A depth-only target has no stencil storage for STENCIL_CLEAR_ENABLE to
write. Titles that clear depth and stencil together on such a target
were rejected; the depth clear and colour writes now proceed. A
read-only stencil plane is still rejected.
sceImeDialogForceClose threw. It now closes a running or finished
dialog the way sceImeDialogTerm does, without writing the typed text to
the title's buffer, and returns NOT_IN_USE (0x80bc0107) when no dialog
is open. The behaviour follows shadPS4 and the error code is the one
SharpProspero lists for PS5. The ImeDialog guest test covers each case.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Arbzg9c2DA4DEFKVSvRgYv
The hmd2s and hmd2n sweeps left 19 libSceHmd2 exports that either write
into their arguments or take a slot number rather than a pointer first.
A third probe called the writers with zero-filled and with 0xAA-filled
buffers, dumping every byte that changed, and the slot exports with a
first argument of 0, 1, 2, 3, 4, 5, 8, 16, 255 and -1. Before
sceHmd2Initialize, six writers put fixed bytes in their output (a 2 and
a zero byte; 0x2000 and 0x100 as 64-bit sizes; four floats; six or
twelve floats of 0 and 0.5 followed by 0x8a720003), and twelve exports
accept a slot of 0 to 1, 2 or 3 and answer 0x8a720009 above it, with
0, -1, 0x8a721002, 0x8a721003, 0x8a72002c or 0x8a72100f for a valid
slot. They are bound here, by NID, to 14 handlers with the measured
checks, returning their value while the library is not initialized and
throwing if sceHmd2Initialize ever succeeds.
The one export whose answer depends on the contents of an in-out
structure stays unimplemented and is described in the debt file.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
The hmd2s sweep left 81 libSceHmd2 exports that answer 0x8a720008 to
all-null arguments but something else to zeroed buffers. A second probe
called each of them six times before sceHmd2Initialize, every argument
pointing at a zeroed 16 KiB buffer except one, to find which arguments
are the checked pointers. 62 exports answer 0x8a720008 exactly when one
of a fixed set of arguments is null and their all-present code otherwise:
48 check the first argument, 10 the second, 6 the first two, 2 the first
and third, 2 all six. They are bound here, by NID, to 18 handlers with
that many pointer parameters, each returning ParameterNull for a null
checked pointer and otherwise the measured code (0x8a720004 for 20 of
them, 0 for 11, 0x8a721002 for 10, -1 for 5, 0x8a720009 for 7,
0x8a72002c for 3, and 0x8a720003, 0x8a721003, 0x8a721010 and 0x800d0203
for the rest) while the library is not initialized, throwing if
sceHmd2Initialize ever succeeds.
Left out: 7 exports that write output and 12 whose first argument is a
handle or slot number rather than a pointer. The debt entries list every
NID with its aerolib name where one exists.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
A sweep of the 281 libSceHmd2 exports on a PS5 (firmware 13.60), each
called from a payload before sceHmd2Initialize once with every argument
null and once with every argument pointing at a zeroed 16 KiB buffer,
found 127 that answer the same code both ways and write nothing. 125 of
them are bound here, by NID, to one handler per answer: 45 return 0, 16
return 0x8a720008, 15 return 0x8a720004, 12 return -1, 10 reprojection
exports return 0x8a72000b, 9 return 0x8a720002, 9 return 0x8a720009, 5
return 0x8a721002 and one each returns 0x8a72002c, 0x8a721003, 0x400 and
0x20000. Each handler returns its measured value while the library is not
initialized and throws if sceHmd2Initialize ever succeeds, because the
initialized behaviour is not measured; since b378541e79 it fails with
UnsupportedFeature here, so these are the answers titles get.
Left out: the export that returns a pointer-like value, the one answering
0x8a72000a (which sceHmd2Initialize also returns for some applications),
the exports that answer differently to null and to zeroed arguments or
write output, the 16 that crashed the probe, and the exports that main,
its aerolib name where one exists.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Decode DB_Z_INFO.MAXMIP and DB_DEPTH_VIEW.MIPID and render into the
selected level of a 64 KiB Z_X mip chain as a surface of its own, at
the level's offset and extent from ComputeElementMipLayout, as color
target mips do. Slices of a mip chain step by the size of the whole
chain. Multisampled depth mips, other swizzles, levels in the packed
mip tail and HTILE on a mip chain still throw. LEGO Builder's
Journey (PPSA05496) stopped at its first scene on
"depth mips (DB_DEPTH_VIEW MIP_LEVEL) is unsupported".
