Skip to content

fix(libkernel): answer sceKernelGetModuleInfoFromAddr's flags and failures as measured on a PS5 - #10230

Merged
oneandonlydean merged 3 commits into
boykopovar:mainfrom
orezraey:fix/libkernel-module-info-from-addr-measured-ps5
Oct 24, 2026
Merged

oneandonlydean merged 3 commits into
boykopovar:mainfrom
orezraey:fix/libkernel-module-info-from-addr-measured-ps5

Conversation

@orezraey

@orezraey orezraey commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

What

sceKernelGetModuleInfoFromAddr measured on a retail PS5 (firmware 13.60) through libkernel_sys.sprx from a payload process, for flags -1 to 8, system-module, stack, heap, low and null addresses, and several input st_size values. The sources and console logs are in this gist (pmodinfo, pmodinfo2).

Case Console Before
flags 1 finds any module: libkernel_sys.sprx (id 1), libSceLibcInternal.sprx (id 2) throws
flags 2 on a system module ESRCH finds it
flags -1, 0, 3 to 8 clears the 0x1A8 bytes, EINVAL throws
any failure (ESRCH for a stack, heap or low address) clears the 0x1A8 bytes leaves the buffer
st_size on success, whatever was passed in (0, 0x160, 0x1A8, 0x10000) left 0 0x1A8
null info, flags 1 or 2 EFAULT EFAULT
null info, other flags faulted now throws

Flags 2 now refuses AnyPS5's host libraries, which stand in for the system modules, and still finds the main program and .guest.prx modules. Flags 2 finding a title module could not be measured, since a payload process has none. The two internal callers that look up any address, the Linux unwind lookup and the thread-destructor DSO lookup, now pass flags 1.

sceKernelInternalMemoryGetModuleSegmentInfo and sceKernelGetLibkernelTextLocation returned 0 with address and size 0 in the payload process. A title process may differ, so the code is unchanged and the debt entry records it.

#8658 and #9263 (macOS) touch the same function and debt lines; whichever lands second keeps both.

Tested

Windows 11, MinGW (winlibs).

  • guest_module_info checks EINVAL and the cleared buffer for flags -1, 0, 3, 4 and 8, a throw for a null info with flags 0, flags 1 and 2 on a system module's address (found, then ESRCH with a cleared buffer), flags 2 on the main program, and st_size 0. It fails on main and passes three runs in a row with the change.
  • The 84 module, TLS, unwind and libkernel_sys tests pass three runs in a row; guest_kernel_sys_module_internal and guest_force_tls_destructor were adjusted to pass flags 1 for host addresses.
  • Linux (WSL, GCC): guest_unwind_module_info_failure now expects flags 1 from the unwind lookup; it fails with the old expectation and passes three runs in a row with guest_module_info, guest_kernel_sys_module_internal and guest_force_tls_destructor.
  • Full suite: 1074 of 1075 pass; guest_kqueue fails intermittently on this machine with and without the change.
  • tools/check_conventions.py passes.

Checklist

  • Based on current main; no other open PR implements the same functions
  • One topic per PR; follow-ups go in a new PR
  • No comments in code except technical debt
  • Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
  • No notes, investigation .md files or images added to the repository (attach them to this PR)
  • New third-party code is a submodule built from source
  • Generic behaviour, not specific to one title
  • Depends on: none
  • Fixes: none
  • Unblocks: none
  • GPUs tested: n/a
  • AI-assisted: yes

orezraey and others added 2 commits October 23, 2026 11:49
…lures as measured on a PS5

Flags 1 finds any module and flags 2 only non-system ones; other flags return EINVAL instead of throwing, every failure clears the 0x1A8 bytes, and st_size is left 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request Conflicting files (lines on main) Same exports Same new files
PR 9263 docs/dev/debt/libkernel.md L46-47
PR 10552 core/libs/prx/libkernel/Module/src/ModuleInfo.cpp L400-402

