127 lines
6.9 KiB
Markdown
127 lines
6.9 KiB
Markdown
# Phase 1.0R: PS5 launch-context comparison
|
|
|
|
Status: `NO_SOURCE_PROVEN_LAUNCH_CONTEXT_FIX_TARGET_CHANGE_BLOCKED`
|
|
|
|
Date: 2026-07-22
|
|
|
|
This is an offline source, map, and provenance audit. It did not build target
|
|
code, connect to the PS5, transfer an artifact, receive a device result, or
|
|
execute anything on the PS5. Phase-1.0O authority remains consumed and every
|
|
authorization remains false.
|
|
|
|
## Question and evidence boundary
|
|
|
|
Phase 1.0O proved that the exact M artifact opened VideoOut, registered its
|
|
buffers, and received `-1` with saved errno `0` from the first
|
|
`sceVideoOutSubmitFlip(handle, 0, 1, 0)`. Phase 1.0R asks whether the raw
|
|
elfldr path differs, in a source-proven way relevant to that call, from the
|
|
launch context used by existing PS5 SDL ports.
|
|
|
|
The comparison is bounded to these exact clean source identities:
|
|
|
|
| Component | Commit | Relevant evidence |
|
|
|---|---|---|
|
|
| Chimera RetroArch | artifact source `12cf1d783c41eb303987e49a5a920805a59ef7a4`; inspected HEAD `606909706f91d7213751c245081333f56c2cce89` | `Makefile.ps5`; exact M map and artifact identities |
|
|
| PS5 Payload SDK | `d2e2e585740362976a39fdd5ccf390f199a7bc37` | `crt/crt.c`, `toolchain/prospero.mk` |
|
|
| PS5 SDL | `0baf4ac49382b537ba449901b5b6d0d189bb1fbb` | `src/main/ps5/SDL_ps5_main.c`, `src/video/ps5/SDL_ps5video.c` |
|
|
| hardened elfldr | `197623058f509eddde18868dafcb92fdcac66464` | `elfldr.c`, `socksrv.c` |
|
|
| controlled Payload Manager | `e23d94ff91233aa770e2342800c1467875bdef44` | `src/ps5_launcher.c`, `src/main.c` |
|
|
| PacBrew recipes | `c2abcfcb60f569128abd0e8e70ad03a67bee5ea7` | SDL2 and port recipes |
|
|
| LakeSnes reference | `a2db690123649c7ffbc68a663af31efb3a41bf3f` | `Makefile.prospero`, `main.c`, `homebrew.js`, `README.prospero` |
|
|
|
|
The official port archives retained from Phase 1.0Q are source references,
|
|
not deployed-artifact or on-device launch evidence.
|
|
|
|
## Exact compared paths
|
|
|
|
### Direct raw ELF and Payload Manager
|
|
|
|
The hardened elfldr listener sends every accepted raw ELF through
|
|
`payload_spawn()` in `socksrv.c`, then through `elfldr_spawn()` in `elfldr.c`.
|
|
That routine creates a process with `rfork_thread`, executes the system
|
|
`SceSpZeroConf` image, replaces its executable mapping under ptrace, and
|
|
detaches. The legacy route duplicates the accepted descriptor to standard
|
|
input/output/error; the controlled route changes standard-I/O and watchdog
|
|
policy. Neither route registers an application, title ID, flip owner, or
|
|
display context.
|
|
|
|
Payload Manager's `ps5_launch_elf()` reads the selected ELF and sends it to
|
|
loopback port 9021. It does not create a distinct payload process. Therefore
|
|
both a direct host send and a Payload Manager launch reach the same
|
|
`payload_spawn()`/`elfldr_spawn()` process constructor. Payload Manager does
|
|
contain separate LNC-based disc-player management, but that path is not the
|
|
ELF process constructor and is not evidence of payload display ownership.
|
|
|
|
### Exact RetroArch artifact
|
|
|
|
`Makefile.ps5` links `libSDL2.a`, but not `libSDL2main.a`. The exact M linker
|
|
map proves `_start` comes from SDK `crt1.o` and includes
|
|
`SDL_ps5video.c.o`. It contains no `SDL_ps5_main.c`, no `libSDL2main`, and no
|
|
`sceSystemServiceLoadExec`; it does import
|
|
`sceSystemServiceHideSplashScreen` through SDL video initialization.
|
|
|
|
SDK `_start(payload_args_t *)` initializes its runtime, invokes the ordinary
|
|
`main(argc, argv, environ)`, finalizes, and terminates according to the SDK
|
|
payload contract. The inspected CRT contains no application/title
|
|
registration and no LNC or VideoOut ownership setup.
|
|
|
|
### SDL2main ports
|
|
|
|
At the pinned SDL commit, PS5 SDL2main is only this lifecycle wrapper:
|
|
|
|
1. `sceSystemServiceHideSplashScreen()`;
|
|
2. `SDL_main(argc, argv)`;
|
|
3. after `SDL_main` returns, `sceSystemServiceLoadExec("exit", 0)`.
|
|
|
|
It contains no app registration, title-ID selection, LNC call, process
|
|
creation, VideoOut call, or flip-owner acquisition. The `LoadExec` operation
|
|
is post-return and cannot affect the first VideoOut submit.
|
|
|
|
The exact SDL PS5 `PS5_VideoInit()` independently calls
|
|
`sceSystemServiceHideSplashScreen()` immediately before
|
|
`sceVideoOutOpen(0xff, 0, 0, NULL)`. Consequently the tested RetroArch path
|
|
already performs the only SDL2main pre-entry action relevant by name before
|
|
opening VideoOut. Linking SDL2main would merely perform that call earlier and
|
|
again; no public source proves that this changes display ownership.
|
|
|
|
LakeSnes does link `-lSDL2main -lSceSystemService` and defines `SDL_main`.
|
|
Its `homebrew.js` returns an executable path and arguments, while its README
|
|
describes `hbldr` through `ps5-payload-shsrv`. These are launcher references,
|
|
not source for application registration. The exact `hbldr`/`shsrv` process
|
|
constructor and its active-app state were not present in this bounded source
|
|
set, so the launch-context relationship is `PARTIAL_UNBOUND`.
|
|
|
|
## Comparison matrix
|
|
|
|
| Property before first submit | Direct host to elfldr | Payload Manager to elfldr | SDL2main-linked port | Evidence result |
|
|
|---|---|---|---|---|
|
|
| process constructor | hardened `elfldr_spawn` | same hardened `elfldr_spawn` | launcher-dependent | first two proven same; port launcher unbound |
|
|
| SDK CRT | `crt1.o` | `crt1.o` | ordinarily `crt1.o` through `prospero.mk` | same SDK model in inspected builds |
|
|
| splash hide | SDL `VideoInit` | SDL `VideoInit` | wrapper plus SDL `VideoInit` | only proven pre-submit difference is earlier duplicate call |
|
|
| SDL application entry | ordinary RetroArch `main` | ordinary RetroArch `main` | wrapper calls `SDL_main` | symbol/lifecycle difference only |
|
|
| post-return exit | SDK termination | SDK termination | `LoadExec("exit")` before wrapper returns | post-submit lifecycle only |
|
|
| title/app registration | absent in inspected path | absent in ELF launch path | absent in SDL2main | no source-proven registration |
|
|
| flip/display ownership | absent in inspected path | absent in ELF launch path | absent in SDL2main | unproven everywhere |
|
|
| autoload or persistent setup | none in launch route | none required by ELF launch route | launcher-dependent | no evidence of a required fix |
|
|
|
|
## LNC log classification
|
|
|
|
Phase 1.0O ordinary stdout repeatedly included
|
|
`getAppStatus: LNC_ISOK::0x80940004`. It is
|
|
`OBSERVED_NONUNIQUE_CORRELATION`: the trace does not identify its caller,
|
|
multiple system-service/video activities can interleave, and public source
|
|
does not define that value as the cause of the flip failure. It is not a
|
|
root-cause verdict and does not justify adding LNC calls.
|
|
|
|
## Decision
|
|
|
|
`SDL2main` is not a source-proven launch-context correction. PacBrew is a
|
|
build/package repository, not a launcher. The official port metadata points
|
|
to launchers whose exact process/app/display setup remains unbound. The
|
|
possibility that active-app or launcher state matters therefore remains
|
|
plausible but unproven.
|
|
|
|
The root cause is unresolved. Do not link SDL2main as an experiment, add LNC
|
|
or SystemService calls, change submit parameters, call another VideoOut
|
|
export, build a target, or perform a device action under Phase 1.0R.
|