The second queue that settles imports is always created on Windows, and a device without one keeps
the comparisons. The other-family settle path is tested through the recorder test device built
with its settle queue on another family (agc_import_watch_other_family) instead of
APS5_SETTLE_OTHER_FAMILY.
The settle read keeps a private import's window open for one round trip on the settle queue, so a
store from another thread can land inside it. CheckImportWindowOtherThread: a store of new bytes from
another thread within the window counts as written, and a same-value one keeps its possible CPU
touch. The debt entry notes the longer window.
On Windows a host import without a section alias left guest write tracking, and its changes were
found by comparison. Since resident direct memory became private MEM_WRITE_WATCH memory, its
imports take that path, and every storage-texture refresh over it compares its whole snapshot.
ProbeImportWriteProtection gets a Windows body on MEM_WRITE_WATCH scratch memory, and
decideImportWatch keeps direct imports of private read-write memory watched when GetWriteWatch
stays honest after an import's first GPU use. The driver marks every imported page written until
that use completes, so each such import is settled inside ImportWatched's window by a 4-byte read on
a second queue of the graphics family (the imports lock comes after GpuMutex, so the main queue
cannot be used there). APS5_NO_WATCHED_PRIVATE_IMPORTS=1 keeps the comparisons.
On a new knote EV_FORCEONESHOT is dropped from the flags; on an
existing one it sets EV_ONESHOT and fires the knote, as
kqueue_register does at l.1339-1341. A modify no longer ORs
EV_ONESHOT, EV_CLEAR or EV_DISPATCH into the knote.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
A knote registered or modified with EV_DISABLE stays registered but is
not polled, fired or reported until an EV_ENABLE change re-arms it, as
kern_event.c does with KN_DISABLED. EV_DISPATCH reports an event once
and then disables the knote, and EV_FORCEONESHOT registers as oneshot.
A negative nevents fails with EINVAL instead of throwing.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Account id 0 or a null output returns SCE_NP_ERROR_INVALID_ARGUMENT;
otherwise the always signed-out NP returns SCE_NP_ERROR_SIGNED_OUT, as
sceNpGetAccountIdA does. PPSA14632 imports it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Since #5056, sceNetCtlGetInfo throws for every info code it does not
model. Ghost of Yotei (PPSA26344) asks for code 12, the DHCP host name,
during boot and now aborts one second in.
The configuration #5056 reports (wired, DHCP, HTTP proxy off) sets no
DHCP host name, no PPPoE user name and no proxy server, so codes 12, 13
and 20 now return 0 with an empty string. The Wi-Fi codes (5-10) and
the proxy port (21) still throw. GuestNetCtl checks the three empty
answers and keeps the throw check for the rest; the libSceNetCtl debt
line says the same.
The relative vector addressing entry still said every window register
lives in one function-scope array. It now describes the array of the
bounded slots, the per-slot variables, the OpSwitch fallback and
APS5_NO_WINDOW_NARROWING, with the RTX 3060 measurement.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Uzy15wqYTt6iWyxYXEzUWo
Since #757, a T# loaded from a buffer heap at a runtime offset is an
image table column, and every capture snapshots the whole heap, up to
65,536 records, even when user data or an SRT read fixes the offset.
When the T#'s eight dwords and its offset are runtime values the SRT
walker evaluates, the column is now selected: the offset is kept as a
descriptor source, the shader indexes entry 0, and the snapshot reads
only the record at the evaluated offset, with the heap base moved to
that record.
The column keeps a table's semantics. An invalid T#, an unmapped record
or an offset that carries past 32 bits is poison that faults only when a
lane selects it; an offset the walker cannot read faults the table
instead of throwing; the record's mode is picked per entry, so no
pipeline variant is added; and a dispatch that writes the record faults
it as written by its dispatch. Dwords past the heap read zeros, as the
scalar loads would, and a record past the key cap is read rather than
poisoned.
A column stays a whole table when its offset is chosen per lane, or when
the shader may write the memory the offset is read from at run time: the
buffer it is read from (by V#), or any memory when the read or a write
goes through a pointer or a GPU-only descriptor. Samplers are unchanged:
an S# the walker evaluates is already a direct sampler. The plan stores
the selection, so the disk cache format is 36.
