Repository navigation
feat(relinker): support SSE guest GS memory accesses - #11689
Open
Felipebmaitan wants to merge 35 commits into
Open
Felipebmaitan wants to merge 35 commits into
Felipebmaitan wants to merge 35 commits into
Conversation
…ower of two ElfReader accepted any p_align on an executable's PT_LOAD, and on the uncovered PT_SCE_RELRO it turns into one, although the gABI says p_align should be 0, 1 or a power of two. When such a segment starts on a page that an earlier segment maps with other bytes, the Linux patcher pads the output one byte at a time to the next offset congruent to its address modulo that alignment: a 3221-byte executable with an alignment of 0xfffffffffffffffb ran for 46 s, reached 12.9 GiB and failed with std::bad_alloc. Both segments are now refused, as the reader already refuses a PT_TLS alignment that is not a power of two. The guest module reader takes its headers from the same function, so the power-of-two half of its own alignment check can no longer fail and is dropped; its offset congruence check stays. A power-of-two alignment still reaches the padding, which the relinker technical debt now records. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # docs/dev/debt/relinker.md
|
Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.
|
12 tasks done
# Conflicts: # core/relinker/relinker/tests/test_windows_guest_gs.py
12 tasks done
This was referenced Oct 30, 2026
11 of 12 tasks
Open
12 tasks done
This was referenced Oct 30, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Execute a bounded set of legacy SSE memory moves using the per-thread guest GS base on Windows: MOVUPS/MOVUPD, MOVAPS/MOVAPD, MOVDQU/MOVDQA, MOVSS/MOVSD, MOVD/MOVQ, and MOVLPS/MOVLPD/MOVHPS/MOVHPD. The relinker removes guest GS/addressing prefixes only after recording the original effective address, then replays the native operation through the existing protected GS frame. Native execution supplies the original transfer width, alignment checks, scalar zeroing, partial lanes, MXCSR and vector-state behavior. XMM4/XMM12 are vector operands, so they no longer hit the scalar SP/ESP/RSP refusal. Selected plain SSE memory followers of short scalar GS instructions also use replay without adding GS.
Unsupported SSE arithmetic/conversions, MMX, non-temporal moves, mixed/repeated mandatory prefixes, LOCK, VEX/EVEX/XOP and unmodeled forms retain the own-length UD2/NOP fallback; unused instructions do not block conversion. Precise FreeBSD signal delivery, debugger stepping, external context manipulation, self-modifying code and JIT code remain unsupported and recorded in existing debt. SSE2 is the x86-64 baseline; AVX is used only conditionally by tests to verify that legacy instructions preserve upper YMM state. This PR does not implement VEX guest-GS forms.
Depends on #11661 at bd67c1b, including its maintainer-requested short-borrowing fallback. Unsafe borrowed roots, branches, relocations and independently decoded GS/state streams preserve the original GS trap and following bytes, with no orphan replay records or GS runtime requirement. The prerequisite fix was made and validated on PR 3 before integration here. PR 4 adds executable/module SSE follower regressions, positive replay controls and comparison against ordinary relocated follower bytes.
Main remains the intended target. Incremental review: Felipebmaitan/AnyPS5@199f953...feat/windows-guest-gs-sse . The main-target diff includes the unmerged prerequisites; the SSE increment changes 11 files and adds no production runtime API. Merge order is #11624, #11090 and #10518 before #11628, then #11661, then this PR. #11276 is merged upstream. The final scan also flags #10861's existing debt-file conflict, inherited from the prerequisite baseline; this PR declares #10861 as an additional merge-order dependency, to land first and reconcile that debt when updating this branch. Its implementation is not copied into this PR and combined runtime behavior has not been validated. Exact prerequisite commits retain original authorship; no agreement with other authors is implied and no comments/messages were posted to them. Current main abed035 is an ancestor. Pre-existing dirty submodule work is excluded.
Both requested micro/macro adversarial reviews completed. Neither found a new SSE correctness defect. The micro review independently exercised 450 additional address cases, including absolute SIB and RBX/RSI as base/index aliases of the replay scratch register. The macro review independently executed a borrowed RIP-relative MOVUPS and confirmed complete Windows/native Linux output equality, then rechecked real-libc address/fault groups. Its integration concern about PR 3's requested fallback is fixed in the prerequisite and covered here.
Review propagation at
94e7acfc8513733960c91e5119680f4b35b2736a: inherited the scalar PR's new address-size execution coverage through the prerequisite stack. This layer already had the same four cases, so the guest-GS feature source/tests remain unchanged from its previously reviewed head. The immediate prerequisite is now199f953a4f26fe08b3a5bfb6267e76e72ad8396e. Current main b986c11 is an ancestor. After propagation, actual production libc/libkernel component builds and 15 Windows runtime/startup/relinker tests plus 14 Linux runtime/relinker tests passed; every selected test remained below 30 seconds. No console/title or performance verification is claimed; the documented full graphics/media build limitation remains.Collaborator integration follow-up at
60cd7a6c827922533ee28d036eefe6186e37bdbc: current main 20cfe35 is now an ancestor, including the merged #11090 entry-root protection (33b48ba). The immediate prerequisite is now339b7e0fd9bafe4bccbebb27777bb05752534b46, carrying #11624's removal of the two Windows FS refusal assertions. The production FS refusal and guest-GS behavior remain unchanged. The existing pre-patch GS entry-root checks and regression registration are retained. Fresh production libc/libkernel component builds passed on Windows and Linux/WSL, followed by 15 Windows and 14 Linux selected runtime/relinker checks; each completed within 30 seconds. #11090 and #11276 are merged upstream; #10518 and the remaining declared prerequisites still apply. No console/title or performance verification is claimed.Tested
Windows x86-64 with WinLibs GCC 15.2 UCRT; native Linux x86-64 under WSL (
imav-tao) with GCC 13.3. Synthetic native ISA and emitted executable/module fixtures only. No PS5, title, title-unblock or performance verification is claimed; no paired performance captures were performed.python tools/check_conventions.py --base origin/main, the public-header audit (368 libraries, 12369 exports), and whitespace checks passed. No new third-party code or submodule changes.Reproduce the SSE groups with
ctest --test-dir <relinker-build> -R '^windows_guest_gs_sse_' --output-on-failure; each group has a 30-second timeout. Full-build Windows testing additionally registerswindows_guest_gs_sse_runtime_*against the production libc andwindows_guest_gs_startupfor emitted program startup. Native Linux runs the same encoded fixtures with native GS set through arch_prctl; the Python test supports--digestfor comparison by case key.Maintenance validation (2026-10-29): exact head
7f992f4931a6bcf3b1e255d3b9a06c164ea79751, including main1189ec3003672bb364dd9f3119ead7b3976e3c83. Complete production libc/libkernel component builds and 23 selected Windows / 14 Linux/WSL runtime/relinker checks passed independently for this layer, each under 30 seconds. Conventions passed against origin/main. Linux follow-up layers used immutable commit snapshots and separate native WSL build outputs. Full graphics/media configuration remains blocked by missing SDL2/FFmpeg sources; no PS5, title or speed verification. Maintainer changes are preserved.Checklist
main; no other open PR implements the same functionsNotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file.mdfiles or images added to the repository (attach them to this PR)Live overlap scan and manual comparison limits
python tools/pr_overlap.py --branch feat/windows-guest-gs-ssecompleted before opening. The scan's incomplete comparisons are retained below; they are not a claim that all open PR combinations were validated. For the SSE increment relative to #11661, file-level three-way checks covered 13 shared files across seven PRs that the initial scan could not compare: #5021, #6713, #10861, #10970, #10983, #11107 and #11366. No new file-level conflict was introduced beyond #11661's baseline. Existing CMake/debt conflicts remain in stale combinations; no combined-runtime validation of those branches was performed. #10861's source changes merge at file level; the final scan now reports its pre-existing debt conflict directly. It is declared above as a merge-order dependency, rather than claiming the overlap is clear.Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.
main)docs/dev/debt/relinker.mdL29-31, L36-37Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.
core/libs/prx/libkernel/Pthread/src/Thread.cppcore/libs/prx/libkernel/Pthread/src/Thread.cppcore/libs/prx/libkernel/System/src/Exception.cppdocs/dev/debt/libkernel.mdcore/libs/prx/libc/CMakeLists.txtcore/libs/prx/libkernel/Pthread/src/Thread.cppcore/libs/prx/libkernel/System/src/Exception.cppcore/libs/prx/libkernel/System/src/Process.cppcore/relinker/CMakeLists.txtdocs/dev/debt/libc.mddocs/dev/debt/libkernel.mddocs/dev/debt/relinker.mddocs/dev/debt/libkernel.mdcore/libs/prx/libc/CMakeLists.txtcore/relinker/CMakeLists.txtcore/relinker/elfpatcher/src/windows/WindowsPePatcher.cppdocs/dev/debt/libc.mddocs/dev/debt/libkernel.mdcore/libs/prx/libc/CMakeLists.txtdocs/dev/debt/libc.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mdcore/libs/prx/libkernel/Pthread/src/Thread.cppdocs/dev/debt/libkernel.mdcore/libs/prx/libc/src/specifics/windows/CrashReport.cppcore/libs/prx/libkernel/System/src/Exception.cppdocs/dev/debt/libkernel.mdcore/libs/prx/libc/CMakeLists.txtcore/libs/prx/libkernel/Pthread/src/Thread.cppcore/libs/prx/libkernel/System/src/Exception.cppcore/libs/prx/libkernel/System/src/Process.cppdocs/dev/debt/libc.mdcore/libs/prx/libc/CMakeLists.txtdocs/dev/debt/libc.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libc.mddocs/dev/debt/libc.mdcore/libs/prx/libc/CMakeLists.txtdocs/dev/debt/libc.mdcore/libs/prx/libkernel/Pthread/src/Thread.cppcore/libs/prx/libkernel/System/src/Process.cppdocs/dev/debt/libkernel.mdcore/libs/prx/libc/CMakeLists.txtcore/libs/prx/libc/CMakeLists.txtdocs/dev/debt/libc.mdcore/libs/prx/libkernel/Pthread/src/Thread.cppcore/libs/prx/libkernel/System/src/Exception.cppdocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mdcore/libs/prx/libkernel/System/src/Process.cppdocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libc.mddocs/dev/debt/libkernel.mddocs/dev/debt/libc.mddocs/dev/debt/libkernel.mddocs/dev/debt/libc.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mdcore/libs/prx/libc/CMakeLists.txtcore/libs/prx/libc/CMakeLists.txtcore/libs/prx/libkernel/System/src/Process.cppdocs/dev/debt/libc.mddocs/dev/debt/libkernel.mddocs/dev/debt/libc.mddocs/dev/debt/libkernel.mddocs/dev/debt/libc.mddocs/dev/debt/libkernel.mdcore/libs/prx/libc/CMakeLists.txtdocs/dev/debt/libc.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libc.mddocs/dev/debt/libkernel.mdcore/relinker/CMakeLists.txtdocs/dev/debt/relinker.mdcore/relinker/CMakeLists.txtdocs/dev/debt/relinker.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mdcore/relinker/CMakeLists.txtdocs/dev/debt/relinker.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libkernel.mddocs/dev/debt/libc.mdcore/libs/prx/libkernel/System/src/Process.cppdocs/dev/debt/libc.mddocs/dev/debt/libkernel.mdcore/relinker/CMakeLists.txt