Publish Chimera GFX source

2026-09-03 03:27:14 +02:00
commit a6037502d7
828 changed files with 100454 additions and 0 deletions
@@ -0,0 +1,54 @@
+# External evidence integrity check â€” 2026-07-29
+
+## Decision
+
+`EXTERNAL_EVIDENCE_WORKSPACE_NOT_REPRODUCIBLE`
+
+This is a host-only integrity record. No PS5, network, transfer, target build,
+installation, execution, result reception, autoload, or device write was used.
+Every authorization remains false and automatic retry remains false.
+
+## Findings
+
+The standalone tracked-input suite passes, but the currently available sibling
+workspace cannot reproduce every historical cross-repository validator:
+
+- Phase-0.9B and Phase-0.9C source digests do not match several committed
+  blobs at the commits named by their historical manifests;
+- the expected historical bytes are not present in any local commit of the
+  affected sibling repositories;
+- Phase-1.0L and Phase-1.0M require ignored sibling audit documents that are
+  absent from the current RetroArch checkout;
+- Phase-1.0P and Phase-1.0R bind older RetroArch revisions and Phase-1.0R also
+  requires ignored Phase-1.0M ELF/map evidence that is absent;
+- a single sibling worktree cannot simultaneously represent all historical
+  revisions.
+
+Worktree CRLF conversion is a separate source of false mismatches on Windows.
+The historical validators and their checksum inventories are immutable and
+were not rewritten. A future source-evidence contract should bind committed
+Git blobs or explicitly normalized text, but that change must use a new schema
+and record rather than altering the historical evidence package. Comparison
+against committed blobs confirmed that several remaining mismatches are
+genuine evidence-availability failures, not line-ending conversion.
+
+## Test boundary
+
+The default CTest suite uses tracked files only. Historical validators needing
+sibling repositories, upstream trees, or ignored artifacts are registered only
+with `CHIMERA_GFX_REGISTER_EXTERNAL_EVIDENCE_VALIDATORS=ON` and must be run one
+at a time against the exact phase-specific workspace described in
+`TEST_PLAN.md`.
+
+Unregistered does not mean passed. Missing or mismatched external evidence
+remains fail-closed and cannot support a compatibility, hardware-safety,
+execution, cleanup, or recovery claim. The historical records are preserved;
+their missing bytes are not reconstructed or replaced by current source.
+
+## Recovery requirement
+
+To re-establish a historical external validation, supply the original exact
+ignored evidence and source bytes, verify their SHA-256 values independently,
+and bind them to a clean phase-specific checkout. If those bytes cannot be
+recovered, the affected source-binding claim remains unavailable permanently;
+no manifest hash may be rewritten merely to make a validator pass.
@@ -0,0 +1,41 @@
+# Phase-0 build evidence — 2026-07-16
+
+This record captures local compile evidence only. No PS5 connection, transfer,
+or execution occurred.
+
+## Inputs
+
+- source workspace: standalone `chimera-gfx`
+- PS5 Payload SDK: v0.41 / commit `d2e2e585740362976a39fdd5ccf390f199a7bc37`
+- SDK ZIP SHA-256:
+  `ebfb0acb5260511951a80e17db41650c62d20a8caf8659a230b928dc85005984`
+- host compiler: MSVC 19.42.34436.0
+- cross compiler: Ubuntu clang 18.1.8 (`20ubuntu8`)
+- CMake: host 3.29.5-msvc4; cross 4.2.3
+- Ninja: 1.13.2
+
+## Host result
+
+The Debug host library and test executables compiled with warnings as errors.
+Clang-tidy completed during the WSL/Clang build. All 7 unit, manifest,
+generated-file, safety, secret, and format checks passed.
