Files
chimera-gfx-Public/docs/retroarch/phase-1.0d-loader-to-entry-analysis.md
Chimera GFX release export a6037502d7
phase0-ci / build-and-audit (push) Successful in 2m14s
Publish Chimera GFX source
2026-09-03 03:27:14 +02:00

56 lines
3.6 KiB
Markdown

# Phase 1.0D loader-to-entry analysis
Status: `RETROARCH_PS5_ENTRY_DIAGNOSTIC_LADDER_BUILT_OFFLINE`.
Nothing in this phase authorizes a PS5 connection, transfer, or execution.
## Source-bound path
The analysis binds hardened elfldr commit
`197623058f509eddde18868dafcb92fdcac66464`, SDK v0.41 commit
`d2e2e585740362976a39fdd5ccf390f199a7bc37`, and chimera-retroarch
commit `69b65858ffaee826d70f5c0df61013cd1b0e2048`.
| Order | Source operation | Observable marker | Failure status |
|---:|---|---|---|
| 1 | elfldr sanity checks the received buffer | none | host receipt and this check remain unobservable |
| 2 | elfldr reserves/copies segments, applies relative relocations and protections | none | allocation, mapping, copy, protection, or sync can fail |
| 3 | elfldr creates `payload_args_t`, saves a synthetic return at `RSP-8`, sets entry RIP and passes args in RDI | none | resource setup and register writes can fail |
| 4 | SDK `_start` clears BSS | none | loader/stack/entry correctness is still required |
| 5 | `payload_init` calls `__crt_syscall_init`, `__kernel_init`, `__klog_init`, resolves and sets `__isthreaded` | none | any failed setup returns before `main` |
| 6 | `__patch_init` changes current-process credentials/capability attributes and the permitted syscall-address range | none | exact runtime success and firmware-9.60 behavior are unproven |
| 7 | `__rtld_init`, dependency opening, relocation and init-array handling | none | a missing module/import or relocation failure can stop before `main` |
| 8 | canary `main` or RetroArch `main` | C1 or D00 | first Phase-1.0D visible boundary |
| 9 | profile body and bounded teardown | D01-D12 for early diagnostic | raw boundary result is retained in memory |
| 10 | `_Exit` selected by the profile | D12 precedes it in the early profile | device exit behavior remains unproven |
The earliest possible failure is therefore before `_start`: elfldr receipt,
validation, mapping, argument-resource construction, or register transfer.
After entry, the earliest application-independent failure is BSS/SDK CRT
initialization. Neither C1 nor D00 can distinguish those earlier steps.
## Loader and artifact effects
The existing loader itself performs process mapping, protection, ptrace-style
register operations, socket-overlap setup for the SDK argument resources, and
kernel/process changes in its broader execution path. The normal SDK CRT also
performs the bounded source-visible writes described above. Phase 1.0D does
not call any of this: it only builds and audits files offline. These effects
must not be described as harmless or absent in any later run authorization.
No SDK CRT or hardened elfldr source was modified. No freestanding startup was
introduced. Static model acceptance is not proof of transport, receipt,
execution, firmware compatibility, visible notification, or safe exit.
## Complexity comparison
| Artifact | Bytes | Entry | PHDRs / LOADs | Relocations | Imports | DT_NEEDED | BSS bytes | Largest LOAD memory |
|---|---:|---:|---:|---:|---:|---:|---:|---:|
| Phase-1.0B smoke | 1,826,216 | `0xfdd70` | 4 / 3 | 1,053 | 140 | 7 | 697,232 | 903,360 |
| CRT canary | 106,344 | `0x290` | 4 / 3 | 144 | 4 | 2 | 2,512 | 35,312 |
| early diagnostic | 1,844,664 | `0xfec40` | 4 / 3 | 1,054 | 141 | 7 | 697,616 | 903,744 |
| lifecycle reference | 112,680 | `0x90` | 4 / 3 | 142 | 2 | 2 | not used as a Phase-1.0D claim | not used as a Phase-1.0D claim |
The canary materially reduces size, imports, modules, and relocation volume.
The comparison can isolate classes of failure in a future authorized ladder;
it does not establish which class caused Phase 1.0C.