On Linux the host keeps data that was buffered before shutdown(SHUT_RD) and
guest_socket_pair expects to read it, so the shortcut that answers 0 for any
receive after SHUT_RD broke that test there. Limit the shortcut to Windows,
where the host cannot answer it, and run the post-shutdown receives of
guest_tcp on Windows only.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
soreceive_generic returns 0 for a socket whose receive side is shut and for a
zero-length receive on a connected stream socket (ENOTCONN when it is not
connected), without waiting. Winsock fails the first with WSAESHUTDOWN, which
reached the guest as EPIPE, and blocks the second until data arrives. recv and
recvfrom now answer both themselves.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
soreceive_generic keeps a MSG_WAITALL receive on a stream socket waiting until
the buffer is full, the peer closes or an error occurs. The three calls failed
every flag but MSG_PEEK and MSG_DONTWAIT with EOPNOTSUPP. A stream socket now
passes the flag to the host receive; a datagram socket ignores it, as a record
is delivered whole.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
bind, connect and sendto looked the descriptor up before they looked at the
address length, so a descriptor that is not open hid an argument error.
FreeBSD 11.4 sys_bind, sys_connect and sendit run getsockaddr first
(ENAMETOOLONG, EINVAL, EFAULT) and only then look the descriptor up, so
these arguments are now answered first and EBADF only follows for a valid
address.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
GuestSockets::Ready only knew the read end of a pipe, and WaitAny asked the host for POLLIN on every descriptor that is not a socket, so a write interest on a pipe could never be reported or wake a wait. PipeWriteState gives the free space of the host buffer (F_GETPIPE_SZ less FIONREAD on Linux, the write quota on Windows), EOF once the read end is closed, and whether the host takes a write now; Ready reports the write end when it is writable or at EOF, and WaitAny asks for POLLOUT on it. macOS has no call for the capacity of a pipe and throws.
listen on a connected stream socket failed with EISCONN, the Winsock error.
FreeBSD 11.4 solisten_proto_check fails a socket that is connected,
connecting or disconnecting with EINVAL. The guest listen now reports EINVAL
for the host's EISCONN, and the connect-listening test checks it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
send, sendto, sendmsg, recv, recvfrom and recvmsg failed with EOPNOTSUPP for
MSG_DONTWAIT on Windows, where FreeBSD 11.4 sosend_generic and
soreceive_generic make the one call non-blocking and fail with EWOULDBLOCK
when it would wait. Winsock has no per-call flag, so the call now asks WSAPoll
with a zero timeout whether the socket is ready and fails with EAGAIN when it
is not. The Windows branches of the socket tests that expected EOPNOTSUPP now
run the same checks as the other hosts.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
bind, listen, accept, connect, shutdown, getsockname, getsockopt, setsockopt, send, recv and the other calls that look up a guest socket answered EBADF for a descriptor that is open but not a socket, for example a pipe end. FreeBSD 11.4's getsock_cap fails these with ENOTSOCK and keeps EBADF for a closed or invalid descriptor.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
bind, connect and sendto answered EFAULT for an address length below 2 and EAFNOSUPPORT for an AF_INET address below 16 or an AF_INET6 address below 28 bytes. FreeBSD 11.4's getsockaddr fails a length below 2 with EINVAL and above SOCK_MAXADDRLEN (255) with ENAMETOOLONG, and the protocols compare the length with sizeof(struct sockaddr_in) or sockaddr_in6 and fail with EINVAL.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
socketpair accepted SOCK_CLOEXEC but left both descriptors out of the
close-on-exec set, so F_GETFD read 0 on them. FreeBSD 11's
kern_socketpair opens both files with O_CLOEXEC when the type carries
SOCK_CLOEXEC, as socket already does here.
The guest socket layer relies on a few Linux calls:
- The equeue wait uses poll with the timeout rounded up to a millisecond;
macOS has no ppoll.
- A readable stream socket whose peer closed is reported with POLLHUP by
peeking one byte; macOS has no POLLRDHUP.
- FIONREAD on a datagram socket, and the byte count that fstat and kevent
report for it, is SO_NREAD, the size of the next datagram; macOS adds the
source address to FIONREAD.
- socketpair throws for SOCK_SEQPACKET, which has no AF_UNIX pair on macOS.
- gethostbyname replaces gethostbyname_r, which macOS lacks.
The UDP test sends on its connected socket without an address, as #7475
does, because macOS, like FreeBSD, fails sendto with an address on a
connected socket with EISCONN. The log test uses a datagram pair with
enlarged buffers instead of SOCK_SEQPACKET.
FreeBSD's sys_ioctl rejects a request with no direction bit, an output request with no length, or a void request whose length is not an int before it reads the argument or resolves the descriptor. ioctl threw on such a request for a file, pipe or directory, failed with EBADF for a closed descriptor and with EFAULT for a socket given no argument.
