Publish Chimera GFX source

2026-09-03 02:53:36 +02:00
commit fee37cd9b5
824 changed files with 100072 additions and 0 deletions
@@ -0,0 +1,49 @@
+# Phase 1.0B device risk assessment
+
+Overall classification:
+`RETROARCH_PS5_DEVICE_SMOKE_CANDIDATE_BUILT_WITH_DECLARED_RISKS`.
+
+## Hard boundaries satisfied offline
+
+- no PS5 connection, request, transfer or execution occurred;
+- no installation, autoload, live replacement, sender or retry exists;
+- no content/config file is required;
+- persistent write attempts fail closed;
+- the run requests shutdown at 60 seconds or 3,600 frames;
+- Options held for two seconds provides an additional shutdown;
+- the final ELF contains no SceNet, GNM, module-loader, installer, mount,
+  reboot, console-shutdown or other-payload launch import;
+- SDL's dynamic API and runtime assertion-exit path are disabled, leaving one
+  smoke-owned post-teardown `_Exit` callsite;
+- the primary ELF contains no permanent W+X load segment.
+
+The strings audit still sees shared RetroArch localization text for disabled
+network, autoload and reboot menu entries, plus the generic
+`udp://127.0.0.1:` template. These are inert data findings, not hidden
+functionality: the complete undefined-symbol inventory has no networking
+primitive, and no RetroArch network callgraph is linked. SDK runtime-loader
+symbol-name strings remain separately because the pinned CRT resolves its
+own loader at runtime.
+
+## Declared device-test risks
+
+| Risk | Class | Bounded mitigation | Residual |
+|---|---|---|---|
+| SDK CRT temporary kernel/process patches before `main` | session/integrity | exact SDK v0.41 source and controlled runtime identity | firmware-9.60 effect unobserved |
+| SDK CRT runtime loader | session/initialization | exact source and DT_NEEDED inventory; no RetroArch dynamic-core path | CRT resolves `sceKernelLoadStartModule` at runtime and can conditionally load `libSceSysmodule`; this is not visible as an ELF import |
+| `sceAudioOutOutput` is blocking | session hang | SDL worker, error counters, outer 60 s policy | no public timeout ABI; thread/join can still block |
+| VideoOut/Pad/AudioOut open calls lack an evidenced timeout variant | session hang | single attempt, no retry, partial cleanup | underlying call can outlive outer policy |
+| direct-memory mapping has no separately evidenced unmap in pinned SDL headers | cleanup | release direct memory and process exit | mapping cleanup before exit is incomplete/unproven |
+| new RX/R/RW layout | child/session crash | source-bound loader flag handling and relocation audit | device behavior unobserved |
+| `_Exit` in injected child | session termination | one smoke-owned call after teardown; SDL secondary exit paths compiled out | exact firmware behavior unobserved; SDK init-failure fallback still owns its separate `exit` path |
+| write firewall relies partly on link wrapping | integrity | VFS guard plus import/disassembly/callgraph audit | libc-internal behavior is not intercepted |
+| controller mapping differs from label conventions | operability | source-bound Options-to-SDL-Back-to-RetroArch-Select chain | on-device button observation absent |
+
+These are not brick-safety guarantees. A later operator must explicitly
+accept possible black screen, missing audio/input, process crash, lost
+jailbreak/host session, forced manual reboot after a hang, and no diagnostic
+after video teardown.
+
+The missing byte-exact Payload Manager backup remains a separate installation
+blocker. This candidate does not alter that gate because it is not an
+installation proposal.