ui_enable_heaac was ignored and FFmpeg applied Parametric Stereo, so an
HE-AAC v2 stream decoded to 48 kHz stereo whatever the flag: 2048
samples in 2 channels per frame, and ERROR_INVALID_PCM_SIZE for a PCM
buffer sized for the console's output. The console returns the 24 kHz
mono core with HE-AAC disabled, and SBR output at 48 kHz in one channel
with it enabled.
AAC access units now reach FFmpeg without their ADTS header, with an
AudioSpecificConfig built from the header or from the raw parameters.
With HE-AAC disabled it signals SBR as absent. With HE-AAC enabled SBR
stays implicit, and a mono stream that FFmpeg decodes to two channels
is reopened with SBR present and Parametric Stereo absent. The new test
decodes fdk-aac HE-AAC v2 and HE-AAC stereo streams, ADTS and raw, with
HE-AAC on and off; it aborts on main.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Implements connection lifecycle and parameter exports in libSceSsl:
sceSslCreateConnection, sceSslConnect, sceSslRead, sceSslWrite,
sceSslDeleteConnection, and sceSslSetVerifyCallback.
The repository has no TLS client, so a connection records its context,
socket, host and verification callback:
- sceSslCreateConnection returns a new connection id, or
SSL_ERROR_INVALID_ID (0x8095F006) for an unknown context. A null host throws.
- sceSslDeleteConnection drops the connection and leaves socket open.
- sceSslSetVerifyCallback stores the callback and argument.
- sceSslConnect, sceSslRead and sceSslWrite throw where handshake starts,
naming the host and the socket peer port.
Carried from @screamm with author attribution preserved.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
A draw with VGT_TF_PARAM.PARTITIONING 0 (PART_INTEGER) was refused by the
state decoder and its hull and domain programs by the recompiler. It is now
drawn with Vulkan's equal spacing, the mode radeonsi programs as
PART_INTEGER, with tessellation factors bounded at 64 instead of
fractional-odd's 63. Power-of-two and fractional-even partitioning still
throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on a PS5 (firmware 13.60): before sceUserServiceInitialize and
after sceUserServiceTerminate, the login list, the event poll and
Terminate return NOT_INITIALIZED (0x80960002); a second Initialize
returns ALREADY_INITIALIZED (0x80960003); a new initialization reports
the initial user's login again.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on a PS5 (firmware 13.60): a thread created with
PTHREAD_INHERIT_SCHED, a null attribute or a default attribute runs at
its creator's priority, whatever priority the attribute holds; with
explicit scheduling it takes the attribute's priority.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
With --trace-imports the entry stub resolves TraceImport_nid_no_patch
in libc.prx and passes each function import through it before writing
the slot: every PLT slot, and a GOT slot only when the original symbol
is a function, so data imports such as __stdoutp keep their address.
Without the option the output is unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FFmpeg resamples narrowband SILK (TOC configurations 0-3) from 8 kHz and
holds back 24 samples of the first narrowband packet after the decoder
starts or after a packet of another bandwidth: a 20 ms packet decodes to
936 samples and the next wider packet to 984. sceOpusDecDecode required
exactly the packet's duration and threw, so ProsperoRadio aborted on a
narrowband Opus station.
The decoder now keeps FFmpeg's output in a queue and returns exactly the
packet's duration, as libopus does: the first narrowband packet starts
with 24 samples of silence and the held-back samples follow in the next
calls. The new test decodes three libopus 6 kb/s narrowband packets and
a wideband packet after them; it aborts on main.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The JpegDec structures were libScePngDec's under new names. OpenOrbis
jpeg.h and SharpProspero JpegDec.cs agree on a 12-byte create param, a
0x30-byte decode param with a coefficient buffer, decode mode and down
scale, and a 0x24-byte image info that reports the coefficient memory
size, the suitable CSC attribute and the output size.
