Repository navigation
fix(libkernel): report the read bit of every write bit in a mapping's protection - #6825
Open
hugodearaujo wants to merge 1 commit into
Open
hugodearaujo wants to merge 1 commit into
hugodearaujo wants to merge 1 commit into
Conversation
… protection A PS5 (firmware 13.60) reports CPU write 0x2 with CPU read 0x1, 0x80 with 0x40 and 0x200 with 0x100 after a map, sceKernelMprotect, sceKernelMtypeprotect or POSIX mprotect; GPU write 0x20 keeps GPU read 0x10 clear. sceKernelVirtualQuery and sceKernelQueryMemoryProtection now report the protection that way.
|
Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.
|
11 tasks done
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
On a PS5 a write bit in a mapping's protection is always reported with its read bit. After a map or a protection change,
sceKernelVirtualQueryandsceKernelQueryMemoryProtectionshow CPU write0x2together with CPU read0x1,0x80with0x40and0x200with0x100. GPU write0x20is the exception: it does not bring GPU read0x10. Here the requested protection was reported as it was passed, so a write-only request read back without its read bit.RecordProtectionnow adds those read bits to the protection it records, which is what both queries report. The host protection does not change: it already lets a written page be read.Titles
APS5_TRACE_MEMORY=1and a local trace of the query: 44 of its 53 direct maps use0xc2(CPU write and0x40/0x80, no CPU read), and it callssceKernelVirtualQuery4,074 times, 3,305 of them answered with0xc2and 533 with0xf2here. The console reports those ranges as0xc3and0xf3.APS5_TRACE_MEMORY=1: six direct maps with0xf2, protection changes to0xf2(two) and0x12(one), and a flexible map with0x2, which the console reports as0xf3,0x13and0x3. It did not call the queries in two runs of about 170 and 200 s.0xf2and then protects it with0xfffffff2(TechnicalDebt, sceKernelMprotect protection bits). The console reports0xf3and then0x3f3; this emulator reported0xf2and0x3f2.Measured
PS5, firmware 13.60, from a homebrew payload process that calls the system's own
libkernelthroughdlopen/dlsym. The protection passed, and whatsceKernelQueryMemoryProtectionreported afterwards (sceKernelVirtualQueryagreed in every case):sceKernelMapFlexibleMemorysceKernelMapDirectMemorysceKernelMprotect, flexible and direct0x10x10x10x10x20x30x30x30x120x130x130x130x200x200x200x200x220x230x230x230x300x300x300x300x400x400x400x400x800xc00xc00xc00x820xc30xc30xc30x1000x1000x1000x1000x2000x3000x3000x3000x2200x3200x3200x3200x2a20x3e30x3e30x3e30xf20xf30xf30xf30x3f20x3f30x3f30x3f30xfffffff2EINVALEINVAL0x3f3sceKernelMtypeprotecton direct memory gave0x3for0x2,0x33for0x32and0xf3for0xf2, and POSIXmmapandmprotectwithPROT_WRITEgave0x3.What the console does there that this PR does not model is now in TechnicalDebt: it dropped the CPU execute bit
0x4from flexible, direct and JIT memory of the payload process (a title process may keep it); POSIXmprotectwith write and execute reported0x2, without the read bit; and the map calls andsceKernelMtypeprotectrefused bits outside0x3F7withEINVAL, where this emulator throws.Probe output (PS5 firmware 13.60, payload process)
Tested
guest_protection_report: maps flexible memory write-only, then changes its protection withsceKernelMprotectthrough 19 of the values above, with POSIXmprotectandPROT_WRITE, and maps direct memory with0xf2and protects it with0xfffffff2, checking both queries each time. WithRecordProtectionas onmain, it fails at its first check (a write-only flexible mapping: reported 0x2 (virtual query) and 0x2 (protection query), expected 0x3).-j8onmain(82ddae75b) and on this branch. 1286 of 1288 pass here.agc_driver_tessellationfails as onmain, andagc_driver_preparation_scope_settlefailed in the-j8run, which shared the machine with a Windows VM build; it passes 5 of 5 alone on this branch and onmain, and perf(agc): take the host import budget from the device's memory budget #6479 lists it as a parallel-load flake.BUILD_TESTING=ON, GPU tests skipped:main(82ddae75b) does not buildGpuIndirectArgumentsMisalignedWriterAhead.cppwith MinGW (alignas(65536)is above the object file's maximum of 8192; agc tests:GpuIndirectArgumentsMisalignedWriterAhead.cppdoes not compile with MinGW GCC (alignas(65536)) #6716, test(agc): align the indirect arguments block at run time #6452), somainand this branch were built withninja -k 0and that test does not run.guest_protection_report,guest_mprotect_unmappedandguest_memorypass. 1320 of 1322 pass; the other failure isguest_kqueue(0xc0000409), as onmain, whereguest_shader_linkandagc_shader_helpersalso timed out.tools/check_conventions.pypasses.tools/pr_overlap.pylists feat(libkernel): map regular files with mmap on Windows #6542, which edits the TechnicalDebt line after the one this PR rewrites, and nothing else.Checklist
main; no other open PR implements the same functionsNotImplemented_nid_no_patch); silent stubs are listed in TechnicalDebt.mdfiles or images added to the repository (attach them to this PR)🤖 Generated with Claude Code