From 2e5004d2a32dbf29c798a4915313d881f9c16b6d Mon Sep 17 00:00:00 2001 From: klosixgaming-arch Date: Mon, 19 Oct 2026 07:09:47 -0500 Subject: [PATCH 001/113] fix(shader): resolve table column pointers through Phi nodes --- .../libSceAgcDriver/tests/ShaderMemory.cpp | 42 +++++++++++++++++ .../Optimization/src/ResourceTracker.cpp | 46 ++++++++++++++++++- 2 files changed, 87 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp index e788638438..058046a306 100644 --- a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp @@ -3042,6 +3042,18 @@ void verifyPointerImageTable() { require(!TableTouched(narrowTable.regions, root + (Palette + 32u) / 4u, 32u) && !TableTouched(narrowTable.regions, root + Committed / 4u, Reserved - Committed), "pointer image table: a record outside the key domain was read"); const std::vector> narrowReads{{base + Palette, 32u}, {base + Palette + 2u * 32u, 32u}, {base + Palette + 255u * 32u, 32u}, {base + Palette + 0x102u * 32u, 32u}}; require(narrowSnapshot.readRanges == narrowReads && narrowTable.result->imageTableReadRanges.size() == 1u && narrowTable.result->imageTableReadRanges[0] == narrowReads, "pointer image table: consumed ranges include skipped keys or the key-domain buffer"); + + auto phiCode = maskedCode; + phiCode.erase(phiCode.begin() + 8, phiCode.begin() + 10); + phiCode.insert(phiCode.begin() + 8, { + 0xbf068010u, 0xbf850003u, 0xf4200444u, 0x20000000u, 0xbf820002u, 0xf4200444u, 0x20000000u + }); + const auto phiRequest = request(phiCode, 0x36000u); + const auto phiPlan = GetResourcePlan(phiRequest); + require(phiPlan->info.images.size() == 1u && phiPlan->info.images[0].table == 0u, "pointer image table: a pointer read through a phi was not planned as a table"); + const auto phiTable = CompileTable(phiRequest); + require(phiTable.capture->snapshot.tables.tables.at(0).codes == snapshot.codes, "pointer image table: a pointer read through a phi captured different records"); + keys = {}; #ifdef _WIN32 VirtualFree(block, 0, MEM_RELEASE); @@ -3445,6 +3457,36 @@ void verifyPointerChainImageTable() { static_cast(ValidateAndOptimizeSpirv(compiled.result->spirv, request.target.vulkanVersion, request.target.spirvVersion)); #endif store(links[1].data() + 4u, address(descriptors[1].data())); + + auto phiCode = code; + phiCode.erase(phiCode.begin() + 15, phiCode.begin() + 17); + phiCode.insert(phiCode.begin() + 15, { + 0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xf4240b02u, 0x24000008u + }); + auto phiRequest = TableRequest(phiCode, userData); + phiRequest.shader.codeAddress = 0x38000u; + const auto phiPlan = GetResourcePlan(phiRequest); + require(phiPlan->info.images.size() == 1u && phiPlan->info.images[0].table == 0u, "pointer chain image table: a pointer read through a phi was not planned as a table"); + const auto phiTable = CompileTable(phiRequest); + require(phiTable.capture->snapshot.tables.tables.at(0).codes == snapshot.codes, "pointer chain image table: a pointer read through a phi captured different records"); + + auto divergentCode = code; + divergentCode.erase(divergentCode.begin() + 15, divergentCode.begin() + 17); + divergentCode.insert(divergentCode.begin() + 15, { + 0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xf4240b02u, 0x24000018u + }); + auto divergentRequest = TableRequest(divergentCode, userData); + divergentRequest.shader.codeAddress = 0x39000u; + expectFailure([&] { static_cast(GetResourcePlan(divergentRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi reading different table offsets was planned as a table"); + + auto nonTableCode = code; + nonTableCode.erase(nonTableCode.begin() + 15, nonTableCode.begin() + 17); + nonTableCode.insert(nonTableCode.begin() + 15, { + 0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xbe960380u, 0xbe970380u + }); + auto nonTableRequest = TableRequest(nonTableCode, userData); + nonTableRequest.shader.codeAddress = 0x3a000u; + expectFailure([&] { static_cast(GetResourcePlan(nonTableRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi with a non-table branch was planned as a table"); } void verifyDescriptorPhis() { diff --git a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp index 7306a87c0e..ceb8017633 100644 --- a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp +++ b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp @@ -691,6 +691,47 @@ private: return true; } + IrValue* UnwrapTableRead(IrValue* value) const { + if (value == nullptr) return nullptr; + value = value->Resolve(); + if (!value->IsPhi()) return value; + IrValue* candidate = nullptr; + std::vector pending{value}; + std::unordered_set visited; + while (!pending.empty()) { + auto* current = pending.back()->Resolve(); + pending.pop_back(); + if (!visited.insert(current).second) continue; + if (current->IsPhi()) { + for (std::size_t i = 0; i < current->ArgumentCount(); i++) { + pending.push_back(current->Argument(i)); + } + continue; + } + std::uint32_t memoryIndex = 0; + IrValue* key = nullptr; + std::uint32_t stride = 0; + std::uint32_t addend = 0; + if (ScalarReadMemory(*current, memoryIndex) == nullptr || !MemoryIndexBelongsTo(memoryIndex, *current) || + !MatchAffineOffset(current->Argument(1), key, stride, addend)) { + return nullptr; + } + if (candidate == nullptr) { + candidate = current; + } else if (!EquivalentValue(m_program.Resources(), candidate, current)) { + std::uint32_t candidateIndex = 0; + const auto* candMem = ScalarReadMemory(*candidate, candidateIndex); + const auto* curMem = ScalarReadMemory(*current, memoryIndex); + if (candMem == nullptr || curMem == nullptr || candMem->offset != curMem->offset || + !EquivalentValue(m_program.Resources(), candidate->Argument(0), current->Argument(0)) || + !EquivalentValue(m_program.Resources(), candidate->Argument(1), current->Argument(1))) { + return nullptr; + } + } + } + return candidate; + } + bool TryMakeIndirectColumn(IrValue& handle, IrValue& descriptorPointer, bool sampler, std::uint32_t words, std::uint32_t descriptorOffset, std::uint32_t descriptorImmediate, TableColumnPlan& plan) { std::vector hops; IrValue* pointer = &descriptorPointer; @@ -728,7 +769,10 @@ private: IrValue* offset = nullptr; std::uint32_t first = 0; for (std::uint32_t dword = 0; dword < 2u; dword++) { - IrValue* read = pointer->Argument(dword)->Resolve(); + IrValue* read = UnwrapTableRead(pointer->Argument(dword)); + if (read == nullptr) { + return false; + } std::uint32_t memoryIndex = 0; const MemoryInfo* memory = ScalarReadMemory(*read, memoryIndex); if (memory == nullptr || !MemoryIndexBelongsTo(memoryIndex, *read)) { From 070e44768c40f7ceaf95d6220549f07dee724a03 Mon Sep 17 00:00:00 2001 From: mugurc Date: Tue, 20 Oct 2026 11:55:07 +0300 Subject: [PATCH 002/113] fix(tests): let the TZ flipper of the zone race yield The zone race of guest_time_conversion changes TZ in a tight loop while six threads convert times. On macOS the flipper keeps the guest environment lock: the default mutex there lets the thread that unlocks take the lock again before a woken waiter runs. The readers mostly waited, and the test ran for 21 seconds, past its 20-second timeout; a run with counters showed about 373 million TZ changes against the readers' 15,000 local time conversions. The flipper now yields after each change. It still changes TZ about 800,000 times while the readers convert, they see each zone in about half of their conversions, and the test takes about a second. --- core/libs/tests/GuestTimeConversion.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/core/libs/tests/GuestTimeConversion.cpp b/core/libs/tests/GuestTimeConversion.cpp index 2330a5acba..50518721ac 100644 --- a/core/libs/tests/GuestTimeConversion.cpp +++ b/core/libs/tests/GuestTimeConversion.cpp @@ -372,7 +372,10 @@ static void CheckZoneRace() { std::atomic stop{false}; std::atomic torn{0}; std::thread flipper([&] { - for (bool west = false; !stop.load(); west = !west) setenv_nid_postfix("TZ", west ? "UTC-5" : "UTC+3", 1); + for (bool west = false; !stop.load(); west = !west) { + setenv_nid_postfix("TZ", west ? "UTC-5" : "UTC+3", 1); + std::this_thread::yield(); + } }); std::array readers; for (auto& reader : readers) { From 4d10a0d00267d07f411e8bb06402ea083c7a998a Mon Sep 17 00:00:00 2001 From: ZSWolt <87244144+ZSWolt@users.noreply.github.com> Date: Tue, 20 Oct 2026 12:03:43 +0300 Subject: [PATCH 003/113] fix(libc): end swscanf at %S and %C as a matching failure swscanf and swscanf_s threw "unsupported conversion" for %S and %C. The console's Dinkumware wide scanner, read from the libc.prx that PPSA21564 ships, treats them as invalid conversions: the scan stops there and returns the fields assigned before them. A length modifier or suppression does not change that. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libc/src/ScanningWide.cpp | 2 ++ core/libs/tests/GuestWideConversion.cpp | 10 ++++++++++ docs/dev/debt/libc.md | 2 +- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libc/src/ScanningWide.cpp b/core/libs/prx/libc/src/ScanningWide.cpp index d040f9afe5..df94bfa287 100644 --- a/core/libs/prx/libc/src/ScanningWide.cpp +++ b/core/libs/prx/libc/src/ScanningWide.cpp @@ -244,6 +244,8 @@ private: case u's': case u'c': case u'[': return Text(directive); + case u'S': + case u'C': return Outcome::Matching; case u'n': return Count(directive); default: Fail("unsupported conversion " + std::to_string(directive.conversion)); } diff --git a/core/libs/tests/GuestWideConversion.cpp b/core/libs/tests/GuestWideConversion.cpp index 335e193708..3569898fde 100644 --- a/core/libs/tests/GuestWideConversion.cpp +++ b/core/libs/tests/GuestWideConversion.cpp @@ -134,6 +134,11 @@ static void CheckScan() { Require(swscanf_s_nid_postfix(u"x", u"%2lc", pair, std::size_t{2}) == 0, "%2lc short input"); Require(swscanf_s_nid_postfix(u"cab12", u"%l[abc]%d", text, std::size_t{6}, &first) == 2 && std::u16string(text) == u"cab" && first == 12, "%l["); Require(swscanf_s_nid_postfix(u"été!", u"%l[^!]", text, std::size_t{6}) == 1 && std::u16string(text) == u"été", "%l[^"); + char16_t untouched[4] = {u'?', u'?', u'?', u'?'}; + Require(swscanf_s_nid_postfix(u"Āb cd", u"%S", untouched, std::size_t{4}) == 0 && untouched[0] == u'?', "%S is an invalid conversion"); + Require(swscanf_s_nid_postfix(u"7 Āb", u"%d%lS", &first, untouched, std::size_t{4}) == 1 && first == 7 && untouched[0] == u'?', "%lS stops after the earlier assignment"); + Require(swscanf_s_nid_postfix(u"Āyz", u"%2C", untouched, std::size_t{4}) == 0 && untouched[0] == u'?', "%C is an invalid conversion"); + Require(swscanf_s_nid_postfix(u"5 6", u"%hC%d", &first) == 0 && first == 7, "%hC stops before later conversions"); std::int64_t count = -1; Require(swscanf_s_nid_postfix(u" 12 ab", u"%d %ln", &first, &count) == 1 && count == 4, "%ln"); @@ -193,6 +198,11 @@ static void CheckUnsizedScan() { Require(swscanf_nid_postfix(u" q7", u"%c%d", &letter, &first) == 1 && letter == ' ', "swscanf %c does not skip white space"); Require(swscanf_nid_postfix(u"cab12", u"%l[abc]%d", text, &first) == 2 && std::u16string(text) == u"cab" && first == 12, "swscanf %l["); Require(swscanf_nid_postfix(u"été!", u"%l[^!]", text) == 1 && std::u16string(text) == u"été", "swscanf %l[^"); + char16_t untouched[4] = {u'?', u'?', u'?', u'?'}; + Require(swscanf_nid_postfix(u"Āb cd", u"%S", untouched) == 0 && untouched[0] == u'?', "swscanf %S is an invalid conversion"); + Require(swscanf_nid_postfix(u"7 Āb 9", u"%d%3S%d", &first, untouched, &second) == 1 && first == 7 && untouched[0] == u'?', "swscanf stops at %S"); + Require(swscanf_nid_postfix(u"Āyz", u"%lC", untouched) == 0 && untouched[0] == u'?', "swscanf %lC is an invalid conversion"); + Require(swscanf_nid_postfix(u"abc", u"%*S") == 0, "swscanf suppressed %S is an invalid conversion"); Require(swscanf_nid_postfix(u"key=val", u"%[^=]=%s", narrow, narrow + 4) == 2 && std::strcmp(narrow, "key") == 0 && std::strcmp(narrow + 4, "val") == 0, "swscanf %[^"); std::int64_t count = -1; Require(swscanf_nid_postfix(u" 12 ab", u"%d %ln", &first, &count) == 1 && count == 4, "swscanf %ln"); diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index 9f025c142e..cd7a9e8225 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -119,7 +119,7 @@ - [wcsftime](../../../core/libs/prx/libc/src/Time.cpp) (libc) follows FreeBSD 11.4's [wcsftime.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/locale/wcsftime.c) over this library's `wcsrtombs`, `strftime` and `mbsrtowcs` in the single-byte C locale of [none.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/locale/none.c), with the guest's 16-bit `wchar_t`, without console verification. It has the `strftime` gaps above. A format unit above 255 returns 0 with `EILSEQ`; an empty result, a result that does not fit and a null buffer return 0 with `errno` unchanged, discarding the `ERANGE` or `EINVAL` that the Windows CRT's `strftime` sets. A null format or `tm` throws, where FreeBSD dereferences it (a null `tm` is read there only when the format has a conversion that needs it) - [syslog](../../../core/libs/prx/libc/src/Syslog.cpp) (libc) writes each message to `stderr` as `[syslog:] `, with a newline added when missing, instead of sending it to the console's system log. Priority and facility handling follow FreeBSD's `vsyslog`: `%m` expands to the guest errno's message, unknown bits are reported (as priority 0x23, since FreeBSD passes `LOG_ERR|LOG_CONS|LOG_PERROR|LOG_PID` as the priority) and masked, a missing facility becomes `LOG_USER` or the facility set by `openlog`, and errno is preserved. `openlog` applies its identity and `LOG_PID`; a null identity retains the previous one, and a valid nonzero facility replaces the default. `closelog` clears the identity but retains the options and facility, as in FreeBSD 11; when no identity is set, FreeBSD falls back to the program name, which this backend does not emit. `LOG_PERROR` has no extra effect because stderr is the emulated log sink; `LOG_NDELAY`/`LOG_ODELAY`, `LOG_NOWAIT` and `LOG_CONS` have no daemon, child or console backend to control. `setlogmask` follows [FreeBSD 11](https://github.com/freebsd/freebsd-src/blob/8d2708de5d6112a492744d367cfdfb8fd219227a/lib/libc/gen/syslog.c): the process-wide mask defaults to 0xff, zero queries it, and nonzero values replace it; masked messages are skipped before formatting, including the unknown-priority diagnostic. The console's mask behaviour is unverified - [daemon](../../../core/libs/prx/libc/src/Process.cpp) (libc) throws: forking into the background is not supported. PPSA85300 imports it and fails to load without it. VLC 3.0 calls it only when its `daemon` option is set ([libvlc.c](https://github.com/videolan/vlc/blob/6de05adcbaf2e8b85fe86aad4169393098628119/src/libvlc.c#L190-L197)), and the title starts libVLC with `--ignore-config` and without `--daemon` ([player.cc](https://github.com/ZiZc3/VLC/blob/f3253020a64368153233ede29183014c0b6c8979/src/player.cc#L960-L981)) -- [_WStoul](../../../core/libs/prx/libc/src/Strings.cpp), [_Iswctype](../../../core/libs/prx/libc/src/RuneLocale.cpp), [swscanf_s and swscanf](../../../core/libs/prx/libc/src/ScanningWide.cpp) (libc) - `_WStoul` is `wcstoul` and throws for a base other than 0 or 2 to 36. `_Iswctype` takes the class numbers of Dinkumware's [xwcc.h](https://github.com/superna9999/ti-cgt6x/blob/cgt6x_7_3_4/include/xwcc.h) (1 `alnum` to 11 `xdigit`, 12 `blank`) and throws for any other value, including the FreeBSD masks `wctype` returns; the numbering is not confirmed on the console's `libc.prx`. `swscanf_s` follows C11 7.29.2.2 and K.3.9.1.5, but reads the size argument as `unsigned int` like `sscanf_s` where K.3.9.1.5 specifies `rsize_t`; the console's width is unverified. A runtime-constraint violation (null buffer, format or receiving pointer) only returns `EOF`, and a too small array gets a null first element as in `sscanf_s`. A literal mismatch is a matching failure and a field that is only a prefix, such as `0x` or `1e`, does not convert, as C11 requires; FreeBSD's `vfwscanf` reports an input failure for the first and converts the second. Integers out of range are truncated from `strtoll`/`strtoull`. `%p` follows FreeBSD 11's [vfwscanf.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdio/vfwscanf.c#L610-L615): a hexadecimal integer with an optional `0x`, converted as unsigned and stored as a pointer; a length modifier on it throws, where FreeBSD ignores it. It throws for `%S`, `%C`, unknown length modifiers, scanset ranges, `%n` with suppression or width, and narrow `%s`, `%c` or `%[` input that the C-locale `wcrtomb` cannot convert. `swscanf` runs the same scanner without the size arguments of `%s`, `%c` and `%[`, as FreeBSD's [swscanf.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/stdio/swscanf.c) passes its arguments to `vswscanf`, so everything above except the sizes applies to it; it also keeps the null buffer, format and receiving pointer checks returning `EOF`, where C leaves those undefined. Neither variant is confirmed on a PS5 title +- [_WStoul](../../../core/libs/prx/libc/src/Strings.cpp), [_Iswctype](../../../core/libs/prx/libc/src/RuneLocale.cpp), [swscanf_s and swscanf](../../../core/libs/prx/libc/src/ScanningWide.cpp) (libc) - `_WStoul` is `wcstoul` and throws for a base other than 0 or 2 to 36. `_Iswctype` takes the class numbers of Dinkumware's [xwcc.h](https://github.com/superna9999/ti-cgt6x/blob/cgt6x_7_3_4/include/xwcc.h) (1 `alnum` to 11 `xdigit`, 12 `blank`) and throws for any other value, including the FreeBSD masks `wctype` returns; the numbering is not confirmed on the console's `libc.prx`. `swscanf_s` follows C11 7.29.2.2 and K.3.9.1.5, but reads the size argument as `unsigned int` like `sscanf_s` where K.3.9.1.5 specifies `rsize_t`; the console's width is unverified. A runtime-constraint violation (null buffer, format or receiving pointer) only returns `EOF`, and a too small array gets a null first element as in `sscanf_s`. A literal mismatch is a matching failure and a field that is only a prefix, such as `0x` or `1e`, does not convert, as C11 requires; FreeBSD's `vfwscanf` reports an input failure for the first and converts the second. Integers out of range are truncated from `strtoll`/`strtoull`. `%p` follows FreeBSD 11's [vfwscanf.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdio/vfwscanf.c#L610-L615): a hexadecimal integer with an optional `0x`, converted as unsigned and stored as a pointer; a length modifier on it throws, where FreeBSD ignores it. `%S` and `%C`, with any length modifier or `*`, end the scan as a matching failure, as the console's Dinkumware scanner in PPSA21564's `libc.prx` treats them as invalid conversions; this was read from the module, not run on a console, and whether input ending before them is an input failure instead is unverified. It throws for unknown length modifiers, scanset ranges, `%n` with suppression or width, and narrow `%s`, `%c` or `%[` input that the C-locale `wcrtomb` cannot convert. `swscanf` runs the same scanner without the size arguments of `%s`, `%c` and `%[`, as FreeBSD's [swscanf.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/stdio/swscanf.c) passes its arguments to `vswscanf`, so everything above except the sizes applies to it; it also keeps the null buffer, format and receiving pointer checks returning `EOF`, where C leaves those undefined. Neither variant is confirmed on a PS5 title - [flock](../../../core/libs/prx/libc/src/FileLock.cpp) (libkernel) on Windows shares one lock state between duplicated descriptors, following FreeBSD 11.4's [flock(2)](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/sys/flock.2). Independent opens have separate states; closing a descriptor or reopening a stream drops only its reference. Lock transitions on one open file description are serialized. The lock is a host [LockFileEx](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-lockfileex) lock on one byte at offset 2^63 - 2, which no file reaches, so it excludes other `flock` calls and leaves reads, writes and mapped views alone, like FreeBSD's advisory locks. Console behavior, signal interruption and concurrent closure of a descriptor while its lock call is pending are unverified. - [std::_Throw_Cpp_error](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) follows Dinkumware `thread0.cpp` ([VC12](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/thread0.cpp), [STL](https://github.com/microsoft/STL/blob/da52dc0f/stl/src/thread0.cpp)), without console verification. Codes outside 0..6 throw `std::out_of_range`, the deleting destructor throws, and STREAMS errnos absent from FreeBSD 11.4 [`errno.h`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/sys/errno.h) (`ENODATA`, `ENOSR`, `ENOSTR`, `ETIME`) are omitted. Codes 0..6 throw a 32-byte [VC12 `system_error`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/system_error) with FreeBSD errnos (16, 22, 3, 12, 1, 11, 35), a static `generic_category` (not `_Generic_object`), and unverified 40-byte [GuestLocale::String](../../../core/libs/prx/libc/include/GuestLocale.hpp) messages from [`syserror.cpp`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/syserror.cpp) - [Call tracing](../../../core/libs/prx/libc/src/specifics/windows/CallTrace.cpp) (`--trace-imports`, `APS5_TRACE_CALLS`) exists on Windows only and records the entry of a call, not its arguments or its result. One process-wide ring keeps the last 65536 calls, so a thread that calls often pushes the others out. Calls are also counted per traced target since start-up; an import bound to a target already traced under another name is counted under the first name. The thunk saves the integer argument registers and `xmm0` to `xmm7`; arguments in wider vector registers pass only as long as the recording code stays free of AVX instructions, which is not tested From db3c47c87a4d6fae308dd5cdf647dc7e5a053423 Mon Sep 17 00:00:00 2001 From: orezraey Date: Tue, 20 Oct 2026 18:55:11 -0300 Subject: [PATCH 004/113] fix(libc): follow the default heap's alignment, errno and realloc to zero as measured on a PS5 Co-Authored-By: Claude Opus 5.5 --- .../libs/prx/libc/include/ApplicationHeap.hpp | 1 + core/libs/prx/libc/src/ApplicationHeap.cpp | 18 +++- core/libs/prx/libc/src/FileAndHeap.cpp | 71 +++++++++++--- core/libs/prx/libc/src/GuestHeap.cpp | 17 ++-- core/libs/tests/ApplicationHeap.cpp | 6 +- core/libs/tests/GuestAllocatorFailures.cpp | 96 ++++++++++++++----- core/libs/tests/GuestHeapRounding.cpp | 8 +- core/libs/tests/GuestReallocalign.cpp | 47 +++++++-- docs/dev/debt/libc.md | 4 +- 9 files changed, 207 insertions(+), 61 deletions(-) diff --git a/core/libs/prx/libc/include/ApplicationHeap.hpp b/core/libs/prx/libc/include/ApplicationHeap.hpp index 00033a1d59..bd604dd95a 100644 --- a/core/libs/prx/libc/include/ApplicationHeap.hpp +++ b/core/libs/prx/libc/include/ApplicationHeap.hpp @@ -9,6 +9,7 @@ const void* ApplicationProcessParameters_nid_no_patch(); bool ApplicationGuestHeapApi_nid_no_patch(void** api); void ApplicationHeapInitialize_nid_no_patch(const void* processParameters); void ApplicationHeapRegister_nid_no_patch(void* const* api); +bool ApplicationHeapDefault_nid_no_patch(); void* ApplicationHeapAllocate_nid_no_patch(std::size_t bytes); void ApplicationHeapFree_nid_no_patch(void* pointer); void* ApplicationHeapReallocate_nid_no_patch(void* pointer, std::size_t bytes); diff --git a/core/libs/prx/libc/src/ApplicationHeap.cpp b/core/libs/prx/libc/src/ApplicationHeap.cpp index 84a8f46eb7..5fc17a5651 100644 --- a/core/libs/prx/libc/src/ApplicationHeap.cpp +++ b/core/libs/prx/libc/src/ApplicationHeap.cpp @@ -2,6 +2,7 @@ #include "prx/libc/include/GuestHeap.hpp" #include "prx/libc/include/general/VabiMacros.hpp" #include +#include #include #include #include @@ -27,6 +28,7 @@ using UsableSize = std::size_t (APS5_VABI *)(void*); std::mutex heapMutex; std::array heapApi{}; +std::atomic heapKind{0}; std::once_flag heapInitialization; std::exception_ptr heapFailure; Initialize heapFinalize = nullptr; @@ -145,6 +147,18 @@ void ApplicationHeapRegister_nid_no_patch(void* const* api) { if (heapFinalized) throw std::runtime_error("application heap: allocator has been finalized"); if (heapApi[0] != nullptr && heapApi != replacement) throw std::runtime_error("application heap: cannot replace an active allocator"); heapApi = replacement; + heapKind.store(replacement == defaultApi() ? 1 : 2, std::memory_order_release); +} + +bool ApplicationHeapDefault_nid_no_patch() { + int kind = heapKind.load(std::memory_order_acquire); + if (kind == 0) { + std::unique_lock lock(heapMutex); + ensureInitialized(lock); + if (heapFailure) std::rethrow_exception(heapFailure); + kind = heapKind.load(std::memory_order_acquire); + } + return kind == 1; } void ApplicationHeapInitialize_nid_no_patch(const void* processParameters) { @@ -192,7 +206,7 @@ void ApplicationHeapFree_nid_no_patch(void* pointer) { } void* ApplicationHeapReallocate_nid_no_patch(void* pointer, std::size_t bytes) { - if (bytes == 0 && pointer != nullptr) { + if (bytes == 0 && pointer != nullptr && !ApplicationHeapDefault_nid_no_patch()) { ApplicationHeapFree_nid_no_patch(pointer); return nullptr; } @@ -227,7 +241,7 @@ extern "C" void APS5_VABI scriptingFreeMem_nid_postfix(void* pointer) { } void* ApplicationHeapRealign_nid_no_patch(void* pointer, std::size_t bytes, std::size_t alignment) { - if (bytes == 0) { + if (bytes == 0 && !ApplicationHeapDefault_nid_no_patch()) { ApplicationHeapFree_nid_no_patch(pointer); return nullptr; } diff --git a/core/libs/prx/libc/src/FileAndHeap.cpp b/core/libs/prx/libc/src/FileAndHeap.cpp index 4b8f5328ba..d1349613d5 100644 --- a/core/libs/prx/libc/src/FileAndHeap.cpp +++ b/core/libs/prx/libc/src/FileAndHeap.cpp @@ -1,4 +1,5 @@ #include +#include #include #include #include @@ -252,13 +253,13 @@ static void SortElements(unsigned char* base, size_t count, size_t size, Compare namespace { template -void* allocationOrNull(TAllocate allocate) { +void* allocationOrNull(TAllocate allocate, int error = 12) { try { return allocate(); } catch (const std::bad_alloc&) { } catch (const std::length_error&) { } - errno = 12; + errno = error; return nullptr; } @@ -266,6 +267,32 @@ bool validAlignment(std::size_t alignment) { return alignment != 0 && (alignment & (alignment - 1)) == 0; } +constexpr std::size_t DefaultHeapAlignment = 32; +constexpr std::size_t DefaultHeapAlignmentLimit = std::size_t{1} << 63; +constexpr std::size_t DefaultHeapOverhead = 0x1008f; +constexpr std::size_t DefaultHeapAlignedOverhead = 0x100af; + +std::size_t defaultHeapAlignment(std::size_t alignment) { + return std::bit_ceil(std::max(alignment, DefaultHeapAlignment)); +} + +bool defaultHeapRequestOverflows(std::size_t bytes, std::size_t alignment) { + const std::size_t overhead = alignment <= DefaultHeapAlignment ? DefaultHeapOverhead : defaultHeapAlignment(alignment) + DefaultHeapAlignedOverhead; + return bytes > std::numeric_limits::max() - overhead; +} + +template +void* defaultHeapAllocation(std::size_t bytes, std::size_t alignment, TAllocate allocate) { + if (defaultHeapRequestOverflows(bytes, alignment)) return nullptr; + return allocationOrNull(allocate, 22); +} + +template +void* heapAllocation(std::size_t bytes, TAllocate allocate) { + if (!ApplicationHeapDefault_nid_no_patch()) return allocationOrNull(allocate); + return defaultHeapAllocation(bytes, 0, allocate); +} + } extern "C" { @@ -546,7 +573,7 @@ size_t APS5_VABI malloc_usable_size_nid_postfix(void* pointer) { } void* APS5_VABI malloc_nid_postfix(size_t size) { - return allocationOrNull([size] { return ApplicationHeapAllocate_nid_no_patch(size); }); + return heapAllocation(size, [size] { return ApplicationHeapAllocate_nid_no_patch(size); }); } void APS5_VABI free_nid_postfix(void* ptr) { @@ -554,7 +581,7 @@ void APS5_VABI free_nid_postfix(void* ptr) { } void* APS5_VABI realloc_nid_postfix(void* ptr, size_t newSize) { - return allocationOrNull([ptr, newSize] { return ApplicationHeapReallocate_nid_no_patch(ptr, newSize); }); + return heapAllocation(newSize, [ptr, newSize] { return ApplicationHeapReallocate_nid_no_patch(ptr, newSize); }); } void* APS5_VABI reallocf_nid_postfix(void* ptr, size_t newSize) { @@ -569,34 +596,50 @@ void* APS5_VABI reallocf_nid_postfix(void* ptr, size_t newSize) { } void* APS5_VABI memalign_nid_postfix(size_t alignment, size_t size) { - if (!validAlignment(alignment)) { - errno = 22; - return nullptr; + if (!ApplicationHeapDefault_nid_no_patch()) { + if (!validAlignment(alignment)) { + errno = 22; + return nullptr; + } + return allocationOrNull([alignment, size] { return ApplicationHeapAlign_nid_no_patch(alignment, size); }); } - return allocationOrNull([alignment, size] { return ApplicationHeapAlign_nid_no_patch(alignment, size); }); + if (alignment >= DefaultHeapAlignmentLimit) return nullptr; + const std::size_t rounded = defaultHeapAlignment(alignment); + return defaultHeapAllocation(size, alignment, [rounded, size] { return ApplicationHeapAlign_nid_no_patch(rounded, size); }); } void* APS5_VABI aligned_alloc_nid_postfix(size_t alignment, size_t size) { + if (ApplicationHeapDefault_nid_no_patch() && !validAlignment(alignment)) return nullptr; return memalign_nid_postfix(alignment, size); } void* APS5_VABI reallocalign_nid_postfix(void* ptr, size_t size, size_t alignment) { - if (size != 0 && !validAlignment(alignment)) { - errno = 22; - return nullptr; + if (!ApplicationHeapDefault_nid_no_patch()) { + if (size != 0 && !validAlignment(alignment)) { + errno = 22; + return nullptr; + } + return allocationOrNull([ptr, size, alignment] { return ApplicationHeapRealign_nid_no_patch(ptr, size, alignment); }); } - return allocationOrNull([ptr, size, alignment] { return ApplicationHeapRealign_nid_no_patch(ptr, size, alignment); }); + if (alignment >= DefaultHeapAlignmentLimit) return nullptr; + const std::size_t rounded = defaultHeapAlignment(alignment); + return defaultHeapAllocation(size, alignment, [ptr, size, rounded] { return ApplicationHeapRealign_nid_no_patch(ptr, size, rounded); }); } void* APS5_VABI calloc_nid_postfix(size_t count, size_t size) { - return allocationOrNull([count, size] { return ApplicationHeapCalloc_nid_no_patch(count, size); }); + const auto allocate = [count, size] { return ApplicationHeapCalloc_nid_no_patch(count, size); }; + if (!ApplicationHeapDefault_nid_no_patch()) return allocationOrNull(allocate); + if (size != 0 && count > std::numeric_limits::max() / size) return nullptr; + return defaultHeapAllocation(count * size, 0, allocate); } int APS5_VABI posix_memalign_nid_postfix(void** pointer, size_t alignment, size_t size) { if (!pointer || alignment < sizeof(void*) || (alignment & (alignment - 1)) != 0) return 22; const int savedError = errno; const int result = ApplicationHeapPosixAlign_nid_no_patch(pointer, alignment, size); - errno = savedError; + const bool failureSetsError = result != 0 && ApplicationHeapDefault_nid_no_patch() && alignment < DefaultHeapAlignmentLimit && + !defaultHeapRequestOverflows(size, alignment); + errno = failureSetsError ? 22 : savedError; return result; } diff --git a/core/libs/prx/libc/src/GuestHeap.cpp b/core/libs/prx/libc/src/GuestHeap.cpp index 96c95d1063..6277174a21 100644 --- a/core/libs/prx/libc/src/GuestHeap.cpp +++ b/core/libs/prx/libc/src/GuestHeap.cpp @@ -280,6 +280,12 @@ void* allocate(GuestAllocations::Mutation& mutation, std::size_t alignment, std: return pointer; } +void* emptyInPlace(GuestAllocations::Mutation& mutation, void* pointer, bool gpu) { + mutation.Remove(pointer); + mutation.Add(pointer, 0, true, true, gpu); + return pointer; +} + void free(GuestAllocations::Mutation& mutation, void* pointer) { mutation.Remove(pointer); const auto blockBytes = reinterpret_cast(pointer)[-1]; @@ -307,10 +313,7 @@ void* GuestHeapReallocate_nid_postfix(void* pointer, std::size_t bytes) { GuestAllocations::Mutation mutation; const auto range = mutation.Find(pointer); mutation.RequireUnpinned(pointer, range.bytes); - if (bytes == 0) { - free(mutation, pointer); - return nullptr; - } + if (bytes == 0) return emptyInPlace(mutation, pointer, range.gpu); void* result = allocate(mutation, MinimumAlignment, bytes, range.gpu); std::memcpy(result, pointer, std::min(bytes, range.bytes)); free(mutation, pointer); @@ -323,8 +326,10 @@ void* GuestHeapRealign_nid_postfix(void* pointer, std::size_t bytes, std::size_t const auto range = mutation.Find(pointer); mutation.RequireUnpinned(pointer, range.bytes); if (bytes == 0) { - free(mutation, pointer); - return nullptr; + if (alignment == 0 || (alignment & (alignment - 1)) != 0) throw std::invalid_argument("invalid guest heap alignment"); + if (reinterpret_cast(pointer) % alignment != 0) + throw std::invalid_argument("reallocalign to 0 bytes with an alignment the block does not have is not measured on the console"); + return emptyInPlace(mutation, pointer, range.gpu); } void* result = allocate(mutation, alignment, bytes, range.gpu); std::memcpy(result, pointer, std::min(bytes, range.bytes)); diff --git a/core/libs/tests/ApplicationHeap.cpp b/core/libs/tests/ApplicationHeap.cpp index be99345d50..3f36d640ef 100644 --- a/core/libs/tests/ApplicationHeap.cpp +++ b/core/libs/tests/ApplicationHeap.cpp @@ -303,7 +303,8 @@ int main(int argc, char** argv) { for (unsigned i = 0; i < 63; ++i) require(pointer[i] == 0x5a); pointer = static_cast(ApplicationHeapReallocate_nid_no_patch(pointer, 11)); for (unsigned i = 0; i < 11; ++i) require(pointer[i] == 0x5a); - require(ApplicationHeapReallocate_nid_no_patch(pointer, 0) == nullptr); + require(ApplicationHeapReallocate_nid_no_patch(pointer, 0) == pointer && ApplicationHeapUsableSize_nid_no_patch(pointer) == 0); + ApplicationHeapFree_nid_no_patch(pointer); pointer = static_cast(ApplicationHeapReallocate_nid_no_patch(nullptr, 32)); require(pointer != nullptr); ApplicationHeapFree_nid_no_patch(pointer); @@ -317,7 +318,8 @@ int main(int argc, char** argv) { require(pointer != nullptr && ApplicationHeapUsableSize_nid_no_patch(pointer) == 9); for (unsigned i = 0; i < 9; ++i) require(pointer[i] == 0x3c); *__error_nid_postfix() = 0; - require(reallocf_nid_postfix(pointer, 0) == nullptr && *__error_nid_postfix() == 0); + require(reallocf_nid_postfix(pointer, 0) == pointer && *__error_nid_postfix() == 0 && ApplicationHeapUsableSize_nid_no_patch(pointer) == 0); + ApplicationHeapFree_nid_no_patch(pointer); reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); }); pointer = static_cast(reallocf_nid_postfix(nullptr, 40)); require(pointer != nullptr); diff --git a/core/libs/tests/GuestAllocatorFailures.cpp b/core/libs/tests/GuestAllocatorFailures.cpp index 5312249a50..ef2ae3d380 100644 --- a/core/libs/tests/GuestAllocatorFailures.cpp +++ b/core/libs/tests/GuestAllocatorFailures.cpp @@ -19,6 +19,7 @@ void* APS5_VABI realloc_nid_postfix(void*, std::size_t); void* APS5_VABI memalign_nid_postfix(std::size_t, std::size_t); void* APS5_VABI aligned_alloc_nid_postfix(std::size_t, std::size_t); int APS5_VABI posix_memalign_nid_postfix(void**, std::size_t, std::size_t); +std::size_t APS5_VABI malloc_usable_size_nid_postfix(void*); void APS5_VABI free_nid_postfix(void*); int* APS5_VABI __error_nid_postfix(); } @@ -27,8 +28,10 @@ namespace { constexpr int NoMemory = 12; constexpr int InvalidArgument = 22; +constexpr int Untouched = 77; constexpr std::size_t Max = std::numeric_limits::max(); constexpr std::size_t HalfPlusOne = static_cast(std::numeric_limits::max()) + 1; +constexpr std::size_t LastPlainFailure = Max - 0x1008f; int failures = 0; @@ -50,7 +53,7 @@ void report(const char* what, const char* detail) { template void expectNull(const char* what, int expectedError, TCall call) { - *__error_nid_postfix() = 0; + *__error_nid_postfix() = Untouched; void* result = nullptr; try { result = call(); @@ -95,27 +98,57 @@ int main() { void* api[10]{}; ApplicationHeapRegister_nid_no_patch(api); - expectNull("malloc(SIZE_MAX)", NoMemory, [] { return malloc_nid_postfix(Max); }); - expectNull("malloc(PTRDIFF_MAX + 1)", NoMemory, [] { return malloc_nid_postfix(HalfPlusOne); }); - expectNull("calloc(SIZE_MAX, 2)", NoMemory, [] { return calloc_nid_postfix(Max, 2); }); - expectNull("calloc(2^33, 2^33)", NoMemory, [] { return calloc_nid_postfix(std::size_t{1} << 33, std::size_t{1} << 33); }); - expectNull("calloc(PTRDIFF_MAX + 1, 1)", NoMemory, [] { return calloc_nid_postfix(HalfPlusOne, 1); }); - expectNull("realloc(NULL, SIZE_MAX)", NoMemory, [] { return realloc_nid_postfix(nullptr, Max); }); - expectNull("aligned_alloc(64, SIZE_MAX)", NoMemory, [] { return aligned_alloc_nid_postfix(64, Max); }); - expectNull("memalign(64, PTRDIFF_MAX + 1)", NoMemory, [] { return memalign_nid_postfix(64, HalfPlusOne); }); - expectNull("aligned_alloc(24, 64)", InvalidArgument, [] { return aligned_alloc_nid_postfix(24, 64); }); - expectNull("aligned_alloc(0, 64)", InvalidArgument, [] { return aligned_alloc_nid_postfix(0, 64); }); - expectNull("memalign(24, 64)", InvalidArgument, [] { return memalign_nid_postfix(24, 64); }); + expectNull("malloc(SIZE_MAX)", Untouched, [] { return malloc_nid_postfix(Max); }); + expectNull("malloc(SIZE_MAX - 0x1008e)", Untouched, [] { return malloc_nid_postfix(LastPlainFailure + 1); }); + expectNull("malloc(SIZE_MAX - 0x1008f)", InvalidArgument, [] { return malloc_nid_postfix(LastPlainFailure); }); + expectNull("malloc(PTRDIFF_MAX + 1)", InvalidArgument, [] { return malloc_nid_postfix(HalfPlusOne); }); + expectNull("calloc(SIZE_MAX, 2)", Untouched, [] { return calloc_nid_postfix(Max, 2); }); + expectNull("calloc(2^33, 2^33)", Untouched, [] { return calloc_nid_postfix(std::size_t{1} << 33, std::size_t{1} << 33); }); + expectNull("calloc(1, SIZE_MAX - 0x1008e)", Untouched, [] { return calloc_nid_postfix(1, LastPlainFailure + 1); }); + expectNull("calloc(PTRDIFF_MAX + 1, 1)", InvalidArgument, [] { return calloc_nid_postfix(HalfPlusOne, 1); }); + expectNull("realloc(NULL, SIZE_MAX)", Untouched, [] { return realloc_nid_postfix(nullptr, Max); }); + expectNull("realloc(NULL, PTRDIFF_MAX + 1)", InvalidArgument, [] { return realloc_nid_postfix(nullptr, HalfPlusOne); }); + expectNull("aligned_alloc(64, SIZE_MAX)", Untouched, [] { return aligned_alloc_nid_postfix(64, Max); }); + expectNull("aligned_alloc(16, PTRDIFF_MAX + 1)", InvalidArgument, [] { return aligned_alloc_nid_postfix(16, HalfPlusOne); }); + expectNull("memalign(64, PTRDIFF_MAX + 1)", InvalidArgument, [] { return memalign_nid_postfix(64, HalfPlusOne); }); + expectNull("memalign(4096, SIZE_MAX - 0x110af)", InvalidArgument, [] { return memalign_nid_postfix(4096, Max - 0x110af); }); + expectNull("memalign(4096, SIZE_MAX - 0x110ae)", Untouched, [] { return memalign_nid_postfix(4096, Max - 0x110ae); }); + expectNull("memalign(100, SIZE_MAX - 0x1012f)", InvalidArgument, [] { return memalign_nid_postfix(100, Max - 0x1012f); }); + expectNull("memalign(100, SIZE_MAX - 0x1012e)", Untouched, [] { return memalign_nid_postfix(100, Max - 0x1012e); }); + expectNull("memalign(3, SIZE_MAX - 0x1008f)", InvalidArgument, [] { return memalign_nid_postfix(3, LastPlainFailure); }); + expectNull("memalign(3, SIZE_MAX - 0x1008e)", Untouched, [] { return memalign_nid_postfix(3, LastPlainFailure + 1); }); + expectNull("memalign(2^63, 16)", Untouched, [] { return memalign_nid_postfix(HalfPlusOne, 16); }); + expectNull("memalign(SIZE_MAX, 16)", Untouched, [] { return memalign_nid_postfix(Max, 16); }); + expectNull("memalign(2^62 + 1, 16)", InvalidArgument, [] { return memalign_nid_postfix((std::size_t{1} << 62) + 1, 16); }); + expectNull("aligned_alloc(24, 64)", Untouched, [] { return aligned_alloc_nid_postfix(24, 64); }); + expectNull("aligned_alloc(0, 64)", Untouched, [] { return aligned_alloc_nid_postfix(0, 64); }); + expectNull("aligned_alloc(2^63, 16)", Untouched, [] { return aligned_alloc_nid_postfix(HalfPlusOne, 16); }); + + struct RoundedAlignment { + std::size_t requested; + std::size_t guaranteed; + }; + for (const RoundedAlignment& alignment : {RoundedAlignment{0, 32}, RoundedAlignment{3, 32}, RoundedAlignment{24, 32}, RoundedAlignment{48, 64}, + RoundedAlignment{100, 128}, RoundedAlignment{3000, 4096}}) { + void* aligned = expectBlock("memalign with an alignment that is not a power of two", [&alignment] { return memalign_nid_postfix(alignment.requested, 40); }); + if (aligned != nullptr && reinterpret_cast(aligned) % alignment.guaranteed != 0) report("memalign", "did not round the alignment up to a power of two"); + free_nid_postfix(aligned); + } auto* block = static_cast(expectBlock("malloc(40)", [] { return malloc_nid_postfix(40); })); if (block != nullptr) { std::memset(block, 0x6b, 40); - expectNull("realloc(block, SIZE_MAX)", NoMemory, [block] { return realloc_nid_postfix(block, Max); }); - expectNull("realloc(block, PTRDIFF_MAX + 1)", NoMemory, [block] { return realloc_nid_postfix(block, HalfPlusOne); }); + expectNull("realloc(block, SIZE_MAX)", Untouched, [block] { return realloc_nid_postfix(block, Max); }); + expectNull("realloc(block, PTRDIFF_MAX + 1)", InvalidArgument, [block] { return realloc_nid_postfix(block, HalfPlusOne); }); for (unsigned index = 0; index < 40; ++index) { if (block[index] != 0x6b) report("realloc failure", "damaged the original block"); } - free_nid_postfix(block); + void* emptied = expectBlock("realloc(block, 0)", [block] { return realloc_nid_postfix(block, 0); }); + if (emptied != block) report("realloc(block, 0)", "did not return the same block"); + if (emptied != nullptr && malloc_usable_size_nid_postfix(emptied) != 0) report("realloc(block, 0)", "left usable bytes in the block"); + void* regrown = expectBlock("realloc(emptied, 64)", [emptied] { return realloc_nid_postfix(emptied, 64); }); + if (regrown != nullptr && malloc_usable_size_nid_postfix(regrown) != 64) report("realloc(emptied, 64)", "did not hold 64 bytes"); + free_nid_postfix(regrown); } #ifdef ANYPS5_ENABLE_ASAN @@ -154,8 +187,8 @@ int main() { if (huge != nullptr) { free_nid_postfix(huge); committed = true; - } else if (*__error_nid_postfix() != NoMemory) { - report("malloc(300 GiB)", "returned NULL without ENOMEM"); + } else if (*__error_nid_postfix() != InvalidArgument) { + report("malloc(300 GiB)", "returned NULL without EINVAL"); } else { ++failedCommits; } @@ -177,7 +210,7 @@ int main() { std::fputs("skipped: the host can commit 300 GiB, so the failed commit and arena release checks did not run\n", stderr); #endif } else { - if (failedCommits != 10) report("failed heap commits", "did not return ENOMEM for all ten attempts"); + if (failedCommits != 10) report("failed heap commits", "did not return EINVAL for all ten attempts"); void* after = nullptr; try { after = GuestArena::GuestArenaAllocate_nid_postfix(probeBytes, 0x4000); @@ -198,12 +231,27 @@ int main() { } #endif - void* untouched = &failures; - *__error_nid_postfix() = 77; - if (posix_memalign_nid_postfix(&untouched, HalfPlusOne, 8) != NoMemory) report("posix_memalign(PTRDIFF_MAX + 1)", "did not return ENOMEM"); - if (posix_memalign_nid_postfix(&untouched, 64, HalfPlusOne) != NoMemory) report("posix_memalign(64, PTRDIFF_MAX + 1)", "did not return ENOMEM"); - if (posix_memalign_nid_postfix(&untouched, 64, Max) != NoMemory) report("posix_memalign(64, SIZE_MAX)", "did not return ENOMEM"); - if (untouched != &failures || *__error_nid_postfix() != 77) report("posix_memalign failure", "touched the output or errno"); + struct PosixCase { + const char* what; + std::size_t alignment; + std::size_t size; + int result; + int error; + }; + for (const PosixCase& check : {PosixCase{"posix_memalign(PTRDIFF_MAX + 1, 8)", HalfPlusOne, 8, NoMemory, Untouched}, + PosixCase{"posix_memalign(64, PTRDIFF_MAX + 1)", 64, HalfPlusOne, NoMemory, InvalidArgument}, + PosixCase{"posix_memalign(64, SIZE_MAX)", 64, Max, NoMemory, Untouched}, + PosixCase{"posix_memalign(64, SIZE_MAX - 0x100ef)", 64, Max - 0x100ef, NoMemory, InvalidArgument}, + PosixCase{"posix_memalign(64, SIZE_MAX - 0x100ee)", 64, Max - 0x100ee, NoMemory, Untouched}, + PosixCase{"posix_memalign(4, 8)", 4, 8, InvalidArgument, Untouched}, PosixCase{"posix_memalign(24, 8)", 24, 8, InvalidArgument, Untouched}, + PosixCase{"posix_memalign(PTRDIFF_MAX + 2, 8)", HalfPlusOne + 1, 8, InvalidArgument, Untouched}}) { + void* untouched = &failures; + *__error_nid_postfix() = Untouched; + const int result = posix_memalign_nid_postfix(&untouched, check.alignment, check.size); + if (result != check.result) report(check.what, "returned the wrong error number"); + if (*__error_nid_postfix() != check.error) report(check.what, "left the wrong errno"); + if (untouched != &failures) report(check.what, "touched the output"); + } free_nid_postfix(expectBlock("calloc(3, 5)", [] { return calloc_nid_postfix(3, 5); })); free_nid_postfix(expectBlock("calloc(0, 5)", [] { return calloc_nid_postfix(0, 5); })); diff --git a/core/libs/tests/GuestHeapRounding.cpp b/core/libs/tests/GuestHeapRounding.cpp index d888f7311f..f27c870d0d 100644 --- a/core/libs/tests/GuestHeapRounding.cpp +++ b/core/libs/tests/GuestHeapRounding.cpp @@ -77,14 +77,14 @@ DWORD runChild(const wchar_t* mode) { int runMallocOverflow() { registerDefaultHeap(); - *__error_nid_postfix() = 0; + *__error_nid_postfix() = 77; try { auto* pointer = malloc_nid_postfix(std::numeric_limits::max() - HeaderBytes); if (pointer != nullptr) { free_nid_postfix(pointer); return 1; } - return *__error_nid_postfix() == 12 ? 0 : 4; + return *__error_nid_postfix() == 77 ? 0 : 4; } catch (const std::exception& error) { std::fprintf(stderr, "malloc failed with an unexpected exception: %s\n", error.what()); return 2; @@ -100,14 +100,14 @@ int runReallocOverflow() { auto* original = static_cast(malloc_nid_postfix(bytes)); std::memset(original, 0x5a, bytes); bool rejectedWithExpectedError = false; - *__error_nid_postfix() = 0; + *__error_nid_postfix() = 77; try { auto* result = realloc_nid_postfix(original, std::numeric_limits::max() - HeaderBytes); if (result != nullptr) { free_nid_postfix(result); return 4; } - rejectedWithExpectedError = *__error_nid_postfix() == 12; + rejectedWithExpectedError = *__error_nid_postfix() == 77; } catch (const std::exception& error) { std::fprintf(stderr, "realloc failed with an unexpected exception: %s\n", error.what()); } catch (...) { diff --git a/core/libs/tests/GuestReallocalign.cpp b/core/libs/tests/GuestReallocalign.cpp index fded34f311..cd36081ec0 100644 --- a/core/libs/tests/GuestReallocalign.cpp +++ b/core/libs/tests/GuestReallocalign.cpp @@ -7,6 +7,8 @@ extern "C" { void* APS5_VABI reallocalign_nid_postfix(void*, std::size_t, std::size_t); +std::size_t APS5_VABI malloc_usable_size_nid_postfix(void*); +void APS5_VABI free_nid_postfix(void*); int* APS5_VABI __error_nid_postfix(); } @@ -30,12 +32,43 @@ int main() { auto* shrunk = static_cast(reallocalign_nid_postfix(grown, 16, 16)); Require(shrunk != nullptr && (reinterpret_cast(shrunk) % 16) == 0); for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a); - *__error_nid_postfix() = 0; - Require(reallocalign_nid_postfix(shrunk, 16, 0) == nullptr && *__error_nid_postfix() == 22); - *__error_nid_postfix() = 0; - Require(reallocalign_nid_postfix(shrunk, 16, 3) == nullptr && *__error_nid_postfix() == 22); - *__error_nid_postfix() = 0; - Require(reallocalign_nid_postfix(shrunk, std::numeric_limits::max(), 16) == nullptr && *__error_nid_postfix() == 12); + shrunk = static_cast(reallocalign_nid_postfix(shrunk, 16, 0)); + Require(shrunk != nullptr && (reinterpret_cast(shrunk) % 32) == 0); for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a); - Require(reallocalign_nid_postfix(shrunk, 0, 16) == nullptr); + shrunk = static_cast(reallocalign_nid_postfix(shrunk, 40, 100)); + Require(shrunk != nullptr && (reinterpret_cast(shrunk) % 128) == 0); + for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a); + constexpr std::size_t max = std::numeric_limits::max(); + *__error_nid_postfix() = 77; + Require(reallocalign_nid_postfix(shrunk, max, 16) == nullptr && *__error_nid_postfix() == 77); + Require(reallocalign_nid_postfix(shrunk, max - 0x1008f, 16) == nullptr && *__error_nid_postfix() == 22); + *__error_nid_postfix() = 77; + Require(reallocalign_nid_postfix(shrunk, max - 0x110ae, 4096) == nullptr && *__error_nid_postfix() == 77); + Require(reallocalign_nid_postfix(shrunk, max - 0x110af, 4096) == nullptr && *__error_nid_postfix() == 22); + *__error_nid_postfix() = 77; + Require(reallocalign_nid_postfix(shrunk, 16, std::size_t{1} << 63) == nullptr && *__error_nid_postfix() == 77); + for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a); + Require(reallocalign_nid_postfix(shrunk, 0, 16) == shrunk && malloc_usable_size_nid_postfix(shrunk) == 0); + free_nid_postfix(shrunk); + void* empty = reallocalign_nid_postfix(nullptr, 0, 0); + Require(empty != nullptr); + free_nid_postfix(empty); + for (std::size_t attempt = 0; attempt < 64; ++attempt) { + void* loose = reallocalign_nid_postfix(nullptr, 40, 32); + Require(loose != nullptr); + if (reinterpret_cast(loose) % 4096 == 0) { + free_nid_postfix(loose); + continue; + } + bool threw = false; + try { + reallocalign_nid_postfix(loose, 0, 4096); + } catch (const std::invalid_argument&) { + threw = true; + } + Require(threw); + free_nid_postfix(loose); + return 0; + } + throw std::runtime_error("reallocalign check could not get a block without 4096-byte alignment"); } diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index 9179b06e02..d9da36364f 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -23,8 +23,8 @@ - [sceLibcPafMspaceCreate, Destroy, Malloc, Memalign, Free, Calloc, Realloc, Reallocalign, MallocStats and MallocStatsFast](../../../core/libs/prx/libc/src/Mspace.cpp) - PAF exports delegate to `sceLibcMspace` without malloc hooks. `Memalign` is inferred as `(handle, alignment, size, owner)`, delegates to `sceLibcMspaceMemalign`, and is unverified on console. `Create` has an extra options pointer with a partly observed layout (version, type 1 or 2 at +2, field at +0x10); non-null options throw because the field's meaning is unknown. Allocation owners are ignored because block footers are not modelled. On PS5 firmware 13.60, heap-owner calls worked; wrong owners in `Reallocalign` or in-place `Realloc` terminate the process, and `MallocStats` returns 1 if non-heap-owned blocks exist. These owner results are not reproduced. `PosixMemalign`, `MallocUsableSize`, `Trim`, `IsHeapEmpty`, `CheckMemoryBounds`, `ReportMemoryBlocks` and `GetFooterValue` remain unimplemented. - [malloc_usable_size](../../../core/libs/prx/libc/src/ApplicationHeap.cpp) (libc) - with the default allocator it returns the size the block was requested with (the range registered for it), not the rounded-up chunk size Sony's allocator reports; both satisfy "at least the requested size", and bytes past the request would not be write-watched. With an application allocator it calls entry 9 of the replacement table (`malloc_usable_size` in KytyPS5's `MallocReplace` order) and throws when the table leaves it null, like `malloc_stats_fast` - [malloc_stats_fast](../../../core/libs/prx/libc/src/GuestHeap.cpp) (libc) - with the default allocator it fills the 0x28-byte managed-size block as `sceLibcMspaceMallocStatsFast` does, from the default heap's own accounting, not Sony's allocator: the system sizes count the 1 MiB spans of its small-block classes and its committed large blocks, cached free ones included, and the in-use sizes count each handed-out block at its size-class or 64 KiB-granule size, header included. A block size below 0x28 or a null pointer returns 22, as in the mspace version; the version field is not checked. Ship of Harkinian (PPSA99320) calls it about 10 s after start-up. -- [malloc, calloc, realloc, memalign, aligned_alloc and reallocalign](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - follow FreeBSD 11.4 `contrib/jemalloc/src/jemalloc.c` for failures, not measured on the console: a size the default heap rejects or the guest arena cannot place (including a `calloc` product that overflows) returns null with `errno` `ENOMEM`, and `memalign` and `aligned_alloc` return null with `EINVAL` for an alignment that is zero or not a power of two. FreeBSD's libc has no `memalign`, so setting `errno` there is assumed. A host commit failure for a block that fits in the arena (Windows `ERROR_NOT_ENOUGH_MEMORY`, `ERROR_OUTOFMEMORY` or `ERROR_COMMITMENT_LIMIT`, Linux `ENOMEM`) resets and releases the reserved range and returns null with `ENOMEM`; any other commit failure releases the range and throws. `reallocalign` returns null with `EINVAL` for an invalid alignment and `ENOMEM` like the others, which is an assumption as it is not in FreeBSD. `realloc(ptr, 0)` frees the block and returns null, where FreeBSD 11.4's jemalloc 4.5 resizes it to one byte and returns a block -- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, not measured on the console: size 0 frees the block and returns null as `realloc` does here, so the block is not freed twice; when `realloc` fails because the application allocator returns null or the default heap rejects the size, the block is freed through the same allocator, `errno` is `ENOMEM` and null is returned. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc` +- [malloc, calloc, realloc, memalign, aligned_alloc, reallocalign and posix_memalign](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - the console's own heap was measured in a payload process on firmware 13.60, not in a title. A heap a title replaces was not measured and keeps the FreeBSD jemalloc behaviour: `ENOMEM` on failure, `EINVAL` for an alignment that is zero or not a power of two, and `realloc(ptr, 0)` frees the block. With the console's heap, failures set `EINVAL`, and `errno` is left alone for a size above `SIZE_MAX - 0x1008f` (`SIZE_MAX - (A + 0x100af)` for an alignment over 32 rounded up to A), a `calloc` overflow or an alignment of 2^63 or more. Alignments round up to a power of two, and `realloc(ptr, 0)` keeps the block with 0 usable bytes. `reallocalign(ptr, 0, alignment)` for a block without that alignment was not measured and throws +- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, not measured on the console: size 0 does what `realloc` does here, keeping the block with 0 usable bytes with the default heap and freeing it and returning null with an application allocator, so the block is not freed twice; when `realloc` fails because the application allocator returns null or the default heap rejects the size, the block is freed through the same allocator, `errno` is `ENOMEM` and null is returned. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc` - [sceLibcMspaceReallocalign](../../../core/libs/prx/libc/src/Mspace.cpp) (libSceLibcInternal, implemented in libc) takes `(void* heap, void* block, size_t alignment, size_t size)`, the order of the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x13880, whose internal routine at 0x12390 treats the third argument as the alignment and, for a null block, passes it to the routine `sceLibcMspaceMemalign` uses). Measured on a PS5 (firmware 13.60) from a homebrew payload: a null block with alignment 4096 and size 100 returns a 4096-aligned block; an alignment of 0 or 3 succeeds and 100 gives a 128-aligned block, as the routine raises it to at least 32 and to the next power of two; an alignment of 2^63 or more returns null, keeps the block and leaves `errno` alone; and a size of 0 returns a block (the same one when it is already suitable) instead of freeing it. A block that is aligned and large enough is kept where it is, without giving back the bytes past the new size as the console's in-place resize does - [acosl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, like the other libc math functions here, not by the console's (FreeBSD msun ld80 code in Sony's `libc.prx`): results can differ from the console's in the last bit, and on Linux glibc sets `errno` to `EDOM` for `acosl` outside [-1, 1] where msun only raises the floating-point exception. `long double` is the x87 80-bit format, as Sony's `frexpl` uses it (`fldt 0x8(%rsp)`, result in `st(0)`) - [atanl, sinl, cosl, tanl, sinhl, coshl, tanhl, expl, exp2l, logl, log10l and powl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, as `acosl` is, not by the console's FreeBSD msun ld80 code: results can differ from the console's in the last bit (glibc's `log10l(1000)` is not exactly 3), and on Linux glibc sets `errno` to `EDOM` or `ERANGE` where msun only raises the floating-point exception. `ldexpl` and `truncl` are exact operations and give the console's result; `logb` and `remainder` give the console's value too, but on Linux glibc sets `errno` (`ERANGE` for `logb(0)`, `EDOM` for `remainder` by zero or of an infinity) where msun only raises the floating-point exception From 55e4819728bedb167bf652defd20a6f418f77027 Mon Sep 17 00:00:00 2001 From: orezraey Date: Tue, 20 Oct 2026 19:27:16 -0300 Subject: [PATCH 005/113] fix(libc): build reallocf on realloc as FreeBSD's reallocf.c does Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libc/src/FileAndHeap.cpp | 11 +++-------- core/libs/tests/ApplicationHeap.cpp | 11 ++++++++--- docs/dev/debt/libc.md | 2 +- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/core/libs/prx/libc/src/FileAndHeap.cpp b/core/libs/prx/libc/src/FileAndHeap.cpp index d1349613d5..2a2d72e0bd 100644 --- a/core/libs/prx/libc/src/FileAndHeap.cpp +++ b/core/libs/prx/libc/src/FileAndHeap.cpp @@ -585,14 +585,9 @@ void* APS5_VABI realloc_nid_postfix(void* ptr, size_t newSize) { } void* APS5_VABI reallocf_nid_postfix(void* ptr, size_t newSize) { - try { - return ApplicationHeapReallocate_nid_no_patch(ptr, newSize); - } catch (const std::bad_alloc&) { - } catch (const std::length_error&) { - } - ApplicationHeapFree_nid_no_patch(ptr); - errno = 12; - return nullptr; + void* result = realloc_nid_postfix(ptr, newSize); + if (result == nullptr && ptr != nullptr && newSize != 0) ApplicationHeapFree_nid_no_patch(ptr); + return result; } void* APS5_VABI memalign_nid_postfix(size_t alignment, size_t size) { diff --git a/core/libs/tests/ApplicationHeap.cpp b/core/libs/tests/ApplicationHeap.cpp index 3f36d640ef..a563e69556 100644 --- a/core/libs/tests/ApplicationHeap.cpp +++ b/core/libs/tests/ApplicationHeap.cpp @@ -323,10 +323,15 @@ int main(int argc, char** argv) { reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); }); pointer = static_cast(reallocf_nid_postfix(nullptr, 40)); require(pointer != nullptr); - require(reallocf_nid_postfix(pointer, SIZE_MAX - 4096) == nullptr && *__error_nid_postfix() == 12); + *__error_nid_postfix() = 77; + require(reallocf_nid_postfix(pointer, SIZE_MAX - 4096) == nullptr && *__error_nid_postfix() == 77); reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); }); - *__error_nid_postfix() = 0; - require(reallocf_nid_postfix(nullptr, SIZE_MAX) == nullptr && *__error_nid_postfix() == 12); + pointer = static_cast(reallocf_nid_postfix(nullptr, 40)); + require(pointer != nullptr); + require(reallocf_nid_postfix(pointer, SIZE_MAX - 0x1008f) == nullptr && *__error_nid_postfix() == 22); + reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); }); + *__error_nid_postfix() = 77; + require(reallocf_nid_postfix(nullptr, SIZE_MAX) == nullptr && *__error_nid_postfix() == 77); void* empty = ApplicationHeapAllocate_nid_no_patch(0); require(empty != nullptr); ApplicationHeapFree_nid_no_patch(empty); diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index d9da36364f..561aced31f 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -24,7 +24,7 @@ - [malloc_usable_size](../../../core/libs/prx/libc/src/ApplicationHeap.cpp) (libc) - with the default allocator it returns the size the block was requested with (the range registered for it), not the rounded-up chunk size Sony's allocator reports; both satisfy "at least the requested size", and bytes past the request would not be write-watched. With an application allocator it calls entry 9 of the replacement table (`malloc_usable_size` in KytyPS5's `MallocReplace` order) and throws when the table leaves it null, like `malloc_stats_fast` - [malloc_stats_fast](../../../core/libs/prx/libc/src/GuestHeap.cpp) (libc) - with the default allocator it fills the 0x28-byte managed-size block as `sceLibcMspaceMallocStatsFast` does, from the default heap's own accounting, not Sony's allocator: the system sizes count the 1 MiB spans of its small-block classes and its committed large blocks, cached free ones included, and the in-use sizes count each handed-out block at its size-class or 64 KiB-granule size, header included. A block size below 0x28 or a null pointer returns 22, as in the mspace version; the version field is not checked. Ship of Harkinian (PPSA99320) calls it about 10 s after start-up. - [malloc, calloc, realloc, memalign, aligned_alloc, reallocalign and posix_memalign](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - the console's own heap was measured in a payload process on firmware 13.60, not in a title. A heap a title replaces was not measured and keeps the FreeBSD jemalloc behaviour: `ENOMEM` on failure, `EINVAL` for an alignment that is zero or not a power of two, and `realloc(ptr, 0)` frees the block. With the console's heap, failures set `EINVAL`, and `errno` is left alone for a size above `SIZE_MAX - 0x1008f` (`SIZE_MAX - (A + 0x100af)` for an alignment over 32 rounded up to A), a `calloc` overflow or an alignment of 2^63 or more. Alignments round up to a power of two, and `realloc(ptr, 0)` keeps the block with 0 usable bytes. `reallocalign(ptr, 0, alignment)` for a block without that alignment was not measured and throws -- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, not measured on the console: size 0 does what `realloc` does here, keeping the block with 0 usable bytes with the default heap and freeing it and returning null with an application allocator, so the block is not freed twice; when `realloc` fails because the application allocator returns null or the default heap rejects the size, the block is freed through the same allocator, `errno` is `ENOMEM` and null is returned. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc` +- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, not measured on the console: size 0 does what `realloc` does here, keeping the block with 0 usable bytes with the default heap and freeing it and returning null with an application allocator, so the block is not freed twice; when `realloc` fails, the block is freed through the same allocator and null is returned with the `errno` that `realloc` left. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc` - [sceLibcMspaceReallocalign](../../../core/libs/prx/libc/src/Mspace.cpp) (libSceLibcInternal, implemented in libc) takes `(void* heap, void* block, size_t alignment, size_t size)`, the order of the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x13880, whose internal routine at 0x12390 treats the third argument as the alignment and, for a null block, passes it to the routine `sceLibcMspaceMemalign` uses). Measured on a PS5 (firmware 13.60) from a homebrew payload: a null block with alignment 4096 and size 100 returns a 4096-aligned block; an alignment of 0 or 3 succeeds and 100 gives a 128-aligned block, as the routine raises it to at least 32 and to the next power of two; an alignment of 2^63 or more returns null, keeps the block and leaves `errno` alone; and a size of 0 returns a block (the same one when it is already suitable) instead of freeing it. A block that is aligned and large enough is kept where it is, without giving back the bytes past the new size as the console's in-place resize does - [acosl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, like the other libc math functions here, not by the console's (FreeBSD msun ld80 code in Sony's `libc.prx`): results can differ from the console's in the last bit, and on Linux glibc sets `errno` to `EDOM` for `acosl` outside [-1, 1] where msun only raises the floating-point exception. `long double` is the x87 80-bit format, as Sony's `frexpl` uses it (`fldt 0x8(%rsp)`, result in `st(0)`) - [atanl, sinl, cosl, tanl, sinhl, coshl, tanhl, expl, exp2l, logl, log10l and powl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, as `acosl` is, not by the console's FreeBSD msun ld80 code: results can differ from the console's in the last bit (glibc's `log10l(1000)` is not exactly 3), and on Linux glibc sets `errno` to `EDOM` or `ERANGE` where msun only raises the floating-point exception. `ldexpl` and `truncl` are exact operations and give the console's result; `logb` and `remainder` give the console's value too, but on Linux glibc sets `errno` (`ERANGE` for `logb(0)`, `EDOM` for `remainder` by zero or of an infinity) where msun only raises the floating-point exception From 285275e6787bd60c414f00439841e909684540ec Mon Sep 17 00:00:00 2001 From: iAbdulrrahman Date: Wed, 21 Oct 2026 09:00:56 +0300 Subject: [PATCH 006/113] feat(libc): implement isascii and toascii --- core/libs/prx/libc/src/LocaleSupport.cpp | 2 ++ core/libs/tests/GuestCharacter.cpp | 9 +++++++++ 2 files changed, 11 insertions(+) diff --git a/core/libs/prx/libc/src/LocaleSupport.cpp b/core/libs/prx/libc/src/LocaleSupport.cpp index a4388c8dfe..230edc7256 100644 --- a/core/libs/prx/libc/src/LocaleSupport.cpp +++ b/core/libs/prx/libc/src/LocaleSupport.cpp @@ -287,6 +287,8 @@ int APS5_VABI isprint_nid_postfix(int c) { return ClassifyCharacter(c, std::ctyp int APS5_VABI isgraph_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::graph); } int APS5_VABI ispunct_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::punct); } int APS5_VABI isxdigit_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::xdigit); } +int APS5_VABI isascii_nid_postfix(int c) { return (c & ~0x7F) == 0; } +int APS5_VABI toascii_nid_postfix(int c) { return c & 0x7F; } int APS5_VABI toupper_nid_postfix(int c) { return ConvertCharacter(c, true); } int APS5_VABI tolower_nid_postfix(int c) { return ConvertCharacter(c, false); } diff --git a/core/libs/tests/GuestCharacter.cpp b/core/libs/tests/GuestCharacter.cpp index 7601716b77..f4d1164934 100644 --- a/core/libs/tests/GuestCharacter.cpp +++ b/core/libs/tests/GuestCharacter.cpp @@ -17,6 +17,8 @@ int APS5_VABI isprint_nid_postfix(int); int APS5_VABI isgraph_nid_postfix(int); int APS5_VABI ispunct_nid_postfix(int); int APS5_VABI isxdigit_nid_postfix(int); +int APS5_VABI isascii_nid_postfix(int); +int APS5_VABI toascii_nid_postfix(int); int APS5_VABI toupper_nid_postfix(int); int APS5_VABI tolower_nid_postfix(int); const short* APS5_VABI _Getptolower_nid_postfix(); @@ -52,9 +54,16 @@ int main() { Require(bool(isgraph_nid_postfix(c)) == bool(std::isgraph(c))); Require(bool(ispunct_nid_postfix(c)) == bool(std::ispunct(c))); Require(bool(isxdigit_nid_postfix(c)) == bool(std::isxdigit(c))); + Require(bool(isascii_nid_postfix(c)) == (c >= 0 && c <= 127)); + Require(toascii_nid_postfix(c) == (c & 0x7F)); Require(toupper_nid_postfix(c) == std::toupper(c)); Require(tolower_nid_postfix(c) == std::tolower(c)); Require(toupper_nid_postfix(c) == _Getptoupper_nid_postfix()[c]); Require(tolower_nid_postfix(c) == _Getptolower_nid_postfix()[c]); } + Require(!isascii_nid_postfix(-100)); + Require(!isascii_nid_postfix(128)); + Require(!isascii_nid_postfix(256)); + Require(toascii_nid_postfix(258) == 2); + Require(toascii_nid_postfix(-1) == 0x7F); } From a2e07a5eb57572d36a9923e38f88ac229024e416 Mon Sep 17 00:00:00 2001 From: Queuze <58829992+lucaslima430@users.noreply.github.com> Date: Wed, 21 Oct 2026 00:45:51 -0300 Subject: [PATCH 007/113] test(libc): check host stdout after freopen --- core/libs/tests/GuestStandardStreams.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/core/libs/tests/GuestStandardStreams.cpp b/core/libs/tests/GuestStandardStreams.cpp index c37c580e6b..c5700d00b9 100644 --- a/core/libs/tests/GuestStandardStreams.cpp +++ b/core/libs/tests/GuestStandardStreams.cpp @@ -17,6 +17,7 @@ #include #ifdef _WIN32 #include +#include #else #include #endif @@ -920,6 +921,14 @@ int main(int argc, char** argv) { CheckStandardStreamDeleteSharing(); const std::string standardFilename = "anyps5-standard-reopen-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()); Require(freopen_nid_postfix(standardFilename.c_str(), "w", __stdoutp_nid_postfix) == __stdoutp_nid_postfix); + const HANDLE hostOutput = ::GetStdHandle(STD_OUTPUT_HANDLE); + Require(hostOutput != nullptr && hostOutput != INVALID_HANDLE_VALUE); + Require(hostOutput != reinterpret_cast(::_get_osfhandle(::_fileno(stdout)))); + DWORD handleFlags = 0; + Require(::GetHandleInformation(hostOutput, &handleFlags) != 0); + constexpr char hostMessage[] = "host stdout preserved\n"; + DWORD hostWritten = 0; + Require(::WriteFile(hostOutput, hostMessage, sizeof(hostMessage) - 1, &hostWritten, nullptr) != 0 && hostWritten == sizeof(hostMessage) - 1); Require(printf_nid_postfix("standard output") == 15 && fflush_nid_postfix(__stdoutp_nid_postfix) == 0); { std::ifstream input(standardFilename, std::ios::binary); std::string contents; std::getline(input, contents); Require(contents == "standard output"); } From 6d464e94951e9f18ae33d8627d1ad6ac3be1f872 Mon Sep 17 00:00:00 2001 From: xXPBSXx <20614131+xXPBSXx@users.noreply.github.com> Date: Wed, 21 Oct 2026 14:50:12 +0200 Subject: [PATCH 008/113] test(recompiler): give the shader cache source fixture room under load shader_cache_runtime_sources configures a CMake fixture several times with a 15 s limit per configure and 180 s for the whole test. On a loaded machine a configure takes longer than that: under a parallel build (load average ~12 on WSL2 Ubuntu) the test timed out in 2 of 2 runs, and on an idle Windows machine it needs about 115 s of the 180 s. Raise the limits to 120 s per configure, 60 s per version query and 600 s for the test. Co-Authored-By: Claude Sonnet 5.5 --- CMakeLists.txt | 2 +- tools/tests/test_shader_cache_runtime_sources.py | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 9eaa66c8db..7dd610b9f5 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -135,7 +135,7 @@ if(BUILD_TESTING) add_test(NAME shader_cache_runtime_sources COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_shader_cache_runtime_sources.py ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler ${CMAKE_COMMAND}) - set_tests_properties(shader_cache_runtime_sources PROPERTIES TIMEOUT 180) + set_tests_properties(shader_cache_runtime_sources PROPERTIES TIMEOUT 600) add_test(NAME pr_overlap_encoding COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_pr_overlap_encoding.py) add_test(NAME pr_overlap_dependencies COMMAND ${Python3_EXECUTABLE} diff --git a/tools/tests/test_shader_cache_runtime_sources.py b/tools/tests/test_shader_cache_runtime_sources.py index 0c462bb7ea..cae5368f02 100644 --- a/tools/tests/test_shader_cache_runtime_sources.py +++ b/tools/tests/test_shader_cache_runtime_sources.py @@ -70,7 +70,7 @@ file(WRITE "${{CMAKE_CURRENT_BINARY_DIR}}/runtime-sources.txt" "${{runtimeSource def configure(self, flags=''): result = subprocess.run([CMAKE, '-S', str(self.root), '-B', str(self.build), '-G', 'Ninja', f'-DCMAKE_CXX_FLAGS={flags}'], - capture_output=True, encoding='utf-8', errors='replace', timeout=15) + capture_output=True, encoding='utf-8', errors='replace', timeout=120) if result.returncode: raise AssertionError(result.stdout + result.stderr) if (self.root / 'compiler-invoked').exists(): @@ -93,7 +93,7 @@ file(WRITE "${{CMAKE_CURRENT_BINARY_DIR}}/runtime-sources.txt" "${{runtimeSource f'-DRECOMPILER_DIR={self.recompiler.as_posix()}', f'-DLIST_FILE={self.listing.as_posix()}', f'-DOUTPUT={output.as_posix()}', f'-DEXTRA={self.extra}', '-P', str(self.recompiler / 'ShaderCacheVersion.cmake')], - capture_output=True, encoding='utf-8', errors='replace', timeout=10) + capture_output=True, encoding='utf-8', errors='replace', timeout=60) if not success: if result.returncode == 0 or output.exists(): raise AssertionError('The generator accepted an unkeyed dependency') @@ -138,7 +138,7 @@ class ShaderCacheRuntimeSourceTests(unittest.TestCase): 'if(NOT result EQUAL 99)', 'message(FATAL_ERROR "Unexpected compiler arguments were accepted")', 'endif()'] script.write_text('\n'.join(lines) + '\n', encoding='utf-8') result = subprocess.run([CMAKE, '-P', str(script)], capture_output=True, - encoding='utf-8', errors='replace', timeout=10) + encoding='utf-8', errors='replace', timeout=60) self.assertEqual(result.returncode, 0, result.stdout + result.stderr) self.assertEqual(len(marker.read_text(encoding='utf-8').splitlines()), len(rejected)) From 038d9a97d77ea4e60575348f7bac5e38f9fc2983 Mon Sep 17 00:00:00 2001 From: orezraey Date: Wed, 21 Oct 2026 11:06:19 -0300 Subject: [PATCH 009/113] fix(libSceAgcDriver): return the console's workload stream registration errors Measured on firmware 13.60: registering an id outside 1 to 31 or one already registered returns 0x8a6c0033, checked before a null stream, which returns 0x8a6c0035; unregistering an id outside 1 to 31 returns 0x8a6c0033 and one that is not registered 0x8a6c003a. Co-Authored-By: Claude Opus 5.5 --- .../Resource/src/Registration.cpp | 20 +++++++++++-------- core/libs/tests/GuestAgcDriverResources.cpp | 17 ++++++++++++++++ docs/dev/debt/libSceAgc.md | 2 +- 3 files changed, 30 insertions(+), 9 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp b/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp index f3fbd0ba67..7cae8c3afb 100644 --- a/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp +++ b/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp @@ -9,6 +9,9 @@ // Resource registration feeds GPU debugging tools, none of which are attached; the game treats this code as benign. static constexpr int SCE_AGC_ERROR_RESOURCE_REGISTRATION_UNAVAILABLE = static_cast(0x8A6C9018); static constexpr uint32_t RESOURCE_REGISTRATION_MAX_NAME_LENGTH = 0xfc; +static constexpr int SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID = static_cast(0x8A6C0033); +static constexpr int SCE_AGC_ERROR_WORKLOAD_STREAM_NULL = static_cast(0x8A6C0035); +static constexpr int SCE_AGC_ERROR_WORKLOAD_STREAM_NOT_REGISTERED = static_cast(0x8A6C003A); static constexpr uint32_t WORKLOAD_STREAM_MIN_ID = 1; static constexpr uint32_t WORKLOAD_STREAM_MAX_ID = 31; @@ -49,10 +52,11 @@ int APS5_VABI sceAgcDriverRegisterMultipleResources(uint32_t* resourceHandle, ui } int APS5_VABI sceAgcDriverRegisterWorkloadStream(uint32_t stream_id, const void* stream) { - if (stream != nullptr && stream_id >= WORKLOAD_STREAM_MIN_ID && stream_id <= WORKLOAD_STREAM_MAX_ID) { - std::lock_guard lock(g_workloadStreamLock); - g_workloadStreams |= 1u << stream_id; - } + if (stream_id < WORKLOAD_STREAM_MIN_ID || stream_id > WORKLOAD_STREAM_MAX_ID) return SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID; + std::lock_guard lock(g_workloadStreamLock); + if ((g_workloadStreams & (1u << stream_id)) != 0) return SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID; + if (stream == nullptr) return SCE_AGC_ERROR_WORKLOAD_STREAM_NULL; + g_workloadStreams |= 1u << stream_id; return 0; } @@ -83,10 +87,10 @@ int APS5_VABI sceAgcDriverUnregisterAllResourcesForOwner(uint32_t owner_handle) } int APS5_VABI sceAgcDriverUnregisterWorkloadStream(uint32_t stream_id) { - if (stream_id >= WORKLOAD_STREAM_MIN_ID && stream_id <= WORKLOAD_STREAM_MAX_ID) { - std::lock_guard lock(g_workloadStreamLock); - g_workloadStreams &= ~(1u << stream_id); - } + if (stream_id < WORKLOAD_STREAM_MIN_ID || stream_id > WORKLOAD_STREAM_MAX_ID) return SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID; + std::lock_guard lock(g_workloadStreamLock); + if ((g_workloadStreams & (1u << stream_id)) == 0) return SCE_AGC_ERROR_WORKLOAD_STREAM_NOT_REGISTERED; + g_workloadStreams &= ~(1u << stream_id); return 0; } diff --git a/core/libs/tests/GuestAgcDriverResources.cpp b/core/libs/tests/GuestAgcDriverResources.cpp index fc55b15a8a..5ee342a763 100644 --- a/core/libs/tests/GuestAgcDriverResources.cpp +++ b/core/libs/tests/GuestAgcDriverResources.cpp @@ -92,8 +92,25 @@ int main() { Require(sceAgcDriverFindResourcesPublic(nullptr, nullptr) == Unavailable); Require(sceAgcDriverUnregisterAllResourcesForOwner(owner) == Unavailable); Require(std::string_view(name) == "unchanged"); + constexpr int InvalidStream = static_cast(0x8A6C0033); + constexpr int NullStream = static_cast(0x8A6C0035); + constexpr int StreamNotRegistered = static_cast(0x8A6C003A); + for (const std::uint32_t id : {0u, 32u, 0x101u, 0xffffffffu}) { + Require(sceAgcDriverRegisterWorkloadStream(id, memory) == InvalidStream); + Require(sceAgcDriverRegisterWorkloadStream(id, nullptr) == InvalidStream); + Require(sceAgcDriverUnregisterWorkloadStream(id) == InvalidStream); + } + Require(sceAgcDriverRegisterWorkloadStream(2u, nullptr) == NullStream); + Require(sceAgcDriverUnregisterWorkloadStream(2u) == StreamNotRegistered); + Require(sceAgcDriverRegisterWorkloadStream(1u, memory) == 0); + Require(sceAgcDriverRegisterWorkloadStream(1u, memory) == InvalidStream); + Require(sceAgcDriverRegisterWorkloadStream(1u, nullptr) == InvalidStream); + Require(sceAgcDriverRegisterWorkloadStream(31u, reinterpret_cast(memory) + 1) == 0); + Require(sceAgcDriverUnregisterWorkloadStream(1u) == 0); + Require(sceAgcDriverUnregisterWorkloadStream(1u) == StreamNotRegistered); Require(sceAgcDriverRegisterWorkloadStream(1u, memory) == 0); Require(sceAgcDriverUnregisterWorkloadStream(1u) == 0); + Require(sceAgcDriverUnregisterWorkloadStream(31u) == 0); Require(!sceAgcDriverIsCaptureInProgress()); Require(!sceAgcDriverIsTraceInProgress()); Require(!sceAgcDriverIsSubmitValidationEnabled()); diff --git a/docs/dev/debt/libSceAgc.md b/docs/dev/debt/libSceAgc.md index 0bd4347123..96d78d4983 100644 --- a/docs/dev/debt/libSceAgc.md +++ b/docs/dev/debt/libSceAgc.md @@ -45,7 +45,7 @@ - [sceAgcDebugRaiseException](../../../core/libs/prx/libSceAgc/Misc/src/Debug.cpp) (libSceAgc) - logs the exception id and returns 0, as retail hardware does nothing per [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c); the trap (`ud2`) OpenAGC describes for development hardware is not reproduced. Neither is verified on a console. The `uint32` exception id is [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/6f0cddd4404ec5203e71fea77e75fc373299ba3f/src/libs/agc.cpp)'s claim; OpenAGC declares no arguments, so the logged id may be leftover register contents - [sceAgcSetAmmSemaphoreMemory, sceAgcGetSemaphoreLabel](../../../core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp) (libSceAgc) - the `(memory, sizeInBytes)` and `(index, label)` signatures, the 16 KiB alignment of the memory and its size, the single registration, the 32-byte labels and the zeroed first 8 bytes of each are what [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L508-L546) and [sharpemu](https://github.com/sharpemu/sharpemu/blob/a2983692930564815a77f81e74c151268f5b935f/src/SharpEmu.Libs/Agc/AgcExports.AmmSemaphore.cs) agree on; KytyPS5 has neither function. OpenAGC clears the whole memory and sharpemu only those 8 bytes, so a registration whose labels hold data past them throws. The two return different errors for every rejected call (OpenAGC `0x8a6c0002`, `0x8a6c000b`, `0x8a6c0048` and `0x8a6c0049`, sharpemu generic invalid-argument and already-exists errors), so every rejected call throws, including a lookup before registration. Not measured on the console; PPSA02801 imports both (OpenAGC's import analysis), no title is shown calling them. -- [sceAgcDcbSetWorkloadsActive and sceAgcDcbSetWorkloadComplete](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) (libSceAgc) and [sceAgcDriverRegisterWorkloadStream](../../../core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp) (libSceAgcDriver) - the driver call records only the stream id (1 to 31; it returns 0 for any argument and keeps no stream record), and the DCB calls write the packets [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/main/src/libs/agc.cpp) writes: an 18-dword (active) or 12-dword (complete) `IT_NOP` packet with the stream id, and for active the 64-bit mask of the workload ids, for complete the workload id and the 64-bit clear mask of that id. Both return null for a null command buffer, an unregistered or out-of-range stream, a workload id above 63, and for active a duplicate id or a count of 0 or above 63. The layouts and checks come from KytyPS5 alone; the console oracle in [prosper](https://github.com/mattias800/prosper/blob/main/prosper/tests/data/console_oracle/agcbuild.golden.tsv) measures the null return only for unregistered streams, not the packet contents of a registered one. The error codes the console driver returns for an invalid or repeated registration are unknown, so registration never fails here. PPSA29866 calls sceAgcDcbSetWorkloadsActive while building its command buffers (sceAgcDcbSetWorkloadComplete was not observed); nothing else was observed. +- [sceAgcDcbSetWorkloadsActive and sceAgcDcbSetWorkloadComplete](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) (libSceAgc) - the DCB calls write the packets [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/main/src/libs/agc.cpp) writes: an 18-dword (active) or 12-dword (complete) `IT_NOP` packet with the stream id, and for active the 64-bit mask of the workload ids, for complete the workload id and the 64-bit clear mask of that id. Both return null for a null command buffer, an unregistered or out-of-range stream, a workload id above 63, and for active a duplicate id or a count of 0 or above 63. The layouts and checks come from KytyPS5 alone; the console oracle in [prosper](https://github.com/mattias800/prosper/blob/main/prosper/tests/data/console_oracle/agcbuild.golden.tsv) measures the null return only for unregistered streams, not the packet contents of a registered one. PPSA29866 calls sceAgcDcbSetWorkloadsActive while building its command buffers (sceAgcDcbSetWorkloadComplete was not observed); nothing else was observed. - [sceAgcDcbSetWorkloadStreamInactive](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) and [sceAgcAcbSetWorkloadsActive, sceAgcAcbSetWorkloadComplete, sceAgcAcbSetWorkloadStreamInactive](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - return null without writing to the buffer for a null command buffer or a stream that is not registered (out-of-range ids included), and throw for a registered stream. The console oracle in prosper measured only that null return, with no stream registered, three argument patterns each and nothing written ([ACB](https://github.com/mattias800/prosper/blob/df074498e56c0df22d74f9c6622e4709bc1c9a19/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L48-L56), [DCB](https://github.com/mattias800/prosper/blob/df074498e56c0df22d74f9c6622e4709bc1c9a19/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L196-L204)); the packet a registered stream gets is not measured. KytyPS5 has no body for these four, and its `IT_NOP` layout for the DCB active and complete calls differs from the SET_UCONFIG_REG, WRITE_DATA and SET_WORKLOAD sequence [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/agc_workload_packet.c) derives from the driver, so neither is taken. The `(buf, streamId)`, `(buf, streamId, workloadId)` and `(buf, streamId, workloadIds, workloadCount)` signatures are those of the DCB calls in [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L2317-L2384), which says the ACB calls use the same driver builders; no ACB declaration was found. `sceAgcDcbSetWorkloadsActive` checks the stream before it reads the workload ids, as OpenAGC does: the console returned null for stream 1 with the ids at address 2 ([measured](https://github.com/mattias800/prosper/blob/df074498e56c0df22d74f9c6622e4709bc1c9a19/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L203)) without faulting - [sceAgcCreatePrimState](../../../core/libs/prx/libSceAgc/Shader/src/PrimState.cpp) (libSceAgc) - the `ge_user_vgpr_en` special is passed to the user configuration registers at whatever offset the shader header stores, as the SPRX does according to [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L1181-L1252), which copies all four specials verbatim (KytyPS5 stops on any other offset). PPSA99039, PPSA99505, PPSA99515 and PPSA99997 build their headers by hand with it at 0x25c (`GE_USER_VGPR1`) instead of 0x262 (`GE_USER_VGPR_EN`), value 0, and run on the console; it is not moved to 0x262, and the driver reads neither register. `ge_cntl`, `vgt_shader_stages_en` and a used `vgt_gs_out_prim_type` must still be at their own offsets, since the driver reads those registers there, so a header that stores one elsewhere throws naming the offset, although by OpenAGC the SPRX would copy it as well - [sceAgcDcbEventWrite](../../../core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp) (libSceAgc) - non-sample-dump event types (any event other than 0x38 and 0x39) emit a 2-dword PM4 packet 0x46 without address dwords; the address argument is ignored for these events. Void Terrarium (PPSA03061, #5055) passes a non-null address buffer (0x00000002d2a10000) with event type 0x16 (cache flush). From 18213e0f3ae5810b07c339eb4a7a07d241b5f1f8 Mon Sep 17 00:00:00 2001 From: Felipebmaitan Date: Wed, 21 Oct 2026 12:14:46 -0300 Subject: [PATCH 010/113] feat(libc): implement fegetexcept --- core/libs/prx/libc/src/FloatingPoint.cpp | 4 ++++ core/libs/tests/GuestFloatingPoint.cpp | 24 ++++++++++++++++++++++++ docs/dev/debt/libc.md | 1 + 3 files changed, 29 insertions(+) diff --git a/core/libs/prx/libc/src/FloatingPoint.cpp b/core/libs/prx/libc/src/FloatingPoint.cpp index e3717ef61b..e63d702609 100644 --- a/core/libs/prx/libc/src/FloatingPoint.cpp +++ b/core/libs/prx/libc/src/FloatingPoint.cpp @@ -119,6 +119,10 @@ int APS5_VABI fegettrapenable_nid_postfix() { return ~control & Exceptions; } +int APS5_VABI fegetexcept_nid_postfix() { + return fegettrapenable_nid_postfix(); +} + int APS5_VABI fesettrapenable_nid_postfix(int exceptions) { const auto mask = static_cast(exceptions); if (mask > Exceptions) return 1; diff --git a/core/libs/tests/GuestFloatingPoint.cpp b/core/libs/tests/GuestFloatingPoint.cpp index 3ea9884bb0..14a8968e86 100644 --- a/core/libs/tests/GuestFloatingPoint.cpp +++ b/core/libs/tests/GuestFloatingPoint.cpp @@ -22,6 +22,7 @@ int APS5_VABI fedisableexcept_nid_postfix(int); int APS5_VABI __feenableexcept_nid_postfix(int); int APS5_VABI __fedisableexcept_nid_postfix(int); int APS5_VABI fegettrapenable_nid_postfix(); +int APS5_VABI fegetexcept_nid_postfix(); int APS5_VABI fesettrapenable_nid_postfix(int); } @@ -60,6 +61,28 @@ Environment SeedFlags(unsigned x87, unsigned sse) { return ReadEnvironment(); } +void CheckEnabledExceptions() { + const auto seeded = SeedFlags(0, 0); + for (unsigned x87 = 0; x87 <= 0x3f; ++x87) { + for (unsigned sse = 0; sse <= 0x3f; ++sse) { + auto state = seeded; + state.x87[0] = (state.x87[0] & ~0xc3fu) | 0x800 | x87; + state.x87[1] = (state.x87[1] & ~0x3fu) | (x87 & 0x15u); + state.sse = (state.sse & ~0x7fbfu) | 0x2000 | (sse << 7) | (sse & 0x2au); + WriteEnvironment(state); + *__error_nid_postfix() = 123; + const int enabled = fegetexcept_nid_postfix(); + const int error = *__error_nid_postfix(); + const auto after = ReadEnvironment(); + WriteEnvironment(seeded); + Require(enabled == static_cast(0x3f ^ x87), "enabled exceptions use the x87 masks independently of SSE"); + Require(after.x87[0] == state.x87[0] && after.x87[1] == state.x87[1] && after.sse == state.sse, + "enabled exception query preserves control modes and flags"); + Require(error == 123, "enabled exception query preserves errno"); + } + } +} + void CheckRounding() { const auto seeded = SeedFlags(0x02, 0x10); constexpr int modes[] = {0, 0x400, 0x800, 0xc00}; @@ -213,6 +236,7 @@ void CheckTraps() { int main() { const auto original = ReadEnvironment(); CheckRounding(); + CheckEnabledExceptions(); CheckFlags(); CheckTraps(); CheckThreads(); diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index 581f589299..48cb046030 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -3,6 +3,7 @@ ### Unknown function info - [strtonum](../../../core/libs/prx/libc/src/StringExtensions.cpp) (libc) is unverified on the console. Its signature, decimal parsing, inclusive bounds, error strings, error precedence and errno preservation follow [FreeBSD 11.4 strtonum.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdlib/strtonum.c). Parsing uses the host `strtoll` with base 10. +- [fegetexcept](../../../core/libs/prx/libc/src/FloatingPoint.cpp) (libSceLibcInternal, implemented in libc) has not been read from the PS5 library or measured on a console. It follows FreeBSD 11.4 amd64 [fenv.h](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/x86/fenv.h#L121-L133), reporting the six unmasked x87 exceptions independently of MXCSR; whether the PS5 uses the same rule when the units disagree is unverified. - [sceLibcBacktraceGetBufferSize, sceLibcBacktraceSelf](../../../core/libs/prx/libc/src/Backtrace.cpp) (libc) - signatures and frame record layout inferred from a title (next pointer, u32 module offset, module name at +0x10); the u32 at +0xC is unknown and written as 0. Module names are host file names without the `.guest.prx` suffix, so their case may differ from the PS5 module name. On Windows, unwinding uses `_Unwind_Backtrace` and stops at a frame without `.ehmeta` or `.ehfram` tables whose PE unwind data has an exception or termination handler, leaving the trace empty or cut short while still returning 0. Implemented only on Linux and Windows; other platforms throw - [ApplicationGuestHeapApi](../../../core/libs/prx/libc/src/ApplicationProcessParameters.cpp) (libc) - on Linux, HLE application allocation uses a loaded guest SDK's ten allocator exports when the title's replacement table has an allocator entry and the exports belong to one native module. With an empty table it keeps the default heap, since a bundled `libc.prx` may export the allocator NIDs while forwarding them to HLE. Its CRT owns application allocator initialization and finalization; HLE retains the module until process exit. Partial or mixed providers throw. This avoids reinitializing an allocator already used by SDK startup; console behavior and other host platforms remain unverified. From 959efbb8d319d0a0ee22f11cf38a8301c73e14c2 Mon Sep 17 00:00:00 2001 From: zmeizy Date: Wed, 21 Oct 2026 18:29:55 +0300 Subject: [PATCH 011/113] fix(shader): take the hardware f32 flush only in shaders that flush f32 denormals When the startup probe chose the hardware f32 flush, every module declared DenormFlushToZero 32, also shaders whose FLOAT_MODE keeps f32 denormals (f32 denormal field 1, 2 or 3), so the device flushed what they keep and DenormPreserve 32 was never declared. The hardware flush now applies to shaders that flush f32 denormals (field 0, or no float mode); the others declare DenormPreserve 32 where the device supports it. Co-Authored-By: Claude Opus 5.5 --- .../tests/F32DenormPreserve.cpp | 19 ++++++++++++++++--- core/shader/recompiler/Recompiler.cpp | 8 ++++++-- docs/dev/debt/shader.md | 1 + 3 files changed, 23 insertions(+), 5 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp b/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp index 0f3fe85da7..f47e2d0ebc 100644 --- a/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp @@ -4,6 +4,7 @@ #include #include #include +#include #include #include #include @@ -19,17 +20,19 @@ void require(bool condition, const std::string& message) { } constexpr std::array CvtF16F32Store{0x7e021500u, 0xe0700000u, 0x80000100u, 0xbf810000u}; +constexpr std::array MovStore{0x7e020300u, 0xe0700000u, 0x80000100u, 0xbf810000u}; -std::vector recompile(bool preserve, bool flush, bool flushCapability = true) { +std::vector recompile(bool preserve, bool flush, bool flushCapability = true, std::optional floatMode = std::nullopt, std::span code = CvtF16F32Store) { const std::array capabilities{spv::CapabilityShader, spv::CapabilityGroupNonUniform, spv::CapabilityDenormPreserve, spv::CapabilityDenormFlushToZero}; const std::array userData{0x10000000u, 0x00100000u, 0x40u, 0x00027facu}; const std::array extensions{"SPV_KHR_storage_buffer_storage_class", "SPV_KHR_float_controls"}; RecompileRequest request{}; - request.shader = {ShaderStage::Compute, 0x20000u, CvtF16F32Store, 0, {}}; + request.shader = {ShaderStage::Compute, 0x20000u, code, 0, {}}; request.context.waveSize = 64; request.context.userDataBaseRegister = 0; request.context.userData = userData; request.context.compute = ShaderComputeStageInfo{{64u, 1u, 1u}, 0u, {false, false, false}, false, 1u}; + request.context.floatMode = floatMode; request.target.vulkanVersion = 0x00403000u; request.target.spirvVersion = 0x00010600u; request.target.subgroupSize = 64; @@ -79,6 +82,16 @@ void verify() { require(flushed.flush32 && !flushed.preserve32, "the hardware 32-bit flush did not take precedence over the preserve flag"); const auto nativeFlush = scan(recompile(true, true, false)); require(!nativeFlush.preserve32 && !nativeFlush.flush32, "a hardware flush without the DenormFlushToZero capability declared a 32-bit denormal execution mode"); + const auto flushingMode = scan(recompile(true, true, true, ShaderFloatMode{0xc0u, true, false, false}, MovStore)); + require(flushingMode.flush32 && !flushingMode.preserve32, "FLOAT_MODE 0xc0 flushes f32 denormals but the module did not take the hardware flush"); + for (const std::uint32_t mode : {0xd0u, 0xe0u, 0xf0u}) { + char name[64]; + std::snprintf(name, sizeof(name), "FLOAT_MODE 0x%02x keeps f32 denormals", mode); + const auto kept = scan(recompile(true, true, true, ShaderFloatMode{mode, true, false, false}, MovStore)); + require(kept.preserve32 && kept.preserveCapability && !kept.flush32, std::string(name) + ", but the module did not declare DenormPreserve 32 instead of the hardware flush"); + const auto unpreserved = scan(recompile(false, true, true, ShaderFloatMode{mode, true, false, false}, MovStore)); + require(!unpreserved.flush32 && !unpreserved.preserve32, std::string(name) + ", but the module took the hardware flush on a device that cannot preserve them"); + } } } @@ -90,6 +103,6 @@ int main() { std::fprintf(stderr, "F32DenormPreserve: %s\n", error.what()); return 1; } - std::puts("F32DenormPreserve: the 32-bit DenormPreserve execution mode follows the target flag and yields to the hardware flush"); + std::puts("F32DenormPreserve: the 32-bit DenormPreserve execution mode follows the target flag and yields to the hardware flush in shaders that flush f32 denormals"); return 0; } diff --git a/core/shader/recompiler/Recompiler.cpp b/core/shader/recompiler/Recompiler.cpp index ad94823d64..bae14c10ed 100644 --- a/core/shader/recompiler/Recompiler.cpp +++ b/core/shader/recompiler/Recompiler.cpp @@ -153,6 +153,10 @@ std::uint32_t DeviceMemoryLdsBytes(const RecompileRequest& request) { return bytes + 4u > request.target.maxWorkgroupSharedMemoryBytes ? static_cast(bytes) : 0u; } +bool HardwareFloat32Flush(const RecompileRequest& request) { + return request.target.float32FlushToZero && (!request.context.floatMode.has_value() || ((request.context.floatMode->floatMode >> 4u) & 3u) == 0u); +} + std::atomic frontEndBuilds{0}; } @@ -239,7 +243,7 @@ IrProgram PrepareResourceProgram(const RecompileRequest& request, ShaderPreparat translateOptions.nativeFloat16 = supports(spv::CapabilityFloat16) && supports(spv::CapabilityRoundingModeRTE) && supports(spv::CapabilityDenormPreserve); translateOptions.interpolationFunctions = supports(spv::CapabilityInterpolationFunction); translateOptions.floatMode = request.context.floatMode; - translateOptions.float32FlushToZero = request.target.float32FlushToZero; + translateOptions.float32FlushToZero = HardwareFloat32Flush(request); translateOptions.inputInfo = inputInfo; constexpr InstructionTranslator translator; @@ -602,7 +606,7 @@ CompiledVariant emitVariant(const RecompileRequest& request, IrProgram& program) targetOptions.float16DenormPreserve = request.target.float16DenormPreserve; targetOptions.spannedWaves = request.target.spannedWaves; targetOptions.robustBufferAccess2 = request.target.robustBufferAccess2; - targetOptions.float32FlushToZero = request.target.float32FlushToZero; + targetOptions.float32FlushToZero = HardwareFloat32Flush(request); targetOptions.float32DenormPreserve = request.target.float32DenormPreserve; targetOptions.meshBarycentricPixel = request.shader.stage == ShaderStage::Fragment && request.graphics && request.graphics->mesh; if (request.shader.stage == ShaderStage::Mesh && request.graphics && request.graphics->meshBarycentrics) { diff --git a/docs/dev/debt/shader.md b/docs/dev/debt/shader.md index d76932d773..9a4ac1f273 100644 --- a/docs/dev/debt/shader.md +++ b/docs/dev/debt/shader.md @@ -116,6 +116,7 @@ - [f32 denormals](../../../core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp) follow the shader's `FLOAT_MODE` f32 denormal field (bits 5:4) when it flushes them (0, and shaders without a known float mode, as in the 0xc0 most titles use), measured on RDNA2 (gfx1035) over 1444 rows per instruction at IEEE=0 and IEEE=1. `v_add/sub/subrev/mul/mul_legacy/mullit/fma/fmac/fmamk/fmaak/min/max/min3/max3/med3/fract/floor/ceil/frexp_mant/sin/cos_f32` flush their f32 inputs and their result to a zero of the same sign (`v_mullit_f32` measured on RDNA2 (gfx1036) over 6907 rows per mode at IEEE=0 and IEEE=1, so a positive denormal src2 counts as zero); the f32 compares, `v_cvt_i32/u32/rpi_i32/flr_i32_f32`, `v_frexp_exp_i32_f32`, `v_cvt_f64_f32`, `v_cvt_f16_f32`, `v_cvt_pkrtz_f16_f32`, `v_cvt_pknorm_i16/u16_f32` and `v_cvt_pk_u8_f32` flush their f32 inputs. `v_div_scale_f32` flushes all three inputs to signed zeros, measured on RDNA2 (gfx1036) over 2744 operand triples per mode at IEEE=0 and IEEE=1 with f32 denormals flushed and kept; its scale-down behaviour and host denormal preservation remain incomplete. `v_div_fixup_f32` flushes its src1 and src2 and keeps a denormal src0 and result, measured on RDNA2 (gfx1036) over 6859 rows per mode at IEEE=0 and IEEE=1. Tininess is detected after rounding, measured on RDNA2 (gfx1036) for `v_mul_f32` and `v_mullit_f32` at IEEE=0 and IEEE=1: a product is flushed when its value rounded to 24 bits with an unbounded exponent is below 2^-126, so `0x3f7ffffe * 0x00800001` (2^-126 * (1 - 2^-46)) gives `0x00800000` and `0x3f7fffff * 0x00800000` (2^-126 * (1 - 2^-24)) gives zero. The check rounds in the f32 round mode of `FLOAT_MODE` (bits 1:0), measured in all four modes, while the products themselves are still rounded to nearest even. This applies to `v_mul_f32`, `v_mul_legacy_f32`, `v_mullit_f32`, and to `v_fma_f32`, `v_fmac_f32`, `v_fmamk_f32`, `v_fmaak_f32` and `v_fma_mix_f32` when the addend is zero; with a nonzero addend the fused result is kept, so an exact result just below 2^-126 that rounds to it is not flushed. In the three directed modes the check is computed exactly from the significands. To nearest even (0, the mode of shaders without a known float mode) one factor is multiplied by 2^64, which is exact below 2^64, and the product with the other factor is compared with 2^-62. That multiply is a plain `OpFMul` like the product, and no f32 rounding mode is requested in the SPIR-V, so the check relies on the driver rounding f32 to nearest even by default, as the products do, and a product that rounds up to 2^-126 is the emitted product. `v_fma_mix_f32` follows this rule with mixed f16/f32 sources too, measured on RDNA2 (gfx1036) with f16 in either multiplicand slot, low and high half selection, and an f32 or f16 zero addend: f32 `0x00801002` times f16 `0x3bff` gives `0x00800000` to nearest at IEEE=0 and IEEE=1, while the neighbours `0x00801001` and `0x00801003` give zero and `0x00800001`. The tiny-product boundary was also measured for both signs in all four f32 round modes at IEEE=0; Its f16 sources are flushed to a zero of their sign when bit 0 of the f16/f64 denormal field is clear (0 and 2), whatever the f32 field, measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with f32 denormal modes 0 and 3 and f16 denormal modes 0 to 3, over 2744 triples of 14 halves with all three sources f16 and 1960 rows with an f32 multiplicand. `v_fma_mixlo_f16` and `v_fma_mixhi_f16` flush their f32 sources too and keep a product below 2^-126, measured on RDNA2 (gfx1036). `v_mad_legacy_f32` and `v_mac_legacy_f32` flush their inputs, their product and their result in every mode, see its entry; their product is still checked for tininess on its exact value, so one below 2^-126 gives zero even when it rounds to 2^-126, as the console's separately rounded encoding is not measured at this boundary. Denormal modes 1 and 2 throw for the other instructions. Not covered, and not measurable on RDNA2 (no such opcodes) or not measured: `v_mac_f32`, `v_mad_f32`, `v_madak_f32` and `v_madmk_f32` (rounded separately), `v_dot2_f32_f16` and `v_div_fmas_f32` (on hardware `v_div_fmas_f32` flushes only its result), f32 interpolation and `ds_add_f32` keep the previous lowering; `ds_min/max/cmpst_f32` flush both operands by the field, see the LDS float atomics entry. With f32 denormals kept (3) the results depend on the driver's default denormal behaviour, as no `DenormPreserve` execution mode is requested; `v_ldexp_f32` and the f32 compares are the exceptions. `v_cmp_X_f32` and `v_cmpx_X_f32` compare the operands as sign-magnitude integers with the NaN cases handled apart, so a denormal is not read as zero, measured on RDNA2 (gfx1036) over 256 operand pairs per opcode at IEEE=0 and IEEE=1 with f32 denormals kept and flushed. `v_ldexp_f32` preserves subnormal inputs and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, measured on RDNA2 (gfx1036) over 2163 rows in each of the four round modes at IEEE=0 and IEEE=1. An overflow rounds like any other result (infinity, or the largest finite value when the mode rounds that sign toward zero). With f32 denormals flushed it flushes a subnormal input and result, measured over the same rows in each round mode at IEEE=0 only. A device whose driver splits `Fma` into a multiply and an add flushes a product below 2^-126 before adding a non-zero addend in `v_fma_f32` and `v_fmac_f32`: `0x1fffffff * 0x1fffffff + 0x00800000` gives `0x00800000` instead of the fused `0x00ffffff` on RADV RENOIR (Mesa 26.2.4), whose compiled shader has `v_mad_f32` and no `v_fma_f32`. [F32DenormalFlush](../../../core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp) accepts that sum on such a device. - [v_rcp, v_rsq, v_sqrt, v_log, v_exp, v_sin and v_cos](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (f32 and f16) use the driver's approximation for finite results, not the console's: the low bits can differ. Only NaN, invalid, zero and infinite results and the exact sin/cos zeros are chosen on the bits. Measured on RDNA2 (gfx1036) over every f16 input and 32,832 f32 inputs: RADV returns the hardware's bits for every input of rcp, rsq, sqrt and log and all but one of exp (f16 0x11c5, 1 ULP); NVIDIA (615.71.09) stays within 2 ULP except `v_log_f32` near 1.0 (next entry). [v_sin and v_cos](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) take the driver's sine or cosine of the radians of the exact cycle, except within 2^-12 of a turn from a zero of the function, where the result is the linear term of the exact distance to the zero: the hardware's constant 6.2831826 (0x40c90fd5) at the integers, which the hardware applies exactly to inputs below 2^-12 of a turn, and the f32 2π at the half and quarter turns, where the hardware is within 7 ULP of it. Outside those bands, a driver result more than 4 ULP from a Taylor series in turns of the exact cycle is replaced by the series, which is within 2 ULP of the true sine and cosine; the hardware is up to 9 ULP from them (gfx1035, 243,092 f32 inputs), so results stay within 13 ULP of the hardware on any driver. RADV returns the hardware's bits for every f16 input and for 32,422 sine and 32,486 cosine results of the 32,832 f32 inputs; the rest are 1 ULP off, except up to 14 ULP on either side of non-zero integers and up to 15 ULP beyond ±256 cycles, where the hardware's own reduction differs from the exact fraction, and up to 6 ULP inside the half- and quarter-turn bands. NVIDIA's own sine is within 1 ULP on 93% of the f32 inputs and up to 1,166 ULP off just outside the bands, its cosine within 163 ULP; the series replaces those results. A denormal f32 input with f32 denormals kept gives the hardware the input times 6.2831826; both hosts flush it. - [v_ldexp_f32 in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the `FLOAT_MODE` f32 denormal field: mode 1 keeps a subnormal input and flushes a result below 2^-126 to a zero of its sign in every f32 round mode, also one that rounds to 2^-126 at subnormal precision (`0x3fffffff` scaled by 2^-127); mode 2 flushes a subnormal input to a zero of its sign and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, as mode 3 does. Measured on RDNA2 (gfx1030, Radeon RX 6800, AMD Windows driver 32.0.21045.5002 through HIP) over 10,260 rows (54 inputs of both signs: zeros, subnormals, normals near 2^-126 and 1.0, the largest finite value, infinities and NaNs, each scaled by 190 exponents from -2^31 to 2^31-1) at IEEE=0 and IEEE=1 with each f32 denormal mode 0 to 3 and f32 round mode 0 to 3, DX10_CLAMP=1, f16 denormals kept, f16 round to nearest even and FP16_OVFL=0; with the `clamp` modifier the result is clamped as in the other modes. The PS5's gfx1013 is not measured. +- [32-bit denormal execution mode](../../../core/shader/recompiler/Recompiler.cpp) (shader recompiler) - the hardware f32 flush that the startup probe chooses (`DenormFlushToZero 32`) is declared only in shaders whose `FLOAT_MODE` flushes f32 denormals (field 0, or no known float mode). A shader that keeps them on either side (field 1, 2 or 3) declares `DenormPreserve 32` when the device has `shaderDenormPreserveFloat32` with a `denormBehaviorIndependence` other than NONE; on other devices it gets the driver's default f32 denormal handling, which flushes the denormals it keeps on MoltenVK. - [v_log_f32 and v_log_f16](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) keep the driver's log2 unless, for inputs within 1/8 of 1.0, it is more than 4 ULP from an eight-term series in x - 1, which then replaces it. `v_log_f16` goes through the same f32 lowering and is rounded to half. The series is evaluated for every `v_log` and chosen with `OpSelect` rather than a branch, so its seven fused multiply-adds and two multiplies are an unconditional cost. Measured on RDNA2 over all 3,145,728 f32 inputs within 1/8 of 1.0 (gfx1035, IEEE 0, f32 denormals flushed), the hardware is within 1 ULP of the correctly rounded log2 and the series within 2 ULP of it and within 3 ULP of the hardware (2 except at 0x3f752e47, 0x3f7baab0 and 0x3f7bc4fb), so a kept driver value is within 7 ULP of the hardware and a driver that returns the hardware's bits never triggers the gate; RADV (Mesa 26.2.4) returns the hardware's bits on the 9,280 such inputs measured on gfx1036; NVIDIA (615.71.09) was up to 23,947,836 ULP off at 1 - 2^-24 and is within 6 ULP inside the band after the change; outside it its own log2 stays up to 9 ULP off (measured up to 1.375). Over every f16 input, the change moves one `v_log_f16` result on NVIDIA (0x3bed, 1 ULP, onto the hardware's bits) and none on RADV. - [Ordered not-equal, less-than and greater-than compares](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) (shader recompiler) - `FPOrdNotEqual32` is emitted as `OpFUnordNotEqual`, and `FPOrdLessThan32` and `FPOrdGreaterThan32` as their ordered forms, each with both operands checked for NaN on their bits; the results are the same for every input. The AMD Windows driver 32.0.13058.8001 (Radeon 860M, RDNA 3.5) returns 1 for a NaN operand when any float form of not-equal feeds a ballot on a 32-wide subgroup (#825), and so does a less-than or greater-than against an infinity the driver sees as a constant (#3536), presumably rewritten into a not-equal by its compiler - [16-bit integer multiplies](../../../core/shader/recompiler/Translation/src/IntegerInstructions.cpp) (`v_mul_lo_u16`, `v_pk_mul_lo_u16`) (shader recompiler) - a factor taken from the low half of its source is read as the low 24 bits of the register, not the low 16; the low 16 bits of the product are the same for every input. The AMD Windows driver 32.0.21045.5002 (RX 6700 XT, RDNA 2) stores the full 32-bit product when two values it knows fit in 16 bits are multiplied, the product is reduced to 16 bits and nothing else is merged into the stored value: `v_mul_lo_u16` into a register whose high half is zero, also with factors masked to 16 bits by the program, and `v_pk_mul_lo_u16` whose high lanes are zero wrote 0xfffe0001 for 0xffff * 0xffff where the GPU writes 0x00000001. Reducing the product with `v_and_b32`, `v_bfe_u32` or a shift pair loses the same bits; factors read as 24-bit fields do not. The [constant folder](../../../core/shader/recompiler/Optimization/src/ConstantFolder.cpp) keeps a field read that a multiply uses, even when the program already masked the factor to 16 bits, since folding it away brings the full product back (#8271). Measured against the same instructions run through the [hardware oracle](../HW_ORACLE.md) on that GPU; other drivers are not checked From 63d39623e351bb536c525bd01ca2327e1e046fae Mon Sep 17 00:00:00 2001 From: milescoviello Date: Wed, 21 Oct 2026 16:09:50 +0000 Subject: [PATCH 012/113] fix(build): run guest_unused_import_dependencies without the ASan link order check The test loads guest_module_args_host into a relinked guest, so in an ANYPS5_ENABLE_ASAN build the ASan runtime is not first in the initial library list and the guest stops before it runs. The other relinker tests that load that host already take verify_asan_link_order=0 through add_asan_test_options; this one was added after them. Co-Authored-By: Claude Opus 5.5 --- core/relinker/CMakeLists.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt index fa78fbaa42..6d0a7af013 100644 --- a/core/relinker/CMakeLists.txt +++ b/core/relinker/CMakeLists.txt @@ -622,6 +622,7 @@ if(BUILD_TESTING) add_asan_test_options(guest_module_args verify_asan_link_order=0) add_asan_test_options(guest_deferred_dependencies verify_asan_link_order=0) add_asan_test_options(guest_module_fini verify_asan_link_order=0) + add_asan_test_options(guest_unused_import_dependencies verify_asan_link_order=0) add_test(NAME guest_needed_nested_modules COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_needed_nested_modules.py $) add_test(NAME guest_zero_initializer COMMAND ${Python3_EXECUTABLE} From 1f87b51ea5ad473e5a0b51b30f58d5ae3736f205 Mon Sep 17 00:00:00 2001 From: milescoviello Date: Wed, 21 Oct 2026 16:32:20 +0000 Subject: [PATCH 013/113] fix(agc): value-initialize a pipeline journal entry before decoding it parse() declared each LoadedEntry without an initializer. Several State members (hasColorTarget, topology, viewport, negativeOneToOne, cullMode, frontFace, blend) have no default member initializer, so the graphics recipe of a compute record, which is never decoded, held indeterminate values. Moving the entry into the loaded list then read them: UBSan reports "load of value 6, which is not a valid value for type 'bool'" in State's move constructor in agc_driver_pipeline_journal. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp index d0669ed238..e18e5bb667 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp @@ -621,7 +621,7 @@ private: if (decoded) loaded.indexModules.insert(identity); } else if (record.kind == GraphicsRecord || record.kind == ComputeRecord) { if (decode && !loaded.indexRecords.contains(record.payloadHash)) { - LoadedEntry entry; + LoadedEntry entry{}; entry.kind = record.kind; bool decoded = false; if (record.kind == GraphicsRecord) { From 90e0781dccfe010a1bf5e0271771338cc00ef381 Mon Sep 17 00:00:00 2001 From: milescoviello Date: Wed, 21 Oct 2026 16:35:13 +0000 Subject: [PATCH 014/113] test(agc): return a zero cancelling coordinate before taking its exponent The interpolation modes test rounds a generated value to half precision with std::ilogb(value) - 10. For a zero value std::ilogb returns FP_ILOGB0 (INT_MIN on Linux), so the subtraction overflows: UBSan reports a signed integer overflow in agc_driver_interpolation_modes. A zero is already a half value, so it is returned as is, as the wrapped result gave. Co-Authored-By: Claude Opus 5.5 --- .../prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp index 9c332e8aaa..913426408a 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp @@ -262,6 +262,7 @@ struct Generator { if (half) return bits; const auto value = std::bit_cast(bits); if (!std::isfinite(value) || std::fabs(value) > 65504.0f) return Half(); + if (value == 0.0f) return bits; const auto exponent = std::max(std::ilogb(value) - 10, -24); return std::bit_cast(static_cast(std::ldexp(std::nearbyint(std::ldexp(value, -exponent)), exponent))); } From 64675a3756f3614ab33bf7664704f25183d9ca21 Mon Sep 17 00:00:00 2001 From: klosixgaming-arch Date: Wed, 21 Oct 2026 17:22:39 +0000 Subject: [PATCH 015/113] fix(shader): require the phi arm table offset to dominate the table read When a table column pointer is read through a phi, the offset taken from one arm is substituted into the image handle after the merge. An offset computed inside an arm does not dominate that use, so planning now refuses it instead of producing an invalid module. Adds a case where each arm computes its own offset; it plans as a table on the previous head and is refused with this change. AI-assisted: yes. Written with AI assistance and reviewed by me. --- .../libSceAgcDriver/tests/ShaderMemory.cpp | 9 +++++++ .../Optimization/src/ResourceTracker.cpp | 24 +++++++++++++++++++ 2 files changed, 33 insertions(+) diff --git a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp index 058046a306..cc24a594d9 100644 --- a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp @@ -3487,6 +3487,15 @@ void verifyPointerChainImageTable() { auto nonTableRequest = TableRequest(nonTableCode, userData); nonTableRequest.shader.codeAddress = 0x3a000u; expectFailure([&] { static_cast(GetResourcePlan(nonTableRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi with a non-table branch was planned as a table"); + + auto armOffsetCode = code; + armOffsetCode.erase(armOffsetCode.begin() + 14, armOffsetCode.begin() + 17); + armOffsetCode.insert(armOffsetCode.begin() + 14, { + 0xbf068010u, 0xbf850004u, 0x8f128411u, 0xf4240b02u, 0x24000008u, 0xbf820003u, 0x8f128411u, 0xf4240b02u, 0x24000008u + }); + auto armOffsetRequest = TableRequest(armOffsetCode, userData); + armOffsetRequest.shader.codeAddress = 0x3b000u; + expectFailure([&] { static_cast(GetResourcePlan(armOffsetRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi whose arms compute their own table offset was planned as a table"); } void verifyDescriptorPhis() { diff --git a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp index ceb8017633..04d2be4845 100644 --- a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp +++ b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp @@ -732,6 +732,27 @@ private: return candidate; } + bool BlockDominates(const IrBlock* dominator, const IrBlock* block) const { + if (dominator == block) return true; + std::vector pending{block}; + std::unordered_set visited{block}; + while (!pending.empty()) { + const IrBlock* current = pending.back(); + pending.pop_back(); + if (current->Predecessors().empty()) return false; + for (const IrBlock* predecessor : current->Predecessors()) { + if (predecessor != dominator && visited.insert(predecessor).second) pending.push_back(predecessor); + } + } + return true; + } + + bool AvailableAt(IrValue* value, const IrBlock* block) const { + value = value->Resolve(); + if (value->HasImmediate() || value->Parent() == nullptr) return true; + return BlockDominates(value->Parent(), block); + } + bool TryMakeIndirectColumn(IrValue& handle, IrValue& descriptorPointer, bool sampler, std::uint32_t words, std::uint32_t descriptorOffset, std::uint32_t descriptorImmediate, TableColumnPlan& plan) { std::vector hops; IrValue* pointer = &descriptorPointer; @@ -786,6 +807,9 @@ private: return false; } } + if (!AvailableAt(offset, handle.Parent())) { + return false; + } IrValue* key = nullptr; std::uint32_t stride = 0; std::uint32_t addend = 0; From 03fae5dfcbc966a96c365db7c2ba619592703dce Mon Sep 17 00:00:00 2001 From: wail-arch <116732676+wail-arch@users.noreply.github.com> Date: Wed, 21 Oct 2026 18:06:47 +0000 Subject: [PATCH 016/113] fix(relinker): bind SDK guest module imports on Linux A bundled module that names a console file dependency (.sprx, .suprx, .debug_prx) imports by symbol name, as homebrew built with the ps5-payload-dev SDK does. Bind those imports to the NID of the name, except names another bundled module or the executable exports, and name the module's host dependencies with the .prx library of the same stem. --- core/relinker/CMakeLists.txt | 4 + .../include/relinker/guest/GuestImage.hpp | 1 + .../relinker/src/guest/GuestImageReader.cpp | 3 + .../relinker/src/guest/GuestModuleBuilder.cpp | 37 +++++- .../tests/test_linux_guest_named_imports.py | 125 ++++++++++++++++++ docs/dev/debt/relinker.md | 2 +- 6 files changed, 168 insertions(+), 4 deletions(-) create mode 100644 core/relinker/relinker/tests/test_linux_guest_named_imports.py diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt index 9b9c265029..e2070ec8e4 100644 --- a/core/relinker/CMakeLists.txt +++ b/core/relinker/CMakeLists.txt @@ -637,6 +637,10 @@ if(BUILD_TESTING) $ $) set_tests_properties(guest_zero_initializer PROPERTIES TIMEOUT 30) add_asan_test_options(guest_zero_initializer verify_asan_link_order=0) + add_test(NAME linux_guest_named_imports COMMAND ${Python3_EXECUTABLE} + ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_guest_named_imports.py + $ $) + add_asan_test_options(linux_guest_named_imports verify_asan_link_order=0) set(windows_stdio_host_arguments) if(WIN32) if(MINGW) diff --git a/core/relinker/relinker/include/relinker/guest/GuestImage.hpp b/core/relinker/relinker/include/relinker/guest/GuestImage.hpp index 6be45157af..8fe4507a89 100644 --- a/core/relinker/relinker/include/relinker/guest/GuestImage.hpp +++ b/core/relinker/relinker/include/relinker/guest/GuestImage.hpp @@ -57,6 +57,7 @@ struct GuestImage { std::uint64_t Got = 0; bool UsePlatformTlsResolver = true; bool Symbolic = false; + std::vector NamedImports; }; class GuestImageReader { diff --git a/core/relinker/relinker/src/guest/GuestImageReader.cpp b/core/relinker/relinker/src/guest/GuestImageReader.cpp index a630010692..c596636aa2 100644 --- a/core/relinker/relinker/src/guest/GuestImageReader.cpp +++ b/core/relinker/relinker/src/guest/GuestImageReader.cpp @@ -162,6 +162,8 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector if (!importModules.emplace(value >> 48, string(value & 0xffffffffu)).second) fail("Duplicate import module ID"); std::vector neededLibraries; for (const auto offset : needed) neededLibraries.push_back(string(offset)); + const bool consoleFileNames = std::any_of(neededLibraries.begin(), neededLibraries.end(), + [](const std::string& name) { return Domain::NeededLibraryName(name) != name; }); std::map exports; for (std::uint64_t offset = 0; offset < symSize; offset += 24) { auto name = string(Io::ReadU32(bytes, symOffset + offset)); @@ -195,6 +197,7 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector if (image.Dynamic.DynStrData.size() > std::numeric_limits::max()) fail("String table too large"); Io::WriteU32(image.Dynamic.DynSymData, offset, static_cast(image.Dynamic.DynStrData.size())); Io::AppendString(image.Dynamic.DynStrData, name); + if (consoleFileNames && section == 0 && !name.empty() && name == qualifiedName) image.NamedImports.push_back(image.Symbols.size()); image.Symbols.push_back(symbol); } if (tags.contains(14)) { diff --git a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp index 1ffd34e19d..6940d43210 100644 --- a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp +++ b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp @@ -6,6 +6,7 @@ #include #include #include +#include #include #include #include @@ -42,6 +43,33 @@ std::vector ReadNeededNames(const Domain::SysVDynamicSection& dynam return names; } +std::string SymbolName(const Domain::SysVDynamicSection& dynamic, const std::size_t index) { + if (dynamic.DynSymData.size() % 24 != 0 || index >= dynamic.DynSymData.size() / 24) throw Domain::RelinkerException("Invalid symbol index"); + const auto nameOffset = Io::ReadU32(dynamic.DynSymData, index * 24); + if (nameOffset >= dynamic.DynStrData.size()) throw Domain::RelinkerException("Invalid symbol name offset"); + const auto start = dynamic.DynStrData.begin() + nameOffset; + const auto end = std::find(start, dynamic.DynStrData.end(), 0); + if (end == dynamic.DynStrData.end()) throw Domain::RelinkerException("Unterminated symbol name"); + return std::string(start, end); +} + +std::set DefinedNames(const Domain::SysVDynamicSection& dynamic) { + std::set names; + for (std::size_t index = 1; index < dynamic.DynSymData.size() / 24; ++index) + if (Io::ReadU16(dynamic.DynSymData, index * 24 + 6) != 0) names.insert(SymbolName(dynamic, index)); + return names; +} + +void BindNamedImportsByNid(GuestImage& image, const std::set& kept) { + for (const auto index : image.NamedImports) { + const auto name = SymbolName(image.Dynamic, index); + if (name.ends_with(GuestSymbolSuffix) || kept.contains(name)) continue; + if (image.Dynamic.DynStrData.size() > std::numeric_limits::max()) throw Domain::RelinkerException("Guest string table too large"); + Io::WriteU32(image.Dynamic.DynSymData, index * 24, static_cast(image.Dynamic.DynStrData.size())); + Io::AppendString(image.Dynamic.DynStrData, Nid::ComputeNid(name, "")); + } +} + std::string FoldFilename(std::string name) { for (auto& character : name) if (character >= 'A' && character <= 'Z') character = static_cast(character + ('a' - 'A')); return name; @@ -292,12 +320,14 @@ std::vector GuestModuleBuilder::Build(const std::filesystem::path return directory == "." ? std::string("app0") : "app0/" + directory; }; if (!windows) { + const auto executableExports = macos ? std::set{} : DefinedNames(dynamic); for (auto& image : images) { for (std::size_t index = 1; index < image.Symbols.size(); ++index) { const auto& symbol = image.Symbols[index]; const bool exported = symbol.Section != 0 && (symbol.Info >> 4) != 0 && symbol.Visibility != 1 && symbol.Visibility != 2; if (((symbol.Section == 0 && !declaresHost(symbol.Library)) || exported) && exports.contains(symbol.Name)) rename(image.Dynamic.DynSymData, image.Dynamic.DynStrData, index, symbol.Name); } + if (!macos) BindNamedImportsByNid(image, executableExports); } } std::vector order; @@ -314,17 +344,18 @@ std::vector GuestModuleBuilder::Build(const std::filesystem::path std::vector hostLibraries; std::vector> moduleHostLibraries(images.size()); std::set uniqueHosts; + const auto hostLibrary = [&](const std::string& name) { return windows || macos ? name : Domain::NeededLibraryName(name); }; const auto addHost = [&](const std::string& name, const bool startup) { if (findGuest(name) != guestNames.end()) return; if (name.empty() || name.find_first_of("/\\:$") != std::string::npos) throw Domain::RelinkerException("Invalid host dependency: " + name); - if (startup && uniqueHosts.insert(name).second) hostLibraries.push_back(name); + if (const auto host = hostLibrary(name); startup && uniqueHosts.insert(host).second) hostLibraries.push_back(host); }; for (const auto& name : neededNames) addHost(name, true); for (std::size_t index = 0; index < images.size(); ++index) { auto& hosts = moduleHostLibraries[index]; for (const auto& dependency : images[index].Dependencies) { addHost(dependency, windows || !deferred(index)); - if (findGuest(dependency) == guestNames.end()) hosts.push_back(dependency); + if (findGuest(dependency) == guestNames.end()) hosts.push_back(hostLibrary(dependency)); } if (!windows && !macos && images[index].HasInit) { if (std::find(hosts.begin(), hosts.end(), "libkernel.prx") == hosts.end()) hosts.push_back("libkernel.prx"); @@ -425,7 +456,7 @@ std::vector GuestModuleBuilder::Build(const std::filesystem::path dynamic.GuestModules.push_back(std::move(runtime)); std::vector neededLibraries; for (const auto& name : image.Dependencies) - if (findGuest(name) == guestNames.end()) neededLibraries.push_back(name); + if (findGuest(name) == guestNames.end()) neededLibraries.push_back(hostLibrary(name)); artifacts.push_back({target, std::move(output), std::move(imports), image.SourcePath, std::move(neededLibraries)}); progress.Report({Domain::ProgressStage::Modules, Io::Utf8Path(image.SourcePath), artifacts.size(), order.size()}); } diff --git a/core/relinker/relinker/tests/test_linux_guest_named_imports.py b/core/relinker/relinker/tests/test_linux_guest_named_imports.py new file mode 100644 index 0000000000..86f36b1236 --- /dev/null +++ b/core/relinker/relinker/tests/test_linux_guest_named_imports.py @@ -0,0 +1,125 @@ +import os +from pathlib import Path +import platform +import shutil +import struct +import subprocess +import sys +import tempfile + +sys.path.insert(0, str(Path(__file__).resolve().parent / "macos")) + +from guest_import_fixtures import executable +from nid import nid +from test_guest_deferred_dependencies import page_aligned +from test_guest_intel_trampolines import main_fixture +from test_guest_module_directories import needed_libraries +from test_guest_needed_modules import module_with_needed +from test_guest_symbol_names import guest_module, imported_symbols, module_symbols, relink +from test_linux_load_alignment import fixture +from test_windows_import_modules import consumer + +PROVIDER = "int provided(void) __asm__(\"\\\"%s\\\"\");\nint provided(void) { return 22; }\n" + + +def guest_with_needed(symbols, needed): + image = guest_module(symbols) + size, = struct.unpack_from("" in its code, and in SuperTuxKart (PPSA69421) and Mortalfin (PPSA99141) the `jae` read from "sf" points into the VEX prefix of a 256-bit store. A direct branch target inside a scanned instruction counts only where every byte before it is a legacy prefix or REX, which a real branch can skip (a `lock` prefix, for example); a target in a VEX prefix, opcode or operand is ignored, as a jump-table entry that starts no instruction already is. A real branch to such a target, overlapping instructions as hand-written code can, is not seen, and the instruction it enters can be moved. - A `PT_SCE_RELRO` segment that no `PT_LOAD` covers, the PS4 layout, is [loaded](../../../core/relinker/relinker/src/parsing/ElfReader.cpp) as a read-write `PT_LOAD` and stays writable after relocation; FreeBSD rtld makes `PT_GNU_RELRO` read-only once relocation is done, and what the console does with `PT_SCE_RELRO` is not checked. From 78bfaba736ea2739d3fe9a32091765ad800b55f5 Mon Sep 17 00:00:00 2001 From: Queuze <58829992+lucaslima430@users.noreply.github.com> Date: Wed, 21 Oct 2026 06:01:33 -0300 Subject: [PATCH 017/113] test(relinker): exercise kernel variant imports --- core/relinker/CMakeLists.txt | 8 ++ .../test_windows_kernel_variant_imports.py | 77 +++++++++++++++++++ 2 files changed, 85 insertions(+) create mode 100644 core/relinker/relinker/tests/test_windows_kernel_variant_imports.py diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt index fa78fbaa42..6f95673303 100644 --- a/core/relinker/CMakeLists.txt +++ b/core/relinker/CMakeLists.txt @@ -666,6 +666,14 @@ if(BUILD_TESTING) add_test(NAME windows_import_modules COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_import_modules.py $ ${windows_stdio_host_arguments}) + if(WIN32) + foreach(kernelVariant IN ITEMS sys web) + add_test(NAME windows_kernel_variant_${kernelVariant} COMMAND ${Python3_EXECUTABLE} + ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_kernel_variant_imports.py + $ libkernel_${kernelVariant}.prx) + set_tests_properties(windows_kernel_variant_${kernelVariant} PROPERTIES TIMEOUT 30) + endforeach() + endif() add_test(NAME elf_header COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_elf_header.py $) add_test(NAME weak_imports COMMAND ${Python3_EXECUTABLE} diff --git a/core/relinker/relinker/tests/test_windows_kernel_variant_imports.py b/core/relinker/relinker/tests/test_windows_kernel_variant_imports.py new file mode 100644 index 0000000000..2335566e12 --- /dev/null +++ b/core/relinker/relinker/tests/test_windows_kernel_variant_imports.py @@ -0,0 +1,77 @@ +import os +import subprocess +import sys +import tempfile +from pathlib import Path + +from guest_import_fixtures import executable +from test_windows_import_modules import provider + + +def main(): + assert os.name == 'nt', 'This test executes Windows startup stubs' + relinker = Path(sys.argv[1]).resolve() + variant = sys.argv[2] + assert variant in ('libkernel_sys.prx', 'libkernel_web.prx') + with tempfile.TemporaryDirectory(prefix='anyps5-kernel-variant-') as directory: + work = Path(directory) + modules = work / 'helpers' / 'prx' + modules.mkdir(parents=True) + for name, value in (('variant', 11), ('canonical', 22), ('runtime', 33), ('guest', 44)): + (modules / (name + '.prx')).write_bytes(provider(value)) + empty = provider(0) + empty[0x800:0x80c] = b'\0other#A#B\0\0' + (modules / 'empty.prx').write_bytes(empty) + source = modules.parent / 'input.elf' + source.write_bytes(executable('variant.prx', 'shared#A#B')) + result = subprocess.run([str(relinker), '--windows', str(source), str(modules.parent / 'output.exe')], + capture_output=True, text=True, timeout=30) + assert result.returncode == 0, result.stderr + converted = modules.parent / 'app0' / 'prx' + images = {name: (converted / (name + '.prx.guest.prx')).read_bytes() + for name in ('variant', 'canonical', 'runtime', 'guest', 'empty')} + cases = ( + ('runtime-fallback', 'empty', 'empty', 'runtime', 33), + ('variant-first', 'variant', 'canonical', 'runtime', 11), + ('canonical-before-runtime', 'empty', 'canonical', 'runtime', 22), + ('missing', 'empty', 'empty', 'empty', None), + ('guest-isolation', 'empty', 'empty', 'runtime', 33), + ('guest-cannot-fill-missing', 'empty', 'empty', 'empty', None), + ('unrelated-host', 'empty', 'empty', 'empty', None), + ('guest-requested-variant', 'variant', 'canonical', 'runtime', 44), + ('unqualified', 'variant', 'canonical', 'runtime', 11), + ) + for label, requested, canonical, runtime, expected in cases: + case = work / label + libraries = case / 'libs' + libraries.mkdir(parents=True) + (case / 'prx').mkdir() + for name, image in ((variant, requested), ('libkernel.prx', canonical), ('libc.prx', runtime)): + (libraries / name).write_bytes(images[image]) + if label.startswith('guest-'): + guests = case / 'sce_module' + guests.mkdir() + names = (variant,) if label == 'guest-requested-variant' else ('libkernel.prx', 'libc.prx') + for name in names: + (guests / name).write_bytes(provider(44)) + extra = ('unrelated.prx',) if label == 'unrelated-host' else () + if extra: + (libraries / extra[0]).write_bytes(images['guest']) + source = case / 'input.elf' + symbol = 'shared' if label == 'unqualified' else 'shared#A#B' + source.write_bytes(executable(variant, symbol, extra_dependencies=extra)) + output = case / 'output.exe' + result = subprocess.run([str(relinker), '--windows', str(source), str(output)], + capture_output=True, text=True, timeout=30) + assert result.returncode == 0, (variant, label, result.stderr) + result = subprocess.run([str(output)], capture_output=True, text=True, timeout=30) + if expected is None: + assert result.returncode & 0xffffffff == 0xc0000139, (label, result.returncode, result.stderr) + assert 'unresolved ELF import shared' in result.stderr, (label, result.stderr) + else: + assert result.returncode == expected, (variant, label, result.returncode, result.stderr) + print(variant + ': runtime, precedence and isolation checks passed') + + +if __name__ == '__main__': + main() From 789a5f686ffd1c26ba83c6de412ebbb27d23608f Mon Sep 17 00:00:00 2001 From: Evgeniy Kazarin Date: Sun, 18 Oct 2026 06:28:39 +0300 Subject: [PATCH 018/113] perf(agc): defer small host imports until first GPU use --- .../Graphics/src/GuestBufferMemory.cpp | 5 ++- .../prx/libSceAgcDriver/tests/Recorder.cpp | 2 +- .../tests/execution/HostImportWindows.cpp | 44 +++++++++++++++++++ 3 files changed, 48 insertions(+), 3 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp index 074681e607..053fb10c01 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp @@ -3441,10 +3441,11 @@ bool ImportMappedRanges(const Context& context, const GuestAllocations::Mapped& } else if (state.refreshedGeneration > generation) { return true; } - if (!adopting) current = GuestAllocations::GuestAllocationsAcquire_nid_postfix(); for (const auto& mapped : ranges) { const auto range = mapped.lock(); - if (range == nullptr || leasedRangeOwner(current, range->address) != range) continue; + if (range == nullptr || range->bytes <= 0x10000) continue; + if (current.empty()) current = GuestAllocations::GuestAllocationsAcquire_nid_postfix(); + if (leasedRangeOwner(current, range->address) != range) continue; try { if (!GuestMemory::GpuMutex().HeldByThisThread()) { const auto run = importRun(current, range->address, std::numeric_limits::max(), effectiveBudget(context, state)); diff --git a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp index 97f02e7f2f..45df34ee97 100644 --- a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp @@ -2371,7 +2371,7 @@ void remappedImportTests(const Device& device) { void hostImportRetirementTests(const Device& device) { const auto& context = device.GetContext(); - constexpr std::size_t UnitBytes = 65536; + constexpr std::size_t UnitBytes = 2 * 65536; constexpr std::size_t AllocationBytes = 4 * UnitBytes; constexpr std::size_t CopyBytes = 256; #ifdef _WIN32 diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp index e6d9bd6b30..35e4f777cd 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp @@ -21,6 +21,14 @@ #include #include +namespace AgcDriver { + +struct VulkanDeviceTestAccess { + static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); } +}; + +} + namespace { namespace Graphics = AgcDriver::Graphics; @@ -163,6 +171,41 @@ Outcome ResidentMappingsImportAfterCollection() { return Outcome::Passed; } +Outcome SmallMappingsImportOnFirstUse() { + GuestBlock small(GuestAlignment); + GuestBlock large(2 * GuestAlignment); + auto device = OpenVulkanTestDevice(); + if (!device) return Outcome::NoDevice; + const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(*device); + if (context.hostImportAlignment == 0) return Outcome::NoImport; + for (auto* guest : {&small, &large}) { + Graphics::ClearHostImports(device->Device()); + GuestAllocations::Mapped ranges; + for (const auto& range : GuestAllocations::GuestAllocationsAcquire_nid_postfix()) { + if (range->address == guest->Address()) ranges.push_back(range); + } + Require(ranges.size() == 1, "mapped import test lost its registered range"); + { + std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex()); + Require(Graphics::ImportMappedRanges(context, ranges, GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true), "mapped import test could not adopt the device"); + } + Require(Graphics::HostImportCovers(context, guest->Address(), ProbeBytes) == (guest == &large), "mapping did not defer exactly the small import"); + Require(Fill(*device, guest->Address()), "first GPU use could not import the mapped buffer"); + Require(Graphics::HostImportCovers(context, guest->Address(), ProbeBytes), "first GPU use left the mapped buffer unimported"); + constexpr std::array pattern{0x11111111u, 0x22222222u, 0x33333333u, 0x44444444u}; + for (std::size_t offset = 0; offset < ProbeBytes; offset += sizeof(std::uint32_t)) { + std::uint32_t actual = 0; + std::memcpy(&actual, guest->Data() + offset, sizeof(actual)); + Require(actual == pattern[(offset / sizeof(actual)) % pattern.size()], "first GPU use changed the fill result"); + } + for (std::size_t offset = ProbeBytes; offset < GuestAlignment; ++offset) { + Require(guest->Data()[offset] == 0, "first GPU use overwrote bytes outside the fill"); + } + } + Graphics::ClearHostImports(device->Device()); + return Outcome::Passed; +} + } int main() { @@ -176,6 +219,7 @@ int main() { const auto windows = WindowsFollowTheirRange(); Require(windows == Outcome::Passed, "host import windows: the device stopped importing guest memory between two scenarios"); Require(ResidentMappingsImportAfterCollection() == Outcome::Passed, "resident import test failed"); + Require(SmallMappingsImportOnFirstUse() == Outcome::Passed, "mapped import test lost its Vulkan device or host import support"); std::puts("host import windows tests passed"); return 0; } catch (const std::exception& error) { From e0764b9e14cb9eece34c9807c0098b75d7613766 Mon Sep 17 00:00:00 2001 From: Evgeniy Kazarin Date: Wed, 21 Oct 2026 10:18:44 +0800 Subject: [PATCH 019/113] test(agc): map-time import tests for ranges of 64 KiB left to first GPU use The import-requester test now counts the map requester on a 128 KiB range and asserts that a 64 KiB range is not imported at map time and is imported, for the access requester, at its first use. The over-budget map test maps 128 KiB so it still reaches the budget check. Co-Authored-By: Claude Opus 5.5 --- .../libSceAgcDriver/tests/BdaResources.cpp | 31 +++++++++++++++---- 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp index e4ea60da83..324c9bf90e 100644 --- a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp @@ -979,7 +979,7 @@ void importNeighbouringEdgesTests(const Context& context) { // A range mapped while the imports are at the budget is refused at map time without retiring an import: the map // observer holds no GPU lock, so it must not evict (before, it evicted the least recently used import to fit). void importAtMapOverBudgetTests(const Context& context) { - constexpr std::size_t bytes = 65536; + constexpr std::size_t bytes = 2 * 65536; auto importing = context; importing.hostImportAlignment = bytes; void* kept = ::operator new(bytes, std::align_val_t{bytes}); @@ -1039,17 +1039,32 @@ void importRequesterTests(const Context& context, const BdaTestAccess& access) { const auto counted = [](ImportRequester requester) { return HostImportCounters().requesters[static_cast(requester)]; }; const auto made = [&](ImportRequester requester) { return counted(requester).made; }; Require(std::string(ImportRequesterName(ImportRequester::Map)) == "map" && std::string(ImportRequesterName(ImportRequester::Build)) == "build" && std::string(ImportRequesterName(ImportRequester::Access)) == "access" && std::string(ImportRequesterName(ImportRequester::Join)) == "join" && std::string(ImportRequesterName(ImportRequester::Segment)) == "segment", "an import requester has the wrong name"); - change(0, true); - { + const auto mappedRange = [&](std::size_t index) { GuestAllocations::Mapped ranges; const auto lease = GuestAllocations::GuestAllocationsAcquire_nid_postfix(); for (const auto& range : lease) { - if (range->address == address(0)) ranges.push_back(range); + if (range->address == address(index)) ranges.push_back(range); } Require(ranges.size() == 1, "the requester test's mapped range is not registered"); + return ranges; + }; + { + GuestAllocations::Mutation mutation; + mutation.Add(block + 6 * piece, 2 * piece, true, true, true); + } + { const auto before = made(ImportRequester::Map); - static_cast(ImportMappedRanges(importing, ranges, GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true)); - Require(made(ImportRequester::Map) == before + 1 && HostImportCovers(importing, address(0), piece), "a range imported at map time was not counted for the map requester"); + static_cast(ImportMappedRanges(importing, mappedRange(6), GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true)); + Require(made(ImportRequester::Map) == before + 1 && HostImportCovers(importing, address(6), 2 * piece), "a range imported at map time was not counted for the map requester"); + } + change(0, true); + { + const auto map = made(ImportRequester::Map); + const auto access = made(ImportRequester::Access); + static_cast(ImportMappedRanges(importing, mappedRange(0), GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true)); + Require(made(ImportRequester::Map) == map && !HostImportCovers(importing, address(0), 16), "a range of 64 KiB was imported at map time"); + Require(HostImportFor(importing, address(0), 16) != nullptr && HostImportCovers(importing, address(0), piece) && made(ImportRequester::Access) == access + 1 && made(ImportRequester::Map) == map, + "a range of 64 KiB left to its first GPU use was not imported there, or not counted for that use's requester"); } change(1, true); { @@ -1127,6 +1142,10 @@ void importRequesterTests(const Context& context, const BdaTestAccess& access) { const auto counts = HostImportCounters(); Require(counts.live >= 4 && counts.liveBytes == HostImportLiveBytes(), "the live import counts disagree with the live bytes"); for (std::size_t index = 0; index < 6; ++index) change(index, false); + { + GuestAllocations::Mutation mutation; + mutation.Remove(block + 6 * piece); + } ClearHostImports(importing.device); ::operator delete(block, std::align_val_t{piece}); } From a1cee90f52ccfa025b6a2b152b4795f7a310fe67 Mon Sep 17 00:00:00 2001 From: Evgeniy Kazarin Date: Thu, 22 Oct 2026 08:57:01 +0800 Subject: [PATCH 020/113] test(agc): keep the map-failure memo test on a range imported at map time importMappedFailureGenerationTests (#8802) maps a single 64 KiB range and expects ImportMappedRanges to try its import. Ranges of 64 KiB are now left to their first GPU use, so the probe saw no allocation. The fixture maps 128 KiB as one window, which is still imported at map time. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp index 324c9bf90e..0f28c680cd 100644 --- a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp @@ -809,7 +809,7 @@ private: void importMappedFailureGenerationTests(const Context& context) { ClearHostImports(context.device); - WindowedRange range(context, WindowedRange::piece, 1); + WindowedRange range(context, 2 * WindowedRange::piece, 1); ImportAllocationProbe probe(range.importing); probe.failure = VK_ERROR_INVALID_EXTERNAL_HANDLE; GuestAllocations::Mapped mapped; From e0c67af31f40c1117d779f6c5cb96aeda31453c8 Mon Sep 17 00:00:00 2001 From: frankea Date: Thu, 22 Oct 2026 05:13:05 -0400 Subject: [PATCH 021/113] fix(agc): accept DB_EQAA INTERPOLATE_COMP_Z for a one-sample depth target without MSAA_ENABLE A one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is drawn as one sample at the pixel center, but DB_EQAA INTERPOLATE_COMP_Z threw on it. Gran Turismo 7 (PPSA01317) draws its 3840x2160 main pass this way after its EQAA pass (PA_SC_AA_CONFIG 0x0020c002, PA_SC_MODE_CNTL_0 0x2, DB_EQAA 0x00050000, a Z_32_FLOAT depth target with one sample) and stops on it. On this path every sample is taken to be at the pixel center, so Z interpolated to any sample position is the center's Z, which the one-sample draw already tests and writes. INTERPOLATE_COMP_Z is now accepted there. INTERPOLATE_SRC_Z and overrasterization still throw. Neither PAL nor radeonsi sets the bit and its meaning is not documented, so the debt entry records this as the same inference. --- core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp | 2 +- core/libs/prx/libSceAgcDriver/tests/Graphics.cpp | 9 +++++++-- docs/dev/debt/libSceAgcDriver.md | 2 +- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp index 44bc19a7d6..a875a68d6b 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp @@ -1327,7 +1327,7 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) { if (depthKeepsSampleZero && (read(cx, 0x292) & 1u) == 0) { const bool filled = result.topology != VK_PRIMITIVE_TOPOLOGY_POINT_LIST && result.topology != VK_PRIMITIVE_TOPOLOGY_LINE_LIST && result.topology != VK_PRIMITIVE_TOPOLOGY_LINE_STRIP; const auto sampleInputs = read(cx, 0x1b3) & read(cx, 0x1b4) & (ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage)); - Require(filled && !result.alphaToCoverage && (PixelProgramSkipped(queue) || sampleInputs == 0) && (read(cx, 0x203) & 0x100u) == 0 && (read(cx, 0x201) & 0x0f0c0000u) == 0, "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index or coverage input, a sample-mask export, or DB_EQAA Z interpolation or overrasterization"); + Require(filled && !result.alphaToCoverage && (PixelProgramSkipped(queue) || sampleInputs == 0) && (read(cx, 0x203) & 0x100u) == 0 && (read(cx, 0x201) & 0x0f080000u) == 0, "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index or coverage input, a sample-mask export, or DB_EQAA source Z interpolation or overrasterization"); result.samples = 1; result.customSampleLocations = false; result.sampleLocations.fill(0); diff --git a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp index 9f97985dcf..37c0446ee4 100644 --- a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp @@ -831,7 +831,7 @@ void msaaEnableClearOneSampleTargetTests() { queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage); Require(AgcDriver::Graphics::PixelProgramSkipped(queue), "the depth-only draw did not skip its pixel program"); requireOneSampleDepth(queue, 0, "a one-sample depth target whose skipped pixel program has PS_ITER_SAMPLE and sample index and coverage inputs"); - constexpr std::string_view depthRefused = "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index or coverage input, a sample-mask export, or DB_EQAA Z interpolation or overrasterization"; + constexpr std::string_view depthRefused = "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index or coverage input, a sample-mask export, or DB_EQAA source Z interpolation or overrasterization"; for (const bool color : {false, true}) { for (const auto input : {ShaderRecompiler::PixelInput::Ancillary, ShaderRecompiler::PixelInput::SampleCoverage}) { queue = depthTarget(color); @@ -857,7 +857,12 @@ void msaaEnableClearOneSampleTargetTests() { queue = depthTarget(color); queue.userConfig[0x242] = 2; expectFailure([&] { DecodeState(queue); }, depthRefused); - for (const auto eqaa : {0x00050002u, 0x00090002u, 0x01010002u, 0x08010002u}) { + for (const auto eqaa : {0x00040000u, 0x00050000u}) { + queue = depthTarget(color); + queue.context[0x201] = eqaa; + requireOneSampleDepth(queue, color ? 1u : 0u, "a one-sample depth target under a 4x PA_SC_AA_CONFIG without MSAA_ENABLE with DB_EQAA INTERPOLATE_COMP_Z"); + } + for (const auto eqaa : {0x00090002u, 0x000d0000u, 0x01010002u, 0x08010002u}) { queue = depthTarget(color); queue.context[0x201] = eqaa; expectFailure([&] { DecodeState(queue); }, depthRefused); diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md index baec5ded56..d1ae439ebf 100644 --- a/docs/dev/debt/libSceAgcDriver.md +++ b/docs/dev/debt/libSceAgcDriver.md @@ -32,7 +32,7 @@ - [Point-list geometry output](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a geometry program with `VGT_GS_OUT_PRIM_TYPE = 0` (point list) runs as a mesh shader with `OutputPoints` and scalar `PrimitivePointIndicesEXT`. Each primitive export emits one point whose vertex index is extracted from bits [8:0] of the packed word. A subgroup gets up to `maxVertices` points, with provoking vertex 0 and point raster primitive topology. Rectangle lists, per-stream types and point or line strips from a vertex program on the mesh path still throw. - [Line-strip geometry output](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a geometry program with `VGT_GS_OUT_PRIM_TYPE = 1` (line strip) runs as a mesh shader with `OutputLinesEXT`: each primitive export is one line whose two vertex indices are packed like the three of a triangle, as Mesa's NGG lowering exports line strips (`ac_nir_lower_ngg_gs.c`), and each input primitive gets `VGT_GS_MAX_VERT_OUT - 1` lines where a triangle strip gets `- 2` triangles. A subgroup gets at least `GE_MAX_OUTPUT_PER_SUBGROUP` line slots; whether the console does the same is unmeasured. A fast-launch subgroup takes its line count from `GE_NGG_SUBGRP_CNTL.PRIM_AMP_FACTOR`. Line output counts as lines for polygon offset decode. The lines are drawn 1 pixel wide with Vulkan default rasterization; `PA_SU_LINE_CNTL` is not read, and console line rules are not measured. - [Alpha-to-coverage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - only `DB_ALPHA_TO_MASK = 0xaa01` is accepted: the enable bit with the four quad offsets at 2 and no `OFFSET_ROUND`, the undithered setting [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/gallium/drivers/radeonsi/si_state.c#L371-L381) programs. Draws are single-sampled, so the pixel shader [writes](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) `SampleMask` 0 when its MRT0 alpha is below one half or NaN and all ones otherwise, and runs with late fragment tests. That rule was measured on a Radeon 660M (gfx1035, RADV with `RADV_DEBUG=noatocdithering`, which programs the same register) for 0, -0, 0.25, the two floats below one half, one half, the two above, 0.75, 1, 2, -1, both infinities and both NaNs, and is pinned in [AlphaToCoverage.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp); it is not measured on gfx1013. Vulkan's `alphaToCoverageEnable` is not used: the NVIDIA driver 615.78.08 dithers single-sample coverage (an alpha of 0.25 writes half the pixels of an RTX 3050 Laptop target). Other offsets, `OFFSET_ROUND`, a sample-mask export, and an MRT0 that is missing, swizzled, packed or exported without a floating-point alpha throw. A draw without a color target on MRT0 keeps alpha-to-coverage from its MRT0 export, as [radeonsi exports MRT0 as `32_AR` for alpha-to-coverage without a color buffer](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state_shaders.cpp#L2425-L2431). A draw that enables alpha-to-coverage with no MRT0 export still throws: what the console covers then is not measured. Default dithered `DB_ALPHA_TO_MASK = 0x18701` additionally uses a per-quad sample-mask table [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/4451#issuecomment-6124848921) for eight standard samples with FP16_ABGR or 32_ABGR exports; other sample counts, custom locations, EQAA combinations and dithered UNORM16/SNORM16 exports throw. The dithered rule is not measured on gfx1013. -- [A one-sample target under a multisampled rasterizer without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear, one-sample color targets and no depth target, or a one-sample depth target with no color target or one-sample color targets, is drawn as a one-sample draw at the pixel center. Without the bit every sample is taken to be at the pixel center (see the entry for a multisampled target rasterized without MSAA_ENABLE below), and a one-sample target is taken to keep the coverage of sample 0, so a one-sample depth target is tested and written once per pixel with the depth at the pixel center. That is the rule [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516) gives a color target with fewer samples than the rasterizer, but Vulkan reaches it only beside a depth or stencil target with the rasterizer's sample count ([VUID-VkGraphicsPipelineCreateInfo-subpass-01505](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/pipelines.adoc#L3033-L3041)), so here it is an analogy, and for a one-sample depth target an extension of it. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_graphics_pipeline.cpp#L127-L128) also rasterizes with the largest sample count of the bound depth and color targets ([L416-L417](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L416-L417), [L477-L480](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L477-L480)), and reads `PA_SC_AA_CONFIG` only for a `SAMPLE_COVERAGE` input ([L174-L177](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L174-L177)). This is not measured on hardware. An `ANCILLARY` or `SAMPLE_COVERAGE` pixel input and a sample-mask export throw in a pixel program that runs, and so does `PS_ITER_SAMPLE` with one-sample color targets and no depth target, because what the console gives them under a multisampled configuration is not known; a depth-only draw that skips its pixel program is drawn with the null program, and its `PS_ITER_SAMPLE` and pixel input bits are ignored. With a one-sample depth target, a pixel program with `PS_ITER_SAMPLE` and neither input runs once per pixel; if the console runs it once per sample, its atomics and append or consume counters count differently. Points, lines and alpha-to-coverage throw as for a multisampled target. With a one-sample depth target, `DB_EQAA` Z interpolation (`INTERPOLATE_COMP_Z`, `INTERPOLATE_SRC_Z`) or overrasterization (`OVERRASTERIZATION_AMOUNT`, `ENABLE_POSTZ_OVERRASTERIZATION`) also throws. METAL GEAR SOLID: Peace Walker (PPSA18216) draws a one-sample color target under a 4x configuration this way; the first draw of its opening movie binds a one-sample depth target and no color target under the same configuration. +- [A one-sample target under a multisampled rasterizer without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear, one-sample color targets and no depth target, or a one-sample depth target with no color target or one-sample color targets, is drawn as a one-sample draw at the pixel center. Without the bit every sample is taken to be at the pixel center (see the entry for a multisampled target rasterized without MSAA_ENABLE below), and a one-sample target is taken to keep the coverage of sample 0, so a one-sample depth target is tested and written once per pixel with the depth at the pixel center. That is the rule [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516) gives a color target with fewer samples than the rasterizer, but Vulkan reaches it only beside a depth or stencil target with the rasterizer's sample count ([VUID-VkGraphicsPipelineCreateInfo-subpass-01505](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/pipelines.adoc#L3033-L3041)), so here it is an analogy, and for a one-sample depth target an extension of it. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_graphics_pipeline.cpp#L127-L128) also rasterizes with the largest sample count of the bound depth and color targets ([L416-L417](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L416-L417), [L477-L480](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L477-L480)), and reads `PA_SC_AA_CONFIG` only for a `SAMPLE_COVERAGE` input ([L174-L177](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L174-L177)). This is not measured on hardware. An `ANCILLARY` or `SAMPLE_COVERAGE` pixel input and a sample-mask export throw in a pixel program that runs, and so does `PS_ITER_SAMPLE` with one-sample color targets and no depth target, because what the console gives them under a multisampled configuration is not known; a depth-only draw that skips its pixel program is drawn with the null program, and its `PS_ITER_SAMPLE` and pixel input bits are ignored. With a one-sample depth target, a pixel program with `PS_ITER_SAMPLE` and neither input runs once per pixel; if the console runs it once per sample, its atomics and append or consume counters count differently. Points, lines and alpha-to-coverage throw as for a multisampled target. With a one-sample depth target, `DB_EQAA.INTERPOLATE_COMP_Z` is accepted: with every sample at the pixel center, Z interpolated to any sample position is the center's Z, which the one-sample draw tests. That rests on the same inference; neither [PAL](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9MsaaState.cpp#L117-L118) nor [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/761d5c8a54f93b3d43608f718910ed742983dd0b/src/gallium/drivers/radeonsi/si_state.c#L3314-L3316) sets the bit, and its meaning is not documented. `INTERPOLATE_SRC_Z` and overrasterization (`OVERRASTERIZATION_AMOUNT`, `ENABLE_POSTZ_OVERRASTERIZATION`) still throw. METAL GEAR SOLID: Peace Walker (PPSA18216) draws a one-sample color target under a 4x configuration this way; the first draw of its opening movie binds a one-sample depth target and no color target under the same configuration. Gran Turismo 7 (PPSA01317) draws its main pass with a one-sample depth target, `DB_EQAA` 0x00050000 and a 4x configuration. - [MSAA_ENABLE on a single-sample target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_MODE_CNTL_0.MSAA_ENABLE` with `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES = 0` is drawn like the same state without the bit when sample 0 of the four `PA_SC_AA_SAMPLE_LOCS_PIXEL_*_0` registers is at the pixel center and the draw rasterizes filled triangles or rectangles (`VGT_PRIMITIVE_TYPE` 7 or 17 as well as the triangle types) with alpha-to-coverage and conservative rasterization off. [RADV](https://gitlab.freedesktop.org/mesa/mesa/-/blob/745709a000482a4a24c91faef5c5a40bd653a863/src/amd/vulkan/radv_cmd_buffer.c#L13606-13609) programs this state for one-sample custom sample locations on GFX10 and later, where the bit makes the rasterizer use the programmed location of sample 0 ([061bc615](https://gitlab.freedesktop.org/mesa/mesa/-/commit/061bc6151a11597f720535f00e79a5752e24aff6)); that the bit changes nothing else for such a draw is inferred from that and is not measured on hardware. EA Sports UFC 5 (PPSA03541) reaches a rect-list draw in this state. Other locations of sample 0, absent location registers, points, lines, alpha-to-coverage and conservative rasterization throw - [A multisampled target rasterized without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear is drawn with the target's sample count and every sample at the pixel center, as a single-sample scan into a multisampled target already is. On GFX10 and later the bit is what makes the rasterizer use the programmed sample locations ([RADV 061bc615](https://gitlab.freedesktop.org/mesa/mesa/-/commit/061bc6151a11597f720535f00e79a5752e24aff6)), and with multisampling disabled GL rasterizes at the pixel center and gives the fragment full coverage, which radeonsi programs by clearing the bit; that the hardware does the same with `MSAA_NUM_SAMPLES` > 0 is inferred from these and is not measured on hardware. A depth target with the same sample count also has every sample at the pixel center, so each depth and stencil sample is tested and written with the depth at the pixel center, as GL allows when multisampling is disabled ([L185-L190](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L185-L190), [L422-L425](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L422-L425)). GL also lets an implementation test only a centermost sample and set every sample from it ([L425-L434](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L425-L434)), which differs when a pixel's stored samples differ; which one the console does, and how its occlusion queries count such a draw, is not measured on hardware. `DB_EQAA` Z interpolation or overrasterization and a sample-mask export with a depth target throw. Points, lines and alpha-to-coverage throw. SONIC SUPERSTARS (PPSA06888) draws such a 2x target, and METAL GEAR SOLID: Peace Walker (PPSA18216) a 4x depth and color pair. - [sceAgcDriverGetEqContextId](../../../core/libs/prx/libSceAgcDriver/Eq/src/Query.cpp) (libSceAgcDriver) - returns `ident`: an end-of-pipe interrupt is delivered only to the registration whose id equals the raising queue, so `ident` is that context's id (titles register 0 or 1 for graphics and `0x20 + 8 * pipe + queue` for compute). The console's value is not known; KytyPS5 returns the event's `data`, which it fills with the interrupt's context id, whereas `data` here is the EV_CLEAR trigger count. Other event filters throw From 795c3903392405b49849bcd90eccb2a6d6cb2380 Mon Sep 17 00:00:00 2001 From: Pacuka <69674426+Pacuka@users.noreply.github.com> Date: Thu, 22 Oct 2026 18:11:12 +0200 Subject: [PATCH 022/113] fix(libSceAgc): take the semaphore address second in Acb/Dcb MemSemaphore PPSA03396 calls sceAgcAcbMemSemaphore and sceAgcDcbMemSemaphore as (cb, address, waitForMailbox, signalType, operation). Both read the address from the fourth argument instead, so the call aborted with "null or misaligned address 0x1". Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgc/Acb/src/Sync.cpp | 5 +-- core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp | 5 +-- core/libs/prx/libSceAgc/tests/Semaphore.cpp | 38 ++++++++++++++++++++ docs/dev/debt/libSceAgc.md | 1 + 4 files changed, 41 insertions(+), 8 deletions(-) diff --git a/core/libs/prx/libSceAgc/Acb/src/Sync.cpp b/core/libs/prx/libSceAgc/Acb/src/Sync.cpp index eee05b37c4..cb4ff7f5a6 100644 --- a/core/libs/prx/libSceAgc/Acb/src/Sync.cpp +++ b/core/libs/prx/libSceAgc/Acb/src/Sync.cpp @@ -44,10 +44,7 @@ std::uint32_t APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize() { return 32; } -std::uint32_t* APS5_VABI sceAgcAcbMemSemaphore(CommandBuffer* buf, std::uint8_t action, std::uint8_t clientCode, const volatile void* address) { - const std::uint8_t operation = action != 0 ? 7u : 6u; - const std::uint8_t signalType = clientCode & 1u; - const std::uint8_t waitForMailbox = (clientCode >> 1u) & 1u; +std::uint32_t* APS5_VABI sceAgcAcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation) { return Agc::Command::WriteMemSemaphore(buf, address, waitForMailbox, signalType, operation, __func__); } diff --git a/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp b/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp index 96c45f0d3c..d3fb4b534b 100644 --- a/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp +++ b/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp @@ -52,10 +52,7 @@ std::uint32_t APS5_VABI sceAgcDcbStallCommandBufferParserGetSize() { return 8; } -std::uint32_t* APS5_VABI sceAgcDcbMemSemaphore(CommandBuffer* buf, std::uint8_t action, std::uint8_t clientCode, const volatile void* address) { - const std::uint8_t operation = action != 0 ? 7u : 6u; - const std::uint8_t signalType = clientCode & 1u; - const std::uint8_t waitForMailbox = (clientCode >> 1u) & 1u; +std::uint32_t* APS5_VABI sceAgcDcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation) { return Agc::Command::WriteMemSemaphore(buf, address, waitForMailbox, signalType, operation, __func__); } diff --git a/core/libs/prx/libSceAgc/tests/Semaphore.cpp b/core/libs/prx/libSceAgc/tests/Semaphore.cpp index 789a303ad8..362d180ad6 100644 --- a/core/libs/prx/libSceAgc/tests/Semaphore.cpp +++ b/core/libs/prx/libSceAgc/tests/Semaphore.cpp @@ -15,6 +15,8 @@ extern "C" int APS5_VABI sceAgcSetAmmSemaphoreMemory(void* memory, std::uint64_t sizeInBytes); extern "C" int APS5_VABI sceAgcGetSemaphoreLabel(std::uint32_t index, void** label); extern "C" std::uint32_t* APS5_VABI sceAgcCbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint32_t operation, std::uint32_t modifier, std::uint32_t value); +extern "C" std::uint32_t* APS5_VABI sceAgcAcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation); +extern "C" std::uint32_t* APS5_VABI sceAgcDcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation); namespace { @@ -180,6 +182,40 @@ void testMemSemaphore() { expectFailure([&] { sceAgcCbMemSemaphore(nullptr, label, 0, 0, 0); }); } +using QueueMemSemaphore = std::uint32_t* APS5_VABI (*)(CommandBuffer*, const volatile void*, std::uint8_t, std::uint8_t, std::uint8_t); + +void testQueueMemSemaphore(QueueMemSemaphore write) { + const auto* semaphore = reinterpret_cast(0x102f221d98ull); + + { + std::array words{}; + words.fill(0xdeadbeefu); + CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0}; + const auto* packet = write(&buffer, semaphore, 0, 1, 6); + check(packet == words.data(), "packet address mismatch"); + check(packet[0] == 0xc0023900u, "MEM_SEMAPHORE header opcode mismatch"); + check(packet[1] == 0x2f221d98u, "MEM_SEMAPHORE address low mismatch"); + check(packet[2] == 0x10u, "MEM_SEMAPHORE address high mismatch"); + check(packet[3] == 0xc0100000u, "MEM_SEMAPHORE signal control word mismatch"); + check(buffer.cursor_up == words.data() + 4, "cursor did not advance by 4 words"); + check(words[4] == 0xdeadbeefu, "words past packet modified"); + } + + { + std::array words{}; + words.fill(0xdeadbeefu); + CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0}; + const auto* packet = write(&buffer, semaphore, 1, 0, 7); + check(packet[3] == 0xe0010000u, "MEM_SEMAPHORE wait control word mismatch"); + } + + std::array words{}; + CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0}; + expectFailure([&] { write(&buffer, reinterpret_cast(1ull), 0, 1, 6); }); + expectFailure([&] { write(&buffer, semaphore, 0, 1, 5); }); + expectFailure([&] { write(&buffer, semaphore, 2, 0, 7); }); +} + } int main() { @@ -191,6 +227,8 @@ int main() { testRegistration(); testLabels(); testMemSemaphore(); + testQueueMemSemaphore(sceAgcAcbMemSemaphore); + testQueueMemSemaphore(sceAgcDcbMemSemaphore); testLabelRejections(); testRepeatedRegistration(); storage.reset(); diff --git a/docs/dev/debt/libSceAgc.md b/docs/dev/debt/libSceAgc.md index ab5eaacf4e..cb177fed98 100644 --- a/docs/dev/debt/libSceAgc.md +++ b/docs/dev/debt/libSceAgc.md @@ -24,6 +24,7 @@ - [sceAgcCreateInterpolantMapping_10000](../../../core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp) (libSceAgc) - name from its NID (`dbOlWdppb4o`); same arguments as `sceAgcCreateInterpolantMapping_0100`; PPSA26344 passes three pointers at each of nine observed call sites (`0x9F914E`, `0x9F91E2`, `0x9F9216`, `0x1604BBD`, `0x16122D7`, `0x1618285`, `0x161838C`, `0x16184EE`, `0x1618607`), consistent with that argument assumption, but does not read the return value there, so its return type is not established. The `SPI_PS_INPUT_CNTL` bits for `is_f16` 2 inputs follow KytyPS5, not confirmed on hardware - [sceAgcGetDataPacketPayloadRange](../../../core/libs/prx/libSceAgc/Misc/src/PacketInfo.cpp) (libSceAgc) - signature, the `{base, size in bytes}` output and the type 0 range (header + 1, one dword longer than the type 1 payload) from KytyPS5 only, matching `sceAgcGetDataPacketPayloadAddress_0090`; prosper returns header + 2 for both types from that address function - [sceAgcGetDataPacketPayloadAddress](../../../core/libs/prx/libSceAgc/Misc/src/PacketInfo.cpp) (libSceAgc) - forward to `sceAgcGetDataPacketPayloadAddress_0090` and the inferred (addr, cmd, type) parameters follow SharpProspero and decrypted firmware 3.20 NID mapping; not verified on console hardware +- [sceAgcAcbMemSemaphore, sceAgcDcbMemSemaphore](../../../core/libs/prx/libSceAgc/Acb/src/Sync.cpp) (libSceAgc) - signature (cb, semaphoreAddr, waitForMailbox, signalType, operation) inferred from PPSA03396, whose wrapper passes the address second and operation 6 (signal) or 7 (wait) last; the three trailing arguments go to the packet as-is - [sceAgcCbMemSemaphore](../../../core/libs/prx/libSceAgc/Cb/src/Sync.cpp) (libSceAgc) - signature (cb, semaphoreAddr, operation, modifier, value) follows SharpProspero; writes 4-dword PM4 0x39 packet with control word 0x80100000 following console oracle measurements in prosper (cases agcbuild_CbMemSemaphore_a/b/c); operation, modifier and value are unused - [sceAgcAsyncCondExecPatchSetCommandAddress, sceAgcAsyncCondExecPatchSetEnd](../../../core/libs/prx/libSceAgc/Patch/src/CondExec.cpp) (libSceAgc) - no reference has a body for them; they are assumed to patch the COND_EXEC packet like `sceAgcCondExecPatchSetCommandAddress` and `sceAgcCondExecPatchSetEnd`, since `sceAgcAcbCondExec` writes the same packet as `sceAgcDcbCondExec`, as `sceAgcAsyncRewindPatchSetRewindState` does for REWIND - [sceAgcAcbAtomicGds_0900](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - name from its NID (`gQkqkLttcpw`), signature unknown From be4fd86249fb6ee3217c411d640f2e72afbb0775 Mon Sep 17 00:00:00 2001 From: Retr0 Date: Wed, 21 Oct 2026 15:16:49 +0300 Subject: [PATCH 023/113] fix(libkernel): disconnect a connected datagram socket on connect to port 0 FreeBSD 11.4's soconnectat() (sys/kern/uipc_socket.c) disconnects a connected socket of a protocol without PR_CONNREQUIRED before it calls pru_connect. udp_disconnect() and udp6_disconnect() drop the peer and reset the local address, then in_pcbconnect_setup() and in6_pcbladdr() fail port 0 with EADDRNOTAVAIL, so the socket is left unconnected. connect to port 0 on a connected datagram socket now dissolves the association through the AF_UNSPEC disconnect path before failing with 49, where it kept the old peer. Stream sockets keep EISCONN. --- core/libs/prx/libkernel/Socket/src/Udp.cpp | 24 +++++++++++++--------- core/libs/tests/GuestSocketPortZero.cpp | 24 +++++++++++++++++++++- docs/dev/debt/libkernel.md | 2 +- 3 files changed, 38 insertions(+), 12 deletions(-) diff --git a/core/libs/prx/libkernel/Socket/src/Udp.cpp b/core/libs/prx/libkernel/Socket/src/Udp.cpp index 938d7d48a6..d1505081d0 100644 --- a/core/libs/prx/libkernel/Socket/src/Udp.cpp +++ b/core/libs/prx/libkernel/Socket/src/Udp.cpp @@ -302,16 +302,6 @@ bool Listening(const Socket& socket) { bool listening = false; return GuestSockets::NativeListening(static_cast(socket.value), listening) && listening; } -bool ZeroPortConnect(const Socket& socket, const void* address, std::uint32_t length) { - if (!address || (socket.type != 1 && socket.type != 2) || (socket.family != 2 && socket.family != 28)) return false; - const auto* bytes = static_cast(address); - if (length < (socket.family == 2 ? 16u : 28u) || bytes[1] != socket.family || (bytes[2] | bytes[3]) != 0) return false; - sockaddr_storage peer{}; - socklen_t peerSize = sizeof(peer); - if (::getpeername(socket.value, reinterpret_cast(&peer), &peerSize) == 0) return false; - Fail(49); - return true; -} constexpr std::int64_t NotAnswered = -2; std::int64_t ZeroPortSend(const Socket& socket, const sockaddr_storage& destination, std::uint64_t length) { if (socket.type != 2 || socket.family != 2 || destination.ss_family != AF_INET) return NotAnswered; @@ -353,6 +343,20 @@ int Disconnect(const Socket& socket) { if (::bind(socket.value, reinterpret_cast(&wildcard), localSize) != 0) return Fail(NativeError()); return 0; } +bool ZeroPortConnect(const Socket& socket, const void* address, std::uint32_t length) { + if (!address || (socket.type != 1 && socket.type != 2) || (socket.family != 2 && socket.family != 28)) return false; + const auto* bytes = static_cast(address); + if (length < (socket.family == 2 ? 16u : 28u) || bytes[1] != socket.family || (bytes[2] | bytes[3]) != 0) return false; + if (socket.type == 2) { + if (Disconnect(socket) != 0) return true; + } else { + sockaddr_storage peer{}; + socklen_t peerSize = sizeof(peer); + if (::getpeername(socket.value, reinterpret_cast(&peer), &peerSize) == 0) return false; + } + Fail(49); + return true; +} void GuestAddress(const sockaddr_storage& native, void* output, std::uint32_t* length) { unsigned char bytes[28]{}; bytes[0] = native.ss_family == AF_INET ? 16 : 28; diff --git a/core/libs/tests/GuestSocketPortZero.cpp b/core/libs/tests/GuestSocketPortZero.cpp index 070b9c8982..36857ee65e 100644 --- a/core/libs/tests/GuestSocketPortZero.cpp +++ b/core/libs/tests/GuestSocketPortZero.cpp @@ -11,6 +11,7 @@ int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t); int APS5_VABI listen_nid_postfix(int, int); int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*); int APS5_VABI getpeername_nid_postfix(int, void*, std::uint32_t*); +std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int); std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t); int APS5_VABI close_nid_postfix(int); int* APS5_VABI __error_nid_postfix(); @@ -45,7 +46,28 @@ static void CheckDatagram(int family) { Require(connect_nid_postfix(probe, address.data(), size) == -1 && *__error_nid_postfix() == 49, "connect to port 0 on an unconnected datagram socket must fail with EADDRNOTAVAIL (49)"); Require(getpeername_nid_postfix(probe, name.data(), &length) == -1 && *__error_nid_postfix() == 57, "still unconnected"); - Require(close_nid_postfix(probe) == 0, "close"); + const int peer = socket_nid_postfix(family, 2, 0); + Require(peer >= 0, "peer"); + const int bound = bind_nid_postfix(peer, address.data(), size); + if (bound < 0 && family == 28 && *__error_nid_postfix() == 49) { + Require(close_nid_postfix(peer) == 0 && close_nid_postfix(probe) == 0, "close"); + return; + } + Require(bound == 0, "bind peer"); + Address target{}; + length = target.size(); + Require(getsockname_nid_postfix(peer, target.data(), &length) == 0, "peer name"); + Require(connect_nid_postfix(probe, target.data(), size) == 0, "connect to the peer"); + length = name.size(); + Require(getpeername_nid_postfix(probe, name.data(), &length) == 0, "connected"); + Require(connect_nid_postfix(probe, address.data(), size) == -1 && *__error_nid_postfix() == 49, + "connect to port 0 on a connected datagram socket must fail with EADDRNOTAVAIL (49)"); + length = name.size(); + Require(getpeername_nid_postfix(probe, name.data(), &length) == -1 && *__error_nid_postfix() == 57, + "connect to port 0 must disconnect a connected datagram socket"); + Require(send_nid_postfix(probe, "x", 1, 0) == -1 && *__error_nid_postfix() == 39, + "send without an address after the disconnect must fail with EDESTADDRREQ (39)"); + Require(close_nid_postfix(peer) == 0 && close_nid_postfix(probe) == 0, "close"); } static void CheckStream(int family) { diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md index 89fbd344b2..3cf9e7fb94 100644 --- a/docs/dev/debt/libkernel.md +++ b/docs/dev/debt/libkernel.md @@ -206,7 +206,7 @@ - [Socket error numbers](../../../core/libs/prx/libkernel/Socket/include/SocketError.hpp) (libkernel) - a host socket error becomes the FreeBSD 11 `errno.h` number of the same name; the numbers are not checked on the console. Winsock `WSAESHUTDOWN` becomes `EPIPE`, as a send after `shutdown` does on FreeBSD, and a host error with no FreeBSD socket counterpart becomes `EIO`. A nonblocking `connect` in progress reports `EINPROGRESS` on Linux but `EAGAIN` on Windows (`WSAEWOULDBLOCK`), where FreeBSD reports `EINPROGRESS`. On Windows a refused nonblocking `connect` is never reported (`SO_ERROR` is unsupported), so a repeated one keeps reporting `EALREADY` where FreeBSD reports `ECONNREFUSED`. A receive after `shutdown(SHUT_RD)` reports `EPIPE` on Windows where FreeBSD returns 0 - [getsockopt, setsockopt](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) on a guest socket handle the SOL_SOCKET level, `TCP_NODELAY` and `IPV6_V6ONLY`, after FreeBSD 11.4's [`sosetopt` and `sogetopt`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c): `SO_REUSEADDR`, `SO_KEEPALIVE`, `SO_DONTROUTE`, `SO_BROADCAST`, `SO_OOBINLINE` and `SO_LINGER` act on the host socket, and `SO_ERROR`, `SO_TYPE`, `SO_ACCEPTCONN`, `SO_SNDBUF` and `SO_RCVBUF` are read. A boolean option reads back as its own bit, as FreeBSD returns `so_options & option`. Winsock does not clear a socket's pending error when it is read, so on Windows the library reports a pending error once and shows it again only after a new `connect`; a second failure with the same code on the same socket without a `connect` in between would be hidden. `SO_SNDBUF` and `SO_RCVBUF` read the host's value, which is not the size FreeBSD reports (Linux doubles it). `SO_NOSIGPIPE` is kept per socket and reads back as its bit. On Linux a `send`, `sendto`, `sendmsg` or `write` on that socket passes `MSG_NOSIGNAL` to the host, as [`kern_sendit`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L890-L895) and [`soo_write`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L147-L151) leave out the signal. An accepted socket takes it from its listener, as [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) copies the options. `SO_NBIO` (`0x1200`) is the console's own option, not FreeBSD's. It switches the socket between blocking and non-blocking as `FIONBIO` does and reads back as 0 or 1, as `sceNetSetsockopt` and `sceNetGetsockopt` treat it here; what the console reads back for it is not measured. `TCP_NODELAY` (`IPPROTO_TCP`, 1) is set on the host socket and reads back as `TF_NODELAY` (4), as [`tcp_default_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet/tcp_usrreq.c#L1860-L1861) returns it. The `IPPROTO_TCP` level on a datagram or `AF_UNIX` socket fails with `EINVAL`, as [`ip_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet/ip_output.c#L943-L944) and [`uipc_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_usrreq.c#L1228-L1229) answer it, and an accepted socket takes `TCP_NODELAY` through the host. `SO_SNDTIMEO` and `SO_RCVTIMEO` follow [`sosetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2657-L2689) and [`sogetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2846-L2850). A 16-byte `timeval` with a negative field or 1000000 microseconds or more fails with `EDOM`, and more than `INT32_MAX` seconds becomes the longest wait. The value is kept and read back through FreeBSD's 32.32 fixed-point conversion ([`tvtosbt`, `sbttotv`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/sys/time.h#L178-L286)), so half a second reads back as 499999 microseconds and one microsecond as 0. A `recv`, `recvfrom`, `recvmsg`, `read` or `readv`, and a `send`, `sendto`, `sendmsg`, `write` or `writev`, on a blocking socket then waits that long for the host to report the socket readable or writable, and fails with `EWOULDBLOCK`; a call with `MSG_DONTWAIT` does not wait. An accepted socket takes both from its listener ([`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L629-L630)). The wait covers only the first transfer: once the socket is writable the host send runs without a limit, where FreeBSD stops a send that cannot finish and returns the bytes sent so far, and a receive whose data another thread takes between the wait and the host call blocks again. `sendfile` ignores the send timeout. The host wait has millisecond steps, so a shorter timeout lasts up to a millisecond longer. A null value fails with `EINVAL`, where FreeBSD's [`kern_setsockopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L1414-L1415) returns `EFAULT`. `IPV6_V6ONLY` (`IPPROTO_IPV6`, 27) on an `AF_INET6` socket is set on the host socket and reads back as 0 or 1, after FreeBSD's [`ip6_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1716-L1732): a value that is not exactly an `int` fails with `EINVAL` ([L1572](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1572)), as does setting it on a bound socket, which the host refuses too. `socket` turns it on for every `AF_INET6` socket, as FreeBSD's default `net.inet6.ip6.v6only` does, and Java turns it off on the sockets it opens: Java 25 Advanced Network (PPSA99871) stops at `java.net.SocketException: Protocol not available` without it. The `IPPROTO_IPV6` level on an `AF_INET` or `AF_UNIX` socket fails with `EINVAL`, as `ip_ctloutput` and `uipc_ctloutput` answer it. Every other SOL_SOCKET option (`SO_DEBUG`, `SO_USELOOPBACK`, `SO_REUSEPORT` and `SO_TIMESTAMP`, which FreeBSD stores, the low-water marks among them; PPSA99871 sets `SO_REUSEPORT` and carries on when it fails), every other `IPPROTO_TCP` option (`TCP_MAXSEG`, `TCP_KEEPIDLE`, `TCP_KEEPINTVL` and `TCP_KEEPCNT` among them), every other `IPPROTO_IPV6` option ([L1928-L1929](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1928-L1929), [L2158-L2159](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L2158-L2159)) and the `IPPROTO_IP` level fail with `ENOPROTOOPT`. None of this was measured on a console. - [connect to AF_UNSPEC](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) dissolves a datagram association as FreeBSD 11.4's `udp_disconnect()` does, which resets the local address to the wildcard address and keeps the port. On Linux a socket bound to an explicit port keeps its local address as well (`127.0.0.1:` stays `127.0.0.1:`), because a bound socket cannot be bound again; one bound to port 0 is bound again to the wildcard address with the port it had -- [connect](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - `connect` to port 0 on an unconnected `AF_INET` or `AF_INET6` stream or datagram socket fails with `EADDRNOTAVAIL` (49), as FreeBSD 11.4's `in_pcbconnect_setup()` and `in6_pcbconnect()` do. A connected stream socket keeps its host `EISCONN` answer. Known gaps: on an already connected datagram socket `connect` to port 0 keeps the old peer, where FreeBSD's `soconnect()` disconnects first and then fails with 49; `sendto` and `sendmsg` to port 0 on an `AF_INET` datagram socket fail with 49 unless the socket is bound to a specific address and port and the destination is neither `INADDR_ANY` nor `INADDR_BROADCAST`, which is the path where `udp_output()` skips `in_pcbconnect_setup()` and FreeBSD sends to port 0. There nothing can receive on port 0, so the call returns the length without the host, because Linux's `udp_sendmsg` refuses port 0 with `EINVAL`; an `AF_INET6` socket still goes to the host. The answers are taken from the FreeBSD source and are not measured on a console. [sceNetConnect](../../../core/libs/prx/libSceNet/Export.cpp) is not changed +- [connect](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - `connect` to port 0 on an unconnected `AF_INET` or `AF_INET6` stream or datagram socket fails with `EADDRNOTAVAIL` (49), as FreeBSD 11.4's `in_pcbconnect_setup()` and `in6_pcbconnect()` do; a connected datagram socket is disconnected first, as `soconnect()` does, and then fails with 49. A connected stream socket keeps its host `EISCONN` answer. Known gap: `sendto` and `sendmsg` to port 0 on an `AF_INET` datagram socket fail with 49 unless the socket is bound to a specific address and port and the destination is neither `INADDR_ANY` nor `INADDR_BROADCAST`, which is the path where `udp_output()` skips `in_pcbconnect_setup()` and FreeBSD sends to port 0. There nothing can receive on port 0, so the call returns the length without the host, because Linux's `udp_sendmsg` refuses port 0 with `EINVAL`; an `AF_INET6` socket still goes to the host. The answers are taken from the FreeBSD source and are not measured on a console. [sceNetConnect](../../../core/libs/prx/libSceNet/Export.cpp) is not changed - [msync](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) follows FreeBSD 11's `kern_msync` and `vm_map_sync`, not measured on the console: the address is rounded down to the page, a range that wraps is `EINVAL`, as is `MS_ASYNC` with `MS_INVALIDATE`, and a range whose start or any page is not mapped (as `sceKernelVirtualQuery` reports it, reservations included) is `ENOMEM`; a page unmapped from inside a larger mapping still counts as mapped there, since `sceKernelVirtualQuery` keeps reporting the whole mapping. The guest has no file mappings, so a successful call writes nothing back. `MS_INVALIDATE` on a mapped range throws: FreeBSD returns `EBUSY` when the range holds `mlock`ed pages, and locked pages are not tracked - [madvise](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) accepts `MADV_PROTECT` (10) as a no-op hint without modifying process protection. FreeBSD 11's `kern_madvise` (`sys/vm/vm_mmap.c`) handles it before the address check, ignores the address and length, and calls `kern_procctl(..., PROC_SPROTECT, PPROT_SET)`, which requires `PRIV_VM_MADV_PROTECT` and fails with `EPERM` without it. Returning 0 unconditionally assumes the calling process is privileged. Console behaviour is unverified - [mincore](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) follows FreeBSD 11's `sys_mincore` (`sys/vm/vm_mmap.c`), not measured on the console: the address is rounded down to the page, length 0 returns 0, a null vector over a mapped range returns `EFAULT`, an overflowing range or any unmapped page in the range (as reported by `sceKernelVirtualQuery`) returns `ENOMEM`. For valid ranges, a page reports `MINCORE_INCORE` (0x1) when `sceKernelVirtualQuery` reports it committed and 0 when it is only reserved; actual residency, referenced and modified bits are not modelled. Length 0 returns 0 when the start page is mapped and `ENOMEM` otherwise, and the range and mapping checks come before the null vector `EFAULT`, as in `kern_mincore` Java 25 LAN / DNS (PPSA99869) imports it From ea6aa0a8091f3ecd4edcb83e1fa0cd6226e84f66 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Wed, 21 Oct 2026 23:56:32 -0400 Subject: [PATCH 024/113] fix(libc): follow the console fgetws for short buffers and read errors The fgetws in the libc.prx that titles ship (the same 133 bytes in the copies of PPSA13934, PPSA07923 and PPSA05916, read from disassembly) differs from this one in two cases: - A size below 2 returns null at once, without writing the buffer, errno or the stream (cmp $0x2,%esi; jge, else the null result). Here a size of 1 stored a NUL and returned the buffer, and a size of 0 or less set the stream error and errno 22. - When fgetwc returns -1 after characters were stored, the console null-terminates and returns the buffer; it returns null only when nothing was stored, and never checks ferror. Here a read error after some characters returned null. The rest already matches: each fgetwc result is stored as its low 16 bits (mov %ax,(%rbx)), and the newline test compares all 32 bits. A null buffer or stream, which the console dereferences, keeps failing with errno 22. guest_standard_streams now expects the console results for sizes 1, 0 and -1 and for an invalid byte after a stored character; its fgetwc error indicator check is unchanged. The libc debt entry cites the reading and what it leaves unverified. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libc/src/FormattingWide.cpp | 10 ++++------ core/libs/tests/GuestStandardStreams.cpp | 10 ++++++---- docs/dev/debt/libc.md | 2 +- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/core/libs/prx/libc/src/FormattingWide.cpp b/core/libs/prx/libc/src/FormattingWide.cpp index a2b3d0fe7d..ac1f820c1d 100644 --- a/core/libs/prx/libc/src/FormattingWide.cpp +++ b/core/libs/prx/libc/src/FormattingWide.cpp @@ -399,7 +399,8 @@ int APS5_VABI putwchar_nid_postfix(char16_t value) { } char16_t* APS5_VABI fgetws_nid_postfix(char16_t* buffer, int size, FileStream* stream) { - if (buffer == nullptr || stream == nullptr || size <= 0) { + if (size < 2) return nullptr; + if (buffer == nullptr || stream == nullptr) { if (stream != nullptr) stream->SetError(); errno = 22; return nullptr; @@ -407,14 +408,11 @@ char16_t* APS5_VABI fgetws_nid_postfix(char16_t* buffer, int size, FileStream* s int count = 0; while (count < size - 1) { const std::int32_t character = fgetwc_nid_postfix(stream); - if (character == -1) { - if (count == 0) return nullptr; - break; - } + if (character == -1) break; buffer[count++] = static_cast(character); if (character == static_cast(u'\n')) break; } - if (ferror_nid_postfix(stream) != 0) return nullptr; + if (count == 0) return nullptr; buffer[count] = 0; return buffer; } diff --git a/core/libs/tests/GuestStandardStreams.cpp b/core/libs/tests/GuestStandardStreams.cpp index c37c580e6b..9e4530a690 100644 --- a/core/libs/tests/GuestStandardStreams.cpp +++ b/core/libs/tests/GuestStandardStreams.cpp @@ -744,9 +744,11 @@ int main(int argc, char** argv) { Require(wideBuf[0] == u'E' && wideBuf[1] == u'n' && wideBuf[2] == u'd' && wideBuf[3] == 0); Require(fgetws_nid_postfix(wideBuf, 16, &wideIo) == nullptr); Require(feof_nid_postfix(&wideIo)); - Require(fgetws_nid_postfix(wideBuf, 0, &wideIo) == nullptr && *__error_nid_postfix() == 22); - Require(ferror_nid_postfix(&wideIo)); clearerr_nid_postfix(&wideIo); + *__error_nid_postfix() = 0; + Require(fgetws_nid_postfix(wideBuf, 0, &wideIo) == nullptr && *__error_nid_postfix() == 0); + Require(fgetws_nid_postfix(wideBuf, -1, &wideIo) == nullptr && *__error_nid_postfix() == 0); + Require(!ferror_nid_postfix(&wideIo)); Require(fgetws_nid_postfix(nullptr, 16, &wideIo) == nullptr && *__error_nid_postfix() == 22); Require(ferror_nid_postfix(&wideIo)); clearerr_nid_postfix(&wideIo); @@ -754,7 +756,7 @@ int main(int argc, char** argv) { wideBuf[0] = u'X'; wideBuf[1] = u'Y'; std::rewind(wideIo.GetHandle()); - Require(fgetws_nid_postfix(wideBuf, 1, &wideIo) == wideBuf && wideBuf[0] == 0 && wideBuf[1] == u'Y'); + Require(fgetws_nid_postfix(wideBuf, 1, &wideIo) == nullptr && wideBuf[0] == u'X' && wideBuf[1] == u'Y'); Require(fgetc_nid_postfix(&wideIo) == 'H'); wideIo.Close(); @@ -778,7 +780,7 @@ int main(int argc, char** argv) { Require(fputc_nid_postfix(0xff, &midErr) == 0xff); std::rewind(midErr.GetHandle()); char16_t midBuf[16]{}; - Require(fgetws_nid_postfix(midBuf, 16, &midErr) == nullptr); + Require(fgetws_nid_postfix(midBuf, 16, &midErr) == midBuf && midBuf[0] == u'A' && midBuf[1] == 0); Require(ferror_nid_postfix(&midErr)); midErr.Close(); diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index ce70a5a958..45ca2c1e89 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -69,7 +69,7 @@ - Stable Windows resident runs of at least 256 KiB use temporary read-only protection for clean write-watch proofs. The first CPU write restores the logical protection of the whole run; that run remains on native write watching until it is remapped, so repeatedly rewritten runs stay writable. Native kernel writes into guest buffers must hold [GuestArena::HostWrite](../../../core/libs/prx/libc/include/GuestArena.hpp), as shared views already require: an unbracketed WinAPI ReadFile can fail with ERROR_NOACCESS while the resident proof is armed. Guest read, pread and socket receive paths already bracket their destinations. GPU host-import access suppresses resident rearming without inventing shared-page stores. This is a host integration requirement, not a change to guest logical protection. - [getc_unlocked, putc_unlocked, getchar_unlocked, putchar_unlocked](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libc) - byte I/O uses the host unlocked operations; guest EOF/error flags and macro counters follow `FileStream`. Linux status queries use `feof_unlocked`/`ferror_unlocked` because [glibc `feof`](https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/libio/feof.c) and [`ferror`](https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/libio/ferror.c) can acquire the stream lock. Windows uses [the CRT no-lock byte operations](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/fgetc-nolock-fgetwc-nolock) and `feof`/`ferror`, verified under a held stream lock on UCRT. Console behavior and other host CRTs remain unverified. - [feof_unlocked and ferror_unlocked](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libSceLibcInternal, implemented in libc) have no console measurement. The firmware 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibcInternal.c) names NIDs `NuydofHcR1w` and `yxbGzBQC5xA`. They follow FreeBSD 11 [feof.c](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/stdio/feof.c) and [ferror.c](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/stdio/ferror.c), returning 0 or 1 from the stream status without acquiring the stream lock. They inherit the host CRT limitations of the unlocked byte operations above. -- [fgetws, getwc, getwchar, putwc, putwchar](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - wide stream I/O encodes and decodes wide characters as UTF-8 on the underlying byte stream; `fgetws` reads characters into the destination buffer until newline or EOF and null-terminates, returning null on stream error. Console wide stream buffering and encoding details remain unverified. +- [fgetws, getwc, getwchar, putwc, putwchar](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - wide stream I/O encodes and decodes wide characters as UTF-8 on the underlying byte stream; `fgetws` follows the `libc.prx` that titles ship (read from disassembly of three titles' copies, PPSA13934, PPSA07923 and PPSA05916, not measured on a console): it returns null for a size below 2 without writing the buffer, `errno` or the stream, stores each `fgetwc` result as its low 16 bits until a newline (compared on all 32 bits), `-1` or a full buffer, and null-terminates and returns the buffer whenever it stored a character, also after a read error. A null buffer or stream, which the console dereferences, sets `errno` to 22 here. The calls the console makes before and after reading, and the one it makes when bits 0xC of the stream's second flag byte are set, are not reproduced. Console wide stream buffering and `fgetwc`'s decoding remain unverified. - [Closed standard descriptors](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libc) - on Linux and macOS, a descriptor 0, 1 or 2 that is closed when libc loads is opened on `/dev/null` (read-only for 0, write-only for 1 and 2) by a static initializer of libc, which runs before the libraries that depend on libc initialize and before the title starts. Within libc this relies on no static initializer opening a descriptor before it, which `guest_closed_standard_descriptors` checks. glibc does the same for set-user-ID programs ([`check_fds.c`](https://sourceware.org/git/?p=glibc.git;a=blob;f=csu/check_fds.c)). Without it the first descriptor a library opens, the write watch's `userfaultfd` for one, becomes the guest's standard input or output. What the console gives a title as its standard descriptors is not measured, and on Windows a process started without standard handles is not handled. - [Guest path names](../../../core/libs/prx/libc/src/General.cpp) (libc) are checked against FreeBSD 11.4's `NAME_MAX` (255 bytes per component) and `MAXPATHLEN` (1024 bytes with the terminating NUL) before they are resolved, and a longer name fails with `ENAMETOOLONG`, as `namei` does. The host's own limit still applies below that: on Windows a path whose host form exceeds `MAX_PATH` fails with `ENOENT`. A backslash counts as a path separator for the component length, because the guest path resolver turns it into `/` before the host call, while FreeBSD treats it as an ordinary name character, so a 301-byte name that contains one is accepted here. `sceNgs2ParseWaveformFile` resolves its path without a try block, so a long component ends in an uncaught `filesystem_error` there where a missing file ended in a `runtime_error` (both end the title). A path through a regular file (`file/x`, `file/`) is not always `ENOTDIR` on the calls that resolve it. None of this was measured on a console. - [ftrylockfile](../../../core/libs/prx/libc/src/RuntimeSupport.cpp) (libc) - tries the host CRT stream lock that `flockfile`, `funlockfile` and each locking host stdio call on the stream take, so it returns -1 while another thread holds the stream through `flockfile` or is inside such a call, and 0 when it acquires the lock or already owns it (recursively, released by as many `funlockfile` calls), as FreeBSD 11 [`_ftrylockfile`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/_flock_stub.c#L89-L104) does. A libc export holds the lock only for each host call it makes, not across several host calls or while it updates the guest `FILE` prefix. Linux uses glibc `ftrylockfile`. UCRT has no try variant of `_lock_file`, so Windows calls `TryEnterCriticalSection` on the `CRITICAL_SECTION` that `_lock_file` enters, found through the private UCRT stream layout (`__crt_stdio_stream_data` in `ucrt/inc/corecrt_internal_stdio.h`, unchanged from Windows SDK 10.0.19041 to 10.0.26100); another CRT or a change of that layout breaks it. A null or closed stream throws where FreeBSD dereferences it From a22e959cd8b1cec415812d625b17ffd983d57a68 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Thu, 22 Oct 2026 11:46:40 -0400 Subject: [PATCH 025/113] fix(libc): compute logf with FreeBSD msun's algorithm, as titles' libc.prx does logf returned the host log, so its last bit and errno depended on the host: on Windows the bits differ from the libc.prx that titles ship on 13,225,175 of the 2^32 floats. That libc.prx is msun's e_logf.c, setting ERANGE for +-0 and EDOM for every argument with the sign bit set. The port gives the same bits and errno as PPSA07923's and PPSA05916's copies for every argument; the FMA-contracted copy of PPSA13934 differs by 1 ulp on 961,881. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libc/src/Math.cpp | 57 ++++++++++++++++++++++++++++++++- core/libs/tests/GuestMath.cpp | 22 +++++++++++++ docs/dev/debt/libc.md | 1 + 3 files changed, 79 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libc/src/Math.cpp b/core/libs/prx/libc/src/Math.cpp index 37616b7be3..d14b4118d3 100644 --- a/core/libs/prx/libc/src/Math.cpp +++ b/core/libs/prx/libc/src/Math.cpp @@ -572,7 +572,62 @@ double APS5_VABI __powidf2_nid_postfix(double base, int exponent) { } float APS5_VABI expf_nid_postfix(float x) { return std::exp(x); } float APS5_VABI exp2f_nid_postfix(float x) { return std::exp2(x); } -float APS5_VABI logf_nid_postfix(float x) { return std::log(x); } +float APS5_VABI logf_nid_postfix(float x) { + const float ln2_hi = static_cast(6.9313812256e-01); + const float ln2_lo = static_cast(9.0580006145e-06); + const float two25 = static_cast(3.355443200e+07); + const float Lg1 = 0xaaaaaa.0p-24f; + const float Lg2 = 0xccce13.0p-25f; + const float Lg3 = 0x91e9ee.0p-25f; + const float Lg4 = 0xf89e26.0p-26f; + static volatile float vzero = 0.0f; + std::int32_t k = 0; + std::int32_t ix = std::bit_cast(x); + if (ix < 0x00800000) { + if ((ix & 0x7fffffff) == 0) { + errno = ERANGE; + return -two25 / vzero; + } + if (ix < 0) { + errno = EDOM; + return (x - x) / 0.0f; + } + k -= 25; + x *= two25; + ix = std::bit_cast(x); + } + if (ix >= 0x7f800000) { + return x + x; + } + k += (ix >> 23) - 127; + ix &= 0x007fffff; + std::int32_t i = (ix + (0x95f64 << 3)) & 0x800000; + x = std::bit_cast(ix | (i ^ 0x3f800000)); + k += i >> 23; + const float f = x - 1.0f; + const float dk = static_cast(k); + if ((0x007fffff & (0x8000 + ix)) < 0xc000) { + if (f == 0.0f) { + return k == 0 ? 0.0f : dk * ln2_hi + dk * ln2_lo; + } + const float R = f * f * (0.5f - static_cast(0.33333333333333333) * f); + return k == 0 ? f - R : dk * ln2_hi - ((R - dk * ln2_lo) - f); + } + const float s = f / (2.0f + f); + const float z = s * s; + i = ix - (0x6147a << 3); + const float w = z * z; + const std::int32_t j = (0x6b851 << 3) - ix; + const float t1 = w * (Lg2 + w * Lg4); + const float t2 = z * (Lg1 + w * Lg3); + i |= j; + const float R = t2 + t1; + if (i > 0) { + const float hfsq = 0.5f * f * f; + return k == 0 ? f - (hfsq - s * (hfsq + R)) : dk * ln2_hi - ((hfsq - (s * (hfsq + R) + dk * ln2_lo)) - f); + } + return k == 0 ? f - s * (f - R) : dk * ln2_hi - ((s * (f - R) - dk * ln2_lo) - f); +} float APS5_VABI log2f_nid_postfix(float x) { return std::log2(x); } double APS5_VABI log10_nid_postfix(double x) { return std::log10(x); } float APS5_VABI ldexpf_nid_postfix(float x, int exp) { return std::ldexp(x, exp); } diff --git a/core/libs/tests/GuestMath.cpp b/core/libs/tests/GuestMath.cpp index 04541e7c79..cf6dacc48f 100644 --- a/core/libs/tests/GuestMath.cpp +++ b/core/libs/tests/GuestMath.cpp @@ -125,6 +125,7 @@ float APS5_VABI nextafterf_nid_postfix(float, float); double APS5_VABI nextafter_nid_postfix(double, double); double APS5_VABI frexp_nid_postfix(double, int*); float APS5_VABI frexpf_nid_postfix(float, int*); +float APS5_VABI logf_nid_postfix(float); std::int64_t APS5_VABI lround_nid_postfix(double); std::div_t APS5_VABI div_nid_postfix(int, int); double APS5_VABI sinh_nid_postfix(double); @@ -1058,6 +1059,26 @@ static void RequireBytes(const void* constant, std::initializer_list(logf_nid_postfix(std::bit_cast(item.input))) == item.expected); + Require(errno == (item.error != 0 ? item.error : 1234)); + } +} + static void CheckDinkumwareConstants() { RequireBytes(&_Inf_nid_postfix, {0, 0, 0, 0, 0, 0, 0xf0, 0x7f}); RequireBytes(&_Denorm_nid_postfix, {1}); @@ -1589,6 +1610,7 @@ int main() { CheckScaledHyperbolic(); CheckSinhf(); CheckAtanhf(); + CheckLogfConsoleBits(); CheckHypotSpecialValue(); CheckFloatUnderflowErrno(); CheckFmodErrno(); diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index ce70a5a958..bf4c6ce2ba 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -64,6 +64,7 @@ - [Guest time conversions](../../../core/libs/prx/libc/src/Time.cpp) rewrite the host process `TZ` when a guest changes its own `TZ`, so other host consumers of that variable (including libSceRtc local time) shift too; code outside libc does not take the zone lock. Zone syntax follows the host C runtime, not FreeBSD: Windows only accepts the `std offset [dst]` form, treats an empty guest `TZ` as `UTC0` and reads `:Europe/Berlin` as an abbreviation (for example `rop`); only Linux honours zone file names. If the guest accepts a `TZ` value that the host rejects (on Windows, for example, one longer than the host environment limit), conversions throw `std::runtime_error`. A `tm_zone` saved before a `TZ` change can refer to storage now holding the new zone name, changing `%Z` output. - [__isfinitel](../../../core/libs/prx/libc/src/Math.cpp) - classifies the x87 80-bit exponent without narrowing to double or performing floating-point comparisons, following [FreeBSD msun](https://github.com/freebsd/freebsd-src/blob/main/lib/msun/src/s_isfinite.c). The signature and classification follow FreeBSD; console behaviour is unmeasured. Requires little-endian x87 long double stored in 16 bytes, as the existing guest long-double ABI does. +- [logf](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`e_logf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/e_logf.c), with `vzero` read at run time as msun's `volatile` read does. As in the `libc.prx` that titles ship, `errno` is set to `ERANGE` for ±0 and to `EDOM` for every argument with the sign bit set, negative NaNs and -inf included; positive NaNs and +inf leave it unchanged. Floating-point exceptions are not compared. It gives the same bits and `errno` as the `logf` of the `libc.prx` bundled with PPSA07923 and PPSA05916 for all 2^32 arguments, run on a Windows host. The FMA-contracted build bundled with PPSA13934 differs from it by 1 ulp on 961,881 arguments, so no single port matches every title's last bit. - Windows direct-memory backing reserves a paging-file section. A [direct memory page](../../../core/libs/prx/libc/include/WindowsMappings.hpp) mapped at one guest address is private write-watched memory at that address and is not committed in the section; a page mapped at a second address moves its whole resident run into the section (committed there) and every address becomes a view of it, tracked by write protection. An unmapped resident page that is not all zeros is kept in a private reservation until it is mapped again. Committed section contents remain across unmap/remap and are released when the backing and its remaining views are destroyed. A host import alias over part of a resident run is refused. Linux retains its existing backing. Peak gameplay memory and Windows versions other than the tested host remain unverified. - Stable Windows resident runs of at least 256 KiB use temporary read-only protection for clean write-watch proofs. The first CPU write restores the logical protection of the whole run; that run remains on native write watching until it is remapped, so repeatedly rewritten runs stay writable. Native kernel writes into guest buffers must hold [GuestArena::HostWrite](../../../core/libs/prx/libc/include/GuestArena.hpp), as shared views already require: an unbracketed WinAPI ReadFile can fail with ERROR_NOACCESS while the resident proof is armed. Guest read, pread and socket receive paths already bracket their destinations. GPU host-import access suppresses resident rearming without inventing shared-page stores. This is a host integration requirement, not a change to guest logical protection. From ac92cc6281131d8499a23c2d1f6ae47296027230 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Thu, 22 Oct 2026 15:18:48 -0400 Subject: [PATCH 026/113] fix(libc): compute cbrtf with FreeBSD msun's algorithm, as titles' libc.prx does cbrtf returned the host cbrt, so its result depended on the host: on Windows it differs from the libc.prx that titles ship on 1,303,357,444 of the 2^32 floats. That libc.prx is msun's s_cbrtf.c, which gives the same bits as PPSA07923's, PPSA05916's and PPSA13934's copies for every argument. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libc/src/Math.cpp | 28 +++++++++++++++++++++++++++- core/libs/tests/GuestMath.cpp | 17 +++++++++++++++++ docs/dev/debt/libc.md | 1 + 3 files changed, 45 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libc/src/Math.cpp b/core/libs/prx/libc/src/Math.cpp index 37616b7be3..9ea3cd7363 100644 --- a/core/libs/prx/libc/src/Math.cpp +++ b/core/libs/prx/libc/src/Math.cpp @@ -584,7 +584,33 @@ double APS5_VABI fmod_nid_postfix(double x, double y) { } float APS5_VABI roundf_nid_postfix(float x) { return std::round(x); } double APS5_VABI round_nid_postfix(double x) { return std::round(x); } -float APS5_VABI cbrtf_nid_postfix(float x) { return std::cbrt(x); } +float APS5_VABI cbrtf_nid_postfix(float x) { + const std::uint32_t B1 = 709958130; + const std::uint32_t B2 = 642849266; + std::uint32_t hx = std::bit_cast(x); + const std::uint32_t sign = hx & 0x80000000u; + hx ^= sign; + if (hx >= 0x7f800000u) { + return x + x; + } + float t; + if (hx < 0x00800000u) { + if (hx == 0) { + return x; + } + t = 0x1p24f * x; + const std::uint32_t high = std::bit_cast(t); + t = std::bit_cast(sign | ((high & 0x7fffffffu) / 3 + B2)); + } else { + t = std::bit_cast(sign | (hx / 3 + B1)); + } + double T = t; + double r = T * T * T; + T = T * (static_cast(x) + x + r) / (x + r + r); + r = T * T * T; + T = T * (static_cast(x) + x + r) / (x + r + r); + return static_cast(T); +} float APS5_VABI remainderf_nid_postfix(float x, float y) { return std::remainder(x, y); } float APS5_VABI nextafterf_nid_postfix(float x, float y) { return std::nextafter(x, y); } double APS5_VABI nextafter_nid_postfix(double x, double y) { return std::nextafter(x, y); } diff --git a/core/libs/tests/GuestMath.cpp b/core/libs/tests/GuestMath.cpp index 04541e7c79..f3124549f3 100644 --- a/core/libs/tests/GuestMath.cpp +++ b/core/libs/tests/GuestMath.cpp @@ -96,6 +96,7 @@ float APS5_VABI remquof_nid_postfix(float, float, int*); float APS5_VABI fmaf_nid_postfix(float, float, float); long double APS5_VABI ceill_nid_postfix(long double); long double APS5_VABI floorl_nid_postfix(long double); +float APS5_VABI cbrtf_nid_postfix(float); float APS5_VABI tanf_nid_postfix(float); int APS5_VABI rand_nid_postfix(); void APS5_VABI srand_nid_postfix(unsigned int); @@ -623,6 +624,21 @@ static void CheckAsinl() { *__error_nid_postfix() = 0; } +static void CheckCbrtfConsoleBits() { + constexpr std::uint32_t cases[][2] = { + {0x00000123u, 0x28059605u}, {0x00400327u, 0x2a4b334bu}, {0x3f000555u, 0x3f4b32c7u}, {0x3fc00778u, 0x3f9287e5u}, + {0x42000999u, 0x404b3509u}, {0x7e000bbcu, 0x544b362au}, {0xbf400dddu, 0xbf689d01u}, {0x80201002u, 0xaa215ff8u}, + {0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u}, {0x00000001u, 0x26a14518u}, {0x007fffffu, 0x2a7fffffu}, + {0x00800000u, 0x2a800000u}, {0x3f800000u, 0x3f800000u}, {0x41000000u, 0x40000000u}, {0xc1000000u, 0xc0000000u}, + {0x7f7fffffu, 0x54cb2ff5u}, {0x7f800000u, 0x7f800000u}, {0xff800000u, 0xff800000u}, {0x7fc00001u, 0x7fc00001u}, + {0xffc00002u, 0xffc00002u}, + }; + for (const auto& [input, expected] : cases) { + errno = 1234; + Require(std::bit_cast(cbrtf_nid_postfix(std::bit_cast(input))) == expected && errno == 1234); + } +} + static void CheckIntegerConversions() { for (const long long numerator : {4294967301LL, -4294967301LL}) { for (const long long denominator : {3LL, -3LL}) { @@ -1309,6 +1325,7 @@ int main() { CheckMissingClassificationExports(); CheckFloatMathExports(); CheckIntegerConversions(); + CheckCbrtfConsoleBits(); CheckExtendedMath(); Require(atof_nid_postfix(" -12.5tail") == -12.5); char* end = nullptr; diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index ce70a5a958..76a49e45e2 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -63,6 +63,7 @@ - [memmem and memccpy](../../../core/libs/prx/libc/src/Strings.cpp) (libc) - `memmem` searches for needle occurrences in memory buffers and `memccpy` copies buffers until a character match, following FreeBSD and POSIX specifications; behavior is unverified on console. - [Guest time conversions](../../../core/libs/prx/libc/src/Time.cpp) rewrite the host process `TZ` when a guest changes its own `TZ`, so other host consumers of that variable (including libSceRtc local time) shift too; code outside libc does not take the zone lock. Zone syntax follows the host C runtime, not FreeBSD: Windows only accepts the `std offset [dst]` form, treats an empty guest `TZ` as `UTC0` and reads `:Europe/Berlin` as an abbreviation (for example `rop`); only Linux honours zone file names. If the guest accepts a `TZ` value that the host rejects (on Windows, for example, one longer than the host environment limit), conversions throw `std::runtime_error`. A `tm_zone` saved before a `TZ` change can refer to storage now holding the new zone name, changing `%Z` output. +- [cbrtf](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`s_cbrtf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_cbrtf.c): a 5-bit first guess from the exponent bits, then two Newton steps in double precision. It sets no `errno`, as the `libc.prx` that titles ship does not. Floating-point exceptions are not compared. It gives the same bits as the `cbrtf` of the `libc.prx` bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host. - [__isfinitel](../../../core/libs/prx/libc/src/Math.cpp) - classifies the x87 80-bit exponent without narrowing to double or performing floating-point comparisons, following [FreeBSD msun](https://github.com/freebsd/freebsd-src/blob/main/lib/msun/src/s_isfinite.c). The signature and classification follow FreeBSD; console behaviour is unmeasured. Requires little-endian x87 long double stored in 16 bytes, as the existing guest long-double ABI does. - Windows direct-memory backing reserves a paging-file section. A [direct memory page](../../../core/libs/prx/libc/include/WindowsMappings.hpp) mapped at one guest address is private write-watched memory at that address and is not committed in the section; a page mapped at a second address moves its whole resident run into the section (committed there) and every address becomes a view of it, tracked by write protection. An unmapped resident page that is not all zeros is kept in a private reservation until it is mapped again. Committed section contents remain across unmap/remap and are released when the backing and its remaining views are destroyed. A host import alias over part of a resident run is refused. Linux retains its existing backing. Peak gameplay memory and Windows versions other than the tested host remain unverified. From 6710ba6702604ebd8f191ebdc76625e5ccae4e42 Mon Sep 17 00:00:00 2001 From: Federico Marras Date: Thu, 22 Oct 2026 22:49:04 +0200 Subject: [PATCH 027/113] feat(libSceNpScoreRanking): model the score requests offline The 15 exports threw. They now keep title contexts and requests, run shadPS4's argument checks in its order, and answer the record, ranking and board calls with SCE_NP_ERROR_SIGNED_OUT, which also finishes the request, as shadPS4 does for a user with no connection. --- .../prx/libSceNpScoreRanking/CMakeLists.txt | 16 ++ core/libs/prx/libSceNpScoreRanking/Export.cpp | 247 ++++++++++++++---- core/libs/tests/GuestNpScoreOffline.cpp | 223 ++++++++++++++++ docs/dev/debt/libSceNpScoreRanking.md | 5 + 4 files changed, 444 insertions(+), 47 deletions(-) create mode 100644 core/libs/prx/libSceNpScoreRanking/CMakeLists.txt create mode 100644 core/libs/tests/GuestNpScoreOffline.cpp create mode 100644 docs/dev/debt/libSceNpScoreRanking.md diff --git a/core/libs/prx/libSceNpScoreRanking/CMakeLists.txt b/core/libs/prx/libSceNpScoreRanking/CMakeLists.txt new file mode 100644 index 0000000000..d73264a441 --- /dev/null +++ b/core/libs/prx/libSceNpScoreRanking/CMakeLists.txt @@ -0,0 +1,16 @@ +add_library(libSceNpScoreRanking SHARED EXCLUDE_FROM_ALL Export.cpp) +target_include_directories(libSceNpScoreRanking PRIVATE ${LIBS_INCLUDE_DIR}) +configure_windows_unwind(libSceNpScoreRanking) + +if(BUILD_TESTING) + add_test_executable(guest_np_score_offline_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpScoreOffline.cpp) + target_include_directories(guest_np_score_offline_tests PRIVATE ${LIBS_INCLUDE_DIR}) + target_link_libraries(guest_np_score_offline_tests PRIVATE libSceNpScoreRanking) + configure_windows_unwind(guest_np_score_offline_tests) + add_test(NAME guest_np_score_offline COMMAND guest_np_score_offline_tests) + set_tests_properties(guest_np_score_offline PROPERTIES TIMEOUT 20) + if(WIN32) + set_tests_properties(guest_np_score_offline PROPERTIES ENVIRONMENT_MODIFICATION + "PATH=path_list_prepend:$") + endif() +endif() diff --git a/core/libs/prx/libSceNpScoreRanking/Export.cpp b/core/libs/prx/libSceNpScoreRanking/Export.cpp index 1bb8bc6df6..47690794d0 100644 --- a/core/libs/prx/libSceNpScoreRanking/Export.cpp +++ b/core/libs/prx/libSceNpScoreRanking/Export.cpp @@ -1,81 +1,234 @@ +#include +#include +#include +#include +#include +#include +#include #include "SceTypes.hpp" #include "prx/libc/include/General.hpp" +static constexpr int SCE_NP_ERROR_SIGNED_OUT = static_cast(0x80550006); +static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT = static_cast(0x80550704); +static constexpr int SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS = static_cast(0x80550706); +static constexpr int SCE_NP_COMMUNITY_ERROR_ABORTED = static_cast(0x80550707); +static constexpr int SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT = static_cast(0x8055070C); +static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ID = static_cast(0x8055070E); +static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT = static_cast(0x80550714); +static constexpr int SCE_NP_COMMUNITY_ERROR_TOO_MANY_NPID = static_cast(0x80550719); +static constexpr std::uint32_t INVALID_SERVICE_LABEL = 0xFFFFFFFF; +static constexpr std::size_t MAX_OBJECTS = 32; +static constexpr std::uint64_t MAX_RANGE_PER_REQUEST = 100; +static constexpr std::uint64_t MAX_NPID_PER_REQUEST = 101; +static constexpr std::uint64_t GAME_INFO_MAX_SIZE = 189; +static constexpr std::uint64_t NP_ID_SIZE = 36; +static constexpr std::uint64_t RANK_DATA_SIZE = 0x80; +static constexpr std::uint64_t PLAYER_RANK_DATA_SIZE = 0x88; +static constexpr std::uint64_t COMMENT_SIZE = 64; +static constexpr std::uint64_t GAME_INFO_SIZE = 200; +static constexpr std::uint64_t FRIEND_RANKING_OPTION_SIZE = 24; +static constexpr int POLL_FINISHED = 0; +static constexpr int POLL_RUNNING = 1; + +struct NpScoreGameInfo { + std::uint64_t infoSize; + std::uint8_t data[189]; + std::uint8_t pad[3]; +}; +static_assert(sizeof(NpScoreGameInfo) == GAME_INFO_SIZE); + +struct NpScoreFriendRankingOption { + std::uint64_t size; + const std::uint32_t* startSerialRank; + const std::uint32_t* hits; +}; +static_assert(sizeof(NpScoreFriendRankingOption) == FRIEND_RANKING_OPTION_SIZE); + +namespace { +struct Request { + int titleCtxId = 0; + std::optional result; +}; + +std::mutex scoreMutex; +std::unordered_set titleContexts; +std::unordered_map requests; +int nextTitleContext = 1; +int nextRequest = 1; + +int CheckArrays(std::uint64_t arrayNum, const void* commentArray, std::uint64_t commentArraySize, const void* infoArray, std::uint64_t infoArraySize) { + if (commentArray && commentArraySize != arrayNum * COMMENT_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT; + if (infoArray && infoArraySize != arrayNum * GAME_INFO_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT; + return 0; +} + +int Offline(int reqId) { + std::lock_guard lock(scoreMutex); + const auto request = requests.find(reqId); + if (request == requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID; + if (request->second.result == SCE_NP_COMMUNITY_ERROR_ABORTED) return SCE_NP_COMMUNITY_ERROR_ABORTED; + if (!request->second.result) request->second.result = SCE_NP_ERROR_SIGNED_OUT; + return SCE_NP_ERROR_SIGNED_OUT; +} + +int RecordScore(int reqId, const NpScoreGameInfo* gameInfo, void* option) { + if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (gameInfo && gameInfo->infoSize > GAME_INFO_MAX_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + return Offline(reqId); +} + +int GetRankingByRange(int reqId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* option) { + if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (arrayNum > MAX_RANGE_PER_REQUEST) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (startSerialRank == 0) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (!rankArray || arrayNum == 0) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT; + if (rankArraySize != arrayNum * RANK_DATA_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT; + if (const int error = CheckArrays(arrayNum, commentArray, commentArraySize, infoArray, infoArraySize)) return error; + return Offline(reqId); +} + +int GetRankingByNpId(int reqId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* option) { + if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (arrayNum > MAX_NPID_PER_REQUEST) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_NPID; + if (!npIdArray || !rankArray) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT; + if (npIdArraySize != arrayNum * NP_ID_SIZE || rankArraySize != arrayNum * PLAYER_RANK_DATA_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT; + if (const int error = CheckArrays(arrayNum, commentArray, commentArraySize, infoArray, infoArraySize)) return error; + return Offline(reqId); +} + +int GetFriendsRanking(int reqId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, const NpScoreFriendRankingOption* option) { + if (!rankArray) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (rankArraySize != arrayNum * RANK_DATA_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT; + std::uint32_t startSerialRank = 1; + if (includeSelf == 0) { + if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + } else if (option) { + if (option->size != FRIEND_RANKING_OPTION_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (option->startSerialRank) startSerialRank = *option->startSerialRank; + } + if (arrayNum > MAX_RANGE_PER_REQUEST) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (startSerialRank == 0) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (arrayNum == 0) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT; + if (const int error = CheckArrays(arrayNum, commentArray, commentArraySize, infoArray, infoArraySize)) return error; + return Offline(reqId); +} +} + extern "C" { -int APS5_VABI sceNpScoreAbortRequest() { - NotImplemented_nid_no_patch(__func__); +int APS5_VABI sceNpScoreAbortRequest(int reqId) { + std::lock_guard lock(scoreMutex); + const auto request = requests.find(reqId); + if (request == requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID; + if (!request->second.result) request->second.result = SCE_NP_COMMUNITY_ERROR_ABORTED; return 0; } -int APS5_VABI sceNpScoreCreateNpTitleCtx() { - NotImplemented_nid_no_patch(__func__); +int APS5_VABI sceNpScoreCreateNpTitleCtx(std::uint32_t serviceLabel, const void* selfNpId) { + if (serviceLabel == INVALID_SERVICE_LABEL) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (!selfNpId) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT; + std::lock_guard lock(scoreMutex); + if (titleContexts.size() >= MAX_OBJECTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS; + const int titleCtxId = nextTitleContext++; + titleContexts.insert(titleCtxId); + return titleCtxId; +} + +int APS5_VABI sceNpScoreCreateRequest(int titleCtxId) { + std::lock_guard lock(scoreMutex); + if (!titleContexts.contains(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID; + if (requests.size() >= MAX_OBJECTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS; + const int reqId = nextRequest++; + requests.emplace(reqId, Request{titleCtxId}); + return reqId; +} + +int APS5_VABI sceNpScoreDeleteNpTitleCtx(int titleCtxId) { + std::lock_guard lock(scoreMutex); + if (!titleContexts.erase(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID; + std::erase_if(requests, [titleCtxId](const auto& entry) { return entry.second.titleCtxId == titleCtxId; }); return 0; } -int APS5_VABI sceNpScoreCreateRequest() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreDeleteRequest(int reqId) { + std::lock_guard lock(scoreMutex); + return requests.erase(reqId) ? 0 : SCE_NP_COMMUNITY_ERROR_INVALID_ID; } -int APS5_VABI sceNpScoreDeleteNpTitleCtx() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreGetBoardInfo(int reqId, std::uint32_t boardId, void* boardInfo, void* option) { + (void)boardId; + if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT; + if (!boardInfo) throw std::runtime_error("sceNpScoreGetBoardInfo: the answer for a null board info depends on the title's SDK version"); + return Offline(reqId); } -int APS5_VABI sceNpScoreDeleteRequest() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreGetFriendsRanking(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option) { + (void)boardId; + (void)lastSortDate; + (void)totalRecord; + return GetFriendsRanking(reqId, includeSelf, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option); } -int APS5_VABI sceNpScoreGetBoardInfo() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreGetFriendsRankingAsync(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option) { + (void)boardId; + (void)lastSortDate; + (void)totalRecord; + return GetFriendsRanking(reqId, includeSelf, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option); } -int APS5_VABI sceNpScoreGetFriendsRanking() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreGetRankingByNpId(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) { + (void)boardId; + (void)lastSortDate; + (void)totalRecord; + return GetRankingByNpId(reqId, npIdArray, npIdArraySize, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option); } -int APS5_VABI sceNpScoreGetFriendsRankingAsync() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreGetRankingByNpIdAsync(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) { + (void)boardId; + (void)lastSortDate; + (void)totalRecord; + return GetRankingByNpId(reqId, npIdArray, npIdArraySize, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option); } -int APS5_VABI sceNpScoreGetRankingByNpId() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreGetRankingByRange(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) { + (void)boardId; + (void)lastSortDate; + (void)totalRecord; + return GetRankingByRange(reqId, startSerialRank, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option); } -int APS5_VABI sceNpScoreGetRankingByNpIdAsync() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreGetRankingByRangeAsync(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) { + (void)boardId; + (void)lastSortDate; + (void)totalRecord; + return GetRankingByRange(reqId, startSerialRank, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option); } -int APS5_VABI sceNpScoreGetRankingByRange() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScorePollAsync(int reqId, int* result) { + std::lock_guard lock(scoreMutex); + const auto request = requests.find(reqId); + if (request == requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID; + if (!request->second.result) return POLL_RUNNING; + if (result) *result = *request->second.result; + return POLL_FINISHED; } -int APS5_VABI sceNpScoreGetRankingByRangeAsync() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreRecordScore(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option) { + (void)boardId; + (void)score; + (void)scoreComment; + (void)tmpRank; + (void)compareDate; + return RecordScore(reqId, gameInfo, option); } -int APS5_VABI sceNpScorePollAsync() { - NotImplemented_nid_no_patch(__func__); - return 0; -} - -int APS5_VABI sceNpScoreRecordScore() { - NotImplemented_nid_no_patch(__func__); - return 0; -} - -int APS5_VABI sceNpScoreRecordScoreAsync() { - NotImplemented_nid_no_patch(__func__); - return 0; +int APS5_VABI sceNpScoreRecordScoreAsync(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option) { + (void)boardId; + (void)score; + (void)scoreComment; + (void)tmpRank; + (void)compareDate; + return RecordScore(reqId, gameInfo, option); } } diff --git a/core/libs/tests/GuestNpScoreOffline.cpp b/core/libs/tests/GuestNpScoreOffline.cpp new file mode 100644 index 0000000000..cb6adb87eb --- /dev/null +++ b/core/libs/tests/GuestNpScoreOffline.cpp @@ -0,0 +1,223 @@ +#include "SceTypes.hpp" +#include +#include +#include + +extern "C" { +int APS5_VABI sceNpScoreCreateNpTitleCtx(std::uint32_t serviceLabel, const void* selfNpId); +int APS5_VABI sceNpScoreDeleteNpTitleCtx(int titleCtxId); +int APS5_VABI sceNpScoreCreateRequest(int titleCtxId); +int APS5_VABI sceNpScoreDeleteRequest(int reqId); +int APS5_VABI sceNpScoreAbortRequest(int reqId); +int APS5_VABI sceNpScorePollAsync(int reqId, int* result); +int APS5_VABI sceNpScoreRecordScore(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const void* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option); +int APS5_VABI sceNpScoreRecordScoreAsync(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const void* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option); +int APS5_VABI sceNpScoreGetRankingByRange(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option); +int APS5_VABI sceNpScoreGetRankingByRangeAsync(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option); +int APS5_VABI sceNpScoreGetRankingByNpId(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option); +int APS5_VABI sceNpScoreGetRankingByNpIdAsync(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option); +int APS5_VABI sceNpScoreGetFriendsRanking(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const void* option); +int APS5_VABI sceNpScoreGetFriendsRankingAsync(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const void* option); +int APS5_VABI sceNpScoreGetBoardInfo(int reqId, std::uint32_t boardId, void* boardInfo, void* option); +} + +namespace { + +constexpr int SignedOut = static_cast(0x80550006u); +constexpr int InvalidArgument = static_cast(0x80550704u); +constexpr int TooManyObjects = static_cast(0x80550706u); +constexpr int Aborted = static_cast(0x80550707u); +constexpr int InsufficientArgument = static_cast(0x8055070Cu); +constexpr int InvalidId = static_cast(0x8055070Eu); +constexpr int InvalidAlignment = static_cast(0x80550714u); +constexpr int TooManyNpId = static_cast(0x80550719u); +constexpr int PollFinished = 0; +constexpr int PollRunning = 1; + +struct GameInfo { + std::uint64_t infoSize; + std::uint8_t data[189]; + std::uint8_t pad[3]; +}; + +struct FriendOption { + std::uint64_t size; + const std::uint32_t* startSerialRank; + const std::uint32_t* hits; +}; + +int failures = 0; +int context = 0; +unsigned char selfNpId[36]; +unsigned char npIds[2 * 36]; +unsigned char ranks[2 * 0x88]; +unsigned char comments[2 * 64]; +unsigned char infos[2 * 200]; +unsigned char board[24]; +unsigned char manyNpIds[101 * 36]; +unsigned char manyRanks[101 * 0x88]; + +void Require(bool value, const char* name, const char* what) { + if (value) return; + std::fprintf(stderr, "%s: %s\n", name, what); + ++failures; +} + +int NewRequest() { + return sceNpScoreCreateRequest(context); +} + +bool Untouched() { + for (const unsigned char value : ranks) if (value != 0xA5) return false; + for (const unsigned char value : comments) if (value != 0xA5) return false; + for (const unsigned char value : infos) if (value != 0xA5) return false; + for (const unsigned char value : board) if (value != 0xA5) return false; + return true; +} + +void CheckOffline(const char* name, int status, int req) { + Require(status == SignedOut, name, "valid arguments did not return SIGNED_OUT"); + int result = 0; + Require(sceNpScorePollAsync(req, &result) == PollFinished && result == SignedOut, name, "the request did not finish with SIGNED_OUT"); +} + +void CheckContexts() { + Require(sceNpScoreCreateNpTitleCtx(0xFFFFFFFFu, nullptr) == InvalidArgument, "sceNpScoreCreateNpTitleCtx", "the invalid service label was not refused before the null NpId"); + Require(sceNpScoreCreateNpTitleCtx(0, nullptr) == InsufficientArgument, "sceNpScoreCreateNpTitleCtx", "a null NpId was taken"); + context = sceNpScoreCreateNpTitleCtx(0, selfNpId); + Require(context == 1, "sceNpScoreCreateNpTitleCtx", "the first context is not id 1"); + Require(sceNpScoreCreateRequest(context + 100) == InvalidId, "sceNpScoreCreateRequest", "an unknown context was taken"); + int extra[31]; + for (int& entry : extra) entry = sceNpScoreCreateNpTitleCtx(1, selfNpId); + Require(extra[30] == 32, "sceNpScoreCreateNpTitleCtx", "32 contexts could not be created"); + Require(sceNpScoreCreateNpTitleCtx(1, selfNpId) == TooManyObjects, "sceNpScoreCreateNpTitleCtx", "a 33rd context did not return TOO_MANY_OBJECTS"); + const int kept = sceNpScoreCreateRequest(extra[0]); + Require(kept == 1, "sceNpScoreCreateRequest", "the first request is not id 1"); + for (const int entry : extra) Require(sceNpScoreDeleteNpTitleCtx(entry) == 0, "sceNpScoreDeleteNpTitleCtx", "deleting a context failed"); + Require(sceNpScoreDeleteRequest(kept) == InvalidId, "sceNpScoreDeleteNpTitleCtx", "a request of a deleted context was kept"); + Require(sceNpScoreDeleteNpTitleCtx(extra[0]) == InvalidId, "sceNpScoreDeleteNpTitleCtx", "a deleted context was found"); + int requests[32]; + for (int& entry : requests) entry = NewRequest(); + Require(requests[31] > 0, "sceNpScoreCreateRequest", "32 requests could not be created"); + Require(NewRequest() == TooManyObjects, "sceNpScoreCreateRequest", "a 33rd request did not return TOO_MANY_OBJECTS"); + for (const int entry : requests) sceNpScoreDeleteRequest(entry); + Require(sceNpScoreDeleteRequest(requests[0]) == InvalidId, "sceNpScoreDeleteRequest", "a deleted request was found"); +} + +void CheckRequests() { + int req = NewRequest(); + int result = 7; + Require(sceNpScorePollAsync(req + 100, &result) == InvalidId, "sceNpScorePollAsync", "an unknown request was taken"); + Require(sceNpScorePollAsync(req, &result) == PollRunning && result == 7, "sceNpScorePollAsync", "an unstarted request was not running"); + Require(sceNpScoreAbortRequest(req + 100) == InvalidId, "sceNpScoreAbortRequest", "an unknown request was taken"); + Require(sceNpScoreAbortRequest(req) == 0, "sceNpScoreAbortRequest", "aborting failed"); + Require(sceNpScorePollAsync(req, nullptr) == PollFinished, "sceNpScorePollAsync", "a null result was not accepted"); + Require(sceNpScorePollAsync(req, &result) == PollFinished && result == Aborted, "sceNpScoreAbortRequest", "an aborted request did not finish with ABORTED"); + Require(sceNpScoreRecordScore(req, 1, 5, nullptr, nullptr, nullptr, nullptr, nullptr) == Aborted, "sceNpScoreRecordScore", "an aborted request did not return ABORTED"); + sceNpScoreDeleteRequest(req); + + req = NewRequest(); + Require(sceNpScoreRecordScore(req, 1, 5, nullptr, nullptr, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreRecordScore", "the first call did not return SIGNED_OUT"); + Require(sceNpScoreAbortRequest(req) == 0, "sceNpScoreAbortRequest", "aborting a finished request failed"); + Require(sceNpScorePollAsync(req, &result) == PollFinished && result == SignedOut, "sceNpScoreAbortRequest", "aborting a finished request changed its result"); + Require(sceNpScoreRecordScore(req, 1, 5, nullptr, nullptr, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreRecordScore", "a finished request was not reused"); + sceNpScoreDeleteRequest(req); +} + +void CheckRecord() { + GameInfo info{}; + std::uint32_t tmpRank = 77; + const int req = NewRequest(); + info.infoSize = 190; + Require(sceNpScoreRecordScore(req, 1, 5, nullptr, &info, &tmpRank, nullptr, &info) == InvalidArgument, "sceNpScoreRecordScore", "an option was taken"); + Require(sceNpScoreRecordScore(req, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr) == InvalidArgument, "sceNpScoreRecordScore", "190 bytes of game info were taken"); + Require(sceNpScoreRecordScoreAsync(req, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr) == InvalidArgument, "sceNpScoreRecordScoreAsync", "190 bytes of game info were taken"); + info.infoSize = 189; + Require(sceNpScoreRecordScore(req + 100, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr) == InvalidId, "sceNpScoreRecordScore", "an unknown request was taken"); + Require(sceNpScorePollAsync(req, nullptr) == PollRunning, "sceNpScoreRecordScore", "a refused call finished the request"); + CheckOffline("sceNpScoreRecordScoreAsync", sceNpScoreRecordScoreAsync(req, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr), req); + Require(tmpRank == 77, "sceNpScoreRecordScoreAsync", "a rank was written"); + sceNpScoreDeleteRequest(req); +} + +void CheckRange() { + const int req = NewRequest(); + Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, board) == InvalidArgument, "sceNpScoreGetRankingByRange", "an option was taken"); + Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 101 * 0x80, nullptr, 0, nullptr, 0, 101, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetRankingByRange", "101 ranks were taken"); + Require(sceNpScoreGetRankingByRange(req, 1, 0, nullptr, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetRankingByRange", "rank 0 was not refused before the null array"); + Require(sceNpScoreGetRankingByRange(req, 1, 1, nullptr, 3, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByRange", "a null rank array was not refused before its size"); + Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByRange", "zero ranks were taken"); + Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByRange", "a rank array size other than 0x80 per rank was taken"); + Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x100, comments, 64, nullptr, 0, 2, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByRange", "a comment array size other than 64 per rank was taken"); + Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x100, comments, 128, infos, 200, 2, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByRange", "an info array size other than 200 per rank was taken"); + Require(sceNpScoreGetRankingByRange(req + 100, 1, 1, ranks, 0x100, comments, 128, infos, 400, 2, nullptr, nullptr, nullptr) == InvalidId, "sceNpScoreGetRankingByRange", "an unknown request was taken"); + CheckOffline("sceNpScoreGetRankingByRange", sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x100, comments, 128, infos, 400, 2, nullptr, nullptr, nullptr), req); + Require(sceNpScoreGetRankingByRangeAsync(req, 1, 1, ranks, 0x100, nullptr, 0, nullptr, 0, 2, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByRangeAsync", "valid arguments did not return SIGNED_OUT"); + Require(sceNpScoreGetRankingByRangeAsync(req, 1, 0, ranks, 0x100, nullptr, 0, nullptr, 0, 2, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetRankingByRangeAsync", "rank 0 was taken"); + Require(sceNpScoreGetRankingByRangeAsync(req, 1, 1, manyRanks, 100 * 0x80, nullptr, 0, nullptr, 0, 100, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByRangeAsync", "100 ranks did not return SIGNED_OUT"); + sceNpScoreDeleteRequest(req); +} + +void CheckNpId() { + const int req = NewRequest(); + Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, board) == InvalidArgument, "sceNpScoreGetRankingByNpId", "an option was taken"); + Require(sceNpScoreGetRankingByNpId(req, 1, nullptr, 0, nullptr, 0, nullptr, 0, nullptr, 0, 102, nullptr, nullptr, nullptr) == TooManyNpId, "sceNpScoreGetRankingByNpId", "102 NpIds were not refused before the null arrays"); + Require(sceNpScoreGetRankingByNpId(req, 1, nullptr, 36, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByNpId", "a null NpId array was taken"); + Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, nullptr, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByNpId", "a null rank array was taken"); + Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 24, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByNpId", "an NpId array size other than 36 per NpId was taken"); + Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByNpId", "a rank array size other than 0x88 per NpId was taken"); + Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, ranks, 0x88, comments, 128, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByNpId", "a comment array size other than 64 per NpId was taken"); + CheckOffline("sceNpScoreGetRankingByNpId", sceNpScoreGetRankingByNpId(req, 1, npIds, 72, ranks, 0x110, comments, 128, infos, 400, 2, nullptr, nullptr, nullptr), req); + Require(sceNpScoreGetRankingByNpIdAsync(req, 1, npIds, 0, ranks, 0, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByNpIdAsync", "zero NpIds did not return SIGNED_OUT"); + Require(sceNpScoreGetRankingByNpIdAsync(req, 1, manyNpIds, sizeof(manyNpIds), manyRanks, sizeof(manyRanks), nullptr, 0, nullptr, 0, 101, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByNpIdAsync", "101 NpIds did not return SIGNED_OUT"); + sceNpScoreDeleteRequest(req); +} + +void CheckFriends() { + const int req = NewRequest(); + const std::uint32_t zero = 0; + const std::uint32_t five = 5; + const FriendOption shortOption{16, nullptr, nullptr}; + const FriendOption rankZero{24, &zero, nullptr}; + const FriendOption rankFive{24, &five, nullptr}; + Require(sceNpScoreGetFriendsRanking(req, 1, 0, nullptr, 0x80, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, &shortOption) == InvalidArgument, "sceNpScoreGetFriendsRanking", "a null rank array was taken"); + Require(sceNpScoreGetFriendsRanking(req, 1, 0, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &shortOption) == InvalidAlignment, "sceNpScoreGetFriendsRanking", "the rank array size was not checked before the option"); + Require(sceNpScoreGetFriendsRanking(req, 1, 0, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &rankFive) == InvalidArgument, "sceNpScoreGetFriendsRanking", "an option without includeSelf was taken"); + Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &shortOption) == InvalidArgument, "sceNpScoreGetFriendsRanking", "an option size other than 24 was taken"); + Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &rankZero) == InvalidArgument, "sceNpScoreGetFriendsRanking", "start rank 0 was taken"); + Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 101 * 0x80, nullptr, 0, nullptr, 0, 101, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetFriendsRanking", "101 friends were taken"); + Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetFriendsRanking", "zero friends were taken"); + Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, nullptr, 0, infos, 400, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetFriendsRanking", "an info array size other than 200 per friend was taken"); + CheckOffline("sceNpScoreGetFriendsRanking", sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, comments, 64, infos, 200, 1, nullptr, nullptr, &rankFive), req); + Require(sceNpScoreGetFriendsRankingAsync(req, 1, 0, ranks, 0x100, nullptr, 0, nullptr, 0, 2, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetFriendsRankingAsync", "valid arguments did not return SIGNED_OUT"); + Require(sceNpScoreGetFriendsRankingAsync(req, 1, 0, manyRanks, 100 * 0x80, nullptr, 0, nullptr, 0, 100, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetFriendsRankingAsync", "100 friends did not return SIGNED_OUT"); + sceNpScoreDeleteRequest(req); +} + +void CheckBoard() { + const int req = NewRequest(); + Require(sceNpScoreGetBoardInfo(req, 1, board, board) == InvalidArgument, "sceNpScoreGetBoardInfo", "an option was taken"); + Require(sceNpScoreGetBoardInfo(req + 100, 1, board, nullptr) == InvalidId, "sceNpScoreGetBoardInfo", "an unknown request was taken"); + CheckOffline("sceNpScoreGetBoardInfo", sceNpScoreGetBoardInfo(req, 1, board, nullptr), req); + sceNpScoreDeleteRequest(req); +} + +} + +int main() { + std::memset(ranks, 0xA5, sizeof(ranks)); + std::memset(comments, 0xA5, sizeof(comments)); + std::memset(infos, 0xA5, sizeof(infos)); + std::memset(board, 0xA5, sizeof(board)); + CheckContexts(); + CheckRequests(); + CheckRecord(); + CheckRange(); + CheckNpId(); + CheckFriends(); + CheckBoard(); + Require(Untouched(), "libSceNpScoreRanking", "an output array was written"); + if (failures != 0) return 1; + std::puts("NpScoreRanking offline tests passed"); + return 0; +} diff --git a/docs/dev/debt/libSceNpScoreRanking.md b/docs/dev/debt/libSceNpScoreRanking.md new file mode 100644 index 0000000000..d373e91695 --- /dev/null +++ b/docs/dev/debt/libSceNpScoreRanking.md @@ -0,0 +1,5 @@ +# libSceNpScoreRanking technical debt + +### Functional + +- [libSceNpScoreRanking](../../../core/libs/prx/libSceNpScoreRanking/Export.cpp) (libSceNpScoreRanking) - offline only, not measured on a PS5: the argument checks, their order, the limit of 32 title contexts and 32 requests and the array sizes follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_score/np_score.cpp#L64-L1210), and a valid call then returns `SCE_NP_ERROR_SIGNED_OUT` and finishes its request with it, as shadPS4 does when the user [has no connection](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_handler/np_handler_score.cpp#L18-L26). No output is written, where shadPS4 first clears the rank, comment and info arrays. A null `boardInfo` throws: shadPS4 answers it by the title's SDK version From 71932c0a56447615c74c5edca1e1272c5ec8e870 Mon Sep 17 00:00:00 2001 From: sivasdeadknight Date: Thu, 22 Oct 2026 20:55:01 +0200 Subject: [PATCH 028/113] fix(libSceNpManager): validate request ids for abort, delete and poll sceNpAbortRequest and sceNpDeleteRequest return SCE_NP_ERROR_REQUEST_NOT_FOUND for an id that was never created or was deleted; sceNpPollAsync does too and additionally rejects a null result pointer with SCE_NP_ERROR_INVALID_ARGUMENT before reading the id, without writing the caller's result. A live request keeps its signed-out completion. This pins the validation half of shadPS4's np_manager model that issue #9277 reports; the kind, completion state and WaitAsync publication half stays open, documented in the debt entry, and the sceNpWaitAsync export itself stays with PR #9282. Tests: guest_np_manager tests the four absent/deleted probes (0, -1, 0x7fffffff, a deleted id) for all three calls, output preservation, null-result precedence and the live-id paths; guest_np_reachability unchanged. Both pass on Linux; the new asserts failed on unpatched exports first. --- core/libs/prx/libSceNpManager/Export.cpp | 11 +++++---- core/libs/tests/GuestNpManager.cpp | 30 ++++++++++++++++++++++++ docs/dev/debt/libSceNpManager.md | 5 ++++ 3 files changed, 42 insertions(+), 4 deletions(-) diff --git a/core/libs/prx/libSceNpManager/Export.cpp b/core/libs/prx/libSceNpManager/Export.cpp index 15fd862b97..c50ab5b01f 100644 --- a/core/libs/prx/libSceNpManager/Export.cpp +++ b/core/libs/prx/libSceNpManager/Export.cpp @@ -673,8 +673,8 @@ int APS5_VABI sceNpManagerIntLoginGetAccessToken(void) { } int APS5_VABI sceNpAbortRequest(int req_id) { - (void)req_id; - return 0; + std::lock_guard lock(requestMutex); + return liveRequests.count(req_id) ? 0 : SCE_NP_ERROR_REQUEST_NOT_FOUND; } int APS5_VABI sceNpCheckCallback(void) { @@ -724,6 +724,7 @@ int APS5_VABI sceNpCreateRequest(void) { int APS5_VABI sceNpDeleteRequest(int req_id) { std::lock_guard lock(requestMutex); + if (!liveRequests.count(req_id)) return SCE_NP_ERROR_REQUEST_NOT_FOUND; liveRequests.erase(req_id); return 0; } @@ -834,8 +835,10 @@ int APS5_VABI sceNpHasSignedUp(int user_id, bool* has_signed_up) { } int APS5_VABI sceNpPollAsync(int req_id, int* result) { - (void)req_id; - if (result) *result = SCE_NP_ERROR_SIGNED_OUT; + if (!result) return SCE_NP_ERROR_INVALID_ARGUMENT; + std::lock_guard lock(requestMutex); + if (!liveRequests.count(req_id)) return SCE_NP_ERROR_REQUEST_NOT_FOUND; + *result = SCE_NP_ERROR_SIGNED_OUT; return NP_POLL_ASYNC_FINISHED; } diff --git a/core/libs/tests/GuestNpManager.cpp b/core/libs/tests/GuestNpManager.cpp index 67e63ff3b0..ef285cab3a 100644 --- a/core/libs/tests/GuestNpManager.cpp +++ b/core/libs/tests/GuestNpManager.cpp @@ -33,6 +33,8 @@ extern "C" { int APS5_VABI sceNpCreateRequest(void); int APS5_VABI sceNpCreateAsyncRequest(const NpCreateAsyncRequestParameter* param); int APS5_VABI sceNpDeleteRequest(int reqId); +int APS5_VABI sceNpAbortRequest(int reqId); +int APS5_VABI sceNpPollAsync(int reqId, int* result); int APS5_VABI sceNpSetTimeout(int reqId, std::int32_t resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout); } @@ -238,6 +240,33 @@ void CheckRequestTimeouts() { Require(sceNpSetTimeout(asyncId, 2, 0, 0, 0, 0) == RequestNotFound, "deleted async request"); } +void CheckAsyncRequestLifecycle() { + NpCreateAsyncRequestParameter param{}; + const int unusedAsyncResult = sceNpCreateAsyncRequest(¶m); + Require(unusedAsyncResult > 0, "sceNpCreateAsyncRequest must return a positive request id"); + const int deletedId = sceNpCreateAsyncRequest(¶m); + Require(sceNpDeleteRequest(deletedId) == 0, "initial delete"); + + constexpr int resultSentinel = 0x5a5a5a5a; + const int unknownIds[] = {0, -1, 0x7fffffff, deletedId}; + for (const int id : unknownIds) { + int result = resultSentinel; + Require(sceNpPollAsync(id, &result) == RequestNotFound, "poll must reject an absent or deleted id"); + Require(result == resultSentinel, "poll must not touch the result for an absent or deleted id"); + Require(sceNpPollAsync(id, nullptr) == InvalidArgument, + "poll must reject a null result before the id"); + Require(sceNpAbortRequest(id) == RequestNotFound, "abort must reject an absent or deleted id"); + Require(sceNpDeleteRequest(id) == RequestNotFound, "delete must reject an absent or deleted id"); + } + + int result = resultSentinel; + Require(sceNpPollAsync(unusedAsyncResult, &result) == 0, "poll on a live async request"); + Require(result == SignedOut, "poll must report the signed-out result on a live async request"); + Require(sceNpAbortRequest(unusedAsyncResult) == 0, "abort on a live request"); + Require(sceNpDeleteRequest(unusedAsyncResult) == 0, "delete after abort"); + Require(sceNpDeleteRequest(unusedAsyncResult) == RequestNotFound, "second delete"); +} + void CheckOnlineIdQueries() { NpOnlineId onlineId{}; std::memcpy(onlineId.data, "player", 6); @@ -394,6 +423,7 @@ int main() { CheckStateCallbacksA(); CheckLegacyStateCallback(); CheckRequestTimeouts(); + CheckAsyncRequestLifecycle(); CheckPlusAndContentRestriction(); NpId npId{}; std::memset(&npId, 0x5a, sizeof(npId)); diff --git a/docs/dev/debt/libSceNpManager.md b/docs/dev/debt/libSceNpManager.md index a484f93b3a..0595fc92c4 100644 --- a/docs/dev/debt/libSceNpManager.md +++ b/docs/dev/debt/libSceNpManager.md @@ -29,3 +29,8 @@ - [sceNpIsPlusMember and sceNpSetContentRestriction](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the signatures and checks follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_manager.cpp): a null output or restriction is `INVALID_ARGUMENT`, a restriction size other than 0x18 is `INVALID_SIZE` (0x80550011), and a negative default age, more than 256 age restrictions or a count without an array is `INVALID_ARGUMENT`. Any user is reported as not a Plus member, and a valid restriction is accepted and not stored. Not measured on a PS5 - [sceNpCheckCallbackForLib](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - not measured on a PS5: it delivers the pending state callbacks like `sceNpCheckCallback`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_manager.cpp) does with its pending state events; shadPS4's `sceNpCheckCallback` also runs other registered NP callbacks, which this library does not keep + +- [sceNpAbortRequest](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - a request id that was never created or was deleted returns `SCE_NP_ERROR_REQUEST_NOT_FOUND` and a live request returns 0, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp) does in `sceNpAbortRequest`; shadPS4 there also moves the request into an `Aborted` state that its later requests read as `ABORTED`, and whether aborting on the console changes a live request's completion is not measured on a PS5 ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)), so nothing in this library reads an abort state and the id stays live +- [sceNpDeleteRequest](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - a request id that was never created or was deleted returns `SCE_NP_ERROR_REQUEST_NOT_FOUND`, and a live request is removed and returns 0, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp) does in `sceNpDeleteRequest` ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)) +- [sceNpPollAsync](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - a null result pointer returns `SCE_NP_ERROR_INVALID_ARGUMENT` before the id is read, a request id that was never created or was deleted returns `SCE_NP_ERROR_REQUEST_NOT_FOUND` without writing the caller's result, and a live request keeps its signed-out completion `0` with `SCE_NP_ERROR_SIGNED_OUT`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp) does in `sceNpPollAsync` ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)). The parts of that model beyond the validation are not implemented: shadPS4 keeps a per-request state machine decorated by `sceNpCheckNpAvailability` and neighbors and refuses `InvalidId` for a ready async request in wait/poll, whose completion publication, poll-versus-wait precedence and already-complete errors remain unattributable to the PS5 +- [sceNpCreateAsyncRequest](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the parameter is not read ([NpCreateAsyncRequestParameter](../../../core/libs/SceTypes.hpp) is a 0x40-byte opaque blob, so shadPS4's nonnull check and `size == sizeof` reject ([81be949167d0060b08f26dc3e055a0b640d129c8](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp)) cannot be applied without inventing a layout) and no async kind or completion state is stored until the console's contract for them is evidenced ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)); `sceNpWaitAsync` (`jyi5p9XWUSs`) has no export here yet and stays with [PR #9282](https://github.com/boykopovar/AnyPS5/pull/9282) From 6ba488116707f4b2e28fa4687d0050fe408f5a89 Mon Sep 17 00:00:00 2001 From: xXPBSXx <20614131+xXPBSXx@users.noreply.github.com> Date: Fri, 23 Oct 2026 04:01:50 +0200 Subject: [PATCH 029/113] test(recompiler): keep the shader cache source test at its 180 s CTest timeout CONTRIBUTING asks to split or shrink a test that gets close instead of raising its timeout; the subprocess timeouts of the previous commit stay. Co-Authored-By: Claude Sonnet 5.5 --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 7dd610b9f5..9eaa66c8db 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -135,7 +135,7 @@ if(BUILD_TESTING) add_test(NAME shader_cache_runtime_sources COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_shader_cache_runtime_sources.py ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler ${CMAKE_COMMAND}) - set_tests_properties(shader_cache_runtime_sources PROPERTIES TIMEOUT 600) + set_tests_properties(shader_cache_runtime_sources PROPERTIES TIMEOUT 180) add_test(NAME pr_overlap_encoding COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_pr_overlap_encoding.py) add_test(NAME pr_overlap_dependencies COMMAND ${Python3_EXECUTABLE} From e118657d4d2c7c52524e2041a348c28bf12d8fd7 Mon Sep 17 00:00:00 2001 From: milescoviello Date: Fri, 23 Oct 2026 02:34:13 +0000 Subject: [PATCH 030/113] fix(agc): share a registered shader's decoded state with its other headers Every registration decodes the header's registers into a RegisteredShaderState: three dense register sets, about 10 KiB, kept by the snapshot for the life of the registry. A title that registers the same code with the same registers at another header address got a copy each time. Ghost of Tsushima does that for 85 % of its registrations, about 400 a second during its opening, so by 200 s 68,000 of its 80,000 snapshots held a copy of a state another snapshot already had. A new snapshot now takes the state of a published snapshot at the same code address whose type, code and decoded registers are equal. The state is immutable once published, and its users only copy it. Co-Authored-By: Claude Opus 5.5 --- .../include/Driver/Shaders/ShaderRegistry.hpp | 2 ++ .../Execution/src/Driver/Shaders/ShaderRegistry.cpp | 12 ++++++++++++ .../tests/execution/PreparedShaders.cpp | 11 +++++++++++ 3 files changed, 25 insertions(+) diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp index 203940d7c3..d24d81c3eb 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp @@ -165,6 +165,8 @@ struct RegisteredShaderState { Registers shader; Registers context; Registers userConfig; + + bool operator==(const RegisteredShaderState&) const = default; }; struct ShaderSnapshot { diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp index 5f93b08490..be8fb88cff 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp @@ -1854,6 +1854,18 @@ void Driver::RegisterShader(const Shader* shader) { localDevice = device; } snapshot.registeredState = std::make_shared(DecodeRegisteredState(snapshot)); + { + std::lock_guard lock(mutex); + if (shaders != nullptr) { + if (const auto found = shaders->find(snapshot.codeAddress); found != shaders->end()) { + for (const auto& current : found->second) { + if (current->registeredState == nullptr || current->type != snapshot.type || current->code != snapshot.code || *current->registeredState != *snapshot.registeredState) continue; + snapshot.registeredState = current->registeredState; + break; + } + } + } + } QueueState registered{}; registered.shader = snapshot.registeredState->shader; registered.context = snapshot.registeredState->context; diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp index 734a7c6825..8d0c2eab31 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp @@ -437,6 +437,15 @@ void SharedCodeHeaders() { AgcDriverRegisterShader_nid_postfix(&mesh.shader); AgcDriverResolveShaderAbi_nid_postfix(&vertex.shader, {}, primitive); AgcDriverRegisterShader_nid_postfix(&mesh.shader); + const auto snapshots = [&] { + const auto registry = AgcDriver::DriverDetail::Driver::Get().RegisteredShaders(); + Require(registry != nullptr, "shared-code headers published no shader registry"); + auto pair = std::pair{AgcDriver::DriverDetail::RegisteredHeader(*registry, &vertex.shader), AgcDriver::DriverDetail::RegisteredHeader(*registry, &mesh.shader)}; + Require(pair.first != nullptr && pair.second != nullptr && pair.first != pair.second, "the shared-code headers were not registered apart"); + return pair; + }; + const auto [vertexSnapshot, meshSnapshot] = snapshots(); + Require(vertexSnapshot->registeredState != meshSnapshot->registeredState, "a header with other registers shared another header's registered state"); Shader copy = vertex.shader; copy.user_data = nullptr; AgcDriverResolveShaderAbi_nid_postfix(©, {}, primitive); @@ -461,6 +470,8 @@ void SharedCodeHeaders() { mesh.shader.cx_registers = mesh.context.data(); mesh.shader.num_cx_registers = mesh.context.size(); AgcDriverRegisterShader_nid_postfix(&mesh.shader); + const auto [sameVertex, sameMesh] = snapshots(); + Require(sameVertex->registeredState == sameMesh->registeredState && sameMesh->registeredState->context.at(0x2d5) == 0x2000u, "two headers with the same code and registers decoded their registered state twice"); AgcDriverResolveShaderAbi_nid_postfix(&mesh.shader, {}, primitive); AgcDriverResolveShaderAbi_nid_postfix(&vertex.shader, {}, primitive); Require(sceAgcDriverSubmitDcb(&packet) == 0, "same-type registered header draw failed"); From 12a14ac1a517863335603d6d5762cec1ff1ac4f1 Mon Sep 17 00:00:00 2001 From: xdCloudy <52116030+xdCloudy@users.noreply.github.com> Date: Fri, 23 Oct 2026 04:03:49 +0100 Subject: [PATCH 031/113] feat(libSceAgcVsh): declare 150 pending exports --- core/libs/prx/libSceAgcVsh/Export.cpp | 900 +++++++++++++++++++++++++- docs/dev/debt/libSceAgcVsh.md | 5 + 2 files changed, 904 insertions(+), 1 deletion(-) create mode 100644 docs/dev/debt/libSceAgcVsh.md diff --git a/core/libs/prx/libSceAgcVsh/Export.cpp b/core/libs/prx/libSceAgcVsh/Export.cpp index fb34206c21..0b65c5fa98 100644 --- a/core/libs/prx/libSceAgcVsh/Export.cpp +++ b/core/libs/prx/libSceAgcVsh/Export.cpp @@ -5,6 +5,904 @@ extern "C" { -APS5_DUMMY_FUN +int APS5_VABI sceAgcDcbCopyData_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("1rZSWUv1IRc", sceAgcDcbCopyData_nid_no_patch); + +int APS5_VABI sceAgcBranchPatchSetElseTarget_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("QmfvaYpsOcI", sceAgcBranchPatchSetElseTarget_nid_no_patch); + +int APS5_VABI sceAgcCbSetShRegistersDirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("UZbQjYAwwXM", sceAgcCbSetShRegistersDirect_nid_no_patch); + +int APS5_VABI sceAgcCreateShader_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("f3dg2CSgRKY", sceAgcCreateShader_nid_no_patch); + +int APS5_VABI sceAgcDcbSetNumInstancesGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("6DFuRKT4C9w", sceAgcDcbSetNumInstancesGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetUcRegisterDirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("aP1Ki9G3++4", sceAgcDcbSetUcRegisterDirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndexIndirectMultiGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("r98I08t+LOg", sceAgcDcbDrawIndexIndirectMultiGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbAtomicGdsGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("1tB0xkLNjcw", sceAgcDcbAtomicGdsGetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbCopyDataGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("CbQh3DKMSno", sceAgcAcbCopyDataGetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbWaitUntilSafeForRendering_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("GPbUp9jXQa8", sceAgcAcbWaitUntilSafeForRendering_nid_no_patch); + +int APS5_VABI sceAgcAsyncCondExecPatchSetEnd_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("k-JpyR2dYAM", sceAgcAsyncCondExecPatchSetEnd_nid_no_patch); + +int APS5_VABI sceAgcDcbDmaDataGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("2ccJz9LQI+w", sceAgcDcbDmaDataGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetUcRegistersIndirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("hvUfkUIQcOE", sceAgcDcbSetUcRegistersIndirect_nid_no_patch); + +int APS5_VABI sceAgcGetRegisterDefaults2_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("2JtWUUiYBXs", sceAgcGetRegisterDefaults2_nid_no_patch); + +int APS5_VABI sceAgcCbReleaseMem_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("wr23dPKyWc0", sceAgcCbReleaseMem_nid_no_patch); + +int APS5_VABI sceAgcCondExecPatchSetEnd_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("ORWsxIbk4TE", sceAgcCondExecPatchSetEnd_nid_no_patch); + +int APS5_VABI sceAgcDcbAtomicGds_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("pH3-dfRpfA0", sceAgcDcbAtomicGds_nid_no_patch); + +int APS5_VABI sceAgcDcbSetCxRegistersIndirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("GBCh3zCihoU", sceAgcDcbSetCxRegistersIndirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcCbSetUcRegisterRangeDirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("MDLD5Ly94Xk", sceAgcCbSetUcRegisterRangeDirect_nid_no_patch); + +int APS5_VABI sceAgcDcbEventWrite_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("aJf+j5yntiU", sceAgcDcbEventWrite_nid_no_patch); + +int APS5_VABI sceAgcDcbWriteData_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("i1jyy49AjXU", sceAgcDcbWriteData_nid_no_patch); + +int APS5_VABI sceAgcSetUcRegIndirectPatchSetAddress_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("6lNcCp+fxi4", sceAgcSetUcRegIndirectPatchSetAddress_nid_no_patch); + +int APS5_VABI sceAgcCbCondWriteGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("FuVbkyKlf+s", sceAgcCbCondWriteGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbQueueEndOfShaderActionGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("zg6u-N6Otxs", sceAgcDcbQueueEndOfShaderActionGetSize_nid_no_patch); + +int APS5_VABI sceAgcGetPacketSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("Lkf86B98qPc", sceAgcGetPacketSize_nid_no_patch); + +int APS5_VABI sceAgcAcbAcquireMem_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("KT-hTp-Ch14", sceAgcAcbAcquireMem_nid_no_patch); + +int APS5_VABI sceAgcAcbEventWriteGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("Y-5vneiBtzk", sceAgcAcbEventWriteGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetIndexIndirectArgs_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("0o3VDdtA6nM", sceAgcDcbSetIndexIndirectArgs_nid_no_patch); + +int APS5_VABI sceAgcAcbDmaData_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("-RnpfpxIhec", sceAgcAcbDmaData_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndexIndirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("t1vNu082-jM", sceAgcDcbDrawIndexIndirect_nid_no_patch); + +int APS5_VABI sceAgcDcbPrimeUtcl2GetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("KjPeVduz6jU", sceAgcDcbPrimeUtcl2GetSize_nid_no_patch); + +int APS5_VABI sceAgcAsyncCondExecPatchSetCommandAddress_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("3ZWa3AoyWZQ", sceAgcAsyncCondExecPatchSetCommandAddress_nid_no_patch); + +int APS5_VABI sceAgcAcbAcquireMemGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("ewobAQeMo5k", sceAgcAcbAcquireMemGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetIndexIndirectArgsGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("AFIh8SQkYlQ", sceAgcDcbSetIndexIndirectArgsGetSize_nid_no_patch); + +int APS5_VABI sceAgcCreateInterpolantMapping_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("pdEV7bI6COI", sceAgcCreateInterpolantMapping_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndexIndirectMulti_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("ypVBz4uPKcQ", sceAgcDcbDrawIndexIndirectMulti_nid_no_patch); + +int APS5_VABI sceAgcDcbEventWriteGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("C4l9fB17t8w", sceAgcDcbEventWriteGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetUcRegisterDirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("w4-d0n60hdo", sceAgcDcbSetUcRegisterDirect_nid_no_patch); + +int APS5_VABI sceAgcQueueEndOfPipeActionPatchAddress_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("0fWWK5uG9rQ", sceAgcQueueEndOfPipeActionPatchAddress_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndirectMultiGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("pYoKs3lPy88", sceAgcDcbDrawIndirectMultiGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetBaseDrawIndirectArgsGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("MMlmJAL7N5w", sceAgcDcbSetBaseDrawIndirectArgsGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetNumInstances_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("tSBxhAPyytQ", sceAgcDcbSetNumInstances_nid_no_patch); + +int APS5_VABI sceAgcDcbWaitOnAddressGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("43WJ08sSugE", sceAgcDcbWaitOnAddressGetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbAtomicGds_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("cduV1f0dcGQ", sceAgcAcbAtomicGds_nid_no_patch); + +int APS5_VABI sceAgcDcbSetBoolPredicationEnableGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("yheJGN-ay+A", sceAgcDcbSetBoolPredicationEnableGetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbAtomicMemGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("da1Sm8-QDoU", sceAgcAcbAtomicMemGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetCfRegisterRangeDirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("BVFg3CWU6Eo", sceAgcDcbSetCfRegisterRangeDirect_nid_no_patch); + +int APS5_VABI sceAgcDcbCondExecGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("ou16V5hh5sg", sceAgcDcbCondExecGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndexMultiInstanced_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("Rlx+bykm0r0", sceAgcDcbDrawIndexMultiInstanced_nid_no_patch); + +int APS5_VABI sceAgcDcbSetCxRegistersIndirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("ZvwO9euwYzc", sceAgcDcbSetCxRegistersIndirect_nid_no_patch); + +int APS5_VABI sceAgcCbSetShRegistersDirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("yUBESvCCJ4I", sceAgcCbSetShRegistersDirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcCondExecPatchSetCommandAddress_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("YWTKOju587o", sceAgcCondExecPatchSetCommandAddress_nid_no_patch); + +int APS5_VABI sceAgcRewindPatchSetRewindState_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("ziVA3whp3p4", sceAgcRewindPatchSetRewindState_nid_no_patch); + +int APS5_VABI sceAgcQueueEndOfPipeActionPatchGcrCntl_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("J8YCgfKAMQs", sceAgcQueueEndOfPipeActionPatchGcrCntl_nid_no_patch); + +int APS5_VABI sceAgcWaitRegMemPatchReference_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("7nOoijNPvEU", sceAgcWaitRegMemPatchReference_nid_no_patch); + +int APS5_VABI sceAgcAcbRewind_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("DwICrVxerkY", sceAgcAcbRewind_nid_no_patch); + +int APS5_VABI sceAgcAcbCondExecGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("ozKzBP4aki4", sceAgcAcbCondExecGetSize_nid_no_patch); + +int APS5_VABI sceAgcSuspendPointAndCheckStatus_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("b+fis+WZ3Ig", sceAgcSuspendPointAndCheckStatus_nid_no_patch); + +int APS5_VABI sceAgcAcbWaitRegMem_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("htn36gPnBk4", sceAgcAcbWaitRegMem_nid_no_patch); + +int APS5_VABI sceAgcDcbAcquireMem_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("57labkp+rSQ", sceAgcDcbAcquireMem_nid_no_patch); + +int APS5_VABI sceAgcSetCxRegIndirectPatchSetNumRegisters_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("whb1RL7K4Ss", sceAgcSetCxRegIndirectPatchSetNumRegisters_nid_no_patch); + +int APS5_VABI sceAgcDcbContextStateOp_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("HabmgqPwPw0", sceAgcDcbContextStateOp_nid_no_patch); + +int APS5_VABI sceAgcAcbWriteData_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("eZ4+17OQz4Q", sceAgcAcbWriteData_nid_no_patch); + +int APS5_VABI sceAgcAcbDmaDataGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("M0ttm8h7SKA", sceAgcAcbDmaDataGetSize_nid_no_patch); + +int APS5_VABI sceAgcCbSetShRegisterRangeDirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("bxGoVxpdSPQ", sceAgcCbSetShRegisterRangeDirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcCbNop_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("LtTouSCZjHM", sceAgcCbNop_nid_no_patch); + +int APS5_VABI sceAgcDcbResetQueue_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("TRO721eVt4g", sceAgcDcbResetQueue_nid_no_patch); + +int APS5_VABI sceAgcDcbDmaData_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("WmAc2MEj6Io", sceAgcDcbDmaData_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndexGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("6ee9Hd3EWXQ", sceAgcDcbDrawIndexGetSize_nid_no_patch); + +int APS5_VABI sceAgcDmaDataPatchSetDstAddressOrOffset_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("IxYiarKlXxM", sceAgcDmaDataPatchSetDstAddressOrOffset_nid_no_patch); + +int APS5_VABI sceAgcCbQueueEndOfPipeActionGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("hL7C0IRpWZI", sceAgcCbQueueEndOfPipeActionGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetFlip_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("YUeqkyT7mEQ", sceAgcDcbSetFlip_nid_no_patch); + +int APS5_VABI sceAgcDcbSetMarker_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("QhCbS4X9Rl8", sceAgcDcbSetMarker_nid_no_patch); + +int APS5_VABI sceAgcDcbSetPredication_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("bbFueFP+J4k", sceAgcDcbSetPredication_nid_no_patch); + +int APS5_VABI sceAgcDcbAtomicMem_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("1-gUn1PI4Sw", sceAgcDcbAtomicMem_nid_no_patch); + +int APS5_VABI sceAgcGetRegisterDefaults2Internal_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("wRbq6ZjNop4", sceAgcGetRegisterDefaults2Internal_nid_no_patch); + +int APS5_VABI sceAgcSetShRegIndirectPatchAddRegisters_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("z2duB-hHQSM", sceAgcSetShRegIndirectPatchAddRegisters_nid_no_patch); + +int APS5_VABI sceAgcDcbPrimeUtcl2_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("jt3pl7EN17o", sceAgcDcbPrimeUtcl2_nid_no_patch); + +int APS5_VABI sceAgcAcbRewindGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("0ZOG0jc9nRg", sceAgcAcbRewindGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetZPassPredicationEnableGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("XN+Iuu7XsM8", sceAgcDcbSetZPassPredicationEnableGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbWaitUntilSafeForRendering_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("MWiElSNE8j8", sceAgcDcbWaitUntilSafeForRendering_nid_no_patch); + +int APS5_VABI sceAgcBranchPatchSetThenTarget_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("xb8VgcXQhvI", sceAgcBranchPatchSetThenTarget_nid_no_patch); + +int APS5_VABI sceAgcSetCxRegIndirectPatchSetAddress_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("vcmNN+AAXnY", sceAgcSetCxRegIndirectPatchSetAddress_nid_no_patch); + +int APS5_VABI sceAgcDcbAtomicMemGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("oz6zQq1JwCE", sceAgcDcbAtomicMemGetSize_nid_no_patch); + +int APS5_VABI sceAgcUpdatePrimState_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("Y3ymLfZ1384", sceAgcUpdatePrimState_nid_no_patch); + +int APS5_VABI sceAgcCbNopGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("t7PlZ9nt5Lc", sceAgcCbNopGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbGetLodStats_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("vuSXe69VILM", sceAgcDcbGetLodStats_nid_no_patch); + +int APS5_VABI sceAgcWaitRegMemPatchAddress_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("3KDcnM3lrcU", sceAgcWaitRegMemPatchAddress_nid_no_patch); + +int APS5_VABI sceAgcQueueEndOfPipeActionPatchData_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("MlEw1feXcjg", sceAgcQueueEndOfPipeActionPatchData_nid_no_patch); + +int APS5_VABI sceAgcGetRegisterDefaultsInternal_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("uIwxsqDlHRc", sceAgcGetRegisterDefaultsInternal_nid_no_patch); + +int APS5_VABI sceAgcInit_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("kW3GLb7QfPg", sceAgcInit_nid_no_patch); + +int APS5_VABI sceAgcDcbDispatchIndirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("w8HVkEeXPv8", sceAgcDcbDispatchIndirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbCondExec_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("BIPexNBSGog", sceAgcDcbCondExec_nid_no_patch); + +int APS5_VABI sceAgcAcbSetMarker_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("xAeBOa0A3kk", sceAgcAcbSetMarker_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndexOffsetGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("qMlfB1ZhMDc", sceAgcDcbDrawIndexOffsetGetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbJump_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("e1DFTg+Sd8U", sceAgcAcbJump_nid_no_patch); + +int APS5_VABI sceAgcDcbSetIndexCount_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("8N2tmT3jmC8", sceAgcDcbSetIndexCount_nid_no_patch); + +int APS5_VABI sceAgcDcbSetShRegistersIndirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("nNlUtdDDvZ0", sceAgcDcbSetShRegistersIndirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbStallCommandBufferParserGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("+u6dKSLWM2o", sceAgcDcbStallCommandBufferParserGetSize_nid_no_patch); + +int APS5_VABI sceAgcSuspendPoint_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("h9z6+0hEydk", sceAgcSuspendPoint_nid_no_patch); + +int APS5_VABI sceAgcWaitRegMemPatchMask_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("hXAnLgDHCoI", sceAgcWaitRegMemPatchMask_nid_no_patch); + +int APS5_VABI sceAgcAcbDispatchIndirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("PxKWV2fVAps", sceAgcAcbDispatchIndirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbAtomicGdsGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("hcIxS8pmXF4", sceAgcAcbAtomicGdsGetSize_nid_no_patch); + +int APS5_VABI sceAgcCbCondWrite_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("7toV+elXqNM", sceAgcCbCondWrite_nid_no_patch); + +int APS5_VABI sceAgcDcbEndOcclusionQueryGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("P1CugZ99Uzc", sceAgcDcbEndOcclusionQueryGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetPredicationDisableGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("vLrBL8DQiz8", sceAgcDcbSetPredicationDisableGetSize_nid_no_patch); + +int APS5_VABI sceAgcLinkShaders_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("MqAdbRMdNz4", sceAgcLinkShaders_nid_no_patch); + +int APS5_VABI sceAgcDcbWaitRegMem_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("VmW0Tdpy420", sceAgcDcbWaitRegMem_nid_no_patch); + +int APS5_VABI sceAgcGetRegisterDefaults_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("Wi82ArQtAwg", sceAgcGetRegisterDefaults_nid_no_patch); + +int APS5_VABI sceAgcCbSetShRegisterRangeDirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("n2fD4A+pb+g", sceAgcCbSetShRegisterRangeDirect_nid_no_patch); + +int APS5_VABI sceAgcSetCxRegIndirectPatchAddRegisters_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("d-6uF9sZDIU", sceAgcSetCxRegIndirectPatchAddRegisters_nid_no_patch); + +int APS5_VABI sceAgcDcbDispatchIndirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("CtB+A9-VxO0", sceAgcDcbDispatchIndirect_nid_no_patch); + +int APS5_VABI sceAgcCbMemSemaphore_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("vHX9guneRBY", sceAgcCbMemSemaphore_nid_no_patch); + +int APS5_VABI sceAgcCbSetUcRegisterRangeDirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("JOWmDrl+j20", sceAgcCbSetUcRegisterRangeDirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcCbDispatch_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("k3GhuSNmBLU", sceAgcCbDispatch_nid_no_patch); + +int APS5_VABI sceAgcDcbCopyDataGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("b5u0Jzm8TF8", sceAgcDcbCopyDataGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndexMultiInstancedGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("mR9j7+SfM34", sceAgcDcbDrawIndexMultiInstancedGetSize_nid_no_patch); + +int APS5_VABI sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("cdDRpqcFGbU", sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate_nid_no_patch); + +int APS5_VABI sceAgcSetShRegIndirectPatchSetAddress_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("Qrj4c+61z4A", sceAgcSetShRegIndirectPatchSetAddress_nid_no_patch); + +int APS5_VABI sceAgcDcbJump_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("xSAR0LTcRKM", sceAgcDcbJump_nid_no_patch); + +int APS5_VABI sceAgcDcbJumpGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("VEGu4dixjUg", sceAgcDcbJumpGetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbPrimeUtcl2_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("szG7hz2yEhA", sceAgcAcbPrimeUtcl2_nid_no_patch); + +int APS5_VABI sceAgcDcbSetCxRegisterDirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("1DeUNpRIDDA", sceAgcDcbSetCxRegisterDirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcQueueEndOfPipeActionPatchType_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("T9fjQIINoeE", sceAgcQueueEndOfPipeActionPatchType_nid_no_patch); + +int APS5_VABI sceAgcDcbSetCxRegisterDirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("LHFXRrlTPD8", sceAgcDcbSetCxRegisterDirect_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndex_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("q88lQ+GP5Yk", sceAgcDcbDrawIndex_nid_no_patch); + +int APS5_VABI sceAgcCbDispatchGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("Abendgtz+3o", sceAgcCbDispatchGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbGetLodStatsGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("rUuVjyR+Rd4", sceAgcDcbGetLodStatsGetSize_nid_no_patch); + +int APS5_VABI sceAgcGetDataPacketPayloadAddress_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("CQsSq6l6+kA", sceAgcGetDataPacketPayloadAddress_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndirect_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("1q1titRBL6o", sceAgcDcbDrawIndirect_nid_no_patch); + +int APS5_VABI sceAgcAcbSetFlip_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("ebixW91gpPw", sceAgcAcbSetFlip_nid_no_patch); + +int APS5_VABI sceAgcGetFusedShaderSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("nQT5kYLv0cg", sceAgcGetFusedShaderSize_nid_no_patch); + +int APS5_VABI sceAgcSetRangePredication_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("n8vgpaQg6dA", sceAgcSetRangePredication_nid_no_patch); + +int APS5_VABI sceAgcDcbSetShRegisterDirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("QhPDD513V0w", sceAgcDcbSetShRegisterDirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbSetIndexSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("GIIW2J37e70", sceAgcDcbSetIndexSize_nid_no_patch); + +int APS5_VABI sceAgcSetPacketPredication_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("w6Dj1VJt5qY", sceAgcSetPacketPredication_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndexOffset_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("B+aG9DUnTKA", sceAgcDcbDrawIndexOffset_nid_no_patch); + +int APS5_VABI sceAgcAsyncRewindPatchSetRewindState_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("eWaWyFegzgQ", sceAgcAsyncRewindPatchSetRewindState_nid_no_patch); + +int APS5_VABI sceAgcJumpPatchSetTarget_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("2BS4EtAaF28", sceAgcJumpPatchSetTarget_nid_no_patch); + +int APS5_VABI sceAgcBranchPatchSetCompareAddress_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("GXBlM-ekzrI", sceAgcBranchPatchSetCompareAddress_nid_no_patch); + +int APS5_VABI sceAgcAcbJumpGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("b-oySn+G2tE", sceAgcAcbJumpGetSize_nid_no_patch); + +int APS5_VABI sceAgcCbBranch_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("w1KFAHVqpaU", sceAgcCbBranch_nid_no_patch); + +int APS5_VABI sceAgcDcbDrawIndexIndirectGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("mStuvI0zOtc", sceAgcDcbDrawIndexIndirectGetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbCopyData_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("qzMN2XKGA4k", sceAgcAcbCopyData_nid_no_patch); + +int APS5_VABI sceAgcDcbWriteDataGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("p9tI+yTvx68", sceAgcDcbWriteDataGetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbAtomicMem_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("XKKuA6VkSRc", sceAgcAcbAtomicMem_nid_no_patch); + +int APS5_VABI sceAgcAcbPrimeUtcl2GetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("eCjKaqeeQ5s", sceAgcAcbPrimeUtcl2GetSize_nid_no_patch); + +int APS5_VABI sceAgcAcbResetQueue_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("JrtiDtKeS38", sceAgcAcbResetQueue_nid_no_patch); + +int APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("F8NLhWvFemI", sceAgcAcbQueueEndOfShaderActionGetSize_nid_no_patch); + +int APS5_VABI sceAgcDcbBeginOcclusionQueryGetSize_nid_no_patch(void) { + NotImplemented_nid_no_patch(__func__); + return 0; +} +APS5_EXPORT("ms1xVoZ-Vwc", sceAgcDcbBeginOcclusionQueryGetSize_nid_no_patch); } diff --git a/docs/dev/debt/libSceAgcVsh.md b/docs/dev/debt/libSceAgcVsh.md new file mode 100644 index 0000000000..c2fb6a18d8 --- /dev/null +++ b/docs/dev/debt/libSceAgcVsh.md @@ -0,0 +1,5 @@ +# libSceAgcVsh technical debt + +### Unknown function info + +- The 150 declarations in [Export.cpp](../../../core/libs/prx/libSceAgcVsh/Export.cpp) are present in the PS5 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAgcVsh.c) and the local import-stub table. Their signatures and behavior are unverified; the parameterless declarations are for import resolution only and throw through NotImplemented_nid_no_patch. From e9bbebeef2cd609539736314064fe1c147122e48 Mon Sep 17 00:00:00 2001 From: Queuze <58829992+lucaslima430@users.noreply.github.com> Date: Fri, 23 Oct 2026 01:13:57 -0300 Subject: [PATCH 032/113] test(libc): cover host stream buffering isolation --- core/libs/prx/libkernel/CMakeLists.txt | 3 +- .../tests/GuestHostStandardErrorWindows.cpp | 49 ++++++++++++++++++- 2 files changed, 50 insertions(+), 2 deletions(-) diff --git a/core/libs/prx/libkernel/CMakeLists.txt b/core/libs/prx/libkernel/CMakeLists.txt index 1b9c5d5348..1f673fc89f 100644 --- a/core/libs/prx/libkernel/CMakeLists.txt +++ b/core/libs/prx/libkernel/CMakeLists.txt @@ -357,7 +357,8 @@ if(BUILD_TESTING) target_link_libraries(guest_host_standard_error_windows_tests PRIVATE libkernel libc) configure_windows_unwind(guest_host_standard_error_windows_tests) add_test(NAME guest_host_standard_error_windows COMMAND guest_host_standard_error_windows_tests) - set_tests_properties(guest_host_standard_error_windows PROPERTIES TIMEOUT 10 ENVIRONMENT_MODIFICATION + add_test(NAME guest_host_standard_buffering_windows COMMAND guest_host_standard_error_windows_tests --buffering) + set_tests_properties(guest_host_standard_error_windows guest_host_standard_buffering_windows PROPERTIES TIMEOUT 10 ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() add_test_executable(guest_truncate_tests ${LIBS_INCLUDE_DIR}/tests/GuestTruncate.cpp) diff --git a/core/libs/tests/GuestHostStandardErrorWindows.cpp b/core/libs/tests/GuestHostStandardErrorWindows.cpp index f91c92d09e..c571983957 100644 --- a/core/libs/tests/GuestHostStandardErrorWindows.cpp +++ b/core/libs/tests/GuestHostStandardErrorWindows.cpp @@ -4,6 +4,7 @@ #include #include #include +#include #include #ifdef _WIN32 #include @@ -19,6 +20,8 @@ int APS5_VABI printf_nid_postfix(const char*, ...); int APS5_VABI puts_nid_postfix(const char*); int APS5_VABI fprintf_nid_postfix(FileStream*, const char*, ...); int APS5_VABI fflush_nid_postfix(FileStream*); +int APS5_VABI setvbuf_nid_postfix(FileStream*, char*, int, std::size_t); +void APS5_VABI setbuf_nid_postfix(FileStream*, char*); void APS5_VABI perror_nid_postfix(const char*); int* APS5_VABI __error_nid_postfix(); extern FileStream _Stdout_nid_postfix; @@ -96,7 +99,51 @@ static void GuestText(int standard, const std::string& text) { ::_close(guest[1]); } -int main() { +static void Buffering(int standard) { + int capture[2]{-1, -1}; + Require(::_pipe(capture, 65536, _O_BINARY) == 0); + const int original = ::_dup(standard); + Require(original >= 0 && ::_dup2(capture[1], standard) == 0); + auto* guestStream = standard == 1 ? &_Stdout_nid_postfix : &_Stderr_nid_postfix; + char buffer[4096]{}; + if (standard == 1) setbuf_nid_postfix(guestStream, buffer); + else Require(setvbuf_nid_postfix(guestStream, buffer, 0, sizeof(buffer)) == 0); + Require(fprintf_nid_postfix(guestStream, "guest-buffered") == 14); + Require(std::fputs("host-immediate", standard == 1 ? stdout : stderr) >= 0); + char bytes[64]{}; + DWORD read = 0; + Require(Available(capture[0], bytes, sizeof(bytes), read) == 14); + Require(read == 14 && std::string(bytes, read) == "host-immediate"); + Require(::_read(capture[0], bytes, 14) == 14); + Require(Available(capture[0], bytes, sizeof(bytes), read) == 0); + Require(fflush_nid_postfix(guestStream) == 0); + Require(Available(capture[0], bytes, sizeof(bytes), read) == 14); + Require(read == 14 && std::string(bytes, read) == "guest-buffered"); + Require(::_read(capture[0], bytes, 14) == 14); + + int guest[2]{-1, -1}; + Require(pipe_nid_postfix(guest) == 0 && dup2_nid_postfix(guest[1], standard) == standard); + Require(fprintf_nid_postfix(guestStream, "guest-redirected") == 16 && fflush_nid_postfix(guestStream) == 0); + Require(std::fputs("host-original", standard == 1 ? stdout : stderr) >= 0); + Require(Available(capture[0], bytes, sizeof(bytes), read) == 13); + Require(read == 13 && std::string(bytes, read) == "host-original"); + Require(Available(guest[0], bytes, sizeof(bytes), read) == 16); + Require(read == 16 && std::string(bytes, read) == "guest-redirected"); + Require(setvbuf_nid_postfix(guestStream, nullptr, 2, 0) == 0); + Require(::_dup2(original, standard) == 0); + ::_close(original); + ::_close(capture[0]); + ::_close(capture[1]); + ::_close(guest[0]); + ::_close(guest[1]); +} + +int main(int argc, char** argv) { + if (argc == 2 && std::strcmp(argv[1], "--buffering") == 0) { + Buffering(2); + Buffering(1); + return 0; + } Split(2); Split(1); GuestText(1, "guest-printf\nguest-puts\n"); From 7358bec9ff7dd3db53547411369160771460d18f Mon Sep 17 00:00:00 2001 From: Queuze <58829992+lucaslima430@users.noreply.github.com> Date: Fri, 23 Oct 2026 01:17:39 -0300 Subject: [PATCH 033/113] fix(libc): isolate host stream buffering --- core/libs/prx/libc/include/General.hpp | 4 +-- core/libs/prx/libc/src/General.cpp | 30 +++++++++++++++++++ core/libs/prx/libc/src/StandardStreams.cpp | 8 ++++- core/libs/prx/libkernel/File/src/Stdio.cpp | 19 +----------- .../tests/GuestHostStandardErrorWindows.cpp | 4 +++ 5 files changed, 44 insertions(+), 21 deletions(-) diff --git a/core/libs/prx/libc/include/General.hpp b/core/libs/prx/libc/include/General.hpp index f22c2e8556..bfdf1c9645 100644 --- a/core/libs/prx/libc/include/General.hpp +++ b/core/libs/prx/libc/include/General.hpp @@ -16,10 +16,10 @@ extern "C" [[noreturn]] void NotImplemented_nid_no_patch(const char* funcName); extern "C" void CxaFinalize_nid_no_patch(void* dsoHandle); extern "C" bool StopAtPrefixLetter_nid_no_patch(const char* str, char** endptr, int base); extern "C" bool RejectIntegerBase_nid_no_patch(const char* str, char** endptr, int base, bool setError); -#ifndef _WIN32 extern "C" int KeepHostStandardError_nid_no_patch(); -extern "C" int HostStandardError_nid_no_patch(); extern "C" int KeepHostStandardOutput_nid_no_patch(); +#ifndef _WIN32 +extern "C" int HostStandardError_nid_no_patch(); #else extern "C" bool AdoptHostStandardStream_nid_no_patch(int standard, int saved); extern "C" std::FILE* HostStandardOutputFile_nid_no_patch(); diff --git a/core/libs/prx/libc/src/General.cpp b/core/libs/prx/libc/src/General.cpp index 26c1935c5a..a02ce8b108 100644 --- a/core/libs/prx/libc/src/General.cpp +++ b/core/libs/prx/libc/src/General.cpp @@ -557,6 +557,36 @@ extern "C" std::FILE* HostStandardErrorFile_nid_no_patch() { if (std::FILE* kept = g_hostStandardErrorFile.load(std::memory_order_acquire)) return kept; return __acrt_iob_func(2); } + +namespace { +std::mutex g_hostStandardStreamMutex; + +int keepHostStandardStream(int standard) { + auto& slot = standard == 1 ? g_hostStandardOutputFile : g_hostStandardErrorFile; + if (auto* stream = slot.load(std::memory_order_acquire)) return ::_fileno(stream); + const std::unique_ptr unlock(__acrt_iob_func(standard), ::_unlock_file); + ::_lock_file(unlock.get()); + const std::lock_guard lock(g_hostStandardStreamMutex); + if (auto* stream = slot.load(std::memory_order_acquire)) return ::_fileno(stream); + const int saved = DuplicateHostDescriptor_nid_no_patch(standard); + if (saved < 0) return -1; + if (!AdoptHostStandardStream_nid_no_patch(standard, saved)) { + const int error = errno; + ::_close(saved); + errno = error; + return -1; + } + return saved; +} +} + +extern "C" int KeepHostStandardError_nid_no_patch() { + return keepHostStandardStream(2); +} + +extern "C" int KeepHostStandardOutput_nid_no_patch() { + return keepHostStandardStream(1); +} #endif extern "C" void AddPathAlias_nid_no_patch(const char* guestPrefix, const char* hostPath) { diff --git a/core/libs/prx/libc/src/StandardStreams.cpp b/core/libs/prx/libc/src/StandardStreams.cpp index 2cd656f01f..aeecad396a 100644 --- a/core/libs/prx/libc/src/StandardStreams.cpp +++ b/core/libs/prx/libc/src/StandardStreams.cpp @@ -1,4 +1,5 @@ #include "prx/libc/include/FileStream.hpp" +#include "prx/libc/include/General.hpp" #include "prx/libc/include/general/VabiMacros.hpp" #include #include @@ -194,7 +195,12 @@ int APS5_VABI setvbuf_nid_postfix(FileStream* stream, char* buffer, int mode, st buffer = nullptr; size = BUFSIZ; } - return std::setvbuf(GetStreamHandle(stream), buffer, native, size); + auto* handle = GetStreamHandle(stream); +#ifdef _WIN32 + if (handle == __acrt_iob_func(1) && KeepHostStandardOutput_nid_no_patch() < 0) return -1; + if (handle == __acrt_iob_func(2) && KeepHostStandardError_nid_no_patch() < 0) return -1; +#endif + return std::setvbuf(handle, buffer, native, size); } void APS5_VABI setbuf_nid_postfix(FileStream* stream, char* buffer) { setvbuf_nid_postfix(stream, buffer, buffer ? 0 : 2, buffer ? 1024 : 0); diff --git a/core/libs/prx/libkernel/File/src/Stdio.cpp b/core/libs/prx/libkernel/File/src/Stdio.cpp index af3a52401b..53a4e4844f 100644 --- a/core/libs/prx/libkernel/File/src/Stdio.cpp +++ b/core/libs/prx/libkernel/File/src/Stdio.cpp @@ -757,26 +757,9 @@ std::atomic g_hostStandardOutput{-1}; void PreserveHostStream(int standard, std::atomic& slot) { if (slot.load() >= 0) return; -#ifdef _WIN32 - const int saved = WithoutParameterHandler([standard] { return ::_dup(standard); }); -#else const int saved = standard == 1 ? KeepHostStandardOutput_nid_no_patch() : KeepHostStandardError_nid_no_patch(); -#endif if (saved < 0) throw std::runtime_error(standard == 1 ? "dup2: cannot keep the host standard output" : "dup2: cannot keep the host standard error"); - int expected = -1; - if (!slot.compare_exchange_strong(expected, saved)) { -#ifdef _WIN32 - _close(saved); -#endif - return; - } -#ifdef _WIN32 - if (!AdoptHostStandardStream_nid_no_patch(standard, saved)) { - slot.store(-1); - _close(saved); - throw std::runtime_error(standard == 1 ? "dup2: cannot keep the host standard output" : "dup2: cannot keep the host standard error"); - } -#endif + slot.store(saved); } void PreserveHostStandardError() { PreserveHostStream(2, g_hostStandardError); } diff --git a/core/libs/tests/GuestHostStandardErrorWindows.cpp b/core/libs/tests/GuestHostStandardErrorWindows.cpp index c571983957..559b90d3f2 100644 --- a/core/libs/tests/GuestHostStandardErrorWindows.cpp +++ b/core/libs/tests/GuestHostStandardErrorWindows.cpp @@ -22,6 +22,8 @@ int APS5_VABI fprintf_nid_postfix(FileStream*, const char*, ...); int APS5_VABI fflush_nid_postfix(FileStream*); int APS5_VABI setvbuf_nid_postfix(FileStream*, char*, int, std::size_t); void APS5_VABI setbuf_nid_postfix(FileStream*, char*); +void APS5_VABI flockfile_nid_postfix(FileStream*); +void APS5_VABI funlockfile_nid_postfix(FileStream*); void APS5_VABI perror_nid_postfix(const char*); int* APS5_VABI __error_nid_postfix(); extern FileStream _Stdout_nid_postfix; @@ -106,8 +108,10 @@ static void Buffering(int standard) { Require(original >= 0 && ::_dup2(capture[1], standard) == 0); auto* guestStream = standard == 1 ? &_Stdout_nid_postfix : &_Stderr_nid_postfix; char buffer[4096]{}; + flockfile_nid_postfix(guestStream); if (standard == 1) setbuf_nid_postfix(guestStream, buffer); else Require(setvbuf_nid_postfix(guestStream, buffer, 0, sizeof(buffer)) == 0); + funlockfile_nid_postfix(guestStream); Require(fprintf_nid_postfix(guestStream, "guest-buffered") == 14); Require(std::fputs("host-immediate", standard == 1 ? stdout : stderr) >= 0); char bytes[64]{}; From 99018acee743642ccc67d76480ba0f4c9d85486c Mon Sep 17 00:00:00 2001 From: slopggobblercobbler81 Date: Thu, 22 Oct 2026 05:07:00 +0200 Subject: [PATCH 034/113] fix(recompiler): normalize shader cache paths across platform separators --- .../recompiler/ShaderCacheVersion.cmake | 10 ++++--- .../tests/test_shader_cache_native_paths.py | 27 +++++++++++++++++++ 2 files changed, 33 insertions(+), 4 deletions(-) diff --git a/core/shader/recompiler/ShaderCacheVersion.cmake b/core/shader/recompiler/ShaderCacheVersion.cmake index 847a513496..e137778069 100644 --- a/core/shader/recompiler/ShaderCacheVersion.cmake +++ b/core/shader/recompiler/ShaderCacheVersion.cmake @@ -26,6 +26,7 @@ endforeach() list(SORT sources) list(SORT guard) get_filename_component(rootReal "${ROOT}" REALPATH) +get_filename_component(recompilerReal "${RECOMPILER_DIR}" REALPATH) set(sourcesReal) foreach(source IN LISTS sources) get_filename_component(real "${source}" REALPATH) @@ -39,8 +40,9 @@ foreach(source IN LISTS sources) if(NOT EXISTS "${source}") continue() endif() + get_filename_component(sourceReal "${source}" REALPATH) file(SHA256 "${source}" digest) - file(RELATIVE_PATH relative "${ROOT}" "${source}") + file(RELATIVE_PATH relative "${rootReal}" "${sourceReal}") string(APPEND manifest "${relative} ${digest}\n") if(NOT source MATCHES "\\.(cpp|hpp|h)$") continue() @@ -50,11 +52,11 @@ foreach(source IN LISTS sources) string(REGEX MATCHALL "\"APS5_[A-Z0-9_]+\"" names "${line}") list(APPEND switches ${names}) endforeach() - string(FIND "${source}" "${RECOMPILER_DIR}/" inRecompiler) + string(FIND "${sourceReal}" "${recompilerReal}/" inRecompiler) if(NOT inRecompiler EQUAL 0) continue() endif() - get_filename_component(sourceDirectory "${source}" DIRECTORY) + get_filename_component(sourceDirectory "${sourceReal}" DIRECTORY) file(STRINGS "${source}" lines ENCODING UTF-8 REGEX "^[ \t]*#[ \t]*include[ \t]*\"[^\"]+\"") foreach(line IN LISTS lines) string(REGEX REPLACE "^[ \t]*#[ \t]*include[ \t]*\"([^\"]+)\".*$" "\\1" included "${line}") @@ -65,7 +67,7 @@ foreach(source IN LISTS sources) break() endif() endforeach() - file(RELATIVE_PATH relativeSource "${ROOT}" "${source}") + file(RELATIVE_PATH relativeSource "${rootReal}" "${sourceReal}") if(NOT resolved) continue() endif() diff --git a/core/shader/recompiler/tests/test_shader_cache_native_paths.py b/core/shader/recompiler/tests/test_shader_cache_native_paths.py index b2f1e8c57f..1c1ad63ae2 100644 --- a/core/shader/recompiler/tests/test_shader_cache_native_paths.py +++ b/core/shader/recompiler/tests/test_shader_cache_native_paths.py @@ -74,5 +74,32 @@ class ShaderCachePathTests(unittest.TestCase): self.assertIn('does not hash', result.stdout + result.stderr) self.assertFalse(output.exists()) + def test_windows_path_separators(self): + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) / 'windows separators' + source, listing, output = self.fixture(root) + windows_path = str(source).replace('/', '\\') + listing.write_text(f'sources {windows_path}\n', encoding='utf-8') + result = self.run_script(root, listing, output) + self.assertEqual(result.returncode, 0, result.stdout + result.stderr) + windows_version = output.read_bytes() + listing.write_text(f'sources {source.as_posix()}\n', encoding='utf-8') + result = self.run_script(root, listing, output) + self.assertEqual(result.returncode, 0, result.stdout + result.stderr) + self.assertEqual(windows_version, output.read_bytes()) + + def test_windows_path_separators_reject_unhashed_include(self): + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) / 'windows separators' + source, listing, output = self.fixture(root) + windows_path = str(source).replace('/', '\\') + listing.write_text(f'sources {windows_path}\n', encoding='utf-8') + (root / 'shared.hpp').write_text('int example();\n', encoding='utf-8') + source.write_text('#include "../shared.hpp"\n', encoding='utf-8') + result = self.run_script(root, listing, output) + self.assertNotEqual(result.returncode, 0) + self.assertIn('does not hash', result.stdout + result.stderr) + self.assertFalse(output.exists()) + unittest.main() From e256e6d2d53d30ff343a05483b3a778abf1f4443 Mon Sep 17 00:00:00 2001 From: slopggobblercobbler81 Date: Fri, 23 Oct 2026 07:10:41 +0200 Subject: [PATCH 035/113] test(recompiler): gate Windows separator test cases to Windows platform --- core/shader/recompiler/tests/test_shader_cache_native_paths.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/core/shader/recompiler/tests/test_shader_cache_native_paths.py b/core/shader/recompiler/tests/test_shader_cache_native_paths.py index 1c1ad63ae2..fe6d0f0922 100644 --- a/core/shader/recompiler/tests/test_shader_cache_native_paths.py +++ b/core/shader/recompiler/tests/test_shader_cache_native_paths.py @@ -74,6 +74,7 @@ class ShaderCachePathTests(unittest.TestCase): self.assertIn('does not hash', result.stdout + result.stderr) self.assertFalse(output.exists()) + @unittest.skipUnless(sys.platform == 'win32', 'Windows path separator semantics require Windows host') def test_windows_path_separators(self): with tempfile.TemporaryDirectory() as temporary: root = Path(temporary) / 'windows separators' @@ -88,6 +89,7 @@ class ShaderCachePathTests(unittest.TestCase): self.assertEqual(result.returncode, 0, result.stdout + result.stderr) self.assertEqual(windows_version, output.read_bytes()) + @unittest.skipUnless(sys.platform == 'win32', 'Windows path separator semantics require Windows host') def test_windows_path_separators_reject_unhashed_include(self): with tempfile.TemporaryDirectory() as temporary: root = Path(temporary) / 'windows separators' From 46ff145113d75bfb5c179287fbc8cd3b85fde550 Mon Sep 17 00:00:00 2001 From: Kovalev Vladislav Date: Wed, 21 Oct 2026 21:52:49 +0600 Subject: [PATCH 036/113] fix(tools): flag qualified imports exported only under a NID --- docs/user/USAGE.md | 2 ++ tools/import_audit.py | 10 +++++-- tools/tests/test_import_audit.py | 51 ++++++++++++++++++++++++++++++++ 3 files changed, 61 insertions(+), 2 deletions(-) diff --git a/docs/user/USAGE.md b/docs/user/USAGE.md index 988659c9ae..6cd3e2ad5f 100644 --- a/docs/user/USAGE.md +++ b/docs/user/USAGE.md @@ -387,6 +387,8 @@ python3 tools/import_audit.py app.registry.json app.libc.prx.guest.prx.registry. | `absent` | No built library exports the NID: the loader fails. | | `module` | The import names a file found in `--modules` (the title's own library), which is trusted to provide it. | +An import that names a library requires the literal export name. If its implementation is found only by hashing the import name, it still counts as `implemented` or `stub`, but the report lists the name mismatch, sets `symbol_mismatch` on the JSON import record and counts it in the summary, and exits with code 1. A strong import with a name mismatch is a current stop. Imports without a library retain the audit's name-to-NID fallback. + Module registries mark ELF weak imports with `"weak": true`, allowing the audit's current-stop selection to skip them. Strong imports omit the field. Older module registries do not preserve weak bindings; regenerate them to distinguish optional imports. ELF modules in `--modules` are audited regardless of filename: their undefined symbols are classified against the built libraries and the other modules' exports, with the module file named in the report, and the libraries they need must have a file in `--libs` or `--modules`. Ordinary non-module sidecars are ignored; malformed ELF, PE/SELF containers and non-ELF files with module extensions remain errors. The audit reads dynamic tables from ELF section headers or, for sectionless files, from `PT_DYNAMIC` and a SysV or GNU hash table. diff --git a/tools/import_audit.py b/tools/import_audit.py index 6ee58ad673..2f445230b9 100644 --- a/tools/import_audit.py +++ b/tools/import_audit.py @@ -594,6 +594,7 @@ def audit(imports, exports, stubs, libraries, modules, module_imports=None, modu record["providers"] = providers record["library_mismatch"] = kind in ("implemented", "stub") and bool(library) and library not in providers and "libc.prx" not in providers record["name"] = next((stubs[(provider, resolved_nid)] for provider in providers if (provider, resolved_nid) in stubs), None) if kind == "stub" else None + record["symbol_mismatch"] = kind in ("implemented", "stub") and resolved_nid != nid and bool(library) ordered = sorted(records.values(), key=lambda record: (record["class"], record["library"] or "", record.get("module") or "", record["nid"])) check_conservation(len(imports) + sum(len(symbols) for symbols, _ in (module_imports or {}).values()), ordered) missing = defaultdict(int) @@ -618,7 +619,7 @@ def current_stop(imports, records): if weak: continue record = classes.get((nid, library)) - if record is not None and record["class"] == "absent": + if record is not None and (record["class"] == "absent" or record["symbol_mismatch"]): return record return None @@ -677,6 +678,7 @@ def summarize(records, references, missing, missing_hosts=()): "missing_libraries": missing, "missing_host_dependencies": [{"importer": entry["importer"], "chain": list(entry["chain"])} for entry in missing_hosts], "library_mismatch": sum(1 for record in records if record["library_mismatch"]), + "symbol_mismatch": sum(1 for record in records if record["symbol_mismatch"]), } @@ -722,6 +724,10 @@ def render(summary, records, missing, stops, missing_hosts=(), located=None): current = record["library"] lines.append(f" [{current or 'library not named'}]") lines.append(f" {label(record)}") + mismatched = [record for record in records if record["symbol_mismatch"]] + if mismatched: + lines.extend(["", f"Qualified import names exported only as their NID ({len(mismatched)}): the loader cannot resolve these names"]) + lines.extend(f" {label(record)} -> {nid_names.compute_nid(record['nid'])}" for record in mismatched) if stops: lines.append("") lines.append("Current stop (first unresolved import, in registry order)") @@ -800,7 +806,7 @@ def main(argv=None): return 2 located = locate_missing(missing, {path.resolve().parent for path in args.registries}) if missing else None print(render(summary, records, missing, stops, missing_hosts, located)) - return 1 if summary["unique_by_class"]["absent"] or missing or missing_hosts or (args.strict_providers and summary["library_mismatch"]) or (args.strict_stubs and summary["unique_by_class"]["stub"]) else 0 + return 1 if summary["unique_by_class"]["absent"] or summary["symbol_mismatch"] or missing or missing_hosts or (args.strict_providers and summary["library_mismatch"]) or (args.strict_stubs and summary["unique_by_class"]["stub"]) else 0 if __name__ == "__main__": diff --git a/tools/tests/test_import_audit.py b/tools/tests/test_import_audit.py index a29775c13b..8d5d3844b3 100644 --- a/tools/tests/test_import_audit.py +++ b/tools/tests/test_import_audit.py @@ -290,6 +290,57 @@ class ImportAuditTests(unittest.TestCase): self.assertTrue(records["missing_function"]["weak"]) self.assertIsNone(data["stops"][0]["nid"]) + def test_nid_only_exports_do_not_resolve_literal_import_names(self): + work = self.work + name, nid = "strlen", nid_names.compute_nid("strlen") + registry, report = work.root / "sdk.registry.json", work.root / "audit.json" + for image in (exporting(nid), build_pe([nid])): + (work.libs / "libc.prx").write_bytes(image) + for stub in (False, True): + write_source(work.source, "libc", (STUB_SOURCE if stub else DONE_SOURCE).format(name=name)) + for weak in (False, True): + with self.subTest(pe=image.startswith(b"MZ"), stub=stub, weak=weak): + write_registry(registry, [(name, "libc.prx", weak)]) + code, out, err = work.run(registry, "--json", str(report)) + self.assertEqual((code, err), (1, "")) + data = json.loads(report.read_text(encoding="utf-8")) + record, = data["imports"] + self.assertEqual(record["class"], "stub" if stub else "implemented") + self.assertEqual(record["providers"], ["libc.prx"]) + self.assertTrue(record["symbol_mismatch"]) + self.assertEqual(data["symbol_mismatch"], 1) + self.assertEqual(data["stops"][0]["nid"], None if weak else name) + self.assertIn("Qualified import names exported only as their NID", out) + self.assertIn(f"-> {nid}", out) + + def test_literal_exports_resolve_without_a_name_mismatch(self): + work = self.work + name, nid = "strlen", nid_names.compute_nid("strlen") + registry, report = work.root / "sdk.registry.json", work.root / "audit.json" + for image in (exporting(name, nid), build_pe(sorted([name, nid]))): + with self.subTest(pe=image.startswith(b"MZ")): + (work.libs / "libc.prx").write_bytes(image) + write_registry(registry, [(name, "libc.prx"), (nid, "libc.prx")]) + code, out, err = work.run(registry, "--json", str(report)) + self.assertEqual((code, err), (0, "")) + data = json.loads(report.read_text(encoding="utf-8")) + self.assertEqual(data["symbol_mismatch"], 0) + self.assertTrue(all(not record["symbol_mismatch"] for record in data["imports"])) + self.assertIsNone(data["stops"][0]["nid"]) + self.assertNotIn("Qualified import names exported only as their NID", out) + + def test_unscoped_windows_imports_keep_the_loaders_nid_fallback(self): + work = self.work + name, nid = "strlen", nid_names.compute_nid("strlen") + registry, report = work.root / "sdk.registry.json", work.root / "audit.json" + write_registry(registry, [(name, "")]) + (work.libs / "libc.prx").write_bytes(build_pe([nid])) + code, out, err = work.run(registry, "--json", str(report)) + self.assertEqual((code, err), (0, "")) + data = json.loads(report.read_text(encoding="utf-8")) + self.assertEqual(data["symbol_mismatch"], 0) + self.assertIsNone(data["stops"][0]["nid"]) + def test_named_nid_fallback_preserves_stub_and_library_classification(self): nid = nid_names.compute_nid(MESSAGE_NAME) imports = [(MESSAGE_NAME, "libSceOther.prx", False)] From b7a6e9d245e190a0fc2ba1d26f7fc9a84c482b98 Mon Sep 17 00:00:00 2001 From: Kovalev Vladislav Date: Fri, 23 Oct 2026 12:23:51 +0600 Subject: [PATCH 037/113] fix(tools): decouple symbol mismatches from stub classification --- tools/import_audit.py | 3 ++- tools/tests/test_import_audit.py | 11 +++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/import_audit.py b/tools/import_audit.py index 2f445230b9..a074a6105a 100644 --- a/tools/import_audit.py +++ b/tools/import_audit.py @@ -584,9 +584,11 @@ def audit(imports, exports, stubs, libraries, modules, module_imports=None, modu if not library: providers = sorted(set(providers) | set((module_exports or {}).get(nid, []))) resolved_nid = nid + record["symbol_mismatch"] = False if not providers: resolved_nid = nid_names.compute_nid(nid) providers = exports.get(resolved_nid, []) + record["symbol_mismatch"] = bool(library) and library not in modules and bool(providers) and resolved_nid != nid if not library: providers = sorted(set(providers) | set((module_exports or {}).get(resolved_nid, []))) kind = classify(resolved_nid, library, providers, stubs, modules) @@ -594,7 +596,6 @@ def audit(imports, exports, stubs, libraries, modules, module_imports=None, modu record["providers"] = providers record["library_mismatch"] = kind in ("implemented", "stub") and bool(library) and library not in providers and "libc.prx" not in providers record["name"] = next((stubs[(provider, resolved_nid)] for provider in providers if (provider, resolved_nid) in stubs), None) if kind == "stub" else None - record["symbol_mismatch"] = kind in ("implemented", "stub") and resolved_nid != nid and bool(library) ordered = sorted(records.values(), key=lambda record: (record["class"], record["library"] or "", record.get("module") or "", record["nid"])) check_conservation(len(imports) + sum(len(symbols) for symbols, _ in (module_imports or {}).values()), ordered) missing = defaultdict(int) diff --git a/tools/tests/test_import_audit.py b/tools/tests/test_import_audit.py index 8d5d3844b3..b57fdf0b49 100644 --- a/tools/tests/test_import_audit.py +++ b/tools/tests/test_import_audit.py @@ -313,6 +313,17 @@ class ImportAuditTests(unittest.TestCase): self.assertIn("Qualified import names exported only as their NID", out) self.assertIn(f"-> {nid}", out) + def test_name_mismatch_requires_a_resolved_host_fallback(self): + name, library = "strlen", "libc.prx" + exports = {nid_names.compute_nid(name): [library]} + for providers, modules, kind, mismatch in (({}, set(), "absent", False), + (exports, {library}, "module", False), + (exports, set(), "implemented", True)): + with self.subTest(kind=kind): + records, _ = import_audit.audit([(name, library, False)], providers, {}, {library}, modules) + self.assertEqual(records[0]["class"], kind) + self.assertEqual(records[0]["symbol_mismatch"], mismatch) + def test_literal_exports_resolve_without_a_name_mismatch(self): work = self.work name, nid = "strlen", nid_names.compute_nid("strlen") From a142125bd102d14e62214d620d4c676ae714bb78 Mon Sep 17 00:00:00 2001 From: klosixgaming-arch Date: Thu, 22 Oct 2026 18:09:22 +0000 Subject: [PATCH 038/113] fix(agc): bind a multisampled sRGB target as a storage image in its UNORM twin MultisampleTargetStorageView required the rendered VkFormat to equal the requested one. A 4x R8G8B8A8_SRGB target asked for as guest format 56 (R8G8B8A8_UNORM) therefore threw "storage image access to multisampled color target ... is not implemented", although the target is created with a UNORM storage view for exactly this access. The lookup now matches when both formats resolve to the same host storage format, which only holds for an sRGB format and its UNORM twin or for identical formats. Unrelated formats of the same size are still refused. AI-assisted: yes. Written with AI assistance and reviewed by me. --- .../Graphics/src/MultisampleTarget.cpp | 8 ++++- .../tests/execution/MultisampleRetirement.cpp | 35 +++++++++++++++++-- 2 files changed, 40 insertions(+), 3 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp index 809e680d42..da1732e9e2 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp @@ -1134,6 +1134,12 @@ VkComponentMapping swapRedBlue(VkComponentMapping components) { return {swapped(components.r, VK_COMPONENT_SWIZZLE_R), swapped(components.g, VK_COMPONENT_SWIZZLE_G), swapped(components.b, VK_COMPONENT_SWIZZLE_B), swapped(components.a, VK_COMPONENT_SWIZZLE_A)}; } +bool sameStorageForm(const Context& context, VkFormat rendered, VkFormat requested) { + if (rendered == requested) return true; + const auto storage = HostStorageFormat(context, rendered); + return storage != VK_FORMAT_UNDEFINED && storage == HostStorageFormat(context, requested); +} + } std::shared_ptr MultisampleTargetTexture(const Context& context, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType viewType) { @@ -1173,7 +1179,7 @@ VkImageView MultisampleTargetStorageView(const Context& context, const GuestText if (!target->active->load(std::memory_order_acquire)) continue; if (target->context.device != context.device || target->target.surfaceAddress != resource.baseAddress) continue; const auto& rendered = target->target; - if (rendered.format == format && rendered.extent.width == resource.width && rendered.extent.height == resource.height && rendered.samples == resource.samples && rendered.mip == 0) return target->Storage(StorageFormatForGuest(context, resource.format)); + if (sameStorageForm(context, rendered.format, format) && rendered.extent.width == resource.width && rendered.extent.height == resource.height && rendered.samples == resource.samples && rendered.mip == 0) return target->Storage(StorageFormatForGuest(context, resource.format)); other = target.get(); } if (other == nullptr) { diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp index 27f7d4ae49..5cc437a819 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp @@ -265,11 +265,11 @@ private: bool mapped = false; }; -ColorTarget Target(const GuestBlock& block) { +ColorTarget Target(const GuestBlock& block, VkFormat format = VK_FORMAT_R8G8B8A8_UNORM) { ColorTarget target{}; target.address = target.surfaceAddress = block.Address(); target.extent = target.surfaceExtent = {Side, Side}; - target.format = VK_FORMAT_R8G8B8A8_UNORM; + target.format = format; target.elementBytes = 4; target.samples = 4; target.tileMode = ColorTileMode::RenderTarget; @@ -556,6 +556,36 @@ public: AwaitImages(0, "MSAA targets with twin views were not fully released"); } + void StorageSrgbTwin() { + if (!context.storageImageMultisample || HostStorageFormat(context, VK_FORMAT_R8G8B8A8_SRGB) != VK_FORMAT_R8G8B8A8_UNORM) { + std::puts("the device has no UNORM storage form for a multisampled sRGB target; its storage twin case is skipped"); + return; + } + GuestBlock block; + const auto target = Target(block, VK_FORMAT_R8G8B8A8_SRGB); + auto resource = Resource(block); + VkImageView storageView = VK_NULL_HANDLE; + { + std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex()); + MultisampleTargetView(context, target); + storageView = MultisampleTargetStorageView(context, resource); + Require(storageView != VK_NULL_HANDLE, "a UNORM storage access to a multisampled sRGB target has no view"); + Require(MultisampleTargetStorageView(context, resource) == storageView, "a repeated UNORM storage access to a multisampled sRGB target changed its view"); + resource.format = 60; + bool refused = false; + try { + MultisampleTargetStorageView(context, resource); + } catch (const std::exception&) { + refused = true; + } + Require(refused, "a storage access in an unrelated format reached a multisampled sRGB target"); + } + Sync(); + block.Unmap(); + Clear(); + AwaitImages(0, "the sRGB storage twin targets were not fully released"); + } + private: AgcDriver::VulkanDevice& device; Context context; @@ -574,6 +604,7 @@ int main() { run.RecordedRemap(); run.SampledRemap(); run.StorageRemap(); + run.StorageSrgbTwin(); run.OrderRemap(); if (context.storageImageMultisample) run.StorageTwin(); std::puts("retired MSAA allocations stay bounded, recorded clears and storage promotions retain their images, sampled aliases release their parents after the last batch, and sample-order targets keep their retired images until their batch completes"); From 3f0a1e4222d0fe257d3f72b99b3a7196076de1d8 Mon Sep 17 00:00:00 2001 From: klosixgaming-arch Date: Thu, 22 Oct 2026 18:09:28 +0000 Subject: [PATCH 039/113] fix(agc): keep a promoted multisampled target's color view out of storage usage A multisampled sRGB target promoted to storage gained VK_IMAGE_USAGE_STORAGE_BIT on its image, and its color view in the sRGB format inherited that usage. sRGB formats have no storage image feature, so the validation layer reported VUID-VkImageViewCreateInfo-usage-02275 on the first storage access. The view now excludes the storage usage whenever the image has it, which is what it already did for targets created with a sample-order storage form. AI-assisted: yes. Written with AI assistance and reviewed by me. --- .../libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp index da1732e9e2..98695ac999 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp @@ -227,7 +227,7 @@ public: viewInfo.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1}; VkImageViewUsageCreateInfo viewUsage{VK_STRUCTURE_TYPE_IMAGE_VIEW_USAGE_CREATE_INFO}; viewUsage.usage = imageUsage & ~VK_IMAGE_USAGE_STORAGE_BIT; - if (orderFormat != VK_FORMAT_UNDEFINED) viewInfo.pNext = &viewUsage; + if ((imageUsage & VK_IMAGE_USAGE_STORAGE_BIT) != 0) viewInfo.pNext = &viewUsage; Check(context.Function("vkCreateImageView")(context.device, &viewInfo, nullptr, &created.view), "vkCreateImageView multisampled target"); } catch (...) { destroy(created); From 73f9b5d9fba1251590ea7af1d84ee19586b0ea78 Mon Sep 17 00:00:00 2001 From: thuanquang Date: Fri, 23 Oct 2026 03:22:21 +0700 Subject: [PATCH 040/113] perf(libc): carve fresh private guest pages out of their placeholder A private guest commit on Windows (every anonymous kernel map commits with a 16 KiB granule) ran reset() on each page before replacing it: 10 VirtualQuery calls, a placeholder split and the VirtualAlloc2, so 12 calls per page. At the arena's first-fit frontier the placeholder is the arena's free tail, hundreds of GiB. Commit now queries a placeholder once, cuts the range out of it (one split where the range starts inside the placeholder, one where the placeholder extends past the range), and carves the pages from that bounded placeholder: one split and one VirtualAlloc2 per page, and no split for the last page. Each page is still its own allocation with the same protection, write watch and created ranges, so munmap, MAP_FIXED remaps, views and collects see the same layout as before. A piece that would cross the end of its placeholder (a whole-range granule over several placeholders) still takes the coalescing path through reset(), and committed memory in the range still only changes its protection. A zero granule now throws std::invalid_argument before touching the address space. windows_write_watch counts the queries with a compile-time counter that only that test defines (APS5_COUNT_MAPPING_QUERIES, copied from #9505) and checks: 256 fresh pages one page into a 1 GiB placeholder take one query (main's loop makes 2,561), each page is its own allocation and the placeholders around them are intact; the release and recommit of one page; a protection-only commit; the write watch of carved pages; a whole-range granule inside one placeholder and across two; committed pieces and adjacent placeholders inside the range; a partial release and a fixed remap that keep their neighbours; a granule that would cross the end of the placeholder being carved, which takes the coalescing path; a short last piece; a commit that runs to the end of its placeholder; an unwatched commit; and the zero-granule throw. PPSA14363 boot on an RX 6700 XT, idle PC, 4 runs on main and 3 with this change: the first 10 s after the first present go from 546-552 presents with a 578-704 ms frame to 588-594 presents with a 97-117 ms frame. Co-Authored-By: Claude --- core/libs/CMakeLists.txt | 2 +- .../libs/prx/libc/include/WindowsMappings.hpp | 46 +++++- core/libs/tests/WindowsWriteWatch.cpp | 146 ++++++++++++++++++ 3 files changed, 188 insertions(+), 6 deletions(-) diff --git a/core/libs/CMakeLists.txt b/core/libs/CMakeLists.txt index 6d9660398d..5d004940de 100644 --- a/core/libs/CMakeLists.txt +++ b/core/libs/CMakeLists.txt @@ -349,7 +349,7 @@ if(BUILD_TESTING) if(WIN32) add_test_executable(windows_write_watch_tests tests/WindowsWriteWatch.cpp) target_include_directories(windows_write_watch_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}) - target_compile_definitions(windows_write_watch_tests PRIVATE _WIN32_WINNT=0x0A00) + target_compile_definitions(windows_write_watch_tests PRIVATE _WIN32_WINNT=0x0A00 APS5_COUNT_MAPPING_QUERIES=1) if(MINGW) target_compile_options(windows_write_watch_tests PRIVATE -fasynchronous-unwind-tables) endif() diff --git a/core/libs/prx/libc/include/WindowsMappings.hpp b/core/libs/prx/libc/include/WindowsMappings.hpp index 624685e8a9..a908e74bd9 100644 --- a/core/libs/prx/libc/include/WindowsMappings.hpp +++ b/core/libs/prx/libc/include/WindowsMappings.hpp @@ -5,6 +5,9 @@ #include #include #include +#ifdef APS5_COUNT_MAPPING_QUERIES +#include +#endif #include #include #include @@ -28,18 +31,48 @@ public: return *mappings; } +#ifdef APS5_COUNT_MAPPING_QUERIES + static std::uint64_t MemoryQueries() { + return queries.load(std::memory_order_relaxed); + } +#endif + void* Reserve(void* address, std::size_t bytes) { return allocate(GetCurrentProcess(), address, bytes, MEM_RESERVE | MEM_RESERVE_PLACEHOLDER, PAGE_NOACCESS, nullptr, 0); } std::vector> Commit(void* address, std::size_t bytes, DWORD protection, std::size_t granule, bool watched) { + if (granule == 0) throw std::invalid_argument("guest memory commit granule is zero"); std::vector> created; std::lock_guard lock(mutex); collectableRanges.clear(); + const DWORD flags = MEM_RESERVE | MEM_COMMIT | MEM_REPLACE_PLACEHOLDER | (watched ? MEM_WRITE_WATCH : 0); + const auto cut = [](std::uintptr_t at, std::size_t size, const char* operation) { + if (!VirtualFree(reinterpret_cast(at), size, MEM_RELEASE | MEM_PRESERVE_PLACEHOLDER)) fail(operation); + }; + const auto replace = [&](std::uintptr_t at, std::size_t size) { + if (!allocate(GetCurrentProcess(), reinterpret_cast(at), size, flags, protection, nullptr, 0)) fail("replace guest placeholder with private memory"); + if (!created.empty() && created.back().first + created.back().second == at) created.back().second += size; + else created.emplace_back(at, size); + }; const auto end = reinterpret_cast(address) + bytes; for (auto cursor = reinterpret_cast(address); cursor < end;) { const auto memory = query(cursor); - const auto stop = std::min(end, reinterpret_cast(memory.BaseAddress) + memory.RegionSize); + const auto regionEnd = reinterpret_cast(memory.BaseAddress) + memory.RegionSize; + const auto stop = std::min(end, regionEnd); + if (memory.State == MEM_RESERVE && std::min(end, cursor + granule) <= regionEnd) { + forgetClean(cursor, stop); + const auto holder = reinterpret_cast(memory.AllocationBase); + if (holder != cursor) cut(holder, cursor - holder, "split guest placeholder prefix"); + if (stop != regionEnd) cut(cursor, stop - cursor, "split guest placeholder suffix"); + while (cursor < stop && std::min(end, cursor + granule) <= stop) { + const auto size = std::min(end, cursor + granule) - cursor; + if (cursor + size != stop) cut(cursor, size, "split guest placeholder suffix"); + replace(cursor, size); + cursor += size; + } + continue; + } if (memory.State == MEM_RESERVE) { const auto limit = std::min(end, cursor + granule); auto placeholderEnd = stop; @@ -50,10 +83,7 @@ public: } const auto size = std::min(limit, placeholderEnd) - cursor; reset(cursor, size); - const DWORD flags = MEM_RESERVE | MEM_COMMIT | MEM_REPLACE_PLACEHOLDER | (watched ? MEM_WRITE_WATCH : 0); - if (!allocate(GetCurrentProcess(), reinterpret_cast(cursor), size, flags, protection, nullptr, 0)) fail("replace guest placeholder with private memory"); - if (!created.empty() && created.back().first + created.back().second == cursor) created.back().second += size; - else created.emplace_back(cursor, size); + replace(cursor, size); cursor += size; } else { if (memory.State != MEM_COMMIT) throw std::runtime_error("guest memory is not committed"); @@ -890,6 +920,9 @@ private: static MEMORY_BASIC_INFORMATION query(std::uintptr_t address) { MEMORY_BASIC_INFORMATION memory{}; +#ifdef APS5_COUNT_MAPPING_QUERIES + queries.fetch_add(1, std::memory_order_relaxed); +#endif if (VirtualQuery(reinterpret_cast(address), &memory, sizeof(memory)) != sizeof(memory)) fail("query guest memory"); return memory; } @@ -1023,6 +1056,9 @@ private: std::map splitAliases; std::size_t granularity = 0x10000; bool watchResident = false; +#ifdef APS5_COUNT_MAPPING_QUERIES + static inline std::atomic queries{0}; +#endif std::mutex mutex; AllocateFunction allocate = nullptr; MapFunction map = nullptr; diff --git a/core/libs/tests/WindowsWriteWatch.cpp b/core/libs/tests/WindowsWriteWatch.cpp index b44c48af61..ee64651144 100644 --- a/core/libs/tests/WindowsWriteWatch.cpp +++ b/core/libs/tests/WindowsWriteWatch.cpp @@ -172,6 +172,149 @@ void CheckPrivate() { VirtualFree(memory, 0, MEM_RELEASE); } +MEMORY_BASIC_INFORMATION RegionAt(const void* address) { + MEMORY_BASIC_INFORMATION info{}; + Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "private commit query failed"); + return info; +} + +void CheckPrivateCommitCarvesPlaceholders() { + auto& mappings = Mappings::Get(); + constexpr std::size_t Page = 16384; + constexpr std::size_t Pages = 256; + constexpr std::size_t Span = Pages * Page; + constexpr std::size_t Reserved = std::size_t{1} << 30; + auto* holder = static_cast(mappings.Reserve(nullptr, Reserved)); + Require(holder != nullptr, "cannot reserve a placeholder for private commits"); + auto* memory = holder + Page; + const auto page = [&](std::size_t index) { return memory + index * Page; }; + const auto at = [](const unsigned char* pointer) { return reinterpret_cast(pointer); }; + auto before = Mappings::MemoryQueries(); + auto created = mappings.Commit(memory, Span, PAGE_READWRITE, Page, true); + const auto queries = Mappings::MemoryQueries() - before; + Require(queries == 1, ("committing 256 fresh pages queried the address space " + std::to_string(queries) + " times").c_str()); + Require(created.size() == 1 && created[0].first == at(memory) && created[0].second == Span, "a fresh commit did not report its range as one created range"); + for (std::size_t index = 0; index < Pages; ++index) { + const auto info = RegionAt(page(index)); + Require(info.State == MEM_COMMIT && info.Type == MEM_PRIVATE && info.AllocationBase == page(index) && info.RegionSize == Page && info.Protect == PAGE_READWRITE, "a committed page is not a read-write allocation of its own"); + } + const auto prefix = RegionAt(holder); + Require(prefix.State == MEM_RESERVE && prefix.AllocationBase == holder && prefix.RegionSize == Page, "the placeholder before the commit changed"); + const auto suffix = RegionAt(page(Pages)); + Require(suffix.State == MEM_RESERVE && suffix.AllocationBase == page(Pages) && suffix.RegionSize == Reserved - Page - Span, "the placeholder after the commit changed"); + for (std::size_t index = 0; index < Pages; ++index) page(index)[8] = static_cast(index + 1); + mappings.Reset(page(11), Page); + const auto released = RegionAt(page(11)); + Require(released.State == MEM_RESERVE && released.AllocationBase == page(11) && released.RegionSize == Page, "a released page did not become a placeholder of its own"); + before = Mappings::MemoryQueries(); + created = mappings.Commit(page(11), Page, PAGE_READWRITE, Page, true); + Require(Mappings::MemoryQueries() - before <= 1 && created.size() == 1 && created[0].first == at(page(11)) && created[0].second == Page && page(11)[8] == 0, "recommitting a released page was not one fresh allocation"); + for (std::size_t index = 0; index < Pages; ++index) { + if (index != 11) Require(page(index)[8] == static_cast(index + 1), "a release or commit changed a neighbouring page"); + } + created = mappings.Commit(memory, Span, PAGE_READONLY, Page, true); + Require(created.empty() && RegionAt(page(0)).Protect == PAGE_READONLY && RegionAt(page(Pages - 1)).Protect == PAGE_READONLY, "a protection change reported fresh memory or missed a page"); + mappings.Commit(memory, Span, PAGE_READWRITE, Page, true); + std::array written{}; + std::size_t count = written.size(); + mappings.Collect(at(page(40)), 4 * Page, written.data(), &count, true); + page(41)[4096 + 3] = 1; + count = written.size(); + Require(mappings.Collect(at(page(40)), 4 * Page, written.data(), &count, true, Collection::Armed) && count == 1 && written[0] == page(41) + 4096, "a carved page lost its write watch"); + mappings.Reset(page(20), 2 * Page); + mappings.Reset(page(22), 2 * Page); + created = mappings.Commit(page(20), 4 * Page, PAGE_READWRITE, 4 * Page, true); + Require(created.size() == 1 && created[0].second == 4 * Page && RegionAt(page(23)).AllocationBase == page(20), "a commit over two placeholders was not one allocation"); + mappings.Reset(memory, Span); + Require(VirtualFree(holder, Reserved, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS) && VirtualFree(holder, 0, MEM_RELEASE), "cannot release the private commit placeholder"); +} + +void CheckPrivateCommitEdgeLayouts() { + auto& mappings = Mappings::Get(); + constexpr std::size_t Page = 16384; + constexpr std::size_t Pages = 32; + auto* memory = static_cast(mappings.Reserve(nullptr, Pages * Page)); + Require(memory != nullptr, "cannot reserve a placeholder for private commit edges"); + const auto page = [&](std::size_t index) { return memory + index * Page; }; + const auto range = [&](std::size_t first, std::size_t count) { return std::make_pair(reinterpret_cast(page(first)), count * Page); }; + const auto region = [&](std::size_t first, std::size_t count, DWORD state) { + const auto info = RegionAt(page(first)); + return info.State == state && info.AllocationBase == page(first) && info.RegionSize == count * Page; + }; + const auto ownPages = [&](std::size_t first, std::size_t count) { + for (auto index = first; index < first + count; ++index) { + if (!region(index, 1, MEM_COMMIT)) return false; + } + return true; + }; + auto before = Mappings::MemoryQueries(); + auto created = mappings.Commit(page(2), 4 * Page, PAGE_READWRITE, 4 * Page, true); + Require(Mappings::MemoryQueries() - before <= 1 && created.size() == 1 && created[0] == range(2, 4), "a whole-range granule inside a placeholder was not one created range from one query"); + Require(region(0, 2, MEM_RESERVE) && region(2, 4, MEM_COMMIT) && region(6, Pages - 6, MEM_RESERVE), "a whole-range granule inside a placeholder was not one allocation between two placeholders"); + page(2)[8] = 0x5a; + before = Mappings::MemoryQueries(); + created = mappings.Commit(page(0), 8 * Page, PAGE_READWRITE, Page, true); + Require(Mappings::MemoryQueries() - before <= 3 && created.size() == 2 && created[0] == range(0, 2) && created[1] == range(6, 2), "a commit around a committed piece did not create exactly the placeholders around it"); + Require(ownPages(0, 2) && region(2, 4, MEM_COMMIT) && page(2)[8] == 0x5a && ownPages(6, 2) && region(8, Pages - 8, MEM_RESERVE), "a commit around a committed piece changed the piece or the layout"); + for (std::size_t index = 0; index < 8; ++index) page(index)[8] = static_cast(index + 1); + mappings.Reset(page(6), 2 * Page); + Require(region(6, 2, MEM_RESERVE) && ownPages(0, 2) && region(2, 4, MEM_COMMIT) && page(1)[8] == 2 && page(5)[8] == 6 && region(8, Pages - 8, MEM_RESERVE), "a partial release of carved pages changed a neighbour"); + mappings.Reset(page(2), 4 * Page); + before = Mappings::MemoryQueries(); + created = mappings.Commit(page(2), 4 * Page, PAGE_READWRITE, Page, true); + Require(Mappings::MemoryQueries() - before <= 1 && created.size() == 1 && created[0] == range(2, 4) && ownPages(2, 4) && page(2)[8] == 0 && page(5)[8] == 0, "a fixed remap was not carved into fresh pages"); + Require(page(1)[8] == 2 && region(6, 2, MEM_RESERVE), "a fixed remap changed a neighbour"); + before = Mappings::MemoryQueries(); + created = mappings.Commit(page(6), 4 * Page, PAGE_READWRITE, Page, true); + Require(Mappings::MemoryQueries() - before <= 2 && created.size() == 1 && created[0] == range(6, 4) && ownPages(6, 4) && region(10, Pages - 10, MEM_RESERVE), "a commit over adjacent placeholders was not carved page by page"); + bool refused = false; + try { + mappings.Commit(page(12), Page, PAGE_READWRITE, 0, true); + } catch (const std::invalid_argument&) { + refused = true; + } + Require(refused && region(10, Pages - 10, MEM_RESERVE), "a zero commit granule was accepted or changed the placeholder"); + mappings.Commit(page(10), 3 * Page, PAGE_READWRITE, 3 * Page, true); + mappings.Reset(page(10), 3 * Page); + created = mappings.Commit(page(10), 4 * Page, PAGE_READWRITE, 2 * Page, true); + Require(created.size() == 1 && created[0] == range(10, 4) && region(10, 2, MEM_COMMIT) && region(12, 2, MEM_COMMIT) && region(14, Pages - 14, MEM_RESERVE), "a granule crossing the end of a carved placeholder did not take the coalescing path"); + mappings.Reset(memory, 14 * Page); + Require(VirtualFree(memory, Pages * Page, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS) && VirtualFree(memory, 0, MEM_RELEASE), "cannot release the private commit edge placeholder"); +} + +void CheckPrivateCommitTails() { + auto& mappings = Mappings::Get(); + constexpr std::size_t Page = 16384; + constexpr std::size_t Pages = 8; + auto* memory = static_cast(mappings.Reserve(nullptr, Pages * Page)); + Require(memory != nullptr, "cannot reserve a placeholder for private commit tails"); + const auto page = [&](std::size_t index) { return memory + index * Page; }; + const auto at = [](const unsigned char* pointer) { return reinterpret_cast(pointer); }; + const auto allocation = [](const unsigned char* base, std::size_t bytes, DWORD state) { + const auto info = RegionAt(base); + return info.State == state && info.AllocationBase == base && info.RegionSize == bytes; + }; + const auto unwatched = [](unsigned char* base) { + std::array written{}; + ULONG_PTR count = written.size(); + DWORD granularity = 0; + return GetWriteWatch(0, base, Small, written.data(), &count, &granularity) != 0; + }; + auto before = Mappings::MemoryQueries(); + auto created = mappings.Commit(page(1), 2 * Page + Small, PAGE_READWRITE, Page, false); + Require(Mappings::MemoryQueries() - before == 1 && created.size() == 1 && created[0].first == at(page(1)) && created[0].second == 2 * Page + Small, "a commit with a short last piece was not one created range from one query"); + Require(allocation(page(0), Page, MEM_RESERVE) && allocation(page(1), Page, MEM_COMMIT) && allocation(page(2), Page, MEM_COMMIT) && allocation(page(3), Small, MEM_COMMIT) && allocation(page(3) + Small, (Pages - 3) * Page - Small, MEM_RESERVE), "a short last piece was not its own allocation before the rest of the placeholder"); + page(3)[Small - 1] = 7; + Require(unwatched(page(1)) && unwatched(page(3)), "an unwatched commit carved write-watched pages"); + before = Mappings::MemoryQueries(); + created = mappings.Commit(page(5), 3 * Page, PAGE_READWRITE, Page, true); + Require(Mappings::MemoryQueries() - before == 1 && created.size() == 1 && created[0].first == at(page(5)) && created[0].second == 3 * Page, "a commit to the end of a placeholder was not one created range from one query"); + Require(allocation(page(3) + Small, 2 * Page - Small, MEM_RESERVE) && allocation(page(5), Page, MEM_COMMIT) && allocation(page(6), Page, MEM_COMMIT) && allocation(page(7), Page, MEM_COMMIT) && page(3)[Small - 1] == 7, "a commit to the end of a placeholder changed the placeholder before it or a neighbour"); + mappings.Reset(page(1), 2 * Page + Small); + mappings.Reset(page(5), 3 * Page); + Require(VirtualFree(memory, Pages * Page, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS) && VirtualFree(memory, 0, MEM_RELEASE), "cannot release the private commit tail placeholder"); +} + void CheckForgottenSectionKeepsNoPages() { auto& mappings = Mappings::Get(); HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, Bytes, nullptr); @@ -230,6 +373,9 @@ int main() { CheckPrivate(); CheckConcurrentWrites(); CheckForgottenSectionKeepsNoPages(); + CheckPrivateCommitCarvesPlaceholders(); + CheckPrivateCommitEdgeLayouts(); + CheckPrivateCommitTails(); std::cout << "Windows deferred write-watch tests passed\n"; } catch (const std::exception& error) { std::cerr << error.what() << '\n'; From b92291c7aea242520e26cee633767888c3364ef7 Mon Sep 17 00:00:00 2001 From: Eduardo Ruiz Date: Fri, 23 Oct 2026 10:05:36 +0200 Subject: [PATCH 041/113] feat(libc): export operator delete(void*, const std::nothrow_t&) The console's libc exports _ZdlPvRKSt9nothrow_t (NID McsGnqV6yRE) as a 12-byte tail call to the same delete function that _ZdlPv uses, ignoring the nothrow tag. Forward to _ZdlPv so memory from the nothrow new overloads is released through the registered application heap; a null pointer is ignored. --- core/libs/prx/libc/src/StdioExtras.cpp | 4 ++++ core/libs/tests/GuestNewHandler.cpp | 14 +++++++++++++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libc/src/StdioExtras.cpp b/core/libs/prx/libc/src/StdioExtras.cpp index 28b5f7b33b..be68fa2638 100644 --- a/core/libs/prx/libc/src/StdioExtras.cpp +++ b/core/libs/prx/libc/src/StdioExtras.cpp @@ -131,6 +131,10 @@ void APS5_VABI _ZdlPv_nid_postfix(void* pointer) { if (pointer != nullptr) ApplicationHeapFree_nid_no_patch(pointer); } +void APS5_VABI _ZdlPvRKSt9nothrow_t_nid_postfix(void* pointer, const void*) noexcept { + _ZdlPv_nid_postfix(pointer); +} + void APS5_VABI _ZdaPv_nid_postfix(void* pointer) { if (pointer != nullptr) ApplicationHeapFree_nid_no_patch(pointer); } diff --git a/core/libs/tests/GuestNewHandler.cpp b/core/libs/tests/GuestNewHandler.cpp index 04a5d9a8a1..6229ada261 100644 --- a/core/libs/tests/GuestNewHandler.cpp +++ b/core/libs/tests/GuestNewHandler.cpp @@ -19,6 +19,7 @@ void* APS5_VABI _ZnwmSt11align_val_t_nid_postfix(std::size_t, std::size_t); void* APS5_VABI _ZnwmRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept; void* APS5_VABI _ZnamRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept; void APS5_VABI _ZdlPv_nid_postfix(void*); +void APS5_VABI _ZdlPvRKSt9nothrow_t_nid_postfix(void*, const void*) noexcept; void APS5_VABI _ZdlPvSt11align_val_t_nid_postfix(void*, std::size_t); } @@ -27,6 +28,7 @@ namespace { alignas(16) std::array storage{}; unsigned failuresLeft = 0; unsigned allocations = 0; +unsigned releases = 0; unsigned handlerCalls = 0; std::size_t lastSize = 0; std::size_t lastAlignment = 0; @@ -50,7 +52,7 @@ void* APS5_VABI allocate(std::size_t bytes) { return storage.data(); } -void APS5_VABI release(void*) {} +void APS5_VABI release(void*) { ++releases; } void* APS5_VABI allocateZeroed(std::size_t count, std::size_t bytes) { return allocate(count * bytes); } void* APS5_VABI reallocate(void*, std::size_t bytes) { return allocate(bytes); } void* APS5_VABI align(std::size_t alignment, std::size_t bytes) { @@ -80,6 +82,7 @@ void APS5_VABI allocatingHandler() { void Reset(unsigned failures) { failuresLeft = failures; allocations = 0; + releases = 0; handlerCalls = 0; } @@ -138,6 +141,15 @@ int main(int argc, char** argv) { REQUIRE(_ZSt15get_new_handlerv_nid_postfix() == nullptr); + Reset(0); + void* nothrowPointer = _Znwm_nid_postfix(8); + const int nothrowTag = 0; + REQUIRE(nothrowPointer == storage.data() && releases == 0); + _ZdlPvRKSt9nothrow_t_nid_postfix(nothrowPointer, ¬hrowTag); + REQUIRE(releases == 1); + _ZdlPvRKSt9nothrow_t_nid_postfix(nullptr, ¬hrowTag); + REQUIRE(releases == 1); + Reset(1); REQUIRE(Throws([] { _Znwm_nid_postfix(8); }) && handlerCalls == 0 && allocations == 1); Reset(1); From 94d9c6a73f74ed1caf9a3f4ee6068d3a9055cb30 Mon Sep 17 00:00:00 2001 From: LeandroLP23 Date: Fri, 23 Oct 2026 11:48:27 +0200 Subject: [PATCH 042/113] build(cmake): compile the Windows test exit wrapper once for every test Co-Authored-By: Claude Opus 5.5 --- CMakeLists.txt | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 25d411aa58..e097e7820c 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -6,13 +6,12 @@ endif() project(Relinker CXX) set(ANYPS5_TEST_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/tests") -set(ANYPS5_WINDOWS_TEST_EXIT "${CMAKE_CURRENT_SOURCE_DIR}/cmake/WindowsTestExit.cpp") function(add_test_executable target) add_executable(${target} ${ARGN}) set_target_properties(${target} PROPERTIES RUNTIME_OUTPUT_DIRECTORY "$<1:${ANYPS5_TEST_OUTPUT_DIRECTORY}>") if(MINGW) - target_sources(${target} PRIVATE "${ANYPS5_WINDOWS_TEST_EXIT}") + target_sources(${target} PRIVATE $) target_link_options(${target} PRIVATE LINKER:--wrap=main) endif() endfunction() @@ -96,6 +95,10 @@ if(APPLE AND NOT ANYPS5_RELINKER_ONLY) add_link_options(-fexperimental-library) endif() +if(MINGW) + add_library(anyps5_windows_test_exit OBJECT cmake/WindowsTestExit.cpp) +endif() + if(BUILD_TESTING) add_test_executable(shader_cache_file_read_tests ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler/tests/CacheFileReadTests.cpp) From 92de1c6a7618fc81c72f65fe9b424a2f637b1979 Mon Sep 17 00:00:00 2001 From: Yunus Shaikh <75296019+EagleBearerYS@users.noreply.github.com> Date: Fri, 23 Oct 2026 09:41:17 +0000 Subject: [PATCH 043/113] feat(libSceNetCtl): report no error from sceNetCtlGetResult for IPv4 events sceNetCtlGetResult threw for every event after its initialization and address checks, and Worms Armageddon: Anniversary Edition (PPSA20052) and Monster Hunter Wilds (PPSA24191) stop on it at boot; MHW's first call asks about event 1, a disconnection. It now answers as sceNetCtlGetResultV6 does: for event types 1 to 3, disconnected to IP obtained (the numbers sceNetCtlCheckCallback delivers), it writes 0 to the result and returns 0. Other event types throw, naming the type. The initialization and null checks come first, as before. The error code a console reports per event is unconfirmed, which the library's debt page now records. The guest NetCtl test covers each supported event, three unsupported ones with the new message and the result left untouched, and a null result answered before the event is looked at. --- core/libs/prx/libSceNetCtl/Export.cpp | 6 +++++- core/libs/tests/GuestNetCtl.cpp | 18 +++++++++++------- docs/dev/debt/libSceNetCtl.md | 3 ++- 3 files changed, 18 insertions(+), 9 deletions(-) diff --git a/core/libs/prx/libSceNetCtl/Export.cpp b/core/libs/prx/libSceNetCtl/Export.cpp index 54c9d941fe..3a31755e82 100644 --- a/core/libs/prx/libSceNetCtl/Export.cpp +++ b/core/libs/prx/libSceNetCtl/Export.cpp @@ -584,7 +584,11 @@ int APS5_VABI sceNetCtlGetNatInfo(NetCtlNatInfo* info) { int APS5_VABI sceNetCtlGetResult(int event, int* result) { if (!g_initialized.load()) return SCE_NET_CTL_ERROR_NOT_INITIALIZED; if (!result) return SCE_NET_CTL_ERROR_INVALID_ADDR; - throw std::logic_error("sceNetCtlGetResult: service event results are not implemented"); + if (event < NET_CTL_EVENT_DISCONNECTED || event > NET_CTL_EVENT_IPOBTAINED) { + throw std::runtime_error("sceNetCtlGetResult: event type " + std::to_string(event) + " is not implemented"); + } + *result = 0; + return 0; } int APS5_VABI sceNetCtlGetState(int* state) { diff --git a/core/libs/tests/GuestNetCtl.cpp b/core/libs/tests/GuestNetCtl.cpp index f45a66dc77..3560d4db92 100644 --- a/core/libs/tests/GuestNetCtl.cpp +++ b/core/libs/tests/GuestNetCtl.cpp @@ -22,6 +22,7 @@ #include #include #include +#include #ifdef __APPLE__ struct NetCtlDefaultRoute { @@ -290,14 +291,17 @@ int main() { Require(sceNetCtlGetStateV6(&stateV6) == 0); Require(stateV6 == 0 || stateV6 == kStateIpObtained); Require(sceNetCtlGetResult(0, nullptr) == kErrInvalidAddr); - int errorCode = -1; - bool resultUnsupported = false; - try { - sceNetCtlGetResult(0, &errorCode); - } catch (const std::logic_error&) { - resultUnsupported = true; + Require(sceNetCtlGetResult(kEventDisconnected, nullptr) == kErrInvalidAddr); + for (const int eventType : {kEventDisconnected, 2, kEventIpObtained}) { + int errorCode = -1; + Require(sceNetCtlGetResult(eventType, &errorCode) == 0 && errorCode == 0); + } + for (const int eventType : {0, 4, -1}) { + int errorCode = -1; + std::string what; + try { sceNetCtlGetResult(eventType, &errorCode); } catch (const std::runtime_error& error) { what = error.what(); } + Require(what == "sceNetCtlGetResult: event type " + std::to_string(eventType) + " is not implemented" && errorCode == -1); } - Require(resultUnsupported && errorCode == -1); Require(sceNetCtlGetResultV6(kEventIpObtained, nullptr) == kErrInvalidAddr); for (const int eventType : {kEventDisconnected, 2, kEventIpObtained}) { int errorCodeV6 = -1; diff --git a/docs/dev/debt/libSceNetCtl.md b/docs/dev/debt/libSceNetCtl.md index aaa9cf2f9d..e0704a1cc7 100644 --- a/docs/dev/debt/libSceNetCtl.md +++ b/docs/dev/debt/libSceNetCtl.md @@ -2,7 +2,7 @@ ### Functional -- [sceNetCtlGetNatInfo and sceNetCtlGetResult](../../../core/libs/prx/libSceNetCtl/Export.cpp) - NAT discovery and service event results are not implemented and throw after native initialization and argument checks. NAT information is 16 bytes with a 32-bit size prefix; the remaining fields are unresolved. +- [sceNetCtlGetNatInfo](../../../core/libs/prx/libSceNetCtl/Export.cpp) - NAT discovery is not implemented and throws after native initialization and argument checks. NAT information is 16 bytes with a 32-bit size prefix; the remaining fields are unresolved. ### Unknown function info @@ -10,6 +10,7 @@ - [sceNetCtlGetInfo](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - answers from the host interface that holds an IPv4 address, preferring the one that carries the default route: its address, netmask, gateway, MTU and first two IPv4 DNS servers. The device is reported as wired, the link as connected, the IP configuration as DHCP and the HTTP proxy as off, whatever the host uses, and the Ethernet address is the one `sceNetGetMacAddress` reports. A gateway or DNS server the interface does not have is reported as `0.0.0.0`; what a console reports then is unknown. The DHCP host name (12), the PPPoE user name (13), the HTTP proxy server (20) and the Wi-Fi BSSID and SSID (5, 6) are empty strings, as that configuration sets none of them; the remaining Wi-Fi codes (7-10) and the HTTP proxy port (21) report 0; this follows [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/main/src/libs/network.cpp) and is not measured on hardware - [sceNetCtlGetInfoV6](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl, NID `Jy1EO5GdlcM`) - imported by PPSA08587. `(int code, SceNetCtlInfoV6* info)` with codes 1-5 (IP address, link-local address, default route, primary and secondary DNS) comes only from [SharpProspero](https://github.com/SvenGDK/SharpProspero), whose source is unknown; shadPS4 and fpPS4 only stub it. A null `info` answers `INVALID_ADDR`, a code outside 1-5 `INVALID_CODE`, and a host without an IPv6 address `NOT_CONNECTED`, as `sceNetCtlGetStateV6` reports it. The layout of each answer is unverified, so every code throws on a host with an IPv6 address +- [sceNetCtlGetResult](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - `(int eventType, int* errorCode)` reports no error: event types 1-3 (disconnected to IP obtained, the numbering `sceNetCtlCheckCallback` delivers) write 0 to `errorCode`, as `sceNetCtlGetResultV6` does. The error code a console reports for each event, a disconnection's cause in particular, is unconfirmed. Callers found: PPSA20052 (Worms Armageddon: Anniversary Edition 01.003.000) calls it 2 s into boot, and PPSA24191 (Monster Hunter Wilds) without a network, with event 1 (disconnected) as its first call. A null `errorCode` answers `INVALID_ADDR` and other event types throw, as their error code on a console is unknown - [sceNetCtlGetResultV6](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl, NID `H5yARg37U5g`) - `(int eventType, int* errorCode)` comes only from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/NetCtl.cs#L246-L251), whose source is unknown; shadPS4 only stubs it. Callbacks registered with `sceNetCtlRegisterCallbackV6` receive no event, so event types 1-3 write 0 to `errorCode`; what a console writes before the first event is unmeasured. A null `errorCode` answers `INVALID_ADDR`, as `sceNetCtlGetResult` does, and other event types throw, as their error code on a console is unknown - [ApRp exports](../../../core/libs/prx/libSceNetCtl/Export.cpp) are constant-success functions in the supplied native module and consume no arguments. No callers were found in the supplied system-library decompilations, so unused callback, output and configuration argument types remain unresolved. Protected stub bodies are unchanged. From 12ca5c16f0cc7c9aee25456e323e8c519c90cb9f Mon Sep 17 00:00:00 2001 From: Giuseppe Magliano Date: Fri, 23 Oct 2026 12:27:39 +0200 Subject: [PATCH 044/113] test(agc): skip the forced-watch shadow tests where imports report pages written agc_driver_bda_reads_shadowed_results, its per-build form and agc_unit_shadow_completion_store force host imports to stay watched on non-Windows hosts. On RADV, importing watched host memory and reading it from the GPU both report the pages written, which is why the driver compares those imports instead of watching them. Under the forced watch those reports read as CPU stores: every shadowed unit is stale-dropped before the address-based publish, and the tests fail on every run. Both tests now run the import probe and skip, like agc_unit_shadow and agc_shadowed_key_stores already do there, when the import or a GPU read reports pages written. Devices whose imports stay clean until a GPU write, such as lavapipe, still run them. --- core/libs/prx/libSceAgcDriver/tests/Recorder.cpp | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp index a5bc67e508..ec52550d47 100644 --- a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp @@ -5106,6 +5106,11 @@ bool addressShadowTests(const Device& device, Recorder& recorder) { } const auto decided = PrepareImportWatch(base); #ifndef _WIN32 + const auto probe = ProbeImportWriteProtection(base); + if (probe.failure != nullptr || probe.writtenAtImport != 0 || probe.writtenAfterSubmit != 0) { + std::cout << "skipped, the device reports watched host memory written when it imports or reads it\n"; + return false; + } SetImportWatch(base, ImportWatch::Watch); #endif struct Restore { @@ -5241,6 +5246,11 @@ bool completionStoreShadowTests(const Device& device, Recorder& recorder) { } const auto decided = PrepareImportWatch(base); #ifndef _WIN32 + const auto probe = ProbeImportWriteProtection(base); + if (probe.failure != nullptr || probe.writtenAtImport != 0 || probe.writtenAfterSubmit != 0) { + std::cout << "skipped, the device reports watched host memory written when it imports or reads it\n"; + return false; + } SetImportWatch(base, ImportWatch::Watch); #endif struct Restore { From fd459d96f795c8cefd90a035bf9db483fffb8ea6 Mon Sep 17 00:00:00 2001 From: Felipebmaitan Date: Fri, 23 Oct 2026 08:33:11 -0300 Subject: [PATCH 045/113] fix(libSceJobManager): honor worker spin and persistence policies --- core/libs/prx/libSceJobManager/CMakeLists.txt | 13 +- core/libs/prx/libSceJobManager/Export.cpp | 44 ++++- core/libs/tests/GuestJobManager.cpp | 150 +++++++++++++++++- core/libs/tests/JobManagerReference.cpp | 79 +++++++++ docs/dev/ENVIRONMENT.md | 2 + docs/dev/debt/libSceJobManager.md | 6 +- tools/test_job_manager_reference.py | 135 ++++++++++++++++ 7 files changed, 421 insertions(+), 8 deletions(-) create mode 100644 core/libs/tests/JobManagerReference.cpp create mode 100644 tools/test_job_manager_reference.py diff --git a/core/libs/prx/libSceJobManager/CMakeLists.txt b/core/libs/prx/libSceJobManager/CMakeLists.txt index 8539bbd0c2..fd14b28c4c 100644 --- a/core/libs/prx/libSceJobManager/CMakeLists.txt +++ b/core/libs/prx/libSceJobManager/CMakeLists.txt @@ -8,7 +8,18 @@ if(BUILD_TESTING) target_include_directories(guest_job_manager_tests PRIVATE ${LIBS_INCLUDE_DIR}) target_link_libraries(guest_job_manager_tests PRIVATE libSceJobManager libSceAgc libSceAgcDriver libkernel libc) configure_windows_unwind(guest_job_manager_tests) - foreach(testCase IN ITEMS memory validation dispatch ordering nested limits priority shutdown) + if(WIN32) + add_library(job_manager_reference SHARED EXCLUDE_FROM_ALL + ${LIBS_INCLUDE_DIR}/tests/GuestJobManager.cpp + ${LIBS_INCLUDE_DIR}/tests/JobManagerReference.cpp) + target_include_directories(job_manager_reference PRIVATE ${LIBS_INCLUDE_DIR}) + target_compile_definitions(job_manager_reference PRIVATE ANYPS5_JOB_MANAGER_REFERENCE) + target_link_libraries(job_manager_reference PRIVATE libkernel libc) + set_target_properties(job_manager_reference PROPERTIES PREFIX "" SUFFIX .prx + RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/tests) + configure_windows_unwind(job_manager_reference) + endif() + foreach(testCase IN ITEMS memory validation dispatch ordering nested limits node_pool priority shutdown worker_policy worker_wake worker_count) add_test(NAME guest_job_manager_${testCase} COMMAND guest_job_manager_tests ${testCase}) set_tests_properties(guest_job_manager_${testCase} PROPERTIES TIMEOUT 20) if(WIN32) diff --git a/core/libs/prx/libSceJobManager/Export.cpp b/core/libs/prx/libSceJobManager/Export.cpp index 155a95220d..18a578a6c7 100644 --- a/core/libs/prx/libSceJobManager/Export.cpp +++ b/core/libs/prx/libSceJobManager/Export.cpp @@ -6,6 +6,7 @@ #include #include #include +#include #include #include #include @@ -23,6 +24,8 @@ int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSiz int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask); int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name); int APS5_VABI scePthreadJoin(Pthread thread, void** result); +std::uint64_t APS5_VABI sceKernelReadTsc(); +std::uint64_t APS5_VABI sceKernelGetTscFrequency(); int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name); int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq); int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo); @@ -226,6 +229,11 @@ struct Manager { std::uint32_t freeNodes = 0; std::uint32_t freeSequences = 0; std::uint32_t persistentThreads = 0; + std::uint32_t workerCount = 0; + std::uint32_t sleepingWorkers = 0; + std::uint32_t wakeTokens = 0; + std::uint64_t outstandingInvocations = 0; + std::uint64_t spinTicks = 0; std::array, 2> runQueues; std::vector sequences; std::deque computeSequences; @@ -238,6 +246,14 @@ struct Manager { std::vector workers; }; +thread_local Manager* currentWorker = nullptr; + +void WakeWorkers(Manager& manager, std::uint32_t invocations) { + const std::uint32_t available = invocations - (currentWorker == &manager ? 1u : 0u); + manager.wakeTokens += std::min(available, manager.sleepingWorkers - manager.wakeTokens); + if (manager.wakeTokens != 0) manager.work.notify_all(); +} + Manager*& Implementation(void* self) { return *static_cast(self); } @@ -285,7 +301,7 @@ void Sequence::Advance() { ++outstanding; ++cursor; manager->runQueues[priority].push_back(&item); - manager->work.notify_all(); + WakeWorkers(*manager, item.count); continue; } if (item.type == ItemType::Compute || item.type == ItemType::ComputeIndirect) { @@ -320,6 +336,7 @@ void Sequence::Advance() { } void Sequence::DispatchCompleted(std::uint32_t invocations) { + manager->outstandingInvocations -= invocations; completed.invocations += invocations; ++completed.dispatches; --outstanding; @@ -338,6 +355,7 @@ int Sequence::Dispatch(JobEntry entry, void* argument, std::uint32_t count, cons if (before.invocations + count > limits.invocations || before.dispatches >= limits.dispatches) return Latch(SequenceLimitExceeded); if (!TakeNode(*manager)) return Latch(SequenceNoNodes); items.push_back({ItemType::Dispatch, this, entry, argument, count, 0, 0, nullptr}); + manager->outstandingInvocations += count; Advance(); return 0; } @@ -551,11 +569,27 @@ bool RunOne(Manager& manager, std::unique_lock& guard) { void* APS5_VABI WorkerEntry(void* argument) { Manager& manager = *static_cast(argument); + currentWorker = &manager; + std::uint64_t lastWork = sceKernelReadTsc(); std::unique_lock guard(manager.lock); while (manager.running) { - if (RunOne(manager, guard)) continue; - manager.work.wait(guard, [&manager] { return !manager.running || !manager.runQueues[0].empty() || !manager.runQueues[1].empty(); }); + if (RunOne(manager, guard)) { + lastWork = sceKernelReadTsc(); + continue; + } + const bool spinning = manager.outstandingInvocations != 0 && sceKernelReadTsc() - lastWork < manager.spinTicks; + if (spinning || manager.sleepingWorkers >= manager.workerCount - manager.persistentThreads) { + guard.unlock(); + _mm_pause(); + guard.lock(); + continue; + } + ++manager.sleepingWorkers; + manager.work.wait(guard, [&manager] { return !manager.running || manager.wakeTokens != 0; }); + if (manager.wakeTokens != 0) --manager.wakeTokens; + --manager.sleepingWorkers; } + currentWorker = nullptr; return nullptr; } @@ -658,6 +692,8 @@ int Initialize(void* self, void* memory, std::uint64_t size, std::uint32_t worke if (computeSequences != 0 && (handlerPriority < 0x100 || handlerPriority > 0x2ff || handlerAffinity == 0 || handlerAffinity > 0x1fff)) return ManagerInvalidArgument; auto* manager = new Manager; manager->running = true; + manager->workerCount = workers; + manager->spinTicks = sceKernelGetTscFrequency() / 1000000 * settings.spinMicroseconds; manager->freeNodes = nodes - 1; manager->freeSequences = sequences == MaxSequences ? ~std::uint32_t{0} : (std::uint32_t{1} << sequences) - 1; manager->sequences = std::vector(sequences); @@ -781,7 +817,7 @@ ISequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryIn int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void* self, std::uint32_t count) { Manager* manager = Implementation(self); if (manager == nullptr) return ManagerNotInitialized; - if (count > manager->workers.size()) return ManagerInvalidArgument; + if (count > manager->workerCount) return ManagerInvalidArgument; const std::lock_guard guard(manager->lock); manager->persistentThreads = count; return 0; diff --git a/core/libs/tests/GuestJobManager.cpp b/core/libs/tests/GuestJobManager.cpp index 7258ae6694..9616edabf4 100644 --- a/core/libs/tests/GuestJobManager.cpp +++ b/core/libs/tests/GuestJobManager.cpp @@ -1,4 +1,5 @@ #include "SceTypes.hpp" +#include #include #include #include @@ -54,6 +55,9 @@ struct SequenceFactory { }; extern "C" { +Pthread APS5_VABI scePthreadSelf(); +int APS5_VABI pthread_getcpuclockid_nid_postfix(Pthread thread, int* clockId); +int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* time); void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void*); void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void*); std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams*); @@ -348,6 +352,15 @@ static void LimitsCase() { Require(factory->Create(&sequence, 4, 2, 1, 1, "waits") == 0); Require(sequence->Wait() == 0 && sequence->Wait() == 0); Require(factory->Destroy(sequence) == 0); + Require(Shutdown(manager.storage) == 0); +} + +static void NodePoolCase() { + Block block(SizeFor(2, 2, 2, 1, 1)); + ManagerObject manager; + Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, nullptr) == 0); + SequenceFactory* factory = Factories(manager.storage, 0); + Sequence* sequence = nullptr; Require(factory->Create(&sequence, 0x7fff, 0x3ff, 0xff, 1, "nodes") == 0); int result = 0; int accepted = 0; @@ -453,16 +466,149 @@ static void ShutdownCase() { } } -int main(int argc, char** argv) { - const std::string name = argc > 1 ? argv[1] : ""; +static void APS5_VABI CaptureWorkerClock(void* argument, std::uint32_t) { + Require(pthread_getcpuclockid_nid_postfix(scePthreadSelf(), static_cast(argument)) == 0); +} + +static std::int64_t CpuNanos(int clock) { + KernelTimespec time{}; + Require(sceKernelClockGettime(clock, &time) == 0); + return time.tv_sec * 1000000000LL + time.tv_nsec; +} + +static void RequireParked(int clock) { + std::this_thread::sleep_for(std::chrono::milliseconds(30)); + const auto start = CpuNanos(clock); + std::this_thread::sleep_for(std::chrono::milliseconds(80)); + Require(CpuNanos(clock) - start < 20000000); +} + +static void WorkerPolicyCase() { + for (const std::uint32_t mode : {0x10000u, 0x20000u}) { + for (const std::uint32_t spin : {0u, 50u}) { + Block block(SizeFor(1, 1, 8, 2, 2)); + ManagerObject manager; + const ConfigParams config{0, mode | 0x1fff, 0x10000, 0x2bc, "WorkerPolicy", spin, 0, 0, 0}; + Require(Initialize(manager.storage, block.memory, block.bytes, 1, 1, &config) == 0); + auto* factory = Factories(manager.storage, 0); + Sequence* sequence = nullptr; + Require(factory->Create(&sequence, 8, 8, 2, 2, "worker policy") == 0); + int clock = 0; + Require(sequence->Dispatch(CaptureWorkerClock, &clock, 1, nullptr) == 0 && sequence->Wait() == 0); + RequireParked(clock); + for (int round = 0; round < 2; ++round) { + Require(SetPersistentThreadCount(manager.storage, 1) == 0); + RequireParked(clock); + Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && sequence->Wait() == 0); + const auto start = CpuNanos(clock); + const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2); + while (CpuNanos(clock) - start < 30000000 && std::chrono::steady_clock::now() < deadline) { + std::this_thread::sleep_for(std::chrono::milliseconds(10)); + } + Require(CpuNanos(clock) - start >= 30000000); + Require(SetPersistentThreadCount(manager.storage, 0) == 0); + RequireParked(clock); + } + Require(SetPersistentThreadCount(manager.storage, 1) == 0); + Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && sequence->Wait() == 0); + Require(Shutdown(manager.storage) == 0); + } + } +} + +static void WorkerWakeCase() { + Block block(SizeFor(4, 1, 8, 2, 2)); + ManagerObject manager; + for (const std::uint32_t mode : {0x10000u, 0x20000u}) { + const ConfigParams config{0, mode | 0x1fff, 0x10000, 0x2bc, "WorkerWake", 50, 0, 0, 0}; + Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, &config) == 0); + Sequence* sequence = nullptr; + auto* factory = Factories(manager.storage, 0); + Require(factory->Create(&sequence, 1024, 8, 2, 2, "worker wake") == 0); + for (std::uint32_t round = 0; round < 60; ++round) { + Require(SetPersistentThreadCount(manager.storage, round % 5) == 0); + Tally tally(257); + Require(sequence->Dispatch(CountJob, &tally, 257, nullptr) == 0); + Require(sequence->SyncPoint() == 0); + Require(sequence->Dispatch(CountJob, &tally, 257, nullptr) == 0); + Require(sequence->Wait() == 0 && tally.calls == 514); + for (const auto& count : tally.seen) Require(count == 2); + } + Require(factory->Destroy(sequence) == 0); + Require(Shutdown(manager.storage) == 0); + } +} + +struct WorkerClocks { + std::array clocks{}; + std::atomic arrived{0}; + std::atomic release{false}; +}; + +static void APS5_VABI CaptureWorkerClocks(void* argument, std::uint32_t index) { + auto& workers = *static_cast(argument); + CaptureWorkerClock(&workers.clocks[index], 0); + ++workers.arrived; + while (!workers.release) std::this_thread::yield(); +} + +static void WorkerCountCase() { + Block block(SizeFor(4, 1, 8, 2, 2)); + ManagerObject manager; + const ConfigParams config{0, 0x1000f, 0x10000, 0x2bc, "WorkerCount", 0, 0, 0, 0}; + Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, &config) == 0); + Sequence* sequence = nullptr; + Require(Factories(manager.storage, 0)->Create(&sequence, 8, 8, 2, 2, "worker count") == 0); + WorkerClocks workers; + Require(sequence->Dispatch(CaptureWorkerClocks, &workers, 4, nullptr) == 0); + const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2); + while (workers.arrived != 4 && std::chrono::steady_clock::now() < deadline) std::this_thread::yield(); + Require(workers.arrived == 4); + workers.release = true; + Require(sequence->Wait() == 0); + for (const std::uint32_t persistent : {2u, 4u}) { + Require(SetPersistentThreadCount(manager.storage, 0) == 0); + for (const int clock : workers.clocks) RequireParked(clock); + Require(SetPersistentThreadCount(manager.storage, persistent) == 0); + for (std::uint32_t job = 0; job < persistent; ++job) { + Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && sequence->Wait() == 0); + } + std::array starts{}; + for (std::size_t index = 0; index < starts.size(); ++index) starts[index] = CpuNanos(workers.clocks[index]); + const auto until = std::chrono::steady_clock::now() + std::chrono::seconds(2); + unsigned int active = 0; + do { + std::this_thread::sleep_for(std::chrono::milliseconds(20)); + active = 0; + for (std::size_t index = 0; index < starts.size(); ++index) { + if (CpuNanos(workers.clocks[index]) - starts[index] >= 30000000) ++active; + } + } while (active < persistent && std::chrono::steady_clock::now() < until); + Require(active == persistent); + } + Require(Shutdown(manager.storage) == 0); +} + +int RunJobManagerCase(const char* caseName) { + const std::string name = caseName; if (name == "memory") MemoryCase(); else if (name == "validation") ValidationCase(); else if (name == "dispatch") DispatchCase(); else if (name == "ordering") OrderingCase(); else if (name == "limits") LimitsCase(); + else if (name == "node_pool") NodePoolCase(); else if (name == "nested") NestedCase(); else if (name == "priority") PriorityCase(); else if (name == "shutdown") ShutdownCase(); + else if (name == "worker_policy") WorkerPolicyCase(); + else if (name == "worker_wake") WorkerWakeCase(); + else if (name == "worker_count") WorkerCountCase(); else return 2; return 0; } + +#ifndef ANYPS5_JOB_MANAGER_REFERENCE +int main(int argc, char** argv) { + return RunJobManagerCase(argc > 1 ? argv[1] : ""); +} +#endif diff --git a/core/libs/tests/JobManagerReference.cpp b/core/libs/tests/JobManagerReference.cpp new file mode 100644 index 0000000000..b808c60f2f --- /dev/null +++ b/core/libs/tests/JobManagerReference.cpp @@ -0,0 +1,79 @@ +#include "SceTypes.hpp" +#include +#include +#include +#include + +struct MemorySizeQueryParams; +struct ConfigParams; +struct SequenceFactory; + +int RunJobManagerCase(const char* name); + +template +static T Resolve(const char* nid) { + const bool host = std::getenv("ANYPS5_JOB_MANAGER_HOST") != nullptr; + const char* library = host ? "libSceJobManager.prx" : "libSceJobManager.prx.guest.prx"; + HMODULE module = GetModuleHandleA(library); + if (module == nullptr && host) module = LoadLibraryA("libs\\libSceJobManager.prx"); + const FARPROC symbol = module != nullptr ? GetProcAddress(module, nid) : nullptr; + if (symbol == nullptr) { + std::fprintf(stderr, "JobManager reference: missing %s in %s (Windows error %lu)\n", nid, library, GetLastError()); + std::exit(3); + } + return reinterpret_cast(symbol); +} + +extern "C" { + +void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void* self) { + static const auto call = Resolve("cwMzzdesLlY"); + call(self); +} + +void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void* self) { + static const auto call = Resolve("4g1ee34TMH8"); + call(self); +} + +std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams* query) { + static const auto call = Resolve("Nm2BhAwYNFk"); + return call(query); +} + +int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeSequences, std::uint64_t mask, const ConfigParams* config) { + static const auto call = Resolve("GS9DSbzC+MY"); + return call(self, memory, size, workers, sequences, computeSequences, mask, config); +} + +int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, const ConfigParams* config) { + static const auto call = Resolve("d205iUFMyyE"); + return call(self, memory, size, workers, sequences, config); +} + +int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void* self) { + static const auto call = Resolve("chxnvsxxfBY"); + return call(self); +} + +SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority) { + static const auto call = Resolve("W-yXgQmaozU"); + return call(self, priority); +} + +SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority) { + static const auto call = Resolve("L5jTAtk3HKA"); + return call(self, priority); +} + +int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void* self, std::uint32_t count) { + static const auto call = Resolve("VTKezfYu-v4"); + return call(self, count); +} + +int APS5_VABI Run_nid_no_patch() { + const char* name = std::getenv("ANYPS5_JOB_MANAGER_CASE"); + return name != nullptr ? RunJobManagerCase(name) : 2; +} + +} diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md index ac824ed4c4..4b03f49404 100644 --- a/docs/dev/ENVIRONMENT.md +++ b/docs/dev/ENVIRONMENT.md @@ -6,6 +6,8 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti | Name | Kind | Source | Default | Description | |------|------|--------|---------|-------------| +| `ANYPS5_JOB_MANAGER_CASE` | string | `core/libs/tests/JobManagerReference.cpp` | | selects the CPU fixture run by `tools/test_job_manager_reference.py` | +| `ANYPS5_JOB_MANAGER_HOST` | presence | `core/libs/tests/JobManagerReference.cpp` | | runs the reference adapter against the host fallback instead of the loaded guest module | | `ANYPS5_LOADEXEC_PARENT` | string | `core/libs/tests/GuestLoadExecHost.cpp` | | variable the Windows entry stub reads; its wide name is built in `core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp` | | `ANYPS5_LOADEXEC_TEST_ROOT` | string | `core/libs/tests/GuestLoadExecHost.cpp` | | directory the load-exec host test reads its guest executable from | | `ANYPS5_TEST_QUOTED_ARGV0` | presence | `core/libs/tests/GuestLoadExecHost.cpp` | | makes the load-exec test's first argument one with quotes, a backslash and non-ASCII text | diff --git a/docs/dev/debt/libSceJobManager.md b/docs/dev/debt/libSceJobManager.md index 123977e935..b3286ee6dc 100644 --- a/docs/dev/debt/libSceJobManager.md +++ b/docs/dev/debt/libSceJobManager.md @@ -2,4 +2,8 @@ ### Functional -- [sce::Job::JobManager](../../../core/libs/prx/libSceJobManager/Export.cpp) (libSceJobManager) is written from the disassembly of the copies PPSA01474 and PPSA36082 ship in `sce_module`, and `guest_job_manager_tests` passes against both of those modules as well: the memory size formula, the error codes, sync point ordering, the per-sequence limits and the priority order are the original's. Compute sequences submit through `sceAgcDriverSubmitAcb` on the queue their mask bit selects and are checked the same way by `agc_driver_job_manager_compute_tests`: results, ordering against CPU dispatches and sync points, limits and sizes match the two modules. The command stream is simpler than the original's: every compute dispatch is submitted with its own label write and interrupt, where the original batches the label write and rewinds commands it encoded ahead, and the command buffers and labels live on the host heap. The per-queue command size in `calculateRequiredMemorySize` is a constant (104, 148 and 32 bytes per dispatch, sync point and wait), which is what the original measures by running the builders of this project's libSceAgc. A compute dispatch on a CPU sequence throws (the original does not check), and a failing `sceAgcDriverAddEqEvent` throws. `shutdown` throws while a compute sequence has work in flight, a sequence's label total is written as 32 bits, and since the label is host memory no GPU import covers, the driver drains recorded work before each label write. The manager's state lives on the host heap, with only the block header written to the title's memory; the original keeps everything in that block, and a block smaller than 0x2d8 bytes throws here. The worker sleep policy, the spin count and the persistent thread count are validated and stored but change nothing, a factory priority above 1 throws, `shutdown` throws while a thread is blocked in a sequence wait, and using a sequence after its `destroy` throws. `initialize` returns 0 where the original returns the result of its last import (`BG26hBGiNlw`, not resolved to a name), the `sceRazorCpuJobManager*` profiler calls are not made, and a worker thread that cannot be created or configured throws where the original does not check. The order of the sequence and factory virtual functions is read from the modules' vtables only, since no title that calls them has been run +- [sce::Job::JobManager](../../../core/libs/prx/libSceJobManager/Export.cpp) submits every compute dispatch with its own label write and interrupt, while the original batches label writes and rewinds commands encoded ahead. Command buffers and labels live on the host heap; labels outside a GPU import force the driver to drain recorded work before each write. Completion labels are written as 32 bits; wrap behavior is unverified. The per-queue command-size formula uses fixed builder sizes of 104, 148 and 32 bytes per dispatch, sync point and wait. +- The [manager](../../../core/libs/prx/libSceJobManager/Export.cpp) keeps its state on the host heap rather than in the caller's block, apart from the block header. Blocks smaller than 0x2d8 bytes throw. Worker parking uses a host condition variable and mutex rather than the original semaphore and atomic queues; console scheduling and spin timing have not been measured. +- [Sequence and manager operations](../../../core/libs/prx/libSceJobManager/Export.cpp) throw on a compute dispatch on a CPU sequence, a failing `sceAgcDriverAddEqEvent`, a factory priority above 1, and use of a destroyed sequence. `shutdown` throws while compute work is in flight or a caller is blocked in a sequence wait. Worker creation and attribute failures throw where the original does not check. +- [`initialize`](../../../core/libs/prx/libSceJobManager/Export.cpp) returns 0 instead of the result of the original's final import (`BG26hBGiNlw`, unresolved). The `sceRazorCpuJobManager*` profiler calls are not made. Sequence and factory virtual-function order is recovered from module vtables; no calling title has been run. +- The [fallback](../../../core/libs/prx/libSceJobManager/Export.cpp) and Windows [reference runner](../../../tools/test_job_manager_reference.py) disagree: the runner times out in the node-pool exhaustion fixture against the PPSA06888 module with the host kernel; the fallback returns `SequenceInvalid` and recycles its nodes. The cause remains unverified. Original-module execution on Linux and console timing equivalence are not covered by this runner. diff --git a/tools/test_job_manager_reference.py b/tools/test_job_manager_reference.py new file mode 100644 index 0000000000..d766bd51bc --- /dev/null +++ b/tools/test_job_manager_reference.py @@ -0,0 +1,135 @@ +import argparse +import hashlib +import json +import os +import shutil +import subprocess +import sys +import tempfile +from pathlib import Path + +from import_audit import read_host_imports +from unwrap_self import unwrap + +ROOT = Path(__file__).resolve().parent.parent +sys.path.insert(0, str(ROOT / "core/relinker/relinker/tests")) +from guest_import_fixtures import executable + +CASES = ("memory", "validation", "dispatch", "ordering", "nested", "limits", "node_pool", "priority", "shutdown", "worker_policy", "worker_wake", "worker_count") + + +def stage_libraries(directory, build, toolchain, dependencies): + providers = {path.name.lower(): path for path in (build / "core/libs/libs").glob("*.prx")} + providers.update({path.name.lower(): path for path in toolchain.glob("*.dll")}) + pending = list(dependencies) + staged = set() + while pending: + name = pending.pop().lower() + if name in staged: + continue + staged.add(name) + source = providers.get(name) + if source is None: + if name.endswith(".prx"): + raise RuntimeError(f"Missing patched runtime {name}; build core/libs/libs/{name}") + continue + shutil.copy2(source, directory / source.name) + pending.extend(read_host_imports(source)) + + +def run(args, directory): + libraries = directory / "libs" + libraries.mkdir() + helper = args.build / "tests/job_manager_reference.prx" + if not helper.is_file(): + raise RuntimeError("Build the job_manager_reference target first") + shutil.copy2(helper, libraries / "jobref.prx") + subprocess.run([str(args.build / "core/libs/nid_patcher.exe"), "jobref", "--preserve-export-list", + str(args.build / "core/libs/libc.exports"), str(libraries / "jobref.prx")], check=True, capture_output=True) + module_hash = None + if args.module: + module_data = args.module.read_bytes() + module_hash = hashlib.sha256(module_data).hexdigest() + modules = directory / "sce_module" + modules.mkdir() + target = modules / "libSceJobManager.prx" + if module_data[:4] == b"\x7fELF": + shutil.copy2(args.module, target) + else: + unwrap(args.module, target) + source = directory / "input.elf" + source.write_bytes(executable("jobref.prx", symbol="Run_nid_no_patch")) + output = directory / "reference.exe" + options = ["--skip-sce-module"] if args.host else [] + result = subprocess.run([str(args.relinker), "--windows", "--registry", *options, str(source), str(output)], + cwd=directory, capture_output=True, timeout=60) + (directory / "relink.log").write_bytes(result.stdout + result.stderr) + if result.returncode: + raise RuntimeError(f"Relinker failed ({result.returncode}); see {directory / 'relink.log'}") + dependencies = set(read_host_imports(helper)) | {"libc.prx"} + for registry in directory.glob("*.registry.json"): + dependencies.update(entry["library"] for entry in json.loads(registry.read_text()) + if entry.get("library") not in ("jobref.prx", "libSceJobManager.prx")) + if args.host: + dependencies.add("libSceJobManager.prx") + stage_libraries(libraries, args.build, args.toolchain, dependencies) + environment = os.environ.copy() + environment["PATH"] = str(libraries) + os.pathsep + environment.get("PATH", "") + environment.pop("ANYPS5_JOB_MANAGER_HOST", None) + if args.host: + environment["ANYPS5_JOB_MANAGER_HOST"] = "1" + results = [] + for case in args.cases: + environment["ANYPS5_JOB_MANAGER_CASE"] = case + try: + result = subprocess.run([str(output)], cwd=directory, env=environment, + capture_output=True, timeout=args.timeout) + log = result.stdout + result.stderr + status = "passed" if result.returncode == 0 else "failed" + code = result.returncode + except subprocess.TimeoutExpired as error: + log = (error.stdout or b"") + (error.stderr or b"") + status, code = "timeout", None + (directory / f"{case}.log").write_bytes(log) + results.append({"case": case, "status": status, "returncode": code}) + print(json.dumps(results[-1]), flush=True) + summary = {"provider": "host" if args.host else "guest", "module_sha256": module_hash, "cases": results} + (directory / "results.json").write_text(json.dumps(summary, indent=2) + "\n") + return 0 if all(result["status"] == "passed" for result in results) else 1 + + +def main(): + parser = argparse.ArgumentParser(description="Run the CPU JobManager fixtures through Windows relinker startup using an owned module or the host fallback.") + provider = parser.add_mutually_exclusive_group(required=True) + provider.add_argument("--module", type=Path, help="Owned decrypted SELF or ELF libSceJobManager.prx") + provider.add_argument("--host", action="store_true", help="Validate the runner against the built host fallback") + parser.add_argument("--build", type=Path, required=True) + parser.add_argument("--relinker", type=Path, required=True) + parser.add_argument("--toolchain", type=Path, required=True, help="Directory containing the matching compiler runtime DLLs") + parser.add_argument("--output", type=Path, help="New directory for staged modules, per-case logs and results.json; defaults to a temporary directory") + parser.add_argument("--cases", nargs="+", choices=CASES, default=list(CASES)) + parser.add_argument("--timeout", type=float, default=20) + args = parser.parse_args() + if sys.platform != "win32": + parser.error("The reference adapter currently supports Windows only") + if args.timeout <= 0 or args.timeout > 30: + parser.error("--timeout must be greater than zero and at most 30 seconds") + try: + for name in ("build", "relinker", "toolchain", "module"): + value = getattr(args, name) + if value is not None: + setattr(args, name, value.resolve(strict=True)) + directory = args.output.resolve() if args.output else Path(tempfile.mkdtemp(prefix="anyps5-jobmanager-")) + if args.output: + directory.mkdir(parents=True, exist_ok=False) + print(f"Artifacts: {directory}", flush=True) + return run(args, directory) + except (OSError, RuntimeError, subprocess.SubprocessError) as error: + print(str(error), file=sys.stderr) + if isinstance(error, subprocess.CalledProcessError) and error.stderr: + print(error.stderr.decode(errors="replace"), file=sys.stderr) + return 2 + + +if __name__ == "__main__": + raise SystemExit(main()) From 14c582fb7555547b08f5a1bdb1a661cffcb162ed Mon Sep 17 00:00:00 2001 From: Felipebmaitan Date: Fri, 23 Oct 2026 09:18:17 -0300 Subject: [PATCH 046/113] fix(tests): distinguish the manual JobManager reference runner --- docs/dev/ENVIRONMENT.md | 2 +- docs/dev/debt/libSceJobManager.md | 2 +- ...st_job_manager_reference.py => run_job_manager_reference.py} | 0 3 files changed, 2 insertions(+), 2 deletions(-) rename tools/{test_job_manager_reference.py => run_job_manager_reference.py} (100%) diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md index 4b03f49404..585edc1a90 100644 --- a/docs/dev/ENVIRONMENT.md +++ b/docs/dev/ENVIRONMENT.md @@ -6,7 +6,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti | Name | Kind | Source | Default | Description | |------|------|--------|---------|-------------| -| `ANYPS5_JOB_MANAGER_CASE` | string | `core/libs/tests/JobManagerReference.cpp` | | selects the CPU fixture run by `tools/test_job_manager_reference.py` | +| `ANYPS5_JOB_MANAGER_CASE` | string | `core/libs/tests/JobManagerReference.cpp` | | selects the CPU fixture run by `tools/run_job_manager_reference.py` | | `ANYPS5_JOB_MANAGER_HOST` | presence | `core/libs/tests/JobManagerReference.cpp` | | runs the reference adapter against the host fallback instead of the loaded guest module | | `ANYPS5_LOADEXEC_PARENT` | string | `core/libs/tests/GuestLoadExecHost.cpp` | | variable the Windows entry stub reads; its wide name is built in `core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp` | | `ANYPS5_LOADEXEC_TEST_ROOT` | string | `core/libs/tests/GuestLoadExecHost.cpp` | | directory the load-exec host test reads its guest executable from | diff --git a/docs/dev/debt/libSceJobManager.md b/docs/dev/debt/libSceJobManager.md index b3286ee6dc..ab9dfe3e1b 100644 --- a/docs/dev/debt/libSceJobManager.md +++ b/docs/dev/debt/libSceJobManager.md @@ -6,4 +6,4 @@ - The [manager](../../../core/libs/prx/libSceJobManager/Export.cpp) keeps its state on the host heap rather than in the caller's block, apart from the block header. Blocks smaller than 0x2d8 bytes throw. Worker parking uses a host condition variable and mutex rather than the original semaphore and atomic queues; console scheduling and spin timing have not been measured. - [Sequence and manager operations](../../../core/libs/prx/libSceJobManager/Export.cpp) throw on a compute dispatch on a CPU sequence, a failing `sceAgcDriverAddEqEvent`, a factory priority above 1, and use of a destroyed sequence. `shutdown` throws while compute work is in flight or a caller is blocked in a sequence wait. Worker creation and attribute failures throw where the original does not check. - [`initialize`](../../../core/libs/prx/libSceJobManager/Export.cpp) returns 0 instead of the result of the original's final import (`BG26hBGiNlw`, unresolved). The `sceRazorCpuJobManager*` profiler calls are not made. Sequence and factory virtual-function order is recovered from module vtables; no calling title has been run. -- The [fallback](../../../core/libs/prx/libSceJobManager/Export.cpp) and Windows [reference runner](../../../tools/test_job_manager_reference.py) disagree: the runner times out in the node-pool exhaustion fixture against the PPSA06888 module with the host kernel; the fallback returns `SequenceInvalid` and recycles its nodes. The cause remains unverified. Original-module execution on Linux and console timing equivalence are not covered by this runner. +- The [fallback](../../../core/libs/prx/libSceJobManager/Export.cpp) and Windows [reference runner](../../../tools/run_job_manager_reference.py) disagree: the runner times out in the node-pool exhaustion fixture against the PPSA06888 module with the host kernel; the fallback returns `SequenceInvalid` and recycles its nodes. The cause remains unverified. Original-module execution on Linux and console timing equivalence are not covered by this runner. diff --git a/tools/test_job_manager_reference.py b/tools/run_job_manager_reference.py similarity index 100% rename from tools/test_job_manager_reference.py rename to tools/run_job_manager_reference.py From fc8f03594d088d50b68c2386a39b9756c9691f11 Mon Sep 17 00:00:00 2001 From: Felipebmaitan Date: Fri, 23 Oct 2026 10:27:59 -0300 Subject: [PATCH 047/113] fix(job-manager): spin only for pending work in host clock time --- core/libs/prx/libSceJobManager/CMakeLists.txt | 11 +- core/libs/prx/libSceJobManager/Export.cpp | 13 +- core/libs/tests/GuestJobManager.cpp | 111 ++++++++++++++++++ docs/dev/ENVIRONMENT.md | 2 +- docs/dev/debt/libSceJobManager.md | 6 +- tools/run_job_manager_reference.py | 2 +- 6 files changed, 132 insertions(+), 13 deletions(-) diff --git a/core/libs/prx/libSceJobManager/CMakeLists.txt b/core/libs/prx/libSceJobManager/CMakeLists.txt index fd14b28c4c..002ba69513 100644 --- a/core/libs/prx/libSceJobManager/CMakeLists.txt +++ b/core/libs/prx/libSceJobManager/CMakeLists.txt @@ -19,7 +19,7 @@ if(BUILD_TESTING) RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/tests) configure_windows_unwind(job_manager_reference) endif() - foreach(testCase IN ITEMS memory validation dispatch ordering nested limits node_pool priority shutdown worker_policy worker_wake worker_count) + foreach(testCase IN ITEMS memory validation dispatch ordering nested limits node_pool priority shutdown worker_policy worker_wake worker_count worker_spin) add_test(NAME guest_job_manager_${testCase} COMMAND guest_job_manager_tests ${testCase}) set_tests_properties(guest_job_manager_${testCase} PROPERTIES TIMEOUT 20) if(WIN32) @@ -27,4 +27,13 @@ if(BUILD_TESTING) "PATH=path_list_prepend:$") endif() endforeach() + set_tests_properties(guest_job_manager_worker_spin PROPERTIES ENVIRONMENT "APS5_TIME_SCALE=1") + foreach(scale IN ITEMS 0.1 10) + add_test(NAME guest_job_manager_worker_spin_scale_${scale} COMMAND guest_job_manager_tests worker_spin) + set_tests_properties(guest_job_manager_worker_spin_scale_${scale} PROPERTIES TIMEOUT 20 ENVIRONMENT "APS5_TIME_SCALE=${scale}") + if(WIN32) + set_tests_properties(guest_job_manager_worker_spin_scale_${scale} PROPERTIES ENVIRONMENT_MODIFICATION + "PATH=path_list_prepend:$") + endif() + endforeach() endif() diff --git a/core/libs/prx/libSceJobManager/Export.cpp b/core/libs/prx/libSceJobManager/Export.cpp index 18a578a6c7..4e3f1395b3 100644 --- a/core/libs/prx/libSceJobManager/Export.cpp +++ b/core/libs/prx/libSceJobManager/Export.cpp @@ -24,7 +24,6 @@ int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSiz int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask); int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name); int APS5_VABI scePthreadJoin(Pthread thread, void** result); -std::uint64_t APS5_VABI sceKernelReadTsc(); std::uint64_t APS5_VABI sceKernelGetTscFrequency(); int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name); int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq); @@ -232,7 +231,7 @@ struct Manager { std::uint32_t workerCount = 0; std::uint32_t sleepingWorkers = 0; std::uint32_t wakeTokens = 0; - std::uint64_t outstandingInvocations = 0; + std::uint64_t pendingInvocations = 0; std::uint64_t spinTicks = 0; std::array, 2> runQueues; std::vector sequences; @@ -301,6 +300,7 @@ void Sequence::Advance() { ++outstanding; ++cursor; manager->runQueues[priority].push_back(&item); + manager->pendingInvocations -= item.count; WakeWorkers(*manager, item.count); continue; } @@ -336,7 +336,6 @@ void Sequence::Advance() { } void Sequence::DispatchCompleted(std::uint32_t invocations) { - manager->outstandingInvocations -= invocations; completed.invocations += invocations; ++completed.dispatches; --outstanding; @@ -355,7 +354,7 @@ int Sequence::Dispatch(JobEntry entry, void* argument, std::uint32_t count, cons if (before.invocations + count > limits.invocations || before.dispatches >= limits.dispatches) return Latch(SequenceLimitExceeded); if (!TakeNode(*manager)) return Latch(SequenceNoNodes); items.push_back({ItemType::Dispatch, this, entry, argument, count, 0, 0, nullptr}); - manager->outstandingInvocations += count; + manager->pendingInvocations += count; Advance(); return 0; } @@ -570,14 +569,14 @@ bool RunOne(Manager& manager, std::unique_lock& guard) { void* APS5_VABI WorkerEntry(void* argument) { Manager& manager = *static_cast(argument); currentWorker = &manager; - std::uint64_t lastWork = sceKernelReadTsc(); + std::uint64_t lastWork = __rdtsc(); std::unique_lock guard(manager.lock); while (manager.running) { if (RunOne(manager, guard)) { - lastWork = sceKernelReadTsc(); + lastWork = __rdtsc(); continue; } - const bool spinning = manager.outstandingInvocations != 0 && sceKernelReadTsc() - lastWork < manager.spinTicks; + const bool spinning = manager.pendingInvocations != 0 && __rdtsc() - lastWork < manager.spinTicks; if (spinning || manager.sleepingWorkers >= manager.workerCount - manager.persistentThreads) { guard.unlock(); _mm_pause(); diff --git a/core/libs/tests/GuestJobManager.cpp b/core/libs/tests/GuestJobManager.cpp index 9616edabf4..3d3644a538 100644 --- a/core/libs/tests/GuestJobManager.cpp +++ b/core/libs/tests/GuestJobManager.cpp @@ -10,6 +10,9 @@ #include #include #include +#ifdef _WIN32 +#include +#endif struct MemorySizeQueryParams { std::uint32_t version; @@ -58,6 +61,7 @@ extern "C" { Pthread APS5_VABI scePthreadSelf(); int APS5_VABI pthread_getcpuclockid_nid_postfix(Pthread thread, int* clockId); int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* time); +int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds); void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void*); void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void*); std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams*); @@ -539,6 +543,112 @@ static void WorkerWakeCase() { } } +struct HeldWorker { + std::atomic started{false}; + std::atomic release{false}; +}; + +struct SpinClock { + int guest = 0; + std::int64_t reference = 0; +#ifdef _WIN32 + HANDLE thread = nullptr; + ~SpinClock() { if (thread != nullptr) CloseHandle(thread); } +#endif +}; + +static std::int64_t SpinCpuUnits(const SpinClock& clock); + +static void APS5_VABI CaptureSpinClock(void* argument, std::uint32_t) { + auto& clock = *static_cast(argument); + CaptureWorkerClock(&clock.guest, 0); +#ifdef _WIN32 + clock.thread = OpenThread(THREAD_QUERY_LIMITED_INFORMATION, FALSE, GetCurrentThreadId()); + Require(clock.thread != nullptr); +#endif + const auto before = SpinCpuUnits(clock); + const auto until = std::chrono::steady_clock::now() + std::chrono::milliseconds(5); + while (std::chrono::steady_clock::now() < until) {} + clock.reference = SpinCpuUnits(clock) - before; + Require(clock.reference > 0); +} + +static std::int64_t SpinCpuUnits(const SpinClock& clock) { +#ifdef _WIN32 + ULONG64 cycles = 0; + Require(QueryThreadCycleTime(clock.thread, &cycles)); + return static_cast(cycles); +#else + return CpuNanos(clock.guest); +#endif +} + +static void APS5_VABI HoldWorker(void* argument, std::uint32_t) { + auto& worker = *static_cast(argument); + worker.started = true; + worker.started.notify_one(); + worker.release.wait(false); +} + +struct SpinSample { + std::int64_t consumed; + std::int64_t reference; +}; + +static SpinSample MeasureWorkerSpin(std::uint32_t spin, std::uint32_t rounds, bool pending) { + Block block(SizeFor(2, 2, 4, 2, 2)); + ManagerObject manager; + const ConfigParams config{0, 0x10003, 0x10000, 0x2bc, "WorkerSpin", spin, 0, 0, 0}; + Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, &config) == 0); + auto* factory = Factories(manager.storage, 0); + Sequence* held = nullptr; + Sequence* pulse = nullptr; + Require(factory->Create(&held, 4, 4, 2, 2, "held worker") == 0); + Require(factory->Create(&pulse, 4, 4, 2, 2, "idle worker") == 0); + HeldWorker worker; + Require(held->Dispatch(HoldWorker, &worker, 1, nullptr) == 0); + worker.started.wait(false); + if (pending) { + Require(held->SyncPoint() == 0); + Require(held->Dispatch(Nothing, nullptr, 1, nullptr) == 0); + } + SpinClock clock; + Require(pulse->Dispatch(CaptureSpinClock, &clock, 1, nullptr) == 0 && pulse->Wait() == 0); + RequireParked(clock.guest); + const auto before = SpinCpuUnits(clock); + for (std::uint32_t round = 0; round < rounds; ++round) { + Require(pulse->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && pulse->Wait() == 0); + Require(sceKernelUsleep_nid_postfix(1000) == 0); + } + const auto consumed = SpinCpuUnits(clock) - before; + RequireParked(clock.guest); + Require(!worker.release); + worker.release = true; + worker.release.notify_one(); + Require(held->Wait() == 0); + Require(factory->Destroy(held) == 0 && factory->Destroy(pulse) == 0); + Require(Shutdown(manager.storage) == 0); + return {consumed, clock.reference}; +} + +static void WorkerSpinCase() { + constexpr std::uint32_t rounds = 512; + const auto parked = MeasureWorkerSpin(0, rounds, true); + const auto spinning = MeasureWorkerSpin(50, rounds, true); + const auto noPending = MeasureWorkerSpin(50, rounds, false); +#ifdef _WIN32 + constexpr const char* units = "cycles"; +#else + constexpr const char* units = "ns"; +#endif + std::fprintf(stderr, "idle worker CPU over %u pulses (%s): spin=0 %lld, spin=50 %lld, no pending work %lld, 5ms active reference %lld\n", rounds, units, + static_cast(parked.consumed), static_cast(spinning.consumed), static_cast(noPending.consumed), static_cast(spinning.reference)); + const auto interval = spinning.reference * rounds / 100; + Require(spinning.consumed > parked.consumed + interval / 3); + Require(spinning.consumed < parked.consumed + interval * 5); + Require(noPending.consumed < parked.consumed + interval / 3); +} + struct WorkerClocks { std::array clocks{}; std::atomic arrived{0}; @@ -602,6 +712,7 @@ int RunJobManagerCase(const char* caseName) { else if (name == "shutdown") ShutdownCase(); else if (name == "worker_policy") WorkerPolicyCase(); else if (name == "worker_wake") WorkerWakeCase(); + else if (name == "worker_spin") WorkerSpinCase(); else if (name == "worker_count") WorkerCountCase(); else return 2; return 0; diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md index 585edc1a90..f9b8466115 100644 --- a/docs/dev/ENVIRONMENT.md +++ b/docs/dev/ENVIRONMENT.md @@ -569,7 +569,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti | `APS5_NO_JOB_AFFINITY` | presence | `core/libs/prx/libkernel/Pthread/src/Thread.cpp` | | disables pinning of job worker threads | | `APS5_NO_SLEEP_WAKE` | presence | `core/libs/prx/libkernel/Time/SleepWake.cpp` | | keeps every sleep of 1 ms or less in full instead of ending it at a GPU batch, batch completion action or flip completion | | `APS5_NO_TIMER_RESOLUTION` | presence | `core/libs/prx/libkernel/Time/Time.cpp` | | keeps the default 15.6 ms scheduler tick instead of raising it to 0.5 ms on Windows | -| `APS5_TIME_SCALE` | integer | `core/libs/prx/libkernel/Time/Time.cpp` | 1 | factor applied to the guest monotonic clocks and TSC; sleeps still take real time | +| `APS5_TIME_SCALE` | integer | `core/libs/prx/libkernel/Time/Time.cpp` | 1 | factor applied to the guest monotonic clocks and TSC; sleeps and host JobManager worker spin intervals still take real time | | `APS5_TRACE_APR` | presence | `core/libs/prx/libkernel/Apr/src/Apr.cpp` | | logs every APR file read with its path, offset, size and destination | | `APS5_TRACE_MEMORY` | presence | `core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp` | | logs direct-memory map, remap, protect, unmap and physical allocation operations | | `APS5_TRACE_SYNC` | presence | `core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp` | | logs event-flag create, set and wait operations | diff --git a/docs/dev/debt/libSceJobManager.md b/docs/dev/debt/libSceJobManager.md index ab9dfe3e1b..0ce05f3280 100644 --- a/docs/dev/debt/libSceJobManager.md +++ b/docs/dev/debt/libSceJobManager.md @@ -3,7 +3,7 @@ ### Functional - [sce::Job::JobManager](../../../core/libs/prx/libSceJobManager/Export.cpp) submits every compute dispatch with its own label write and interrupt, while the original batches label writes and rewinds commands encoded ahead. Command buffers and labels live on the host heap; labels outside a GPU import force the driver to drain recorded work before each write. Completion labels are written as 32 bits; wrap behavior is unverified. The per-queue command-size formula uses fixed builder sizes of 104, 148 and 32 bytes per dispatch, sync point and wait. -- The [manager](../../../core/libs/prx/libSceJobManager/Export.cpp) keeps its state on the host heap rather than in the caller's block, apart from the block header. Blocks smaller than 0x2d8 bytes throw. Worker parking uses a host condition variable and mutex rather than the original semaphore and atomic queues; console scheduling and spin timing have not been measured. +- The [manager](../../../core/libs/prx/libSceJobManager/Export.cpp) keeps its state on the host heap rather than in the caller's block, apart from the block header. Blocks smaller than 0x2d8 bytes throw. Worker parking uses a host condition variable and mutex rather than the original semaphore and atomic queues; console scheduling and spin timing have not been measured. The fallback uses raw host TSC for its spin interval, so APS5_TIME_SCALE does not change host CPU use; the original module reads the scaled guest TSC when run through the host kernel. - [Sequence and manager operations](../../../core/libs/prx/libSceJobManager/Export.cpp) throw on a compute dispatch on a CPU sequence, a failing `sceAgcDriverAddEqEvent`, a factory priority above 1, and use of a destroyed sequence. `shutdown` throws while compute work is in flight or a caller is blocked in a sequence wait. Worker creation and attribute failures throw where the original does not check. -- [`initialize`](../../../core/libs/prx/libSceJobManager/Export.cpp) returns 0 instead of the result of the original's final import (`BG26hBGiNlw`, unresolved). The `sceRazorCpuJobManager*` profiler calls are not made. Sequence and factory virtual-function order is recovered from module vtables; no calling title has been run. -- The [fallback](../../../core/libs/prx/libSceJobManager/Export.cpp) and Windows [reference runner](../../../tools/run_job_manager_reference.py) disagree: the runner times out in the node-pool exhaustion fixture against the PPSA06888 module with the host kernel; the fallback returns `SequenceInvalid` and recycles its nodes. The cause remains unverified. Original-module execution on Linux and console timing equivalence are not covered by this runner. +- [`initialize`](../../../core/libs/prx/libSceJobManager/Export.cpp) returns 0 instead of the result of `_sceUlobjmgrRegisterObject`. The `sceRazorCpuJobManager*` profiler calls are not made. Sequence and factory virtual-function order is recovered from module vtables; no calling title has been run. +- The [fallback](../../../core/libs/prx/libSceJobManager/Export.cpp) and Windows [reference runner](../../../tools/run_job_manager_reference.py) disagree: the runner times out in the node-pool exhaustion fixture against the PPSA06888 module with the host kernel; the fallback returns `SequenceInvalid` and recycles its nodes. The original Wait spins while allocating a node from the exhausted global pool and resumes when another sequence returns one; the fallback deliberately needs no Wait node. Original-module execution on Linux and console timing equivalence are not covered by this runner. diff --git a/tools/run_job_manager_reference.py b/tools/run_job_manager_reference.py index d766bd51bc..488916cba2 100644 --- a/tools/run_job_manager_reference.py +++ b/tools/run_job_manager_reference.py @@ -15,7 +15,7 @@ ROOT = Path(__file__).resolve().parent.parent sys.path.insert(0, str(ROOT / "core/relinker/relinker/tests")) from guest_import_fixtures import executable -CASES = ("memory", "validation", "dispatch", "ordering", "nested", "limits", "node_pool", "priority", "shutdown", "worker_policy", "worker_wake", "worker_count") +CASES = ("memory", "validation", "dispatch", "ordering", "nested", "limits", "node_pool", "priority", "shutdown", "worker_policy", "worker_wake", "worker_count", "worker_spin") def stage_libraries(directory, build, toolchain, dependencies): From 1aab236614c9b579d627b99f4f5fca62c0de2fd2 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 23 Oct 2026 13:52:35 +0000 Subject: [PATCH 048/113] feat(libSceJson2): implement sce::Json::String at, find and rfind Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01GDe3GT5MyAARmdWTiGsiNU --- core/libs/prx/libSceJson2/Export.cpp | 29 +++++++++++++ .../libs/prx/libSceJson2/InventoryExports.cpp | 42 ------------------ core/libs/tests/GuestJson.cpp | 43 +++++++++++++++++++ docs/dev/debt/libSceJson2.md | 8 +--- 4 files changed, 73 insertions(+), 49 deletions(-) diff --git a/core/libs/prx/libSceJson2/Export.cpp b/core/libs/prx/libSceJson2/Export.cpp index a84b073cd9..9a7943f651 100644 --- a/core/libs/prx/libSceJson2/Export.cpp +++ b/core/libs/prx/libSceJson2/Export.cpp @@ -14,6 +14,7 @@ #include #include #include +#include #include "SceTypes.hpp" #include "prx/libc/include/General.hpp" @@ -725,6 +726,34 @@ String* APS5_VABI _ZNK3sce4Json6String6substrEmm(String* result, const String* s } std::size_t APS5_VABI _ZNK3sce4Json6String4findEcm(const String* self, char character, std::size_t position) { return self->text->find(character, position); } std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEcm(const String* self, char character, std::size_t position) { return self->text->rfind(character, position); } +char APS5_VABI _ZNK3sce4Json6String2atEm(const String* self, std::size_t position) { + if (position >= self->text->size()) throw std::out_of_range("sce::Json::String::at: position past the end"); + return (*self->text)[position]; +} +std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcm(const String* self, const char* text, std::size_t position) { + if (text == nullptr) throw std::invalid_argument("sce::Json::String::find: null text"); + return self->text->find(text, position); +} +std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcmm(const String* self, const char* text, std::size_t position, std::size_t length) { + if (text == nullptr && length > 0) throw std::invalid_argument("sce::Json::String::find: null text"); + return self->text->find(std::string_view(text == nullptr ? "" : text, length), position); +} +std::size_t APS5_VABI _ZNK3sce4Json6String4findERKS1_m(const String* self, const String* other, std::size_t position) { + if (other == nullptr || other->text == nullptr) throw std::invalid_argument("sce::Json::String::find: null other"); + return self->text->find(*other->text, position); +} +std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcm(const String* self, const char* text, std::size_t position) { + if (text == nullptr) throw std::invalid_argument("sce::Json::String::rfind: null text"); + return self->text->rfind(text, position); +} +std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcmm(const String* self, const char* text, std::size_t position, std::size_t length) { + if (text == nullptr && length > 0) throw std::invalid_argument("sce::Json::String::rfind: null text"); + return self->text->rfind(std::string_view(text == nullptr ? "" : text, length), position); +} +std::size_t APS5_VABI _ZNK3sce4Json6String5rfindERKS1_m(const String* self, const String* other, std::size_t position) { + if (other == nullptr || other->text == nullptr) throw std::invalid_argument("sce::Json::String::rfind: null other"); + return self->text->rfind(*other->text, position); +} int APS5_VABI _ZNK3sce4Json6String7compareEPKc(const String* self, const char* text) { if (text == nullptr) throw std::invalid_argument("sce::Json::String::compare: null text"); return CompareText(self->text->c_str(), text); diff --git a/core/libs/prx/libSceJson2/InventoryExports.cpp b/core/libs/prx/libSceJson2/InventoryExports.cpp index 5c89743172..89026a8217 100644 --- a/core/libs/prx/libSceJson2/InventoryExports.cpp +++ b/core/libs/prx/libSceJson2/InventoryExports.cpp @@ -407,46 +407,4 @@ int APS5_VABI sceJson2Unknown_067_nid_no_patch() { } APS5_EXPORT("_ZNK3sce4Json5ValueixERKNS0_6StringE", sceJson2Unknown_067_nid_no_patch); -int APS5_VABI sceJson2Unknown_068_nid_no_patch() { - NotImplemented_nid_no_patch(__func__); - return 0; -} -APS5_EXPORT("_ZNK3sce4Json6String2atEm", sceJson2Unknown_068_nid_no_patch); - -int APS5_VABI sceJson2Unknown_069_nid_no_patch() { - NotImplemented_nid_no_patch(__func__); - return 0; -} -APS5_EXPORT("_ZNK3sce4Json6String4findEPKcm", sceJson2Unknown_069_nid_no_patch); - -int APS5_VABI sceJson2Unknown_070_nid_no_patch() { - NotImplemented_nid_no_patch(__func__); - return 0; -} -APS5_EXPORT("_ZNK3sce4Json6String4findEPKcmm", sceJson2Unknown_070_nid_no_patch); - -int APS5_VABI sceJson2Unknown_071_nid_no_patch() { - NotImplemented_nid_no_patch(__func__); - return 0; -} -APS5_EXPORT("_ZNK3sce4Json6String4findERKS1_m", sceJson2Unknown_071_nid_no_patch); - -int APS5_VABI sceJson2Unknown_072_nid_no_patch() { - NotImplemented_nid_no_patch(__func__); - return 0; -} -APS5_EXPORT("_ZNK3sce4Json6String5rfindEPKcm", sceJson2Unknown_072_nid_no_patch); - -int APS5_VABI sceJson2Unknown_073_nid_no_patch() { - NotImplemented_nid_no_patch(__func__); - return 0; -} -APS5_EXPORT("_ZNK3sce4Json6String5rfindEPKcmm", sceJson2Unknown_073_nid_no_patch); - -int APS5_VABI sceJson2Unknown_074_nid_no_patch() { - NotImplemented_nid_no_patch(__func__); - return 0; -} -APS5_EXPORT("_ZNK3sce4Json6String5rfindERKS1_m", sceJson2Unknown_074_nid_no_patch); - } diff --git a/core/libs/tests/GuestJson.cpp b/core/libs/tests/GuestJson.cpp index b2951558b6..989e53d686 100644 --- a/core/libs/tests/GuestJson.cpp +++ b/core/libs/tests/GuestJson.cpp @@ -94,6 +94,13 @@ String* APS5_VABI _ZN3sce4Json6StringpLEh(String*, unsigned char); String* APS5_VABI _ZNK3sce4Json6String6substrEmm(String*, const String*, std::size_t, std::size_t); std::size_t APS5_VABI _ZNK3sce4Json6String4findEcm(const String*, char, std::size_t); std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEcm(const String*, char, std::size_t); +char APS5_VABI _ZNK3sce4Json6String2atEm(const String*, std::size_t); +std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcm(const String*, const char*, std::size_t); +std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcmm(const String*, const char*, std::size_t, std::size_t); +std::size_t APS5_VABI _ZNK3sce4Json6String4findERKS1_m(const String*, const String*, std::size_t); +std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcm(const String*, const char*, std::size_t); +std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcmm(const String*, const char*, std::size_t, std::size_t); +std::size_t APS5_VABI _ZNK3sce4Json6String5rfindERKS1_m(const String*, const String*, std::size_t); bool APS5_VABI _ZNK3sce4Json6Object8iteratorneERKS2_(const Iterator*, const Iterator*); bool APS5_VABI _ZNK3sce4Json6Object8iteratoreqERKS2_(const Iterator*, const Iterator*); void APS5_VABI _ZN3sce4Json5ValueC1Ev(Value*); @@ -692,6 +699,42 @@ static void StringMethods() { Require(_ZNK3sce4Json6String4findEcm(&base, 'z', 0) == _ZN3sce4Json6String4nposE); Require(_ZNK3sce4Json6String5rfindEcm(&base, '/', _ZN3sce4Json6String4nposE) == 3); Require(_ZNK3sce4Json6String5rfindEcm(&base, '/', 2) == 1); + const std::size_t npos = _ZN3sce4Json6String4nposE; + Require(_ZNK3sce4Json6String2atEm(&base, 0) == 'a'); + Require(_ZNK3sce4Json6String2atEm(&base, 4) == 'c'); + bool atRefused = false; + try { + _ZNK3sce4Json6String2atEm(&base, 5); + } catch (const std::out_of_range&) { + atRefused = true; + } + Require(atRefused); + Require(_ZNK3sce4Json6String4findEPKcm(&base, "/b", 0) == 1); + Require(_ZNK3sce4Json6String4findEPKcm(&base, "/", 2) == 3); + Require(_ZNK3sce4Json6String4findEPKcm(&base, "", 5) == 5); + Require(_ZNK3sce4Json6String4findEPKcm(&base, "", 6) == npos); + Require(_ZNK3sce4Json6String4findEPKcm(&base, "b/d", 0) == npos); + Require(_ZNK3sce4Json6String4findEPKcmm(&base, "b/d", 0, 2) == 2); + Require(_ZNK3sce4Json6String4findEPKcmm(&base, nullptr, 3, 0) == 3); + Require(_ZNK3sce4Json6String5rfindEPKcm(&base, "/", npos) == 3); + Require(_ZNK3sce4Json6String5rfindEPKcm(&base, "/", 2) == 1); + Require(_ZNK3sce4Json6String5rfindEPKcm(&base, "", npos) == 5); + Require(_ZNK3sce4Json6String5rfindEPKcmm(&base, "a/x", npos, 2) == 0); + Require(_ZNK3sce4Json6String5rfindEPKcmm(&base, "zz", npos, 2) == npos); + String needle{}; + _ZN3sce4Json6StringC1EPKc(&needle, "/c"); + Require(_ZNK3sce4Json6String4findERKS1_m(&base, &needle, 0) == 3); + Require(_ZNK3sce4Json6String4findERKS1_m(&base, &needle, 4) == npos); + Require(_ZNK3sce4Json6String5rfindERKS1_m(&base, &needle, npos) == 3); + Require(_ZNK3sce4Json6String5rfindERKS1_m(&base, &needle, 2) == npos); + _ZN3sce4Json6StringD1Ev(&needle); + bool findRefused = false; + try { + _ZNK3sce4Json6String4findEPKcm(&base, nullptr, 0); + } catch (const std::invalid_argument&) { + findRefused = true; + } + Require(findRefused); String part{}; Require(_ZNK3sce4Json6String6substrEmm(&part, &base, 2, 3) == &part); Require(text(part) == "b/c"); diff --git a/docs/dev/debt/libSceJson2.md b/docs/dev/debt/libSceJson2.md index b9fac63328..2f2507b74c 100644 --- a/docs/dev/debt/libSceJson2.md +++ b/docs/dev/debt/libSceJson2.md @@ -10,6 +10,7 @@ - [sce::Json::Value::setTypeMismatchHandler, setElementAccessFailureHandler and setSpecialFloatHandler](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - members of `Value` that return an int, inferred from a caller that registers them on its root `Value` before parsing into it, with the handler and its context, and accepts 0 or 0x80848104 as success; they return 0. The PS Vita library's `Value::setNullAccessCallback` is such a member too ([vitasdk](https://github.com/vitasdk/vita-headers/blob/15605617cbbb23d266f88af28899fdb573e2355e/include/psp2/json.h#L638)). The handler signatures follow the mangled names. A handler applies to the `Value` it is set on and to the values that `Value` holds then, and `Parser::parse` gives the values it creates the handlers of the `Value` it parses into, since the title reads the errors its handlers record after accessing parsed members; copies, `push_back` and `Object::operator[]` do not carry them, and how the console finds the handler of an accessed value is unknown. A typed getter on a non-null value of another type calls the type mismatch handler with the requested type, the value, null and the context, and returns the value the handler returns if it has the requested type, else the getter's default; passing null as the third handler argument (the second `Value` pointer), and the order of the two `Value` pointers, remain unverified against the console. The element access failure handler is not called: a failed `operator[]` or `getValue` on a value carrying it throws, as the error code the console passes, which the title records as its error, is unknown; without one the access still reaches the null-access callback. The special float handler is not called: serializing a non-finite real throws with or without it, as the `FunctionType` values and the `bool*` output are unknown, and the title's handler returns a different replacement for each of its two types - [sce::Json::MemAllocator::notifyError](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the base class's virtual does nothing. A title's allocator that does not override it calls it through its own vtable; the library never calls the title's allocator, so it never reports an allocation failure. Whether the console's base implementation logs anything is unknown - [sce::Json::String size, capacity, resize, append(const char*, size_t), operator+=](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - storage uses `std::string`; capacity and allocation growth do not match the system 32-bit capacity and allocator settings. Appending null text with a nonzero length throws instead of dereferencing it. +- [sce::Json::String at, find and rfind](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the return types follow the PS Vita library's `String` ([vitasdk](https://github.com/vitasdk/vita-headers/blob/15605617cbbb23d266f88af28899fdb573e2355e/include/psp2/json.h#L338)) and the search follows `std::string`. `at` past the end and a null text or `String` throw; what the console returns or does there is unverified. - [sce::Json::Array::iterator::advance and Object::iterator members](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the return type of `advance` remains unverified. Object iterator advancement past the end throws instead of asserting. Dereferencing an empty array iterator throws instead of returning the system null-value pointer or an invalid address. - [sce::Json::Value::operator bool](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - callback dispatch before conversion is not implemented. The system library invokes the applicable type mismatch handler before converting a non-boolean value, with SDK-dependent global callback handling. @@ -82,10 +83,3 @@ - [_ZNK3sce4Json14InitParameter217getFileBufferSizeEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `Pcg6xQUhq9E` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. - [_ZNK3sce4Json14InitParameter225getSpecialFloatFormatTypeEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `PDkib0zyABg` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. - [_ZNK3sce4Json5ValueixERKNS0_6StringE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `clF7J7N9xXE` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. -- [_ZNK3sce4Json6String2atEm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `KrKM-5SdQrA` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. -- [_ZNK3sce4Json6String4findEPKcm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `yjsf6SvXA08` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. -- [_ZNK3sce4Json6String4findEPKcmm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `wwDnDDsQVc0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. -- [_ZNK3sce4Json6String4findERKS1_m](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `awkeNR6Ukp8` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. -- [_ZNK3sce4Json6String5rfindEPKcm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `VpQBXbaHXOo` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. -- [_ZNK3sce4Json6String5rfindEPKcmm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `A29RHrlfTM0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. -- [_ZNK3sce4Json6String5rfindERKS1_m](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `-R9mdXBspeQ` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only. From 191266170b88403e4f6df09974d98ee554132364 Mon Sep 17 00:00:00 2001 From: Nciibi Date: Fri, 23 Oct 2026 16:11:00 +0100 Subject: [PATCH 049/113] fix(relinker): move a following in-place replacement into a 256-bit store's stub A 4-byte 256-bit store at the start of a segment followed by an AMD-only site that can only be emitted in place (RDSEED, CLWB, MOVNTSS, ...) had no preceding instruction to move, so WindowPlacer gave up with "No room for a jump to the stub of 256-bit store within its neighbours or a nearby island". Try a last-resort window placement that allows EmitOutOfLine to use the in-place lowering for the follower. Preferred preceding and following moves are unchanged. --- .../codegen/x86/IAmd64OnlyInstructionMatcher.hpp | 3 ++- core/relinker/codegen/src/Amd64OnlyConverter.cpp | 9 ++++++--- .../src/x86/Amd64OnlyInstructionMatcher.cpp | 11 ++++++++--- .../codegen/tests/Amd64OnlyConverterTests.cpp | 15 +++++++++++++++ 4 files changed, 31 insertions(+), 7 deletions(-) diff --git a/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp b/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp index 9986e79286..998c321b29 100644 --- a/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp +++ b/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp @@ -27,7 +27,8 @@ public: virtual void EmitOutOfLine( StubBodyBuilder& body, - std::span instruction + std::span instruction, + bool allowInPlace = false ) const = 0; }; diff --git a/core/relinker/codegen/src/Amd64OnlyConverter.cpp b/core/relinker/codegen/src/Amd64OnlyConverter.cpp index 8f312031fe..de510c4224 100644 --- a/core/relinker/codegen/src/Amd64OnlyConverter.cpp +++ b/core/relinker/codegen/src/Amd64OnlyConverter.cpp @@ -56,6 +56,7 @@ public: ) : _seg(seg), _matches(matches), _ph(ph), _branchTargets(branchTargets), _pending(pending), _claimed(claimed), _matcher(matcher) {} [[nodiscard]] std::optional Window(const std::size_t index) const { + std::optional fallback; for (const bool avoidSegment : {true, false}) { if (index + 1 < _matches.size() && (_pending.contains(index + 1) || _movable(index + 1, true, avoidSegment))) { if (auto placement = _relocate(index, index, index + 1)) @@ -65,8 +66,10 @@ public: if (auto placement = _relocate(index, index - 1, index)) return placement; } + if (!fallback && index + 1 < _matches.size() && _pending.contains(index + 1)) + fallback = _relocate(index, index, index + 1, true); } - return std::nullopt; + return fallback; } [[nodiscard]] std::optional Island(const std::size_t index) { @@ -130,7 +133,7 @@ private: }; } - [[nodiscard]] std::optional _relocate(const std::size_t index, const std::size_t first, const std::size_t last) const { + [[nodiscard]] std::optional _relocate(const std::size_t index, const std::size_t first, const std::size_t last, const bool allowInPlace = false) const { if (_entered(_address(first), _end(last))) return std::nullopt; StubBodyBuilder body; @@ -138,7 +141,7 @@ private: try { for (auto k = first; k <= last; ++k) { if (_pending.contains(k)) { - _matcher.EmitOutOfLine(body, _bytes(k)); + _matcher.EmitOutOfLine(body, _bytes(k), allowInPlace); if (k != index) placement.Consumed.push_back(k); } else { diff --git a/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp b/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp index 739a3aea7f..ff0f8f9c9c 100644 --- a/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp +++ b/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp @@ -172,7 +172,8 @@ public: void EmitOutOfLine( StubBodyBuilder& body, - std::span instruction + std::span instruction, + bool allowInPlace = false ) const override; private: @@ -355,8 +356,12 @@ const char* Amd64OnlyInstructionMatcher::_emitInPlace(StubBodyBuilder& body, con return nullptr; } -void Amd64OnlyInstructionMatcher::EmitOutOfLine(StubBodyBuilder& body, const std::span instruction) const { - if (_emitOutOfLine(body, DecodedInstruction{instruction.data(), instruction.size()}) == nullptr) +void Amd64OnlyInstructionMatcher::EmitOutOfLine(StubBodyBuilder& body, const std::span instruction, const bool allowInPlace) const { + const DecodedInstruction instr{instruction.data(), instruction.size()}; + const auto* emitted = _emitOutOfLine(body, instr); + if (emitted == nullptr && allowInPlace) + emitted = _emitInPlace(body, instr); + if (emitted == nullptr) throw CodegenException("AMD-only instruction has no out-of-line lowering"); body.Advance(instruction.size()); } diff --git a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp index 8f26dba82d..b130149682 100644 --- a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp +++ b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp @@ -837,6 +837,21 @@ void converterWideStoreWindows() { expected.insert(expected.end(), {0xC5, 0xF8, 0x11, 0x0E, 0xC4, 0xE3, 0x7D, 0x19, 0x4E, 0x10, 0x01}); require(paired.Trampolines.size() == 1 && paired.Trampolines[0].Length == 8 && body(paired.Trampolines[0]) == expected && paired.Reports.size() == 1, "A 256-bit store followed by another was not lowered with it in one stub"); + const auto withRdseed = convert(withStore({}, {0x0F, 0xC7, 0xF8, 0xC3})); + expected = halves; + expected.insert(expected.end(), {0x0F, 0xC7, 0xF0}); + require(withRdseed.Trampolines.size() == 1 && withRdseed.Trampolines[0].Length == 7 && body(withRdseed.Trampolines[0]) == expected && withRdseed.Reports.size() == 1, "A 256-bit store followed by an in-place site did not move its replacement into the stub"); + + const auto withClwb = convert(withStore({}, {0x66, 0x0F, 0xAE, 0x37, 0xC3})); + expected = halves; + expected.insert(expected.end(), {0x0F, 0x1F, 0x40, 0x00}); + require(withClwb.Trampolines.size() == 1 && withClwb.Trampolines[0].Length == 8 && body(withClwb.Trampolines[0]) == expected, "A 256-bit store followed by CLWB did not move its replacement into the stub"); + + const auto withRipStore = convert(withStore({}, {0xF3, 0x0F, 0x2B, 0x05, 0x40, 0x00, 0x00, 0x00, 0xC3})); + expected = halves; + expected.insert(expected.end(), {0xF3, 0x0F, 0x11, 0x05, 0x00, 0x00, 0x00, 0x00}); + require(withRipStore.Trampolines.size() == 1 && withRipStore.Trampolines[0].Length == 12 && body(withRipStore.Trampolines[0]) == expected && withRipStore.Trampolines[0].Relocations.size() == 1 && withRipStore.Trampolines[0].Relocations[0].SiteTarget == 0x4C && withRipStore.Trampolines[0].Relocations[0].InstructionEnd == 19, "A 256-bit store followed by a RIP-relative in-place site did not relocate its replacement"); + const Bytes push = {0x48, 0x8D, 0x64, 0x24, 0xF8, 0x50, 0x48, 0x8D, 0x05, 0, 0, 0, 0, 0x48, 0x89, 0x44, 0x24, 0x08, 0x58}; const auto ripCalled = convert(withStore({}, {0xFF, 0x15, 0x10, 0x00, 0x00, 0x00})); expected = halves; From 74878ee102d70bb1e3dd70179d28333f0a28b675 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Thu, 15 Oct 2026 16:56:30 -0400 Subject: [PATCH 050/113] feat(loader): prototype deferred Linux runtime module lifecycles --- core/libs/prx/libkernel/CMakeLists.txt | 10 +++ .../libkernel/Module/src/DynamicLoader.cpp | 54 ++++++++++++ core/libs/tests/GuestRuntimeLifecycle.cpp | 85 +++++++++++++++++++ .../elfpatcher/general/GuestModuleWriter.hpp | 2 +- .../src/linux/LinuxGuestModuleWriter.cpp | 70 +++++++++++++-- .../relinker/src/guest/GuestModuleBuilder.cpp | 2 +- .../tests/test_guest_runtime_lifecycle.py | 57 +++++++++++++ 7 files changed, 272 insertions(+), 8 deletions(-) create mode 100644 core/libs/tests/GuestRuntimeLifecycle.cpp create mode 100644 core/relinker/relinker/tests/test_guest_runtime_lifecycle.py diff --git a/core/libs/prx/libkernel/CMakeLists.txt b/core/libs/prx/libkernel/CMakeLists.txt index 2f39251297..266e6941d7 100644 --- a/core/libs/prx/libkernel/CMakeLists.txt +++ b/core/libs/prx/libkernel/CMakeLists.txt @@ -213,6 +213,16 @@ if(BUILD_TESTING) set_tests_properties(guest_process_arguments PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() + if(CMAKE_SYSTEM_NAME STREQUAL "Linux" AND Python3_Interpreter_FOUND) + add_test_executable(guest_runtime_lifecycle_tests ${LIBS_INCLUDE_DIR}/tests/GuestRuntimeLifecycle.cpp) + target_include_directories(guest_runtime_lifecycle_tests PRIVATE ${LIBS_INCLUDE_DIR}) + target_link_libraries(guest_runtime_lifecycle_tests PRIVATE libkernel libc ${CMAKE_DL_LIBS}) + set_target_properties(guest_runtime_lifecycle_tests PROPERTIES ENABLE_EXPORTS ON) + add_dependencies(guest_runtime_lifecycle_tests relinker) + add_test(NAME guest_runtime_lifecycle COMMAND ${Python3_EXECUTABLE} + ${CMAKE_SOURCE_DIR}/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py + $ $ $) + endif() add_library(guest_module_fixture SHARED ${LIBS_INCLUDE_DIR}/tests/GuestModuleFixture.cpp) target_include_directories(guest_module_fixture PRIVATE ${LIBS_INCLUDE_DIR}) add_custom_command(TARGET guest_module_fixture POST_BUILD diff --git a/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp b/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp index 29765cb8e6..6a6f544b10 100644 --- a/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp +++ b/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp @@ -24,6 +24,9 @@ #else #include #include +#ifdef __linux__ +#include +#endif #endif #ifdef _WIN32 @@ -137,6 +140,54 @@ char* APS5_VABI dlerror_nid_postfix() { pendingError = false; return loaderError.data(); } +#ifdef __linux__ +static void InitializeLinuxGuestModule(void* native) { + auto* table = static_cast(::dlsym(native, "__aps5_guest_lifecycle_nid_no_patch")); + if (!table) return; + link_map* requested = nullptr; + link_map* owner = nullptr; + Dl_info info{}; + if (::dlinfo(native, RTLD_DI_LINKMAP, &requested) != 0 || + !::dladdr1(table, &info, reinterpret_cast(&owner), RTLD_DL_LINKMAP) || owner != requested) return; + if (table[0] != 0x415053354c494658ull) throw std::runtime_error("dlopen: unsupported guest lifecycle metadata"); + using Entry = int (APS5_VABI *)(std::size_t, const void*, void*); + using Initializer = void (APS5_VABI *)(int, char**, char**); + static std::mutex initializedLock; + static std::condition_variable initializedChanged; + const auto thread = static_cast(::gettid()); + std::unique_lock lock(initializedLock); + while (table[6] == 1) { + if (table[7] == thread) return; + initializedChanged.wait(lock); + } + if (table[6] == 2) return; + if (table[6] != 0) throw std::runtime_error("dlopen: deferred guest initialization failed or finalized"); + table[6] = 1; + table[7] = thread; + lock.unlock(); + try { + const auto pending = *static_cast(__aps5_get_pending_module_args_nid_no_patch()); + const int result = table[2] == 0 ? 