BunnyFl measured firmware 13.42 libSceNpManager.sprx. The IdMapper
account-id lookups take seven arguments: a request id of 0 or less
gives 0x80553085, then user id -1, a null pointer or a value outside
1 to 1000 gives 0x80553083, and past the checks they answer signed out
as main's offline model does. IdMapper abort and delete refuse a
request id of 0 or less with 0x80553085, and IdMapper requests get a
counter of their own instead of the sceNpCreateRequest pool.
NpManagerInt requests sit in a 64-slot table of their own: the 65th
live request gives 0x80559D05, delete gives 0x80559D0A for an id the
table does not hold, and abort answers from the offline service.
BunnyFl measured both calls in firmware 13.42 libSceNet.sprx, run in an
emulator on the module itself. sceNetInitParam returns 0x80410116 for a
null parameter. The first non-null call copies the first 32 bytes of the
parameter and returns 0, and every later call returns 0x80410110, with a
null parameter and after sceNetTerm too, because the flag is never
cleared. sceNetConfigGetIfFlags returns 0x8041130E for a null flags
pointer before anything else. Both replace throws that stood in for the
unknown answers.
The first successful sceNetInitParam still marks the library initialized,
as sceNetInit does here, because the other calls check it. The module
reads only bit 0 of the stored copy's first word, to raise the pool limit
of sceNetPoolCreate from 32 to 128; that limit is recorded as not
modelled, as sceNetPoolCreate here has none.
Firmware 13.60's libSceSpSysCallWrapper.sprx jumps to libkernel's
scePthreadMutexattrSetprioceiling, which libkernel now implements, so the
wrapper forwards to it like the 47 other wrappers in the library. The
library's debt file held only this entry and is removed.
The Linux output copied a nonzero r_addend of GLOB_DAT and JUMP_SLOT
relocations unchanged into DT_RELA and DT_JMPREL, while the Windows,
macOS and guest module paths refuse it. The x86-64 psABI computes both
types as S, but glibc before f8587a61892c applies S+A when binding
eagerly, so the result depended on the host glibc and, for JUMP_SLOT,
on the binding mode. The Linux patcher now refuses such an entry in all
three Linux modes with the Windows message and the unrebased r_offset.
Entries with a zero addend are emitted as before.
Windows output accepted an executable import relocation whose target
overlaps the PT_TLS initialization image, and every guest thread read 0
there because the .gtls template is copied before the entry stub binds
the import. In ELF, ld.so relocates the image before copying it into a
thread's TLS block. The PE patcher now refuses such a relocation after
the relocation pass, as the Windows guest module writer already does,
and reports its ELF target address. Linux and macOS outputs are
unchanged, and the gap is recorded in docs/dev/debt/relinker.md.
Main's #10375 adds CheckDepthAttachmentAlias next to the ClearFault enum,
which this branch extends with FillDuringClear and a ClearSource enum; the
merge keeps both.
Main extends the libkernel debt entry on libSceNet sockets with poll and
fcntl, where this branch adds getsockopt to the same entry; the merge keeps
both.
std::condition_variable_any regressed guest_libc_cnd_timed_wait on the Windows runner. Keep CRITICAL_SECTION/CONDITION_VARIABLE on Windows and poll TryEnterCriticalSection for _Mtx_timedlock.
Adrià