A V# without records (all zero, say, for a slot the taken path never
uses) makes every access out of bounds on hardware: loads read zero or the
format's default, stores and atomics are dropped. The recompiler now
specializes such a buffer as empty, so every access through it is out of
bounds, and the driver binds a small per-device placeholder buffer to the
element instead of rejecting the V#. A V# with records at address zero
still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A V# the SRT walker cannot compute (loaded from a descriptor heap at a
GPU offset, or built by the program) has no binding to hold it. Raw
dword loads and stores of 1-4 dwords through one now decode the V# in the
shader, apply the RDNA2 bounds rules (OOB_SELECT, stride, swizzle,
ADD_TID, format 0) and go through the BDA page table, as Kyty does.
Stores need Write permission, which only ranges that are a writable
allocation's host import get, so a store into a mirror or a copy faults
rather than being lost. The shader notes each written page in an
open-addressed set behind the fault record; once the work completed the
host marks those pages GPU-written, and an overflowing set throws.
Formatted, typed, sub-dword and atomic access through such a V#, and
their use outside compute shaders, still fail.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A sampled T# of a 32-bit integer format over a depth layout (a Z swizzle
mode) reads the raw bits of a depth plane, and a host cannot view a depth
image with an integer format. Such an image is specialized as float and
bound as the depth surface's float view: a fetch returns the same bits,
which the shader keeps as they are, and swizzle constants read as the
integers 0 and 1. Filtering is forced to point, as for integer formats.
The same T# over guest memory rather than a depth surface throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
EVENT_WRITE PIXEL_PIPE_STAT_DUMP (event 0x39) dumps the DB sample
counters. The recorder, once a title asks for them, keeps an occlusion
query open over each batch (precise when the device supports it) and adds
the result to a running count when the batch is reaped. A dump drains
recorded work like a label and writes the count in the PS5 layout: 16 DBs
16 bytes apart, begin and end counters interleaved, the count in the
first and bit 63 marking each ready. Kyty and SharpEmu write a fixed
"visible" result instead.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A depth target lives only in a GPU image (its guest surface is never
written), so a texture over its depth or stencil plane now samples that
image through a view of the plane's aspect: R32_SFLOAT for D32, R16_UNORM
for D16, R8_UINT for stencil, one level and slice at the surface's extent.
Other shapes, and storage access to a depth surface, throw. Depth images
get the sampled usage, and the barriers after a render pass and before a
dispatch include depth attachment writes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title maps physical pages at a new address while the GPU still reads them
through the old one. Every view of such a page gets the same contents and
loses write access while the page is shared; the last view left gets its
protection back. A CPU write to a shared page faults, and views that differ
when one is unmapped (a GPU write through an import) throw, instead of the
views silently diverging.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAgcQueueEndOfPipeActionPatchData is called with the packet and the new
64-bit label value only; reading a context id and a data selector from the
unused argument registers wrote garbage into the RELEASE_MEM, so fences
signalled with wrong values.
-KRzWekV120 is sceAgcDcbSetIndexSize with the per-instance object id flag
(VGT_INDEX_TYPE bit 14), as Kyty and SharpEmu build it. The no-op left the
previous index type in place, so 32-bit index buffers were read as 16-bit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- NP: signed-out callbacks and reachability; owned add-on entitlements
from anyps5-entitlements.ini next to the executable (or the file
ANYPS5_ENTITLEMENTS names)
- web browser, message, player invitation and player selection dialogs
finish without a UI; Remote Play, IME keyboard, SharePlay, live
streaming and video recording lifecycles for a console without them
- app content temporary data mount, format and free space (download data
quota from param.json); content export, search and delete lifecycles
- pad output-only calls, system service notice-screen flags, RazorCpu
markers, ulobjmgr
- throwing stubs for the remaining imports, so missing behavior fails
loudly
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- AJM codec 0 (MP3) decodes with FFmpeg, prebuilt through the
ffmpeg-core submodule as in Kyty; sceAjmBatchJobDecode and the Run job;
the PCM encoding follows the job flags; other codecs throw
- AudioOut2 ports of 16-bit integer samples, and the ambisonics speaker
array decode for the reported layout
- the voice library for a console with no headset, with a frame size for
voice ports
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Depth/stencil: draws that test depth or stencil against a bound surface
render with a GPU-only depth/stencil attachment (DepthSurface), cleared
to DB_DEPTH_CLEAR/DB_STENCIL_CLEAR when made. Z test/write/function and
per face the stencil function, operations and masks (BACKFACE_ENABLE);
replacements by another value where Vulkan's single reference can carry
them. Clear and copy draws, add/sub other than 1, array or mip views
and MSAA throw, and texture reads of a surface's memory are refused.
Scaleform menus mask with the stencil (REPLACE 0, ADD_CLAMP, EQUAL);
their masked content was skipped before.
- Mipmapped color targets render through the resident image of the whole
chain with a view of the mip, so mips in the packed tail are drawn too;
CB_COLOR_VIEW's mip level is read from bits 26-29 (GFX10).
- Color: SNORM targets, UNORM16/SNORM16 exports, one-component formats
honouring COMP_SWAP (A8), 32_R/32_GR/32_AR exports, linear rows padded
to 256 bytes, BLEND_BYPASS.
- INDIRECT_BUFFER jumps are followed when copying a submission; thin 3D
textures in display and rotated XOR swizzles; only the bytes the GPU
changed are written back; resource registration.
- VideoOut: a flip stalls the GPU queue while the flip queue is full and
holds the submitter back.
- APS5_DUMP_FRAMES_EVERY dumps every k-th presented frame.
- The graphics test target builds again (missing sources, a hand-aligned
64 KiB buffer, stale expectations updated) and gains DepthStencilTests.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- packet sizes for the existing builders and the tessellation ring
config
- direct register writes and end-of-pipe action data, type and cache
patches
- GS/HS shader halves fused by merging their registers, after Kyty
- jump target patches; reserved jumps are allowed
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libkernel:
- direct memory keeps its contents per physical page across unmap and
remap; a page mapped at two live addresses at once throws
- sceKernelDirectMemoryQuery answers from tracked allocations
- SCE protections read back as set, GPU and AMPR bits included
- APR prefix path resolve, file size and stat by id, positional reads,
fsync/pread/pwrite; directories open as descriptors on Windows
- sceKernelCheckReachability, getpeername, shutdown
- Dinkumware C11 threads (_Mtx_*, _Cnd_*, _Thrd_*) in the title libc
layout; any pthread stack size, rounded at thread creation
libc:
- unaddressed guest mappings go to the system-managed area from
0x2_0000_0000, leaving the application area to fixed mappings
- the process starts in /app0
- guest sscanf on Windows; a null %s prints as (null) as on FreeBSD
- localeconv, _FNan, _FDtest, _FExp, __udivti3, wcsncpy_s, aligned
operator new, _Throw_Cpp_error
Tests: direct memory following physical pages, guest formatting.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- MIMG word0 bit 12 (UNORM) is accepted on every op without a sampler
(compute image stores set it, as the ISA asks); sample and gather still
reject it, and rejections name the instruction words.
- The image_sample_*_a opcodes keep the plain address layout, as in Kyty.
- The _cl LOD clamp becomes the MinLod image operand (or clamps an
explicit level) on devices with shaderResourceMinLod; a gather with a
clamp fails loudly.
- v_add_co_ci_u32, v_sub_co_ci_u32 and v_subrev_co_ci_u32 in VOP3 form
take their carry-in from the SGPR pair of their third source, not VCC:
a glyph upload's reciprocal division corrected its quotient on the
wrong lanes and UI text came out stippled.
- Pixel exports follow each MRT slot's component mapping and write only
the components of their export format (32_R, 32_GR, 32_AR).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- --exclude-sce-module <file> (repeatable) drops one title module from
guest conversion, e.g. a title libc.prx, while the rest of sce_module
is still relinked as guest modules
- the instruction scanner stops at zero padding that ends a code segment
with an odd byte instead of failing on a truncated `add [rax], al`
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Per maintainer feedback: PNG encode/decode belongs together in a
future core/Decoder/Png shared by the relinker (icon loading) and
PRX layer, not a one-off libScePngEnc-only encoder. Reverts
libScePngEnc/Export.cpp to the upstream stub and removes the vendored
stb_image_write.h dependency, leaving ConvertKeycode, VoiceChat and
the PlayGo chunk-id fix.
Strip inline explanatory comments (comments are restricted to
technical-debt markers, #endif, and namespace-close trailers) from
HitLog.hpp, libSceConvertKeycode, libSceVoiceChat, libScePngEnc, and
the new hunk in libScePlayGo; add the missing #endif trailer comment
to HitLog.hpp's include guard. Rename the local helpers/params that
didn't match the naming convention: log_soft -> logSoft and
Readable -> readable (private free functions, camelCase), and
snake_case arguments (user_id, request_id, memory_address,
memory_size, output_info) to camelCase. NID export functions and
pre-existing upstream code (libScePlayGo's existing snake_case
parameters, PngEnc's vendored stb_image_write.h) are left untouched.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Bring the pad-gamepad-haptics diff in line with docs/dev/CONVENTIONS.md:
strip explanatory/rationale comments (struct layouts, algorithm notes,
rewired-NID rationale) down to code only, and rename the anonymous-
namespace helpers in PadState.cpp (Normalize/Fuse/EncodeZones/MaxOf/
ScaleStrength) to camelCase to match upstream's free-function style.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Was a NotImplemented stub that returned an empty/undefined result.
For a package where every declared chunk is already local, the
installed-chunk set is identical to the full chunk set already
computed by ValidateChunks()/ValidChunks(), so this simply delegates
to the existing scePlayGoGetChunkId(). Driven by the title's own
playgo-chunkdefs.xml, not any hardcoded per-title chunk count.
Replaces the 4-stub placeholder with a working create/delete/encode
path backed by stb_image_write. The encode parameter block layout is
inferred by analogy with the decoder's and validated strictly
(dimensions, pitch, buffer sizes, readability of both the source and
destination buffers) before any pixel is touched; anything that does
not fit is rejected rather than guessed at. Handles RGBA and BGRA
source pixel formats.
Init/terminate/handler/event exports are real no-ops. Session and
channel request exports return SCE_VOICE_CHAT error SIGNED_OUT, since
voice chat sessions cannot be established without a network backend.
Matches the offline-stub pattern already used by other online-service
PRX modules in this project.
sceConvertKeycodeGetImeKeyboardType is implemented for real (reports
keyboard type 0 for a valid user id). sceConvertKeycodeGetVirtualKeycode
has an unconfirmed ABI, so it only logs its raw arguments and reports
failure rather than guessing a pointer layout.
Renames template parameters to the TKey-style the conventions doc
requires (TValue, TFunction), removes the extern "C" close comment
(not one of the two allowed structural exceptions), and replaces
the magic error/flag numbers left after the previous comment
cleanup with the existing SCE_KERNEL_ERROR_* constants and a named
RTLD_NOW constant so the code documents itself.
Comments in this codebase may only mark technical debt (human-added
only), the end of #endif, and the end of a namespace, per
docs/dev/CONVENTIONS.md. Remove the inline rationale comments added in
the AGC PM4 opcode and shader recompiler robustness commits; the code
itself, the commit history, and the PR description now carry that
context instead.
Notably, Command::WriteMemSemaphore takes the corrected 4-argument
form (address, waitForMailbox, signalType, operation): an earlier
revision of this helper used a different, incompatible argument
order. sceAgc*MemSemaphore callers derive waitForMailbox/signalType
from the low two bits of clientCode, and operation from action
(0 = signal, 1 = wait). This ABI note previously lived as an inline
comment; it is recorded here instead per the no-comments convention.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Comments in this codebase may only mark technical debt (per
docs/dev/CONVENTIONS.md), plus the #endif and namespace-close
structural exceptions. Removes the descriptive comments added on
this branch across PreciseWait.hpp, FormattingWide.cpp, the
direct-memory pool query/free-run plumbing, and the module loader
wiring, keeping the two allowed structural markers intact.
The project's coding conventions restrict inline comments to
technical-debt markers, #endif, and namespace-close trailers. Remove
the explanatory comment on writeGotStub's DIR64 write; the same
rationale (why the slot must hold the preferred-VA form, and why the
base-relocation pass was moved after lazy-stub writes) is already
captured in the fix(relinker) commit message and PR description.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
sceSystemServiceGetHdrToneMapLuminance was NotImplemented. Titles read
it at startup to set up their HDR tone mapping.
The presenter always outputs through a B8G8R8A8 sRGB-nonlinear swapchain,
so the display range the title has to map into is SDR: the maximum and
full-frame maximum luminance are the 100 cd/m2 SDR reference white and
the minimum is 0. A null output pointer returns
SYSTEM_SERVICE_ERROR_PARAMETER like the other getters here.