0 : reinterpret_cast(table[2])(pending.args, pending.argp, nullptr); + for (std::uint64_t index = 0; index < table[4]; ++index) { + const auto initializer = *reinterpret_cast(table[8 + index]); + if (initializer) initializer(0, nullptr, nullptr); + } + __aps5_set_module_init_result_nid_no_patch(result); + lock.lock(); + table[6] = 2; + table[7] = 0; + lock.unlock(); + initializedChanged.notify_all(); + } catch (...) { + lock.lock(); + table[6] = 3; + table[7] = 0; + lock.unlock(); + initializedChanged.notify_all(); + throw; + } +} +#endif #ifdef _WIN32 static void InitializeDeferredModule(HMODULE native) { using Entry = int (APS5_VABI *)(std::size_t, const void*, void*); @@ -228,6 +279,9 @@ void* APS5_VABI dlopen_nid_postfix(const char* path, int flags) { if (path) LoadFailure(source, resolved, ::dlerror()); else Error(::dlerror()); return nullptr; } +#ifdef __linux__ + if (path) InitializeLinuxGuestModule(module->native); +#endif #endif std::lock_guard lock(modulesMutex); const auto handle = nextHandle++; diff --git a/core/libs/tests/GuestRuntimeLifecycle.cpp b/core/libs/tests/GuestRuntimeLifecycle.cpp new file mode 100644 index 0000000000..f1f13bc4c0 --- /dev/null +++ b/core/libs/tests/GuestRuntimeLifecycle.cpp @@ -0,0 +1,85 @@ +#include "prx/libc/include/general/VabiMacros.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +extern "C" { +char* APS5_VABI dlerror_nid_postfix(); +std::int32_t APS5_VABI sceKernelLoadStartModule(const char*, std::size_t, const void*, std::uint32_t, const void*, int*); +int APS5_VABI sceKernelStopUnloadModule(std::int32_t, std::size_t, const void*, std::uint32_t, const void*, int*); +} + +namespace { +struct Event { std::size_t args; const void* argp; }; +std::array events{}; +std::atomic count{0}; +std::atomic entered{false}, releaseEntry{false}; +bool concurrent = false; +void Require(bool ok, const std::source_location& where = std::source_location::current()) { + if (ok) return; + std::fprintf(stderr, "guest_runtime_lifecycle: failed at %u\n", where.line()); + std::abort(); +} +} + +extern "C" void APS5_VABI RecordArgs(std::size_t args, const void* argp) { + const auto index = count.fetch_add(1); + Require(index < events.size()); + events[index] = {args, argp}; + if (index == 0 && concurrent) { + entered.store(true, std::memory_order_release); + const auto limit = std::chrono::steady_clock::now() + std::chrono::seconds(5); + while (!releaseEntry.load(std::memory_order_acquire)) { + Require(std::chrono::steady_clock::now() < limit); + std::this_thread::yield(); + } + } +} + +int main(int argc, char** argv) { + Require(argc == 3); + concurrent = std::strcmp(argv[2], "concurrent") == 0; + void* preload = ::dlopen(argv[1], RTLD_NOW | RTLD_LOCAL); + if (!preload) std::fprintf(stderr, "%s\n", ::dlerror()); + Require(preload && count.load() == 0); + if (std::strcmp(argv[2], "never-start") == 0) { + Require(::dlclose(preload) == 0 && count.load() == 0); + return 0; + } + const std::uint64_t payload = 0xfeed0123; + int result = -1; + std::int32_t first = -1, second = -1; + if (concurrent) { + std::thread one([&] { first = sceKernelLoadStartModule(argv[1], sizeof(payload), &payload, 0, nullptr, &result); }); + const auto limit = std::chrono::steady_clock::now() + std::chrono::seconds(5); + while (!entered.load(std::memory_order_acquire)) { + Require(std::chrono::steady_clock::now() < limit); + std::this_thread::yield(); + } + std::thread two([&] { second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr); }); + releaseEntry.store(true, std::memory_order_release); + one.join(); + two.join(); + } else { + first = sceKernelLoadStartModule(argv[1], sizeof(payload), &payload, 0, nullptr, &result); + second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr); + } + std::fprintf(stderr, "first=%d second=%d result=%x count=%u\n", first, second, result, count.load()); + if (first < 0) std::fprintf(stderr, "loader error: %s\n", dlerror_nid_postfix()); + Require(first > 0 && second > 0 && first != second && result == 0x5a17); + Require(count.load() == 2 && events[0].args == sizeof(payload) && events[0].argp == &payload); + Require(events[1].args == 0xa1 && events[1].argp == nullptr); + Require(sceKernelStopUnloadModule(first, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2); + Require(sceKernelStopUnloadModule(second, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2); + Require(::dlclose(preload) == 0 && count.load() == 4); + Require(events[2].args == 0xf1 && events[2].argp == nullptr); + Require(events[3].args == 0xfe && events[3].argp == nullptr); +} diff --git a/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp b/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp index 5ca491e9bf..1dcc28bbd0 100644 --- a/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp +++ b/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp @@ -9,7 +9,7 @@ namespace Elfpatcher { class GuestModuleWriter { public: - std::vector WriteLinux(const Relinker::GuestImage& image, const std::vector& dependencies, const std::string& runPath) const; + std::vector WriteLinux(const Relinker::GuestImage& image, const std::vector& dependencies, const std::string& runPath, bool deferInitialization = false) const; std::vector WriteWindows(const Relinker::GuestImage& image, Domain::GuestRuntime& runtime, const std::function& message = {}) const; std::vector WriteMacOs(const Relinker::GuestImage& image, const std::vector& dependencies, const std::string& runPath, const std::function& message = {}) const; }; diff --git a/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp b/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp index 76b91f97dc..1102afde6e 100644 --- a/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp +++ b/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp @@ -9,7 +9,7 @@ namespace Elfpatcher { -std::vector GuestModuleWriter::WriteLinux(const Relinker::GuestImage& image, const std::vector& dependencies, const std::string& runPath) const { +std::vector GuestModuleWriter::WriteLinux(const Relinker::GuestImage& image, const std::vector& dependencies, const std::string& runPath, const bool deferInitialization) const { auto bytes = image.Bytes; std::vector headers; std::uint64_t end = 0; @@ -35,7 +35,7 @@ std::vector GuestModuleWriter::WriteLinux(const Relinker::GuestIma const auto extraOffset = bytes.size(); const auto extraAddress = Io::AlignUp64(end, 0x4000); const auto address = [&] { return extraAddress + bytes.size() - extraOffset; }; - const bool passesModuleArgs = image.HasInit; + const bool passesModuleArgs = image.HasInit && !deferInitialization; std::uint64_t argsSlot = 0; std::uint64_t resultSlot = 0; if (passesModuleArgs) { @@ -83,6 +83,39 @@ std::vector GuestModuleWriter::WriteLinux(const Relinker::GuestIma Io::WriteU64(relaData, entry, slot); Io::WriteU64(relaData, entry + 8, (symbol << 32) | kGlobDat); }; + std::uint64_t lifecycleTable = 0; + if (deferInitialization) { + constexpr char exportName[] = "__aps5_guest_lifecycle_nid_no_patch"; + if (std::any_of(image.Symbols.begin(), image.Symbols.end(), [&](const auto& symbol) { return symbol.Name == exportName; })) + throw Domain::RelinkerException("Reserved guest lifecycle export is already present"); + Io::AlignBuffer(bytes, 8); + lifecycleTable = address(); + const auto pointer = [&](std::uint64_t target, bool relocate = true) { + const auto slot = address(); + Io::AppendU64(bytes, 0); + if (!relocate) return; + Io::AppendU64(relaData, slot); + Io::AppendU64(relaData, 8); + Io::AppendU64(relaData, target); + }; + Io::AppendU64(bytes, 0x415053354c494658ull); + pointer(0); + pointer(image.Init, image.Init != 0); + pointer(image.Fini, image.Fini != 0); + Io::AppendU64(bytes, image.InitArray.size()); + Io::AppendU64(bytes, image.FiniArray.size()); + Io::AppendU64(bytes, 0); + Io::AppendU64(bytes, 0); + for (const auto slot : image.InitArray) pointer(slot); + for (const auto slot : image.FiniArray) pointer(slot); + const auto entry = symbols.size(); + symbols.resize(entry + 24, 0); + Io::WriteU32(symbols, entry, addString(exportName)); + symbols[entry + 4] = 0x11; + Io::WriteU16(symbols, entry + 6, 1); + Io::WriteU64(symbols, entry + 8, lifecycleTable); + Io::WriteU64(symbols, entry + 16, address() - lifecycleTable); + } if (passesModuleArgs) { argsImport = addUndefinedImport("__aps5_get_pending_module_args_nid_no_patch"); resultImport = addUndefinedImport("__aps5_set_module_init_result_nid_no_patch"); @@ -156,8 +189,33 @@ std::vector GuestModuleWriter::WriteLinux(const Relinker::GuestIma Io::AppendU32(bytes, static_cast(distance)); return start; }; - const auto init = lifecycle(image.Init); - const auto fini = finalizer(image.Fini); + const auto init = deferInitialization ? 0 : lifecycle(image.Init); + auto fini = deferInitialization ? 0 : finalizer(image.Fini); + if (deferInitialization && (image.Fini != 0 || !image.FiniArray.empty())) { + fini = address(); + bytes.insert(bytes.end(), {0x48, 0x83, 0x3d}); + Io::AppendU32(bytes, stubDisplacement(lifecycleTable + 48, address() + 5)); + bytes.push_back(2); + bytes.insert(bytes.end(), {0x0f, 0x85}); + const auto skip = bytes.size(); + Io::AppendU32(bytes, 0); + bytes.insert(bytes.end(), {0x48, 0xc7, 0x05}); + Io::AppendU32(bytes, stubDisplacement(lifecycleTable + 48, address() + 8)); + Io::AppendU32(bytes, 4); + bytes.insert(bytes.end(), {0x48, 0x83, 0xec, 8}); + for (auto slot = image.FiniArray.rbegin(); slot != image.FiniArray.rend(); ++slot) { + bytes.insert(bytes.end(), {0x48, 0x8b, 0x05}); + Io::AppendU32(bytes, stubDisplacement(*slot, address() + 4)); + bytes.insert(bytes.end(), {0x48, 0x85, 0xc0, 0x74, 8, 0x31, 0xff, 0x31, 0xf6, 0x31, 0xd2, 0xff, 0xd0}); + } + if (image.Fini != 0) { + bytes.insert(bytes.end(), {0x31, 0xff, 0x31, 0xf6, 0x31, 0xd2, 0xe8}); + Io::AppendU32(bytes, stubDisplacement(image.Fini, address() + 4)); + } + bytes.insert(bytes.end(), {0x48, 0x83, 0xc4, 8}); + Io::WriteU32(bytes, skip, static_cast(bytes.size() - skip - 4)); + bytes.push_back(0xc3); + } Io::AlignBuffer(bytes, 8); const auto dynamicOffset = bytes.size(); const auto dynamicAddress = address(); @@ -181,8 +239,8 @@ std::vector GuestModuleWriter::WriteLinux(const Relinker::GuestIma tag(20, 7); tag(3, image.Got); } - if (!image.InitArray.empty()) { tag(25, image.InitArray.front()); tag(27, image.InitArray.size() * 8); } - if (!image.FiniArray.empty()) { tag(26, image.FiniArray.front()); tag(28, image.FiniArray.size() * 8); } + if (!deferInitialization && !image.InitArray.empty()) { tag(25, image.InitArray.front()); tag(27, image.InitArray.size() * 8); } + if (!deferInitialization && !image.FiniArray.empty()) { tag(26, image.FiniArray.front()); tag(28, image.FiniArray.size() * 8); } if (init != 0) tag(12, init); if (fini != 0) tag(13, fini); tag(30, DF_BIND_NOW | (image.Symbolic ? DF_SYMBOLIC : 0)); diff --git a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp index 1ffd34e19d..0fe7a2da9e 100644 --- a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp +++ b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp @@ -404,7 +404,7 @@ std::vector GuestModuleBuilder::Build(const std::filesystem::path needed.push_back("$ORIGIN/" + dependencyPath.lexically_relative(image.SourcePath.parent_path()).generic_string()); } needed.insert(needed.end(), moduleHostLibraries[index].begin(), moduleHostLibraries[index].end()); - output = macos ? Elfpatcher::GuestModuleWriter().WriteMacOs(image, needed, guestRunPath, message) : Elfpatcher::GuestModuleWriter().WriteLinux(image, needed, guestRunPath); + output = macos ? Elfpatcher::GuestModuleWriter().WriteMacOs(image, needed, guestRunPath, message) : Elfpatcher::GuestModuleWriter().WriteLinux(image, needed, guestRunPath, isRuntime(index)); } if (windows) { for (const auto& [name, provider] : guestNames) { diff --git a/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py new file mode 100644 index 0000000000..4aad6c3e55 --- /dev/null +++ b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py @@ -0,0 +1,57 @@ +from pathlib import Path +import os +import struct +import subprocess +import sys +import tempfile + +from test_guest_module_args import args_module + + +def lifecycle_module(): + image = args_module() + tags = [] + for offset in range(0x2000, 0x2300, 16): + tag, value = struct.unpack_from(" Date: Thu, 15 Oct 2026 17:04:57 -0400 Subject: [PATCH 051/113] test(loader): verify explicit runtime starts and record lifecycle limits --- core/libs/prx/libkernel/CMakeLists.txt | 2 +- .../tests/test_guest_deferred_dependencies.py | 4 ++-- .../relinker/tests/test_guest_module_args.py | 15 ++++++++++++++- docs/dev/debt/libkernel.md | 2 ++ 4 files changed, 19 insertions(+), 4 deletions(-) diff --git a/core/libs/prx/libkernel/CMakeLists.txt b/core/libs/prx/libkernel/CMakeLists.txt index 266e6941d7..03f482f74c 100644 --- a/core/libs/prx/libkernel/CMakeLists.txt +++ b/core/libs/prx/libkernel/CMakeLists.txt @@ -213,6 +213,7 @@ if(BUILD_TESTING) set_tests_properties(guest_process_arguments PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() + find_package(Python3 QUIET COMPONENTS Interpreter) if(CMAKE_SYSTEM_NAME STREQUAL "Linux" AND Python3_Interpreter_FOUND) add_test_executable(guest_runtime_lifecycle_tests ${LIBS_INCLUDE_DIR}/tests/GuestRuntimeLifecycle.cpp) target_include_directories(guest_runtime_lifecycle_tests PRIVATE ${LIBS_INCLUDE_DIR}) @@ -231,7 +232,6 @@ if(BUILD_TESTING) add_dependencies(guest_module_fixture nid_patcher) configure_windows_unwind(guest_module_fixture) set_target_properties(guest_module_fixture PROPERTIES BUILD_WITH_INSTALL_RPATH ON INSTALL_RPATH "$ORIGIN") - find_package(Python3 QUIET COMPONENTS Interpreter) if(Python3_Interpreter_FOUND AND NOT WIN32) target_link_options(guest_module_fixture PRIVATE -Wl,--no-as-needed) add_test(NAME nid_patcher_dynamic_strings COMMAND ${Python3_EXECUTABLE} diff --git a/core/relinker/relinker/tests/test_guest_deferred_dependencies.py b/core/relinker/relinker/tests/test_guest_deferred_dependencies.py index 7d27de5530..1a155bc31e 100644 --- a/core/relinker/relinker/tests/test_guest_deferred_dependencies.py +++ b/core/relinker/relinker/tests/test_guest_deferred_dependencies.py @@ -124,8 +124,8 @@ def main(): env={**os.environ, "ANYPS5_GUEST_MODULE_ARGS": str(events)}) assert run.returncode == 42, (root, run.returncode, run.stdout, run.stderr) recorded = events.read_text() if events.exists() else "" - assert recorded.count("args=") == (1 if root in ("executable", "bundled", "imported") else 0), (root, recorded) - load_and_record(case, libraries / "libc.prx", runtime / "plugin.prx.guest.prx") + assert recorded.count("args=") == 0, (root, recorded) + load_and_record(case, libraries / "libc.prx", runtime / "provider.prx.guest.prx") print("Guest deferred dependency tests passed") diff --git a/core/relinker/relinker/tests/test_guest_module_args.py b/core/relinker/relinker/tests/test_guest_module_args.py index ea9ecf0f18..2bebfb1b87 100644 --- a/core/relinker/relinker/tests/test_guest_module_args.py +++ b/core/relinker/relinker/tests/test_guest_module_args.py @@ -161,7 +161,20 @@ def main(): host = ctypes.CDLL(sys.argv[2], mode=ctypes.RTLD_GLOBAL if sys.platform == 'darwin' else ctypes.DEFAULT_MODE) host.SetPendingArgs.argtypes = [ctypes.c_size_t, ctypes.c_void_p] host.SetPendingArgs(ARGS, ARGP) - ctypes.CDLL(sys.argv[3]) + module = ctypes.CDLL(sys.argv[3]) + try: + table = (ctypes.c_uint64 * 8).in_dll(module, '__aps5_guest_lifecycle_nid_no_patch') + except ValueError: + return + assert table[0] == 0x415053354c494658 and table[6] == 0 + table[6] = 1 + returned = ctypes.CFUNCTYPE(ctypes.c_int, ctypes.c_size_t, ctypes.c_void_p, ctypes.c_void_p)(table[2])(ARGS, ARGP, None) if table[2] else 0 + for index in range(table[4]): + callback = ctypes.c_void_p.from_address(ctypes.c_uint64.from_address(ctypes.addressof(table) + 64 + index * 8).value).value + if callback: + ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_void_p, ctypes.c_void_p)(callback)(0, None, None) + host.__aps5_set_module_init_result_nid_no_patch(returned) + table[6] = 2 return relinker = Path(sys.argv[1]).resolve() host = Path(sys.argv[2]).resolve() diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md index 515c8d8c2b..b0d8438fe7 100644 --- a/docs/dev/debt/libkernel.md +++ b/docs/dev/debt/libkernel.md @@ -123,6 +123,8 @@ - [scePthreadYield](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) on Windows calls Sleep(1) after 512 consecutive yields that find no other thread ready on the current processor and arrive less than ~10,000 TSC ticks apart (so the span varies with host CPU TSC rate); FreeBSD sched_yield never sleeps. - [Guest thread scheduling](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - the policies and priorities that `sched_get_priority_max`, `sched_get_priority_min`, `pthread_setschedparam` and `scePthreadSetschedparam` accept, and those a created thread takes, follow a PS5 (firmware 13.60), but they are only recorded and reported: they are not applied to host threads, so a title's priority order has no effect on host scheduling +- [Linux runtime module initialization](../../../core/libs/prx/libkernel/Module/src/DynamicLoader.cpp) (libkernel) - modules in explicit runtime directories can be mapped for startup bindings while their initialization waits for an explicit guest load. Linux guest lifecycle metadata preserves the caller arguments, initializes once, and suppresses finalizers for modules never started. Synthetic native-loader checks cover arguments, concurrent starts and finalization ordering; Double Dragon Gaiden (PPSA16018) passes its prior plugin null-context startup stop and reaches the title screen. Console lifecycle ordering is unmeasured. Windows and macOS retain their existing lifecycle paths. The first title run still required forced termination after a close request; shutdown and gameplay are not established. + - [sceKernelMprotect, sceKernelMtypeprotect](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) over a range with a gap that is not registered in the allocation tracker protect the registered parts and skip the gap, and return 0, as FreeBSD 11.4's [`vm_map_protect`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/vm/vm_map.c) does (it has no check for holes); a range whose start is unmapped (also when later pages are mapped) returns `SCE_KERNEL_ERROR_EINVAL` (`mprotect`: `EINVAL`) because an existing test pins that for an unmapped start; FreeBSD answers 0 there too (`vm_map_protect` takes the next entry), so this errno is not taken from the source and was not changed. `sceKernelMprotect` threw for a gap before, which ended the title. Every part is checked for a GPU or image pin before the first one is protected; the parts are then protected one after the other, so a host protection failure in a later part leaves the earlier parts changed (FreeBSD's `vm_map_protect` cannot fail in its second pass). The behaviour on the console is not known. None of this was measured on a console. - [sceKernelMprotect protection bits](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - bits outside `0x3F7` are dropped instead of refused, in the POSIX `mprotect` as well (FreeBSD 11.4 masks the argument, `sys/vm/vm_mmap.c:613`; the console was measured only through `sceKernelMprotect`), as a PS5 (firmware 13.60) drops them: Onimusha: Way of the Sword (PPSA27836 01.000.001) maps direct memory with `0xf2` and then protects it with `0xfffffff2`, which the console reports as `0xf3` and then `0x3f3`. In a payload process the console also drops the CPU execute bit (`0x4`) of flexible, direct and JIT memory, and POSIX `mprotect` with write and execute reports write only (`0x2`). A title process may keep execute, so it is kept here. The map calls and `sceKernelMtypeprotect` refuse undefined bits on the console with `EINVAL` (`0x80020016`), and the direct map calls refuse execute; here both throw for undefined bits, and the direct map calls map execute - [JIT shared memory](../../../core/libs/prx/libkernel/DirectMemory/Jit.cpp) (libkernel) - `sceKernelJitCreateSharedMemory`, `sceKernelJitCreateAliasOfSharedMemory` and `sceKernelJitMapSharedMemory` take the signatures of [Orbital](https://github.com/AlexAltea/orbital)'s `tools/ida/db_types.json` (name, length, maximum protection, descriptor out; descriptor, maximum protection, descriptor out; descriptor, protection, address in and out), which ps4sdk, ps5-jar-loader and the call sites in RetroArch PPSA99169, XPSemu PPSA97358 and VLC PPSA85300 match; SharpProspero declares the alias as returning the descriptor. The object is a host anonymous file shared by its descriptors (a `memfd` on Linux, a delete-on-close temporary file mapped as an executable section on Windows), the alias is a duplicate descriptor, and every map maps the whole object, so writes through one view show through the others; a non-null address is a hint, as in `mmap` without `MAP_FIXED`. Not measured on the console: a length that is zero or not a multiple of 16 KiB and protection bits other than CPU read, write and execute are `EINVAL`; an alias or a map asking for more than the descriptor's maximum protection (write and execute counting as read) is `EACCES`, as FreeBSD 11's `vm_map_protect` treats a protection past `max_protection`; a descriptor that is not a JIT object is `EBADF`. The name is ignored, the objects do not count against the flexible memory budget, `mprotect` of a view is not limited to the maximum protection, and `mmap` of the descriptors maps the object as a [regular file](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp), so its views and the JIT views see each other's writes. On Linux the `memfd` is created without `MFD_EXEC`, which Linux 6.3 added and older kernels reject with `EINVAL`, and relies on the protection of the mapping: the flag only sets the file's execute permission bits, and the direct memory `memfd` is mapped executable the same way; a host with `vm.memfd_noexec` set to 2 refuses the creation and the call throws From 2d4d55036dc1fdad4476d46e7e01de6667f547fa Mon Sep 17 00:00:00 2001 From: JJenkx Date: Thu, 15 Oct 2026 17:20:27 -0400 Subject: [PATCH 052/113] test(loader): preserve explicit zero-argument module starts --- core/libs/prx/libkernel/Module/src/DynamicLoader.cpp | 6 ++++-- core/libs/tests/GuestRuntimeLifecycle.cpp | 9 ++++++--- .../relinker/tests/test_guest_runtime_lifecycle.py | 2 +- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp b/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp index 6a6f544b10..64c1b9b553 100644 --- a/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp +++ b/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp @@ -147,8 +147,10 @@ static void InitializeLinuxGuestModule(void* native) { link_map* requested = nullptr; link_map* owner = nullptr; Dl_info info{}; - if (::dlinfo(native, RTLD_DI_LINKMAP, &requested) != 0 || - !::dladdr1(table, &info, reinterpret_cast(&owner), RTLD_DL_LINKMAP) || owner != requested) return; + if (::dlinfo(native, RTLD_DI_LINKMAP, &requested) != 0 || requested == nullptr || + !::dladdr1(table, &info, reinterpret_cast(&owner), RTLD_DL_LINKMAP) || owner == nullptr) + throw std::runtime_error("dlopen: cannot identify guest lifecycle metadata owner"); + if (owner != requested) return; if (table[0] != 0x415053354c494658ull) throw std::runtime_error("dlopen: unsupported guest lifecycle metadata"); using Entry = int (APS5_VABI *)(std::size_t, const void*, void*); using Initializer = void (APS5_VABI *)(int, char**, char**); diff --git a/core/libs/tests/GuestRuntimeLifecycle.cpp b/core/libs/tests/GuestRuntimeLifecycle.cpp index f1f13bc4c0..095f83bb56 100644 --- a/core/libs/tests/GuestRuntimeLifecycle.cpp +++ b/core/libs/tests/GuestRuntimeLifecycle.cpp @@ -55,10 +55,13 @@ int main(int argc, char** argv) { return 0; } const std::uint64_t payload = 0xfeed0123; + const bool zeroStart = std::strcmp(argv[2], "zero-start") == 0; + const std::size_t requestedSize = zeroStart ? 0 : sizeof(payload); + const void* requestedPointer = zeroStart ? nullptr : &payload; int result = -1; std::int32_t first = -1, second = -1; if (concurrent) { - std::thread one([&] { first = sceKernelLoadStartModule(argv[1], sizeof(payload), &payload, 0, nullptr, &result); }); + std::thread one([&] { first = sceKernelLoadStartModule(argv[1], requestedSize, requestedPointer, 0, nullptr, &result); }); const auto limit = std::chrono::steady_clock::now() + std::chrono::seconds(5); while (!entered.load(std::memory_order_acquire)) { Require(std::chrono::steady_clock::now() < limit); @@ -69,13 +72,13 @@ int main(int argc, char** argv) { one.join(); two.join(); } else { - first = sceKernelLoadStartModule(argv[1], sizeof(payload), &payload, 0, nullptr, &result); + first = sceKernelLoadStartModule(argv[1], requestedSize, requestedPointer, 0, nullptr, &result); second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr); } std::fprintf(stderr, "first=%d second=%d result=%x count=%u\n", first, second, result, count.load()); if (first < 0) std::fprintf(stderr, "loader error: %s\n", dlerror_nid_postfix()); Require(first > 0 && second > 0 && first != second && result == 0x5a17); - Require(count.load() == 2 && events[0].args == sizeof(payload) && events[0].argp == &payload); + Require(count.load() == 2 && events[0].args == requestedSize && events[0].argp == requestedPointer); Require(events[1].args == 0xa1 && events[1].argp == nullptr); Require(sceKernelStopUnloadModule(first, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2); Require(sceKernelStopUnloadModule(second, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2); diff --git a/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py index 4aad6c3e55..220ce145e9 100644 --- a/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py +++ b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py @@ -47,7 +47,7 @@ def main(): run = subprocess.run([str(relinker), "--skip-syscall-check", "--module-dir", "Media/Plugins", "--rpath", str(libraries), str(source), str(root / "app.elf")], capture_output=True, text=True, timeout=30) assert run.returncode == 0, (run.stdout, run.stderr) module = root / "app0/Media/Plugins/args.prx.guest.prx" - for mode in ("never-start", "start", "concurrent"): + for mode in ("never-start", "start", "zero-start", "concurrent"): run = subprocess.run([str(executable), "./" + module.name, mode], cwd=module.parent, env=os.environ, capture_output=True, text=True, timeout=10) assert run.returncode == 0, (mode, run.returncode, run.stdout, run.stderr) print("Runtime module initialization and finalization passed") From d5987b3fb82967283bc89bca2b13ede9b4089872 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Thu, 15 Oct 2026 17:23:22 -0400 Subject: [PATCH 053/113] docs(loader): keep lifecycle debt focused on ABI limits --- docs/dev/debt/libkernel.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md index b0d8438fe7..8eb95b53dd 100644 --- a/docs/dev/debt/libkernel.md +++ b/docs/dev/debt/libkernel.md @@ -123,7 +123,7 @@ - [scePthreadYield](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) on Windows calls Sleep(1) after 512 consecutive yields that find no other thread ready on the current processor and arrive less than ~10,000 TSC ticks apart (so the span varies with host CPU TSC rate); FreeBSD sched_yield never sleeps. - [Guest thread scheduling](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - the policies and priorities that `sched_get_priority_max`, `sched_get_priority_min`, `pthread_setschedparam` and `scePthreadSetschedparam` accept, and those a created thread takes, follow a PS5 (firmware 13.60), but they are only recorded and reported: they are not applied to host threads, so a title's priority order has no effect on host scheduling -- [Linux runtime module initialization](../../../core/libs/prx/libkernel/Module/src/DynamicLoader.cpp) (libkernel) - modules in explicit runtime directories can be mapped for startup bindings while their initialization waits for an explicit guest load. Linux guest lifecycle metadata preserves the caller arguments, initializes once, and suppresses finalizers for modules never started. Synthetic native-loader checks cover arguments, concurrent starts and finalization ordering; Double Dragon Gaiden (PPSA16018) passes its prior plugin null-context startup stop and reaches the title screen. Console lifecycle ordering is unmeasured. Windows and macOS retain their existing lifecycle paths. The first title run still required forced termination after a close request; shutdown and gameplay are not established. +- [Linux runtime module initialization](../../../core/libs/prx/libkernel/Module/src/DynamicLoader.cpp) (libkernel) - modules in explicit runtime directories can be mapped for bindings before an explicit guest load runs their entry and init array once with the caller arguments. Finalizers run only after initialization completed. Console dependency-start and finalization ordering are unmeasured. Windows and macOS use their existing lifecycle paths. - [sceKernelMprotect, sceKernelMtypeprotect](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) over a range with a gap that is not registered in the allocation tracker protect the registered parts and skip the gap, and return 0, as FreeBSD 11.4's [`vm_map_protect`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/vm/vm_map.c) does (it has no check for holes); a range whose start is unmapped (also when later pages are mapped) returns `SCE_KERNEL_ERROR_EINVAL` (`mprotect`: `EINVAL`) because an existing test pins that for an unmapped start; FreeBSD answers 0 there too (`vm_map_protect` takes the next entry), so this errno is not taken from the source and was not changed. `sceKernelMprotect` threw for a gap before, which ended the title. Every part is checked for a GPU or image pin before the first one is protected; the parts are then protected one after the other, so a host protection failure in a later part leaves the earlier parts changed (FreeBSD's `vm_map_protect` cannot fail in its second pass). The behaviour on the console is not known. None of this was measured on a console. - [sceKernelMprotect protection bits](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - bits outside `0x3F7` are dropped instead of refused, in the POSIX `mprotect` as well (FreeBSD 11.4 masks the argument, `sys/vm/vm_mmap.c:613`; the console was measured only through `sceKernelMprotect`), as a PS5 (firmware 13.60) drops them: Onimusha: Way of the Sword (PPSA27836 01.000.001) maps direct memory with `0xf2` and then protects it with `0xfffffff2`, which the console reports as `0xf3` and then `0x3f3`. In a payload process the console also drops the CPU execute bit (`0x4`) of flexible, direct and JIT memory, and POSIX `mprotect` with write and execute reports write only (`0x2`). A title process may keep execute, so it is kept here. The map calls and `sceKernelMtypeprotect` refuse undefined bits on the console with `EINVAL` (`0x80020016`), and the direct map calls refuse execute; here both throw for undefined bits, and the direct map calls map execute From adf0176d3a26d7b5235bc94e7fa8b62b410801e0 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Thu, 15 Oct 2026 17:30:47 -0400 Subject: [PATCH 054/113] fix(loader): preserve SDK startup in browser conversions --- .../relinker/src/guest/GuestModuleBuilder.cpp | 5 +++- .../relinker/tests/ConversionTests.cpp | 30 +++++++++++++++++++ docs/dev/debt/relinker.md | 4 +-- docs/user/USAGE.md | 2 +- 4 files changed, 37 insertions(+), 4 deletions(-) diff --git a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp index 0fe7a2da9e..7794b6ee9f 100644 --- a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp +++ b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp @@ -404,7 +404,10 @@ std::vector GuestModuleBuilder::Build(const std::filesystem::path needed.push_back("$ORIGIN/" + dependencyPath.lexically_relative(image.SourcePath.parent_path()).generic_string()); } needed.insert(needed.end(), moduleHostLibraries[index].begin(), moduleHostLibraries[index].end()); - output = macos ? Elfpatcher::GuestModuleWriter().WriteMacOs(image, needed, guestRunPath, message) : Elfpatcher::GuestModuleWriter().WriteLinux(image, needed, guestRunPath, isRuntime(index)); + const auto directory = image.SourcePath.parent_path(); + const bool deferLinuxStart = isRuntime(index) && directory != root / "sce_module" && + directory != root / "sce_modules" && directory != root / "prx"; + output = macos ? Elfpatcher::GuestModuleWriter().WriteMacOs(image, needed, guestRunPath, message) : Elfpatcher::GuestModuleWriter().WriteLinux(image, needed, guestRunPath, deferLinuxStart); } if (windows) { for (const auto& [name, provider] : guestNames) { diff --git a/core/relinker/relinker/tests/ConversionTests.cpp b/core/relinker/relinker/tests/ConversionTests.cpp index 9fb582c837..9acbc3ba84 100644 --- a/core/relinker/relinker/tests/ConversionTests.cpp +++ b/core/relinker/relinker/tests/ConversionTests.cpp @@ -127,6 +127,35 @@ void convert() { require(progress.Events.back().Completed != 1 || progress.Events.back().Stage != Domain::ProgressStage::Executable, "Failed conversion reported completion"); } +void runtimeLifecyclePolicy() { + TestProgress progress; + const Relinker::Conversion converter(progress); + for (const auto* directory : {"sce_module", "sce_modules", "prx", "Media/Plugins"}) { + auto source = input(); + const auto parent = source.ModuleRoot / directory; + auto module = fixture(); + Io::WriteU64(module, 0x2080, 12); + Io::WriteU64(module, 0x2088, 0x1000); + Io::WriteU64(module, 208, 160); + Io::WriteU64(module, 216, 160); + source.Modules.push_back({parent / "plugin.prx", std::move(module)}); + source.RuntimeDirectories.push_back(parent); + const auto output = converter.Convert(std::move(source), {}); + const auto& bytes = output.Modules.at(0).Bytes; + const auto headers = Io::ReadU64(bytes, 32); + bool initializesOnMapping = false; + for (std::uint16_t index = 0; index < Io::ReadU16(bytes, 56); ++index) { + const auto header = headers + index * 56; + if (Io::ReadU32(bytes, header) != 2) continue; + const auto dynamic = Io::ReadU64(bytes, header + 8); + const auto end = dynamic + Io::ReadU64(bytes, header + 32); + for (auto offset = dynamic; offset < end; offset += 16) + if (Io::ReadU64(bytes, offset) == 12) initializesOnMapping = Io::ReadU64(bytes, offset + 8) != 0; + } + require(initializesOnMapping == (std::string_view(directory) != "Media/Plugins"), "Default SDK directories lost their mapping initializer"); + } +} + void fixedBase() { TestProgress progress; const Relinker::Conversion converter(progress); @@ -348,6 +377,7 @@ void relocationValidation() { int main() { try { convert(); + runtimeLifecyclePolicy(); fixedBase(); scanning(); diagnosticContext(); diff --git a/docs/dev/debt/relinker.md b/docs/dev/debt/relinker.md index f4e849cbda..f0c2f84faa 100644 --- a/docs/dev/debt/relinker.md +++ b/docs/dev/debt/relinker.md @@ -4,8 +4,8 @@ - [Executable guest imports](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) - on Linux and macOS, a relocated executable import resolved to one guest provider requires that module and its dependencies at startup, even when it was discovered through `--module-dir` without a DT_NEEDED entry. Unreferenced symbols and no-op relocations do not require an otherwise deferred module. Console module-start ordering is unmeasured. -- [Runtime-loaded modules](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) that another module needs are initialized at startup with no start arguments, before the module that needs them is loaded; the console is assumed to start them when that module is loaded. -- [Runtime-loaded modules the executable needs](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) are mapped at startup on Windows and started when the title loads them with `sceKernelLoadStartModule`, with their start arguments, as a Unity player loads `mono-ps4.sprx`. A title that calls such a module before loading it finds its initializers not run; whether the console starts it earlier is not measured. A module the executable only imports from and the title never loads itself gets no `module_start` and no initializers at all under this deferral, and nothing reports it. Linux and macOS still start it at startup. +- [Runtime-loaded modules](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) can be mapped early for bindings. Linux defers their initialization to an explicit load of each module; standard SDK folders keep their mapping initializer, including through the browser conversion API. On Windows and macOS, a module another module needs is initialized at startup without start arguments; console dependency-start ordering is unmeasured. +- [Runtime-loaded modules the executable needs](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) are mapped at startup on Windows and started when the title loads them with `sceKernelLoadStartModule`, with their start arguments, as a Unity player loads `mono-ps4.sprx`. A title that calls such a module before loading it finds its initializers not run; whether the console starts it earlier is not measured. A module the executable only imports from and the title never loads itself gets no `module_start` and no initializers at all under this deferral, and nothing reports it. macOS still starts it at startup. - The executable file that [relinker](../../../core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp) generates opens a console when launched, unless it is relinked with `--windows-gui`, which selects the GUI subsystem. A GUI build started from Explorer has no standard output or error handle; the [entry stub](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp) gives each missing one `anyps5.log` beside the executable, replacing the previous run's file (#3282). Errors about the executable path or about waiting for the previous LoadExec process are written before the log is opened and are lost when the standard error handle is missing. If the log cannot be created, output to the missing handles is lost. - [Guest import registries](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) - declared host imports of bundled modules are recorded with their module name and relocation target, even when another guest module exports the same stripped NID. No-op relocations are omitted. Registries describe import bindings, not implementation correctness or runtime reachability. - Converted Windows main executables [omit `DYNAMIC_BASE`](../../../core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp) by default, not only with `--windows-fixed-base`: on the console the executable lies inside the 40-bit window that the title's own `sceLibcMspaceCreate` checks (#3043). Relocations are kept, so if `0x140000000` is taken Windows relocates the image, possibly above that window. Verified only on Windows 10. diff --git a/docs/user/USAGE.md b/docs/user/USAGE.md index bf137f6dd6..ce9bf3e31e 100644 --- a/docs/user/USAGE.md +++ b/docs/user/USAGE.md @@ -77,7 +77,7 @@ All switches are disabled by default. `unused-filter` defaults to `0`; `--rpath` | `--rpath ` | Set the system library search path. Quote `$ORIGIN` to prevent shell expansion, for example `--rpath '$ORIGIN/libs'` in Bash or PowerShell. Linux guest modules require an absolute path or a path beginning with `$ORIGIN`. Windows requires a nonempty ASCII path and supports `$ORIGIN` as the executable directory. | | `--autorun` | Run the output after conversion, print its exit code, and wait for Enter. Adds executable permissions for Linux output. Requires the target OS and prepared runtime layout. | | `--sce-module-path ` | Parent of the module directories, not the module directory itself. Default: input ELF parent; relative input paths resolve from the process working directory. Explicit absolute path: used directly. Explicit relative path (including `.` and `..`): relative to the process working directory. Output path has no effect. Requires one nonempty value; repeats, nonexistent or nondirectory paths, access failures, and combination with `--skip-sce-module` are errors. | -| `--module-dir ` | Relink the ELF modules of a directory under the module parent directory, besides `sce_module`/`sce_modules`/`prx`; outputs keep the relative path. A module another module needs is initialized at startup, and on Linux and macOS also one the executable needs; any other when the title loads it with `sceKernelLoadStartModule`, with its start arguments (for example Unity plugins in `Media/Plugins`, or `mono-ps4.sprx` on Windows). Repeatable; `.` is the parent itself, without the input ELF. Conflicts with `--skip-sce-module`. | +| `--module-dir ` | Relink the ELF modules of a directory under the module parent directory, besides `sce_module`/`sce_modules`/`prx`; outputs keep the relative path. Needed modules are mapped at startup. On Linux, modules in these extra directories initialize only when explicitly loaded, with the arguments from `sceKernelLoadStartModule` (for example Unity plugins in `Media/Plugins`). A module another module needs initializes at startup on Windows and macOS; one only the executable needs initializes when explicitly loaded on Windows and at startup on macOS. Other modules initialize when loaded. Repeatable; `.` is the parent itself, without the input ELF. Conflicts with `--skip-sce-module`. | | `--executable ` | Also convert another executable of the title, which it starts with `sceSystemServiceLoadExec`; the path is relative to the module parent directory, for example `picker/picker.bin`. It is written beside the output, named after the path with `/` replaced by `.` and given the output's extension (`picker.picker.bin.exe`), and uses the same `libs/`, `app0/` and guest modules. It is an error if a guest module converts differently for it. Repeatable. Conflicts with `--skip-sce-module`. | | `--patches ` | Apply the byte patches of this file during conversion, see [game patches](#game-patches). Overrides `relinker-patches.toml` discovery. Conflicts with `--no-patches`. | | `--no-patches` | Do not apply patches, and do not load `relinker-patches.toml` from the input directory. | From 13b33108b61403f72e1558a9ea11157bebb31d41 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Fri, 16 Oct 2026 01:03:48 -0400 Subject: [PATCH 055/113] fix(relinker): retain deferred zero-address initializers Retain DT_INIT presence when emitting the deferred Linux lifecycle slot. Check zero-valued initializers with and without preinit, native argument forwarding and return status, and the absent-tag case. Addresses the interaction with PR #6684 identified in review. --- .../src/linux/LinuxGuestModuleWriter.cpp | 2 +- .../tests/test_guest_zero_initializer.py | 45 ++++++++++++++++++- 2 files changed, 44 insertions(+), 3 deletions(-) diff --git a/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp b/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp index 1102afde6e..316a1cc318 100644 --- a/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp +++ b/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp @@ -100,7 +100,7 @@ std::vector GuestModuleWriter::WriteLinux(const Relinker::GuestIma }; Io::AppendU64(bytes, 0x415053354c494658ull); pointer(0); - pointer(image.Init, image.Init != 0); + pointer(image.Init, image.HasInit); pointer(image.Fini, image.Fini != 0); Io::AppendU64(bytes, image.InitArray.size()); Io::AppendU64(bytes, image.FiniArray.size()); diff --git a/core/relinker/relinker/tests/test_guest_zero_initializer.py b/core/relinker/relinker/tests/test_guest_zero_initializer.py index 7cc9a40ef7..a4c07d4695 100644 --- a/core/relinker/relinker/tests/test_guest_zero_initializer.py +++ b/core/relinker/relinker/tests/test_guest_zero_initializer.py @@ -8,10 +8,10 @@ import tempfile from guest_import_fixtures import executable from test_guest_intel_trampolines import main_fixture, pe_sections -from test_guest_module_args import ARGP, ARGS, GETTER, RETURNED, SETTER, macho_binds +from test_guest_module_args import ARGP, ARGS, GETTER, RETURNED, SETTER, load_and_record, macho_binds from test_guest_module_directories import needed_libraries from test_guest_module_dir import pe_export_names -from test_guest_symbol_names import dynamic_tags, imported_symbols +from test_guest_symbol_names import dynamic_tags, file_offset, imported_symbols, module_symbols PREINIT_SLOT = 0x2900 SHARED = 0x100 @@ -85,6 +85,44 @@ def convert(relinker, work, preinit, options, base=0): return output, work / 'app0' / 'sce_module' / (name + '.guest.prx') +def check_deferred_linux(relinker, work, host, preinit, has_init, native): + (work / 'sce_module').mkdir(parents=True) + plugins = work / 'plugins' + plugins.mkdir() + source = work / 'input.elf' + source.write_bytes(main_fixture()) + image = zero_init_module(preinit) + if not has_init: + for position in range(0x2000, 0x2300, 16): + if struct.unpack_from(' Date: Fri, 16 Oct 2026 01:13:16 -0400 Subject: [PATCH 056/113] test(relinker): use a guest-relative zero-init fixture run path --- core/relinker/relinker/tests/test_guest_zero_initializer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/relinker/relinker/tests/test_guest_zero_initializer.py b/core/relinker/relinker/tests/test_guest_zero_initializer.py index a4c07d4695..705598bc70 100644 --- a/core/relinker/relinker/tests/test_guest_zero_initializer.py +++ b/core/relinker/relinker/tests/test_guest_zero_initializer.py @@ -105,7 +105,7 @@ def check_deferred_linux(relinker, work, host, preinit, has_init, native): provider = libraries / 'libc.prx' shutil.copyfile(host, provider) result = subprocess.run([str(relinker), '--skip-syscall-check', '--module-dir', 'plugins', - '--rpath', str(libraries), str(source), str(work / 'output.elf')], + '--rpath', '$ORIGIN/libs', str(source), str(work / 'output.elf')], capture_output=True, text=True, timeout=30) assert result.returncode == 0, (preinit, has_init, result.stdout, result.stderr) converted = work / 'app0/plugins/zero.prx.guest.prx' From 8309412720410487e43e31b3f3c1d893a91caf4f Mon Sep 17 00:00:00 2001 From: JJenkx Date: Sun, 18 Oct 2026 22:27:39 -0400 Subject: [PATCH 057/113] test(loader): distinguish runtime mapping from explicit initialization --- core/relinker/relinker/tests/test_guest_module_args.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/core/relinker/relinker/tests/test_guest_module_args.py b/core/relinker/relinker/tests/test_guest_module_args.py index 2bebfb1b87..0ee80ca6f3 100644 --- a/core/relinker/relinker/tests/test_guest_module_args.py +++ b/core/relinker/relinker/tests/test_guest_module_args.py @@ -105,6 +105,11 @@ def check_lifecycle_host(relinker, host, work, linux, deferred): env={**os.environ, 'ANYPS5_GUEST_MODULE_ARGS': str(events)}, capture_output=True, text=True, timeout=30) assert run.returncode == 0, (run.returncode, run.stdout, run.stderr) + assert not events.exists(), events.read_text() + run = subprocess.run([sys.executable, __file__, '--load', str(libraries / 'libkernel.prx'), str(initializer)], + env={**os.environ, 'ANYPS5_GUEST_MODULE_ARGS': str(events)}, + capture_output=True, text=True, timeout=30) + assert run.returncode == 0, (run.returncode, run.stdout, run.stderr) assert events.read_text() == 'result=0\n', events.read_text() From df7fe4182facb407c3ba08fbbcd6d006f4ea8479 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Sun, 18 Oct 2026 22:43:31 -0400 Subject: [PATCH 058/113] test(relinker): check deferred zero-init host dependency --- core/relinker/relinker/tests/test_guest_zero_initializer.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/core/relinker/relinker/tests/test_guest_zero_initializer.py b/core/relinker/relinker/tests/test_guest_zero_initializer.py index 705598bc70..8d8a5d14d0 100644 --- a/core/relinker/relinker/tests/test_guest_zero_initializer.py +++ b/core/relinker/relinker/tests/test_guest_zero_initializer.py @@ -104,12 +104,14 @@ def check_deferred_linux(relinker, work, host, preinit, has_init, native): libraries.mkdir() provider = libraries / 'libc.prx' shutil.copyfile(host, provider) + shutil.copyfile(host, libraries / 'libkernel.prx') result = subprocess.run([str(relinker), '--skip-syscall-check', '--module-dir', 'plugins', '--rpath', '$ORIGIN/libs', str(source), str(work / 'output.elf')], capture_output=True, text=True, timeout=30) assert result.returncode == 0, (preinit, has_init, result.stdout, result.stderr) converted = work / 'app0/plugins/zero.prx.guest.prx' image = converted.read_bytes() + assert ('libkernel.prx' in needed_libraries(image)) == has_init, 'Deferred initializer dependency does not match DT_INIT presence' tags = dynamic_tags(image) assert tags.get(12, 0) == 0 and tags.get(25, 0) == 0, 'Deferred Linux module has an eager initializer' index = module_symbols(image).index('__aps5_guest_lifecycle_nid_no_patch') + 1 From a82db0717da79c96436c69d312ca58df3ba17da2 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Tue, 20 Oct 2026 12:29:58 -0400 Subject: [PATCH 059/113] test(loader): separate import mapping from runtime initialization --- .../relinker/tests/test_guest_unused_import_dependencies.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py b/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py index f3054ee7bd..264c6a251e 100644 --- a/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py +++ b/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py @@ -9,7 +9,7 @@ import tempfile from guest_import_fixtures import dynamic from test_guest_deferred_dependencies import page_aligned from test_guest_intel_trampolines import main_fixture -from test_guest_module_args import args_module +from test_guest_module_args import args_module, load_and_record from test_guest_module_directories import module_with_symbol, needed_libraries from test_guest_module_dir import pe_export_names from test_guest_needed_modules import module_with_needed @@ -98,7 +98,8 @@ def main(): else: assert run.returncode == 42, (kind, run.returncode, run.stdout, run.stderr) recorded = events.read_text() if events.exists() else '' - assert recorded.count('args=') == (1 if kind in ('referenced', 'weak-referenced', 'plt', 'needed') else 0), (kind, recorded) + assert recorded.count('args=') == 0, (kind, recorded) + load_and_record(case, libraries / 'libc.prx', case / provider) cases += 1 cycle = Path(directory) / f'{system}-cycle' (cycle / 'sce_module').mkdir(parents=True) From bbaf07d1104b56a36b2f4e543d6670acb47a140d Mon Sep 17 00:00:00 2001 From: JJenkx Date: Wed, 21 Oct 2026 15:09:47 -0400 Subject: [PATCH 060/113] test(loader): cover reentrant deferred module loads --- core/libs/tests/GuestRuntimeLifecycle.cpp | 14 +++++++++++++- .../relinker/tests/test_guest_runtime_lifecycle.py | 2 +- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/core/libs/tests/GuestRuntimeLifecycle.cpp b/core/libs/tests/GuestRuntimeLifecycle.cpp index 095f83bb56..b75fbc8e21 100644 --- a/core/libs/tests/GuestRuntimeLifecycle.cpp +++ b/core/libs/tests/GuestRuntimeLifecycle.cpp @@ -22,7 +22,9 @@ struct Event { std::size_t args; const void* argp; }; std::array events{}; std::atomic count{0}; std::atomic entered{false}, releaseEntry{false}; -bool concurrent = false; +bool concurrent = false, reentrant = false; +const char* modulePath = nullptr; +std::int32_t reentrantHandle = -1; void Require(bool ok, const std::source_location& where = std::source_location::current()) { if (ok) return; std::fprintf(stderr, "guest_runtime_lifecycle: failed at %u\n", where.line()); @@ -34,6 +36,10 @@ extern "C" void APS5_VABI RecordArgs(std::size_t args, const void* argp) { const auto index = count.fetch_add(1); Require(index < events.size()); events[index] = {args, argp}; + if (index == 0 && reentrant) { + reentrantHandle = sceKernelLoadStartModule(modulePath, 0, nullptr, 0, nullptr, nullptr); + Require(reentrantHandle > 0 && count.load() == 1); + } if (index == 0 && concurrent) { entered.store(true, std::memory_order_release); const auto limit = std::chrono::steady_clock::now() + std::chrono::seconds(5); @@ -47,6 +53,8 @@ extern "C" void APS5_VABI RecordArgs(std::size_t args, const void* argp) { int main(int argc, char** argv) { Require(argc == 3); concurrent = std::strcmp(argv[2], "concurrent") == 0; + reentrant = std::strcmp(argv[2], "reentrant") == 0; + modulePath = argv[1]; void* preload = ::dlopen(argv[1], RTLD_NOW | RTLD_LOCAL); if (!preload) std::fprintf(stderr, "%s\n", ::dlerror()); Require(preload && count.load() == 0); @@ -82,6 +90,10 @@ int main(int argc, char** argv) { Require(events[1].args == 0xa1 && events[1].argp == nullptr); Require(sceKernelStopUnloadModule(first, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2); Require(sceKernelStopUnloadModule(second, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2); + if (reentrant) { + Require(reentrantHandle != first && reentrantHandle != second); + Require(sceKernelStopUnloadModule(reentrantHandle, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2); + } Require(::dlclose(preload) == 0 && count.load() == 4); Require(events[2].args == 0xf1 && events[2].argp == nullptr); Require(events[3].args == 0xfe && events[3].argp == nullptr); diff --git a/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py index 220ce145e9..cc80f80fcc 100644 --- a/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py +++ b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py @@ -47,7 +47,7 @@ def main(): run = subprocess.run([str(relinker), "--skip-syscall-check", "--module-dir", "Media/Plugins", "--rpath", str(libraries), str(source), str(root / "app.elf")], capture_output=True, text=True, timeout=30) assert run.returncode == 0, (run.stdout, run.stderr) module = root / "app0/Media/Plugins/args.prx.guest.prx" - for mode in ("never-start", "start", "zero-start", "concurrent"): + for mode in ("never-start", "start", "zero-start", "concurrent", "reentrant"): run = subprocess.run([str(executable), "./" + module.name, mode], cwd=module.parent, env=os.environ, capture_output=True, text=True, timeout=10) assert run.returncode == 0, (mode, run.returncode, run.stdout, run.stderr) print("Runtime module initialization and finalization passed") From f32d9d89bec9455dabab4a22f27832624964eae5 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Wed, 21 Oct 2026 15:15:42 -0400 Subject: [PATCH 061/113] test(loader): verify nested handle retains runtime module --- core/libs/tests/GuestRuntimeLifecycle.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/core/libs/tests/GuestRuntimeLifecycle.cpp b/core/libs/tests/GuestRuntimeLifecycle.cpp index b75fbc8e21..9c007ec701 100644 --- a/core/libs/tests/GuestRuntimeLifecycle.cpp +++ b/core/libs/tests/GuestRuntimeLifecycle.cpp @@ -92,9 +92,11 @@ int main(int argc, char** argv) { Require(sceKernelStopUnloadModule(second, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2); if (reentrant) { Require(reentrantHandle != first && reentrantHandle != second); - Require(sceKernelStopUnloadModule(reentrantHandle, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2); + Require(::dlclose(preload) == 0 && count.load() == 2); + Require(sceKernelStopUnloadModule(reentrantHandle, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 4); + } else { + Require(::dlclose(preload) == 0 && count.load() == 4); } - Require(::dlclose(preload) == 0 && count.load() == 4); Require(events[2].args == 0xf1 && events[2].argp == nullptr); Require(events[3].args == 0xfe && events[3].argp == nullptr); } From 5c507eda3948b7906684f90c1d2322b0537ff26e Mon Sep 17 00:00:00 2001 From: JJenkx Date: Wed, 21 Oct 2026 16:19:13 -0400 Subject: [PATCH 062/113] test(loader): verify deferred module unload and reload lifecycle --- core/libs/tests/GuestRuntimeLifecycle.cpp | 13 +++++++++++++ .../relinker/tests/test_guest_runtime_lifecycle.py | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/core/libs/tests/GuestRuntimeLifecycle.cpp b/core/libs/tests/GuestRuntimeLifecycle.cpp index 9c007ec701..2457b49752 100644 --- a/core/libs/tests/GuestRuntimeLifecycle.cpp +++ b/core/libs/tests/GuestRuntimeLifecycle.cpp @@ -99,4 +99,17 @@ int main(int argc, char** argv) { } Require(events[2].args == 0xf1 && events[2].argp == nullptr); Require(events[3].args == 0xfe && events[3].argp == nullptr); + if (std::strcmp(argv[2], "reload") == 0) { + void* resident = ::dlopen(argv[1], RTLD_NOW | RTLD_NOLOAD); + Require(resident == nullptr); + result = -1; + const auto reload = sceKernelLoadStartModule(argv[1], sizeof(payload), &payload, 0, nullptr, &result); + Require(reload > 0 && reload != first && reload != second && result == 0x5a17); + Require(count.load() == 6 && events[4].args == sizeof(payload) && events[4].argp == &payload); + Require(events[5].args == 0xa1 && events[5].argp == nullptr); + Require(sceKernelStopUnloadModule(reload, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 8); + Require(events[6].args == 0xf1 && events[6].argp == nullptr); + Require(events[7].args == 0xfe && events[7].argp == nullptr); + Require(::dlopen(argv[1], RTLD_NOW | RTLD_NOLOAD) == nullptr); + } } diff --git a/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py index cc80f80fcc..d7bd720160 100644 --- a/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py +++ b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py @@ -47,7 +47,7 @@ def main(): run = subprocess.run([str(relinker), "--skip-syscall-check", "--module-dir", "Media/Plugins", "--rpath", str(libraries), str(source), str(root / "app.elf")], capture_output=True, text=True, timeout=30) assert run.returncode == 0, (run.stdout, run.stderr) module = root / "app0/Media/Plugins/args.prx.guest.prx" - for mode in ("never-start", "start", "zero-start", "concurrent", "reentrant"): + for mode in ("never-start", "start", "zero-start", "concurrent", "reentrant", "reload"): run = subprocess.run([str(executable), "./" + module.name, mode], cwd=module.parent, env=os.environ, capture_output=True, text=True, timeout=10) assert run.returncode == 0, (mode, run.returncode, run.stdout, run.stderr) print("Runtime module initialization and finalization passed") From 2c98914fe4d95fc406b585c377412c7b48675bdc Mon Sep 17 00:00:00 2001 From: JJenkx Date: Wed, 21 Oct 2026 23:01:45 -0400 Subject: [PATCH 063/113] test(loader): observe concurrent module initialization wait --- core/libs/tests/GuestRuntimeLifecycle.cpp | 27 ++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/core/libs/tests/GuestRuntimeLifecycle.cpp b/core/libs/tests/GuestRuntimeLifecycle.cpp index 2457b49752..e424940b2a 100644 --- a/core/libs/tests/GuestRuntimeLifecycle.cpp +++ b/core/libs/tests/GuestRuntimeLifecycle.cpp @@ -10,6 +10,7 @@ #include #include #include +#include extern "C" { char* APS5_VABI dlerror_nid_postfix(); @@ -23,6 +24,9 @@ std::array events{}; std::atomic count{0}; std::atomic entered{false}, releaseEntry{false}; bool concurrent = false, reentrant = false; +thread_local bool isLifecycleWaiter = false; +std::atomic waiterObserved{false}; +std::atomic waiterReturns{0}; const char* modulePath = nullptr; std::int32_t reentrantHandle = -1; void Require(bool ok, const std::source_location& where = std::source_location::current()) { @@ -32,6 +36,16 @@ void Require(bool ok, const std::source_location& where = std::source_location:: } } +extern "C" int pthread_cond_wait(pthread_cond_t* condition, pthread_mutex_t* mutex) { + using Wait = int (*)(pthread_cond_t*, pthread_mutex_t*); + static const auto actual = reinterpret_cast(::dlsym(RTLD_NEXT, "pthread_cond_wait")); + Require(actual != nullptr); + if (isLifecycleWaiter) waiterObserved.store(true, std::memory_order_release); + const int result = actual(condition, mutex); + if (isLifecycleWaiter) waiterReturns.fetch_add(1, std::memory_order_relaxed); + return result; +} + extern "C" void APS5_VABI RecordArgs(std::size_t args, const void* argp) { const auto index = count.fetch_add(1); Require(index < events.size()); @@ -75,10 +89,21 @@ int main(int argc, char** argv) { Require(std::chrono::steady_clock::now() < limit); std::this_thread::yield(); } - std::thread two([&] { second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr); }); + std::thread two([&] { + isLifecycleWaiter = true; + second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr); + isLifecycleWaiter = false; + }); + while (!waiterObserved.load(std::memory_order_acquire)) { + Require(std::chrono::steady_clock::now() < limit); + std::this_thread::yield(); + } + Require(count.load() == 1); releaseEntry.store(true, std::memory_order_release); one.join(); two.join(); + Require(waiterReturns.load() > 0); + std::fprintf(stderr, "Observed lifecycle waiter before initializer release; actual condition-wait returns=%u\n", waiterReturns.load()); } else { first = sceKernelLoadStartModule(argv[1], requestedSize, requestedPointer, 0, nullptr, &result); second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr); From 2a05015c2a15917516d6c13422e47b4c08b05b18 Mon Sep 17 00:00:00 2001 From: orezraey Date: Fri, 23 Oct 2026 12:21:25 -0300 Subject: [PATCH 064/113] fix(libkernel): refuse long thread names and answer a detach after a join as measured on a PS5 scePthreadCreate returns ENAMETOOLONG for a name of 32 bytes or more without creating the thread, and scePthreadDetach returns ESRCH for a joined thread. Co-Authored-By: Claude Opus 5.5 --- .../libs/prx/libkernel/Pthread/src/Thread.cpp | 5 ++++- core/libs/tests/GuestPthreadSecondJoin.cpp | 19 ++++++++++++++++++- docs/dev/debt/libkernel.md | 3 ++- 3 files changed, 24 insertions(+), 3 deletions(-) diff --git a/core/libs/prx/libkernel/Pthread/src/Thread.cpp b/core/libs/prx/libkernel/Pthread/src/Thread.cpp index 1d2fecb349..fdc3881ebc 100644 --- a/core/libs/prx/libkernel/Pthread/src/Thread.cpp +++ b/core/libs/prx/libkernel/Pthread/src/Thread.cpp @@ -35,6 +35,7 @@ #endif static constexpr int SCE_OK = 0; +static constexpr std::size_t GUEST_THREAD_NAME_CAPACITY = 32; static constexpr std::size_t HOST_STACK_MARGIN = 1u << 20; static constexpr int DETACH_DETACHED = 1; @@ -820,6 +821,7 @@ extern "C" { int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name) { if (!thread || !entry) throw std::runtime_error("scePthreadCreate: null arg"); + if (name && std::strlen(name) >= GUEST_THREAD_NAME_CAPACITY) return SCE_KERNEL_ERROR_ENAMETOOLONG; if (attr && !*attr) attr = nullptr; auto p = std::make_unique(attr ? *attr : nullptr); bool detached = false; @@ -988,7 +990,8 @@ int APS5_VABI scePthreadDetach(Pthread thread) { if (!thread) return SCE_KERNEL_ERROR_EINVAL; { std::lock_guard lock(thread->_join_mtx); - if (thread->_detached || thread->_joining || thread->_joined.load(std::memory_order_acquire)) return SCE_KERNEL_ERROR_EINVAL; + if (thread->_joined.load(std::memory_order_acquire)) return SCE_KERNEL_ERROR_ESRCH; + if (thread->_detached || thread->_joining) return SCE_KERNEL_ERROR_EINVAL; thread->_detached = true; } #ifdef _WIN32 diff --git a/core/libs/tests/GuestPthreadSecondJoin.cpp b/core/libs/tests/GuestPthreadSecondJoin.cpp index 4db4d57034..0173a7bd2c 100644 --- a/core/libs/tests/GuestPthreadSecondJoin.cpp +++ b/core/libs/tests/GuestPthreadSecondJoin.cpp @@ -3,18 +3,21 @@ #include #include #include +#include #include extern "C" { int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name); int APS5_VABI scePthreadJoin(Pthread thread, void** retval); int APS5_VABI scePthreadDetach(Pthread thread); +int APS5_VABI scePthreadGetname(Pthread thread, char* name); int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** retval); } static constexpr int SCE_OK = 0; static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast(0x80020003u); static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast(0x80020016u); +static constexpr int SCE_KERNEL_ERROR_ENAMETOOLONG = static_cast(0x8002003fu); static constexpr int GUEST_ESRCH = 3; static constexpr std::size_t REUSED_SLOT_ROUNDS = 64; @@ -40,7 +43,7 @@ int main() { result = reinterpret_cast(std::uintptr_t{0x55}); Require(scePthreadJoin(thread, &result) == SCE_KERNEL_ERROR_ESRCH); Require(result == reinterpret_cast(std::uintptr_t{0x55})); - Require(scePthreadDetach(thread) == SCE_KERNEL_ERROR_EINVAL); + Require(scePthreadDetach(thread) == SCE_KERNEL_ERROR_ESRCH); Require(pthread_join_nid_postfix(thread, &result) == GUEST_ESRCH); Require(result == reinterpret_cast(std::uintptr_t{0x55})); @@ -62,4 +65,18 @@ int main() { Require(result == reinterpret_cast(std::uintptr_t{0x55})); Require(scePthreadDetach(detached) == SCE_KERNEL_ERROR_EINVAL); release = true; + + Pthread named = nullptr; + char name[64] = {}; + Require(scePthreadCreate(&named, nullptr, Finish, nullptr, "0123456789abcdefghijklmnopqrstu") == SCE_OK); + Require(scePthreadGetname(named, name) == SCE_OK && std::strcmp(name, "0123456789abcdefghijklmnopqrstu") == 0); + Require(scePthreadJoin(named, nullptr) == SCE_OK); + Pthread untouched = reinterpret_cast(std::uintptr_t{0x77}); + Require(scePthreadCreate(&untouched, nullptr, Finish, nullptr, "0123456789abcdefghijklmnopqrstuv") == SCE_KERNEL_ERROR_ENAMETOOLONG); + Require(untouched == reinterpret_cast(std::uintptr_t{0x77})); + Pthread unnamed = nullptr; + std::memset(name, 'x', sizeof(name)); + Require(scePthreadCreate(&unnamed, nullptr, Finish, nullptr, nullptr) == SCE_OK); + Require(scePthreadGetname(unnamed, name) == SCE_OK && name[0] == 0); + Require(scePthreadJoin(unnamed, nullptr) == SCE_OK); } diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md index 515c8d8c2b..aeb843b727 100644 --- a/docs/dev/debt/libkernel.md +++ b/docs/dev/debt/libkernel.md @@ -170,7 +170,8 @@ - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Windows runs the handler wherever the target thread was interrupted. It waits only while the thread is inside winpthreads or restoring a context through `NtContinue`, and throws if that lasts 1 s, so a handler that calls into other host code the thread was interrupted in, such as the C runtime's heap or a lock of the emulator, can deadlock on it or reenter it. A thread that holds the address-wait lock of `sceKernelSyncOnAddressWait`, `sceKernelSyncOnAddressWake` and `_umtx_op`, or the park queue lock of the guest mutexes, gets the raise as an APC instead, which runs once it has released the lock or while it waits; the other locks of the emulator are not deferred this way - [sigaltstack](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) records each thread's alternate signal stack and reports it back, following FreeBSD's `kern_sigaltstack` (`EINVAL` for flags other than `SS_DISABLE`, `ENOMEM` below `MINSIGSTKSZ` 2048), but handlers never run on it, so `SS_ONSTACK` and `EPERM` are never reported - [sigpending](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) reports the intersection of the process-wide pending set of `sigtimedwait` and the blocked mask of `_sigprocmask`, as FreeBSD's `sys_sigpending` intersects the pending list with `td_sigmask`, and returns -1 with `EFAULT` for a null set. Because `_sigprocmask` keeps only the first 32 signals, signals 33 to 128 are never blocked and never appear in the set, and setting `SIG_IGN` (or `SIG_DFL` on a signal whose default action is to ignore) does not clear a signal that was already marked pending. PPSA99420 imports it -- [scePthreadJoin, scePthreadCreate](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - on a PS5 (firmware 13.60) joining a thread a second time returns `ESRCH` (`0x80020003`), as it does here, but a joined thread is kept until `scePthreadCreate` publishes over the same handle storage, so one host object and its handle are retained per distinct guest handle storage location for the lifetime of the process; a guest that joins into a fresh storage location every time keeps every one of them. A null entry crashed the payload and still throws. Joining the calling thread returns `EDEADLK` and a zeroed attribute creates a default thread, as on the console. `scePthreadDetach` on a joined thread answers `EINVAL`, as FreeBSD does on a thread that is not joinable; the console answer for a detach after a join is unverified. Detaching a thread while another thread waits to join it returns `EINVAL`, and a second concurrent join returns `EOPNOTSUPP`, as FreeBSD 11.4's [`thr_detach.c`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_detach.c) and [`thr_join.c`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_join.c) check `joiner`; before this PPSA34015 stopped once with `Joining guest thread: Access is denied` when a thread it was joining was released under the join, and which of the two calls released it was not captured. A detached thread is still released when it ends, so joining it after it ended reads freed memory. A handle value copied to a second storage and joined there retains the object under the original storage key, so a later `scePthreadCreate` over that original storage releases an object the copy still points at, and the copy reads freed memory +- [scePthreadJoin, scePthreadCreate](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - a joined thread is kept until `scePthreadCreate` publishes over the same handle storage, so one host object and its handle are retained per distinct guest storage location for the life of the process; a guest that joins into a fresh location every time keeps every one. A handle copied to a second storage and joined there retains the object under the original storage key, so a later `scePthreadCreate` over the original storage releases an object the copy still points at, and the copy reads freed memory. A detached thread is released when it ends, so joining it after it ended reads freed memory. A null entry crashed the payload and throws. Joining the calling thread returns `EDEADLK` and a zeroed attribute creates a default thread, as on the console. PPSA34015 once stopped with `Joining guest thread: Access is denied` before the join and detach checks followed the console +- [scePthreadCreate and scePthreadDetach, measured](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - as in a payload process on a PS5 (firmware 13.60): a name of 32 bytes or more returns `ENAMETOOLONG` (`0x8002003f`) without creating a thread, 31 is kept whole, and a null name gives an empty one; detaching a joined thread returns `ESRCH`; detaching a thread another thread is joining, or a detached one, returns `EINVAL`, as does joining a detached one; a second concurrent join returns `EOPNOTSUPP`; a null thread returns `EINVAL` from both; a null handle pointer to `scePthreadCreate` faulted and throws here. Whether the handle is written before the name check was not measured; here it is left alone - [Thread cancellation](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) follows FreeBSD libthr (states and types 0/1 and 0/2, `PTHREAD_CANCELED` 1, the `_pthread_cleanup_info` node layout), not measured on the console. A request is acted on only in `scePthreadTestcancel`, the condition variable, `sem` and `scePthreadSem` waits, `scePthreadJoin` and the sleeps, and their POSIX names; file and socket calls are not cancellation points. An enabled cancellation request wakes POSIX `sleep` and exits the thread. `usleep`, `sceKernelUsleep`, `nanosleep`, `_nanosleep`, `sceKernelNanosleep` and `sceKernelSleep` check cancellation only before and after the host sleep, so an enabled request during those waits is delivered when the sleep ends. The asynchronous type acts like the deferred one, except at the two set calls. - [cpuset_setaffinity](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - the calling thread, another live guest thread selected by its guest TID, or the calling process is handled; other levels (ROOT/CPUSET) and other scopes (CPUSET/JAIL) throw as unmodelled, invalid levels or scopes return `EINVAL` and unknown thread or process IDs return `ESRCH`, following [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/kern_cpuset.c#L1281-L1286) thread selection. Bits outside `sceKernelGetAvailableCpumask` are dropped, and a mask with none of those bits fails with `EDEADLK`, as FreeBSD does when the new set has no CPU in common with the parent set. Guest-TID lookup and the update hold the thread registry lock so a join cannot release the target during access. Affinity is recorded for guest CPU reporting and child inheritance, not applied to host scheduling; PS5 behaviour has not been measured - [cpuset_getaffinity](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - the calling thread, another live guest thread selected by its guest TID, or the calling process is handled; other levels (ROOT/CPUSET) and other scopes (CPUSET/JAIL) throw as unmodelled, invalid levels or scopes return `EINVAL` and unknown thread or process IDs return `ESRCH`, following [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/kern_cpuset.c#L426-L437) guest-TID selection, not measured on PS5. For the process the mask is the union of the affinities of the live guest threads, as [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/kern_cpuset.c#L1150-L1156) ORs the mask of every thread in the process; threads the guest did not create through libkernel are not included, and the console result is unverified From 3d4fadbcae49ef23bc9a7fb0345e18b4f8518c0f Mon Sep 17 00:00:00 2001 From: orezraey Date: Fri, 23 Oct 2026 12:23:42 -0300 Subject: [PATCH 065/113] fix(libSceUlt): keep ulthread names within the pthread name limit Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceUlt/Export.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libSceUlt/Export.cpp b/core/libs/prx/libSceUlt/Export.cpp index f876cfba21..cc3c25c60a 100644 --- a/core/libs/prx/libSceUlt/Export.cpp +++ b/core/libs/prx/libSceUlt/Export.cpp @@ -10,6 +10,7 @@ #include #include #include +#include #include #include @@ -818,7 +819,8 @@ int APS5_VABI sceUltUlthreadCreate(void* ulthread, const char* name, UltUlthread std::memset(ulthread, 0, 512); gUlthreads[ulthread] = state; } - const int result = scePthreadCreate(&state->_thread, nullptr, ulthreadRunner, state.get(), name != nullptr ? name : ""); + const std::string threadName = name != nullptr ? std::string(name).substr(0, 31) : std::string(); + const int result = scePthreadCreate(&state->_thread, nullptr, ulthreadRunner, state.get(), threadName.c_str()); if (result != 0) { std::lock_guard lock(gMutex); gUlthreads.erase(ulthread); From 54158953772526ea3dbdd21d53d93d461d153f38 Mon Sep 17 00:00:00 2001 From: orezraey Date: Fri, 23 Oct 2026 12:28:46 -0300 Subject: [PATCH 066/113] docs(libc): record reallocf as measured on a PS5 Co-Authored-By: Claude Opus 5.5 --- docs/dev/debt/libc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index 561aced31f..efc1981c97 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -24,7 +24,7 @@ - [malloc_usable_size](../../../core/libs/prx/libc/src/ApplicationHeap.cpp) (libc) - with the default allocator it returns the size the block was requested with (the range registered for it), not the rounded-up chunk size Sony's allocator reports; both satisfy "at least the requested size", and bytes past the request would not be write-watched. With an application allocator it calls entry 9 of the replacement table (`malloc_usable_size` in KytyPS5's `MallocReplace` order) and throws when the table leaves it null, like `malloc_stats_fast` - [malloc_stats_fast](../../../core/libs/prx/libc/src/GuestHeap.cpp) (libc) - with the default allocator it fills the 0x28-byte managed-size block as `sceLibcMspaceMallocStatsFast` does, from the default heap's own accounting, not Sony's allocator: the system sizes count the 1 MiB spans of its small-block classes and its committed large blocks, cached free ones included, and the in-use sizes count each handed-out block at its size-class or 64 KiB-granule size, header included. A block size below 0x28 or a null pointer returns 22, as in the mspace version; the version field is not checked. Ship of Harkinian (PPSA99320) calls it about 10 s after start-up. - [malloc, calloc, realloc, memalign, aligned_alloc, reallocalign and posix_memalign](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - the console's own heap was measured in a payload process on firmware 13.60, not in a title. A heap a title replaces was not measured and keeps the FreeBSD jemalloc behaviour: `ENOMEM` on failure, `EINVAL` for an alignment that is zero or not a power of two, and `realloc(ptr, 0)` frees the block. With the console's heap, failures set `EINVAL`, and `errno` is left alone for a size above `SIZE_MAX - 0x1008f` (`SIZE_MAX - (A + 0x100af)` for an alignment over 32 rounded up to A), a `calloc` overflow or an alignment of 2^63 or more. Alignments round up to a power of two, and `realloc(ptr, 0)` keeps the block with 0 usable bytes. `reallocalign(ptr, 0, alignment)` for a block without that alignment was not measured and throws -- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, not measured on the console: size 0 does what `realloc` does here, keeping the block with 0 usable bytes with the default heap and freeing it and returning null with an application allocator, so the block is not freed twice; when `realloc` fails, the block is freed through the same allocator and null is returned with the `errno` that `realloc` left. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc` +- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, as a payload process on a PS5 (firmware 13.60) does with the default heap (null and 0, size 0, 2^40 with `errno` 22 and the block freed, `SIZE_MAX` with `errno` untouched): size 0 does what `realloc` does here, keeping the block with 0 usable bytes with the default heap and freeing it and returning null with an application allocator, so the block is not freed twice; when `realloc` fails, the block is freed through the same allocator and null is returned with the `errno` that `realloc` left. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc` - [sceLibcMspaceReallocalign](../../../core/libs/prx/libc/src/Mspace.cpp) (libSceLibcInternal, implemented in libc) takes `(void* heap, void* block, size_t alignment, size_t size)`, the order of the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x13880, whose internal routine at 0x12390 treats the third argument as the alignment and, for a null block, passes it to the routine `sceLibcMspaceMemalign` uses). Measured on a PS5 (firmware 13.60) from a homebrew payload: a null block with alignment 4096 and size 100 returns a 4096-aligned block; an alignment of 0 or 3 succeeds and 100 gives a 128-aligned block, as the routine raises it to at least 32 and to the next power of two; an alignment of 2^63 or more returns null, keeps the block and leaves `errno` alone; and a size of 0 returns a block (the same one when it is already suitable) instead of freeing it. A block that is aligned and large enough is kept where it is, without giving back the bytes past the new size as the console's in-place resize does - [acosl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, like the other libc math functions here, not by the console's (FreeBSD msun ld80 code in Sony's `libc.prx`): results can differ from the console's in the last bit, and on Linux glibc sets `errno` to `EDOM` for `acosl` outside [-1, 1] where msun only raises the floating-point exception. `long double` is the x87 80-bit format, as Sony's `frexpl` uses it (`fldt 0x8(%rsp)`, result in `st(0)`) - [atanl, sinl, cosl, tanl, sinhl, coshl, tanhl, expl, exp2l, logl, log10l and powl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, as `acosl` is, not by the console's FreeBSD msun ld80 code: results can differ from the console's in the last bit (glibc's `log10l(1000)` is not exactly 3), and on Linux glibc sets `errno` to `EDOM` or `ERANGE` where msun only raises the floating-point exception. `ldexpl` and `truncl` are exact operations and give the console's result; `logb` and `remainder` give the console's value too, but on Linux glibc sets `errno` (`ERANGE` for `logb(0)`, `EDOM` for `remainder` by zero or of an infinity) where msun only raises the floating-point exception From c2cd880e1429b3db83a3067289c7d9fbd8eccd8a Mon Sep 17 00:00:00 2001 From: emirplus Date: Fri, 23 Oct 2026 19:05:46 +0300 Subject: [PATCH 067/113] fix(tools): wrap entrypoint in main with stream reconfigure in nid_names --- tools/nid_names.py | 6 +++--- tools/tests/test_nid_names.py | 27 +++++++++++++++++++++++++++ 2 files changed, 30 insertions(+), 3 deletions(-) diff --git a/tools/nid_names.py b/tools/nid_names.py index 86610f409c..a7d1841005 100644 --- a/tools/nid_names.py +++ b/tools/nid_names.py @@ -181,6 +181,9 @@ def symbol_file(path): def main(argv=None): + for stream in (sys.stdout, sys.stderr): + if hasattr(stream, "reconfigure"): + stream.reconfigure(encoding="utf-8", errors="backslashreplace") parser = argparse.ArgumentParser( description="Suggest real names for Unknown NID stubs") parser.add_argument("--db", default=os.environ.get("ANYPS5_NID_DB"), @@ -261,7 +264,4 @@ def main(argv=None): if __name__ == "__main__": - for stream in (sys.stdout, sys.stderr): - if hasattr(stream, "reconfigure"): - stream.reconfigure(encoding="utf-8") sys.exit(main()) diff --git a/tools/tests/test_nid_names.py b/tools/tests/test_nid_names.py index e317357de5..f5ccf2945d 100644 --- a/tools/tests/test_nid_names.py +++ b/tools/tests/test_nid_names.py @@ -425,6 +425,33 @@ int APS5_VABI sceReal() { return 0; } self.write_source('// continued \\\nAPS5_EXPORT("AAAAAAAAAAA", exampleUnknown00);\nAPS5_EX\\\nPORT("BBBBBBBBBBB", exampleUnknown01);\n') self.assertEqual(nid_names.collect_unknowns(), {"BBBBBBBBBBB": "core/libs/prx/libSceExample/Export.cpp:exampleUnknown01"}) + def test_main_reconfigures_streams(self): + class Stream: + def __init__(self): + self.encoding = None + self.errors = None + + def reconfigure(self, encoding=None, errors=None): + self.encoding = encoding + self.errors = errors + + def write(self, text): + pass + + def flush(self): + pass + + out, err = Stream(), Stream() + with patch.object(nid_names.sys, "stdout", out), patch.object(nid_names.sys, "stderr", err): + try: + nid_names.main(["--invalid-argument"]) + except SystemExit: + pass + self.assertEqual(out.encoding, "utf-8") + self.assertEqual(out.errors, "backslashreplace") + self.assertEqual(err.encoding, "utf-8") + self.assertEqual(err.errors, "backslashreplace") + if __name__ == "__main__": From c242694d099fa8cb1cd44eb40dceed9ce1699ae3 Mon Sep 17 00:00:00 2001 From: MarcZX10 <67475268+MarcZX10@users.noreply.github.com> Date: Fri, 23 Oct 2026 16:31:10 +0000 Subject: [PATCH 068/113] test(tools): cover Unicode environment reports --- tools/tests/test_env_reference.py | 59 +++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/tools/tests/test_env_reference.py b/tools/tests/test_env_reference.py index f56a933b14..51fac32289 100644 --- a/tools/tests/test_env_reference.py +++ b/tools/tests/test_env_reference.py @@ -3,6 +3,7 @@ import io import sys import tempfile import unittest +from unittest import mock from pathlib import Path sys.path.insert(0, str(Path(__file__).resolve().parents[1])) @@ -164,6 +165,64 @@ class EnvReferenceTests(unittest.TestCase): (core / "3rdparty" / "Ignored.cpp").write_text('static bool b = IsEnvironmentSet("APS5_IGNORED");\n', encoding="utf-8") self.assertEqual(set(env_reference.reads([core], BOTH)), {"APS5_TRACE_GPU"}) + def test_main_reconfigures_streams_for_unicode_report_paths(self): + class Stream: + def __init__(self): + self.encoding = "ascii" + self.errors = "strict" + self.text = "" + + def reconfigure(self, encoding=None, errors=None): + self.encoding = encoding + self.errors = errors + + def write(self, text): + text.encode(self.encoding, self.errors) + self.text += text + return len(text) + + def flush(self): + pass + + root = self.fixture() / "source-Ж" + root.mkdir() + core = root / "core" + core.mkdir() + (core / "Sample.cpp").write_text('static bool a = std::getenv("APS5_TRACE_GPU") != nullptr;\n', encoding="utf-8") + out, err = Stream(), Stream() + with mock.patch.object(env_reference.sys, "stdout", out), mock.patch.object(env_reference.sys, "stderr", err): + self.assertEqual(env_reference.main(["--root", str(core)]), 0) + self.assertEqual((out.encoding, out.errors), ("utf-8", "backslashreplace")) + self.assertEqual((err.encoding, err.errors), ("utf-8", "backslashreplace")) + self.assertIn(str(core / "Sample.cpp"), out.text) + + def test_main_reports_unicode_scan_root_with_non_utf8_stderr(self): + class Stream: + def __init__(self): + self.encoding = "ascii" + self.errors = "strict" + self.text = "" + + def reconfigure(self, encoding=None, errors=None): + self.encoding = encoding + self.errors = errors + + def write(self, text): + text.encode(self.encoding, self.errors) + self.text += text + return len(text) + + def flush(self): + pass + + root = Path(tempfile.gettempdir()) / "missing-source-Ж" + out, err = Stream(), Stream() + with mock.patch.object(env_reference.sys, "stdout", out), mock.patch.object(env_reference.sys, "stderr", err): + self.assertEqual(env_reference.main(["--root", str(root)]), 1) + self.assertEqual((out.encoding, out.errors), ("utf-8", "backslashreplace")) + self.assertEqual((err.encoding, err.errors), ("utf-8", "backslashreplace")) + self.assertIn(str(root), err.text) + def test_main_rejects_a_scan_root_that_is_not_a_directory(self): root = self.fixture() for name in ("missing", "core/Sample.cpp"): From 8ce4ed4e77ebb19918db3291456fdd096935c9ba Mon Sep 17 00:00:00 2001 From: JJenkx Date: Fri, 23 Oct 2026 12:31:17 -0400 Subject: [PATCH 069/113] fix(pad): timestamp scripted overlays in queued samples --- core/libs/prx/libScePad/src/PadState.cpp | 4 ++- core/libs/tests/GuestPad.cpp | 39 ++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libScePad/src/PadState.cpp b/core/libs/prx/libScePad/src/PadState.cpp index 5a6795f32e..e4bcf6eb90 100644 --- a/core/libs/prx/libScePad/src/PadState.cpp +++ b/core/libs/prx/libScePad/src/PadState.cpp @@ -25,6 +25,7 @@ namespace { std::array audioHapticRumble{}; PadAudioHapticQueue legacyHaptics; std::uint64_t timestamp = 0; + std::uint64_t injectedTimestamp = 0; struct QueuedInput { PadInputState input; @@ -224,6 +225,7 @@ Pad::InputCommandFile::Input InjectedInput(std::uint64_t now) { if (injected != lastInjected) { lastInjected = injected; timestamp = now; + injectedTimestamp = now; } return injected; } @@ -260,7 +262,7 @@ int Pad::Read(PadData* data, int num) { int count = 0; while (count < num && !queue.empty()) { const QueuedInput& entry = queue.front(); - data[count++] = BuildData(entry.input, entry.timestamp, now, injected); + data[count++] = BuildData(entry.input, std::max(entry.timestamp, injectedTimestamp), now, injected); queue.pop_front(); } return count; diff --git a/core/libs/tests/GuestPad.cpp b/core/libs/tests/GuestPad.cpp index 35abd4888c..c68b413632 100644 --- a/core/libs/tests/GuestPad.cpp +++ b/core/libs/tests/GuestPad.cpp @@ -6,6 +6,7 @@ #include #include #include +#include #include #include #include @@ -487,6 +488,43 @@ static void CheckInjectedState(const std::filesystem::path& path) { PadPublishInput_nid_postfix(PadInputState{}); } +static void CheckInjectedQueueTimes(const std::filesystem::path& path) { + PadData drained[64]{}; + Pad::Read(drained, 64); + PadInputState physical; + physical.buttons = 0x2000; + PadPublishInput_nid_postfix(physical); + const auto before = Pad::ReadState(); + std::ofstream(path) << "5 16384 300\n"; + PadData pressed{}; + const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2); + do { + pressed = Pad::ReadState(); + if ((pressed.buttons & 0x4000) != 0) break; + std::this_thread::sleep_for(std::chrono::milliseconds(10)); + } while (std::chrono::steady_clock::now() < deadline); + Require(pressed.buttons == 0x6000 && pressed.timestamp > before.timestamp); + PadData queued{}; + Require(Pad::Read(&queued, 1) == 1); + Require(queued.buttons == pressed.buttons); + if (queued.timestamp < pressed.timestamp) { + std::fputs("queued input predates its injected button press\n", stderr); + std::abort(); + } + physical.sticks[0] = 130; + PadPublishInput_nid_postfix(physical); + std::this_thread::sleep_for(std::chrono::milliseconds(310)); + const auto released = Pad::ReadState(); + Require(released.buttons == 0x2000 && released.timestamp > pressed.timestamp); + Require(Pad::Read(&queued, 1) == 1); + Require(queued.buttons == released.buttons && queued.left_stick_x == 130); + if (queued.timestamp < released.timestamp) { + std::fputs("queued input predates its injected button release\n", stderr); + std::abort(); + } + PadPublishInput_nid_postfix(PadInputState{}); +} + int main() { CheckInputCommands(); std::uint32_t accessibilityState = 7; @@ -569,6 +607,7 @@ int main() { CheckTrackerDevices(handle); CheckAccessibilityControllerState(handle); CheckInjectedState(commandPath); + CheckInjectedQueueTimes(commandPath); PadLightBarParam lightBar{255, 128, 64}; Require(scePadSetLightBar(handle, &lightBar) == PAD_OK); Require(scePadSetLightBar(handle, nullptr) == PAD_ERROR_INVALID_ARG); From 918bbde6faf58fe89b8506fb6cd70869b18e6de9 Mon Sep 17 00:00:00 2001 From: MarcZX10 <67475268+MarcZX10@users.noreply.github.com> Date: Fri, 23 Oct 2026 16:31:23 +0000 Subject: [PATCH 070/113] fix(tools): reconfigure environment report streams --- tools/env_reference.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/env_reference.py b/tools/env_reference.py index b7277df3bb..b4640417ac 100644 --- a/tools/env_reference.py +++ b/tools/env_reference.py @@ -160,6 +160,9 @@ def check(found, doc, prefixes, out): def main(argv=None): + for stream in (sys.stdout, sys.stderr): + if hasattr(stream, "reconfigure"): + stream.reconfigure(encoding="utf-8", errors="backslashreplace") parser = argparse.ArgumentParser( description="list the environment names the code reads, or check them against a reference document") parser.add_argument("--check", action="store_true", From 492583bfe7454569e3ac37bf74587de026163b48 Mon Sep 17 00:00:00 2001 From: al3w0f205 Date: Fri, 23 Oct 2026 11:32:21 -0500 Subject: [PATCH 071/113] test(libSceNpCommon): cover recursive lock in sceNpLwMutexLock --- core/libs/tests/GuestNpCommon.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/core/libs/tests/GuestNpCommon.cpp b/core/libs/tests/GuestNpCommon.cpp index d605767148..c3d964f7ea 100644 --- a/core/libs/tests/GuestNpCommon.cpp +++ b/core/libs/tests/GuestNpCommon.cpp @@ -24,6 +24,7 @@ int APS5_VABI sceNpLwMutexInit(PthreadMutex* mutex, const char* name, std::uint6 int APS5_VABI sceNpLwMutexTryLock(PthreadMutex* mutex); int APS5_VABI sceNpLwMutexUnlock(PthreadMutex* mutex); int APS5_VABI sceNpLwMutexDestroy(PthreadMutex* mutex); +int APS5_VABI sceNpLwMutexLock(PthreadMutex* mutex); int APS5_VABI sceNpCondInit(PthreadCond* cond, const char* name, std::uint64_t flags); int APS5_VABI sceNpCondDestroy(PthreadCond* cond); int APS5_VABI sceNpCondSignal(PthreadCond* cond); @@ -127,6 +128,8 @@ static int testSync() { ok &= expect(sceNpMutexUnlock(&plain) == 0, "the plain mutex did not unlock"); ok &= expect(sceNpLwMutexTryLock(&recursive) == 0 && sceNpLwMutexTryLock(&recursive) == 0, "flag 1 did not make the mutex recursive"); ok &= expect(sceNpLwMutexUnlock(&recursive) == 0 && sceNpLwMutexUnlock(&recursive) == 0, "the recursive mutex did not unlock twice"); + ok &= expect(sceNpLwMutexLock(&recursive) == 0, "the recursive mutex did not lock via sceNpLwMutexLock"); + ok &= expect(sceNpLwMutexUnlock(&recursive) == 0, "the recursive mutex did not unlock"); ok &= expect(sceNpLwMutexDestroy(&recursive) == 0, "the recursive mutex was not destroyed"); PthreadCond cond = nullptr; From 8713da0cbb352474529b29a483b338992e8edaa2 Mon Sep 17 00:00:00 2001 From: al3w0f205 Date: Fri, 23 Oct 2026 11:33:11 -0500 Subject: [PATCH 072/113] test(libSceSystemGesture): cover debug version query --- core/libs/tests/GuestSystemGesture.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/core/libs/tests/GuestSystemGesture.cpp b/core/libs/tests/GuestSystemGesture.cpp index 656f943aca..c1e62e8934 100644 --- a/core/libs/tests/GuestSystemGesture.cpp +++ b/core/libs/tests/GuestSystemGesture.cpp @@ -31,6 +31,7 @@ int APS5_VABI sceSystemGestureUpdatePrimitiveTouchRecognizer(std::int32_t, const int APS5_VABI sceSystemGestureInitializePrimitiveTouchRecognizer(); int APS5_VABI sceSystemGestureFinalizePrimitiveTouchRecognizer(void); int APS5_VABI sceSystemGestureGetPrimitiveTouchEventByPrimitiveID(std::int32_t, std::uint16_t, void*); +int APS5_VABI sceSystemGestureDebugGetVersion(void); } static void Require(bool value) { if (!value) std::abort(); } @@ -280,6 +281,7 @@ int main() { Require(sceSystemGestureUpdateAllTouchRecognizer(handle + 1) == invalidHandle); Require(sceSystemGestureUpdatePrimitiveTouchRecognizer(handle + 1, nullptr) == invalidArgument); + Require(sceSystemGestureDebugGetVersion() == 0x6a00); TestTouchRecognizerInformation(handle, invalidArgument, invalidHandle); TestPrimitiveTouchEvents(handle, invalidArgument, invalidHandle, indexOutOfArray); std::array otherHandles{}; From da5c03c20f8d33a78c27608a2f5840cb77e3a145 Mon Sep 17 00:00:00 2001 From: MarcZX10 <67475268+MarcZX10@users.noreply.github.com> Date: Fri, 23 Oct 2026 16:42:45 +0000 Subject: [PATCH 073/113] test(tools): normalize Windows report paths --- tools/tests/test_env_reference.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/tests/test_env_reference.py b/tools/tests/test_env_reference.py index 51fac32289..388160602c 100644 --- a/tools/tests/test_env_reference.py +++ b/tools/tests/test_env_reference.py @@ -194,7 +194,7 @@ class EnvReferenceTests(unittest.TestCase): self.assertEqual(env_reference.main(["--root", str(core)]), 0) self.assertEqual((out.encoding, out.errors), ("utf-8", "backslashreplace")) self.assertEqual((err.encoding, err.errors), ("utf-8", "backslashreplace")) - self.assertIn(str(core / "Sample.cpp"), out.text) + self.assertIn((core / "Sample.cpp").as_posix(), out.text) def test_main_reports_unicode_scan_root_with_non_utf8_stderr(self): class Stream: From f334c156e11969b7ce1484f0ab6277e0fc195557 Mon Sep 17 00:00:00 2001 From: orezraey Date: Fri, 23 Oct 2026 13:49:03 -0300 Subject: [PATCH 074/113] fix(libkernel): keep socket buffer sizes and SO_NBIO as measured on a PS5 Co-Authored-By: Claude Opus 5.5 --- .../Socket/include/SocketOptions.hpp | 8 ++- .../libkernel/Socket/src/SocketOptions.cpp | 62 ++++++++++++++----- core/libs/prx/libkernel/Socket/src/Udp.cpp | 10 ++- core/libs/tests/GuestSocketOptions.cpp | 50 +++++++++++++++ core/libs/tests/GuestSocketStreamOptions.cpp | 4 +- docs/dev/debt/libkernel.md | 6 +- 6 files changed, 116 insertions(+), 24 deletions(-) diff --git a/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp b/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp index 56bbe00efe..523842f51c 100644 --- a/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp +++ b/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp @@ -9,11 +9,15 @@ struct SocketOptionState { bool noSignal = false; std::int64_t sendTimeout = 0; std::int64_t receiveTimeout = 0; + int sendBuffer = 0; + int receiveBuffer = 0; + int sendLowWater = 0; + int receiveLowWater = 0; }; bool NativeListening(std::uintptr_t native, bool& listening); -int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int option, const void* value, std::uint32_t length); -int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int type, int option, void* value, std::uint32_t* length); +int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, const void* value, std::uint32_t length); +int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, void* value, std::uint32_t* length); int SetTcpLevelOption(std::uintptr_t native, bool tcp, int option, const void* value, std::uint32_t length); int GetTcpLevelOption(std::uintptr_t native, bool tcp, int option, void* value, std::uint32_t* length); int SetIpv6LevelOption(std::uintptr_t native, bool ipv6, int option, const void* value, std::uint32_t length); diff --git a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp index 37fce2af2e..77abe31e34 100644 --- a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp +++ b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp @@ -30,11 +30,15 @@ constexpr int GuestOobInline = 0x100; constexpr int GuestNoSigpipe = 0x800; constexpr int GuestSendBuffer = 0x1001; constexpr int GuestReceiveBuffer = 0x1002; +constexpr int GuestSendLowWater = 0x1003; +constexpr int GuestReceiveLowWater = 0x1004; constexpr int GuestSendTimeout = 0x1005; constexpr int GuestReceiveTimeout = 0x1006; constexpr int GuestError = 0x1007; constexpr int GuestType = 0x1008; constexpr int GuestNonBlocking = 0x1200; +constexpr int GuestNonBlockingState = 0x100; +constexpr int GuestUnix = 1; constexpr int GuestTcpNoDelay = 1; constexpr int GuestTcpNoDelayFlag = 4; constexpr int GuestIpv6Only = 27; @@ -42,6 +46,9 @@ constexpr int GuestIpv6Only = 27; constexpr int ErrorInvalid = 22; constexpr int ErrorDomain = 33; constexpr int ErrorNoProtocolOption = 42; +constexpr int ErrorNoBuffers = 55; +constexpr int MaximumReservation = 5592405; +constexpr int MaximumBuffer = 524288; constexpr int MaximumLinger = 65535; constexpr std::int64_t LongestTimeout = 0x7fffffffffffffffLL; @@ -87,9 +94,21 @@ int NativeBoolean(int option) { } } +void EnsureBuffers(SocketOptionState& state, int family, int type) { + if (state.sendBuffer != 0) return; + if (family == GuestUnix) { + state.sendBuffer = type == 2 ? 2048 : 8192; + state.receiveBuffer = type == 2 ? 4096 : 8192; + } else { + state.sendBuffer = type == 1 ? 32768 : 9216; + state.receiveBuffer = type == 1 ? 65536 : 42080; + } + state.sendLowWater = std::min(2048, state.sendBuffer); + state.receiveLowWater = 1; +} + int Copy(void* output, std::uint32_t* length, const void* value, std::uint32_t size) { const std::uint32_t count = std::min(*length, size); - if (count != 0 && !output) return ErrorInvalid; if (count != 0) std::memcpy(output, value, count); *length = count; return 0; @@ -97,11 +116,10 @@ int Copy(void* output, std::uint32_t* length, const void* value, std::uint32_t s } -int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int option, const void* value, std::uint32_t length) { +int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, const void* value, std::uint32_t length) { const auto handle = static_cast(native); if (option == GuestLinger) { if (length < sizeof(GuestLingerValue)) return ErrorInvalid; - if (!value) return ErrorInvalid; GuestLingerValue guest; std::memcpy(&guest, value, sizeof(guest)); if (guest.seconds < 0 || guest.seconds > MaximumLinger) return ErrorDomain; @@ -119,7 +137,6 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int op } if (option == GuestSendTimeout || option == GuestReceiveTimeout) { if (length < sizeof(GuestTimeval)) return ErrorInvalid; - if (!value) return ErrorInvalid; GuestTimeval time; std::memcpy(&time, value, sizeof(time)); if (time.seconds < 0 || time.microseconds < 0 || time.microseconds >= 1000000) return ErrorDomain; @@ -128,7 +145,6 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int op } if (option == GuestNoSigpipe || option == GuestNonBlocking) { if (length < sizeof(int)) return ErrorInvalid; - if (!value) return ErrorInvalid; int number; std::memcpy(&number, value, sizeof(number)); if (option == GuestNoSigpipe) { @@ -146,15 +162,28 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int op return 0; } const bool native_boolean = NativeBoolean(option) != -1; - if (native_boolean || option == GuestSendBuffer || option == GuestReceiveBuffer) { + const bool buffer = option == GuestSendBuffer || option == GuestReceiveBuffer; + const bool lowWater = option == GuestSendLowWater || option == GuestReceiveLowWater; + if (native_boolean || buffer || lowWater) { if (length < sizeof(int)) return ErrorInvalid; - if (!value) return ErrorInvalid; int number; std::memcpy(&number, value, sizeof(number)); - if (option == GuestSendBuffer || option == GuestReceiveBuffer) { + if (buffer || lowWater) { if (number < 1) return ErrorInvalid; - const int nativeOption = option == GuestSendBuffer ? SO_SNDBUF : SO_RCVBUF; - if (::setsockopt(handle, SOL_SOCKET, nativeOption, reinterpret_cast(&number), sizeof(number))) return HostError(); + EnsureBuffers(state, family, type); + const bool send = option == GuestSendBuffer || option == GuestSendLowWater; + int& size = send ? state.sendBuffer : state.receiveBuffer; + int& mark = send ? state.sendLowWater : state.receiveLowWater; + if (lowWater) { + mark = std::min(number, size); + return 0; + } + if (number > MaximumReservation) return ErrorNoBuffers; + const int reserved = std::min(number, MaximumBuffer); + const int nativeOption = send ? SO_SNDBUF : SO_RCVBUF; + if (::setsockopt(handle, SOL_SOCKET, nativeOption, reinterpret_cast(&reserved), sizeof(reserved))) return HostError(); + size = reserved; + mark = std::min(mark, size); return 0; } const int enabled = number != 0 ? 1 : 0; @@ -178,7 +207,7 @@ bool NativeListening(std::uintptr_t native, bool& listening) { return true; } -int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int type, int option, void* value, std::uint32_t* length) { +int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, void* value, std::uint32_t* length) { const auto handle = static_cast(native); if (option == GuestLinger) { linger current{}; @@ -206,7 +235,7 @@ int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int ty } else if (option == GuestNoSigpipe) { number = state.noSignal ? GuestNoSigpipe : 0; } else if (option == GuestNonBlocking) { - number = state.nonblocking ? 1 : 0; + number = state.nonblocking ? GuestNonBlockingState : 0; } else if (option == GuestError) { int pending = 0; socklen_t size = sizeof(pending); @@ -216,9 +245,10 @@ int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int ty else if (pending != 0) state.reportedError = pending; #endif number = pending == 0 ? 0 : GuestErrorFromHost(pending); - } else if (option == GuestSendBuffer || option == GuestReceiveBuffer) { - socklen_t size = sizeof(number); - if (::getsockopt(handle, SOL_SOCKET, option == GuestSendBuffer ? SO_SNDBUF : SO_RCVBUF, reinterpret_cast(&number), &size)) return HostError(); + } else if (option == GuestSendBuffer || option == GuestReceiveBuffer || option == GuestSendLowWater || option == GuestReceiveLowWater) { + EnsureBuffers(state, family, type); + number = option == GuestSendBuffer ? state.sendBuffer : option == GuestReceiveBuffer ? state.receiveBuffer + : option == GuestSendLowWater ? state.sendLowWater : state.receiveLowWater; } else { return ErrorNoProtocolOption; } @@ -229,7 +259,6 @@ int SetTcpLevelOption(std::uintptr_t native, bool tcp, int option, const void* v if (!tcp) return ErrorInvalid; if (option != GuestTcpNoDelay) return ErrorNoProtocolOption; if (length < sizeof(int)) return ErrorInvalid; - if (!value) return ErrorInvalid; int number; std::memcpy(&number, value, sizeof(number)); const int enabled = number != 0 ? 1 : 0; @@ -251,7 +280,6 @@ int SetIpv6LevelOption(std::uintptr_t native, bool ipv6, int option, const void* if (!ipv6) return ErrorInvalid; if (option != GuestIpv6Only) return ErrorNoProtocolOption; if (length != sizeof(int)) return ErrorInvalid; - if (!value) return ErrorInvalid; int number; std::memcpy(&number, value, sizeof(number)); const int enabled = number != 0 ? 1 : 0; diff --git a/core/libs/prx/libkernel/Socket/src/Udp.cpp b/core/libs/prx/libkernel/Socket/src/Udp.cpp index f17394f4e4..a63772505c 100644 --- a/core/libs/prx/libkernel/Socket/src/Udp.cpp +++ b/core/libs/prx/libkernel/Socket/src/Udp.cpp @@ -1113,6 +1113,7 @@ int APS5_VABI _fcntl_nid_postfix(int descriptor, int command, ...) { } int APS5_VABI setsockopt_nid_postfix(int descriptor, int level, int option, const void* value, std::uint32_t length) { + if (!value && length != 0) return Fail(14); int netError = 0; if (!GuestSockets::IsOpen(descriptor) && KernelSetSocketOption_nid_no_patch(descriptor, level, option, value, length, &netError)) { return netError == 0 ? 0 : Fail(netError); @@ -1124,7 +1125,7 @@ int APS5_VABI setsockopt_nid_postfix(int descriptor, int level, int option, const auto native = static_cast(socket->value); const int error = level == 6 ? GuestSockets::SetTcpLevelOption(native, socket->family != GuestUnix && socket->type == 1, option, value, length) : level == 41 ? GuestSockets::SetIpv6LevelOption(native, socket->family == 28, option, value, length) - : GuestSockets::SetSocketLevelOption(native, socket->options, option, value, length); + : GuestSockets::SetSocketLevelOption(native, socket->options, socket->family, socket->type, option, value, length); return error == 0 ? 0 : Fail(error); } int APS5_VABI getsockopt_nid_postfix(int descriptor, int level, int option, @@ -1133,11 +1134,12 @@ int APS5_VABI getsockopt_nid_postfix(int descriptor, int level, int option, if (!socket) return -1; if (level != 0xffff && level != 6 && level != 41) return Fail(42); if (!length) return Fail(22); + if (!value) *length = 0; std::lock_guard lock(socket->modeMutex); const auto native = static_cast(socket->value); const int error = level == 6 ? GuestSockets::GetTcpLevelOption(native, socket->family != GuestUnix && socket->type == 1, option, value, length) : level == 41 ? GuestSockets::GetIpv6LevelOption(native, socket->family == 28, option, value, length) - : GuestSockets::GetSocketLevelOption(native, socket->options, socket->type, option, value, length); + : GuestSockets::GetSocketLevelOption(native, socket->options, socket->family, socket->type, option, value, length); return error == 0 ? 