+
+## PS5 compile result
+
+`chimera-gfx-capability-probe.elf` compiled as a 64-bit x86-64 PIE using the
+public SDK toolchain, with `CHIMERA_GFX_PS5_ALLOWED_FIRMWARE=NONE` and warnings
+as errors. Initial artifact SHA-256 before the final source split was
+`618eadc14975eb3f20942ee2228007b2457c0f6c1b0e4daa72d17ae9feb64c5c`.
+After splitting unused host allocation code out of the linked probe surface and
+performing the final rebuild, the artifact SHA-256 is
+`bc09865f6d26ba4fa86a5167b99841ad3ebee3629421a2cb4bae678bde63227f`.
+
+Read-only symbol inspection found:
+
+- GNM imports: 0
+- VideoOut imports: 0
+- loader entry points present: `dlopen`, `dlsym`, `dlclose`
+- undefined allocation imports (`calloc`, `free`): 0
+- representative GNM names present only as embedded lookup strings
+
+This evidence does not claim runtime compatibility with any firmware.
@@ -0,0 +1,76 @@
+# Phase-0 and offline Phase-1 build evidence
+
+- Date: 2026-07-17
+- Source commit: `72292f2d5788ad643e9d1816ce28ab754ef739b5`
+- Branch: `main`
+- Firmware gate: `NONE`
+- Hardware transfer/execution: **not performed**
+
+The source tree was clean when the two artifacts below were rebuilt. Generated
+build directories and ELFs are ignored; only their machine-readable manifests
+are tracked.
+
+## Host verification
+
+| Environment | Result |
+|---|---|
+| Windows, Visual Studio 2022 x64 Debug | 11/11 CTest tests passed |
+| Windows, Visual Studio 2022 x64 Release | 11/11 CTest tests passed |
+| WSL, Clang 18.1.8, clang-tidy 18, warnings as errors | 12/12 CTest tests passed |
+| WSL, GCC 15.2.0, ASan + UBSan | 12/12 CTest tests passed |
+| Installed core library consumer | compiled and exited 0 |
+| Installed RetroArch/SDL2 scaffold consumer | compiled and exited 0 |
+
+The tests include API/error/lifecycle validation, cross-context ownership,
+resource limits, deterministic mock upload/present state, adapter refusal,
+firmware-gate negative cases, symbol-manifest generation, artifact-manifest
+tamper rejection, format, safety policy, and secret scanning.
+
+The Clang ASan/UBSan variant was attempted but could not link because this WSL
+installation lacks Clang 18's `compiler-rt` ASan archives. That attempt is not
+counted as a passed test. The available GCC sanitizer runtime completed the
+same 12-test suite successfully.
+
+Docker was not installed in the local environment, so the pinned Dockerfile
+was reviewed but not built. Its host and Phase-0 cross-build commands were run
+directly with the same pinned compiler/SDK inputs. No Gitea job is claimed as
+passed merely from being queued.
+
+## Cross-build verification
+
+The clean PS5 compile used:
+
+- PS5 Payload SDK `v0.41`, commit
+  `d2e2e585740362976a39fdd5ccf390f199a7bc37`;
+- PS5 SDL2 commit `0baf4ac49382b537ba449901b5b6d0d189bb1fbb`;
+- the single reviewed keyboard/IME-removal overlay;
+- SDL2main, audio, joystick, haptic, sensor, power, file, filesystem, locale,
+  misc, OpenGL, LoadSO, render, Vulkan, dummy/offscreen video, and HIDAPI
+  disabled for the Phase-1 candidate;
+- warnings as errors and firmware identifier `NONE`.
+
+All core, adapter, firmware-gate, probe, and disabled Phase-1 targets compiled
+and linked. Static `prospero-nm` inspection then passed the strict import audit.
