Guest environment: make environ and libc read the same variables

[lgqdaxia]

Current status (2 November 2026): The refreshed implementation is now submitted as PR #15095, ready for review, at a535212ecd5b4b5faeec919885b676740decf95c.

The PR uses the same exported environ table for libc reads and writes and preserves main's later #12054 string-lifetime behavior. On the pinned main 92d2fdc343, the Shared and Binding regressions fail naturally; with the fix, Windows passes 9 focused CTests, all 65 public-header checks, and the real project test-registration audit. Linux passes 4 actual-source component tests without skips. The PR gives the exact build settings, controls, overlap review and remaining limits. These Linux results cover isolated components, not a full Linux product or complete production-libkernel unload. No PS5/game unblock or performance result is claimed.

The earlier candidate and its branch remain available. The proposal and results below describe that older da9c8be3ad revision; the new PR is the current review location.

---

Earlier proposal and validation (25 October 2026)

Linux validation update: four original fixtures pass against the unchanged candidate in isolated actual-source builds, including cross-library sharing and component unload/reload. Results, negative controls and build boundaries. The complete Linux product remains untested.

I have a fix for the existing environ debt entry, and would welcome feedback on the approach and remaining test gaps.

The code is on my fork branch, with a comparison against main. Tested revision: da9c8be3ad406b71e745a2674c25cf868ee556ad, based on main 2f506cacac52cc58887236582b96338c5ad51f62. This was the original candidate shared for feedback before a formal PR slot was available.

The failure is simple: setenv("ENV_CHECK", "value", 1) succeeds and getenv("ENV_CHECK") returns "value", but the exported environ list still contains no variables. Replacing the whole environ pointer also does not affect libc's lookup. A new cross-library regression reproduces the split.

The fix makes libc use the actual exported environ pointer while keeping that data object in libkernel. It preserves putenv's borrowed strings and owned string aliases, observes whole-table replacement, and keeps the environment usable when libkernel is unloaded and reloaded. Allocation failures leave the old table and values intact. Removing a missing name succeeds without allocating.

On Windows with WinLibs GCC 15.2, Release, the full system libraries and relinker build successfully, and 11 focused CTests pass (21.85 seconds on the revision above). Coverage includes shared-list updates, replacement/alias lifetimes, real libkernel unload/reload, and allocation failure injection against the production Environment.cpp. The new regressions fail before their fixes. Conventions pass. During the initial validation on main ae7d59258e, an additional existing wide-time formatting test failed at the same assertion with both the original and changed environment implementation on this Chinese Windows installation; it is not counted among the 11 passing tests.

The guest still starts with an empty environment; host HOME/PATH stay isolated, and cross-process inheritance is unchanged. The coherence rules use the FreeBSD/POSIX references recorded in the debt entry. Linux source-component validation is now recorded in this follow-up. Full Linux product, macOS, console and game testing remain unverified, and no title is claimed unblocked.

Is this a suitable way to close the recorded gap? In particular, are there console measurements or Linux/macOS checks that should be added before a PR?

AI-assisted: yes

[lgqdaxia]

I added focused Linux validation for the existing candidate da9c8be3ad. The candidate and its committed test sources are unchanged.

Environment: Ubuntu 24.04 under WSL2, GCC 13.3, CMake 3.28, C++20 Release. Four unchanged repository fixtures pass across two isolated source-component builds:

• GuestEnvironment.cpp: environment API behavior and host isolation.
• GuestEnvironmentAllocation.cpp: the original allocation-failure injection, including the zero-allocation removal of a missing name and rollback of failed mutations.
• GuestEnvironmentShared.cpp: immediate cross-library publication, whole-table/null/offset replacement, borrowed and owned aliases, growth, value stability and host isolation.
• GuestEnvironmentBinding.cpp: adopt values created before loading the kernel component, replace the exported table, unload, mutate the fallback, reload/rebind, unload again and clean up. The component really unloads; this run does not return the fixture's skip code 77.

The cross-library build compiles the complete production Environment.cpp and libkernel/System/src/Process.cpp into separate shared libraries. It uses the actual exported environ_nid_postfix object and the production EnvironmentBinding constructor/destructor. It has no artificial environment slot, manual binding call or replacement of environment behavior. The basic fixture has only a host-errno adapter identical to the production helper; Allocation and the cross-library components need no such adapter.

ELF checks cover two different data-reference paths: the Shared executable has an R_X86_64_COPY relocation for environ_nid_postfix, while Binding links only the environment component and loads the kernel component with dlopen/dlsym. Loader traces confirm two real kernel-component load/unload cycles on the successful lifecycle run.

Negative controls use the same fixtures:

• The original recorded base 2f506cacac still passes the basic API fixture, as expected. Its actual Environment/Process sources fail Shared at setenv did not publish its variable through environ, and Binding at loading libkernel replaced the libc-only environment.
• The pre-OOM-correction source 8714734014 fails Allocation at the missing-name unsetenv zero-budget assertion; the published candidate passes.
• Removing only the production kernel binding destructor's detach call makes the same Binding fixture fail with SIGSEGV after its first real unload. The unchanged candidate completes both unload/reload cycles. This is an intentional failing component control, not a new candidate defect or a timeout result.

Coverage boundary: these are actual-source component tests, not a full Linux product build or complete production libkernel unload test. Function/data sections, linker garbage collection and narrow export maps remove unrelated Process exports; that can change module residency compared with the full libraries. I did not use -fno-gnu-unique or force unloading. GCC documents that GNU-unique symbols can keep affected DSOs loaded after dlclose. The fixture keeps its return-77 skip behavior if the loader retains a module.

The earlier full Windows results remain unchanged. Full Linux product integration/unload, macOS, console and game runs remain unverified; no title unblock is claimed. The build definitions below make the component boundary explicit.

AI-assisted: Codex

Exact cross-library component build definitions

These definitions were used for the two cross-library checks. Set ANYPS5_SOURCE_DIR to a checkout of the pinned candidate. The old-source controls override ENVIRONMENT_SOURCE and PROCESS_SOURCE; the fixture sources, export maps and other flags stay the same. This link intentionally exports only the tested environment interface and data object.

CMakeLists.txt:

cmake_minimum_required(VERSION 3.20)
project(AnyPS5EnvironmentDsoComponents LANGUAGES CXX)

set(ANYPS5_SOURCE_DIR "" CACHE PATH "Actual AnyPS5 source checkout")
set(ENVIRONMENT_SOURCE "${ANYPS5_SOURCE_DIR}/core/libs/prx/libc/src/Environment.cpp" CACHE FILEPATH "Actual environment source")
set(PROCESS_SOURCE "${ANYPS5_SOURCE_DIR}/core/libs/prx/libkernel/System/src/Process.cpp" CACHE FILEPATH "Actual process source")
set(CMAKE_CXX_STANDARD 20)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
find_package(Threads REQUIRED)
enable_testing()

add_library(environment_component SHARED "${ENVIRONMENT_SOURCE}")
target_include_directories(environment_component PUBLIC "${ANYPS5_SOURCE_DIR}/core/libs")
target_compile_definitions(environment_component PRIVATE _GNU_SOURCE)
target_compile_options(environment_component PRIVATE -ffunction-sections -fdata-sections)
target_link_libraries(environment_component PRIVATE Threads::Threads)
target_link_options(environment_component PRIVATE -Wl,--gc-sections -Wl,--no-undefined "-Wl,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/environment.exports")

add_library(kernel_process_component SHARED "${PROCESS_SOURCE}")
target_include_directories(kernel_process_component PUBLIC "${ANYPS5_SOURCE_DIR}/core/libs")
target_compile_definitions(kernel_process_component PRIVATE _GNU_SOURCE)
target_compile_options(kernel_process_component PRIVATE -ffunction-sections -fdata-sections)
target_link_libraries(kernel_process_component PRIVATE environment_component Threads::Threads)
target_link_options(kernel_process_component PRIVATE -Wl,--gc-sections -Wl,--no-undefined "-Wl,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/kernel.exports")

add_executable(guest_environment_shared_component_tests "${ANYPS5_SOURCE_DIR}/core/libs/tests/GuestEnvironmentShared.cpp")
target_link_libraries(guest_environment_shared_component_tests PRIVATE kernel_process_component environment_component)
add_test(NAME guest_environment_shared_component COMMAND guest_environment_shared_component_tests)
set_tests_properties(guest_environment_shared_component PROPERTIES TIMEOUT 20)

add_executable(guest_environment_binding_component_tests "${ANYPS5_SOURCE_DIR}/core/libs/tests/GuestEnvironmentBinding.cpp")
target_include_directories(guest_environment_binding_component_tests PRIVATE "${ANYPS5_SOURCE_DIR}/core/libs")
target_compile_definitions(guest_environment_binding_component_tests PRIVATE "GUEST_ENVIRONMENT_KERNEL_PATH=u8\"$<TARGET_FILE:kernel_process_component>\"")
target_link_libraries(guest_environment_binding_component_tests PRIVATE environment_component ${CMAKE_DL_LIBS})
add_dependencies(guest_environment_binding_component_tests kernel_process_component)
add_test(NAME guest_environment_binding_component COMMAND guest_environment_binding_component_tests)
set_tests_properties(guest_environment_binding_component PROPERTIES TIMEOUT 20 SKIP_RETURN_CODE 77)

kernel.exports:

{
    global:
        environ_nid_postfix;
    local: *;
};

environment.exports:

{
    global:
        getenv_nid_postfix;
        setenv_nid_postfix;
        unsetenv_nid_postfix;
        putenv_nid_postfix;
        CopyGuestEnvironment_nid_no_patch;
        BindGuestEnvironment_nid_no_patch;
    local: *;
};