fdopendir listed the directory from its first entry whatever position the
descriptor had, and left FD_CLOEXEC unchanged. FreeBSD 11.4 fdopendir sets
FD_CLOEXEC on the descriptor and preserves the initial seek position (lib/libc/gen/opendir.c).
The Windows directory handle now skips the entries the descriptor already
consumed, the Linux handle duplicates the descriptor, and the test requires both.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The double Bessel functions follow the system libc.prx: FreeBSD msun
e_j0.c, e_j1.c and e_jn.c with every multiply-add the console fuses
done as one FMA, and the console's constant results for zero and
negative arguments of the second kind.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
A --module-dir module that only the executable needs was initialized by
the Windows entry stub with no start arguments, so a later
sceKernelLoadStartModule with arguments found it started and its
module_start never saw them. Unity's mono-ps4.sprx keeps those
arguments for the plugins it loads. Such a module is now deferred like
any other runtime module: mapped at startup and started, with its
arguments, when the title loads it. Modules another guest module needs
are still started at startup, and Linux and macOS are unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
rename and sceKernelRename resolved "dir/." to "dir" and renamed the directory. FreeBSD 11.4's lookup fails a last component of "." for DELETE and RENAME with EINVAL, for the source and the destination alike. Check the guest string before it is resolved: a last component of "." (also under trailing slashes) fails with EINVAL when its parent exists, ENOENT when it does not and ENOTDIR when it is not a directory.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Return the handle of an event flag this process created under the
given name, or ENOENT. Twispero opens the shell's
SceShellCoreUtilAppFocus flag at start-up and treats a failed open as
unknown focus.
stat, open, mkdir, rename and the other calls that resolve a guest path answered ENOENT (or EIO for rename) for a name longer than 255 bytes or a path of 1024 bytes or more, because the host path just did not exist. FreeBSD 11.4's namei fails a component above NAME_MAX and a path of MAXPATHLEN bytes with ENAMETOOLONG. Check both limits on the guest string before it is resolved; FilesystemError already maps the error to 63.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
bind, connect and sendto answered EFAULT for an address length below 2 and EAFNOSUPPORT for an AF_INET address below 16 or an AF_INET6 address below 28 bytes. FreeBSD 11.4's getsockaddr fails a length below 2 with EINVAL and above SOCK_MAXADDRLEN (255) with ENAMETOOLONG, and the protocols compare the length with sizeof(struct sockaddr_in) or sockaddr_in6 and fail with EINVAL.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
sceNpGetAccountId and sceNpSetGamePresenceOnline report NP as signed
out, and sceNpUnregisterPlusEventCallback returns 0 like the premium
form.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rosetta ends the process instead of raising SIGSEGV or SIGBUS when a
VMASKMOVPS, VMASKMOVPD, VPMASKMOVD or VPMASKMOVQ store faults on any
element other than an active first element ("rosetta error: unexpectedly
need to EmulateForward on a synchronous exception"). Measured on an M5
with macOS 27.0.1 for all eight 128- and 256-bit store forms. A masked
store into a page the macOS write watch keeps read-only therefore ends
the title.
--to-rosetta now moves each masked store to a stub that saves RAX, RCX
and RFLAGS below the red zone, computes the operand address with LEA,
reads the mask sign bits with VMOVMSKPS or VMOVMSKPD, and writes to the
first and last byte of every active element with LOCK OR of 0. Those
writes fault normally, so the write watch sees the page and unprotects
it, and they leave memory unchanged. The stub then restores the
registers and runs the original store. Segment and address-size
prefixes are kept on the probes, RSP-based operands skip the spill
frame, and RIP-relative operands are relocated. Masked loads, the
Intel target and a plain relink are unchanged.
masked_store_lowering decodes every form, register and extension,
checks the stub bytes, and on x86-64 Linux and macOS runs 1728 stubs
across all forms, six addressing modes, six offsets around a read-only
page and six mask patterns. It checks the stored bytes, that exactly one
fault reaches the handler when an active element touches the page,
that no register, flag or red-zone byte changes, and that RSP is
restored. Without the probes the x86-64 build aborts under Rosetta.
test_to_rosetta.py checks that only --to-rosetta lowers a VMASKMOVPS.
A domain program that picks one of its patch's control points from data
(Onimusha: Way of the Sword, PPSA27836, selects a corner with v_cmp and
v_cndmask before a buffer_load from the off-chip ring) was refused with
"the tessellation ring or LDS address is not affine in the control point
and relative patch". Computed indices were accepted only for hull LDS
reads.
- The address evaluator gives off-chip EvaluationInput reads the same
dynamic term as hull LDS reads, and a value read from the patch's own
ring or LDS no longer counts as depending on the relative patch index,
since the lowered read takes the patch implicitly.
- When the program also uses its relative patch index as data, the
index is replaced by the grouped patch instead of 0, which left a
computed read's address pointing into another patch. Such reads now
subtract their relative patch term, for hull and domain reads alike;
reads in programs that do not use the index as data keep their address.
- The computed offset must be a whole number of control points, and the
backend clamps the domain gl_in index to the last output control point
as it already does for hull reads.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The controller information reported 1920 by 943, the DualShock 4 height with
the DualSense pixel density, while the host controller's fingers were scaled to
1920 by 942 and the keyboard touch contacts sat on the 942 centre line. A title
that maps touch coordinates through the reported resolution lost the lower part
of the touchpad. The width and height now live beside the pad state and all
three places use them.
Resolve docs/dev/debt/shader.md: keep main's reworded guest memory load guard entry and add the descriptor web arm entry after it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceMoveOpen returned a new handle for any user, type and index, although
the console's result for a user other than the initial user and for a
type and index that are already open is not known. Both now throw, as
libSceHmd2 does for another user. Record which shadPS4 behaviour the
handle and open checks add to.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Arbzg9c2DA4DEFKVSvRgYv
MCOMMIT becomes STC plus NOP padding and RDPRU goes through a
runtime-checked stub returning the host TSC for MPERF/APERF while
other selectors yield zero, with converter and execution tests.
docs/dev/debt/relinker.md records the new lowering and its unverified
assumptions.
PS4 titles import both and do not load without them; every call throws and
the debt files list them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The fast proof of a cached ShaderResources proves each sampled texture
from write stamps, keys and the pending registry. It never asks whether
the sampled lookup would still return the bound Texture, so a template
whose surface memory is unchanged keeps binding an old object:
- After the sampled cache drops or replaces the entry (#6492 marks the
texture released), Find keeps serving the template until the next
Insert, and its fast proof passes.
- When the lookup's answer changes without any lookup running (a
snapshot whose surface became host-imported is viewed through its
storage image from then on), nothing replaces the entry and the
template keeps the snapshot until it leaves the resource cache.
The fast proof now fails with 'replaced texture' when a bound texture
is released. A template whose last full walk is older than
APS5_TEMPLATE_AUDIT_MS (default 1000, 0 turns it off) takes the full
walk instead of the fast proof ('audit'), so a different lookup answer
fails the proof and the template is rebuilt.
The entry stated that image atomics on 32_SINT and 32_FLOAT act on the
raw dword with no measurement behind it. On gfx1100 the 13 integer image
atomics return and store the same raw-dword results on 32_UINT, 32_SINT
and 32_FLOAT, while 16_UINT and 8_8_8_8_UINT controls differ. gfx1100
has no float image atomics, so that part stays open.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