+
+| Artifact | Size | SHA-256 | Static result |
+|---|---:|---|---|
+| `chimera-gfx-capability-probe.elf` | 110424 | `f0f74978ac62490ff2482386e9c4efa3ad6d6cc46e10d54c41cb8669b4449f36` | 0 direct Sce imports; 0 GNM imports |
+| `chimera-gfx-phase1-videoout-clear.elf` | 1566368 | `2e826ac4ea2bffb626d82e370f98909bb508417d92b1ac3796e9f5a902e975c9` | exact reviewed 15-name Sce set; 0 GNM/keyboard/IME/UserService imports |
+
+The 15 Phase-1 imports are six direct-memory/equeue functions, one
+SystemService function, and eight VideoOut functions listed in
+`docs/phase1/VIDEOOUT_CLEAR_EXPERIMENT.md`.
+
+`llvm-objdump-18` confirmed the retained control-flow order in the Phase-1
+`main`: firmware gate at offset `0x78`, `SDL_SetMainReady` at `0xa9`,
+`SDL_Init` at `0xb4`, and the sole `SDL_UpdateWindowSurface` at `0x1fc`. The
+probe likewise reaches its firmware gate before loader construction and probe
+logic. With embedded identifier `NONE`, both return before the later calls.
+
+The corresponding tracked manifests are:
+
+- `manifests/artifacts/chimera-gfx-capability-probe-0.1.0-none.json`;
+- `manifests/artifacts/chimera-gfx-phase1-videoout-clear-0.1.0-none.json`.
+
+Both manifests verify against the local bytes and state `authorized: false`,
+`transferred: false`, and `executed: false`.
@@ -0,0 +1,67 @@
+# Phase 0.5 startup offline evidence — 2026-07-17
+
+## Outcome
+
+Decision: **BLOCKED**. The stock SDK v0.41 startup is `UNSAFE`, and the exact
+loader caller needed to prove safe return from a replacement is absent. No
+custom `_start` source and no PS5 ELF were created.
+
+No PS5 connection, transfer, execution, VideoOut open, module load, network
+initialization, GNM operation, framebuffer mutation, credential change,
+syscall-bound change, MMIO access, or firmware change occurred.
+
+## Offline startup audit
+
+`tools/audit_ps5_startup_feasibility.py` was run twice independently against
+the pinned SDK source and install. Both JSON outputs were byte-identical:
+
+- startup audit SHA-256:
+  `d0e8202c1a07e4104476cadf6c14a1dea2d724b1d97495dddcdf05858f6c8d4a`;
+- 12 transitive stock CRT sources enumerated;
+- six other CRT-named installed files confirmed as empty archives;
+- 31 functions and 182 call/tail-call edges reachable from stock `_start`;
+- reachable prohibited set: `__patch_init`, `kernel_copyin`, `kernel_copyout`,
+  `kernel_set_ucred_caps`, and `kernel_set_ucred_attrs`;
+- compiler `-###` trace confirmed that `-nostartfiles -nodefaultlibs` adds no
+  stock CRT or default library and produced no ELF;
+- non-SDK local loader-contract hits: zero.
+
+## Policy verification
+
+The real legacy artifact, its updated manifest, and the permanent denylist were
+evaluated together. The policy tool returned exit 2 with both
+`ARTIFACT_PERMANENTLY_DENYLISTED` and
+`MANIFEST_EXECUTION_INELIGIBLE`.
+
+JSON Schema validation passed for all three tracked artifact manifests and the
+permanent denylist.
+
+## Host and static tests
+
+- Windows MSVC warnings-as-errors build: passed.
+- Windows CTest: 14/14 passed.
+- WSL Clang 18 plus clang-tidy build: passed.
+- WSL Clang CTest including formatting: 15/15 passed.
+- WSL GCC 15 ASan+UBSan build: passed.
+- WSL GCC ASan+UBSan CTest: 15/15 passed.
+- Python syntax compilation for every changed tool/test: passed.
+- `git diff --check`: passed at review time.
+
+An initial Clang ASan configure did not compile a project source because the
+local Clang install lacks `libclang_rt.asan*`. GCC's available ASan/UBSan
+runtime was used successfully instead. The failed configure is an environment
+toolchain limitation and was not reported as a passed test.
+
+## Bound hashes
+
+| Record | SHA-256 |
+|---|---|
+| permanent denylist | `e9603b0e3792781ad5b511afb22ef61e3d4fd4c5a16bf928f8609193bcd97783` |
+| denylist schema | `78d0d28da552550e4b7dabc5b9c25347fb2618c4664b7a554b87c6de69cd6c96` |
+| startup audit JSON | `d0e8202c1a07e4104476cadf6c14a1dea2d724b1d97495dddcdf05858f6c8d4a` |
+| non-build decision | `b04dd224c00af0c7228c582f6ba3ca55ef03e9453287f233a0c4ff2e545092fc` |
+| machine proof matrix | `aefd1d1e663be617ed1042c6a1d68b9f21dd0c137f0c601d15cdcbfdf03dadb7` |
+| permanently blocked legacy ELF | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` |
+
+The last hash names pre-existing bytes only. It is not a Phase-0.5 artifact and
+must not be transferred or executed.
@@ -0,0 +1,61 @@
+# Phase-0.7 offline build evidence — 2026-07-17
+
+- Public SDK: v0.41,
+  `d2e2e585740362976a39fdd5ccf390f199a7bc37`
+- Firmware build gate: exact `9.60`
+- Host validation: MSVC 19.50 `/W4 /WX`; Clang 18
+  warnings-as-errors/clang-tidy/format; GCC 15 ASan/UBSan
+- Fuzz fallback: 100,000 deterministic ASan/UBSan inputs for both controlled
+  header and verified metadata
+- Cross-build: all three targets with warnings-as-errors
+- Reproducibility: two clean byte-identical builds per ELF
+- Console actions: none
+
+The complete machine evidence is
+`manifests/runtime/phase-0.7-offline-audit.json`. Full ignored reports and
+artifacts are packaged below `outputs/phase07/`.
+
+## Exact outputs
+
+| Artifact | SHA-256 | Size | Undefined imports | `DT_NEEDED` |
+|---|---|---:|---|---|
+| hardened elfldr | `63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561` | 397000 | none | `libSceLibcInternal.sprx`, `libSceNet.sprx`, `libkernel_web.sprx` |
+| controlled Payload Manager | `8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1` | 99560 | none | `libSceLibcInternal.sprx`, `libSceNet.sprx`, `libkernel_web.sprx` |
+| lifecycle probe | `bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182` | 112680 | `_exit`, `sceKernelSendNotificationRequest` | `libSceLibcInternal.sprx`, `libkernel_web.sprx` |
+
+The lifecycle project's called functions are exactly one
+`sceKernelSendNotificationRequest` followed by `_exit`. The normal SDK startup
+is statically included and reaches `__patch_init` before `main`; that fact is
+proven from source, linker map, disassembly, and the 499-edge lifecycle
+callgraph rather than inferred from imports. The hardened loader audit records
+1032 call edges and the controlled manager records 478.
+
+The lifecycle linker map also contains stock-SDK `__dlopen`, `__dlsym`,
+`sceKernelLoadStartModule`, and `sceKernelStopUnloadModule` symbols. Direct
+static reachability proves the rtld initialization path but cannot resolve all
+116 indirect lifecycle edges. The audit therefore records linked symbols,
+direct `_start` reachability where symbolization permits it, and every
+unresolved indirect edge separately. No graphics/display-sensitive symbol is
+linked in any of the three audited ELFs.
+
+## Final offline tests
+
+- Chimera GFX Windows host build: MSVC `/W4 /WX`, 16/16 CTest passed.
+- Hardened elfldr: MSVC 1/1; Clang 18 plus clang-tidy 1/1; GCC 15
+  ASan/UBSan 1/1; 100,000-input sanitizer fuzz pass.