0 : Fail(error); } int APS5_VABI socket_nid_postfix(int family, int type, int protocol) { @@ -1271,6 +1273,10 @@ int APS5_VABI accept_nid_postfix(int descriptor, void* address, std::uint32_t* l accepted->options.noSignal = listener->options.noSignal; accepted->options.sendTimeout = listener->options.sendTimeout; accepted->options.receiveTimeout = listener->options.receiveTimeout; + accepted->options.sendBuffer = listener->options.sendBuffer; + accepted->options.receiveBuffer = listener->options.receiveBuffer; + accepted->options.sendLowWater = listener->options.sendLowWater; + accepted->options.receiveLowWater = listener->options.receiveLowWater; } if (inheritNonblocking && SetNonBlocking(*accepted)) return -1; const int acceptedDescriptor = Install(std::move(accepted)); diff --git a/core/libs/tests/GuestSocketOptions.cpp b/core/libs/tests/GuestSocketOptions.cpp index 7ab20ba2f4..730c174523 100644 --- a/core/libs/tests/GuestSocketOptions.cpp +++ b/core/libs/tests/GuestSocketOptions.cpp @@ -14,6 +14,7 @@ int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t); int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*); int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t); int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*); +int APS5_VABI socketpair_nid_postfix(int, int, int, int*); int APS5_VABI fcntl_nid_postfix(int, int, ...); int APS5_VABI poll_nid_postfix(void*, std::uint32_t, int); int APS5_VABI close_nid_postfix(int); @@ -35,6 +36,9 @@ constexpr int SoReusePort = 0x200; constexpr int SoTimestamp = 0x400; constexpr int SoNoSigpipe = 0x800; constexpr int SoSendBuffer = 0x1001; +constexpr int SoReceiveBuffer = 0x1002; +constexpr int SoSendLowWater = 0x1003; +constexpr int SoReceiveLowWater = 0x1004; constexpr int SoError = 0x1007; constexpr int SoType = 0x1008; constexpr int ErrorInvalid = 22; @@ -204,6 +208,50 @@ void LengthsFollowFreeBsd() { Require(close_nid_postfix(stream) == 0, "close failed"); } +void BuffersFollowThePs5() { + const int stream = socket_nid_postfix(2, Stream, 0); + const int datagram = socket_nid_postfix(28, Datagram, 0); + Require(stream >= 0 && datagram >= 0, "socket failed"); + Require(GetInt(stream, SoSendBuffer) == 32768 && GetInt(stream, SoReceiveBuffer) == 65536, "a stream socket starts with 32768 and 65536 bytes"); + Require(GetInt(stream, SoSendLowWater) == 2048 && GetInt(stream, SoReceiveLowWater) == 1, "the low-water marks start at 2048 and 1"); + Require(GetInt(datagram, SoSendBuffer) == 9216 && GetInt(datagram, SoReceiveBuffer) == 42080, "a datagram socket starts with 9216 and 42080 bytes"); + SetInt(stream, SoSendBuffer, 1000); + Require(GetInt(stream, SoSendBuffer) == 1000 && GetInt(stream, SoSendLowWater) == 1000, "a smaller buffer is kept and lowers its low-water mark"); + SetInt(stream, SoReceiveBuffer, 524289); + Require(GetInt(stream, SoReceiveBuffer) == 524288, "a buffer above 512 KiB is limited to 524288 bytes"); + SetInt(stream, SoSendBuffer, 5592405); + Require(GetInt(stream, SoSendBuffer) == 524288, "the largest reservation is accepted and limited"); + const int tooLarge = 5592406; + Require(SetFails(stream, SolSocket, SoSendBuffer, &tooLarge, sizeof(tooLarge), 55), "a reservation above sb_max must fail with ENOBUFS (55)"); + Require(GetInt(stream, SoSendBuffer) == 524288, "a failed reservation keeps the buffer"); + SetInt(stream, SoReceiveLowWater, 600000); + Require(GetInt(stream, SoReceiveLowWater) == 524288, "a low-water mark above the buffer is limited to it"); + SetInt(stream, SoReceiveBuffer, 50); + Require(GetInt(stream, SoReceiveLowWater) == 50, "a smaller buffer lowers the low-water mark"); + const int zero = 0; + Require(SetFails(stream, SolSocket, SoReceiveLowWater, &zero, sizeof(zero), ErrorInvalid), "a low-water mark below 1 must fail with EINVAL (22)"); + int pair[2] = {-1, -1}; + Require(socketpair_nid_postfix(1, Stream, 0, pair) == 0, "socketpair failed"); + Require(GetInt(pair[0], SoSendBuffer) == 8192 && GetInt(pair[0], SoReceiveBuffer) == 8192, "an AF_UNIX stream socket starts with 8192 bytes each way"); + Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0, "close failed"); + Require(socketpair_nid_postfix(1, Datagram, 0, pair) == 0, "socketpair failed"); + Require(GetInt(pair[0], SoSendBuffer) == 2048 && GetInt(pair[0], SoReceiveBuffer) == 4096, "an AF_UNIX datagram socket starts with 2048 and 4096 bytes"); + Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0, "close failed"); + Require(close_nid_postfix(stream) == 0 && close_nid_postfix(datagram) == 0, "close failed"); +} + +void NullValues() { + const int stream = socket_nid_postfix(2, Stream, 0); + Require(stream >= 0, "socket failed"); + Require(SetFails(stream, SolSocket, SoKeepAlive, nullptr, sizeof(int), 14), "a null value with a length must fail with EFAULT (14)"); + Require(SetFails(-1, SolSocket, SoKeepAlive, nullptr, sizeof(int), 14), "the null value is checked before the descriptor"); + Require(SetFails(stream, SolSocket, 0x7fff, nullptr, sizeof(int), 14), "the null value is checked before the option"); + Require(SetFails(stream, SolSocket, SoKeepAlive, nullptr, 0, ErrorInvalid), "a null value without a length must fail with EINVAL (22)"); + std::uint32_t size = sizeof(int); + Require(getsockopt_nid_postfix(stream, SolSocket, SoSendBuffer, nullptr, &size) == 0 && size == 0, "getsockopt without a value succeeds with length 0"); + Require(close_nid_postfix(stream) == 0, "close failed"); +} + void UnknownRequestsFail() { const int stream = socket_nid_postfix(2, Stream, 0); Require(stream >= 0, "socket failed"); @@ -224,6 +272,8 @@ int main() { BooleanOptionsReportTheirBit(); LingerFollowsFreeBsd(); LengthsFollowFreeBsd(); + BuffersFollowThePs5(); + NullValues(); UnknownRequestsFail(); return 0; } diff --git a/core/libs/tests/GuestSocketStreamOptions.cpp b/core/libs/tests/GuestSocketStreamOptions.cpp index f85a693f17..2d03377a36 100644 --- a/core/libs/tests/GuestSocketStreamOptions.cpp +++ b/core/libs/tests/GuestSocketStreamOptions.cpp @@ -124,13 +124,13 @@ int main() { char received = 0; Require(Get(server, SocketLevel, NonBlockingOption) == 0); Require((fcntl_nid_postfix(server, GetStatusFlags) & NonBlockingFlag) == 0); - Require(Set(server, SocketLevel, NonBlockingOption, 5) && Get(server, SocketLevel, NonBlockingOption) == 1); + Require(Set(server, SocketLevel, NonBlockingOption, 5) && Get(server, SocketLevel, NonBlockingOption) == 0x100); Require((fcntl_nid_postfix(server, GetStatusFlags) & NonBlockingFlag) != 0); Require(Fails(recv_nid_postfix(server, &received, sizeof(received), 0), Again)); Require(Set(server, SocketLevel, NonBlockingOption, 0) && Get(server, SocketLevel, NonBlockingOption) == 0); Require((fcntl_nid_postfix(server, GetStatusFlags) & NonBlockingFlag) == 0); Require(Fails(setsockopt_nid_postfix(server, SocketLevel, NonBlockingOption, &one, sizeof(one) - 1), Invalid)); - Require(Set(datagram, SocketLevel, NonBlockingOption, 1) && Get(datagram, SocketLevel, NonBlockingOption) == 1); + Require(Set(datagram, SocketLevel, NonBlockingOption, 1) && Get(datagram, SocketLevel, NonBlockingOption) == 0x100); Require(Fails(recv_nid_postfix(datagram, &received, sizeof(received), 0), Again)); #ifndef _WIN32 diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md index 515c8d8c2b..0a121b798f 100644 --- a/docs/dev/debt/libkernel.md +++ b/docs/dev/debt/libkernel.md @@ -210,7 +210,11 @@ - [kevent on a pipe](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - host pipes are one-way, where FreeBSD's [`kern_pipe`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/sys_pipe.c#L422) opens both ends for reading and writing, so `EVFILT_READ` on the write end and `EVFILT_WRITE` on the read end throw; on macOS `EVFILT_WRITE` on a pipe throws, as the host has no call for a pipe's capacity. `EVFILT_WRITE` reports the free space of the host buffer, not of FreeBSD's 16 KiB one, and on Linux fires when the host says the pipe is writable rather than at `PIPE_BUF` (512) free bytes. Windows pipes cannot be waited on, so a kqueue waiting on one checks it every 1 ms. Otherwise [`filt_piperead`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/sys_pipe.c#L1787-L1828) and `filt_pipewrite` are followed: `EV_EOF` once the other end closes, `EPIPE` for a write event added after the read end closed, and `NOTE_LOWAT` ignored. On Windows `fcntl` cannot make a pipe write end non-blocking, so the full-pipe and drain case of `EVFILT_WRITE` is tested on Linux only and the `NtQueryInformationFile` write quota is checked there only for the free space, `EV_EOF` and `EPIPE`. - [kevent on a kqueue](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - `EVFILT_READ` on a kqueue counts the watched queue's enabled notes that are ready when it is evaluated, where [`filt_kqueue`](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/sys/kern/kern_event.c#L363-L370) reports `kq_count`, the queued notes: a queued note counts until that kqueue is scanned, even once disabled or no longer ready (a socket or pipe read empty, a user note cleared, a watched kqueue drained), so FreeBSD can report it readable where this reports nothing. A queued `EV_ONESHOT` note is reported there with its last count and deleted; here it is evaluated again and, if the watched queue is empty by then, neither reported nor deleted. `EV_CLEAR` throws, as FreeBSD re-arms it only when the watched kqueue queues a note. A cycle of watches throws; a note on the queue itself is `EINVAL`. Not measured on a console - [Socket error numbers](../../../core/libs/prx/libkernel/Socket/include/SocketError.hpp) (libkernel) - a host socket error becomes the FreeBSD 11 `errno.h` number of the same name; the numbers are not checked on the console. Winsock `WSAESHUTDOWN` becomes `EPIPE`, as a send after `shutdown` does on FreeBSD, and a host error with no FreeBSD socket counterpart becomes `EIO`. On Windows a refused nonblocking `connect` is never reported (`SO_ERROR` is unsupported), so a repeated one keeps reporting `EALREADY` where FreeBSD reports `ECONNREFUSED`. A receive after `shutdown(SHUT_RD)` reports `EPIPE` on Windows where FreeBSD returns 0 -- [getsockopt, setsockopt](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) on a guest socket handle the SOL_SOCKET level, `TCP_NODELAY` and `IPV6_V6ONLY`, after FreeBSD 11.4's [`sosetopt` and `sogetopt`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c): `SO_REUSEADDR`, `SO_KEEPALIVE`, `SO_DONTROUTE`, `SO_BROADCAST`, `SO_OOBINLINE` and `SO_LINGER` act on the host socket, and `SO_ERROR`, `SO_TYPE`, `SO_ACCEPTCONN`, `SO_SNDBUF` and `SO_RCVBUF` are read. A boolean option reads back as its own bit, as FreeBSD returns `so_options & option`. Winsock does not clear a socket's pending error when it is read, so on Windows the library reports a pending error once and shows it again only after a new `connect`; a second failure with the same code on the same socket without a `connect` in between would be hidden. `SO_SNDBUF` and `SO_RCVBUF` read the host's value, which is not the size FreeBSD reports (Linux doubles it). `SO_NOSIGPIPE` is kept per socket and reads back as its bit. On Linux a `send`, `sendto`, `sendmsg` or `write` on that socket passes `MSG_NOSIGNAL` to the host, as [`kern_sendit`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L890-L895) and [`soo_write`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L147-L151) leave out the signal. An accepted socket takes it from its listener, as [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) copies the options. `SO_NBIO` (`0x1200`) is the console's own option, not FreeBSD's. It switches the socket between blocking and non-blocking as `FIONBIO` does and reads back as 0 or 1, as `sceNetSetsockopt` and `sceNetGetsockopt` treat it here; what the console reads back for it is not measured. `TCP_NODELAY` (`IPPROTO_TCP`, 1) is set on the host socket and reads back as `TF_NODELAY` (4), as [`tcp_default_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet/tcp_usrreq.c#L1860-L1861) returns it. The `IPPROTO_TCP` level on a datagram or `AF_UNIX` socket fails with `EINVAL`, as [`ip_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet/ip_output.c#L943-L944) and [`uipc_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_usrreq.c#L1228-L1229) answer it, and an accepted socket takes `TCP_NODELAY` through the host. `SO_SNDTIMEO` and `SO_RCVTIMEO` follow [`sosetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2657-L2689) and [`sogetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2846-L2850). A 16-byte `timeval` with a negative field or 1000000 microseconds or more fails with `EDOM`, and more than `INT32_MAX` seconds becomes the longest wait. The value is kept and read back through FreeBSD's 32.32 fixed-point conversion ([`tvtosbt`, `sbttotv`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/sys/time.h#L178-L286)), so half a second reads back as 499999 microseconds and one microsecond as 0. A `recv`, `recvfrom`, `recvmsg`, `read` or `readv`, and a `send`, `sendto`, `sendmsg`, `write` or `writev`, on a blocking socket then waits that long for the host to report the socket readable or writable, and fails with `EWOULDBLOCK`; a call with `MSG_DONTWAIT` does not wait. An accepted socket takes both from its listener ([`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L629-L630)). The wait covers only the first transfer: once the socket is writable the host send runs without a limit, where FreeBSD stops a send that cannot finish and returns the bytes sent so far, and a receive whose data another thread takes between the wait and the host call blocks again. `sendfile` ignores the send timeout. The host wait has millisecond steps, so a shorter timeout lasts up to a millisecond longer. A null value fails with `EINVAL`, where FreeBSD's [`kern_setsockopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L1414-L1415) returns `EFAULT`. `IPV6_V6ONLY` (`IPPROTO_IPV6`, 27) on an `AF_INET6` socket is set on the host socket and reads back as 0 or 1, after FreeBSD's [`ip6_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1716-L1732): a value that is not exactly an `int` fails with `EINVAL` ([L1572](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1572)), as does setting it on a bound socket, which the host refuses too. `socket` turns it on for every `AF_INET6` socket, as FreeBSD's default `net.inet6.ip6.v6only` does, and Java turns it off on the sockets it opens: Java 25 Advanced Network (PPSA99871) stops at `java.net.SocketException: Protocol not available` without it. The `IPPROTO_IPV6` level on an `AF_INET` or `AF_UNIX` socket fails with `EINVAL`, as `ip_ctloutput` and `uipc_ctloutput` answer it. Every other SOL_SOCKET option (`SO_DEBUG`, `SO_USELOOPBACK`, `SO_REUSEPORT` and `SO_TIMESTAMP`, which FreeBSD stores, the low-water marks among them; PPSA99871 sets `SO_REUSEPORT` and carries on when it fails), every other `IPPROTO_TCP` option (`TCP_MAXSEG`, `TCP_KEEPIDLE`, `TCP_KEEPINTVL` and `TCP_KEEPCNT` among them), every other `IPPROTO_IPV6` option ([L1928-L1929](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1928-L1929), [L2158-L2159](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L2158-L2159)) and the `IPPROTO_IP` level fail with `ENOPROTOOPT`. None of this was measured on a console. +- [getsockopt, setsockopt](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - a guest socket has the SOL_SOCKET level, `TCP_NODELAY` and `IPV6_V6ONLY`. `SO_DEBUG`, `SO_REUSEPORT` and `SO_TIMESTAMP`, `IP_TTL` and `IP_TOS`, `TCP_MAXSEG` and `TCP_KEEPIDLE` fail with `ENOPROTOOPT` (42), where a payload process on a PS5 (firmware 13.60) accepted them and read back their bit, 64, 0, 536 and 7200; the rest of the `IPPROTO_IP` level, the other `IPPROTO_TCP` and `IPPROTO_IPV6` options and `SO_USELOOPBACK` fail the same way and were not measured. `SO_REUSEADDR`, `SO_KEEPALIVE`, `SO_DONTROUTE`, `SO_BROADCAST`, `SO_OOBINLINE` and `SO_LINGER` act on the host socket, and a boolean option reads back as its own bit, as there. Winsock does not clear a pending error when `SO_ERROR` reads it, so on Windows a pending error is reported once and again only after a new `connect`; a second failure with the same code without a `connect` in between is hidden +- [SO_SNDBUF, SO_RCVBUF, SO_SNDLOWAT, SO_RCVLOWAT](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket with the defaults, the 524288-byte limit, the `ENOBUFS` above 5592405 bytes and the low-water clipping of a payload process on a PS5 (firmware 13.60), and the host socket gets the same size. The host's real buffering, FreeBSD's automatic growth of a connected TCP socket's buffers, and a low-water mark's effect on `select`, `poll` and a receive are not reproduced. An accepted socket takes all four from its listener, as FreeBSD's [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) does; that was not measured +- [SO_NOSIGPIPE](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket and read back as its bit. On Linux a `send`, `sendto`, `sendmsg` or `write` on that socket passes `MSG_NOSIGNAL` to the host, as [`kern_sendit`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L890-L895) and [`soo_write`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L147-L151) leave out the signal, and an accepted socket takes it from its listener, as [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) copies the options. Not measured on a console +- [SO_SNDTIMEO, SO_RCVTIMEO](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - the value checks and the 32.32 fixed-point read-back follow [`sosetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2657-L2689), as a payload process on a PS5 (firmware 13.60) answered them. A receive or send on a blocking socket waits that long for the host to report the socket readable or writable and fails with `EWOULDBLOCK`, but only before the first transfer: once writable the host send has no limit, where FreeBSD returns the bytes sent so far, and a receive whose data another thread takes after the wait blocks again. `sendfile` ignores the send timeout, the host wait has millisecond steps, and an accepted socket takes both from its listener +- [IPV6_V6ONLY](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - the `IPPROTO_IPV6` option 27 is set on the host socket and reads back as 0 or 1, after FreeBSD's [`ip6_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1716-L1732): a value that is not exactly an `int` fails with `EINVAL`, as does setting it on a bound socket, which the host refuses too. `socket` turns it on for every `AF_INET6` socket, as a payload process on a PS5 (firmware 13.60) reported, and Java turns it off on the sockets it opens: Java 25 Advanced Network (PPSA99871) stops at `java.net.SocketException: Protocol not available` without it. The value checks and the bound-socket answer were not measured - [connect to AF_UNSPEC](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) dissolves a datagram association as FreeBSD 11.4's `udp_disconnect()` does, which resets the local address to the wildcard address and keeps the port. On Linux a socket bound to an explicit port keeps its local address as well (`127.0.0.1:` stays `127.0.0.1:`), because a bound socket cannot be bound again; one bound to port 0 is bound again to the wildcard address with the port it had - [connect](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - `connect` to port 0 on an unconnected `AF_INET` or `AF_INET6` stream or datagram socket fails with `EADDRNOTAVAIL` (49), as FreeBSD 11.4's `in_pcbconnect_setup()` and `in6_pcbconnect()` do. A connected stream socket keeps its host `EISCONN` answer. Known gaps: on an already connected datagram socket `connect` to port 0 keeps the old peer, where FreeBSD's `soconnect()` disconnects first and then fails with 49; `sendto` and `sendmsg` to port 0 on an `AF_INET` datagram socket fail with 49 unless the socket is bound to a specific address and port and the destination is neither `INADDR_ANY` nor `INADDR_BROADCAST`, which is the path where `udp_output()` skips `in_pcbconnect_setup()` and FreeBSD sends to port 0. There nothing can receive on port 0, so the call returns the length without the host, because Linux's `udp_sendmsg` refuses port 0 with `EINVAL`; an `AF_INET6` socket still goes to the host. The answers are taken from the FreeBSD source and are not measured on a console. [sceNetConnect](../../../core/libs/prx/libSceNet/Export.cpp) is not changed - [msync](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) follows FreeBSD 11's `kern_msync` and `vm_map_sync`, not measured on the console: the address is rounded down to the page, a range that wraps is `EINVAL`, as is `MS_ASYNC` with `MS_INVALIDATE`, and a range whose start or any page is not mapped (as `sceKernelVirtualQuery` reports it, reservations included) is `ENOMEM`; a page unmapped from inside a larger mapping still counts as mapped there, since `sceKernelVirtualQuery` keeps reporting the whole mapping. The guest has no file mappings, so a successful call writes nothing back. `MS_INVALIDATE` on a mapped range throws: FreeBSD returns `EBUSY` when the range holds `mlock`ed pages, and locked pages are not tracked From d8d03c2839f16779e651b1fd4ab253dfa393de00 Mon Sep 17 00:00:00 2001 From: orezraey Date: Fri, 23 Oct 2026 15:16:09 -0300 Subject: [PATCH 075/113] fix(libkernel): give the host the requested socket buffer and test the inherited sizes Co-Authored-By: Claude Opus 5.5 --- .../prx/libkernel/Socket/src/SocketOptions.cpp | 7 +++---- core/libs/tests/GuestSocketOptions.cpp | 14 ++++++++++++++ docs/dev/debt/libkernel.md | 2 +- 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp index 77abe31e34..88a166ab74 100644 --- a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp +++ b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp @@ -108,7 +108,7 @@ void EnsureBuffers(SocketOptionState& state, int family, int type) { } int Copy(void* output, std::uint32_t* length, const void* value, std::uint32_t size) { - const std::uint32_t count = std::min(*length, size); + const std::uint32_t count = output ? std::min(*length, size) : 0; if (count != 0) std::memcpy(output, value, count); *length = count; return 0; @@ -179,10 +179,9 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int fa return 0; } if (number > MaximumReservation) return ErrorNoBuffers; - const int reserved = std::min(number, MaximumBuffer); const int nativeOption = send ? SO_SNDBUF : SO_RCVBUF; - if (::setsockopt(handle, SOL_SOCKET, nativeOption, reinterpret_cast(&reserved), sizeof(reserved))) return HostError(); - size = reserved; + if (::setsockopt(handle, SOL_SOCKET, nativeOption, reinterpret_cast(&number), sizeof(number))) return HostError(); + size = std::min(number, MaximumBuffer); mark = std::min(mark, size); return 0; } diff --git a/core/libs/tests/GuestSocketOptions.cpp b/core/libs/tests/GuestSocketOptions.cpp index 730c174523..3f9d26467f 100644 --- a/core/libs/tests/GuestSocketOptions.cpp +++ b/core/libs/tests/GuestSocketOptions.cpp @@ -238,6 +238,20 @@ void BuffersFollowThePs5() { Require(GetInt(pair[0], SoSendBuffer) == 2048 && GetInt(pair[0], SoReceiveBuffer) == 4096, "an AF_UNIX datagram socket starts with 2048 and 4096 bytes"); Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0, "close failed"); Require(close_nid_postfix(stream) == 0 && close_nid_postfix(datagram) == 0, "close failed"); + const int listener = socket_nid_postfix(2, Stream, 0); + Require(listener >= 0, "socket failed"); + auto address = Loopback(0); + Require(bind_nid_postfix(listener, address.data(), address.size()) == 0 && listen_nid_postfix(listener, 1) == 0, "listen failed"); + std::uint32_t size = address.size(); + Require(getsockname_nid_postfix(listener, address.data(), &size) == 0, "getsockname failed"); + SetInt(listener, SoReceiveBuffer, 3000); + SetInt(listener, SoSendLowWater, 700); + const int client = socket_nid_postfix(2, Stream, 0); + Require(client >= 0 && connect_nid_postfix(client, address.data(), address.size()) == 0, "connect failed"); + const int accepted = accept_nid_postfix(listener, nullptr, nullptr); + Require(accepted >= 0, "accept failed"); + Require(GetInt(accepted, SoReceiveBuffer) == 3000 && GetInt(accepted, SoSendLowWater) == 700 && GetInt(accepted, SoSendBuffer) == 32768, "an accepted socket takes the listener's buffers"); + Require(close_nid_postfix(accepted) == 0 && close_nid_postfix(client) == 0 && close_nid_postfix(listener) == 0, "close failed"); } void NullValues() { diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md index 0a121b798f..6bcf1a0608 100644 --- a/docs/dev/debt/libkernel.md +++ b/docs/dev/debt/libkernel.md @@ -211,7 +211,7 @@ - [kevent on a kqueue](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - `EVFILT_READ` on a kqueue counts the watched queue's enabled notes that are ready when it is evaluated, where [`filt_kqueue`](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/sys/kern/kern_event.c#L363-L370) reports `kq_count`, the queued notes: a queued note counts until that kqueue is scanned, even once disabled or no longer ready (a socket or pipe read empty, a user note cleared, a watched kqueue drained), so FreeBSD can report it readable where this reports nothing. A queued `EV_ONESHOT` note is reported there with its last count and deleted; here it is evaluated again and, if the watched queue is empty by then, neither reported nor deleted. `EV_CLEAR` throws, as FreeBSD re-arms it only when the watched kqueue queues a note. A cycle of watches throws; a note on the queue itself is `EINVAL`. Not measured on a console - [Socket error numbers](../../../core/libs/prx/libkernel/Socket/include/SocketError.hpp) (libkernel) - a host socket error becomes the FreeBSD 11 `errno.h` number of the same name; the numbers are not checked on the console. Winsock `WSAESHUTDOWN` becomes `EPIPE`, as a send after `shutdown` does on FreeBSD, and a host error with no FreeBSD socket counterpart becomes `EIO`. On Windows a refused nonblocking `connect` is never reported (`SO_ERROR` is unsupported), so a repeated one keeps reporting `EALREADY` where FreeBSD reports `ECONNREFUSED`. A receive after `shutdown(SHUT_RD)` reports `EPIPE` on Windows where FreeBSD returns 0 - [getsockopt, setsockopt](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - a guest socket has the SOL_SOCKET level, `TCP_NODELAY` and `IPV6_V6ONLY`. `SO_DEBUG`, `SO_REUSEPORT` and `SO_TIMESTAMP`, `IP_TTL` and `IP_TOS`, `TCP_MAXSEG` and `TCP_KEEPIDLE` fail with `ENOPROTOOPT` (42), where a payload process on a PS5 (firmware 13.60) accepted them and read back their bit, 64, 0, 536 and 7200; the rest of the `IPPROTO_IP` level, the other `IPPROTO_TCP` and `IPPROTO_IPV6` options and `SO_USELOOPBACK` fail the same way and were not measured. `SO_REUSEADDR`, `SO_KEEPALIVE`, `SO_DONTROUTE`, `SO_BROADCAST`, `SO_OOBINLINE` and `SO_LINGER` act on the host socket, and a boolean option reads back as its own bit, as there. Winsock does not clear a pending error when `SO_ERROR` reads it, so on Windows a pending error is reported once and again only after a new `connect`; a second failure with the same code without a `connect` in between is hidden -- [SO_SNDBUF, SO_RCVBUF, SO_SNDLOWAT, SO_RCVLOWAT](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket with the defaults, the 524288-byte limit, the `ENOBUFS` above 5592405 bytes and the low-water clipping of a payload process on a PS5 (firmware 13.60), and the host socket gets the same size. The host's real buffering, FreeBSD's automatic growth of a connected TCP socket's buffers, and a low-water mark's effect on `select`, `poll` and a receive are not reproduced. An accepted socket takes all four from its listener, as FreeBSD's [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) does; that was not measured +- [SO_SNDBUF, SO_RCVBUF, SO_SNDLOWAT, SO_RCVLOWAT](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket with the defaults, the 524288-byte limit, the `ENOBUFS` above 5592405 bytes and the low-water clipping of a payload process on a PS5 (firmware 13.60); the host socket gets the size asked for, so a request above the limit still enlarges the host's buffer. The host's real buffering, FreeBSD's automatic growth of a connected TCP socket's buffers, and a low-water mark's effect on `select`, `poll` and a receive are not reproduced. An accepted socket takes all four from its listener, as FreeBSD's [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) does; that was not measured - [SO_NOSIGPIPE](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket and read back as its bit. On Linux a `send`, `sendto`, `sendmsg` or `write` on that socket passes `MSG_NOSIGNAL` to the host, as [`kern_sendit`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L890-L895) and [`soo_write`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L147-L151) leave out the signal, and an accepted socket takes it from its listener, as [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) copies the options. Not measured on a console - [SO_SNDTIMEO, SO_RCVTIMEO](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - the value checks and the 32.32 fixed-point read-back follow [`sosetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2657-L2689), as a payload process on a PS5 (firmware 13.60) answered them. A receive or send on a blocking socket waits that long for the host to report the socket readable or writable and fails with `EWOULDBLOCK`, but only before the first transfer: once writable the host send has no limit, where FreeBSD returns the bytes sent so far, and a receive whose data another thread takes after the wait blocks again. `sendfile` ignores the send timeout, the host wait has millisecond steps, and an accepted socket takes both from its listener - [IPV6_V6ONLY](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - the `IPPROTO_IPV6` option 27 is set on the host socket and reads back as 0 or 1, after FreeBSD's [`ip6_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1716-L1732): a value that is not exactly an `int` fails with `EINVAL`, as does setting it on a bound socket, which the host refuses too. `socket` turns it on for every `AF_INET6` socket, as a payload process on a PS5 (firmware 13.60) reported, and Java turns it off on the sockets it opens: Java 25 Advanced Network (PPSA99871) stops at `java.net.SocketException: Protocol not available` without it. The value checks and the bound-socket answer were not measured From da511cb29c757f8517479edfbef21a8cfbc478fe Mon Sep 17 00:00:00 2001 From: roboterspinne <229981445+roboterspinne@users.noreply.github.com> Date: Fri, 23 Oct 2026 18:47:25 +0000 Subject: [PATCH 076/113] refactor(relinker): remove relocation types validation already rejects ValidationPolicy rejects R_X86_64_GOT32, PLT32, GOTPCREL, 32S, GOTPCRELX and REX_GOTPCRELX for every DT_RELA and DT_JMPREL entry before the Linux patcher runs, so the R_X86_64_32S case of the fixed-base relocation list cannot be reached. It was the only user of R_X86_64_32S, and the other five constants have none. Remove the case and the six constants; no behaviour changes. --- .../elfpatcher/include/elfpatcher/general/ElfConstants.hpp | 6 ------ core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp | 1 - 2 files changed, 7 deletions(-) diff --git a/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp b/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp index 78ed999eab..b8b6b853b6 100644 --- a/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp +++ b/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp @@ -139,20 +139,14 @@ inline constexpr std::int64_t DT_OS_SYMTABSZ = 0x6100003f; inline constexpr std::uint32_t R_X86_64_NONE = 0; inline constexpr std::uint32_t R_X86_64_64 = 1; inline constexpr std::uint32_t R_X86_64_PC32 = 2; -inline constexpr std::uint32_t R_X86_64_GOT32 = 3; -inline constexpr std::uint32_t R_X86_64_PLT32 = 4; inline constexpr std::uint32_t R_X86_64_COPY = 5; inline constexpr std::uint32_t R_X86_64_GLOB_DAT = 6; inline constexpr std::uint32_t R_X86_64_JUMP_SLOT = 7; inline constexpr std::uint32_t R_X86_64_RELATIVE = 8; -inline constexpr std::uint32_t R_X86_64_GOTPCREL = 9; inline constexpr std::uint32_t R_X86_64_32 = 10; -inline constexpr std::uint32_t R_X86_64_32S = 11; inline constexpr std::uint32_t R_X86_64_DTPMOD64 = 16; inline constexpr std::uint32_t R_X86_64_DTPOFF64 = 17; inline constexpr std::uint32_t R_X86_64_TPOFF64 = 18; -inline constexpr std::uint32_t R_X86_64_GOTPCRELX = 41; -inline constexpr std::uint32_t R_X86_64_REX_GOTPCRELX = 42; inline constexpr std::uint32_t R_X86_64_IRELATIVE = 37; inline constexpr std::uint8_t STB_GLOBAL = 1; diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp index 7453d82aca..b2f84ae52d 100644 --- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp +++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp @@ -85,7 +85,6 @@ std::vector RebasedRelocations(const std::vector& ta case R_X86_64_GLOB_DAT: case R_X86_64_JUMP_SLOT: case R_X86_64_32: - case R_X86_64_32S: case R_X86_64_DTPMOD64: case R_X86_64_DTPOFF64: case R_X86_64_TPOFF64: From 0aef357591a6d656d813997ec3598900b14187d4 Mon Sep 17 00:00:00 2001 From: cadenasynyster <8373765+cadenasynyster@users.noreply.github.com> Date: Fri, 23 Oct 2026 21:17:33 +0200 Subject: [PATCH 077/113] fix(libkernel_sys): report ELOOP from mkdirat through a Windows symlink loop on a descriptor On Windows, mkdirat with a directory descriptor and a relative path that goes through a symbolic link pointing to itself reported EIO. CreateDirectoryW fails with ERROR_CANT_RESOLVE_FILENAME for such a path, and the error mapping had no case for it, so it fell through to GuestEio. FreeBSD fails the lookup with ELOOP. The path form of mkdir and openat with the same descriptor already return ELOOP. ERROR_CANT_RESOLVE_FILENAME now gives ELOOP. guest_kernel_sys gains a Windows check with a file-type and a directory-type self-loop: mkdirat through the loop returns ELOOP and mkdirat of the link itself still returns EEXIST. The check is skipped when the host denies symbolic link creation. --- core/libs/prx/libkernel_sys/Export.cpp | 1 + core/libs/tests/GuestKernelSys.cpp | 13 +++++++++++++ 2 files changed, 14 insertions(+) diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp index e9546a3d34..6266663bf3 100644 --- a/core/libs/prx/libkernel_sys/Export.cpp +++ b/core/libs/prx/libkernel_sys/Export.cpp @@ -547,6 +547,7 @@ int APS5_VABI mkdirat_nid_postfix(int fd, const char* path, std::uint16_t mode) if (code == ERROR_ALREADY_EXISTS || code == ERROR_FILE_EXISTS) return static_cast(Fail(GuestEexist)); if (code == ERROR_ACCESS_DENIED) return static_cast(Fail(GuestEperm)); if (code == ERROR_FILENAME_EXCED_RANGE) return static_cast(Fail(GuestEnametoolong)); + if (code == ERROR_CANT_RESOLVE_FILENAME) return static_cast(Fail(GuestEloop)); if (code == ERROR_PATH_NOT_FOUND) { if (HasNonDirectoryPrefix(native)) return static_cast(Fail(GuestEnotdir)); return static_cast(Fail(GuestEnoent)); diff --git a/core/libs/tests/GuestKernelSys.cpp b/core/libs/tests/GuestKernelSys.cpp index a540b9b666..19da282cfc 100644 --- a/core/libs/tests/GuestKernelSys.cpp +++ b/core/libs/tests/GuestKernelSys.cpp @@ -677,6 +677,19 @@ int main() { const std::string longName(256, 'a'); Require(mkdirat_nid_postfix(base, longName.c_str(), 0700) == -1 && Error() == 63); Require(mkdirat_nid_postfix(base, "dir/../dotdot_dir", 0700) == 0 && std::filesystem::is_directory(root / "dotdot_dir")); +#ifdef _WIN32 + for (const DWORD linkFlags : {DWORD(0), DWORD(SYMBOLIC_LINK_FLAG_DIRECTORY)}) { + const auto loopLink = root / "mkdirat_loop"; + if (CreateSymbolicLinkW(loopLink.c_str(), L"mkdirat_loop", linkFlags | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) == 0) { + Require(GetLastError() == ERROR_PRIVILEGE_NOT_HELD); + std::fprintf(stderr, "symbolic links unavailable: the mkdirat loop case not tested\n"); + break; + } + Require(mkdirat_nid_postfix(base, "mkdirat_loop/child", 0700) == -1 && Error() == 62); + Require(mkdirat_nid_postfix(base, "mkdirat_loop", 0700) == -1 && Error() == 17); + Require((linkFlags != 0 ? RemoveDirectoryW(loopLink.c_str()) : DeleteFileW(loopLink.c_str())) != 0); + } +#endif Require(unlinkat_nid_postfix(plain, "file.txt", 0) == -1 && Error() == 20); Require(unlinkat_nid_postfix(-1, "file.txt", 0) == -1 && Error() == 9); Require(sceKernelClose(plain) == 0); From 98f9a89877eccffd6e6c66b3df8c321e87fbda13 Mon Sep 17 00:00:00 2001 From: SandstromPL Date: Wed, 21 Oct 2026 21:59:55 +0530 Subject: [PATCH 078/113] test(agc): honor ANYPS5_GPU in the fixtures that open their own Vulkan device Seven AGC fixtures create their own Vulkan instance and take the first enumerated device or choose one by device type, without reading ANYPS5_GPU: PresentationPass, DepthPlaneGuestLayers, DepthStorage, DepthSurfaceLastWriter, OversizedDescriptorSets, PartiallyResidentSnapshot and SparseBufferHoles. With a name that matches no device they still pass on whichever GPU came first, so a run meant for one GPU can report results from another. They now pick their device through one shared helper with the driver's rule: among Vulkan 1.1 devices, the first whose name contains ANYPS5_GPU ignoring case, otherwise the first of the highest-ranked device type. A name that matches nothing throws with the device names, which these fixtures report as a skip, or as a failure under ANYPS5_REQUIRE_VULKAN. A CPU test covers the selection and the error message. Co-Authored-By: Claude Opus 5.5 --- .../tests/PresentationPass.cpp | 3 +- .../tests/execution/DepthPlaneGuestLayers.cpp | 3 +- .../tests/execution/DepthStorage.cpp | 3 +- .../execution/DepthSurfaceLastWriter.cpp | 3 +- .../execution/FixtureDeviceSelection.cpp | 100 ++++++++++++++++++ .../execution/FixtureDeviceSelection.hpp | 57 ++++++++++ .../execution/OversizedDescriptorSets.cpp | 11 +- .../execution/PartiallyResidentSnapshot.cpp | 3 +- .../tests/execution/SparseBufferHoles.cpp | 14 +-- 9 files changed, 171 insertions(+), 26 deletions(-) create mode 100644 core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp create mode 100644 core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp diff --git a/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp b/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp index f55704d524..b5887de16a 100644 --- a/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp @@ -7,6 +7,7 @@ #include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp" #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp" #include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp" +#include "execution/FixtureDeviceSelection.hpp" #include #include #include @@ -56,7 +57,7 @@ public: Require(count != 0, "no Vulkan device"); std::vector devices(count); Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices"); - context.physical = devices.front(); + context.physical = SelectFixturePhysicalDevice(devices, function("vkGetPhysicalDeviceProperties")); const auto queues = function("vkGetPhysicalDeviceQueueFamilyProperties"); queues(context.physical, &count, nullptr); std::vector families(count); diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp index cdb94c5363..db4b9a1841 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp @@ -7,6 +7,7 @@ #include "prx/libc/include/GuestAllocations.hpp" #include "prx/libc/include/GuestArena.hpp" #include "prx/libc/include/GuestWriteWatch.hpp" +#include "FixtureDeviceSelection.hpp" #include #ifdef _WIN32 #ifndef NOMINMAX @@ -93,7 +94,7 @@ public: Require(count != 0, "no Vulkan device"); std::vector devices(count); Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices"); - context.physical = devices.front(); + context.physical = SelectFixturePhysicalDevice(devices, function("vkGetPhysicalDeviceProperties")); const auto extensions = function("vkEnumerateDeviceExtensionProperties"); Check(extensions(context.physical, nullptr, &count, nullptr), "vkEnumerateDeviceExtensionProperties"); std::vector available(count); diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp index 27236f4199..fcd33dfb24 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp @@ -10,6 +10,7 @@ #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp" #include "prx/libc/include/GuestAllocations.hpp" #include "VulkanTestDevice.hpp" +#include "FixtureDeviceSelection.hpp" #include #include #include @@ -59,7 +60,7 @@ public: Require(count != 0, "no Vulkan device"); std::vector devices(count); Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices"); - context.physical = devices.front(); + context.physical = SelectFixturePhysicalDevice(devices, function("vkGetPhysicalDeviceProperties")); const auto extensions = function("vkEnumerateDeviceExtensionProperties"); Check(extensions(context.physical, nullptr, &count, nullptr), "vkEnumerateDeviceExtensionProperties"); std::vector available(count); diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp index b7f809f6ee..8afad65394 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp @@ -4,6 +4,7 @@ #include "prx/libc/include/GuestArena.hpp" #include "prx/libc/include/GuestWriteWatch.hpp" #include "VulkanTestDevice.hpp" +#include "FixtureDeviceSelection.hpp" #include #ifdef _WIN32 #ifndef NOMINMAX @@ -54,7 +55,7 @@ public: Require(count != 0, "no Vulkan device"); std::vector devices(count); Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices"); - context.physical = devices.front(); + context.physical = SelectFixturePhysicalDevice(devices, function("vkGetPhysicalDeviceProperties")); const auto queues = function("vkGetPhysicalDeviceQueueFamilyProperties"); queues(context.physical, &count, nullptr); std::vector families(count); diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp new file mode 100644 index 0000000000..6350f326e5 --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp @@ -0,0 +1,100 @@ +#include "FixtureDeviceSelection.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include + +namespace { + +void Require(bool condition, const std::string& message) { + if (!condition) throw std::runtime_error(message); +} + +void SetRequest(const char* value) { +#ifdef _WIN32 + if (_putenv_s("ANYPS5_GPU", value) != 0) throw std::runtime_error("cannot set ANYPS5_GPU"); +#else + if (setenv("ANYPS5_GPU", value, 1) != 0) throw std::runtime_error("cannot set ANYPS5_GPU"); +#endif +} + +VkPhysicalDeviceProperties Properties(const char* name, VkPhysicalDeviceType type) { + VkPhysicalDeviceProperties result{}; + result.apiVersion = VK_API_VERSION_1_1; + result.deviceType = type; + std::memcpy(result.deviceName, name, std::strlen(name) + 1u); + return result; +} + +std::array described{ + Properties("llvmpipe (LLVM 20.1.2, 256 bits)", VK_PHYSICAL_DEVICE_TYPE_CPU), + Properties("AMD Radeon(TM) Graphics", VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU), + Properties("NVIDIA GeForce RTX 5080", VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU), +}; + +VkPhysicalDevice Handle(std::size_t index) { + return reinterpret_cast(static_cast(index + 1u)); +} + +void VKAPI_CALL Describe(VkPhysicalDevice device, VkPhysicalDeviceProperties* properties) { + *properties = described[reinterpret_cast(device) - 1u]; +} + +std::string SelectionError(const char* request) { + SetRequest(request); + try { + static_cast(SelectFixturePhysicalDevice(std::array{Handle(0), Handle(1), Handle(2)}, Describe)); + } catch (const std::runtime_error& error) { + return error.what(); + } + throw std::runtime_error(std::string("ANYPS5_GPU=\"") + request + "\" selected a device"); +} + +void SelectionTests() { + std::array devices = described; + Require(!SelectFixtureDevice({}, {}).has_value(), "an empty device list selected a device"); + Require(SelectFixtureDevice(devices, {}) == 2u, "default selection did not prefer the discrete GPU"); + Require(SelectFixtureDevice(std::span(devices).first(2), {}) == 1u, "default selection did not prefer the integrated GPU to the CPU device"); + Require(SelectFixtureDevice(devices, "AMD") == 1u, "an AMD request lost to the discrete GPU"); + Require(SelectFixtureDevice(devices, "aMd rAdEoN") == 1u, "GPU name matching was not case-insensitive"); + Require(SelectFixtureDevice(devices, "RTX 5080") == 2u, "partial GPU name matching failed"); + Require(SelectFixtureDevice(devices, "llvmpipe") == 0u, "a requested CPU device was not selected"); + Require(!SelectFixtureDevice(devices, "missing device").has_value(), "an unmatched GPU request selected a device"); + Require(!SelectFixtureDevice(devices, "NVIDIA GeForce RTX 5080 with a longer name").has_value(), "a request longer than the device name matched"); + devices[0] = devices[1]; + Require(SelectFixtureDevice(devices, "AMD") == 0u, "equally ranked matches did not keep enumeration order"); + devices[1].apiVersion = VK_API_VERSION_1_0; + devices[2].apiVersion = VK_API_VERSION_1_0; + Require(!SelectFixtureDevice(devices, "NVIDIA").has_value(), "a requested device without Vulkan 1.1 was selected"); +} + +void EnvironmentTests() { + const std::array handles{Handle(0), Handle(1), Handle(2)}; + SetRequest(""); + Require(SelectFixturePhysicalDevice(handles, Describe) == Handle(2), "an empty ANYPS5_GPU did not select the discrete GPU"); + SetRequest("radeon"); + Require(SelectFixturePhysicalDevice(handles, Describe) == Handle(1), "ANYPS5_GPU=radeon did not select the integrated GPU"); + SetRequest("LLVMPIPE"); + Require(SelectFixturePhysicalDevice(handles, Describe) == Handle(0), "ANYPS5_GPU=LLVMPIPE did not select the CPU device"); + const std::string error = SelectionError("no such device 1d3d154f"); + Require(error == "no Vulkan 1.1 device whose name contains ANYPS5_GPU=\"no such device 1d3d154f\"; devices: llvmpipe (LLVM 20.1.2, 256 bits), AMD Radeon(TM) Graphics, NVIDIA GeForce RTX 5080", "unexpected error: " + error); +} + +} + +int main() { + try { + SelectionTests(); + EnvironmentTests(); + std::puts("fixture device selection tests passed"); + return 0; + } catch (const std::exception& error) { + std::cerr << error.what() << '\n'; + return 1; + } +} diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp new file mode 100644 index 0000000000..7bc494e0ec --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp @@ -0,0 +1,57 @@ +#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_TESTS_EXECUTION_FIXTUREDEVICESELECTION_HPP +#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_TESTS_EXECUTION_FIXTUREDEVICESELECTION_HPP + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +inline std::optional SelectFixtureDevice(std::span devices, std::string_view request) { + const auto rankDeviceType = [](VkPhysicalDeviceType type) { + switch (type) { + case VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU: return 3; + case VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU: return 2; + case VK_PHYSICAL_DEVICE_TYPE_VIRTUAL_GPU: return 1; + default: return 0; + } + }; + std::optional selected; + int selectedRank = -1; + for (std::size_t index = 0; index < devices.size(); ++index) { + const auto& candidate = devices[index]; + if (candidate.apiVersion < VK_API_VERSION_1_1) continue; + const std::string_view name(candidate.deviceName); + if (!request.empty() && std::search(name.begin(), name.end(), request.begin(), request.end(), [](char left, char right) { + return std::tolower(static_cast(left)) == std::tolower(static_cast(right)); + }) == name.end()) continue; + const int rank = request.empty() ? rankDeviceType(candidate.deviceType) : 4; + if (rank <= selectedRank) continue; + selected = index; + selectedRank = rank; + } + return selected; +} + +inline VkPhysicalDevice SelectFixturePhysicalDevice(std::span devices, PFN_vkGetPhysicalDeviceProperties physicalProperties) { + std::vector properties(devices.size()); + for (std::size_t index = 0; index < devices.size(); ++index) physicalProperties(devices[index], &properties[index]); + const char* requestedName = std::getenv("ANYPS5_GPU"); + const std::string_view request = requestedName != nullptr ? requestedName : ""; + if (const auto selected = SelectFixtureDevice(properties, request)) return devices[*selected]; + if (request.empty()) throw std::runtime_error("no Vulkan 1.1 device"); + std::string names; + for (const auto& candidate : properties) { + if (!names.empty()) names += ", "; + names += candidate.deviceName; + } + throw std::runtime_error("no Vulkan 1.1 device whose name contains ANYPS5_GPU=\"" + std::string(request) + "\"; devices: " + names); +} + +#endif diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp index 8984302a91..213d8c7aaf 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp @@ -2,6 +2,7 @@ #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp" #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp" #include "VulkanTestDevice.hpp" +#include "FixtureDeviceSelection.hpp" #include #include #include @@ -50,15 +51,7 @@ public: std::vector devices(count); Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices"); const auto properties = function("vkGetPhysicalDeviceProperties"); - context.physical = devices.front(); - for (const auto candidate : devices) { - VkPhysicalDeviceProperties described{}; - properties(candidate, &described); - if (described.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU) { - context.physical = candidate; - break; - } - } + context.physical = SelectFixturePhysicalDevice(devices, properties); VkPhysicalDeviceProperties selected{}; properties(context.physical, &selected); context.limits = selected.limits; diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp index 0afb33266f..9b5c7bbba5 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp @@ -6,6 +6,7 @@ #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp" #include "prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp" #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp" +#include "FixtureDeviceSelection.hpp" #include "prx/libc/include/GuestAllocations.hpp" #include "prx/libc/include/GuestArena.hpp" #include "prx/libc/include/GuestWriteWatch.hpp" @@ -72,7 +73,7 @@ public: Require(count != 0, "no Vulkan device"); std::vector devices(count); Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices"); - context.physical = devices.front(); + context.physical = SelectFixturePhysicalDevice(devices, function("vkGetPhysicalDeviceProperties")); const auto extensions = function("vkEnumerateDeviceExtensionProperties"); Check(extensions(context.physical, nullptr, &count, nullptr), "vkEnumerateDeviceExtensionProperties"); std::vector available(count); diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp index a7a25f9f88..cfadc23a89 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp @@ -2,6 +2,7 @@ #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp" #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp" #include "VulkanTestDevice.hpp" +#include "FixtureDeviceSelection.hpp" #include #ifdef _WIN32 #ifndef NOMINMAX @@ -58,18 +59,7 @@ public: Require(count != 0, "no Vulkan device"); std::vector devices(count); Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices"); - const auto properties = function("vkGetPhysicalDeviceProperties"); - int rank = -1; - for (const auto candidate : devices) { - VkPhysicalDeviceProperties described{}; - properties(candidate, &described); - if (described.apiVersion < VK_API_VERSION_1_1) continue; - const int candidateRank = described.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU ? 2 : described.deviceType == VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU ? 1 : 0; - if (candidateRank <= rank) continue; - context.physical = candidate; - rank = candidateRank; - } - Require(context.physical != VK_NULL_HANDLE, "no Vulkan 1.1 device"); + context.physical = SelectFixturePhysicalDevice(devices, function("vkGetPhysicalDeviceProperties")); VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES}; VkPhysicalDeviceProperties2 selected{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &subgroup}; function("vkGetPhysicalDeviceProperties2")(context.physical, &selected); From dca749aaa0cd89340ed04a908ac6b0a4f7033d33 Mon Sep 17 00:00:00 2001 From: Felipebmaitan Date: Fri, 23 Oct 2026 17:27:22 -0300 Subject: [PATCH 079/113] fix(job-manager): wake runnable work before a worker waits --- core/libs/prx/libSceJobManager/CMakeLists.txt | 2 +- core/libs/prx/libSceJobManager/Export.cpp | 11 +++- core/libs/tests/GuestJobManager.cpp | 56 +++++++++++++++++++ tools/run_job_manager_reference.py | 2 +- 4 files changed, 67 insertions(+), 4 deletions(-) diff --git a/core/libs/prx/libSceJobManager/CMakeLists.txt b/core/libs/prx/libSceJobManager/CMakeLists.txt index 002ba69513..02088aa791 100644 --- a/core/libs/prx/libSceJobManager/CMakeLists.txt +++ b/core/libs/prx/libSceJobManager/CMakeLists.txt @@ -19,7 +19,7 @@ if(BUILD_TESTING) RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/tests) configure_windows_unwind(job_manager_reference) endif() - foreach(testCase IN ITEMS memory validation dispatch ordering nested limits node_pool priority shutdown worker_policy worker_wake worker_count worker_spin) + foreach(testCase IN ITEMS memory validation dispatch ordering nested limits node_pool priority shutdown worker_policy worker_wake worker_wait worker_count worker_spin) add_test(NAME guest_job_manager_${testCase} COMMAND guest_job_manager_tests ${testCase}) set_tests_properties(guest_job_manager_${testCase} PROPERTIES TIMEOUT 20) if(WIN32) diff --git a/core/libs/prx/libSceJobManager/Export.cpp b/core/libs/prx/libSceJobManager/Export.cpp index 4e3f1395b3..ad0c9ed5ce 100644 --- a/core/libs/prx/libSceJobManager/Export.cpp +++ b/core/libs/prx/libSceJobManager/Export.cpp @@ -247,8 +247,8 @@ struct Manager { thread_local Manager* currentWorker = nullptr; -void WakeWorkers(Manager& manager, std::uint32_t invocations) { - const std::uint32_t available = invocations - (currentWorker == &manager ? 1u : 0u); +void WakeWorkers(Manager& manager, std::uint32_t invocations, bool publisherCanRun = true) { + const std::uint32_t available = invocations - (publisherCanRun && currentWorker == &manager ? 1u : 0u); manager.wakeTokens += std::min(available, manager.sleepingWorkers - manager.wakeTokens); if (manager.wakeTokens != 0) manager.work.notify_all(); } @@ -477,6 +477,13 @@ int Sequence::WaitLocked(std::unique_lock& guard) { bool done = false; items.push_back({ItemType::Wait, this, nullptr, nullptr, 0, 0, 0, &done}); Advance(); + if (!done && currentWorker == manager) { + std::uint64_t runnable = 0; + for (const auto& queue : manager->runQueues) { + for (const Item* item : queue) runnable += item->count - item->handedOut; + } + WakeWorkers(*manager, static_cast(std::min(runnable, std::uint64_t{manager->workerCount})), false); + } passed.wait(guard, [&done] { return done; }); --manager->blockedWaiters; return result; diff --git a/core/libs/tests/GuestJobManager.cpp b/core/libs/tests/GuestJobManager.cpp index 3d3644a538..e8bfeb526f 100644 --- a/core/libs/tests/GuestJobManager.cpp +++ b/core/libs/tests/GuestJobManager.cpp @@ -303,6 +303,61 @@ static void APS5_VABI LeaderJob(void* argument, std::uint32_t) { nested.leaderFinished = true; } +static void RequireParked(int clock); + +struct WorkerWait { + int spareClock = 0; + Sequence* child; + std::atomic publisherEntered{false}; + std::atomic spareEntered{false}; + std::atomic publish{false}; + std::atomic finished{false}; + std::atomic childCalls{0}; +}; + +static void APS5_VABI WorkerWaitChild(void* argument, std::uint32_t) { + ++static_cast(argument)->childCalls; +} + +static void APS5_VABI WorkerWaitPublisher(void* argument, std::uint32_t index) { + auto& state = *static_cast(argument); + if (index != 0) { + Require(pthread_getcpuclockid_nid_postfix(scePthreadSelf(), &state.spareClock) == 0); + state.spareEntered = true; + return; + } + state.publisherEntered = true; + while (!state.publish) std::this_thread::yield(); + Require(state.child->Dispatch(WorkerWaitChild, &state, 1, "child") == 0); + Require(state.child->Wait() == 0); + state.finished = true; +} + +static void WorkerWaitCase() { + Block block(SizeFor(2, 2, 4, 0, 4)); + ManagerObject manager; + const ConfigParams config{0, 0x21fff, 0x10000, 0x2bc, "WorkerWait", 0, 0, 0, 0}; + Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, &config) == 0); + Require(SetPersistentThreadCount(manager.storage, 0) == 0); + SequenceFactory* factory = Factories(manager.storage, 0); + Sequence* publisher = nullptr; + WorkerWait state{}; + Require(factory->Create(&publisher, 2, 1, 0, 1, "publisher") == 0); + Require(factory->Create(&state.child, 1, 1, 0, 1, "child") == 0); + Require(publisher->Dispatch(WorkerWaitPublisher, &state, 2, "park spare") == 0); + auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(3); + while ((!state.publisherEntered || !state.spareEntered) && std::chrono::steady_clock::now() < deadline) std::this_thread::yield(); + Require(state.publisherEntered && state.spareEntered); + RequireParked(state.spareClock); + state.publish = true; + deadline = std::chrono::steady_clock::now() + std::chrono::seconds(3); + while (!state.finished && std::chrono::steady_clock::now() < deadline) std::this_thread::yield(); + Require(state.finished && state.childCalls == 1); + Require(publisher->Wait() == 0); + Require(factory->Destroy(publisher) == 0 && factory->Destroy(state.child) == 0); + Require(Shutdown(manager.storage) == 0); +} + static void NestedCase() { Block block(SizeFor(2, 1, 4, 2, 2)); ManagerObject manager; @@ -711,6 +766,7 @@ int RunJobManagerCase(const char* caseName) { else if (name == "priority") PriorityCase(); else if (name == "shutdown") ShutdownCase(); else if (name == "worker_policy") WorkerPolicyCase(); + else if (name == "worker_wait") WorkerWaitCase(); else if (name == "worker_wake") WorkerWakeCase(); else if (name == "worker_spin") WorkerSpinCase(); else if (name == "worker_count") WorkerCountCase(); diff --git a/tools/run_job_manager_reference.py b/tools/run_job_manager_reference.py index 488916cba2..d804f3e573 100644 --- a/tools/run_job_manager_reference.py +++ b/tools/run_job_manager_reference.py @@ -15,7 +15,7 @@ ROOT = Path(__file__).resolve().parent.parent sys.path.insert(0, str(ROOT / "core/relinker/relinker/tests")) from guest_import_fixtures import executable -CASES = ("memory", "validation", "dispatch", "ordering", "nested", "limits", "node_pool", "priority", "shutdown", "worker_policy", "worker_wake", "worker_count", "worker_spin") +CASES = ("memory", "validation", "dispatch", "ordering", "nested", "limits", "node_pool", "priority", "shutdown", "worker_policy", "worker_wake", "worker_wait", "worker_count", "worker_spin") def stage_libraries(directory, build, toolchain, dependencies): From 3654f15bfaf40914956bccc430bca3aa7fc593d4 Mon Sep 17 00:00:00 2001 From: thibaut Date: Wed, 21 Oct 2026 19:55:54 +0200 Subject: [PATCH 080/113] feat(shader): bit-exact RDNA v_rcp_f32 behind APS5_EXACT_RCP v_rcp_f32 and v_rcp_iflag_f32 lower to the driver's 1/x, whose low bits differ from the console's on NVIDIA and Intel. With APS5_EXACT_RCP set, normal inputs with normal results take the RDNA reciprocal datapath instead: a cubic over 32 segments of the mantissa in 32-bit integer arithmetic, the linear term rounded to nearest even, and a 2,761-entry table of one-ULP corrections, looked up only when the dropped bits fall next to the rounding cut (6.25 % of inputs). This reproduces all 2^23 mantissas of an RDNA2 (gfx1031) sweep. Other inputs keep 1/x. It is off by default: the tables add about 13k SPIR-V words to each shader that uses it. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017EjjFU1FjMR11oWDYs8UMo --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 6 + .../tests/execution/RcpHardware.cpp | 162 ++++++ core/shader/recompiler/CMakeLists.txt | 1 + .../SpirvBackend/SpirvEmitterHelpers.hpp | 1 + .../SpirvBackend/SpirvEmitterState.hpp | 2 + .../src/SpirvAlu/SpirvAluEmitterMath.cpp | 8 - .../SpirvAlu/SpirvAluEmitterReciprocal.cpp | 502 ++++++++++++++++++ .../SpirvBackend/src/SpirvModuleEmitter.cpp | 1 + docs/dev/ENVIRONMENT.md | 1 + docs/dev/debt/shader.md | 1 + 10 files changed, 677 insertions(+), 8 deletions(-) create mode 100644 core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp create mode 100644 core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index 75f7e48d00..e2f14d2d93 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -2128,6 +2128,12 @@ if(BUILD_TESTING) set_tests_properties(agc_driver_address_passes_targets_split PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() + add_test(NAME agc_driver_rcp_hardware_exact COMMAND agc_driver_rcp_hardware_tests) + set_tests_properties(agc_driver_rcp_hardware_exact PROPERTIES ENVIRONMENT "APS5_EXACT_RCP=1;ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 60) + if(WIN32) + set_tests_properties(agc_driver_rcp_hardware_exact PROPERTIES ENVIRONMENT_MODIFICATION + "PATH=path_list_prepend:$") + endif() endif() foreach(agcExecutionTestName IN LISTS ANYPS5_AGC_EXECUTION_TESTS) if(NOT EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/tests/execution/${agcExecutionTestName}.cpp) diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp new file mode 100644 index 0000000000..66a3c78357 --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp @@ -0,0 +1,162 @@ +#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp" +#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp" +#include "Recompiler.hpp" +#include "VulkanTestDevice.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include + +namespace { + +using AgcDriver::Graphics::Require; +using ShaderRecompiler::ShaderStage; + +constexpr std::uint32_t Threads = 32; +constexpr std::array, 256> Measured{{ + {0x000000u, 0x3f800000u}, {0x002922u, 0x3f7fadd6u}, {0x00a1a9u, 0x3f7ebe44u}, {0x010c47u, 0x3f7debceu}, + {0x013df5u, 0x3f7d8a32u}, {0x01a87fu, 0x3f7cb9ddu}, {0x024f43u, 0x3f7b766fu}, {0x02d76du, 0x3f7a70beu}, + {0x031690u, 0x3f79f820u}, {0x033035u, 0x3f79c742u}, {0x03adabu, 0x3f78d946u}, {0x04435bu, 0x3f77bfa4u}, + {0x04f3a1u, 0x3f76772au}, {0x057a96u, 0x3f757df8u}, {0x05c6afu, 0x3f74f253u}, {0x06342au, 0x3f742a80u}, + {0x06bf6fu, 0x3f732e24u}, {0x07709au, 0x3f71f00au}, {0x07eb02u, 0x3f711627u}, {0x086273u, 0x3f704304u}, + {0x09362bu, 0x3f6ed04au}, {0x099950u, 0x3f6e2438u}, {0x09f75cu, 0x3f6d81e2u}, {0x0a097cu, 0x3f6d62b3u}, + {0x0ab7e3u, 0x3f6c3840u}, {0x0b1a69u, 0x3f6b90f0u}, {0x0b93a5u, 0x3f6ac454u}, {0x0becd7u, 0x3f6a2eadu}, + {0x0bf0b4u, 0x3f6a2836u}, {0x0c5c7fu, 0x3f697463u}, {0x0c9164u, 0x3f691c8au}, {0x0cb1e2u, 0x3f68e6b5u}, + {0x0d5f89u, 0x3f67c8a0u}, {0x0dd27au, 0x3f670cc6u}, {0x0e09e4u, 0x3f66b2a2u}, {0x0ead02u, 0x3f65aae2u}, + {0x0ed904u, 0x3f656421u}, {0x0f17a3u, 0x3f64ffbeu}, {0x0f21ddu, 0x3f64ef61u}, {0x0f2bcdu, 0x3f64df7du}, + {0x0f4205u, 0x3f64bbfeu}, {0x0f8808u, 0x3f644c6cu}, {0x0faddcu, 0x3f641050u}, {0x0fd630u, 0x3f63d05fu}, + {0x1012f0u, 0x3f637050u}, {0x108fe7u, 0x3f62abb4u}, {0x10a3d6u, 0x3f628c77u}, {0x1184b9u, 0x3f612e5au}, + {0x119a72u, 0x3f610cc2u}, {0x11e20bu, 0x3f609e4fu}, {0x123f59u, 0x3f600f00u}, {0x128b2fu, 0x3f5f9b0du}, + {0x12bd4au, 0x3f5f4eb3u}, {0x12f18du, 0x3f5eff48u}, {0x135d16u, 0x3f5e5c8du}, {0x13deefu, 0x3f5d994bu}, + {0x140ceeu, 0x3f5d5472u}, {0x14a0f9u, 0x3f5c77fdu}, {0x14f473u, 0x3f5bfc70u}, {0x15051au, 0x3f5be3dau}, + {0x153e7cu, 0x3f5b8f4fu}, {0x15b949u, 0x3f5adb3au}, {0x1600a3u, 0x3f5a7320u}, {0x1676ebu, 0x3f59c766u}, + {0x172abbu, 0x3f58c45au}, {0x1738f7u, 0x3f58aff3u}, {0x17a05au, 0x3f581c33u}, {0x17f5e8u, 0x3f57a288u}, + {0x1818e8u, 0x3f5770e9u}, {0x185f1au, 0x3f570da8u}, {0x18f135u, 0x3f564038u}, {0x194f2fu, 0x3f55bce2u}, + {0x1a61dbu, 0x3f54409cu}, {0x1a63e2u, 0x3f543dd2u}, {0x1af098u, 0x3f537d12u}, {0x1bd958u, 0x3f52413au}, + {0x1cb224u, 0x3f511e54u}, {0x1deb7au, 0x3f4f7f68u}, {0x1df9fdu, 0x3f4f6c59u}, {0x1e27a1u, 0x3f4f307du}, + {0x1e398fu, 0x3f4f1903u}, {0x1ef9d8u, 0x3f4e1e85u}, {0x1fb17cu, 0x3f4d317eu}, {0x1fec12u, 0x3f4ce652u}, + {0x202036u, 0x3f4ca39au}, {0x20b671u, 0x3f4be450u}, {0x211c70u, 0x3f4b633bu}, {0x21b455u, 0x3f4aa42eu}, + {0x2217beu, 0x3f4a27e7u}, {0x22c947u, 0x3f494b6eu}, {0x230d97u, 0x3f48f719u}, {0x23a75fu, 0x3f483a41u}, + {0x244f6fu, 0x3f476d74u}, {0x24ede6u, 0x3f46add8u}, {0x250d33u, 0x3f46882au}, {0x254b0cu, 0x3f463de2u}, + {0x263ba6u, 0x3f451ef3u}, {0x269e0du, 0x3f44aa89u}, {0x26a2c0u, 0x3f44a4fdu}, {0x26bb7du, 0x3f4487d0u}, + {0x26e875u, 0x3f4452ddu}, {0x2744e3u, 0x3f43e660u}, {0x281972u, 0x3f42eeaau}, {0x29b882u, 0x3f4111f2u}, + {0x2a3af4u, 0x3f407e00u}, {0x2a96fbu, 0x3f401628u}, {0x2afa95u, 0x3f3fa642u}, {0x2b0537u, 0x3f3f9a58u}, + {0x2baf6au, 0x3f3edc66u}, {0x2c7557u, 0x3f3e015au}, {0x2d1c9au, 0x3f3d49c5u}, {0x2d711au, 0x3f3ced8cu}, + {0x2e0531u, 0x3f3c4cc6u}, {0x2e4415u, 0x3f3c08d1u}, {0x2e8e7du, 0x3f3bb8aau}, {0x2eae05u, 0x3f3b96c8u}, + {0x2fa54eu, 0x3f3a8eaeu}, {0x301850u, 0x3f3a14d7u}, {0x30d16au, 0x3f39520au}, {0x31f5efu, 0x3f38216cu}, + {0x32c6ecu, 0x3f374a2du}, {0x33d0ceu, 0x3f363b28u}, {0x34b9b5u, 0x3f355051u}, {0x34c9ebu, 0x3f35400eu}, + {0x364b9du, 0x3f33c092u}, {0x36f675u, 0x3f3318bau}, {0x376cbfu, 0x3f32a53au}, {0x37dc76u, 0x3f3238afu}, + {0x387a34u, 0x3f31a04au}, {0x3898d1u, 0x3f3182d5u}, {0x392630u, 0x3f30fb4bu}, {0x398406u, 0x3f30a1c6u}, + {0x3aa8b5u, 0x3f2f8cd0u}, {0x3b1287u, 0x3f2f2983u}, {0x3b6186u, 0x3f2edfabu}, {0x3bbbe9u, 0x3f2e8b79u}, + {0x3bfb1eu, 0x3f2e50c8u}, {0x3cf38cu, 0x3f2d6b98u}, {0x3d9c17u, 0x3f2cd172u}, {0x3e7d1bu, 0x3f2c054du}, + {0x3e875fu, 0x3f2bfc08u}, {0x3f63afu, 0x3f2b360fu}, {0x3f98e2u, 0x3f2b0685u}, {0x3fa7d9u, 0x3f2af92au}, + {0x407b49u, 0x3f2a3d5au}, {0x4174afu, 0x3f2961e2u}, {0x427df9u, 0x3f287ad8u}, {0x43435cu, 0x3f27d089u}, + {0x437bcbu, 0x3f27a016u}, {0x44985eu, 0x3f26ad72u}, {0x451abdu, 0x3f263f34u}, {0x457d42u, 0x3f25ec44u}, + {0x472077u, 0x3f248ef6u}, {0x4724dau, 0x3f248b56u}, {0x47469au, 0x3f246f78u}, {0x482c9cu, 0x3f23b287u}, + {0x486824u, 0x3f2381e6u}, {0x48db40u, 0x3f232432u}, {0x499523u, 0x3f228dc2u}, {0x49b64au, 0x3f22730au}, + {0x49dea9u, 0x3f22528du}, {0x4a23d5u, 0x3f221b02u}, {0x4b14f9u, 0x3f215a86u}, {0x4c25fcu, 0x3f2082beu}, + {0x4cbd87u, 0x3f200befu}, {0x4cdd20u, 0x3f1ff340u}, {0x4dd422u, 0x3f1f334cu}, {0x4ef8aau, 0x3f1e5249u}, + {0x4f20f3u, 0x3f1e337eu}, {0x4f426du, 0x3f1e19f1u}, {0x5051c1u, 0x3f1d4c05u}, {0x506bf2u, 0x3f1d3841u}, + {0x507313u, 0x3f1d32e0u}, {0x519088u, 0x3f1c5cc0u}, {0x520935u, 0x3f1c02eau}, {0x52e6b4u, 0x3f1b5f10u}, + {0x536d35u, 0x3f1afc38u}, {0x54a6d8u, 0x3f1a17a2u}, {0x55c663u, 0x3f19485eu}, {0x56ed5bu, 0x3f187600u}, + {0x571242u, 0x3f185bd8u}, {0x5790f8u, 0x3f180249u}, {0x57ee05u, 0x3f17c0c8u}, {0x588a7eu, 0x3f175320u}, + {0x58d556u, 0x3f171ee4u}, {0x59a54au, 0x3f168e80u}, {0x59f999u, 0x3f165444u}, {0x5affb2u, 0x3f15a05bu}, + {0x5b855cu, 0x3f15453fu}, {0x5bd86du, 0x3f150cd9u}, {0x5c90a9u, 0x3f149059u}, {0x5cd546u, 0x3f146230u}, + {0x5d9dc9u, 0x3f13dbf0u}, {0x5e14d9u, 0x3f138caau}, {0x5e8766u, 0x3f1340b6u}, {0x5f41cau, 0x3f12c5c6u}, + {0x5f5572u, 0x3f12b8dcu}, {0x60fd9bu, 0x3f11a440u}, {0x616499u, 0x3f1161b4u}, {0x625d1cu, 0x3f10c218u}, + {0x62c33au, 0x3f1080e8u}, {0x63c0e3u, 0x3f0fdff7u}, {0x641547u, 0x3f0faabcu}, {0x64b8d7u, 0x3f0f43feu}, + {0x651327u, 0x3f0f0b83u}, {0x658cdau, 0x3f0ebfadu}, {0x65dc9fu, 0x3f0e8e23u}, {0x662b59u, 0x3f0e5d60u}, + {0x66d228u, 0x3f0df67eu}, {0x670f27u, 0x3f0dd104u}, {0x67e4c4u, 0x3f0d4e61u}, {0x6916adu, 0x3f0c94eeu}, + {0x6a50dfu, 0x3f0bd86cu}, {0x6a7a5au, 0x3f0bbfaeu}, {0x6b0a18u, 0x3f0b6a37u}, {0x6b0d54u, 0x3f0b684cu}, + {0x6b4013u, 0x3f0b4a3au}, {0x6b4cb2u, 0x3f0b42c1u}, {0x6bd361u, 0x3f0af338u}, {0x6bf46cu, 0x3f0adfc3u}, + {0x6cad4au, 0x3f0a734au}, {0x6cb93du, 0x3f0a6c4cu}, {0x6d76b0u, 0x3f09fdddu}, {0x6dc676u, 0x3f09cf92u}, + {0x6e36aau, 0x3f098ea8u}, {0x6f0367u, 0x3f0918d3u}, {0x6fa5cau, 0x3f08bbedu}, {0x70c958u, 0x3f08165eu}, + {0x71e6c2u, 0x3f0775ccu}, {0x721583u, 0x3f075ba3u}, {0x72e6ccu, 0x3f06e703u}, {0x72fdf2u, 0x3f06da29u}, + {0x73596du, 0x3f06a778u}, {0x7403e4u, 0x3f064966u}, {0x744916u, 0x3f06235cu}, {0x74c9dfu, 0x3f05dccau}, + {0x74e69au, 0x3f05cd16u}, {0x756dbau, 0x3f05836cu}, {0x7631a9u, 0x3f05192au}, {0x7731afu, 0x3f048f50u}, + {0x7774a2u, 0x3f046b72u}, {0x791a7cu, 0x3f038b32u}, {0x795e82u, 0x3f036751u}, {0x7aa2c1u, 0x3f02bd52u}, + {0x7c2684u, 0x3f01f444u}, {0x7c64ebu, 0x3f01d422u}, {0x7d2cafu, 0x3f016db2u}, {0x7d959fu, 0x3f013822u}, + {0x7e62aau, 0x3f00cffbu}, {0x7ebff2u, 0x3f00a0d0u}, {0x7eecf4u, 0x3f008a1au}, {0x7f1505u, 0x3f0075eau}, + {0x7f1b10u, 0x3f0072dfu}, {0x7f2614u, 0x3f006d53u}, {0x7ff486u, 0x3f0005beu}, {0x7fffffu, 0x3f000001u}, +}}; +constexpr std::array Exponents{1u, 60u, 127u, 128u, 200u, 252u}; +constexpr std::uint32_t Cases = static_cast(Measured.size() * Exponents.size() * 2u); +constexpr std::uint32_t Batches = Cases / Threads; +alignas(256) std::array Input{}; +alignas(256) std::array Output{}; + +alignas(256) constexpr std::array Code{ + 0x34020082, 0xe0301000, 0x80000201, 0xbf8c3f70, 0x7e065502, 0xe0701000, 0x80010301, 0xbf8c3f70, + 0xbf810000, +}; + +std::array BufferDescriptor(const void* data, std::uint32_t bytes) { + const auto address = reinterpret_cast(data); + return {static_cast(address), static_cast((address >> 32u) & 0xffffu), bytes, 0x31016facu}; +} + +std::string Hex(std::uint32_t value) { + char text[16]; + std::snprintf(text, sizeof(text), "0x%08x", value); + return text; +} + +std::uint32_t Sample(std::uint32_t index) { + const auto& measured = Measured[index % Measured.size()]; + const auto exponent = Exponents[(index / Measured.size()) % Exponents.size()]; + const auto sign = (index / static_cast(Measured.size() * Exponents.size())) << 31u; + return sign | exponent << 23u | measured[0]; +} + +std::uint32_t Expected(std::uint32_t index) { + const auto& measured = Measured[index % Measured.size()]; + const auto exponent = Exponents[(index / Measured.size()) % Exponents.size()]; + const auto sign = (index / static_cast(Measured.size() * Exponents.size())) << 31u; + return sign | ((measured[1] >> 23u) + 127u - exponent) << 23u | (measured[1] & 0x7fffffu); +} +} + +int main() { + try { + if (std::getenv("APS5_EXACT_RCP") == nullptr) return VulkanTestSkipped; + const auto device = OpenVulkanTestDevice(); + if (!device) return VulkanTestSkipped; + std::vector userData(8, 0u); + const auto input = BufferDescriptor(Input.data(), static_cast(Input.size() * 4u)); + const auto output = BufferDescriptor(Output.data(), static_cast(Output.size() * 4u)); + std::copy(input.begin(), input.end(), userData.begin()); + std::copy(output.begin(), output.end(), userData.begin() + 4); + const std::span code(Code); + const std::array memory{{{reinterpret_cast(code.data()), std::as_bytes(code)}}}; + const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1}; + ShaderRecompiler::RecompileRequest request{ + {ShaderStage::Compute, reinterpret_cast(code.data()), code, 0, {}}, + {32, 0, userData, compute, std::nullopt, std::nullopt, memory}, + device->Target(), + {0, 0, 0, 128} + }; + request.useCache = false; + request.context.floatMode = ShaderRecompiler::ShaderFloatMode{0xf0u, true, true, false}; + const auto result = ShaderRecompiler::Recompile(request); + for (std::uint32_t batch = 0; batch < Batches; ++batch) { + for (std::uint32_t tid = 0; tid < Threads; ++tid) Input[tid] = Sample(batch * Threads + tid); + Output.fill(0xdeadbeefu); + device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast(code.data())); + device->WaitIdle(); + for (std::uint32_t tid = 0; tid < Threads; ++tid) { + const auto wanted = Expected(batch * Threads + tid); + Require(Output[tid] == wanted, std::string("v_rcp_f32 of ") + Hex(Input[tid]) + " is " + Hex(Output[tid]) + ", expected the RDNA 2 value " + Hex(wanted)); + } + } + std::puts("rcp hardware tests passed"); + return 0; + } catch (const std::exception& error) { + std::cerr << error.what() << '\n'; + return 1; + } +} diff --git a/core/shader/recompiler/CMakeLists.txt b/core/shader/recompiler/CMakeLists.txt index b278d2b8a0..2f8d98958f 100644 --- a/core/shader/recompiler/CMakeLists.txt +++ b/core/shader/recompiler/CMakeLists.txt @@ -131,6 +131,7 @@ function(add_shader_recompiler target runtimeTarget) ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAnalysis.cpp ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterFloat64.cpp + ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterRegisters.cpp ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvFlowEmitter.cpp ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvImageEmitter.cpp diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp index 34213a41b6..6556b78469 100644 --- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp +++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp @@ -154,6 +154,7 @@ std::uint32_t EmitF16BitsToF32Decoded(SpirvEmitterState& state, std::uint32_t bi void EmitProgram(SpirvEmitterState& state); void DefineGetBdaPointer(SpirvEmitterState& state); void DefineDot2F32F16Function(SpirvEmitterState& state); +void DefineReciprocalCorrectionFunction(SpirvEmitterState& state); void EmitLabel(SpirvEmitterState& state, std::uint32_t label); std::uint32_t Unary(SpirvEmitterState& state, std::uint32_t opcode, std::uint32_t type, std::uint32_t value); std::uint32_t Binary(SpirvEmitterState& state, std::uint32_t opcode, std::uint32_t type, std::uint32_t lhs, std::uint32_t rhs); diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp index 38b321e595..16541a653a 100644 --- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp +++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp @@ -167,6 +167,8 @@ struct SpirvEmitterState { bool nativeF16ModesEmitted = false; bool f16DenormPreserveEmitted = false; std::uint32_t dot2F32F16Function = 0; + std::uint32_t reciprocalCorrectionFunction = 0; + std::array reciprocalTables {}; std::map, std::uint32_t> interpolateFunctions; bool integerInterpolation = false; std::array, 2> bdaDwordReadFunctions {}; diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp index 1ce65a7506..abf7b6fce4 100644 --- a/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp +++ b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp @@ -983,14 +983,6 @@ std::uint32_t EmitFPMedTri32(SpirvEmitterState& state, std::uint32_t arg0, std:: return value(Select(state, u32, anyNan, min3, median)); } -std::uint32_t EmitFPRecip32(SpirvEmitterState& state, std::uint32_t arg0) { - return Binary(state, spv::OpFDiv, TypeF32(state), ConstantF32(state, 0x3f800000u), arg0); -} - -std::uint32_t EmitFPRecipIFlag32(SpirvEmitterState& state, std::uint32_t arg0) { - return Binary(state, spv::OpFDiv, TypeF32(state), ConstantF32(state, 0x3f800000u), arg0); -} - std::uint32_t EmitFPRecipSqrt32(SpirvEmitterState& state, std::uint32_t arg0) { return EmitExt(state, TypeF32(state), GLSLstd450InverseSqrt, {arg0}); } diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp new file mode 100644 index 0000000000..69a21a884c --- /dev/null +++ b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp @@ -0,0 +1,502 @@ +#include "SpirvBackend/SpirvEmitterHelpers.hpp" +#include "SpirvBackend/SpirvEmitterInstructions.hpp" +#include "IntermediateRepresentation/IrBlock.hpp" +#include "IntermediateRepresentation/IrValue.hpp" +#include +#include +#include +#include +#include + +namespace ShaderRecompiler { +namespace { + +constexpr std::array ReciprocalConstant{ + 0x04000000u, 0x03e0f83eu, 0x03c3c3c3u, 0x03a83a83u, 0x038e38e3u, 0x03759f22u, 0x035e50d7u, 0x03483483u, + 0x03333333u, 0x031f3831u, 0x030c30c3u, 0x02fa0be8u, 0x02e8ba2eu, 0x02d82d82u, 0x02c8590bu, 0x02b93105u, + 0x02aaaaaau, 0x029cbc14u, 0x028f5c28u, 0x02828282u, 0x02762762u, 0x026a439fu, 0x025ed097u, 0x0253c825u, + 0x02492492u, 0x023ee08fu, 0x0234f72cu, 0x022b63cbu, 0x02222222u, 0x02192e29u, 0x02108421u, 0x02082082u, +}; + +constexpr std::array ReciprocalLinear{ + 0x001ffff2u, 0x001e16feu, 0x001c588au, 0x001abfcfu, 0x001948a9u, 0x0017ef84u, 0x0016b143u, 0x00158b2cu, + 0x00147adcu, 0x00137e3bu, 0x0012936eu, 0x0011b8d2u, 0x0010ecf2u, 0x00102e83u, 0x000f7c5cu, 0x000ed575u, + 0x000e38e1u, 0x000da5cau, 0x000d1b6fu, 0x000c9924u, 0x000c1e4au, 0x000baa54u, 0x000b3cbfu, 0x000ad517u, + 0x000a72efu, 0x000a15e6u, 0x0009bda3u, 0x000969d3u, 0x00091a2au, 0x0008ce64u, 0x00088642u, 0x00084187u, +}; + +constexpr std::array ReciprocalHigherOrder{ + 0x0785ffb6u, 0x06a9e92du, 0x05ecd536u, 0x0548c377u, 0x04bab3a2u, 0x043ea577u, 0x03d198c0u, 0x03728d4eu, + 0x031e82f9u, 0x02d479a0u, 0x02927126u, 0x02576970u, 0x0223626au, 0x01f55c00u, 0x01cb5622u, 0x01a550c1u, + 0x01844bd0u, 0x01654744u, 0x014a4313u, 0x01313f35u, 0x011a3ba2u, 0x01063852u, 0x00f33540u, 0x00e23266u, + 0x00d22fbfu, 0x00c42d47u, 0x00b72afau, 0x00ab28d4u, 0x00a026d2u, 0x009624f2u, 0x008c232fu, 0x00832189u, +}; + +constexpr std::array ReciprocalCorrectionStarts{ + 0x00000000u, 0x00020000u, 0x00040002u, 0x000a0008u, 0x0012000cu, 0x00160014u, 0x001a0018u, 0x0023001cu, + 0x00280026u, 0x00290029u, 0x002f002cu, 0x00320031u, 0x00390038u, 0x0042003eu, 0x00480045u, 0x004a004au, + 0x004f004du, 0x00550052u, 0x00570056u, 0x005d005bu, 0x005f005eu, 0x00640061u, 0x006b0069u, 0x0076006fu, + 0x007d0077u, 0x0082007eu, 0x00850084u, 0x008d0088u, 0x00920090u, 0x00990097u, 0x00a0009cu, 0x00a400a3u, + 0x00ab00a8u, 0x00ab00abu, 0x00b000adu, 0x00b700b5u, 0x00bb00b8u, 0x00be00bdu, 0x00c100c1u, 0x00c300c3u, + 0x00c900c5u, 0x00d000cdu, 0x00d300d2u, 0x00d800d5u, 0x00db00dau, 0x00de00dcu, 0x00e100dfu, 0x00e900e3u, + 0x00ea00e9u, 0x00ef00edu, 0x00f300f1u, 0x00fb00f7u, 0x00fb00fbu, 0x00ff00feu, 0x01060105u, 0x01080106u, + 0x010c010au, 0x0112010fu, 0x01150112u, 0x011a0117u, 0x011c011bu, 0x01240120u, 0x012b0126u, 0x0132012fu, + 0x01360135u, 0x013b0137u, 0x013f013du, 0x01490143u, 0x014a0149u, 0x014e014du, 0x014f014fu, 0x01540151u, + 0x01580158u, 0x015b0158u, 0x0161015du, 0x01650163u, 0x01670166u, 0x016a0169u, 0x016d016bu, 0x0170016eu, + 0x01730173u, 0x01750175u, 0x017b0179u, 0x01830181u, 0x01860184u, 0x01870187u, 0x018c018au, 0x0191018fu, + 0x01970194u, 0x01a1019eu, 0x01a601a4u, 0x01ab01a8u, 0x01b001acu, 0x01b701b5u, 0x01c101bfu, 0x01c701c4u, + 0x01cd01cbu, 0x01d001cfu, 0x01d501d4u, 0x01d701d6u, 0x01de01ddu, 0x01e301e2u, 0x01e601e5u, 0x01eb01eau, + 0x01eb01ebu, 0x01ee01ecu, 0x01f001f0u, 0x01f601f4u, 0x01fa01f7u, 0x01fb01fbu, 0x020101feu, 0x02030201u, + 0x020a0207u, 0x020e020cu, 0x02140212u, 0x02170217u, 0x021d021cu, 0x0220021du, 0x02210221u, 0x02280225u, + 0x0230022bu, 0x02370233u, 0x023b023bu, 0x023f023bu, 0x02470241u, 0x024b0249u, 0x024f024cu, 0x02540250u, + 0x02560255u, 0x025a0257u, 0x025a025au, 0x025f025cu, 0x0261025fu, 0x02660264u, 0x02670267u, 0x026d026bu, + 0x026f026fu, 0x02710271u, 0x02740274u, 0x02760276u, 0x02790276u, 0x027e027cu, 0x0282027fu, 0x02830283u, + 0x02850285u, 0x02880285u, 0x028d028du, 0x028f028eu, 0x0292028fu, 0x02960293u, 0x029b029au, 0x02a0029du, + 0x02aa02a5u, 0x02b302acu, 0x02b602b4u, 0x02b902b8u, 0x02bc02bbu, 0x02be02bdu, 0x02c302c0u, 0x02c902c5u, + 0x02ce02cau, 0x02d202d0u, 0x02d302d2u, 0x02d802d6u, 0x02db02dau, 0x02de02deu, 0x02e102deu, 0x02e102e1u, + 0x02e602e2u, 0x02ec02eau, 0x02f002eeu, 0x02f502f2u, 0x02f602f6u, 0x02f802f7u, 0x02fc02fau, 0x030002fdu, + 0x03040302u, 0x03060304u, 0x030a0309u, 0x030d030cu, 0x0310030fu, 0x03130311u, 0x03160316u, 0x031c0319u, + 0x031f031du, 0x03260322u, 0x0330032au, 0x03350332u, 0x03380337u, 0x033c0339u, 0x0341033du, 0x03470344u, + 0x034b0349u, 0x034d034cu, 0x034d034du, 0x03500350u, 0x03530350u, 0x03570354u, 0x035a0358u, 0x035b035bu, + 0x0361035fu, 0x03620361u, 0x03660363u, 0x03680366u, 0x03690368u, 0x036b036au, 0x036d036cu, 0x0370036eu, + 0x03720371u, 0x03750375u, 0x03790376u, 0x037f037bu, 0x03830382u, 0x03870384u, 0x038a0389u, 0x0390038du, + 0x03950393u, 0x03960395u, 0x03990396u, 0x039e039bu, 0x039f039fu, 0x03a303a2u, 0x03a503a5u, 0x03ab03a8u, + 0x03af03aeu, 0x03b103b0u, 0x03b403b3u, 0x03b603b4u, 0x03b803b8u, 0x03bc03b9u, 0x03c003beu, 0x03c303c0u, + 0x03c503c3u, 0x03c503c5u, 0x03c603c5u, 0x03ca03c8u, 0x03ca03cau, 0x03cc03cbu, 0x03cf03cdu, 0x03d303d0u, + 0x03d503d4u, 0x03d803d7u, 0x03da03d9u, 0x03dc03dbu, 0x03de03dcu, 0x03de03deu, 0x03e203e0u, 0x03e703e5u, + 0x03e903e8u, 0x03ea03eau, 0x03ed03ebu, 0x03ef03eeu, 0x03f103efu, 0x03f503f2u, 0x03fb03f7u, 0x03fe03fbu, + 0x04080401u, 0x040d040bu, 0x040e040eu, 0x040f040eu, 0x04130411u, 0x04130413u, 0x04150414u, 0x04160415u, + 0x04180416u, 0x041b041au, 0x041e041du, 0x0420041fu, 0x04240421u, 0x04280428u, 0x042b042bu, 0x042d042bu, + 0x042f042fu, 0x04330431u, 0x04330433u, 0x04350433u, 0x04380436u, 0x043d043bu, 0x043f043eu, 0x0441043fu, + 0x04450443u, 0x04460445u, 0x04460446u, 0x044a0449u, 0x0450044eu, 0x04560454u, 0x04590457u, 0x045e045bu, + 0x04640462u, 0x04650464u, 0x046b0466u, 0x046c046cu, 0x0470046eu, 0x04750473u, 0x04780477u, 0x047b047au, + 0x0480047eu, 0x04810480u, 0x04830481u, 0x04850483u, 0x04870486u, 0x048b0488u, 0x048f048eu, 0x0490048fu, + 0x04920492u, 0x04940492u, 0x04970497u, 0x049b049au, 0x049f049eu, 0x04a1049fu, 0x04a304a2u, 0x04a504a5u, + 0x04a704a6u, 0x04a904a8u, 0x04ad04abu, 0x04b304afu, 0x04b504b5u, 0x04b604b5u, 0x04b804b7u, 0x04bc04bbu, + 0x04c104beu, 0x04c204c2u, 0x04c404c3u, 0x04c404c4u, 0x04c504c5u, 0x04c704c6u, 0x04c804c7u, 0x04c904c9u, + 0x04c904c9u, 0x04ce04cdu, 0x04d004cfu, 0x04d304d2u, 0x04d304d3u, 0x04d604d6u, 0x04d904d7u, 0x04dc04d9u, + 0x04e004dfu, 0x04e004e0u, 0x04e104e0u, 0x04e204e1u, 0x04e404e4u, 0x04e404e4u, 0x04e704e7u, 0x04eb04e8u, + 0x04ef04edu, 0x04f304f2u, 0x04f704f4u, 0x04fb04f9u, 0x04fd04fdu, 0x05030500u, 0x05090505u, 0x050d050bu, + 0x05130510u, 0x05140514u, 0x05160515u, 0x05160516u, 0x051a0518u, 0x051d051bu, 0x051e051du, 0x0520051fu, + 0x05260523u, 0x05280527u, 0x05290529u, 0x052d052au, 0x0531052eu, 0x05320531u, 0x05350533u, 0x053a0538u, + 0x053d053bu, 0x053f053fu, 0x05420542u, 0x05420542u, 0x05440542u, 0x05480546u, 0x054c054bu, 0x054f054eu, + 0x054f054fu, 0x0551054fu, 0x05530552u, 0x05550553u, 0x05570557u, 0x055c0559u, 0x055e055du, 0x055e055eu, + 0x055f055fu, 0x0563055fu, 0x05660566u, 0x05690568u, 0x056c056bu, 0x056d056cu, 0x056e056du, 0x05710571u, + 0x05720572u, 0x05720572u, 0x05730573u, 0x05750573u, 0x05760575u, 0x05790578u, 0x057f057cu, 0x05830581u, + 0x05850585u, 0x05870587u, 0x058e0589u, 0x058f058eu, 0x05930592u, 0x05980595u, 0x059c059au, 0x05a205a0u, + 0x05a205a2u, 0x05a305a3u, 0x05a805a6u, 0x05aa05a9u, 0x05ac05acu, 0x05ad05adu, 0x05b005adu, 0x05b705b2u, + 0x05ba05b9u, 0x05bb05bbu, 0x05bd05bbu, 0x05bd05bdu, 0x05bf05bfu, 0x05c305c1u, 0x05c605c4u, 0x05c605c6u, + 0x05c705c7u, 0x05c905c8u, 0x05ca05c9u, 0x05cd05ccu, 0x05cf05cdu, 0x05d105d0u, 0x05d305d2u, 0x05d605d4u, + 0x05d805d6u, 0x05d905d8u, 0x05dc05dau, 0x05dc05dcu, 0x05de05dcu, 0x05df05deu, 0x05e005e0u, 0x05e405e3u, + 0x05e705e5u, 0x05ec05eau, 0x05ee05edu, 0x05f205f1u, 0x05f305f2u, 0x05f705f4u, 0x05f905f8u, 0x05fb05fbu, + 0x05fd05fcu, 0x06000600u, 0x06050604u, 0x06050605u, 0x06090609u, 0x060c060bu, 0x0610060fu, 0x06100610u, + 0x06130610u, 0x06140613u, 0x061a0618u, 0x061b061au, 0x061d061cu, 0x06250622u, 0x06260625u, 0x06280628u, + 0x062a0629u, 0x062b062bu, 0x062e062cu, 0x062e062eu, 0x06300630u, 0x06330632u, 0x06350635u, 0x06370636u, + 0x06390638u, 0x063a063au, 0x063b063au, 0x063d063cu, 0x0641063eu, 0x06420641u, 0x06450643u, 0x06480646u, + 0x064e064au, 0x064f064fu, 0x06510651u, 0x06530652u, 0x06570656u, 0x06580658u, 0x065a0659u, 0x065d065cu, + 0x065e065eu, 0x0661065fu, 0x06630662u, 0x06640664u, 0x06660666u, 0x06670666u, 0x06690668u, 0x066b0669u, + 0x066d066du, 0x066e066du, 0x06710670u, 0x06720671u, 0x06740673u, 0x06760676u, 0x06780678u, 0x067a0679u, + 0x067c067cu, 0x067e067eu, 0x067f067eu, 0x06820680u, 0x06860685u, 0x068a0688u, 0x068c068cu, 0x068e068cu, + 0x06990690u, 0x069b069au, 0x069b069bu, 0x069e069cu, 0x06a206a0u, 0x06a506a4u, 0x06a606a5u, 0x06ab06aau, + 0x06ad06adu, 0x06b006afu, 0x06b406b1u, 0x06b406b4u, 0x06b606b5u, 0x06ba06b8u, 0x06ba06bau, 0x06be06bdu, + 0x06c106c1u, 0x06c506c2u, 0x06c806c6u, 0x06c906c9u, 0x06ce06ccu, 0x06ce06ceu, 0x06d306d3u, 0x06d706d4u, + 0x06dd06dcu, 0x06dd06ddu, 0x06de06ddu, 0x06e006deu, 0x06e406e1u, 0x06e506e5u, 0x06e806e8u, 0x06e906e8u, + 0x06ed06ebu, 0x06ee06eeu, 0x06f106eeu, 0x06f206f2u, 0x06f606f3u, 0x06fa06f9u, 0x06fc06fbu, 0x06fd06fdu, + 0x07000700u, 0x07020700u, 0x07070703u, 0x070a0709u, 0x070c070cu, 0x070d070cu, 0x070d070du, 0x070f070eu, + 0x07100710u, 0x07120710u, 0x07120712u, 0x07140714u, 0x07150714u, 0x07160715u, 0x07170717u, 0x071a0719u, + 0x0720071eu, 0x07230720u, 0x07260725u, 0x07290727u, 0x072a0729u, 0x072d072bu, 0x072f072eu, 0x0732072fu, + 0x07340733u, 0x07370735u, 0x07370737u, 0x07380737u, 0x073a0739u, 0x073b073au, 0x073e073eu, 0x07410740u, + 0x07420741u, 0x07440743u, 0x07450744u, 0x07460746u, 0x07480747u, 0x074b074au, 0x074b074bu, 0x074e074du, + 0x0751074eu, 0x07520751u, 0x07550755u, 0x07580757u, 0x07590759u, 0x075c075bu, 0x075f075fu, 0x0760075fu, + 0x07610760u, 0x07660766u, 0x07690769u, 0x076a0769u, 0x076d076bu, 0x076e076eu, 0x0771076fu, 0x07740772u, + 0x07780774u, 0x077a0778u, 0x077d077cu, 0x077e077du, 0x0781077fu, 0x07830782u, 0x07830783u, 0x07840783u, + 0x07870786u, 0x07890788u, 0x078a0789u, 0x078c078bu, 0x078d078du, 0x078d078du, 0x078e078eu, 0x07920792u, + 0x07930792u, 0x07970796u, 0x07990799u, 0x079a0799u, 0x079d079au, 0x079e079eu, 0x07a007a0u, 0x07a007a0u, + 0x07a207a0u, 0x07a407a3u, 0x07a507a5u, 0x07a507a5u, 0x07a807a6u, 0x07ac07abu, 0x07ad07adu, 0x07ad07adu, + 0x07b207aeu, 0x07b407b3u, 0x07b607b6u, 0x07b907b9u, 0x07bd07bcu, 0x07be07bdu, 0x07bf07beu, 0x07c207bfu, + 0x07c407c4u, 0x07c507c5u, 0x07c507c5u, 0x07c607c5u, 0x07c707c6u, 0x07c907c8u, 0x07ca07cau, 0x07cc07cau, + 0x07d007ceu, 0x07d307d1u, 0x07d407d4u, 0x07d607d6u, 0x07d607d6u, 0x07d907d8u, 0x07db07dbu, 0x07dc07dbu, + 0x07de07ddu, 0x07df07dfu, 0x07e207e0u, 0x07e807e5u, 0x07eb07e9u, 0x07eb07ebu, 0x07ee07eeu, 0x07ef07efu, + 0x07f407f1u, 0x07f407f4u, 0x07f807f7u, 0x07f807f8u, 0x07f807f8u, 0x07fc07fau, 0x07fe07fcu, 0x080207ffu, + 0x08040803u, 0x08060806u, 0x08080806u, 0x080a0809u, 0x080a080au, 0x080d080bu, 0x08120810u, 0x08130813u, + 0x08160814u, 0x08180818u, 0x081b0819u, 0x081e081eu, 0x0821081eu, 0x08220821u, 0x08240824u, 0x08270826u, + 0x08270827u, 0x082b0829u, 0x082e082cu, 0x082f082eu, 0x0830082fu, 0x08310830u, 0x08320832u, 0x08340833u, + 0x08360834u, 0x08360836u, 0x08380837u, 0x08390839u, 0x083d083bu, 0x083f083du, 0x08410840u, 0x08410841u, + 0x08420841u, 0x08440843u, 0x08450845u, 0x08470846u, 0x084a0849u, 0x084d084bu, 0x084e084eu, 0x084f084fu, + 0x08530852u, 0x08540854u, 0x08550855u, 0x08570855u, 0x085a0858u, 0x085b085au, 0x085c085cu, 0x085d085cu, + 0x085d085du, 0x08630861u, 0x08650864u, 0x08670865u, 0x086a0867u, 0x086e086cu, 0x08710871u, 0x08730872u, + 0x08760873u, 0x08790878u, 0x08790879u, 0x087b087au, 0x087c087bu, 0x087c087cu, 0x087d087du, 0x0880087eu, + 0x08810881u, 0x08830883u, 0x08870886u, 0x08890888u, 0x088d088cu, 0x088e088du, 0x088f088fu, 0x08900890u, + 0x08920890u, 0x08960894u, 0x08970896u, 0x08970897u, 0x08990898u, 0x089d089cu, 0x089f089du, 0x08a208a2u, + 0x08a408a4u, 0x08a808a7u, 0x08a908a8u, 0x08ab08aau, 0x08ae08acu, 0x08af08aeu, 0x08b108b0u, 0x08b208b2u, + 0x08b408b2u, 0x08b608b4u, 0x08b808b7u, 0x08bb08b9u, 0x08bc08bcu, 0x08bd08bcu, 0x08bd08bdu, 0x08be08beu, + 0x08c008bfu, 0x08c108c0u, 0x08c508c3u, 0x08ca08c8u, 0x08cd08ccu, 0x08ce08cdu, 0x08ce08ceu, 0x08d108d0u, + 0x08d208d2u, 0x08d408d4u, 0x08d408d4u, 0x08d508d5u, 0x08d808d6u, 0x08dc08d9u, 0x08dc08dcu, 0x08dd08ddu, + 0x08e008dfu, 0x08e408e2u, 0x08e408e4u, 0x08e508e4u, 0x08e708e6u, 0x08e808e7u, 0x08eb08e9u, 0x08f008eeu, + 0x08f308f2u, 0x08f608f4u, 0x08f608f6u, 0x08f908f9u, 0x08fc08f9u, 0x08fe08fcu, 0x09010901u, 0x09020902u, + 0x09040902u, 0x09050904u, 0x09060906u, 0x09080907u, 0x090b090au, 0x090d090du, 0x090f090eu, 0x09100910u, + 0x09140913u, 0x09160915u, 0x09190917u, 0x091d091cu, 0x091f091eu, 0x09220920u, 0x09260926u, 0x092a0929u, + 0x092d092bu, 0x092e092du, 0x09320931u, 0x09340933u, 0x09350935u, 0x093b0938u, 0x093e093du, 0x0943093fu, + 0x09450945u, 0x09470946u, 0x09480947u, 0x094d0949u, 0x094f094fu, 0x09500950u, 0x09550951u, 0x09560955u, + 0x09560956u, 0x09570957u, 0x09590957u, 0x095c095au, 0x095c095cu, 0x095e095eu, 0x09600960u, 0x09610960u, + 0x09630962u, 0x09650964u, 0x09670967u, 0x096b096au, 0x096e096du, 0x09720970u, 0x09740974u, 0x09740974u, + 0x09750975u, 0x09790978u, 0x097d097bu, 0x097f097fu, 0x097f097fu, 0x09810981u, 0x09820981u, 0x09850983u, + 0x098b0985u, 0x098b098bu, 0x0990098du, 0x09920990u, 0x09940993u, 0x09950994u, 0x09990998u, 0x099e099cu, + 0x099f099eu, 0x09a209a1u, 0x09a309a3u, 0x09a509a4u, 0x09a909a7u, 0x09ad09aau, 0x09b009adu, 0x09b209b0u, + 0x09b209b2u, 0x09b409b2u, 0x09b509b4u, 0x09b509b5u, 0x09b609b5u, 0x09b609b6u, 0x09b909b8u, 0x09bb09bbu, + 0x09be09bdu, 0x09bf09beu, 0x09c109c0u, 0x09c109c1u, 0x09c209c1u, 0x09c409c3u, 0x09c709c6u, 0x09c909c9u, + 0x09ce09cbu, 0x09ce09ceu, 0x09cf09ceu, 0x09cf09cfu, 0x09d109d0u, 0x09d509d2u, 0x09d909d8u, 0x09d909d9u, + 0x09de09ddu, 0x09e009dfu, 0x09e209e1u, 0x09e609e3u, 0x09e809e8u, 0x09e809e8u, 0x09ec09e9u, 0x09ef09eeu, + 0x09f109f1u, 0x09f209f2u, 0x09f409f3u, 0x09f509f4u, 0x09f609f5u, 0x09f909f6u, 0x09fa09f9u, 0x09fd09fbu, + 0x09fe09feu, 0x09ff09ffu, 0x0a030a02u, 0x0a060a05u, 0x0a090a08u, 0x0a0c0a0bu, 0x0a120a0eu, 0x0a140a13u, + 0x0a170a16u, 0x0a190a18u, 0x0a1b0a1au, 0x0a1c0a1cu, 0x0a1d0a1du, 0x0a200a1fu, 0x0a220a20u, 0x0a250a24u, + 0x0a280a27u, 0x0a2b0a2au, 0x0a2d0a2cu, 0x0a300a2du, 0x0a320a31u, 0x0a360a35u, 0x0a380a36u, 0x0a3c0a3au, + 0x0a3d0a3cu, 0x0a3d0a3du, 0x0a3d0a3du, 0x0a3e0a3du, 0x0a400a3fu, 0x0a400a40u, 0x0a410a41u, 0x0a420a41u, + 0x0a420a42u, 0x0a440a43u, 0x0a440a44u, 0x0a440a44u, 0x0a470a47u, 0x0a490a47u, 0x0a490a49u, 0x0a4b0a4au, + 0x0a4e0a4cu, 0x0a500a4eu, 0x0a530a52u, 0x0a540a54u, 0x0a560a55u, 0x0a570a56u, 0x0a580a58u, 0x0a590a58u, + 0x0a590a59u, 0x0a5d0a5cu, 0x0a5e0a5du, 0x0a5f0a5fu, 0x0a600a5fu, 0x0a640a62u, 0x0a660a64u, 0x0a670a66u, + 0x0a6a0a68u, 0x0a6b0a6bu, 0x0a6e0a6eu, 0x0a700a6fu, 0x0a710a71u, 0x0a720a71u, 0x0a730a73u, 0x0a740a74u, + 0x0a750a75u, 0x0a760a76u, 0x0a780a77u, 0x0a7b0a79u, 0x0a7c0a7bu, 0x0a7e0a7cu, 0x0a7e0a7eu, 0x0a7f0a7eu, + 0x0a820a7fu, 0x0a840a83u, 0x0a860a85u, 0x0a880a86u, 0x0a8a0a89u, 0x0a8c0a8bu, 0x0a8f0a8du, 0x0a910a90u, + 0x0a910a91u, 0x0a950a92u, 0x0a970a96u, 0x0a990a98u, 0x0a9b0a99u, 0x0a9d0a9du, 0x0a9f0a9du, 0x0aa00aa0u, + 0x0aa40aa0u, 0x0aa50aa4u, 0x0aaa0aa6u, 0x0aab0aaau, 0x0aaf0aacu, 0x0ab00aafu, 0x0ab10ab1u, 0x0ab40ab1u, + 0x0ab50ab4u, 0x0aba0ab9u, 0x0abd0abbu, 0x0abf0abeu, 0x0ac20ac0u, 0x0ac50ac3u, 0x0ac50ac5u, 0x0ac80ac8u, + 0x00000ac9u, +}; + +constexpr std::array ReciprocalCorrections{ + 0x09230922u, 0x0dcd0dccu, 0x01d101d0u, 0x04e704e6u, 0x0e8d0e8cu, 0x05df05deu, 0x07a507a4u, 0x085b085au, + 0x0f7f0f7eu, 0x0e070e06u, 0x01a901a8u, 0x0bdf0bdeu, 0x06e306e2u, 0x04db04dau, 0x02650264u, 0x0a430a42u, + 0x0fda0e3au, 0x039b0fdbu, 0x03df03deu, 0x0ca30ca2u, 0x096e0c74u, 0x0df5096fu, 0x0e7c0b2au, 0x09020e7du, + 0x08c409abu, 0x005b005au, 0x096e072eu, 0x0e7d096fu, 0x04ff07a9u, 0x07530752u, 0x0a830a82u, 0x04670466u, + 0x087f087eu, 0x06ef0524u, 0x02880cb3u, 0x05b70289u, 0x0d2b0d2au, 0x05d5013eu, 0x08fb0ef3u, 0x03020a8du, + 0x0906042eu, 0x089f00d9u, 0x0f340ea5u, 0x03790f43u, 0x045b045au, 0x01b60f1fu, 0x02970938u, 0x062d0626u, + 0x02b408cfu, 0x0f670c20u, 0x02b50068u, 0x0cdd0cdcu, 0x06e10ebeu, 0x00ab0c9eu, 0x08a7076du, 0x01230da0u, + 0x02590258u, 0x056e051eu, 0x0ecb08ffu, 0x02ba06dcu, 0x03ac0396u, 0x03c303adu, 0x03720927u, 0x01250031u, + 0x12f6018fu, 0x058e0035u, 0x001101e0u, 0x0a6f06a0u, 0x03c2017eu, 0x0975055fu, 0x06490f45u, 0x09520742u, + 0x074d051fu, 0x087204f7u, 0x0c5a0a55u, 0x01650c5bu, 0x01f30dabu, 0x0d5b0364u, 0x087f0368u, 0x0e730953u, + 0x036101bcu, 0x064a1e36u, 0x03a602d2u, 0x0d240954u, 0x081e002au, 0x06690e87u, 0x035b0e6bu, 0x0aa9058au, + 0x044a0018u, 0x06f504f5u, 0x01160bbbu, 0x068101bfu, 0x02790121u, 0x033b0e62u, 0x0dc80b27u, 0x046b014du, + 0x00a70cb1u, 0x03a10230u, 0x03320549u, 0x092708ddu, 0x00640c76u, 0x193b01acu, 0x02eb0998u, 0x0fa30e9du, + 0x0d680286u, 0x0ae40808u, 0x03870f6du, 0x09fa0451u, 0x0a960098u, 0x09ef0cbeu, 0x031702c2u, 0x017d0185u, + 0x02ed03c8u, 0x003e0453u, 0x068801c4u, 0x0f4d0d62u, 0x0b360fe3u, 0x0afb0293u, 0x064a0c79u, 0x042a0ed6u, + 0x014e0c5du, 0x03530535u, 0x0499039fu, 0x02460953u, 0x086f0303u, 0x07b50d76u, 0x0dc40928u, 0x024e0a5au, + 0x068304ecu, 0x07b2076au, 0x07750f6fu, 0x0d3c02a5u, 0x0c6c03bfu, 0x086a00c7u, 0x02b50270u, 0x00ad06cdu, + 0x05b00515u, 0x097b063cu, 0x04d00df2u, 0x09890e9cu, 0x0d830992u, 0x0f40009au, 0x0d86022bu, 0x0ee70e34u, + 0x09560897u, 0x0d240cf7u, 0x06650343u, 0x0488008fu, 0x06bf053cu, 0x0ba80c1cu, 0x0caf0c32u, 0x071f0d84u, + 0x0ded0b02u, 0x07c40558u, 0x00220b18u, 0x018b04cdu, 0x098d05e3u, 0x0b1e0fb9u, 0x01710dc4u, 0x030b0accu, + 0x0f4d0a1cu, 0x01b20fcbu, 0x0273021bu, 0x0b27092du, 0x0d640d14u, 0x08cb0258u, 0x06b10bb5u, 0x0ab506a2u, + 0x01281af9u, 0x0eb00d04u, 0x06b102d1u, 0x0bc70b39u, 0x096b0783u, 0x062b0d74u, 0x01500e6fu, 0x1a11033bu, + 0x09ad0f37u, 0x07150d85u, 0x0a480fabu, 0x081b098eu, 0x0c850be0u, 0x03fc04bfu, 0x0e160d48u, 0x0e130c66u, + 0x075c01f8u, 0x03580e3du, 0x00bd0877u, 0x064602b4u, 0x052b0697u, 0x00bd0c4du, 0x02270179u, 0x096e06bbu, + 0x011c0a9cu, 0x04f80a78u, 0x0fcb020bu, 0x17e301a8u, 0x0e9909d5u, 0x0cbf06abu, 0x072d019du, 0x07110d1eu, + 0x03e60785u, 0x0f5807b7u, 0x076b0114u, 0x009f08b3u, 0x048b0153u, 0x09ed0879u, 0x0eeb0a69u, 0x05c500e7u, + 0x06530d54u, 0x18010680u, 0x06b502c8u, 0x0a8209f2u, 0x062204f0u, 0x10440a5au, 0x042e0254u, 0x0ca908a8u, + 0x0073003au, 0x074103a5u, 0x025a1908u, 0x02a10ce1u, 0x03e503c9u, 0x06ab043cu, 0x097008a3u, 0x05c20d91u, + 0x03250b4cu, 0x0cc70a0fu, 0x071a006eu, 0x00710c41u, 0x0b5a00b4u, 0x00300e76u, 0x08fa0994u, 0x0dfa0973u, + 0x054104cfu, 0x0d5c0d47u, 0x0abf0257u, 0x021d0bc4u, 0x043c03c3u, 0x0e16087fu, 0x09b30eafu, 0x17000164u, + 0x07750726u, 0x02f208d3u, 0x03f306e3u, 0x06280379u, 0x0dce0ae4u, 0x02c400c3u, 0x09d6067cu, 0x0bf10552u, + 0x09eb00bau, 0x0f890af0u, 0x03640035u, 0x00520f97u, 0x05590223u, 0x0c16028du, 0x0d840c21u, 0x068c0130u, + 0x00360f87u, 0x0598018eu, 0x080f07c4u, 0x04110cc6u, 0x09e404eeu, 0x089802d2u, 0x0ed60c97u, 0x0cd10722u, + 0x0ecf0dbbu, 0x0f6008f8u, 0x0b650931u, 0x06dc0cc0u, 0x0a9e07ddu, 0x0ed90ca7u, 0x01150058u, 0x0d020745u, + 0x06e80cc6u, 0x086f072au, 0x013f0e21u, 0x0fc61bdeu, 0x06ff00cau, 0x061a0d5fu, 0x073b06cfu, 0x0f650a40u, + 0x0bc60234u, 0x00280bd0u, 0x0bcd00c3u, 0x006e0f98u, 0x057e04c6u, 0x01ae07d0u, 0x09d7043du, 0x08710d0eu, + 0x08220b46u, 0x0a3909c6u, 0x0c320ab3u, 0x02e70dd1u, 0x0d850f0bu, 0x027f0ddcu, 0x0599044cu, 0x07710a83u, + 0x1b610ae2u, 0x0cca0b68u, 0x001c06aau, 0x002f08a7u, 0x0b990a66u, 0x04a4043du, 0x09c402d4u, 0x0ba20ba9u, + 0x02680fe7u, 0x0b8908a8u, 0x09ce0491u, 0x01af0966u, 0x0c3e0797u, 0x02750f5cu, 0x02d70a0du, 0x0057064au, + 0x0126018au, 0x0ed30792u, 0x0a5504c3u, 0x0cef04b9u, 0x07d10de6u, 0x0f5d0a98u, 0x0f8a0d52u, 0x03c60aebu, + 0x0caf088fu, 0x06b406eau, 0x09040a91u, 0x0bbb0a57u, 0x08a6003au, 0x0f590de3u, 0x06020fb7u, 0x008e083du, + 0x01940124u, 0x07a101bbu, 0x0f1e0c68u, 0x092c0310u, 0x09b4096du, 0x0d120297u, 0x02b70e2du, 0x0c2e19ceu, + 0x118d00a9u, 0x0cf7067fu, 0x01790e25u, 0x0dd91421u, 0x0f040dfeu, 0x0b3c0133u, 0x033b013bu, 0x0ac2048eu, + 0x0d050bcdu, 0x0da40eddu, 0x0ae2046fu, 0x0d1602a4u, 0x01d20669u, 0x0f9b0f24u, 0x04cb1b07u, 0x0d2f06feu, + 0x0f4c0ad0u, 0x076e0fd4u, 0x039a0ea2u, 0x05b203a2u, 0x0cfe0fc6u, 0x00040000u, 0x0cee04a8u, 0x0a9313e9u, + 0x08e60433u, 0x03370317u, 0x0f12092cu, 0x0e8e06b0u, 0x07191400u, 0x02480745u, 0x1bc10a4fu, 0x0930051du, + 0x18de0e5fu, 0x069f051au, 0x0e8e0abbu, 0x09a10231u, 0x0fe10afbu, 0x02f70146u, 0x0a38020cu, 0x0b380995u, + 0x0b420727u, 0x091a0494u, 0x07361c40u, 0x0c320376u, 0x09b10949u, 0x0a270370u, 0x059302c5u, 0x0f4a06cbu, + 0x0e1e069eu, 0x0e0503f9u, 0x0df6017cu, 0x07cb0184u, 0x0c1d08bau, 0x0e3500b8u, 0x02730c99u, 0x0a3f06ebu, + 0x063d06e2u, 0x05ff086cu, 0x0a8208b7u, 0x085f0660u, 0x02dd0f51u, 0x06130576u, 0x061a0581u, 0x00380e54u, + 0x06b102dfu, 0x0752029eu, 0x1c810abbu, 0x0a4502dbu, 0x0ecb0d85u, 0x051a01a6u, 0x09ea0774u, 0x0e390cf0u, + 0x04c40019u, 0x055100cfu, 0x037206c8u, 0x049403b8u, 0x005a153du, 0x0243011du, 0x00ac007cu, 0x088c06f7u, + 0x0ce70b5cu, 0x0e7b0d84u, 0x040902a2u, 0x031a084bu, 0x002e064au, 0x0c9d0cd2u, 0x00c8036cu, 0x0f1a07a7u, + 0x07420150u, 0x0b850f5du, 0x0bb20072u, 0x0cae0dbau, 0x06891371u, 0x04f40adfu, 0x08360659u, 0x12810f3bu, + 0x019108fdu, 0x037e0c9du, 0x0f2f0b57u, 0x0cc405a8u, 0x064a07d5u, 0x08340f67u, 0x02410d1fu, 0x08c506cbu, + 0x0d3e0d7fu, 0x088a0198u, 0x0d3b0eb6u, 0x08340031u, 0x01591f7du, 0x03e20cdfu, 0x0cf30c50u, 0x00fe1ef7u, + 0x050f01c4u, 0x07ac0c36u, 0x0658057du, 0x02c80743u, 0x0d3e0d4cu, 0x06570264u, 0x01ee0e6eu, 0x0ab30a4bu, + 0x01160098u, 0x00e307e3u, 0x07da050bu, 0x0349013eu, 0x00d10568u, 0x023014d7u, 0x0efa02a0u, 0x0b9f0f6au, + 0x0ff50d0fu, 0x034e08b8u, 0x03f40a10u, 0x09d60958u, 0x09670336u, 0x02d70e9du, 0x08490548u, 0x073f0012u, + 0x007c0b8fu, 0x19120fc8u, 0x0ed008dcu, 0x0d890533u, 0x030802fbu, 0x0e410c8du, 0x1cb80224u, 0x0e7d08fcu, + 0x18c108beu, 0x06ef0e4bu, 0x0b0b0b85u, 0x02bb019cu, 0x09331414u, 0x01900342u, 0x063b1bf8u, 0x0d2a0d59u, + 0x0b7a090du, 0x087f0e27u, 0x06dc046du, 0x05380a6du, 0x09070314u, 0x0ce40ee0u, 0x0a8d09b7u, 0x0e680367u, + 0x0d920486u, 0x091b0288u, 0x0d010fb4u, 0x09d80eceu, 0x0ea6048au, 0x02da0b5du, 0x01570b88u, 0x016c078bu, + 0x074d037cu, 0x08be078du, 0x025f0b3fu, 0x05360c4cu, 0x09b706f9u, 0x04b00b46u, 0x0c1208ebu, 0x1e8a0a46u, + 0x00080f72u, 0x003a0021u, 0x13f402cfu, 0x0642053du, 0x00e700aau, 0x04b10ad4u, 0x0fa00e90u, 0x00970eb0u, + 0x04740b05u, 0x16710ba9u, 0x0a3007d6u, 0x0b8a0a4fu, 0x0d2d0af9u, 0x02e109bbu, 0x0c650d75u, 0x0f5c01d9u, + 0x01990f6fu, 0x0ea30ac5u, 0x0d1507b3u, 0x0f7a0ed1u, 0x05ec0455u, 0x01b609e8u, 0x04bd0cc1u, 0x07bd0bd0u, + 0x02470b13u, 0x062a19afu, 0x04da0a7cu, 0x0ee308cau, 0x0be5000fu, 0x046d0ef7u, 0x050d0eccu, 0x04780947u, + 0x0b141721u, 0x04a30c26u, 0x00f30e27u, 0x086a0034u, 0x0efb0e58u, 0x09470553u, 0x0f770bf9u, 0x0c100059u, + 0x077b02e8u, 0x0e8507d0u, 0x0e3f075fu, 0x073601c9u, 0x05640dd8u, 0x075f0a4bu, 0x0ee60e3du, 0x057a0212u, + 0x0db10c5au, 0x067f0008u, 0x039301bbu, 0x085e0565u, 0x0efa0bc3u, 0x03380f6fu, 0x0cba0034u, 0x14d7100fu, + 0x096d006eu, 0x03d40d1au, 0x049609eeu, 0x0f7f0b78u, 0x0a0e08feu, 0x01e20b90u, 0x0e6705b0u, 0x0d3310c3u, + 0x055f0302u, 0x096b08c2u, 0x1acc09c1u, 0x08aa0345u, 0x037602c2u, 0x057504d4u, 0x0f3b0ee8u, 0x0aa00f66u, + 0x04fc0215u, 0x0e43005eu, 0x0ba60350u, 0x04c81cf9u, 0x0df707afu, 0x069707cbu, 0x0ed70965u, 0x007b05bcu, + 0x0c960f1au, 0x05f60c04u, 0x0e800dcbu, 0x09c70f82u, 0x04b40612u, 0x04e30c57u, 0x09c508b9u, 0x045b1f4au, + 0x0aa814d7u, 0x0c2b0ecbu, 0x180a1ef5u, 0x0ab0045du, 0x039100b3u, 0x0c7c0587u, 0x0d5b02a9u, 0x002d000eu, + 0x09720c68u, 0x0ecf0231u, 0x03c70afau, 0x0d6c06f5u, 0x01320bcfu, 0x04e811cfu, 0x0cdf0f7bu, 0x06ca09deu, + 0x0b0e06c8u, 0x01230562u, 0x0fb20b65u, 0x02c70882u, 0x08c40749u, 0x0d480b66u, 0x177103cfu, 0x06ca09f2u, + 0x063c0456u, 0x0add00d5u, 0x0b3308afu, 0x0ea30f84u, 0x0b7204d7u, 0x04e70e35u, 0x043b0a95u, 0x18450cbfu, + 0x0fd70a2bu, 0x0c8c03e2u, 0x087a008au, 0x1dd31d76u, 0x00300f35u, 0x0bd6084eu, 0x01050d8bu, 0x06600568u, + 0x0c9e0c4du, 0x13550f6au, 0x15bc073au, 0x082306ddu, 0x02500c6cu, 0x15710e9bu, 0x084f1eedu, 0x0a5f0949u, + 0x046a000eu, 0x092317f2u, 0x0cd11c78u, 0x05570228u, 0x061c008bu, 0x092d081du, 0x04b40b07u, 0x01b706ecu, + 0x099414f2u, 0x120d0a3cu, 0x0e600a1bu, 0x1719049cu, 0x08da0984u, 0x0627033eu, 0x011a09c4u, 0x0727010du, + 0x04f0082cu, 0x057a015du, 0x1a8509d7u, 0x0d2b1cccu, 0x097d0792u, 0x01c80e69u, 0x02bb0366u, 0x009b0c68u, + 0x0a2909f7u, 0x0e7d071au, 0x0e941c04u, 0x03a911d3u, 0x0a240957u, 0x0c940bf4u, 0x0b5f0b28u, 0x028e0fc5u, + 0x08ae0d84u, 0x05d20c71u, 0x05710aedu, 0x052e0a9cu, 0x054e0ac8u, 0x0f880c7eu, 0x0ef6083du, 0x006f0a28u, + 0x19d50787u, 0x02ac0f28u, 0x0a5f033cu, 0x1e5c0c9bu, 0x0d2f0553u, 0x0fe60f84u, 0x08ae0214u, 0x09d1016au, + 0x083d0d58u, 0x11e00e5du, 0x02ea0e50u, 0x0e27081du, 0x028002eau, 0x099205d2u, 0x0c5e0726u, 0x09ba1e66u, + 0x00290ef6u, 0x05b50223u, 0x079305efu, 0x06e31f47u, 0x00b00e11u, 0x02b0028fu, 0x09fe0634u, 0x024901d1u, + 0x07251586u, 0x0a681520u, 0x02571e25u, 0x0e8802c8u, 0x0f130029u, 0x1aa606ecu, 0x1c6015fau, 0x0f990ef3u, + 0x089406f0u, 0x02b30befu, 0x0f1b0d89u, 0x04a60145u, 0x10980c5bu, 0x06a2017fu, 0x167f1e12u, 0x0b0c19a0u, + 0x19a500ceu, 0x04f6018eu, 0x0e710c36u, 0x00120f15u, 0x00001e03u, 0x0156194fu, 0x14b80330u, 0x1e570bc2u, + 0x01050f3du, 0x1af905a8u, 0x09eb0862u, 0x0d5f05b1u, 0x048c03ebu, 0x0963061au, 0x19dc019du, 0x04691bebu, + 0x07f20e07u, 0x0fcf0bbbu, 0x1cc007fdu, 0x1e800b64u, 0x04651b38u, 0x0b9d0a7du, 0x0b720005u, 0x0fd6063du, + 0x06ae11bau, 0x013816b1u, 0x082c021bu, 0x03221beau, 0x16f906f8u, 0x025001a2u, 0x009f1a20u, 0x0acd100fu, + 0x0cbf0ef2u, 0x0569036du, 0x070e102bu, 0x06210b4du, 0x18fa0d3eu, 0x04fd0b06u, 0x084507b6u, 0x0bea1a45u, + 0x08be0573u, 0x0d0a1be9u, 0x192700a4u, 0x0ad60a34u, 0x05410f23u, 0x08c40c2du, 0x08bf026du, 0x007e09bbu, + 0x012c1041u, 0x0a5911b9u, 0x18a202c8u, 0x0b540a76u, 0x07af0530u, 0x040309e1u, 0x11f90406u, 0x0b5f032fu, + 0x0db00d5eu, 0x081b07deu, 0x0e291f5eu, 0x1ab202d6u, 0x0ab60b13u, 0x0b3107b4u, 0x069c11f8u, 0x09a3163eu, + 0x056b026cu, 0x042608b5u, 0x01c30788u, 0x079414e1u, 0x085f054fu, 0x02fd1d41u, 0x169e0794u, 0x0d5d1680u, + 0x074f1ffcu, 0x192e091au, 0x1b411e08u, 0x0b4f0a9au, 0x0e570b1eu, 0x0288001fu, 0x078e05a2u, 0x01b01c0du, + 0x069313e1u, 0x0ad708feu, 0x0ed01dcfu, 0x060b0a56u, 0x03c807e4u, 0x1fbc0d62u, 0x038c1d8du, 0x033609fcu, + 0x09ca086au, 0x0a260bacu, 0x0f7708e4u, 0x0774040fu, 0x0e340e69u, 0x0cfe0e3fu, 0x0e9f0fbfu, 0x0a4f0715u, + 0x01160fcdu, 0x075f0642u, 0x0a3f090du, 0x0dac0382u, 0x03b40ce9u, 0x16410523u, 0x0355003eu, 0x02590d33u, + 0x0c6516bdu, 0x088f05c3u, 0x068a0971u, 0x0f4b0dd7u, 0x07d9004fu, 0x086a1548u, 0x07341000u, 0x068c0274u, + 0x00090000u, 0x001b0012u, 0x002d0024u, 0x003f0036u, 0x03a006e2u, 0x0c7a0985u, 0x13a310f2u, 0x0b491025u, + 0x033800d3u, 0x1c7206e3u, 0x0c691176u, 0x1a11016bu, 0x0cc20b72u, 0x05710df1u, 0x15680f1au, 0x0cd108aau, + 0x04630ce6u, 0x0c35050eu, 0x046004afu, 0x0fed061du, 0x1be00967u, 0x0d1d16c4u, 0x0f640e55u, 0x07e00417u, + 0x14190c5au, 0x1d921554u, 0x1df90ea5u, 0x0eb00a5eu, 0x110309cau, 0x0e5a0df9u, 0x0e690a65u, 0x075801eeu, + 0x0db30a05u, 0x0ee30f7bu, 0x04cf02d1u, 0x008a094du, 0x08a51872u, 0x0e300bd0u, 0x09450f24u, 0x0fb7016cu, + 0x00960bcbu, 0x0ade00f8u, 0x10940bfcu, 0x075e1465u, 0x031a0539u, 0x00111b10u, 0x0b15187bu, 0x035200b4u, + 0x0a2e1bdeu, 0x112e195bu, 0x095a13eau, 0x09ce085eu, 0x18060f1du, 0x07130d9du, 0x182d0b88u, 0x1c990a9du, + 0x1ac702fdu, 0x01cc0bf4u, 0x04ea04d7u, 0x05870cd2u, 0x0afe0a48u, 0x0d421cb2u, 0x02d71310u, 0x0df21bf7u, + 0x0c0e165eu, 0x040a0165u, 0x015401adu, 0x11a0021bu, 0x0daa0d0eu, 0x07780545u, 0x0a3c098eu, 0x1f620f4bu, + 0x04da034du, 0x038f1e83u, 0x01ef0a87u, 0x014e0b47u, 0x19c6028du, 0x1264026bu, 0x075b0a7eu, 0x0480044cu, + 0x0c4a1acbu, 0x0024022fu, 0x11820dc5u, 0x08241f8fu, 0x07c00859u, 0x03f50058u, 0x0d1a0430u, 0x099306a9u, + 0x00d60f4du, 0x0eb308b5u, 0x10360779u, 0x0c6e0606u, 0x05e603b3u, 0x032a0b25u, 0x11c00ea9u, 0x1632033eu, + 0x0d40078bu, 0x022710a8u, 0x03530a0fu, 0x07f206edu, 0x02c209e0u, 0x0f9a0cd0u, 0x0e1f1817u, 0x099f0fc7u, + 0x00331fbeu, 0x05a814f9u, 0x08cb16f3u, 0x0b0004ccu, 0x07430d5du, 0x04330e7eu, 0x17e20c33u, 0x03ec1ddcu, + 0x03ea1604u, 0x0eac0c76u, 0x00210000u, 0x0d0d19dcu, 0x0ae615fcu, 0x1b300887u, 0x0a060fdbu, 0x1d4a08dau, + 0x0ef51ff9u, 0x0514076fu, 0x0258005fu, 0x0d641050u, 0x015b0045u, 0x08090032u, 0x0c250a8du, 0x07030422u, + 0x0d180a87u, 0x00860588u, 0x0e5608c4u, 0x11110c54u, 0x15110b74u, 0x096d0068u, 0x089c0b25u, 0x064102dau, + 0x15cd048au, 0x00f308f1u, 0x0ddb1fb3u, 0x0d8e06aau, 0x07360644u, 0x02910f00u, 0x076e16bfu, 0x00420000u, + 0x0f821945u, 0x1e1202c5u, 0x08170125u, 0x07d50672u, 0x03131806u, 0x1b5904beu, 0x0c5a03dau, 0x104908f8u, + 0x0f6e1de5u, 0x1c2016a6u, 0x01ec02b7u, 0x0bbc11f9u, 0x1df102d1u, 0x0e880345u, 0x06190350u, 0x1935015eu, + 0x0185006bu, 0x03640955u, 0x165711ceu, 0x0a3102fbu, 0x08d802fbu, 0x0c760ac8u, 0x07ed0103u, 0x02040b8eu, + 0x0ff50cdcu, 0x1e6707c3u, 0x0d351edfu, 0x1ea41e21u, 0x00450603u, 0x055c0b12u, 0x0fab1f82u, 0x08430a7eu, + 0x005419ddu, 0x076416beu, 0x08c3014au, 0x0b9d19a3u, 0x09a112b2u, 0x1b6906d8u, 0x0262011cu, 0x014715f9u, + 0x076d15e0u, 0x0aae0380u, 0x086d022eu, 0x1fe3003eu, 0x01071660u, 0x135d0e1du, 0x070a16c5u, 0x0c7c0ad7u, + 0x1f540663u, 0x061612b5u, 0x1ce40423u, 0x06561183u, 0x03b904ccu, 0x04470860u, 0x0c0e0a18u, 0x1a4f0997u, + 0x00670b7du, 0x0e9f113du, 0x0a601481u, 0x05560d5bu, 0x08cb0a58u, 0x1e190c37u, 0x164301fbu, 0x03370418u, + 0x04c20a9cu, 0x023918a4u, 0x079b0010u, 0x069f00a9u, 0x00a40146u, 0x141c0687u, 0x13d91a7eu, 0x10b81811u, + 0x0b62170au, 0x1bc10fbbu, 0x017d00a1u, 0x04a707dcu, 0x019c08d3u, 0x03dd1ea4u, 0x0c190f3au, 0x071b028eu, + 0x09990925u, 0x01570979u, 0x0529006fu, 0x03e118f1u, 0x1b7e01d2u, 0x14d609cbu, 0x11280c7eu, 0x01b90190u, + 0x006b09b0u, 0x0f0c0566u, 0x043a0d40u, 0x055c05e4u, 0x0f510979u, 0x17a50103u, 0x0f3c0688u, 0x126c1269u, + 0x05251cbfu, 0x000704d9u, 0x19910048u, 0x0fe21090u, 0x1ecb17b3u, 0x0f2e0c18u, 0x05460a35u, 0x07560314u, + 0x0d68054du, 0x13291e85u, 0x0d751c10u, 0x1d4815b4u, 0x041d08f3u, 0x0f8107b4u, 0x0b520641u, 0x02f20cefu, + 0x09e70742u, 0x19e004d9u, 0x0e2d0c5du, 0x00201b11u, 0x108e0118u, 0x03cf03ccu, 0x003b0b77u, 0x012a08d5u, + 0x0aca09a4u, 0x0ed80807u, 0x18171265u, 0x057f097fu, 0x043d01cau, 0x005d0c51u, 0x1efd079au, 0x0c03012fu, + 0x184e1258u, 0x00310000u, 0x1f960f23u, 0x11f00ff4u, 0x140f038du, 0x0a421607u, 0x01620388u, 0x0eee0d9bu, + 0x0cd80a39u, 0x0aea0d38u, 0x05b90ba7u, 0x0d250730u, 0x07830276u, 0x0c2915f9u, 0x0ba20be3u, 0x0aa60303u, + 0x0e861e0cu, 0x1fbb07aeu, 0x04bf0d1cu, 0x11b4005au, 0x10b11792u, 0x1d870202u, 0x023b0bfdu, 0x15b81f61u, + 0x0b3008bcu, 0x0cf01148u, 0x10800ec6u, 0x0fd8018bu, 0x00e314c5u, 0x005805d4u, 0x08961309u, 0x15a400cbu, + 0x1b481956u, 0x04770015u, 0x0d021957u, 0x16a713feu, 0x008b0876u, 0x1d5318c1u, 0x09a70279u, 0x08d703cau, + 0x05310a00u, 0x0dba1a6bu, 0x03970e3eu, 0x00301562u, 0x1cc214d6u, 0x168c0949u, 0x1a0206b1u, 0x0def0f0cu, + 0x02460055u, 0x03ca05c4u, 0x0b591ac3u, 0x188f128eu, 0x01980a22u, 0x156502a8u, 0x07cd100cu, 0x1a7004b2u, + 0x0151007eu, 0x1863023du, 0x0ac10a73u, 0x05df1469u, 0x146f0666u, 0x0f27043bu, 0x17161f46u, 0x0a7314a8u, + 0x05d90c56u, 0x0bb215d3u, 0x03ba0edeu, 0x08c716d7u, 0x14450138u, 0x02d01b31u, 0x0eea0cc4u, 0x016d0326u, + 0x058404c4u, 0x03c5066du, 0x066105deu, 0x05ef014cu, 0x056d05a8u, 0x17c0165cu, 0x02b109a3u, 0x0382092cu, + 0x13e707dcu, 0x0c8a143du, 0x05550d36u, 0x13b916adu, 0x0e9f0f47u, 0x0f3f137cu, 0x0c1010d1u, 0x04c80072u, + 0x006403e8u, 0x06a20a4au, 0x0a3e004au, 0x03720f4eu, 0x0eae0d91u, 0x05980076u, 0x1bf10a5au, 0x15191332u, + 0x1b980322u, 0x0bdc1ad4u, 0x121a1ef7u, 0x048f03feu, 0x17000b34u, 0x18fc0c20u, 0x04e61979u, 0x12241579u, + 0x074a14d7u, 0x05860361u, 0x000e0be1u, 0x0030001fu, 0x00520041u, 0x00f61e9bu, 0x00130615u, 0x0c7e0964u, + 0x045f00cdu, 0x14061a21u, 0x023d085bu, 0x093d06fbu, 0x046d0deau, 0x0a6407d6u, 0x194d1640u, 0x00a6085bu, + 0x013009bcu, 0x058116a0u, 0x09541decu, 0x03c01dd0u, 0x0d240864u, 0x05950108u, 0x16761db9u, 0x0ef606a8u, + 0x15fe05ebu, 0x0f7715e9u, 0x174d1f96u, 0x1e3504a6u, 0x0165004bu, 0x02130278u, 0x09a90a61u, 0x177d063cu, + 0x09070105u, 0x05ca1855u, 0x1a051152u, 0x07851330u, 0x1df209a7u, 0x00001f55u, 0x07440007u, 0x1a5d1cbfu, + 0x0cbc0885u, 0x089f00d2u, 0x02e91d3au, 0x0bf9092bu, 0x11551958u, 0x19b503cau, 0x06b40a1au, 0x18110ed0u, + 0x05bf07a6u, 0x03cf07fdu, 0x1d4008f3u, 0x0bf312c8u, 0x000a070au, 0x0e1a0abeu, 0x1e5e1dc8u, 0x128006c2u, + 0x0d861299u, 0x0ba303c8u, 0x07761fceu, 0x0b7409f7u, 0x09bd1efcu, 0x05ad184fu, 0x0aba1b89u, 0x00790713u, + 0x0a631655u, 0x09640f98u, 0x132f196du, 0x043e0351u, 0x13c707c7u, 0x08630605u, 0x0ee30212u, 0x0e6e0397u, + 0x0f0a1ebcu, 0x0fc41ec8u, 0x0c651a13u, 0x0ada1d6cu, 0x09571288u, 0x062a0916u, 0x087e14b4u, 0x0bd70e45u, + 0x172611e8u, 0x0e6815b9u, 0x12850c43u, 0x17db14a3u, 0x0f9b1a71u, 0x07021de6u, 0x08f01334u, 0x1dba1ccbu, + 0x07bd01d0u, 0x16440166u, 0x017a1ad3u, 0x1d210b61u, 0x160c1080u, 0x070c0405u, 0x0537192bu, 0x08d412acu, + 0x0b1d0786u, 0x0a560117u, 0x04a20130u, 0x04ca0b7bu, 0x082709bfu, 0x0da50a93u, 0x19590007u, 0x16ba068bu, + 0x1ed401c3u, 0x00b50f57u, 0x165c0a4fu, 0x0a680e76u, 0x010c1db6u, 0x0a7c07e9u, 0x12e818f3u, 0x1f991014u, + 0x155c02f6u, 0x0e7600f4u, 0x0747008eu, 0x1a6413d0u, 0x0d0303b6u, 0x12d105e2u, 0x04bc03e6u, 0x01741353u, + 0x12c1062du, 0x1a8c0f24u, 0x046606d9u, 0x11c106d6u, 0x18850fa7u, 0x0cce097au, 0x1f9b1509u, 0x000001eeu, + 0x003e001fu, 0x1b2c08b8u, 0x152b0237u, 0x1deb04ebu, 0x14001b2fu, 0x11280499u, 0x006b1be7u, 0x160015e1u, + 0x00f41df0u, 0x08181371u, 0x01530a86u, 0x0da20b03u, 0x0a820433u, 0x049c0ab5u, 0x0816059fu, 0x0d640e1fu, + 0x0cd00303u, 0x1f9b1d50u, 0x0f040c3cu, 0x19e017dbu, 0x0fb20b51u, 0x18fa0384u, 0x0d4f08e4u, 0x0a890da6u, + 0x07e7120fu, 0x1de00cf4u, 0x04e01320u, 0x0826070au, 0x1a740ff8u, 0x012a1619u, 0x1a2d0481u, 0x00741488u, + 0x069d0388u, 0x11f00f3cu, 0x03ff1615u, 0x1720071eu, 0x00001486u, +}; + +template +std::uint32_t DefineTable(SpirvEmitterState& state, const std::array& values) { + std::array words{}; + for (std::size_t index = 0; index < Size; ++index) words[index] = ConstantU32(state, values[index]); + const auto arrayType = state.module.Type(spv::OpTypeArray, TypeU32(state), ConstantU32(state, static_cast(Size))); + const auto table = state.module.Constant(spv::OpConstantComposite, arrayType, std::span(words)); + return state.module.DefineInitializedGlobalVariable(TypePointer(state, spv::StorageClassPrivate, arrayType), spv::StorageClassPrivate, table); +} + +std::uint32_t LoadTable(SpirvEmitterState& state, std::uint32_t table, std::uint32_t index) { + const auto pointer = state.module.AllocateId(); + state.module.AddFunction(spv::OpAccessChain, TypePointer(state, spv::StorageClassPrivate, TypeU32(state)), pointer, table, index); + const auto value = state.module.AllocateId(); + state.module.AddFunction(spv::OpLoad, TypeU32(state), value, pointer); + return value; +} + +std::array MultiplyExtended(SpirvEmitterState& state, std::uint32_t lhs, std::uint32_t rhs) { + const auto product = state.module.AllocateId(); + state.module.AddFunction(spv::OpUMulExtended, TypeU32Pair(state), product, lhs, rhs); + std::array words{state.module.AllocateId(), state.module.AllocateId()}; + state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), words[0], product, 0u); + state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), words[1], product, 1u); + return words; +} + +std::uint32_t ReciprocalCorrection(SpirvEmitterState& state, std::uint32_t mantissa) { + const auto u32 = TypeU32(state); + const auto boolean = TypeBool(state); + const auto op = [&](spv::Op opcode, std::uint32_t lhs, std::uint32_t value) { return Binary(state, opcode, u32, lhs, ConstantU32(state, value)); }; + const auto starts = DefineTable(state, ReciprocalCorrectionStarts); + const auto corrections = DefineTable(state, ReciprocalCorrections); + const auto halfword = [&](std::uint32_t table, std::uint32_t index, std::uint32_t last) { + const auto clamped = Select(state, u32, Binary(state, spv::OpULessThan, boolean, index, ConstantU32(state, last)), index, ConstantU32(state, last)); + const auto word = LoadTable(state, table, op(spv::OpShiftRightLogical, clamped, 1u)); + return op(spv::OpBitwiseAnd, Binary(state, spv::OpShiftRightLogical, u32, word, op(spv::OpShiftLeftLogical, op(spv::OpBitwiseAnd, clamped, 1u), 4u)), 0xffffu); + }; + const auto lastStart = static_cast(ReciprocalCorrectionStarts.size() * 2u - 1u); + const auto lastCorrection = static_cast(ReciprocalCorrections.size() * 2u - 1u); + const auto bucket = op(spv::OpShiftRightLogical, mantissa, 12u); + const auto key = op(spv::OpBitwiseAnd, mantissa, 0xfffu); + const auto end = halfword(starts, op(spv::OpIAdd, bucket, 1u), lastStart); + auto first = halfword(starts, bucket, lastStart); + auto remaining = Binary(state, spv::OpISub, u32, end, first); + for (const std::uint32_t step : {8u, 4u, 2u, 1u}) { + const auto probe = op(spv::OpBitwiseAnd, halfword(corrections, op(spv::OpIAdd, first, step - 1u), lastCorrection), 0xfffu); + const auto inside = Binary(state, spv::OpULessThanEqual, boolean, ConstantU32(state, step), remaining); + const auto skip = Binary(state, spv::OpLogicalAnd, boolean, inside, Binary(state, spv::OpULessThan, boolean, probe, key)); + first = Select(state, u32, skip, op(spv::OpIAdd, first, step), first); + remaining = Select(state, u32, skip, op(spv::OpISub, remaining, step), remaining); + } + const auto entry = halfword(corrections, first, lastCorrection); + const auto hit = Binary(state, spv::OpLogicalAnd, boolean, Binary(state, spv::OpULessThan, boolean, first, end), Binary(state, spv::OpIEqual, boolean, op(spv::OpBitwiseAnd, entry, 0xfffu), key)); + const auto delta = Select(state, u32, Binary(state, spv::OpINotEqual, boolean, op(spv::OpBitwiseAnd, entry, 0x1000u), ConstantU32(state, 0u)), ConstantU32(state, 1u), ConstantU32(state, 0xffffffffu)); + return Select(state, u32, hit, delta, ConstantU32(state, 0u)); +} + +bool ExactReciprocal() { + static const bool exact = std::getenv("APS5_EXACT_RCP") != nullptr; + return exact; +} + +std::uint32_t DeviceReciprocal(SpirvEmitterState& state, std::uint32_t value) { + return Binary(state, spv::OpFDiv, TypeF32(state), ConstantF32(state, 0x3f800000u), value); +} + +std::uint32_t HardwareReciprocal(SpirvEmitterState& state, std::uint32_t value) { + const auto u32 = TypeU32(state); + const auto f32 = TypeF32(state); + const auto boolean = TypeBool(state); + const auto op = [&](spv::Op opcode, std::uint32_t lhs, std::uint32_t constant) { return Binary(state, opcode, u32, lhs, ConstantU32(state, constant)); }; + const auto add = [&](std::uint32_t lhs, std::uint32_t rhs) { return Binary(state, spv::OpIAdd, u32, lhs, rhs); }; + const auto sub = [&](std::uint32_t lhs, std::uint32_t rhs) { return Binary(state, spv::OpISub, u32, lhs, rhs); }; + const auto test = [&](spv::Op opcode, std::uint32_t lhs, std::uint32_t rhs) { return Binary(state, opcode, boolean, lhs, rhs); }; + const auto pick = [&](std::uint32_t condition, std::uint32_t whenTrue, std::uint32_t whenFalse) { return Select(state, u32, condition, ConstantU32(state, whenTrue), ConstantU32(state, whenFalse)); }; + if (state.reciprocalTables[0] == 0u) { + state.reciprocalTables = {DefineTable(state, ReciprocalConstant), DefineTable(state, ReciprocalLinear), DefineTable(state, ReciprocalHigherOrder)}; + } + const auto bits = Unary(state, spv::OpBitcast, u32, value); + const auto exponent = op(spv::OpBitwiseAnd, op(spv::OpShiftRightLogical, bits, 23u), 0xffu); + const auto mantissa = op(spv::OpBitwiseAnd, bits, 0x7fffffu); + const auto segment = op(spv::OpShiftRightLogical, mantissa, 18u); + const auto fraction = op(spv::OpBitwiseAnd, mantissa, 0x3ffffu); + const auto constant = LoadTable(state, state.reciprocalTables[0], segment); + const auto linearFactor = LoadTable(state, state.reciprocalTables[1], segment); + const auto higherOrder = LoadTable(state, state.reciprocalTables[2], segment); + + const auto linearProduct = MultiplyExtended(state, linearFactor, fraction); + const auto wide = test(spv::OpUGreaterThanEqual, linearProduct[1], ConstantU32(state, 64u)); + const auto shift = pick(wide, 15u, 14u); + const auto quotient = Binary(state, spv::OpBitwiseOr, u32, Binary(state, spv::OpShiftLeftLogical, u32, linearProduct[1], sub(ConstantU32(state, 32u), shift)), Binary(state, spv::OpShiftRightLogical, u32, linearProduct[0], shift)); + const auto midpoint = pick(wide, 0x4000u, 0x2000u); + const auto remainder = Binary(state, spv::OpBitwiseAnd, u32, linearProduct[0], pick(wide, 0x7fffu, 0x3fffu)); + const auto odd = test(spv::OpINotEqual, op(spv::OpBitwiseAnd, quotient, 1u), ConstantU32(state, 0u)); + const auto roundUp = Binary(state, spv::OpLogicalOr, boolean, test(spv::OpUGreaterThan, remainder, midpoint), Binary(state, spv::OpLogicalAnd, boolean, test(spv::OpIEqual, remainder, midpoint), odd)); + const auto rounded = add(quotient, pick(roundUp, 1u, 0u)); + const auto linear = Binary(state, spv::OpShiftLeftLogical, u32, rounded, pick(wide, 1u, 0u)); + + const auto half = op(spv::OpShiftRightLogical, fraction, 1u); + const auto quadraticProduct = MultiplyExtended(state, op(spv::OpBitwiseAnd, higherOrder, 0xffffu), half); + const auto shiftedHigh = Binary(state, spv::OpBitwiseOr, u32, op(spv::OpShiftLeftLogical, quadraticProduct[1], 18u), op(spv::OpShiftRightLogical, quadraticProduct[0], 14u)); + const auto shiftedLow = op(spv::OpShiftLeftLogical, quadraticProduct[0], 18u); + const auto cubicProduct = MultiplyExtended(state, Binary(state, spv::OpIMul, u32, op(spv::OpShiftRightLogical, higherOrder, 16u), fraction), half); + const auto innerLow = sub(shiftedLow, cubicProduct[0]); + const auto innerHigh = sub(sub(shiftedHigh, cubicProduct[1]), pick(test(spv::OpULessThan, shiftedLow, cubicProduct[0]), 1u, 0u)); + const auto upper = MultiplyExtended(state, innerHigh, half); + const auto lower = MultiplyExtended(state, innerLow, half); + const auto upperPart = Binary(state, spv::OpBitwiseOr, u32, op(spv::OpShiftLeftLogical, upper[1], 15u), op(spv::OpShiftRightLogical, upper[0], 17u)); + const auto carryPart = op(spv::OpShiftRightLogical, add(op(spv::OpBitwiseAnd, upper[0], 0x1ffffu), lower[1]), 17u); + const auto quadratic = add(upperPart, carryPart); + + const auto sum = add(sub(op(spv::OpShiftLeftLogical, constant, 4u), linear), op(spv::OpIAdd, op(spv::OpShiftLeftLogical, quadratic, 1u), 32u)); + const auto dropped = op(spv::OpBitwiseAnd, sum, 63u); + const auto nearCut = Binary(state, spv::OpLogicalOr, boolean, test(spv::OpULessThan, dropped, ConstantU32(state, 2u)), test(spv::OpUGreaterThanEqual, dropped, ConstantU32(state, 62u))); + const auto correction = EmitValueOrZeroIfCondition(state, nearCut, [&] { + const auto result = state.module.AllocateId(); + state.module.AddFunction(spv::OpFunctionCall, u32, result, state.reciprocalCorrectionFunction, mantissa); + return result; + }); + const auto normalized = add(op(spv::OpIAdd, op(spv::OpShiftRightLogical, sum, 6u), 0x3e800000u), correction); + const auto resultExponent = sub(op(spv::OpIAdd, op(spv::OpShiftRightLogical, normalized, 23u), 127u), exponent); + const auto exactBits = Binary(state, spv::OpBitwiseOr, u32, Binary(state, spv::OpBitwiseOr, u32, op(spv::OpBitwiseAnd, bits, 0x80000000u), op(spv::OpShiftLeftLogical, resultExponent, 23u)), op(spv::OpBitwiseAnd, normalized, 0x7fffffu)); + const auto normalInput = Binary(state, spv::OpLogicalAnd, boolean, test(spv::OpINotEqual, exponent, ConstantU32(state, 0u)), test(spv::OpINotEqual, exponent, ConstantU32(state, 0xffu))); + const auto normalResult = Binary(state, spv::OpLogicalAnd, boolean, test(spv::OpSGreaterThan, resultExponent, ConstantU32(state, 0u)), test(spv::OpSLessThan, resultExponent, ConstantU32(state, 0xffu))); + const auto approximate = DeviceReciprocal(state, value); + return Select(state, f32, Binary(state, spv::OpLogicalAnd, boolean, normalInput, normalResult), Unary(state, spv::OpBitcast, f32, exactBits), approximate); +} + +} + +void DefineReciprocalCorrectionFunction(SpirvEmitterState& state) { + bool used = false; + for (const IrBlock* block : state.program.BlockOrder()) { + for (const IrValue* inst : block->Instructions()) used = used || inst->Opcode() == IrOpcode::FPRecip32 || inst->Opcode() == IrOpcode::FPRecipIFlag32; + } + if (!used || !ExactReciprocal()) return; + const auto u32 = TypeU32(state); + state.reciprocalCorrectionFunction = state.module.AllocateId(); + state.module.AddName(state.reciprocalCorrectionFunction, "rcp_f32_correction"); + state.module.AddFunction(spv::OpFunction, u32, state.reciprocalCorrectionFunction, spv::FunctionControlDontInlineMask, state.module.Type(spv::OpTypeFunction, u32, u32)); + const auto mantissa = state.module.AllocateId(); + state.module.AddFunction(spv::OpFunctionParameter, u32, mantissa); + EmitLabel(state, state.module.AllocateId()); + state.module.AddFunction(spv::OpReturnValue, ReciprocalCorrection(state, mantissa)); + state.module.AddFunction(spv::OpFunctionEnd); +} + +std::uint32_t EmitFPRecip32(SpirvEmitterState& state, std::uint32_t arg0) { + if (!ExactReciprocal()) return DeviceReciprocal(state, arg0); + if (state.reciprocalCorrectionFunction == 0u) FailEmit("v_rcp_f32 correction function was not defined before function emission"); + return HardwareReciprocal(state, arg0); +} + +std::uint32_t EmitFPRecipIFlag32(SpirvEmitterState& state, std::uint32_t arg0) { + if (!ExactReciprocal()) return DeviceReciprocal(state, arg0); + if (state.reciprocalCorrectionFunction == 0u) FailEmit("v_rcp_iflag_f32 correction function was not defined before function emission"); + return HardwareReciprocal(state, arg0); +} + +} diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp index ed2edb7466..2c9ebf55bd 100644 --- a/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp +++ b/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp @@ -1534,6 +1534,7 @@ void EmitProgram(SpirvEmitterState& state) { } DefineGetBdaPointer(state); DefineDot2F32F16Function(state); + DefineReciprocalCorrectionFunction(state); for (const IrBlock* block : program.BlockOrder()) { const bool needsScratch = std::any_of(block->Instructions().begin(), block->Instructions().end(), [](const IrValue* inst) { return inst->Opcode() == IrOpcode::SwizzleU32; diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md index d14be69b73..9df29ac79b 100644 --- a/docs/dev/ENVIRONMENT.md +++ b/docs/dev/ENVIRONMENT.md @@ -28,6 +28,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti | `APS5_BDA_BYTE_READS` | presence | `core/shader/recompiler/SpirvBackend/src/SpirvBdaRead.cpp` | | forces one address lookup and byte load per byte for BDA reads instead of a wide dword load | | `APS5_BDA_DWORD_STORES` | presence | `core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp` | | reverts BDA writes to one address store per dword instead of a wide multi-dword store | | `APS5_DUMP_IR` | string | `core/shader/recompiler/Recompiler.cpp` | | hex code address (or all) of the programs whose IR is printed after each front-end pass | +| `APS5_EXACT_RCP` | presence | `core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp` | | emits `v_rcp_f32` and `v_rcp_iflag_f32` as the RDNA hardware reciprocal (bit-exact for normal inputs and results) instead of the driver's division; adds about 13k SPIR-V words to each shader that uses them | | `APS5_GATHER_CONST` | integer | `core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp` | | integer every non-depth gather returns in all four texels instead of the sampled value | | `APS5_IMAGE_TABLE_KEY_SCAN` | integer | `core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp` | 256 | number of image-table entries the key scan examines | | `APS5_IMAGE_TABLE_STRICT` | presence | `core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp` | | sets image-table materialization to its strict form; 0 leaves it off | diff --git a/docs/dev/debt/shader.md b/docs/dev/debt/shader.md index 1f438c1157..0dc4b1b688 100644 --- a/docs/dev/debt/shader.md +++ b/docs/dev/debt/shader.md @@ -124,6 +124,7 @@ - [Packed f16 NaN results](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (`v_pk_add/mul/fma/min/max_f16`) follow the hardware measured on RDNA2 (gfx1035) at IEEE=0 and IEEE=1 with f16 round-to-nearest-even and f16 denormals kept: with IEEE=1 a signaling NaN input is quieted and min/max return the other operand only for a quiet NaN; with IEEE=0 NaN inputs pass through unquieted and min/max ignore signaling. In `v_pk_fma_f16` an invalid product (inf * 0) gives the default NaN even when src2 is a NaN. A shader without a known float mode is translated as IEEE=0, the mode titles use; a mode with another f16 rounding throws. In the f16 denormal modes that flush, each denormal input lane is flushed to a zero of its sign when bit 0 of the field is clear (0 and 2), so `inf * 0x0001` is an invalid product there, and when bit 1 is clear (0 and 1) a `v_pk_add_f16` result below 2^-14, or a `v_pk_mul_f16`, `v_pk_fma_f16` or `v_pk_fmac_f16` result whose exact value rounded to 11 significant bits with an unbounded exponent is below 2^-14, is flushed to a zero of its sign; `v_pk_min/max_f16` flush only their inputs. The native f16x2 add and multiply is not used while results are flushed. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with denorm16 0..3, over 19,192 to 162,204 lanes per instruction with op_sel, op_sel_hi, neg_lo, neg_hi and clamp variants and products and sums at the 2^-14 boundary. - [f32 denormals](../../../core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp) follow the shader's `FLOAT_MODE` f32 denormal field (bits 5:4) when it flushes them (0, and shaders without a known float mode, as in the 0xc0 most titles use), measured on RDNA2 (gfx1035) over 1444 rows per instruction at IEEE=0 and IEEE=1. `v_add/sub/subrev/mul/mul_legacy/mullit/fma/fmac/fmamk/fmaak/min/max/min3/max3/med3/fract/floor/ceil/frexp_mant/sin/cos_f32` flush their f32 inputs and their result to a zero of the same sign (`v_mullit_f32` measured on RDNA2 (gfx1036) over 6907 rows per mode at IEEE=0 and IEEE=1, so a positive denormal src2 counts as zero); the f32 compares, `v_cvt_i32/u32/rpi_i32/flr_i32_f32`, `v_frexp_exp_i32_f32`, `v_cvt_f64_f32`, `v_cvt_f16_f32`, `v_cvt_pkrtz_f16_f32`, `v_cvt_pknorm_i16/u16_f32` and `v_cvt_pk_u8_f32` flush their f32 inputs. `v_div_scale_f32` flushes all three inputs to signed zeros, measured on RDNA2 (gfx1036) over 2744 operand triples per mode at IEEE=0 and IEEE=1 with f32 denormals flushed and kept; its scale-down behaviour and host denormal preservation remain incomplete. `v_div_fixup_f32` flushes its src1 and src2 and keeps a denormal src0 and result, measured on RDNA2 (gfx1036) over 6859 rows per mode at IEEE=0 and IEEE=1. Tininess is detected after rounding, measured on RDNA2 (gfx1036) for `v_mul_f32` and `v_mullit_f32` at IEEE=0 and IEEE=1: a product is flushed when its value rounded to 24 bits with an unbounded exponent is below 2^-126, so `0x3f7ffffe * 0x00800001` (2^-126 * (1 - 2^-46)) gives `0x00800000` and `0x3f7fffff * 0x00800000` (2^-126 * (1 - 2^-24)) gives zero. The check rounds in the f32 round mode of `FLOAT_MODE` (bits 1:0), measured in all four modes, while the products themselves are still rounded to nearest even. This applies to `v_mul_f32`, `v_mul_legacy_f32`, `v_mullit_f32`, and to `v_fma_f32`, `v_fmac_f32`, `v_fmamk_f32`, `v_fmaak_f32` and `v_fma_mix_f32` when the addend is zero; with a nonzero addend the fused result is kept, so an exact result just below 2^-126 that rounds to it is not flushed. In the three directed modes the check is computed exactly from the significands. To nearest even (0, the mode of shaders without a known float mode) one factor is multiplied by 2^64, which is exact below 2^64, and the product with the other factor is compared with 2^-62. That multiply is a plain `OpFMul` like the product, and no f32 rounding mode is requested in the SPIR-V, so the check relies on the driver rounding f32 to nearest even by default, as the products do, and a product that rounds up to 2^-126 is the emitted product. `v_fma_mix_f32` follows this rule with mixed f16/f32 sources too, measured on RDNA2 (gfx1036) with f16 in either multiplicand slot, low and high half selection, and an f32 or f16 zero addend: f32 `0x00801002` times f16 `0x3bff` gives `0x00800000` to nearest at IEEE=0 and IEEE=1, while the neighbours `0x00801001` and `0x00801003` give zero and `0x00800001`. The tiny-product boundary was also measured for both signs in all four f32 round modes at IEEE=0; Its f16 sources are flushed to a zero of their sign when bit 0 of the f16/f64 denormal field is clear (0 and 2), whatever the f32 field, measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with f32 denormal modes 0 and 3 and f16 denormal modes 0 to 3, over 2744 triples of 14 halves with all three sources f16 and 1960 rows with an f32 multiplicand. `v_fma_mixlo_f16` and `v_fma_mixhi_f16` flush their f32 sources too and keep a product below 2^-126, measured on RDNA2 (gfx1036). `v_mad_legacy_f32` and `v_mac_legacy_f32` flush their inputs, their product and their result in every mode, see its entry; their product is still checked for tininess on its exact value, so one below 2^-126 gives zero even when it rounds to 2^-126, as the console's separately rounded encoding is not measured at this boundary. Denormal modes 1 and 2 throw for the other instructions. Not covered, and not measurable on RDNA2 (no such opcodes) or not measured: `v_mac_f32`, `v_mad_f32`, `v_madak_f32` and `v_madmk_f32` (rounded separately), `v_dot2_f32_f16` and `v_div_fmas_f32` (on hardware `v_div_fmas_f32` flushes only its result), f32 interpolation and `ds_add_f32` keep the previous lowering; `ds_min/max/cmpst_f32` and the image, buffer, global and flat `fmin/fmax/fcmpswap` flush both operands by the field, see the float atomics entries. With f32 denormals kept (3) the results depend on the driver's default denormal behaviour, as no `DenormPreserve` execution mode is requested; `v_ldexp_f32` and the f32 compares are the exceptions. `v_cmp_X_f32` and `v_cmpx_X_f32` compare the operands as sign-magnitude integers with the NaN cases handled apart, so a denormal is not read as zero, measured on RDNA2 (gfx1036) over 256 operand pairs per opcode at IEEE=0 and IEEE=1 with f32 denormals kept and flushed. `v_ldexp_f32` preserves subnormal inputs and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, measured on RDNA2 (gfx1036) over 2163 rows in each of the four round modes at IEEE=0 and IEEE=1. An overflow rounds like any other result (infinity, or the largest finite value when the mode rounds that sign toward zero). With f32 denormals flushed it flushes a subnormal input and result, measured over the same rows in each round mode at IEEE=0 only. A device whose driver splits `Fma` into a multiply and an add flushes a product below 2^-126 before adding a non-zero addend in `v_fma_f32` and `v_fmac_f32`: `0x1fffffff * 0x1fffffff + 0x00800000` gives `0x00800000` instead of the fused `0x00ffffff` on RADV RENOIR (Mesa 26.2.4), whose compiled shader has `v_mad_f32` and no `v_fma_f32`. [F32DenormalFlush](../../../core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp) accepts that sum on such a device. - [v_rcp, v_rsq, v_sqrt, v_log, v_exp, v_sin and v_cos](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (f32 and f16) use the driver's approximation for finite results, not the console's: the low bits can differ. Only NaN, invalid, zero and infinite results and the exact sin/cos zeros are chosen on the bits. Measured on RDNA2 (gfx1036) over every f16 input and 32,832 f32 inputs: RADV returns the hardware's bits for every input of rcp, rsq, sqrt and log and all but one of exp (f16 0x11c5, 1 ULP); NVIDIA (615.71.09) stays within 2 ULP except `v_log_f32` near 1.0 (next entry). [v_sin and v_cos](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) take the driver's sine or cosine of the radians of the exact cycle, except within 2^-12 of a turn from a zero of the function, where the result is the linear term of the exact distance to the zero: the hardware's constant 6.2831826 (0x40c90fd5) at the integers, which the hardware applies exactly to inputs below 2^-12 of a turn, and the f32 2π at the half and quarter turns, where the hardware is within 7 ULP of it. Outside those bands, a driver result more than 4 ULP from a Taylor series in turns of the exact cycle is replaced by the series, which is within 2 ULP of the true sine and cosine; the hardware is up to 9 ULP from them (gfx1035, 243,092 f32 inputs), so results stay within 13 ULP of the hardware on any driver. RADV returns the hardware's bits for every f16 input and for 32,422 sine and 32,486 cosine results of the 32,832 f32 inputs; the rest are 1 ULP off, except up to 14 ULP on either side of non-zero integers and up to 15 ULP beyond ±256 cycles, where the hardware's own reduction differs from the exact fraction, and up to 6 ULP inside the half- and quarter-turn bands. NVIDIA's own sine is within 1 ULP on 93% of the f32 inputs and up to 1,166 ULP off just outside the bands, its cosine within 163 ULP; the series replaces those results. A denormal f32 input with f32 denormals kept gives the hardware the input times 6.2831826; both hosts flush it. +- [v_rcp_f32 and v_rcp_iflag_f32 with `APS5_EXACT_RCP`](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp) return the hardware reciprocal for normal inputs with normal results: a cubic over 32 mantissa segments, the linear term rounded to nearest even, plus 2,761 one-ULP corrections. It matches all 2^23 mantissas of an RDNA2 (gfx1031) sweep; inputs or results that are not normal keep the driver's 1/x. It is off by default because the coefficient and correction tables add about 13k SPIR-V words to each shader that uses it. - [v_ldexp_f32 in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the `FLOAT_MODE` f32 denormal field: mode 1 keeps a subnormal input and flushes a result below 2^-126 to a zero of its sign in every f32 round mode, also one that rounds to 2^-126 at subnormal precision (`0x3fffffff` scaled by 2^-127); mode 2 flushes a subnormal input to a zero of its sign and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, as mode 3 does. Measured on RDNA2 (gfx1030, Radeon RX 6800, AMD Windows driver 32.0.21045.5002 through HIP) over 10,260 rows (54 inputs of both signs: zeros, subnormals, normals near 2^-126 and 1.0, the largest finite value, infinities and NaNs, each scaled by 190 exponents from -2^31 to 2^31-1) at IEEE=0 and IEEE=1 with each f32 denormal mode 0 to 3 and f32 round mode 0 to 3, DX10_CLAMP=1, f16 denormals kept, f16 round to nearest even and FP16_OVFL=0; with the `clamp` modifier the result is clamped as in the other modes. The PS5's gfx1013 is not measured. - [v_log_f32 and v_log_f16](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) keep the driver's log2 unless, for inputs within 1/8 of 1.0, it is more than 4 ULP from an eight-term series in x - 1, which then replaces it. `v_log_f16` goes through the same f32 lowering and is rounded to half. The series is evaluated for every `v_log` and chosen with `OpSelect` rather than a branch, so its seven fused multiply-adds and two multiplies are an unconditional cost. Measured on RDNA2 over all 3,145,728 f32 inputs within 1/8 of 1.0 (gfx1035, IEEE 0, f32 denormals flushed), the hardware is within 1 ULP of the correctly rounded log2 and the series within 2 ULP of it and within 3 ULP of the hardware (2 except at 0x3f752e47, 0x3f7baab0 and 0x3f7bc4fb), so a kept driver value is within 7 ULP of the hardware and a driver that returns the hardware's bits never triggers the gate; RADV (Mesa 26.2.4) returns the hardware's bits on the 9,280 such inputs measured on gfx1036; NVIDIA (615.71.09) was up to 23,947,836 ULP off at 1 - 2^-24 and is within 6 ULP inside the band after the change; outside it its own log2 stays up to 9 ULP off (measured up to 1.375). Over every f16 input, the change moves one `v_log_f16` result on NVIDIA (0x3bed, 1 ULP, onto the hardware's bits) and none on RADV. - [Ordered not-equal, less-than and greater-than compares](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) (shader recompiler) - `FPOrdNotEqual32` is emitted as `OpFUnordNotEqual`, and `FPOrdLessThan32` and `FPOrdGreaterThan32` as their ordered forms, each with both operands checked for NaN on their bits; the results are the same for every input. The AMD Windows driver 32.0.13058.8001 (Radeon 860M, RDNA 3.5) returns 1 for a NaN operand when any float form of not-equal feeds a ballot on a 32-wide subgroup (#825), and so does a less-than or greater-than against an infinity the driver sees as a constant (#3536), presumably rewritten into a not-equal by its compiler From 86d9e49f2ee344e3a92b22176b721364413d0430 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A0=20Franch?= Date: Fri, 23 Oct 2026 22:50:13 +0200 Subject: [PATCH 081/113] docs(shader): note APS5_EXACT_RCP reaches v_rcp_f16 and position W Co-Authored-By: Claude Sonnet 5.5 --- docs/dev/debt/shader.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/dev/debt/shader.md b/docs/dev/debt/shader.md index 0dc4b1b688..89f88ad5f4 100644 --- a/docs/dev/debt/shader.md +++ b/docs/dev/debt/shader.md @@ -124,7 +124,7 @@ - [Packed f16 NaN results](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (`v_pk_add/mul/fma/min/max_f16`) follow the hardware measured on RDNA2 (gfx1035) at IEEE=0 and IEEE=1 with f16 round-to-nearest-even and f16 denormals kept: with IEEE=1 a signaling NaN input is quieted and min/max return the other operand only for a quiet NaN; with IEEE=0 NaN inputs pass through unquieted and min/max ignore signaling. In `v_pk_fma_f16` an invalid product (inf * 0) gives the default NaN even when src2 is a NaN. A shader without a known float mode is translated as IEEE=0, the mode titles use; a mode with another f16 rounding throws. In the f16 denormal modes that flush, each denormal input lane is flushed to a zero of its sign when bit 0 of the field is clear (0 and 2), so `inf * 0x0001` is an invalid product there, and when bit 1 is clear (0 and 1) a `v_pk_add_f16` result below 2^-14, or a `v_pk_mul_f16`, `v_pk_fma_f16` or `v_pk_fmac_f16` result whose exact value rounded to 11 significant bits with an unbounded exponent is below 2^-14, is flushed to a zero of its sign; `v_pk_min/max_f16` flush only their inputs. The native f16x2 add and multiply is not used while results are flushed. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with denorm16 0..3, over 19,192 to 162,204 lanes per instruction with op_sel, op_sel_hi, neg_lo, neg_hi and clamp variants and products and sums at the 2^-14 boundary. - [f32 denormals](../../../core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp) follow the shader's `FLOAT_MODE` f32 denormal field (bits 5:4) when it flushes them (0, and shaders without a known float mode, as in the 0xc0 most titles use), measured on RDNA2 (gfx1035) over 1444 rows per instruction at IEEE=0 and IEEE=1. `v_add/sub/subrev/mul/mul_legacy/mullit/fma/fmac/fmamk/fmaak/min/max/min3/max3/med3/fract/floor/ceil/frexp_mant/sin/cos_f32` flush their f32 inputs and their result to a zero of the same sign (`v_mullit_f32` measured on RDNA2 (gfx1036) over 6907 rows per mode at IEEE=0 and IEEE=1, so a positive denormal src2 counts as zero); the f32 compares, `v_cvt_i32/u32/rpi_i32/flr_i32_f32`, `v_frexp_exp_i32_f32`, `v_cvt_f64_f32`, `v_cvt_f16_f32`, `v_cvt_pkrtz_f16_f32`, `v_cvt_pknorm_i16/u16_f32` and `v_cvt_pk_u8_f32` flush their f32 inputs. `v_div_scale_f32` flushes all three inputs to signed zeros, measured on RDNA2 (gfx1036) over 2744 operand triples per mode at IEEE=0 and IEEE=1 with f32 denormals flushed and kept; its scale-down behaviour and host denormal preservation remain incomplete. `v_div_fixup_f32` flushes its src1 and src2 and keeps a denormal src0 and result, measured on RDNA2 (gfx1036) over 6859 rows per mode at IEEE=0 and IEEE=1. Tininess is detected after rounding, measured on RDNA2 (gfx1036) for `v_mul_f32` and `v_mullit_f32` at IEEE=0 and IEEE=1: a product is flushed when its value rounded to 24 bits with an unbounded exponent is below 2^-126, so `0x3f7ffffe * 0x00800001` (2^-126 * (1 - 2^-46)) gives `0x00800000` and `0x3f7fffff * 0x00800000` (2^-126 * (1 - 2^-24)) gives zero. The check rounds in the f32 round mode of `FLOAT_MODE` (bits 1:0), measured in all four modes, while the products themselves are still rounded to nearest even. This applies to `v_mul_f32`, `v_mul_legacy_f32`, `v_mullit_f32`, and to `v_fma_f32`, `v_fmac_f32`, `v_fmamk_f32`, `v_fmaak_f32` and `v_fma_mix_f32` when the addend is zero; with a nonzero addend the fused result is kept, so an exact result just below 2^-126 that rounds to it is not flushed. In the three directed modes the check is computed exactly from the significands. To nearest even (0, the mode of shaders without a known float mode) one factor is multiplied by 2^64, which is exact below 2^64, and the product with the other factor is compared with 2^-62. That multiply is a plain `OpFMul` like the product, and no f32 rounding mode is requested in the SPIR-V, so the check relies on the driver rounding f32 to nearest even by default, as the products do, and a product that rounds up to 2^-126 is the emitted product. `v_fma_mix_f32` follows this rule with mixed f16/f32 sources too, measured on RDNA2 (gfx1036) with f16 in either multiplicand slot, low and high half selection, and an f32 or f16 zero addend: f32 `0x00801002` times f16 `0x3bff` gives `0x00800000` to nearest at IEEE=0 and IEEE=1, while the neighbours `0x00801001` and `0x00801003` give zero and `0x00800001`. The tiny-product boundary was also measured for both signs in all four f32 round modes at IEEE=0; Its f16 sources are flushed to a zero of their sign when bit 0 of the f16/f64 denormal field is clear (0 and 2), whatever the f32 field, measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with f32 denormal modes 0 and 3 and f16 denormal modes 0 to 3, over 2744 triples of 14 halves with all three sources f16 and 1960 rows with an f32 multiplicand. `v_fma_mixlo_f16` and `v_fma_mixhi_f16` flush their f32 sources too and keep a product below 2^-126, measured on RDNA2 (gfx1036). `v_mad_legacy_f32` and `v_mac_legacy_f32` flush their inputs, their product and their result in every mode, see its entry; their product is still checked for tininess on its exact value, so one below 2^-126 gives zero even when it rounds to 2^-126, as the console's separately rounded encoding is not measured at this boundary. Denormal modes 1 and 2 throw for the other instructions. Not covered, and not measurable on RDNA2 (no such opcodes) or not measured: `v_mac_f32`, `v_mad_f32`, `v_madak_f32` and `v_madmk_f32` (rounded separately), `v_dot2_f32_f16` and `v_div_fmas_f32` (on hardware `v_div_fmas_f32` flushes only its result), f32 interpolation and `ds_add_f32` keep the previous lowering; `ds_min/max/cmpst_f32` and the image, buffer, global and flat `fmin/fmax/fcmpswap` flush both operands by the field, see the float atomics entries. With f32 denormals kept (3) the results depend on the driver's default denormal behaviour, as no `DenormPreserve` execution mode is requested; `v_ldexp_f32` and the f32 compares are the exceptions. `v_cmp_X_f32` and `v_cmpx_X_f32` compare the operands as sign-magnitude integers with the NaN cases handled apart, so a denormal is not read as zero, measured on RDNA2 (gfx1036) over 256 operand pairs per opcode at IEEE=0 and IEEE=1 with f32 denormals kept and flushed. `v_ldexp_f32` preserves subnormal inputs and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, measured on RDNA2 (gfx1036) over 2163 rows in each of the four round modes at IEEE=0 and IEEE=1. An overflow rounds like any other result (infinity, or the largest finite value when the mode rounds that sign toward zero). With f32 denormals flushed it flushes a subnormal input and result, measured over the same rows in each round mode at IEEE=0 only. A device whose driver splits `Fma` into a multiply and an add flushes a product below 2^-126 before adding a non-zero addend in `v_fma_f32` and `v_fmac_f32`: `0x1fffffff * 0x1fffffff + 0x00800000` gives `0x00800000` instead of the fused `0x00ffffff` on RADV RENOIR (Mesa 26.2.4), whose compiled shader has `v_mad_f32` and no `v_fma_f32`. [F32DenormalFlush](../../../core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp) accepts that sum on such a device. - [v_rcp, v_rsq, v_sqrt, v_log, v_exp, v_sin and v_cos](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (f32 and f16) use the driver's approximation for finite results, not the console's: the low bits can differ. Only NaN, invalid, zero and infinite results and the exact sin/cos zeros are chosen on the bits. Measured on RDNA2 (gfx1036) over every f16 input and 32,832 f32 inputs: RADV returns the hardware's bits for every input of rcp, rsq, sqrt and log and all but one of exp (f16 0x11c5, 1 ULP); NVIDIA (615.71.09) stays within 2 ULP except `v_log_f32` near 1.0 (next entry). [v_sin and v_cos](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) take the driver's sine or cosine of the radians of the exact cycle, except within 2^-12 of a turn from a zero of the function, where the result is the linear term of the exact distance to the zero: the hardware's constant 6.2831826 (0x40c90fd5) at the integers, which the hardware applies exactly to inputs below 2^-12 of a turn, and the f32 2π at the half and quarter turns, where the hardware is within 7 ULP of it. Outside those bands, a driver result more than 4 ULP from a Taylor series in turns of the exact cycle is replaced by the series, which is within 2 ULP of the true sine and cosine; the hardware is up to 9 ULP from them (gfx1035, 243,092 f32 inputs), so results stay within 13 ULP of the hardware on any driver. RADV returns the hardware's bits for every f16 input and for 32,422 sine and 32,486 cosine results of the 32,832 f32 inputs; the rest are 1 ULP off, except up to 14 ULP on either side of non-zero integers and up to 15 ULP beyond ±256 cycles, where the hardware's own reduction differs from the exact fraction, and up to 6 ULP inside the half- and quarter-turn bands. NVIDIA's own sine is within 1 ULP on 93% of the f32 inputs and up to 1,166 ULP off just outside the bands, its cosine within 163 ULP; the series replaces those results. A denormal f32 input with f32 denormals kept gives the hardware the input times 6.2831826; both hosts flush it. -- [v_rcp_f32 and v_rcp_iflag_f32 with `APS5_EXACT_RCP`](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp) return the hardware reciprocal for normal inputs with normal results: a cubic over 32 mantissa segments, the linear term rounded to nearest even, plus 2,761 one-ULP corrections. It matches all 2^23 mantissas of an RDNA2 (gfx1031) sweep; inputs or results that are not normal keep the driver's 1/x. It is off by default because the coefficient and correction tables add about 13k SPIR-V words to each shader that uses it. +- [v_rcp_f32 and v_rcp_iflag_f32 with `APS5_EXACT_RCP`](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp) return the hardware reciprocal for normal inputs with normal results: a cubic over 32 mantissa segments, the linear term rounded to nearest even, plus 2,761 one-ULP corrections. It matches all 2^23 mantissas of an RDNA2 (gfx1031) sweep; inputs or results that are not normal keep the driver's 1/x. It is off by default because the coefficient and correction tables add about 13k SPIR-V words to each shader that uses it. The switch also reaches v_rcp_f16 (rounded from the f32 reciprocal) and the pixel shader's position W input. - [v_ldexp_f32 in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the `FLOAT_MODE` f32 denormal field: mode 1 keeps a subnormal input and flushes a result below 2^-126 to a zero of its sign in every f32 round mode, also one that rounds to 2^-126 at subnormal precision (`0x3fffffff` scaled by 2^-127); mode 2 flushes a subnormal input to a zero of its sign and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, as mode 3 does. Measured on RDNA2 (gfx1030, Radeon RX 6800, AMD Windows driver 32.0.21045.5002 through HIP) over 10,260 rows (54 inputs of both signs: zeros, subnormals, normals near 2^-126 and 1.0, the largest finite value, infinities and NaNs, each scaled by 190 exponents from -2^31 to 2^31-1) at IEEE=0 and IEEE=1 with each f32 denormal mode 0 to 3 and f32 round mode 0 to 3, DX10_CLAMP=1, f16 denormals kept, f16 round to nearest even and FP16_OVFL=0; with the `clamp` modifier the result is clamped as in the other modes. The PS5's gfx1013 is not measured. - [v_log_f32 and v_log_f16](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) keep the driver's log2 unless, for inputs within 1/8 of 1.0, it is more than 4 ULP from an eight-term series in x - 1, which then replaces it. `v_log_f16` goes through the same f32 lowering and is rounded to half. The series is evaluated for every `v_log` and chosen with `OpSelect` rather than a branch, so its seven fused multiply-adds and two multiplies are an unconditional cost. Measured on RDNA2 over all 3,145,728 f32 inputs within 1/8 of 1.0 (gfx1035, IEEE 0, f32 denormals flushed), the hardware is within 1 ULP of the correctly rounded log2 and the series within 2 ULP of it and within 3 ULP of the hardware (2 except at 0x3f752e47, 0x3f7baab0 and 0x3f7bc4fb), so a kept driver value is within 7 ULP of the hardware and a driver that returns the hardware's bits never triggers the gate; RADV (Mesa 26.2.4) returns the hardware's bits on the 9,280 such inputs measured on gfx1036; NVIDIA (615.71.09) was up to 23,947,836 ULP off at 1 - 2^-24 and is within 6 ULP inside the band after the change; outside it its own log2 stays up to 9 ULP off (measured up to 1.375). Over every f16 input, the change moves one `v_log_f16` result on NVIDIA (0x3bed, 1 ULP, onto the hardware's bits) and none on RADV. - [Ordered not-equal, less-than and greater-than compares](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) (shader recompiler) - `FPOrdNotEqual32` is emitted as `OpFUnordNotEqual`, and `FPOrdLessThan32` and `FPOrdGreaterThan32` as their ordered forms, each with both operands checked for NaN on their bits; the results are the same for every input. The AMD Windows driver 32.0.13058.8001 (Radeon 860M, RDNA 3.5) returns 1 for a NaN operand when any float form of not-equal feeds a ballot on a 32-wide subgroup (#825), and so does a less-than or greater-than against an infinity the driver sees as a constant (#3536), presumably rewritten into a not-equal by its compiler From c9147cbeecf926ef1f27f01d08f5dda8e69973b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A0=20Franch?= Date: Fri, 23 Oct 2026 22:57:38 +0200 Subject: [PATCH 082/113] test(agc): register only the APS5_EXACT_RCP entry of the rcp hardware test Co-Authored-By: Claude Sonnet 5.5 --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index e2f14d2d93..ddcfb73d18 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -2128,6 +2128,7 @@ if(BUILD_TESTING) set_tests_properties(agc_driver_address_passes_targets_split PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() + set_target_properties(agc_driver_rcp_hardware_tests PROPERTIES EXCLUDE_FROM_ALL OFF) add_test(NAME agc_driver_rcp_hardware_exact COMMAND agc_driver_rcp_hardware_tests) set_tests_properties(agc_driver_rcp_hardware_exact PROPERTIES ENVIRONMENT "APS5_EXACT_RCP=1;ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 60) if(WIN32) @@ -2427,7 +2428,7 @@ if(BUILD_TESTING) set_tests_properties(agc_shader_bindless agc_shader_selected_records_image_limit agc_shader_selected_records_pair_limit agc_shader_selected_records_direct_image_limit agc_shader_selected_records_direct_pair_limit agc_shader_srt_read_patching agc_shader_type_zero_image_materialization agc_shader_frontend_pair agc_shader_frontend_pair_off agc_shader_layout_pair agc_shader_layout_pair_off agc_shader_entry_lane_proof_budget PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() foreach(agcTest IN ITEMS agc_vertex_input_tests agc_mesh_output_budget_tests agc_shared_write_tests agc_locks_tests agc_driver_tests agc_shader_memory_tests agc_structurizer_tests agc_spirv_module_tests agc_dpp_write_tests agc_masked_select_tests agc_ir_reclaim_tests agc_vector_window_tests agc_constant_bit_test_tests agc_integer_narrowing_tests agc_scalar_select_mask_tests agc_vertex_input_validation_tests agc_vop1_control_decode_tests agc_validate_program_tests agc_pass_hazards_tests agc_barrier_batch_tests agc_shader_disk_cache_tests agc_screenshot_tests agc_shader_device_profile_tests agc_placeholder_images_tests agc_shader_control_flow_tests agc_driver_flip_tests agc_driver_pm4_tests agc_driver_graphics_tests agc_driver_bda_device_tests agc_driver_mesh_tests agc_driver_cmask_fast_clear_tests agc_formatted_buffer_once_tests agc_formatted_buffer_byte_stores_tests ${agcExecutionTests} agc_fma_mix_once_tests agc_f16_single_convert_tests) - if(agcTest STREQUAL "agc_driver_constant_store_tests" OR agcTest STREQUAL "agc_driver_flat_apertures_tests" OR agcTest STREQUAL "agc_driver_pipeline_optimized_readback_tests") + if(agcTest STREQUAL "agc_driver_constant_store_tests" OR agcTest STREQUAL "agc_driver_flat_apertures_tests" OR agcTest STREQUAL "agc_driver_pipeline_optimized_readback_tests" OR agcTest STREQUAL "agc_driver_rcp_hardware_tests") continue() endif() string(REGEX REPLACE "_tests$" "" agcTestName "${agcTest}") From cd329c060aa2d2824e202cf0bec977d830a90621 Mon Sep 17 00:00:00 2001 From: Crimson <144462348+CrimsonMac@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:49:52 +0300 Subject: [PATCH 083/113] fix(shader): fault on misaligned 64-bit LDS atomics under the workgroup lock --- .../libSceAgcDriver/tests/LdsLockBudget.cpp | 2 +- .../tests/SpirvLdsAtomicLock.cpp | 8 +++ .../tests/execution/LdsMixedWidthAtomics.cpp | 11 ++-- .../Optimization/src/ShaderInfoCollector.cpp | 2 +- .../SpirvMemory/SpirvMemoryInstructions.cpp | 50 +++++++++---------- docs/dev/debt/shader.md | 2 +- 6 files changed, 43 insertions(+), 32 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp b/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp index d409fc1d07..55c6fc91b1 100644 --- a/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp @@ -114,7 +114,7 @@ void verify(std::uint32_t waveSize, std::uint32_t limit, bool int64Atomics) { const bool native = int64Atomics && limit < 68u; require(widths.contains(64u) == native, native ? "device-memory LDS did not use a 64-bit compare exchange" : "a 64-bit compare exchange appeared without device-memory LDS and shaderBufferInt64Atomics"); require(widths.contains(32u) != native, native ? "device-memory LDS with shaderBufferInt64Atomics kept the workgroup lock" : "the 64-bit LDS atomic lost its workgroup lock"); - require(result.bdaAbiVersion == (limit < 68u ? 