105 lines
5.1 KiB
Markdown
105 lines
5.1 KiB
Markdown
# Phase 1.0E inherited result channel
|
|
|
|
Status: **ONE-SHOT TEST CONSUMED; INCOMPLETE BEFORE D03; NO DEVICE ACTION AUTHORIZED**.
|
|
|
|
## Source-bound transport
|
|
|
|
Hardened elfldr commit `197623058f509eddde18868dafcb92fdcac66464`
|
|
provides a duplex channel only on its legacy raw-ELF route:
|
|
|
|
- `socksrv.c:335-339` invokes `elfldr_read` for raw ELF input;
|
|
- `elfldr.c:837-923` derives and reads the exact ELF extent, so socket EOF is
|
|
not the input framing contract;
|
|
- `socksrv.c:139-141` passes the accepted descriptor to `elfldr_spawn` for the
|
|
legacy route but passes `-1` for the controlled route;
|
|
- `elfldr.c:499-520` duplicates that descriptor to payload stdin, stdout and
|
|
stderr; and
|
|
- `socksrv.c:421-423` closes the parent copy only after spawn returns.
|
|
|
|
The Phase-1.0E profile therefore writes results to inherited stdout. It adds no
|
|
target-side `socket`, `connect`, `bind`, `listen`, `accept` or `recv`, no target
|
|
address or port, and no loader change. This finding does **not** apply to the
|
|
controlled route, whose `stdio=-1` contract remains intentionally outputless.
|
|
|
|
## Target frame and write behavior
|
|
|
|
After each first D00-D12 notification attempt, the target performs exactly one
|
|
nonblocking, signal-suppressed operation:
|
|
|
|
```c
|
|
send(STDOUT_FILENO, frame, 64, MSG_DONTWAIT | MSG_NOSIGNAL)
|
|
```
|
|
|
|
There is no send loop or retry. A short write or error is retained only in
|
|
process memory and cannot block the pre-existing notification/diagnostic path.
|
|
D11 and D12 are terminal frames. Each 64-byte big-endian frame contains magic
|
|
`CHD10E01`, version, size, strict sequence, stage, kind, flags, raw results,
|
|
notification result/masks, twenty zero bytes and CRC-32 over bytes 0-59.
|
|
|
|
## Host behavior
|
|
|
|
The host tool validates exact ELF size and SHA-256 before socket creation. It
|
|
then permits one connect, one `sendall`, one `shutdown(SHUT_WR)`, bounded
|
|
receive of at most 65,536 bytes, and one close. It never retries, reconnects,
|
|
resumes or overwrites an existing trace. The half-close ends only host-to-PS5
|
|
input; it leaves payload stdout readable on the same descriptor.
|
|
|
|
The parser rejects invalid magic/version/size, CRC, reserved bytes, stage,
|
|
kind, flags or sequence. EOF, timeout or the byte ceiling without a valid
|
|
terminal frame is incomplete evidence. A valid frame proves code output from
|
|
the transferred payload process on that connection; it does not prove safe
|
|
exit, loader cleanup or an unreported graphics boundary.
|
|
|
|
## Static artifact result
|
|
|
|
`retroarch_ps5_result_diag.elf` is 1,844,880 bytes with SHA-256
|
|
`1049c78099a60b472a3fb0e2999e3393b6ad76337a28532a7e53872e7772dedf`.
|
|
Two clean builds from chimera-retroarch commit
|
|
`b9fc037304a14199f35f8229edac26fa5c840509` produced byte-identical ELF and
|
|
map files. Compared with RUN B, the complete undefined-symbol set changes only
|
|
by adding `send`.
|
|
|
|
The ELF retains the ordinary SDK v0.41 CRT and Phase-1.0D SDL/VideoOut path.
|
|
Disassembly proves `_start` calls `__patch_init`; the statically linked CRT
|
|
contains its credential/capability and syscall-range helpers. Those bounded,
|
|
temporary runtime effects are not hidden or reclassified by this channel.
|
|
No RWX load segment, TLS or non-empty init/fini array exists.
|
|
|
|
## Consumed RUN C result
|
|
|
|
The exact one-shot permission was consumed on 2026-07-22. The host verified
|
|
the authorized 1,844,880-byte artifact before connecting, used one connection,
|
|
one `sendall` and one write-half-close, then received 3,413 bytes before remote
|
|
EOF. There was no retry, reconnect, parser error or timeout.
|
|
|
|
Three 64-byte frames validated: D00, D01 and D02 in strict sequence. D02's
|
|
`raw0=0` proves the bounded in-memory PS5 platform/frontend initialization
|
|
marks succeeded. The result channel itself is therefore proven on firmware
|
|
9.60 for those stages. No D03 or terminal frame arrived. Because D03 is the
|
|
first operation in `sdl2_gfx_init()`, this result does not prove entry into the
|
|
SDL video driver, SDL initialization, VideoOut, a flip, rendering, cleanup or
|
|
safe exit. Remote EOF is an observed transport boundary, not proof of normal
|
|
process return.
|
|
|
|
The ignored local trace is bound by size 1,795 and SHA-256
|
|
`4ff27a0eac48283cdc4c7ff964226def2689e808e3adea6594d0e77674a676f0`.
|
|
It is not committed because it contains the session address. All authorization
|
|
fields are false after this consumed attempt.
|
|
|
|
## Offline D02-to-D03 follow-up
|
|
|
|
Source inspection bounds the unobserved interval but does not identify a root
|
|
cause. After D02, RetroArch still performs synchronous content-load setup,
|
|
argument/config processing, driver selection, static-core/content init and the
|
|
entry into `drivers_init()`. D03 is the first instrumented operation in
|
|
`sdl2_gfx_init()`. Any earlier failure or external termination can therefore
|
|
produce the observed boundary.
|
|
|
|
Chimera-retroarch commit `f1391c3e6717ff4e2b869007fb9627c9edde52e4`
|
|
updates only the host receiver, its tests and documentation. Future traces can
|
|
retain the full bounded receive stream and non-frame stdout losslessly as
|
|
base64 with byte counts and SHA-256 values. The pre-encoding limit remains
|
|
65,536 bytes and trace creation remains exclusive. The client explicitly
|
|
rejects the consumed RUN-C state. No target code, target artifact, device
|
|
action or authorization was added.
|