Comments are reserved for technical debt (docs/dev/TechnicalDebt.md), so
the ones the previous commit added to the recorder, the snapshot keep and
the tests go.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HZHkb8kUwnHAuBBbHywvJf
A ShaderResources from the resource caches is the same object for every
draw or dispatch that uses it, and Recorder::ReusableDrawSnapshot hands
the next draw the same snapshot buffer, so passing their bytes with each
Keep counted one allocation once per use and submitted the batch before
it held the budget. Recorder::KeepBytes counts an owner's bytes once per
batch, and the dispatch, draw and snapshot keeps use it.
The recorded kept bytes test runs a dispatch and a draw that copy a
guest buffer and two draws that snapshot one on the device, and fails
when any of the three sites stops counting or a reused snapshot counts
twice. The BdaResources check pins the copied region it sets up.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HZHkb8kUwnHAuBBbHywvJf
The recorder bounds the bytes a batch keeps alive (KeptBytesBudget) and
waits for older batches past twice that. A recorded dispatch or draw kept
its ShaderResources, and a draw its snapshot buffers, with a size of 0, so
the host-visible copies of guest buffers they own never counted. A title
that binds a 124 MiB writable guest buffer in every draw then held about
ninety copies, 11 GB, until the GPU caught up, and aborted with
VK_ERROR_OUT_OF_HOST_MEMORY from vkAllocateMemory.
GuestBufferMemory reports the bytes of its copied regions, and the
dispatch and draw keeps and the draw snapshots pass their bytes to
Recorder::Keep, so the existing bound applies to them.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The registry calls an observer on the mapping thread, after the registry
lock is released, with the ranges a kernel mapping gave GPU access:
direct and flexible maps with it, and fixed remaps with it over a
registered range (a reservation). The mutation looks them up while it
still holds the lock and hands them over weakly, with the registry
generation it ended at, so the observer does not keep a range alive.
The driver imports those ranges on its current device, so an
address-based build finds the import instead of pinning the memory on
the queue that first uses it. A range that gains GPU access through
sceKernelMprotect, and AnyPS5's own libc heap, are still imported on
first use.
The import at map does not reconcile the other imports with the
registry, so its cost does not grow with the number of imports. It skips
a range that is gone, and any range when the imports were reconciled
with a newer registry since; the next lookup imports those as before.
It installs the pin waiter as the other import paths do, so unmapping a
range imported at map retires its import. The live import bytes are kept as a
running total instead of being summed over every import. Once the import
table belongs to the current device the import takes only the table's
lock; the first import on a device (which runs the write-watch probe)
and a device that was just replaced go through the GPU lock. Clearing
the observer waits for calls already running.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ProsperoRadio (PPSA99001) imports six sceOpusCeltDec functions from
libSceOpusCeltDec and fails to load because no such module exists. It
opens this decoder only as a fallback when libSceOpusDec reports a
retryable error for a CELT packet, which libSceOpusDec here never
returns, so the module is exported without an implementation and each
function throws if it is called, as for sceSaveDataCancel.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Measured on RDNA2 (gfx1035) in review:
- the shared and private apertures are 4 GB windows (the gfx9+ layout of kfd_flat_memory.c), so a flat
address routes by its whole high dword, 0x80000000 or 0x70000000, not by its top 16 bits;
- a dword or short access whose last byte is past the end of LDS reads 0 or writes nothing as a whole;
multi-dword accesses are checked per dword.
The aperture test gets rows that straddle and pass the end of LDS; the TechnicalDebt line names the
public source of the layout and keeps only the PS5's base values as inferred.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Main's StoreAddressU32x2..x4 (one BDA lookup per wide store, b95842597) bypassed the aperture routing:
a flat_store_dwordx2 into the shared aperture went to BDA at 0x8000000000000000 and LDS kept its old
value. The wide store now stores each component through the aperture like the 32-bit store, and keeps
the single BDA lookup outside the apertures.
The aperture test's V# word 3 is 0x31016fac (OOB_SELECT 3, raw), as in main's other execution tests:
with OOB_SELECT 0 its output buffer read as out of range after #639, which was the failure reported on
four drivers.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sub-dword stores and unaligned dword accesses go byte-wise; 32- and 64-bit FLAT atomics
route to LDS (64-bit under the workgroup lock), scratch (read-modify-write) or BDA.
agc_driver_flat_apertures covers them in 121 rows, with mixed-address waves and wave64.
The aperture bases and the unmodelled operands 235-238 are listed as inferred.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A compute FLAT access whose address has the console's shared aperture in its high dword (0x8000xxxx)
reads or writes the workgroup's LDS at its low dword, and one in the private aperture (0x7000xxxx)
the lane's scratch; other addresses stay guest memory through BDA. GTA V's ray traversal keeps its
stack in LDS and spills it to scratch through such addresses; treated as guest memory the pushes were
lost and the traversal never ended (device lost). An execution test round-trips both apertures.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
v_cvt_f32_i32 and v_cvt_f32_u32 used the host Convert which always
rounds to nearest even. When FLOAT_MODE bits 1:0 are directed, build
the f32 bits from the integer magnitude so discarded low bits follow
round toward +inf, -inf or zero, as measured on RDNA2 (gfx1036).
Co-Authored-By: Composer <noreply@cursor.com>
Twenty-five of the ninety-seven errno messages differed from FreeBSD releng/11.4 lib/libc/gen/errlst.c (for example errno 0, 30, 47, 62, 70 and 84).
(cherry picked from commit ce14c9ad7dc639335ff72b60122bae2bd0fee302)
Directed FLOAT_MODE modes for v_cvt_f16_f32, v_cvt_f16_i16,
v_cvt_f16_u16 and v_ldexp_f16 were ignored, so results stayed
round-to-nearest-even. Hardware uses FLOAT_MODE bits 3:2 (round16);
the directed path runs only when f16 denormals are preserved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
v_interp_p1_f32_e64, v_interp_p2_f32_e64 and v_interp_mov_f32_e64
(VOP3Interp opcodes 0x200, 0x201 and 0x202) reach the decoder as VOP3
and were refused as unimplemented VOP3 opcodes. Decode them into the
existing VInterpP1F32, VInterpP2F32 and VInterpMovF32 opcodes with the
VOP3Interp operand layout, so the interpolation translation already
used by the VINTRP encodings handles them.
Encodings and operand layout follow LLVM's gfx10 MC tests for
VOP3Interp_Real_gfx10 (D69348). The interpolation parameter is the low
six bits of src0, the channel bits 6:7, the coordinate (or the
interpolation parameter of the mov form) is src1, and clamp and omod
reach the destination. op_sel, the packed-half selector, a third source
and abs/neg on operands that do not exist throw.
The mesh stage was compiled at the driver's default subgroup width, while the translated mesh program lays wave64 lanes out on, and ballots over, a 32-lane host subgroup. Intel's Windows driver (Arrow Lake, 32.0.101.8991) reports subgroupSize 32 but prefers 16 for mesh shaders, and every agc_driver_mesh draw drew no triangle there. The mesh stage now gets VkPipelineShaderStageRequiredSubgroupSizeCreateInfo{32} when the program's hostSubgroupSize is 32 and the device lists the mesh stage in requiredSubgroupSizeStages, as compute pipelines already do.
Scalar f16 add/mul/sub ignore FLOAT_MODE denorm16 flush bits on main.
Flush inputs when bit 0 is clear and results when bit 1 is clear at
nearest-even. Multiply checks tininess after 11-bit rounding
(0x387ff000); add/sub use 0x38800000.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep WAIT_REG_MEM diagnostic timeouts from completing unsatisfied waits.
Register the existing gated-dispatch capture test with a 1ms diagnostic
timeout and document the missing-producer limitation.
sceSystemServiceParamGetInt always reported English (United States) as
the console language, so a title that follows the console's language,
such as Jelly5 (PPSA99505) with its Arabic text, can only show English.
ANYPS5_LANGUAGE now selects a console language number from 0 to 30
(21 is Arabic). Unset or empty keeps English (United States); any other
value throws at the language query instead of being ignored.
(cherry picked from commit 9bcf196daa01b07a22be876a7f1143149503e054)
Submit the same vertex and pixel draw twice through the driver and
require the second one to hit the draw cache, with graphics pipeline
libraries and with APS5_NO_GPL=1. With pipeline libraries the pixel
stage is cached at its fixed push slot, so a lookup at the stacked
offset misses every draw on its layout. The driver exposes a copy of
its draw-cache counters for the test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AI-assisted: yes. Return AnyPS5 without reading the native machine name, hostname environment or network configuration. Preserve FreeBSD bounded-copy behavior, guest ENAMETOOLONG, null queries and success errno. The final tree passes a complete Windows Release build and guest_hostname/guest_errors repeated five times each on main 5edae3536. No new Linux or title test is claimed.
AI-assisted: yes. Verify AnyPS5 rather than the native PC hostname. Cover buffer capacities, guard bytes, maximum size_t capacity, null queries, success errno and thread-local isolation. The old implementation fails this regression; the final fixed tree passes the complete Windows build and five repeated runs each of guest_hostname and guest_errors on main 5edae3536. Linux and title tests of this new revision are pending.
AI-assisted: yes. Moves hostname test registration to avoid #2170 overlap. The full current-main build and focused Windows tests pass; implementation and test source are unchanged.
AI-assisted: yes. Add a deterministic backend that overwrites errno on success; verify restoration on success and retained failure errors. Extend native tests for current-time errno preservation. The new regression fails on original ca87abb and passes with this fix.
AI-assisted: yes. Restore guest errno only on successful utimes forwarding and retain delegated failure errors. Register the controlled-backend regression test. Windows library build and focused tests pass; Linux rerun pending.
PPSA11386 calls sceSharePlayInitialize(NULL, 0x1800) at start-up and stops
on any non-zero result, so the console accepts a null heap. The library
keeps no state and does not use the heap; a zero size still throws, as its
error is unknown. libSceSharePlay gets its own CMakeLists for the test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An NGG passthrough program on the vertex path whose s_barrier only orders wave 0's GS_ALLOC_REQ produced a workgroup OpControlBarrier, which the Vertex execution model does not allow; SPIR-V validation rejected the module at the program's first draw. In a Vertex-stage program the barrier now emits nothing when the program has no LDS or GDS access and no memory write or atomic, so no wave can observe another. With any of those it throws.
A comparison sample with a 2D-array address on a plain 2D color T# takes the emulated comparison, whose runtime modes were only the 2D-array and cube ones. No mode matched, and materialization threw that the image descriptor was incompatible with the static runtime image interface. The emulated comparison now also gets a 2D mode, as the native modes of a 2D-array access already have; the slice is ignored.
Resize drained the device before reading the surface extent, so a drawable
size that never matches the surface, as with fractional scaling, drained it
on every present.
(cherry picked from commit b4aae246766a108f78cd9ad29d7c874ea036d481)
Export it next to remainderf, stepping to the adjacent float in the
direction of the second argument.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Export it next to lroundf and llround, rounding halfway cases away
from zero into the 64-bit guest long long.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both parse like strtol and strtoll in base 10. The guest long is 64
bits wide on every host, so atol uses strtoll rather than the host
atol, whose long is 32 bits on Windows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Export the double version next to __isnan and __isfinite, returning
1 for either infinity like __isinff.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PokeMMO Prospero (PPSA98001) stops at siglongjmp (pebqbE5ws8s) from
libkernel. The title links its own FreeBSD sigsetjmp, so siglongjmp
follows FreeBSD's amd64 __siglongjmp and its sigjmp_buf layout: when the
save-mask flag at offset 88 is set it restores the mask saved at 72
through _sigprocmask, then reloads rbx, rsp, rbp, r12-r15 and the x87
control word and returns to the saved address with val, or 1 for 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The ternary forms share minMaxF16 with v_min_f16 and v_max_f16 and follow
the same rule on gfx1036: a subnormal half input becomes a signed zero when
bit 0 of the f16 denormal field is clear, at IEEE=0 and IEEE=1.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With graphics pipeline libraries a draw places the pixel shader's push
constants at the fixed fragment slot (Graphics::StagePushOffset) and the
draw cache records that offset, but lookupDraw still expected the stacked
offset after the vertex shader's push bytes. Every pixel stage then missed
as a layout mismatch, so no cached draw or draw recipe was reused and each
draw was captured and materialized again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FreeBSD's unlink ignores the file's own permission bits, so it succeeds
on a file the guest made read-only with chmod(0400). On Windows the guest
chmod sets the read-only attribute and _wunlink then failed with EACCES,
which sceKernelUnlink and unlink reported. When the path is a regular file
without write permission, make it writable before the single _wunlink and
restore the read-only attribute if the unlink fails, as remove() does
since #2342.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The mutex attribute now keeps its protocol and priority ceiling the way
FreeBSD's libthr does: the ceiling can be set and read only under
PTHREAD_PRIO_PROTECT (EINVAL otherwise), and setting a protocol resets it
to the highest SCHED_RR priority. Mutexes still do not apply priority
protection; that is listed as a silent stub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit d10c024f8fdbcdfced0187550f272333264f07df)
A map without MAP_FIXED whose hint lies wholly inside a range still
reserved by sceKernelReserveVirtualRange is placed at the hint, as a fixed
map into the reservation would be. Hints outside reservations and ranges
that are partly mapped keep their hint behaviour. The reservation is
checked under the registry mutation, so it cannot be released and its
address reused between the check and the map (MarcZX100, #2687).
Fixes#2687
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2cY3SsTYnh4u4ZtEr2Adx
Unity reuses the memory of transient render targets: in FPV Simulator
(PPSA10698) an RGBA8 1920x1080 color texture is sampled at the address
that a D32S8 surface's stencil plane occupied earlier. The lookup found
the stencil plane and threw "sampling the stencil plane ... is not
implemented", which ended the presentation.
9d65003c made depth-plane views in a format that cannot hold the plane
fall through to the ordinary texture path. A stencil-plane view whose
texels are not one byte wide cannot hold the 8-bit stencil plane
either, so it now falls through the same way.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Registration prepares the variants a shader's registered state
predicts; a draw or dispatch whose state needs another one threw
"prepared shader artifact is missing for the requested static ABI".
Titles that link their own libSceAgc build that state themselves and
never call the driver's static ABI resolution, so their draws differ
from the registered prediction. The missing artifact is now prepared at use, logged, and kept
with the snapshot like the deferred and null pixel cases. SourceHandleFor
now checks that the request refers to the registered code, as
InvocationFor already did.
Uncharted: Legacy of Thieves Collection (PPSA05684) still misses on
main 197ffac9 (after the fixed push slots of #2661) for its own pixel
shaders: "prepared shader artifact is missing for the requested static
ABI: address=85899411712 stage=5 wave=64 pushOffset=128
pushCapacity=128".
sceVoiceSetMuteFlag was NotImplemented with an unknown signature and
sceVoiceGetMuteFlag was not exported. Signatures follow shadPS4's
voice.h: a port id and a bool, and for sceVoiceGetMuteFlag a port id
and a bool pointer. The flag is stored per port like the volume; an
unknown port throws and a null output pointer is an invalid argument.
Uncharted: Legacy of Thieves Collection (PPSA05684) imports
sceVoiceGetMuteFlag (Pc4z1QjForU), so on main it stops at startup with
"undefined symbol: Pc4z1QjForU".
CB_COLOR_INFO COMP_SWAP 1 (SWAP_ALT) on a two-channel format stores the
x and w exports in its two channels (Mesa si_translate_colorswap,
"X__Y"). COLOR_8_8 UNORM and SNORM targets with it bind as R8G8 with
export mapping 0xec; blending into them still throws, since Vulkan
would apply alpha factors to the wrong channel.
Uncharted: Legacy of Thieves Collection (PPSA05684) stopped in its
first level with "unsupported color format 3 number type 0 component
swap 1".
The specialization pass turned OpCompositeConstruct of extracts from one
composite into OpVectorShuffle without checking the types. When the
source is a struct (the {uint, uint} pairs of extended multiplies and
phis of them), the result is invalid SPIR-V ("The type of Vector 1 must
be a vector type"), which the NVIDIA driver (615.71.09) crashes on in
vkCreateGraphicsPipelines instead of rejecting. The fold now requires
both the source and the result to be vector types; a test builds the
struct and vector cases by hand.
Uncharted: Legacy of Thieves Collection (PPSA05684) crashed in the
driver's SPIR-V compiler right after loading its first level.
sceAvPlayerAddSource queues an auto start for a player created with auto
start or without an event callback. When the title enabled its streams
and called sceAvPlayerStart before the controller thread ran it, the auto
start called Start again on the playing player, which stopped it, released
every video buffer, including the frame the title held, and started the
film over. guest_avplayer occasionally caught this as "video frame is not
a texture allocation"; right after the test's own start, 8 texture
buffers were released in 15 of 15 runs.
The auto start now starts the player only while it is still ready, and
checks that under the player lock together with the start.
TestAutoStartKeepsStartedPlayback starts a callback-less player itself and
checks that no texture buffer is released afterwards and that the frame
it holds stays allocated. It fails on every run without the fix.
v_div_fmas_f32 always quieted source NaNs and let a NaN addend
hide the default NaN from an invalid product. Reuse the existing
bit selection helpers, measured on gfx1036 in four float modes.
Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
RDNA2 min/max flush half inputs to signed zero when input
preservation is disabled, while output flushing alone keeps them.
Apply this to the measured binary forms and pin the hardware rows.
Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
The background link-time-optimized link used the Pipeline's own layout, which ~Pipeline destroys right after marking the slot released, and ClearCachedPipelines destroys the cached pipelines before ClearPipelineLibraries waits for pending links. A link already past the released check then created its pipeline with a destroyed VkPipelineLayout. On Intel's Windows driver (Arrow Lake iGPU, 32.0.101.8991) agc_driver_vertex_fetch, agc_driver_pixel_interlock and agc_driver_mesh faulted inside igc-default64.dll every run, and agc_driver_prepared_exports and agc_driver_pixel_barycentric_emulation intermittently; all passed with APS5_NO_PIPELINE_LTO=1. The library store's layout, made from the same create info and used for the libraries, lives until ClearPipelineLibraries has waited for the pending links.
(cherry picked from commit 758eeb9fb255d88c41945b299dc3ec5ac1578331)
Validate timeout arguments and track live requests so unknown or deleted
ids return REQUEST_NOT_FOUND. This supplies the remaining absent load
import alongside the dialog Close export; timeouts follow the existing
offline network model and are not stored.
Co-Authored-By: GPT-6.1-sol <noreply@openai.com>
Eager binding fails when a caller imports sceG2PDialogClose.
Add the missing throwing stub alongside the existing G2P exports
and record the assumed Close signature in TechnicalDebt.
Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
sceAjmBatchJobDecodeSplit queues a split run job with the stream
sideband, as sceAjmBatchJobDecode does for a single buffer pair.
sceAjmBatchJobSetResampleParametersEx with a zero ratio change per
sample sets the ratio as sceAjmBatchJobSetResampleParameters does; a
non-zero change throws, since its ramp is unknown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Measure the mixed f16/f32 boundary on gfx1036 and pin both factor
slots, half selection, signs and zero f16 addends in the existing test.
Record this measured scope while keeping legacy mad/mac unchanged.
Co-Authored-By: Codex gpt-6.1-sol <noreply@openai.com>
With f32 denormals flushed, RDNA2 flushes a product only when its value
rounded to 24 bits in the current round mode is below 2^-126. The
tiny-product check tested the exact product, so products that round up
to 2^-126 became zero in v_mul_f32, v_mul_legacy_f32, v_mullit_f32 and
zero-addend f32 FMAs. The separately rounded v_mad_legacy_f32 and
v_mac_legacy_f32 keep the exact check, as they are not measured there.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
v_cvt_f16_u16 SDWA only accepted word and dword source selects. Silent
Hill Townfall (PPSA33286) converts the top byte into the low half of a register
and keeps the high half (src0_sel:BYTE_3 dst_sel:WORD_0
dst_unused:UNUSED_PRESERVE), so its shaders failed to recompile. The
generic SDWA source path already zero-extends byte selects, which is the
u16 value the conversion expects, so the rule now accepts every source
select, with whole and partial destinations.
agc_driver_sdwa_cvt_f16_u16 runs four byte selects with dword, WORD_0
and WORD_1 destinations on the GPU and checks the converted halves and
the preserved bits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit d55dfe8b33c6ee418f40a92e49236f8679a6470b)
A guest path whose bytes the host cannot convert to a native path made
ResolvePath throw std::filesystem::filesystem_error, which aborted the
process. No file can have such a name on the host, so stat reports
ENOENT, as for any other missing file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
VLC (PPSA85300) imports execvp (0NJDcQ2B8vE) from libkernel and fails
to load because no library exports it. Replacing the process image is
not supported, so it throws if called, like sceSystemServiceLoadExec
does for executable replacement. VLC itself cannot reach the call: its
fork and vfork fail with ENOSYS, so the child that would call execvp is
never created.
sceKernelSignalSema threw invalid_argument for a count of 0. Marvel's
Wolverine (PPSA03671) signals with a count computed as min(a, b) - c,
which can be 0, and ignores the result, so the throw ended the title a
few minutes in. A zero count now adds no tokens and returns SCE_OK, as
in shadPS4 and Kyty. A null semaphore and a negative count still throw.
guest_kernel_errors signals 0 on a full and on an empty semaphore and
checks that the count is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 7191d34c4d79622ba71087f0da2b75eb81ad2c23)
sceKernelMkdir checked that the parent of the resolved path exists, but
for "dir/" std::filesystem::path reports "dir" itself as the parent, so
the call failed with ENOENT and created nothing, while FreeBSD's mkdir
(and the POSIX mkdir export) accept it. Strip trailing separators first,
and report ENOTDIR when the parent exists but is not a directory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 5f74ddba8b346e6c552cf02554d47382708206f3)
The Linux loader takes the unnamed main image for guest code, as the
relinker's ET_DYN output is. Fedora's GCC does not default to PIE, so the
test executables were ET_EXEC and three loader tests failed.
PPSA11386 imports it; on main it is one of the title's three missing
imports, with sceSslGetCaList and sceSslFreeCaList, and the title does not
call it during its start-up. The signature is unknown, so it is declared
without parameters and throws.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PPSA11386 imports sceSslGetCaList and sceSslFreeCaList and PPSA15508
imports sceSslUnloadCert; on main all three are missing and the loaders of
both titles stop on them. No root certificate bundle is shipped and no
loaded certificate is kept, so an SSL context holds no certificates:
sceSslGetCaList clears the list and returns NOT_FOUND, as sceSslGetCaCerts
does; sceSslFreeCaList accepts only that cleared list; sceSslUnloadCert has
nothing to drop and is assumed to return 0. A null list returns the
invalid-argument code that sceSslGetCaCerts and KytyPS5 return. An unknown
context and a list sceSslGetCaList did not return throw, as their codes are
not confirmed. Signatures and the SceSslCaList layout follow SharpProspero
and shadPS4.
guest_ssl_tests now links libc, as guest_http2_tests does, so an exception
thrown from libSceSsl unwinds with the same unwinder that resumes it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the guest socket descriptor guard to sceKernelFdatasync before any
native syscall, matching the existing sceKernelFchmod pattern. This
prevents high guest socket descriptors (e.g. 0x10000000) from reaching
the Windows CRT _commit, which would trigger the invalid-parameter
handler, and ensures the correct SCE error is returned on all platforms.
Refactor fdatasync_nid_postfix to delegate to sceKernelFdatasync via
PosixResult, removing the duplicated socket guard and native syscall.
Extend GuestFilesystem tests to cover:
- sceKernelFdatasync on a valid guest socket returns SCE EINVAL (0x80020016)
- sceKernelFdatasync on a closed guest socket returns SCE EBADF (0x80020009)
- sceKernelFdatasync on a high invalid descriptor (0x7fffffff) returns SCE EBADF
- closed-ordinary-descriptor tests now run on Windows (verified _commit on
a closed descriptor returns EBADF without provoking the CRT handler)
A recorded dispatch or draw whose use needs completion work goes into the
copied-writer lists (VulkanDevice's copiedWriters, DrawCopiedWriters).
Fills, buffer copies and indirect argument reads treat every write of a
listed object as a store the CPU makes when its batch is reaped, and wait
for that batch. Completion work is also needed for the BDA fault check
alone, and the written sub-ranges of GPU copies are copied back by the
GPU (RecordCopyBacks) before the listing. Such an object has no CPU
write-back (HasCopiedWrites is false), and its stores are ordered by the
barriers like direct writes, yet it was listed and waited for.
Both lists now take an object only when HasCopiedWrites holds after
MarkGpuWrites. The completion action still runs for the fault check.
agc_driver_copied_writer_copy records a dispatch that reads through
global (BDA) loads and stores through a bound buffer into registered
memory, then copies that output on the GPU (VulkanDevice::CopyBuffer)
before the batch ran. It checks that the copy is a transfer between the
host imports without a sync, and the copied bytes. Without the change the
copy waits for the dispatch's batch.
PPSA14632 (LEGO Horizon Adventures): every one of the DMA_DATA copy
waits counted over 75 s came from such writers. Queue 0's GPU-mutex hold
for copies drops from 3.5 s to 30 ms per 10 s, and presents rise from
about 102 to 109 per 10 s.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An upload of a storage image up to 1 MiB reads the surface's guest bytes
into a baseline (#1599), which a later write-back compares against for
blocks the CPU stamped. When a unit shadow, another image's pending
results or a recorded GPU store covers the surface, that read goes
through the flush hook: the shadow is published and the worker waits for
the GPU, although the upload itself runs on the GPU from the import.
The baseline is now taken only when nothing of that kind overlaps the
surface. Otherwise the image has none, and its write-back keeps the CPU's
bytes for stamped blocks, the rule before #1599. TechnicalDebt's entry
names the condition.
agc_storage_baseline_settled creates a storage image over a watched host
import with a recorded store pending over part of it and checks that the
upload did not submit the open batch; without the change the baseline
read syncs on that store. agc_unchanged_cpu_stamps (#1599) still passes.
PPSA14632 (LEGO Horizon Adventures) refreshes such images about 870
times per 10 s from queue 0 dispatches: the hook's recorded-store syncs
go from about 3400 waiting 4.0 s to about 630 waiting 0.3 s per 10 s,
and a direct dispatch's device call from 356 to 107 us.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A build's sampled image elements often repeat the element just before them
in plan order (the same eight descriptor words). Each still took its own
stage-A record (decode, collect, DCC key read, cache entry) and its own
stage-B lookup.
The lookups run in plan order and nothing runs between two consecutive ones,
so a repeated element's lookup would find the state the previous lookup just
left: the entry it validated or made, current against the same collect. Such
an element now binds the previous element's texture (when the depth-compare
flag matches too, which is part of the cache key), and stage A gives it a
record of the decoded descriptor only. An element repeating an earlier but
not the immediately preceding one still takes its own lookup, as does any
element after a storage image lookup.
A resource build decodes every image element's eight descriptor words,
describes the surface (a mip layout with a vector of levels) and finds the
sampled texture's cache entry by hashing its key, once in stage A and again
in stage B. Most elements repeat a small set of descriptors from build to
build.
Each worker now keeps a small direct-mapped memo by descriptor words of the
decoded resource, its guest size and view component mapping (pure functions
of the words) and of the cache entry the words last found. The entry is
reused only while the sampled texture cache has erased no entry since it
was found (an erase counter bumped by eraseTexture), so the list iterator is
still valid and still holds the same key; anything else takes the hash
lookup.
Buffer and DeviceBuffer created their VkBuffer at the pool's size class, so
a robust read past the requested size stayed in bounds and returned the
bytes an earlier user of the pooled memory left there instead of an
out-of-range result. Each VkBuffer now has the requested size, created with
the pool's usage, over memory of its class (or its slab slot); one taken
from the pool for a different size is recreated over the same memory at
the same offset. agc_buffer_pool follows a pooled buffer by its memory, so
its class and reuse cases hold with the exact-size buffers.
Intersect copied fixed-point sets without allocating each intermediate.
Preserve sorted results and the existing analysis iteration order.
Compact oversized storage only when publishing a changed set.
Keep an allocating control switch outside the cache key.
Compare complete fixed points over empty intersections, loops and DAGs.
Register the same equivalence fixtures for the allocating control.
A DMA_DATA copy larger than the store limit runs as a transfer between
host imports. When the destination is not registered guest memory (the
GPU can neither read nor write it, so no import exists), the transfer
was refused and the packet drained the device: every batch recorded so
far was submitted and waited for, then the CPU copied.
Such a copy only has to see the source's results. When CopyBuffer
refused for want of an import (path 2) and nothing can still store over
the destination (VulkanDevice::StoresPendingOver: a recorded write, a
label, a copied write-back, a storage image's pending write-back or a
unit shadow), the packet now flushes storage results pending over the
source and waits for the batches that write it (Recorder::SyncThrough),
then copies on the CPU without a drain. Anything else still drains as
before. The [sync] line counts these copies.
agc_driver_tests copies a buffer the GPU just wrote into host memory,
once directly and once behind a label into the destination, and checks
the bytes and that the copy did not drain.
PPSA14632 (LEGO Horizon Adventures) copies 256 KiB of GPU results into
host memory this way, about 50 times per 10 s: device drains drop from
about 50 to none per 10 s.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
TestUnsyncedVideoKeepsUpWithAudio built its player without an event
callback, which enables auto-start (autoStartEnabled = init.auto_start ||
callback.event_callback == nullptr). The controller thread then enables the
streams and starts playback shortly after the source is added, racing the
test's own sceAvPlayerEnableStream. When the controller won,
Source::EnableStream saw started == true and the test failed with "enable
video failed".
The test now passes an Events object, as the other tests that drive the
player by hand do.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Jelly5 (PPSA99505) imports sceAudioOutExGetMonitorInfo (PhnNN0UEV6Y),
sceAudioOutExConfigureOutput (VcE+gXSwFXI), sceAudioOutExOpen
(6X6dp+07h4U) and sceAudioOutExClose (0TfjSulCV2A) from libSceAudioOut
and fails to load because no library exports them. It calls them only
for its optional HDMI bitstream output, and their signatures are
unconfirmed, so they are exported without an implementation and throw
if they are called, like sceSaveDataCancel.
Without MAP_FIXED the address is a hint, as for FreeBSD's mmap: the reservation goes at the hint when that range is free, else at the first free range above it. The hint was dropped, so every hinted reservation landed at the lowest free address.
RetroArch (PPSA99169) reserves its cores' direct-memory heap near 0x2000000000 outside the GPU window (0x200000000-0x300000000) and refuses a range inside it; with every reservation at 0x200400000 the heap was never made, and Dolphin's first aligned allocation returned null.
AI-assisted (Claude Code).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every draw into a resident target refreshes the target's storage image
(StorageTexture::Refresh): a pending-registry scan for an alias,
FlushPending over the surface, the collect, the key proof, a
whole-surface UnchangedSince, four vectors and a generation update over
every 64 KiB unit, nearly always finding the image current.
A refresh that finds the image current now keeps a proof: the image's
generation and uploaded keys, its key proof's generation and the pending
registry serial. The next refresh is answered from it when the image's
own state is still that, the surface and its key range are unstamped
since those generations (CollectWrites over both, then one
UnchangedSinceAll), and no other image has results pending over the
surface: the registry serial is unchanged, or the registry is scanned and
holds none (a newly pending image, a flush in progress). The proof is
taken only under GuestMemory::GpuMutex, without a pending alias, with
stable keys and when no other pending image overlaps the surface; any
full refresh drops it. A CPU write, a driver or GPU store, a key store,
another image's pending results or a different image therefore always
refresh in full, and the image's own pending results (a draw into it)
keep the proof.
agc_driver_recorder_tests refreshProofTests: an unchanged image and one
holding its own pending results are proved; a CPU write, a driver store
into the surface, a key store, another image's pending results, a new
image of the surface and a fast clear of the keys each refresh in full.
A geometry (NGG) strip draw on the mesh path assigned every primitive the next index positions without looking for the restart index: a triangle spanning a restart fetched vertex 0xFFFF and was drawn to wherever that read landed, and the strip parity never reset, so after an odd-length strip every triangle's winding flipped and face culling dropped it.
For an indexed strip draw with restart enabled and the restart index present, the draw now records each position's strip start (one past the last restart at or before it) and passes the table after the mesh arguments, flagged in draw word 3. The mesh prologue reads the start of its primitive's last vertex: a primitive whose start lies past its first vertex spans a restart and is made degenerate, and the others take their parity from their strip's start (or the draw's first index). The restart vertex itself fetches vertex 0. The table is built from the index bytes the draw already reads (its copy, or the guest memory an in-place import reads), next to #1968's restart-aware highest-index scan.
The new Mesh.cpp test draws quads as four-index strips each followed by a restart (16- and 32-bit indices, and an indirect draw starting mid-buffer) with front faces culled: every quad must render whole and the gaps between them stay clear. Without the table the first check fails ("a triangle crossed the restart after quad 0").
AI-assisted (Claude Code).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#2096 keeps a copy of a storage image's guest bytes so that Refresh can
compare memory the write watch does not cover. The host-import upload
path takes that copy only when the range is unwatched, but the DCC
fast-clear path took it on every upload. Reading the whole surface goes
through the flush hook, so each 64 KiB block of a surface that a unit
shadow covers recorded a publish and waited for the GPU.
The clear path now resolves the surface's host import first (the import
can unwatch the range, as a compared host-pointer import does) and takes
the copy only when the range is then unwatched, like the import path.
Write-watched memory, such as direct memory behind a dma-buf import,
skips it; a range that is unwatched later re-uploads instead of
comparing, as before #2096.
agc_driver_dcc_keys_first_write checks that a fast-cleared upload keeps
the copy exactly when its range is unwatched at that point.
PPSA14632 (LEGO Horizon Adventures) on Linux, RX 9070 XT: the flush hook
waited ~60,000 times per 10 s for these publishes (6.4 s), now ~3,500,
and presents rise from ~24 to ~100 per 10 s.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A stale storage snapshot is revalidated by comparing every tracker block
stamped since it was taken. A title that binds buffers a dispatch writes
in place every frame (the whole declared range stamped, few pages really
changed) makes the graphics worker compare gigabytes per second.
Compares of 1 MiB or more are now split by block across a small pool of
helper threads (hardware threads / 8, from 1 to 4). The compare is memory
bound, so the worker's share roughly halves rather than dividing by the
thread count. A caller that finds the pool busy compares on its own
thread. Results and the patch-in-place rules are unchanged.
agc_driver_graphics_tests parallelCompareTests: per-span results on the
pool and serial paths, and two threads comparing at once.
A stale storage snapshot was compared whole with the guest bytes and, on
any difference, copied whole into a new buffer, although few of the
tracker blocks stamped since the copy usually hold different bytes.
Only the 64 KiB tracker blocks stamped since the snapshot's generation
are compared now. When some differ and the cache holds the only
reference (no recorded draw binds the buffer), those blocks are copied
into it in place; otherwise the range is copied again as before.
agc_driver_recorder_tests drawSnapshotPatchTests: changed bytes in
several blocks and a whole changed block patch the snapshot nothing else
holds, an unchanged one is reused, and one a recorded draw still holds is
copied again with its bytes untouched.
A written V# element bound in place in a host import makes every load a
PCIe round trip. A particle update that loads and stores a 10 MiB pool
(2048x64 threads over 131072 records of 80 bytes), above the 2 MiB written
window, took about 4.8 ms of GPU per frame.
An element the shader also reads (DescriptorBinding::bufferRead), written by
a direct dispatch whose threads times the V# stride cover at least half of
it, now takes device-local staging up to 16 MiB: that dispatch drops to
about 0.06 ms plus 0.9 ms of bulk copies. The coverage test keeps a kernel
that updates about 12k records of a 16 MiB pool in place, where staging all
of it would cost 1.3 ms of copies for a 0.08 ms kernel. Write-only
elements, indirect dispatches and raw (stride 0) buffers keep the 2 MiB
window.
A storage write-back copied the image into a linear buffer and retiled
that buffer; an upload detiled into a linear buffer and copied it into
the image. With storage image access without a format, the retile now
reads each texel from the image through an unsigned integer view of the
element size, and the detile writes it there, so the linear buffer, its
copy and one barrier per move go away. The texels move bit for bit as
before, through the same tiling equations and windows.
This covers the block-unit windows of write-backs and uploads and the
whole-surface direct upload, for 2D, array and cube images.
agc_driver_recorder_tests singlePassTests: a first upload, a write-back
of new texels in every mip and a second upload over the stored memory
leave the images and guest memory byte for byte equal to the copies
through a linear buffer, in plain and write-watched memory.
DescriptorBinding gains bufferRead next to bufferWritten and bufferAtomic,
filled from the resource tracker's per-buffer read flag and kept in the
shader disk cache (format 24).
A recorded draw continued the open render pass only after a draw that
wrote no memory, so every draw with a storage write ended the pass and
paid two barriers. A draw now continues the open pass when its accesses
have no hazard (PassHazards) against those of the draws since the last
barrier. Address-based draws, draws through buffer device addresses and
draws with copied writes count as reading and writing any guest memory.
A draw of other attachments with no hazard ends the pass without a
barrier and begins its own without one, and a hazard break records the
begin barrier alone, towards every graphics stage, instead of the pass
end barrier plus the begin barrier. A pass with a depth attachment or
attachment proxies, or one followed by work after the pass, keeps both
barriers. APS5_FULL_BARRIERS keeps every barrier, as for the other merges.
PassHazards keeps the guest ranges, images and attachments the draws
since the last barrier read and wrote, and answers whether a new draw has
a RAW, WAW or WAR hazard against them. Address-based reads and unknown
writes count as touching any guest memory; attachments of the current
pass are ordered by rasterization and only conflict with other passes or
with sampled and storage uses. Unit tests in agc_pass_hazards.
The Windows sceKernelPread stopped going through pread when it learned to
return errors, and with it lost the random device read, so a pread on
/dev/urandom reached ReadFile on a handle that is not a disk and failed
with ESPIPE. Read random devices first, as the Linux path does.
A pread into a read-only guest mapping now returns EFAULT instead of
throwing, matching Linux and the AIO read beside it, so the Windows
guest memory test checks for that return.
Read rtkit's MaxRealtimePriority and RTTimeUSecMax before touching the
limit, keep a hard limit that already satisfies rtkit, lower the soft
limit to at most half of the hard one, and log when the hard limit is
lowered. rtkit checks the hard limit, so it cannot be left alone when it
is above RTTimeUSecMax; the side effect is listed in TechnicalDebt.md.
Log the policy rtkit applied, SCHED_RR by default.
A draw's storage snapshot was copied again whenever the write tracker
reported a store over its range, although most such stores leave the
bytes as they were: in one title screen about 10k of 14k stale lookups per
10 s held the same bytes (3.5 GiB of copies).
A stale storage snapshot is now compared with the guest bytes, after the
caller's collect of the range, before it is dropped. When they are equal
it takes that collect's generation and is reused; any store after the
collect is stamped newer and fails the next check, as for a fresh copy. A
registry change still drops it without reading, and vertex and index
snapshots are dropped as before.
materializeRegisterClear read the target's DCC keys with CurrentDccKeys on
every draw into a resident target with metadata: a full AllKeysEqual scan
of the key range (52 KiB for a 2432x1368 RGBA8 target), about 440k scans
per 10 s and 7.2% of the queue 0 worker's CPU time in one level.
ProvedCurrentDccKeys answers CurrentDccKeys from a proof kept with the
resident image (DccRangeProof: the key range, the keys and the write
generation collected before the scan), the rule ProvedClearKeys already
applies to a storage image's own keys: the proof holds while the key range
is unstamped since that generation (CollectWrites first, then
UnchangedSince), and a scan becomes the proof only when it read the bytes
(not the pending store memo) and no recorded work still writes them. Every
key writer stamps the range, so a store, a pending result or another key
range always scans again. The proof is used under GuestMemory::GpuMutex
only, and not with APS5_NO_KEY_FAST_PATH.
agc_driver_recorder_tests: an unchanged range is proved, and a key store
stamp, a CPU write, another range or address, and a pending key fill each
force a scan; the fill's result is proved once its batch finished.
Every small host buffer (size classes below 1 MiB: draw and dispatch data,
copied regions, snapshots) had a VkDeviceMemory of its own. When the pool
missed, the worker paid a vkAllocateMemory and vkMapMemory, and the release
thread a vkUnmapMemory and vkFreeMemory, for each one. The frees also stall
the worker's vkQueueSubmit in the driver.
A host-visible buffer of a size class now gets its own VkBuffer bound into a
slot of a shared block (2 MiB, or 8 slots for the large classes) per memory
type, size class and device-address use, mapped once. Releasing it destroys
only the VkBuffer and returns the slot; a block is freed when it empties and
its slab already keeps an empty one. A slot is used only when the buffer's
alignment and the non-coherent atom divide its size class, so the slot
offset is valid for the bind and Invalidate covers exactly the slot. The
pool still retains released buffers by class as before; only what backs
them changed.
A sample whose T# is chosen in one if/else and whose S# is chosen in a later one has descriptor Phis in two blocks. The web walk required every Phi of the tuple to sit in one block, so it gave up and the plan threw "GetImageResource dword 0 is not a valid runtime value". The walk now splits at the Phis of the latest block in program order, and Phis of earlier blocks pass through each edge unchanged until the walk reaches their block.
The hold no longer polls every millisecond and has no switch to turn it
off. A held submission waits on the driver's condition variable until no
flip is ahead of it, or until queue 0 waits for memory that only the
title can store. The queue 0 worker reports the second case from its
memory and rewind waits, and the worker that reaches a flip wakes the
holders.
agc_driver_flip_tests: a flip held behind a rendering wait is released
when the worker goes on to wait for a label only the title stores, with
no further submission.
A draw whose stages bind a BDA table or a fault buffer builds resources
that need completion work, so noteReusable never keeps them and the shared
resource cache never holds an entry such a draw could hit. Building the
content key and probing the cache for each of them was pure cost. Those
draws now skip both (ShaderResources::NeverReusable) and count as
uncacheable.
A title that paces itself on pending flips assumes what hardware gives it:
the command processor consumes a submitted buffer at once, so a pending flip
is a frame whose commands have been read and that only waits for the display.
The queue worker is slower than that. With three flips pending it can still be
recording the oldest frame while the title rewrites that frame's slot of a
three-deep ring of per-frame memory for the frame after next, and the draws
are then recorded with the later frame's (or half-written) constants.
A submission on queue 0 that carries a flip now waits until the worker has
reached the flip of every earlier one. The wait ends early when queue 0 is
blocked on memory that no running or pending work writes, since only the
title can end that wait. APS5_NO_FLIP_HOLD=1 submits as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017MPYE7P9ob12aAE1H4JtHF
Throw when /proc/self/maps cannot be read or parsed, and when the kernel
places a reservation chunk at another address (MAP_FIXED_NOREPLACE
treated as a hint). Remove the unused PageSize and keep the POSIX-only
headers in the non-Windows block.
An unmapped range inside the guest arena stays a PROT_NONE host
reservation, so host munlock succeeds on it. Check the guest mapping
state first, as msync does, and return ENOMEM for ranges the guest
has not mapped or reserved.
CheckUnmappedArenaRangeStaysReserved uses mmap, PROT_READ, PROT_WRITE,
MAP_FIXED_NOREPLACE and EEXIST directly, so the Windows build fails to compile it.
The probe exists to show that an unmapped arena range still rejects a hostile
MAP_FIXED_NOREPLACE mapping, which is Linux-specific behaviour.
Guard the function and its call site with __linux__. The other tests in the file
compile on both platforms.
The Linux implementation of GuestArenaReset released the range in addition to
resetting the memory, while the Windows implementation only resets the memory and
leaves accounting to the caller. Two call sites already release explicitly after a
reset, so every one of them released the same range twice: sceKernelMunmap through
ArenaForget, and GuestHeap::release through GuestArenaRelease.
The two releases acquire the arena lock separately. Contains is span-based, so the
second release still runs, and Release erases every overlapping entry. A thread that
allocates the range between the two calls therefore has its entry erased, and the arena
hands the same guest address range out twice.
Delete the release from the Linux reset so both platforms restore the documented
contract. Every existing caller already pairs the reset with an explicit release.
The arena constructor was Windows-only, so on Linux Available() was false: the guest heap fell back to the host allocator and direct memory landed wherever the kernel pleased. Titles that require a low virtual address rejected the mapping and re-issued the identical request, which surfaced as a start-up assert inside their own allocator.
Seed the window from the mappings that already exist instead of reserving it up front, because a PROT_NONE reservation of the whole range starves the kernel's own top-down mmap, which picks addresses just below the stack inside that range. Commit, reset and set-protection become portable so the arena owns its used ranges on both platforms, and fixed mappings are checked against the arena's used ranges rather than against EEXIST from a reservation.
The window-placement and no-overwrite checks in guest_memory were compiled only for Windows; they now run on Linux too, and the window check fails without this change.
Fixes#692
Since guest threads get exactly the stack size they request, host code
that a guest thread calls runs on that small stack too. sceAgcCreateShader
reaches Driver::RegisterShader, whose frame alone is about 50 KiB, so a
title whose job threads ask for 48 KiB overflows the stack (#2603).
Each guest thread now gets a fixed 1 MiB of host stack below the range it
asked for. The guest still sees the requested size and address range
through scePthreadAttrGet and sceKernelIsStack; only host calls made from
the thread use the extra room. Running the prepared-shader driver tests on
a limited main-thread stack needs between 128 and 192 KiB for shader
registration, Vulkan setup included, so 1 MiB leaves several times that.
Switching to a separate host stack at each HLE entry point would need a
trampoline on every export that may go deep, handling of stack-passed
arguments and unwinding across the switch, and a list of which exports
qualify. A margin below the guest range covers every host call with no
per-export list.
On Windows the committed size was the requested size, and the margin
below it depended on the executable's default stack reserve; requests at
or above that reserve had none. The commit now includes the same margin.
macOS does not run guest threads.
guest_pthread_stack now also calls host code that uses 256 KiB of stack
below each thread's guest range; without the margin it crashes on the
16 KiB thread.
Fixes#2603
scePthreadCancel and pthread_cancel threw, scePthreadTestcancel did
nothing and the cleanup handler exports did not exist.
A cancel request is now recorded on the thread and acted on at
scePthreadTestcancel, the condition variable waits, scePthreadSem and
sem waits, scePthreadJoin and the sleeps, and under their POSIX names.
A thread blocked in one of the waits is woken; a condition wait takes
its mutex back before the thread exits. The thread exits with
PTHREAD_CANCELED through scePthreadExit, which now runs the handlers
of __pthread_cleanup_push_imp and __pthread_cleanup_pop_imp.
scePthreadSetcancelstate and scePthreadSetcanceltype reject unknown
values, and pthread_setcanceltype is added.
Constants, the handler node layout and the order of events follow
FreeBSD libthr. A sleep is not interrupted, file and socket calls are
not cancellation points and the asynchronous type acts like the
deferred one except at the two set calls (TechnicalDebt). New test:
guest_pthread_cancel.
Astro's Playroom (PPSA01325) calls sceRudpActivate during start-up, where the throwing stub stopped it. The host has no reliable-UDP stack to activate, so the export returns success and does nothing, matching the OK-returning stubs shadPS4 keeps for the whole library. The guest_offline_imports test now checks the success path with and without sceRudpInit, and still checks that the sceRudpGetStatus sibling throws and writes nothing.
Leave the Windows identity fields at their stat values when
GetFileInformationByHandle fails on a handle whose basic information
could be read, instead of failing the whole call.
st_ino was always 0 and st_dev differed between stat (drive number) and
fstat (0), so the usual a.st_dev == b.st_dev && a.st_ino == b.st_ino
identity check gave wrong answers. Read the volume serial, the file index
and the link count from the file handle, which works the same for path and
descriptor lookups.
Fixes#2296
ProsperoStore (PPSA99000) imports kill from libkernel and stops at it on
current main. Its crash reporter resets a crash signal to SIG_DFL and
sends it again with kill(getpid(), signal).
kill follows FreeBSD's kern_kill and killpg1 for the only guest process:
EINVAL for signals outside 0 to 128, signal 0 only checks the target,
and the caller's own pid, 0 and minus its pid deliver through raise.
Any other pid, and -1, which skips the caller, report ESRCH.
The registry records whether a range was mapped or protected with GPU
access (0x10/0x20), and an address-based build leaves out ranges without
it, as the console's GPU page tables do. The main image is registered
without GPU access; the title's own mprotect with GPU bits adds it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The hardware turns anisotropy off under ANISO_OVERRIDE when the T#'s BASE_LEVEL equals its LAST_LEVEL. The view's level count is taken after LAST_LEVEL is clamped to MAX_MIP, so a T# with BASE 0, LAST 3, MAX_MIP 0 counted as single-level here while the hardware keeps anisotropic filtering for it (measured by @adriadam10 on the hardware oracle). The pairing now reads BASE_LEVEL and LAST_LEVEL from word 3 (DescriptorSingleLevel).
The per-draw path gets a test, agc_driver_image_sample_aniso_override: one ANISO_OVERRIDE sampler shared by two images in a dispatch, with single-level, mipmapped, mixed, and LAST_LEVEL > MAX_MIP descriptors, checking which pairings run (with their samples) and which are refused as mixed. With the old view-based check the LAST_LEVEL > MAX_MIP pairing is refused.
applyAnisoOverride reads the APS5_NO_SAMPLER_CACHE switch through the same cached flag as addImageBinding instead of calling getenv per sampler per draw.
AI-assisted (Claude Code).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With ANISO_OVERRIDE the texture unit disables anisotropic filtering when the
sampled view has a single level. Each draw now records, per sampler, whether
its paired images are single-level or mipmapped. A sampler with the bit and an
anisotropic filter whose images are all single-level is bound as the same S#
with point or linear filtering in place of the anisotropic filters, taken from
the sampler cache. One sampler descriptor serves every image paired with it,
so a sampler paired with both kinds in one draw still throws. Samplers of
mipmapped images keep their anisotropy, as on the hardware.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mesa sets ANISO_OVERRIDE (S# word 2, bit 29) on every GFX10+ sampler
unless aniso_single_level is on; it turns anisotropic filtering off for
single-level views. Samplers carrying it were rejected. Accept and
ignore it: host samplers are built from the S# alone and shared between
images, so single-level views keep the sampler's anisotropy. The gap is
recorded in TechnicalDebt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Route oversized compute LDS through a per-workgroup storage buffer.
Retain native shared memory for programs that fit the device limit.
Carry the spill stride through prepared shader results and dispatches.
Preserve the stride in the full-result codec and its round-trip fixture.
Keep the Linux RecompileResult size guard aligned with the added field.
Exercise interleaved workgroups and the device-limit boundary.
This topic contains only the LDS change and its reviewer-requested repair.
The base includes upstream's separately merged NaN result correction.
VOP2 0x06 measured the same as VOP3 0x140 on gfx1010 (RX 5700 XT) in
wave32 and wave64, IEEE 0 and 1 and f32 denormal modes 0 to 3: the
product is rounded before the add, f32 denormal sources, product and
result are flushed in every mode, and a zero factor gives a +0 product.
It now shares the v_mad_legacy_f32 translation with the accumulator as
the addend, and f32DenormalFlushFor returns 3 for it as well. A new
execution test pins the measured results of its VOP2 and VOP3 forms.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The guest_interfaces test now follows guest_thread_callback_abi instead of guest_errors, and the TechnicalDebt entry follows the libc SSE4a trap emulation entry instead of ending the Functional list, where other open pull requests add theirs.
A formatted buffer load or store through a GPU-selected descriptor still
emitted the switch over every buffer format inline, at each access. A
Ghost of Yotei compute pass with ~300 such accesses compiled to 37M SPIR-V
words, and its pipeline took 40 s or more to create.
The switch is now emitted once per component count, direction, d16,
coherence, kind and stop mode, as a SPIR-V function that takes the
descriptor fields, the offsets and the access's PC. When faults stop the
invocation, the helper returns whether one did and the caller stops there.
BDA faults record the PC from BdaInstructionPc, the access's own PC or the
one a shared helper takes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The --deferred-undecodable mode registers shaders through a Vulkan
device but, unlike --deferred, did not check for one first. On the
Windows CI runner, which has no Vulkan driver, vkCreateInstance returns
VK_ERROR_INCOMPATIBLE_DRIVER and the test fails instead of skipping, so
the windows job on main has failed since e5b32bb4. It now returns
VulkanTestSkipped like the other modes.
CB_BLENDn_CONTROL factors 15-18 (BLEND_SRC1_COLOR, BLEND_INV_SRC1_COLOR,
BLEND_SRC1_ALPHA, BLEND_INV_SRC1_ALPHA) threw "unsupported blend
factor". They blend MRT0 with the pixel shader's MRT1 export as the
second source, as RADV and radeonsi program it.
DecodeState maps them to the VK_BLEND_FACTOR_SRC1_* factors and accepts
them only with pixel exports to slots 0 and 1, color writes to slot 0
alone, an MRT1 export with MRT0's export format and shader mask, an
ADD, SUBTRACT or REVERSE_SUBTRACT operation and an identity component
order. The blend is draw state, so the specialized module of the
registered pixel shader moves its MRT1 output to location 0 index 1,
which ValidateShaders requires; pipelines need dualSrcBlend, now enabled
when present. The request field dualSourceBlend is in the module key,
the result memo, the draw key and the serialized request (version 15).
Drop IFF_POINTOPOINT from an address without a peer and compute an IPv4 broadcast address the host omits from the netmask, since FreeBSD always provides the address when the flag is set. Check zero port, flowinfo and padding in the test.
Return -1 with the FreeBSD errno for a null list and for expected host and allocation failures, as getcwd does. On Windows, give an unspecified prefix length a host mask, leave PPP and tunnel adapters without broadcast or point-to-point flags since their peer address is not reported, fall back to if<index> for long NDIS names, and bound the adapter query retries. Compare every entry with the host's own list in the test.
List the host's IPv4 and IPv6 addresses in FreeBSD's struct ifaddrs layout, with FreeBSD sockaddrs and interface flags, from getifaddrs on Linux and GetAdaptersAddresses on Windows. The list is one allocation, so freeifaddrs is a single free.
Move the image unregistration out of the Module destructor into
dlclose_nid_postfix. It runs while the handle is still registered, so a
failure (the image stays leased by GPU work) propagates to the caller and
leaves the module loaded and usable. Images shared by another open
handle stay registered until the last handle closes.
guest_memory now checks that dlclose under a held lease throws and keeps
the module, its symbols and its protection.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A .guest.prx image registered by sceKernelMprotect stayed in the guest
allocation registry after dlclose freed it, so its dead ranges blocked
later mappings at that address and could reach GPU builds.
The Windows module destructor now unregisters the image before
FreeLibrary. Unregistering waits for outstanding leases on the image like
unmap and protect do; if the wait fails the module stays loaded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On Windows, sceKernelMprotect accepted only the executable's image and threw
"Memory protection of a foreign image is not supported" for every other
image. Bundled title modules are relinked into DLLs named <module>.guest.prx,
so a title that reprotects its own module pages failed. Dying Light 2's
bundled libNRD does this at start-up (#1794).
DoMprotect now also accepts images whose file name ends in .guest.prx, and
registers their committed pages like the executable's. Other images are
still refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On Windows, sceKernelPread and sceKernelPwrite called the POSIX pread and
pwrite wrappers, which throw on every failure, so a bad descriptor, a
negative offset or a write to a read-only descriptor aborted the process
instead of returning an error as the Linux build does. ftruncate and
sceKernelFtruncate threw on any host failure on both platforms.
Give the Windows sceKernelPread and sceKernelPwrite the same checks and
SceErrorFromErrno returns as the Linux ones, and accept a zero-length
transfer with a null buffer. Report a positioned transfer on a handle
opened without the needed access as EBADF instead of EIO. Return EINVAL
from ftruncate for a negative length and for a descriptor opened without
write access, as FreeBSD does, and pass other host errors to the guest.
Fixes#2423
sceFontGetCharGlyphMetrics and sceFontGetRenderCharGlyphMetrics set the
vertical bearing and advance to zero although the glyph is loaded with
FT_LOAD_VERTICAL_LAYOUT. The library's own text writing steps the pen by
that vertical advance, so every character of vertical text was placed on
the previous one.
The vertical metrics now follow the FreeType driver's metrics of a
rendered glyph: FreeType's vertical advance, and for a face without
vertical metrics a bearing of half the horizontal advance left of the
horizontal bearing and of half the advance left over by the glyph height.
guest_system_font checks every metric of a square glyph at 100 pixels.
(cherry picked from commit 04dd69f806379df8b52cfdeb2979f2595973a9b3)
(cherry picked from commit 11f6f9e954756ee8d4a3fc2be574ab3b57ecd7c5)
Palworld (PPSA23126) imports sceSaveDataCancel (e6y3WMBYbiM) from
libSceSaveData and fails to load because no library exports it. Its
signature is unknown, so it is exported without an implementation and
throws if it is called, like sceSaveDataConvert.
A registered compute shader takes its wave size from its header's
specials (dispatch_modifier), and PrepareRegistered read them without a
null check. ps5-opengl registers compute headers without specials, since
it writes the specials pointer only for linked graphics stages, and
passes the wave size in the dispatch initiator instead. Registration
then threw "shader metadata is outside the registered header".
Such a shader is now deferred like the other shaders that can't be
prepared at registration, so it is prepared at its first dispatch with
the wave size from the initiator's CS_W32_EN.
On Windows, getargc and getargv reported only the executable path, read
with GetModuleFileNameA in the ANSI code page, and dropped every other
argument. Linux returns the whole command line from /proc/self/cmdline,
and the relinker's Windows entry stub already passes the guest entry all
arguments converted to UTF-8.
Parse GetCommandLineW with CommandLineToArgvW and convert each argument
to UTF-8 with WC_ERR_INVALID_CHARS, as the entry stub does, so getargv
matches the entry's argv and the Linux behaviour. The Linux path is
unchanged.
DecodeColorTileMode rejected 2D color targets with a nonzero MIP0_DEPTH, so
an array target could only be rendered into through a view of a surface that
declares one slice. radeonsi sets CB_COLOR_ATTRIB3.MIP0_DEPTH to the last layer
of an array target (si_state.c, ac_descriptors.c), and Mesa-built homebrew
emits such targets. The view's slice already moves the target by one slice
size; it is now also checked against MIP0_DEPTH.
On Windows libc exports __cxa_init_primary_exception, std::uncaught_exception
and std::uncaught_exceptions only as _nid_postfix symbols (GCC_GLOBAL_ALIAS
is empty there), so host modules bind libstdc++-6.dll's versions:
- std::make_exception_ptr, which std::promise's destructor uses for
broken_promise, allocated the exception with libc and initialized it with
libstdc++'s __cxa_init_primary_exception, whose header layout differs.
A test that makes one and rethrows it dies with an access violation.
- std::uncaught_exceptions read libstdc++'s thread state, which libc's
throws never touch, so it returned 0 while an exception unwound. The
AGC driver's deferred-label guard relies on it to tell a failed record
from a finished one.
The three are now exported natively, like __cxa_throw and the rest.
__cxa_init_primary_exception also sets the reference count to 0, as the
Itanium ABI does: the exception_ptr created next takes the only
reference, so a made exception is destroyed once instead of leaking.
On Windows std::_Exit ends in ExitProcess, which still runs every module's
DLL_PROCESS_DETACH and TLS callbacks after the other threads are gone. A
static destructor that joins a worker then waits forever: a title that calls
_Exit while libSceVideoOut's flip queue runs (ps5-opengl's retirement
fail-stop) stays alive in FlipQueue's destructor. _Exit and libkernel's _exit
now terminate the process with TerminateProcess, as _exit ends a POSIX
process: no atexit handlers, stream flushes or module destructors.
Guest samplers with DISABLE_CUBE_WRAP (S# word 0 bit 28) are created with
VK_SAMPLER_CREATE_NON_SEAMLESS_CUBE_MAP_BIT_EXT when the device enables
VK_EXT_non_seamless_cube_map; RADV maps the flag to the same bit. The bit
only changes cube filtering, so without the extension the sampler is still
created and only a cube texture sampled through it throws.
The buffer pool's device tier (detiler scratch buffers and the staging
shadows of written guest buffers) retained at most 512 MiB by default.
A title whose working set of these buffers is larger allocates and
frees device memory continually: PPSA14632 (LEGO Horizon Adventures)
had 70761 misses and 69828 evictions per 10 s with 485 of 512 MiB
retained, each a vkAllocateMemory or vkFreeMemory.
The default budget is now an eighth of the largest device-local heap,
and at least the old 512 MiB, so a 16 GiB card retains up to 2 GiB and
an 8 GiB card 1 GiB. APS5_STAGING_POOL_MIB still sets it.
Only the constructor knows the device, so only the budget comes from the
heap. Whether the tier is in use at all (APS5_STAGING_POOL_MIB unset or
not 0) stays a static check, DeviceTierEnabled, which Capacity, Usage and
tierFor share, so the size classes and the tier stay consistent.
On PPSA14632 with 2 GiB the device tier has 1312 misses and 99
evictions per 10 s (1628 MiB retained), and presents rise from about 34
to about 39 per 10 s.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A select of exec and zero gives a mask that is the same for every lane. Reading
it back went through a lane number, which Metal does not have in a vertex
shader, so MoltenVK rejected the shader. The select now stores the lane bit and
marks the pair as a mask, a constant mask word reads as a constant, and the
constant folder removes the bit test on an all-zero or all-one word.
agc_scalar_select_mask runs the translated IR over a wave and pins the lane
values for scc set and clear, a source that differs per lane, the two wave64
halves differing, a destination that is also a source, and constant and
literal sources.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Unknown options are now checked for every pid, with 0x80 and 0x80000040 added, and so are valid combinations such as WNOHANG | WUNTRACED. Each call is repeated with a null status. The TechnicalDebt entry cites kern_wait, which adds WEXITED and WTRAPPED, and lists pdfork.
waitpid returns -1 with ECHILD, or EINVAL for an option FreeBSD does not know, and leaves the status unwritten: AnyPS5 runs the title as one process and exports nothing that creates a child. VLC PPSA85300 stops on main at this import.
FillClearColor refused half and B10G11R11 patterns with a denormal code,
since an implementation may flush them in a clear, so such fills over a
resident image took the CPU path: PPSA01325 fast-clears its 3840x2160
R16G16_SFLOAT target 0x515390000 with a denormal half every frame, a
33 MiB guest write and re-upload (about 85 ms).
ClearKeepsDenormals probes the device once per format: a 1x1 image
cleared with denormal codes (half 0x0001, 0x83ff, 0x0200, 0x8001;
11/10-bit 0x001) and read back. When the bits survive, FillClear takes
the refused pattern again with SmallFloat decoding denormals exactly.
NaNs, float32 denormals and the SNORM minimum stay refused.
agc_driver_recorder_tests clears an R16G16_SFLOAT resident image with a
normal, a denormal and a NaN pattern: the denormal is cleared exactly
when the probe says the device keeps it, and the NaN is refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UTjpbMX7BUFMZZaxJE98zV
A shader reported in review binds 40 sampled images of one class, more
than 32. The cap only bounds the compact heap arrays, so no layout or
ABI version changes. The test covers 40 images and a full class through
the constant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A compute program of PPSA26344 binds 29 sampled images of one class, more
than the 16 a typed sampled heap held, and failed with "shader image heap
capacity exceeded". Heap arrays are declared with their compact length,
so shaders that fitted before keep their layout and SPIR-V.
Bindless image tables keep 16 slots: they were sized by the same constant,
and each slot costs an image entry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A strided vertex fetch whose index is at or past the descriptor's num_records threw and aborted the title. PPSA01325 draws its fullscreen composite as a 4-vertex strip over a 3-record buffer, so the fourth vertex past the records stopped presentation.
Hardware returns (0, 0, 0, 0) for such a fetch with OOB_SELECT 0 and 1, measured on RDNA2 gfx1036 with tools/hw-oracle in #2241. VertexBufferReadSize now spans the whole fetch, and the staging copy reads the record bytes then zero-fills from num_records * stride onward. Each such fetch gets its own copy, outside the shared copies of its sibling attributes, the host-import in-place path and the draw-snapshot cache. OOB_SELECT 2 and 3 keep throwing past num_records, since each needs its own rule. Recorded in docs/dev/TechnicalDebt.md.
eb06284c7 made a read-only 2D image_load through a 1D T# valid, so the
test no longer pins a refusal. The TechnicalDebt line now says storage
loads still throw.
#1629 makes sceAgcDcbResetQueue throw 'unsupported op bit 0x40' (and for
0x200/0x400). Dreaming Sarah and Astro Bot call it with op bit 0x40 at
start-up, so both abort before the first frame. Main with only #1629
reverted runs Dreaming Sarah normally again (59.9/59.9 fps, no skipped
draws, no flashes).
Measured on RDNA2 (gfx1035) in review: image_store with DIM 2D through a
1D T# writes texel x for every y, including y = 0xffffffff. The T# type
decides the addressing and DIM only how many address VGPRs are read. The
store no longer drops y != 0.
The test now pins the second store at y = 1 with dmask 0x5: texel x holds
its components 0 and 2, components 1 and 3 are 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A compute program of PPSA26344 writes a 1D storage image with image_store
DIM 2D, and no runtime image mode matched its T#. A write-only 2D storage
access now also gets a 1D mode. A store through it is dropped when y is not
0, as a one-texel-high image bounds it; this mirrors the measured 3D loads
through 2D T#s of #2023 and is listed in TechnicalDebt as unmeasured.
Loads, atomics and image_store_mip through such a pair still throw.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A flip packet names a buffer index; the buffer was looked up when the
command buffer was submitted, so a title that registers its buffers
after submitting the first frame failed with "flip buffer is not
registered". The buffer is now resolved when the GPU reaches the flip,
as the hardware does. A flip whose buffer is still unregistered then
presents black and completes (see TechnicalDebt).
Uncharted: Legacy of Thieves Collection (PPSA05684) submits its first flip before registering its buffers and stopped with "flip buffer is not registered".
AI-assisted: yes. Match the firmware 13.60 probe in PR #1798: names of 32 bytes or more return guest ENAMETOOLONG=63 and preserve the prior name. The complete final change passed a full Windows build and eight focused runtime tests.
AI-assisted: yes. Validated with the final library change on Windows; full build and eight focused runtime tests pass. Expected rename behavior comes from the public firmware 13.60 probe in PR #1798.
In SCE_AVPLAYER_AV_SYNC_MODE_NONE every decoded frame was handed out in
order, so a title that requests video slower than the film's frame rate
fell behind its audio (about 52 s by the end of the PPSA12544 intro).
While the title pulls audio, frames the audio clock has already passed are
now skipped; frames that are not late are handed out as before.
Fixes#1635
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On RDNA2 (gfx1036) ds_min/max/cmpst(_rtn)_f32 and _f64 flush both operands
when bit 0 of the type's denormal field is clear: field 2 flushes like field
0, field 1 keeps like field 3, in IEEE 0 and 1. The flush decision now tests
that bit. agc_driver_lds_float_atomic_modes adds FLOAT_MODE 0x50 (both fields
1) and 0xa0 (both fields 2), and the TechnicalDebt entry records the measured
fields.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GLfKH7Sqe51wX254k1XsV
ds_min/max/cmpst_f32 and ds_min/max/cmpst_f64 with their _rtn forms follow the
rule measured on RDNA2 (gfx1036): both operands are flushed to a signed zero
when the type's denormal field flushes, a signalling-NaN data operand is stored
quieted, else a signalling-NaN old value, else a quiet NaN loses, else the
ordered compare decides, and the flushed value is written. The shared f32
path used the host's float compares, so its NaN and denormal results were the
driver's; the shared f64 path lacked the signalling-NaN rules the buffer path
has. Both now use AtomicFloatBits. The translation marks the shared float
atomics with the mode's flush in MemoryInfo.
The new agc_driver_lds_float_atomic_modes pins 32 operand pairs per type in
the titles' mode, with both fields kept and with both flushed. The 64-bit
test's model gets the signalling-NaN rule and one lane kind now feeds the
signalling NaN of its table into min/max.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GLfKH7Sqe51wX254k1XsV
The f64 unary instructions, v_ldexp_f64, v_div_fixup_f64 and
v_cvt_f64_f32 always quieted a signaling NaN. The hardware does that
only with IEEE_MODE=1, as #1867 measured for the f32 and f16 forms;
with IEEE=0 the NaN comes out unchanged, measured on gfx1036.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The ±6.1e-5 lanes take the driver's cosine of a tiny angle, where RADV
returns the hardware's 0x3f7ffffe, NVIDIA 0x3f7ffffd and Intel ANV
0x3f800000 (reported by Kikoarl on #2380), so the lanes tolerate 2 ULP
instead of 1.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GLfKH7Sqe51wX254k1XsV
After #1979 the cycle is exact, but the driver's sine of the radians loses
tiny results to its absolute error, and near the zeros of sine at k + 0.5
and of cosine at k ± 0.25 the f32 radians drop the low bits of the cycle.
Measured on RDNA2 (gfx1036), the hardware returns the input times 6.2831826
for every input below 2^-12 of a turn and stays within 7 ULP of the f32 2π
times the distance at the half and quarter turns.
Within 2^-12 of a turn from a zero the lowering now returns the linear term
of the exact distance to that zero, with the hardware's constant at the
integers and the f32 2π elsewhere; everywhere else it keeps the driver's
sine or cosine of the radians. agc_driver_sin_cos_near_zero pins 32 inputs
per type from the oracle with per-lane tolerances.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GLfKH7Sqe51wX254k1XsV
A context without a device, such as the graphics test's mock, leaves state.device equal to context.device, so refreshImports never loaded destroyBuffer and freeMemory and retiring an import called a null pointer.
The pin waiter now receives the mutation range, drains GPU work and retires every overlapping host import before the unmap callback releases the pages. Deferred import retirement keeps only the device handle and the Vulkan destroy functions, so the static import registry no longer owns a Context or its BufferPool past the device.
A compute shader in Astro Bot samples an image as 2D while the bound
T# is 1D, and the recompiler refused it. Offer a 1D runtime mode for
sampled images used only by image_sample_lz and mip-less image_load,
which reads the texel the first coordinate selects, as measured on
RDNA2 in #2237.
With FP16_OVFL=1 the hardware writes an f16 result that would round to
infinity as the largest finite value of that sign, unless a source
operand is infinite. v_div_fixup_f16 keeps the infinity it writes for a
zero denominator or an infinite numerator. Measured on RDNA2 (gfx1036)
at IEEE=0 and IEEE=1 with f16 denormals kept and flushed.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A 64-thread compute kernel (69 dwords) stores pattern[min(i % s9, 3)],
the pattern in s4..s7, to dword i of a 4-byte-stride buffer for every
i below min(launched threads, s8, num_records), with the group id in s10.
PPSA01325 runs it every frame to clear DCC keys, HTILE and other
metadata. It ran as a shader; a direct dispatch with a period of 1, 2
or 4 dwords, whole 16-byte units and a 16-byte aligned destination now
goes through fillBuffer like the existing fill kernel (clear path,
FillBuffer, key memo). APS5_NO_FILL_HLE turns both off.
tests/execution/DwordPatternFill.cpp checks the matcher and runs the
kernel through Submit for matched and unmatched cases (periods 3 and 5,
partial counts, record clamps, a partial dispatch); with
APS5_NO_FILL_HLE=1 the same expectations hold for the translated kernel.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UTjpbMX7BUFMZZaxJE98zV
Both dominance analyses start from sorted unique sets and intersect them.
Insert the current block ID with lower_bound instead of sorting again.
Preserve every intermediate set and the existing ID-order iteration.
Keep the generic unsorted helper and all graph rewrite logic unchanged.
Compare both analyses against the original algorithms on six raw CFGs.
Cover finite loops, closed SCCs, unreachable islands and permuted IDs.
With SDL's disk driver no pad audio device is open, so AudioOut2MixPorts
runs with no pad output. A vibration port and a mono pad speaker port
are pushed together: only the speaker's data reaches the main mix, and
a vibration port alone leaves it silent.
Without a DualSense audio device every AudioOut2 port was mixed into the
main output, including PAD_VIBRATION ports. Their waveforms drive the
controller's actuators on the console and are never heard; mixed into
the speakers they made PPSA28997's combat about 20 dB louder than its
dialogue. Vibration ports are now left out in that case; pad speaker
ports still go to the main output.
The f16 min/max/min3/max3/med3 now pick NaN results on the bits and
quiet a signaling NaN only with IEEE=1. With IEEE=0, v_min_f64 and
v_max_f64 return the other operand for a NaN, not a quieted NaN. This
completes #1826 for these forms, as measured on RDNA2 (gfx1036).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With IEEE_MODE=1 the hardware quiets a signaling NaN that v_cubesc,
v_cubetc or v_cubema_f32 returns, keeping the sign the instruction gives
it; with IEEE=0 the bits pass through. Same rule as #1867, measured on
gfx1036 in both modes.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Neither existed under the guest root, so opening them failed and titles
that then read from the descriptor crashed. Opening either for reading
now returns a descriptor whose reads, positioned reads and vector reads
fill the buffer from the host's random device, as
sceRandomGetRandomNumber does. Opening them for writing throws.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Since #1178 the SPI_PS_INPUT_ENA/ADDR emplace calls did nothing, so the registered variant had no pixel inputs, and null pixel draws took the last pixel shader's user SGPR count and the bound targets' export mapping. Registration now overwrites those registers, the draw gives the null program no user SGPRs and an empty export mapping, and the at-draw preparation is left for wave32 only. Root cause found by @Raghav314.
A draw that rasterizes both faces with different front and back depth
bias was rejected, since Vulkan has one depth bias per draw and the
cull mode is pipeline state. Such a draw is now recorded twice in the
same pass: front faces with the back faces culled and the front bias,
then back faces with the front faces culled and the back bias. A face
whose offset is disabled gets no bias.
#2279 made agc_driver_f32_arithmetic_nan fail on NVIDIA (Windows):
v_fmamk_f32 returns a quiet NaN where the signalling one is expected
(lane 1 no float mode v_fmamk_f32 is 0x7fc12345, expected 0x7f812345),
5/5 runs on main and 5/5 passing with #2279 reverted. CI's Windows job
skips the AGC execution tests, so it did not show there.
v_fma_legacy was rewritten as a split multiply and add after #2279; it
keeps that and gets back the invalid-product argument it passed before.
Fixes#2581
scePthreadCreate on Linux started guest threads with std::thread, so every
thread got the host default stack (RLIMIT_STACK, usually 8 MiB) whatever the
title asked for. A thread that asks for more than that and uses it crashes
with SIGSEGV. Once the thread ran, scePthreadAttrGet also reported the host
size instead of the requested one.
Create the thread with pthread_create and a stack of the requested size plus
what glibc keeps at its top (static TLS, the thread control block and the
start_thread frame). That reserve is measured once with a probe thread.
The thread reports [top - reserve - size, top - reserve) as its stack, as
Windows reports [top - size, top), and the creator waits until the range is
set, as on Windows.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With f32 denormals flushed, as in the 0xc0 float mode titles use, the
hardware flushes all three v_mullit_f32 sources and its product like
v_mul_f32, so a positive denormal limit selects -FLT_MAX and a tiny
product gives zero. The recompiler kept denormals in every mode.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With IEEE_MODE=1 the hardware quiets each signaling NaN half that
v_pack_b32_f16 packs, after neg and abs; with IEEE=0 it copies the bits.
The recompiler always copied them. Same rule as #1867, measured on
gfx1036 in both modes.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The registered-shader decode ran before the deferral decision, so a single
instruction the decoder does not implement ended the title at registration
instead of deferring the shader to its first use.
Give the decoder's unsupported-instruction failures their own type
(UnsupportedInstructionError): the five family-scoped SOP opcode defaults and
the MIMG opcode lookup (which now names the opcode) raise it, and the decode in
PrepareRegistered defers the shader with that reason when it hits one. Any
other exception still throws, so the corrupt-code contract is unchanged.
PPSA26344 hits this: unsupported MIMG opcode 229 (0xE5), issue #1941. The
failing word is reproducible offline from the title's own shader store
(cache_ps5/all_shaders.xpps, code word 260), which is how the fixture was
checked before it was written.
Scope: this defers the scalar-family and MIMG opcode gaps. The vector (VOP*)
and memory (SMEM/MUBUF/MTBUF/FLAT/DS) opcode lookups, the modifier-level
"not supported" throws and the malformed/truncated throws still abort.
Widening the deferral to those is a policy call for the maintainers.
Stacked on #1836 (the deferral machinery); re-stacked on its current head so
this diff no longer carries #1836's earlier broad catch. Once #1836 lands only
the decode change remains.
Written with AI assistance.
A title that opens a main and an overlay port flips both, and every flip
was presented as a whole frame, so the window alternated between the two
buses: PPSA01736 shows its intro on the main bus and an empty overlay,
and the intro blinked black on every other frame. Overlay flips now
complete and signal their events without being shown. Compositing the
overlay over the main output is not implemented.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A pixel shader whose early discards branch to one small ending block
gave that block several conditional predecessors outside any loop, and
structurizing failed. When the regular pass throws, the structurizer
restarts from the original graph and first gives each conditional
predecessor its own copy of such a return block (within the clone word
floor and a budget of four clones per block).
Uncharted: Legacy of Thieves Collection (PPSA05684) stopped at such a pixel shader with "conditional block 15 has no structured merge".
A typed storage-image heap held four elements, and a dynamic-mip storage
image takes four of them for its mip slots. A shader with a dynamic-mip
storage image and any other storage image of the same class needed five
and failed with "shader image heap capacity exceeded". The mip slots
per dynamic image stay four (StorageMipSlots); a storage heap now holds
sixteen elements (StorageHeapCapacity). Heap arrays are declared with
their compact length, so shaders that fitted before are unchanged.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Vulkan counts the framebuffer colour attachments against maxPerStageResources
for the fragment stage. The draw's attachment count now seeds the fragment
stage's resource total in ShaderResources, so a pixel shader whose buffers and
images fit the limit but whose pipeline exceeds it throws instead of creating
an invalid pipeline. The draw resource cache key carries the attachment count,
so a cached build is never reused by a draw with more attachments.
RADV clears depth by rewriting HTILE with its clear_htile_mask kernel
(ZMASK to 0) instead of writing depth memory. Recognize that kernel and
clear the matching host depth surface to DB_DEPTH_CLEAR when it is next
bound; the depth target now records its HTILE address.
AI-assisted (Claude Code).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The f16 forms of v_fma_mix computed an f32 FMA and converted it to f16,
so a result that lands on an f16 tie after the f32 rounding was rounded
twice. RDNA2 rounds the exact product-sum once. They now use the exact
f64 path of v_interp_p2_f16 and flush f32 sources like v_fma_mix_f32.
They follow the f16 round and denormal fields on hardware, so another
f16 mode throws, as packed f16 does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DEPTH_CLEAR_ENABLE (DB_RENDER_CONTROL bit 0, Mesa sid.h) makes the DB
write DB_DEPTH_CLEAR wherever the draw covers. Such a draw is now
rasterized as submitted with an always-passing depth write, no depth
bounds, no depth bias and the viewport depth range pinned to the clear
value, so it touches exactly the pixels the title's geometry covers.
Clearing a read-only or absent depth plane throws, at decode and in the
draw precheck. Depth and stencil clears combine; copy, resummarize and
decompress draws still throw.
Uncharted: Legacy of Thieves Collection (PPSA05684) clears with draws
that set DB_RENDER_CONTROL to 0x3 and stopped with "depth/stencil
clear, copy, resummarize or decompress draws (DB_RENDER_CONTROL) is
unsupported (register 0x0 = 0x00000003)".
libc implements the C++ exception runtime and already defines
exception_ptr's out-of-line members, so host modules that link libc
reference-count libc's exceptions. Code inside libstdc++-6.dll does not
see those definitions on Windows: std::__future_base::_Result_base's
destructor is one of them, and it releases the stored exception with
libstdc++'s own exception_ptr::_M_release. That decrements a count 0xa0
bytes before the object, while libc keeps it 0x80 bytes before, so the
decrement lands in the heap memory in front of libc's allocation and
the exception is never freed.
VideoOutDriver reports the presentation thread's start-up failure
through a std::promise, so video_out_flip_lifetime sometimes ended with
0xc0000374 when SDL's offscreen driver refused the window.
libc now defines the base destructor, with a _nid_postfix twin so that
the NID-patched libc keeps its name, and modules bind it there.
A zero, unaligned, overflowing or out-of-range length reached the physical pool, where a sub-page length silently freed a whole page and fragmented the block map, and an out-of-range length walked the page table past the backing store. Validate alignment and bounds up front and return EINVAL instead.
- DISPATCH_DIRECT and DISPATCH_INDIRECT with the SHADER_TYPE header bit,
which RADV sets on every dispatch, as other packets already may.
- FORCE_START_AT_000 in the dispatch initiator. The driver never offsets
dispatches by COMPUTE_START_X/Y/Z, so it already starts at zero.
- LOAD_CONTEXT_REG_INDEX, LOAD_SH_REG_INDEX and LOAD_UCONFIG_REG_INDEX in
their consecutive-register form (a register offset and a count, DATA_FORMAT
0), which RADV uses to load DB_STENCIL_CLEAR and DB_DEPTH_CLEAR from an
image's clear values. The offset-and-data form keeps its old checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
RADV builds its own command streams. Its preamble and draws use packet
forms the validator refused:
- CONTEXT_CONTROL that only updates the load and shadow enables to zero,
which RADV emits when it does not shadow registers. It is a no-op.
- SET_UCONFIG_REG_INDEX of VGT_PRIMITIVE_TYPE with index 1, next to the
index-2 VGT_INDEX_TYPE write already accepted.
- WRITE_DATA to memory (DST_SEL 5) from the graphics queue.
- DMA_DATA with DST_SEL NOWHERE, RADV's L2 prefetch of shader code. It
writes nothing and resolves to an empty store.
- EVENT_WRITE PIPELINESTAT_START, PIPELINESTAT_STOP, SQ_NON_EVENT and
VGT_FLUSH. The statistics counters are not modelled, and the events that
would read them stay rejected.
- ACQUIRE_MEM over the full 48-bit range (COHER_SIZE_HI and COHER_BASE_HI).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
VOP3 0x140 is v_mad_legacy_f32 on gfx10.1. Measured on gfx1010 (RX 5700
XT) in wave32 and wave64, IEEE 0 and 1 and f32 denormal modes 0 to 3, it
rounds the product before the add, flushes f32 denormal sources, product
and result in every mode, and gives a +0 product for a zero factor.
The translation multiplies, applies the zero rule and flushTinyProduct,
adds, and keeps the nanResultF32 wrapper. f32DenormalFlushFor returns 3
for the instruction before reading FLOAT_MODE. A sum of two zeros takes
its sign on the bits, as lavapipe returned -0 for +0 + -0. The execution
test pins the measured results and compares NaN bits exactly. RDNA2
(gfx1031), where the encoding is v_fma_legacy_f32 and fused, is noted in
TechnicalDebt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Importing guest memory collected the write watch over the whole import,
which write-protected every page of it, so pages nothing had collected yet
took a write fault on their first CPU write. The import now collects only
the parts a collect already protects (GuestWriteWatchCollectArmed). The
rest stays unprotected until something collects it, which reports it as
written; a GPU write recorded into such memory (MarkWritten) first collects
the never-collected parts of its 64 KiB blocks
(GuestWriteWatchCollectFresh), so that report is older than the GPU's
results and does not read as a CPU write over them.
Those pages are stamped as written and their CPU pages are noted, but the
block's CPU stamp is left alone, so a GPU label record or a pending storage
image elsewhere in the block does not see a CPU write. StoredOver and
UnchangedSinceCollected read the noted pages whenever a block has them, so
a store to such a page is still seen by a check over that page. The extra
generation step happens only when something was collected; a block whose
write protection fails is unwatched and the write returns no generation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The padded, exact-fit and invalid-conversion swprintf checks come from #1512.
Co-Authored-By: Noface07 <yuvrajsoni7@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ULF8vCbJFyzxVsW3SfiWC5
flock_nid_postfix threw on every failure, so a LOCK_NB request on a lock
held through another descriptor ended the process. FreeBSD flock(2)
returns -1 with EWOULDBLOCK there. Return guest errno 35 when LOCK_NB is
set and the host reports the lock as held: ERROR_LOCK_VIOLATION on
Windows, EWOULDBLOCK on Linux. Other failures still throw.
A formatted buffer load or store whose format comes from a prepared
descriptor emitted the switch over every buffer format inline, at each
access. The switch is now emitted once per resource, component count and
direction as a SPIR-V function taking the index, offsets, record count and
storage buffer offset, and each access calls it. Specialization still folds
the switch to the descriptor's format. Accesses through GPU-selected
descriptors keep the inline switch.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FreeBSD's __sflags reads the access character, then b, +, x, e and v, and
stops at the first other character without failing, so "rt" opens for
reading. On Windows fopen inserted b after the first character and passed
the rest on, so "rt" became "rbt", the CRT rejected it with EINVAL, and
fopen threw. vkQuake opens history.txt with "rt" at startup. freopen
accepted only a fixed list of modes.
Both now parse the mode like __sflags. An unknown access character, or x
on a read-only stream, returns NULL with EINVAL; x on an existing file
returns NULL with EEXIST; e and v are accepted and ignored.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An anonymous private mapping with MAP_ALIGNED_SUPER (FreeBSD MAP_ALIGNED(1))
is placed on a 2 MiB superpage boundary. Yamagi Quake II requests it for its
hunk allocations of 2 MiB and more.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SDL queries the SCHED_OTHER range before it sets a thread priority. It gets
the same 256 to 767 range as SCHED_FIFO and SCHED_RR, which
pthread_setschedparam applies regardless of policy. The console's answer is
unverified and recorded in TechnicalDebt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A global_store_dwordx2/x3/x4 was split into one StoreAddressU32 per
dword, each with its own write-pointer lookup and its own 4-byte store.
Across a wave those are strided partial writes, which are very slow to
host memory: RADV's clear_htile_mask kernel (one dwordx4 load and store
per thread over 640 KiB) took ~9 ms. Multi-dword stores are now one
StoreAddressU32xN; the emitter probes the whole span once and, when it
is mapped writable and 4-byte aligned, stores it as one vector (16- or
8-byte aligned) or as consecutive dwords, noting each written page.
Anything else takes the per-dword path as before, so faults and
range-spanning stores behave as they did. APS5_BDA_DWORD_STORES=1
restores per-dword stores.
AI-assisted (Claude Code).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
0xffff1000 is a type-3 NOP whose count field is 0x3fff, which the command processor reads as a single dword. The driver read it as a 16385-dword packet and rejected every sceAgcDcbResetQueue envelope. Pm4::FillerPacket now also matches exactly this header, so every packet walker steps over it as one dword.
Refs #1581
The case reached the compared path once host imports kept a guest-byte
snapshot, so it passed without the fix. It now runs over watched memory
without an import on every host, and over a watched host import on Linux
(the font atlas's path, with no valid snapshot), checks the image is on
that path, and runs as its own ctest test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A write-back keeps the CPU's bytes for a block stamped since the layer's
generation. Stamps can fall on bytes the CPU did not change (PPSA12544's
font atlas: the stamped pages still hold the allocator fill the image was
uploaded from), and the GPU results there were lost. Images up to 1 MiB
keep the guest bytes of their generation point; a stamped range that still
equals them stores the GPU results.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A CMASK that was neither all fast-cleared nor all expanded threw, so a
title that fast clears a target and then draws over part of it before the
eliminate could not run past it.
The CMASK is now decoded tile by tile: one nibble per 8x8 tile in
1024x512 metablocks of 4 KiB, addressed with the pipe-aligned
SW_64KB_Z_X CMASK equation for 16 pipes (addrlib
GFX10_CMASK_SW_PATTERN, Gfx10Lib::HwlComputeCmaskAddrFromCoord). Code 0
stores CB_COLOR_CLEAR_WORD into the tile's texels, 0xF keeps them; any
other code, a cleared tile of a DCC target and any other CMASK swizzle
mode throw. Edge tiles are included and the CMASK is then stored as
expanded.
For a resident target whose CMASK is host-imported the clear is a
compute pass recorded in stream order: it reads the nibbles from the
import, stores the clear into the cleared tiles through a UINT view of
the image and fills the CMASK expanded, so nothing waits for pending GPU
writes of the CMASK. Invalid codes it reads set a bit that the next
materialization throws on. Otherwise the CPU reads the CMASK and stores
the cleared tiles into guest memory, or fills the resident image when
every tile is cleared. A CMASK nothing has stored over since it was
expanded is skipped.
The decode requires CB_COLOR_ATTRIB3 FMASK_SW_MODE SW_64KB_Z_X with
CMASK_PIPE_ALIGNED, a 4 KiB aligned writable CMASK and texels of at most
64 bits, and CMASK_BASE_EXT is part of the draw key.
Tests: CMASK sizes and nibble addresses against addrlib; decode
rejections and draw key coverage; CPU eliminate of full, partial,
out-of-range-nibble and DCC decompress cases and invalid codes. The new
agc_driver_cmask_fast_clear GPU test draws over fast-cleared and partly
fast-cleared linear and SW_64KB_R_X targets, eliminates partial, edge
and checkerboard CMASKs through the compute pass and checks that an
invalid code it reads throws.
A wave64 vertex program reduces a float key across the wave with the same shape as the integer half-wave reductions: keys selected under the all-lanes EXEC with -inf (v_max_f32) or +inf (v_min_f32) outside the entry EXEC, four DPP row_shr steps, v_permlanex16_b32, then v_readlane_b32 of lanes 31 and 63, combined by one more v_max_f32. On a 32-lane host subgroup the read of lane 63 threw that it is outside the subgroup.
The matcher now also accepts FPMax32 and FPMin32 steps, with their BitCasts and the f32 denormal flush the float mode may add around operands and results; the flush leaves the -inf and +inf keys unchanged. When the entry EXEC proves that lanes 32-63 hold the constant key, every step there combines that constant with itself. The existing v_max_f32/v_min_f32 lowering returns the operand unchanged for equal operands (NaN included), so lane 63 is exactly that constant, and the read returns it. No subgroup float reduction is emitted. Lane 31, the lanes on a 64-lane subgroup, and the combining v_max_f32 keep their existing lowering. So NaN and signed-zero results are the ones the shader computes today.
On Linux, sceKernelSync called sync(2), which blocks until all
dirty pages are written back. Unrelated host I/O can stall guest's
sceKernelSync, causing the guest_kernel_sync test to stall for minutes.
Share the Windows implementation instead.
Fsync each recorded path and its changed parent directories.
Use st_mtim and coarse realtime mark on Linux in place of FILETIME.
Every draw copied its index range and its vertex ranges out of guest
memory into new host buffers (CopyDrawInput) before the GPU could read
them. A range that lies in a host import is now bound from the import
itself, at its offset in it, the way the console's input assembler reads
guest memory directly.
A range is bound in place only when the batch has no write over it that
could still land (a recorded or in-flight GPU write after the pending
results are flushed, a completion label, a queued label store, a copied
buffer a dispatch or draw writes back) and its offset in the import is a
multiple of what the reader needs: the index size, or the strictest
format alignment of the vertex attributes that share the range
(VertexCopyPlan::alignments; a copy starts its range at offset 0, so
only an in-place range can be misaligned). Otherwise it is copied as
before. The read is noted on the batch (Recorder::ReadKind::DrawInput),
so a CPU store into the range waits for the draw like the other in-place
readers, and the barrier validation sees it. Imports gain vertex and
index buffer usage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FreeBSD sys_flock takes LOCK_UN over LOCK_EX over LOCK_SH, ignores other
bits and fails with EBADF when none of the three is set. The operation
reached the host unchanged, so malformed operations differed between
hosts: Linux rejects them with EINVAL and the Windows lock tracking threw.
Decode the operation before either host sees it.
flock mapped each call straight onto LockFileEx/UnlockFileEx, whose
byte-range locks stack per handle. LOCK_UN without a lock failed with
ERROR_NOT_LOCKED and aborted the process, a repeated LOCK_EX blocked
forever, converting between shared and exclusive failed, and a repeated
LOCK_SH needed as many unlocks.
Track the one lock each descriptor holds: a repeated mode and LOCK_UN
without a lock succeed, a conversion releases the old lock before taking
the new one, and close forgets the descriptor's lock.
On Windows the existence check accepts "file/", then _wstat64 rejects
it and FillFileStat throws, aborting the title. On Linux the host
reports ENOTDIR, which became ENOENT. A trailing slash on something
that is not a directory now returns ENOTDIR on both hosts, as on
FreeBSD.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Format the address bytes in network order as dotted decimal into a
per-thread buffer, like FreeBSD's inet_ntoa returns its static one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FreeBSD's gettimeofday stores the time only when tp is not null, and
clock_getres the resolution only when res is not null; both succeed
otherwise. Both threw, which aborted a title probing a clock or only
asking for the time zone. Write into a local result instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A 3D image access bound to a 2D T# matched no runtime image mode and
threw "image descriptor is incompatible with the static runtime image
interface" (Sonic Origins, #2023). CouchRiv measured RDNA2 (gfx1036)
with the hardware oracle: image_sample_lz with dim 3D ignores r and
reads the (u,v) texel, and image_load reads the (x,y) texel when z is
0 and returns zero otherwise. Add a 2D mode for 3D accesses whose only
uses are those two forms, and make the load return zero for z != 0.
Every other access keeps throwing.
Fixes#2023
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Windows runner has no Vulkan driver, so agc_pipeline_cache (#1331)
fails at device creation: 'AGC graphics: vkCreateInstance: Vulkan
result -9'. Skip with 77 like the other agc execution tests, unless
ANYPS5_REQUIRE_VULKAN is set, as on the Linux job.
video_out_flip_tests writes app0/sce_sys/param.json in the shared test
directory on every run, and every VideoOut window reads it for its
title. Under ctest --parallel one test read the file while another
rewrote it: 'unexpected end of param.json' in video_out_flip_controls.
Give all of them one RESOURCE_LOCK.
The unopened-handle checks call sceVideoOutIsOutputSupported before
sceVideoOutOpen, and that first call builds the VideoOut driver, whose
window creation throws without a Vulkan-capable SDL driver. The throw
left main before the skip, so the test aborted on the Linux runner:
'DisplayWindow: Vulkan support is either not configured in SDL or not
available in current SDL video driver (offscreen) or platform'.
Run those checks inside the same skip.
guest_video_out_output_mode (#1496) opens VideoOut directly, which needs
a Vulkan-capable SDL window, and aborts on the CI runners that have none.
Skip with 77 like the other VideoOut window tests, unless
ANYPS5_REQUIRE_DISPLAY is set.
AJM's instance and batch tables and APR's file, directory and AMM
state were namespace-scope statics, destroyed by std::exit while the
title's threads keep calling the libraries. A decoder thread then read
a freed instance (an unknown codec), sceAjmBatchWait no longer found
its batch, and APR resolved file ids through a freed vector. The state
is now allocated once and never destroyed.
A port kept only the last PCM buffer set before a push and played it again
at every later push without a new one. PPSA12544 sets one grain of a ring
buffer per call on its object port, often two or three between pushes and
then none for a few, so all but the last of each burst were dropped and the
stale grain repeated: a buzz on loud sounds and after a sound stopped.
Buffers set between pushes are now queued and played in order, at most 16
queued. A push without a new buffer repeats the last one only for a port
that has always been given the same buffer (rewritten in place, as the
timing tests do); a port whose buffers move on plays silence.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without VK_KHR_fragment_shader_barycentric the recompiler dropped
v_interp_p1_f32 and made v_interp_p2_f32 read the attribute Vulkan
interpolated, but never wrote the I/J VGPRs: a pixel shader that read
them for anything else got 0, and v_interp_mov_f32 of P10/P20 (or P0 of
an interpolated input) needed PerVertexKHR and failed pipeline
validation.
The fallback translation now loads the I/J VGPRs and marks v_interp_p1
and v_interp_p2 with witnesses. After the front-end simplification
(SSA, folding, DCE, read-lane and masked-select elimination),
HostInterpolationChecker requires every p2 to read its J, and its p1's
I, from a barycentric of the parameter's kind, every p1 result to reach
only the matching p2 (through a write masked by the p2's EXEC, whose
inactive lanes keep the old register), no parameter read as raw
vertices and no slot shared by different interpolations. It then
lowers the witnesses to the host-interpolated attribute as before,
reruns DCE and masked-select elimination, and accepts the program only
when no barycentric read remains, so reusing the I/J VGPRs after
interpolating keeps host interpolation and the previous SPIR-V. Any other
program is translated with the barycentric path and marked as emulated:
its barycentrics become vec3 inputs (NoPerspective for the linear
weights) and its per-vertex parameters flat vec4[3] inputs, placed in
the free locations by LayoutBarycentricEmulation. The driver then
inserts a generated geometry stage between the vertex and fragment
shaders that copies the position and parameters, writes the one-hot
weights of each vertex and the three vertices' parameter values, so the
rasterizer interpolates the same weights the extension provides.
The stage needs geometryShader and a vertex shader before it;
tessellation, mesh and rect-list pipelines, other primitive types and
interfaces beyond 32 locations or the device's geometry limits throw.
CompiledShaderArtifact carries the emulation (shader disk cache format 21).
Hardware snaps window corners to 1/256 pixel before interpolating
(measured by yahya308 on an RTX 4070 Laptop and a Radeon 780M in #1547);
lavapipe snaps only for coverage (lp_rast.h FIXED_ORDER 8), so the test
accepts either reference per pixel at the original 1e-4 margin.
Sources:
- v_interp_p1_f32/v_interp_p2_f32/v_interp_mov_f32 semantics (P0,
P10, P20, I/J): AMD RDNA2 ISA, "Parameter Interpolation".
- BaryCoordKHR/BaryCoordNoPerspKHR weights and PerVertexKHR vertex order:
SPV_KHR_fragment_shader_barycentric, VK_KHR_fragment_shader_barycentric.
- Geometry shader triangle input order and provoking vertex: Vulkan
specification, "Primitive Topologies" and "Geometry Shading".
- Interpolation decorations decided by the fragment input: Vulkan
specification, "Interpolation Decorations".
- lavapipe interpolation: Mesa src/gallium/drivers/llvmpipe/lp_rast.h
(FIXED_ORDER 8), lp_setup_tri.c (subpixel_snap for coverage only),
lp_state_setup.c (init_args, plane setup from float positions).
A PIXEL_PIPE_STAT_DUMP event (EVENT_WRITE 0x39, Recorder::DumpSamples)
ended the render pass the previous draw left open: the dump ended the
batch-long occlusion query, copied its result with
vkCmdCopyQueryPoolResults and ran the fold kernel, none of which Vulkan
allows inside a render pass. VulkanDevice::DumpSamplesOnGpu also flushed
the queued store run over the dumped bytes first, which ended the pass
and recorded the run's barriers as well. A title that clears each query
slot with WRITE_DATA and brackets every bounding draw with a begin and an
end dump gets a render pass, two copy barriers and a label run per draw.
Samples are now counted in segments. A segment is one slot of a
per-batch occlusion query pool (128 slots, reset outside any pass when the
batch's first pass needs one). It begins at the first draw recorded after
a pass begins or after a dump, inside that pass's subpass, and ends at the
next dump or right before vkCmdEndRenderPass, so each query begins and
ends in one subpass. A pass whose pool has no free slot left is not
continued, so a new pool can be reset. The draw path that records a whole
pass of its own prepares a slot before its pass and ends its segment
before ending it.
A dump ends the open segment and is queued in the batch's store run with
the number of segments before it; it no longer ends the pass and no
longer flushes the queued stores. The run is recorded where queued stores
already are: at Submit, or earlier when a later command reads or writes
the queued bytes. Its recording copies the results of the segments the
dumps need (one vkCmdCopyQueryPoolResults per contiguous slot range) and
the dump list, then records the queue in groups: a group's stores, then
one dispatch of the SampleDumps kernel, which adds each dump's segments to
the running total and stores the 16 counters in queue order. A store over
bytes a dump of the current group writes starts a new group, so every
byte ends with the value of its last write in program order
(Recorder::QueuedWriteGroups). At Submit, segments no dump consumed are
folded the same way once 64 are pending.
No reader sees a dump later than before: a CPU reader of the dumped bytes
syncs the batch (the dump still notes them as a pending write), and Submit
records the run before the batch ends; a later label or store is queued
after the dump in the same run; GPU work that reads or writes the queued
bytes flushes the run first, as for queued label stores. No reader sees it
earlier either: the dump is recorded after every draw whose samples it
counts, and its segments end at the dump. Without the GPU sample counter
(no buffer device addresses) the batch-long query is kept as before.
Tests (agc_driver_recorder_tests, GPU, run by hand): QueuedWriteGroups
keeps the program order's bytes for 20,000 random store and dump
sequences; a queued dump does not land before its run is recorded, a
reader of other bytes leaves it queued and a reader of its bytes records
it; clear, dump and store orders over shared bytes; two dumps inside one
render pass keep it open (the next draw continues it) and split its three
draws' samples exactly with precise queries; a reader flushing a dump
inside a pass ends the pass; 160 dumps in one pass past a pool's 128
slots; 70 passes without a dump folded at Submit.
Main renders depth and stencil tests without a depth target when DB_Z_INFO and DB_STENCIL_INFO both have FORMAT INVALID (48ebf3195e): with no plane, the DB has nothing to test, and every test passes. The depth bounds test (DB_DEPTH_CONTROL bit 3) reads the same absent depth plane, but such a draw still threw "depth bounds without a depth surface". A title does this when a level loads.
Depth bounds now follow the same rule when both planes are absent. With an absent depth plane beside a present stencil plane, the bounds test still throws ("depth bounds without a depth plane"), as before.
Every direct memory allocation had a memfd of its own, so each one the
GPU used became its own udmabuf and its own imported buffer object. An
imported buffer object cannot be always valid in the GPU VM: amdgpu
validates every one of them at every command submission. PPSA14632
(LEGO Horizon Adventures) imports about 7000 allocations, 5800 of them
64 KiB, and each vkQueueSubmit took about 2.3 ms (5 s per 10 s, held
under the GPU mutex). A standalone test shows the cost follows the
count of imported dma-buf buffer objects, not their size or the count
of ordinary allocations.
- libkernel: on Linux all direct memory lives in one sparse memfd of
DIRECT_MEMORY_SIZE, at file offset = physical address
(PhysicalBacking keeps the file and its offset; SharedBacking returns
that offset). A range allocated again is zeroed through a temporary
mapping, as the old per-allocation memfd was.
- Driver: an import of shared direct memory that lies inside one
64 MiB chunk of the file binds its own VkBuffer into that chunk's
memory, one udmabuf import per chunk (HostImport::chunk holds it, so
it lives until the last buffer bound to it retires). Ranges that
cross a chunk or do not meet the buffer alignment are imported alone
as before.
On PPSA14632 vkQueueSubmit drops from about 2400 us to 46 us on
average, the GPU idles 36 ms instead of 172 ms per present, and
presents go from about 40 to 80-97 per 10 s.
Released direct memory stays committed in the file (see
TechnicalDebt.md): a live chunk import pins its pages.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
macOS has no counterpart to userfaultfd write-protect or
MEM_WRITE_WATCH, so GuestWriteWatch had no backend there and the driver
re-read every guest buffer on each use.
The macOS backend write-protects watched pages. The first write to a
page faults, the SIGBUS/SIGSEGV handler records the page and restores
its protection, and Collect reports the recorded pages and protects
them again. A page is protected before its record is cleared, under the
lock the handler takes, so a write that lands in between is recorded.
The lock hands out turns in order: an unfair one starved writers under
Rosetta.
The protection is real, which adds three entry points:
- GuestWriteWatchBeginHostWrite/EndHostWrite lift it around a system
call that writes guest memory, which would otherwise fail with
EFAULT. GuestArena::HostWrite calls them, as it calls the Windows
equivalent.
- GuestWriteWatchProtectionChanged tells the watch the protection given
to watched pages by mprotect or a new mapping.
- GuestWriteWatchProtection reports that protection, since a watched
page is read-only between a collection and the next write.
Register keeps the recorded protection of a page it already watches:
read from the kernel it would be the watch's own read-only protection,
and the page would never be watched again.
The tests build without the prx libraries and run natively and through
Rosetta.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Retain an immutable decoded program and structured control flow while
preparing the registration variants for one shader.
Match owned code, stage and the complete SWAPPC inputs before reuse.
Translate and plan each variant separately using its current inputs.
Keep cache keys and persisted artifact layouts unchanged.
Provide a cache-neutral off switch for controlled comparisons.
Cover identity, lifetime, failed replacements and variant equivalence.
Main's Linux job fails since #1028 and #1714: guest_video_out_resolution_status aborts when SDL's offscreen
driver has no Vulkan window, and check_skips.py rejects the skips of guest_video_out_wqhd_detection and the
flip tests because "no display" is not among the device limitations it accepts.
The resolution status test now skips with code 77 like its wqhd sibling, the flip tests print the same skip
reason, and check_skips.py accepts "no display" as a device limitation. ANYPS5_REQUIRE_DISPLAY still turns
the skip into a failure.
AI-assisted: yes. Full current-main project build passed. Seven focused Windows tests pass; four shader tests also pass in full and none optimization modes with actual Vulkan execution required. Updated Linux and title runs remain pending.
gmtime, localtime, mktime, strftime and asctime took and returned the
host std::tm. The guest's FreeBSD tm has tm_gmtoff and tm_zone after the
nine calendar fields, so on Windows, where std::tm is 36 bytes, a title
reading those fields read past the thread-local result, and gmtime_s left
them unwritten. Windows gmtime_s also accepts only 1969-12-31 12:00 to
3001-01-19 21:59 UTC, where the guest libc converts any time.
Convert through a GuestTm with the guest layout on both hosts. Compute
the UTC fields from the day count, so every time whose year fits an int
converts, and on Windows take the local offset and zone name from the
CRT. gmtime reports the zone as UTC like the guest libc. localtime and
mktime keep the CRT's range on Windows; recorded in TechnicalDebt.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
As requested in review: a failed sceKernelGetModuleInfoFromAddr no longer
reports an empty answer. Adds a failure test (symbol interposition) and
extends the metadata test (EH record walk, terminator, no-header DSO).
Co-authored-by: jweidenh <38249793+jweidenh@users.noreply.github.com>
Co-Authored-By: Claude <noreply@anthropic.com>
A title that ships its own libc.prx unwinds C++ exceptions with that
libc's libunwind, which asks sceKernelGetModuleInfoForUnwind where each
frame's eh_frame is. On Linux the call always reported no tables, so
no C++ exception thrown in guest code could be caught. For the main
executable and .guest.prx images, report the PT_GNU_EH_FRAME tables
that sceKernelGetModuleInfoFromAddr finds, as Windows does from
.ehmeta. Other host images still report none.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HeC9bA3n74TzJRYv9AgBE8
CB_COLOR_INFO format 6 (COLOR_10_11_11) with NUMBER_UNORM threw in
DecodeColorFormat: Vulkan has only the B10G11R11 float format. Such a
target now renders into an R32_UINT attachment in the layout of
format-30 images (unorm11 R and G in bits 0-21, unorm10 B in bits
22-31), so later image loads of the surface read the same words.
The target format is draw state, so the packing is a specialization of
the registered pixel shader: every float MRT export also computes the
packed word (EmitFormatStoreComponent) behind specialization constant
ExportPackingBase + target, and the specialized module turns a packed
target's output into a uint4 that ValidateShaders expects. The new
request field targetExportPacking is in the module key, the result memo,
the draw key and the serialized request (version 14). Blending, partial
RGB writes, UNORM16/SNORM16/UINT16 exports, DCC and ROUND_MODE throw.
agc_driver_pending_exact_surface writes mip 0 of a 2-mip 256x256 surface and then a 1-mip surface at the same address. The chain's mip 0 lies past the 1-mip surface's bytes, so both images stay pending, the chain first. A lookup of the 1-mip size must return the 1-mip image, and with only the chain pending it must still return the chain. On main the first lookup returns the chain.
Winsock fails send, sendto and sendmsg on a socket shut down for writing
with WSAESHUTDOWN, which neither Windows error map handled, so libkernel
and libSceNet reported EIO. FreeBSD reports EPIPE there, and the Linux
maps already translate the host's EPIPE to 32. Map WSAESHUTDOWN to 32
in both.
agc_driver_graphics registers a D32 and a D16 surface on a mock device and looks up views at their addresses. Views of the surface's own extent in R32F or R16, and T#s that read the raw depth bits, sample the depth plane; a view of another extent, a 2D array view of another extent, an R11G11B10 view, an R32 uint view without a depth layout and an R32F view of a D16 surface return null and take the ordinary texture path. On main the first of these throws in DepthSurface::Sampled.
Measured on a PS5 (firmware 13.60) through dlopen of
libSceVideoOut.sprx on a handle the payload opened.
sceVideoOutInitializeOutputOptions writes 0xFF to byte 2 of the 64-byte
options and returns INVALID_ADDRESS for a null pointer.
sceVideoOutIsOutputSupported checks the handle, then the reserved
arguments, then the mode, then the options. It never answers 0: a mode
the display lacks returns UNSUPPORTED_OUTPUT_MODE, and a value that is
not a mode returns 0x8029001E. Options must keep the initialized words,
except word 3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fill takes either info struct, so sceKernelGetModuleInfo reports the
name and segments sceKernelGetModuleInfoFromAddr reports for the same
image, on Linux and Windows.
A sampler with FORCE_DEGAMMA (S# word 0 bit 20) threw at decode, so
every dispatch or draw sampling through one was skipped.
DecodeSamplerResource now records the bit, but accepts it only for a
caller that pairs the sampler with its images. The direct sampler
binding does, and RequireDegammaFormat checks each sampled image
against its paired samplers: only already sRGB formats (8, 8_8 and
8_8_8_8 SRGB, BC1, BC2, BC3 and BC7 SRGB) pass, decoded once, as
shadPS4 (PS4) models it. Other textures and unpaired decodes still
throw; gfx10 behaviour is not measured.
On Windows, nanosleep and this_thread::sleep_for/sleep_until go
through winpthreads, which ends a wait on a 15.6 ms GetTickCount64
step. Blocking sceAudioOutOutput and sceAudioOut2ContextPush calls
returned in bursts about every 16 ms, a blocking sceAudio3dPortPush
ran at about 68 % of real time, and sceAudioInInput without a device
woke anywhere from 1 ms to 31 ms apart. They now sleep with
PreciseSleepUs or the new PreciseSleepUntil.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sigprocmask keeps the first word of the title's set as it is, where
FreeBSD keeps signal n at bit n - 1 (_SIG_BIT), but Dispatch tested bit
n. A title that blocked SIGTERM with a FreeBSD-built set (bit 14) was
not protected, and a set with bit 15 blocked SIGTERM instead of SIGURG.
Dispatch now tests bit n - 1; the stored mask and the set returned by
sigprocmask are unchanged.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
When every dst_sel of a sampled view selects constant 0 or 1, a sample
or gather returns that constant whatever the texel, filter, LOD or
coordinates. Such placeholder views can have a dimension the static
runtime image interface has no mode for (a 3D view under a 2D sample,
a 1D view under a 2D gather), and a 3D one paired with an unnormalized
sampler fails the unnormalized proof.
A direct sampled image whose accesses are all non-compare samples or
gathers gets three constant runtime modes (float, uint, sint). The mode
is selected when all four dst_sel are 0 or 1, unless the view is FMASK,
depth bits, converted or sRGB-decoded. In it the emitter returns each
channel's constant (the dmask channel's, in all four texels, for a
gather) from the image's swizzle specialization constants, and the
image is left unbound. ProveUnnormalized skips the mode after the
run-time-selected check, so table roots still throw.
Untracked host imports may retain pending image results on the GPU after an unchanged refresh. Assert that behavior and verify that an explicit FlushPending makes the results visible in guest memory, while watched memory still checks refresh write-back.
Fixes#2155
Keep serialized lookup scratch under the existing pipeline cache mutex and use the standard byte-string hash for indexing. Preserve exact key comparison and private handling of unidentified shaders. Add a real-device cache lifetime fixture and warmed lookup benchmark.
Written with AI assistance.
sceKernelLoadStartModule discarded its arguments, and the relinker's Linux guest writer
synthesized an initialisation trampoline that also cleared the argument registers before
jumping to the module entry point, so a converted module always reached its own start-up
code with args = 0 and argp = NULL.
On PPSA28997 two of the title's own modules validate that parameter block as their first
act and dereference it unconditionally: SaveData faults on `mov (%rsi),%eax` with rsi = 0
beside its `cmp $0x10` size checks, and PSN faults the same way at PSN+0x3ee7 with rbx = 0.
The Windows branch delivers the block, so identical code reports its parameter-version
error and continues instead of faulting.
sceKernelLoadStartModule now records the pair before dlopen and clears it afterwards, and
the emitted DT_INIT stub reads it through two accessors exported by libkernel. The
initialiser is called rather than tail-jumped so its return value can be reported through
*res as the PS5 API specifies. The state is thread_local, which makes the handoff per-call:
ld.so runs a module's initialiser on the thread that called dlopen. DT_FINI keeps a plain
call-through, so unloading neither reads stale arguments nor reports a result.
The accessor names use the _nid_no_patch suffix so the NID resolver leaves them alone and a
guest import can name them exactly.
Retain host backing views for emulator writes and completion labels. Validate full spans, preserve write versions and GPU ordering, and keep the fallback for other mappings. Test remaps, aliases, access checks, partial failures, tracking, view lifetime, and completion ordering.
Written with AI assistance.
Keep logical sample and skip counts across byte-only continuation buffers, assemble split superframes, and allow callbacks to refill, pause or reset the stream. Preserve decoded audio while waiting for input and reject truncated closed streams.
Validated with seven NGS2 tests, an ASan/UBSan streaming test build, and PPSA03747 repeatedly supplying continuation buffers during playback. Flag semantics follow the pinned KytyPS5 source documented in TechnicalDebt.md.
Written with AI assistance.
The named VRR functions hash to LibwuIonIBw and kP2L8t3j-aM already.
Their explicit aliases therefore create second PE exports with the same
patched NIDs and prevent Windows builds from completing.
Keep the named function exports and remove their redundant aliases.
The NID patcher's duplicate-export validation remains unchanged.
Scan version stamps within contiguous leaves. On Linux, collect nearby
pages within queue epochs only after confirming full watched coverage.
Keep the requested range on Windows. Select the range before collection
and do not retry a failed walk.
Test sparse-leaf boundaries, write histories, partial unwatches and epochs.
Fedora 44 Release tests pass with default, disabled and shared caching.
Isolated upstream comparison reduces the saved collect replay by 11-12%.
Windows was not tested.
AI-assisted: yes.
EVO-PLAYER (PPSA99039) v0.11.0 stops at sigaction once its earlier
imports resolve: it installs a crash handler for SIGSEGV, SIGBUS and
SIGABRT and a quit handler for SIGTERM, SIGINT and SIGHUP at start-up.
sigaction records the handler, flags and mask of signals 1 to 128 and
reports them back, with FreeBSD's EINVAL cases. signal shares the table
and records SA_RESTART, as FreeBSD's libc does. Plain handlers on the
signals signal already delivers run as signal handlers do; SA_SIGINFO
handlers and other signals are recorded only, and raise of such a
signal throws.
Assisted by Claude Code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DwFnKjMxmwGDWiuYYf1v4D
On Linux, shared direct memory is imported through /dev/udmabuf (#943).
Many distributions create it as root:kvm 0660, so a user outside the
kvm group cannot open it. The ranges are then copied instead of
imported, and GPU stores through FLAT/GLOBAL addresses to them fail
with "BDA access failed": DOOM PPSA99666's compute presenter falls back
to its CPU scaler. The only trace was "failed at open /dev/udmabuf
(-1000072003)", a Vulkan result that hides errno.
Print the open error once, with the fix for EACCES, and document the
requirement in USAGE.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With OOB_SELECT 0 and stride 0 every access is out of range now that the
buffer bounds follow OOB_SELECT, so the shader never read or wrote.
Co-Authored-By: Claude <noreply@anthropic.com>
Expected values measured on RDNA2 (gfx1035) with the HW oracle at IEEE=0
and IEEE=1, f64 denormals kept.
Co-Authored-By: Claude <noreply@anthropic.com>
A subnormal operand sent v_fma_f64 to a separate multiply and add, and a
subnormal result was rounded twice: once to 53 bits in the scaled domain
and again by the power-of-two rescale. Both differ from IEEE 754
fusedMultiplyAdd in the last bit.
Subnormal operands are now widened by 2^64 and enter the exact path with
their exponent lowered by 64. The exact path keeps the sign of the residual
between the 53-bit result and the exact sum; when the result lands on a
midpoint of the subnormal grid it is moved one ulp towards the exact sum
before the single final rounding. Normal results are rebuilt by setting
the exponent, so only a subnormal result rounds. v_div_fmas_f64 shares the
path.
Each Windows AIO request is an overlapped ReadFile/WriteFile at the
request's offset, which on a synchronous handle also moves the
descriptor's file pointer; on the console AIO transfers leave it alone.
The requests now go through the positioned path sceKernelPread and
sceKernelPwrite use (NativePositioned in Stdio.cpp, exposed as
NativePositioned_nid_no_patch), which restores the pointer afterwards.
Negative offsets still fail with EINVAL before the transfer.
GuestAio sets the offset to 2 before a write batch and checks it is
still 2 after. TechnicalDebt records that a concurrent read or write on
the same descriptor can see the moved pointer in between, as for the
pread family.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UTjpbMX7BUFMZZaxJE98zV
A use of the packed ancillary VGPR other than a constant field extract (the word passed through a
select before its sample number is extracted) reads the word rebuilt from the sample number (bit 8)
and the render target index (bit 16). Extracts of other bits straight from the word stay refused, and
the refusal now names the uses.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Use the current registered range after protection splits and partial unmaps, including FIND_NEXT lookups. Add a regression covering extents, protection and surviving contents.
AI-assisted: yes
Keeps both new TechnicalDebt entries: this branch's note that a raise
can still reenter host code it interrupted, and #2107's sigaltstack note.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
read, write, _read and _write on a guest socket descriptor went to the
host, which has no such descriptor, so sceKernelRead and sceKernelWrite
threw. They now reach the socket as recv and send without flags, with
the socket layer's errno (EAGAIN 35, EPIPE 32, EBADF 9), a zero-length
read returns 0 as dofileread does, and the two sceKernel forms return
the kernel error for the same cases. The host's SIGPIPE on EPIPE, a
write above INT_MAX bytes, readv, writev and the positioned forms are
recorded in TechnicalDebt.
OpenSSL's QUIC notifier signals its socketpair with write and read.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The status layout is shadPS4's OrbisGameLiveStreamingStatus2 (72
bytes). Live streaming is not supported, so the call reports that no
stream is on air, with an invalid user id; a null status throws.
Uncharted: Legacy of Thieves Collection (PPSA05684) stopped at sceGameLiveStreamingGetCurrentStatus2.
Two different vertex programs that compute the same position give
bit-identical depth on the GPU, which a depth pre-pass followed by an
equal-or-greater redraw relies on. Without Invariant, a Vulkan driver may
compile the same position arithmetic differently in each shader (for
example contracting into an FMA in only one), so the redraw fails the
depth test.
Decorate the gl_PerVertex Position member and the mesh shader's Position
output Invariant, and check both in a new recompiler test.
AI-assisted: yes
msync follows FreeBSD 11's kern_msync and vm_map_sync over the guest's
mappings as sceKernelVirtualQuery reports them: the address is rounded
down to the page, a range that wraps and MS_ASYNC with MS_INVALIDATE are
EINVAL, an unmapped start or page is ENOMEM, and length 0 checks the
mapping that holds the address. The guest has no file mappings, so a
successful call has nothing to write back. MS_INVALIDATE on a mapped
range throws, since FreeBSD's EBUSY for mlocked pages needs lock state
that is not tracked.
EVO-PLAYER PPSA99039 v0.11.0 imports it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The IME panel cannot be open while sceImeOpen is unimplemented, so the
query returns SCE_IME_ERROR_NOT_OPENED and leaves the output untouched,
like sceImeSetCaret, sceImeSetText and sceImeSetTextGeometry. As with
sceImeSetCaret, the closed panel is reported before a null output.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The guest's unsigned long is 64 bits. _Stoul was declared with the
host's unsigned long and returned std::strtoul, which are 32 bits on
Windows (LLP64): "4294967296" clamped to 4294967295 with ERANGE and
"-1" gave 0xffffffff, so a guest std::stoul threw out_of_range on values
the console accepts. It now returns std::uint64_t from std::strtoull,
as strtoul_nid_postfix and _Stoull already do; on Linux nothing changes.
The binary-prefix check stays in front of the host call.
Reported in #2424 by AchrafReyani; the same change was proposed in #2442
by SurajKhanna, whose two guest_math cases are taken here. Folded in at
MarcZX100's suggestion on #1459.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Both exports are imported by titles that link libSceAudio3d; without them the loader fails with an unresolved import before the title runs. Following the offline model, object attributes are validated but produce no audio and PortFlush drops the frames queued by sceAudio3dPortAdvance.
Pan follows the PS4 firmware 11.00 libSceNgs2.sprx: the speaker layout
from the init angles, then each param's angle and distance into a
volume matrix for the voice. Every param is checked before anything is
written, and angles too large to wrap throw. The pan functions are
exported from the existing Voice.cpp export block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wcstol, wcstoll, wcstoul and wcstoull parse the ASCII prefix of the
guest's UTF-16 text with std::strtoll and std::strtoull, which glibc 2.38
and later bind to the C23 __isoc23_* functions: wcstol(u"0b101", &end, 0)
returned 5 with the end pointer after the whole string. They now check
StopAtBinaryPrefix_nid_no_patch first, like the narrow functions, and the
end pointer maps back through ParseAsciiPrefix as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
C17 has no binary prefix: with base 0 or 2, strtol("0b101", &end, base)
reads the subject "0", returns 0 and leaves end at the 'b'. With glibc
2.38 or later, g++ (which defines _GNU_SOURCE) binds std::strtoll,
strtoull, strtoul, strtoimax and strtoumax to the C23 __isoc23_*
functions, which accept 0b/0B: the Linux exports returned 5 and
consumed the whole string. The Windows UCRT already follows C17, so the
same guest call gave different results on the two hosts.
strtol, strtoul, strtoll, strtoull, _Stoull, strtoimax, strtoumax and
_Stoul now return 0 with the end pointer after the '0' when, after
white space and an optional sign, the text starts with 0b or 0B and a
binary digit, in base 0 or 2. Everything else still goes to the host
function. The scanf family's %i has the same glibc behaviour; it is
recorded in TechnicalDebt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A port without a matrix sent source channel n to destination channel n, so a
mono voice reached only the left channel of a stereo mix. The PS4 firmware
11.00 libSceNgs2.sprx mixes such ports, and ports whose matrix levels were
never set, through a fixed channel map instead: mono reaches both stereo
channels at -3 dB and the centre of 5.1 and 7.1, stereo folds to mono at
-3 dB per side, and wider sources fold down with 0.5 and -3 dB gains. The map
was measured for every source width into 1, 2, 6 and 8 channels.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PPSA22520 routes its title music through port matrix 0 without setting the
matrix levels, so the music rendered silent. A matrix without levels now
mixes like a port without a matrix, source channel n to destination channel
n. The console's initial levels are unknown; the assumption is recorded in
TechnicalDebt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FreeBSD vsyslog logs the complaint with LOG_ERR|LOG_CONS|LOG_PERROR|LOG_PID passed as the priority (0x23), not LOG_ERR.
Co-Authored-By: Claude <noreply@anthropic.com>
ps5-opengl (PPSA99005) and ProsperoRadio (PPSA99001) import syslog
from libSceLibcInternal. Messages go to stderr with the priority, and
the format follows FreeBSD's vsyslog: %m expansion, masking of unknown
priority bits, LOG_USER as the default facility, errno preserved.
Assisted by Claude Code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A title's descriptors are taken as never being terminals: a file or
pipe gets ENOTTY with the termios untouched, a socket gets what its
protocol answers a termios ioctl on FreeBSD (EADDRNOTAVAIL for AF_INET,
EOPNOTSUPP otherwise), and a closed or invalid descriptor EBADF.
tcsetattr gives EINVAL for an action other than TCSANOW, TCSADRAIN or
TCSAFLUSH, with or without TCSASOFT, before anything else, and EFAULT
for a null termios before the descriptor is checked; with TCSASOFT a
null termios throws, where FreeBSD's libc faults copying it. What the
console gives a title as descriptors 0 to 2 is unknown, as recorded in
TechnicalDebt.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
LibwuIonIBw registers video out event id 16, which the host never triggers because its VRR state does not change; kP2L8t3j-aM returns 0 without effect.
Keeps this branch's CONTEXT_FULL | CONTEXT_SEGMENTS read, context-first
order and bounded retry in RaiseOn, and adds #1478's ymm save fields to
both deliveries. The test keeps both phase sets; the vectors phase runs
after the continuing, selfing and looping phases and counts their
deliveries. The TechnicalDebt entry about ymm upper halves is dropped,
since #1478 preserves them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GuestOfflineImports still expected sceRudpGetStatus to throw not-implemented;
the implementation now returns RUDP_ERROR_NOT_INITIALIZED before init and
zeroes the status buffer after it.
v_dot2_f32_f16 rounded a.x * b.x + a.y * b.y + c once, computed with f64
TwoSums and round-to-odd. GeForce GPUs run f64 at 1/32 or 1/64 of the
f32 rate, which made it cost about 44 v_fma_f32 on an RTX 4060.
The f16 products are exact in f32, and the correctly rounded sum of
three f32 values only needs f32: two TwoSums, a round-to-odd sum of
their errors and a final add (Boldo and Melquiond, "Emulation of FMA and
Correctly Rounded Sums: Proved Algorithms Using Rounding to Odd",
IEEE TC 57(4), 2008), with round-to-odd emulated by stepping an even
rounded sum one ulp toward its error. With finite inputs, c zero or at
least 2^-100 and a result between 2^-100 and 2^127, every value involved
is zero or a multiple of 2^-123, so no driver flush can reach it. Other
inputs, and zero results, take the f64 lowering in a branch.
New test agc_driver_f32_dot2_rounding checks random, cancelling and tie
cases against an exact fixed-point sum, and the NaN, infinity and zero
rules.
Titles that link the release module libScePsml.prx failed to start
because no host library had that name; PPSA25344 links it. libScePsml
and libScePsml_debug are now built from the same source.
scePsmlMfsrGetDispatchMfsrPacket1000, which PPSA25344 imports, is
added without an implementation.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With the 16-bit RoundingModeRTE, DenormPreserve and
SignedZeroInfNanPreserve guarantees, convert each value to the nearest
half with OpFConvert, convert the half back to f32 and, when it is
further from zero than the source, step its bits one toward zero. That is
the toward-zero half for every finite value, including subnormal results
and 65504 for values from 65520 up; infinities and the quiet NaN with
the high payload bits are kept. Other devices keep the integer
conversion.
New test agc_driver_f16_pack_toward_zero checks every half, its f32
neighbours and the midpoints to the next half, with both signs.
The integer emulation of the round-to-nearest-even float-to-half
conversion is exact but costly: a compute shader with about 3600
conversions never finished compiling on NVIDIA. When the device enables
shaderFloat16 and guarantees shaderRoundingModeRTEFloat16,
shaderDenormPreserveFloat16 and shaderSignedZeroInfNanPreserveFloat16,
it advertises Float16, RoundingModeRTE and DenormPreserve, and the
recompiler emits OpFConvert under the 16-bit RoundingModeRTE,
DenormPreserve and SignedZeroInfNanPreserve execution modes instead.
NaNs keep the emulated quiet NaN with the high payload bits. Devices
without these guarantees keep the emulation.
Graphics validation accepts the RoundingModeRTE, DenormPreserve and
SignedZeroInfNanPreserve execution modes for 16-, 32- and 64-bit floats,
so vertex and pixel shaders with a native conversion still draw.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The smallest mip levels of a tiled surface are packed together into one
block, the mip tail. A size limit decides which level is the first to
go into the tail.
For SW_64KB_Z_X, AnyPS5 used the same limit as the other 64 KiB modes.
In addrlib, that is only the case on Navi10. On every other GFX10 chip,
including the PS5's gfx1013, addrlib halves the limit for 8 and 16 bpp
Z_X surfaces: the width at both sizes, and also the height at 8 bpp.
The setting behind this is dsMipmapHtileFix (see HwlConvertChipFamily
and ComputeSurfaceInfoMacroTiled in gfx10addrlib.cpp).
With the larger limit, the tail started too early. For example, a
256x256 R8 surface with 9 levels started its tail at mip 1 instead of
mip 2, and took 131072 bytes instead of 196608. Every level was then
read and written back at the wrong offset.
GetMipTailLayout now halves the limits the same way. Only the level
where the tail starts changes; the tail slot positions stay the same.
This follows addrlib's setting for gfx1013. The console's own layout
has not been measured.
Fixes#1590
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v_cvt_pknorm_i16/u16_f32 rounded |x| * 32767 or 65535 to nearest even
with a 64-bit integer product, variable 64-bit shifts and a sticky bit.
In f32, p = |x| * scale is the f32 nearest to the exact product, so
roundEven(p) is the answer unless p is exactly k + 0.5, where the sign of
the exact error fma(|x|, scale, -p) decides. Lanes that select a
constant (NaN, |x| >= 1) multiply 0 instead.
v_cvt_pk_u8_f32 truncated with the saturating conversion and rounded the
fraction by hand; it is now roundEven(x) between the 0 and 255 clamps,
NaN giving 0, read without the f32 denormal flush.
New test agc_driver_f32_pack_rounding: 563,232 inputs around every
rounding tie, checked against the exact product in double.
When f32 denormals are flushed, v_cmp_*_f32 compares flush(a) with
flush(b). With one operand a constant, the flush of the other operand
can go into the compare: a denormal and its flushed zero compare the same
way with a NaN, an infinity or a normal constant, and comparing flush(x)
with a zero is comparing x with +-2^-126 (flush(x) < 0 is x <= -2^-126,
flush(x) == 0 is |x| < 2^-126, and so on, the unordered forms alike).
emitFloatCompare reads both operands unflushed, finds a constant operand
after its abs/neg modifiers, mirrors the predicate when the constant is
first, and emits one compare. Two registers, f16 compares and modes that
keep f32 denormals are unchanged. New test agc_driver_f32_compare_constant
checks all 12 predicates against flush(a) op flush(b).
The guest process is assumed to run as root. Under FreeBSD's
sys_seteuid and sys_setegid, id 0 is then accepted without a privilege
check and changes no credential, so both return 0. Any other id would
change the effective credential, which is not modelled, and throws.
Part of #1578.
When the embedded vertex fetch adds the base vertex or start instance
user SGPR to the index VGPR, the driver folds that SGPR into the draw's
first vertex and first instance. v5/v8 were gl_VertexIndex and
gl_InstanceIndex, which already include it, so the translated add
counted it twice, on direct draws and CPU-path indirect records alike.
The entry of a vertex or local program now subtracts the folded SGPR's
user data word from the builtin, which gives the zero-based indices the
hardware has. A record drawn in place on the GPU keeps the CPU's word,
so the fetch analyzer counts the SGPR as shared unless the fetch add is
the only reader of v5/v8 and the SGPR (no earlier access or EXEC write,
no carry, clamp, second add or other write of the SGPR); such records
take the CPU path. The fold moves into Driver::FoldDrawOffsets,
ClassifyIndirectDraw becomes public for the test, and the env switches
that skipped the fold go.
A program with one GLC or DLC buffer load or store decorated the whole
guest buffer array Coherent, so its other loads were coherent too. On
NVIDIA that keeps them out of the L1 cache: one GLC store made the
re-reads of a 4 KiB window about 2.7 times slower.
RDNA keeps those loads incoherent. A load without GLC or DLC can hit the
per-CU L0 and per-SA L1 caches, which are not coherent between
work-groups, and code that needs another work-group's data reads it
with GLC/DLC or invalidates the caches first (LLVM AMDGPU memory model,
GFX10: an acquiring load is followed by buffer_gl1_inv; buffer_gl0_inv).
The program metadata now records whether a program invalidates a cache
(buffer_gl0_inv, buffer_gl1_inv, s_gl1_inv, s_dcache_inv). Without one,
a program with GLC/DLC accesses gets a second array on the same binding,
buffers_coherent, decorated Coherent, and both arrays are Aliased as
buffers_u64 already is. Loads without GLC or DLC read buffers; GLC/DLC
loads, stores and atomics use buffers_coherent. A program that
invalidates a cache keeps the whole array Coherent.
sceKernelAprSubmitCommandBuffer rejected a buffer object with EINVAL
unless sceAmprAprCommandBufferConstructor had tagged it. The tag is
AnyPS5's own: in the retail layout the type word only carries state
bits and the constructors zero the object, so a zero-filled object
bound with SetBuffer is a valid APR buffer.
CRI's file system in Sonic Origins (PPSA05324) lays out its
AprCommandBuffer objects in its own zeroed work memory and never calls
the constructors. Its first read submit failed with 0x80020016, and the
CRI file system stopped there.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sceNpEAAccessInitialize and sceNpEAAccessTerminate resolve the NIDs
7CxI50-xlCk and pMxXhNozUX8, which shadPS4 names in np_partner.cpp. The
stubs still throw; only the names and no-argument signatures change.
FreeBSD's unlink ignores the file's own permission bits, so remove()
succeeds on a file the guest made read-only with chmod(0400). On Windows
the guest chmod sets FILE_ATTRIBUTE_READONLY, and DeleteFileW then fails
with ERROR_ACCESS_DENIED, which remove() reported as EACCES. Clear the
attribute and retry, restoring it if the retry still fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use INFINITY and NAN from <cmath> instead of a new <limits> include, and
list the TechnicalDebt entry beside the other NGS2 voice entries, so the
change merges cleanly with the pan, channel map and reverb changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The guest passes and expects UTF-8 names, but on Windows opendir and
readdir used MinGW's narrow dirent API, which works in the ANSI code
page: opendir failed for a directory whose name is outside the code page,
and readdir returned names as ANSI bytes, with "?" for characters the code
page lacks. Use _wopendir and _wreaddir there and convert each name to
UTF-8.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A reverb_size other than the default was accepted and ignored, and below
about 7.5 kHz an allpass length went negative and wrapped to a 16 GB buffer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WindowsMappings::Collect resets each part of the range as it walks it:
it marks shared views seen and resets private pages' write-watch bits.
When it then met a NOACCESS view or memory that is not committed
private memory, it returned false with the earlier parts already reset,
so their writes were lost to the caller's fallback. With reset, the
whole range is now checked first and nothing is reset when it fails.
AI-assisted (Claude Code).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Parse legacy decimal, octal and hexadecimal forms before host lookup. Preserve FreeBSD shorthand, whitespace and 64-bit accumulation, clear the SDK resolver error on numeric success, and add regression coverage.
getcwd(NULL, size) returned memory from the guest heap directly, while
the caller frees it with free(), which goes to the application heap.
With a title's malloc replacement registered, that free reached the
replacement with a pointer it never returned. Allocate from the
application heap like strdup, and report ENOMEM when it returns null.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolve the missing EVO-PLAYER import reported in #1578. Convert native host entries into the guest ABI with owned per-thread storage, and use the SDK network error location for failures.
Check numeric address bytes, guest hostent fields, per-thread result lifetime, and the SDK resolver error location. The check currently fails to link because the reported export is missing.
MIN_LOD_WARN, MIP_STATS_COUNTER_EN and MIP_STATS_COUNTER_ID are ignored by the texture decoder, but the cache
key held the raw T# words. A title that rotates the counter fields per use got a cache entry per variant of the
same texture, and the extra entries evicted live ones under the budget.
sceAgcCreatePrimState only packs registers, but it now also resolves the
graphics ABI ahead of time, and that resolve throws when the primitive
type is a patch list without HS_EN or a hull stage with another type.
No draw can use such a state, so leave it to draw time and return the
registers. Bit 2 of VGT_SHADER_STAGES_EN is HS_EN, not an NGG bit.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A flip still queued or in presentation when the title closes its port is discarded, as on hardware, rather than stored as a driver failure. A closed port no longer terminates the presentation thread nor surfaces from Shutdown. The lifetime test now expects cancellation and the reopen mode is registered in ctest.
#2083 chooses the NaN result of the f32 fma family on the bits: the first
NaN source, quieted in IEEE mode, with the addend skipped when the
product is infinity times zero, and 0xffc00000 otherwise. The selection
and the infinity-times-zero test ran for every fma, but a NaN source
always gives a NaN result, so for any other result they return it
unchanged.
FPNanResultFma32 carries the result and the three sources, with the IEEE
mode as a flag. The SPIR-V emitter makes the selection, including the
infinity-times-zero test, in a branch taken only for a NaN result, and
the SRT evaluator computes it exactly. Add, sub and mul keep the inline
selects: with two sources a branch costs more than it saves.
winpthreads initializes a PTHREAD_RWLOCK_INITIALIZER lock on its first
use and fails a concurrent first lock with EINVAL. std::shared_timed_mutex
ignores that result in release builds, so two guest threads could both
hold a fresh guest rwlock.
Lock and unlock the mutex once when the guest rwlock is created, before
another thread can reach it, and record the remaining host exposure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FreeBSD's unlink(2) reports EPERM for a directory, but the host call
returns EACCES on Windows and EISDIR on Linux, so the guest saw a
different error on each host. Check for a directory, not following a
symbolic link, before unlinking.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sceKernelMunlock and the POSIX munlock unlock the page-rounded range with
FreeBSD's results: 0 for a mapped range whether or not it is locked, EINVAL
for a range that wraps around zero, ENOMEM for an unmapped range. On Linux
the host munlock gives them. On Windows a reserved placeholder counts as
mapped only while the guest reservation or protection registry covers it,
and a region VirtualUnlock refuses as not fully locked is unlocked page by
page, as VirtualUnlock is all-or-nothing. sceKernelMlock shares the range
rounding.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GLfKH7Sqe51wX254k1XsV
The sampled texture cache let go of its least recently used entry even
when a build, a recorded batch or a cached resource set still held that
texture, which frees no memory and makes the next lookup create a
second copy. A frame that samples more textures than the cache holds
also missed on all of them every frame.
Eviction passes over an entry whose texture is held elsewhere, or a
view of a cached storage image, up to a quarter over the budget, and
rescans for released textures about once a second. While the least
recently used entry was used in this frame or the previous one, a
texture's first use in the frame is returned uncached and only a second
use evicts, so the next frame finds the cached textures again, even
after an early miss; a new set replaces the old one on its second
frame. APS5_PROFILE_DRAW prints the cache's counts every 10 s.
The device-local tier of BufferPool only reused a buffer of the exact
size and usage it was asked for. Partial storage-image detiles and
retiles ask for a new size and the other transfer direction almost
every time, so the tier sat at its budget and missed and evicted
dozens of buffers per frame, and the vkFreeMemory calls on the release
thread held up submits and allocations on the recording threads.
Device-tier requests of 1 MiB and more now round up to an eighth of
their octave, the tier's buffers are created for storage and both
transfer directions, and a request takes the smallest retained buffer
from its own class up to twice its size. Host tiers, the budget and
eviction are unchanged. agc_buffer_pool covers the classes, the fit
and its bound, reuse only after release, the budget and the unchanged
lists.
An address-based build whose heap mirror the device refused, or one past
APS5_HEAP_MIRROR_MIB, stopped the process inside acquireMirror. PPSA26344
hit it at 478 s with 6.8 GiB of heap mirrors beside the host imports.
- a mirror that would go past the budget first sweeps the mirrors whose
registered range is gone, before its allocation; if it still does not
fit, the build throws "past the budget"
- the mirror is allocated once: a refusal throws with the range, the
Vulkan result and the mirror totals, so the draw or dispatch fails like
any other allocation; nothing is registered for the refused range
- the BDA resource tests run with a 4 MiB mirror budget and a mock memory
limit: a mirror past the budget is made in the swept mirror's memory,
and a refused one fails after a single allocation attempt
Every BDA dword read site still emitted in the entry function the add
of its first dword address with the overflow fault, a probe_bda_pointer
call, the wide loads, and one read_bda_dword_bytes call per extracted
dword. NVIDIA's pipeline compile time grows with every call left in the
entry function, so large compute programs with a few hundred such reads
spend 47-77 s in vkCreateComputePipelines.
A read site is now one call to a DontInline read_bda_span function, in
a stop and a coherent variant, taking the address, the immediate offset,
the mask of extracted dwords and the pc, which does the same steps in
the same order. Fault reasons, addresses, pcs, Volatile, the stop
behaviour and the APS5_BDA_BYTE_READS path are unchanged.
An address-based build maps every readable registered range: through a
host import when one can be made, else through a heap mirror, a
host-visible copy of the range. A range mirrored while the import budget
was full kept its mirror after a later pass imported it, until the guest
freed the range. The pass then read the range through the import, and the
mirror only held host-visible memory and a second copy of the bytes.
The pass now releases the heap mirror of every range it serves through
an import. Recorded work that bound the mirror keeps it until it
completes. If the import goes away while the range stays registered, the
next pass makes a new mirror from the guest bytes. The [buffers] image
mirrors profile line counts the released mirrors.
A build served by the cached address space walked every region of the
space for its mirrors, sorted the heap mirrors, compared each heap
mirror's blocks with the write tracker under its own lock and swept the
whole mirror registry. In an offline replay with 37,000 heap mirrors
that took about 10 ms per build, every build.
The space now keeps its writable mirrors, its sorted heap mirrors and
their adjacent runs from when it is published. Each run is still
flushed and collected; a run with no block stamped since the generation
its last complete check collected skips the per-mirror compare, and that
generation is stored only once the build's blocks were copied. The
registry sweep is skipped while every live mirror's range is held by the
cached address space's lease and no mirror was added, replaced or
dropped since.
LoadLibraryEx with an unresolved import shows the loader's "Entry Point
Not Found" message box unless SEM_FAILCRITICALERRORS is set, so
patched_libraries waited on the dialog until ctest's timeout instead of
printing the failing libraries. Set it at start, as GuestHeapRounding does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The POSIX form of sceKernelMlock: 0 on success, -1 with errno (EINVAL,
ENOMEM, EPERM, EAGAIN) where the sce form returns the kernel error, as
munmap and mprotect do beside it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Releasing direct memory left the virtual ranges that mapped it registered,
so sceKernelVirtualQuery reported them as flexible memory at offset 0 and
titles walking a range with FIND_NEXT released physical page 0.
Collect every view of the released pages before freeing them and unmap
them through UnmapRegistered, as shadPS4's MemoryManager::Free does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nid_patcher turns the _nid_postfix names of a library into NIDs for ELF
and PE. A library built on macOS is a Mach-O dylib, whose exports are in
a dyld export trie and whose imports are in the chained fixups, so it
gets its own patcher.
- The export trie is read, every exported C name (without Mach-O's
leading underscore) is resolved to its NID, and the trie is rebuilt the
way ld64 lays it out: the offsets are uleb128, so the layout is repeated
until it is stable. A trie that no longer fits is appended to
__LINKEDIT, which has to end the file, and a signed image is refused.
- Weak definitions that are not marked _nid_postfix or _nid_no_patch keep
their names: dyld coalesces those across images by name.
- In the chained imports, names bound to a .prx dylib that are guest
facing (a _nid_postfix name or an sce prefix) are patched in place; a
name that would grow, or that shares storage with another import, is an
error. Images that use bind opcodes instead of chained fixups are
refused.
- ExportExclusions reads the exports of a reference Mach-O, so the
exclusion list works for libraries built on macOS as well.
The offscreen SDL driver cannot create a Vulkan window on Windows since
the VideoOut window uses SDL_WINDOW_VULKAN, so the tests that open a port
now exit 77 (skipped) like the other display tests, unless
ANYPS5_REQUIRE_DISPLAY is set. The tests also write app0/sce_sys/param.json,
which AppMetadata now requires.
presentLoop called AgcDriverShutdown outside its try block, so a stored
worker failure rethrown there terminated the process. Store it in
flipQueue->failure so VideoOutDriver::Shutdown rethrows it after the join.
Register the lifetime, decode and controls modes of video_out_flip_tests
in ctest.
The rect-list control and evaluation shaders put their fault buffer one
past the highest vertex or fragment binding. Bindings are grouped per
stage (RuntimeAbi::BindingNumber), so that number could fall inside
another stage's group and collide with one of its bindings, and the
draw failed with a duplicate binding. The fault buffer now uses the
TessellationControl FaultBuffer binding.
Uncharted: Legacy of Thieves Collection (PPSA05684) stopped at its first rect-list draw with "duplicate shader binding".
v_not_b32_sdwa takes the same dst_sel and dst_unused operands as the
other 32-bit VOP1 SDWA forms (RDNA2 ISA 6.3.1 "SDWA"; LLVM
VOP1Instructions.td gives V_NOT_B32 a VOP1_SDWA encoding with dst_sel
and dst_unused). The rule now allows byte and word destinations with
every unused mode, which the existing SDWA writeback implements; the
execution test checks WORD_0 with UNUSED_PRESERVE.
Uncharted: Legacy of Thieves Collection (PPSA05684) stopped at a v_not_b32_sdwa with dst_sel:WORD_0 dst_unused:UNUSED_PRESERVE.
GFX10 image format 2 (8_SNORM, Mesa gfx10_format_table) resolves to
VK_FORMAT_R8_SNORM and is marked sampleable in the recompiler's format
table.
Uncharted: Legacy of Thieves Collection (PPSA05684) stopped at a compute shader sampling an 8_SNORM image.
Debug markers are NOP payloads the command processor skips, so a pop
with no marker pushed (a title that pops a marker it pushed in an
earlier command buffer) has no effect on the GPU; it no longer throws.
Uncharted: Legacy of Thieves Collection (PPSA05684) pops one marker more than it pushes and stopped with "marker stack underflow".
A viewport whose X or Y scale is zero maps every vertex onto one line,
so triangle, strip, fan and rect-list draws through it cover no pixel.
Such draws, which titles use to skip work without rebuilding a command
buffer, get a valid 1x1 Vulkan viewport and an empty scissor instead of
throwing. Points, lines and other negative or non-finite scales still
throw.
Uncharted: Legacy of Thieves Collection (PPSA05684) stopped at such a draw with "unsupported viewport transform: scale=(0, -0, 1)".
libSceVdecsw is the software H.264 decoder interface PPSA05684 uses for
its movies. Decoder creation, compute queues, memory queries, decode
input and output, AVC picture info, reset and finalize are implemented
with the layouts of shadPS4's vdecsw.h, checked against the title's
movie decoder, and decode through libSceVideodec2. The H.264 stream the
Videodec2 test uses moves to a shared fixture, and a guest test decodes
it through Vdecsw.
Uncharted: Legacy of Thieves Collection (PPSA05684) plays its movies through libSceVdecsw and stopped at sceVdecswQueryComputeMemoryInfo.
libstdc++ already defines NOMINMAX on MinGW, so the unguarded define
warned on every Windows build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The geometry pass adds the mesh capability and extension to the device
target but kept its SPIR-V version. On a device without mesh shaders
that is 1.3, and the mesh module was rejected as exceeding the target.
VulkanDevice targets 1.4 whenever mesh shading is enabled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On a host without IPv6, socket(AF_INET6) fails with EAFNOSUPPORT, so
guest_sce_net aborted at its first IPv6 socket and never ran the TCP,
UDP, epoll, sendmsg/recvmsg, resolver and NetCtl checks after it.
When sceNetSocket reports guest EAFNOSUPPORT (47) for the IPv6 socket,
skip those socket checks, run the rest of the test, and exit with 77,
which ctest reports as skipped. Hosts with IPv6 run every check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ha6Tsy62AFUyp9a5Mf7vjA
llvmpipe builds the high dword of the shader clock with a left shift by
32 (emit_clock in Mesa's lp_bld_nir_soa.c), so it is always 0 and
s_memtime and s_memrealtime wrap every 2^32 ns. A pass of
agc_driver_shader_clock whose two reads straddle a wrap failed with
"memtime: lane N went back from 4294921902 to 3823"; dispatching right
before the boundary fails every lane of that pass.
On llvmpipe compare the low dwords modulo 2^32, which stays correct if
Mesa fixes the shift. Other devices keep the 64-bit comparison.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ha6Tsy62AFUyp9a5Mf7vjA
When a queue worker failed, it published the failure and woke the idle
waiters before failing the flips of the submission it was executing.
A thread returning from AgcDriverWaitIdle with that failure could still
see one of those flips neither completed nor failed, which made
agc_driver_flip fail with "failed flip was completed successfully" in
2 of 240 runs under four-way parallel load on lavapipe.
Fail the executing submission's flips first, as ReportFailure already
does for the pending submissions it drops before it notifies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ha6Tsy62AFUyp9a5Mf7vjA
PS5 titles pass a 0x230-byte SceAvPlayerInitDataEx: auto start is the
byte after debug_level at 0x74, nine 0x30-byte thread parameter blocks
fill 0x78-0x228 and the output video frame buffer count is at 0x228.
sceAvPlayerInitEx read both fields at their PS4 offsets: auto start at
0xa8 is the video decoder thread priority and the buffer count at 0xa4
lies in the audio decoder block. PPSA25063 (Poppy Playtime: Chapter 4)
sets every thread priority to 700, so its intro video started on its
own and stopped at once; it writes auto start 0 and starts playback
itself.
With this_size 0x230 or more both fields are read at the PS5 offsets;
smaller structures are read as before. The layout follows KytyPS5,
prosper, SharpProspero and sharpemu and is recorded in TechnicalDebt.
guest_avplayer builds a 0x230-byte structure with auto start 0 and
nonzero thread parameters, then with auto start 1, and checks when
playback starts and how many video buffers are allocated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An address-based build maps each imported registered range through its
host import. UploadPrepare merges a descriptor range or snapshot
overlapping such a range into the range's region, and the region kept
the import even when the merge took it past the import's end, as a V#
crossing into the next registered range does. Descriptor then bound the
import's buffer beyond its size, and the BDA table mapped the whole
region, the next range included, through the import's device address.
A merge that extends a region past its end now drops the import. The
region then takes the import lookup and, with no import covering it,
the copy path, as a range crossing an image mirror's end already does.
Like every copied range, it is read-only to pointer stores.
sceVideoOutAddPreVblankStartEvent threw "physical pre-vblank timing is
not implemented", so titles that pace on it stopped at startup. It now
registers the event like the vblank event does, and each emulated vblank
tick triggers the pre-vblank start events just before the vblank events,
with the pre-vblank count as data. The console's lead time is unknown.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A title that never writes SPI_PS_INPUT_CNTL_0 relies on its clear-state
value 0, but the register was absent from the initial context, so every
draw of a pixel shader with interpolants was rejected with "missing
register at DWORD 0x191". All 32 SPI_PS_INPUT_CNTL registers now start at
0, as in the GFX10 clear state, both initially and after CLEAR_STATE.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
v_fma_f16, v_fmac_f16, v_fmamk_f16, v_fmaak_f16, v_pk_fma_f16 and
v_pk_fmac_f16 rounded an f32 fused multiply-add to f16, rounding twice.
The product of two f16 values is exact in f32, so the sum is now rounded
to odd in f32 with an exact error term and then rounded to nearest even
in f16, which rounds the exact result once.
computePostDominators iterates its sets to a fixed point, visiting the
blocks in id order. Post-dominance flows from a block's successors back to
it, and successors mostly have higher ids, so each pass moved the sets back
by about one block: a long program needed about as many passes as it has
blocks, each costing O(blocks^2). recomputeAnalyses runs it after every
split of splitSharedMergeBlocks, up to four times per block.
Visit the blocks in post-order of the CFG (successors first), then any the
entry does not reach. The sets start from every block and only shrink, so
the iteration still converges to the same greatest fixed point, now in a
few passes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CB_COLOR_ATTRIB3.RESOURCE_TYPE 0 is a 1D surface (AddrResourceType
ADDR_RSRC_TEX_1D in addrlib). On GFX10, addrlib allows a 1D surface the
linear and render swizzle modes (Gfx10Rsrc1dSwModeMask) and picks its
swizzle pattern the same way as for a 2D surface (GetSwizzlePatternInfo
only tells 3D apart). So a 1D color target one row high is laid out
exactly like a 2D target one row tall, and is decoded as one.
A 1D target with a standard swizzle mode is rejected as invalid; one
with more than one row is not modeled and is rejected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With f32 denormals flushed, every f32 multiply and fma checks whether the
exact product is below 2^-126 (#1850): two exponent extracts, a 32-bit
significand multiply-high and a chain of compares and selects. When a
factor is a literal or inline constant, its exponent settles the check
during translation:
- a factor that is zero (after the input flush), infinite, NaN or at least
1 in magnitude never gives a tiny product, so the check is not emitted;
- a power-of-two factor never carries out of the significand product, so
the multiply-high is not emitted.
Constant sources are folded with their abs, neg and denormal flush, so the
factor reaches the check as a constant.
With f32 denormals flushed, every f32 result is flushed when it is
written and every f32 source when it is read, so a source computed by an
earlier flushing op is flushed twice. A flush returns any value that is
not a denormal unchanged, and the driver can't tell that the first flush
already removed them.
DenormalFlushEliminator replaces a flush whose source can't be a
denormal with the source: a flush, a normal or zero constant, a sign
change, absolute value, clamp or bit cast of such a value, an integer or
f16 converted to f32, and a select or phi of such values.
sceHttp2GetMemoryPoolStats, sceSslGetMemoryPoolStats and
sceNetGetMemoryPoolStats threw. PPSA16064 (Minecraft Dungeons II,
Unreal Engine) queries all three while its HTTP module starts, and
aborted there.
Each library now records the pool size given at sceHttp2Init,
sceSslInit or sceNetPoolCreate and reports it with a peak and current
use of 0: the offline Http2 and Ssl models and the host-socket Net
library allocate nothing from these pools. The layouts follow the PS4
SDK's *MemoryPoolStats structures. Net returns EBADF for an unknown
pool and EINVAL for a null output, like its other pool calls; Http2 and
Ssl throw for both, as their error codes are unknown. Terminating a
context or destroying a pool forgets its size.
sceHttp2SetResolveRetry, which the title calls next, accepts and
ignores its value like the other Http2 settings. The four Http2
WebSocket exports the title imports are added as unimplemented.
guest_http2, guest_ssl and guest_sce_net check the reported sizes;
guest_sce_net also checks the null-output and unknown-pool errors.
A program's entry EXEC is the ballot of !gl_HelperInvocation in a pixel program and the ballot of true in vertex, local and tessellation programs (emitEntryPrologue). The half-wave reduction matcher only accepted the pixel form, so a wave64 vertex program that scans keys selected under its EXEC and reads lane 63 threw that the lane is outside the 32-lane host subgroup.
EntryLaneWalk now also accepts a ballot of true as within the entry EXEC for those stages. Every invocation is live at their entry, and a later ballot of true holds only invocations that are still active. Pixel programs keep the !gl_HelperInvocation form, because a ballot of true there includes helper invocations. Compute and mesh programs keep their own form too, because their entry EXEC can bound the local invocation index.
A draw's guest buffer region inside a host import at an offset off
minStorageBufferOffsetAlignment was copied per build (a new buffer, an
input snapshot, a vkCmdCopyBuffer that ends the open render pass), and
DirectRegions refused such builds as templates.
Descriptor already binds any DWORD-aligned view from the aligned offset
below it and passes the remainder through the shader's memory offset
slot. A draw build that is not address-based and whose every guest buffer
element has such a slot (a push constant byte, or a shader data byte
inside its data buffer) now binds a region whose offset in its import is
DWORD aligned in place, like an aligned one: its read-only views are
snapshotted per draw by PrepareDrawBindings at address - adjustment, the
import serial keys the template, and Revalidate proves it per use.
Dispatches keep the copy (they read in-place inputs at execution, not at
record).
agc_driver_recorder_tests misalignedRegionTests: a misaligned read-only
draw region is read in place, the build is reusable, the push constant
carries the adjustment, and the per-draw snapshot starts at the aligned
offset below the view.
CachedPipeline keeps at most 256 pipelines. A level with a larger working
set thrashes the LRU: every miss creates a new VkPipeline (modules,
layout, render pass and a driver compile from the pipeline cache). The
bound is now 1024. A cached pipeline is a pure function of its key, so
the bound changes only memory and time.
The half-wave reduction read (v_readlane_b32 of lane 31 or 63 after a DPP row scan) is exact on a narrower host subgroup only when the scan's keys are the identity outside the entry EXEC. EntryLaneWalk::ZeroBit now also proves that through a constant false, a SelectU1 whose two values both prove it, and a bool Phi whose inputs all do. A mask written inside a divergent branch reaches the key select in that form, so such a scan threw that lane 63 is outside the 32-lane host subgroup.
A draw with DB_RENDER_CONTROL.RESUMMARIZE_ENABLE recomputes the HTILE summary of the bound depth surface from its depth values. HTILE is not modeled, so such a draw with depth and stencil tests off and no color writes changes no modeled state. It now passes the maintenance check and draws nothing, instead of throwing. Resummarize draws with depth, stencil or color work, and copy and decompress draws, still throw.
ctest loads the libraries from libs/unpatched, so an import that nid_patcher
renames out of another library's exports only shows when a title loads the
patched prx. patched_libraries loads each patched .prx with LoadLibraryEx on
Windows and dlopen(RTLD_NOW) on Linux, and depends on the libs target so the
patched files are current.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The unified and service entitlement info list requests and polls threw.
They now return SCE_NP_ERROR_SIGNED_OUT, like the consume requests in
the same library. Their signatures are unknown, so they stay declared
without parameters.
PPSA15657 calls the unified request during start-up and continues past
the error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0134RWCyiyydJBbfKz8g9Bwe
Sackboy: A Big Adventure (PPSA01289) imports nine functions that no library
exports, so eager binding fails before it starts.
- libSceVoiceChat: sceVoiceChatRequestLeaveVoiceChatGroup and
sceVoiceChatRequestDeleteVoiceChatGroup, offline requests like the other
sceVoiceChatRequest* calls
- libSceNpSessionSignaling: sceNpSessionSignalingGetConnectionFromPeerAddress,
a throwing stub; the signature is unknown
- libSceCdlgG2P, a new library: the six sceG2PDialog* functions, throwing
stubs declared without parameters
TechnicalDebt records the assumed and unknown signatures.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The param is void*, as RommPS declares it. The test also passes a null and an empty URI and a param that must stay untouched, and compares against 0x8002002D itself. The debt entries now say the error is returned for any arguments and that the param layout and the console's argument checks are unknown.
PPSA01289 (Sackboy: A Big Adventure) calls sceAudioOut2MasteringTerm when it
replaces its world, which threw. Like Init and SetParam it has no effect, as
there is no mastering stage. The title creates its next world's audio device
before it destroys the previous one, so Init runs twice before Term runs
twice; whether the console reports an error for either is unknown, so both
return 0 and the case is recorded in TechnicalDebt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sceSystemServiceLaunchWebBrowser fails with the kernel's EOPNOTSUPP: there is no web browser to open. RommPS PPSA76677 stops on main at this import and shows a QR code instead when the browser does not open.
sceAmprCommandBufferClearBuffer detaches a command buffer's memory and
returns it so the caller can free it. It returned 0. PPSA01289 (Sackboy: A
Big Adventure) frees the result after every streaming read, so each read
leaked its 16 KiB command buffer until the allocator ran out of memory
during the first world load.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With depth bias enabled, RADV sets POLY_OFFSET_PARA_ENABLE in
PA_SU_SC_MODE_CNTL next to the front and back enables, whatever the
topology; vkQuake's draws carry 0x3a46. The bit applies the offset to
points and lines, so it changes nothing for triangles, and Vulkan applies
depth bias only to polygons. It is now accepted with depth bias on
triangle topologies; point and line draws with it are still rejected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A label in memory the device has no host import of was stored when its
batch was reaped, after later labels the GPU had already made visible.
A title that reused that memory saw its next command buffer overwritten
by the stale value (#1458). Wait for the recorded work and store it then.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A title that replaces the allocator through its libc parameters also
supplies malloc_stats_fast in that table, and PPSA28997 calls it. It is
now forwarded to the title's function. Without a replacement allocator
that provides it, the call throws.
Without TZ, glibc's localtime and mktime run tzset on every call and
re-check /etc/localtime each time. PPSA28997 calls them every frame
during its intro, which then spent most of its time there. TZ is set
to :/etc/localtime when unset, so the zone is read once.
With f32 denormals flushed, as in the 0xc0 float mode titles use, the
hardware flushes the denominator and numerator of v_div_fixup_f32 but
keeps a denormal quotient and result. The recompiler kept all three,
so a denormal divisor gave the quotient back instead of an infinity.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
PrepareMultisampledStorage only inspects the SPIR-V that the recompiler
emits for multisampled storage writes and atomics, but it took its
target from the device, so on a device without
shaderStorageImageMultisample, such as MoltenVK, the emission failed
and agc_driver_prepared_shaders failed in all its variants. The target
now has the StorageImageMultisample capability, and the check that a
target without it is refused still removes it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PixelProgramSkipped only treated SPI_SHADER_PGM_LO/HI_PS written as 0 as
a draw without a pixel program, while the draw decoder already reads an
unwritten address as 0 and binds the null pixel program for it. A
depth/stencil-only draw whose pixel program address was never written
was instead rejected by the precheck with "depth/stencil-only draws
without a pixel shader are not implemented".
An unwritten address is now unset in PixelProgramSkipped too, so such a
draw goes through the null pixel program like one with the address
written as 0, and one that writes color is rejected as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With IEEE=1, v_pk_min_f16 and v_pk_max_f16 return a quieted NaN for a
signaling NaN operand, and DX10_CLAMP=1 clamps it to +0. The clamped
form skipped the bit-level NaN selection and saturated the driver's
min/max, which returns the other operand, so it gave that operand.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sonic Origins (PPSA05324) imports sce::Json::Object::empty() const
(i2l3IYvQ9UE) and fails to load without it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sceSystemServiceKillApp now ends the title as guest exit() does, so driver calls that wait for the exit park instead of throwing ProcessShutdown, and a second exit waits for the first. The test now fails when the kill returns, exits with a status other than 0 or bypasses the coordinator, and checks why a rejected call throws.
Report an app ID for the running title from sceSystemServiceGetAppIdOfRunningBigApp, and shut the guest down and exit when sceSystemServiceKillApp receives that ID with the arguments -1, 0 and 0. SwanStationPS5 (PPSA98510) 1.0.6 closes itself this way and stops on both imports on main.
ReadRawComputeShader decodes a growing prefix of guest memory and reads
more when the decoder throws std::out_of_range, which the vector, scalar
and instruction-length checks throw for an instruction cut off by the end
of the span. The memory (SMEM, DS, MUBUF, MTBUF, FLAT), image and export
decoders threw std::runtime_error instead, so a two-word instruction
across a window boundary failed the read: vkQuake terminated on "truncated
FLAT instruction". These now throw std::out_of_range too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The hardware findings give 0xF_F000_0000, which is 0xFF0000000, not 0xFF00000000. Check the ring across threads, at ps5-opengl's size of 0x1b000 and with a canary after the outputs, and say in the debt entry that nothing is written to the ring.
Record the tessellation factor ring that sceAgcDriverSetTFRing receives and report it from sceAgcDriverGetTFRing, with the console's default of 0xFF00000000 and 128 KiB before a title sets one. VITA5 (PPSA39410) and Homebrew UI Lab (PPSA99050) stop on this import once sceVideoOutGetResolutionStatus resolves.
v_sin_f32 and v_cos_f32 take their input in cycles, and the SPIR-V
backend reduced it with GLSL Fract before scaling by 2*pi. For x in
(-0.5, 0), fract(x) = 1 + x is rounded to a multiple of 2^-24, which
drops the low bits of x, and for |x| <= 2^-25 it rounds to 1.0, which
RADV's v_fract_f32 clamps to 0x3f7fffff. On RADV, v_sin_f32(-2^-30)
returned 0xb4c90fde (-3.7e-7) where RDNA3 returns 0xb1c90fd5 (-5.9e-9).
The cycle is now x - roundEven(x). It lies in [-0.5, 0.5] and is exact
for every finite x: it is x when roundEven(x) is 0, and Sterbenz's
lemma applies otherwise. Finite inputs of magnitude 2^23 or more still
reduce to +0, so the select that forced them to 0 is removed. Infinite
and NaN inputs are unaffected: the translation selects their results
on the input bits.
Measured on RDNA3 (gfx1101) with the hardware oracle, with the same
results in all 16 combinations of IEEE, DX10_CLAMP and the f32 and f16
denormal modes: over 544 inputs, v_sin_f32(x - v_rndne_f32(x)) returns
the bits of v_sin_f32(x) for 519 and is at most 11 ulp off, while
v_sin_f32(v_fract_f32(x)) matches 403 and is more than 16 ulp off for
80, all of them in (-0.5, 0). For v_cos_f32 the counts are 523 (at
most 7 ulp off) and 484 (6 more than 16 ulp off). On RADV the
recompiled shader returns the bits of the v_fract_f32 sequence before
this change and of the v_rndne_f32 sequence after it, for all 544.
v_sin_f16 and v_cos_f16 share the reduction. On RADV, with f16
denormals kept, v_sin_f16 now returns the RDNA3 bits for all 65536
inputs, where it was 1 ulp off for 6 small negative ones, and
v_cos_f16 matches for all of them before and after.
An image with several runtime modes is emitted as a switch whose default
and disabled modes end in OpUnreachable. In a loop latch that exit breaks
the continue construct, and spirv-val rejected the shader. Inside a
continue target those cases now join the merge with an undefined result.
Fixes#1921
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
v_ldexp_f16 read src1 with readU32, so a float inline constant gave
the low 16 bits of its f32 pattern: 0 for 0.5, 1.0, 2.0, 4.0 and
their negatives, which returned src0 unchanged, and 0xf983 for
1/(2*pi), which clamped to -64 and returned a signed zero. The
hardware treats src1 as an f16 operand, as LLVM's
LDEXP_F16_VOPProfile in VOP2Instructions.td records, so it receives
the f16 encoding: 0.5 is 0x3800, an exponent of 14336. Measured on
gfx1101, ldexp(1.0, 0.5) is +inf and ldexp(1.0, -0.5) is +0.
Read VOP3 src1 through readF16SourceBits, which maps the float inline
constants to their f16 bits and reads other operands as before.
Registers, integer inline constants and literals already matched the
sign-extended low 16 bits the hardware uses. SDWA src1 keeps its old
read, as gfx11 has no SDWA to measure it on.
With VCC set and a src2 exponent field of 128 or more (scale 2^64),
v_div_fmas_f32 recomputed an fma result with exponent field 0 as an
fma of the smaller multiplicand times 2^64, the other multiplicand and
src2 * 2^64. For |src2| >= 2^64, src2 * 2^64 overflows to infinity, so
an fma that cancels exactly returned -inf or +inf. The hardware
returns +0: measured on gfx1101 for (1.0, FLT_MAX, -FLT_MAX) and
(1.0, -2^100, 2^100) in all 16 combinations of IEEE mode, f32 and
f16/f64 denormal mode and DX10_CLAMP.
Only exact cancellations reach that path. With |src2| >= 2, a nonzero
sum below 2^-126 needs a product above 1, which is a multiple of
2^-47, while src2 is a multiple of 2^-22, so a nonzero sum is at least
2^-47 and the fma result is normal. The scaled result is then the fma
result times 2^64, +0 for a cancellation. The recomputation is now
done only for the 2^-64 scale, when the fma result overflows.
FmaRounding checks v_fma_f32, v_fmac_f32, v_fmaak_f32 and v_fmamk_f32
against the fused result on the GPU, but not v_fma_mix_f32. It now
also runs v_fma_mix_f32 v20, v4, v5, v6 with all sources f32 on its 64
rows and expects the fused value, in the group that is skipped when the
device splits fma.
fastTexture took the Textures() cache entry of a stage-A image record
without asking whether a depth surface is resident at the address. The
full lookup in cachedTexture returns DepthSurfaceTexture first; the fast
path skipped it, so once a guest-memory entry existed for a depth
target's descriptor, every later sampled read got that entry and saw
the guest memory under the target, which a depth target never writes.
The fast path now returns nothing while a depth surface is resident
there, and the lookup falls back to cachedTexture.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UTjpbMX7BUFMZZaxJE98zV
EVO-PLAYER (PPSA99039) creates resident AVC, HEVC and VP9 decoders at
start-up, and stopped at "Videodec2: unsupported codec" on the HEVC one.
Codec types 974921 (HEVC) and 2382845 (VP9) now open FFmpeg's HEVC and
VP9 decoders. HEVC input goes through the same Annex B conversion as
H.264 and VP9 frames are passed through; output stays 8-bit NV12, and a
frame deeper than 8 bits throws. Picture info throws for HEVC and VP9,
whose layouts differ from the AVC one.
Assisted by Claude Code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DwFnKjMxmwGDWiuYYf1v4D
With conservative rasterization disabled, RADV programs
PA_SC_CONSERVATIVE_RASTERIZATION_CNTL to NULL_SQUAD_AA_MASK_ENABLE alone,
where libSceAgc writes the two INNER_TO_NORMAL overrides (0x6000). A value
made of only those bits now decodes as disabled; overestimation (0x6001) keeps
its checks, and every other mode is still rejected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
RADV sets OUT_OF_ORDER_WATER_MARK to 7 on every GFX10 draw, also when
OUT_OF_ORDER_PRIMITIVE_ENABLE is off. The watermark only tunes out-of-order
rasterization, which stays rejected, so the field is accepted alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FORCE_DST_ALPHA_1 makes blending read a target's destination alpha as 1, as
for an RGBX surface; RADV sets it for formats without alpha. The target's
blend factors are rewritten to what they become with Ad = 1: DST_ALPHA is
ONE and ONE_MINUS_DST_ALPHA is ZERO, SRC_ALPHA_SATURATE is ZERO in the color
equation, and DST_COLOR and ONE_MINUS_DST_COLOR are ONE and ZERO in the
alpha equation. Other CB_COLOR_ATTRIB bits stay rejected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
scePadSetVibrationMode rejected mode 2 (compatible, per SharpProspero's
ScePadVibrationMode). The PS5 SDL joystick driver requests it on every
open and closes the pad when it fails, so SDL titles lost their controller.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Capturing a shader evaluates every V#, T# and S# the program uses,
including those behind a branch the wave does not take. When such a
descriptor was loaded through a pointer read from memory that is null
or unmapped, the capture threw "guest memory is not readable", while
the console faults only if a wave executes that s_load. The descriptor
now reads as zero words, and the flat SRT walk records the s_load's
dwords as it does for flat reads, so their guarded ReadConst raises
the BDA fault where the wave runs the s_load. A zero V# is an absent
buffer and a zero T# binds a null descriptor, as for any zero word
read from memory, so nothing new enters a key. A zeroed descriptor
whose read no flat slot records still throws, as do branch conditions,
uniform fills, table bases and user-data pointers.
Capturing a shader threw "null or misaligned address" when the flat
SRT walk read through a pointer loaded from memory that is null or
unmapped, even when the program skips that s_load. Such a read now
yields zero and a record with its pc and address, as does a slot whose
address needs it. The registered artifact checks one flag word per
guarded slot at each ReadConst; the capture appends the flags and the
records to the flattened SRT, and a set flag raises an Unmapped BDA
fault through the fault buffer and stops the invocation as a BDA read
does. Nothing per capture enters a key: poisoned and clean captures
share one variant and specialization. Descriptors, branch conditions,
uniform fills, table bases and user-data pointers that need such a
value still throw, and poisoned results stay out of the dispatch and
draw caches. The shader disk cache format becomes 21.
The layout offsets the titles read are static_asserts, and guest_sce_net now
checks a canary past byte 384, distinct records, and an untouched buffer on the
EINVAL, RESOLVER_ENODNS and EBADF paths, as #1845's test did.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PS5VR (PPSA99177) stops at start-up on the unresolved import sT4nBQKUPqM;
Jelly5, Emby5 and Nuvio import it too. The call fills the 384-byte resolver
info with up to ten IPv4 records (32 bytes each, family at +16) and the record
counts at +320 and +324, from the same host lookup sceNetResolverStartNtoa
uses, now shared. Only flags 0 is implemented; other flags throw.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PICO-8 for PS5 (PPSA99808) stops at start-up on the unresolved import
a7ToDPsIQrc from libSceLibcInternal. The parser follows FreeBSD's inet_aton
(lib/libc/inet/inet_addr.c): one to four parts in decimal, octal or hex, the
last part filling the remaining bytes, input ending at a NUL or whitespace,
and a null address only validating.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The mesh test was built only on request and never registered, so the
translation of NGG geometry programs to mesh shaders ran in no test
run. On an RTX 4060 it passes. Register it with the other AGC driver
tests.
Three cases would fail or mislead under ctest. Without a Vulkan device
the test failed, and the Windows job has none. A device without
VK_EXT_mesh_shader exited 0, so ctest reported a pass for a test that
drew nothing. On llvmpipe, with the Linux job's Mesa 25.2.8 and Ubuntu
24.04's LLVM 20.1.2, every draw that builds a mesh pipeline stops the
process with "LLVM ERROR: Cannot emit physreg copy instruction"; Mesa
26.2.4 with LLVM 23.1 segfaults in LLVM's code generation instead. The
SPIR-V of all 18 modules the test builds passes spirv-val. Mesa #14376
reports the same error for lavapipe mesh shaders that index shared
memory per invocation; that the cause is the same is not established.
The test now opens its device with OpenVulkanTestDevice and exits 77
without a device, without VK_EXT_mesh_shader and on llvmpipe, saying
why. ANYPS5_REQUIRE_VULKAN still turns a missing device into a
failure. The Linux job therefore skips the test; it runs on hosts with
a GPU.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Config 0x30 (the ambisonic layout, 4 to 16 channels) was rejected at instance init, so Demon's Souls asserted in
its audio player and crashed entering the tutorial level. Each channel is decoded as a mono stream and the
blocks are interleaved.
Measured on RDNA2 in #697: v_interp_p1ll_f16 and v_interp_p1lv_f16 are a
fused multiply-add rounded once to f32, and v_interp_p2_f16 rounds the exact
P20 * J + S2 once to f16. The separate multiply and add matched about 85% and
4% of the measured rows.
Both steps now use FPInterpolateF32 and FPInterpolateF16: the f16 delta times
the f32 coordinate is exact in f64, the sum is rounded to odd and then once to
nearest even at the target precision, so no driver can split or reround it.
Infinite and NaN operands take the unbounded f64 result.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Decode the three VOP3 16-bit interpolation instructions (attribute, channel
and high-half select in the src0 field, the I/J VGPR in src1, P0 or the first
step's result in src2) and translate them with a new
GetInterpolationParameterF16 IR value. It reads the selected 16-bit half of
each vertex's parameter through VK_KHR_fragment_shader_barycentric, so P10 and
P20 are vertex differences rounded to f16; both steps are a multiply and an
add, as in the f32 forms.
An input in FP16_INTERP_MODE whose low half is defaulted is still declared at
its slot when its high half is read, and the high half takes its default from
USE_DEFAULT_ATTR1 and DEFAULT_VAL_ATTR1. Without barycentrics, on an input
without FP16_INTERP_MODE or on a pass-through input the instructions throw.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PICO-8 for PS5 (PPSA99808) imports stpcpy from libSceLibcInternal, one
of the absent imports #1578 lists for it. POSIX defines it as strcpy
that returns a pointer to the terminating null of the copy.
RetroArch (PPSA99169) imports ldiv from libSceLibcInternal, one of the
absent imports #1578 lists for it. The guest long is 64-bit, so the
export takes std::int64_t and returns lldiv_t, which has the guest
ldiv_t layout; std::ldiv would truncate on Windows, where long is 32-bit.
The repo allows one implementation per export. Move libc's rename into
libc/src/Rename.cpp, compile that file into both libc and libkernel, and
drop the second copy from libkernel's Stdio.cpp. FilesystemError moves to a
header so the shared source can use it.
The test now checks that the symbol it resolves belongs to libkernel (module
handle on Windows, dladdr on Linux) so it fails when the export is removed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The guest VFS on Linux does not map absolute host paths, so the test failed
at the first rename there. Match GuestFilesystem.cpp and build the directory
relative to the working directory.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
guest_filesystem_tests links libkernel and libc, both of which define
rename_nid_postfix, so which one it binds to depends on the loader and the
suite passes either way. Resolve the symbol from libkernel.prx explicitly so
the export added for titles that ship their own libc.prx is actually tested.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Titles that ship their own libc in sce_module import rename from
libkernel (NID NN01qLRhiqU), where it was missing, so PPSA12544 failed
to start. It checks both paths like unlink and maps sceKernelRename's
result to errno.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Give guest exception what, non-deleting destructor and deleting destructor slots explicit APS5_VABI types and register guest adapters. Preserve native helpers, object layouts, native exception routing and existing malloc/free ownership.
Add mismatched and cleared RCX regressions for plain and message vtables, observing actual libc free calls to reject foreign or duplicate frees. Retain typed guest catch/rethrow and native exception coverage. All 27 targeted CTests pass three repetitions on Windows Release; Linux execution remains unvalidated.
Guest message throws registered native Windows callbacks even though Release invokes guest callbacks using System V. Register an APS5_VABI adapter in the standard and regex message throw paths and retain the native DestroyMessage helper and legacy callback storage type.
Add MinGW CTest regressions with distinct or zero RCX, shared and final-release messages, typed guest catches, rethrow and normal Release. All ten new cases plus Windows exception and thread callback regressions pass three repetitions. Linux execution remains unvalidated; guest vtables and host exception paths are unchanged.
The decoder threw on the GFX10.1 DS src2 opcodes 0x80-0x8b, 0x8d,
0x92, 0x93 and 0x95. Each reads DS[B], where B is the address plus
four times the 15-bit signed offset in offset1[6:0]:offset0, and
applies the matching operation to DS[A]: add, sub, rsub, inc, dec,
signed and unsigned min and max, and, or, xor, f32 min, max and add
through the 32-bit LDS atomics, and a plain write for
ds_write_src2_b32. The form that takes the offset from the address
bits (offset1[7]), the 64-bit forms and GDS still throw.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keeping lastFuseTime at its maximum never let it recover from a process time that wrapped on the first call (fixed separately in #1501), so tilt correction stopped and guest_pad failed. Queued states keep their own timestamp; the orientation is fused once at the time of the read, as scePadReadState does.
Measured on a PS5 (firmware 13.60) through dlopen of libSceAudioOut.sprx:
a MAIN (type 0) port accepts 1, 2, 8 or 12 channels (bits 8-11) with
sample type 0 or 1 (bits 0-6). Bit 7 without 8 channels returns
0x80268001, any other unsupported format returns 0x8026800E, and both
write UINT64_MAX to the output handle. Bits 12-31 do not affect the
result. Other port types keep their current validation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AF_UNIX pairs as FreeBSD 11 makes them: SOCK_STREAM, SOCK_DGRAM and
SOCK_SEQPACKET with protocol 0, SOCK_NONBLOCK applied to both ends and
SOCK_CLOEXEC accepted, EAFNOSUPPORT for an unknown family, EOPNOTSUPP
for AF_INET and AF_INET6, EPROTONOSUPPORT for type 0 or a protocol,
EPROTOTYPE for another type, EFAULT for a null output, and nothing
written on failure. The ends are guest sockets, so send, recv,
shutdown, fcntl, poll and close work on them; getsockname and
getpeername report the unnamed AF_UNIX address, recvfrom and recvmsg
no address for a stream and the unnamed one for a datagram. On Linux
the pair is the host's socketpair; on Windows a loopback TCP connection
or two connected UDP sockets, and SOCK_SEQPACKET throws. The remaining
differences from the console are recorded in TechnicalDebt.
OpenSSL's QUIC notifier in 15 catalog titles creates such a pair.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Returns the name of the directory under which a title's sandbox exposes
system files, which homebrew SDKs splice into paths such as
/<name>/common/cert/CA_LIST.cer and /<name>/common/lib/libc.sprx. The
name is fixed here; recorded in TechnicalDebt together with the fact
that nothing is mounted under it.
Registers guest_sandbox_random_word.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A path whose T# or S# dwords hold a program-counter, EXEC or compare-mask
value is no longer folded onto the first descriptor: the web split gives up
and the read throws as on main. Cache the invariant-Phi resolution per web,
lower the state limit to 512 and test the program-counter, EXEC and
compare-mask rows, unwritten registers, and the arm and state limits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
It returned the network error, which titles that poll their epoll treat
as fatal. No request is ever pending, since sending fails at once, so the
wait now times out with no events; an infinite wait throws.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
sceSaveDataMount3 with SCE_SAVE_DATA_MOUNT_MODE_CREATE2 opens a save that
already exists, so its mount status is 0 rather than CREATED, as shadPS4's
savedata.cpp reports. A CREATE mount still reports CREATED.
With stride 0, OOB_SELECT 2 puts a fetch out of range only when NUM_RECORDS
is 0, and OOB_SELECT 3 only when the offset is not below NUM_RECORDS (GFX10
table in Mesa ac_descriptors.c). A one-record descriptor therefore returns
its whole element: Unreal's per-draw PrimitiveId stream is such a descriptor,
and refusing it skipped the draw. A wholly out-of-range fetch reads a zero
buffer.
PPSA13427 imports sceHttpSetAuthInfoCallback (jf4TB2nUO40), which no
library exported, so the relinked title failed to load. No request
reaches the network, so no server asks for authentication: the
callback is accepted and never called. The signature and callback
type follow shadPS4.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HeC9bA3n74TzJRYv9AgBE8
Decodes IMAGE_GATHER4H_PCK (MIMG opcode 98) and IMAGE_GATHER8H_PCK
(opcode 99), implements gather4h_pck through translation, the SPIR-V
backend and a GPU execution test, and documents gather8h_pck as a
desktop null-op.
Semantics were measured on gfx1031 hardware with hand-encoded MIMG
words (LLVM rejects the PCK gather mnemonics on every RDNA1/RDNA2
target). The measured rule for gather4h_pck: the four-texel horizontal
window is floor(u*width-0.5)+{-1,0,+1,+2} clamped to the width, the row
is floor(v*height) clamped, the raw bits of the window texels are
concatenated into a little-endian bitstream (texel k at bit offset
k*texelBits), and output register j - the j-th set DMASK bit in
ascending order - receives stream word j, zero past the end of the
stream. Exactly popcount(dmask) consecutive VGPRs are written from vdst
ascending; texels wider than 32 bits write zeros (hardware limit); rows
past the height read zeros; negative coordinates clamp to zero. The
window anchor matches the repo's existing PS5-validated HorizontalOffsets
rule, so this reuses the established convention.
The decoder accepts multi-bit DMASKs for these two opcodes only and
sizes their data span as popcount(dmask) (measured), unlike gather4h
which always writes four components. Translation carries the packed
flag through imageMemoryInfoFromInstruction; the SPIR-V emitter
reassembles the bitstream per lane with per-texel OpImageFetch and
byte assembly. D16 data throws until measured.
gather8h_pck never returns texel data on this hardware: across dmasks
0x1-0xFF including the upper nibble, RGBA8/RGBA16/RGBA32 formats, 1D/2D
and 3D descriptors, normalized and unnormalized sampling, sentinel-
prefilled destination registers confirm it only ever zero-fills
popcount(dmask) registers. It decodes but throws at translation.
The measured semantics and the gather8h_pck null-op are recorded in
docs/dev/TechnicalDebt.md.
Write initial SaveDataParam metadata before replacing the memory blob so metadata failure cannot leave a prematurely grown blob. Handle blob write failure with metadata rollback, and allow retries to recover slots with missing metadata. Expand tests with nonzero data, blob failure, and fresh readback.
The storage image and sampled texture caches each let go of their least
recently used entries past a fixed 2 GiB, and a sampled view of a
storage image counted that image a second time.
The storage image cache keeps a quarter of the largest device-local
heap, at least the 2 GiB of before (TextureCacheBudget). The sampled
cache gets what VK_EXT_memory_budget leaves on that heap after the
memory in use outside sampled textures and cached storage images, the
storage cache's budget and an eighth of the heap budget, read at most
once a second and at least 2 GiB; without the extension it keeps the
storage cache's rule. A snapshot counts its image allocation, a texture
still bound after leaving the cache counts as sampled memory, and a
change of more than 10% is logged at most every 10 s. A nonzero
APS5_TEXTURE_CACHE_MIB sets both budgets; a view of a cached storage
image counts nothing and leaves the cache when its image does.
ComputeTarget(32) can fall back to the default subgroup size. Report both effective sizes and dispatch the third configuration only when it differs, so duplicate runs do not imply wave32 host coverage.
Lavapipe exposes subgroup 8 for both requests: seven CMake checks pass, the distinct matrix passes 1,920 comparisons, ten captured modules validate, and the expected-output negative control fails as intended.
Reject tuple and descriptor overlap, wrong-pair returns, relative SGPR reads, reversed regions and ordinary or conditional fall-through into a callee. Preserve the existing scalar write analysis and require exact return-pair matching.
Seven targeted regressions fail before these guards and pass afterward. Seven focused CMake tests and 15 SPIR-V validations pass; the execution matrix passes 3,200 comparisons and detects a one-bit expected-output mutation.
Hades (PPSA03355) stops at load on main with "undefined symbol:
9HzfhdtESio", the NID of pthread_getname_np, which it calls on
pthread_self() with a 32-byte buffer. Measured on a PS5 (firmware 13.60)
through dlopen of libkernel: the function takes (thread, buffer), copies
the name and its terminator, returns an empty name for an unnamed
thread, ESRCH for a null or joined thread and EFAULT for a null buffer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reuse the prerequisite call-region analysis for signed relative calls, including callees after s_endpgm. Lower the saved link as shader base plus PC+4 and reject unsupported targets and call shapes.
Add decoder, IR, CFG and Vulkan execution regressions. Seven focused CMake tests pass; five layouts cover 15 dispatches and 3,200 output comparisons on lavapipe. Record ISA sources and native RDNA2/PS5 limits in TechnicalDebt.
The recompiler emits OpCapability Int64Atomics for 64-bit buffer atomics
in any stage, and the device enables shaderBufferInt64Atomics when it
has it, but graphics shader validation only accepted its fixed list of
capabilities, so every draw whose shaders use one was rejected with
"SPIR-V requires unsupported device capability 12". Compute dispatches
are not validated this way and already ran them.
The device records the feature (bufferInt64Atomics in the device state
and the graphics Context) and ValidateShaders accepts Int64Atomics when
it is enabled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Decodes SOP1 0x21 s_swappc_b64 (link pair = pc + 4) and resolves its call/return pairing through the existing s_setpc_b64 path: static call regions in GraphBuilder and the vertex-entry fetch-shader call inlined from the parsed fetch-shader plan. s_call_b64 (SOPK 0x16) and s_rfe_b64 (SOP1 0x22) throw at decode. Unmodeled cases throw; see docs/dev/TechnicalDebt.md.
perf(agc): baseline shader recompilation on registration
In main, baseline recompilation depends on the resource configuration and runs on the first use of each corresponding variant.
This branch prepares IR, the static interface, baseline SPIR-V, and available ABI variants during shader registration. The compiled artifact is separate from per-draw and per-dispatch data.
Before the first execution with a new resource configuration, the runtime reads descriptors, validates compatibility, prepares the binding plan, specializes existing SPIR-V by substituting constants and removing unused branches and computations, materializes invocation data, and creates the Vulkan pipeline. These results are cached.
Variants that depend on linked graphics stages are prepared when the corresponding ABI is resolved. Unregistered compute shaders undergo baseline preparation on their first dispatch, emit an error log, and cache the result.
Subsequent executions reuse prepared artifacts, specializations, and pipelines while updating invocation data and resources as needed.
The PS4 firmware 11.00 libSceNgs2.sprx stores matrix levels clamped to
-4..4, keeps NaN, and rejects a level count of 0. Levels were stored
unclamped, so a level of 8 played twice as loud as on the console, and a
count of 0 cleared the matrix.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Three homebrew titles from #1578 import it and stop at start-up without
it: ps5-opengl (PPSA99005), EVO-PLAYER-PS5 (PPSA99039) and
ProsperoRadio (PPSA99001).
It reports the port's resolution as the full and pane size and the
refresh rate ID as sceVideoOutGetOutputStatus does. The 48-byte layout
follows the declarations in ps5-opengl and EVO-PLAYER-PS5, which agree;
the screen size is 0 and the flags are 0. An invalid handle or a null
status throws, as in the other status getters.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
guest_errors sets errno to 13 and checks at the end that the strerror_r
calls left it alone, but a std::thread is created and joined in between.
Guest errno is the host's errno. Since glibc 2.42, pthread_create first
tries madvise(MADV_GUARD_INSTALL) for the new thread's stack guard.
Kernels before 6.13, including WSL2's 6.6, reject it with EINVAL, and
glibc falls back to mprotect with errno left at EINVAL. POSIX leaves
errno unspecified after a successful call, so the test aborts on Ubuntu
26.04 (glibc 2.43) under WSL2 without anything being wrong.
Check errno right after the strerror calls, and set it to 13 again after
the join, so every errno check covers only strerror and strerror_r.
DMA_DATA with DST_SEL 2 (V_411_NOWHERE in Mesa's src/amd/common/sid.h)
reads its source into L2 and stores nothing; libSceAgc emits it as an
L2 prefetch with the source address repeated as the destination. It
threw as a register or prefetch destination. A prefetch of a memory
source is now accepted and writes nothing: ResolveStore returns it as an
empty store, so the packet stays ordered without a drain,
DecodeMemoryCopy keeps rejecting it and Execute skips it. A prefetch of
a register, GDS or immediate source and a register destination still
throw.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
sceUltFinalize cleared gUlthreads directly, dropping the last
shared_ptr to an UltUlthreadState while its worker thread still held
the raw pointer passed to scePthreadCreate. Finalize now returns
ULT_ERROR_BUSY when an ulthread is still registered, before any global
state is torn down, following the BUSY convention of the queue,
semaphore and queue data pool destroy paths. Joining the ulthread
remains the caller's responsibility, as sceUltUlthreadJoin already
keeps the state alive across scePthreadJoin and erases it afterwards.
SPI_SHADER_COL_FORMAT 7 (UINT16_ABGR) was rejected by DecodeState,
though the recompiler already handles it: a pixel shader's MRT output
under mode 7 is a uvec4, and a compressed export's 16-bit halves are
taken with OpBitFieldUExtract. The format is now accepted when the
target's CB_COLOR_INFO number type is UINT; into any other target it
still throws, as does SINT16_ABGR (8), whose halves would need sign
extension.
The target records the export (ColorTarget::uintExport). Shader
validation then requires a uint4 output at its location instead of a
float4 one, and blending into it is refused (Vulkan has no blending of
integer attachments).
PPSA14632 (LEGO Horizon Adventures) writes a 2848x1600 R8_UINT target
this way; those draws were dropped.
agc_driver_pixel_uint16_export draws compressed MRT0 exports under mode
7 into a linear 16_16_16_16 UINT target, one row per pair of packed
words (0x0000ffff/0xffff0000, 0x00010002/0xffffffff and four distinct
halves), and reads every 16-bit component back under the identity,
STD_REV and ALT_REV export mappings. agc_driver_graphics covers the
decode and the blend refusal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ScreenTester5 (PPSA69420) stops at start-up on the unresolved sysctlbyname
import and also imports sysctl. hw.ncpu (CTL_HW.HW_NCPU) reports the same
processor count as sysconf(_SC_NPROCESSORS_ONLN). Other names and MIBs throw.
Report SAVE_DATA_ERROR_INTERNAL when setupSaveDataMemory2 fails to persist initial SaveDataParam metadata, and restore previous state so retrying setup can initialize cleanly. Closes#1667.
When another live image overlaps the fill, a fill at a live image's dccAddress is a key fill
only while it stays within DccKeyCount (the pipe-aligned key count); with nothing overlapping
the length rule is unchanged. ClassifyFill, NoteKeysFill and ClearByKeysFill share the match.
agc_driver_fill_cover_keys pins Keys, Inside and Several for fills at and beside the keys.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
LibcExit called std::exit, which ran the static destructors of the libraries
before the guest exit handlers. A guest handler that freed memory then locked
a destroyed std::mutex, which throws, and a noexcept guest destructor ended in
std::terminate. The guest handlers now run first, while the library objects
are alive.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add sigemptyset, sigfillset, sigaddset, sigdelset and sigismember with
FreeBSD 11 semantics (lib/libc/gen/sigsetops.c): a 128-bit set of four
32-bit words, signal n at bit n - 1, signals 1 to 128 valid. sigfillset
sets every bit. An invalid signal returns -1 with errno EINVAL and leaves
the set untouched; sigismember returns 1 or 0. A null set throws.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Each direct memory backing keeps a memfd open, so a title such as
Dreaming Sarah (PPSA02929) holds about 1100 descriptors at startup.
With the systemd default soft limit of 1024, later opens fail with
EMFILE: memfd_create throws "create direct memory backing: Too many
open files", or the title's fopen returns NULL and it faults in fread.
libkernel now raises the RLIMIT_NOFILE soft limit to the hard limit
when it is loaded, before the title creates any descriptor, and throws
if the limit cannot be read or raised.
MoltenVK reports VK_KHR_fragment_shader_barycentric, but its SPIR-V to MSL step
rejects the PerVertexKHR decoration that the barycentric path uses, so every
pixel shader on that path fails to compile into a pipeline. Treat the feature
as unavailable when the driver is MoltenVK, so the no-barycentric path is used.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A raw 5.1 LC frame decodes as 6 channels with a maximum of 6 and of 8,
which is only reached by moving past the mono/stereo configuration. The
configuration search is listed under unknown function info, together with
a mono raw stream being reported as 2 channels.
Co-authored-by: Dextroid17 <217507631+Dextroid17@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
For a raw M4AAC stream the maximum channel count was written into the
AudioSpecificConfig as the channel configuration. The maximum only bounds
the stream: The Smurfs Dreams creates its decoder with 8 channels at most
and sends stereo, so FFmpeg refused configuration 8 (reserved) and a
stereo stream under configuration 6 or 7 decodes no frame. The decoder
now starts from the mono/stereo configuration and on the first access
unit that it cannot decode moves on to the configurations with more
channels, up to the maximum, keeping the first one that decodes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sceSysmoduleIsLoaded returned 0x80A90002 and the unload calls 0x80A90003
for a module that is not loaded. Neither value exists in the SDK: the
sysmodule facility is 0x5A and the error is 0x805A1001, which titles
compare against (GTA V PPSA04263: cmp eax,0x805a1001 after IsLoaded) to
decide whether to load and initialise the module themselves. Return that
value from all three places and cover it in guest_sysmodule.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Replace the CLEAR_STATE approximation with the envelope and per-op-bit packet groups measured on PS5 firmware 13.60. Emit groups for op bits 0x001, 0x002, 0x004, 0x008, 0x010, 0x020, 0x080, 0x100 and 0x800 in ascending order; throw for 0x040, 0x200 and 0x400 whose packets the driver rejects. state 2 sets the envelope flag and state 3 sets the 0x004 and 0x800 group payload dword.
Clang's PS4 and PS5 targets set the default new alignment and the suitable
alignment to 32 bytes, so PS5 code may store to a fresh malloc or operator
new result with 32-byte-aligned AVX instructions. The guest heap aligned
blocks to 16 bytes, and the arena's 32-byte classes put every small block
16 bytes past a 32-byte boundary after its header, so such a store faulted.
The minimum alignment is now 32 bytes; the padding still assumes only the
16-byte alignment the raw blocks guarantee.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A suspend point flushes the labels queued since the last submission. It
recorded them only when a Vulkan device existed, and the device is created
lazily, so labels queued by a title that had not yet drawn were never
written. RADV ends each submission with a RELEASE_MEM to a marker it polls
from the CPU; when the end of that submission was folded into a following
suspend point, the marker stayed at 0 and RADV reported the device lost.
The labels are now recorded either way, which writes them from the CPU
without a device.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The retry that waits for a target to leave NtContinue, NtContinueEx or
libwinpthread-1.dll had no bound, so a target that stayed there made
sceKernelRaiseException spin forever. It now throws after 1 s. A new
guest_raise_exception phase keeps a thread inside NtContinue by
continuing a context that calls NtContinue again, and checks that the
raise throws and that the handler did not run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The console's DCC of a single-level 4-byte SW_64KB_R_X surface is
ceil(W/512) * ceil(H/512) * 4096 bytes, 49152 for 1920x1080, but the
driver stored and read one key per 256 surface bytes (34560).
PPSA26344 retiles its render DCC into the displayable copy it
registers (cs_dcc_retile_32bpp); a retile of the stale tail gives the
mixed keys PPSA12544 stops on.
DccKeyCount gives that extent. Color target and storage image key
stores cover it when the DCC is pipe-aligned (CB_COLOR_ATTRIB3 bit 30,
T# word 6 bit 19), whose CB keys reach its last meta block, and throw
where it is not writable; unaligned DCC keeps one key per 256 bytes,
as do texture and color target key reads. DisplayBufferKeys reads the
display DCC over the extent, presents only when every key agrees,
names the first differing key's pixels and checks a pending image
against those keys.
Mode 0 of CB_COLOR_CONTROL turns color writes off, but a draw with a
written color target and this mode was skipped as unsupported. Count no
export as written when the mode is disable, so the draw renders without
a color attachment like the existing attachment-free path, and accept
the mode with any ROP3, which does not apply while writes are off.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The vertex entry set only the vertex and instance index VGPRs, leaving
the NGG merged wave info SGPR s3 at 0. NGG shaders build EXEC from it
(s_bfe_u64 exec, -1, <count in bits 16..22>), so Mesa's NGG vertex
shaders ran with an empty EXEC and rasterized nothing.
Each host invocation on the vertex path is one vertex of a full wave:
when the user data starts at s8 or later, set s3 to the wave size as
both vertex and primitive count, with wave index 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Store: negative, -0, NaN (quiet and low-payload), +-Inf, overflow to the
largest finite value, truncation and small-float denormals. Load: Inf,
denormal and largest finite codes. Values measured on gfx1035.
Co-Authored-By: Claude <noreply@anthropic.com>
Format 43 packs R as a 10-bit and G and B as 11-bit unsigned floats, which
Vulkan has no format for. Keep it in an R32_UINT image like the other
packed formats without a host equivalent, and convert texels in the shader
on image loads and stores; sampling it still throws.
When one guest sampler is paired both with an image that needs point
filtering (sint, depth-bits or converted format) and with an ordinary
image, ResourceMaterializer::Apply appends a point-filtered copy of the
sampler after the original samplers. The resource snapshot only holds
the original samplers, so DescriptorBindingBuilder::Populate threw
"guest sampler index is out of range" for the copy, both in the sampler
binding and in the unnormalized-coordinate check.
SamplerResource::copyOf records the sampler a copy was made from, and
the guest sampler descriptor of a copy is read from that sampler; the
point-filter rewrite of word 2 still applies to the copy. The field is
part of the disk cache encoding: cache format version 8.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The integer emulation of the round-to-nearest-even float-to-half
conversion is exact but costly: a compute shader with about 3600
conversions never finished compiling on NVIDIA. When the device enables
shaderFloat16 and guarantees shaderRoundingModeRTEFloat16,
shaderDenormPreserveFloat16 and shaderSignedZeroInfNanPreserveFloat16,
it advertises Float16, RoundingModeRTE and DenormPreserve, and the
recompiler emits OpFConvert under the 16-bit RoundingModeRTE,
DenormPreserve and SignedZeroInfNanPreserve execution modes instead.
NaNs keep the emulated quiet NaN with the high payload bits. Devices
without these guarantees keep the emulation.
Graphics validation accepts the RoundingModeRTE, DenormPreserve and
SignedZeroInfNanPreserve execution modes for 16-, 32- and 64-bit floats,
so vertex and pixel shaders with a native conversion still draw.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
On GFX10.3 to GFX11.7, ACO lowers a subgroup-scope OpReadClockKHR to
s_getreg_b32 of SHADER_CYCLES, 20 bits zero-extended to 64, so s_memtime
wrapped every 2^20 cycles and went backwards. Detect those families from
the RADV device name and read the device clock there instead.
Fixes#985
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolve ASCII case differences in guest paths and mount aliases while preferring exact names and rejecting ambiguous fallback matches. Preserve new filenames and host roots. Five filesystem tests pass; Skyrim now loads its INI and shader archives, initializes Vulkan and uploads intro textures instead of dereferencing null shader metadata. Written with AI assistance.
Titles pass handle 0 (RTLD_DEFAULT) for a process-wide lookup, and the loader rejected it: the handle is
not in the module map, so every such lookup failed even when a loaded module exports the symbol. Handle 0
and -2 now take the default scope, searching the global modules by plain name, NID and `#guest` form, and
then the process-wide scope.
The process-wide scope of the real loader also contains glibc and libstdc++, so an unfiltered fallback
would answer `malloc`, `dlopen` and `pthread_create` where PS5 reports the symbol as missing: handle 0 is
the main program, whose lookup sees the program's exports, not the host C++ runtime. A result from the
process scope is therefore accepted only when `dladdr` attributes it to a converted or replacement module
(a `.prx` library or the executable), which keeps the fallback for guest symbols and removes the host
leak. `guest_dynamic_loader` asserts the three host names are not found; disabling the filter makes that
test fail.
The scripting heap that an earlier revision of this branch added has been dropped: the title reaches the
same boot milestone with the lookup failing honestly, so the export was an inference rather than a
requirement, and prosper's bring-up notes report `ESRCH` for that name on hardware.
A draw whose PA_SC_CONSERVATIVE_RASTERIZATION_CNTL (context 0x313) was
not the default 0x6000 threw in DecodeState and the draw precheck.
0x6001 sets OVER_RAST_ENABLE and now decodes to Vulkan's overestimation
mode, chained to the pipeline's rasterization state and its key.
The device enables VK_EXT_conservative_rasterization only when its
primitiveOverestimationSize is at most 1/256 pixel and it rasterizes
degenerate triangles; elsewhere the pipeline throws. Overestimation is
accepted only when triangles reach the rasterizer: VGT_GS_OUT_PRIM_TYPE
behind a geometry shader, VGT_TF_PARAM's output topology behind
tessellation, VGT_PRIMITIVE_TYPE otherwise. Other 0x313 values and
centroid interpolation still throw.
Adds the agc_driver_conservative_rasterization GPU test and extends
agc_driver_graphics.
Check module headers, instruction lengths and required operands before
scanning narrow types.
Cover malformed and byte-swapped modules while retaining the native
SPIR-V 1.3 conversion matrix.
Tested: Linux/llvmpipe CTest three times with SPIRV-Tools on and off,
cold-cache Vulkan regressions, and ASan/UBSan in all optimization modes.
Skip CCP and Simplification for storage-only narrow types while keeping
the remaining passes and arithmetic-capable folding.
Add compiler and Vulkan readback regressions for default/full/none modes.
Tested: Linux/llvmpipe, full CTest with SPIRV-Tools on/off, ASan/UBSan
optimizer checks, and cold-cache Vulkan wave32/wave64 readback.
Fixesboykopovar/AnyPS5#1276
Invoke the title callback on planar mixed samples and silence. Preserve per-voice callback data, reset registration on setup, and release the render guard on callback failure. Include behavioral tests and source references. Written with AI assistance.
A draw that sets STENCIL_CLEAR_ENABLE was rejected as a whole, so its
color output was lost as well. The draw is now rasterized with every
covered sample's stencil replaced by DB_STENCIL_CLEAR, whatever the
stencil and depth tests are, and its color outputs are written as usual.
The depth/stencil state is decoded for such a draw even when
DB_DEPTH_CONTROL enables no test. Depth clear, copy, resummarize and
decompress draws are still rejected.
describePages parsed the whole /proc/self/maps for every run it
reported. On kernels with the PROCMAP_QUERY ioctl (Linux 6.11+) each run
is now one ioctl on an open /proc/self/maps fd with
PROCMAP_QUERY_COVERING_OR_NEXT_VMA, which returns the covering or next
VMA and its read/write flags straight from the kernel, so the answer is
exact for host mappings too. A VMA starting above the cursor is a gap up
to its start and ENOENT is a gap to the end. Kernels without the ioctl
keep the line scan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A V# whose base is not a multiple of 4 bytes from the start of its GPU
owner threw in GuestBufferMemory::Descriptor, because the shader added
the offset below the view only in whole dwords.
Descriptor now binds from the offset alignment below the view and
passes the whole remainder. Such a view's range covers the dwords
around it, and its descriptor region starts and ends on dword
boundaries, so a lone view copied to its own buffer binds the same way.
The buffer specialization records the V# base's low two bits. Raw
vector loads through such a V# join two dwords, glc dwordx2 loads
included, stores merge their bytes into both with compare-exchange
loops, and bounds checks include the second dword. s_buffer_load
ignores the low two bits, as SrtEvaluator does. Formatted accesses
whose element alignment (min(element bytes, 4)) the base breaks throw,
as they fault the wave on RDNA2, and so do atomics.
SleepUntil, PollSleepUntil and SleepNanosCoarse each wait on one
thread_local high-resolution timer. A sceKernelRaiseException handler
that runs as an APC inside a sleeping thread's wait and sleeps itself
re-armed that timer and consumed its signal, so the interrupted sleep
never returned. A nested TimerWait now waits on its own timer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Preserve files across unmount, block new lookups until remount, and validate mount-dependent operations. Keep prior-run storage inaccessible after initialization.
Written with AI assistance.
StorageTexture::MarkDirty skips the first write's uncompressed key
store while the image's filledKeys holds a clear code, and only an
upload or clearByKeysFill reset that fill. After a 0001 key fill, a
kernel storing 0000 over the keys and a storage write, the refresh of
write-watched memory read 0000, the keys the image was uploaded under,
so it did not upload again and kept the stale 0001. The write then
left the 0000 keys in memory, and a kernel reading them saw the clear
colour.
StorageTexture::ProvedKeys, the key read of Refresh and the fast
revalidation, now forgets the fill when it reads other keys while the
image has no results pending. An image with pending results keeps it,
since its write-backs treat those results as killed by that fill.
Since #1156 a title's bundled sce_module/libc.prx is loaded for its
exports but its init is suppressed, while titles still call its malloc,
which then returns NULL (#1500). On Linux, titles that bundle libc crash
at launch: one segfaults within 0.2 s, another stops with bad_alloc.
This reverts commit 2d6aff7a1e, reversing
changes made to e82e03f11e.
send, sendto and sendmsg rejected every flag with EOPNOTSUPP, so callers
that pass FreeBSD's MSG_NOSIGNAL (0x20000) could not send at all. Accept
it: Windows sockets never raise SIGPIPE, and on Linux it maps to the
native MSG_NOSIGNAL. Other flags still fail with EOPNOTSUPP.
DOOM (PPSA99666) sends its upload server replies with MSG_NOSIGNAL and
closed every connection without an answer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Translate the FreeBSD pollfd layout and flags to WSAPoll on Windows and
poll on Linux. Closed socket descriptors report POLLNVAL, a timeout below
-1 fails with EINVAL and a null array with EFAULT. Non-socket
descriptors, unknown event bits, POLLPRI on Windows and an infinite wait
without sockets throw; these are recorded in TechnicalDebt.
DOOM (PPSA99666) imports poll for its upload server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Guest C built with -fexceptions binds __gcc_personality_v0 to
__gcc_personality_v0_nid_postfix, and the unwinder recognizes the frame
by that address. exception_c_cleanup links the host personality, so it
passed without the export.
The new test builds a call-site table by hand and drives the routine the
way the unwinder does: through the _nid_postfix symbol and through
CallPersonality. It covers the cleanup phase installing the landing pad,
the search phase continuing, ranges before and after the call site, a
call site with no landing pad, no LSDA, a signal frame, an unsupported
version, and an unknown personality. Without the export it fails to link.
On macOS the host keeps libc++abi: libc++ binds __cxa_throw two-level,
so moving only the personality into this runtime would leave the two
halves disagreeing on the exception header. The host personalities stay
libc++abi's and libunwind's, and libc.prx serves guest code:
- the guest's libstdc++ std::exception_ptr is modelled directly, since
libc++'s differs, and the Itanium type_info layouts that libc++abi
keeps private are declared for the runtime;
- guest frames are found through their PT_GNU_EH_FRAME, using a
dl_iterate_phdr emulation over the ELF program headers that relinked
images keep in __APS5DATA,__meta (written by relinker --macos, which
comes in a later pull request);
- host frames are found by scanning __TEXT,__eh_frame;
- sceKernelGetModuleInfoForUnwind uses the same emulation and falls back
to dladdr for host images.
The libc++ paths compile only with libc++/libc++abi and the rest only
on __APPLE__, so Linux and Windows builds are unchanged.
exception_c_cleanup throws from host code, which this runtime does not
serve on macOS, so it is not built there.
Guest C built with -fexceptions imports __gcc_personality_v0 for its
cleanup frames, and libc.prx did not export it. The routine becomes
__gcc_personality_v0_nid_postfix, the host __gcc_personality_v0
forwards to it as __gxx_personality_v0 already does, and
CallPersonality recognizes both names.
The GFX10 lowering of a wave64 reduction scans rows with DPP row_shr
1/2/4/8 and v_permlanex16_b32 under EXEC -1, then joins lanes 31 and 63
with a scalar op. The console fills lanes outside the entry EXEC with
the identity, but on the host they can be helpers that sit out subgroup
operations or invocations that were never launched: on 64 lanes (RADV)
the emulated chain reads 0 or stale values from them, and on 32 lanes
lane 63 throws since #997.
EmitReadLane now recognises the sequence on any host for UMin, UMax,
SMin, SMax, IAdd, AND and OR when the keys are the identity outside the
entry EXEC. On 64 lanes, lanes 31 and 63 become subgroup reductions of
the keys of invocations 0-31 and 32-63; on 32 lanes or fewer, lane 31
reduces all keys and lane 63 is the identity. It throws without
subgroup arithmetic or on a subgroup wider than the wave. VulkanDevice
reports GroupNonUniformArithmetic and ShaderValidation checks it.
Adrià
Adrià Franch
MathiasDevelopes
raghav314
Joey Fisher
Renan Pires
Josip Parlov
Hannah Lyons
Achraf Reyani
Michon
David
MarcZX100
pushkarreddyy
David
Scott Schuster
Alex
Hussein Kadhim
Dean
goncalompontes
Chad
Abdulrahman Elkordy
MrMha
Sanjaysrinivas
Get-fix
JAB-dev
QRMOE
Jan Šlégl
Dean Galvin
ThatsLeo
ps54all
emirplus
AlxcBTW
XairRrR
Yassine
LeandroLP23
arcwiser
Lexroid
Karan Vora
krishnaraya
Tharun Balaji
alfalfa-star
tototomate123
TideOPL
Celegans12
Yuvaraj
boykopovar
Rohan K
virp-mta
Dextroid17
Scramblrrrr
AymanFE
jeffrey12cali
Nicolas Abosch
danzaio
overlordxrz-source
Marcus
Mini
LuisBiceps
Alex Collini
Doston Abdullayev
xXPBSXx
Samuel Jean
Morten Holm
Raihan Abdul Majid
authurtabo-byte
EdouardSence
Gjon Gojcevic
Faffu
Nahuel Genchi
eliasbruno124-dev
ale
Sasha Papo
Aryan Sharma
ah
Daniele Giovane
NevesHenry
erick-dsnk
seven
Julio Cacko
jweidenh
Pouare514
fisherjoey
turkishcuber
Zurisen
aashishaxo
andre
22alfbassett
Daan Dehing
Oguzhan Ozdemir
validation agent
hazzardouslysolid
russhil
Elijah De Guzman
Mohd Faour
clem-gb
Zheorgyan
hamb3r
Roojool
ArjenS-LA
hugodearaujo
popcoder565
TibixDev
john.maia
esatturan
Saranxzi
Praveen Kumar
Mouhand Kaddo
hikazey
Claude
NumberGuan
marcio-ch
Ruzi
Pouare514
Gerard L.
Archit Dewan
Daniel Radosa
Pedro
eljackjoestar-cmd
Andreas
meiz
mugurc
Arvind Frøiland
don
Petre Buia
kali113
krishalivaibhav
tezzgod74
Angel
Jordan Hans
Negesin
Obi Newman
jdmagic
Liav Mordouch
journaltraces
Prophet069
gdr-98
Mark Kuebel
ebosido444-ai
muhzain05
st44rplatinum
Pacuka
ahmedhamouda78
Leandro
ToyuAU
Zheorgyan
nisbenz
Nikhil Panchal
Kikoarl