A search range with no free direct memory returned EAGAIN (0x80020023).
A PS5 returns ENOMEM (0x8002000c) for an occupied range, as the
PS5_RetroArch author's console capture records, and PS5_PayloadSDK's
ps5_memory_query, which RetroArch uses for its memory status, gives up
on any other error.
LargestFree now returns the error: ENOMEM when no block is found, and
EAGAIN as before for a negative start, an end at or below the start and
an alignment that overflows when rounded to a page. guest_memory expects
ENOMEM for an occupied range and EAGAIN for those arguments. The
unmeasured argument handling is recorded in the libkernel debt file.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
writeBackWindows retiles the kept 64 KiB units through the windows of the
surface's (layer, mip) slices. A unit can lie outside every window: the
tracking grid spans the whole guest range flat, while the slices of a 3D
surface taper in depth (HasLayer), so the upper depth slices' higher-level
blocks belong to no window. The empty window set then sized the retile
linear and scratch buffers at zero, and the zero-sized device buffer threw
'AGC graphics: zero-sized device buffer', aborting the process.
Keep such units as the guest left them: there is no tiled data of the
surface to retile or store. The caller alone accounts for the unit.
The padding bound in buildGraph's decoding loop skipped worklist targets inside the trailing zero region without decoding them, so malformed mandatory roots were accepted silently and complete instructions at targeted zero offsets lost their reachable marking. Decode the first instruction at each popped target against text.size() and keep the codeSize bound for sequential fall-through only. Covers the entry, extra-entry, branch-target, complete-zero-instruction and zero-immediate cases in the direct API test and in the CLI fixture.
buildGraph fell through from the entry points into the segment's zero
padding; an odd-length zero tail left a lone 0x00 the decoder needs a
ModRM byte for, and the non-speculative walk let that truncation escape
the pipeline, so unused-filter=1 exited 2 on input the other levels
convert. Bound the walk before the trailing zeros the way
StrictReachability does; mandatory roots still decode strictly.
A MarkWritten whose fresh collect fails (a no-access or unwatchable
resident page inside the 64 KiB block span) took the span out of the
write watch without running the unwatch hook, so pending storage-image
results over it kept no saved guest bytes and their write-back refused:
storing storage image results pending over memory outside the write
watch without the guest bytes saved before them is not implemented
(#7017, Palworld PPSA23126 among others).
The hook now runs over the block span before the blocks leave the
watch, as Unwatch and the import fallback do, with the tracker lock
released for it like #6308 does for imports. The debt entry drops the
failed collect from the unsaved cases.
The check makes a collect fail over a no-access arena page and requires
the hook to have covered the block; it needs the WindowsMappings
protection failure, so it runs in the Windows-only section of the write
tracking test.
Align scePlayGoDialogGetResult unfinished error code with the other common dialog modules across the tree (0x80B80005, COMMON_DIALOG_ERROR_NOT_FINISHED) instead of 0x80ED0005. Update GuestPlayGoDialog test and technical debt entry accordingly.
Validate that the dialog is in finished state before returning results in scePlayGoDialogGetResult, returning ERROR_INVALID_STATE when called while initialized, and cover this case in GuestPlayGoDialog.
On Windows, localtime_s moves a time outside the host range into it by
subtracting whole 400-year cycles, computed as
cycles * CALENDAR_CYCLE_SECONDS. For times within about 7.2e9 seconds of
INT64_MIN that product overflows int64, which is undefined behaviour:
built with -fsanitize=undefined -fsanitize-trap=all, guest_time_conversion
traps there on its INT64_MIN case.
Take the remainder of the time by the cycle length instead. It is the
same value for every input that did not overflow, so results do not
change, and the extreme inputs still fail the year range check.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
DispatchWriteRanges decoded the T# of every written storage image
element before checking its base address, and DecodeTextureResource
throws on a null base, so a dispatch that writes a null storage image
slot threw instead of contributing no range. On main the
APS5_PIPELINE_DISPATCH item path reaches it.
Check IsNullTextureResource first and skip the element, as
DrawWriteRanges does for draws. The draw write ranges test now also
runs DispatchWriteRanges on its written-plus-null image program.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01PqKN8pgLXDvWRPSucJTLU7
A ds_ordered_count with offset1 bit 4 set swaps the first active lane's value into the GDS counter instead of adding it. Emit it as one device-scope atomic exchange through the same path as the ordered add, and return the counter's previous value to every active lane.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A wake set after the previous wait returned left the per-thread
auto-reset event signalled, so the next short sleep returned from its
wait at once and spun to its deadline. With APS5_COARSE_TIMED_WAITS or
a request under 50 us the sleep now takes TimedWait::SleepNanos as on
main.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Transition dialog status to finished in sceLoginDialogClose, matching the behavior in libSceSigninDialog, and add unit test coverage in GuestLoginDialog.
Transition dialog status to finished in sceNpAuthAuthorizedAppDialogClose, matching the behavior in libSceSigninDialog, and add unit test coverage in GuestNpAuthAuthorizedAppDialog.
#7924 adds its check between CheckInetPtonEx and CheckUsleep, where
these checks were, so the two pull requests conflicted in
GuestSceNet.cpp. The checks now sit after CheckAddressText.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PS4 firmware 10.71 converts "1.2.3.4" followed by a space, tab, LF,
VT, FF or CR, and anything after it ("1.2.3.4 x"), to 1.2.3.4 and
returns 1, where host inet_pton returns 0. Leading whitespace, other
trailing bytes (0x01, 0xa0), "1.2.3 " and IPv6 text with whitespace
still fail there.
A failed conversion leaves the destination and sceNetErrnoLoc
unchanged on the console; Winsock inet_pton writes the parsed prefix
before failing, so the conversion now goes through a local buffer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A vertex shader exporting the render target index draws one value per
layer into a CB_COLOR_VIEW of slices 1 to 3 of a four-slice 2D array and
into slices 0 to 2 of a surface of one slice. After the write-back every
slice of guest memory must hold its layer's value, and the slices
outside the view (slice 0, and slice 3 of the one-slice surface) their
initial bytes.
AI-assisted: yes
Dean Galvin