GuestSockets::Ready only knew the read end of a pipe, and WaitAny asked the host for POLLIN on every descriptor that is not a socket, so a write interest on a pipe could never be reported or wake a wait. PipeWriteState gives the free space of the host buffer (F_GETPIPE_SZ less FIONREAD on Linux, the write quota on Windows), EOF once the read end is closed, and whether the host takes a write now; Ready reports the write end when it is writable or at EOF, and WaitAny asks for POLLOUT on it. macOS has no call for the capacity of a pipe and throws.
listen on a connected stream socket failed with EISCONN, the Winsock error.
FreeBSD 11.4 solisten_proto_check fails a socket that is connected,
connecting or disconnecting with EINVAL. The guest listen now reports EINVAL
for the host's EISCONN, and the connect-listening test checks it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
send, sendto, sendmsg, recv, recvfrom and recvmsg failed with EOPNOTSUPP for
MSG_DONTWAIT on Windows, where FreeBSD 11.4 sosend_generic and
soreceive_generic make the one call non-blocking and fail with EWOULDBLOCK
when it would wait. Winsock has no per-call flag, so the call now asks WSAPoll
with a zero timeout whether the socket is ready and fails with EAGAIN when it
is not. The Windows branches of the socket tests that expected EOPNOTSUPP now
run the same checks as the other hosts.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
bind, listen, accept, connect, shutdown, getsockname, getsockopt, setsockopt, send, recv and the other calls that look up a guest socket answered EBADF for a descriptor that is open but not a socket, for example a pipe end. FreeBSD 11.4's getsock_cap fails these with ENOTSOCK and keeps EBADF for a closed or invalid descriptor.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
bind, connect and sendto answered EFAULT for an address length below 2 and EAFNOSUPPORT for an AF_INET address below 16 or an AF_INET6 address below 28 bytes. FreeBSD 11.4's getsockaddr fails a length below 2 with EINVAL and above SOCK_MAXADDRLEN (255) with ENAMETOOLONG, and the protocols compare the length with sizeof(struct sockaddr_in) or sockaddr_in6 and fail with EINVAL.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
socketpair accepted SOCK_CLOEXEC but left both descriptors out of the
close-on-exec set, so F_GETFD read 0 on them. FreeBSD 11's
kern_socketpair opens both files with O_CLOEXEC when the type carries
SOCK_CLOEXEC, as socket already does here.
FreeBSD's sys_ioctl rejects a request with no direction bit, an output request with no length, or a void request whose length is not an int before it reads the argument or resolves the descriptor. ioctl threw on such a request for a file, pipe or directory, failed with EBADF for a closed descriptor and with EFAULT for a socket given no argument.
(cherry picked from commit 501518f321ac5d0b45ce1090af39c680927edf49)
(cherry picked from commit 3eb7edd9cf)
kevent threw for EV_CLEAR on a socket or the read end of a pipe; Boost.Asio's kqueue reactor, among others, registers every socket that way. On Linux such a knote now watches its host descriptor through an edge watch. It is armed when added, on every later EV_ADD or EV_ENABLE while enabled, and by each host wakeup; when armed it is checked with the level-triggered readiness test and reported with the current data and EV_EOF, or disarmed if no longer ready, as kqueue_scan re-runs the filter; reporting it disarms it until the next edge. Waits block on the watch's epoll descriptor, so a socket that stays readable does not wake them. Windows and macOS still throw. GuestSockets::NativeDescriptor exposes the host socket behind a guest one for the watch.
Address review: check the msghdr, iovec array, iovec bases and name
are mapped before MessageLength or the receive loop touches them,
pairing the HostWrite guard with committed-range validation. Add
regression tests for forged iovec-array and output pointers.
recvmsg_nid_postfix wrote the msghdr, every iovec base and the sender
address with only null checks, unlike recv_nid_postfix and the
sceNetRecvfrom sender outputs which all gate on GuestArena::HostWrite.
Validate the message, each iovec base and the name buffer the same way
so a forged pointer fails with EFAULT instead of writing received bytes
to an arbitrary host address.
Measured from a payload process on a PS5 (firmware 12.70), where
__inet_ntop/__inet_pton and the plain inet_ntop/inet_pton exports
resolve to the same functions:
- inet_ntop follows an AF_INET6 result with zero bytes up to size (sizes
4 to 65536 sampled) and never writes past size; AF_INET writes only the
text and its NUL.
- An unsupported family returns EAFNOSUPPORT first, even with null
pointers.
- A null source or text raises SIGSEGV during the call, before the size
is checked; here it throws instead of returning EFAULT.
- A null destination is reached only after the size check and the text
parse: ENOSPC for a size that is too small, 0 for text that does not
parse, and SIGSEGV (a throw here) otherwise.
The test pins the measured inet_pton and inet_ntop rows, including all
inputs the existing assertions use. The text-form debt entry is replaced
by one that records what a payload process measured (the text forms, the
order of the checks and the padding) and what is still assumed: the
sizes that were not sampled, sizes above 65536, and a title process.
inet_ntoa_r calls __inet_ntop, so a null inet_ntoa_r buffer with room
for the text now throws, and a null buffer that is too small sets ENOSPC
instead of EFAULT; the libSceLibcInternal debt entry says so.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
macOS does not support getsockopt with SO_ACCEPTCONN; it fails with
ENOPROTOOPT. So on macOS the guest's getsockopt of SO_ACCEPTCONN failed,
connect did not see that a stream socket was listening (an address of
another family failed with EAFNOSUPPORT instead of EOPNOTSUPP), and the
read event of a listening socket reported FIONREAD's 0 instead of the
waiting connection and did not ignore its low watermark.
