A delta read its blocks with ReadCommittedUnsynced while GPU work
accepted before the call could still write them, so a capture could
hold a block from before a DMA copy that the replay then wrote back over
the copy's result. A delta with blocks to read now waits up to 10 s for
the accepted submissions and records the serials after the wait; the
capture stops with a warning when the work does not finish. The Windows
quarantine of agc_driver_frame_replay is removed.
Fixes#10711
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In PS5 Prospero PRX binaries, compilers place embedded constant data tables (such as the OpenSSL Whirlpool lookup table in ubiservices.prx) in inter-FDE gaps after function code, referenced via RIP-relative LEA instructions.
- In RelativeJumpTables, detect constant data tables in inter-FDE gaps that begin with padding, contain no direct branch targets, and contain undecodable non-code bytes, distinguishing them from valid unannotated code routines and multi-hop gap branches.
- In GuestModuleBuilder and RelinkerPipeline, extract unwind functions from PT_GNU_EH_FRAME as well as PT_SCE_DYNLIBDATA, and mask embedded data tables with 0x90 in scan buffers before SyscallScanner.
- In CodeInstructionCollector, populate table boundaries whenever unwind functions are present to prevent addAddressTakenRoot from adding data table addresses to CFG roots on Windows and macOS.
- Update relinker technical debt documentation and add regression tests.
Fixes#7547
Unblocks: PPSA28155 #7547
BunnyFl ran firmware 13.42's libSceSystemService.sprx in an emulator and
recorded the checks these calls make before they pass a request on. A
null title ID or one whose length isn't 9 makes sceSystemServiceGetAppId
and sceLncUtilGetAppId return -1 and sceLncUtilIsAppLaunched return
0x80940005. A null output, list, count or user returns 0x80940005 from
the LncUtil and SystemService calls and 0x80e30003 from
sceShellCoreUtilGetUserFocus, before the app ID is looked at, and a null
sceLncUtilLoadExec path returns 0x80940005.
What the module passes on as a request still throws: another
9-character title ID, another app ID, a list capacity of 0 and an empty
sceLncUtilLoadExec path.
main's canonical-header refactor (f38d29fd08) edited the old libSceSaveData and libSceSaveDataDialog sources this branch removes, and made EventFlag.cpp, libSceNpCommon's Runtime.cpp and GuestKernelErrors.cpp include the old SaveDataCore.hpp. Those three use nothing from it and build without it, so the include is dropped. SaveDataWriteReplacement.cpp takes main's canonical header and keeps only the native path.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On a standard-port handle the console answers NOT_PERMITTED (0x80920101):
Halo CE Universal's pad probe measured it on firmware 13.59 for two
connected DualSenses in three runs. The function returned 0 with
invented controller information instead. The special port keeps its
zeroed answer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The libc.prx that PPSA31872 ships returns ERANGE for a buffer shorter than
23 bytes and otherwise strncpy's length - 1 bytes and terminates the last
one. This matches the firmware 13.60 log, where error 0 with a 16-byte
buffer returned 34 although "No error" fits.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Prospero Win measured on firmware 12.02 that the PS5 kernel accepts
MAP_EXCL but ignores it: MAP_FIXED | MAP_EXCL over an existing mapping
replaces it without error. Fixed anonymous mmap now does the same instead
of FreeBSD's ENOMEM. MAP_EXCL without MAP_FIXED stays EINVAL.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The nine-slot _ZTVSt7collateIcE export added by #9979 was still zeroed, so a guest that called through the exported vtable faulted. Fill slots 2 through 8 with the same facet methods that g_collateVtable uses, leave the offset-to-top and typeinfo slots zero, and cover compare, transform, hash, retain and release through the exported object.
