AppMetadata throws length_error for a title or title ID that does not fit its
buffer, which the title ID lookup did not catch, so a homebrew title with a long
ID made sceConvertKeycodeGetImeKeyboardType throw instead of using the PS5
fallback. Catch it with the other metadata failures and cover oversized,
malformed and missing metadata at the export. sceUserServiceGetKeyboardType also
gets a test that a malformed ANYPS5_LANGUAGE is rejected with the output left
untouched, and the debt entries say so.
A linear color target got a resident image only when its memory already
had a host import (#6892). Every other draw into it was synchronous:
copied in, drawn, waited for on the CPU and copied back. #6892 only
looked the import up because a first version that made it broke
agc_driver_pixel_ancillary_word and agc_driver_pixel_fixed_point_position:
the import over a short-lived block was compared, and the next block
allocated at the same address stayed outside the write watch. A page
committed again inside an excluded block is watched again since #6759.
On a lookup miss the draw now makes the import itself, with the new
ColorTarget requester, when its registered ranges are writable, the
whole import run is write-watched and the import keeps it watched: a
separate alias of shared memory, a direct import of private memory that
settles on Windows (1 MiB or more, when the import probe keeps the
watch and a settle queue exists), or an import the probe keeps watched
on other systems, where a dma-buf import must stay watched too if the
range has shared backing. Private pages that the write watch armed
read-only count as writable when their guest protection is, because the
import opens them (a resident direct-memory run the CPU has not stored
to since its last collect). The gate's scan stops at the first page
that decides a refusal, and a run of private memory whose direct import
would be compared is refused after one page query. A refusal is
remembered for its run until the registry, the committed pages
(Windows) or the write watch change, or a shared alias is mapped over
the run, so a target that stays synchronous costs a lookup per draw.
importRunAt checks this after its remembered failures and refusals and
before it retires or evicts anything, through the helpers its own
decision now uses: importWatching (settled, watched host-pointer and
dma-buf imports) and importPages (the Windows page scan). A target whose
import would be compared stays synchronous, because a compared import
makes every refresh of the resident image compare the whole target. A
target over an import that already exists is resident as before, with
ExistingHostImportFor as the fast path, and APS5_NO_RESIDENT_LINEAR=1
still keeps every linear target synchronous.
This is the case draft #1191 (MichonGoddijn231849) was to bring back
on top of #6892 once partial-block write-watch coverage existed.
agc_driver_linear_target_import_creation covers a target in freshly
registered, write-watched memory (the draw is recorded, the target is
imported and stays watched), a block freed and allocated again at the
same address (it is watched, and the next draw starts from the CPU's
bytes), a resident direct-memory run armed read-only by the write watch
(the draw is recorded and the target imported; Windows), the gate over
armed and read-only private memory (a compared import of an armed run is
refused without opening it, memory committed read-only behind a writable
registry range is refused without a count, an armed run is imported
where imports stay watched; Windows), a 64 KiB block whose import would
be compared (no import, a synchronous draw, the block stays watched), a
1 MiB block the guest registered read-only (no import, a synchronous
draw), a 1 MiB run with one 64 KiB block outside the write watch
(refused, the target stays watched), and the same run once that block is
committed again (the refused run is imported; Windows).
On other systems the test forces ImportWatch::Watch, so the watched
cases also run where imports are compared (lavapipe in CI). The import
requester tests count the new requester and check that it makes no
compared import, no import of a range the guest cannot write and no
import of memory outside the write watch.
Co-Authored-By: Claude <[email protected]>
A drawn target kept the bounding box of its draws' scissors, so a store
at a completion point also wrote the pixels between two disjoint
scissors, over CPU stores made there after the draws.
- The target keeps the clipped scissor rectangles. Two merge only when
their union is a rectangle: one inside the other, or the same columns
overlapping or touching in rows, or the same rows overlapping or
touching in columns.
- The store still copies the rectangles' bounding box out of the image,
but writes to guest memory, for each row, only the union of the
column runs of the rectangles that cover that row.
- At most 16 rectangles wait for a completion point: the draw that
brings a 17th stores the target right after it, with all of them.
- A target the rectangle store does not cover (attachment proxy, several
mips or layers, 3D or DCC surface, results of a dispatch, fill or
copy) is stored after each draw again, instead of whole at the next
completion point.
- LinearTargetRectangleBound draws and waits once before its draws, so
the target's upload runs before the CPU stores instead of in the same
batch, adds CPU stores between the two scissors, and adds a case with
17 one-row scissors and a CPU store between two of them.
Co-Authored-By: Claude <[email protected]>
- MarkDrawn registers the scissor while any layer is pending instead of
while the image is dirty. A flush on another thread can take the image
out of the pending set between MarkSliceDirty and the registration;
layerPending changes only under the GPU lock, so the flusher, which
reads the drawn area after taking that lock, stores the widened area.
