mirror of
https://github.com/Pharaoh2k/ps5debug-NG.git
synced 2026-10-22 11:53:13 -05:00
Pharaoh2k
43f715975d
proc_alloc hijacks an arbitrary game thread and single-steps it through mmap;
if that thread holds a non-sleeping kernel lock, the step's copyin trips the
kernel WITNESS ("copyin: eboot.bin has nonsleeping lock") and crashes the game.
Concurrent hammering accumulates and makes it near-certain.
Serve plain allocations from a per-pid 16MB arena: one hijacking mmap per
segment, then zero-hijack sub-allocation with free-list recycling. This cuts
hijacks from thousands to about one. Default on and transparent to clients
(same wire, valid target addresses); a freed sub-block is recycled rather than
munmap'd and reclaimed when the game exits. Hinted allocations (which need a
specific address) pass straight through. Cap the real-alloc retry storm from
100 to 5. Runtime toggle via raw literal 0xBDAACC24.
HW-validated on FW 4.51: procalloc_stress 3 conns x 2000 iters (6000 cycles)
completes with the game alive (previously a reliable crash at 6-120 hijacks);
smoke 18/18 green.