Resolve the docs/dev/debt/relinker.md conflict with #5994: keep its
sce_module syscall-scan entry, which now also stops at the end of the
last unwind function when the PLT comes before the code (it calls the
same FindSceCodeEnd), and its /libexec/ld-elf.so.1 start in the code
analysis entry, with this PR's end for a PLT before the code.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Windows deferred preinit thunk pushed r12, r13 and r14 and then
popped r12, r13 and r14, so the caller got r12 and r14 back swapped.
InitializeDeferredModule keeps the module base, table and count live
across the call to the thunk, so a compiler that keeps any of them in
r12 or r14 sees corrupted loader state after opening a deferred module
that has a preinit array. Pop in reverse push order instead and pin the
new bytes in test_guest_preinit.
guest_preinit loads the instrumented guest_module_args_host.prx into Python, so in an ANYPS5_ENABLE_ASAN build it needs the same verify_asan_link_order=0 as the other module tests; without it, it fails with "ASan runtime does not come first in initial library list". add_asan_test_options does nothing outside ASan builds.
Signed-off-by: Ayamullah Khan <[email protected]>
Converted guest modules never ran their DT_PREINIT_ARRAY entries: the
reader validated the array and the unused-NID filter kept its targets,
but no writer emitted or ran it. ld.so runs a shared object's preinit
array only for the main executable, so the Linux output runs the
entries from the DT_INIT stub before the module initializer; the macOS
and Windows outputs run them before the initializer in their startup
stubs, and the deferred Windows output exports a thunk that runs them
before the initializer for runtime-loaded modules. A module with a
preinit array and no initializer is still rejected, since the Linux
stub exists only with one.
Four tests printed a value with std::to_string after "0x", so a decimal number
read as a hex one. The anchor of a differing anchored BDA read, guest + 0x100,
was reported as 0x140733498786049 instead of 0x7fff12340101. They now print
these values in hex.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The SPIR-V emission failures printed the shader hash with std::to_string
after "hash=0x", so the hash read as a hex number that was the decimal one.
Shader 0x1173ae1000 was reported as hash=0x74955231232. Both now print it in
hex, as the driver's own messages print the shader address.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
main replaced g_outputMutex with g_outputMutexes[], so the Sys close no longer compiled. Mirror sceAudioOutExClose: range-check the handle, lock its mutex.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
guest_gameupdate still asserted the throw that sceGameUpdateGetAddcontLatestVersion
no longer raises for a null entitlement label since it answers 0x80412803, so the
test aborts; it now asserts the error, the same change #5919 makes. The mastering
states layout is pinned with compile-time size checks for the descriptors, the
compressor and limiter states and both states structs, as #6380 suggested.
libSceCesCs goes to 17 of 17: three-byte EUC-JP JIS X 0212 (0x8F)
characters convert through a table read from the Unicode consortium's
JIS0212.TXT, both directions, so sceCesEucJpToUcs2, the MbcsStrTo*
and *Get*Len forms and the context conversions accept them, and a
character with cells in both JIS X 0208 and JIS X 0212 still encodes
to the two-byte form. sceCesRefersUcsProfileCp1250 returns a profile
with the Windows-1250 table of Microsoft's bestfit1250.txt, accepted
by the SBC and context conversions.
The AudioOut HDMI bitstream Sys family follows the Ex ports: SysOpen
opens a port only for mode 5, the TrueHD MAT route EVO-PLAYER-PS5
reads from the firmware 12.70 mode tables, paced at 192 kHz with no
host device; SysConfigureOutput accepts the observed HDMI MAT switch;
SysClose closes a Sys port. sceAudioOut2MasteringGetState fills the
states by states id with the descriptors KytyPS5 declares, SetParam
answers a null parameter with the mastering invalid-API-parameter
error, Set3DLatency follows KytyPS5's output validation (0x80268001
above 2, any user), SetSystemDebugState records the debug state id,
and GetSpeakerArrayCoefficients returns the front pair KytyPS5 and
prosper both return.
sceAudioInOpen accepts param 0x10 as float mono like KytyPS5; HqOpen
answers a longer grain or a lower rate with the invalid-size and
invalid-frequency errors; AsyncOpen also accepts the 384-sample grain
SharpProspero documents. sceGameUpdateGetAddcontLatestVersion answers
a null entitlement label with 0x80412803, as prosper does.
libkernel exported scePthreadAttrSetschedpolicy and
scePthreadAttrSetinheritsched but not the matching getters,
scePthreadAttrGetschedpolicy (NID NMyIQ9WgWbU) and
scePthreadAttrGetinheritsched (NID lpMP8HhkBbg), so a title that
imports either one stopped at startup on the unresolved import. Dragon
Ball Xenoverse 2 (PPSA08587) imports both.
Implement them as FreeBSD 11.4 libthr implements
pthread_attr_getschedpolicy and pthread_attr_getinheritsched
(lib/libthr/thread/thr_attr.c): a null or uninitialized attribute
returns EINVAL (0x80020016), as does a null output of
scePthreadAttrGetschedpolicy; otherwise the attribute's policy or
inheritance is stored and 0 is returned. libthr writes through a null
output of the inheritance getter unchecked, so that case throws, as
pthread_attr_getinheritsched and scePthreadAttrGetsolosched do.
Neither getter was measured on a console. The scePthreadAttr entry in
docs/dev/debt/libkernel.md, which describes the calls measured on a
PS5, now says so and records the throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The process_vm_readv probe answered a small read check before the page
table was looked at, so a page the table holds as inaccessible (as #6184
records them) read as accessible whenever the host page was readable. The
probe now runs only for ranges with no recorded page state.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Linux kernels without PROCMAP_QUERY (before 6.11, which includes the
stock Ubuntu 24.04 kernel), every guest range check that misses the page
cache reads and parses /proc/self/maps up to the covering mapping. The
cache only covers the guest arena and the image, so ranges in the host
heap always miss. ASTRO BOT (PPSA21564) checks 96-byte shader headers
there from RegisteredHeader (through SameHeader) on every
sceAgcCreatePrimState and interpolant mapping, about 3,700 times per
second while it loads.
A read-only check of at most 4 KiB on such a kernel now first reads the
range into a scratch buffer with process_vm_readv on the own process.
If every byte is read, the range is readable. Anything else (a fault,
a partial read, a refused call, a write check or a larger range) takes
the path it took before, which also builds the failure message.
agc_driver_graphics runs a second time with APS5_NO_PROCMAP_QUERY=1, so
the fallback path is covered on kernels that have PROCMAP_QUERY too, and
LiveStack gains read-only checks: a readable range, and ranges that end
in a guard page.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceNetCtlRegisterCallback and sceNetCtlRegisterCallbackV6 stored only
the function and dropped its argument, and sceNetCtlCheckCallback
returned 0 without calling anything, so a title that polls
sceNetCtlCheckCallback until its callback reports IPOBTAINED never
got the event.
Each callback slot now keeps the function, its argument and the last
event it received; unregistration clears the slot. With no IPv4
callback registered, sceNetCtlCheckCallback returns 0 without querying
the host. Otherwise it takes the state from the same host-interface
predicate as sceNetCtlGetState, IPOBTAINED (3) or DISCONNECTED (1)
(shadPS4 src/core/libraries/network/net_ctl_codes.h L27-29
@15abf68c9b52), marks the IPv4 slots whose last event differs and
calls them on the calling thread with their argument after the lock is
released, so a callback can unregister itself. Delivery once per state
change and slot follows KytyPS5 src/libs/network.cpp @9e41d8320a27
(NetCtlCallbackSlot L3447-3451, NetCtlCheckCallback L3648-3661,
NetCtlRegisterCallback L3687-3707); shadPS4 net_ctl_obj.cpp L47-57
delivers on every check instead, and the debt entry records the
difference and that KytyPS5 calls the callbacks under its lock.
sceNetCtlTerm clears both tables, as KytyPS5 NetCtlTerm (L3625-3633)
does. V6 slots keep their argument but get no event, since no source
says which call delivers them.
NetCtlCallback is now an APS5_VABI pointer, so the Windows build calls
the guest function with the System V ABI.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rosetta sets RDTSCP's ECX to its constant TSC_AUX, 0xAAAAAAAB, which is
not a processor index. --to-rosetta already makes RDPID return processor
0 for the same reason, so code reading the processor through RDTSCP saw
a different value from code reading it through RDPID.
--to-rosetta now moves RDTSCP into an optional stub that runs the
instruction unchanged and then loads 0 into ECX with a MOV, which
leaves the counter in EDX:EAX and the flags as they were. A site with no
movable instruction after it for the jump is kept, as for RDPID. The
Intel target and a plain relink are unchanged.
Adrià