Accept the CSC attributes 1 and 2 that SharpProspero passes, fill the
output size, component count, coefficient memory size and suitable
attribute, apply the requested alpha, and throw for decode modes other
than 0 and down scales other than 1.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
sceNetCtlGetState reports IPOBTAINED from the host's addresses, but
sceNetCtlGetInfo returned NOT_CONNECTED for every code. It now answers
from the host interface that holds an IPv4 address, preferring the one
with the default route: its address, netmask, gateway, MTU and DNS
servers. The link is presented as wired, connected, configured by DHCP
and without a proxy, with the Ethernet address sceNetGetMacAddress
reports. A null info returns INVALID_ADDR and a code outside 1..21
INVALID_CODE; the Wi-Fi, DHCP host name, PPPoE and proxy server codes
throw.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
sceCoredumpAttachUserFile (5nc2gdLNsok) and
sceCoredumpAttachMemoryRegionAsUserFile (MEJ7tc7ThwM) get the
signatures of Orbital's db_types.json (cc408367) and SharpProspero's
KernelSystem.cs (5dfdb4b0): (uint32_t userValue, const char* path) and
(uint32_t userValue, const void* mem, size_t size, const char* name).
The handler is never invoked here, so both return
SCE_COREDUMP_ERROR_NOT_IN_COREDUMP_HANDLER (0x81180003, shadPS4
coredump_error.h e0a46675) and attach nothing; a null path or name and
a null, empty or wrapping region throw because the order of the
console's checks is unknown.
Carried from @screamm with author attribution preserved.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
PPSA99058 and PPSA99420 import sceKernelGetCpuTemperature and sceKernelGetSocSensorTemperature and stop at start-up on main. Read the host CPU/package, board and NVMe sensors (hwmon/thermal on Linux, the ACPI thermal zones and the storage temperature property on Windows) and report an unsupported sensor with EINVAL.
2 Ship 2 Harkinian (PPSA99621) imports fchmodat through std::filesystem::permissions and stops at start-up on main. Resolve AT_FDCWD and absolute paths as usual and join other relative paths to the directory descriptor like openat, accept 0 and AT_SYMLINK_NOFOLLOW, and mask the mode to 07777.
TraceImport_nid_no_patch wraps a function of a library named in
APS5_TRACE_CALLS in a thunk that records the import, the thread and
the caller in a ring and counts the call, then jumps to the function.
One target keeps one thunk, so function pointers compare equal. The
crash and abort reports print the last 64 calls and the 32 most called
imports. Nothing calls TraceImport_nid_no_patch yet.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Porpoise (PPSA99764) stops on its weak chroot import (#3632, #4497).
Run 5 on main c2565f014, and again on a copy of that runtime:
FAIL: unresolved ELF import AKknh8Cx-V8 from libkernel_sys.prx
Its only call is in put_root_back (src/porpoise_jailbreak.cpp,
elripalda/Porpoise-Dolphin-Emulator-for-PS5 2ed1ab5a06995aa1): after a
jailbreak daemon has made the console's root its root and /app0 is
gone, it calls fchdir on the descriptor of "/" it opened at start, then
chroot("."), and checks the result. So it only ever puts back the root
it started in, and it does not use paths under any other root.
On top of the lookup errors of the previous commit, chroot now follows
FreeBSD 11.4 sys_chroot and pwd_chroot (8c639945, vfs_syscalls.c and
kern_descrip.c) for that case: a directory that is the guest root
("/", "/..", "." after fchdir to "/") succeeds without a change, since
fd_rdir would be set to the vnode it already is. The guest is taken
never to have changed its root, so with chroot_allow_open_directories 1
an open directory does not give EPERM. ENAMETOOLONG is added as in
pathconf, and a ".." through a file reports ENOTDIR instead of
escaping as a filesystem_error. Any other directory still throws: the
resolver's root and mount aliases are fixed, and no title is known that
needs a real new root.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Porpoise (PPSA99764) imports chroot (AKknh8Cx-V8) from
libkernel_sys.prx, not libkernel.prx, one reference. Predicted stop
once pathconf, the pthread_attr calls and ftrylockfile ahead of it are
covered (not a run):
FAIL: unresolved ELF import AKknh8Cx-V8 from libkernel_sys.prx
The NID is computed with tools/nid_names.py and matches aerolib.