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request Shared files not compared
PR 4630 docs/dev/debt/libkernel.md
PR 5021 core/libs/prx/libSceLibcInternal/Export.cpp
core/libs/prx/libkernel/Module/src/Module.cpp
core/libs/prx/libkernel/Module/src/ModuleInfo.cpp
docs/dev/debt/libkernel.md
PR 6044 core/libs/tests/GuestForceTlsDestructor.cpp
core/libs/tests/GuestModuleInfo.cpp
core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp
PR 6149 core/libs/prx/libkernel/Module/src/Module.cpp
docs/dev/debt/libkernel.md
PR 6740 docs/dev/debt/libkernel.md
PR 6830 docs/dev/debt/libkernel.md
PR 6936 docs/dev/debt/libkernel.md
PR 7088 docs/dev/debt/libkernel.md
PR 7090 docs/dev/debt/libkernel.md
PR 7105 docs/dev/debt/libkernel.md
PR 7121 docs/dev/debt/libkernel.md
PR 7149 docs/dev/debt/libkernel.md
PR 7201 core/libs/prx/libkernel/Module/src/Module.cpp
core/libs/prx/libkernel/Module/src/ModuleInfo.cpp
core/libs/tests/GuestModuleInfo.cpp
PR 7509 docs/dev/debt/libkernel.md
PR 7511 docs/dev/debt/libkernel.md
PR 8010 docs/dev/debt/libkernel.md
PR 8605 docs/dev/debt/libkernel.md
PR 9123 docs/dev/debt/libkernel.md
PR 9160 docs/dev/debt/libkernel.md
PR 9187 docs/dev/debt/libkernel.md
PR 9199 docs/dev/debt/libkernel.md
PR 9284 docs/dev/debt/libkernel.md
PR 9293 docs/dev/debt/libkernel.md
PR 9297 docs/dev/debt/libkernel.md
PR 9302 docs/dev/debt/libkernel.md
PR 9491 docs/dev/debt/libkernel.md
PR 9509 docs/dev/debt/libkernel.md
PR 9557 docs/dev/debt/libkernel.md
PR 9561 docs/dev/debt/libkernel.md
PR 9566 docs/dev/debt/libkernel.md
PR 9575 docs/dev/debt/libkernel.md
PR 9669 docs/dev/debt/libkernel.md
PR 9693 docs/dev/debt/libkernel.md
PR 9843 docs/dev/debt/libkernel.md
PR 9947 docs/dev/debt/libkernel.md
PR 10105 docs/dev/debt/libkernel.md

@oneandonlydean

Copy link
Copy Markdown
Collaborator

@orezraey Please keep the final checklist value to yes, removing the parenthetical suffix.

@orezraey

Copy link
Copy Markdown
Contributor Author

The AI-assisted line now reads yes.

@oneandonlydean

Copy link
Copy Markdown
Collaborator

@orezraey, a full CI run with this head (run 40072810060) fails one Linux test, guest_unwind_module_info_failure:

guest module lookup was not intercepted exactly once

This PR changes sceKernelGetModuleInfoForUnwind in Module.cpp to call sceKernelGetModuleInfoFromAddr(address, 1, &module) instead of flags 2. core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp interposes sceKernelGetModuleInfoFromAddr and requires flags == 2. With flags 1 its Require throws before ++calls, the throw is caught as the expected failure, and the count stays 0. The test passes on runs without this PR.

If flags 1 is the measured behaviour for the unwind path, please update that test's expectation (and the debt note if it describes the flags), otherwise keep 2 there. We'll rerun full CI on the new head.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@orezraey

Copy link
Copy Markdown
Contributor Author

Thanks for running it. Flags 1 is the measured lookup for any module (pmodinfo found libkernel_sys.sprx and libSceLibcInternal.sprx with it, while flags 2 gave ESRCH on them), so the unwind path keeps it and 2d27fbb changes GuestUnwindModuleInfoFailureLinux.cpp to expect flags 1. The debt note does not describe the flags, so it is unchanged. On Linux (WSL, GCC) guest_unwind_module_info_failure fails with the old expectation and passes with the new one, and it passes three runs in a row together with guest_module_info, guest_kernel_sys_module_internal and guest_force_tls_destructor.

@oneandonlydean
oneandonlydean merged commit 0fc488a into boykopovar:main Oct 24, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants