On macOS a fiber's context buffer is its guest stack, and the buffer sits in the write-watched guest heap. Every collect re-armed its pages, so a push in a function prologue could fault on the page below the stack pointer. Rosetta cannot resume a synchronous exception that arrives after earlier instructions of the same translated block have run, and aborts with "unexpectedly need to EmulateForward on a synchronous exception".
PinStack and UnpinStack now bracket the context with a host write on macOS, as the Windows build does with the arena's writable pin, so the pages stay writable for the life of the fiber. The same hooks cover contexts attached on run or switch.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Fibers may be initialized without a context and get one from
_sceFiberAttachContextAndRun or _sceFiberAttachContextAndSwitch.
_sceFiberInitializeWithInternalOptionImpl accepts the ulobjmgr,
context size check and FPU default flags.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The overlap audit against origin/main and the open pull requests found 39 of
the 193 declared exports that must not be declared here:
- 14 that origin/main already exports. The nid_patcher computes the NID of a
symbol from its name, and a name ending in _nid_postfix exports the NID of
the base name, so scePadOpen, sceNetInit and the rest are already there.
- 23 that an open pull request provides: #6832, #6847, #6852, #7846, #7881,
#7889, #7890, #6977 and #7690.
- 2 whose technical-debt file an open pull request creates: #7463 and #8094.
The scope is now 30 libraries and 154 exports.
AnyPS5 resolves a title's imports by NID, so a title that imports a system
function no library provides fails to load with an unresolved import. The
PS5 3.20 export inventory lists 193 such exports across 37 PS5 system
libraries AnyPS5 implements but does not provide.
Declare them as throwing stubs so those titles load and reach their next
blocker. Each declaration calls NotImplemented_nid_no_patch and returns 0;
none of them implements the function. Declarations with a credible
prototype use it and cite the source with a pinned commit, and the rest
are declared without parameters, which resolves the import without making
an ABI claim. The technical-debt files record the limitation per library.
libSceMbus and libSceSystemService are left out because pull request #7821
declares them. libSceAgc is left out because its exports are versioned, so
the 3.20 NID names a different symbol from the one AnyPS5 ships.
libSceAvPlayer.native is left out because it compiles libSceAvPlayer's
Export.cpp.
Names and NIDs come from the PS5 3.20 export inventory at
https://github.com/DNNDHH/PS5-3.20_Libs/tree/b2a77c09cd71c01f34c790cfbe98c751a13262ad
Under -DANYPS5_ENABLE_ASAN=ON with ASAN_OPTIONS=detect_leaks=0, 14 of
the 849 tests outside the AGC driver, shader and VideoOut suites failed
on main for reasons that come from the ASan build itself, not from the
code they test:
- libc copies the main executable's file-backed writable pages before
remapping them anonymously. In an instrumented test executable those
pages hold ASan's redzones around globals, so the memcpy reported a
global-buffer-overflow at load (patched_libraries,
guest_memory_lifetime). The ASan build copies the pages word by word
without instrumentation.
- Five tests check that a local variable is on the thread's stack.
With detect_stack_use_after_return, which is on by default on Linux,
instrumented locals live on ASan's fake stack. These tests now run
with it off. guest_kernel_is_stack also bounded the worker stack by
the application area without the ASan build's arena offset.
- The relinker module tests and loadexec_arguments load instrumented
libraries into a Python process or a relinked guest, so the ASan
runtime is not first in the initial library list. They now run with
verify_asan_link_order=0. Preloading libasan instead put its
__cxa_throw interceptor ahead of libc.prx's and broke the unwind of
an exception that LoadExec throws and catches.
- guest_allocator_failures limits RLIMIT_DATA to 128 MiB and then
commits 300 GiB. ASan maps 37.5 GiB of shadow for that commit, which
the limit refuses, and aborts. The ASan build skips that section.
- fiber checks the address of a local against the fiber's context too,
so it runs without fake stacks as well. Its CheckActiveContext then
reads the fiber stack word by word above that local, through the
redzones of the frames on that stack, and is no longer instrumented.
- agc_multisample_guest_access passed aligned_alloc a size that is not
a multiple of the alignment, which C11 does not allow and ASan
rejects. It now rounds the size up.
add_asan_test_options appends to ASAN_OPTIONS for one test in an ASan
build and does nothing otherwise.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Unreal Engine walks the frame-pointer chain until it reads a return
address of 0 and never checks the frame pointer itself. Guest threads
started with whatever rbp the host code held, so the walk ran into host
start-up frames (glibc's saved rbp 0x21 in a LEGO Batman core dump,
address 8 in Returnal on Windows) and faulted. Fibers ended their chain
with a null frame, and makecontext started its function with rbp 0, so
the same walker read address 8 there too.
Guest threads now start through a thunk that points rbp at a
{saved rbp 0, return address 0} record, as the relinker's entry stub
does for the main thread; the fiber trampolines push the same record,
and the makecontext start function is built with frame pointers so its
frame, over the zero return address makecontext stores, ends the chain.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Since 794714983 every fiber ran on an mmap'd host stack so that host calls
cannot overrun the small contexts PPSA01341 packs next to each other. A
title that derives state from the stack pointer then reads the wrong
memory: PPSA05684's job fibers have 512 KiB contexts at 1 MiB-aligned
addresses and find their job record by masking rsp with ~0xfffff, so the
job system lost track of a GameInit job and the game waited forever
right after loading big4r/actor76.txt. Its 64 KiB fibers fault later on
a host stack too.
