Follow FreeBSD 11.4 sys_kenv: KENV_GET, KENV_SET, KENV_UNSET and KENV_DUMP over
an in-memory kernel environment of at most 512 variables, with the 128-byte
name and value limits, ENOENT, EINVAL, ENAMETOOLONG and EFAULT.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Follow FreeBSD 11.4's sys_kldsym: EFAULT for an unreadable lookup
structure, EINVAL for a wrong version or command, EFAULT or
ENAMETOOLONG for the symbol name, ENOENT for a negative file id. Any
other lookup throws, as no kernel module is modelled. Adds
GuestCopyIn_nid_no_patch for the checked structure read.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
sigreturn applies FreeBSD 11's amd64 sys_sigreturn checks:
- EFAULT for a null context;
- EINVAL for unknown mc_flags, and for rflags bits outside
PSL_USERCHANGE that differ from the current flags;
- set_fpcontext's FPU format and ownership cases.
It then restores the context through the path setcontext uses, which
now lives in RestoreContext. A non-user %cs and an extended FPU state
still throw.
FreeBSD 11's sys_sched_setscheduler checks: a null parameter is EFAULT,
another process is ESRCH and an unknown policy is EINVAL. Pid 0 sets the
calling thread through scePthreadSetschedparam. Values that call
rejects, and the guest's own pid, whose first thread is not tracked,
still throw.
ProsperoEden declares the setter with the mode as its argument and the
getter with an int output, and measured on a PS5 that modes 0 and 1 are
accepted, 2 to 7 return 0x80020016 and 1 is the default. Both threw as
discovered stubs. Other modes and a null output throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Generate version 1 UUIDs as FreeBSD 11's kern_uuidgen does: consecutive
timestamps from the guest CLOCK_REALTIME, a 14-bit clock sequence that is
randomised on first use and incremented when the clock has not passed the
last batch, and a random multicast node. A count outside 1 to 2048 fails
with EINVAL and a null store with EFAULT.
Implement pthread_attr_setcreatesuspend_np, pthread_resume_np,
pthread_resume_all_np and pthread_multi_np with the sce forms
scePthreadAttrSetcreatesuspend, scePthreadResume, scePthreadResumeAll
and scePthreadMulti, following FreeBSD 11.4 libthr and the firmware
13.42 libkernel_sys module. A thread created suspended waits before its
start routine, outside any cancellation point, until it is resumed.
sceKernelRaiseException throws on Windows for a thread still suspended
at creation.
The map, map direct and mtype-protect writers take type as a 64-bit
value and store it in the record's 32-bit field. That matches
sceKernelWriteModifyMtypeProtectCommand and the libSceAmpr siblings,
whose type is 32 bits, but nothing checked it. A type with bit 32 set
now has to record the same bytes as the sibling given the low 32 bits,
and the debt entry says the console's handling of such a type is not
measured.
sceKernelWaitCommandBufferCompletion waits for an AMM submission as
libSceAmpr's sceAmprAmmWaitCommandBufferCompletion does: 0 once the
submission has run, SCE_KERNEL_ERROR_ESRCH for an id that was never
submitted. The signature follows ampr_emu's libkernel hook targets,
where the libSceAmpr wait forwards to it.
guest_kernel_sys submits a map written by sceKernelWriteMapCommand,
waits for it and uses the mapped page, and checks ids 0 and past the
last submission.
The twelve AMM kernel writers record into a caller buffer the command
their libSceAmpr command buffer sibling appends, built with the shared
encoder: sceKernelWriteMapCommand, sceKernelWriteMapWithGpuMaskIdCommand,
sceKernelWriteMapDirectCommand, sceKernelWriteMapDirectWithGpuMaskIdCommand,
sceKernelWriteUnmapCommand, sceKernelWriteRemapCommand,
sceKernelWriteRemapWithGpuMaskIdCommand, sceKernelWriteMultiMapCommand,
sceKernelWriteMultiMapWithGpuMaskIdCommand,
sceKernelWriteModifyProtectCommand,
sceKernelWriteModifyProtectWithGpuMaskIdCommand and
sceKernelWriteModifyMtypeProtectWithGpuMaskIdCommand.
The signatures follow ampr_emu's libkernel hook targets: the sibling's
arguments as 64-bit values between the destination and the size output.
A null destination only reports the size and a null size output only
writes, as for sceKernelWriteModifyMtypeProtectCommand. Invalid ranges,
offsets and protections return the sibling's SCE_KERNEL_ERROR_EINVAL and
write nothing; protection or mask bits above 32 are rejected too.
guest_kernel_sys compares each writer with its sibling on valid and
invalid arguments, in both modes.
Measured in a payload process on a PS5 (firmware 13.60) through libkernel_sys.sprx's pathconf: /system_data gives 65536 for the allocation, transfer and hole sizes, 16384 for the transfer alignment, 3 for _PC_ACL_PATH_MAX and 0 for the ACL and MAC flags, and EINVAL for _PC_MAX_CANON, _PC_MAX_INPUT, _PC_VDISABLE and _PC_ASYNC_IO, which used to throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
kern_fpathconf answers _PC_ASYNC_IO with _POSIX_ASYNCHRONOUS_IO (200112) after the descriptor lookup, and a pipe or socket (no vnode) with PIPE_BUF for _PC_PIPE_BUF and EINVAL for every other name. Drop the unused File.hpp include and the duplicate KernelErrors.hpp include.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Dean