sceUltGetQueueInfo reported every blocked queue thread as a waiting popper because both directions incremented one counter. Track the two wait classes in separate fields and fill both query outputs, copy one waiter record per blocked thread, and cover full-queue and empty-queue waits with a new queue-waiters test. sceUltGetUlthreadRuntimeInfo now throws when a caller asks for worker thread handles, since this runtime starts no worker threads, and the debt entry records the remaining limitations.
SSLeay() returns 0x20000000, the value measured on a PS5 with firmware
13.40 and the SSLEAY_VERSION_NUMBER of LibreSSL 2.5.4, which the module
is. The guest_libressl_version test checks it.
CONTRIBUTING.md permits silent stubs only when unblocking a title UI path and when backed by title evidence. Since no title ID evidence demonstrates that a constant no-disc return unblocks a UI path, throw NotImplemented_nid_no_patch from sceDiscIdGet and sceDiscIdGet2 without touching caller memory. Tests assert both calls throw on null and non-null outputs and across flags values while leaving caller buffers untouched, and the debt entry records the unresolved hardware contract.
The previous revision rejected a null output with 0x80D50001 and any nonzero flag with 0x80D50002, but no SDK or console evidence establishes those validation rules, the error codes or their precedence, and the flag argument may be a bitfield. Report SCE_DISC_ID_ERROR_NO_DISC for every pointer and flag value without touching the output, and record the unverified contract in the debt entry.
A long double %La went to the host, which on Windows (MinGW) prints the
64-bit significand with its integer bit as the leading digit:
0xc.ccccccccccccccdp-7 for 0.1L. The libc.prx that titles ship
normalises it like a double, with a leading 1 and the remaining 63 bits
as 16 hexadecimal digits, 0x1.999999999999999ap-4, and rounds a shorter
precision half up with the carry kept in the leading digit. Share
HexFloat's digit and rounding code between double and long double and
use it for finite long double %a and %A in the narrow and wide families.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
BunnyFl ran firmware 13.42's libScePad natively over a slot table he
wrote, and oneandonlydean asked for the four calls to follow it.
scePadIsValidHandle matches the handle's open port type against the
argument, and answers false before scePadInit.
scePadResetLightBarAllByPortType returns INVALID_ARG for any type but 0,
1 and 2 before the initialisation check, and otherwise resets each open
handle of that type as scePadResetLightBar resets it;
scePadResetLightBarAll is type 0. So a standard port with no open handle
keeps its light bar, and types 3, 4 and 16 no longer throw.
scePadSetVibrationForce returns NOT_INITIALIZED before scePadInit, then
INVALID_ARG for a null parameter, without looking the handle up. There
is no pad driver here: a special handle returns PAD_OK and a standard
handle sets its port's motors, open or not. A handle with no pad port
throws, as the driver's answer for it is not measured.
The tests drop the closed and unknown handle checks that no longer hold
and check the measured answers; the debt entries cite the run and say
which parts are this model's.
A shader with an image table map read its fault buffer back only when a
table record was poisoned, an SRT read was poisoned, it had window lane
guards or the loop guard was on. A DescriptorFault only set the fault
buffer, so with a valid table and no copied write nothing ran the fault
check, and a lane that took a folded descriptor web path or selected an
undefined arm read arm 0 or zeros with no report.
The compiled artifact now counts its DescriptorFault instructions
(descriptorFaults, stored in the shader disk cache, format 48), and the
readback gate requests the fault check when it is nonzero. The result a
capture materializes copies the count, and also windowLaneGuards, which
that copy had dropped, so the gate's window lane guard condition never
saw it. sizeof(CompiledShaderArtifact) is 288 and sizeof(RecompileResult)
552 with the new field.
agc_driver_descriptor_web_faults adds a wave32 shader that reads an image
table and then the descriptor web, storing only to LDS so no copied write
forces completion: it binds an image table and no BDA address table, a
valid arm and an unselected undefined arm stay clean, the folded path and
a selected undefined arm fault at the read, and nothing faults with EXEC
empty. Without the gate change the folded case does not fault.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
BunnyFl ran firmware 13.42's libSceBluetoothHid natively. A null block
given to sceBluetoothHidParamInitialize returns 0x81540001, so it now
returns InvalidArgument instead of throwing, and the test checks that
answer. The run also shows sceBluetoothHidRegisterCallback reading the
event thread's priority and affinity through the stored value, which
makes it the BluetoothHidThreadParam pointer the signature declares;
the debt entry cites the run and its limits.
Resolve the overlap with main's WindowLaneGuard and image-resource changes
by keeping both sides: DescriptorFault sits next to WindowLaneGuard in the
opcode list, metadata and side-effect switch, and its emitter next to
EmitWindowLaneGuard; optionalDescriptor is serialized after
remappedDepth1D; undefinedImageWords follows the new image helpers; the
descriptor web debt entry follows main's new entries.
The ImageResource field-count assertion is derived from the merged
structure (44 fields: main's 43 plus optionalDescriptor). sizeof
(ImageResource) stays 96 and sizeof(MemoryInfo) stays 80, so those
assertions are unchanged. The undefined-format test keeps its captured
regions in a variable, as MemoryRegionView no longer binds a temporary.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A target in host code got the delivery as an APC as well as through the
return breakpoint and the sampling. An APC runs in any alertable wait,
so host code that waits alertably while holding a lock would have run
the guest handler inside that wait with the lock held. The APC is now
queued only while the target is in a libkernel wait (Pthread waitCount),
the point where the handler already ran before; a target elsewhere in
host code takes the delivery when it returns into guest code.
guest_raise_leaves_host_code adds a target in an alertable
WaitForSingleObjectEx: each raise must return in under 500 ms and the
handler must run in the executable after the wait was released. The
earlier behaviour (an APC for every host-code target) fails it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
RaiseOn suspended the target and, while it sat in host code, resampled
it until a 50 ms limit and then redirected it into the handler there.
A handler that waits, as Unity's GC thread-stop handler does, then held
whatever host lock the thread had: in Graveyard Keeper 2 a job worker
stopped inside shader specialization kept the shader registration lock,
another worker blocked on that lock never ran its own stop, and the
load froze with 39 of 40 threads acknowledged (about 1 in 15 loads).
A target in host code is never redirected now. The raise queues the
delivery as an APC (taken when the thread waits alertably), arms a
debug register 0 execute breakpoint at the frame's return address into
guest code (found with the image's own .pdata and RtlVirtualUnwind,
stopping at frames that push a machine frame, guarded against faults),
and hands the target to a host deliverer thread that keeps sampling it.
The first of the three to reach the thread delivers, through one taken
flag per delivery. A target in guest code is still redirected at once;
a target inside NtContinue still makes the raise throw after 1 s.
guest_raise_leaves_host_code checks that a handler never runs in host
code, for a target blocked in WaitForSingleObject and one busy in
MultiByteToWideChar, and that each raise of the blocked one returns in
under 500 ms.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
BunnyFl ran firmware 13.42's libSceFont natively against this PR's
checks. With both set, the surface's style frame wins over the argument,
so it is now taken first. A frame that sets no scale, zeroed or only
initialised, is accepted and keeps the glyph's generation scale instead
of returning SCE_FONT_ERROR_INVALID_PARAMETER. A valid
sceFontGlyphRenderImageVertical call, and sceFontGlyphRenderImage on a
vertical font, throw again: the module draws the char call's pixels
there but reports a different advance and stride (40/40 against 90/90
at 40 px), and one case doesn't name the rule.
The test drops the vertical comparison and the non-renderer pointer
check, whose result in the module depends on memory past the pointer,
and checks the frame order and the unscaled frames.
Adrià