+- Controlled Payload Manager: MSVC 1/1; Clang 18 plus clang-tidy 2/2; GCC 15
+  ASan/UBSan 2/2; 100,000-input sanitizer fuzz pass.
+- All three PS5 cross-builds passed warnings-as-errors and reproduced the
+  exact hashes and sizes above.
+- Negative lifecycle firmware `9.50` configure failed before creating a build
+  graph.
+- Controlled-manager build without exact hash/size/artifact ID failed.
+- Static execution-policy refusal suite, manifest schemas, Phase-0.5/0.6
+  historical gates, Phase-0.7 proof matrix, safety audit, and secret scans
+  passed.
+
+The local Clang installation does not contain the optional
+`libclang_rt.asan`/libFuzzer runtime archives. Clang warnings and clang-tidy
+therefore run without sanitizers; GCC supplies the ASan/UBSan and deterministic
+fuzz coverage. This is a host-tool packaging limitation, not a target
+compiler, linker, or ABI blocker.
@@ -0,0 +1,147 @@
+# Firmware 9.60 capability-probe offline evidence
+
+Date: 2026-07-17. No PS5 connection, transfer, deployment, or execution was
+performed.
+
+## Artifact identity
+
+| Field | Value |
+|---|---|
+| Artifact | `chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf` |
+| Size | 110424 bytes |
+| SHA-256 | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` |
+| Source commit | `ba8f6a40cf37dff628254caa9b11d83a73957cf8` |
+| SDK | PS5 Payload SDK v0.41, commit `d2e2e585740362976a39fdd5ccf390f199a7bc37` |
+| Build type | Release, C11, warnings as errors |
+| Phase-1 VideoOut | explicitly `OFF`; target not built or linked |
+| Transfer / execution | false / false |
+| Execution eligibility | **false** |
+
+Two clean builds around an audit-tool-only commit produced the same size and
+SHA-256. The tracked manifest is
+`manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json`.
+
+## Firmware gate
+
+The checked-in discovery allowlist is exactly `["9.60"]`; CMake still defaults
+to `NONE`. Configure rejects `9.61`. The Phase-1 target rejects `9.60` and every
+other non-`NONE` value.
+
+The ELF embeds `9.60` and requires exactly these application arguments:
+
+```text
+--firmware 9.60 --acknowledge-read-only-probe
+```
+
+Disassembly places `chimera_gfx_firmware_gate_allows` at `main+0x7f`, before
+`chimera_gfx_ps5_make_loader_ops` at `main+0xa5` and the probe call at
+`main+0xb2`. This is only a comparison against an operator-supplied string; it
+does not independently attest the console firmware. SDK startup occurs before
+`main` and therefore before this gate.
+
+## Complete dynamic import inventory
+
+Undefined symbols (`prospero-nm -u`), exact set:
+
+- `__stderrp`
+- `__stdoutp`
+- `fprintf`
+- `fwrite`
+- `snprintf`
+- `strcmp`
+
+`DT_NEEDED` modules (`llvm-readelf-18 --dynamic-table`), exact set:
+
+- `libkernel_web.sprx`
+- `libSceLibcInternal.sprx`
+- `libSceNet.sprx`
+
+There are zero direct `sce*`, GNM, VideoOut, SDL, draw, dispatch, submit, or
+flip imports. `libSceVideoOut.sprx` text is present only because the SDK rtld
+statically includes a general sysmodule-name table; there is no corresponding
+import or call. `INIT_ARRAYSZ` and `FINI_ARRAYSZ` are both zero.