Five agc_shader_memory and agc_shader_bindless checks asserted the old
planning and now assert the selected record:
- "image table SRT key": a key read through the SRT narrowed a 4-key
table to records 0 and 2. It now selects record 2 alone, captures no
other record, and a changed key moves the capture without changing the
module or its disk key.
- "image table key union" and "image table late key": two keys of one
heap shared one column with two value key domains. Each key now
selects its own record, as two one-record tables.
- "image table unkeyed access": a read keyed through the SRT shared a
whole column with a read keyed per lane. The first now selects its
record; the second keeps the whole, unnarrowed table.
- "uniform table image": the T# at a user data offset was one key of a
full table. It is now the one selected record, and the record the user
data does not select is not read.
A value key domain only arises for a key the walker evaluates, so it no
longer narrows an image column; key buffer domains (keys loaded per
lane) still do.
Return the RLIMIT_NOFILE soft limit that getrlimit reports, capped at INT_MAX: FreeBSD sys_getdtablesize returns the smaller of that limit and maxfilesperproc, and the guest limit never exceeds the hard limit that bounds it here. The guest test now asserts the value instead of the throw, and the debt entry records the semantics.
A draw with PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES 2 (4x) and MSAA_ENABLE
clear into a 4x depth/stencil and color pair threw "multisampled
targets rasterized without MSAA_ENABLE are unsupported for points,
lines, a depth target or alpha-to-coverage", which stops METAL GEAR
SOLID: Peace Walker (PPSA18216) at its first presentation (draw B on
#5268). A depth target with the same sample count now gets the same
pixel center samples as the color targets, so each depth and stencil
sample is tested and written with the depth at the pixel center, as GL
allows when multisampling is disabled.
DB_EQAA Z interpolation or overrasterization and a sample-mask export
with a depth target throw on this path.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Decode the four PA_SC_AA_MASK fields at the rasterized sample count. Use the native Vulkan mask when all four pixels agree and apply varying masks in the fragment shader, preserving helpers and combining coverage with alpha-to-coverage and shader mask exports. Add the normalized masks to pipeline, draw and shader keys and the versioned replay request.
Refuse unsupported conservative-raster, centroid and early depth/stencil memory-write cases. Synthetic readbacks cover driver submission, depth/stencil suppression, fragment stores and one-sample and four-sample coverage.
Reject native sampled views of the depth image attached by the same draw before pipeline creation. Keep unrelated views, other devices and the single-sample path unaffected. Add unrun native-view refusal and scope controls; full dependency-stack build and runtime validation remain pending.
Adapt our preserved native-depth sampling work from c0d9edf and sample-aware footprint work from 6e35a877, retaining creation-time coherence and initial HTILE proof. The descriptor interface in upstream PR 4820 remains a separate prerequisite. This source draft has not been built or run.
Follows mlockall (#4386) for XPSemu (PPSA97358, QEMU os-posix.c), which
imports munlockall (NpLBpgVV7PU) from libkernel.prx. Predicted stop:
FAIL: unresolved ELF import NpLBpgVV7PU from libkernel.prx
The NID is computed with tools/nid_names.py and matches aerolib.
Follows FreeBSD 11.4 sys/vm/vm_mmap.c sys_munlockall
(8c639945a44588f6cfdddfb057bb5aad88735da0): checks PRIV_VM_MUNLOCK,
clears wire state and returns 0. To match, munlockall unlocks ranges
locked by mlock (through VirtualUnlock on Windows, tolerating
ERROR_NOT_LOCKED, and munlockall on Linux).
Implement __modti3, the signed 128-bit integer modulo runtime helper complementing __divti3, __udivti3 and __umodti3. Add unit test coverage in guest_crt_tests and document zero-divisor exception behavior in technical debt.
A dump is fully installed, so scePlayGoGetSupportedOptionalChunk and
scePlayGoGetOptionalChunk report every optional chunk (language pack) like
scePlayGoGetLanguageMask reports every language. They returned an empty
bitmask, so PPSA01748 hid every text language its playgo-scenario.json
lists as a chunk language, English included.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceNpRegisterStateCallback and sceNpRegisterStateCallbackA stored nothing,
the unregister calls always succeeded and sceNpCheckCallback did nothing,
so a title that waits for its NP state callback never learned the user's
state. #1277 reports that Minecraft Preview (PPSA19639) needs the callback
(stop 2).
sceNpRegisterStateCallbackA now keeps up to 8 callbacks and returns the
slot plus 1. A null callback returns INVALID_ARGUMENT, a callback that is
already registered CALLBACK_ALREADY_REGISTERED and a ninth one
CALLBACK_MAX (0x8055001D). sceNpUnregisterStateCallbackA returns
INVALID_ARGUMENT for an id outside 1..8 and CALLBACK_NOT_REGISTERED for an
empty slot. The legacy sceNpRegisterStateCallback keeps one callback with
the same errors. The rules follow shadPS4
src/core/libraries/np/np_manager.cpp @15abf68c9b52 (RegisterStateCallbackA
and UnregisterStateCallbackAById L857-L901, the legacy pair L981-L1005,
ORBIS_NP_STATE_CALLBACK_MAX L36) and np_error.h L38.
Each registration is marked pending. sceNpCheckCallback takes the pending
registrations under the lock and calls them after releasing it, on the
calling thread, with SIGNED_OUT for the initial user 0x10000000. For the A
form this follows KytyPS5 src/libs/network.cpp @9e41d8320a27
(NpRegisterStateCallbackA L4021-L4034 marks the registration pending,
NpCheckCallback L3959-L3974 delivers it once). KytyPS5 never calls the
legacy callback (NpRegisterStateCallback and NpUnregisterStateCallback,
L4009-L4019, do nothing). The legacy callback is called as
(user, SIGNED_OUT, nullptr, userdata), as in shadPS4, which passes an NpId
only for SIGNED_IN (L823, L938-L940).
shadPS4 queues SIGNED_OUT from the user service login event instead
(DispatchPendingNpStateCallbacks L903-L962), and the same event calls the
reachability callback once with UNAVAILABLE (L922-L931, L959-L961). The
reachability callback is still not called here. These differences and the
unmeasured console behaviour are recorded in
docs/dev/debt/libSceNpManager.md.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
EVENT_WRITE (PM4 opcode 0x46) with event type SAMPLE_STREAMOUTSTATS1-3
(0x01-0x03) or SAMPLE_STREAMOUTSTATS (0x20) failed submission validation
with "EVENT_WRITE event type 1 is not implemented". Minecraft Preview
(PPSA19639, discussion #1277, stop 9) submits a 2-dword type-1 packet
while entering a world, and the GPU thread aborted intermittently.
The four values are VGT_EVENT_TYPE entries in Linux
drivers/gpu/drm/amd/include/navi10_enum.h L14155-14188 at
0fcb05b72344f40806cbe810de8872f1698bf053.
drivers/gpu/drm/amd/amdgpu/nvd.h L326-347 at the same commit documents
these events only with the sampling index (3, or
EVENT_INDEX__SAMPLE_STREAMOUTSTATS* 8-11 on gfx10), followed by
ADDRESS_LO/HI. The 2-dword index-0 packet has no destination dwords, and
what the CP does with it is neither documented nor measured. AnyPS5 does
not emulate the VGT stream-out counters, so there is nothing to sample.
Packet execution already skips EVENT_WRITE.
These event types are now accepted on the graphics queue as 2-dword
packets with event index 0. The sampling indices 3 and 8-11 throw that
stream-out statistics sampling to memory is not implemented, before the
size and reserved-bit checks. Other indices, other sizes and the compute
queue still throw.
sceAgcDcbEventWrite ignores the address for every event type except 0x38
and 0x39, so a call with one of these event types and an address now
builds a packet that validates and writes nothing. This is recorded in
docs/dev/debt/libSceAgcDriver.md with the unmeasured hardware behaviour.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Josip Parlov