Follows FreeBSD 11.4 sys/kern/vfs_syscalls.c sys_chroot and change_dir
(8c639945a44588f6cfdddfb057bb5aad88735da0) for a root caller up to the
lookup: EFAULT for a null path, ENOENT for an empty or missing one,
ENOTDIR for a file or a path through a file. A directory that is found
throws with the path named: the resolver's root is fixed and the mount
aliases (/app0, /savedata0) are host paths that do not move with it,
so it cannot be re-based, and a real chroot is not modelled. Nothing
shows that Porpoise calls it.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
The console's mouse reports relative motion, so the host cursor can never line
up with the cursor a title draws. While a title has a mouse open and the
window is focused the host cursor is hidden and captured, released on focus
loss or while the pad's mouse-to-stick toggle is on. Motion deltas are scaled
from the presented image's size in window units to the title's display
resolution with sub-pixel carry, so the title's cursor travels as far as the
host pointer would, on scaled desktops and letterboxed windows alike.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
ioctl() on a file, directory, pipe or character device threw "request
0x20006601 ... is not implemented" for FIOCLEX, and the same for
FIONCLEX, although the close-on-exec flag they change is already kept
for these descriptors and reported by fcntl(F_GETFD).
FreeBSD 11.4 handles both requests in kern_ioctl() for every descriptor,
before the request reaches the file's own ioctl, by changing the flag
F_GETFD reads. sys/kern/sys_generic.c, kern_ioctl():
case FIONCLEX:
fdp->fd_ofiles[fd].fde_flags &= ~UF_EXCLOSE;
goto out;
case FIOCLEX:
fdp->fd_ofiles[fd].fde_flags |= UF_EXCLOSE;
goto out;
sys/kern/kern_descrip.c, kern_fcntl():
case F_GETFD:
...
td->td_retval[0] =
(fde->fde_flags & UF_EXCLOSE) ? FD_CLOEXEC : 0;
Both requests now set or clear that flag and return 0. libuv before 1.44
sets close-on-exec this way on FreeBSD (uv__cloexec_ioctl).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PS5MC (PPSA99420, Kodi 22) imports clock_settime (d7nUj1LOdDU) from
libkernel.prx, one reference, after sigwaitinfo in its import order.
Predicted stop once the imports ahead of it are covered (not a run):
FAIL: unresolved ELF import d7nUj1LOdDU from libkernel.prx
The NID is computed with tools/nid_names.py and matches aerolib.
Follows FreeBSD 11.4 sys/kern/kern_time.c sys_clock_settime and
kern_clock_settime (8c639945a44588f6cfdddfb057bb5aad88735da0) for a
root caller: EFAULT for a null time (copyin), EINVAL for any clock but
CLOCK_REALTIME and for a negative tv_sec or a tv_nsec outside 0 to
999999999. A valid CLOCK_REALTIME request throws with the requested
time named, since the host clock must not be set and no guest clock
offset is kept.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Co-authored-by: David <[email protected]>
The Python in PS5MC (PPSA99420) reads sysconf(_SC_CLK_TCK) while
importing its posix module and failed with "cannot read
ticks_per_second". It returns FreeBSD's CLK_TCK, 128.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A flip packet now delivers the queue's end-of-pipe event once the work
recorded before it completes, as a RELEASE_MEM with INT_SEL does. Minecraft
(PPSA17221) registers the graphics event, never requests an interrupt in its
releases, and waits on the event after every flip while holding its render
lock, so it presented one frame and then waited forever.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
image_sample_d and image_sample_cd on a cube pass their gradients through the
same conversion as the face coordinates, which subtracts 1.0 to move AMD's
[1, 2] face range to [0, 1]. A gradient is a difference of coordinates, so the
bias turned a one-texel gradient into one of about -1 and the sample read the
smallest mip. Gradients now skip the bias.
agc_driver_image_sample_cube_derivatives samples every face of a 16x16 cube at
five levels through image_sample_d and checks the level and face it read.
TechnicalDebt records that the gradient handling follows Mesa and was not
measured on hardware.