- AccessKeptByCpu no longer skips or evicts a drawn target. Its store
writes CPU-stamped blocks inside the drawn rectangle, so the hook's
CPU-kept rule would drop the draw's results.
- A drawn target that is stored whole keeps main's rule that CPU-written
64 KiB blocks stay the CPU's.
- A linear target that is no longer cached is stored after its draw, as
before: the pending registry holds raw pointers.
- LinearTargetCompletionPoints skips without host import, where the
target is never resident. LinearTargetCpuWrites adds a driver read of
the target between the CPU stores and the store.
Co-Authored-By: Claude <[email protected]>
- A flush from a thread without the GPU lock takes the lock before it takes a drawn target out of the pending set, so a flip, label or interrupt on the queue worker cannot run between the two and get ahead of the target's store.
- A label written on the GPU stores the drawn targets first and submits that store with the label, so the label's end-of-pipe interrupt is not held back to a later submission.
- The pending-writer check skips the target's own earlier stores only when the flush stores that target alone.
Co-Authored-By: Claude <[email protected]>
A type 0 signal read the semaphore, added one and wrote it back, so an
increment made by a CPU thread or another queue in between was lost.
Signals now store or add with atomic operations and a wait takes one
with a compare-exchange. The new test races two queues and a CPU thread
incrementing the same word.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A recorded draw into a resident linear color target stored the whole
image to guest memory right after the draw. Every draw copied the full
surface, waited for the previous draw's store in the open batch (the
pending-writer check of FlushPending), and the recorded copy landed over
CPU stores made after Draw returned (#8152).
A draw now records its scissor, clipped to the image, as a union
rectangle in the target and lists the target as drawn. The listed
targets are stored before each point where the guest can first observe
the draws' completion: a flip (inside its locked block, before the
flip's submit, so the flip's end-of-pipe interrupt and the presenter
follow the store), a drain (which covers APS5_SYNC_FLIP=1),
VulkanDevice::WaitIdle, a label the GPU writes for the graphics queue
(WriteLabelOnGpu), and an interrupt-only RELEASE_MEM in
preparePacketMemory and in commitLabel, which submit the store's batch
before the interrupt can be delivered. The idle store, the access hooks
and the eviction store are unchanged and also store by rectangle.
A store of a drawn target copies the rectangle out of the image and
writes it row by row at the guest pitch into the host import, stamped
with one MarkWritten per run of 64 KiB blocks. A block that only other
driver stores wrote since the target's generation keeps the old rule.
In a block the CPU wrote, or that changed outside the write watch, only
the rectangle's rows are stored, so CPU stores outside the rectangle
stay, and the target re-uploads at its next use. A target with an
attachment proxy, several mips or layers, a 3D or DCC surface, or
results of a dispatch, fill or copy is stored whole at the same points.
A store no longer waits for the same target's previous store: the
pending-writer check skips the write notes of the target's own stores
when it has a host import.
APS5_PROFILE_DRAW adds the drawn targets' stores by reason and the
pending drawn targets (count, MiB, oldest) to the [storage] line.
The tests cover a target that stays pending across draws and labels
until WaitIdle without a submission, #8152's CPU stores after Draw
(ported from #8246, seeded and unseeded, inside and outside the write
watch), CPU stores outside the drawn rectangle and in the gap before a
target that starts past a 64 KiB boundary, and a flip, a drain, a label
and an interrupt-only RELEASE_MEM through AgcDriver::Submit with the
queue held by a WAIT_REG_MEM, inside and outside the write watch.
Co-Authored-By: Claude <[email protected]>
MEM_SEMAPHORE (0x39) threw "cooperative command-queue waits are not
implemented". A signal now writes 1 (signal type 1) or adds 1 (signal
type 0) to the 64-bit semaphore; a wait polls until it is non-zero and
takes one. Mailbox waits throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceUserServiceGetKeyboardType now returns the keyboard type of the configured
system language from the repository owner's table (languages 0 to 29), with 20
(US English) for a language outside it. The input variants stay 0, the only
value the table gives for Japanese and Traditional Chinese.
sceConvertKeycodeGetImeKeyboardType takes the PS4 client rule from the title ID
prefix (CUSA is PS4); a missing or custom ID is treated as PS5. Tests walk the
owner's table through both calls and the title ID cases; both debt entries
updated.
Return SCE_SHARE_PLAY_ERROR_INVALID_ARGS (0x810E0001) instead of throwing APS5_INVALID_ARG_EX when an invalid prohibition value is passed to sceSharePlayProhibitController. Update regression test assertions in GuestSharePlay to verify the error code and record technical debt.
Dean Galvin