1u : 0u), "the fault buffer for a misaligned 64-bit LDS atomic does not follow device-memory LDS at limit " + std::to_string(limit)); + require(result.bdaAbiVersion == 1u, "a 64-bit LDS atomic did not get the fault buffer for a misaligned address at limit " + std::to_string(limit)); } } diff --git a/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp b/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp index 8155564e0b..2bb13e5283 100644 --- a/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp @@ -77,10 +77,18 @@ Usage Scan(std::span words) { std::uint32_t laneZeroBody = 0u; std::uint32_t lockPointer = 0u; std::map constants; + std::uint32_t faultFunction = 0u; + bool inFaultFunction = false; for (std::size_t cursor = 5; cursor < words.size();) { const auto count = words[cursor] >> spv::WordCountShift; const auto op = static_cast(words[cursor] & spv::OpCodeMask); Require(count != 0 && cursor + count <= words.size(), "truncated SPIR-V instruction"); + if (op == spv::OpName && count >= 3u && std::string_view(reinterpret_cast(words.data() + cursor + 2u)) == "record_bda_fault") faultFunction = words[cursor + 1u]; + if (op == spv::OpFunction && count >= 3u) inFaultFunction = words[cursor + 2u] == faultFunction; + if (inFaultFunction) { + cursor += count; + continue; + } if (op == spv::OpDecorate && count >= 4u && words[cursor + 2u] == spv::DecorationBuiltIn && words[cursor + 3u] == spv::BuiltInLocalInvocationIndex) { localIndexVariable = words[cursor + 1u]; } diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp index 1f8032e93c..250f80264a 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp @@ -325,8 +325,9 @@ void Run(AgcDriver::VulkanDevice& device, std::span code, c if (expectedDeviceDwords) std::printf("lds lock budget: %s GPU readback verified across 256 lanes\n", name); } -void Misaligned(AgcDriver::VulkanDevice& device, std::uint32_t ldsDwords) { +void Misaligned(AgcDriver::VulkanDevice& device, std::uint32_t ldsDwords, const char* lds) { const auto result = Compile(device, MisalignedCode, ldsDwords); + Output.fill(0xdeadbeefu); StderrCapture capture; try { device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast(MisalignedCode.data())); @@ -336,8 +337,9 @@ void Misaligned(AgcDriver::VulkanDevice& device, std::uint32_t ldsDwords) { throw; } const auto log = capture.Finish(); - Require(log.find("BDA access failed: address=0x4 instruction=0x2c bytes=8 ") != std::string::npos && log.find("reason=7") != std::string::npos, "lds lock budget: misaligned ds_add_u64 on device-backed LDS did not fault"); - std::puts("lds lock budget: misaligned ds_add_u64 faulted"); + Require(log.find("BDA access failed: address=0x4 instruction=0x2c bytes=8 ") != std::string::npos && log.find("reason=7") != std::string::npos, std::string("lds lock budget: misaligned ds_add_u64 on ") + lds + " LDS did not fault"); + for (std::uint32_t tid = 0; tid < Threads; ++tid) Require(Output[tid * 2u] == 0u && Output[tid * 2u + 1u] == 0u, std::string("lds lock budget: misaligned ds_add_u64 on ") + lds + " LDS changed the slot: lane " + std::to_string(tid) + " read " + Hex(Output[tid * 2u] | (static_cast(Output[tid * 2u + 1u]) << 32u))); + std::printf("lds lock budget: misaligned ds_add_u64 on %s LDS faulted\n", lds); } void LockBudget(AgcDriver::VulkanDevice& device) { @@ -349,7 +351,8 @@ void LockBudget(AgcDriver::VulkanDevice& device) { const auto operations = static_cast(Threads) * Iterations; Run(device, UniformCode, "limit", operations, 1, limit / 4u, (limit / 4u + 2u) & ~1u); const auto& capabilities = target.supportedCapabilities; - if (std::find(capabilities.begin(), capabilities.end(), static_cast(spv::CapabilityInt64Atomics)) != capabilities.end()) Misaligned(device, limit / 4u); + if (std::find(capabilities.begin(), capabilities.end(), static_cast(spv::CapabilityInt64Atomics)) != capabilities.end()) Misaligned(device, limit / 4u, "device-backed"); + Misaligned(device, LdsDwords, "workgroup"); Run(device, UniformCode, "limit-4", operations, 1, (limit - 4u) / 4u, 0u); std::puts("lds lock budget tests passed"); } diff --git a/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp b/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp index d9c6fbcc3d..4f63227a5d 100644 --- a/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp +++ b/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp @@ -603,7 +603,7 @@ void ShaderInfoCollector::Collect(IrProgram& program, const ShaderStageInputInfo return SharedAccessOf(inst->Opcode()) == SharedAccess::Atomic && inst->Type() == IrType::U64; }); }); - next.usesFaultBuffer = next.usesFaultBuffer || (next.sharedMemoryBytes != 0u && ldsAtomic64); + next.usesFaultBuffer = next.usesFaultBuffer || ldsAtomic64; switch (program.Resources().stage) { case IrShaderStage::Vertex: case IrShaderStage::Local: diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp index cd82fa2998..3f3724c0e9 100644 --- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp +++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp @@ -1444,31 +1444,31 @@ std::uint32_t SharedAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst, TR const auto low = EmitMemoryElementIndex(state, resource, rawIndex); const auto high = EmitMemoryElementIndex(state, resource, Binary(state, spv::OpIAdd, TypeU32(state), rawIndex, ConstantU32(state, 1u))); return EmitValueOrDefaultIfCondition(state, EmitMemoryElementInBounds(state, resource, high), TypeU64(state), ConstantU64(state, 0u), [&]() { - if (state.requirements.ldsBufferInt64Atomics) { - const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), low, ConstantU32(state, 1u)), ConstantU32(state, 0u)); - EmitIfCondition(state, unaligned, [&] { RecordBdaFaultWords(state, Binary(state, spv::OpShiftLeftLogical, TypeU32(state), rawIndex, ConstantU32(state, 2u)), ConstantU32(state, 0u), ConstantU32(state, 8u), ConstantU32(state, inst.Flags().pc), BdaAbi::FaultReason::Unaligned); }); - const auto aligned = Unary(state, spv::OpLogicalNot, TypeBool(state), unaligned); - return EmitValueOrDefaultIfCondition(state, aligned, TypeU64(state), ConstantU64(state, 0u), [&]() { return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return replacement(state, old); }); }); - } - const auto update = [&]() { - const auto lowPointer = EmitMemoryElementPointer(state, resource, low); - const auto highPointer = EmitMemoryElementPointer(state, resource, high); - const auto lowValue = state.module.AllocateId(); - const auto highValue = state.module.AllocateId(); - state.module.AddFunction(spv::OpLoad, TypeU32(state), lowValue, lowPointer); - state.module.AddFunction(spv::OpLoad, TypeU32(state), highValue, highPointer); - const auto old = state.module.AllocateId(); - state.module.AddFunction(spv::OpCompositeConstruct, TypeU64(state), old, lowValue, highValue); - const auto next = Unary(state, spv::OpBitcast, TypeU64(state), replacement(state, Unary(state, spv::OpBitcast, TypeScalarU64(state), old))); - const auto nextLow = state.module.AllocateId(); - const auto nextHigh = state.module.AllocateId(); - state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextLow, next, 0u); - state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextHigh, next, 1u); - state.module.AddFunction(spv::OpStore, lowPointer, nextLow); - state.module.AddFunction(spv::OpStore, highPointer, nextHigh); - return old; - }; - return state.requirements.ldsLock ? LockedLdsUpdate(state, TypeU64(state), ConstantU64(state, 0u), update) : update(); + const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), rawIndex, ConstantU32(state, 1u)), ConstantU32(state, 0u)); + EmitIfCondition(state, unaligned, [&] { RecordBdaFaultWords(state, Binary(state, spv::OpShiftLeftLogical, TypeU32(state), rawIndex, ConstantU32(state, 2u)), ConstantU32(state, 0u), ConstantU32(state, 8u), ConstantU32(state, inst.Flags().pc), BdaAbi::FaultReason::Unaligned); }); + const auto aligned = Unary(state, spv::OpLogicalNot, TypeBool(state), unaligned); + return EmitValueOrDefaultIfCondition(state, aligned, TypeU64(state), ConstantU64(state, 0u), [&]() { + if (state.requirements.ldsBufferInt64Atomics) return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return replacement(state, old); }); + const auto update = [&]() { + const auto lowPointer = EmitMemoryElementPointer(state, resource, low); + const auto highPointer = EmitMemoryElementPointer(state, resource, high); + const auto lowValue = state.module.AllocateId(); + const auto highValue = state.module.AllocateId(); + state.module.AddFunction(spv::OpLoad, TypeU32(state), lowValue, lowPointer); + state.module.AddFunction(spv::OpLoad, TypeU32(state), highValue, highPointer); + const auto old = state.module.AllocateId(); + state.module.AddFunction(spv::OpCompositeConstruct, TypeU64(state), old, lowValue, highValue); + const auto next = Unary(state, spv::OpBitcast, TypeU64(state), replacement(state, Unary(state, spv::OpBitcast, TypeScalarU64(state), old))); + const auto nextLow = state.module.AllocateId(); + const auto nextHigh = state.module.AllocateId(); + state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextLow, next, 0u); + state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextHigh, next, 1u); + state.module.AddFunction(spv::OpStore, lowPointer, nextLow); + state.module.AddFunction(spv::OpStore, highPointer, nextHigh); + return old; + }; + return state.requirements.ldsLock ? LockedLdsUpdate(state, TypeU64(state), ConstantU64(state, 0u), update) : update(); + }); }); }); } diff --git a/docs/dev/debt/shader.md b/docs/dev/debt/shader.md index 1f438c1157..4275fe8e3f 100644 --- a/docs/dev/debt/shader.md +++ b/docs/dev/debt/shader.md @@ -152,7 +152,7 @@ - [Negative color-texture comparison wrap indices](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (libSceAgcDriver) use explicit `OpSRem` normalization to implement modulo; the negative-offset point-wrap regression fails with direct `OpSMod` and passes with normalization on Mesa 22.3.6 llvmpipe (LLVM 15.0.6), but negative-index wrap has not been measured on PS5 hardware. - [Converted unorm images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (10_11_11_UNORM, read and written through an R32_UINT view) are sampled in the shader, the way color comparisons are emulated: `image_sample` of a 2D or 2D array view fetches the one or four texels at LOD 0, decodes them and blends them, for point or bilinear filtering with equal minification and magnification filters and wrap or clamp-to-edge addressing. A shader gets these sample modes only once a converted descriptor reaches one of its sampled images: that capture throws `ConvertedSampleRequired`, the driver records the program and prepares it again with `GuestContext::convertedSamples`, so such a shader is prepared twice per run and its first capture is repeated. The record lives with the registered program and is not kept across runs. Bilinear weights are rounded to the hardware's 8-bit grid (`roundEven(fraction * 256) / 256`, ties to even), as measured with `image_sample_lz` on RDNA2 (gfx1035) for 10_11_11 UNORM texels by adriadam10 in #5958; point sampling, decoding, swizzles and wrap and clamp-to-edge addressing matched the same measurement. A sample that is not `_lz` needs an image with one mip level; gathers, LOD queries, clamp-to-border and mirrored addressing, other filters, min/max reduction, unnormalized coordinates, images selected at run time, 16-bit data and a DST_SEL of the missing W channel throw. - [Converted unorm image loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) divide by 2^n - 1 with the buffer format path's `OpFDiv`, which Vulkan allows to be up to 2.5 ULP off, so some drivers are not bit-exact. -- [64-bit LDS atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_*_u64`, `ds_*_b64`, `ds_*_f64`) read and write the two dwords under a workgroup lock stored after the guest LDS, as LDS is a 32-bit array without 64-bit atomics. On RDNA2 (gfx1036) the LDS serialises a 32-bit atomic on a slot's high dword and a 64-bit atomic on that slot: 128 lanes of `ds_add_u32` and 128 lanes of `ds_add_u64` on one slot sum exactly. Only that pair was measured. Every 32-bit LDS atomic of a program that contains a 64-bit LDS atomic therefore takes the same lock, including a 32-bit `flat_atomic_*` whose address lands in the LDS aperture (a 64-bit one takes it already); the flat forms were not measured against a 64-bit atomic either (the other 32-bit LDS atomics, `ds_min/max`, `ds_cmpst`, the float forms, `ds_inc/dec`, `ds_mskor` and `ds_wrxchg`, are extrapolated from `ds_add_u32` and were not measured against a 64-bit atomic); a program without a 64-bit LDS atomic keeps its native 32-bit atomics. `ds_condxchg32_rtn_b64` is two `ds_mskor` halves, each under the lock but not atomic as a pair, so a 64-bit atomic between the two halves is not excluded. Sub-dword writes (`ds_write_b8`, `ds_write_b16` and their `_d16_hi` forms) and plain `ds_read_*`, `ds_write_*`, `ds_append_u32` and `ds_consume_u32` are not taken under the lock, so a plain access racing a 64-bit atomic on the same dwords can see or overwrite one half of it; whether the hardware orders them was not measured. The lock serialises the workgroup's LDS atomics of such a program; the throughput cost was not measured. `VK_KHR_workgroup_memory_explicit_layout` with `shaderSharedInt64Atomics` would make both widths native and is not used. A 64-bit atomic at an address that is 4-byte but not 8-byte aligned faults the wave on gfx1036, as on gfx1035. When the LDS lives in device memory (compute LDS beyond the device's shared-memory limit) and the device has `shaderBufferInt64Atomics`, no lock is used: a 64-bit atomic is a compare-exchange loop on a 64-bit view of the storage buffer and a 32-bit atomic is a native buffer atomic, a misaligned 64-bit atomic records the `Unaligned` shader fault with the LDS byte address instead of updating, so a mixed-width pair on one slot relies on the device ordering both widths on one buffer address; only `ds_add_u32` against `ds_add_u64` was measured, on gfx1036 (AMD Windows driver 32.0.21042.62) and an RTX 4070 SUPER. The lock is not used there because AMD's Windows driver compiles an acquire or release on a storage buffer, at workgroup scope or wider, to `s_barrier`, and those barriers inside the lock's divergent loop pair with the program's own `s_barrier`s. The fence after each LDS atomic compiles to `s_barrier` on that driver as well, so a wave that skips an LDS atomic that other waves of its workgroup execute misses a barrier they reach; its effect was not measured. On that path a 64-bit atomic at an address that is 4-byte but not 8-byte aligned is skipped and returns 0. +- [64-bit LDS atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_*_u64`, `ds_*_b64`, `ds_*_f64`) read and write the two dwords under a workgroup lock stored after the guest LDS, as LDS is a 32-bit array without 64-bit atomics. On RDNA2 (gfx1036) the LDS serialises a 32-bit atomic on a slot's high dword and a 64-bit atomic on that slot: 128 lanes of `ds_add_u32` and 128 lanes of `ds_add_u64` on one slot sum exactly. Only that pair was measured. Every 32-bit LDS atomic of a program that contains a 64-bit LDS atomic therefore takes the same lock, including a 32-bit `flat_atomic_*` whose address lands in the LDS aperture (a 64-bit one takes it already); the flat forms were not measured against a 64-bit atomic either (the other 32-bit LDS atomics, `ds_min/max`, `ds_cmpst`, the float forms, `ds_inc/dec`, `ds_mskor` and `ds_wrxchg`, are extrapolated from `ds_add_u32` and were not measured against a 64-bit atomic); a program without a 64-bit LDS atomic keeps its native 32-bit atomics. `ds_condxchg32_rtn_b64` is two `ds_mskor` halves, each under the lock but not atomic as a pair, so a 64-bit atomic between the two halves is not excluded. Sub-dword writes (`ds_write_b8`, `ds_write_b16` and their `_d16_hi` forms) and plain `ds_read_*`, `ds_write_*`, `ds_append_u32` and `ds_consume_u32` are not taken under the lock, so a plain access racing a 64-bit atomic on the same dwords can see or overwrite one half of it; whether the hardware orders them was not measured. The lock serialises the workgroup's LDS atomics of such a program; the throughput cost was not measured. `VK_KHR_workgroup_memory_explicit_layout` with `shaderSharedInt64Atomics` would make both widths native and is not used. A 64-bit atomic at an address that is 4-byte but not 8-byte aligned faults the wave on gfx1036, as on gfx1035; with the workgroup lock, in device memory and in the invocation-private LDS of other stages alike, the recompiler records the `Unaligned` shader fault with the LDS byte address, leaves both dwords unchanged and returns 0, but the lane and the rest of its wave keep running. When the LDS lives in device memory (compute LDS beyond the device's shared-memory limit) and the device has `shaderBufferInt64Atomics`, no lock is used: a 64-bit atomic is a compare-exchange loop on a 64-bit view of the storage buffer and a 32-bit atomic is a native buffer atomic, so a mixed-width pair on one slot relies on the device ordering both widths on one buffer address; only `ds_add_u32` against `ds_add_u64` was measured, on gfx1036 (AMD Windows driver 32.0.21042.62) and an RTX 4070 SUPER. The lock is not used there because AMD's Windows driver compiles an acquire or release on a storage buffer, at workgroup scope or wider, to `s_barrier`, and those barriers inside the lock's divergent loop pair with the program's own `s_barrier`s. The fence after each LDS atomic compiles to `s_barrier` on that driver as well, so a wave that skips an LDS atomic that other waves of its workgroup execute misses a barrier they reach; its effect was not measured. - [Image, buffer and global float atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`image_atomic_fmin/fmax/fcmpswap`, the same three `buffer_atomic_*` and `global_atomic_*` forms and their `_x2` forms) follow the rule of the LDS float atomics below, including its operand flush: the 32-bit forms flush both operands to a signed zero when bit 0 of the f32 denormal field is clear, the `_x2` forms by the f16/f64 field, and `fcmpswap` stores a denormal source as given. The `flat_atomic_*` forms take the same path and are not measured. Measured on RDNA2 (gfx1031, RX 6700 XT) with the [hardware oracle](../HW_ORACLE.md) over 20 x 20 f32 and 18 x 18 f64 operand pairs in every value of both fields, at IEEE 0 and 1, in wave32 and wave64, and for the image forms on 32_UINT, 32_SINT and 32_FLOAT surfaces. The console's gfx1013 is not measured. - [LDS float atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_min/max/cmpst_f32`, `ds_min/max/cmpst_f64` and their `_rtn` forms) follow the hardware measured on RDNA2 (gfx1036) over 14 x 14 operand sets (zeros, ones, infinities, denormals, quiet and signalling NaNs of both signs and with payloads) in IEEE 0 and 1 with every value 0-3 of the type's denormal field: both operands are flushed to a signed zero when bit 0 of the field is clear (0 and 2; 1 and 3 keep them; the f32 field for the f32 forms, the f16/f64 field for the f64 forms; a shader without a known float mode flushes f32 and keeps f64), then a signalling-NaN data operand is stored quieted, else a signalling-NaN old value is stored quieted, else a quiet-NaN old value is replaced by the data, else a quiet-NaN data operand loses, else the ordered compare with -0 below +0 decides, and the flushed value is what is written, also when the old value wins. `cmpst` compares the flushed bits (both zeros equal, NaN never equal) and leaves memory unchanged when they differ. The returned value is always the old value as it was in memory. `IEEE_MODE` has no effect. Not measured: a denormal or signalling-NaN `data1` of `cmpst` (stored as given). `ds_add_f32` and `ds_add_rtn_f32` follow RDNA1 (gfx1010, RX 5700 XT), measured with the [hardware oracle](../HW_ORACLE.md) template run through the Windows driver's comgr and HIP runtime over 1574 operand pairs (signed zeros, denormals, the smallest normals, infinities, quiet and signalling NaNs with payloads, the largest normals, random pairs near the denormal range and pairs that nearly cancel) in all 16 combinations of the f32 denormal field and the f32 round mode, and at IEEE 1 and DX10 clamp 0: both operands are flushed to a signed zero when bit 0 of the field is clear and the result when bit 1 is clear, the sum is rounded to nearest even whatever the round mode, a NaN data operand is stored quieted, else a NaN old value is stored quieted, `+inf + -inf` stores 0xffc00000, and `IEEE_MODE` and `DX10_CLAMP` have no effect. The sum is the host's `OpFAdd` between those flushes, so where the field keeps f32 denormals the result also depends on the host preserving them, which the module does not request. thuanquang measured the same rule on RDNA2 (gfx1031, RX 6700 XT) in #5492, with the same operand classes and 18 modes in wave32 and wave64; the PS5's gfx1013 is not measured. - [LDS in pixel, vertex-path and fetch programs](../../../core/shader/recompiler/SpirvBackend/src/SpirvAnalysis.cpp) (shader recompiler) - console waves share one LDS region; the host uses a private `Function` array (8192 dwords when unbounded). On NVIDIA proprietary, past about 4 GiB of private memory over every resident invocation that array fails (4090 on 617.42: 5456 ok, 5472 fault at 128×48×32 from `VK_NV_shader_sm_builtins`; 5090: 4096 ok, 6144 timeout). Above `min(4096, 4 GiB / (SMs × warps/SM × subgroup × 4))` it is a storage buffer per lane; other drivers keep `Function`. Only the 4090 sizes are measured. The NVIDIA-only pool fits subgroups in min(2 GiB, storage range) until teardown; excess slots sticky-flag and `WaitIdle` throws (no recycle). Header mapped host-visible/coherent (prefer device-local). Sub-dword writes, 32-bit atomics, `ds_append` and `ds_consume` are non-atomic on the lane's copy; append/consume update only the first active lane. Not measured on hardware. From 75212edbfd0ccef4e4c4d79c5e4ea904602c7bdb Mon Sep 17 00:00:00 2001 From: wail-arch <116732676+wail-arch@users.noreply.github.com> Date: Fri, 23 Oct 2026 21:40:31 +0000 Subject: [PATCH 084/113] fix(relinker): keep only visible executable exports bound by name A bundled module's import keeps its name only when the executable exports it as a visible global or weak symbol, as the dynamic loader can bind it. Test local, internal and hidden executable symbols of the same name next to global, weak and protected ones. --- .../relinker/src/guest/GuestModuleBuilder.cpp | 12 ++++++++---- .../tests/test_linux_guest_named_imports.py | 17 ++++++++++------- 2 files changed, 18 insertions(+), 11 deletions(-) diff --git a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp index 6940d43210..83383d283f 100644 --- a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp +++ b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp @@ -53,10 +53,14 @@ std::string SymbolName(const Domain::SysVDynamicSection& dynamic, const std::siz return std::string(start, end); } -std::set DefinedNames(const Domain::SysVDynamicSection& dynamic) { +std::set ExportedNames(const Domain::SysVDynamicSection& dynamic) { std::set names; - for (std::size_t index = 1; index < dynamic.DynSymData.size() / 24; ++index) - if (Io::ReadU16(dynamic.DynSymData, index * 24 + 6) != 0) names.insert(SymbolName(dynamic, index)); + for (std::size_t index = 1; index < dynamic.DynSymData.size() / 24; ++index) { + const auto info = dynamic.DynSymData[index * 24 + 4]; + const auto visibility = dynamic.DynSymData[index * 24 + 5] & 3; + if (Io::ReadU16(dynamic.DynSymData, index * 24 + 6) != 0 && (info >> 4) != 0 && visibility != 1 && visibility != 2) + names.insert(SymbolName(dynamic, index)); + } return names; } @@ -320,7 +324,7 @@ std::vector GuestModuleBuilder::Build(const std::filesystem::path return directory == "." ? std::string("app0") : "app0/" + directory; }; if (!windows) { - const auto executableExports = macos ? std::set{} : DefinedNames(dynamic); + const auto executableExports = macos ? std::set{} : ExportedNames(dynamic); for (auto& image : images) { for (std::size_t index = 1; index < image.Symbols.size(); ++index) { const auto& symbol = image.Symbols[index]; diff --git a/core/relinker/relinker/tests/test_linux_guest_named_imports.py b/core/relinker/relinker/tests/test_linux_guest_named_imports.py index 86f36b1236..7f087e7343 100644 --- a/core/relinker/relinker/tests/test_linux_guest_named_imports.py +++ b/core/relinker/relinker/tests/test_linux_guest_named_imports.py @@ -34,13 +34,13 @@ def guest_with_needed(symbols, needed): return image -def exporting_executable(name): +def exporting_executable(name, info=0x12, other=0): image = fixture() strings = b"\0" + name.encode() + b"\0" image[0x4600:0x4600 + len(strings)] = strings image[0x4210:0x4216] = bytes.fromhex("b82a000000c3") struct.pack_into(" Date: Thu, 22 Oct 2026 21:56:19 -0400 Subject: [PATCH 085/113] perf(agc): let the storage image cache take up to half of the heap budget Co-Authored-By: Claude Opus 5.5 --- .../Graphics/src/ShaderResources.cpp | 2 +- core/libs/prx/libSceAgcDriver/tests/Graphics.cpp | 16 ++++++++-------- docs/dev/debt/libSceAgcDriver.md | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp index 0dab080f00..5c47f1dc37 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp @@ -1289,7 +1289,7 @@ std::uint64_t StorageTextureBudget(const VkPhysicalDeviceMemoryProperties& memor const auto budget = reported->heapBudget[*heap]; const auto usage = reported->heapUsage[*heap]; const auto reserved = usage - std::min(usage, sampledBytes + storageBytes) + sampledBytes + budget / 8u; - const auto cap = std::min(TextureCacheBudget(memory), budget / 4u); + const auto cap = std::min(memory.memoryHeaps[*heap].size / 2u, budget / 2u); return std::max(512ull << 20u, std::min(cap, budget > reserved ? budget - reserved : 0u)); } diff --git a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp index 3c04279773..eca8602234 100644 --- a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp @@ -6936,29 +6936,29 @@ void storageTextureBudgetTests() { reported.heapBudget[1] = 100 * GiB; Require(StorageTextureBudget(memory, &reported, 0, 0) == 4 * GiB, "a zero budget for the largest device-local heap did not fall back to a quarter of the heap"); reported.heapBudget[2] = 10 * GiB; - Require(StorageTextureBudget(memory, &reported, 0, 0) == 2560 * MiB, "a 10 GiB budget on the 16 GiB heap does not limit the storage image cache to a quarter of the budget"); + Require(StorageTextureBudget(memory, &reported, 0, 0) == 5 * GiB, "a 10 GiB budget on the 16 GiB heap does not limit the storage image cache to half of the budget"); reported.heapUsage[2] = 5 * GiB; - Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 2560 * MiB, "2 GiB used outside the texture caches on a 10 GiB budget lowered the storage image cache below its quarter"); + Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 5 * GiB, "2 GiB used outside the texture caches on a 10 GiB budget lowered the storage image cache below its half"); reported.heapUsage[2] = 8 * GiB + 512 * MiB; Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 2304 * MiB, "a 10 GiB budget with 5632 MiB used outside the texture caches does not leave 2304 MiB after 1 GiB of sampled textures and 1280 MiB of headroom"); reported.heapUsage[2] = 9 * GiB; Require(StorageTextureBudget(memory, &reported, 3 * GiB, 2 * GiB) == 1792 * MiB, "3 GiB of sampled textures were not reserved in full"); reported.heapUsage[2] = 1 * GiB; - Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 2560 * MiB, "usage below the cached bytes is not read as no other device memory in use"); + Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 5 * GiB, "usage below the cached bytes is not read as no other device memory in use"); Require(StorageTextureBudget(memory, &reported, 7 * GiB, 1 * GiB) == 1792 * MiB, "7 GiB of sampled textures with the usage below the cached bytes do not leave 1792 MiB after their reservation and 1280 MiB of headroom"); reported.heapUsage[2] = 9 * GiB + 512 * MiB; Require(StorageTextureBudget(memory, &reported, 2 * GiB, 512 * MiB) == 512 * MiB, "a heap whose other users leave no room does not keep the 512 MiB floor"); reported.heapUsage[2] = 0; reported.heapBudget[2] = 6 * GiB; - Require(StorageTextureBudget(memory, &reported, 0, 0) == 1536 * MiB, "a 6 GiB budget on the 16 GiB heap does not limit the storage image cache to a quarter of the budget"); + Require(StorageTextureBudget(memory, &reported, 0, 0) == 3 * GiB, "a 6 GiB budget on the 16 GiB heap does not limit the storage image cache to half of the budget"); reported.heapBudget[2] = 1 * GiB; Require(StorageTextureBudget(memory, &reported, 0, 0) == 512 * MiB, "a 1 GiB budget does not keep the 512 MiB floor"); reported.heapBudget[2] = 40 * GiB; - Require(StorageTextureBudget(memory, &reported, 0, 0) == 4 * GiB, "a budget above the heap size raised the storage image cache past a quarter of the heap"); + Require(StorageTextureBudget(memory, &reported, 0, 0) == 8 * GiB, "a budget above the heap size raised the storage image cache past half of the heap"); memory.memoryHeaps[2].size = 8 * GiB; reported.heapBudget[2] = 7189 * MiB; reported.heapUsage[2] = 4491 * MiB; - Require(StorageTextureBudget(memory, &reported, 49 * MiB, 506 * MiB) == 7189 * MiB / 4u, "49 MiB of sampled textures on an 8 GiB heap with a 7189 MiB budget and 3936 MiB used outside the texture caches held the storage image cache below a quarter of the budget"); + Require(StorageTextureBudget(memory, &reported, 49 * MiB, 506 * MiB) == 7189 * MiB - 3936 * MiB - 49 * MiB - 7189 * MiB / 8u, "49 MiB of sampled textures on an 8 GiB heap with a 7189 MiB budget and 3936 MiB used outside the texture caches did not leave the storage image cache what the budget has left after them and its eighth"); reported.heapUsage[2] = 6490 * MiB; Require(StorageTextureBudget(memory, &reported, 2 * GiB, 506 * MiB) == 512 * MiB, "2 GiB of sampled textures on an 8 GiB heap with a 7189 MiB budget and 3936 MiB used outside the texture caches did not take the storage image cache back to its 512 MiB floor"); memory.memoryHeaps[2].size = 10 * GiB; @@ -6975,8 +6975,8 @@ void storageTextureBudgetTests() { reported.heapUsage[2] = outside + sampled + 512 * MiB; const auto limit = StorageTextureBudget(memory, &reported, sampled, 512 * MiB); Require(limit >= 512 * MiB, "pressure sweep lost the storage cache floor"); - Require(limit <= std::max(512 * MiB, budget / 4u), "pressure sweep exceeded a quarter of the reported budget above the floor"); - Require(limit <= std::max(2 * GiB, heapGiB * GiB / 4u), "pressure sweep exceeded the heap storage cache cap"); + Require(limit <= std::max(512 * MiB, budget / 2u), "pressure sweep exceeded half of the reported budget above the floor"); + Require(limit <= std::max(512 * MiB, heapGiB * GiB / 2u), "pressure sweep exceeded half of the heap"); if (outside != 0) Require(limit <= previous, "additional non-cache memory usage grew the storage cache budget"); if (limit > 512 * MiB) Require(outside + sampled + budget / 8u + limit <= budget, "storage cache budget consumed live sampled memory or pressure headroom"); previous = limit; diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md index 75f3df451c..28d0e37ce0 100644 --- a/docs/dev/debt/libSceAgcDriver.md +++ b/docs/dev/debt/libSceAgcDriver.md @@ -71,7 +71,7 @@ - [Workgroup count split](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) - a direct dispatch over `maxComputeWorkGroupCount` runs as `vkCmdDispatch` chunks, each bound to a pipeline variant whose workgroup offset specialization constants add the chunk's base to `WorkgroupId` and `GlobalInvocationId`. A variant is built when its chunk base is first recorded, not when the dispatch is prepared. A split of a shader with device-memory LDS throws: its slot base reads the chunk's `NumWorkgroups`, not the dispatch's. Chunks are ordered by a compute barrier, which the console does not have between workgroups of one dispatch. - [GPU allocation recovery](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - recovery may free too little and still throw: caller-held sampled images, pending storage results and recorder references stay alive. Budgets remain floors rather than hard device limits. Image and buffer allocation failures trim idle buffers, then sampled and clean storage cache entries. A held cache lock is reused only for a new image's allocation after lookup iterators are no longer used; hit refreshes and flushes skip that cache. Other cache, resource and device locks are tried without waiting. - [Scan-resistant sampled texture admission](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - while the sampled texture cache is over its budget but within a quarter over it, the first use of a texture it does not hold in a present is refused (used for its draw, then released, never cached) when its least recently used entry was used in the current or previous present, and a later use in the same present is refused when that entry was used in the current present. So a working set larger than the budget keeps a stable subset: a texture used more than once in a present still evicts an entry not yet used in that present, so a working set with interleaved multi-use textures rotates as on main, and the textures that arrive after the cache fills are created again at each use for as long as the least recently used entry is from the current present, including in the transition present after a scene change. Past a quarter over the budget the entries are evicted as before, so after the budget falls the cache can sit at up to 125% of the reduced budget until entries stop being used. Entries unused for two presents are evicted as before. A later use can evict an entry from the previous present and then be refused when the next least recently used entry is from the current present, so that entry is created again in the next present. The "current or previous present" window is an unmeasured threshold: it was chosen, not derived. Measured once, as one A-B-A series on one title (loading phase about 33000 textures per frame against a 5.4 GiB budget) on one RTX 4090, 3600 s each: 932 / 968 / 941 frames, evictions after frame 620 2.72M -> 1.17M, texture creations unchanged (about 5.8M). Nothing is measured on other titles or GPUs, and a title whose per-present working set only slightly exceeds the budget now re-creates the excess textures at every use. -- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache's budget is what the reported heap budget leaves after the heap's use other than the cached storage images (at least the sampled textures alive) and an eighth of the budget, capped at a quarter of the budget and at `TextureCacheBudget` (a quarter of the heap's size, at least 2 GiB), never below 512 MiB; the sampled cache's budget reserves `TextureCacheBudget` for the storage cache and never falls below 2 GiB. The storage budget keeps no room for the part of that 2 GiB floor the sampled textures alive do not use: it gives room back as they grow, at its next read. As the heap's other use grows the sampled budget reaches its floor first, then the storage budget falls. Each cache trims only at its next insert, a storage image is allocated before its insert reads the budget, and both budgets read the heap at most once a second, so a burst between two reads, sampled textures included, can still exceed the reported budget. The eighth is the sampled formula's value reused and the 512 MiB floor and the caps the earlier ones; none was measured beyond PPSA11386 on one 10 GB GPU and PPSA16064 on one 8 GB GPU, and a title whose storage working set exceeds the shrunk budget re-creates storage images at each use. +- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache's budget is what the reported heap budget leaves after the heap's use other than the cached storage images (at least the sampled textures alive) and an eighth of the budget, capped at half of the budget and at half of the heap's size, never below 512 MiB; the sampled cache's budget reserves `TextureCacheBudget` for the storage cache and never falls below 2 GiB. The storage budget keeps no room for the part of that 2 GiB floor the sampled textures alive do not use: it gives room back as they grow, at its next read. As the heap's other use grows the sampled budget reaches its floor first, then the storage budget falls. Each cache trims only at its next insert, a storage image is allocated before its insert reads the budget, and both budgets read the heap at most once a second, so a burst between two reads, sampled textures included, can still exceed the reported budget. The eighth is the sampled formula's value reused and the 512 MiB floor the earlier one. The halves come from PPSA25636 on one 8 GB GPU, whose storage working set in play is about 3.5-4 GiB of a 6.8 GiB budget: at a quarter it re-created about 2000 storage images every 10 s. None of these values was measured on other titles beyond PPSA11386 on one 10 GB GPU and PPSA16064 on one 8 GB GPU, and a title whose storage working set exceeds the shrunk budget still re-creates storage images at each use. - [Polygon primitive type](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `VGT_PRIMITIVE_TYPE` 21 (`PrimitiveType::Polygon`) decodes to `VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN` and is treated as inactive for vertex point size, like triangle fans and strips. PPSA01317 (Gran Turismo 7) submits polygon draws; whether the console performs polygon-mode decomposition or custom vertex routing is unverified. - [Native multisampled DCC fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) import uniform 0000/0001/1110/1111 keys into a single-layer, level-zero SW_64KB_R_X color image with 2, 4 or 8 fragments. Color and DCC/CMASK ranges must stay write-watched and unchanged; expanded or mixed initial DCC, register CMASK clears, compressed payloads, color transforms, lossy modes, other metadata changes, guest publication and writes over a live owner throw. A whole-range DCC fill with one of those keys, landed or still recorded, is taken as its fast clear; a partial fill, or a CMASK changed without a whole fill, throws. Driver-mediated reads of the color and metadata stay guarded. The metadata extent follows [AMD Addrlib](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L347-L454) with the [PS5 Mesa model](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/vulkan/winsys/ps5/radv_ps5_winsys.c): GFX10.1, 16 pipes, 256-byte interleave, two maximum compressed fragments. Console geometry, concurrent guest mutation and transitions outside this subset are unverified. From 3f2e9865b1a86431220102b39a1ec903a61fc6a0 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Fri, 23 Oct 2026 02:15:17 -0400 Subject: [PATCH 086/113] docs(agc): condense the texture cache budget debt entry Co-Authored-By: Claude Opus 5.5 --- docs/dev/debt/libSceAgcDriver.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md index 28d0e37ce0..c5ca78ffab 100644 --- a/docs/dev/debt/libSceAgcDriver.md +++ b/docs/dev/debt/libSceAgcDriver.md @@ -71,7 +71,7 @@ - [Workgroup count split](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) - a direct dispatch over `maxComputeWorkGroupCount` runs as `vkCmdDispatch` chunks, each bound to a pipeline variant whose workgroup offset specialization constants add the chunk's base to `WorkgroupId` and `GlobalInvocationId`. A variant is built when its chunk base is first recorded, not when the dispatch is prepared. A split of a shader with device-memory LDS throws: its slot base reads the chunk's `NumWorkgroups`, not the dispatch's. Chunks are ordered by a compute barrier, which the console does not have between workgroups of one dispatch. - [GPU allocation recovery](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - recovery may free too little and still throw: caller-held sampled images, pending storage results and recorder references stay alive. Budgets remain floors rather than hard device limits. Image and buffer allocation failures trim idle buffers, then sampled and clean storage cache entries. A held cache lock is reused only for a new image's allocation after lookup iterators are no longer used; hit refreshes and flushes skip that cache. Other cache, resource and device locks are tried without waiting. - [Scan-resistant sampled texture admission](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - while the sampled texture cache is over its budget but within a quarter over it, the first use of a texture it does not hold in a present is refused (used for its draw, then released, never cached) when its least recently used entry was used in the current or previous present, and a later use in the same present is refused when that entry was used in the current present. So a working set larger than the budget keeps a stable subset: a texture used more than once in a present still evicts an entry not yet used in that present, so a working set with interleaved multi-use textures rotates as on main, and the textures that arrive after the cache fills are created again at each use for as long as the least recently used entry is from the current present, including in the transition present after a scene change. Past a quarter over the budget the entries are evicted as before, so after the budget falls the cache can sit at up to 125% of the reduced budget until entries stop being used. Entries unused for two presents are evicted as before. A later use can evict an entry from the previous present and then be refused when the next least recently used entry is from the current present, so that entry is created again in the next present. The "current or previous present" window is an unmeasured threshold: it was chosen, not derived. Measured once, as one A-B-A series on one title (loading phase about 33000 textures per frame against a 5.4 GiB budget) on one RTX 4090, 3600 s each: 932 / 968 / 941 frames, evictions after frame 620 2.72M -> 1.17M, texture creations unchanged (about 5.8M). Nothing is measured on other titles or GPUs, and a title whose per-present working set only slightly exceeds the budget now re-creates the excess textures at every use. -- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache's budget is what the reported heap budget leaves after the heap's use other than the cached storage images (at least the sampled textures alive) and an eighth of the budget, capped at half of the budget and at half of the heap's size, never below 512 MiB; the sampled cache's budget reserves `TextureCacheBudget` for the storage cache and never falls below 2 GiB. The storage budget keeps no room for the part of that 2 GiB floor the sampled textures alive do not use: it gives room back as they grow, at its next read. As the heap's other use grows the sampled budget reaches its floor first, then the storage budget falls. Each cache trims only at its next insert, a storage image is allocated before its insert reads the budget, and both budgets read the heap at most once a second, so a burst between two reads, sampled textures included, can still exceed the reported budget. The eighth is the sampled formula's value reused and the 512 MiB floor the earlier one. The halves come from PPSA25636 on one 8 GB GPU, whose storage working set in play is about 3.5-4 GiB of a 6.8 GiB budget: at a quarter it re-created about 2000 storage images every 10 s. None of these values was measured on other titles beyond PPSA11386 on one 10 GB GPU and PPSA16064 on one 8 GB GPU, and a title whose storage working set exceeds the shrunk budget still re-creates storage images at each use. +- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache gets what the reported heap budget leaves after the heap's other use, the live sampled textures and an eighth of the budget, capped at half of the budget and of the heap, at least 512 MiB; the sampled cache reserves `TextureCacheBudget` for it and keeps at least 2 GiB. Both read the heap at most once a second and trim only at their next insert, so a burst can still exceed the reported budget. The storage budget gives back the part of the sampled floor not in use. The eighth and the floors were checked only on PPSA11386 (10 GB GPU) and PPSA16064 (8 GB GPU); the halves come from PPSA25636 on one 8 GB GPU (storage working set about 3.5-4 GiB of a 6.8 GiB budget). A title whose storage working set exceeds its budget re-creates storage images at each use. - [Polygon primitive type](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `VGT_PRIMITIVE_TYPE` 21 (`PrimitiveType::Polygon`) decodes to `VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN` and is treated as inactive for vertex point size, like triangle fans and strips. PPSA01317 (Gran Turismo 7) submits polygon draws; whether the console performs polygon-mode decomposition or custom vertex routing is unverified. - [Native multisampled DCC fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) import uniform 0000/0001/1110/1111 keys into a single-layer, level-zero SW_64KB_R_X color image with 2, 4 or 8 fragments. Color and DCC/CMASK ranges must stay write-watched and unchanged; expanded or mixed initial DCC, register CMASK clears, compressed payloads, color transforms, lossy modes, other metadata changes, guest publication and writes over a live owner throw. A whole-range DCC fill with one of those keys, landed or still recorded, is taken as its fast clear; a partial fill, or a CMASK changed without a whole fill, throws. Driver-mediated reads of the color and metadata stay guarded. The metadata extent follows [AMD Addrlib](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L347-L454) with the [PS5 Mesa model](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/vulkan/winsys/ps5/radv_ps5_winsys.c): GFX10.1, 16 pipes, 256-byte interleave, two maximum compressed fragments. Console geometry, concurrent guest mutation and transitions outside this subset are unverified. From 9904c737ca41241bc891ea42f43c09412dfb2109 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Fri, 23 Oct 2026 17:59:52 -0400 Subject: [PATCH 087/113] fix(agc): reserve the storage images held in the sampled texture budget Co-Authored-By: Claude Opus 5.5 --- .../Graphics/include/ShaderResources.hpp | 2 +- .../Graphics/src/ShaderResources.cpp | 6 ++-- .../prx/libSceAgcDriver/tests/Graphics.cpp | 29 +++++++++++++++++++ docs/dev/debt/libSceAgcDriver.md | 2 +- 4 files changed, 34 insertions(+), 5 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp index fad67e586e..72abe68f5b 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp @@ -33,7 +33,7 @@ void ClearCachedTextures(VkDevice device); std::uint64_t ReleaseTextureCaches(std::uint64_t bytes, bool newImage = false); std::uint64_t TextureCacheBudget(const VkPhysicalDeviceMemoryProperties& memory); std::uint64_t StorageTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t sampledBytes, std::uint64_t storageBytes); -std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes); +std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes, std::uint64_t storageBytes = 0); bool SampledBudgetReportDue(std::uint64_t reported, std::uint64_t budget, std::chrono::steady_clock::duration sinceReport); std::optional LargestDeviceLocalHeap(const VkPhysicalDeviceMemoryProperties& memory); std::uint64_t StorageTextureCacheBudget(const Context& context); diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp index 5c47f1dc37..cf59cb14ab 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp @@ -646,7 +646,7 @@ std::uint64_t sampledBudget(const Context& context, TextureCache& cache) { context.memoryProperties2(context.physical, &properties); const auto sampled = SampledTextureMemory(); const auto storage = storageCacheBytes(); - const auto budget = SampledTextureBudget(context.memory, &reported, sampled + storage); + const auto budget = SampledTextureBudget(context.memory, &reported, sampled + storage, storage); const bool fresh = cache.budgetDevice != context.physical; const auto storageLimit = storageBudget(context); if (const auto heap = largestDeviceLocalHeap(context.memory); heap && (fresh || SampledBudgetReportDue(cache.reportedBudget, budget, now - cache.reportedAt) || SampledBudgetReportDue(cache.reportedStorage, storageLimit, now - cache.reportedAt))) { @@ -1293,12 +1293,12 @@ std::uint64_t StorageTextureBudget(const VkPhysicalDeviceMemoryProperties& memor return std::max(512ull << 20u, std::min(cap, budget > reserved ? budget - reserved : 0u)); } -std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes) { +std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes, std::uint64_t storageBytes) { const auto heap = largestDeviceLocalHeap(memory); if (reported == nullptr || !heap || reported->heapBudget[*heap] == 0) return TextureCacheBudget(memory); const auto budget = reported->heapBudget[*heap]; const auto usage = reported->heapUsage[*heap]; - const auto reserved = usage - std::min(usage, textureBytes) + TextureCacheBudget(memory) + budget / 8u; + const auto reserved = usage - std::min(usage, textureBytes) + std::max(TextureCacheBudget(memory), storageBytes) + budget / 8u; return std::max(2048ull << 20u, budget > reserved ? budget - reserved : 0u); } diff --git a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp index eca8602234..abc6abc2fc 100644 --- a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp @@ -6914,8 +6914,37 @@ void sampledTextureBudgetTests() { Require(SampledTextureBudget(memory, &reported, 5 * GiB) == 5 * GiB + 128 * MiB, "a 15 GiB budget with 4 GiB used outside the texture caches does not leave 5 GiB 128 MiB after the 4 GiB storage cache and 1 GiB 896 MiB of headroom"); reported.heapUsage[2] = 3 * GiB; Require(SampledTextureBudget(memory, &reported, 5 * GiB) == 9 * GiB + 128 * MiB, "usage below the cached bytes is not read as no other device memory in use"); + reported.heapUsage[2] = 9 * GiB; + Require(SampledTextureBudget(memory, &reported, 5 * GiB, 4 * GiB + 512 * MiB) == 4 * GiB + 640 * MiB, "a storage image cache larger than TextureCacheBudget was not reserved in full"); + Require(SampledTextureBudget(memory, &reported, 5 * GiB, 1 * GiB) == 5 * GiB + 128 * MiB, "a storage image cache smaller than TextureCacheBudget did not keep the TextureCacheBudget reservation"); reported.heapUsage[2] = 12 * GiB; Require(SampledTextureBudget(memory, &reported, 1 * GiB) == 2 * GiB, "a heap whose other users leave no room does not keep the 2 GiB floor"); + { + using AgcDriver::Graphics::StorageTextureBudget; + auto small = memory; + small.memoryHeaps[2].size = 8 * GiB; + VkPhysicalDeviceMemoryBudgetPropertiesEXT example{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT}; + example.heapBudget[2] = 7373 * MiB; + example.heapUsage[2] = 2 * GiB + 3686 * MiB; + Require(SampledTextureBudget(small, &example, 3686 * MiB, 3686 * MiB) == 2 * GiB, "3686 MiB of storage images on an 8 GiB heap with a 7373 MiB budget and 2 GiB of other use left the sampled cache above its floor"); + for (const auto heapGiB : {8u, 16u}) { + small.memoryHeaps[2].size = heapGiB * GiB; + for (std::uint64_t budget = 4 * GiB; budget <= heapGiB * GiB; budget += GiB) { + example.heapBudget[2] = budget; + for (std::uint64_t other = 0; other <= budget; other += GiB) { + for (std::uint64_t sampled = 0; sampled <= 4 * GiB; sampled += 512 * MiB) { + for (std::uint64_t storage = 0; storage <= heapGiB * GiB / 2u; storage += 512 * MiB) { + example.heapUsage[2] = other + sampled + storage; + const auto sampledLimit = SampledTextureBudget(small, &example, sampled + storage, storage); + const auto storageLimit = StorageTextureBudget(small, &example, sampled, storage); + if (sampledLimit > 2 * GiB) Require(other + storage + sampledLimit + budget / 8u <= budget, "the sampled cache budget and the storage images held exceed the reported budget less its eighth"); + if (storageLimit > 512 * MiB) Require(other + sampled + storageLimit + budget / 8u <= budget, "the storage cache budget and the sampled textures held exceed the reported budget less its eighth"); + } + } + } + } + } + } memory.memoryHeaps[0].flags = 0; memory.memoryHeaps[2].flags = 0; Require(SampledTextureBudget(memory, &reported, 0) == 2 * GiB, "a device without a device-local heap does not keep 2 GiB of sampled textures"); diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md index c5ca78ffab..662c1b6b25 100644 --- a/docs/dev/debt/libSceAgcDriver.md +++ b/docs/dev/debt/libSceAgcDriver.md @@ -71,7 +71,7 @@ - [Workgroup count split](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) - a direct dispatch over `maxComputeWorkGroupCount` runs as `vkCmdDispatch` chunks, each bound to a pipeline variant whose workgroup offset specialization constants add the chunk's base to `WorkgroupId` and `GlobalInvocationId`. A variant is built when its chunk base is first recorded, not when the dispatch is prepared. A split of a shader with device-memory LDS throws: its slot base reads the chunk's `NumWorkgroups`, not the dispatch's. Chunks are ordered by a compute barrier, which the console does not have between workgroups of one dispatch. - [GPU allocation recovery](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - recovery may free too little and still throw: caller-held sampled images, pending storage results and recorder references stay alive. Budgets remain floors rather than hard device limits. Image and buffer allocation failures trim idle buffers, then sampled and clean storage cache entries. A held cache lock is reused only for a new image's allocation after lookup iterators are no longer used; hit refreshes and flushes skip that cache. Other cache, resource and device locks are tried without waiting. - [Scan-resistant sampled texture admission](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - while the sampled texture cache is over its budget but within a quarter over it, the first use of a texture it does not hold in a present is refused (used for its draw, then released, never cached) when its least recently used entry was used in the current or previous present, and a later use in the same present is refused when that entry was used in the current present. So a working set larger than the budget keeps a stable subset: a texture used more than once in a present still evicts an entry not yet used in that present, so a working set with interleaved multi-use textures rotates as on main, and the textures that arrive after the cache fills are created again at each use for as long as the least recently used entry is from the current present, including in the transition present after a scene change. Past a quarter over the budget the entries are evicted as before, so after the budget falls the cache can sit at up to 125% of the reduced budget until entries stop being used. Entries unused for two presents are evicted as before. A later use can evict an entry from the previous present and then be refused when the next least recently used entry is from the current present, so that entry is created again in the next present. The "current or previous present" window is an unmeasured threshold: it was chosen, not derived. Measured once, as one A-B-A series on one title (loading phase about 33000 textures per frame against a 5.4 GiB budget) on one RTX 4090, 3600 s each: 932 / 968 / 941 frames, evictions after frame 620 2.72M -> 1.17M, texture creations unchanged (about 5.8M). Nothing is measured on other titles or GPUs, and a title whose per-present working set only slightly exceeds the budget now re-creates the excess textures at every use. -- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache gets what the reported heap budget leaves after the heap's other use, the live sampled textures and an eighth of the budget, capped at half of the budget and of the heap, at least 512 MiB; the sampled cache reserves `TextureCacheBudget` for it and keeps at least 2 GiB. Both read the heap at most once a second and trim only at their next insert, so a burst can still exceed the reported budget. The storage budget gives back the part of the sampled floor not in use. The eighth and the floors were checked only on PPSA11386 (10 GB GPU) and PPSA16064 (8 GB GPU); the halves come from PPSA25636 on one 8 GB GPU (storage working set about 3.5-4 GiB of a 6.8 GiB budget). A title whose storage working set exceeds its budget re-creates storage images at each use. +- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache gets what the reported heap budget leaves after the heap's other use, the live sampled textures and an eighth of the budget, capped at half of the budget and of the heap, at least 512 MiB; the sampled cache reserves the larger of `TextureCacheBudget` and the storage images held, and keeps at least 2 GiB; above the floors neither budget plus the other cache's bytes exceeds the budget less its eighth. Both read the heap at most once a second and trim at their next insert, so a burst can exceed the budget. The storage budget gives back the part of the sampled floor not in use. The eighth and the floors were checked only on PPSA11386 (10 GB GPU) and PPSA16064 (8 GB GPU); the halves come from PPSA25636 on one 8 GB GPU (a 3.5-4 GiB storage working set). A title whose storage working set exceeds its budget re-creates storage images at each use. - [Polygon primitive type](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `VGT_PRIMITIVE_TYPE` 21 (`PrimitiveType::Polygon`) decodes to `VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN` and is treated as inactive for vertex point size, like triangle fans and strips. PPSA01317 (Gran Turismo 7) submits polygon draws; whether the console performs polygon-mode decomposition or custom vertex routing is unverified. - [Native multisampled DCC fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) import uniform 0000/0001/1110/1111 keys into a single-layer, level-zero SW_64KB_R_X color image with 2, 4 or 8 fragments. Color and DCC/CMASK ranges must stay write-watched and unchanged; expanded or mixed initial DCC, register CMASK clears, compressed payloads, color transforms, lossy modes, other metadata changes, guest publication and writes over a live owner throw. A whole-range DCC fill with one of those keys, landed or still recorded, is taken as its fast clear; a partial fill, or a CMASK changed without a whole fill, throws. Driver-mediated reads of the color and metadata stay guarded. The metadata extent follows [AMD Addrlib](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L347-L454) with the [PS5 Mesa model](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/vulkan/winsys/ps5/radv_ps5_winsys.c): GFX10.1, 16 pipes, 256-byte interleave, two maximum compressed fragments. Console geometry, concurrent guest mutation and transitions outside this subset are unverified. From 378ce8f9b526287f5962e8dbaa30695161a4d7c4 Mon Sep 17 00:00:00 2001 From: Akul Tyagi <69496404+AkulTyagi11@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:27:42 +0530 Subject: [PATCH 088/113] test(libSceSaveData.native): cover transferring and v1 mount lifecycle --- core/libs/tests/GuestSaveDataPs4.cpp | 40 ++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/core/libs/tests/GuestSaveDataPs4.cpp b/core/libs/tests/GuestSaveDataPs4.cpp index 6ee6868bd4..d795b28195 100644 --- a/core/libs/tests/GuestSaveDataPs4.cpp +++ b/core/libs/tests/GuestSaveDataPs4.cpp @@ -8,7 +8,21 @@ #include #include +struct SaveDataMountPs4 { + std::int32_t user_id; + std::int32_t pad; + const void* title_id; + const SceSaveDataDirName* dir_name; + const void* fingerprint; + std::uint64_t blocks; + std::uint32_t mount_mode; + std::uint8_t reserved[32]; +}; + +extern "C" int APS5_VABI sceSaveDataTransferringMount(const SaveDataTransferringMount*, SaveDataMountResult*); extern "C" int APS5_VABI sceSaveDataTransferringMountPs4(const SaveDataTransferringMount*, SaveDataMountResult*); +extern "C" int APS5_VABI sceSaveDataMount(const SaveDataMountPs4*, SaveDataMountResult*); +extern "C" int APS5_VABI sceSaveDataUmount(const SaveDataMountPoint*); extern "C" int APS5_VABI sceSaveDataDirNameSearchPs4(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*); extern "C" int APS5_VABI sceSaveDataDirNameSearch(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*); extern "C" int APS5_VABI sceSaveDataInitialize(const void*); @@ -21,6 +35,9 @@ namespace { constexpr int SaveDataErrorNotFound = -2137063416; constexpr int SaveDataErrorNotInitialized = -2137063423; +constexpr int SaveDataErrorParameter = -2137063424; +constexpr int SaveDataErrorNotMounted = -2137063420; +constexpr std::uint32_t MountReadWrite = 2; int failures = 0; @@ -53,6 +70,11 @@ void TestTransferringMountPs4() { std::memset(&result, 0xAA, sizeof(result)); Check(sceSaveDataTransferringMountPs4(&mount, &result) == SaveDataErrorNotFound, "TransferringMountPs4 returns NOT_FOUND"); Check(result.mount_point.data[0] == '\0', "TransferringMountPs4 reports no mount point"); + std::memset(&result, 0xAA, sizeof(result)); + Check(sceSaveDataTransferringMount(&mount, &result) == SaveDataErrorNotFound, "TransferringMount returns NOT_FOUND"); + Check(result.mount_point.data[0] == '\0', "TransferringMount reports no mount point"); + Check(sceSaveDataTransferringMount(nullptr, nullptr) == SaveDataErrorNotFound, "TransferringMount handles null arguments"); + Check(sceSaveDataTransferringMountPs4(nullptr, nullptr) == SaveDataErrorNotFound, "TransferringMountPs4 handles null arguments"); } void TestDirNameSearchPs4() { @@ -96,6 +118,23 @@ void TestSaveDataMemoryV1() { Check(sceSaveDataTerminate() == 0, "Terminate after v1 Initialize"); } +void TestMountPs4() { + SaveDataMountResult result{}; + Check(sceSaveDataMount(nullptr, &result) == SaveDataErrorParameter, "null mount is PARAMETER"); + SaveDataMountPs4 mount{}; + Check(sceSaveDataMount(&mount, &result) == SaveDataErrorParameter, "null dir_name is PARAMETER"); + Check(sceSaveDataUmount(nullptr) == SaveDataErrorParameter, "umount null point is PARAMETER"); + SceSaveDataDirName dir{}; + std::strcpy(dir.data, "kept"); + mount.dir_name = &dir; + mount.mount_mode = MountReadWrite; + Check(ThrowsRuntimeError([&] { sceSaveDataMount(&mount, nullptr); }), "null mount_result throws"); + Check(sceSaveDataMount(&mount, &result) == 0, "mount existing save directory succeeds"); + Check(result.mount_point.data[0] != '\0', "mount writes mount point"); + Check(sceSaveDataUmount(&result.mount_point) == 0, "umount mounted point succeeds"); + Check(sceSaveDataUmount(&result.mount_point) == SaveDataErrorNotMounted, "umount unmounted point is NOT_MOUNTED"); +} + } int main() { @@ -107,6 +146,7 @@ int main() { TestTransferringMountPs4(); TestDirNameSearchPs4(); TestSaveDataMemoryV1(); + TestMountPs4(); std::filesystem::current_path(previous); std::error_code error; From 3ddaa6470770b89c4fd3b7c65eacd8775c2eaa65 Mon Sep 17 00:00:00 2001 From: Max Date: Mon, 19 Oct 2026 03:05:09 +0200 Subject: [PATCH 089/113] fix(libkernel): return EINVAL for the semaphore arguments the console rejects The prosper console oracle measured SCE_KERNEL_ERROR_EINVAL for creating a semaphore with an initial count above the maximum, a maximum of 0, a negative initial count or a null name, for polling 0 or more than the maximum, and for signalling 0. These threw, or polled past the maximum returned EBUSY, and signalling 0 succeeded. Co-Authored-By: Claude Opus 5.5 --- .../prx/libkernel/Semaphore/src/Semaphore.cpp | 12 +++++++--- core/libs/tests/GuestKernelErrors.cpp | 4 ++-- core/libs/tests/GuestSemaphore.cpp | 24 +++++++++++++++++++ docs/dev/debt/libkernel.md | 1 + 4 files changed, 36 insertions(+), 5 deletions(-) diff --git a/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp b/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp index eab1d9b52d..a1b4e1bd60 100644 --- a/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp +++ b/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp @@ -21,9 +21,12 @@ extern "C" { int APS5_VABI sceKernelCreateSema(KernelSema* sem, const char* name, uint32_t attr, int init, int max, void* opt) { (void)opt; - if (sem == nullptr || name == nullptr || attr > 2 || init < 0 || max <= 0 || init > max) { + if (sem == nullptr || attr > 2 || max < 0) { APS5_INVALID_ARG_EX; } + if (name == nullptr || init < 0 || max == 0 || init > max) { + return SCE_KERNEL_ERROR_EINVAL; + } *sem = new KernelSemaPrivate(init, max, std::string(name), attr == 1); if (TraceSync()) std::fprintf(stderr, "[sema] create %p '%s' attr=0x%x init=%d max=%d\n", static_cast(*sem), name, attr, init, max); @@ -34,8 +37,8 @@ int APS5_VABI sceKernelPollSema(KernelSema sem, int need) { if (sem == nullptr) { return SCE_KERNEL_ERROR_ESRCH; } - if (need <= 0) { - APS5_INVALID_ARG_EX; + if (need <= 0 || need > sem->maxCount) { + return SCE_KERNEL_ERROR_EINVAL; } std::lock_guard lock(sem->mutex); @@ -53,6 +56,9 @@ int APS5_VABI sceKernelSignalSema(KernelSema sem, int count) { if (count < 0) { APS5_INVALID_ARG_EX; } + if (count == 0) { + return SCE_KERNEL_ERROR_EINVAL; + } std::lock_guard lock(sem->mutex); if (count > sem->maxCount - sem->tokenCount) { diff --git a/core/libs/tests/GuestKernelErrors.cpp b/core/libs/tests/GuestKernelErrors.cpp index 8989624672..66b6210e17 100644 --- a/core/libs/tests/GuestKernelErrors.cpp +++ b/core/libs/tests/GuestKernelErrors.cpp @@ -95,9 +95,9 @@ int main() { Require(sceKernelCreateSema(&semaphore, "limit", 1, 1, 3, nullptr) == SCE_OK); Require(sceKernelSignalSema(semaphore, 3) == SCE_KERNEL_ERROR_EINVAL); Require(sceKernelSignalSema(semaphore, 2) == SCE_OK); - Require(sceKernelSignalSema(semaphore, 0) == SCE_OK); + Require(sceKernelSignalSema(semaphore, 0) == SCE_KERNEL_ERROR_EINVAL); Require(sceKernelPollSema(semaphore, 3) == SCE_OK); - Require(sceKernelSignalSema(semaphore, 0) == SCE_OK); + Require(sceKernelSignalSema(semaphore, 0) == SCE_KERNEL_ERROR_EINVAL); Require(sceKernelPollSema(semaphore, 1) == SCE_KERNEL_ERROR_EBUSY); Require(sceKernelDeleteSema(semaphore) == SCE_OK); diff --git a/core/libs/tests/GuestSemaphore.cpp b/core/libs/tests/GuestSemaphore.cpp index 0ba58d4520..4ee50ec2ea 100644 --- a/core/libs/tests/GuestSemaphore.cpp +++ b/core/libs/tests/GuestSemaphore.cpp @@ -36,6 +36,28 @@ static void* APS5_VABI Wait(void* arg) { return nullptr; } +static void RequireInvalidArguments() { + KernelSema rejected = nullptr; + Require(sceKernelCreateSema(&rejected, "rejected", 0, 5, 3, nullptr) == SCE_KERNEL_ERROR_EINVAL); + Require(sceKernelCreateSema(&rejected, "rejected", 0, 0, 0, nullptr) == SCE_KERNEL_ERROR_EINVAL); + Require(sceKernelCreateSema(&rejected, "rejected", 0, -1, 3, nullptr) == SCE_KERNEL_ERROR_EINVAL); + Require(sceKernelCreateSema(&rejected, nullptr, 0, 0, 1, nullptr) == SCE_KERNEL_ERROR_EINVAL); + Require(rejected == nullptr); + + KernelSema sem = nullptr; + Require(sceKernelCreateSema(&sem, "limits", 0, 2, 3, nullptr) == SCE_OK); + Require(sceKernelPollSema(sem, 0) == SCE_KERNEL_ERROR_EINVAL); + Require(sceKernelPollSema(sem, -1) == SCE_KERNEL_ERROR_EINVAL); + Require(sceKernelPollSema(sem, 4) == SCE_KERNEL_ERROR_EINVAL); + Require(sceKernelPollSema(sem, 100) == SCE_KERNEL_ERROR_EINVAL); + Require(sceKernelPollSema(sem, 3) == SCE_KERNEL_ERROR_EBUSY); + Require(sceKernelSignalSema(sem, 0) == SCE_KERNEL_ERROR_EINVAL); + Require(sceKernelPollSema(sem, 2) == SCE_OK); + Require(sceKernelSignalSema(sem, 3) == SCE_OK); + Require(sceKernelPollSema(sem, 3) == SCE_OK); + Require(sceKernelDeleteSema(sem) == SCE_OK); +} + int main() { KernelUseconds nullTimeout = 1000; int nullWaiters = -1; @@ -94,4 +116,6 @@ int main() { Require(sceKernelSignalSema(sem, 1) == SCE_OK); Require(sceKernelWaitSema(sem, 1, nullptr) == SCE_OK); Require(sceKernelDeleteSema(sem) == SCE_OK); + + RequireInvalidArguments(); } diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md index 80453ebf50..ec49912b08 100644 --- a/docs/dev/debt/libkernel.md +++ b/docs/dev/debt/libkernel.md @@ -58,6 +58,7 @@ - [Protecting a host thread's stack](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - on Windows `sceKernelIsStack` reports a host thread's whole stack reservation, which Windows commits on demand from the top down behind a guard page. A protect over that range changes only the pages above the guard; the guard page and the reserved pages below it are left as they are, so the stack still grows and an overflow still raises a stack overflow. A protect that starts at the bottom of the reservation and stops short of the guard page, as HotSpot makes its stack guard zones, is committed and protected. Windows moves the guard page down by committing the pages below it as read/write guard pages, whether they were reserved or committed, so those pages come in read/write as the stack grows to within one guard region of them (three pages on GitHub's runners). A protection other than read/write on them, `PROT_NONE` included, does not hold once the stack is that close, where on the console every page of the reported range takes the protection. Holding it would mean removing the thread's guard page and keeping the stack limit in its TEB by hand. On Linux the reported range of the main thread is mostly unmapped; the unmapped pages from the bottom of a protect up to the top of the stack are mapped read/write in place, then the protect is applied, so the stack never has to grow down to the protected pages, which Linux refuses within its stack guard gap (1 MiB by default) above a readable mapping. The pages below a protect stay unmapped and out of the stack's reach, where on the console the stack goes on below them - [Foreign guest module image protection on Windows](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - `sceKernelMprotect` on Windows allows protection mutations on mapped PE images containing a `.elf0` section (as relinked guest modules produce, such as NVIDIA Real-time Denoisers `libNRD.prx` bundled in Dying Light 2: Stay Human PPSA02262), registering their sections into `GuestAllocations`. Host libraries and system DLLs (such as `libkernel.prx` and `kernel32.dll`) without a `.elf0` section continue to be rejected - [_umtx_op](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - the mutex, condition variable, read-write lock, legacy lock and `SEM2` operations throw, and so does a misaligned object. Implemented as FreeBSD 11's [kern_umtx.c](https://github.com/freebsd/freebsd-src/blob/stable/11/sys/kern/kern_umtx.c): `UMTX_OP_WAIT`, `UMTX_OP_WAKE`, `UMTX_OP_WAIT_UINT`, `UMTX_OP_WAIT_UINT_PRIVATE`, `UMTX_OP_WAKE_PRIVATE`, `UMTX_OP_NWAKE_PRIVATE`, `UMTX_OP_SEM_WAIT` and `UMTX_OP_SEM_WAKE` (the last two built under `COMPAT_FREEBSD9`/`10`). Operations 0 and 1 fail with `EOPNOTSUPP`, as measured on a PS5 (firmware 12.70). The `SEM2` operations, 23 and 24, were measured on the console and returned `0` for a count of 0 where FreeBSD would time out, so they stay unimplemented. +- [sceKernelCreateSema, sceKernelPollSema, sceKernelSignalSema, sceKernelDeleteSema](../../../core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp) (libkernel) - a poll, a signal or a second delete of a deleted semaphore reads freed memory here, where the console returns `0x80020003` (ESRCH) ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L17-L19)). A null output pointer to `sceKernelCreateSema`, an attribute above 2, a negative maximum and a negative signal count throw, as they were not measured. `SCE_KERNEL_ERROR_EINVAL` for an initial count above the maximum or negative, a maximum of 0, a null name, a poll of 0 or above the maximum and a signal of 0 is [measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L10-L23). - [sceKernelSyncOnAddressWait](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - the only known caller passes a null timeout and a name string as the fourth argument; the timeout is assumed to point to microseconds like the other kernel waits, and the name is ignored - [sceKernelSyncOnAddressWait8 / sceKernelSyncOnAddressWait16 / sceKernelSyncOnAddressWait32 / sceKernelSyncOnAddressWait64](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - libc's `__std_atomic_wait_direct_8/16/32/64` pass a microsecond timeout or null and ignore the result; the by-value comparand, return values and the 2- and 8-byte alignment of Wait16 and Wait64 are assumed - [scePthreadRwlockDestroy, pthread_rwlock_destroy](../../../core/libs/prx/libkernel/Pthread/src/Rwlock.cpp) (libkernel) - measured on a PS5 (firmware 13.60): destroying a rwlock returns 0 whether it is free or held for reading or writing, and leaves 1 in the handle; every call on that handle then returns `EINVAL` until it is initialized again, and a zero handle is initialized on first use by the `scePthreadRwlock` calls as by the POSIX ones. A rwlock destroyed while held is not freed, so its memory leaks. Destroying a rwlock while another thread is acquiring it is not guarded From 39d4e73e2636336896dd4e64c4d97856e178c7f6 Mon Sep 17 00:00:00 2001 From: orezraey Date: Fri, 23 Oct 2026 20:34:40 -0300 Subject: [PATCH 090/113] test(libc): stop pinning the unmeasured reallocalign zero-size realignment Co-Authored-By: Claude Opus 5.5 --- core/libs/tests/GuestReallocalign.cpp | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) diff --git a/core/libs/tests/GuestReallocalign.cpp b/core/libs/tests/GuestReallocalign.cpp index cd36081ec0..f94576018d 100644 --- a/core/libs/tests/GuestReallocalign.cpp +++ b/core/libs/tests/GuestReallocalign.cpp @@ -53,22 +53,5 @@ int main() { void* empty = reallocalign_nid_postfix(nullptr, 0, 0); Require(empty != nullptr); free_nid_postfix(empty); - for (std::size_t attempt = 0; attempt < 64; ++attempt) { - void* loose = reallocalign_nid_postfix(nullptr, 40, 32); - Require(loose != nullptr); - if (reinterpret_cast(loose) % 4096 == 0) { - free_nid_postfix(loose); - continue; - } - bool threw = false; - try { - reallocalign_nid_postfix(loose, 0, 4096); - } catch (const std::invalid_argument&) { - threw = true; - } - Require(threw); - free_nid_postfix(loose); - return 0; - } - throw std::runtime_error("reallocalign check could not get a block without 4096-byte alignment"); + return 0; } From 95d2a76583700f915c40d55bc0334f0a66eef8ea Mon Sep 17 00:00:00 2001 From: Sam Date: Tue, 20 Oct 2026 23:56:08 +0100 Subject: [PATCH 091/113] feat(agc): capture frames at the driver boundary and replay them offline APS5_FRAME_CAPTURE= makes the AGC driver record a few frames of a title: the shader registrations and ABI resolutions, video output and EOP flip reservations it made since it started, a snapshot of every readable guest allocation (the title image included) taken at a frame boundary once the driver is idle, and for the next frames each submission, flip and suspend point with the thread that made it, its serial progress and the guest pages the write tracker saw the CPU write before it. At the end it stores the presented display buffers as reference images. APS5_FRAME_CAPTURE_AT_FLIP, _TRIGGER and _FRAMES pick the frames. agc_frame_replay maps the captured memory at its addresses and replays the calls of each captured thread on a thread of its own, in captured order, through the current build of the driver with no title running. It paces GPU work to the in-flight depth the title had, releases GPU waits that the title's CPU threads released without calling the driver (AgcDriverAwaitedWaits), and reports frame times, released waits and how closely the replayed display buffers match the references. Tests: agc_frame_capture (file format) and agc_driver_frame_replay (two captured frames of CPU writes and DMA copies replayed and compared). Docs: BUILD.md, ENVIRONMENT.md and the libSceAgcDriver debt file. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 42 + .../Execution/include/Driver.hpp | 11 + .../Execution/include/Driver/Driver.hpp | 16 + .../Execution/include/FrameCapture.hpp | 137 ++++ .../Execution/include/FrameRecorder.hpp | 109 +++ .../Execution/include/GuestMemory.hpp | 2 + .../Execution/include/VideoOutput.hpp | 1 + .../Execution/src/Driver/EntryPoints.cpp | 49 +- .../Execution/src/Driver/Lifecycle.cpp | 38 + .../Execution/src/Driver/Presentation.cpp | 16 + .../src/Driver/Queues/Submission.cpp | 12 + .../src/Driver/Synchronization/WaitMemory.cpp | 1 + .../Execution/src/FrameCapture.cpp | 454 +++++++++++ .../Execution/src/FrameRecorder.cpp | 531 +++++++++++++ .../Execution/src/GuestMemory.cpp | 65 ++ .../libSceAgcDriver/tests/FrameCapture.cpp | 233 ++++++ .../prx/libSceAgcDriver/tests/FrameReplay.cpp | 198 +++++ .../prx/libSceAgcDriver/tools/FrameReplay.cpp | 736 ++++++++++++++++++ docs/dev/BUILD.md | 13 + docs/dev/ENVIRONMENT.md | 4 + docs/dev/debt/libSceAgcDriver.md | 2 + 21 files changed, 2668 insertions(+), 2 deletions(-) create mode 100644 core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp create mode 100644 core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp create mode 100644 core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp create mode 100644 core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp create mode 100644 core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp create mode 100644 core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp create mode 100644 core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index 3b1a03da36..46e62427c0 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -329,6 +329,8 @@ set(agcDriverSources ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/ShaderDeviceProfile.cpp ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/Pm4.cpp ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/SubmissionCapture.cpp + ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/FrameCapture.cpp + ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/FrameRecorder.cpp ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/VulkanDevice.cpp ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/FloatFlushProbe.cpp ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/AspectFit.cpp @@ -441,6 +443,7 @@ target_link_libraries(libSceAgcDriver PRIVATE libc libkernel jpeg_turbo + libzstd_static ${CMAKE_DL_LIBS} ) if(APS5_ENABLE_TRACY) @@ -508,6 +511,18 @@ if(BUILD_TESTING) "PATH=path_list_prepend:$") endif() + add_test_executable(agc_frame_capture_tests tests/FrameCapture.cpp Execution/src/FrameCapture.cpp) + target_include_directories(agc_frame_capture_tests PRIVATE ${LIBS_INCLUDE_DIR}) + target_link_libraries(agc_frame_capture_tests PRIVATE libc libzstd_static) + set_target_properties(agc_frame_capture_tests PROPERTIES CXX_EXTENSIONS OFF) + configure_windows_unwind(agc_frame_capture_tests) + add_test(NAME agc_frame_capture COMMAND agc_frame_capture_tests) + set_tests_properties(agc_frame_capture PROPERTIES TIMEOUT 30) + if(WIN32) + set_tests_properties(agc_frame_capture PROPERTIES ENVIRONMENT_MODIFICATION + "PATH=path_list_prepend:$") + endif() + add_test_executable(agc_write_watch_coverage_tests tests/WriteWatchCoverage.cpp) target_include_directories(agc_write_watch_coverage_tests PRIVATE ${LIBS_INCLUDE_DIR}) target_link_libraries(agc_write_watch_coverage_tests PRIVATE libc) @@ -3210,6 +3225,18 @@ if(BUILD_TESTING) endif() endif() +add_executable(agc_frame_replay EXCLUDE_FROM_ALL + tools/FrameReplay.cpp + Execution/src/FrameCapture.cpp +) +target_include_directories(agc_frame_replay PRIVATE ${LIBS_INCLUDE_DIR}) +target_link_libraries(agc_frame_replay PRIVATE libSceAgcDriver libkernel libc libzstd_static) +if(WIN32) + target_link_options(agc_frame_replay PRIVATE LINKER:--image-base=0x500000000000) +endif() +set_target_properties(agc_frame_replay PROPERTIES CXX_EXTENSIONS OFF) +configure_windows_unwind(agc_frame_replay) + add_executable(agc_pm4_replay EXCLUDE_FROM_ALL tools/Pm4Replay.cpp tools/Pm4Analysis.cpp @@ -3256,6 +3283,21 @@ if(BUILD_TESTING) set_tests_properties(agc_driver_pm4_replay agc_driver_pm4_replay_tool PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() + + add_test_executable(agc_driver_frame_replay_tests tests/FrameReplay.cpp Execution/src/FrameCapture.cpp) + target_include_directories(agc_driver_frame_replay_tests PRIVATE ${LIBS_INCLUDE_DIR}) + target_link_libraries(agc_driver_frame_replay_tests PRIVATE libSceAgc libSceAgcDriver libkernel libc libzstd_static) + set_target_properties(agc_driver_frame_replay_tests PROPERTIES CXX_EXTENSIONS OFF) + configure_windows_unwind(agc_driver_frame_replay_tests) + add_dependencies(agc_driver_frame_replay_tests agc_frame_replay) + add_test(NAME agc_driver_frame_replay COMMAND agc_driver_frame_replay_tests $) + set_tests_properties(agc_driver_frame_replay PROPERTIES + ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-replay-capture;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=2" + TIMEOUT 120) + if(WIN32) + set_tests_properties(agc_driver_frame_replay PROPERTIES ENVIRONMENT_MODIFICATION + "PATH=path_list_prepend:$") + endif() endif() add_executable(agc_compute_pipeline_replay EXCLUDE_FROM_ALL tools/ComputePipelineReplay.cpp) diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp index 384c601ccc..e02db9f381 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp @@ -1,6 +1,7 @@ #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_HPP #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_HPP +#include #include #include #include @@ -11,6 +12,14 @@ namespace AgcDriver { void Submit(const Packet* packet, std::uint32_t queue); +struct AwaitedWait { + std::uint64_t address = 0; + std::uint64_t reference = 0; + std::uint64_t mask = 0; + std::uint32_t function = 0; + std::uint32_t bytes = 0; +}; + } extern "C" void AgcDriverPrepareCommandWrite_nid_no_patch(std::uint64_t address, std::size_t bytes); @@ -21,6 +30,8 @@ extern "C" void AgcDriverUnlockVulkanLoader_nid_postfix(); extern "C" void AgcDriverShutdown_nid_postfix(); extern "C" void AgcDriverRequestScreenshot_nid_postfix(); extern "C" void AgcDriverSuspendPoint_nid_postfix(); +extern "C" void AgcDriverSerialProgress_nid_postfix(std::uint64_t* accepted, std::uint64_t* completed); +extern "C" std::size_t AgcDriverAwaitedWaits_nid_postfix(AgcDriver::AwaitedWait* waits, std::size_t capacity); extern "C" std::uint64_t AgcDriverDispatchesAdoptedAhead_nid_postfix(); extern "C" void AgcDriverRegisterShader_nid_postfix(const Shader* shader); extern "C" void AgcDriverResolveShaderAbi_nid_postfix(const Shader* shader, std::span context, std::span primitive); diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp index 922c68099c..e1cfcba5e1 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp @@ -2,6 +2,7 @@ #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_DRIVER_HPP #include "prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp" +#include "prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionRing.hpp" #include "prx/libSceAgcDriver/Execution/include/Driver/DeviceAccess.hpp" #include "prx/libSceAgcDriver/Execution/include/Driver/Packets/PacketHistory.hpp" #include "prx/libSceAgcDriver/Execution/include/Driver/Dispatch/DispatchCache.hpp" @@ -64,6 +65,12 @@ public: void SubmitFlip(const FlipInfo& info); void SuspendPoint(); std::uint32_t ReserveEopFlip(const FlipInfo& info); + std::uint32_t ReserveEopFlipAt(const FlipInfo& info, std::uint32_t token); + std::vector PendingEopFlipTokens(); + std::pair SerialProgress(); + std::uint64_t FlipSubmissions() const; + std::vector AwaitedWaits(); + bool WaitIdleFor(std::chrono::milliseconds timeout); void RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr& output); void UnregisterVideoOutput(std::uint32_t handle, const std::shared_ptr& output); void AttachWindow(const PresentationWindow& window); @@ -367,6 +374,15 @@ private: std::shared_ptr pendingFrameTiming; std::atomic flipsCounted{0}; + std::atomic flipSubmissions{0}; + struct AwaitedSlot { + std::atomic address{0}; + std::atomic reference{0}; + std::atomic mask{0}; + std::atomic shape{0}; + }; + std::array awaitedSlots{}; + void noteWaitFields(std::uint32_t queue, std::span packet); std::atomic flipSerial{0}; std::atomic flipBatchesUnsignaled{0}; diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp new file mode 100644 index 0000000000..51940432e8 --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp @@ -0,0 +1,137 @@ +#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMECAPTURE_HPP +#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMECAPTURE_HPP + +#include "SceShaders.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include + +namespace AgcDriver { + +enum class FrameCallKind : std::uint32_t { + RegisterShader = 1, + ResolveShaderAbi, + ResolveGraphicsAbi, + ResolveGraphicsStagesAbi, + RegisterVideoOutput, + SetTessellationFactorRing, + Submit, + Flip, + ReserveEopFlip, + Suspend, + Memory, + FrameStart, + End, + DisplayBuffer, +}; + +struct FrameCall { + FrameCallKind kind = FrameCallKind::End; + std::uint64_t ordinal = 0; + std::uint64_t timeNs = 0; + std::uint64_t thread = 0; + std::uint64_t accepted = 0; + std::uint64_t completed = 0; + std::uint32_t queue = 0; + std::uint32_t flags = 0; + bool cpuFlip = false; + std::uint64_t address = 0; + std::uint64_t size = 0; + std::vector values; + std::vector context; + std::vector primitive; +}; + +enum class FrameMemoryKind : std::uint32_t { Range = 1, Snapshot, Delta, Reference }; + +enum class FrameRangeKind : std::uint32_t { Watched = 1, Unwatched, Section, Alias, File, Host }; + +struct FrameRangeAccess { + static constexpr std::uint32_t Readable = 1; + static constexpr std::uint32_t Writable = 2; + static constexpr std::uint32_t Gpu = 4; +}; + +struct FrameMemoryChunk { + FrameMemoryKind kind = FrameMemoryKind::Range; + FrameRangeKind rangeKind = FrameRangeKind::Watched; + std::uint32_t protection = 0; + std::uint32_t access = 0; + std::uint64_t group = 0; + std::uint64_t completed = 0; + std::uint64_t address = 0; + std::uint64_t bytes = 0; + std::uint64_t compressedBytes = 0; + std::uint64_t offset = 0; +}; + +class FrameCaptureWriter { +public: + static constexpr std::string_view CallsName = "calls.bin"; + static constexpr std::string_view MemoryName = "memory.bin"; + static constexpr std::string_view HeaderName = "capture.json"; + static constexpr std::string_view CallsMagic = "aps5-frame-calls 1\n"; + static constexpr std::string_view MemoryMagic = "aps5-frame-memory 1\n"; + static constexpr std::size_t BlockBytes = 64u * 1024u; + static constexpr std::size_t ChunkBytes = 4u * 1024u * 1024u; + + explicit FrameCaptureWriter(const std::filesystem::path& directory, int level = 1); + FrameCaptureWriter(const FrameCaptureWriter&) = delete; + FrameCaptureWriter& operator=(const FrameCaptureWriter&) = delete; + + void WriteCall(const FrameCall& call); + void WriteRange(std::uint64_t address, std::uint64_t bytes, FrameRangeKind kind, std::uint32_t protection, std::uint32_t access); + std::uint64_t WriteSnapshot(std::uint64_t address, std::span bytes); + void WriteDelta(std::uint64_t group, std::uint64_t completed, std::uint64_t address, std::span bytes); + void WriteReference(std::uint64_t index, std::uint64_t address, std::span pixels); + void Finish(std::string_view header); + + std::uint64_t RawBytes() const; + std::uint64_t StoredBytes() const; + const std::filesystem::path& Directory() const; + +private: + void writeChunk(const FrameMemoryChunk& chunk, std::span payload); + std::vector compress(std::span bytes) const; + + std::filesystem::path directory; + int level; + mutable std::mutex mutex; + std::ofstream calls; + std::ofstream memory; + std::uint64_t rawBytes = 0; + std::uint64_t storedBytes = 0; + bool finished = false; +}; + +class FrameCaptureReader { +public: + explicit FrameCaptureReader(const std::filesystem::path& directory); + + const std::vector& Calls() const; + const std::vector& Chunks() const; + const std::string& Header() const; + bool Truncated() const; + void Read(const FrameMemoryChunk& chunk, std::span destination) const; + std::vector Read(const FrameMemoryChunk& chunk) const; + +private: + std::filesystem::path directory; + std::vector calls; + std::vector chunks; + std::string header; + bool truncated = false; +}; + +std::string_view FrameCallName(FrameCallKind kind); +bool AllZero(std::span bytes); + +} + +#endif diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp new file mode 100644 index 0000000000..7082bcf586 --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp @@ -0,0 +1,109 @@ +#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMERECORDER_HPP +#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMERECORDER_HPP + +#include "prx/libSceAgcDriver/Execution/include/DisplayBuffer.hpp" +#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp" +#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp" +#include "SceShaders.hpp" +#include "SceTypes.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +namespace AgcDriver { + +class FrameRecorder { +public: + static constexpr std::uint64_t DefaultFrames = 10; + static constexpr std::size_t ReservationHistory = 256; + static constexpr std::size_t SnapshotPieceBytes = 64u * 1024u * 1024u; + static constexpr std::uint64_t MinimumFreeBytes = std::uint64_t{4} << 30; + static constexpr std::size_t HostPageBytes = 4096; + + static FrameRecorder* Active(); + + void RegisterShader(const Shader* shader); + void ResolveShaderAbi(const Shader* shader, std::span context, std::span primitive); + void ResolveGraphicsStagesAbi(std::span stages, std::span context, std::span primitive); + void ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType); + void RegisterVideoOutput(std::uint32_t handle); + void Submit(const Packet& packet, std::uint32_t queue); + void Flip(const FlipInfo& info); + void ReserveEopFlip(const FlipInfo& info, std::uint32_t token); + void Suspend(); + void PresentBuffer(const DisplayBuffer& buffer); + void FrameBoundary(); + +private: + enum class State { Waiting, Recording, Done }; + + struct Range { + std::uint64_t address = 0; + std::uint64_t bytes = 0; + FrameRangeKind kind = FrameRangeKind::Watched; + std::uint32_t protection = 0; + std::uint32_t access = 0; + bool readable = false; + }; + + FrameRecorder(std::filesystem::path directory, std::filesystem::path trigger, std::uint64_t atBoundary, std::uint64_t frames); + struct Span { + std::uint64_t address = 0; + std::uint64_t bytes = 0; + std::uint64_t since = 0; + }; + + FrameCall make(FrameCallKind kind); + void record(FrameCall call, bool prologueCall, std::span shaders = {}); + void emitDelta(); + void emitShaderDelta(std::span shaders); + void writeDelta(std::span spans, std::span hostPages); + bool triggered(); + void start(); + void finish(); + void snapshot(const Range& range); + void writeReferenceFrames(); + bool abandonIfDiskLow(); + std::string header() const; + std::vector committedRanges(); + + std::filesystem::path directory; + std::filesystem::path trigger; + std::uint64_t atBoundary = 0; + std::uint64_t frames = DefaultFrames; + std::mutex mutex; + State state = State::Waiting; + std::unique_ptr writer; + std::vector prologue; + std::deque reservations; + std::vector ranges; + std::map shaderMarks; + std::map hostPageHashes; + std::mutex displayMutex; + std::map displayBuffers; + std::uint64_t ordinal = 0; + std::uint64_t boundaries = 0; + std::uint64_t startBoundary = 0; + std::uint64_t recordedFrames = 0; + std::uint64_t generation = 0; + std::uint64_t deltaGroups = 0; + std::uint64_t deltaBytes = 0; + std::uint64_t snapshotBytes = 0; + std::uint64_t recordedCalls = 0; + std::uint64_t startAttempts = 0; + std::uint64_t unreadableBytes = 0; + std::vector warnings; + std::chrono::steady_clock::time_point origin; + std::chrono::steady_clock::time_point startedAt; +}; + +} + +#endif diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp index 0e9c7b751a..c360a6a579 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp @@ -81,6 +81,8 @@ struct UnchangedQuery { bool WrittenSince(std::uint64_t address, std::size_t bytes, std::uint64_t generation); bool UnchangedSinceAll(std::span queries); std::uint64_t CollectCommittedWrites(std::uint64_t address, std::size_t bytes, std::vector>& ranges); +std::uint64_t WriteGeneration(); +std::uint64_t CollectWrittenBlocks(std::uint64_t address, std::size_t bytes, std::uint64_t since, std::vector>& written); bool UnchangedCommittedSince(std::span> ranges, std::uint64_t generation); // Returns the generation the blocks were stamped with (0 when the arena is not write-watched): // UnchangedSince(range, it) holds until the next store over the range. diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp index 2c7443e9a5..c642371e8e 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp @@ -55,6 +55,7 @@ public: extern "C" std::uint32_t AgcDriverReserveEopFlip_nid_postfix(const AgcDriver::FlipInfo& info); extern "C" void AgcDriverSubmitFlip_nid_postfix(const AgcDriver::FlipInfo& info); +extern "C" std::uint32_t AgcDriverReserveEopFlipAt_nid_postfix(const AgcDriver::FlipInfo& info, std::uint32_t token); extern "C" void AgcDriverRegisterVideoOutput_nid_postfix(std::uint32_t handle, const std::shared_ptr& output); extern "C" void AgcDriverUnregisterVideoOutput_nid_postfix(std::uint32_t handle, const std::shared_ptr& output); diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp index 8e846cf2fa..f223dcd0ff 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp @@ -1,15 +1,28 @@ #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp" #include "prx/libSceAgcDriver/Execution/include/ThreadPriority.hpp" #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp" +#include "prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp" +#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp" #include "prx/libSceAgcDriver/Execution/include/Screenshot.hpp" #include "prx/libkernel/Time/include/SleepWake.hpp" +#include #include namespace AgcDriver { void Submit(const Packet* packet, std::uint32_t queue) try { KernelNoteGpuSubmit_nid_no_patch(); - DriverDetail::Driver::Get().Submit(packet, queue); + auto& driver = DriverDetail::Driver::Get(); + auto* const recorder = FrameRecorder::Active(); + if (recorder == nullptr) { + driver.Submit(packet, queue); + return; + } + GuestMemory::CheckRange(packet, sizeof(Packet), alignof(Packet)); + recorder->Submit(*packet, queue); + const auto flips = driver.FlipSubmissions(); + driver.Submit(packet, queue); + if (driver.FlipSubmissions() != flips) recorder->FrameBoundary(); } catch (const ProcessShutdown&) { LibcAwaitExit_nid_postfix(); } @@ -23,14 +36,17 @@ void Shutdown() { } void RegisterShader(const Shader* shader) { + if (auto* const recorder = FrameRecorder::Active()) recorder->RegisterShader(shader); DriverDetail::Driver::Get().RegisterShader(shader); } void SuspendPoint() { + if (auto* const recorder = FrameRecorder::Active()) recorder->Suspend(); DriverDetail::Driver::Get().SuspendPoint(); } void RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr& output) { + if (auto* const recorder = FrameRecorder::Active()) recorder->RegisterVideoOutput(handle); DriverDetail::Driver::Get().RegisterVideoOutput(handle, output); } @@ -47,6 +63,7 @@ void PresentClear(const PresentationWindow& window, bool opaque, void (*gpuReady } void PresentBuffer(const PresentationWindow& window, const DisplayBuffer& buffer, void (*gpuReady)(void*), void* context) { + if (auto* const recorder = FrameRecorder::Active()) recorder->PresentBuffer(buffer); DriverDetail::Driver::Get().Present(window, &buffer, true, gpuReady, context); } @@ -104,11 +121,36 @@ extern "C" void AgcDriverSuspendPoint_nid_postfix() try { } extern "C" std::uint32_t AgcDriverReserveEopFlip_nid_postfix(const AgcDriver::FlipInfo& info) { - return AgcDriver::DriverDetail::Driver::Get().ReserveEopFlip(info); + const auto token = AgcDriver::DriverDetail::Driver::Get().ReserveEopFlip(info); + if (auto* const recorder = AgcDriver::FrameRecorder::Active(); recorder != nullptr && token != 0) { + recorder->ReserveEopFlip(info, token); + recorder->FrameBoundary(); + } + return token; +} + +extern "C" std::uint32_t AgcDriverReserveEopFlipAt_nid_postfix(const AgcDriver::FlipInfo& info, std::uint32_t token) { + return AgcDriver::DriverDetail::Driver::Get().ReserveEopFlipAt(info, token); +} + +extern "C" std::size_t AgcDriverAwaitedWaits_nid_postfix(AgcDriver::AwaitedWait* waits, std::size_t capacity) { + const auto awaited = AgcDriver::DriverDetail::Driver::Get().AwaitedWaits(); + const auto count = std::min(capacity, awaited.size()); + std::copy_n(awaited.begin(), count, waits); + return count; +} + +extern "C" void AgcDriverSerialProgress_nid_postfix(std::uint64_t* accepted, std::uint64_t* completed) { + const auto [submitted, done] = AgcDriver::DriverDetail::Driver::Get().SerialProgress(); + *accepted = submitted; + *completed = done; } extern "C" void AgcDriverSubmitFlip_nid_postfix(const AgcDriver::FlipInfo& info) try { + auto* const recorder = AgcDriver::FrameRecorder::Active(); + if (recorder != nullptr) recorder->Flip(info); AgcDriver::DriverDetail::Driver::Get().SubmitFlip(info); + if (recorder != nullptr) recorder->FrameBoundary(); } catch (const ProcessShutdown&) { LibcAwaitExit_nid_postfix(); } @@ -146,17 +188,20 @@ extern "C" void AgcDriverReportFailure_nid_postfix(std::exception_ptr error) { } extern "C" void AgcDriverResolveShaderAbi_nid_postfix(const Shader* shader, std::span context, std::span primitive) try { + if (auto* const recorder = AgcDriver::FrameRecorder::Active()) recorder->ResolveShaderAbi(shader, context, primitive); AgcDriver::DriverDetail::Driver::Get().ResolveShaderAbi(shader, context, primitive); } catch (const ProcessShutdown&) { LibcAwaitExit_nid_postfix(); } extern "C" void AgcDriverResolveGraphicsAbi_nid_postfix(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) try { + if (auto* const recorder = AgcDriver::FrameRecorder::Active()) recorder->ResolveGraphicsAbi(vertex, pixel, primitiveType); AgcDriver::DriverDetail::Driver::Get().ResolveGraphicsAbi(vertex, pixel, primitiveType); } catch (const ProcessShutdown&) { LibcAwaitExit_nid_postfix(); } extern "C" void AgcDriverResolveGraphicsStagesAbi_nid_postfix(std::span stages, std::span context, std::span primitive) try { + if (auto* const recorder = AgcDriver::FrameRecorder::Active()) recorder->ResolveGraphicsStagesAbi(stages, context, primitive); AgcDriver::DriverDetail::Driver::Get().ResolveGraphicsStagesAbi(stages, context, primitive); } catch (const ProcessShutdown&) { LibcAwaitExit_nid_postfix(); diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp index b138f1b720..95a2b1ec08 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp @@ -247,6 +247,44 @@ void Driver::WaitIdle() { if (const auto localDevice = device.Load()) localDevice->WaitIdle(); } +bool Driver::WaitIdleFor(std::chrono::milliseconds timeout) { + require(!onWorkerThread(), "worker cannot wait for itself"); + std::unique_lock lock(mutex); + const auto target = accepted; + ++idleWaiters; + const bool idle = changed.wait_for(lock, timeout, [&] { return failure != nullptr || stopping || completed >= target; }); + --idleWaiters; + rethrowFailure(); + checkStopping(); + return idle; +} + +std::vector Driver::AwaitedWaits() { + std::vector result; + for (const auto& slot : awaitedSlots) { + const auto address = slot.address.load(std::memory_order_acquire); + if (address == 0) continue; + AwaitedWait wait; + wait.address = address; + wait.reference = slot.reference.load(std::memory_order_relaxed); + wait.mask = slot.mask.load(std::memory_order_relaxed); + const auto shape = slot.shape.load(std::memory_order_relaxed); + wait.function = static_cast(shape); + wait.bytes = static_cast(shape >> 32u); + if (slot.address.load(std::memory_order_acquire) == address) result.push_back(wait); + } + return result; +} + +std::uint64_t Driver::FlipSubmissions() const { + return flipSubmissions.load(std::memory_order_relaxed); +} + +std::pair Driver::SerialProgress() { + std::lock_guard lock(mutex); + return {accepted, completed}; +} + void Driver::CheckFailure() { if (failed.load(std::memory_order_acquire)) { std::lock_guard lock(mutex); diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp index d071d049fc..dc8d16c80a 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp @@ -25,6 +25,22 @@ std::uint32_t Driver::ReserveEopFlip(const FlipInfo& info) { return token; } +std::uint32_t Driver::ReserveEopFlipAt(const FlipInfo& info, std::uint32_t token) { + { + std::lock_guard lock(mutex); + require(token >= EopFlipTokenBase && token <= EopFlipTokenLimit && !eopFlips.contains(token), "EOP flip token is not free"); + nextEopToken = token; + } + return ReserveEopFlip(info); +} + +std::vector Driver::PendingEopFlipTokens() { + std::lock_guard lock(mutex); + std::vector tokens; + for (const auto& [token, flip] : eopFlips) tokens.push_back(token); + return tokens; +} + void Driver::RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr& output) { require(output != nullptr, "null video output"); std::lock_guard lock(mutex); diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp index 5249610775..a6078230e1 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp @@ -402,6 +402,7 @@ void Driver::Submit(const Packet* packet, std::uint32_t queue, bool cpuFlip) { submission.holdsFlip = true; flipsAhead.fetch_add(1, std::memory_order_acq_rel); } + if (!submission.flips.empty()) flipSubmissions.fetch_add(1, std::memory_order_relaxed); enqueue(std::move(submission)); ++accepted; } @@ -466,7 +467,18 @@ bool Driver::orderReleased(std::uint32_t queue, std::uint64_t received) const { return runningWorkers.load(std::memory_order_acquire) == 0 && !completionsPending() && !Graphics::Recorder::SnapshotWriteOverlaps(awaited, 4); } +void Driver::noteWaitFields(std::uint32_t queue, std::span packet) { + const auto fields = Pm4::DecodeWait(packet); + auto& slot = awaitedSlots[queue == 0 ? 0 : queue - 0x20 + 1]; + slot.reference.store(fields.reference, std::memory_order_relaxed); + slot.mask.store(fields.mask, std::memory_order_relaxed); + slot.shape.store(static_cast(fields.function) | static_cast(fields.bytes) << 32u, std::memory_order_relaxed); +} + void Driver::noteWaitBlocked(std::uint32_t queue, std::uint64_t awaited, bool blocked) { + auto& slot = awaitedSlots[queue == 0 ? 0 : queue - 0x20 + 1]; + if (!blocked) slot.shape.store(0, std::memory_order_relaxed); + slot.address.store(blocked ? awaited : 0, std::memory_order_release); if (blocked) { if (runningWorkers.fetch_sub(1, std::memory_order_acq_rel) == 1) { idleEpoch.fetch_add(1, std::memory_order_release); diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp index 6aead1a2cc..f1b7df1757 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp @@ -322,6 +322,7 @@ void Driver::waitMemory(std::span packet, std::uint32_t que if (entryTryFailed && pollService(false)) return; + noteWaitFields(queue, packet); noteWaitBlocked(queue, awaited, true); struct BlockedWait { Driver& driver; diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp new file mode 100644 index 0000000000..ff6c4ebac8 --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp @@ -0,0 +1,454 @@ +#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +namespace AgcDriver { +namespace { + +static_assert(std::endian::native == std::endian::little, "frame captures are stored in little-endian order"); + +constexpr std::size_t ChunkHeaderBytes = 64; + +void requireCapture(bool condition, const std::string& reason) { + if (!condition) throw std::runtime_error("frame capture: " + reason); +} + +class Encoder { +public: + template + void Put(TValue value) { + const auto at = bytes.size(); + bytes.resize(at + sizeof(TValue)); + std::memcpy(bytes.data() + at, &value, sizeof(TValue)); + } + + std::vector bytes; +}; + +class Decoder { +public: + explicit Decoder(std::span bytes) : bytes(bytes) {} + + template + TValue Take(const char* what) { + requireCapture(sizeof(TValue) <= bytes.size() - at, std::string("record ends inside ") + what); + TValue value{}; + std::memcpy(&value, bytes.data() + at, sizeof(TValue)); + at += sizeof(TValue); + return value; + } + + std::size_t Count(std::size_t elementBytes, const char* what) { + const auto count = Take(what); + requireCapture(count <= (bytes.size() - at) / elementBytes, std::string("count of ") + what + " exceeds its record"); + return count; + } + + bool Done() const { return at == bytes.size(); } + +private: + std::span bytes; + std::size_t at = 0; +}; + +void putRegisters(Encoder& encoder, const std::vector& registers) { + encoder.Put(static_cast(registers.size())); + for (const auto& value : registers) { + encoder.Put(value.offset); + encoder.Put(value.value); + } +} + +std::vector takeRegisters(Decoder& decoder) { + std::vector registers(decoder.Count(8, "registers")); + for (auto& value : registers) { + value.offset = decoder.Take("register offset"); + value.value = decoder.Take("register value"); + } + return registers; +} + +std::vector encodeCall(const FrameCall& call) { + Encoder encoder; + encoder.Put(call.ordinal); + encoder.Put(call.timeNs); + encoder.Put(call.thread); + encoder.Put(call.accepted); + encoder.Put(call.completed); + encoder.Put(call.queue); + encoder.Put(call.flags); + encoder.Put(static_cast(call.cpuFlip ? 1u : 0u)); + encoder.Put(call.address); + encoder.Put(call.size); + encoder.Put(static_cast(call.values.size())); + for (const auto value : call.values) encoder.Put(value); + putRegisters(encoder, call.context); + putRegisters(encoder, call.primitive); + return std::move(encoder.bytes); +} + +FrameCall decodeCall(FrameCallKind kind, std::span payload) { + Decoder decoder(payload); + FrameCall call; + call.kind = kind; + call.ordinal = decoder.Take("ordinal"); + call.timeNs = decoder.Take("time"); + call.thread = decoder.Take("thread"); + call.accepted = decoder.Take("accepted serial"); + call.completed = decoder.Take("completed serial"); + call.queue = decoder.Take("queue"); + call.flags = decoder.Take("flags"); + const auto cpuFlip = decoder.Take("cpu flip"); + requireCapture(cpuFlip <= 1, "cpu flip is not 0 or 1"); + call.cpuFlip = cpuFlip == 1; + call.address = decoder.Take("address"); + call.size = decoder.Take("size"); + call.values.resize(decoder.Count(8, "values")); + for (auto& value : call.values) value = decoder.Take("value"); + call.context = takeRegisters(decoder); + call.primitive = takeRegisters(decoder); + requireCapture(decoder.Done(), "call record has trailing bytes"); + return call; +} + +bool knownCall(std::uint32_t kind) { + return kind >= static_cast(FrameCallKind::RegisterShader) && kind <= static_cast(FrameCallKind::DisplayBuffer); +} + +std::vector readFile(const std::filesystem::path& path) { + std::ifstream file(path, std::ios::binary); + requireCapture(file.is_open(), "cannot open " + path.string()); + std::vector bytes; + file.seekg(0, std::ios::end); + bytes.resize(static_cast(file.tellg())); + file.seekg(0); + file.read(reinterpret_cast(bytes.data()), static_cast(bytes.size())); + requireCapture(file.good() || bytes.empty(), "cannot read " + path.string()); + return bytes; +} + +void requireMagic(std::span bytes, std::string_view magic, const std::filesystem::path& path) { + requireCapture(bytes.size() >= magic.size() && std::memcmp(bytes.data(), magic.data(), magic.size()) == 0, path.string() + " is not a frame capture file"); +} + +struct Run { + std::uint64_t address; + std::span bytes; +}; + +} + +bool AllZero(std::span bytes) { + constexpr std::size_t Word = sizeof(std::uint64_t); + std::size_t at = 0; + for (; at + Word <= bytes.size(); at += Word) { + std::uint64_t value = 0; + std::memcpy(&value, bytes.data() + at, Word); + if (value != 0) return false; + } + return std::all_of(bytes.begin() + static_cast(at), bytes.end(), [](std::byte value) { return value == std::byte{0}; }); +} + +std::string_view FrameCallName(FrameCallKind kind) { + switch (kind) { + case FrameCallKind::RegisterShader: return "register-shader"; + case FrameCallKind::ResolveShaderAbi: return "resolve-shader-abi"; + case FrameCallKind::ResolveGraphicsAbi: return "resolve-graphics-abi"; + case FrameCallKind::ResolveGraphicsStagesAbi: return "resolve-graphics-stages-abi"; + case FrameCallKind::RegisterVideoOutput: return "register-video-output"; + case FrameCallKind::SetTessellationFactorRing: return "set-tf-ring"; + case FrameCallKind::Submit: return "submit"; + case FrameCallKind::Flip: return "flip"; + case FrameCallKind::ReserveEopFlip: return "reserve-eop-flip"; + case FrameCallKind::Suspend: return "suspend"; + case FrameCallKind::Memory: return "memory"; + case FrameCallKind::FrameStart: return "frame-start"; + case FrameCallKind::End: return "end"; + case FrameCallKind::DisplayBuffer: return "display-buffer"; + } + throw std::runtime_error("frame capture: unknown call kind " + std::to_string(static_cast(kind))); +} + +FrameCaptureWriter::FrameCaptureWriter(const std::filesystem::path& directory, int level) : directory(directory), level(level) { + std::error_code error; + std::filesystem::create_directories(directory, error); + requireCapture(!error && std::filesystem::is_directory(directory), "cannot create the directory " + directory.string()); + for (const auto name : {CallsName, MemoryName, HeaderName}) std::filesystem::remove(directory / name, error); + calls.open(directory / CallsName, std::ios::binary | std::ios::trunc); + memory.open(directory / MemoryName, std::ios::binary | std::ios::trunc); + requireCapture(calls.is_open() && memory.is_open(), "cannot create the capture files in " + directory.string()); + calls.write(CallsMagic.data(), static_cast(CallsMagic.size())); + memory.write(MemoryMagic.data(), static_cast(MemoryMagic.size())); + requireCapture(calls.good() && memory.good(), "cannot write the capture files in " + directory.string()); +} + +void FrameCaptureWriter::WriteCall(const FrameCall& call) { + FrameCallName(call.kind); + const auto payload = encodeCall(call); + requireCapture(payload.size() <= UINT32_MAX, "call record too large"); + std::lock_guard lock(mutex); + requireCapture(!finished, "call written after the capture finished"); + const auto kind = static_cast(call.kind); + const auto bytes = static_cast(payload.size()); + calls.write(reinterpret_cast(&kind), sizeof(kind)); + calls.write(reinterpret_cast(&bytes), sizeof(bytes)); + calls.write(reinterpret_cast(payload.data()), static_cast(payload.size())); + requireCapture(calls.good(), "cannot write " + (directory / CallsName).string()); +} + +void FrameCaptureWriter::WriteRange(std::uint64_t address, std::uint64_t bytes, FrameRangeKind kind, std::uint32_t protection, std::uint32_t access) { + FrameMemoryChunk chunk; + chunk.kind = FrameMemoryKind::Range; + chunk.rangeKind = kind; + chunk.protection = protection; + chunk.access = access; + chunk.address = address; + chunk.bytes = bytes; + std::lock_guard lock(mutex); + writeChunk(chunk, {}); +} + +std::uint64_t FrameCaptureWriter::WriteSnapshot(std::uint64_t address, std::span bytes) { + std::vector runs; + for (std::size_t at = 0; at < bytes.size();) { + const auto block = bytes.subspan(at, std::min(BlockBytes, bytes.size() - at)); + if (AllZero(block)) { + at += block.size(); + continue; + } + if (!runs.empty() && runs.back().address + runs.back().bytes.size() == address + at && runs.back().bytes.size() + block.size() <= ChunkBytes) { + runs.back().bytes = bytes.subspan(runs.back().address - address, runs.back().bytes.size() + block.size()); + } else { + runs.push_back({address + at, block}); + } + at += block.size(); + } + const auto workers = std::max(1, std::thread::hardware_concurrency() / 2); + std::uint64_t stored = 0; + for (std::size_t first = 0; first < runs.size(); first += workers) { + const auto last = std::min(runs.size(), first + workers); + std::vector>> compressed; + for (auto index = first; index < last; ++index) { + compressed.push_back(std::async(std::launch::async, [this, run = runs[index]] { return compress(run.bytes); })); + } + std::lock_guard lock(mutex); + for (auto index = first; index < last; ++index) { + const auto payload = compressed[index - first].get(); + FrameMemoryChunk chunk; + chunk.kind = FrameMemoryKind::Snapshot; + chunk.address = runs[index].address; + chunk.bytes = runs[index].bytes.size(); + chunk.compressedBytes = payload.size(); + writeChunk(chunk, payload); + stored += chunk.bytes; + } + } + return stored; +} + +void FrameCaptureWriter::WriteDelta(std::uint64_t group, std::uint64_t completed, std::uint64_t address, std::span bytes) { + for (std::size_t at = 0; at < bytes.size(); at += ChunkBytes) { + const auto part = bytes.subspan(at, std::min(ChunkBytes, bytes.size() - at)); + const auto payload = compress(part); + FrameMemoryChunk chunk; + chunk.kind = FrameMemoryKind::Delta; + chunk.group = group; + chunk.completed = completed; + chunk.address = address + at; + chunk.bytes = part.size(); + chunk.compressedBytes = payload.size(); + std::lock_guard lock(mutex); + writeChunk(chunk, payload); + } +} + +void FrameCaptureWriter::WriteReference(std::uint64_t index, std::uint64_t address, std::span pixels) { + const auto payload = compress(pixels); + FrameMemoryChunk chunk; + chunk.kind = FrameMemoryKind::Reference; + chunk.group = index; + chunk.address = address; + chunk.bytes = pixels.size(); + chunk.compressedBytes = payload.size(); + std::lock_guard lock(mutex); + writeChunk(chunk, payload); +} + +void FrameCaptureWriter::Finish(std::string_view header) { + std::lock_guard lock(mutex); + requireCapture(!finished, "capture finished twice"); + finished = true; + calls.flush(); + memory.flush(); + requireCapture(calls.good() && memory.good(), "cannot flush the capture files in " + directory.string()); + calls.close(); + memory.close(); + std::ofstream file(directory / HeaderName, std::ios::binary | std::ios::trunc); + file.write(header.data(), static_cast(header.size())); + file.flush(); + requireCapture(file.good(), "cannot write " + (directory / HeaderName).string()); +} + +std::uint64_t FrameCaptureWriter::RawBytes() const { + std::lock_guard lock(mutex); + return rawBytes; +} + +std::uint64_t FrameCaptureWriter::StoredBytes() const { + std::lock_guard lock(mutex); + return storedBytes; +} + +const std::filesystem::path& FrameCaptureWriter::Directory() const { + return directory; +} + +void FrameCaptureWriter::writeChunk(const FrameMemoryChunk& chunk, std::span payload) { + requireCapture(!finished, "memory written after the capture finished"); + Encoder encoder; + encoder.Put(static_cast(chunk.kind)); + encoder.Put(static_cast(chunk.rangeKind)); + encoder.Put(chunk.protection); + encoder.Put(chunk.access); + encoder.Put(chunk.group); + encoder.Put(chunk.completed); + encoder.Put(chunk.address); + encoder.Put(chunk.bytes); + encoder.Put(static_cast(payload.size())); + encoder.Put(std::uint64_t{0}); + memory.write(reinterpret_cast(encoder.bytes.data()), static_cast(encoder.bytes.size())); + memory.write(reinterpret_cast(payload.data()), static_cast(payload.size())); + requireCapture(memory.good(), "cannot write " + (directory / MemoryName).string()); + if (chunk.kind != FrameMemoryKind::Range) rawBytes += chunk.bytes; + storedBytes += payload.size(); +} + +std::vector FrameCaptureWriter::compress(std::span bytes) const { + std::vector output(ZSTD_compressBound(bytes.size())); + const auto written = ZSTD_compress(output.data(), output.size(), bytes.data(), bytes.size(), level); + requireCapture(ZSTD_isError(written) == 0, std::string("zstd: ") + ZSTD_getErrorName(written)); + output.resize(written); + return output; +} + +FrameCaptureReader::FrameCaptureReader(const std::filesystem::path& directory) : directory(directory) { + const auto callsPath = directory / FrameCaptureWriter::CallsName; + const auto callBytes = readFile(callsPath); + requireMagic(callBytes, FrameCaptureWriter::CallsMagic, callsPath); + std::size_t at = FrameCaptureWriter::CallsMagic.size(); + while (at < callBytes.size()) { + if (callBytes.size() - at < 8) { + truncated = true; + break; + } + std::uint32_t kind = 0; + std::uint32_t bytes = 0; + std::memcpy(&kind, callBytes.data() + at, 4); + std::memcpy(&bytes, callBytes.data() + at + 4, 4); + requireCapture(knownCall(kind), callsPath.string() + ": unknown call kind " + std::to_string(kind) + " at byte " + std::to_string(at)); + if (callBytes.size() - at - 8 < bytes) { + truncated = true; + break; + } + calls.push_back(decodeCall(static_cast(kind), std::span(callBytes).subspan(at + 8, bytes))); + at += 8 + static_cast(bytes); + } + + const auto memoryPath = directory / FrameCaptureWriter::MemoryName; + std::ifstream memory(memoryPath, std::ios::binary); + requireCapture(memory.is_open(), "cannot open " + memoryPath.string()); + memory.seekg(0, std::ios::end); + const auto size = static_cast(memory.tellg()); + std::string magic(FrameCaptureWriter::MemoryMagic.size(), '\0'); + memory.seekg(0); + memory.read(magic.data(), static_cast(magic.size())); + requireCapture(memory.good() && magic == FrameCaptureWriter::MemoryMagic, memoryPath.string() + " is not a frame capture file"); + std::uint64_t offset = magic.size(); + while (offset < size) { + if (size - offset < ChunkHeaderBytes) { + truncated = true; + break; + } + std::array raw{}; + memory.seekg(static_cast(offset)); + memory.read(reinterpret_cast(raw.data()), static_cast(raw.size())); + requireCapture(memory.good(), "cannot read " + memoryPath.string()); + Decoder decoder(raw); + FrameMemoryChunk chunk; + const auto kind = decoder.Take("memory kind"); + const auto rangeKind = decoder.Take("range kind"); + requireCapture(kind >= 1 && kind <= 4 && rangeKind >= 1 && rangeKind <= 6, memoryPath.string() + ": corrupt chunk header at byte " + std::to_string(offset)); + chunk.kind = static_cast(kind); + chunk.rangeKind = static_cast(rangeKind); + chunk.protection = decoder.Take("protection"); + chunk.access = decoder.Take("access"); + chunk.group = decoder.Take("group"); + chunk.completed = decoder.Take("completed serial"); + chunk.address = decoder.Take("address"); + chunk.bytes = decoder.Take("bytes"); + chunk.compressedBytes = decoder.Take("compressed bytes"); + requireCapture((chunk.kind == FrameMemoryKind::Range) == (chunk.compressedBytes == 0), memoryPath.string() + ": chunk payload does not match its kind at byte " + std::to_string(offset)); + chunk.offset = offset + ChunkHeaderBytes; + if (size - chunk.offset < chunk.compressedBytes) { + truncated = true; + break; + } + chunks.push_back(chunk); + offset = chunk.offset + chunk.compressedBytes; + } + + const auto headerPath = directory / FrameCaptureWriter::HeaderName; + if (std::filesystem::exists(headerPath)) { + const auto bytes = readFile(headerPath); + header.assign(reinterpret_cast(bytes.data()), bytes.size()); + } else { + truncated = true; + } +} + +const std::vector& FrameCaptureReader::Calls() const { + return calls; +} + +const std::vector& FrameCaptureReader::Chunks() const { + return chunks; +} + +const std::string& FrameCaptureReader::Header() const { + return header; +} + +bool FrameCaptureReader::Truncated() const { + return truncated; +} + +void FrameCaptureReader::Read(const FrameMemoryChunk& chunk, std::span destination) const { + requireCapture(chunk.kind != FrameMemoryKind::Range, "a range chunk has no bytes"); + requireCapture(destination.size() == chunk.bytes, "destination size does not match the chunk"); + const auto path = directory / FrameCaptureWriter::MemoryName; + std::ifstream memory(path, std::ios::binary); + requireCapture(memory.is_open(), "cannot open " + path.string()); + std::vector compressed(chunk.compressedBytes); + memory.seekg(static_cast(chunk.offset)); + memory.read(reinterpret_cast(compressed.data()), static_cast(compressed.size())); + requireCapture(memory.good(), "cannot read " + path.string()); + const auto written = ZSTD_decompress(destination.data(), destination.size(), compressed.data(), compressed.size()); + requireCapture(ZSTD_isError(written) == 0, std::string("zstd: ") + ZSTD_getErrorName(written)); + requireCapture(written == chunk.bytes, "chunk at " + std::to_string(chunk.address) + " decompressed to the wrong size"); +} + +std::vector FrameCaptureReader::Read(const FrameMemoryChunk& chunk) const { + std::vector bytes(chunk.bytes); + Read(chunk, bytes); + return bytes; +} + +} diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp new file mode 100644 index 0000000000..f1bd18dc32 --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp @@ -0,0 +1,531 @@ +#include "prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp" +#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp" +#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp" +#include "prx/libSceAgcDriver/TraceRevision.hpp" +#include "prx/libc/include/GuestAllocations.hpp" +#include "prx/libc/include/GuestArena.hpp" +#include "prx/libc/include/General.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef _WIN32 +#include +#else +#include +#endif + +extern "C" int APS5_VABI sceAgcDriverGetTFRing(uintptr_t* base, uint32_t* size); + +namespace AgcDriver { +namespace { + +std::uint64_t readNumber(const char* text, std::uint64_t fallback) { + if (text == nullptr || *text == '\0') return fallback; + std::uint64_t value = 0; + const std::string_view view(text); + const auto [last, error] = std::from_chars(view.data(), view.data() + view.size(), value); + if (error != std::errc{} || last != view.data() + view.size()) throw std::runtime_error("frame capture: '" + std::string(view) + "' is not a number"); + return value; +} + +std::string jsonString(std::string_view text) { + std::string result = "\""; + for (const char character : text) { + if (character == '"' || character == '\\') { + result += '\\'; + result += character; + } else if (static_cast(character) < 0x20) { + char escaped[8]; + std::snprintf(escaped, sizeof(escaped), "\\u%04x", static_cast(static_cast(character))); + result += escaped; + } else { + result += character; + } + } + return result + "\""; +} + +std::vector> captureEnvironment() { +#ifdef _WIN32 + char** entries = _environ; +#else + char** entries = environ; +#endif + std::vector> result; + for (; entries != nullptr && *entries != nullptr; ++entries) { + const std::string_view entry = *entries; + const auto equals = entry.find('='); + if (!entry.starts_with("APS5_") || equals == std::string_view::npos) continue; + result.emplace_back(std::string(entry.substr(0, equals)), std::string(entry.substr(equals + 1))); + } + std::sort(result.begin(), result.end()); + return result; +} + +std::uint64_t threadId() { + return static_cast(std::hash{}(std::this_thread::get_id())); +} + +std::vector copyRegisters(std::span registers) { + return {registers.begin(), registers.end()}; +} + +std::uint64_t pointer(const void* value) { + return static_cast(reinterpret_cast(value)); +} + +std::uint64_t flipValue(std::int64_t value) { + return static_cast(value); +} + +std::uint64_t contentHash(std::span bytes) { + std::uint64_t hash = 0xcbf29ce484222325ull; + for (const auto value : bytes) hash = (hash ^ static_cast(value)) * 0x100000001b3ull; + return hash == 0 ? 1 : hash; +} + +} + +FrameRecorder* FrameRecorder::Active() { + static FrameRecorder* const recorder = []() -> FrameRecorder* { + const char* directory = std::getenv("APS5_FRAME_CAPTURE"); + if (directory == nullptr || *directory == '\0') return nullptr; + const char* trigger = std::getenv("APS5_FRAME_CAPTURE_TRIGGER"); + const auto atBoundary = readNumber(std::getenv("APS5_FRAME_CAPTURE_AT_FLIP"), 0); + const auto frames = readNumber(std::getenv("APS5_FRAME_CAPTURE_FRAMES"), DefaultFrames); + if (frames == 0) throw std::runtime_error("frame capture: APS5_FRAME_CAPTURE_FRAMES must be at least 1"); + return new FrameRecorder(directory, trigger != nullptr ? trigger : "", atBoundary, frames); + }(); + return recorder; +} + +FrameRecorder::FrameRecorder(std::filesystem::path directory, std::filesystem::path trigger, std::uint64_t atBoundary, std::uint64_t frames) + : directory(std::move(directory)), trigger(std::move(trigger)), atBoundary(atBoundary), frames(frames), origin(std::chrono::steady_clock::now()) {} + +FrameCall FrameRecorder::make(FrameCallKind kind) { + FrameCall call; + call.kind = kind; + call.timeNs = static_cast(std::chrono::duration_cast(std::chrono::steady_clock::now() - origin).count()); + call.thread = threadId(); + return call; +} + +void FrameRecorder::RegisterShader(const Shader* shader) { + auto call = make(FrameCallKind::RegisterShader); + call.address = pointer(shader); + const std::array shaders{shader}; + record(std::move(call), true, shaders); +} + +void FrameRecorder::ResolveShaderAbi(const Shader* shader, std::span context, std::span primitive) { + auto call = make(FrameCallKind::ResolveShaderAbi); + call.address = pointer(shader); + call.context = copyRegisters(context); + call.primitive = copyRegisters(primitive); + const std::array shaders{shader}; + record(std::move(call), true, shaders); +} + +void FrameRecorder::ResolveGraphicsStagesAbi(std::span stages, std::span context, std::span primitive) { + auto call = make(FrameCallKind::ResolveGraphicsStagesAbi); + for (const auto* stage : stages) call.values.push_back(pointer(stage)); + call.context = copyRegisters(context); + call.primitive = copyRegisters(primitive); + record(std::move(call), true, stages); +} + +void FrameRecorder::ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) { + auto call = make(FrameCallKind::ResolveGraphicsAbi); + call.values = {pointer(vertex), pointer(pixel), primitiveType}; + const std::array shaders{vertex, pixel}; + record(std::move(call), true, shaders); +} + +void FrameRecorder::RegisterVideoOutput(std::uint32_t handle) { + auto call = make(FrameCallKind::RegisterVideoOutput); + call.values = {handle}; + record(std::move(call), true); +} + +void FrameRecorder::Submit(const Packet& packet, std::uint32_t queue) { + auto call = make(FrameCallKind::Submit); + call.queue = queue; + call.address = pointer(packet.addr); + call.size = packet.dw_num; + call.flags = packet.flags; + record(std::move(call), false); +} + +void FrameRecorder::Flip(const FlipInfo& info) { + auto call = make(FrameCallKind::Flip); + call.cpuFlip = true; + call.values = {info.handle, flipValue(info.index), info.mode, flipValue(info.argument)}; + record(std::move(call), false); +} + +void FrameRecorder::ReserveEopFlip(const FlipInfo& info, std::uint32_t token) { + auto call = make(FrameCallKind::ReserveEopFlip); + call.values = {info.handle, flipValue(info.index), info.mode, flipValue(info.argument), token}; + std::lock_guard lock(mutex); + if (state == State::Waiting) { + call.ordinal = ++ordinal; + reservations.push_back(std::move(call)); + if (reservations.size() > ReservationHistory) reservations.pop_front(); + return; + } + if (state != State::Recording) return; + emitDelta(); + if (state != State::Recording) return; + call.ordinal = ++ordinal; + std::tie(call.accepted, call.completed) = DriverDetail::Driver::Get().SerialProgress(); + writer->WriteCall(call); + ++recordedCalls; +} + +void FrameRecorder::Suspend() { + record(make(FrameCallKind::Suspend), false); +} + +void FrameRecorder::PresentBuffer(const DisplayBuffer& buffer) { + std::lock_guard lock(displayMutex); + displayBuffers[buffer.address] = buffer; +} + +void FrameRecorder::writeReferenceFrames() { + std::map presented; + { + std::lock_guard lock(displayMutex); + presented = displayBuffers; + } + if (presented.empty()) return; + if (!DriverDetail::Driver::Get().WaitIdleFor(std::chrono::seconds(10))) { + warnings.push_back("no reference frames: the driver did not go idle after the last frame"); + return; + } + std::uint64_t index = 0; + for (const auto& [address, buffer] : presented) { + try { + const auto pixels = ReadDisplayBuffer(buffer); + writer->WriteReference(index, address, pixels); + } catch (const std::exception& failure) { + warnings.push_back(std::string("no reference frame for a display buffer: ") + failure.what()); + continue; + } + auto call = make(FrameCallKind::DisplayBuffer); + call.ordinal = ++ordinal; + call.address = buffer.address; + call.values = {index, buffer.pixelFormat, buffer.width, buffer.height, buffer.tilingMode, buffer.pitchInPixel, buffer.dccAddress, buffer.dccClearColor, buffer.alignment}; + writer->WriteCall(call); + ++index; + } +} + +void FrameRecorder::record(FrameCall call, bool prologueCall, std::span shaders) { + std::lock_guard lock(mutex); + if (state == State::Waiting) { + if (!prologueCall) return; + call.ordinal = ++ordinal; + prologue.push_back(std::move(call)); + return; + } + if (state != State::Recording) return; + if (prologueCall) emitShaderDelta(shaders); + else emitDelta(); + if (state != State::Recording) return; + call.ordinal = ++ordinal; + std::tie(call.accepted, call.completed) = DriverDetail::Driver::Get().SerialProgress(); + writer->WriteCall(call); + ++recordedCalls; +} + +void FrameRecorder::FrameBoundary() { + std::lock_guard lock(mutex); + ++boundaries; + if (state == State::Recording) { + if (++recordedFrames >= frames) finish(); + return; + } + if (state == State::Waiting && triggered()) start(); +} + +bool FrameRecorder::triggered() { + if (!trigger.empty()) { + std::error_code error; + if (!std::filesystem::exists(trigger, error)) return false; + std::ifstream file(trigger); + std::uint64_t requested = 0; + if (file >> requested && requested != 0) frames = requested; + return true; + } + return boundaries >= std::max(atBoundary, 1); +} + +void FrameRecorder::emitDelta() { + std::vector spans; + for (const auto& range : ranges) { + if (range.kind == FrameRangeKind::Watched || range.kind == FrameRangeKind::Unwatched) spans.push_back({range.address, range.bytes, generation}); + } + const auto mark = GuestMemory::WriteGeneration(); + writeDelta(spans, {}); + generation = mark; + shaderMarks.clear(); +} + +void FrameRecorder::emitShaderDelta(std::span shaders) { + std::set blocks; + std::set hostPages; + std::uintptr_t arenaBase = 0; + std::size_t arenaBytes = 0; + GuestArena::GuestArenaRange_nid_postfix(&arenaBase, &arenaBytes); + const auto note = [&](const void* address) { + if (address == nullptr) return; + const auto at = pointer(address); + if (at >= arenaBase && at - arenaBase < arenaBytes) { + blocks.insert(at & ~std::uint64_t{FrameCaptureWriter::BlockBytes - 1}); + return; + } + const auto page = at & ~std::uint64_t{HostPageBytes - 1}; + hostPages.insert(page); + hostPages.insert(page + HostPageBytes); + }; + for (const auto* shader : shaders) { + if (shader == nullptr || !GuestMemory::Accessible(shader, sizeof(Shader))) continue; + note(shader); + note(shader->user_data); + note(shader->cx_registers); + note(shader->sh_registers); + note(shader->specials); + note(shader->input_semantics); + note(shader->output_semantics); + if (shader->user_data == nullptr || !GuestMemory::Accessible(shader->user_data, sizeof(ShaderUserData))) continue; + note(shader->user_data->direct_resource_offset); + for (const auto* sharps : shader->user_data->sharp_resource_offset) note(sharps); + } + if (blocks.empty() && hostPages.empty()) return; + const auto mark = GuestMemory::WriteGeneration(); + std::vector spans; + for (const auto block : blocks) { + const auto found = shaderMarks.find(block); + spans.push_back({block, 2 * FrameCaptureWriter::BlockBytes, found != shaderMarks.end() ? std::max(found->second, generation) : generation}); + } + const std::vector pages(hostPages.begin(), hostPages.end()); + writeDelta(spans, pages); + for (const auto block : blocks) shaderMarks[block] = mark; +} + +void FrameRecorder::writeDelta(std::span spans, std::span hostPages) { + if (abandonIfDiskLow()) return; + const auto [accepted, completed] = DriverDetail::Driver::Get().SerialProgress(); + const auto group = deltaGroups + 1; + bool any = false; + std::vector> written; + std::vector bytes; + for (const auto page : hostPages) { + if (!GuestMemory::Accessible(reinterpret_cast(static_cast(page)), HostPageBytes)) continue; + bytes.resize(HostPageBytes); + std::memcpy(bytes.data(), reinterpret_cast(static_cast(page)), HostPageBytes); + const auto hash = contentHash(bytes); + auto& known = hostPageHashes[page]; + if (known == hash) continue; + known = hash; + writer->WriteDelta(group, completed, page, bytes); + deltaBytes += bytes.size(); + any = true; + } + for (const auto& span : spans) { + GuestMemory::CollectWrittenBlocks(span.address, static_cast(span.bytes), span.since, written); + for (const auto& [begin, end] : written) { + bytes.resize(static_cast(end - begin)); + GuestMemory::ReadCommittedUnsynced(begin, bytes); + writer->WriteDelta(group, completed, begin, bytes); + deltaBytes += bytes.size(); + any = true; + } + } + if (!any) return; + deltaGroups = group; + auto call = make(FrameCallKind::Memory); + call.ordinal = ++ordinal; + call.accepted = accepted; + call.completed = completed; + call.values = {group}; + writer->WriteCall(call); +} + +void FrameRecorder::snapshot(const Range& range) { + writer->WriteRange(range.address, range.bytes, range.kind, range.protection, range.access); + if (!range.readable) { + unreadableBytes += range.bytes; + return; + } + std::vector bytes; + for (std::uint64_t at = 0; at < range.bytes; at += SnapshotPieceBytes) { + if (abandonIfDiskLow()) return; + bytes.resize(static_cast(std::min(SnapshotPieceBytes, range.bytes - at))); + GuestMemory::ReadCommitted(range.address + at, bytes); + snapshotBytes += writer->WriteSnapshot(range.address + at, bytes); + } +} + +bool FrameRecorder::abandonIfDiskLow() { + std::error_code error; + const auto space = std::filesystem::space(directory, error); + if (error || space.available >= MinimumFreeBytes) return false; + warnings.push_back("stopped: less than 4 GiB free on the capture volume"); + std::fprintf(stderr, "[frame-capture] stopped: less than 4 GiB free on the capture volume\n"); + try { + writer->Finish(header()); + } catch (const std::exception& failure) { + std::fprintf(stderr, "[frame-capture] %s\n", failure.what()); + } + writer.reset(); + state = State::Done; + return true; +} + +void FrameRecorder::start() { + ++startAttempts; + auto& driver = DriverDetail::Driver::Get(); + if (!driver.WaitIdleFor(std::chrono::seconds(10))) { + std::fprintf(stderr, "[frame-capture] the driver did not go idle within 10 s at frame boundary %llu (attempt %llu)\n", static_cast(boundaries), static_cast(startAttempts)); + if (startAttempts >= 5) { + std::fprintf(stderr, "[frame-capture] giving up: no idle frame boundary\n"); + state = State::Done; + } + return; + } + startedAt = std::chrono::steady_clock::now(); + startBoundary = boundaries; + ranges = committedRanges(); + writer = std::make_unique(directory); + std::vector> written; + for (const auto& range : ranges) { + if (range.kind == FrameRangeKind::Watched || range.kind == FrameRangeKind::Unwatched) GuestMemory::CollectWrittenBlocks(range.address, static_cast(range.bytes), std::numeric_limits::max(), written); + } + generation = GuestMemory::WriteGeneration(); + for (const auto& range : ranges) { + snapshot(range); + if (!writer) return; + } + for (const auto& call : prologue) writer->WriteCall(call); + std::uintptr_t ringBase = 0; + std::uint32_t ringSize = 0; + sceAgcDriverGetTFRing(&ringBase, &ringSize); + auto ring = make(FrameCallKind::SetTessellationFactorRing); + ring.ordinal = ++ordinal; + ring.address = ringBase; + ring.size = ringSize; + writer->WriteCall(ring); + const auto pending = driver.PendingEopFlipTokens(); + const std::set open(pending.begin(), pending.end()); + for (const auto& call : reservations) { + if (open.contains(call.values.back())) writer->WriteCall(call); + } + auto begin = make(FrameCallKind::FrameStart); + begin.ordinal = ++ordinal; + std::tie(begin.accepted, begin.completed) = driver.SerialProgress(); + begin.values = {boundaries}; + writer->WriteCall(begin); + state = State::Recording; + recordedFrames = 0; + std::fprintf(stderr, "[frame-capture] started at frame boundary %llu: %zu ranges, %.1f MiB snapshot in %.1f s\n", static_cast(boundaries), ranges.size(), + static_cast(snapshotBytes) / (1024.0 * 1024.0), std::chrono::duration(std::chrono::steady_clock::now() - startedAt).count()); +} + +void FrameRecorder::finish() { + emitDelta(); + if (!writer) return; + auto end = make(FrameCallKind::End); + end.ordinal = ++ordinal; + std::tie(end.accepted, end.completed) = DriverDetail::Driver::Get().SerialProgress(); + writer->WriteCall(end); + writeReferenceFrames(); + writer->Finish(header()); + std::fprintf(stderr, "[frame-capture] %llu frames, %llu calls, %llu memory deltas (%.1f MiB), %.1f MiB raw, %.1f MiB stored in %s\n", static_cast(recordedFrames), + static_cast(recordedCalls), static_cast(deltaGroups), static_cast(deltaBytes) / (1024.0 * 1024.0), + static_cast(writer->RawBytes()) / (1024.0 * 1024.0), static_cast(writer->StoredBytes()) / (1024.0 * 1024.0), directory.string().c_str()); + writer.reset(); + state = State::Done; +} + +std::string FrameRecorder::header() const { + std::uintptr_t arenaBase = 0; + std::size_t arenaBytes = 0; + GuestArena::GuestArenaRange_nid_postfix(&arenaBase, &arenaBytes); + std::string text = "{\"magic\":\"aps5-frame-capture 1\""; + text += ",\"commit\":" + jsonString(APS5_TRACE_COMMIT); + text += std::string(",\"dirty\":") + (APS5_TRACE_DIRTY < 0 ? "null" : APS5_TRACE_DIRTY != 0 ? "true" : "false"); + text += ",\"arena_base\":" + std::to_string(arenaBase) + ",\"arena_bytes\":" + std::to_string(arenaBytes); + text += ",\"start_boundary\":" + std::to_string(startBoundary) + ",\"frames\":" + std::to_string(recordedFrames); + text += ",\"calls\":" + std::to_string(recordedCalls) + ",\"prologue_calls\":" + std::to_string(prologue.size()); + text += ",\"ranges\":" + std::to_string(ranges.size()) + ",\"snapshot_bytes\":" + std::to_string(snapshotBytes) + ",\"unreadable_bytes\":" + std::to_string(unreadableBytes); + text += ",\"memory_groups\":" + std::to_string(deltaGroups) + ",\"delta_bytes\":" + std::to_string(deltaBytes); + text += ",\"capture_seconds\":" + std::to_string(std::chrono::duration(std::chrono::steady_clock::now() - startedAt).count()); + text += ",\"env\":{"; + bool first = true; + for (const auto& [name, value] : captureEnvironment()) { + text += (first ? "" : ",") + jsonString(name) + ":" + jsonString(value); + first = false; + } + text += "},\"warnings\":["; + first = true; + for (const auto& warning : warnings) { + text += (first ? "" : ",") + jsonString(warning); + first = false; + } + return text + "]}\n"; +} + +std::vector FrameRecorder::committedRanges() { +#ifdef _WIN32 + std::uintptr_t base = 0; + std::size_t size = 0; + GuestArena::GuestArenaRange_nid_postfix(&base, &size); + if (size == 0) throw std::runtime_error("frame capture: the guest arena is not reserved"); + std::vector result; + for (const auto& allocation : GuestAllocations::GuestAllocationsAcquireAll_nid_postfix()) { + if (!allocation->readable) continue; + const auto first = allocation->address; + const auto end = first + allocation->bytes; + const bool host = first < base || end > base + size; + const auto access = FrameRangeAccess::Readable | (allocation->writable ? FrameRangeAccess::Writable : 0u) | (allocation->gpu ? FrameRangeAccess::Gpu : 0u); + for (auto address = first; address < end;) { + MEMORY_BASIC_INFORMATION info{}; + if (VirtualQuery(reinterpret_cast(static_cast(address)), &info, sizeof(info)) == 0) throw std::runtime_error("frame capture: VirtualQuery failed inside the guest arena"); + const auto regionEnd = std::min(end, reinterpret_cast(info.BaseAddress) + info.RegionSize); + if (info.State == MEM_COMMIT) { + Range range; + range.address = address; + range.bytes = regionEnd - address; + range.protection = info.Protect; + range.access = access; + const auto page = info.Protect & 0xffu; + range.readable = (info.Protect & PAGE_GUARD) == 0 && (page == PAGE_READONLY || page == PAGE_READWRITE || page == PAGE_WRITECOPY || page == PAGE_EXECUTE_READ || page == PAGE_EXECUTE_READWRITE || page == PAGE_EXECUTE_WRITECOPY); + if (host) range.kind = FrameRangeKind::Host; + else if (info.Type == MEM_PRIVATE) range.kind = GuestMemory::Watched(range.address, static_cast(range.bytes)) ? FrameRangeKind::Watched : FrameRangeKind::Unwatched; + else range.kind = FrameRangeKind::Section; + auto& last = result.empty() ? range : result.back(); + if (!result.empty() && last.address + last.bytes == range.address && last.kind == range.kind && last.protection == range.protection && last.readable == range.readable && last.access == range.access) last.bytes += range.bytes; + else result.push_back(range); + } + address = regionEnd; + } + } + return result; +#else + throw std::runtime_error("frame capture: guest memory capture is implemented on Windows only"); +#endif +} + +} diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp index 960cf4a11c..8648a7fa14 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp @@ -1549,6 +1549,71 @@ std::uint64_t CollectWritesUncached(std::uint64_t address, std::size_t bytes) { return collectWrites(address, bytes, false); } +std::uint64_t WriteGeneration() { + return Tracker().generation.load(std::memory_order_acquire); +} + +std::uint64_t CollectWrittenBlocks(std::uint64_t address, std::size_t bytes, std::uint64_t since, std::vector>& written) { + written.clear(); + if (bytes == 0 || bytes > std::numeric_limits::max() - address) return 0; + auto& tracker = Tracker(); + const auto lock = lockTracker(tracker); + tracker.initialize(); + if (!tracker.watched) return 0; +#ifdef _WIN32 + if (address < tracker.base || bytes > tracker.size || address - tracker.base > tracker.size - bytes) return 0; +#endif + const auto end = address + bytes; + const auto first = tracker.blockOf(address); + const auto last = tracker.blockOf(end - 1); + const auto clip = [&](std::uint64_t block) { + const auto begin = tracker.blockBegin(block); + return std::pair{std::max(address, begin), std::min(end, begin + WriteBlockBytes)}; + }; + std::uint64_t spanBegin = 0; + std::uint64_t spanEnd = 0; + const auto walkSpan = [&] { + if (spanEnd > spanBegin) walkWrites(tracker, spanBegin & ~std::uint64_t{WritePageBytes - 1}, (spanEnd + WritePageBytes - 1) & ~std::uint64_t{WritePageBytes - 1}, StampKind::Cpu); + spanBegin = spanEnd = 0; + }; + for (auto block = first; block <= last; ++block) { + const auto [begin, stop] = clip(block); + if (!tracker.covers(begin, stop - begin)) { + walkSpan(); + continue; + } + if (spanEnd != begin) { + walkSpan(); + spanBegin = begin; + } + spanEnd = stop; + } + walkSpan(); + const auto append = [&](std::uint64_t begin, std::uint64_t stop) { + if (!written.empty() && written.back().second == begin) written.back().second = stop; + else written.emplace_back(begin, stop); + }; + for (auto block = first; block <= last; ++block) { + if (tracker.cpuStampOf(block) <= since) continue; + const auto [begin, stop] = clip(block); + const auto pages = tracker.cpuPages.find(block); + bool any = false; + if (pages != tracker.cpuPages.end()) { + const auto blockStart = tracker.blockBegin(block); + for (std::size_t page = 0; page < WritePagesPerBlock; ++page) { + if (pages->second.pages[page] <= since) continue; + const auto pageBegin = std::max(begin, blockStart + page * WritePageBytes); + const auto pageEnd = std::min(stop, blockStart + (page + 1) * WritePageBytes); + if (pageBegin >= pageEnd) continue; + append(pageBegin, pageEnd); + any = true; + } + } + if (!any) append(begin, stop); + } + return tracker.generation.load(std::memory_order_relaxed); +} + void BumpCollectEpoch() { const auto epoch = nextCollectEpoch.fetch_add(1, std::memory_order_relaxed) + 1; HostThreadSlot::Set(epoch); diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp new file mode 100644 index 0000000000..c14a54bba8 --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp @@ -0,0 +1,233 @@ +#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp" +#include +#include +#include +#include +#include +#include +#include +#include + +#ifdef _WIN32 +#include +#define getpid _getpid +#else +#include +#endif + +namespace { + +using AgcDriver::FrameCall; +using AgcDriver::FrameCallKind; +using AgcDriver::FrameCaptureReader; +using AgcDriver::FrameCaptureWriter; +using AgcDriver::FrameMemoryChunk; +using AgcDriver::FrameMemoryKind; +using AgcDriver::FrameRangeKind; + +void check(bool condition, const std::string& message) { + if (!condition) { + std::fprintf(stderr, "FAILED: %s\n", message.c_str()); + std::exit(1); + } +} + +template +void checkThrows(TFunction&& function, const std::string& message) { + try { + function(); + } catch (const std::runtime_error&) { + return; + } + check(false, message); +} + +bool sameRegisters(const std::vector& left, const std::vector& right) { + if (left.size() != right.size()) return false; + for (std::size_t index = 0; index < left.size(); ++index) { + if (left[index].offset != right[index].offset || left[index].value != right[index].value) return false; + } + return true; +} + +bool sameCall(const FrameCall& left, const FrameCall& right) { + return left.kind == right.kind && left.ordinal == right.ordinal && left.timeNs == right.timeNs && left.thread == right.thread && left.accepted == right.accepted && left.completed == right.completed && left.queue == right.queue && + left.flags == right.flags && left.cpuFlip == right.cpuFlip && left.address == right.address && left.size == right.size && left.values == right.values && sameRegisters(left.context, right.context) && + sameRegisters(left.primitive, right.primitive); +} + +std::vector sampleCalls() { + std::vector calls; + FrameCall shader; + shader.kind = FrameCallKind::RegisterShader; + shader.ordinal = 1; + shader.address = 0x2000010000; + calls.push_back(shader); + FrameCall abi; + abi.kind = FrameCallKind::ResolveGraphicsStagesAbi; + abi.ordinal = 2; + abi.values = {0x2000010000, 0x2000020000, 0}; + abi.context = {{0x1a0, 7}, {0x1a1, 0xffffffffu}}; + abi.primitive = {{0x242, 3}}; + calls.push_back(abi); + FrameCall submit; + submit.kind = FrameCallKind::Submit; + submit.ordinal = 3; + submit.timeNs = 123456789; + submit.thread = 4242; + submit.accepted = 20; + submit.completed = 17; + submit.queue = 0x21; + submit.address = 0x2000030000; + submit.size = 4096; + calls.push_back(submit); + FrameCall flip; + flip.kind = FrameCallKind::Flip; + flip.ordinal = 4; + flip.cpuFlip = true; + flip.values = {1, 2, 0, static_cast(-5)}; + calls.push_back(flip); + FrameCall end; + end.kind = FrameCallKind::End; + end.ordinal = 5; + calls.push_back(end); + return calls; +} + +std::vector sampleMemory() { + constexpr std::size_t Block = FrameCaptureWriter::BlockBytes; + std::vector memory(Block * 150 + 4096); + for (std::size_t block = 0; block < 150; ++block) { + if (block % 3 == 1 || (block >= 10 && block < 90)) { + for (std::size_t at = 0; at < Block; at += 97) memory[block * Block + at] = static_cast((block * 131 + at) & 0xff); + } + } + memory[memory.size() - 1] = std::byte{0x5a}; + return memory; +} + +void truncateFile(const std::filesystem::path& path, std::uintmax_t removed) { + const auto size = std::filesystem::file_size(path); + std::filesystem::resize_file(path, size - removed); +} + +void testRoundTrip(const std::filesystem::path& directory) { + constexpr std::uint64_t Base = 0x2000000000; + const auto calls = sampleCalls(); + const auto memory = sampleMemory(); + std::vector delta(8192); + for (std::size_t at = 0; at < delta.size(); ++at) delta[at] = static_cast(at * 7); + std::uint64_t stored = 0; + { + FrameCaptureWriter writer(directory); + writer.WriteRange(Base, memory.size(), FrameRangeKind::Watched, 3, AgcDriver::FrameRangeAccess::Readable | AgcDriver::FrameRangeAccess::Gpu); + stored = writer.WriteSnapshot(Base, memory); + for (const auto& call : calls) writer.WriteCall(call); + writer.WriteDelta(1, 17, Base + 0x3000, delta); + writer.Finish("{\"magic\":\"aps5-frame-capture 1\"}\n"); + check(writer.RawBytes() == stored + delta.size(), "raw byte count does not add the snapshot and the delta"); + } + std::size_t nonzero = 0; + for (std::size_t at = 0; at < memory.size(); at += FrameCaptureWriter::BlockBytes) { + const auto bytes = std::min(FrameCaptureWriter::BlockBytes, memory.size() - at); + if (!AgcDriver::AllZero(std::span(memory).subspan(at, bytes))) nonzero += bytes; + } + check(stored == nonzero, "the snapshot stored zero blocks or lost data blocks"); + + const FrameCaptureReader reader(directory); + check(!reader.Truncated(), "a finished capture reads as truncated"); + check(reader.Header() == "{\"magic\":\"aps5-frame-capture 1\"}\n", "header does not round-trip"); + check(reader.Calls().size() == calls.size(), "call count does not round-trip"); + for (std::size_t index = 0; index < calls.size(); ++index) check(sameCall(reader.Calls()[index], calls[index]), "call " + std::to_string(index) + " does not round-trip"); + + std::vector restored(memory.size()); + std::size_t ranges = 0, snapshots = 0, deltas = 0; + for (const auto& chunk : reader.Chunks()) { + if (chunk.kind == FrameMemoryKind::Range) { + ++ranges; + check(chunk.address == Base && chunk.bytes == memory.size() && chunk.rangeKind == FrameRangeKind::Watched && chunk.protection == 3 && + chunk.access == (AgcDriver::FrameRangeAccess::Readable | AgcDriver::FrameRangeAccess::Gpu), "range does not round-trip"); + continue; + } + if (chunk.kind == FrameMemoryKind::Snapshot) { + ++snapshots; + check(chunk.bytes <= FrameCaptureWriter::ChunkBytes, "snapshot chunk is larger than the chunk limit"); + check(chunk.address >= Base && chunk.address - Base + chunk.bytes <= restored.size(), "snapshot chunk outside its range"); + reader.Read(chunk, std::span(restored).subspan(chunk.address - Base, chunk.bytes)); + continue; + } + ++deltas; + check(chunk.group == 1 && chunk.completed == 17 && chunk.address == Base + 0x3000, "delta header does not round-trip"); + check(reader.Read(chunk) == delta, "delta bytes do not round-trip"); + } + check(ranges == 1 && deltas == 1 && snapshots >= 2, "unexpected chunk counts"); + check(restored == memory, "snapshot does not restore the memory"); + std::vector wrong(1); + checkThrows([&] { reader.Read(reader.Chunks()[1], wrong); }, "a read into a wrongly sized destination does not throw"); +} + +void testTruncated(const std::filesystem::path& source, const std::filesystem::path& directory) { + std::filesystem::remove_all(directory); + std::filesystem::copy(source, directory, std::filesystem::copy_options::recursive); + truncateFile(directory / FrameCaptureWriter::CallsName, 3); + truncateFile(directory / FrameCaptureWriter::MemoryName, 10); + std::filesystem::remove(directory / FrameCaptureWriter::HeaderName); + const FrameCaptureReader reader(directory); + const auto calls = sampleCalls(); + check(reader.Truncated(), "a cut capture does not read as truncated"); + check(reader.Calls().size() == calls.size() - 1, "a cut call record is not dropped"); + check(reader.Chunks().back().kind != FrameMemoryKind::Delta, "a cut memory chunk is not dropped"); +} + +void testCorrupt(const std::filesystem::path& source, const std::filesystem::path& directory) { + std::filesystem::remove_all(directory); + std::filesystem::copy(source, directory, std::filesystem::copy_options::recursive); + { + std::fstream file(directory / FrameCaptureWriter::CallsName, std::ios::binary | std::ios::in | std::ios::out); + file.seekp(static_cast(FrameCaptureWriter::CallsMagic.size())); + const std::uint32_t kind = 99; + file.write(reinterpret_cast(&kind), sizeof(kind)); + } + checkThrows([&] { FrameCaptureReader reader(directory); }, "an unknown call kind does not throw"); + std::ofstream(directory / FrameCaptureWriter::CallsName, std::ios::binary | std::ios::trunc) << "not a capture"; + checkThrows([&] { FrameCaptureReader reader(directory); }, "a file without the magic does not throw"); +} + +void testWriter(const std::filesystem::path& directory) { + FrameCaptureWriter writer(directory); + writer.Finish("{}"); + FrameCall call; + call.kind = FrameCallKind::Suspend; + checkThrows([&] { writer.WriteCall(call); }, "a call after Finish does not throw"); + checkThrows([&] { writer.Finish("{}"); }, "a second Finish does not throw"); + FrameCall unknown; + unknown.kind = static_cast(77); + FrameCaptureWriter other(directory / "other"); + checkThrows([&] { other.WriteCall(unknown); }, "an unknown call kind is written"); +} + +void testAllZero() { + std::vector bytes(37); + check(AgcDriver::AllZero(bytes), "zero bytes are not all zero"); + check(AgcDriver::AllZero({}), "an empty span is not all zero"); + bytes[36] = std::byte{1}; + check(!AgcDriver::AllZero(bytes), "a nonzero tail byte is missed"); + bytes[36] = std::byte{0}; + bytes[3] = std::byte{1}; + check(!AgcDriver::AllZero(bytes), "a nonzero word is missed"); +} + +} + +int main() { + const auto root = std::filesystem::temp_directory_path() / ("aps5-frame-capture-test-" + std::to_string(getpid())); + std::filesystem::remove_all(root); + testAllZero(); + testRoundTrip(root / "capture"); + testTruncated(root / "capture", root / "truncated"); + testCorrupt(root / "capture", root / "corrupt"); + testWriter(root / "writer"); + std::filesystem::remove_all(root); + std::puts("frame capture tests passed"); + return 0; +} diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp new file mode 100644 index 0000000000..a6df961ace --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp @@ -0,0 +1,198 @@ +#include "prx/libSceAgcDriver/Execution/include/Driver.hpp" +#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp" +#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp" +#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp" +#include "prx/libc/include/GuestAllocations.hpp" +#include "prx/libc/include/GuestArena.hpp" +#include "SceTypes.