A patched TLS load calls TlsRegStub and SafeCall, which moved RSP past the
red zone with sub/add rsp,0x80. ADD and SUB write the arithmetic flags, so
the sub ran before SafeCall's pushfq saved them and the add ran after its
popfq restored them: guest code that compares, loads fs:[0] and then
branches on the flags could branch the wrong way. lea moves RSP without
touching the flags. The entry lea plus a two-byte nop keeps every patched
offset in both stubs; the exit lea is one byte longer and moves only ret.
TlsStubsPreserveFlags calls the stubs with two flag patterns and checks
the status flags, the output register and RAX; it fails with the old
bytes.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* loader: keep the output of a process LoadExec relaunches
LoadExec on Windows starts a new emulator process and exits the current
one. The new process was created without a console and without the
standard handles, so everything it printed was lost: a redirected log of
a game that relaunches itself ended at the relaunch.
Hand the new process the standard input, output and error handles,
inheriting only those, and let it share the console when there is one.
* loader: flush output before LoadExec starts the new program
On Windows, LoadExec flushed the C streams only after the new process
had been created, so output the old process still held could appear
after the new one's first lines. On Linux they were not flushed at all
before exec, which discards them.
Flush the log and every stream before starting the new program.
* loader: continue the log file across LoadExec
With --printf-direction File, the program LoadExec starts is given the
same --printf-output-file and opened it anew, emptying it. Everything
the first program had logged, its LoadExec line included, was lost.
LoadExec now sets KYTY_RELAUNCHED for the program it starts, which then
appends to the log file instead of replacing it. On Linux the variable
goes into the environment passed to exec rather than this process's
own, which other threads may be reading.
* loader: show LoadExec switches on the console
LoadExec logged the program it switched to only when guest output was
logged, and then only into the log: on a console the new program's
startup output followed the old one's without anything marking where
one program ended and the next began.
Write the switch to the console as well as the log, with the program's
arguments.
* loader: enable AMD CPU instruction patching on macOS
The guest instruction patcher was compiled out on macOS and runtimeLinker forced emulate_amd off,
so under Rosetta every SSE4a EXTRQ/INSERTQ took the SIGILL path (about 18 us each). Build the
patcher on all hosts and let --amd-cpu enable it on macOS like on Windows and Linux. The host
feature probe already reports no SSE4a under Rosetta, so EXTRQ becomes a native trampoline and the
remaining fallbacks keep using the x64 instruction emulator through the host exception handler.
* tests: macos_sse4a covers the guest instruction patcher on macOS
Patch EXTRQ/INSERTQ blobs in an RWX area with a trampoline page behind it, with the host features of
Rosetta (no SSE4a/RDPID/CLWB), and compare against the SIGILL emulator: EXTRQ must become a native
trampoline without SIGILL, INSERTQ stays a trap handled by the emulator, and nothing is touched
without emulate_amd.
* loader: emulate the patcher's VRSQRTPS trap and MWAITX on macOS
The AMD CPU patcher marks VRSQRTPS it cannot relocate by clearing a reserved
VEX.vvvv bit, which raises #UD on every host including Rosetta. The macOS build
left TryEmulateReciprocalSquareRoot and TryEmulateMonitorxMwaitx out, so the
guest died with an unhandled SIGILL at the first such site.
Both are plain SSE2/libc, so enable them on macOS. The Darwin context also
gains ClearUpperYmm so the VEX.128 result zeroes YMM[255:128] when the thread
has the AVX context. macos_sse4a covers the trapped VRSQRTPS and MWAITX.
* tests: macos_sse4a runs a plain VEX.128 VRSQRTPS through the patcher
The existing case started from an instruction that was already marked as a trap. The
new cases feed the ordinary encoding to PatchGuestInstructions and compare the result
with the emulated reference, both through a native trampoline and, when the instruction
cannot be relocated, through the trap mark and the signal emulator.
* loader: compact macOS instruction patcher coverage
Share the emulator dispatch chain while keeping SHA emulation limited to non-Apple hosts and preserving handler order. Remove a duplicate VRSQRTPS signal test already covered by both native and trapped patcher cases, plus blank lines left by removed platform guards.
---------
Co-authored-by: nmzik <Nmzik@mail.ru>
* loader: emulate immediate SSE4a instructions on macOS
* tests: simplify macOS SSE4a test integration
Keep the Darwin target, CTest registration, and aggregate dependency in
one conditional block without a separate target list. Preserve the
standalone target when BUILD_TESTING is disabled.
Lowercase the test filename and diagnostic prefix, and drop unrelated
formatting changes from the instruction emulator.
Credit Brandon Strong's related SSE4a work in
https://github.com/KytyPS5/KytyPS5/pull/467.
Co-authored-by: Brandon Strong <brandostrong@gmail.com>
---------
Co-authored-by: nmzik <Nmzik@mail.ru>
Co-authored-by: Brandon Strong <brandostrong@gmail.com>
* fix: keep hint-less guest mappings at the canonical PS5 base
FindGuestFreeRange searched the low system-managed range first for
mappings with no address hint, so the first hint-less direct-memory map
could land as low as 0x200000. The PS5 kernel never places hint-less
user mappings below 0x200000000 and guest code relies on that: Sony's
libc maps 4 MiB of direct memory for its internal heap, fails its
mspace setup when the returned address is that low, and the first
malloc then dereferences a null mspace (a read at 0x38, the mspace
magic check). On macOS this made Raiden III crash on the main guest
thread a couple of seconds after boot, 100 percent reproducible with
--printf-direction Silent.
Search from the canonical base first, fall back to the user range, and
keep the low system-managed range only as a last resort. The mmap path
already anchored hint-less searches at 0x200000000; this aligns the
shared search helper with it.
Adds two regression tests: the libc-shaped allocation must come back at
or above the canonical base and hold writes, and direct-memory content
must survive an unmap and remap of the same physical range.
* macos: make the fatal-report memory dumps fault-safe
IsReadableRange returned true for any nonzero address on macOS, so the
fatal report's guest memory dumps dereferenced whatever the crashed
thread had in its registers. A fault inside the reporter re-enters the
signal handler and wedges the reporting thread, which hid real guest
crashes whenever logging was enabled: the game kept running with a dead
thread and the report was never completed.
Walk the Mach regions covering the range and require read permission
before dumping, the same contract the Linux implementation provides.
* do not fallthrough HOST_SYSTEM_MANAGED_MIN
---------
Co-authored-by: nmzik <Nmzik@mail.ru>
Nawid3333