The recorder released its lock between recording a submission, flip or
suspend point and the driver accepting it. Another thread's delta could
then wait for the accepted work, read its blocks, and record itself
after a call whose work the driver had not accepted yet, so the replay
submitted that work before applying stale bytes over its result. The
entry points now pass the driver call to the recorder, which runs it
under the same lock right after recording the call.
agc_driver_frame_replay_concurrent submits copies from a second thread
during the capture and checks that every memory delta was read after
the submissions recorded before it had completed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
swscanf restores errno around strtof and strtod, as the bundled
libc.prx does, while long double conversions keep host strtold's
errno and the narrow sscanf family keeps the host's ERANGE. Record
both gaps in the existing swscanf debt entry, as review asked.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
atan2f returned the host atan2, so its last bit depended on the host: on
Windows it differs from the libc.prx that titles ship on 7,126,466 of
200,001,024 sampled argument pairs. That libc.prx is msun's e_atan2f.c over
its atanf; with two NaN arguments it returns y's. The port gives the same
bits as PPSA07923's, PPSA05916's and PPSA13934's copies on every pair.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Main implements sceAppContentGetEntitlementKey next to this branch's
sceAppContentGetPftFlag; the merge keeps both declarations, both test
blocks and both debt entries. With that export implemented, Export.cpp
has 8 NotImplemented exports, and the pending-exports count says 8.
Read the unwind functions of an image that only has PT_GNU_EH_FRAME so
inter-FDE data tables are still found and masked, but leave the syscall
and call-site scan ranges empty without PT_SCE_DYNLIBDATA as main does.
The fixture now emits standard dynamic tags for its SysV block, and the
debt entry stays within the 1000 character limit.
A delta read its blocks with ReadCommittedUnsynced while GPU work
accepted before the call could still write them, so a capture could
hold a block from before a DMA copy that the replay then wrote back over
the copy's result. A delta with blocks to read now waits up to 10 s for
the accepted submissions and records the serials after the wait; the
capture stops with a warning when the work does not finish. The Windows
quarantine of agc_driver_frame_replay is removed.
Fixes#10711
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In PS5 Prospero PRX binaries, compilers place embedded constant data tables (such as the OpenSSL Whirlpool lookup table in ubiservices.prx) in inter-FDE gaps after function code, referenced via RIP-relative LEA instructions.
- In RelativeJumpTables, detect constant data tables in inter-FDE gaps that begin with padding, contain no direct branch targets, and contain undecodable non-code bytes, distinguishing them from valid unannotated code routines and multi-hop gap branches.
- In GuestModuleBuilder and RelinkerPipeline, extract unwind functions from PT_GNU_EH_FRAME as well as PT_SCE_DYNLIBDATA, and mask embedded data tables with 0x90 in scan buffers before SyscallScanner.
- In CodeInstructionCollector, populate table boundaries whenever unwind functions are present to prevent addAddressTakenRoot from adding data table addresses to CFG roots on Windows and macOS.
- Update relinker technical debt documentation and add regression tests.
Fixes#7547
Unblocks: PPSA28155 #7547
BunnyFl ran firmware 13.42's libSceSystemService.sprx in an emulator and
recorded the checks these calls make before they pass a request on. A
null title ID or one whose length isn't 9 makes sceSystemServiceGetAppId
and sceLncUtilGetAppId return -1 and sceLncUtilIsAppLaunched return
0x80940005. A null output, list, count or user returns 0x80940005 from
the LncUtil and SystemService calls and 0x80e30003 from
sceShellCoreUtilGetUserFocus, before the app ID is looked at, and a null
sceLncUtilLoadExec path returns 0x80940005.
What the module passes on as a request still throws: another
9-character title ID, another app ID, a list capacity of 0 and an empty
sceLncUtilLoadExec path.
