In PS5 Prospero PRX binaries, compilers place embedded constant data tables (such as the OpenSSL Whirlpool lookup table in ubiservices.prx) in inter-FDE gaps after function code, referenced via RIP-relative LEA instructions.
- In RelativeJumpTables, detect constant data tables in inter-FDE gaps that begin with padding, contain no direct branch targets, and contain undecodable non-code bytes, distinguishing them from valid unannotated code routines and multi-hop gap branches.
- In GuestModuleBuilder and RelinkerPipeline, extract unwind functions from PT_GNU_EH_FRAME as well as PT_SCE_DYNLIBDATA, and mask embedded data tables with 0x90 in scan buffers before SyscallScanner.
- In CodeInstructionCollector, populate table boundaries whenever unwind functions are present to prevent addAddressTakenRoot from adding data table addresses to CFG roots on Windows and macOS.
- Update relinker technical debt documentation and add regression tests.
Fixes#7547
Unblocks: PPSA28155 #7547
Run 40226437381 failed guest_floating_point (feholdexcept workers preserve the main environment). The test compared the whole fnstenv image (tag word, FIP/FDP) of the main thread before and after other threads ran; a context switch re-initialises that state when the x87 unit is idle, so it flakes (3 of 28 main builds). Compare control word, status word and MXCSR.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
BunnyFl ran firmware 13.42's libSceSystemService.sprx in an emulator and
recorded the checks these calls make before they pass a request on. A
null title ID or one whose length isn't 9 makes sceSystemServiceGetAppId
and sceLncUtilGetAppId return -1 and sceLncUtilIsAppLaunched return
0x80940005. A null output, list, count or user returns 0x80940005 from
the LncUtil and SystemService calls and 0x80e30003 from
sceShellCoreUtilGetUserFocus, before the app ID is looked at, and a null
sceLncUtilLoadExec path returns 0x80940005.
What the module passes on as a request still throws: another
9-character title ID, another app ID, a list capacity of 0 and an empty
sceLncUtilLoadExec path.
X509_STORE_add_lookup allocated the lookup before it threw for a null
method or a guest new_item callback, so each caught refusal left one
guest heap block behind. Both checks now run before the allocation, and
the allocator test checks that a refused method allocates nothing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
main's canonical-header refactor (f38d29fd08) edited the old libSceSaveData and libSceSaveDataDialog sources this branch removes, and made EventFlag.cpp, libSceNpCommon's Runtime.cpp and GuestKernelErrors.cpp include the old SaveDataCore.hpp. Those three use nothing from it and build without it, so the include is dropped. SaveDataWriteReplacement.cpp takes main's canonical header and keeps only the native path.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The same-range/same-protection fast path in RemapFixedIntoRegistered
returned without touching host pages, but DoMprotect/DoMtypeprotect
change host protection without updating the recorded nativeProtection,
so a stale record could leave guest pages with the wrong host
permissions. The shortcut now reissues the per-block backing map with
records skipped, keeping the bookkeeping optimization while reapplying
the requested host protection.
CreateDirectMemoryBacking registered g_physBlocks before building the
per-page map, so a bad_alloc during page construction left an orphaned
physical block that poisoned later allocations; the block now publishes
after the page map is built.
CheckFixedRemapReprotectsAfterMprotect covers both shortcut directions
with stale records and verifies the host protection via VirtualQuery /
proc maps, and the existing remap test gains the current uint64 Munmap
call.
On a standard-port handle the console answers NOT_PERMITTED (0x80920101):
Halo CE Universal's pad probe measured it on firmware 13.59 for two
connected DualSenses in three runs. The function returned 0 with
invented controller information instead. The special port keeps its
zeroed answer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The libc.prx that PPSA31872 ships returns ERANGE for a buffer shorter than
23 bytes and otherwise strncpy's length - 1 bytes and terminates the last
one. This matches the firmware 13.60 log, where error 0 with a 16-byte
buffer returned 34 although "No error" fits.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every map, remap, and validate call walked the physical range
page-by-page through physPages, so a guest that remaps a large arena
in a sliding window pays O(pages) per call and O(n^2) overall. Track
one physBlocks entry per CreateDirectMemoryBacking allocation and
split it on partial release; validate and map at block granularity.
Skip the host unmap/remap when the requested range already has the
identical guest-to-physical relationship.
Fixes#10521
Dean Galvin