(cherry picked from commit 501518f321ac5d0b45ce1090af39c680927edf49)
(cherry picked from commit 3eb7edd9cf)
kevent threw for EV_CLEAR on a socket or the read end of a pipe; Boost.Asio's kqueue reactor, among others, registers every socket that way. On Linux such a knote now watches its host descriptor through an edge watch. It is armed when added, on every later EV_ADD or EV_ENABLE while enabled, and by each host wakeup; when armed it is checked with the level-triggered readiness test and reported with the current data and EV_EOF, or disarmed if no longer ready, as kqueue_scan re-runs the filter; reporting it disarms it until the next edge. Waits block on the watch's epoll descriptor, so a socket that stays readable does not wake them. Windows and macOS still throw. GuestSockets::NativeDescriptor exposes the host socket behind a guest one for the watch.
Address review: check the msghdr, iovec array, iovec bases and name
are mapped before MessageLength or the receive loop touches them,
pairing the HostWrite guard with committed-range validation. Add
regression tests for forged iovec-array and output pointers.
recvmsg_nid_postfix wrote the msghdr, every iovec base and the sender
address with only null checks, unlike recv_nid_postfix and the
sceNetRecvfrom sender outputs which all gate on GuestArena::HostWrite.
Validate the message, each iovec base and the name buffer the same way
so a forged pointer fails with EFAULT instead of writing received bytes
to an arbitrary host address.
Measured from a payload process on a PS5 (firmware 12.70), where
__inet_ntop/__inet_pton and the plain inet_ntop/inet_pton exports
resolve to the same functions:
- inet_ntop follows an AF_INET6 result with zero bytes up to size (sizes
4 to 65536 sampled) and never writes past size; AF_INET writes only the
text and its NUL.
- An unsupported family returns EAFNOSUPPORT first, even with null
pointers.
- A null source or text raises SIGSEGV during the call, before the size
is checked; here it throws instead of returning EFAULT.
- A null destination is reached only after the size check and the text
parse: ENOSPC for a size that is too small, 0 for text that does not
parse, and SIGSEGV (a throw here) otherwise.
The test pins the measured inet_pton and inet_ntop rows, including all
inputs the existing assertions use. The text-form debt entry is replaced
by one that records what a payload process measured (the text forms, the
order of the checks and the padding) and what is still assumed: the
sizes that were not sampled, sizes above 65536, and a title process.
inet_ntoa_r calls __inet_ntop, so a null inet_ntoa_r buffer with room
for the text now throws, and a null buffer that is too small sets ENOSPC
instead of EFAULT; the libSceLibcInternal debt entry says so.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
macOS does not support getsockopt with SO_ACCEPTCONN; it fails with
ENOPROTOOPT. So on macOS the guest's getsockopt of SO_ACCEPTCONN failed,
connect did not see that a stream socket was listening (an address of
another family failed with EAFNOSUPPORT instead of EOPNOTSUPP), and the
read event of a listening socket reported FIONREAD's 0 instead of the
waiting connection and did not ignore its low watermark.
On macOS the listening state is read from the SO_ACCEPTCONN flag of the
socket options that proc_pidfdinfo reports, and the three places that ask
go through NativeListening. Other hosts keep getsockopt.
A read event on a listening socket took its data from FIONREAD, which a listening socket refuses on Linux, so kevent and sceKernelAddReadEvent reported 0 connections while saying one was ready. FreeBSD 11.4 gives a listening socket filt_solisten, which reports so_qlen, the completed connections waiting for accept. Ready now checks SO_ACCEPTCONN and on Linux reads a TCP listener's accept backlog from TCP_INFO, where tcp_get_info puts it in tcpi_unacked; with no host call for the count (Windows, macOS, a listener that is not TCP) it reports 1, the lower bound the readiness already implies.
A kqueue descriptor is readable while one of its events is triggered and
is never writable or exceptional, as FreeBSD's kqueue_poll answers, on
both hosts. On Windows select threw for it, and on Linux its /dev/null
placeholder was reported readable and writable.
A descriptor that stops being a socket, a kqueue or a pipe during the
wait now fails the call with EBADF when it was closed and is selected
again with the rest of the timeout when its number was reused, as
FreeBSD's kern_select looks every descriptor up again in each pass,
instead of throwing. On Windows a host descriptor that is not a pipe
throws when select starts, before waiting.
Depends on #7139.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
select takes descriptors 0 to 2 as a console title's terminal with no input: 0 is never readable and 1 and 2 are always writable. poll threw for them unless the host happened to attach a pipe, so the same title could select on its standard streams but not poll them. poll now gives the same answer, with POLLOUT, the one bit ttydev_poll reports for a writable terminal, for 1 and 2 and nothing for 0.
Adrià