On macOS the listening state is read from the SO_ACCEPTCONN flag of the
socket options that proc_pidfdinfo reports, and the three places that ask
go through NativeListening. Other hosts keep getsockopt.
A read event on a listening socket took its data from FIONREAD, which a listening socket refuses on Linux, so kevent and sceKernelAddReadEvent reported 0 connections while saying one was ready. FreeBSD 11.4 gives a listening socket filt_solisten, which reports so_qlen, the completed connections waiting for accept. Ready now checks SO_ACCEPTCONN and on Linux reads a TCP listener's accept backlog from TCP_INFO, where tcp_get_info puts it in tcpi_unacked; with no host call for the count (Windows, macOS, a listener that is not TCP) it reports 1, the lower bound the readiness already implies.
A kqueue descriptor is readable while one of its events is triggered and
is never writable or exceptional, as FreeBSD's kqueue_poll answers, on
both hosts. On Windows select threw for it, and on Linux its /dev/null
placeholder was reported readable and writable.
A descriptor that stops being a socket, a kqueue or a pipe during the
wait now fails the call with EBADF when it was closed and is selected
again with the rest of the timeout when its number was reused, as
FreeBSD's kern_select looks every descriptor up again in each pass,
instead of throwing. On Windows a host descriptor that is not a pipe
throws when select starts, before waiting.
Depends on #7139.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
select takes descriptors 0 to 2 as a console title's terminal with no input: 0 is never readable and 1 and 2 are always writable. poll threw for them unless the host happened to attach a pipe, so the same title could select on its standard streams but not poll them. poll now gives the same answer, with POLLOUT, the one bit ttydev_poll reports for a writable terminal, for 1 and 2 and nothing for 0.
selscan asks a descriptor once, with the flags of every set it is in (POLLRDNORM for the read set, POLLWRNORM for the write set, POLLRDBAND for the exception set, plus POLLHUP and POLLERR), and marks each set whose flags the answer shares. A seeded random device's randomdev_poll narrows a request with POLLRDNORM to that bit and returns any other request whole, so in the read set it is readable and in no other set, and otherwise it is in each write and exception set it was asked in; select reported it readable and writable together and never exceptional. A regular file or directory went to the host poll, which on Windows threw; vop_stdpoll makes it readable and writable and never exceptional, which select now answers in process on every host, as poll does.
poll threw for /dev/random and /dev/urandom, which select already treats as ready. FreeBSD 11.4's randomdev_poll, once the device is seeded, narrows a request that has POLLIN or POLLRDNORM to those bits and returns any other request whole, POLLOUT and the band bits included. poll now answers that, and the test that relied on the random device throwing uses a kqueue descriptor, which poll still does not support.
poll threw for any descriptor that is neither a socket nor a pipe, so a title polling a file it also reads stopped there. FreeBSD 11.4 hands a vnode to VOP_POLL, and both vop_stdpoll and vop_nopoll return POLLIN, POLLRDNORM and POLLOUT of the requested events for every event poll accepts and never POLLPRI, POLLRDBAND or POLLWRBAND. A file, a directory or a file read from app0.zar now answers that without a host call. File::IsVnode tells such a descriptor apart from the host file type without throwing, so a host socket lent by libSceNet still reaches its own path.
socket() returned EPROTONOSUPPORT for every socket type it does not create.
FreeBSD 11.4's socreate returns EPROTOTYPE when no protocol is found, the
protocol is 0 and the type is not 0, and EPROTONOSUPPORT when a protocol was
given. Its inet domain (in_proto.c) has SOCK_RAW entries in every kernel and
a SOCK_SEQPACKET entry only with SCTP, and no SOCK_RDM or other type.
Return EPROTOTYPE for a type the inet domain never has, such as SOCK_RDM,
with protocol 0. SOCK_RAW and SOCK_SEQPACKET keep EPROTONOSUPPORT, since
whether the console creates them is not known. Test the unknown types and
mismatched protocols for AF_INET and AF_INET6, and list the socket types and
families that are not created in the library's technical debt file.
Written with AI assistance (Claude).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
select takes descriptors 0 to 2 as a console title's terminal with no input: 0 is never readable and 1 and 2 are always writable. poll threw for them unless the host happened to attach a pipe, so the same title could select on its standard streams but not poll them. poll now gives the same answer, with POLLOUT, the one bit ttydev_poll reports for a writable terminal, for 1 and 2 and nothing for 0.
selscan asks a descriptor once, with the flags of every set it is in (POLLRDNORM for the read set, POLLWRNORM for the write set, POLLRDBAND for the exception set, plus POLLHUP and POLLERR), and marks each set whose flags the answer shares. A seeded random device's randomdev_poll narrows a request with POLLRDNORM to that bit and returns any other request whole, so in the read set it is readable and in no other set, and otherwise it is in each write and exception set it was asked in; select reported it readable and writable together and never exceptional. A regular file or directory went to the host poll, which on Windows threw; vop_stdpoll makes it readable and writable and never exceptional, which select now answers in process on every host, as poll does.
poll threw for /dev/random and /dev/urandom, which select already treats as ready. FreeBSD 11.4's randomdev_poll, once the device is seeded, narrows a request that has POLLIN or POLLRDNORM to those bits and returns any other request whole, POLLOUT and the band bits included. poll now answers that, and the test that relied on the random device throwing uses a kqueue descriptor, which poll still does not support.
Ondra97