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef _WIN32 +#include +#endif + +extern "C" { +std::uint32_t* APS5_VABI sceAgcDcbWriteData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, const void*, std::uint32_t, std::uint8_t, std::uint8_t); +std::uint32_t* APS5_VABI sceAgcDcbDmaData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint32_t, std::uint8_t, std::uint8_t, std::uint8_t); +} + +namespace { + +using AgcDriver::FrameCallKind; +using AgcDriver::FrameCaptureReader; +using AgcDriver::FrameMemoryKind; + +constexpr std::uint32_t Handle = 7; +constexpr std::uint8_t GraphicsMemory = 0x0a; +constexpr std::uint8_t DmaMemory = 0; +constexpr std::size_t BlockBytes = 1u << 20; +constexpr std::size_t CommandBytes = 64u * 1024u; +constexpr std::size_t DataBytes = 4096; +constexpr std::uint32_t Done = 1; + +void check(bool condition, const std::string& reason) { + if (!condition) throw std::runtime_error(reason); +} + +std::uint64_t at(const volatile void* pointer) { + return static_cast(reinterpret_cast(pointer)); +} + +class Request final : public AgcDriver::IFlipRequest { +public: + explicit Request(std::atomic& ready) : ready(ready) {} + void GpuReady(const std::shared_ptr&) override { ++ready; } + void Fail(std::exception_ptr error) noexcept override { + if (!error) std::terminate(); + } + +private: + std::atomic& ready; +}; + +class Output final : public AgcDriver::IVideoOutput { +public: + std::shared_ptr Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared(ready); } + void Fail(std::exception_ptr error) noexcept override { + if (!error) std::terminate(); + } + std::atomic ready = 0; +}; + +struct Layout { + std::byte* base = nullptr; + std::uint32_t* firstCommands = nullptr; + std::uint32_t* secondCommands = nullptr; + std::byte* source = nullptr; + std::byte* firstTarget = nullptr; + std::byte* secondTarget = nullptr; + std::uint32_t* label = nullptr; +}; + +Layout allocate() { + auto* const block = static_cast(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536)); + check(block != nullptr, "cannot allocate guest memory"); +#ifdef _WIN32 + GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, PAGE_READWRITE, BlockBytes); +#else + GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 3, BlockBytes); +#endif + { + GuestAllocations::Mutation mutation; + mutation.Add(block, BlockBytes, true, true, true); + } + Layout layout; + layout.base = block; + layout.firstCommands = reinterpret_cast(block); + layout.secondCommands = reinterpret_cast(block + CommandBytes); + layout.source = block + 2 * CommandBytes; + layout.firstTarget = layout.source + DataBytes; + layout.secondTarget = layout.firstTarget + DataBytes; + layout.label = reinterpret_cast(layout.secondTarget + DataBytes); + return layout; +} + +std::vector pattern(std::uint8_t seed) { + std::vector bytes(DataBytes); + for (std::size_t index = 0; index < bytes.size(); ++index) bytes[index] = static_cast((index * 31 + seed) & 0xff); + return bytes; +} + +void copyFrame(std::uint32_t* words, const Layout& layout, std::byte* target) { + CommandBuffer buffer{words, words + CommandBytes / sizeof(std::uint32_t), words, words + CommandBytes / sizeof(std::uint32_t), nullptr, nullptr, 0}; + sceAgcDcbDmaData(&buffer, 0, DmaMemory, 0, at(target), DmaMemory, 0, at(layout.source), DataBytes, 0, 1, 0); + sceAgcDcbWriteData(&buffer, GraphicsMemory, 0, at(layout.label), &Done, 1, 0, 1); + Packet packet{words, static_cast(buffer.cursor_up - words), 0, {}}; + check(sceAgcDriverSubmitDcb(&packet) == 0, "submission failed"); +} + +void flip() { + AgcDriverSubmitFlip_nid_postfix(AgcDriver::FlipInfo{Handle, -1, 1, 0}); +} + +std::vector readFile(const std::filesystem::path& path) { + std::ifstream file(path, std::ios::binary); + check(file.is_open(), "cannot open " + path.string()); + std::vector bytes((std::istreambuf_iterator(file)), std::istreambuf_iterator()); + std::vector result(bytes.size()); + std::memcpy(result.data(), bytes.data(), bytes.size()); + return result; +} + +bool equal(const std::byte* bytes, const std::vector& expected) { + return std::memcmp(bytes, expected.data(), expected.size()) == 0; +} + +void testCaptureAndReplay(const std::filesystem::path& tool) { + const char* directory = std::getenv("APS5_FRAME_CAPTURE"); + check(directory != nullptr && *directory != '\0', "APS5_FRAME_CAPTURE is not set"); + const std::filesystem::path capture(directory); + const auto layout = allocate(); + const auto first = pattern(3); + const auto second = pattern(101); + auto output = std::make_shared(); + AgcDriverRegisterVideoOutput_nid_postfix(Handle, output); + + flip(); + std::memcpy(layout.source, first.data(), first.size()); + copyFrame(layout.firstCommands, layout, layout.firstTarget); + flip(); + std::memcpy(layout.source, second.data(), second.size()); + copyFrame(layout.secondCommands, layout, layout.secondTarget); + flip(); + AgcDriverWaitIdle_nid_postfix(); + check(equal(layout.firstTarget, first) && equal(layout.secondTarget, second), "the driver did not run the copies while capturing"); + + const FrameCaptureReader reader(capture); + check(!reader.Truncated(), "the capture is truncated"); + check(reader.Header().find("\"frames\":2") != std::string::npos, "the capture header does not record two frames: " + reader.Header()); + std::size_t submits = 0, flips = 0, memory = 0, starts = 0; + for (const auto& call : reader.Calls()) { + submits += call.kind == FrameCallKind::Submit; + flips += call.kind == FrameCallKind::Flip; + memory += call.kind == FrameCallKind::Memory; + starts += call.kind == FrameCallKind::FrameStart; + } + check(starts == 1 && submits == 2 && flips == 2, "the capture holds " + std::to_string(submits) + " submits and " + std::to_string(flips) + " flips after " + std::to_string(starts) + " frame starts"); + check(memory >= 2, "the CPU writes before each copy were not recorded as memory deltas"); + const auto snapshot = std::any_of(reader.Chunks().begin(), reader.Chunks().end(), [&](const auto& chunk) { + return chunk.kind == FrameMemoryKind::Range && chunk.address <= at(layout.base) && at(layout.base) + BlockBytes <= chunk.address + chunk.bytes; + }); + check(snapshot, "the guest block is not in the snapshot ranges"); + + const auto firstDump = capture / "first.bin"; + const auto secondDump = capture / "second.bin"; + const auto command = "\"\"" + tool.string() + "\" \"" + capture.string() + "\" --strict --dump " + std::to_string(at(layout.firstTarget)) + ":" + std::to_string(DataBytes) + ":\"" + firstDump.string() + + "\" --dump " + std::to_string(at(layout.secondTarget)) + ":" + std::to_string(DataBytes) + ":\"" + secondDump.string() + "\"\""; + const auto code = std::system(command.c_str()); + check(code == 0, "agc_frame_replay exited with " + std::to_string(code)); + check(readFile(firstDump) == first, "the replay did not reproduce the first copy"); + check(readFile(secondDump) == second, "the replay did not reproduce the second copy"); +} + +} + +int main(int argc, char** argv) { + if (argc != 2) { + std::fprintf(stderr, "usage: agc_driver_frame_replay_tests \n"); + return 2; + } + try { + testCaptureAndReplay(argv[1]); + } catch (const std::exception& error) { + std::fprintf(stderr, "FAILED: %s\n", error.what()); + return 1; + } + std::puts("frame replay tests passed"); + return 0; +} diff --git a/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp new file mode 100644 index 0000000000..a90586046f --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp @@ -0,0 +1,736 @@ +#include "prx/libSceAgcDriver/Execution/include/DisplayBuffer.hpp" +#include "prx/libSceAgcDriver/Execution/include/Driver.hpp" +#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp" +#include "prx/libSceAgcDriver/Execution/include/FrameDumpIo.hpp" +#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp" +#include "prx/libSceAgcDriver/Submit/include/Acb.hpp" +#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp" +#include "prx/libc/include/GuestAllocations.hpp" +#include "prx/libc/include/GuestArena.hpp" +#include "SceTypes.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef _WIN32 +#include +#endif + +extern "C" int APS5_VABI sceAgcDriverSetTFRing(const volatile void* base, std::uint32_t size); + +namespace { + +using AgcDriver::FrameCall; +using AgcDriver::FrameCallKind; +using AgcDriver::FrameCaptureReader; +using AgcDriver::FrameMemoryChunk; +using AgcDriver::FrameMemoryKind; +using AgcDriver::FrameRangeAccess; +using AgcDriver::FrameRangeKind; +using Clock = std::chrono::steady_clock; + +struct Dump { + std::uint64_t address = 0; + std::uint64_t bytes = 0; + std::filesystem::path path; +}; + +struct Options { + std::filesystem::path directory; + std::vector dumps; + std::filesystem::path frames; + bool pace = true; + bool strict = false; + std::chrono::milliseconds paceTimeout{10000}; + std::chrono::milliseconds memoryPaceTimeout{10000}; + std::chrono::milliseconds releaseAfter{3}; + std::chrono::milliseconds drainTimeout{10000}; + bool release = true; + bool synthesize = true; +}; + +class Frames { +public: + void MarkReady() { + std::lock_guard lock(mutex); + ready.push_back(Clock::now()); + } + + void Failed(std::exception_ptr error) { + std::lock_guard lock(mutex); + if (!failure) failure = error; + } + + std::vector Times() const { + std::lock_guard lock(mutex); + return ready; + } + + std::exception_ptr Failure() const { + std::lock_guard lock(mutex); + return failure; + } + +private: + mutable std::mutex mutex; + std::vector ready; + std::exception_ptr failure; +}; + +class ReplayFlip final : public AgcDriver::IFlipRequest { +public: + explicit ReplayFlip(Frames& frames) : frames(frames) {} + void GpuReady(const std::shared_ptr&) override { frames.MarkReady(); } + void Fail(std::exception_ptr error) noexcept override { frames.Failed(error); } + +private: + Frames& frames; +}; + +class ReplayRenderingWait final : public AgcDriver::IRenderingWait { +public: + void Wait() override {} +}; + +class ReplayOutput final : public AgcDriver::IVideoOutput { +public: + explicit ReplayOutput(Frames& frames) : frames(frames) {} + std::shared_ptr Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared(frames); } + std::shared_ptr CaptureRenderingWait(std::uint32_t) override { return std::make_shared(); } + void Fail(std::exception_ptr error) noexcept override { frames.Failed(error); } + +private: + Frames& frames; +}; + +std::uint64_t headerNumber(const std::string& header, std::string_view key) { + const auto quoted = "\"" + std::string(key) + "\":"; + const auto at = header.find(quoted); + if (at == std::string::npos) throw std::runtime_error("frame replay: the capture header has no " + std::string(key)); + return std::strtoull(header.c_str() + at + quoted.size(), nullptr, 10); +} + +void restore(const FrameCaptureReader& reader, const FrameMemoryChunk& chunk) { + reader.Read(chunk, std::span(reinterpret_cast(static_cast(chunk.address)), static_cast(chunk.bytes))); +} + +bool committedWritable(std::uint64_t address, std::uint64_t bytes) { +#ifdef _WIN32 + for (auto at = address; at < address + bytes;) { + MEMORY_BASIC_INFORMATION info{}; + if (VirtualQuery(reinterpret_cast(static_cast(at)), &info, sizeof(info)) == 0 || info.State != MEM_COMMIT) return false; + const auto access = info.Protect & 0xffu; + if ((info.Protect & PAGE_GUARD) != 0 || (access != PAGE_READWRITE && access != PAGE_EXECUTE_READWRITE)) return false; + at = reinterpret_cast(info.BaseAddress) + info.RegionSize; + } + return true; +#else + static_cast(address); + static_cast(bytes); + return false; +#endif +} + +std::pair progress(); + +struct Skipped { + std::vector> ranges; + std::uint64_t bytes = 0; + + void Add(const FrameMemoryChunk& chunk) { + ranges.emplace_back(chunk.address, chunk.address + chunk.bytes); + bytes += chunk.bytes; + } + + bool Overlaps(const FrameMemoryChunk& chunk) const { + return std::any_of(ranges.begin(), ranges.end(), [&](const auto& range) { return chunk.address < range.second && range.first < chunk.address + chunk.bytes; }); + } +}; + +void mapHostRanges(const FrameCaptureReader& reader, Skipped& skipped) { + std::vector host; + for (const auto& chunk : reader.Chunks()) { + if (chunk.kind == FrameMemoryKind::Range && chunk.rangeKind == FrameRangeKind::Host) host.push_back(&chunk); + } +#ifdef _WIN32 + constexpr std::uint64_t Granularity = 64u * 1024u; + std::vector> envelopes; + for (const auto* chunk : host) { + const auto begin = chunk->address & ~(Granularity - 1); + const auto end = (chunk->address + chunk->bytes + Granularity - 1) & ~(Granularity - 1); + if (!envelopes.empty() && begin <= envelopes.back().second) envelopes.back().second = std::max(envelopes.back().second, end); + else envelopes.emplace_back(begin, end); + } + std::vector> refused; + for (const auto& [begin, end] : envelopes) { + if (VirtualAlloc(reinterpret_cast(static_cast(begin)), static_cast(end - begin), MEM_RESERVE, PAGE_NOACCESS) == nullptr) refused.emplace_back(begin, end); + } + for (const auto* chunk : host) { + const bool blocked = std::any_of(refused.begin(), refused.end(), [&](const auto& range) { return chunk->address < range.second && range.first < chunk->address + chunk->bytes; }); + if (!blocked && VirtualAlloc(reinterpret_cast(static_cast(chunk->address)), static_cast(chunk->bytes), MEM_COMMIT, PAGE_READWRITE) != nullptr) continue; + if ((chunk->access & FrameRangeAccess::Gpu) != 0) throw std::runtime_error("frame replay: cannot map the GPU-visible host range at " + std::to_string(chunk->address)); + skipped.Add(*chunk); + } +#else + for (const auto* chunk : host) skipped.Add(*chunk); +#endif +} + +Skipped restoreMemory(const FrameCaptureReader& reader) { + std::uintptr_t base = 0; + std::size_t size = 0; + GuestArena::GuestArenaRange_nid_postfix(&base, &size); + if (!reader.Header().empty() && headerNumber(reader.Header(), "arena_base") != base) throw std::runtime_error("frame replay: the guest arena is at a different address than in the capture"); + progress(); + Skipped skipped; + mapHostRanges(reader, skipped); + { + GuestAllocations::Mutation mutation; + for (const auto& chunk : reader.Chunks()) { + if (chunk.kind != FrameMemoryKind::Range || chunk.rangeKind == FrameRangeKind::Host) continue; + const bool gpu = (chunk.access & FrameRangeAccess::Gpu) != 0; + if (committedWritable(chunk.address, chunk.bytes)) { + if (!gpu) skipped.Add(chunk); + continue; + } + auto* const pointer = reinterpret_cast(static_cast(chunk.address)); + const auto bytes = static_cast(chunk.bytes); + try { + GuestArena::GuestArenaMarkUsed_nid_postfix(pointer, bytes); + } catch (const std::exception&) { + if (gpu) throw; + skipped.Add(chunk); + continue; + } +#ifdef _WIN32 + GuestArena::GuestArenaCommit_nid_postfix(pointer, bytes, PAGE_READWRITE, bytes); +#else + GuestArena::GuestArenaCommit_nid_postfix(pointer, bytes, 3, bytes); +#endif + mutation.Add(pointer, bytes, (chunk.access & FrameRangeAccess::Readable) != 0, (chunk.access & FrameRangeAccess::Writable) != 0, gpu); + } + } + std::vector snapshot; + for (const auto& chunk : reader.Chunks()) { + if (chunk.kind == FrameMemoryKind::Snapshot && !skipped.Overlaps(chunk)) snapshot.push_back(&chunk); + } + const auto workers = std::max(1, std::thread::hardware_concurrency()); + for (std::size_t first = 0; first < snapshot.size(); first += workers) { + std::vector> pending; + for (auto index = first; index < std::min(snapshot.size(), first + workers); ++index) { + pending.push_back(std::async(std::launch::async, [&reader, chunk = snapshot[index]] { restore(reader, *chunk); })); + } + for (auto& future : pending) future.get(); + } + return skipped; +} + +std::pair progress() { + std::uint64_t accepted = 0; + std::uint64_t completed = 0; + AgcDriverSerialProgress_nid_postfix(&accepted, &completed); + return {accepted, completed}; +} + +struct Replay { + const Options& options; + const FrameCaptureReader& reader; + Frames frames; + std::mutex outputsMutex; + std::vector> outputs; + std::map> groups; + Skipped skipped; + std::atomic paceTimeouts{0}; + std::atomic staleRegistrations{0}; + std::atomic failedRegistrations{0}; + std::atomic submits{0}; + std::atomic deltaBytes{0}; + std::atomic paceWaitedNs{0}; + std::atomic stalled{false}; + std::atomic stalledAt{0}; + std::atomic earlyReleases{0}; + std::atomic lateReleases{0}; + std::atomic syntheticReleases{0}; + std::atomic sequenced{0}; + std::uint64_t unfinished = 0; + std::size_t threads = 0; + bool recording = false; + Clock::time_point startedAt{}; + Clock::time_point endedAt{}; + + double paceWaitedSeconds() const { + return static_cast(paceWaitedNs.load()) / 1e9; + } + + void report() const { + const auto [accepted, completed] = progress(); + std::fprintf(stderr, "[frame-replay] %llu submits, %zu frames ready, %.1f s since the first frame, pacing waited %.1f s (%llu timeouts), serials %llu/%llu\n", + static_cast(submits.load()), frames.Times().size(), std::chrono::duration(Clock::now() - startedAt).count(), paceWaitedSeconds(), + static_cast(paceTimeouts.load()), static_cast(completed), static_cast(accepted)); + } + + static bool paced(FrameCallKind kind) { + return kind == FrameCallKind::Submit || kind == FrameCallKind::Flip || kind == FrameCallKind::ReserveEopFlip || kind == FrameCallKind::Suspend || kind == FrameCallKind::Memory; + } + + void pace(const FrameCall& call) { + if (!options.pace || !recording || !paced(call.kind) || call.accepted < call.completed) return; + if (stalled.load()) { + if (progress().second == stalledAt.load()) return; + stalled.store(false); + } + const auto inFlight = call.accepted - call.completed; + const bool memory = call.kind == FrameCallKind::Memory; + const auto began = Clock::now(); + const auto deadline = began + (memory ? options.memoryPaceTimeout : options.paceTimeout); + const auto waited = [&] { paceWaitedNs += std::chrono::duration_cast(Clock::now() - began).count(); }; + while (true) { + const auto [accepted, completed] = progress(); + if (accepted - completed <= inFlight) return waited(); + if (Clock::now() >= deadline) { + waited(); + if (memory) return; + stalled.store(true); + stalledAt.store(completed); + std::fprintf(stderr, "[frame-replay] pacing gave up at call %llu (%s): serials %llu/%llu, the capture had %llu in flight\n", static_cast(call.ordinal), + std::string(AgcDriver::FrameCallName(call.kind)).c_str(), static_cast(completed), static_cast(accepted), static_cast(inFlight)); + ++paceTimeouts; + if (options.strict) throw std::runtime_error("frame replay: call " + std::to_string(call.ordinal) + " waited longer than the pacing timeout"); + return; + } + std::this_thread::sleep_for(std::chrono::microseconds(50)); + } + } + + void execute(const FrameCall& call) { + pace(call); + switch (call.kind) { + case FrameCallKind::RegisterShader: + registration([&] { AgcDriverRegisterShader_nid_postfix(shader(call.address)); }); + return; + case FrameCallKind::ResolveShaderAbi: + registration([&] { AgcDriverResolveShaderAbi_nid_postfix(shader(call.address), call.context, call.primitive); }); + return; + case FrameCallKind::ResolveGraphicsAbi: + registration([&] { AgcDriverResolveGraphicsAbi_nid_postfix(shader(call.values.at(0)), shader(call.values.at(1)), static_cast(call.values.at(2))); }); + return; + case FrameCallKind::ResolveGraphicsStagesAbi: { + std::vector stages; + for (const auto value : call.values) stages.push_back(shader(value)); + registration([&] { AgcDriverResolveGraphicsStagesAbi_nid_postfix(stages, call.context, call.primitive); }); + return; + } + case FrameCallKind::RegisterVideoOutput: { + auto output = std::make_shared(frames); + { + std::lock_guard lock(outputsMutex); + outputs.push_back(output); + } + AgcDriverRegisterVideoOutput_nid_postfix(static_cast(call.values.at(0)), output); + return; + } + case FrameCallKind::SetTessellationFactorRing: + sceAgcDriverSetTFRing(reinterpret_cast(static_cast(call.address)), static_cast(call.size)); + return; + case FrameCallKind::Submit: { + const Packet packet{reinterpret_cast(static_cast(call.address)), static_cast(call.size), static_cast(call.flags), {}}; + if (call.queue == 0) sceAgcDriverSubmitDcb(&packet); + else sceAgcDriverSubmitAcb(call.queue, &packet); + if (++submits % 25 == 0) report(); + return; + } + case FrameCallKind::Flip: + AgcDriverSubmitFlip_nid_postfix(flipInfo(call)); + return; + case FrameCallKind::ReserveEopFlip: { + const auto token = static_cast(call.values.at(4)); + if (AgcDriverReserveEopFlipAt_nid_postfix(flipInfo(call), token) != token) throw std::runtime_error("frame replay: EOP flip token " + std::to_string(token) + " was not reserved"); + return; + } + case FrameCallKind::Suspend: + AgcDriverSuspendPoint_nid_postfix(); + return; + case FrameCallKind::Memory: { + const auto found = groups.find(call.values.at(0)); + if (found == groups.end()) return; + for (const auto* chunk : found->second) { + if (skipped.Overlaps(*chunk)) continue; + restore(reader, *chunk); + deltaBytes += chunk->bytes; + } + return; + } + case FrameCallKind::FrameStart: + case FrameCallKind::End: + case FrameCallKind::DisplayBuffer: + return; + } + throw std::runtime_error("frame replay: unknown call kind"); + } + + static std::uint64_t load(std::uint64_t address, std::size_t bytes) { + std::uint64_t value = 0; + std::memcpy(&value, reinterpret_cast(static_cast(address)), bytes); + return value; + } + + static bool satisfies(const AgcDriver::AwaitedWait& wait, std::uint64_t value) { + const auto masked = value & wait.mask; + const auto reference = wait.reference & wait.mask; + switch (wait.function) { + case 1: return masked < reference; + case 2: return masked <= reference; + case 3: return masked == reference; + case 4: return masked != reference; + case 5: return masked >= reference; + case 6: return masked > reference; + default: return false; + } + } + + static std::optional satisfying(const AgcDriver::AwaitedWait& wait, std::uint64_t current) { + const auto keep = current & ~wait.mask; + const auto reference = wait.reference & wait.mask; + switch (wait.function) { + case 2: + case 3: + case 5: return keep | reference; + case 1: return reference == 0 ? std::nullopt : std::optional(keep); + case 4: return keep | (~reference & wait.mask); + case 6: return reference == wait.mask ? std::nullopt : std::optional(keep | ((reference + 1) & wait.mask)); + default: return std::nullopt; + } + } + + bool writeRecordedValue(const FrameCall& call, const AgcDriver::AwaitedWait& wait) { + if (call.kind != FrameCallKind::Memory) return false; + const auto found = groups.find(call.values.at(0)); + if (found == groups.end()) return false; + const auto address = wait.address; + for (const auto* chunk : found->second) { + if (chunk->address > address || address + 4 > chunk->address + chunk->bytes || skipped.Overlaps(*chunk)) continue; + const auto bytes = reader.Read(*chunk); + const auto length = static_cast(std::min(wait.bytes == 8 ? 8 : 4, chunk->address + chunk->bytes - address)); + const auto* const recorded = bytes.data() + (address - chunk->address); + auto* const target = reinterpret_cast(static_cast(address)); + if (std::memcmp(target, recorded, length) == 0) return false; + std::uint64_t value = 0; + std::memcpy(&value, recorded, length); + if (wait.function != 0 && !satisfies(wait, value)) return false; + std::memcpy(target, recorded, length); + return true; + } + return false; + } + + void releaseAwaited(std::span calls, std::size_t from) { + std::array awaited{}; + const auto count = AgcDriverAwaitedWaits_nid_postfix(awaited.data(), awaited.size()); + for (std::size_t slot = 0; slot < count; ++slot) { + const auto& wait = awaited[slot]; + if (wait.address == 0) continue; + const std::size_t bytes = wait.bytes == 8 ? 8 : 4; + if (wait.function != 0 && satisfies(wait, load(wait.address, bytes))) continue; + bool released = false; + for (auto index = from; index < calls.size() && !released; ++index) released = writeRecordedValue(calls[index], wait); + for (auto index = std::min(from, calls.size()); index > 0 && !released; --index) { + released = writeRecordedValue(calls[index - 1], wait); + if (released) ++lateReleases; + } + if (!released && options.synthesize) { + if (const auto value = satisfying(wait, load(wait.address, bytes))) { + std::memcpy(reinterpret_cast(static_cast(wait.address)), &*value, bytes); + ++syntheticReleases; + released = true; + } + } + if (released) ++earlyReleases; + } + } + + void runWindow(std::span calls) { + std::map> byThread; + for (std::size_t index = 0; index < calls.size(); ++index) byThread[calls[index].thread].push_back(index); + threads = byThread.size(); + std::mutex mutex; + std::condition_variable turn; + std::size_t started = 0; + std::exception_ptr failure; + std::atomic finished{false}; + std::thread breaker([&] { + if (!options.release) return; + auto lastCompleted = progress().second; + auto lastProgress = Clock::now(); + while (!finished.load()) { + std::this_thread::sleep_for(std::chrono::milliseconds(1)); + const auto completed = progress().second; + if (completed != lastCompleted) { + lastCompleted = completed; + lastProgress = Clock::now(); + continue; + } + if (Clock::now() - lastProgress < options.releaseAfter) continue; + releaseAwaited(calls, sequenced.load()); + lastProgress = Clock::now(); + } + }); + std::vector workers; + for (const auto& entry : byThread) { + workers.emplace_back([&, &indices = entry.second] { + for (const auto index : indices) { + { + std::unique_lock lock(mutex); + turn.wait(lock, [&] { return started == index || failure != nullptr; }); + if (failure != nullptr) return; + ++started; + sequenced.store(started); + } + turn.notify_all(); + try { + execute(calls[index]); + } catch (...) { + std::lock_guard lock(mutex); + if (failure == nullptr) failure = std::current_exception(); + turn.notify_all(); + return; + } + } + }); + } + for (auto& worker : workers) worker.join(); + if (failure == nullptr) drain(); + finished.store(true); + breaker.join(); + if (failure != nullptr) std::rethrow_exception(failure); + } + + void drain() { + auto lastCompleted = progress().second; + auto lastProgress = Clock::now(); + while (true) { + const auto [accepted, completed] = progress(); + unfinished = accepted - completed; + if (unfinished == 0) return; + if (completed != lastCompleted) { + lastCompleted = completed; + lastProgress = Clock::now(); + } else if (Clock::now() - lastProgress >= options.drainTimeout) { + std::fprintf(stderr, "[frame-replay] %llu submissions did not complete after the last captured call (serials %llu/%llu)\n", static_cast(unfinished), + static_cast(completed), static_cast(accepted)); + return; + } + std::this_thread::sleep_for(std::chrono::milliseconds(5)); + } + } + + template + void registration(TFunction&& function) { + try { + function(); + } catch (const std::exception& error) { + if (recording && options.strict) throw; + ++(recording ? failedRegistrations : staleRegistrations); + std::fprintf(stderr, "[frame-replay] %s registration failed: %s\n", recording ? "recorded" : "prologue", error.what()); + } + } + + static const Shader* shader(std::uint64_t address) { + return reinterpret_cast(static_cast(address)); + } + + static AgcDriver::FlipInfo flipInfo(const FrameCall& call) { + return {static_cast(call.values.at(0)), static_cast(call.values.at(1)), static_cast(call.values.at(2)), static_cast(call.values.at(3))}; + } +}; + +int usage() { + std::fprintf(stderr, "usage: agc_frame_replay [--no-pace] [--no-release] [--release-after-ms ] [--strict]\n" + " [--dump
::]...\n" + " replays the driver calls and guest memory that APS5_FRAME_CAPTURE= recorded, through this\n" + " build's AGC driver with no title running, and prints one JSON line with the frame times\n" + " --no-pace issues calls without waiting for the in-flight depth the title had\n" + " --no-release never copies recorded CPU stores early to release a GPU wait\n" + " --release-after-ms milliseconds without a completion before awaited dwords are released (3)\n" + " --no-synthesize releases a wait only with a value the capture recorded, never with its reference value\n" + " --strict fails on a pacing timeout or a failed registration inside the captured frames\n" + " --dump writes guest memory to a file after the replay (hexadecimal or decimal)\n" + " --frames writes each recorded and replayed display buffer as reference-.bmp and replay-.bmp\n"); + return 2; +} + +Dump parseDump(std::string_view text) { + const auto first = text.find(':'); + const auto second = first == std::string_view::npos ? std::string_view::npos : text.find(':', first + 1); + if (second == std::string_view::npos) throw std::invalid_argument("frame replay: --dump takes
::"); + const auto number = [](std::string_view part) { + const std::string value(part); + char* end = nullptr; + const auto parsed = std::strtoull(value.c_str(), &end, 0); + if (value.empty() || end != value.c_str() + value.size()) throw std::invalid_argument("frame replay: '" + value + "' is not a number"); + return static_cast(parsed); + }; + return {number(text.substr(0, first)), number(text.substr(first + 1, second - first - 1)), std::filesystem::path(std::string(text.substr(second + 1)))}; +} + +void writeDump(const Dump& dump) { + auto* const pointer = reinterpret_cast(static_cast(dump.address)); + GuestArena::GuestArenaPrepareHostRead_nid_no_patch(pointer, static_cast(dump.bytes)); + std::ofstream file(dump.path, std::ios::binary | std::ios::trunc); + file.write(reinterpret_cast(pointer), static_cast(dump.bytes)); + if (!file.good()) throw std::runtime_error("frame replay: cannot write " + dump.path.string()); +} + +struct FrameCheck { + std::size_t compared = 0; + double identical = 1.0; + int maxDifference = 0; +}; + +void writeFrame(const std::filesystem::path& path, const AgcDriver::DisplayBuffer& buffer, std::span pixels) { + std::FILE* file = std::fopen(path.string().c_str(), "wb"); + const auto failure = file != nullptr ? AgcDriver::WriteBmpAndClose_nid_no_patch(file, buffer.width, buffer.height, pixels) : AgcDriver::FrameDumpIoFailure{"open", errno}; + if (failure) std::fprintf(stderr, "[frame-replay] cannot write %s (%s failed)\n", path.string().c_str(), failure.operation); +} + +FrameCheck compareFrames(const FrameCaptureReader& reader, const Options& options) { + FrameCheck check; + if (!options.frames.empty()) std::filesystem::create_directories(options.frames); + for (const auto& call : reader.Calls()) { + if (call.kind != FrameCallKind::DisplayBuffer || call.values.size() < 9) continue; + AgcDriver::DisplayBuffer buffer{}; + buffer.address = call.address; + buffer.pixelFormat = call.values[1]; + buffer.width = static_cast(call.values[2]); + buffer.height = static_cast(call.values[3]); + buffer.tilingMode = static_cast(call.values[4]); + buffer.pitchInPixel = static_cast(call.values[5]); + buffer.dccAddress = call.values[6]; + buffer.dccClearColor = call.values[7]; + buffer.alignment = static_cast(call.values[8]); + const auto chunk = std::find_if(reader.Chunks().begin(), reader.Chunks().end(), [&](const FrameMemoryChunk& candidate) { return candidate.kind == FrameMemoryKind::Reference && candidate.group == call.values[0]; }); + if (chunk == reader.Chunks().end()) continue; + const auto reference = reader.Read(*chunk); + const auto replayed = AgcDriver::ReadDisplayBuffer(buffer); + ++check.compared; + std::size_t same = 0; + const auto pixels = std::min(reference.size(), replayed.size()) / 4; + for (std::size_t pixel = 0; pixel < pixels; ++pixel) { + bool equal = true; + for (std::size_t channel = 0; channel < 4; ++channel) { + const auto difference = std::abs(static_cast(reference[pixel * 4 + channel]) - static_cast(replayed[pixel * 4 + channel])); + check.maxDifference = std::max(check.maxDifference, difference); + equal = equal && difference == 0; + } + same += equal ? 1 : 0; + } + const auto total = std::max(reference.size(), replayed.size()) / 4; + check.identical = std::min(check.identical, total == 0 ? 1.0 : static_cast(same) / static_cast(total)); + if (options.frames.empty()) continue; + const auto index = std::to_string(call.values[0]); + writeFrame(options.frames / ("reference-" + index + ".bmp"), buffer, reference); + writeFrame(options.frames / ("replay-" + index + ".bmp"), buffer, replayed); + } + return check; +} + +int run(const Options& options) { + const auto loadStart = Clock::now(); + const FrameCaptureReader reader(options.directory); + if (reader.Truncated()) std::fprintf(stderr, "[frame-replay] the capture is truncated; replaying the complete records\n"); + auto skipped = restoreMemory(reader); + const auto loaded = Clock::now(); + Replay replay{options, reader}; + replay.skipped = std::move(skipped); + for (const auto& chunk : reader.Chunks()) { + if (chunk.kind == FrameMemoryKind::Delta) replay.groups[chunk.group].push_back(&chunk); + } + const auto& calls = reader.Calls(); + const auto frameStart = std::find_if(calls.begin(), calls.end(), [](const FrameCall& call) { return call.kind == FrameCallKind::FrameStart; }); + for (auto call = calls.begin(); call != frameStart; ++call) replay.execute(*call); + replay.recording = true; + replay.startedAt = Clock::now(); + if (frameStart != calls.end()) replay.runWindow(std::span(calls).subspan(static_cast(frameStart - calls.begin()) + 1)); + if (frameStart == calls.end()) AgcDriverWaitIdle_nid_postfix(); + replay.endedAt = Clock::now(); + if (const auto failure = replay.frames.Failure()) std::rethrow_exception(failure); + FrameCheck check; + if (replay.unfinished == 0) { + for (const auto& dump : options.dumps) writeDump(dump); + check = compareFrames(reader, options); + } else if (!options.dumps.empty()) { + std::fprintf(stderr, "[frame-replay] no dumps written: the GPU work did not finish\n"); + } + const auto ready = replay.frames.Times(); + std::vector frameMs; + for (std::size_t index = 1; index < ready.size(); ++index) frameMs.push_back(std::chrono::duration(ready[index] - ready[index - 1]).count()); + std::string frameList; + for (const auto value : frameMs) frameList += (frameList.empty() ? "" : ",") + std::to_string(static_cast(value)); + std::sort(frameMs.begin(), frameMs.end()); + const auto percentile = [&](double fraction) { return frameMs.empty() ? 0.0 : frameMs[std::min(frameMs.size() - 1, static_cast(fraction * static_cast(frameMs.size())))]; }; + const auto seconds = std::chrono::duration(replay.endedAt - replay.startedAt).count(); + std::printf("{\"frames\":%zu,\"replay_s\":%.3f,\"fps\":%.3f,\"frame_ms\":{\"p50\":%.3f,\"p90\":%.3f,\"max\":%.3f,\"each\":[%s]},\"submits\":%llu,\"delta_mib\":%.1f,\"pace_timeouts\":%llu,\"pace_wait_s\":%.3f,\"stale_registrations\":%llu,\"failed_registrations\":%llu,\"skipped_mib\":%.1f,\"threads\":%zu,\"released_waits\":%llu,\"of_them_from_earlier_writes\":%llu,\"of_them_synthesized\":%llu,\"unfinished\":%llu,\"frames_compared\":%zu,\"pixels_identical\":%.6f,\"max_channel_diff\":%d,\"load_s\":%.3f}\n", + ready.size(), seconds, seconds > 0 ? static_cast(ready.size()) / seconds : 0.0, percentile(0.5), percentile(0.9), frameMs.empty() ? 0.0 : frameMs.back(), frameList.c_str(), + static_cast(replay.submits.load()), static_cast(replay.deltaBytes.load()) / (1024.0 * 1024.0), static_cast(replay.paceTimeouts.load()), + replay.paceWaitedSeconds(), static_cast(replay.staleRegistrations.load()), static_cast(replay.failedRegistrations.load()), + static_cast(replay.skipped.bytes) / (1024.0 * 1024.0), replay.threads, static_cast(replay.earlyReleases.load()), static_cast(replay.lateReleases.load()), + static_cast(replay.syntheticReleases.load()), + static_cast(replay.unfinished), check.compared, check.identical, check.maxDifference, std::chrono::duration(loaded - loadStart).count()); + std::fflush(stdout); + return replay.unfinished == 0 ? 0 : 3; +} + +} + +int main(int argc, char** argv) { + Options options; + for (int index = 1; index < argc; ++index) { + const std::string_view argument = argv[index]; + if (argument == "--no-pace") options.pace = false; + else if (argument == "--no-release") options.release = false; + else if (argument == "--no-synthesize") options.synthesize = false; + else if (argument == "--release-after-ms" && index + 1 < argc) options.releaseAfter = std::chrono::milliseconds(std::strtoll(argv[++index], nullptr, 10)); + else if (argument == "--strict") options.strict = true; + else if (argument == "--dump" && index + 1 < argc) options.dumps.push_back(parseDump(argv[++index])); + else if (argument == "--frames" && index + 1 < argc) options.frames = argv[++index]; + else if (!argument.starts_with("-") && options.directory.empty()) options.directory = argument; + else return usage(); + } + if (options.directory.empty()) return usage(); +#ifdef _WIN32 + _putenv_s("APS5_FRAME_CAPTURE", ""); +#else + unsetenv("APS5_FRAME_CAPTURE"); +#endif + int code = 2; + try { + code = run(options); + if (code == 0) { + AgcDriverShutdown_nid_postfix(); + return 0; + } + } catch (const std::exception& error) { + std::fprintf(stderr, "agc_frame_replay: %s\n", error.what()); + } + std::fflush(stdout); + std::fflush(stderr); + std::_Exit(code); +} diff --git a/docs/dev/BUILD.md b/docs/dev/BUILD.md index 08190a503e..d670d91c05 100644 --- a/docs/dev/BUILD.md +++ b/docs/dev/BUILD.md @@ -186,6 +186,19 @@ build/core/libs/prx/libSceAgcDriver/agc_pm4_replay submits On Windows use `agc_pm4_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_driver_pm4_replay` captures submissions made with the libSceAgc command builders through the driver and checks the index, the held waits, the conditional ranges, the dwords, the decode and the outcome of each wait, then checks hand-made captures: each release route; a store of another queue to the awaited bytes that entered before or after the store of the waiting queue (unknown); the label history limit, with the stores after the label on the waiting queue or on another queue; a fill the history does not keep; a store in an earlier submission overwritten later; later stores, rejected values and a missing rewind tail (unreleased); the six captures of the reviews (a two-queue deadlock, a store of 0 behind a released wait on another queue, with and without that wait held at submit, and labels pushed out of the history by stores of another queue), none of whose waits may be released except the one held at submit; five groups of waits in eight submission orders with identical outcomes; an index without the held and conditional columns; corrupt captures; then a failed write. `agc_driver_pm4_replay_tool` runs the tool on the driver capture and checks its exit codes and report. +## Frame capture and replay + +Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip, an EOP flip reservation or a submission that holds a flip packet. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps). Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk. + +`agc_frame_replay [--no-pace] [--no-release] [--release-after-ms ] [--no-synthesize] [--strict] [--dump
::]... [--frames ]` maps the captured ranges at their addresses and registers them with their access (a range the replaying process already maps writable, such as the driver's fixed memory, is only refilled, and a non-GPU range it uses itself is skipped and counted), repeats the registrations, then replays the calls of each captured thread on a thread of its own, started in captured order. Before a call that hands work to the GPU it waits until no more submissions are in flight than when the title made it (`--no-pace` turns this off). Titles release GPU waits from threads that never call the driver, so when the driver completes nothing for 3 ms the replay reads the waits its queues are blocked on (`AgcDriverAwaitedWaits`) and writes the next recorded CPU value of the awaited dword that satisfies the compare, else the last earlier one, else a value derived from the reference (`--no-synthesize` turns this last step off). It prints one JSON line with the frame count and times, the submissions, the pacing wait, the released waits and how many were derived, the submissions that never completed and, for captures with reference images, the share of identical pixels and the largest channel difference of the replayed display buffers (`--frames` writes both images). Effects that depend on timing (temporal antialiasing, particles) make pixels differ, so expect a visual match rather than identical frames. Replay times follow the GPU clock state: lock the clocks (`nvidia-smi -lgc`, `-lmc`) when comparing two drivers. + +```sh +cmake --build build --target agc_frame_replay +build/core/libs/prx/libSceAgcDriver/agc_frame_replay capture +``` + +On Windows use `agc_frame_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_frame_capture` checks the file format (round trip, zero-block elision, truncated and corrupt files) and `agc_driver_frame_replay` captures two frames of CPU writes followed by DMA copies, replays them in `agc_frame_replay` and compares the copies. + ## Pipeline statistics Set `APS5_PIPELINE_STATS=1` to capture and print driver statistics for each newly created graphics or compute pipeline. This requires `VK_KHR_pipeline_executable_properties` and `pipelineExecutableInfo`; an unsupported device fails with an error. Statistic names and units are driver-specific. Capturing statistics can increase pipeline compilation cost. The setting is disabled by default. diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md index 27fc474b9c..830b20243a 100644 --- a/docs/dev/ENVIRONMENT.md +++ b/docs/dev/ENVIRONMENT.md @@ -147,6 +147,10 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti | `APS5_FLIP_READ_CHECK` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` | | records the in-place reads of completed batches and checks them before the present blit's fence | | `APS5_FORCE_SDR` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/HostHdr.cpp` | unset | suppresses advertised HDR availability while retaining detected host capabilities; uses the existing SDR presentation path | | `APS5_FORCE_STRUCTURIZER_FALLBACK` | presence | `core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp` | | makes the control-flow test expect the reach-flag fallback instead of no cloning | +| `APS5_FRAME_CAPTURE` | string | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | | directory in which the driver records a few frames of the title's driver calls and guest memory for `agc_frame_replay` | +| `APS5_FRAME_CAPTURE_AT_FLIP` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | 1 | frame boundary (CPU flip or EOP flip reservation) at which the frame capture starts when no trigger file is set | +| `APS5_FRAME_CAPTURE_FRAMES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | 10 | number of frame boundaries the frame capture records | +| `APS5_FRAME_CAPTURE_TRIGGER` | string | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | | file whose appearance starts the frame capture at the next frame boundary; a number in it replaces the frame count | | `APS5_FULL_BARRIERS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` | | records every barrier instead of merging redundant ones | | `APS5_GPU_CHECKPOINTS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` | | attaches device diagnostic checkpoints through VK_NV_device_diagnostic_checkpoints, or buffer markers through VK_AMD_buffer_marker on a device without it | | `APS5_GPU_COPY_MAX_KIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` | 1024 | size cap in KiB on a descriptor sub-range copied through the GPU path, larger ones staying on the CPU | diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md index 417a1f42c9..20e3ee036d 100644 --- a/docs/dev/debt/libSceAgcDriver.md +++ b/docs/dev/debt/libSceAgcDriver.md @@ -68,6 +68,8 @@ ### Functional - [Written staging window on discrete GPUs](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) - a written buffer element of a dispatch that is not swept is staged device-local up to 8 MiB on a discrete GPU (`Context::discreteGpu`) and up to 2 MiB otherwise; `APS5_WRITTEN_SHADOW_MAX_KIB` replaces either bound. The 8 MiB figure comes from one title on one NVIDIA Windows system (PPSA09911: a 2.5 and a 3.3 MiB skin-cache output written in place cost 55 ms of GPU time per frame, 1.8 ms of extra staging copies once staged); the point where the two copies of a larger element cost more than its in-place stores, and whether AMD or Linux drivers move it, has not been measured. The window is per element and per use, so a kernel that streams once through an element inside the window pays the copy-in and the copy-back on every dispatch. +- [Frame capture](../../../core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp) (libSceAgcDriver) records guest memory on Windows only (a VirtualQuery walk of the registry allocations and the Windows write tracker); elsewhere a capture throws when it starts. Ranges are captured by allocation and protection, not by mapping: section views, aliases of one direct memory block and file views are snapshotted and replayed as separate private memory, so a store through one alias is not seen through another, and CPU stores to them during the captured frames are not recorded (only write-watched private memory is). Pages of the title's image are recorded during the frames only when a shader header or an array it points to lies in them and their content changed. A capture starts only at a frame boundary where the driver goes idle within 10 s, and gives up after five boundaries that do not. +- [Frame replay](../../../core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp) (libSceAgcDriver) orders the calls of different captured threads only by their start (a call starts once every earlier call has started), so the driver sees a schedule the title could have produced, not necessarily the one it did. CPU stores a title made from threads that never call the driver are known only by the next recorded call, so the replay applies them early or late when a GPU wait needs them and derives a value from the wait's reference when no recorded store satisfies it (`of_them_synthesized`). Pacing compares the number of submissions in flight, not what they hold. Prologue registrations of shaders whose memory the title reused after registering them fail and are counted (`stale_registrations`). The title's image range must be free in the replaying process, so the tool is linked at a high image base on Windows. - [Workgroup count split](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) - a direct dispatch over `maxComputeWorkGroupCount` runs as `vkCmdDispatch` chunks, each bound to a pipeline variant whose workgroup offset specialization constants add the chunk's base to `WorkgroupId` and `GlobalInvocationId`. A variant is built when its chunk base is first recorded, not when the dispatch is prepared. A split of a shader with device-memory LDS throws: its slot base reads the chunk's `NumWorkgroups`, not the dispatch's. Chunks are ordered by a compute barrier, which the console does not have between workgroups of one dispatch. - [GPU allocation recovery](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - recovery may free too little and still throw: caller-held sampled images, pending storage results and recorder references stay alive. Budgets remain floors rather than hard device limits. Image and buffer allocation failures trim idle buffers, then sampled and clean storage cache entries. A held cache lock is reused only for a new image's allocation after lookup iterators are no longer used; hit refreshes and flushes skip that cache. Other cache, resource and device locks are tried without waiting. - [Scan-resistant sampled texture admission](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - while the sampled texture cache is over its budget but within a quarter over it, the first use of a texture it does not hold in a present is refused (used for its draw, then released, never cached) when its least recently used entry was used in the current or previous present, and a later use in the same present is refused when that entry was used in the current present. So a working set larger than the budget keeps a stable subset: a texture used more than once in a present still evicts an entry not yet used in that present, so a working set with interleaved multi-use textures rotates as on main, and the textures that arrive after the cache fills are created again at each use for as long as the least recently used entry is from the current present, including in the transition present after a scene change. Past a quarter over the budget the entries are evicted as before, so after the budget falls the cache can sit at up to 125% of the reduced budget until entries stop being used. Entries unused for two presents are evicted as before. A later use can evict an entry from the previous present and then be refused when the next least recently used entry is from the current present, so that entry is created again in the next present. The "current or previous present" window is an unmeasured threshold: it was chosen, not derived. Measured once, as one A-B-A series on one title (loading phase about 33000 textures per frame against a 5.4 GiB budget) on one RTX 4090, 3600 s each: 932 / 968 / 941 frames, evictions after frame 620 2.72M -> 1.17M, texture creations unchanged (about 5.8M). Nothing is measured on other titles or GPUs, and a title whose per-present working set only slightly exceeds the budget now re-creates the excess textures at every use. From dbe034fdf8b221887d32fdbbd8ebc153c9d2bf2d Mon Sep 17 00:00:00 2001 From: Sam Date: Wed, 21 Oct 2026 00:18:23 +0100 Subject: [PATCH 092/113] fix(agc): end a captured frame once per EOP flip An EOP flip reservation also ended a frame, and so did the submission whose EOP release carries the reserved token, so a title flipping with EOP releases counted each displayed frame twice: a capture of N frames stopped after about N/2 and could start between the reservation and the submission that flips. The reservation is now only recorded; a frame ends at a CPU flip or at a submission that flips. agc_driver_frame_capture_eop reserves and submits six EOP flips with APS5_FRAME_CAPTURE_FRAMES=3 and checks that the capture starts after the first flipping submission and holds three frames of one reservation and one submission each. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 14 ++ .../Execution/src/Driver/EntryPoints.cpp | 5 +- .../libSceAgcDriver/tests/FrameCaptureEop.cpp | 122 ++++++++++++++++++ docs/dev/BUILD.md | 4 +- docs/dev/ENVIRONMENT.md | 2 +- 5 files changed, 140 insertions(+), 7 deletions(-) create mode 100644 core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index 46e62427c0..009a759584 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -3284,6 +3284,20 @@ if(BUILD_TESTING) "PATH=path_list_prepend:$") endif() + add_test_executable(agc_driver_frame_capture_eop_tests tests/FrameCaptureEop.cpp Execution/src/FrameCapture.cpp) + target_include_directories(agc_driver_frame_capture_eop_tests PRIVATE ${LIBS_INCLUDE_DIR}) + target_link_libraries(agc_driver_frame_capture_eop_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static) + set_target_properties(agc_driver_frame_capture_eop_tests PROPERTIES CXX_EXTENSIONS OFF) + configure_windows_unwind(agc_driver_frame_capture_eop_tests) + add_test(NAME agc_driver_frame_capture_eop COMMAND agc_driver_frame_capture_eop_tests) + set_tests_properties(agc_driver_frame_capture_eop PROPERTIES + ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-capture-eop;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=3" + TIMEOUT 120) + if(WIN32) + set_tests_properties(agc_driver_frame_capture_eop PROPERTIES ENVIRONMENT_MODIFICATION + "PATH=path_list_prepend:$") + endif() + add_test_executable(agc_driver_frame_replay_tests tests/FrameReplay.cpp Execution/src/FrameCapture.cpp) target_include_directories(agc_driver_frame_replay_tests PRIVATE ${LIBS_INCLUDE_DIR}) target_link_libraries(agc_driver_frame_replay_tests PRIVATE libSceAgc libSceAgcDriver libkernel libc libzstd_static) diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp index f223dcd0ff..6e0a3e199f 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp @@ -122,10 +122,7 @@ extern "C" void AgcDriverSuspendPoint_nid_postfix() try { extern "C" std::uint32_t AgcDriverReserveEopFlip_nid_postfix(const AgcDriver::FlipInfo& info) { const auto token = AgcDriver::DriverDetail::Driver::Get().ReserveEopFlip(info); - if (auto* const recorder = AgcDriver::FrameRecorder::Active(); recorder != nullptr && token != 0) { - recorder->ReserveEopFlip(info, token); - recorder->FrameBoundary(); - } + if (auto* const recorder = AgcDriver::FrameRecorder::Active(); recorder != nullptr && token != 0) recorder->ReserveEopFlip(info, token); return token; } diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp new file mode 100644 index 0000000000..89033ce6a8 --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp @@ -0,0 +1,122 @@ +#include "prx/libSceAgcDriver/Execution/include/Driver.hpp" +#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp" +#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp" +#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp" +#include "prx/libc/include/GuestAllocations.hpp" +#include "prx/libc/include/GuestArena.hpp" +#include "SceTypes.hpp" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef _WIN32 +#include +#endif + +namespace { + +using AgcDriver::FrameCallKind; +using AgcDriver::FrameCaptureReader; + +constexpr std::uint32_t Handle = 7; +constexpr std::size_t BlockBytes = 1u << 20; +constexpr std::size_t Frames = 6; +constexpr std::size_t CapturedFrames = 3; + +void check(bool condition, const std::string& reason) { + if (!condition) throw std::runtime_error(reason); +} + +class Request final : public AgcDriver::IFlipRequest { +public: + explicit Request(std::atomic& ready) : ready(ready) {} + void GpuReady(const std::shared_ptr&) override { ++ready; } + void Fail(std::exception_ptr error) noexcept override { + if (!error) std::terminate(); + } + +private: + std::atomic& ready; +}; + +class Output final : public AgcDriver::IVideoOutput { +public: + std::shared_ptr Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared(ready); } + void Fail(std::exception_ptr error) noexcept override { + if (!error) std::terminate(); + } + std::atomic ready = 0; +}; + +std::byte* allocate() { + auto* const block = static_cast(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536)); + check(block != nullptr, "cannot allocate guest memory"); +#ifdef _WIN32 + GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, PAGE_READWRITE, BlockBytes); +#else + GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 3, BlockBytes); +#endif + GuestAllocations::Mutation mutation; + mutation.Add(block, BlockBytes, true, true, true); + return block; +} + +void submitEopFrame(std::byte* block, std::size_t frame) { + const auto token = AgcDriverReserveEopFlip_nid_postfix(AgcDriver::FlipInfo{Handle, 0, 1, static_cast(frame)}); + check(token != 0, "the EOP flip of frame " + std::to_string(frame) + " was not reserved"); + auto* const words = reinterpret_cast(block + frame * 256); + const auto label = reinterpret_cast(block + BlockBytes / 2 + frame * 8); + const std::array release{0xc0064900u, 0x06200504u, 0x42010000u, static_cast(label), static_cast(label >> 32u), 1u, 0u, token}; + std::memcpy(words, release.data(), sizeof(release)); + Packet packet{words, static_cast(release.size()), 0, {}}; + check(sceAgcDriverSubmitDcb(&packet) == 0, "the EOP submission of frame " + std::to_string(frame) + " failed"); +} + +void testEopFramesCountOnce() { + const char* directory = std::getenv("APS5_FRAME_CAPTURE"); + check(directory != nullptr && *directory != '\0', "APS5_FRAME_CAPTURE is not set"); + auto* const block = allocate(); + auto output = std::make_shared(); + AgcDriverRegisterVideoOutput_nid_postfix(Handle, output); + for (std::size_t frame = 0; frame < Frames; ++frame) submitEopFrame(block, frame); + AgcDriverWaitIdle_nid_postfix(); + check(output->ready.load() == static_cast(Frames), "the driver presented " + std::to_string(output->ready.load()) + " of the EOP flips"); + + const FrameCaptureReader reader{std::filesystem::path(directory)}; + check(!reader.Truncated(), "the capture is truncated"); + check(reader.Header().find("\"frames\":" + std::to_string(CapturedFrames)) != std::string::npos, "the capture header does not record " + std::to_string(CapturedFrames) + " frames: " + reader.Header()); + const auto& calls = reader.Calls(); + const auto start = std::find_if(calls.begin(), calls.end(), [](const auto& call) { return call.kind == FrameCallKind::FrameStart; }); + check(start != calls.end(), "the capture has no frame start"); + std::size_t submits = 0, reservations = 0; + FrameCallKind first = FrameCallKind::End; + for (auto call = start + 1; call != calls.end(); ++call) { + if (call->kind == FrameCallKind::Submit || call->kind == FrameCallKind::ReserveEopFlip) { + if (first == FrameCallKind::End) first = call->kind; + submits += call->kind == FrameCallKind::Submit; + reservations += call->kind == FrameCallKind::ReserveEopFlip; + } + } + check(first == FrameCallKind::ReserveEopFlip, "the capture started between a reservation and the submission that flips it"); + check(submits == CapturedFrames && reservations == CapturedFrames, + "the captured frames hold " + std::to_string(submits) + " submissions and " + std::to_string(reservations) + " reservations, expected " + std::to_string(CapturedFrames) + " of each"); +} + +} + +int main() { + try { + testEopFramesCountOnce(); + } catch (const std::exception& error) { + std::fprintf(stderr, "FAILED: %s\n", error.what()); + return 1; + } + std::puts("frame capture EOP tests passed"); + return 0; +} diff --git a/docs/dev/BUILD.md b/docs/dev/BUILD.md index d670d91c05..b5daedddf7 100644 --- a/docs/dev/BUILD.md +++ b/docs/dev/BUILD.md @@ -188,7 +188,7 @@ On Windows use `agc_pm4_replay.exe` and prepend `build/core/libs/libs/unpatched` ## Frame capture and replay -Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip, an EOP flip reservation or a submission that holds a flip packet. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps). Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk. +Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip or at a submission that flips (a flip packet, or the EOP release of a reserved flip token); the reservation itself only records its token. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps). Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk. `agc_frame_replay [--no-pace] [--no-release] [--release-after-ms ] [--no-synthesize] [--strict] [--dump
::]... [--frames ]` maps the captured ranges at their addresses and registers them with their access (a range the replaying process already maps writable, such as the driver's fixed memory, is only refilled, and a non-GPU range it uses itself is skipped and counted), repeats the registrations, then replays the calls of each captured thread on a thread of its own, started in captured order. Before a call that hands work to the GPU it waits until no more submissions are in flight than when the title made it (`--no-pace` turns this off). Titles release GPU waits from threads that never call the driver, so when the driver completes nothing for 3 ms the replay reads the waits its queues are blocked on (`AgcDriverAwaitedWaits`) and writes the next recorded CPU value of the awaited dword that satisfies the compare, else the last earlier one, else a value derived from the reference (`--no-synthesize` turns this last step off). It prints one JSON line with the frame count and times, the submissions, the pacing wait, the released waits and how many were derived, the submissions that never completed and, for captures with reference images, the share of identical pixels and the largest channel difference of the replayed display buffers (`--frames` writes both images). Effects that depend on timing (temporal antialiasing, particles) make pixels differ, so expect a visual match rather than identical frames. Replay times follow the GPU clock state: lock the clocks (`nvidia-smi -lgc`, `-lmc`) when comparing two drivers. @@ -197,7 +197,7 @@ cmake --build build --target agc_frame_replay build/core/libs/prx/libSceAgcDriver/agc_frame_replay capture ``` -On Windows use `agc_frame_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_frame_capture` checks the file format (round trip, zero-block elision, truncated and corrupt files) and `agc_driver_frame_replay` captures two frames of CPU writes followed by DMA copies, replays them in `agc_frame_replay` and compares the copies. +On Windows use `agc_frame_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_frame_capture` checks the file format (round trip, zero-block elision, truncated and corrupt files) `agc_driver_frame_capture_eop` reserves and submits six EOP flips with `APS5_FRAME_CAPTURE_FRAMES=3` and checks that the capture starts after the first flipping submission and holds three frames of one reservation and one submission each, and `agc_driver_frame_replay` captures two frames of CPU writes followed by DMA copies, replays them in `agc_frame_replay` and compares the copies. ## Pipeline statistics diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md index 830b20243a..58ebb78bc3 100644 --- a/docs/dev/ENVIRONMENT.md +++ b/docs/dev/ENVIRONMENT.md @@ -148,7 +148,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti | `APS5_FORCE_SDR` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/HostHdr.cpp` | unset | suppresses advertised HDR availability while retaining detected host capabilities; uses the existing SDR presentation path | | `APS5_FORCE_STRUCTURIZER_FALLBACK` | presence | `core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp` | | makes the control-flow test expect the reach-flag fallback instead of no cloning | | `APS5_FRAME_CAPTURE` | string | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | | directory in which the driver records a few frames of the title's driver calls and guest memory for `agc_frame_replay` | -| `APS5_FRAME_CAPTURE_AT_FLIP` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | 1 | frame boundary (CPU flip or EOP flip reservation) at which the frame capture starts when no trigger file is set | +| `APS5_FRAME_CAPTURE_AT_FLIP` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | 1 | frame boundary (CPU flip or submission that flips) at which the frame capture starts when no trigger file is set | | `APS5_FRAME_CAPTURE_FRAMES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | 10 | number of frame boundaries the frame capture records | | `APS5_FRAME_CAPTURE_TRIGGER` | string | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | | file whose appearance starts the frame capture at the next frame boundary; a number in it replaces the frame count | | `APS5_FULL_BARRIERS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` | | records every barrier instead of merging redundant ones | From 268525d6126bb6b95671bd29a4fcc54218be2fe2 Mon Sep 17 00:00:00 2001 From: Sam Date: Wed, 21 Oct 2026 00:52:32 +0100 Subject: [PATCH 093/113] fix(agc): keep replayed memory, tokens and outputs faithful to the capture - Order memory deltas and video output registration before the next recorded call, and serialize the deadlock breaker with delta application - Capture the blocks holding shader code with each shader delta - Reserve explicit and automatic EOP flip tokens under one lock - Record video output unregistration so replay can close and reopen a handle - Clear already mapped ranges before restoring the snapshot so elided zero blocks replay as zero Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 23 ++ .../Execution/include/Driver/Driver.hpp | 1 + .../Execution/include/FrameCapture.hpp | 1 + .../Execution/include/FrameRecorder.hpp | 1 + .../Execution/src/Driver/EntryPoints.cpp | 1 + .../Execution/src/Driver/Presentation.cpp | 24 +- .../Execution/src/FrameCapture.cpp | 3 +- .../Execution/src/FrameRecorder.cpp | 24 +- .../libSceAgcDriver/tests/FrameCapture.cpp | 7 +- .../prx/libSceAgcDriver/tests/FrameReplay.cpp | 12 +- .../tests/FrameReplayState.cpp | 245 ++++++++++++++++++ .../prx/libSceAgcDriver/tools/FrameReplay.cpp | 40 ++- docs/dev/BUILD.md | 2 +- 13 files changed, 345 insertions(+), 39 deletions(-) create mode 100644 core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index 009a759584..d7192a3e4e 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -3298,6 +3298,29 @@ if(BUILD_TESTING) "PATH=path_list_prepend:$") endif() + add_test_executable(agc_driver_frame_replay_state_tests tests/FrameReplayState.cpp Execution/src/FrameCapture.cpp) + target_include_directories(agc_driver_frame_replay_state_tests PRIVATE ${LIBS_INCLUDE_DIR}) + target_link_libraries(agc_driver_frame_replay_state_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static) + set_target_properties(agc_driver_frame_replay_state_tests PROPERTIES CXX_EXTENSIONS OFF) + configure_windows_unwind(agc_driver_frame_replay_state_tests) + set(agcFrameReplayModes order tokens blocking) + if(WIN32) + list(APPEND agcFrameReplayModes zero shader shader_host) + endif() + foreach(mode IN LISTS agcFrameReplayModes) + set(capture "${CMAKE_CURRENT_BINARY_DIR}/frame-replay-${mode}") + add_test(NAME agc_driver_frame_replay_${mode} COMMAND agc_driver_frame_replay_state_tests ${mode} "${capture}") + set_tests_properties(agc_driver_frame_replay_${mode} PROPERTIES TIMEOUT 30) + if(mode MATCHES "^shader") + set_tests_properties(agc_driver_frame_replay_${mode} PROPERTIES ENVIRONMENT + "APS5_FRAME_CAPTURE=${capture};APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=1") + endif() + if(WIN32) + set_tests_properties(agc_driver_frame_replay_${mode} PROPERTIES ENVIRONMENT_MODIFICATION + "PATH=path_list_prepend:$") + endif() + endforeach() + add_test_executable(agc_driver_frame_replay_tests tests/FrameReplay.cpp Execution/src/FrameCapture.cpp) target_include_directories(agc_driver_frame_replay_tests PRIVATE ${LIBS_INCLUDE_DIR}) target_link_libraries(agc_driver_frame_replay_tests PRIVATE libSceAgc libSceAgcDriver libkernel libc libzstd_static) diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp index e1cfcba5e1..28bcef85b3 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp @@ -116,6 +116,7 @@ private: Driver(); void rethrowFailure() const; void checkStopping() const; + std::uint32_t reserveEopFlip(const FlipInfo& info, std::uint32_t token); static bool& onWorkerThread(); static void copyCommands(Submission& submission, const std::uint32_t* guest, std::size_t words); static bool copySegment(Submission& submission, const std::uint32_t* guest, std::size_t words, std::size_t& budget); diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp index 51940432e8..b3721a17d5 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp @@ -29,6 +29,7 @@ enum class FrameCallKind : std::uint32_t { FrameStart, End, DisplayBuffer, + UnregisterVideoOutput, }; struct FrameCall { diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp index 7082bcf586..dc76db4614 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp @@ -34,6 +34,7 @@ public: void ResolveGraphicsStagesAbi(std::span stages, std::span context, std::span primitive); void ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType); void RegisterVideoOutput(std::uint32_t handle); + void UnregisterVideoOutput(std::uint32_t handle); void Submit(const Packet& packet, std::uint32_t queue); void Flip(const FlipInfo& info); void ReserveEopFlip(const FlipInfo& info, std::uint32_t token); diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp index 6e0a3e199f..af6202cb08 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp @@ -51,6 +51,7 @@ void RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr& output) { + if (auto* const recorder = FrameRecorder::Active()) recorder->UnregisterVideoOutput(handle); DriverDetail::Driver::Get().UnregisterVideoOutput(handle, output); } diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp index dc8d16c80a..a2fa486528 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp @@ -12,28 +12,28 @@ namespace AgcDriver::DriverDetail { std::uint32_t Driver::ReserveEopFlip(const FlipInfo& info) { std::lock_guard lock(mutex); + require(nextEopToken <= EopFlipTokenLimit, "EOP flip token space exhausted"); + return reserveEopFlip(info, nextEopToken); +} + +std::uint32_t Driver::ReserveEopFlipAt(const FlipInfo& info, std::uint32_t token) { + std::lock_guard lock(mutex); + return reserveEopFlip(info, token); +} + +std::uint32_t Driver::reserveEopFlip(const FlipInfo& info, std::uint32_t token) { rethrowFailure(); checkStopping(); - require(nextEopToken <= EopFlipTokenLimit, "EOP flip token space exhausted"); + require(token >= EopFlipTokenBase && token <= EopFlipTokenLimit && !eopFlips.contains(token), "EOP flip token is not free"); const auto output = outputs.find(info.handle); require(output != outputs.end(), "EOP flip references an unregistered video output"); auto request = output->second->TryReserve(info); if (!request) return 0; - const auto token = nextEopToken; eopFlips.emplace(token, EopFlip{info.handle, std::move(request)}); - ++nextEopToken; + nextEopToken = std::max(nextEopToken, token + 1); return token; } -std::uint32_t Driver::ReserveEopFlipAt(const FlipInfo& info, std::uint32_t token) { - { - std::lock_guard lock(mutex); - require(token >= EopFlipTokenBase && token <= EopFlipTokenLimit && !eopFlips.contains(token), "EOP flip token is not free"); - nextEopToken = token; - } - return ReserveEopFlip(info); -} - std::vector Driver::PendingEopFlipTokens() { std::lock_guard lock(mutex); std::vector tokens; diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp index ff6c4ebac8..7505860321 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp @@ -120,7 +120,7 @@ FrameCall decodeCall(FrameCallKind kind, std::span payload) { } bool knownCall(std::uint32_t kind) { - return kind >= static_cast(FrameCallKind::RegisterShader) && kind <= static_cast(FrameCallKind::DisplayBuffer); + return kind >= static_cast(FrameCallKind::RegisterShader) && kind <= static_cast(FrameCallKind::UnregisterVideoOutput); } std::vector readFile(const std::filesystem::path& path) { @@ -164,6 +164,7 @@ std::string_view FrameCallName(FrameCallKind kind) { case FrameCallKind::ResolveGraphicsAbi: return "resolve-graphics-abi"; case FrameCallKind::ResolveGraphicsStagesAbi: return "resolve-graphics-stages-abi"; case FrameCallKind::RegisterVideoOutput: return "register-video-output"; + case FrameCallKind::UnregisterVideoOutput: return "unregister-video-output"; case FrameCallKind::SetTessellationFactorRing: return "set-tf-ring"; case FrameCallKind::Submit: return "submit"; case FrameCallKind::Flip: return "flip"; diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp index f1bd18dc32..8c46526383 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp @@ -158,6 +158,12 @@ void FrameRecorder::RegisterVideoOutput(std::uint32_t handle) { record(std::move(call), true); } +void FrameRecorder::UnregisterVideoOutput(std::uint32_t handle) { + auto call = make(FrameCallKind::UnregisterVideoOutput); + call.values = {handle}; + record(std::move(call), true); +} + void FrameRecorder::Submit(const Packet& packet, std::uint32_t queue) { auto call = make(FrameCallKind::Submit); call.queue = queue; @@ -288,20 +294,20 @@ void FrameRecorder::emitShaderDelta(std::span shaders) { std::uintptr_t arenaBase = 0; std::size_t arenaBytes = 0; GuestArena::GuestArenaRange_nid_postfix(&arenaBase, &arenaBytes); - const auto note = [&](const void* address) { + const auto note = [&](const void* address, std::uint64_t bytes = 0) { if (address == nullptr) return; const auto at = pointer(address); - if (at >= arenaBase && at - arenaBase < arenaBytes) { - blocks.insert(at & ~std::uint64_t{FrameCaptureWriter::BlockBytes - 1}); - return; - } - const auto page = at & ~std::uint64_t{HostPageBytes - 1}; - hostPages.insert(page); - hostPages.insert(page + HostPageBytes); + const bool arena = at >= arenaBase && at - arenaBase < arenaBytes; + const auto blockBytes = arena ? FrameCaptureWriter::BlockBytes : HostPageBytes; + const auto begin = at & ~std::uint64_t{blockBytes - 1}; + const auto count = bytes != 0 ? (at - begin + bytes + blockBytes - 1) / blockBytes : 2; + auto& pages = arena ? blocks : hostPages; + for (std::uint64_t index = 0; index < count; ++index) pages.insert(begin + index * blockBytes); }; for (const auto* shader : shaders) { if (shader == nullptr || !GuestMemory::Accessible(shader, sizeof(Shader))) continue; note(shader); + note(const_cast(shader->code), shader->shader_size); note(shader->user_data); note(shader->cx_registers); note(shader->sh_registers); @@ -317,7 +323,7 @@ void FrameRecorder::emitShaderDelta(std::span shaders) { std::vector spans; for (const auto block : blocks) { const auto found = shaderMarks.find(block); - spans.push_back({block, 2 * FrameCaptureWriter::BlockBytes, found != shaderMarks.end() ? std::max(found->second, generation) : generation}); + spans.push_back({block, FrameCaptureWriter::BlockBytes, found != shaderMarks.end() ? std::max(found->second, generation) : generation}); } const std::vector pages(hostPages.begin(), hostPages.end()); writeDelta(spans, pages); diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp index c14a54bba8..63bfa42046 100644 --- a/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp @@ -87,9 +87,14 @@ std::vector sampleCalls() { flip.cpuFlip = true; flip.values = {1, 2, 0, static_cast(-5)}; calls.push_back(flip); + FrameCall unregister; + unregister.kind = FrameCallKind::UnregisterVideoOutput; + unregister.ordinal = 5; + unregister.values = {1}; + calls.push_back(unregister); FrameCall end; end.kind = FrameCallKind::End; - end.ordinal = 5; + end.ordinal = 6; calls.push_back(end); return calls; } diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp index a6df961ace..c1bb3ecb13 100644 --- a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp @@ -142,11 +142,18 @@ void testCaptureAndReplay(const std::filesystem::path& tool) { const auto second = pattern(101); auto output = std::make_shared(); AgcDriverRegisterVideoOutput_nid_postfix(Handle, output); + AgcDriverUnregisterVideoOutput_nid_postfix(Handle, output); + output = std::make_shared(); + AgcDriverRegisterVideoOutput_nid_postfix(Handle, output); flip(); std::memcpy(layout.source, first.data(), first.size()); copyFrame(layout.firstCommands, layout, layout.firstTarget); flip(); + AgcDriverWaitIdle_nid_postfix(); + AgcDriverUnregisterVideoOutput_nid_postfix(Handle, output); + output = std::make_shared(); + AgcDriverRegisterVideoOutput_nid_postfix(Handle, output); std::memcpy(layout.source, second.data(), second.size()); copyFrame(layout.secondCommands, layout, layout.secondTarget); flip(); @@ -156,15 +163,18 @@ void testCaptureAndReplay(const std::filesystem::path& tool) { const FrameCaptureReader reader(capture); check(!reader.Truncated(), "the capture is truncated"); check(reader.Header().find("\"frames\":2") != std::string::npos, "the capture header does not record two frames: " + reader.Header()); - std::size_t submits = 0, flips = 0, memory = 0, starts = 0; + std::size_t submits = 0, flips = 0, memory = 0, starts = 0, registrations = 0, unregistrations = 0; for (const auto& call : reader.Calls()) { submits += call.kind == FrameCallKind::Submit; flips += call.kind == FrameCallKind::Flip; memory += call.kind == FrameCallKind::Memory; starts += call.kind == FrameCallKind::FrameStart; + registrations += call.kind == FrameCallKind::RegisterVideoOutput; + unregistrations += call.kind == FrameCallKind::UnregisterVideoOutput; } check(starts == 1 && submits == 2 && flips == 2, "the capture holds " + std::to_string(submits) + " submits and " + std::to_string(flips) + " flips after " + std::to_string(starts) + " frame starts"); check(memory >= 2, "the CPU writes before each copy were not recorded as memory deltas"); + check(registrations == 3 && unregistrations == 2, "video output close and reopen was not recorded before and during capture"); const auto snapshot = std::any_of(reader.Chunks().begin(), reader.Chunks().end(), [&](const auto& chunk) { return chunk.kind == FrameMemoryKind::Range && chunk.address <= at(layout.base) && at(layout.base) + BlockBytes <= chunk.address + chunk.bytes; }); diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp new file mode 100644 index 0000000000..fd5253bbd6 --- /dev/null +++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp @@ -0,0 +1,245 @@ +#define main frameReplayToolMain +#include "../tools/FrameReplay.cpp" +#undef main +#include "prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp" +#include + +namespace { + +using AgcDriver::FrameCaptureWriter; + +void check(bool condition, const char* reason) { + if (!condition) throw std::runtime_error(reason); +} + +std::uint64_t address(const void* pointer) { + return reinterpret_cast(pointer); +} + +std::byte* allocate(std::size_t size, bool gpu = true) { + auto* bytes = static_cast(GuestArena::GuestArenaAllocate_nid_postfix(size, 65536)); + check(bytes != nullptr, "guest allocation failed"); +#ifdef _WIN32 + GuestArena::GuestArenaCommit_nid_postfix(bytes, size, PAGE_READWRITE, size); +#else + GuestArena::GuestArenaCommit_nid_postfix(bytes, size, 3, size); +#endif + GuestAllocations::Mutation mutation; + mutation.Add(bytes, size, true, true, gpu); + return bytes; +} + +void collectGroups(Replay& replay) { + for (const auto& chunk : replay.reader.Chunks()) { + if (chunk.kind == FrameMemoryKind::Delta) replay.groups[chunk.group].push_back(&chunk); + } +} + +FrameCall memoryCall(std::uint64_t group, std::uint64_t thread) { + FrameCall call; + call.kind = FrameCallKind::Memory; + call.values = {group}; + call.thread = thread; + return call; +} + +void testMemoryOrder(const std::filesystem::path& directory) { + constexpr std::size_t Size = 64u * 1024u * 1024u; + auto* bytes = allocate(Size); + const std::vector first(Size, std::byte{0x11}); + const std::vector second(4096, std::byte{0x22}); + FrameCaptureWriter writer(directory); + writer.WriteDelta(1, 0, address(bytes), first); + writer.WriteDelta(2, 0, address(bytes + Size - second.size()), second); + writer.Finish("{}"); + const FrameCaptureReader reader(directory); + Options options; + options.release = false; + Replay replay{options, reader}; + replay.recording = true; + collectGroups(replay); + const std::array calls{memoryCall(1, 1), memoryCall(2, 2)}; + replay.runWindow(calls); + check(std::all_of(bytes, bytes + Size - second.size(), [](std::byte value) { return value == std::byte{0x11}; }), "first delta was not restored"); + check(std::equal(second.begin(), second.end(), bytes + Size - second.size()), "an earlier delta overwrote the later thread's delta"); +} + +void testReusedMemory(const std::filesystem::path& directory) { +#ifdef _WIN32 + constexpr std::size_t Size = 2 * FrameCaptureWriter::BlockBytes; + auto* bytes = allocate(Size); + auto* cpu = allocate(FrameCaptureWriter::BlockBytes, false); + std::fill_n(bytes, Size, std::byte{0x7f}); + std::fill_n(cpu, FrameCaptureWriter::BlockBytes, std::byte{0x55}); + std::vector expected(Size); + std::fill(expected.begin() + FrameCaptureWriter::BlockBytes, expected.end(), std::byte{0x22}); + std::uintptr_t base = 0; + std::size_t arenaSize = 0; + GuestArena::GuestArenaRange_nid_postfix(&base, &arenaSize); + FrameCaptureWriter writer(directory); + writer.WriteRange(address(bytes), Size, FrameRangeKind::Watched, PAGE_READWRITE, FrameRangeAccess::Readable | FrameRangeAccess::Writable | FrameRangeAccess::Gpu); + writer.WriteRange(address(cpu), FrameCaptureWriter::BlockBytes, FrameRangeKind::Unwatched, PAGE_READWRITE, FrameRangeAccess::Readable | FrameRangeAccess::Writable); + check(writer.WriteSnapshot(address(bytes), expected) == FrameCaptureWriter::BlockBytes, "zero snapshot block was not elided"); + writer.Finish("{\"arena_base\":" + std::to_string(base) + "}"); + const FrameCaptureReader reader(directory); + const auto skipped = restoreMemory(reader); + check(std::equal(expected.begin(), expected.end(), bytes), "reused GPU memory did not restore zero and nonzero snapshot blocks"); + check(skipped.bytes == FrameCaptureWriter::BlockBytes, "unexpected skipped memory"); + check(std::all_of(cpu, cpu + FrameCaptureWriter::BlockBytes, [](std::byte value) { return value == std::byte{0x55}; }), "reused CPU memory was overwritten"); +#endif +} + +void testEopTokens() { + Frames frames; + auto output = std::make_shared(frames); + AgcDriverRegisterVideoOutput_nid_postfix(7, output); + std::barrier together(2); + std::atomic wrong{0}; + const auto worker = [&](int lane) { + for (int round = 0; round < 2000; ++round) { + const auto requested = AgcDriver::EopFlipTokenBase + round * 8 + lane * 2; + together.arrive_and_wait(); + try { + if (AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, requested) != requested) ++wrong; + } catch (const std::exception&) { ++wrong; } + } + }; + std::thread first(worker, 0), second(worker, 1); + first.join(); + second.join(); + check(wrong.load() == 0, "concurrent explicit EOP reservations returned the wrong token"); + const auto high = AgcDriver::EopFlipTokenBase + 20000; + check(AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, high) == high, "explicit high token was not reserved"); + check(AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, high - 1) == high - 1, "explicit lower token was not reserved"); + check(AgcDriverReserveEopFlip_nid_postfix({7, -1, 1, 0}) == high + 1, "ordinary reservation reused an explicit token"); + bool rejected = false; + try { AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, high); } + catch (const std::runtime_error&) { rejected = true; } + check(rejected, "duplicate explicit token was not rejected"); + AgcDriverUnregisterVideoOutput_nid_postfix(7, output); +} + +class WaitingOutput final : public AgcDriver::IVideoOutput { +public: + WaitingOutput(Frames& frames, const std::uint32_t* label) : frames(frames), label(label) {} + std::shared_ptr Reserve(const AgcDriver::FlipInfo&) override { + const auto deadline = Clock::now() + std::chrono::seconds(2); + while (*static_cast(label) == 0) { + check(Clock::now() < deadline, "a blocking driver call prevented the later memory update"); + std::this_thread::yield(); + } + return std::make_shared(frames); + } + void Fail(std::exception_ptr error) noexcept override { frames.Failed(error); } + +private: + Frames& frames; + const std::uint32_t* label; +}; + +void testBlockingSubmission(const std::filesystem::path& directory) { + auto* bytes = allocate(FrameCaptureWriter::BlockBytes); + auto* label = reinterpret_cast(bytes); + const std::uint32_t ready = 1; + FrameCaptureWriter writer(directory); + writer.WriteDelta(1, 0, address(label), std::as_bytes(std::span(&ready, 1))); + writer.Finish("{}"); + const FrameCaptureReader reader(directory); + Options options; + options.pace = false; + options.release = false; + Replay replay{options, reader}; + collectGroups(replay); + auto output = std::make_shared(replay.frames, label); + AgcDriverRegisterVideoOutput_nid_postfix(7, output); + std::array words{AgcDriver::FlipPacketHeader, 7, 0xffffffffu, 1, 0, 0}; + for (const auto kind : {FrameCallKind::Submit, FrameCallKind::Flip, FrameCallKind::ReserveEopFlip}) { + *label = 0; + FrameCall submit; + submit.kind = kind; + submit.thread = 1; + submit.address = address(words.data()); + submit.size = words.size(); + submit.values = {7, static_cast(-1), 1, 0, AgcDriver::EopFlipTokenBase}; + const std::array calls{submit, memoryCall(1, 2)}; + replay.runWindow(calls); + check(*label == ready && replay.unfinished == 0, "blocking submission did not complete"); + } + check(replay.frames.Times().size() == 2, "blocking submissions lost a flip"); + AgcDriverUnregisterVideoOutput_nid_postfix(7, output); +} + +void testShaderCode(const std::filesystem::path& directory, bool host) { + auto* bytes = allocate(1u << 20); + auto* shader = reinterpret_cast(bytes); + auto* code = bytes + (1u << 19) + 256; + constexpr std::size_t CodeBytes = 3 * FrameCaptureWriter::BlockBytes; +#ifdef _WIN32 + if (host) { + auto* memory = static_cast(VirtualAlloc(nullptr, CodeBytes + 4096, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE)); + check(memory != nullptr, "host shader allocation failed"); + GuestAllocations::Mutation mutation; + mutation.Add(memory, CodeBytes + 4096, true, true, true); + code = memory + 256; + } +#endif + *shader = {}; + shader->file_header = 0x34333231u; + shader->version = 0x18u; + shader->header_size = sizeof(Shader); + shader->shader_size = CodeBytes; + shader->code = code; + auto* recorder = AgcDriver::FrameRecorder::Active(); + check(recorder != nullptr, "frame recorder is disabled"); + recorder->FrameBoundary(); + std::vector expected(CodeBytes); + for (std::size_t i = 0; i < expected.size(); ++i) expected[i] = static_cast(i * 31 + 17); + std::memcpy(code, expected.data(), expected.size()); + recorder->RegisterShader(shader); + recorder->FrameBoundary(); + const FrameCaptureReader reader(directory); + std::vector captured(CodeBytes); + const auto apply = [&](const FrameMemoryChunk& chunk) { + const auto begin = std::max(address(code), chunk.address); + const auto end = std::min(address(code) + CodeBytes, chunk.address + chunk.bytes); + if (begin >= end) return; + const auto data = reader.Read(chunk); + std::memcpy(captured.data() + begin - address(code), data.data() + begin - chunk.address, end - begin); + }; + for (const auto& chunk : reader.Chunks()) if (chunk.kind == FrameMemoryKind::Snapshot) apply(chunk); + bool registered = false; + for (const auto& call : reader.Calls()) { + if (call.kind == FrameCallKind::RegisterShader) { + registered = true; + break; + } + if (call.kind != FrameCallKind::Memory) continue; + for (const auto& chunk : reader.Chunks()) { + if (chunk.kind == FrameMemoryKind::Delta && chunk.group == call.values.at(0)) apply(chunk); + } + } + check(registered && captured == expected, "the complete separate shader code was not captured before registration"); +} + +} + +int main(int argc, char** argv) { + try { + check(argc == 3, "expected a test name and capture directory"); + const std::string mode = argv[1]; + const std::filesystem::path directory = argv[2]; + if (mode == "order") testMemoryOrder(directory); + else if (mode == "zero") testReusedMemory(directory); + else if (mode == "tokens") testEopTokens(); + else if (mode == "blocking") testBlockingSubmission(directory); + else if (mode == "shader" || mode == "shader_host") testShaderCode(directory, mode == "shader_host"); + else throw std::runtime_error("unknown test"); + AgcDriverShutdown_nid_postfix(); + std::puts("frame replay state test passed"); + return 0; + } catch (const std::exception& error) { + std::fprintf(stderr, "%s\n", error.what()); + try { AgcDriverShutdown_nid_postfix(); } catch (...) {} + return 1; + } +} diff --git a/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp index a90586046f..3d76c7ff1a 100644 --- a/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp +++ b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp @@ -210,6 +210,7 @@ Skipped restoreMemory(const FrameCaptureReader& reader) { const bool gpu = (chunk.access & FrameRangeAccess::Gpu) != 0; if (committedWritable(chunk.address, chunk.bytes)) { if (!gpu) skipped.Add(chunk); + else std::memset(reinterpret_cast(static_cast(chunk.address)), 0, static_cast(chunk.bytes)); continue; } auto* const pointer = reinterpret_cast(static_cast(chunk.address)); @@ -255,8 +256,8 @@ struct Replay { const Options& options; const FrameCaptureReader& reader; Frames frames; - std::mutex outputsMutex; - std::vector> outputs; + std::map> outputs; + std::mutex memoryMutex; std::map> groups; Skipped skipped; std::atomic paceTimeouts{0}; @@ -340,12 +341,16 @@ struct Replay { return; } case FrameCallKind::RegisterVideoOutput: { + const auto handle = static_cast(call.values.at(0)); auto output = std::make_shared(frames); - { - std::lock_guard lock(outputsMutex); - outputs.push_back(output); - } - AgcDriverRegisterVideoOutput_nid_postfix(static_cast(call.values.at(0)), output); + AgcDriverRegisterVideoOutput_nid_postfix(handle, output); + outputs.emplace(handle, std::move(output)); + return; + } + case FrameCallKind::UnregisterVideoOutput: { + const auto handle = static_cast(call.values.at(0)); + AgcDriverUnregisterVideoOutput_nid_postfix(handle, outputs.at(handle)); + outputs.erase(handle); return; } case FrameCallKind::SetTessellationFactorRing: @@ -370,6 +375,7 @@ struct Replay { AgcDriverSuspendPoint_nid_postfix(); return; case FrameCallKind::Memory: { + std::lock_guard lock(memoryMutex); const auto found = groups.find(call.values.at(0)); if (found == groups.end()) return; for (const auto* chunk : found->second) { @@ -443,6 +449,7 @@ struct Replay { } void releaseAwaited(std::span calls, std::size_t from) { + std::lock_guard lock(memoryMutex); std::array awaited{}; const auto count = AgcDriverAwaitedWaits_nid_postfix(awaited.data(), awaited.size()); for (std::size_t slot = 0; slot < count; ++slot) { @@ -497,18 +504,23 @@ struct Replay { for (const auto& entry : byThread) { workers.emplace_back([&, &indices = entry.second] { for (const auto index : indices) { - { - std::unique_lock lock(mutex); - turn.wait(lock, [&] { return started == index || failure != nullptr; }); - if (failure != nullptr) return; + std::unique_lock lock(mutex); + turn.wait(lock, [&] { return started == index || failure != nullptr; }); + if (failure != nullptr) return; + const auto advance = [&] { ++started; sequenced.store(started); - } - turn.notify_all(); + lock.unlock(); + turn.notify_all(); + }; + const auto kind = calls[index].kind; + const bool ordered = kind == FrameCallKind::Memory || kind == FrameCallKind::RegisterVideoOutput || kind == FrameCallKind::UnregisterVideoOutput; + if (!ordered) advance(); try { execute(calls[index]); + if (ordered) advance(); } catch (...) { - std::lock_guard lock(mutex); + if (!lock.owns_lock()) lock.lock(); if (failure == nullptr) failure = std::current_exception(); turn.notify_all(); return; diff --git a/docs/dev/BUILD.md b/docs/dev/BUILD.md index b5daedddf7..f693ca0fe4 100644 --- a/docs/dev/BUILD.md +++ b/docs/dev/BUILD.md @@ -197,7 +197,7 @@ cmake --build build --target agc_frame_replay build/core/libs/prx/libSceAgcDriver/agc_frame_replay capture ``` -On Windows use `agc_frame_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_frame_capture` checks the file format (round trip, zero-block elision, truncated and corrupt files) `agc_driver_frame_capture_eop` reserves and submits six EOP flips with `APS5_FRAME_CAPTURE_FRAMES=3` and checks that the capture starts after the first flipping submission and holds three frames of one reservation and one submission each, and `agc_driver_frame_replay` captures two frames of CPU writes followed by DMA copies, replays them in `agc_frame_replay` and compares the copies. +On Windows use `agc_frame_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_frame_capture` checks the file format (round trip, zero-block elision, truncated and corrupt files), and `agc_driver_frame_capture_eop` reserves and submits six EOP flips with `APS5_FRAME_CAPTURE_FRAMES=3` and checks that the capture starts after the first flipping submission and holds three frames of one reservation and one submission each, and `agc_driver_frame_replay` captures two frames of CPU writes followed by DMA copies, replays them in `agc_frame_replay` and compares the copies. ## Pipeline statistics From a70e108a03fd18f41a6d4b856bc8ea98d320f608 Mon Sep 17 00:00:00 2001 From: Sam Date: Wed, 21 Oct 2026 17:47:42 +0100 Subject: [PATCH 094/113] fix(agc): capture memory committed during the frames and count flips per thread The recorder took its ranges once, at the snapshot, so a title that committed memory during the captured frames replayed submissions from memory the capture never had. Each memory delta now adds the allocations the registry gained since the last one as new ranges with their nonzero 64 KiB blocks, and the header counts them as late_ranges. A submission ended a captured frame when the driver's flip count changed while it was being submitted, and the count was global, so a submission that overlapped another thread's flipping one ended the frame as well. The count is now kept per thread. agc_driver_frame_replay copies its second frame from a block committed during the capture, and agc_driver_frame_capture_eop checks that a flip submitted on another thread leaves this thread's count unchanged; both fail without the fix. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 2 +- .../Execution/include/Driver/Driver.hpp | 1 - .../Execution/include/FrameRecorder.hpp | 5 +- .../Execution/src/Driver/Lifecycle.cpp | 4 -- .../src/Driver/Queues/Submission.cpp | 11 +++- .../Execution/src/FrameRecorder.cpp | 56 ++++++++++++++++++- .../libSceAgcDriver/tests/FrameCaptureEop.cpp | 25 +++++++++ .../prx/libSceAgcDriver/tests/FrameReplay.cpp | 21 ++++--- docs/dev/BUILD.md | 4 +- 9 files changed, 108 insertions(+), 21 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index d7192a3e4e..098d27316c 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -3285,7 +3285,7 @@ if(BUILD_TESTING) endif() add_test_executable(agc_driver_frame_capture_eop_tests tests/FrameCaptureEop.cpp Execution/src/FrameCapture.cpp) - target_include_directories(agc_driver_frame_capture_eop_tests PRIVATE ${LIBS_INCLUDE_DIR}) + target_include_directories(agc_driver_frame_capture_eop_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR} ${ANYPS5_SPIRV_HEADERS_INCLUDE_DIR}) target_link_libraries(agc_driver_frame_capture_eop_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static) set_target_properties(agc_driver_frame_capture_eop_tests PROPERTIES CXX_EXTENSIONS OFF) configure_windows_unwind(agc_driver_frame_capture_eop_tests) diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp index 28bcef85b3..9f61ecaa0e 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp @@ -375,7 +375,6 @@ private: std::shared_ptr pendingFrameTiming; std::atomic flipsCounted{0}; - std::atomic flipSubmissions{0}; struct AwaitedSlot { std::atomic address{0}; std::atomic reference{0}; diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp index dc76db4614..bad806af09 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp +++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp @@ -65,7 +65,7 @@ private: void record(FrameCall call, bool prologueCall, std::span shaders = {}); void emitDelta(); void emitShaderDelta(std::span shaders); - void writeDelta(std::span spans, std::span hostPages); + void writeDelta(std::span spans, std::span hostPages, std::span added = {}); bool triggered(); void start(); void finish(); @@ -74,6 +74,7 @@ private: bool abandonIfDiskLow(); std::string header() const; std::vector committedRanges(); + std::vector newRanges(); std::filesystem::path directory; std::filesystem::path trigger; @@ -100,6 +101,8 @@ private: std::uint64_t recordedCalls = 0; std::uint64_t startAttempts = 0; std::uint64_t unreadableBytes = 0; + std::uint64_t allocationsGeneration = 0; + std::uint64_t lateRanges = 0; std::vector warnings; std::chrono::steady_clock::time_point origin; std::chrono::steady_clock::time_point startedAt; diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp index 95a2b1ec08..ba19bb4a60 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp @@ -276,10 +276,6 @@ std::vector Driver::AwaitedWaits() { return result; } -std::uint64_t Driver::FlipSubmissions() const { - return flipSubmissions.load(std::memory_order_relaxed); -} - std::pair Driver::SerialProgress() { std::lock_guard lock(mutex); return {accepted, completed}; diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp index a6078230e1..3c67005c43 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp @@ -43,6 +43,15 @@ bool& submitsQueue0() { return HostThreadLocal(); } +std::uint64_t& flipSubmissionsOfThread() { + struct FlipSubmissionsStorage {}; + return HostThreadLocal(); +} + +} + +std::uint64_t Driver::FlipSubmissions() const { + return flipSubmissionsOfThread(); } std::deque& Driver::releasedTails() { @@ -402,7 +411,7 @@ void Driver::Submit(const Packet* packet, std::uint32_t queue, bool cpuFlip) { submission.holdsFlip = true; flipsAhead.fetch_add(1, std::memory_order_acq_rel); } - if (!submission.flips.empty()) flipSubmissions.fetch_add(1, std::memory_order_relaxed); + if (!submission.flips.empty()) ++flipSubmissionsOfThread(); enqueue(std::move(submission)); ++accepted; } diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp index 8c46526383..0b64a184c8 100644 --- a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp +++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp @@ -283,11 +283,40 @@ void FrameRecorder::emitDelta() { if (range.kind == FrameRangeKind::Watched || range.kind == FrameRangeKind::Unwatched) spans.push_back({range.address, range.bytes, generation}); } const auto mark = GuestMemory::WriteGeneration(); - writeDelta(spans, {}); + const auto added = newRanges(); + writeDelta(spans, {}, added); generation = mark; shaderMarks.clear(); } +std::vector FrameRecorder::newRanges() { + const auto current = GuestAllocations::GuestAllocationsGeneration_nid_postfix(); + if (current == allocationsGeneration) return {}; + allocationsGeneration = current; + std::map covered; + for (const auto& range : ranges) { + auto& end = covered[range.address]; + end = std::max(end, range.address + range.bytes); + } + std::vector added; + for (const auto& range : committedRanges()) { + const auto end = range.address + range.bytes; + for (auto at = range.address; at < end;) { + const auto next = covered.upper_bound(at); + if (next != covered.begin() && std::prev(next)->second > at) { + at = std::prev(next)->second; + continue; + } + auto piece = range; + piece.address = at; + piece.bytes = (next == covered.end() ? end : std::min(end, next->first)) - at; + added.push_back(piece); + at += piece.bytes; + } + } + return added; +} + void FrameRecorder::emitShaderDelta(std::span shaders) { std::set blocks; std::set hostPages; @@ -330,13 +359,33 @@ void FrameRecorder::emitShaderDelta(std::span shaders) { for (const auto block : blocks) shaderMarks[block] = mark; } -void FrameRecorder::writeDelta(std::span spans, std::span hostPages) { +void FrameRecorder::writeDelta(std::span spans, std::span hostPages, std::span added) { if (abandonIfDiskLow()) return; const auto [accepted, completed] = DriverDetail::Driver::Get().SerialProgress(); const auto group = deltaGroups + 1; bool any = false; std::vector> written; std::vector bytes; + for (const auto& range : added) { + writer->WriteRange(range.address, range.bytes, range.kind, range.protection, range.access); + ranges.push_back(range); + ++lateRanges; + if (!range.readable) { + unreadableBytes += range.bytes; + continue; + } + for (std::uint64_t at = 0; at < range.bytes;) { + bytes.resize(static_cast(std::min(FrameCaptureWriter::BlockBytes, range.bytes - at))); + GuestMemory::ReadCommittedUnsynced(range.address + at, bytes); + const bool zero = std::all_of(bytes.begin(), bytes.end(), [](std::byte value) { return value == std::byte{0}; }); + if (!zero) { + writer->WriteDelta(group, completed, range.address + at, bytes); + deltaBytes += bytes.size(); + any = true; + } + at += bytes.size(); + } + } for (const auto page : hostPages) { if (!GuestMemory::Accessible(reinterpret_cast(static_cast(page)), HostPageBytes)) continue; bytes.resize(HostPageBytes); @@ -413,6 +462,7 @@ void FrameRecorder::start() { } startedAt = std::chrono::steady_clock::now(); startBoundary = boundaries; + allocationsGeneration = GuestAllocations::GuestAllocationsGeneration_nid_postfix(); ranges = committedRanges(); writer = std::make_unique(directory); std::vector> written; @@ -475,7 +525,7 @@ std::string FrameRecorder::header() const { text += ",\"arena_base\":" + std::to_string(arenaBase) + ",\"arena_bytes\":" + std::to_string(arenaBytes); text += ",\"start_boundary\":" + std::to_string(startBoundary) + ",\"frames\":" + std::to_string(recordedFrames); text += ",\"calls\":" + std::to_string(recordedCalls) + ",\"prologue_calls\":" + std::to_string(prologue.size()); - text += ",\"ranges\":" + std::to_string(ranges.size()) + ",\"snapshot_bytes\":" + std::to_string(snapshotBytes) + ",\"unreadable_bytes\":" + std::to_string(unreadableBytes); + text += ",\"ranges\":" + std::to_string(ranges.size()) + ",\"late_ranges\":" + std::to_string(lateRanges) + ",\"snapshot_bytes\":" + std::to_string(snapshotBytes) + ",\"unreadable_bytes\":" + std::to_string(unreadableBytes); text += ",\"memory_groups\":" + std::to_string(deltaGroups) + ",\"delta_bytes\":" + std::to_string(deltaBytes); text += ",\"capture_seconds\":" + std::to_string(std::chrono::duration(std::chrono::steady_clock::now() - startedAt).count()); text += ",\"env\":{"; diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp index 89033ce6a8..50a673cb05 100644 --- a/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp @@ -1,4 +1,5 @@ #include "prx/libSceAgcDriver/Execution/include/Driver.hpp" +#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp" #include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp" #include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp" #include "prx/libSceAgcDriver/Submit/include/Dcb.hpp" @@ -15,6 +16,7 @@ #include #include #include +#include #ifdef _WIN32 #include #endif @@ -108,11 +110,34 @@ void testEopFramesCountOnce() { "the captured frames hold " + std::to_string(submits) + " submissions and " + std::to_string(reservations) + " reservations, expected " + std::to_string(CapturedFrames) + " of each"); } +void testFlipsCountPerThread() { + auto* const block = allocate(); + const auto& driver = AgcDriver::DriverDetail::Driver::Get(); + const auto before = driver.FlipSubmissions(); + std::uint64_t otherBefore = 0, otherAfter = 0; + std::exception_ptr failure; + std::thread submitter([&] { + try { + otherBefore = driver.FlipSubmissions(); + submitEopFrame(block, 0); + otherAfter = driver.FlipSubmissions(); + } catch (...) { + failure = std::current_exception(); + } + }); + submitter.join(); + if (failure) std::rethrow_exception(failure); + AgcDriverWaitIdle_nid_postfix(); + check(otherAfter == otherBefore + 1, "the flipping submission did not count on the thread that made it"); + check(driver.FlipSubmissions() == before, "a flip submitted on another thread changed this thread's flip count, so a submission of this thread that overlaps it would end a captured frame"); +} + } int main() { try { testEopFramesCountOnce(); + testFlipsCountPerThread(); } catch (const std::exception& error) { std::fprintf(stderr, "FAILED: %s\n", error.what()); return 1; diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp index c1bb3ecb13..c939812613 100644 --- a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp @@ -154,11 +154,12 @@ void testCaptureAndReplay(const std::filesystem::path& tool) { AgcDriverUnregisterVideoOutput_nid_postfix(Handle, output); output = std::make_shared(); AgcDriverRegisterVideoOutput_nid_postfix(Handle, output); - std::memcpy(layout.source, second.data(), second.size()); - copyFrame(layout.secondCommands, layout, layout.secondTarget); + const auto late = allocate(); + std::memcpy(late.source, second.data(), second.size()); + copyFrame(late.firstCommands, late, late.firstTarget); flip(); AgcDriverWaitIdle_nid_postfix(); - check(equal(layout.firstTarget, first) && equal(layout.secondTarget, second), "the driver did not run the copies while capturing"); + check(equal(layout.firstTarget, first) && equal(late.firstTarget, second), "the driver did not run the copies while capturing"); const FrameCaptureReader reader(capture); check(!reader.Truncated(), "the capture is truncated"); @@ -175,15 +176,19 @@ void testCaptureAndReplay(const std::filesystem::path& tool) { check(starts == 1 && submits == 2 && flips == 2, "the capture holds " + std::to_string(submits) + " submits and " + std::to_string(flips) + " flips after " + std::to_string(starts) + " frame starts"); check(memory >= 2, "the CPU writes before each copy were not recorded as memory deltas"); check(registrations == 3 && unregistrations == 2, "video output close and reopen was not recorded before and during capture"); - const auto snapshot = std::any_of(reader.Chunks().begin(), reader.Chunks().end(), [&](const auto& chunk) { - return chunk.kind == FrameMemoryKind::Range && chunk.address <= at(layout.base) && at(layout.base) + BlockBytes <= chunk.address + chunk.bytes; - }); - check(snapshot, "the guest block is not in the snapshot ranges"); + const auto recorded = [&](const std::byte* base) { + return std::any_of(reader.Chunks().begin(), reader.Chunks().end(), [&](const auto& chunk) { + return chunk.kind == FrameMemoryKind::Range && chunk.address <= at(base) && at(base) + BlockBytes <= chunk.address + chunk.bytes; + }); + }; + check(recorded(layout.base), "the guest block is not in the snapshot ranges"); + check(recorded(late.base), "the block committed during the capture is not in its ranges"); + check(reader.Header().find("\"late_ranges\":1") != std::string::npos, "the capture header does not count one range committed during the capture: " + reader.Header()); const auto firstDump = capture / "first.bin"; const auto secondDump = capture / "second.bin"; const auto command = "\"\"" + tool.string() + "\" \"" + capture.string() + "\" --strict --dump " + std::to_string(at(layout.firstTarget)) + ":" + std::to_string(DataBytes) + ":\"" + firstDump.string() + - "\" --dump " + std::to_string(at(layout.secondTarget)) + ":" + std::to_string(DataBytes) + ":\"" + secondDump.string() + "\"\""; + "\" --dump " + std::to_string(at(late.firstTarget)) + ":" + std::to_string(DataBytes) + ":\"" + secondDump.string() + "\"\""; const auto code = std::system(command.c_str()); check(code == 0, "agc_frame_replay exited with " + std::to_string(code)); check(readFile(firstDump) == first, "the replay did not reproduce the first copy"); diff --git a/docs/dev/BUILD.md b/docs/dev/BUILD.md index f693ca0fe4..f0568d9761 100644 --- a/docs/dev/BUILD.md +++ b/docs/dev/BUILD.md @@ -188,7 +188,7 @@ On Windows use `agc_pm4_replay.exe` and prepend `build/core/libs/libs/unpatched` ## Frame capture and replay -Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip or at a submission that flips (a flip packet, or the EOP release of a reserved flip token); the reservation itself only records its token. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps). Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk. +Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip or at a submission that flips (a flip packet, or the EOP release of a reserved flip token); the reservation itself only records its token. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps); an allocation the registry gained after the snapshot is recorded there as a new range with its nonzero 64 KiB blocks. A submission ends a frame only when it flips itself, not when another thread's submission flipped while it was being submitted. Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk. `agc_frame_replay [--no-pace] [--no-release] [--release-after-ms ] [--no-synthesize] [--strict] [--dump
::]... [--frames ]` maps the captured ranges at their addresses and registers them with their access (a range the replaying process already maps writable, such as the driver's fixed memory, is only refilled, and a non-GPU range it uses itself is skipped and counted), repeats the registrations, then replays the calls of each captured thread on a thread of its own, started in captured order. Before a call that hands work to the GPU it waits until no more submissions are in flight than when the title made it (`--no-pace` turns this off). Titles release GPU waits from threads that never call the driver, so when the driver completes nothing for 3 ms the replay reads the waits its queues are blocked on (`AgcDriverAwaitedWaits`) and writes the next recorded CPU value of the awaited dword that satisfies the compare, else the last earlier one, else a value derived from the reference (`--no-synthesize` turns this last step off). It prints one JSON line with the frame count and times, the submissions, the pacing wait, the released waits and how many were derived, the submissions that never completed and, for captures with reference images, the share of identical pixels and the largest channel difference of the replayed display buffers (`--frames` writes both images). Effects that depend on timing (temporal antialiasing, particles) make pixels differ, so expect a visual match rather than identical frames. Replay times follow the GPU clock state: lock the clocks (`nvidia-smi -lgc`, `-lmc`) when comparing two drivers. @@ -197,7 +197,7 @@ cmake --build build --target agc_frame_replay build/core/libs/prx/libSceAgcDriver/agc_frame_replay capture ``` -On Windows use `agc_frame_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_frame_capture` checks the file format (round trip, zero-block elision, truncated and corrupt files), and `agc_driver_frame_capture_eop` reserves and submits six EOP flips with `APS5_FRAME_CAPTURE_FRAMES=3` and checks that the capture starts after the first flipping submission and holds three frames of one reservation and one submission each, and `agc_driver_frame_replay` captures two frames of CPU writes followed by DMA copies, replays them in `agc_frame_replay` and compares the copies. +On Windows use `agc_frame_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_frame_capture` checks the file format (round trip, zero-block elision, truncated and corrupt files), and `agc_driver_frame_capture_eop` reserves and submits six EOP flips with `APS5_FRAME_CAPTURE_FRAMES=3` and checks that the capture starts after the first flipping submission and holds three frames of one reservation and one submission each, then that a flipping submission on another thread leaves this thread's flip count unchanged, and `agc_driver_frame_replay` captures two frames of CPU writes followed by DMA copies, the second from a block committed during the capture, replays them in `agc_frame_replay` and compares the copies. ## Pipeline statistics From 58a8195422fb5c7a29a6fe30c7dc413bd4cb64b3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A0=20Franch?= Date: Fri, 23 Oct 2026 21:27:49 +0200 Subject: [PATCH 095/113] fix(agc): pass PAGE_READWRITE to the guest arena on every platform Co-Authored-By: Claude Sonnet 5.5 --- core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp | 6 +----- core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp | 6 +----- core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp | 6 +----- core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp | 6 +----- 4 files changed, 4 insertions(+), 20 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp index 50a673cb05..88d8cb144e 100644 --- a/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp @@ -59,11 +59,7 @@ public: std::byte* allocate() { auto* const block = static_cast(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536)); check(block != nullptr, "cannot allocate guest memory"); -#ifdef _WIN32 - GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, PAGE_READWRITE, BlockBytes); -#else - GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 3, BlockBytes); -#endif + GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 0x04, BlockBytes); GuestAllocations::Mutation mutation; mutation.Add(block, BlockBytes, true, true, true); return block; diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp index c939812613..56d6b1c40d 100644 --- a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp @@ -82,11 +82,7 @@ struct Layout { Layout allocate() { auto* const block = static_cast(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536)); check(block != nullptr, "cannot allocate guest memory"); -#ifdef _WIN32 - GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, PAGE_READWRITE, BlockBytes); -#else - GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 3, BlockBytes); -#endif + GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 0x04, BlockBytes); { GuestAllocations::Mutation mutation; mutation.Add(block, BlockBytes, true, true, true); diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp index fd5253bbd6..c54b01466a 100644 --- a/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp @@ -19,11 +19,7 @@ std::uint64_t address(const void* pointer) { std::byte* allocate(std::size_t size, bool gpu = true) { auto* bytes = static_cast(GuestArena::GuestArenaAllocate_nid_postfix(size, 65536)); check(bytes != nullptr, "guest allocation failed"); -#ifdef _WIN32 - GuestArena::GuestArenaCommit_nid_postfix(bytes, size, PAGE_READWRITE, size); -#else - GuestArena::GuestArenaCommit_nid_postfix(bytes, size, 3, size); -#endif + GuestArena::GuestArenaCommit_nid_postfix(bytes, size, 0x04, size); GuestAllocations::Mutation mutation; mutation.Add(bytes, size, true, true, gpu); return bytes; diff --git a/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp index 3d76c7ff1a..ac6a434a0e 100644 --- a/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp +++ b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp @@ -222,11 +222,7 @@ Skipped restoreMemory(const FrameCaptureReader& reader) { skipped.Add(chunk); continue; } -#ifdef _WIN32 - GuestArena::GuestArenaCommit_nid_postfix(pointer, bytes, PAGE_READWRITE, bytes); -#else - GuestArena::GuestArenaCommit_nid_postfix(pointer, bytes, 3, bytes); -#endif + GuestArena::GuestArenaCommit_nid_postfix(pointer, bytes, 0x04, bytes); mutation.Add(pointer, bytes, (chunk.access & FrameRangeAccess::Readable) != 0, (chunk.access & FrameRangeAccess::Writable) != 0, gpu); } } From b7ac6a4903c8b111ad957c6fd4f320dd43dee43c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A0=20Franch?= Date: Fri, 23 Oct 2026 21:56:09 +0200 Subject: [PATCH 096/113] test(agc): register the frame capture tests that need guest memory capture on Windows only Co-Authored-By: Claude Sonnet 5.5 --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index 098d27316c..40c7a41a7d 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -3289,11 +3289,11 @@ if(BUILD_TESTING) target_link_libraries(agc_driver_frame_capture_eop_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static) set_target_properties(agc_driver_frame_capture_eop_tests PROPERTIES CXX_EXTENSIONS OFF) configure_windows_unwind(agc_driver_frame_capture_eop_tests) - add_test(NAME agc_driver_frame_capture_eop COMMAND agc_driver_frame_capture_eop_tests) - set_tests_properties(agc_driver_frame_capture_eop PROPERTIES - ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-capture-eop;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=3" - TIMEOUT 120) if(WIN32) + add_test(NAME agc_driver_frame_capture_eop COMMAND agc_driver_frame_capture_eop_tests) + set_tests_properties(agc_driver_frame_capture_eop PROPERTIES + ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-capture-eop;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=3" + TIMEOUT 120) set_tests_properties(agc_driver_frame_capture_eop PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() @@ -3327,11 +3327,11 @@ if(BUILD_TESTING) set_target_properties(agc_driver_frame_replay_tests PROPERTIES CXX_EXTENSIONS OFF) configure_windows_unwind(agc_driver_frame_replay_tests) add_dependencies(agc_driver_frame_replay_tests agc_frame_replay) - add_test(NAME agc_driver_frame_replay COMMAND agc_driver_frame_replay_tests $) - set_tests_properties(agc_driver_frame_replay PROPERTIES - ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-replay-capture;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=2" - TIMEOUT 120) if(WIN32) + add_test(NAME agc_driver_frame_replay COMMAND agc_driver_frame_replay_tests $) + set_tests_properties(agc_driver_frame_replay PROPERTIES + ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-replay-capture;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=2" + TIMEOUT 120) set_tests_properties(agc_driver_frame_replay PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() From a27ab262d4b7e7f12417938b89d5ad2248714158 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A0=20Franch?= Date: Sat, 24 Oct 2026 01:49:25 +0200 Subject: [PATCH 097/113] test(agc): build the Windows-only frame capture tests on Windows only Co-Authored-By: Claude Sonnet 5.5 --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 22 ++++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index 40c7a41a7d..4479d0b330 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -3284,12 +3284,12 @@ if(BUILD_TESTING) "PATH=path_list_prepend:$") endif() - add_test_executable(agc_driver_frame_capture_eop_tests tests/FrameCaptureEop.cpp Execution/src/FrameCapture.cpp) - target_include_directories(agc_driver_frame_capture_eop_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR} ${ANYPS5_SPIRV_HEADERS_INCLUDE_DIR}) - target_link_libraries(agc_driver_frame_capture_eop_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static) - set_target_properties(agc_driver_frame_capture_eop_tests PROPERTIES CXX_EXTENSIONS OFF) - configure_windows_unwind(agc_driver_frame_capture_eop_tests) if(WIN32) + add_test_executable(agc_driver_frame_capture_eop_tests tests/FrameCaptureEop.cpp Execution/src/FrameCapture.cpp) + target_include_directories(agc_driver_frame_capture_eop_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR} ${ANYPS5_SPIRV_HEADERS_INCLUDE_DIR}) + target_link_libraries(agc_driver_frame_capture_eop_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static) + set_target_properties(agc_driver_frame_capture_eop_tests PROPERTIES CXX_EXTENSIONS OFF) + configure_windows_unwind(agc_driver_frame_capture_eop_tests) add_test(NAME agc_driver_frame_capture_eop COMMAND agc_driver_frame_capture_eop_tests) set_tests_properties(agc_driver_frame_capture_eop PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-capture-eop;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=3" @@ -3321,13 +3321,13 @@ if(BUILD_TESTING) endif() endforeach() - add_test_executable(agc_driver_frame_replay_tests tests/FrameReplay.cpp Execution/src/FrameCapture.cpp) - target_include_directories(agc_driver_frame_replay_tests PRIVATE ${LIBS_INCLUDE_DIR}) - target_link_libraries(agc_driver_frame_replay_tests PRIVATE libSceAgc libSceAgcDriver libkernel libc libzstd_static) - set_target_properties(agc_driver_frame_replay_tests PROPERTIES CXX_EXTENSIONS OFF) - configure_windows_unwind(agc_driver_frame_replay_tests) - add_dependencies(agc_driver_frame_replay_tests agc_frame_replay) if(WIN32) + add_test_executable(agc_driver_frame_replay_tests tests/FrameReplay.cpp Execution/src/FrameCapture.cpp) + target_include_directories(agc_driver_frame_replay_tests PRIVATE ${LIBS_INCLUDE_DIR}) + target_link_libraries(agc_driver_frame_replay_tests PRIVATE libSceAgc libSceAgcDriver libkernel libc libzstd_static) + set_target_properties(agc_driver_frame_replay_tests PROPERTIES CXX_EXTENSIONS OFF) + configure_windows_unwind(agc_driver_frame_replay_tests) + add_dependencies(agc_driver_frame_replay_tests agc_frame_replay) add_test(NAME agc_driver_frame_replay COMMAND agc_driver_frame_replay_tests $) set_tests_properties(agc_driver_frame_replay PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-replay-capture;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=2" From 82b151597a50cd768b21182936d6a9b110b98b8f Mon Sep 17 00:00:00 2001 From: Dean Galvin Date: Sat, 24 Oct 2026 13:15:57 +1300 Subject: [PATCH 098/113] docs: point game status links to the Game bring-up discussions The README, the Game bring-up discussion form and the converter page now link to the Game bring-up discussions for per-game status and test reports. --- .github/DISCUSSION_TEMPLATE/game-bring-up.yml | 2 +- README.md | 2 +- demo/web/index.html | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/DISCUSSION_TEMPLATE/game-bring-up.yml b/.github/DISCUSSION_TEMPLATE/game-bring-up.yml index afb5f3d3d3..ff08c3cca6 100644 --- a/.github/DISCUSSION_TEMPLATE/game-bring-up.yml +++ b/.github/DISCUSSION_TEMPLATE/game-bring-up.yml @@ -6,7 +6,7 @@ body: One thread per title, for every platform: search this category for the title ID first. If a thread exists, reply there, also when your OS or GPU differs from the one it reports. Name the discussion `Game name (title ID)`, for example `DOOM Shareware (PPSA99666)`, without the platform. Bug reports and implementation work belong in issues and pull requests; link them here as the blocker. - Per-game progress is also tracked on the [blocker map](https://alxcbtw.github.io/anyps5-roadmap/), built from public GitHub data. Only share material you have the right to distribute. + Only share material you have the right to distribute. - type: checkboxes id: searched attributes: diff --git a/README.md b/README.md index 3e7fc3ccf4..1a3a9ac30e 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ The [shader recompiler](core/shader/recompiler/Recompiler.cpp) successfully prod ## Compatibility -Per-game progress (stage reached, open blockers, libraries and GPU coverage) is tracked on the [blocker map](https://alxcbtw.github.io/anyps5-roadmap/), a community project built from public GitHub data ([source](https://github.com/AlxcBTW/anyps5-roadmap)). Test reports go in the [Game bring-up](https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up) discussions, one thread per title. +Per-game status and test reports live in the [Game bring-up](https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up) discussions, one thread per title. ## Input mapping diff --git a/demo/web/index.html b/demo/web/index.html index e0d468febc..5d974cd58f 100644 --- a/demo/web/index.html +++ b/demo/web/index.html @@ -6,7 +6,7 @@ AnyPS5 · Converter -
AnyPS5 / Converter
+
AnyPS5 / Converter

LOCAL CONVERSION

PS5 apps to Windows/Linux converter

@@ -23,7 +23,7 @@

Memory downloads have a 256 MiB budget, checked against expanded files and output overhead. For multiple ZIPs, the limit applies to the combined bundle; larger batches require Save ZIP to disk in desktop Chrome or Edge. Executable and modules are limited to 256 MiB per app; the icon is also limited to 16 MiB and counts toward the Windows conversion limit. Use the native relinker for larger conversion inputs.