+
+## Project-requested functions
+
+Before the firmware gate, project `main` uses only argument checks, `strcmp`,
+and a refusal log on error. After the gate, the complete project path is:
+
+1. `chimera_gfx_ps5_make_loader_ops`;
+2. `chimera_gfx_ps5_probe_symbols`;
+3. internal `log_line`/`write_log` callbacks for boolean JSON events;
+4. loader callback `open_module`, which calls
+   `dlopen("libSceGnmDriver.sprx", RTLD_LAZY | RTLD_LOCAL)`;
+5. loader callback `resolve_symbol` 21 times; it calls `dlerror`, `dlsym`, then
+   `dlerror`; every returned address is reduced to a boolean and discarded;
+6. `snprintf` plus `fprintf`/compiler-selected `fwrite` for boolean JSON lines;
+7. loader callback `close_module`, which calls `dlclose`;
+8. `chimera_gfx_status_string` and a final summary log.
+
+No resolved GNM pointer is cast to a callable type or invoked. The 21 exact
+names are machine-checked against `manifests/ps5_gnm_symbols.json`.
+
+## SDK startup and loader side effects
+
+Pinned-source review plus disassembly proves this pre-`main` success path:
+
+1. `_start` clears payload BSS.
+2. `__crt_syscall_init`, `__kernel_init`, and `__klog_init` initialize SDK
+   state from loader-supplied arguments.
+3. libc `__isthreaded` is set to one.
+4. `__patch_init` reads current process credentials, calls
+   `kernel_set_ucred_caps` and `kernel_set_ucred_attrs`, and performs two
+   `kernel_copyin` writes that change the process syscall-address bounds.
+5. `__rtld_init` initializes SPRX/SO/payload/dlfcn support and may call
+   `sceKernelLoadStartModule` for `libSceSysmodule.sprx` if it is absent.
+6. payload dependencies are opened and relocations modify payload memory;
+   payload init/fini arrays themselves are empty.
+
+After the project gate, SDK `dlopen` first checks loaded modules through SDK
+kernel reads. If GNM is absent it can call `sceKernelLoadStartModule`. It then
+uses `kernel_copyout` to copy module metadata, symbol tables, and string tables
+into allocated user memory. The pinned SPRX-specific `init` callback is empty,
+but the internal behavior of the system load/start call is unknown.
+
+These facts mean the ELF is non-rendering at project level but is not globally
+non-mutating. The pre-`main` kernel writes violate the project's userland-only
+execution boundary.
+
+## Cleanup audit
+
+The bounded project loop attempts `dlclose` after all lookups and on lookup or
+format failures. SDK `dlclose` calls rtld fini, close, and destroy. The pinned
+SPRX `fini` callback is empty. If this open loaded the module, `sprx_close`
+calls `sceKernelStopUnloadModule`, then frees copied tables and clears local
+state.
+
+Cleanup is not guaranteed:
+
+- there is no documented cancellation or bounded timeout around loader calls;
+- a crash or hang can bypass `dlclose`;
+- a stop/unload failure can leave the module loaded while SDK bookkeeping is
+  destroyed;
+- the CRT's credential/syscall-permission changes have no matching restoration
+  path in the pinned source;
+- a `libSceSysmodule.sprx` load during rtld initialization has no observed
+  matching unload in this call chain.
+
+## Offline verification results
+
+- Windows MSVC Debug: 11/11 tests passed.
+- WSL Clang 18 with clang-tidy and formatting: 12/12 tests passed.
+- Strict artifact audit: six exact undefined symbols, three exact
+  `DT_NEEDED` modules, empty init/fini arrays, all 21 manifest names, zero
+  direct Sce/GNM imports.
+- SDK runtime source audit: passed and concluded execution eligibility false.
+- Negative configure tests: firmware `9.61` rejected; Phase-1 with `9.60`
+  rejected.
+- Artifact-manifest digest/size verification: passed.
+- Secret scan and `git diff --check`: passed.
+
+## Remaining blockers
+
+The exact system-module initialization effects, runtime argument delivery,
+firmware attestation, loader timeout behavior, and partial-failure recovery are
+unproven. More decisively, the SDK v0.41 CRT performs prohibited kernel writes
+before the project firmware gate. This exact artifact must not be transferred
+or executed.