Use the current registered range after protection splits and partial unmaps, including FIND_NEXT lookups. Add a regression covering extents, protection and surviving contents.
AI-assisted: yes
Releasing direct memory left the virtual ranges that mapped it registered,
so sceKernelVirtualQuery reported them as flexible memory at offset 0 and
titles walking a range with FIND_NEXT released physical page 0.
Collect every view of the released pages before freeing them and unmap
them through UnmapRegistered, as shadPS4's MemoryManager::Free does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clang's PS4 and PS5 targets set the default new alignment and the suitable
alignment to 32 bytes, so PS5 code may store to a fresh malloc or operator
new result with 32-byte-aligned AVX instructions. The guest heap aligned
blocks to 16 bytes, and the arena's 32-byte classes put every small block
16 bytes past a 32-byte boundary after its header, so such a store faulted.
The minimum alignment is now 32 bytes; the padding still assumes only the
16-byte alignment the raw blocks guarantee.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both return -1/EINVAL: FreeBSD kern_mprotect (sys/vm/vm_mmap.c) maps only
PROTECTION_FAILURE, RESOURCE_SHORTAGE and OUT_OF_BOUNDS to their own errno, so
KERN_INVALID_ADDRESS falls to EINVAL.
Co-Authored-By: Claude <noreply@anthropic.com>
mprotect changes the protection of guest memory through the same path
as sceKernelMprotect and reports failures through errno: EINVAL for a
null or overflowing range or a range the allocation tracker rejects,
ENOMEM when allocation fails. A zero length succeeds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A fixed mapping without no-overwrite unmaps the registered pieces it overlaps before mapping, as it already did when the range lay inside registered allocations.
On Linux, direct memory is a memfd mapped MAP_SHARED. amdgpu accepts only
private anonymous memory for a host pointer import (libdrm sets
AMDGPU_GEM_USERPTR_ANONONLY), so every import of direct memory failed with
VK_ERROR_INVALID_EXTERNAL_HANDLE and its ranges were copied.
When a host pointer import fails, the range's memfd slice is turned into a
dma-buf through /dev/udmabuf and imported with VK_EXT_external_memory_dma_buf.
The direct memory backing is sealed against shrinking and growing, as
udmabuf requires. libkernel reports the backing of a guest range through
GuestArenaSharedBacking. Without /dev/udmabuf, or past its size limit, the
range is copied as before. APS5_TRACE_HOST_IMPORT now prints the mappings
behind a failed import on Linux too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Also unpin the previous context when a fiber object is initialised again
without being finalised.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A title maps direct memory with protection 0x3f2, which adds bits
0x100 and 0x200 to the CPU, GPU and AMPR bits, and the mapping threw.
They are the audio coprocessor (ACP) read and write bits, as named in
the KytyPS5 and etaHEN headers. The coprocessor work runs on the host
CPU, so they map to host read and read/write access like the GPU bits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MAP_FIXED | MAP_NO_OVERWRITE over a range that already holds an
allocation fails with ENOMEM and leaves the mapping in place, as in
fpPS4's TVirtualManager.check_fixed. UFC 6 (PPSA23566) relies on it to
probe for a free address and aborted on the throw.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(libkernel): implement sceKernelReleaseFlexibleMemory
Unmaps the range through sceKernelMunmap, which returns its pages to
the flexible memory budget, as fpPS4 and prosper do.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(libkernel): keep the flexible memory release check apart from the batch map checks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The SDK 9 libc.prx heap maps its arenas with flag 0x8000, which threw as
an unsupported flag. The flag is ignored for this function, as sharpemu
does; other unknown flags still throw.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Release direct memory only when the whole range is allocated: a misaligned
start or length returns EINVAL, a zero length succeeds, and a range that
leaves direct memory or covers an unallocated page returns ENOENT without
releasing anything, as in shadPS4. The check and the release run under
the pool lock.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A range reserved with sceKernelReserveVirtualRange is registered as not
readable, and sceKernelVirtualQuery only searched readable registrations,
so a query inside a reservation fell back to the host and returned EACCES.
Reserved ranges are now tracked until a direct or flexible mapping or an
unmap covers them, and a query inside one succeeds with the reserved piece
as its extent, protection 0 and is_committed clear. PPSA12544's allocator
queries a reservation before committing it and treated the error as a
failed commit, then wrote to the inaccessible range.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On Windows the guest arena ended at 0x72_0000_0000: #231 kept its
448 GiB size after #153 had moved its start down to 0x2_0000_0000.
Titles map fixed addresses up to the application map area end,
0xFC_0000_0000 (SCE_KERNEL_APP_MAP_AREA_END_ADDR on the PS4), and a
direct memory mapping above the old end threw "shared mapping outside
the guest arena".
The arena is now reserved up to 0xFC_0000_0000. The out-of-arena
errors name the address and length, and a fixed mapping over a used
arena range says whether it hit a host region. guest_memory maps
direct memory at the last two pages below the end, reads it through
an alias and checks that a mapping at the end is refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ForgetDirectMemory erased the physical pages but left g_directMappings entries pointing at the dead backing, so sceKernelVirtualQuery kept reporting is_direct with a stale physical offset. Erase (and split, on the phys axis) the affected mapping tracking on release; mapped views are untouched, so no new faults are introduced.
Lock the guest pages of the range with VirtualLock or mlock, following FreeBSD mlock(2): the range is widened to guest pages, a zero length succeeds, a wrapping range is EINVAL and a range that is not mapped and accessible is ENOMEM. The Windows working set limits and the Linux RLIMIT_MEMLOCK soft limit are raised when the lock needs it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
libkernel did not export sceKernelMapNamedFlexibleMemoryInternal, which
the libc bundled with SDK 9 titles imports. It now forwards to
sceKernelMapNamedFlexibleMemory: the mapping counts against the flexible
budget, gets the range name and is released by sceKernelMunmap. Older
libc builds call the public function at the same sites with the same
arguments and result handling.
The known callers pass flag 0x8000, whose meaning is unknown. It is
still rejected as an unsupported mapping flag and is recorded in
TechnicalDebt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A file read into guest memory is a host write: before the I/O it pins the shared pages it
covers, which reopens any page armed for write tracking and keeps write tracking from arming
it again until the read ends, when the pages count as written. A destination the guest cannot
write fails with EFAULT before any I/O; read and pread throw as for any failed read, AIO
reports SCE_KERNEL_ERROR_EFAULT, and APR throws. APR also throws when a read ends before the
requested size.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Dean
Hannah Lyons
Saranxzi
MarcZX100
Praveen Kumar
Andreas
Scott Schuster
Adrià Franch
kjhq
Adrià
Gjon Gojcevic
alfalfa-star
SP4C3B4R-8
Pouare514
JAB-dev
Chad
Merijn
Celegans12
Pouare514
DotDebian
boykopovar
Michon