Why: Thread-atexit registrations were discarded, leaving objects alive after their guest TLS storage was released.
What: Store registrations per host thread and run them in LIFO order before pthread keys and guest TLS are destroyed.
Why safe: Only callbacks registered on the exiting thread run, once, before existing teardown continues.
* Sampler dword 3 only matters when a clamp mode uses border color
(values >= 4). When no border mode is active, dword 3 is unused
but can still vary across loop iterations due to wave-lane spills.
This makes resource tracking think the descriptor is dynamic and
fail with "unsupported GPU selection".
* Fix by zeroing dword 3 when all clamp modes are non-border.
Signed-off-by: Claxten <claxten10@gmail.com>
fix(cmake): anchor the macOS guest address space for all full-emulator tests
Every target created by add_kyty_full_emulator_test links against the
full kyty_emulator sources, so it drags in the same 620 GiB .zerofill
guest address space segments as the emulator itself. Only the emulator
target and virtual_memory_allocation_tests had the linker flags that
anchor those segments; every other full-emulator test target got the
segments without the anchoring, and the kernel killed them on exec
(posix_spawn EIO / SIGKILL) before main() ever ran.
Move the configure_macos_guest_address_space() call into
add_kyty_full_emulator_test() itself so every target it creates gets
it automatically, and drop the now-redundant explicit call on
virtual_memory_allocation_tests.
* fix: keep hint-less guest mappings at the canonical PS5 base
FindGuestFreeRange searched the low system-managed range first for
mappings with no address hint, so the first hint-less direct-memory map
could land as low as 0x200000. The PS5 kernel never places hint-less
user mappings below 0x200000000 and guest code relies on that: Sony's
libc maps 4 MiB of direct memory for its internal heap, fails its
mspace setup when the returned address is that low, and the first
malloc then dereferences a null mspace (a read at 0x38, the mspace
magic check). On macOS this made Raiden III crash on the main guest
thread a couple of seconds after boot, 100 percent reproducible with
--printf-direction Silent.
Search from the canonical base first, fall back to the user range, and
keep the low system-managed range only as a last resort. The mmap path
already anchored hint-less searches at 0x200000000; this aligns the
shared search helper with it.
Adds two regression tests: the libc-shaped allocation must come back at
or above the canonical base and hold writes, and direct-memory content
must survive an unmap and remap of the same physical range.
* macos: make the fatal-report memory dumps fault-safe
IsReadableRange returned true for any nonzero address on macOS, so the
fatal report's guest memory dumps dereferenced whatever the crashed
thread had in its registers. A fault inside the reporter re-enters the
signal handler and wedges the reporting thread, which hid real guest
crashes whenever logging was enabled: the game kept running with a dead
thread and the report was never completed.
Walk the Mach regions covering the range and require read permission
before dumping, the same contract the Linux implementation provides.
* do not fallthrough HOST_SYSTEM_MANAGED_MIN
---------
Co-authored-by: nmzik <Nmzik@mail.ru>
* A one-dword type-2 NOP is a valid packet tail. Parse it normally instead of aborting command-buffer dumps.
Signed-off-by: Claxten <claxten10@gmail.com>
The README had macOS badges and an experimental-support note but no build,
run, or system-requirement information for the platform. Document the
Rosetta 2 / MoltenVK setup, the x86-64 configure invocation, the Qt
universal-build requirement, MoltenVK installation and signing, and the
SDL_VULKAN_LIBRARY variable needed at run time.
macos: enable guest signal dispatch on the target thread
The POSIX signal-dispatch path (pthread_kill based, added with the Linux
port) was compiled out on macOS, leaving KernelRaiseException to run the
guest handler on the calling thread. IL2CPP's garbage collector raises its
stop-the-world signal at every managed thread and each handler parks its
own thread until resume, so the collector parked itself and every Unity
title froze on the first collection.
Enable the same delivery path on macOS:
- translate between the Darwin mcontext (uc_mcontext->__ss) and the guest
ucontext in CreateSignalUcontextFromHost/ApplySignalUcontextToHost
- use SIGUSR1 as the host dispatch signal (macOS has no realtime signals)
- block the dispatch signal inside the host fault handler so a suspend
request cannot preempt fault resolution between the protection fix and
the retry
Windows and Linux are unchanged.
src: platform: Linux: Drop redundant PROT_NONE tracking in reserve paths
* Some UE4 games, such as The Pathless, reserve a 512 GiB virtual address range during libc startup.
Tracking every 4 KiB page causes a long delay and is unnecessary since the range is already PROT_NONE,
and untracked pages are treated as NoAccess.
Signed-off-by: Claxten <claxten10@gmail.com>
