Review 2 (mstan): psx_mod_read_* in a host-output hook now peek RAM /
scratchpad / BIOS ROM (psx_peek_word) and read MMIO as 0, so SIO data / stat
reads no longer pop RX or age the ACK. The CPUState copy's bus pointers are
replaced: reads peek, writes are dropped, so cpu->write_* cannot reach the
shared guest. psx_mod_call_guest_uncharged_counted clears *counted_cycles on
refusal. netplay_view_mods_test now runs the real sio.c behind the bus: the
host-output callback reads SIO_DATA / SIO_STAT through both the mod API and
cpu->read_*, and stores through cpu->write_* (RAM and SIO_CTRL); it checks 0
MMIO bus accesses, SIO stat / ctrl / RX unchanged, RAM unchanged. Other tests
linking mod_runtime.cpp get a psx_peek_word stub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review (mstan): a host-output callback could change the shared CPU (GPR2 set
to 0x12345678 survived an online psx_mod_function_entry). Each host-output
callback now gets a private CPUState copy whose changes are discarded, and
while one runs (psx_mod_host_output_scope) every guest-mutating mod service
refuses: memory writes, host_write_ram, call_guest*, DMA / SPU / VRAM
uploads, guest and GPU-DMA allocations, texture packet memory, the
cycle-scale gate and finish_function. netplay_view_mods_test reproduces the
review case (GPR2 + PC changed in the callback) and checks the shared CPU is
byte-identical after the hook; it fails without the copy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Matthew Stanley