fix(libkernel): map Windows shared memory with the regular file checks - #12296

What

On Windows, mmap sent a shared memory descriptor straight to the shared file mapper (DoMapFileBacked). It skipped the access checks and the private path that a regular file descriptor takes. Shared memory objects are files there: anonymous objects are delete-on-close temporary files, and named objects are files under AnyPS5/shm. Skipping those steps produced two errors:

• MAP_PRIVATE of a named or anonymous object failed with EOPNOTSUPP (45), because DoMapFileBacked refuses private mappings on Windows. FreeBSD maps them, and a private mapping of a regular file on Windows already works as a copy of the file read at mmap (MapPrivateFileCopy).
• A writable MAP_SHARED mapping of a read-only descriptor failed with EIO (5): the section was created read-only and the writable view then failed. FreeBSD and the regular-file path return EACCES.

Shared memory descriptors now take the same handle lookup, access checks and private copy as a regular file. Only the refusal of directories, the random device and non-disk handles stays limited to other descriptors. Shared mappings still go through the same section code as before.

A new Windows test, guest_named_shm_windows_mapping (GuestNamedShmWindowsMapping.cpp), maps a named object:

• shared, through two descriptors;
• against pread and pwrite;
• at an offset;
• private, with its stores staying out of the object;
• read-only, plus a refused writable shared mapping of a read-only descriptor;
• after shm_unlink.

Until now no Windows test mapped a named object; the named-object mapping tests are Linux-only. The libkernel debt entry that said so is updated, and is now shorter than on main.

Tested

Windows 11 Enterprise 10.0.22621, Ryzen 9 5950X, WinLibs GCC 15.2.0 UCRT r7, Ninja, Release, BUILD_TESTING=ON, Vulkan drivers hidden. Base main 660a0b306d.

• Without the fix (the new test on main's PosixMemory.cpp): it aborts at "a private mapping of the named object failed (guest errno 45)". With the private case moved last, it aborts at "a writable shared mapping of a read-only descriptor was not refused with EACCES (guest errno 5)". The shared, offset and pread/pwrite checks already pass on main.
• With the fix: these 17 tests pass in each of 3 runs. They are every Windows test whose source calls mmap, plus the named shared-memory Windows tests: guest_named_shm_windows_mapping, guest_named_shm_windows (with its short_temp and long_short_temp variants), guest_shm_open, guest_jit_shared_memory, guest_memory, guest_mmap_fixed_anonymous, guest_low_address_memory, guest_mprotect_unmapped, guest_msync, guest_kernel_stack_protect, guest_posix_filesystem, guest_system_configuration and the guest_kernel_app_archive* tests.

Not tested on Linux or macOS. The change is inside the _WIN32 branch only.

Overlap. tools/pr_overlap.py reports two textual conflicts with no shared behaviour:

• feat(libkernel): map app0.zar archive-backed files #11625 renames the line above this change (mappingDescriptor = sourceDescriptor); merged, the line takes that name and keeps this block.
• feat(libkernel): add pipe write events and socket low watermarks to sceKernelAdd*Event #10645 edits the two debt entries right after the one changed here.

Proposed merge order: this PR first, then #11625 and #10645 take the small textual merge; asked on #11625 and #10645. If either author prefers to go first, this PR will declare Depends on that PR and be rebased after it lands. #12339's author agreed that this PR lands before #12339, whose copy of the same check then becomes unreachable.

Current Linux qualification — 2026-10-29

Rebased onto main 5454cd2e455 as dc1d801c4ce47fe1083ac473619f60400ad560f6. Production, regression and CMake topic additions/removals are preserved exactly. The debt resolution keeps main’s #12339 read/execute permission details alongside this PR’s regular-file mapping statement; all recursive submodule pointers match main.

Linux: libc/libkernel build, and five memory/shared-memory groups pass three repetitions (15 passes, zero skips). The actual Windows production translation unit also passes MinGW GCC16.2.0 cross syntax checking on Linux. That is not Windows execution: the existing Windows pause remains in force, so earlier actual Windows tests retain their historical source pins. Conventions and whitespace pass.

The #11625/#10645 author-order questions remain unanswered, so no agreement is claimed. #12339 has now merged; its production check and debt details are preserved in this refresh. AI-assisted: yes.

Evidence: immutable Linux qualification bundle. Its SHA-256 is ca6b35926bcc6d3f21a9650517894c86b65594e2e2b653c5c32cd1c1de89c835. No fresh Windows runtime execution is claimed; older measurements retain their recorded source pins.

AI-assisted: yes (Codex).

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none (proposed order above; awaiting feat(libkernel): map app0.zar archive-backed files #11625's and feat(libkernel): add pipe write events and socket low watermarks to sceKernelAdd*Event #10645's authors)
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes (Claude Code)

🤖 Generated with Claude Code