A fiber now gets a host stack only when its context is smaller than
64 KiB; a larger context is the stack again, as on the console. The
limit sits between the 16 KiB contexts that need protection and the
64 KiB ones that need the guest stack (technical debt entry). The fiber
test runs a 512 KiB fiber and checks that its stack is in its context;
it fails without this change.
AI-assisted: yes
AllocateHostStack passes MAP_STACK to mmap. The macOS SDK defines
MAP_NORESERVE but not MAP_STACK, so Export.cpp does not compile there.
Build the flags in a local variable and add MAP_STACK only where the
host defines it. Linux keeps the same flags.
Aps5FiberMain kept the fiber's entry address in rbp when it called the
entry, so the guest entry saved that code address as the caller's frame.
A guest walking frame pointers from inside a fiber read machine code as
a frame record and faulted. libSceFiber is now built with frame
pointers: Aps5FiberMain sets up a frame whose saved rbp is the zero of
the initial fiber frame, and the chain ends there.
#4265 gives each fiber an mmap'd host stack on Linux and leaves Windows
as it was: there a fiber still runs host calls inside the context the
title passed to sceFiberInitialize. Demon's Souls packs its 16 KiB job
fiber contexts back to back. A job that calls
sceAgcCreateInterpolantMapping reaches shader preparation on the fiber
(Driver::ResolveShaderAbi, PrepareRegistered, the RDNA decoder,
BuildShaderStageInputInfo), goes more than 16 KiB deep and overwrites
the frames at the top of the context below it. On the loading screen
after the opening cinematic the fiber that owns that context then
failed the title's stack check, or returned to 0x7fffffff.
On Windows each fiber now gets a host stack from VirtualAlloc, the
context size plus 1 MiB, committed like the 1 MiB host margin of guest
threads, with a PAGE_NOACCESS page at the bottom. While the fiber runs,
the TIB stack base and limit and the deallocation stack describe that
host stack, as Windows does for its own fibers, so stack probes and
GetCurrentThreadStackLimits see the stack the fiber runs on. A host
stack that cannot be allocated, protected or released throws instead
of falling back to the context.
agc_driver_gpu_map_on_fiber: GetCurrentThreadStackLimits on a fiber now
returns its host stack, which has room for the import, so on Windows a
GPU mapping made on a fiber imports on the fiber's stack instead of a
host thread. The fiber's context is still not written.
Test: on Windows, fiber checks that the TIB stack bounds inside a fiber
cover its host stack, at least the context plus 256 KiB. With #4265
alone it fails at "the thread's stack bounds are the fiber's host
stack", and without that check at "a host call from a 16 KiB fiber
writes nothing below its context"; with this change fiber and
agc_driver_gpu_map_on_fiber pass (Windows Server 2025, RTX 3060,
WinLibs GCC 15.2.0, Release).
Demon's Souls (PPSA01342) on that host: at the loading screen the two
16 KiB job fibers above the overwritten one now use 17,592 and 16,936
bytes of their host stacks, the title's stack check no longer fails
there, and the load goes on until a separate Vulkan allocation failure
(vkAllocateMemory of a 4 MiB host-visible buffer, out of device memory).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Host code that a guest fiber calls runs on the fiber's stack. Demon's
Souls (PPSA01341) gives its job fibers 16 KiB contexts packed next to each
other, and a fiber that reaches shader preparation through
Driver::ResolveGraphicsStagesAbi goes about 21 KiB deep when SPIRV-Tools
validates the module. That overwrites the saved frame of the fiber below,
and the next switch to that fiber pops garbage into rbp, rbx, r12-r15 and
rip (a jump to 0x1a in the observed crash).
Fibers now run on an mmap'd host stack of the context size plus 1 MiB,
with a guard page at the bottom, the same margin guest threads get since
#2647. The guest context is no longer written. Context size checks fill
and scan the top context-size bytes of the host stack, so
size_context_margin keeps its meaning. If the mapping fails the fiber
runs in its context as before. Windows is unchanged: it pins and
publishes the guest context as the stack, and that path is not covered
here.
The fiber test now runs a 256 KiB host call from a 16 KiB fiber placed at
the top of a guard-filled area and checks nothing below the context was
written. It fails on main.
C symbols in Mach-O carry a leading underscore, and its assembler has no
.type or .size directives. APS5_ASM_SYMBOL names a symbol the way the
assembler of the host expects it, APS5_ASM_FUNCTION_END closes a function
(.size on ELF, nothing elsewhere), and APS5_ASM_FUNCTION defines a global
function on macOS.
The fiber stack switch, the signal mask helpers, getcontext and their tests
use them instead of writing the ELF spelling. The assembly they produce on
Linux and Windows is the same as before.
Every library CMakeLists.txt ended with the same block removing -static,
-static-libgcc and -static-libstdc++ from CMAKE_EXE_LINKER_FLAGS on MinGW,
because core/libs/CMakeLists.txt only removed them after adding the library
directories. Remove them before the libc and library directories are added
so each directory inherits the stripped flags, and drop the 52 copies.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_017pTZqAyVSZy2FZmaqakPHZ
Write tracking protects shared guest pages read-only. A push on a fiber
stack in such a page faults, and Windows cannot dispatch it because the
exception frame lands on the same protected stack, so the process was
terminated without a report. Pin fiber contexts writable for their
lifetime; pinned pages are always collected as written.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceFiberStartContextSizeCheck and sceFiberStopContextSizeCheck toggle a
mode in which new fibers get their context filled with a pattern, so
sceFiberGetInfo can report the unused stack margin.
sceFiberGetThreadFramePointerAddress returns the frame pointer of the
thread that called sceFiberRun.
Co-Authored-By: Claude <[email protected]>
Adrià