-

Conversion does not guarantee that an app runs. Check the community compatibility list for known blockers and reports.

+

Conversion does not guarantee that an app runs. Check the Game bring-up discussions for known blockers and reports.

From d7d9747e7d9aae3375846c52f4814c3b80d2cb39 Mon Sep 17 00:00:00 2001 From: milescoviello Date: Fri, 23 Oct 2026 22:42:53 +0000 Subject: [PATCH 099/113] fix(shader): key the device's capabilities and extensions by a digest Every recompile cache key appended the target's capability list and each SPIR-V extension name one byte per 64-bit word, so on a device that enables a few dozen extensions most of every key was the same device description: built and compared on every dispatch and draw, and kept in every in-memory key and disk cache entry. The two lists now enter the key as a 128-bit digest over the capabilities and the length and bytes of each extension name, eight bytes per step. Co-Authored-By: Claude Opus 5.5 --- .../libSceAgcDriver/tests/ShaderMemory.cpp | 36 +++++++++++++++++++ core/shader/recompiler/CacheKey.hpp | 28 +++++++++++++-- 2 files changed, 62 insertions(+), 2 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp index bb480c295f..8e0efa2829 100644 --- a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp @@ -1713,6 +1713,41 @@ std::array TableSelected(const ShaderRecompiler::ImageTableSna return column.words.at(column.codes[0]).dwords; } +void verifyTargetFeatureKey() { + using namespace ShaderRecompiler; + static constexpr std::array code{0xbf810000u}; + RecompileRequest request{}; + request.shader = {ShaderStage::Compute, 0x10000u, code, 0, {}}; + request.context.waveSize = 64; + const std::vector capabilities{1u, 4448u, 5347u}; + const std::vector extensions{"SPV_KHR_8bit_storage", "SPV_KHR_physical_storage_buffer"}; + const auto build = [&](std::span capabilityList, std::span extensionList) { + auto keyed = request; + keyed.target.supportedCapabilities = capabilityList; + keyed.target.supportedExtensions = extensionList; + std::vector key; + RecompileCacheKey::Build(keyed, key); + return key; + }; + const auto base = build(capabilities, extensions); + const std::vector capabilityCopy = capabilities; + const std::vector extensionStorage{"SPV_KHR_8bit_storage", "SPV_KHR_physical_storage_buffer"}; + const std::vector extensionCopy{extensionStorage[0], extensionStorage[1]}; + require(build(capabilityCopy, extensionCopy) == base, "target feature key: equal capability and extension lists in other storage gave another key"); + auto renamed = extensionStorage; + renamed[1].back() = 'X'; + const std::vector renamedViews{renamed[0], renamed[1]}; + require(build(capabilities, renamedViews) != base, "target feature key: an extension name that differs in its last byte gave the same key"); + const std::vector moved{"SPV_KHR_8bit_storageS", "PV_KHR_physical_storage_buffer"}; + require(build(capabilities, moved) != base, "target feature key: a byte moved between two extension names gave the same key"); + const std::vector more{1u, 4448u, 5347u, 11u}; + require(build(more, extensions) != base, "target feature key: an added capability gave the same key"); + std::vector many; + for (std::uint32_t index = 0; index < 40u; ++index) many.push_back("SPV_EXT_descriptor_indexing_" + std::to_string(index)); + const std::vector manyViews(many.begin(), many.end()); + require(build(capabilities, manyViews).size() == base.size(), "target feature key: the key grows with the device's extension names"); +} + void verifyImageTableKeys() { using namespace ShaderRecompiler; namespace Abi = ImageTableAbi; @@ -8377,6 +8412,7 @@ int main(int argc, char** argv) { verifyGuardedDescriptorSources(); verifyLaneMaskGuardedDescriptorSources(); verifySrtTape(); + verifyTargetFeatureKey(); verifyImageTableKeys(); verifyImageTables(); verifyImageTableRegistration(); diff --git a/core/shader/recompiler/CacheKey.hpp b/core/shader/recompiler/CacheKey.hpp index 1c59f40753..8c5d2b2678 100644 --- a/core/shader/recompiler/CacheKey.hpp +++ b/core/shader/recompiler/CacheKey.hpp @@ -4,8 +4,10 @@ #include "Recompiler.hpp" #include "RdnaDecoder/RdnaDescriptorFormat.hpp" #include "prx/libc/include/HostThreadLocal.hpp" +#include #include #include +#include #include #include @@ -275,13 +277,35 @@ private: append(key, value.maxEvaluationOutputComponents); } + static void appendFeatureDigest(std::vector& key, std::span capabilities, std::span extensions) { + std::uint64_t low = 0xcbf29ce484222325ull; + std::uint64_t high = 0x6a09e667f3bcc909ull; + const auto mix = [&](std::uint64_t value) { + low = (low ^ value) * 0x100000001b3ull; + high = (high ^ (value * 0x9e3779b97f4a7c15ull)) * 0xff51afd7ed558ccdull; + high ^= high >> 29u; + }; + mix(capabilities.size()); + for (const auto capability : capabilities) mix(capability); + mix(extensions.size()); + for (const auto extension : extensions) { + mix(extension.size()); + for (std::size_t offset = 0; offset < extension.size(); offset += sizeof(std::uint64_t)) { + std::uint64_t chunk = 0; + std::memcpy(&chunk, extension.data() + offset, std::min(sizeof(std::uint64_t), extension.size() - offset)); + mix(chunk); + } + } + key.push_back(low); + key.push_back(high); + } + static void append(std::vector& key, const SpirvTarget& value) { append(key, value.vulkanVersion); append(key, value.spirvVersion); append(key, value.subgroupSize); append(key, value.bdaAbiVersion); - append(key, value.supportedCapabilities); - append(key, value.supportedExtensions); + appendFeatureDigest(key, value.supportedCapabilities, value.supportedExtensions); append(key, value.fragmentShaderBarycentricEnabled); append(key, value.maxWorkgroupSize); append(key, value.maxWorkgroupInvocations); From dd6220698a3e2fa3b6abb4bc212d89dba599e381 Mon Sep 17 00:00:00 2001 From: Dom3005 Date: Wed, 21 Oct 2026 18:38:51 +0200 Subject: [PATCH 100/113] fix(libkernel): change O_APPEND on a Windows file through fcntl fcntl(F_SETFL) threw when it changed O_APPEND on a Windows file. The guest flag already chooses WriteAtEnd, but a descriptor opened with O_APPEND also carries the CRT's append flag, so _write kept appending after the guest cleared it. F_SETFL now replaces the CRT descriptor of every descriptor sharing the open file's status with a duplicate handle opened with or without _O_APPEND, as libc fdopen does for append mode. Co-Authored-By: Claude Opus 5.5 --- .../libkernel/File/src/DescriptorControl.cpp | 29 ++++++++++++++++++- core/libs/tests/GuestKernelFcntl.cpp | 22 +++++++++++--- docs/dev/debt/libkernel.md | 2 +- 3 files changed, 47 insertions(+), 6 deletions(-) diff --git a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp index f832da7ae0..8f7dd2c448 100644 --- a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp +++ b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp @@ -22,8 +22,10 @@ #include #ifdef _WIN32 +#include #include #include +#include "prx/libc/include/General.hpp" #include "prx/libc/include/WindowsDescriptor.hpp" #else #include @@ -180,8 +182,33 @@ Entry InitialEntry(int fd) { return {false, std::make_shared(status)}; } +void SetHostAppend(int fd, bool append, const char* function) { + const int translation = ::_setmode(fd, _O_BINARY); + if (translation == -1 || ::_setmode(fd, translation) == -1) + throw std::runtime_error(std::string(function) + ": cannot read the translation mode of descriptor " + std::to_string(fd) + ", errno=" + std::to_string(errno)); + HANDLE copy = nullptr; + if (!::DuplicateHandle(::GetCurrentProcess(), WindowsDescriptorHandle_nid_no_patch(fd), ::GetCurrentProcess(), ©, 0, TRUE, DUPLICATE_SAME_ACCESS)) + throw std::runtime_error(std::string(function) + ": cannot duplicate the handle of descriptor " + std::to_string(fd) + ", error=" + std::to_string(::GetLastError())); + const int replacement = ::_open_osfhandle(reinterpret_cast(copy), (append ? _O_APPEND : 0) | translation); + if (replacement < 0) { + ::CloseHandle(copy); + throw std::runtime_error(std::string(function) + ": cannot open a replacement for descriptor " + std::to_string(fd) + ", errno=" + std::to_string(errno)); + } + auto* const standard = HostStandardHandle_nid_no_patch(fd); + const int moved = ::_dup2(replacement, fd); + const int error = errno; + ::_close(replacement); + KeepStandardHandle_nid_no_patch(fd, standard); + if (moved != 0) + throw std::runtime_error(std::string(function) + ": cannot replace descriptor " + std::to_string(fd) + ", errno=" + std::to_string(error)); +} + void ApplyHostStatus(int fd, Kind kind, int changed, int next, const char* function) { - if ((changed & Append) && kind == Kind::File) Unsupported(function, "changing O_APPEND", kind, fd); + if ((changed & Append) && kind == Kind::File) { + const auto status = g_entries.at(fd).status; + for (const auto& [descriptor, entry] : g_entries) + if (entry.status == status && DescriptorIsOpen_nid_no_patch(descriptor)) SetHostAppend(descriptor, (next & Append) != 0, function); + } if ((changed & Nonblocking) && kind == Kind::Device) Unsupported(function, "changing O_NONBLOCK", kind, fd); if ((changed & Nonblocking) && kind == Kind::Pipe) SetPipeNonblocking(fd, (next & Nonblocking) != 0, function); } diff --git a/core/libs/tests/GuestKernelFcntl.cpp b/core/libs/tests/GuestKernelFcntl.cpp index 3220eaa25c..63cae9c110 100644 --- a/core/libs/tests/GuestKernelFcntl.cpp +++ b/core/libs/tests/GuestKernelFcntl.cpp @@ -275,12 +275,26 @@ static void FileFlagsRoundTrip() { Require(fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append)); Require(fcntl_nid_postfix(appending, SetFlags, Append | NonBlocking) == 0); Require(fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append | NonBlocking)); -#ifdef _WIN32 - Require(ThrowsWith([appending] { fcntl_nid_postfix(appending, SetFlags, 0); }, "fcntl: changing O_APPEND on a file is not implemented")); -#else + Require(write_nid_postfix(appending, "ab", 2) == 2); Require(fcntl_nid_postfix(appending, SetFlags, 0) == 0); Require(fcntl_nid_postfix(appending, GetFlags) == WriteOnly); -#endif + Require(sceKernelLseek(appending, 0, FromStart) == 0); + Require(write_nid_postfix(appending, "X", 1) == 1); + const int sharing = fcntl_nid_postfix(appending, DuplicateCommand, 0); + Require(sharing >= 0); + Require(fcntl_nid_postfix(sharing, SetFlags, Append) == 0); + Require(fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append)); + Require(sceKernelLseek(appending, 0, FromStart) == 0); + Require(write_nid_postfix(appending, "c", 1) == 1); + Require(fcntl_nid_postfix(sharing, SetFlags, 0) == 0); + Require(sceKernelLseek(appending, 0, FromStart) == 0); + Require(write_nid_postfix(appending, "Y", 1) == 1); + Require(close_nid_postfix(sharing) == 0); + const int reading = sceKernelOpen("kernel_fcntl_probe.bin", ReadOnly, 0); + Require(reading >= 0); + char written[16]{}; + Require(sceKernelRead(reading, written, sizeof(written)) == 8 && std::memcmp(written, "Ybcdeabc", 8) == 0); + Require(sceKernelClose(reading) == 0); Require(ThrowsWith([appending] { fcntl_nid_postfix(appending, SetFlags, Append | 0x80); }, "fcntl: changing O_FSYNC on a file is not implemented")); Require(sceKernelClose(appending) == 0); std::remove("kernel_fcntl_probe.bin"); diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md index 67bf4903a9..de2b407332 100644 --- a/docs/dev/debt/libkernel.md +++ b/docs/dev/debt/libkernel.md @@ -230,7 +230,7 @@ - [kill, killpg](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) follow FreeBSD's `kern_kill` and `killpg1` for the only guest process: `EINVAL` for signals outside 0 to 128 and for negative `killpg` process groups, signal 0 only checks that the target exists, and its own pid, 0 and minus its own pid (the guest is taken to lead its own process group) signal it through `raise`, so they share `raise`'s limits above. Any other pid, and -1, which skips the caller, report `ESRCH`, so `EPERM` is never reported - [sceKernelFcntl](../../../core/libs/prx/libkernel/File/src/Open.cpp) (libkernel) runs the POSIX `fcntl` below and returns its guest errno as `SCE_KERNEL_ERROR_*`, the form the other `sceKernel` file exports use. The return values and error codes are unverified on a console - [Creating through a trailing slash](../../../core/libs/prx/libkernel/File/src/Open.cpp) (libkernel) - `open` and `sceKernelOpen` with `O_CREAT` on a missing name followed by a slash (`new/`) fail with `EINVAL` on Windows and with the host's `EISDIR` on Linux, where FreeBSD 11.4's `lookup()` (sys/kern/vfs_lookup.c) fails with `ENOENT` because only a directory may be created through a trailing slash -- [fcntl](../../../core/libs/prx/libkernel/File/src/DescriptorControl.cpp) (libkernel) follows FreeBSD 11.4's [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L479-L799) and [`kern_dup`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L812) on file, directory, pipe and character device descriptors; a socket keeps the libSceNet path (`F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFL`, `F_SETFL` with `O_NONBLOCK`, `F_GETFD` and `F_SETFD`, `EINVAL` for every other command, see the next entry). On Linux and macOS a host socket that is not a guest socket, such as a standard descriptor a service manager connected to its journal, takes the flag handling of a pipe end and `FIONREAD` asks the host for its queued bytes (for a datagram socket Linux counts only the next datagram, where FreeBSD's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_socket.c#L202-L205) counts every buffered byte); its record locks and read-ahead hints fail with `EBADF`, as FreeBSD fails them on a descriptor without a vnode, and `O_ASYNC` on it throws. The close-on-exec flag and the status flags live in a guest table, the status flags shared by `dup`, `dup2` and `F_DUPFD` as in an open file description; a descriptor the table has not seen, such as 0 to 2, starts from the host's flags, since the console's are not known. `F_DUPFD` and `F_DUPFD_CLOEXEC` return the lowest free host descriptor at or above the start, so the bound is the host table (`EMFILE` on Windows, `EINVAL` past `RLIMIT_NOFILE` on Linux), not the console's unknown `RLIMIT_NOFILE` and `kern.maxfilesperproc`. `O_NONBLOCK` switches a host pipe (`PIPE_NOWAIT` on Windows, where an empty read and a full write then report `EAGAIN`) and is only recorded on files, directories and the random device, as their reads never block; on a Windows console or other character device it throws. Changing `O_APPEND` on a Windows file, changing `O_FSYNC` on a file, `O_ASYNC` on a pipe or character device (`SIGIO` is not delivered), `F_GETOWN`, `F_SETOWN` and `F_SETLK_REMOTE` throw; `O_DIRECT`, `F_RDAHEAD` and `F_READAHEAD` are recorded as the hints they are. Record locks (`F_GETLK`, `F_SETLK`, `F_SETLKW` and their forms without `l_sysid`) use the host's POSIX locks on Linux and macOS. `F_GETLK` with `F_UNLCK` asks the host with `F_RDLCK`: as in [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) only another owner's overlapping write lock conflicts with either request. On Windows they follow [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L607-L752) and [`lf_advlockasync`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L433-L487) for the one guest process, which owns every lock: `EOVERFLOW` for an `SEEK_CUR` start past `OFF_MAX`, then `EBADF` for `F_RDLCK` without read access or `F_WRLCK` without write access and `EINVAL` for another type, then `EINVAL` and `EOVERFLOW` for the range; as [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) never lets locks of one owner conflict, whichever descriptor or thread asks, `F_SETLK` and `F_SETLKW` then succeed without waiting and `F_GETLK` reports `F_UNLCK`, so no lock list is kept and merging, splitting and the release on close have nothing to change. Nothing is held on the host, since Windows byte-range locks are mandatory and would fail the guest's own reads and writes through other descriptors, so other host processes neither see these locks nor are seen; a lock from the end of a directory throws. The return values and error codes are unverified on a console +- [fcntl](../../../core/libs/prx/libkernel/File/src/DescriptorControl.cpp) (libkernel) follows FreeBSD 11.4's [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L479-L799) and [`kern_dup`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L812) on file, directory, pipe and character device descriptors; a socket keeps the libSceNet path (`F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFL`, `F_SETFL` with `O_NONBLOCK`, `F_GETFD` and `F_SETFD`, `EINVAL` for every other command, see the next entry). On Linux and macOS a host socket that is not a guest socket, such as a standard descriptor a service manager connected to its journal, takes the flag handling of a pipe end and `FIONREAD` asks the host for its queued bytes (for a datagram socket Linux counts only the next datagram, where FreeBSD's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_socket.c#L202-L205) counts every buffered byte); its record locks and read-ahead hints fail with `EBADF`, as FreeBSD fails them on a descriptor without a vnode, and `O_ASYNC` on it throws. The close-on-exec flag and the status flags live in a guest table, the status flags shared by `dup`, `dup2` and `F_DUPFD` as in an open file description; a descriptor the table has not seen, such as 0 to 2, starts from the host's flags, since the console's are not known. `F_DUPFD` and `F_DUPFD_CLOEXEC` return the lowest free host descriptor at or above the start, so the bound is the host table (`EMFILE` on Windows, `EINVAL` past `RLIMIT_NOFILE` on Linux), not the console's unknown `RLIMIT_NOFILE` and `kern.maxfilesperproc`. `O_NONBLOCK` switches a host pipe (`PIPE_NOWAIT` on Windows, where an empty read and a full write then report `EAGAIN`) and is only recorded on files, directories and the random device, as their reads never block; on a Windows console or other character device it throws. Changing `O_FSYNC` on a file, `O_ASYNC` on a pipe or character device (`SIGIO` is not delivered), `F_GETOWN`, `F_SETOWN` and `F_SETLK_REMOTE` throw; `O_DIRECT`, `F_RDAHEAD` and `F_READAHEAD` are recorded as the hints they are. Record locks (`F_GETLK`, `F_SETLK`, `F_SETLKW` and their forms without `l_sysid`) use the host's POSIX locks on Linux and macOS. `F_GETLK` with `F_UNLCK` asks the host with `F_RDLCK`: as in [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) only another owner's overlapping write lock conflicts with either request. On Windows they follow [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L607-L752) and [`lf_advlockasync`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L433-L487) for the one guest process, which owns every lock: `EOVERFLOW` for an `SEEK_CUR` start past `OFF_MAX`, then `EBADF` for `F_RDLCK` without read access or `F_WRLCK` without write access and `EINVAL` for another type, then `EINVAL` and `EOVERFLOW` for the range; as [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) never lets locks of one owner conflict, whichever descriptor or thread asks, `F_SETLK` and `F_SETLKW` then succeed without waiting and `F_GETLK` reports `F_UNLCK`, so no lock list is kept and merging, splitting and the release on close have nothing to change. Nothing is held on the host, since Windows byte-range locks are mandatory and would fail the guest's own reads and writes through other descriptors, so other host processes neither see these locks nor are seen; a lock from the end of a directory throws. The return values and error codes are unverified on a console - [fcntl on a guest socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) answers `F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFD`, `F_SETFD`, `F_GETFL` and `F_SETFL` and fails every other command with `EINVAL`; FreeBSD 11.4's `kern_fcntl` also handles `F_GETOWN` and `F_SETOWN` on a socket. `FD_CLOEXEC` is only recorded (there is no `exec`): `dup`, `dup2`, `F_DUPFD`, `F_DUP2FD` onto another descriptor and an accepted socket start without it, `F_DUP2FD` onto the same descriptor keeps it, and `SOCK_CLOEXEC`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC` and `F_SETFD` set it. None of this was measured on a console. - [ioctl, _ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) handle only `FIONBIO` and `FIONREAD` on a socket, and any other request there fails with `ENOTTY`. On the other descriptors they follow FreeBSD's [`kern_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_generic.c#L758), [`vn_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_vnops.c#L1488) and [`pipe_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_pipe.c#L1346): `FIONBIO` sets `O_NONBLOCK` as `fcntl` does, `FIOCLEX` and `FIONCLEX` set and clear the close-on-exec flag `F_GETFD` reports, and `FIONREAD` reports the size past the offset of a file, the queued bytes of a pipe's read end, 0 on its write end and `ENOTTY` on the random device, while it throws on a directory or another character device. Every termios request (group `t`, `TIOCGWINSZ` included) fails with `ENOTTY`, since those descriptors are taken as not a terminal, as in `tcgetattr`, and any other well-formed request throws. An input request with length 0 is not rejected as malformed: [`sys_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_generic.c#L703-L718) rejects it only in a kernel built without `COMPAT_FREEBSD4`, `COMPAT_FREEBSD5` and `COMPAT_43`, and which of these the PS5 kernel has is unknown. Stremio Plus (PPSA74126) imports `_ioctl` for its statically linked `tc*` functions, which send `TIOCGETA`, `TIOCSETA`, `TIOCSPGRP` and the other termios requests - [ioctl, _ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) do not pass a `sceNetSocket` socket to libSceNet as `fcntl` does. On Linux its number duplicates the host socket, so `FIONBIO` switches the host `O_NONBLOCK` but not the library's `SO_NBIO` state; on Windows it is a `NUL` placeholder, so `FIONREAD` and enabling `FIONBIO` throw as on a character device. `sceNetIoctl` handles both requests on such a socket. From 69cdebdbb55aeaa0312cce8fe2198087691c64f0 Mon Sep 17 00:00:00 2001 From: Dom3005 Date: Wed, 21 Oct 2026 23:55:51 +0200 Subject: [PATCH 101/113] test(libkernel): remove a stale fcntl probe file before the flags test Co-Authored-By: Claude Opus 5.5 --- core/libs/tests/GuestKernelFcntl.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/core/libs/tests/GuestKernelFcntl.cpp b/core/libs/tests/GuestKernelFcntl.cpp index 63cae9c110..164a289714 100644 --- a/core/libs/tests/GuestKernelFcntl.cpp +++ b/core/libs/tests/GuestKernelFcntl.cpp @@ -199,6 +199,7 @@ static void SocketsKeepTheirPath() { } static void FileFlagsRoundTrip() { + std::remove("kernel_fcntl_probe.bin"); const int file = sceKernelOpen("kernel_fcntl_probe.bin", CreateReadWrite, 0644); Require(file >= 0); Require(sceKernelFcntl(file, GetFlags) == ReadWrite); From 371652fd0e87047b399cccd12e0a2299ae3186dd Mon Sep 17 00:00:00 2001 From: milescoviello Date: Mon, 19 Oct 2026 22:25:04 +0000 Subject: [PATCH 102/113] fix(agc): draw a PS_ITER_SAMPLE program once per pixel into a one-sample color target Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp | 3 ++- core/libs/prx/libSceAgcDriver/tests/Graphics.cpp | 6 +++++- docs/dev/debt/libSceAgcDriver.md | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp index 56436ff48f..e5fad3bdb1 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp @@ -1492,9 +1492,10 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) { color.uintExport = slotExport == 7; if (color.samples == 1 && result.samples > 1 && result.colors.empty() && !result.depth && (read(cx, 0x292) & 1u) == 0) { const auto sampleInputs = read(cx, 0x1b3) & read(cx, 0x1b4) & (ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage)); - Require(!result.perSampleShading && sampleInputs == 0 && (read(cx, 0x203) & 0x100u) == 0, "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with PS_ITER_SAMPLE, a sample index or coverage input, or a sample-mask export"); + Require(sampleInputs == 0 && (read(cx, 0x203) & 0x100u) == 0, "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with a sample index or coverage input, or a sample-mask export"); result.samples = 1; result.customSampleLocations = false; + result.perSampleShading = false; } if (color.samples > 1 && result.samples == 1 && result.colors.empty() && !result.depth && !result.alphaToCoverage && (read(cx, 0x292) & 1u) == 0) { Require(result.conservativeRasterization == VK_CONSERVATIVE_RASTERIZATION_MODE_DISABLED_EXT || (read(cx, 0x1b3) & 0x44u) == 0, "conservative rasterization with centroid interpolation of a draw raised to a multisampled target is unsupported"); diff --git a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp index abdb669923..00390f67fb 100644 --- a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp @@ -824,7 +824,7 @@ void msaaEnableClearOneSampleTargetTests() { queue = drawC(); queue.context[0x1b3] |= ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary); requireOneSample(queue, "draw C with an enabled but unaddressed ANCILLARY input"); - constexpr std::string_view refused = "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with PS_ITER_SAMPLE, a sample index or coverage input, or a sample-mask export"; + constexpr std::string_view refused = "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with a sample index or coverage input, or a sample-mask export"; for (const auto input : {ShaderRecompiler::PixelInput::Ancillary, ShaderRecompiler::PixelInput::SampleCoverage}) { queue = drawC(); queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(input); @@ -832,6 +832,10 @@ void msaaEnableClearOneSampleTargetTests() { } queue = drawC(); queue.context[0x293] = 0x10000u; + queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveSample); + requireOneSample(queue, "draw C with PS_ITER_SAMPLE and a sample-interpolated input"); + Require(!DecodeState(queue).perSampleShading, "PS_ITER_SAMPLE into a one-sample color target without MSAA_ENABLE asked for sample shading"); + queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary); expectFailure([&] { DecodeState(queue); }, refused); queue = drawC(); queue.context[0x1c4] = 9; diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md index 7a8f6ad52d..9e87ef8f93 100644 --- a/docs/dev/debt/libSceAgcDriver.md +++ b/docs/dev/debt/libSceAgcDriver.md @@ -37,7 +37,7 @@ - [Point geometry output](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a geometry program with `VGT_GS_OUT_PRIM_TYPE = 0` emits mesh points with `OutputPoints` and scalar `PrimitivePointIndicesEXT` as required by [SPV_EXT_mesh_shader](https://github.khronos.org/SPIRV-Registry/extensions/EXT/SPV_EXT_mesh_shader.html). Each packed primitive export contributes its first 9-bit vertex index and its null bit, using the same NGG primitive packing as line and triangle outputs. The subgroup reserves at least `GE_MAX_OUTPUT_PER_SUBGROUP` point slots, as the line path does; the console budget is not measured. Points use the register size or the misc-X point-size export and clamp interpreted by the vertex-point path; those register, clamp and rasterization inferences remain unmeasured on the console. Point sprites remain unsupported. Point output from a vertex workgroup still throws. Cocoon (PPSA08766) reaches this path with triangle-strip input. - [Line-strip geometry output](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a geometry program with `VGT_GS_OUT_PRIM_TYPE = 1` (line strip) runs as a mesh shader with `OutputLinesEXT`: each primitive export is one line whose two vertex indices are packed like the three of a triangle, as Mesa's NGG lowering exports line strips (`ac_nir_lower_ngg_gs.c`), and each input primitive gets `VGT_GS_MAX_VERT_OUT - 1` lines where a triangle strip gets `- 2` triangles. A subgroup gets at least `GE_MAX_OUTPUT_PER_SUBGROUP` line slots; whether the console does the same is unmeasured. A fast-launch subgroup takes its line count from `GE_NGG_SUBGRP_CNTL.PRIM_AMP_FACTOR`. Line output counts as lines for polygon offset decode. The lines are drawn 1 pixel wide with Vulkan default rasterization; `PA_SU_LINE_CNTL` is not read, and console line rules are not measured. - [Alpha-to-coverage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - only `DB_ALPHA_TO_MASK = 0xaa01` is accepted: the enable bit with the four quad offsets at 2 and no `OFFSET_ROUND`, the undithered setting [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/gallium/drivers/radeonsi/si_state.c#L371-L381) programs. Draws are single-sampled, so the pixel shader [writes](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) `SampleMask` 0 when its MRT0 alpha is below one half or NaN and all ones otherwise, and runs with late fragment tests. That rule was measured on a Radeon 660M (gfx1035, RADV with `RADV_DEBUG=noatocdithering`, which programs the same register) for 0, -0, 0.25, the two floats below one half, one half, the two above, 0.75, 1, 2, -1, both infinities and both NaNs, and is pinned in [AlphaToCoverage.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp); it is not measured on gfx1013. Vulkan's `alphaToCoverageEnable` is not used: the NVIDIA driver 615.78.08 dithers single-sample coverage (an alpha of 0.25 writes half the pixels of an RTX 3050 Laptop target). Other offsets, `OFFSET_ROUND`, a sample-mask export, and an MRT0 that is missing, swizzled, packed or exported without a floating-point alpha throw. A draw without a color target on MRT0 keeps alpha-to-coverage from its MRT0 export, as [radeonsi exports MRT0 as `32_AR` for alpha-to-coverage without a color buffer](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state_shaders.cpp#L2425-L2431). A draw that enables alpha-to-coverage with no MRT0 export still throws: what the console covers then is not measured. Default dithered `DB_ALPHA_TO_MASK = 0x18701` additionally uses a per-quad sample-mask table [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/4451#issuecomment-6124848921) for eight standard samples with FP16_ABGR or 32_ABGR exports; other sample counts, custom locations, EQAA combinations and dithered UNORM16/SNORM16 exports throw. The dithered rule is not measured on gfx1013. -- [A one-sample target under a multisampled rasterizer without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear, one-sample color targets and no depth target, or a one-sample depth target with no color target or one-sample color targets, is drawn as a one-sample draw at the pixel center. Without the bit every sample is taken to be at the pixel center (see the entry for a multisampled target rasterized without MSAA_ENABLE below), and a one-sample target is taken to keep the coverage of sample 0, so a one-sample depth target is tested and written once per pixel with the depth at the pixel center. That is the rule [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516) gives a color target with fewer samples than the rasterizer, but Vulkan reaches it only beside a depth or stencil target with the rasterizer's sample count ([VUID-VkGraphicsPipelineCreateInfo-subpass-01505](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/pipelines.adoc#L3033-L3041)), so here it is an analogy, and for a one-sample depth target an extension of it. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_graphics_pipeline.cpp#L127-L128) also rasterizes with the largest sample count of the bound depth and color targets ([L416-L417](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L416-L417), [L477-L480](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L477-L480)), and reads `PA_SC_AA_CONFIG` only for a `SAMPLE_COVERAGE` input ([L174-L177](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L174-L177)). This is not measured on hardware. An `ANCILLARY` or `SAMPLE_COVERAGE` pixel input and a sample-mask export throw in a pixel program that runs, and so does `PS_ITER_SAMPLE` with one-sample color targets and no depth target, because what the console gives them under a multisampled configuration is not known; a depth-only draw that skips its pixel program is drawn with the null program, and its `PS_ITER_SAMPLE` and pixel input bits are ignored. With a one-sample depth target, a pixel program with `PS_ITER_SAMPLE` and neither input runs once per pixel; if the console runs it once per sample, its atomics and append or consume counters count differently. Points and alpha-to-coverage throw as for a multisampled target. With a one-sample depth target, `DB_EQAA.INTERPOLATE_COMP_Z` is accepted: with every sample at the pixel center, Z interpolated to any sample position is the center's Z, which the one-sample draw tests. That rests on the same inference; neither [PAL](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9MsaaState.cpp#L117-L118) nor [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/761d5c8a54f93b3d43608f718910ed742983dd0b/src/gallium/drivers/radeonsi/si_state.c#L3314-L3316) sets the bit, and its meaning is not documented. Line and point lists (`VGT_PRIMITIVE_TYPE` 1-3, even when a geometry program turns them into triangles), `INTERPOLATE_SRC_Z` and overrasterization (`OVERRASTERIZATION_AMOUNT`, `ENABLE_POSTZ_OVERRASTERIZATION`) still throw. METAL GEAR SOLID: Peace Walker (PPSA18216) draws a one-sample color target under a 4x configuration this way; the first draw of its opening movie binds a one-sample depth target and no color target under the same configuration. Gran Turismo 7 (PPSA01317) draws its main pass with a one-sample depth target, `DB_EQAA` 0x00050000 and a 4x configuration. +- [A one-sample target under a multisampled rasterizer without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear, one-sample color targets and no depth target, or a one-sample depth target with no color target or one-sample color targets, is drawn as a one-sample draw at the pixel center. Without the bit every sample is taken to be at the pixel center (see the entry for a multisampled target rasterized without MSAA_ENABLE below), and a one-sample target is taken to keep the coverage of sample 0, so a one-sample depth target is tested and written once per pixel with the depth at the pixel center. That is the rule [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516) gives a color target with fewer samples than the rasterizer, but Vulkan reaches it only beside a depth or stencil target with the rasterizer's sample count ([VUID-VkGraphicsPipelineCreateInfo-subpass-01505](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/pipelines.adoc#L3033-L3041)), so here it is an analogy, and for a one-sample depth target an extension of it. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_graphics_pipeline.cpp#L127-L128) also rasterizes with the largest sample count of the bound depth and color targets ([L416-L417](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L416-L417), [L477-L480](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L477-L480)), and reads `PA_SC_AA_CONFIG` only for a `SAMPLE_COVERAGE` input ([L174-L177](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L174-L177)). This is not measured on hardware. An `ANCILLARY` or `SAMPLE_COVERAGE` pixel input and a sample-mask export throw in a pixel program that runs, because what the console gives them under a multisampled configuration is not known; a depth-only draw that skips its pixel program is drawn with the null program, and its `PS_ITER_SAMPLE` and pixel input bits are ignored. A pixel program with `PS_ITER_SAMPLE` and neither input runs once per pixel; if the console runs it once per sample, its atomics and append or consume counters count differently. Points and alpha-to-coverage throw as for a multisampled target. With a one-sample depth target, `DB_EQAA.INTERPOLATE_COMP_Z` is accepted: with every sample at the pixel center, Z interpolated to any sample position is the center's Z, which the one-sample draw tests. That rests on the same inference; neither [PAL](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9MsaaState.cpp#L117-L118) nor [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/761d5c8a54f93b3d43608f718910ed742983dd0b/src/gallium/drivers/radeonsi/si_state.c#L3314-L3316) sets the bit, and its meaning is not documented. Line and point lists (`VGT_PRIMITIVE_TYPE` 1-3, even when a geometry program turns them into triangles), `INTERPOLATE_SRC_Z` and overrasterization (`OVERRASTERIZATION_AMOUNT`, `ENABLE_POSTZ_OVERRASTERIZATION`) still throw. METAL GEAR SOLID: Peace Walker (PPSA18216) draws a one-sample color target under a 4x configuration this way; the first draw of its opening movie binds a one-sample depth target and no color target under the same configuration. Gran Turismo 7 (PPSA01317) draws its main pass with a one-sample depth target, `DB_EQAA` 0x00050000 and a 4x configuration. - [MSAA_ENABLE on a single-sample target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_MODE_CNTL_0.MSAA_ENABLE` with `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES = 0` is drawn like the same state without the bit when sample 0 of the four `PA_SC_AA_SAMPLE_LOCS_PIXEL_*_0` registers is at the pixel center and the draw rasterizes filled triangles or rectangles (`VGT_PRIMITIVE_TYPE` 7 or 17 as well as the triangle types) with alpha-to-coverage and conservative rasterization off. [RADV](https://gitlab.freedesktop.org/mesa/mesa/-/blob/745709a000482a4a24c91faef5c5a40bd653a863/src/amd/vulkan/radv_cmd_buffer.c#L13606-13609) programs this state for one-sample custom sample locations on GFX10 and later, where the bit makes the rasterizer use the programmed location of sample 0 ([061bc615](https://gitlab.freedesktop.org/mesa/mesa/-/commit/061bc6151a11597f720535f00e79a5752e24aff6)); that the bit changes nothing else for such a draw is inferred from that and is not measured on hardware. EA Sports UFC 5 (PPSA03541) reaches a rect-list draw in this state. Other locations of sample 0, absent location registers, points, lines, alpha-to-coverage and conservative rasterization throw - [A multisampled target rasterized without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - not measured on hardware: `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear puts every color, depth and stencil sample at the pixel center, as in GL without multisampling ([ARB_multisample](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089/extensions/ARB/ARB_multisample.txt#L185), [RADV 061bc615](https://gitlab.freedesktop.org/mesa/mesa/-/commit/061bc6151a11)). Lines cover whole pixels by the host's line rule, not the console's aliased one ([D3D11.3](https://github.com/microsoft/DirectX-Specs/blob/f37b0d6033a1/d3d/archive/D3D11_3_FunctionalSpec.htm#L13705)). Depth sample tests and occlusion counts are unknown. Rasterized points, alpha-to-coverage, and Z interpolation, overrasterization or a sample-mask export with depth throw. PPSA06888 draws a 2x target, PPSA18216 a 4x depth and color pair and 4x lines. - [sceAgcDriverGetEqContextId](../../../core/libs/prx/libSceAgcDriver/Eq/src/Query.cpp) (libSceAgcDriver) - returns `ident`: an end-of-pipe interrupt is delivered only to the registration whose id equals the raising queue, so `ident` is that context's id (titles register 0 or 1 for graphics and `0x20 + 8 * pipe + queue` for compute). The console's value is not known; KytyPS5 returns the event's `data`, which it fills with the interrupt's context id, whereas `data` here is the EV_CLEAR trigger count. Other event filters throw From 3769bce12cf531f07c5859c395893cf437b7f5a4 Mon Sep 17 00:00:00 2001 From: notaxeltv Date: Wed, 14 Oct 2026 23:33:45 +0200 Subject: [PATCH 103/113] feat(libc): export std::thread::hardware_concurrency Absent PPSA34015 import CHrhwd8QSBs; forward to host hardware_concurrency. Co-authored-by: Cursor --- core/libs/prx/libc/CMakeLists.txt | 10 ++++++ core/libs/prx/libc/src/Threads.cpp | 4 +++ .../GuestStdThreadHardwareConcurrency.cpp | 33 +++++++++++++++++++ 3 files changed, 47 insertions(+) create mode 100644 core/libs/tests/GuestStdThreadHardwareConcurrency.cpp diff --git a/core/libs/prx/libc/CMakeLists.txt b/core/libs/prx/libc/CMakeLists.txt index dfbe462ee1..233ff92c44 100644 --- a/core/libs/prx/libc/CMakeLists.txt +++ b/core/libs/prx/libc/CMakeLists.txt @@ -451,6 +451,16 @@ if(BUILD_TESTING) set_tests_properties(guest_libc_threads PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() + add_test_executable(guest_std_thread_hardware_concurrency_tests ${LIBS_INCLUDE_DIR}/tests/GuestStdThreadHardwareConcurrency.cpp) + target_include_directories(guest_std_thread_hardware_concurrency_tests PRIVATE ${LIBS_INCLUDE_DIR}) + target_link_libraries(guest_std_thread_hardware_concurrency_tests PRIVATE libc) + configure_windows_unwind(guest_std_thread_hardware_concurrency_tests) + add_test(NAME guest_std_thread_hardware_concurrency COMMAND guest_std_thread_hardware_concurrency_tests) + set_tests_properties(guest_std_thread_hardware_concurrency PROPERTIES TIMEOUT 20) + if(WIN32) + set_tests_properties(guest_std_thread_hardware_concurrency PROPERTIES ENVIRONMENT_MODIFICATION + "PATH=path_list_prepend:$") + endif() add_test_executable(guest_libc_static_imports_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibcStaticImports.cpp) target_include_directories(guest_libc_static_imports_tests PRIVATE ${LIBS_INCLUDE_DIR}) target_link_libraries(guest_libc_static_imports_tests PRIVATE libc) diff --git a/core/libs/prx/libc/src/Threads.cpp b/core/libs/prx/libc/src/Threads.cpp index 1e7ea35688..4933672426 100644 --- a/core/libs/prx/libc/src/Threads.cpp +++ b/core/libs/prx/libc/src/Threads.cpp @@ -350,6 +350,10 @@ int SignalCondition_nid_no_patch(void** handle) { return threadSuccess; } +unsigned APS5_VABI _ZNSt6thread20hardware_concurrencyEv_nid_postfix() { + return std::thread::hardware_concurrency(); +} + int APS5_VABI _Thrd_sleep_nid_postfix(const Xtime* target, Xtime*) { if (!target) APS5_INVALID_ARG_EX; diff --git a/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp b/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp new file mode 100644 index 0000000000..fe6a695747 --- /dev/null +++ b/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp @@ -0,0 +1,33 @@ +#include "prx/libc/include/general/VabiMacros.hpp" +#include +#include +#ifdef _WIN32 +#include +#else +#include +#endif + +extern "C" unsigned APS5_VABI _ZNSt6thread20hardware_concurrencyEv_nid_postfix(); + +int main() { + unsigned expected = 0; +#ifdef _WIN32 + SYSTEM_INFO info{}; + GetSystemInfo(&info); + expected = info.dwNumberOfProcessors; +#else + const long processors = sysconf(_SC_NPROCESSORS_ONLN); + if (processors > 0) expected = static_cast(processors); +#endif + const unsigned result = _ZNSt6thread20hardware_concurrencyEv_nid_postfix(); + if (expected != 0 && result != expected) { + std::fprintf(stderr, "guest processor hint %u differs from OS count %u\n", result, expected); + return 1; + } + if (result != std::thread::hardware_concurrency()) { + std::fprintf(stderr, "guest processor hint %u differs from std::thread::hardware_concurrency %u\n", + result, std::thread::hardware_concurrency()); + return 1; + } + return 0; +} From b443b9f9f011381019a70b31ca57ee747d819ec9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A0=20Franch?= Date: Sat, 24 Oct 2026 03:31:05 +0200 Subject: [PATCH 104/113] fix(libc): compare only with std::thread::hardware_concurrency, record host count in debt Co-Authored-By: Claude Sonnet 5.5 --- .../GuestStdThreadHardwareConcurrency.cpp | 18 ------------------ docs/dev/debt/libc.md | 1 + 2 files changed, 1 insertion(+), 18 deletions(-) diff --git a/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp b/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp index fe6a695747..6b53d172cf 100644 --- a/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp +++ b/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp @@ -1,29 +1,11 @@ #include "prx/libc/include/general/VabiMacros.hpp" #include #include -#ifdef _WIN32 -#include -#else -#include -#endif extern "C" unsigned APS5_VABI _ZNSt6thread20hardware_concurrencyEv_nid_postfix(); int main() { - unsigned expected = 0; -#ifdef _WIN32 - SYSTEM_INFO info{}; - GetSystemInfo(&info); - expected = info.dwNumberOfProcessors; -#else - const long processors = sysconf(_SC_NPROCESSORS_ONLN); - if (processors > 0) expected = static_cast(processors); -#endif const unsigned result = _ZNSt6thread20hardware_concurrencyEv_nid_postfix(); - if (expected != 0 && result != expected) { - std::fprintf(stderr, "guest processor hint %u differs from OS count %u\n", result, expected); - return 1; - } if (result != std::thread::hardware_concurrency()) { std::fprintf(stderr, "guest processor hint %u differs from std::thread::hardware_concurrency %u\n", result, std::thread::hardware_concurrency()); diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index fbc52c5e51..dbec0ee78f 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -60,6 +60,7 @@ ### Functional - [_Cosh](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the two-argument Dinkumware CRT helper used by `std::complex`, including a scaled large-finite-input path; the signature, exact result and floating-point exception behavior are not verified against the console. +- [std::thread::hardware_concurrency](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `CHrhwd8QSBs`) returns the host's `std::thread::hardware_concurrency()` (which may be 0 when unknown) instead of the console's processor count; no reference implements it and the value a title expects (PPSA34015 imports it) is unverified. - [fmodf](../../../core/libs/prx/libc/src/Math.cpp) (libc) - console `errno`, exception flags and NaN payloads remain unverified. The wrapper preserves `errno` like the existing double `fmod`, following FreeBSD 11.4 [`e_fmodf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/e_fmodf.c); host `std::fmod` still supplies the result and exception flags. - [_FSinh and _FCosh](../../../core/libs/prx/libc/src/Math.cpp) (libc) finite results are not verified bit for bit against the console: the scaled product uses the host's binary64 hyperbolic function before rounding to binary32, rather than the float rational and `_FExp` sequence in PRAGMATA's bundled `libc.prx`. NaN preference and payloads, signed zeros, infinite operands and the range-error thresholds follow that binary's instructions; the system `libSceLibcInternal` implementation and nondefault flush-to-zero modes are unverified. From 9fc13424e8551b565acb0da8f28aabf09974d90e Mon Sep 17 00:00:00 2001 From: JJenkx Date: Fri, 23 Oct 2026 22:12:45 -0400 Subject: [PATCH 105/113] test(agc): expect half of the heap or budget in the storage cache execution test Co-Authored-By: Claude Opus 5.5 --- .../tests/execution/SampledCacheBudget.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp index 10ccf51718..6cfb074620 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp @@ -1004,7 +1004,7 @@ std::uint64_t ExpectedBudget(const Context& context) { VkPhysicalDeviceMemoryBudgetPropertiesEXT reported{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT}; VkPhysicalDeviceMemoryProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_PROPERTIES_2, &reported}; ReportBudget(context.physical, &properties); - return SampledTextureBudget(context.memory, &reported, SampledTextureMemory() + TextureCacheUsage().storageBytes); + return SampledTextureBudget(context.memory, &reported, SampledTextureMemory() + TextureCacheUsage().storageBytes, TextureCacheUsage().storageBytes); } std::uint64_t ReadBudget(const Context& context) { @@ -1049,8 +1049,10 @@ void storageMemoryTests(Context context) { context.memoryProperties2 = &ReportBudget; Block block(context); auto held = Sampled(context, block.Surface(0)); - const auto quarter = std::min(StorageTextureBudget(context.memory, nullptr, 0, 0), ReportedBudget / 4u); - Require(ReadStorageBudget(context) == quarter, "52 GiB free of a 64 GiB budget does not leave the storage image cache its quarter"); + const auto heap = LargestDeviceLocalHeap(context.memory); + Require(heap.has_value(), "the device has no device-local heap"); + const auto half = std::min(context.memory.memoryHeaps[*heap].size / 2u, ReportedBudget / 2u); + Require(ReadStorageBudget(context) == half, "52 GiB free of a 64 GiB budget does not leave the storage image cache half of the heap or of the budget"); context.memoryProperties2 = &ReportPressure; const auto pressed = ReadStorageBudget(context); const auto expected = GiB + TextureCacheUsage().storageBytes; From 1f11b8ab9be0eca9c008df566bf11efce99cd578 Mon Sep 17 00:00:00 2001 From: billybobpicklio Date: Sun, 18 Oct 2026 21:37:23 -0400 Subject: [PATCH 106/113] fix(agc): bound the sampled depth-plane copies A depth plane copy (a depth surface sampled as several slices, an integer view or a cube) was kept until the device went away, with a staging buffer of its own size, and a staging buffer it outgrew was never freed. Every depth surface a scene ever sampled this way held its copy, so device memory grew with each new scene (0.4-1.2 GB in RE2 after a level load). The copies now share their image's ownership with the views they hand out, the recorder keeps the image and the staging buffer until the recorded copy has run, and past APS5_DEPTH_PLANE_COPY_MIB (default 256; 0 keeps every copy) the least recently used copies leave the cache. A copy made again refills from the surface and guest memory as a new one does. agc_driver_depth_plane_sampling_evicting runs the plane sampling cases with a 1 MiB budget. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 6 ++ .../Graphics/src/DepthSurface.cpp | 84 ++++++++++++++----- docs/dev/ENVIRONMENT.md | 1 + 3 files changed, 72 insertions(+), 19 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index 2c79ef109e..463796c703 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -2141,6 +2141,12 @@ if(BUILD_TESTING) set_tests_properties(agc_driver_rcp_hardware_exact PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() + add_test(NAME agc_driver_depth_plane_sampling_evicting COMMAND agc_driver_depth_plane_sampling_tests) + set_tests_properties(agc_driver_depth_plane_sampling_evicting PROPERTIES ENVIRONMENT "APS5_DEPTH_PLANE_COPY_MIB=1" SKIP_RETURN_CODE 77 TIMEOUT 120) + if(WIN32) + set_tests_properties(agc_driver_depth_plane_sampling_evicting PROPERTIES ENVIRONMENT_MODIFICATION + "PATH=path_list_prepend:$") + endif() endif() foreach(agcExecutionTestName IN LISTS ANYPS5_AGC_EXECUTION_TESTS) if(NOT EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/tests/execution/${agcExecutionTestName}.cpp) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp index 458af384d5..17800bb4b0 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp @@ -1218,8 +1218,10 @@ public: allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT); memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory depth plane copy"); Check(context.Function("vkBindImageMemory")(context.device, image, memory, 0), "vkBindImageMemory depth plane copy"); - stagingSize = static_cast(sliceBytes()) * layers; - staging = std::make_unique(context, stagingSize, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); + imageBytes = requirements.size; + // The views share the image's ownership: the copy can leave the cache while a draw or a + // cached resource set still samples it. + owned = std::make_shared(context, image, memory); } catch (...) { release(); throw; @@ -1238,12 +1240,7 @@ public: std::snprintf(text, sizeof(text), "AGC graphics: depth plane copy geometry does not match its layers (copy %ux%u, %u layers, %llu bytes a slice; texture %ux%u guest format %u, dimension %d, tile mode %u, %u layers, %llu bytes a slice, %zu mips)", extent.width, extent.height, layers, static_cast(sliceBytes()), resource.width, resource.height, resource.format, static_cast(resource.dimension), resource.tileMode, geometry.layers, static_cast(geometry.sliceLinearBytes), geometry.mips.size()); throw std::runtime_error(text); } - const auto stagingBytes = static_cast(geometry.sliceLinearBytes) * layers; - if (stagingBytes > stagingSize) { - retiredStaging.push_back(std::move(staging)); - staging = std::make_unique(context, stagingBytes, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); - stagingSize = stagingBytes; - } + const auto stagingBytes = std::max(static_cast(geometry.sliceLinearBytes), static_cast(sliceBytes())) * layers; std::vector> uploads; std::vector uploadLayers; std::vector copiedLayers; @@ -1269,11 +1266,16 @@ public: uploadLayers.push_back(layer); held = current; } - if (!copiedLayers.empty() || !uploads.empty()) record(slices, resource, geometry, copiedLayers, uploads, uploadLayers); + if (!copiedLayers.empty() || !uploads.empty()) { + // The recorder keeps the staging buffer (and the image) until the copy ran, so a copy + // evicted meanwhile, or a staging buffer outgrown, does not free memory in use. + if (staging == nullptr || stagingBytes > staging->Size()) staging = std::make_shared(context, stagingBytes, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); + record(slices, resource, geometry, copiedLayers, uploads, uploadLayers, staging); + } const std::array key{static_cast(components.r), static_cast(components.g), static_cast(components.b), static_cast(components.a), static_cast(viewType), baseLayer}; auto& texture = textures[key]; if (texture == nullptr) { - texture = std::make_shared(context, image, format, aspect(), components, viewType, baseLayer); + texture = std::make_shared(context, image, format, aspect(), components, viewType, baseLayer, owned); texture->MarkRefreshedPerUse(); } return texture; @@ -1283,6 +1285,9 @@ public: const VkExtent2D extent; const VkFormat format; const std::uint32_t layers; + VkDeviceSize imageBytes = 0; + std::uint64_t lastUse = 0; + VkDeviceSize HeldBytes() const { return imageBytes + (staging != nullptr ? staging->Size() : 0u); } private: struct GuestLayer { @@ -1295,15 +1300,14 @@ private: VkImage image = VK_NULL_HANDLE; VkDeviceMemory memory = VK_NULL_HANDLE; - std::unique_ptr staging; - std::size_t stagingSize = 0; - std::vector> retiredStaging; + std::shared_ptr owned; + std::shared_ptr staging; std::map, std::shared_ptr> textures; std::vector guestLayers; std::vector surfaceLayers; bool filled = false; - void record(std::span slices, const GuestTextureResource& resource, const SurfaceGeometry& geometry, std::span copiedLayers, std::span> uploads, std::span uploadLayers) { + void record(std::span slices, const GuestTextureResource& resource, const SurfaceGeometry& geometry, std::span copiedLayers, std::span> uploads, std::span uploadLayers, const std::shared_ptr& staging) { if (!uploads.empty()) { Require(context.detiler != nullptr, "depth plane copy requires a texture detiler"); context.detiler->BeginBatch(); @@ -1360,7 +1364,11 @@ private: barrier(commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, 0, 0, nullptr, 0, nullptr, 1, &toGeneral); filled = true; if (batch) batch->SubmitAndWait(); - else Recorder::CountBarriers(Recorder::CommandClass::Draw, 3); + else { + Recorder::CountBarriers(Recorder::CommandClass::Draw, 3); + recorder->Keep(staging, staging->Size()); + if (owned != nullptr) recorder->Keep(owned); + } } VkDeviceSize sliceBytes() const { @@ -1374,8 +1382,11 @@ private: void release() noexcept { textures.clear(); staging.reset(); - if (image) context.Function("vkDestroyImage")(context.device, image, nullptr); - if (memory) context.Function("vkFreeMemory")(context.device, memory, nullptr); + if (owned != nullptr) owned.reset(); + else { + if (image) context.Function("vkDestroyImage")(context.device, image, nullptr); + if (memory) context.Function("vkFreeMemory")(context.device, memory, nullptr); + } image = VK_NULL_HANDLE; memory = VK_NULL_HANDLE; } @@ -1386,6 +1397,37 @@ std::map& keep) { + static const VkDeviceSize budget = [] { + const char* text = std::getenv("APS5_DEPTH_PLANE_COPY_MIB"); + return static_cast(text != nullptr ? std::strtoull(text, nullptr, 10) : 256ull) << 20u; + }(); + if (budget == 0) return; + auto& copies = planeCopies(); + VkDeviceSize total = 0; + for (const auto& entry : copies) total += entry.second->HeldBytes(); + while (total > budget) { + auto oldest = copies.end(); + for (auto it = copies.begin(); it != copies.end(); ++it) { + if (it->first == keep) continue; + if (oldest == copies.end() || it->second->lastUse < oldest->second->lastUse) oldest = it; + } + if (oldest == copies.end()) break; + total -= oldest->second->HeldBytes(); + copies.erase(oldest); + } +} + struct LayeredSlice { DepthSurface* surface; std::uint32_t layer; @@ -2372,10 +2414,14 @@ std::shared_ptr DepthSurfaceTexture(const Context& context, std::spanimage, slice == drawnDepth ? 0u : slice->written}); } const auto imageFormat = integer ? VK_FORMAT_R16_UINT : d16 ? VK_FORMAT_D16_UNORM : VK_FORMAT_D32_SFLOAT; - auto& copy = planeCopies()[{context.device, base.address, base.extent.width, base.extent.height, imageFormat, layers}]; - if (copy == nullptr) { + auto& copies = planeCopies(); + const std::tuple copyKey{context.device, base.address, base.extent.width, base.extent.height, imageFormat, layers}; + if (auto& copy = copies[copyKey]; copy == nullptr) { copy = std::make_unique(context, base.extent, imageFormat, layers); + evictPlaneCopies(copyKey); } + auto& copy = copies[copyKey]; + copy->lastUse = ++planeCopyClock(); return copy->Refresh(slices, resource, components, cube || resource.dimension == TextureDimension::k2DArray ? VK_IMAGE_VIEW_TYPE_2D_ARRAY : VK_IMAGE_VIEW_TYPE_2D, layered && !cube ? resource.baseArray : 0u); } diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md index ca8bf9bc15..2435a84081 100644 --- a/docs/dev/ENVIRONMENT.md +++ b/docs/dev/ENVIRONMENT.md @@ -109,6 +109,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti | `APS5_CPU_STORES` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp` | | writes packet stores on the CPU instead of recording them on the GPU | | `APS5_DCC_KEYS_EACH` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` | | records every DCC key store at once instead of batching them | | `APS5_DEPTH_COPY_MIN_KIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 1024 | minimum surface size in KiB for a depth target to take the depth-copy path | +| `APS5_DEPTH_PLANE_COPY_MIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp` | 256 | budget in MiB of the sampled depth-plane copies kept for reuse (least recently used copies leave first); `0` keeps every copy | | `APS5_DEPTH_PLANE_WHOLE_STORE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp` | | stores a stale depth plane whole when memory over it is read, instead of only the 64 KiB units the read overlaps | | `APS5_DISPATCH_CACHE_BYTES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` | 268435456 | size of the dispatch cache in bytes (0 keeps the default of 256 MiB) | | `APS5_DISPATCH_CACHE_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` | 8192 | number of dispatch cache entries; 0 picks a default from the variant count | From 3245a347e97777b2963372ea4602013207b0e1b8 Mon Sep 17 00:00:00 2001 From: billybobpicklio Date: Mon, 19 Oct 2026 09:56:34 -0400 Subject: [PATCH 107/113] test(agc): check that the evicting depth-plane run keeps only the newest copy agc_driver_depth_plane_sampling_evicting passes --evicting, and the test then requires a single depth plane copy left in the cache (DepthPlaneCopyCount) after the cases. With APS5_DEPTH_PLANE_COPY_MIB=0, which keeps every copy, it fails with "8 depth plane copies were kept with a 1 MiB budget, expected only the newest". The explanatory comments move to the pull request. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceAgcDriver/CMakeLists.txt | 2 +- .../Graphics/include/DepthSurface.hpp | 1 + .../libSceAgcDriver/Graphics/src/DepthSurface.cpp | 13 ++++--------- .../tests/execution/DepthPlaneSampling.cpp | 7 ++++++- 4 files changed, 12 insertions(+), 11 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt index 463796c703..880f08f9ad 100644 --- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt +++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt @@ -2141,7 +2141,7 @@ if(BUILD_TESTING) set_tests_properties(agc_driver_rcp_hardware_exact PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$") endif() - add_test(NAME agc_driver_depth_plane_sampling_evicting COMMAND agc_driver_depth_plane_sampling_tests) + add_test(NAME agc_driver_depth_plane_sampling_evicting COMMAND agc_driver_depth_plane_sampling_tests --evicting) set_tests_properties(agc_driver_depth_plane_sampling_evicting PROPERTIES ENVIRONMENT "APS5_DEPTH_PLANE_COPY_MIB=1" SKIP_RETURN_CODE 77 TIMEOUT 120) if(WIN32) set_tests_properties(agc_driver_depth_plane_sampling_evicting PROPERTIES ENVIRONMENT_MODIFICATION diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp index 835b80f59b..96030245b3 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp @@ -72,6 +72,7 @@ VkImageAspectFlags HtileFillClears(std::uint32_t pattern, bool stencilInHtile); std::uint64_t HtileMetadataBytes(VkExtent2D extent); bool HtileFillCovers(std::uint64_t htile, VkExtent2D extent, std::uint64_t address, std::size_t bytes); std::shared_ptr DepthSurfaceTexture(const Context& context, std::span words, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D); +std::size_t DepthPlaneCopyCount(); VkFormat HostDepthFormat(const Context& context, VkFormat format); float HostDepthBiasConstant(const Context& context, VkFormat format, float constant); std::shared_ptr DepthSurfaceStorage(const Context& context, std::span words, const GuestTextureResource& resource, std::uint32_t mip); diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp index 17800bb4b0..be31cbccf5 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp @@ -1219,8 +1219,6 @@ public: memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory depth plane copy"); Check(context.Function("vkBindImageMemory")(context.device, image, memory, 0), "vkBindImageMemory depth plane copy"); imageBytes = requirements.size; - // The views share the image's ownership: the copy can leave the cache while a draw or a - // cached resource set still samples it. owned = std::make_shared(context, image, memory); } catch (...) { release(); @@ -1267,8 +1265,6 @@ public: held = current; } if (!copiedLayers.empty() || !uploads.empty()) { - // The recorder keeps the staging buffer (and the image) until the copy ran, so a copy - // evicted meanwhile, or a staging buffer outgrown, does not free memory in use. if (staging == nullptr || stagingBytes > staging->Size()) staging = std::make_shared(context, stagingBytes, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); record(slices, resource, geometry, copiedLayers, uploads, uploadLayers, staging); } @@ -1402,11 +1398,6 @@ std::uint64_t& planeCopyClock() { return clock; } -// The plane copies were kept until the device went away: every depth surface a scene ever sampled -// held a full-size copy in device memory (0.4-1.2 GB in RE2 after a level load). Past -// APS5_DEPTH_PLANE_COPY_MIB (default 256; 0 keeps all) the least recently used copies leave the -// cache; their views keep the image alive while a draw, a recorded batch or a cached resource set -// still holds them, and a copy made again refills from the surface. void evictPlaneCopies(const std::tuple& keep) { static const VkDeviceSize budget = [] { const char* text = std::getenv("APS5_DEPTH_PLANE_COPY_MIB"); @@ -2353,6 +2344,10 @@ void ClearDepthSurfaces(VkDevice device) { UpdateResidentImageUnmapObserver_nid_no_patch(); } +std::size_t DepthPlaneCopyCount() { + return planeCopies().size(); +} + std::shared_ptr DepthSurfaceTexture(const Context& context, std::span words, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType multisampleViewType) { const auto held = [&](const auto& surface) { return surface->active->load(std::memory_order_acquire) && surface->context.device == context.device && !surface->retired && (surface->target.address == resource.baseAddress || (surface->target.stencilAddress != 0 && surface->target.stencilAddress == resource.baseAddress)); diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp index 33c6cfdb6b..2b497f99b9 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp @@ -434,8 +434,9 @@ void RefusalCase(AgcDriver::VulkanDevice& device, GuestBlock& block) { } } -int main() { +int main(int argc, char** argv) { try { + const bool evicting = argc > 1 && std::string(argv[1]) == "--evicting"; GuestBlock block; const auto device = OpenVulkanTestDevice(); if (!device) return VulkanTestSkipped; @@ -452,6 +453,10 @@ int main() { PaddedD16CubeCase(*device, block, output); BaseSliceCase(*device, block, output); RefusalCase(*device, block); + if (evicting) { + const auto kept = AgcDriver::Graphics::DepthPlaneCopyCount(); + Require(kept == 1, std::to_string(kept) + " depth plane copies were kept with a 1 MiB budget, expected only the newest"); + } std::puts("depth plane sampling tests passed"); return 0; } catch (const std::exception& error) { From c2b128b56d7faaffce52678adbb0ee59443dc374 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A0=20Franch?= Date: Sat, 24 Oct 2026 04:24:25 +0200 Subject: [PATCH 108/113] fix(agc): count the staging buffer before evicting depth plane copies The newest copy's staging buffer exists only after Refresh, so evicting before it under-counted the held bytes. The evicting test now asserts a count that holds on every driver: at least the newest copy and fewer than the 8 an unbounded cache keeps. --- .../prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp | 9 ++++----- .../tests/execution/DepthPlaneSampling.cpp | 2 +- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp index be31cbccf5..5836a6deee 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp @@ -2411,13 +2411,12 @@ std::shared_ptr DepthSurfaceTexture(const Context& context, std::span copyKey{context.device, base.address, base.extent.width, base.extent.height, imageFormat, layers}; - if (auto& copy = copies[copyKey]; copy == nullptr) { - copy = std::make_unique(context, base.extent, imageFormat, layers); - evictPlaneCopies(copyKey); - } auto& copy = copies[copyKey]; + if (copy == nullptr) copy = std::make_unique(context, base.extent, imageFormat, layers); copy->lastUse = ++planeCopyClock(); - return copy->Refresh(slices, resource, components, cube || resource.dimension == TextureDimension::k2DArray ? VK_IMAGE_VIEW_TYPE_2D_ARRAY : VK_IMAGE_VIEW_TYPE_2D, layered && !cube ? resource.baseArray : 0u); + auto texture = copy->Refresh(slices, resource, components, cube || resource.dimension == TextureDimension::k2DArray ? VK_IMAGE_VIEW_TYPE_2D_ARRAY : VK_IMAGE_VIEW_TYPE_2D, layered && !cube ? resource.baseArray : 0u); + evictPlaneCopies(copyKey); + return texture; } bool DepthSurfaceHolds(const Context& context, const GuestTextureResource& resource, const Texture* texture) { diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp index 2b497f99b9..f77432e092 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp @@ -455,7 +455,7 @@ int main(int argc, char** argv) { RefusalCase(*device, block); if (evicting) { const auto kept = AgcDriver::Graphics::DepthPlaneCopyCount(); - Require(kept == 1, std::to_string(kept) + " depth plane copies were kept with a 1 MiB budget, expected only the newest"); + Require(kept >= 1 && kept < 8, std::to_string(kept) + " depth plane copies were kept with a 1 MiB budget, expected at least the newest and fewer than the 8 an unbounded cache keeps"); } std::puts("depth plane sampling tests passed"); return 0; From 3551a22670951a6ed83b0f8f9c137f3e4a2b8b20 Mon Sep 17 00:00:00 2001 From: Yunus Shaikh <75296019+EagleBearerYS@users.noreply.github.com> Date: Fri, 23 Oct 2026 19:23:25 -0700 Subject: [PATCH 109/113] test(libSceNetCtl): drop the checks that unimplemented event types throw The loops over event types 0, 4 and -1 for sceNetCtlGetResult and sceNetCtlGetResultV6 required the not-implemented throw, so they would fail once those events are implemented. Events 1 to 3, initialization and the null-pointer checks stay. --- core/libs/tests/GuestNetCtl.cpp | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/core/libs/tests/GuestNetCtl.cpp b/core/libs/tests/GuestNetCtl.cpp index 3560d4db92..facc12ccf6 100644 --- a/core/libs/tests/GuestNetCtl.cpp +++ b/core/libs/tests/GuestNetCtl.cpp @@ -22,7 +22,6 @@ #include #include #include -#include #ifdef __APPLE__ struct NetCtlDefaultRoute { @@ -296,23 +295,11 @@ int main() { int errorCode = -1; Require(sceNetCtlGetResult(eventType, &errorCode) == 0 && errorCode == 0); } - for (const int eventType : {0, 4, -1}) { - int errorCode = -1; - std::string what; - try { sceNetCtlGetResult(eventType, &errorCode); } catch (const std::runtime_error& error) { what = error.what(); } - Require(what == "sceNetCtlGetResult: event type " + std::to_string(eventType) + " is not implemented" && errorCode == -1); - } Require(sceNetCtlGetResultV6(kEventIpObtained, nullptr) == kErrInvalidAddr); for (const int eventType : {kEventDisconnected, 2, kEventIpObtained}) { int errorCodeV6 = -1; Require(sceNetCtlGetResultV6(eventType, &errorCodeV6) == 0 && errorCodeV6 == 0); } - for (const int eventType : {0, 4, -1}) { - int errorCodeV6 = -1; - bool threw = false; - try { sceNetCtlGetResultV6(eventType, &errorCodeV6); } catch (const std::runtime_error&) { threw = true; } - Require(threw && errorCodeV6 == -1); - } NetCtlInfo info{}; Require(sceNetCtlGetInfo(0, &info) == kErrInvalidCode); Require(sceNetCtlGetInfo(22, &info) == kErrInvalidCode); From 42424dd55e8158845b47a900337b5d61441b4bb3 Mon Sep 17 00:00:00 2001 From: valenciana-nc Date: Fri, 23 Oct 2026 08:50:16 -0600 Subject: [PATCH 110/113] fix(agc): include descriptor words in vertex validation errors --- .../Graphics/include/VertexInput.hpp | 8 ++++- .../prx/libSceAgcDriver/tests/VertexInput.cpp | 34 +++++++++++++++++++ .../tests/execution/ZeroStrideVertexFetch.cpp | 23 +++++++++++++ core/shader/recompiler/Recompiler.cpp | 8 ++++- 4 files changed, 71 insertions(+), 2 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp index aad386bfc1..fc85f5b358 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include @@ -120,7 +121,12 @@ inline VertexInputLayout BuildVertexInputLayout(const Context& context, std::spa const auto format = DecodeVertexFormat(attribute); Require(attribute.location < context.limits.maxVertexInputAttributes && locations.insert(attribute.location).second, "invalid or duplicate vertex attribute location"); Require(attribute.fetchIndex <= 1, "unsupported vertex fetch index"); - Require((fields[1] & 0x80000000u) == 0 && (fields[3] & 0x00800000u) == 0 && (fields[3] >> 30u) == 0, "unsupported vertex buffer descriptor flags"); + if ((fields[1] & 0x80000000u) != 0 || (fields[3] & 0x00800000u) != 0 || (fields[3] >> 30u) != 0) { + char message[160]; + std::snprintf(message, sizeof(message), "unsupported vertex buffer descriptor flags at location %u (V#=[%08x %08x %08x %08x])", + attribute.location, fields[0], fields[1], fields[2], fields[3]); + Require(false, message); + } const auto stride = (fields[1] >> 16u) & 0x3fffu; const auto address = fields[0] | (static_cast(fields[1] & 0xffffu) << 32u); Require(NullVertexDescriptor(attribute) || (address != 0 && address % format.alignment == 0 && stride % format.alignment == 0), "unaligned vertex buffer"); diff --git a/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp b/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp index 5d56b47f05..6b55bfe04a 100644 --- a/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp @@ -58,8 +58,42 @@ template void fails(TAction&& fn) { Require(failed, "invalid vertex input was accepted"); } +void descriptorDiagnostics(const Context& ctx) { + auto input = attribute(7); + input.resource.fields = {0x89abcde0u, 0x0010abcdu, 0x12345678u, 0x0104dfacu}; + Require(BuildVertexInputLayout(ctx, std::span(&input, 1)).attributes.size() == 1, "valid diagnostic control was rejected"); + struct Case { + unsigned field; + std::uint32_t bits; + const char* words; + }; + constexpr std::array cases{ + Case{1, 0x80000000u, "V#=[89abcde0 8010abcd 12345678 0104dfac]"}, + Case{3, 0x00800000u, "V#=[89abcde0 0010abcd 12345678 0184dfac]"}, + Case{3, 0x40000000u, "V#=[89abcde0 0010abcd 12345678 4104dfac]"}, + Case{3, 0x80000000u, "V#=[89abcde0 0010abcd 12345678 8104dfac]"}, + Case{3, 0xc0800000u, "V#=[89abcde0 0010abcd 12345678 c184dfac]"} + }; + for (const auto& value : cases) { + auto invalid = input; + invalid.resource.fields[value.field] |= value.bits; + const auto before = invalid.resource.fields; + bool rejected = false; + try { + BuildVertexInputLayout(ctx, std::span(&invalid, 1)); + } catch (const std::runtime_error& error) { + const std::string message(error.what()); + Require(message.find("unsupported vertex buffer descriptor flags at location 7") != std::string::npos && message.find(value.words) != std::string::npos, + "vertex flag error did not identify the attribute and all four descriptor words: " + message); + rejected = true; + } + Require(rejected && invalid.resource.fields == before, "invalid descriptor was accepted or changed"); + } +} + void run() { auto ctx = context(); + descriptorDiagnostics(ctx); VertexInputCache cache(ctx, 2); std::array attributes{attribute(0), attribute(1)}; auto first = get(cache, ctx, 1, attributes); diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp index e5804bf70a..0642450135 100644 --- a/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp @@ -124,6 +124,28 @@ void Draw(AgcDriver::VulkanDevice& device, const Case& value) { device.WaitIdle(); } +void DescriptorDiagnostics(AgcDriver::VulkanDevice& device) { + for (std::uint32_t component = 0; component < 4u; ++component) { + for (const auto selector : {2u, 3u}) { + const auto shift = component * 3u; + const Case value{3u, 16u, true, "reserved selector", (0xfacu & ~(7u << shift)) | (selector << shift)}; + const auto fields = VertexBufferDescriptor(value); + char expected[192]; + std::snprintf(expected, sizeof(expected), "reserved prepared vertex component selector %u at location 0 component %u (V#=[%08x %08x %08x %08x])", + selector, component, fields[0], fields[1], fields[2], fields[3]); + bool rejected = false; + try { + Draw(device, value); + } catch (const std::runtime_error& error) { + const std::string message(error.what()); + Require(message.find(expected) != std::string::npos, "reserved selector error did not identify the component and descriptor: " + message); + rejected = true; + } + Require(rejected, "a reserved vertex component selector was accepted"); + } + } +} + void Check(const Case& value) { for (std::uint32_t vertex = 0; vertex < Vertices; ++vertex) { for (std::uint32_t component = 0; component < 4u; ++component) { @@ -169,6 +191,7 @@ int main() { Draw(*device, value); Check(value); } + DescriptorDiagnostics(*device); std::puts("zero-stride vertex fetch tests passed"); return 0; } catch (const std::exception& error) { diff --git a/core/shader/recompiler/Recompiler.cpp b/core/shader/recompiler/Recompiler.cpp index a149307af2..8c90d56488 100644 --- a/core/shader/recompiler/Recompiler.cpp +++ b/core/shader/recompiler/Recompiler.cpp @@ -1091,7 +1091,13 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil formatComponents = 1u; for (std::uint32_t component = 0; component < 4u; ++component) { const auto selector = (input.outputMask & (1u << component)) != 0u ? (resource.fields[3] >> (component * 3u)) & 7u : 0u; - if (selector == 2u || selector == 3u) throw std::runtime_error("reserved prepared vertex component selector"); + if (selector == 2u || selector == 3u) { + const auto& fields = resource.fields; + char message[192]; + std::snprintf(message, sizeof(message), "reserved prepared vertex component selector %u at location %u component %u (V#=[%08x %08x %08x %08x])", + selector, input.location, component, fields[0], fields[1], fields[2], fields[3]); + throw std::runtime_error(message); + } if (selector >= 4u) formatComponents = std::max(formatComponents, selector - 3u); selectors |= selector << (component * 3u); } From a155c9e2aebfe33a29faeef7f3f58eccf795a9c9 Mon Sep 17 00:00:00 2001 From: valenciana-nc Date: Fri, 23 Oct 2026 20:46:16 -0600 Subject: [PATCH 111/113] test(agc): decouple descriptor diagnostics from unsupported paths --- .../Graphics/include/VertexInput.hpp | 13 ++++++++---- .../prx/libSceAgcDriver/tests/VertexInput.cpp | 20 +++++++------------ 2 files changed, 16 insertions(+), 17 deletions(-) diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp index fc85f5b358..b59420e595 100644 --- a/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp +++ b/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp @@ -112,6 +112,14 @@ struct VertexInputLayout { std::vector attributes; }; +inline std::array VertexDescriptorFlagsMessage(const ShaderRecompiler::VertexAttribute& attribute) { + std::array message{}; + const auto& fields = attribute.resource.fields; + std::snprintf(message.data(), message.size(), "unsupported vertex buffer descriptor flags at location %u (V#=[%08x %08x %08x %08x])", + attribute.location, fields[0], fields[1], fields[2], fields[3]); + return message; +} + inline VertexInputLayout BuildVertexInputLayout(const Context& context, std::span attributes) { Require(attributes.size() <= context.limits.maxVertexInputBindings && attributes.size() <= context.limits.maxVertexInputAttributes, "vertex input count exceeds device limits"); VertexInputLayout result; @@ -122,10 +130,7 @@ inline VertexInputLayout BuildVertexInputLayout(const Context& context, std::spa Require(attribute.location < context.limits.maxVertexInputAttributes && locations.insert(attribute.location).second, "invalid or duplicate vertex attribute location"); Require(attribute.fetchIndex <= 1, "unsupported vertex fetch index"); if ((fields[1] & 0x80000000u) != 0 || (fields[3] & 0x00800000u) != 0 || (fields[3] >> 30u) != 0) { - char message[160]; - std::snprintf(message, sizeof(message), "unsupported vertex buffer descriptor flags at location %u (V#=[%08x %08x %08x %08x])", - attribute.location, fields[0], fields[1], fields[2], fields[3]); - Require(false, message); + Require(false, VertexDescriptorFlagsMessage(attribute).data()); } const auto stride = (fields[1] >> 16u) & 0x3fffu; const auto address = fields[0] | (static_cast(fields[1] & 0xffffu) << 32u); diff --git a/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp b/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp index 6b55bfe04a..48d26f71df 100644 --- a/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp @@ -75,19 +75,13 @@ void descriptorDiagnostics(const Context& ctx) { Case{3, 0xc0800000u, "V#=[89abcde0 0010abcd 12345678 c184dfac]"} }; for (const auto& value : cases) { - auto invalid = input; - invalid.resource.fields[value.field] |= value.bits; - const auto before = invalid.resource.fields; - bool rejected = false; - try { - BuildVertexInputLayout(ctx, std::span(&invalid, 1)); - } catch (const std::runtime_error& error) { - const std::string message(error.what()); - Require(message.find("unsupported vertex buffer descriptor flags at location 7") != std::string::npos && message.find(value.words) != std::string::npos, - "vertex flag error did not identify the attribute and all four descriptor words: " + message); - rejected = true; - } - Require(rejected && invalid.resource.fields == before, "invalid descriptor was accepted or changed"); + auto described = input; + described.resource.fields[value.field] |= value.bits; + const auto before = described.resource.fields; + const std::string message(VertexDescriptorFlagsMessage(described).data()); + Require(message.find("unsupported vertex buffer descriptor flags at location 7") != std::string::npos && message.find(value.words) != std::string::npos, + "vertex flag message did not identify the attribute and all four descriptor words: " + message); + Require(described.resource.fields == before, "formatting changed the descriptor"); } } From a25aa3664150cc6f8d340c6a193c70de0e23ce56 Mon Sep 17 00:00:00 2001 From: Kapy2003 Date: Sat, 24 Oct 2026 01:19:01 +0530 Subject: [PATCH 112/113] feat(libSceNgs2): support custom mastering rack 0x4003 Accept SCE_NGS2_RACK_ID_CUSTOM_MASTERING (0x4003) using the 0x508-byte custom rack option layout without modules. Channels above NGS2_MAX_CHANNELS (8) and non-zero module counts throw runtime_error as unsupported. Support mastering voice control parameters 0x40030000 (setup), 0x40030004 (gain), and 0x40030005 (output), write active mastering voices to render buffers, and return voice state flags in sceNgs2VoiceGetState. References #8039. --- .../libSceNgs2.native/include/Ngs2Types.hpp | 6 ++ .../libs/prx/libSceNgs2.native/src/Custom.cpp | 3 + core/libs/prx/libSceNgs2.native/src/Rack.cpp | 20 +++--- .../libs/prx/libSceNgs2.native/src/Render.cpp | 2 +- core/libs/prx/libSceNgs2.native/src/Voice.cpp | 13 +++- .../libSceNgs2.native/tests/Ngs2Custom.cpp | 62 +++++++++++++++++++ docs/dev/debt/libSceNgs2.native.md | 1 + 7 files changed, 94 insertions(+), 13 deletions(-) diff --git a/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp b/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp index 54093115a2..eda5e07ef3 100644 --- a/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp +++ b/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp @@ -43,6 +43,7 @@ static constexpr std::uint32_t SCE_NGS2_RACK_ID_REVERB = 0x2001; static constexpr std::uint32_t SCE_NGS2_RACK_ID_MASTERING = 0x3000; static constexpr std::uint32_t SCE_NGS2_RACK_ID_CUSTOM_SAMPLER = 0x4001; static constexpr std::uint32_t SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER = 0x4002; +static constexpr std::uint32_t SCE_NGS2_RACK_ID_CUSTOM_MASTERING = 0x4003; static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_I16L = 0x12; static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_I16B = 0x13; @@ -87,6 +88,9 @@ static constexpr std::uint32_t SCE_NGS2_CUSTOM_SAMPLER_VOICE_PARAM_ADD_WAVEFORM_ static constexpr std::uint32_t SCE_NGS2_CUSTOM_SAMPLER_VOICE_PARAM_EXIT_LOOP = 0x40010004; static constexpr std::uint32_t SCE_NGS2_CUSTOM_SAMPLER_VOICE_PARAM_PITCH = 0x40010005; static constexpr std::uint32_t SCE_NGS2_CUSTOM_SUBMIXER_VOICE_PARAM_SETUP = 0x40020000; +static constexpr std::uint32_t SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_SETUP = 0x40030000; +static constexpr std::uint32_t SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_GAIN = 0x40030004; +static constexpr std::uint32_t SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_OUTPUT = 0x40030005; static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_FILTER = 0x40001300; static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN = 0x40001500; static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX = 0x40001900; @@ -360,6 +364,8 @@ struct Ngs2CustomSubmixerRackOption { }; static_assert(sizeof(Ngs2CustomSubmixerRackOption) == 1288); +using Ngs2CustomMasteringRackOption = Ngs2CustomSubmixerRackOption; + struct Ngs2RackInfo { char name[64]; Ngs2Handle rack_handle; diff --git a/core/libs/prx/libSceNgs2.native/src/Custom.cpp b/core/libs/prx/libSceNgs2.native/src/Custom.cpp index e87845360e..5d066d889a 100644 --- a/core/libs/prx/libSceNgs2.native/src/Custom.cpp +++ b/core/libs/prx/libSceNgs2.native/src/Custom.cpp @@ -61,6 +61,9 @@ static void CheckDelayModule(std::uint32_t rackId, const Ngs2CustomRackModuleInf } int Ngs2CheckCustomRack(std::uint32_t rackId, const Ngs2CustomRackOption& option, std::uint32_t maxInputs) { + if (rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING && option.num_modules != 0) { + throw std::runtime_error("NGS2: custom mastering racks with modules are not implemented"); + } if (option.num_buffers == 0 || option.num_buffers > SCE_NGS2_CUSTOM_MAX_BUFFERS || option.num_buffers < maxInputs) { return SCE_NGS2_ERROR_INVALID_NUM_BUFFERS; } diff --git a/core/libs/prx/libSceNgs2.native/src/Rack.cpp b/core/libs/prx/libSceNgs2.native/src/Rack.cpp index 21d0cb17ba..fd8f22db33 100644 --- a/core/libs/prx/libSceNgs2.native/src/Rack.cpp +++ b/core/libs/prx/libSceNgs2.native/src/Rack.cpp @@ -19,6 +19,7 @@ union RackOptions { Ngs2ReverbRackOption reverb; Ngs2CustomSamplerRackOption customSampler; Ngs2CustomSubmixerRackOption customSubmixer; + Ngs2CustomMasteringRackOption customMastering; }; static std::size_t RackOptionSize(std::uint32_t rackId) { @@ -29,12 +30,13 @@ static std::size_t RackOptionSize(std::uint32_t rackId) { case SCE_NGS2_RACK_ID_REVERB: return sizeof(Ngs2ReverbRackOption); case SCE_NGS2_RACK_ID_CUSTOM_SAMPLER: return sizeof(Ngs2CustomSamplerRackOption); case SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER: return sizeof(Ngs2CustomSubmixerRackOption); + case SCE_NGS2_RACK_ID_CUSTOM_MASTERING: return sizeof(Ngs2CustomMasteringRackOption); default: throw std::runtime_error("NGS2: rack id " + Ngs2Hex(rackId) + " is not implemented"); } } static RackOptions DefaultRackOption(std::uint32_t rackId) { - if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER || rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) { + if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER || rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) { throw std::runtime_error("NGS2: default custom rack options are not implemented"); } RackOptions options{}; @@ -83,7 +85,7 @@ static std::uint32_t RackMaxChannels(std::uint32_t rackId, const RackOptions& op if (rackId == SCE_NGS2_RACK_ID_SUBMIXER) return options.submixer.max_channels; if (rackId == SCE_NGS2_RACK_ID_MASTERING) return options.mastering.max_channels; if (rackId == SCE_NGS2_RACK_ID_REVERB) return options.reverb.max_channels; - if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) return options.customSubmixer.max_channels; + if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) return options.customSubmixer.max_channels; return NGS2_MAX_CHANNELS; } @@ -97,17 +99,17 @@ static int CheckedRackOption(std::uint32_t rackId, const Ngs2RackOption* option, options = {}; std::memcpy(&options, option, size); const auto maxChannels = RackMaxChannels(rackId, options); - if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER && maxChannels > SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS) return SCE_NGS2_ERROR_INVALID_NUM_CHANNELS; - if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER && (options.customSubmixer.max_inputs == 0 || options.customSubmixer.max_inputs > SCE_NGS2_CUSTOM_SUBMIXER_MAX_INPUTS)) { + if ((rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) && maxChannels > SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS) return SCE_NGS2_ERROR_INVALID_NUM_CHANNELS; + if ((rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) && (options.customSubmixer.max_inputs == 0 || options.customSubmixer.max_inputs > SCE_NGS2_CUSTOM_SUBMIXER_MAX_INPUTS)) { throw std::runtime_error("NGS2: custom submixer racks with " + std::to_string(options.customSubmixer.max_inputs) + " inputs are not implemented"); } if (options.common.max_voices == 0 || maxChannels == 0) throw std::invalid_argument("NGS2: invalid rack voice or channel count"); int result = SCE_NGS2_OK; if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) result = Ngs2CheckCustomRack(rackId, options.customSampler.custom_rack_option, 0); - if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) result = Ngs2CheckCustomRack(rackId, options.customSubmixer.custom_rack_option, options.customSubmixer.max_inputs); + if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) result = Ngs2CheckCustomRack(rackId, options.customSubmixer.custom_rack_option, options.customSubmixer.max_inputs); if (result != SCE_NGS2_OK) return result; if (maxChannels > NGS2_MAX_CHANNELS) { - if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) { + if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) { throw std::runtime_error("NGS2: custom submixer racks with " + std::to_string(maxChannels) + " channels are not implemented"); } throw std::invalid_argument("NGS2: invalid rack voice or channel count"); @@ -129,7 +131,7 @@ static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackO rack->maxChannels = RackMaxChannels(rackId, options); rack->maxFilters = rackId == SCE_NGS2_RACK_ID_SAMPLER ? options.sampler.max_filters : rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER ? options.customSampler.custom_rack_option.num_modules - : rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER ? options.customSubmixer.custom_rack_option.num_modules : 0; + : (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) ? options.customSubmixer.custom_rack_option.num_modules : 0; rack->uid = nextUid++; std::memcpy(rack->name, options.common.name, sizeof(rack->name)); rack->name[sizeof(rack->name) - 1] = '\0'; @@ -137,7 +139,7 @@ static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackO if (rackId == SCE_NGS2_RACK_ID_SAMPLER) rack->maxChannelWorks = options.sampler.max_channel_works; if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) rack->maxChannelWorks = options.customSampler.max_channel_works; if (rackId == SCE_NGS2_RACK_ID_SUBMIXER) rack->maxInputs = options.submixer.max_inputs; - if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) rack->maxInputs = options.customSubmixer.max_inputs; + if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) rack->maxInputs = options.customSubmixer.max_inputs; rack->bufferInfo = bufferInfo; rack->allocator = allocator; rack->voices.resize(options.common.max_voices); @@ -147,7 +149,7 @@ static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackO voice.matrices.resize(options.common.max_matrices); } if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) Ngs2SetupUserFx(*rack, options.customSampler.custom_rack_option); - if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) Ngs2SetupUserFx(*rack, options.customSubmixer.custom_rack_option); + if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) Ngs2SetupUserFx(*rack, options.customSubmixer.custom_rack_option); system->racks.push_back(rack); *handle = reinterpret_cast(rack); return SCE_NGS2_OK; diff --git a/core/libs/prx/libSceNgs2.native/src/Render.cpp b/core/libs/prx/libSceNgs2.native/src/Render.cpp index fa764d375a..c2d82f9e5d 100644 --- a/core/libs/prx/libSceNgs2.native/src/Render.cpp +++ b/core/libs/prx/libSceNgs2.native/src/Render.cpp @@ -336,7 +336,7 @@ void Ngs2RenderSystem(Ngs2System& system, const Ngs2RenderBufferInfo* bufferInfo std::vector> mixes(numBufferInfo); for (auto* voice : voices) { RenderVoice(*voice, voices, grain, system.option.sample_rate); - if (voice->rack->rackId != SCE_NGS2_RACK_ID_MASTERING || !voice->hasSamples) continue; + if ((voice->rack->rackId != SCE_NGS2_RACK_ID_MASTERING && voice->rack->rackId != SCE_NGS2_RACK_ID_CUSTOM_MASTERING) || !voice->hasSamples) continue; auto& mix = OutputMix(mixes, bufferInfo, numBufferInfo, *voice, grain); const std::uint32_t outputChannels = bufferInfo[voice->outputId].num_channels; for (std::uint32_t channel = 0; channel < voice->channels; channel++) { diff --git a/core/libs/prx/libSceNgs2.native/src/Voice.cpp b/core/libs/prx/libSceNgs2.native/src/Voice.cpp index 8f9c3fabc4..cd0fc18ea8 100644 --- a/core/libs/prx/libSceNgs2.native/src/Voice.cpp +++ b/core/libs/prx/libSceNgs2.native/src/Voice.cpp @@ -369,18 +369,19 @@ static void ApplyParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param) { } break; case SCE_NGS2_RACK_ID_MASTERING: - if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_SETUP) { + case SCE_NGS2_RACK_ID_CUSTOM_MASTERING: + if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_SETUP || param.id == SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_SETUP) { SetupMixer(voice, ParamAs(param).num_io_channels); return; } - if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_GAIN) { + if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_GAIN || param.id == SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_GAIN) { const auto& gain = ParamAs(param); if (!std::isfinite(gain.fbw_level) || !std::isfinite(gain.lfe_level)) APS5_INVALID_ARG_EX; voice.fbwLevel = gain.fbw_level; voice.lfeLevel = gain.lfe_level; return; } - if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_OUTPUT) { + if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_OUTPUT || param.id == SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_OUTPUT) { voice.outputId = ParamAs(param).output_id; return; } @@ -472,6 +473,12 @@ int APS5_VABI sceNgs2VoiceGetState(uintptr_t voice_handle, Ngs2VoiceState* state sampler.num_decoded_samples = voice.decodedSamples; return SCE_NGS2_OK; } + case SCE_NGS2_RACK_ID_CUSTOM_MASTERING: { + if (state_size != sizeof(Ngs2VoiceState)) return SCE_NGS2_ERROR_INVALID_OUT_SIZE; + *state = {}; + state->state_flags = voice.stateFlags; + return SCE_NGS2_OK; + } default: throw std::runtime_error("NGS2: voice state of rack " + Ngs2Hex(voice.rack->rackId) + " is not implemented"); } } diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp index 1e30889e34..80d9d2cb34 100644 --- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp +++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp @@ -103,6 +103,21 @@ static bool CreateSamplerThrows(const Ngs2CustomSamplerRackOption& option) { return false; } +static Ngs2CustomMasteringRackOption MasteringRackOption(std::uint32_t channels, std::uint32_t inputs) { + Ngs2CustomMasteringRackOption option{}; + auto& common = option.custom_rack_option.rack_option; + common.size = sizeof(option); + common.max_grain_samples = 512; + common.max_voices = 2; + common.max_matrices = 1; + common.max_ports = 1; + option.custom_rack_option.num_buffers = 1; + option.custom_rack_option.num_modules = 0; + option.max_channels = channels; + option.max_inputs = inputs; + return option; +} + template static bool ControlThrows(uintptr_t voice, std::uint32_t id, TParam param) { param.header = {static_cast(sizeof(TParam)), 0, id}; @@ -825,6 +840,52 @@ static void TestCustomModuleInfo() { Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK); } +static void TestCustomMastering() { + const auto system = CreateSystem(); + const auto good = MasteringRackOption(2, 1); + + Ngs2ContextBufferInfo query{}; + Require(sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_MASTERING, &good.custom_rack_option.rack_option, &query) == SCE_NGS2_OK); + const auto info = Buffer(query); + uintptr_t rack = 0; + Require(sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_MASTERING, &good.custom_rack_option.rack_option, &info, &rack) == SCE_NGS2_OK); + const auto voice = Voice(rack); + + Control(voice, SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_SETUP, Ngs2MasteringVoiceSetupParam{{}, 2, 0}); + Control(voice, SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, 1.0f, 1.0f}); + Control(voice, SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_OUTPUT, Ngs2MasteringVoiceOutputParam{{}, 0, 0}); + Event(voice, SCE_NGS2_VOICE_EVENT_PLAY); + + Ngs2VoiceState state{}; + Require(sceNgs2VoiceGetState(voice, &state, sizeof(state)) == SCE_NGS2_OK); + Require((state.state_flags & SCE_NGS2_VOICE_STATE_FLAG_INUSE) != 0); + Require(sceNgs2VoiceGetState(voice, &state, sizeof(state) - 1) == SCE_NGS2_ERROR_INVALID_OUT_SIZE); + + std::vector pcm(Grain * 2 * 8, 16384); + const auto sampler = Sampler(system, pcm); + Patch(sampler, voice); + Event(sampler, SCE_NGS2_VOICE_EVENT_PLAY); + + auto out = Render(system); + Require(out.size() == Grain * 2); + Require(out[0] != 0.0f); + + Require(sceNgs2VoiceGetState(voice, &state, sizeof(state)) == SCE_NGS2_OK); + Require((state.state_flags & SCE_NGS2_VOICE_STATE_FLAG_PLAYING) != 0); + + auto createMastering = [&](const Ngs2CustomMasteringRackOption& opt) { + uintptr_t r = 0; + return sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_MASTERING, &opt.custom_rack_option.rack_option, &info, &r); + }; + + auto invalidChannels = good; + invalidChannels.max_channels = SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS + 1; + Require(createMastering(invalidChannels) == SCE_NGS2_ERROR_INVALID_NUM_CHANNELS); + + Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK); + Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK); +} + int main() { for (const auto count : {1u, 2u, 24u}) { for (const auto delay : {DelayOption{}, DelayOption{20, 1, 1, 1.0f, 0}, DelayOption{20, 1, 8, 20000.0f, 0}}) { @@ -839,5 +900,6 @@ int main() { for (const auto moduleIndex : {0u, 1u, 23u}) TestCustomLegacyUserFx(moduleIndex); TestCustomGain(); TestCustomModuleInfo(); + TestCustomMastering(); return 0; } diff --git a/docs/dev/debt/libSceNgs2.native.md b/docs/dev/debt/libSceNgs2.native.md index a49957e009..09dbb8bd3b 100644 --- a/docs/dev/debt/libSceNgs2.native.md +++ b/docs/dev/debt/libSceNgs2.native.md @@ -27,6 +27,7 @@ - [NGS2 custom Delay](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, 0x1d) - processing and defaults remain unverified on PS5. The [agreed compatibility path](https://github.com/boykopovar/AnyPS5/pull/9337#issuecomment-6351205140) preserves main's PCM pass-through for Void Terrarium (PPSA03061) until any Delay parameter is set; every `0x40001dxx` parameter throws. Only one-buffer custom submixers with no module state and a 20-byte option are accepted. Option type 0/1, taps 1..8, length 1..20000 and reserved 0 follow [fma-rc's 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943). Other shapes and values throw because their console errors are unknown. This preserves host behavior, not console-equivalent Delay processing - [NGS2 custom module ids](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native) - Reverb (0x1b), PitchShift (0x20) and Convolution (0x23) are not processed: a rack that passes their creation checks throws. Gain (0x15) on custom sampler racks also throws. Per [fma-rc's 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6294323150), creation returns `0x804A8302` for a wrong non-zero state size, and `0x804A8013`, `0x804A8099` and `0x804A8098` for a bad Reverb option size or word and PitchShift word. Unknown: check order, errors for a Gain option, missing Reverb or PitchShift options, other PitchShift and Convolution option sizes, and Convolution's state (64 bytes from SDK 3.0). PPSA04540 uses 0x15, 0x19, 0x1b and 0x23 (#8039), PPSA35169 0x20 (#4246) - [NGS2 custom Gain module](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, rack 0x4002) - follows [fma-rc's reading of the 12.70 module](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943): parameter `0x40001500 | module index` holds 37 linear levels, one per channel, default 0, and the module writes source × level into dest, ramping linearly over the grain from the previous level. Unverified: where the ramp starts and ends (here the grain's first sample is one step past the previous level and its last sample is at the new level), whether stopping or setting up the voice again resets the levels, and what the library does with a level outside -32 to 32 (here it throws). On a custom sampler rack, whose parameter index is one higher per fma-rc, Gain throws. A Gain module with an option throws: fma-rc reads Gain as taking none, and the error the library returns for one is unknown. The extra buffer is ignored, as fma-rc reads it +- [NGS2 custom mastering rack](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native, rack 0x4003) - follows [fma-rc's reading of the 12.70 module](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943): option size is 0x508, matching the custom submixer rack layout. Creation returns `0x804A8052` above 37 channels; channels 9 to 37 throw because voices hold at most 8 channels. Mastering racks with modules throw: attached modules and non-default option fields are unverified on PS5. Voice control parameters 0x40030000 (setup), 0x40030004 (gain) and 0x40030005 (output) configure channels, levels and destination buffer. `sceNgs2VoiceGetState` fills common voice state flags. PPSA10278 and PPSA04540 create rack 0x4003 without modules (#8039) - [NGS2 custom rack buffers and channels](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, racks 0x4001 and 0x4002) - racks with 2 to 4 buffers, custom submixers with 9 to 37 channels and submixer `max_inputs` other than 1 or 2 throw: how modules and ports route several buffers is unknown, and voices hold at most 8 channels. Per [fma-rc's reading of the 12.70 module](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6294323150), creation returns `0x804A830B` for a buffer count outside 1 to 4 or below the submixer's `max_inputs`, `0x804A8306` for a module source, extra or dest buffer id at or above the count, and `0x804A8052` for more than 37 submixer channels; the check order is not known. `sceNgs2RackQueryBufferSize` throws for these options, as no source says whether it checks them. A port buffer id other than 0 throws. PPSA04540 creates racks with up to 4 buffers and a 16-channel custom submixer (#8039) - [NGS2 reverb rack](../../../core/libs/prx/libSceNgs2.native/src/Reverb.cpp) (libSceNgs2.native, rack 0x2001) - follows the PS4 firmware 11.00 `libSceNgs2.sprx`, read and checked against its output at 11.025 to 48 kHz, including parameter changes during playback (differences at float rounding level); not yet compared with the PS5 library. Structure layouts come from [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_reverb.h` and the param ids 0x20010000 (setup) and 0x20010001 (I3DL2) from PPSA22520. Only the default `reverb_size` of 1 is handled, with its 14400-sample reflection buffer; other sizes and the library's half-rate mode throw. System sample rates below about 7.5 kHz, where an allpass delay would have no samples, throw. Setup only accepts equal input and output channel counts - [sceNgs2ReportRegisterHandler, sceNgs2ReportUnregisterHandler](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native, NIDs `uBIN24Tv2MI`, `nPzb7Ly-VjE`) keep a registry of report handlers. Register rejects a null handler with an invalid argument and returns `INVALID_OUT_ADDRESS` for a null out handle, then stores the report type, handler and user data under a freshly allocated opaque handle; unregister removes and frees the matching record and throws for a handle that is not registered. The signatures (report type, handler, user data, out handle) and (report handle) follow [SharpProspero](https://github.com/SvenGDK/SharpProspero) and [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_report.h`, and the 24-byte `Ngs2ReportDataHeader` passed to a handler is its `OrbisNgs2ReportDataHeader`. No report is produced yet, so no registered handler is ever invoked and PPSA04540, which imports both and registers a CPU load handler (type 5), still receives none. From 99abd2604d53b7588b6386de012527c60ad6dcc7 Mon Sep 17 00:00:00 2001 From: JJenkx Date: Fri, 23 Oct 2026 12:23:03 -0400 Subject: [PATCH 113/113] fix(libc): compute expm1 with FreeBSD msun's algorithm, as titles' libc.prx does expm1 returned the host's expm1, whose last bit differs from the titles' copy on Windows on 35,152,346 of 320 million random arguments. The titles' copy is FreeBSD msun's s_expm1.c, and it sets ERANGE only when a finite argument overflows to infinity. expm1 now computes that algorithm and sets ERANGE there. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libc/src/Math.cpp | 100 +++++++++++++++++++++++++++++++- core/libs/tests/GuestMath.cpp | 30 ++++++++++ docs/dev/debt/libc.md | 1 + 3 files changed, 130 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libc/src/Math.cpp b/core/libs/prx/libc/src/Math.cpp index 0b767ede8c..0a834bdebc 100644 --- a/core/libs/prx/libc/src/Math.cpp +++ b/core/libs/prx/libc/src/Math.cpp @@ -462,7 +462,105 @@ double APS5_VABI log2_nid_postfix(double x) { return std::log2(x); } double APS5_VABI log_nid_postfix(double x) { return std::log(x); } double APS5_VABI log1p_nid_postfix(double x) { return std::log1p(x); } float APS5_VABI log1pf_nid_postfix(float x) { return std::log1p(x); } -double APS5_VABI expm1_nid_postfix(double x) { return std::expm1(x); } +static double Expm1(double x) { + const double tiny = 1.0e-300; + const double o_threshold = 7.09782712893383973096e+02; + const double ln2_hi = 6.93147180369123816490e-01; + const double ln2_lo = 1.90821492927058770002e-10; + const double invln2 = 1.44269504088896338700e+00; + const double Q1 = -3.33333333333331316428e-02; + const double Q2 = 1.58730158725481460165e-03; + const double Q3 = -7.93650757867487942473e-05; + const double Q4 = 4.00821782732936239552e-06; + const double Q5 = -2.01099218183624371326e-07; + static volatile double huge = 1.0e+300; + const std::uint64_t bits = std::bit_cast(x); + std::uint32_t hx = static_cast(bits >> 32); + const std::uint32_t xsb = hx & 0x80000000u; + hx &= 0x7fffffff; + if (hx >= 0x4043687a) { + if (hx >= 0x40862e42) { + if (hx >= 0x7ff00000) { + if (((hx & 0xfffff) | static_cast(bits)) != 0) return x + x; + return xsb == 0 ? x : -1.0; + } + if (x > o_threshold) return huge * huge; + } + if (xsb != 0 && x + tiny < 0.0) return tiny - 1.0; + } + double c = 0.0; + std::int32_t k; + if (hx > 0x3fd62e42) { + double hi; + double lo; + if (hx < 0x3ff0a2b2) { + if (xsb == 0) { + hi = x - ln2_hi; + lo = ln2_lo; + k = 1; + } else { + hi = x + ln2_hi; + lo = -ln2_lo; + k = -1; + } + } else { + k = static_cast(invln2 * x + (xsb == 0 ? 0.5 : -0.5)); + const double t = k; + hi = x - t * ln2_hi; + lo = t * ln2_lo; + } + x = hi - lo; + c = (hi - x) - lo; + } else if (hx < 0x3c900000) { + const double t = huge + x; + return x - (t - (huge + x)); + } else { + k = 0; + } + const double hfx = 0.5 * x; + const double hxs = x * hfx; + const double r1 = 1.0 + hxs * (Q1 + hxs * (Q2 + hxs * (Q3 + hxs * (Q4 + hxs * Q5)))); + double t = 3.0 - r1 * hfx; + double e = hxs * ((r1 - t) / (6.0 - x * t)); + if (k == 0) return x - (x * e - hxs); + const double twopk = std::bit_cast(static_cast(static_cast(0x3ff + k) << 20) << 32); + e = (x * (e - c) - c); + e -= hxs; + if (k == -1) return 0.5 * (x - e) - 0.5; + if (k == 1) { + if (x < -0.25) return -2.0 * (e - (x + 0.5)); + return 1.0 + 2.0 * (x - e); + } + double y; + if (k <= -2 || k > 56) { + y = 1.0 - (e - x); + if (k == 1024) { + y = y * 2.0 * 0x1p1023; + } else { + y = y * twopk; + } + return y - 1.0; + } + if (k < 20) { + t = std::bit_cast(static_cast(0x3ff00000u - (0x200000u >> k)) << 32); + y = t - (e - x); + y = y * twopk; + } else { + t = std::bit_cast(static_cast(static_cast((0x3ff - k) << 20)) << 32); + y = x - (e + t); + y += 1.0; + y = y * twopk; + } + return y; +} + +double APS5_VABI expm1_nid_postfix(double x) { + const double result = Expm1(x); + if (std::isinf(result) && std::isfinite(x)) { + errno = ERANGE; + } + return result; +} float APS5_VABI expm1f_nid_postfix(float x) { return std::expm1(x); } float APS5_VABI erff_nid_postfix(float x) { return std::erf(x); } double APS5_VABI erf_nid_postfix(double x) { return std::erf(x); } diff --git a/core/libs/tests/GuestMath.cpp b/core/libs/tests/GuestMath.cpp index 48f7a6d643..161769a12f 100644 --- a/core/libs/tests/GuestMath.cpp +++ b/core/libs/tests/GuestMath.cpp @@ -683,6 +683,35 @@ static long double MakeExtended(std::uint64_t mantissa, std::uint16_t signExpone return value; } +static void CheckExpm1ConsoleBits() { + constexpr struct { + std::uint64_t input; + std::uint64_t expected; + int error; + } cases[] = { + {0x0000000000000000ull, 0x0000000000000000ull, 0}, {0x8000000000000000ull, 0x8000000000000000ull, 0}, + {0x3c8fffffffffffffull, 0x3c8fffffffffffffull, 0}, {0x3c90000000000000ull, 0x3c90000000000000ull, 0}, + {0x3fd62e42fefa39efull, 0x3fda827999fcef32ull, 0}, {0x3fd62e4300000000ull, 0x3fda82799b6f2366ull, 0}, + {0x3ff0a2b1ffffffffull, 0x3ffd413c1a24d411ull, 0}, {0x3ff0a2b200000000ull, 0x3ffd413c1a24d414ull, 0}, + {0xbfd0000000000000ull, 0xbfcc5041854df7d4ull, 0}, {0xbfe0000000000000ull, 0xbfd92e9a0720d3ecull, 0}, + {0x3ff0000000000000ull, 0x3ffb7e151628aed2ull, 0}, {0xbff0000000000000ull, 0xbfe43a54e4e98864ull, 0}, + {0x4043687a00000000ull, 0x436fffd8395c0c41ull, 0}, {0xc043687a00000000ull, 0xbff0000000000000ull, 0}, + {0x4049000000000000ull, 0x44719103e4080b45ull, 0}, {0x40862e42fefa39efull, 0x7fefffffffffff2aull, 0}, + {0x40862e42fefa39f0ull, 0x7ff0000000000000ull, ERANGE}, {0xc08f400000000000ull, 0xbff0000000000000ull, 0}, + {0x7fefffffffffffffull, 0x7ff0000000000000ull, ERANGE}, {0xffefffffffffffffull, 0xbff0000000000000ull, 0}, + {0x7ff0000000000000ull, 0x7ff0000000000000ull, 0}, {0xfff0000000000000ull, 0xbff0000000000000ull, 0}, + {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0}, {0xfff8000000000002ull, 0xfff8000000000002ull, 0}, + {0x3fc78b9e474afed8ull, 0x3fc9d99e60806b35ull, 0}, {0xbf887a99bea50fb1ull, 0xbf88554c5b9d0cbbull, 0}, + {0x3ff790fb0ae85390ull, 0x400ae5103402894bull, 0}, {0xbf840fe48e07e54dull, 0xbf83f6d1bcda4943ull, 0}, + {0xbfbb1276066a31c7ull, 0xbfb9b098289dab68ull, 0}, {0x3fc07bc20a0c887eull, 0x3fc197828317c86cull, 0}, + }; + for (const auto& item : cases) { + errno = 1234; + Require(std::bit_cast(expm1_nid_postfix(std::bit_cast(item.input))) == item.expected); + Require(errno == (item.error != 0 ? item.error : 1234)); + } +} + static void CheckAsinl() { const struct { std::uint64_t inputMantissa; std::uint16_t inputSignExponent; std::uint64_t outputMantissa; std::uint16_t outputSignExponent; } cases[] = { {0, 0x0000, 0, 0x0000}, {0, 0x8000, 0, 0x8000}, @@ -1639,6 +1668,7 @@ int main() { CheckFegetenv(); CheckLongDouble(); CheckNearbyintl(); + CheckExpm1ConsoleBits(); CheckAsinl(); Require(scalbn_nid_postfix(0.75, -2) == 0.1875); Require(scalbnf_nid_postfix(0.75f, 4) == 12.f); diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md index df30d4bf18..d40c2e0402 100644 --- a/docs/dev/debt/libc.md +++ b/docs/dev/debt/libc.md @@ -97,6 +97,7 @@ - [seed48 and lcong48](../../../core/libs/prx/libc/src/Random.cpp) (libSceLibcInternal, implemented in libc) follow the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x6F460 and 0x6F420): the multiplier and addend are shared by the whole `rand48` family, including `erand48`, `nrand48` and `jrand48` on a caller's seed; `lcong48` sets them with the seed, and `srand48` and `seed48` restore 0x5DEECE66D and 0xB. Unlike FreeBSD, `seed48` returns a static copy of the new seed rather than the previous one. A null argument, which the console dereferences, throws - [lgamma and signgam](../../../core/libs/prx/libc/src/Math.cpp) (libc) - `lgamma` returns the host's `lgamma` and stores the sign of Γ(x) in the exported `signgam` (NID `5gOOC0kzW0c`, starting at 0 as in FreeBSD 11's [`s_signgam.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/msun/src/s_signgam.c)) by the rules of [`e_lgamma_r.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/msun/src/e_lgamma_r.c): -1 for -0 and for a negative non-integer whose floor is odd, 1 otherwise, including poles, infinities and NaN. Taken from the FreeBSD source, not measured on the console. The NID is in the aerolib symbol list; no title is known to read `signgam`. PPSA99004 imports `lgamma` - [coshf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows FreeBSD msun's [`e_coshf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_coshf.c), using the `expm1f` and `expf` paths already inlined for `sinhf` below; the Windows UCRT differed from the `libc.prx` copies in PPSA07923 and PPSA13934 on 500,554 and 500,614 of 20 million inputs in the #9707 survey. The exact system `libSceLibcInternal` behavior and the FMA-contracted `libc.prx` results remain unverified +- [expm1](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_expm1.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_expm1.c) with `huge` read at run time, and sets `ERANGE` only when a finite argument overflows to infinity, as the titles' `libc.prx` does. It gives the same bits and `errno` as the `expm1` bundled with PPSA07923 and PPSA05916 on 320 million random and 47,222 structured arguments on a Windows host; the FMA-contracted build bundled with PPSA13934 differs on 43,433 of the random ones. - [sinhf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `sinhf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_sinhf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_sinhf.c) from before `__ldexp_expf`, which squares `expf(|x| / 2)` between `logf(FLT_MAX)` and the overflow threshold, calling msun's [`expm1f`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/s_expm1f.c) and [`expf`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/e_expf.c), whose paths for the arguments it passes are inlined here. Past the threshold Sony's error helper sets `errno` to `ERANGE` before returning `x * 1e37`; msun itself sets no `errno`. That code, run on a Windows host, gives the same bits as this implementation for every finite argument up to the threshold, of both signs; it was not run on Linux. That the system `libSceLibcInternal`, which Ruffle (PPSA68091) and RetroArch (PPSA99169) import while bundling a zero-return `libc.prx`, has the same code is assumed - [acoshl, asinhl, atanhl, atan2l, cbrtl, erfl, erfcl, expm1l, hypotl, log1pl, log2l, lgammal, tgammal, j0f, j1f, jnf, y0f, y1f and ynf](../../../core/libs/prx/libc/src/Math.cpp) (libc) return the host C library's results (the float Bessel functions through its double ones), not those of the console's own code, so the last bits can differ (`y0f`, `y1f`, `ynf` follow the console at `+-0`). As in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x56410), `lgammal` does not store the sign in `signgam`; `hypotl` returns infinity for an infinite argument even when the other is a NaN, as C11 F.10.4.3 requires. [hypot3, hypot3f and hypot3l](../../../core/libs/prx/libc/src/Math.cpp) follow that module (0x51D30, 0x520D0, 0x52420): the first NaN of x, y and z is returned unchanged, any infinity gives positive infinity, a zero argument gives the two-argument hypot of the other two, and otherwise the largest magnitude is combined with the hypot of the other two - [asinl](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `asinl` of the `libc.prx` bundled with PPSA28319 (disassembly), FreeBSD msun's [`e_asinl.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/src/e_asinl.c) with the ld80 [`invtrig.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/ld80/invtrig.c) coefficients, which the binary holds as the same 80-bit constants. For |x| > 1, the infinities and NaN, Sony's error helper raises `FE_INVALID` and sets `errno` to `EDOM` before returning `(x - x) / (x - x)`, so a NaN argument also sets `EDOM`; msun itself sets no `errno`. 20 million random arguments in (-1, 1) give the same bits as that code run on a Windows host. The result needs the x87 precision control at 64 bits, as FreeBSD amd64 starts threads (control word `0x37f`), but guest threads do not set it: on Windows a thread started by `_beginthreadex` runs at 53 bits (`0x27f`), where `asinl(0.75)` returns mantissa `0xd91a98ae3406e000` instead of `0xd91a98ae3406e041`. The system `libSceLibcInternal` that RetroArch (PPSA99169) imports is assumed to have the same code