A destroy waited only for another thread's render, so destroying a rack
that another thread had locked freed it under that lock. Destroys now
wait like renders and rack locks do, and the render owner field that
only those waits read is gone.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
soreceive_generic keeps a MSG_WAITALL receive on a stream socket waiting until
the buffer is full, the peer closes or an error occurs. The three calls failed
every flag but MSG_PEEK and MSG_DONTWAIT with EOPNOTSUPP. A stream socket now
passes the flag to the host receive; a datagram socket ignores it, as a record
is delivered whole.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Parse Xing/Info and LAME tags across candidate offsets covering both CRC-protected and unprotected streams, and accept VBRI headers at byte 36 for non-stereo / MPEG-2 frames. Reject non-Layer-3 streams with SCE_AJM_ERROR_INVALID_PARAMETER without throwing.
Progress: sceAjmDecMp3ParseFrame implemented (libSceAjm.native: 19/40 -> 20/40, 50.0%)
The start-up f32 denormal flush probe already stays out of the pipeline
counters and the pipeline journal, but APS5_DUMP_COMPUTE_PIPELINES still
captured its pipelines. On a device that runs the probe, every capture
directory gained twelve driver-internal records that count toward the
128-record limit, and agc_compute_pipeline_capture_run found 14 captures
for a fixture with two programs.
A relocation or lea target outside the unwind functions of a PS4 image
is now decoded up to its first jump, return or trap, or to the start of
the next unwind function, which also bounds the transfer check of the
tail rule. A target whose run holds an fs:[disp32] access, the form the
linear TLS sweep roots, is followed as code. The other targets taken as
data are counted in one message and kept as entry points that the
Windows TLS rewrite may not overwrite. The analysis merges nested
unwind ranges like the scans.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The skip of syscall patterns outside the unwind functions let some real
syscalls through. The scan now merges nested and overlapping unwind
ranges with the instruction scanner's MergeCodeRanges, so a pattern
inside an outer function is refused. A constant syscall number is also
looked for in the bytes in front of the pattern, whatever alignment the
decoding took: a mov eax, mov rax or xor eax, eax that ends at the
pattern or before register moves and zeroings that leave rax alone. The
decoded lookback requires each instruction to end where the next one
starts. Guest modules without PT_SCE_DYNLIBDATA get no unwind ranges,
so their scan stays strict even when their unwind table is read.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rack locks and renders were tracked per system, so a voice callback
that locked a rack of another system could deadlock with that system's
render, or with a thread holding rack locks in both systems. Rack locks
and renders now exclude each other across threads and systems, as the
single internal lock did, while a thread nests them and other calls go
ahead.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Add the unversioned sceAgcCreateInterpolantMapping and
sceAgcUpdateInterpolantMapping and stop sceAgcUpdateInterpolantMapping_10000
throwing for split f16 defaults, all matching libSceAgc bit for bit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
The code analysis of the Windows and macOS outputs followed every
relocation and lea target inside the code range as code. PS4 images keep
read-only data between unwind functions, and strings and tables there
decoded into garbage, failing the conversion. Outside the unwind functions
such a target is now code only when it is 16-byte aligned, starts less
than 256 bytes after an unwind function and decodes to a jump, return or
trap; lea targets go through the same rule instead of the graph's own.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceNetCtlRegisterCallbackForNpToolkit, sceNetCtlUnregisterCallbackForNpToolkit
and sceNetCtlCheckCallbackForNpToolkit keep their own table of eight
callbacks next to the IPv4 and IPv6 ones and share the existing register,
unregister and event delivery, which sceNetCtlCheckCallback now also goes
through. sceNetCtlTerm clears the new table. The register signature and the
separate table follow shadPS4; the rest follows the IPv4 functions and is
recorded as unverified in the libSceNetCtl technical debt.
In a payload process on a PS5 (firmware 12.70), sysctlbyname returns -1
with ENOENT for thirteen names that threw here, and leaves the buffer and
the length alone, for a read, a size query, a null length and a null
buffer with a null length. sysctl does the same for the fixed MIBs of
seven of them. sysctlnametomib gives those seven MIBs and returns ENOENT
for hw.cacheline_size and hw.usermem, which threw too.
machdep.cacheline_size already returned ENOENT and is now tested with
the others. A write to the new names and MIBs throws, as the console's
answer to a write was not tried. The hw.realmem and vm.overcommit debt
entries now say that a payload process gets ENOENT for them as well.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean