v_cvt_pk_u8_f32 rounds its source in the f32 round mode of FLOAT_MODE
and flushes a denormal source when f32 denormals are flushed, as
measured on RDNA2 (gfx1030). It was always rounded to nearest even, so
the three directed modes gave wrong bytes for non-integer sources.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A custom submixer rack now accepts the Gain module (0x15). Its voice
parameter 0x40001500 | module index sets one linear level per channel
(37 levels, default 0), and each grain multiplies the voice's samples
by a level that ramps linearly from the previous one to the new one,
following fma-rc's reading of the PS5 12.70 module (#8039). Gain on a
custom sampler rack, whose parameter index is offset, still throws, as
do levels outside -32 to 32.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Since #8162 a --module-dir module that the executable needs is deferred
on Windows: the entry stub maps it and the title starts it with
sceKernelLoadStartModule. A module the executable imports from but the
title never loads gets no module_start and no initializers, silently.
The entry stub now prints one line at startup for each deferred guest
module that an import of the executable names. Guest module bytes are
unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Write the low 32 bits of the SDK version field at offset 0x10 of the
title's process parameters and return EINVAL (0x80020016) for a null
output, following shadPS4.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WYjMwvLdPR8iX8EP8tQYWa
When the startup probe chose the hardware f32 flush, every module declared
DenormFlushToZero 32, also shaders whose FLOAT_MODE keeps f32 denormals
(f32 denormal field 1, 2 or 3), so the device flushed what they keep and
DenormPreserve 32 was never declared. The hardware flush now applies to
shaders that flush f32 denormals (field 0, or no float mode); the others
declare DenormPreserve 32 where the device supports it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Both were missing from libkernel.prx, so a title importing either
(dYv-+If2GPk, RRnSj8h8VR4) failed to load. They take a relative timeout
in microseconds and are scePthreadRwlockTimedrdlock and
scePthreadRwlockTimedwrlock with POSIX error numbers; a zero lock is
initialized as by pthread_rwlock_rdlock. The signature comes from
shadPS4, which registers one function for each NID and its
scePthreadRwlockTimed* twin; FreeBSD 11.4 has no such calls. The throwing
libkernel_sys copies are removed, as an export may live in one library
only. Recorded in the libkernel debt file.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Follow FreeBSD 11.4 sys_setresuid and sys_setresgid (sys/kern/kern_prot.c):
accept real, effective, and saved user and group IDs for the guest process,
which is assumed to run as root with IDs 0. Setting an ID to 0 or -1 (unchanged)
is accepted without changing credentials and returns 0; any other value throws.
Cover both in guest_credentials test and update libkernel debt documentation.
tools/hw-oracle needed Linux with ROCm, so Windows measurements went
through private runners. oracle_hip.py assembles and links template.s
kernels with the driver's amd_comgr and dispatches them with its HIP
runtime, with the same rows, padding, dispatch splitting and report as
oracle.c. hw_oracle.py selects it with HW_ORACLE_RUNTIME, by default on
Windows, and loads it in-process so the DLLs are loaded once per run.
The driver's comgr 2.9 numbers its assemble and link actions 0x8 and
0x7, not 0xA and 0x9, so each step tries both and keeps the one that
returns exactly one output of the expected kind.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PS5 3.20 export inventory lists _err, _warn and _getprogname in
libSceLibcInternal next to err, warn and getprogname, with the NIDs
UhKI6z9WWuo, XQFE8Y58WZM and iI6kGxgXzcU. In FreeBSD 11.4 libc the
underscore names are the definitions and the public names are weak
references to them (lib/libc/gen/err.c, lib/libc/gen/getprogname.c),
and libthr interposes none of them, so each pair is one function.
_err and _warn now hand their arguments to verr and vwarn, which use
errno at the call as err and warn do; _getprogname returns
getprogname(). The debt file records that the console's module was not
read.
guest_err checks the _warn and _err text for errno 13 with a formatted
message, that _err passes its status to the err_set_exit hook, and that
_warn without a format returns without calling the hook.
guest_program_name checks that _getprogname returns the current
__progname pointer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PS5 libkernel exports _accept, _bind, _connect, _getdirentries,
_getpeername, _getsockname, _getsockopt, _listen, _recvfrom, _recvmsg,
_sendmsg, _sendto, _setsockopt, _sigaction and _sigsuspend (PS5 3.20
export list, DNNDHH/PS5-3.20_Libs b2a77c0 libkernel.c), and main
exports none of them, so a title importing one fails at startup. Each
now forwards to the export without the underscore, as _close, _ioctl
and _nanosleep already do.
In FreeBSD 11.4 (8c639945a4) these are libc's plain system call
entries: lib/libc/amd64/SYS.h makes bind, getdirentries, getpeername,
getsockname, getsockopt, listen and setsockopt one stub under both
names, and lib/libc/sys/Makefile.inc gives accept, connect, recvfrom,
recvmsg, sendmsg, sendto, sigaction and sigsuspend a separate public
name that goes through libthr's interposing table, which adds the
cancellation points and the sigaction wrapper. The exports without the
underscore have no libthr layer here, so forwarding gives the system
call. docs/dev/debt/libkernel.md records what stays unverified: the
console is not measured, _sigaction shares the handler table of
sigaction, and a null set throws in _sigsuspend as in sigsuspend,
where FreeBSD's system call returns EFAULT.
guest_underscore_entries calls every new export: a loopback TCP
connection, UDP datagrams with scatter, truncation and sender
addresses, a directory listing compared with getdirentries, a SIGTERM
handler set by _sigaction, and a pending SIGUSR1 that _sigsuspend
delivers before returning EINTR with the mask restored. It checks the
errors they pass on (EBADF, EINVAL, EFAULT, ENOPROTOOPT, EOPNOTSUPP)
and that outputs stay untouched on failure.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
lchmod forwards to fchmodat with AT_FDCWD and AT_SYMLINK_NOFOLLOW, as
FreeBSD 11.4's sys_lchmod does. On Linux and Windows, which cannot change
the mode of a symbolic link itself, a symbolic link throws instead of
succeeding without a change.
An RX 6700 XT hands a geometry shader odd strip triangle i as
(i+1, i, i+2) with the last provoking vertex, which is the order the
translator already uses, and since #7374 last mode takes the flat
outputs of the program's primitives from their last index. Keep the
last-mode refusal for fans only, which reach the program as
(i+1, i+2, 0) while the hardware gives (0, i+1, i+2). TEKKEN DARK
RESURRECTION (PPSA31371) stops on such a strip draw.
Co-Authored-By: Claude <[email protected]>
sceCesRefersUcsProfile threw for every code page except 1250, 1251 and
1252. Twenty-seven more now return a profile that sceCesSbcToUtf8,
sceCesUtf8ToSbc and the MBCS context conversions accept: ISO 8859-1,
-2, -4, -5, -9, -10, -13, -14, -15 and -16, code pages 437, 737, 775,
850, 852, 855, 860, 861, 862, 863, 865 and 866, KOI8-R, KOI8-U and
Windows 1254, 1256 and 1258.
SingleByte.hpp holds the high half of each table, taken from the
public mapping files at unicode.org: ISO8859, Microsoft's PC tables,
VENDORS/MISC for KOI8 and Microsoft's best-fit tables for 1254, 1256
and 1258, the same source and derivation as the existing Cp1250 table,
whose high half equals bestfit1250's byte table. Bytes 0x00-0x7F are
unchanged in all of them, and every table maps its 256 bytes to 256
distinct BMP characters. The three existing profiles keep their
tables; one lookup now serves them all.
Profiles whose public table leaves bytes undefined (ISO 8859-3, -6, -7,
-8, -11, code pages 857, 864, 869), maps bytes to private use (874,
1253, 1255, 1257) or has no public table here still throw.
guest_ces checks that each new profile is a distinct, stable pointer,
four bytes per table against the source, a round trip of every byte
through sceCesSbcToUtf8 and sceCesUtf8ToSbc, UNASSIGNED_CODE for a
character outside the table, and a KOI8-R string through an MBCS
context in both directions.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAudioOutSetMainOutput threw "not implemented". In firmware 12.70
the export is `xor eax,eax; ret` (PS5-Audio-Passthrough-Research,
docs/FINDINGS.md line 25 at cf3c921): it reads no argument, changes
nothing and returns 0. It now does the same, defined in AudioOut.cpp
next to the Sys output calls.
Its parameters stay unknown and other firmware versions are
unverified. The debt file records this under Silent stubs, which
check_conventions requires for an export that returns a constant,
in place of the function's unknown-signature line.
The audio_out_sys test checks that the call does not throw and
returns 0; on main both checks fail.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
_openat now opens files as openat does. It reads the mode argument only
when O_CREAT is set, as openat and _open do, and calls openat with the
same descriptor, path, flags and mode, so it returns the same
descriptors and errors.
The PS5 3.20 libkernel_sys export list (DNNDHH/PS5-3.20_Libs) has
_openat, NID bGVEgWXy6dg, as well as openat (A8Yk5AhNDck). In FreeBSD
11.4, _openat is the openat system call stub (lib/libc/sys/Makefile.inc,
amd64/SYS.h) and only libthr's openat adds a cancellation point
(thr_syscalls.c). openat here is not a cancellation point, so
forwarding to it leaves _openat without one, as in FreeBSD.
The openat debt entry now names _openat and no longer says that
O_NOFOLLOW is ignored: open, and so openat, has returned EMLINK for
O_NOFOLLOW on a symbolic link since 9421484572.
The kernel_sys test opens a file through a directory descriptor with
_openat and reads it back, creates one with O_CREAT, O_EXCL and mode
0600, checks outside Windows that it has mode 0600, reopens it for
writing, and checks EEXIST, EINVAL, EBADF and ENOTDIR.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PS5 3.20 export inventory of libSceLibcInternal lists
__inet_ntoa_r next to inet_ntoa_r, and no AnyPS5 library exported it,
so a title importing it could not resolve it. It now runs inet_ntoa_r:
FreeBSD 11.4's arpa/inet.h names the function __inet_ntoa_r, and
inet_ntoa.c makes inet_ntoa_r a weak alias of it.
__inet_addr, __inet_aton and __inet_ntoa are in the same inventory,
but libc already exports them and the relinker also looks up
libSceLibcInternal imports in libc, so they are not added here.
guest_inet_address formats an address through __inet_ntoa_r into a
buffer of exactly the text's size, and checks that a buffer one byte
short is returned unchanged with ENOSPC and that inet_ntoa's buffer is
left alone.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on firmware 13.60: registering an id outside 1 to 31 or one
already registered returns 0x8a6c0033, checked before a null stream,
which returns 0x8a6c0035; unregistering an id outside 1 to 31 returns
0x8a6c0033 and one that is not registered 0x8a6c003a.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A clean resident run was made read-only so that the next collect
could skip GetWriteWatch, and the first guest store into it was
resumed on the guest thread. The exception frame Windows builds for
that fault overwrites the System V red zone below rsp (#361), which
is what #5596 removed for singly mapped direct memory. Resident runs
are now never armed and are collected with GetWriteWatch only.
Refs #9136
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on firmware 13.60: a start whose rounding to 16 KiB overflows
finds nothing, and of two equal free ranges the lowest is returned.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on firmware 13.60: an alignment that is not zero or a power of
two returns EINVAL before anything else; bounds with nothing between
them return ENOMEM, a negative start searches from the bottom, only the
start is rounded up to 16 KiB and the end is used as given; null outputs
are skipped; errors leave both outputs untouched.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceNgs2RackCreate and sceNgs2RackCreateWithAllocator now return the firmware's errors for a custom rack whose buffer count is outside 1 to 4 or below the submixer's max_inputs, whose module buffer id is at or above the count, or whose submixer has more than 37 channels, and for the state sizes of the Gain, Reverb and PitchShift modules, the Reverb option size and word, and the PitchShift option word. Racks that pass these checks with one of these modules or Convolution, with more than one buffer, more than 8 channels or a submixer max_inputs other than 1 or 2 still throw, and so does sceNgs2RackQueryBufferSize for the rejected options.
Nixitov