The OpenOrbis net_http sample stops on 0x5413, the Linux TIOCGWINSZ
that musl sends to standard output; the carried cases covered 0x5401
but not that word, so the test adds it to the malformed words. It also
pins the two boundary words the check takes as well-formed, 0x20046601
(IOC_VOID, length 4) and 0x80006601 (IOC_IN, length 0): on a guest
socket with a null argument they fail with EFAULT, not ENOTTY.
The debt sentence now states the open gap: an input request with
length 0 is not rejected as malformed, while sys_ioctl rejects it in a
kernel built without COMPAT_FREEBSD4, COMPAT_FREEBSD5 and COMPAT_43,
and which of these the PS5 kernel has is unknown.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD's sys_ioctl rejects a request with no direction bit, an output request with no length, or a void request whose length is not an int before it reads the argument or resolves the descriptor. ioctl threw on such a request for a file, pipe or directory, failed with EBADF for a closed descriptor and with EFAULT for a socket given no argument.
(cherry picked from commit 501518f321ac5d0b45ce1090af39c680927edf49)
(cherry picked from commit 3eb7edd9cf)
scePthreadAttrGet copied the attributes of any non-null handle, so a
thread that was joined or had finished still answered 0, and a thread
that ended detached was read after its object had been freed. FreeBSD
11.4's _pthread_attr_get_np returns ESRCH for a dead or reclaimed thread,
and Monster Hunter Wilds (PPSA24191) reuses a slot of its thread table
only when scePthreadAttrGet returns 0x80020003.
After the EINVAL checks it now returns ESRCH unless the handle is a live
guest thread, and copies the fields while holding the thread registry
lock (LockLiveGuestThread), so a detached thread exiting during the call
is not freed under the copy. GuestThreadIsLive uses the same lookup.
pthread_attr_get_np, which the title does not import, is left as it is;
the debt entry records the difference.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A search range with no free direct memory returned EAGAIN (0x80020023).
A PS5 returns ENOMEM (0x8002000c) for an occupied range, as the
PS5_RetroArch author's console capture records, and PS5_PayloadSDK's
ps5_memory_query, which RetroArch uses for its memory status, gives up
on any other error.
LargestFree now returns the error: ENOMEM when no block is found, and
EAGAIN as before for a negative start, an end at or below the start and
an alignment that overflows when rounded to a page. guest_memory expects
ENOMEM for an occupied range and EAGAIN for those arguments. The
unmeasured argument handling is recorded in the libkernel debt file.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
writeBackWindows retiles the kept 64 KiB units through the windows of the
surface's (layer, mip) slices. A unit can lie outside every window: the
tracking grid spans the whole guest range flat, while the slices of a 3D
surface taper in depth (HasLayer), so the upper depth slices' higher-level
blocks belong to no window. The empty window set then sized the retile
linear and scratch buffers at zero, and the zero-sized device buffer threw
'AGC graphics: zero-sized device buffer', aborting the process.
Keep such units as the guest left them: there is no tiled data of the
surface to retile or store. The caller alone accounts for the unit.
Results that land in a unit whose store ran while its blocks were
watched, after those blocks left the watch while nothing was pending,
have neither saved bytes nor a watch: the unwatch hook found nothing to
save and the write-back refuses as before (#7017). The entry named only
the range that leaves the watch without the hook running over it.
A MarkWritten whose fresh collect fails (a no-access or unwatchable
resident page inside the 64 KiB block span) took the span out of the
write watch without running the unwatch hook, so pending storage-image
results over it kept no saved guest bytes and their write-back refused:
storing storage image results pending over memory outside the write
watch without the guest bytes saved before them is not implemented
(#7017, Palworld PPSA23126 among others).
The hook now runs over the block span before the blocks leave the
watch, as Unwatch and the import fallback do, with the tracker lock
released for it like #6308 does for imports. The debt entry drops the
failed collect from the unsaved cases.
The check makes a collect fail over a no-access arena page and requires
the hook to have covered the block; it needs the WindowsMappings
protection failure, so it runs in the Windows-only section of the write
tracking test.
Align scePlayGoDialogGetResult unfinished error code with the other common dialog modules across the tree (0x80B80005, COMMON_DIALOG_ERROR_NOT_FINISHED) instead of 0x80ED0005. Update GuestPlayGoDialog test and technical debt entry accordingly.
A ds_ordered_count with offset1 bit 4 set swaps the first active lane's value into the GDS counter instead of adding it. Emit it as one device-scope atomic exchange through the same path as the ordered add, and return the counter's previous value to every active lane.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PS4 firmware 10.71 converts "1.2.3.4" followed by a space, tab, LF,
VT, FF or CR, and anything after it ("1.2.3.4 x"), to 1.2.3.4 and
returns 1, where host inet_pton returns 0. Leading whitespace, other
trailing bytes (0x01, 0xa0), "1.2.3 " and IPv6 text with whitespace
still fail there.
A failed conversion leaves the destination and sceNetErrnoLoc
unchanged on the console; Winsock inet_pton writes the parsed prefix
before failing, so the conversion now goes through a local buffer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
v_mad_f32, v_mac_f32, v_madak_f32 and v_madmk_f32 exist only on gfx10.1,
so the RDNA2 oracle can't measure them. Measured on gfx1010 (RX 5700 XT)
in wave32 at IEEE 0 and 1, f32 denormal modes 0 to 3 and round modes 0
to 3, and in wave64, they round the product before the add, flush f32
sources, product (tiny after rounding with an unbounded exponent) and
result in every mode, and choose NaN results like the fma forms.
The behaviour stays left to the driver: translating it on every lane
cost about 15x main on the RX 5700 XT and 23x on an RTX 3070, and a
branch around the exact path still about 6x, so the lowering waits for
the SPIR-V float controls of #981.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A layered draw into a color view of slices 0 to 5 of a 2D surface whose
CB_COLOR_ATTRIB3 declares one slice was refused. The CB clamps the
render target array index to the view's SLICE_MAX, not to the surface's
slice count, so each layer is written one slice pitch further on.
PPSA01317 renders a 512x512 cube map this way. Such a view now renders as
a 2D array of the view's last slice + 1 slices.
AI-assisted: yes
Export sceNpAuthGetAuthorizationCode (NID KxGkOrQJTqY) and
sceNpAuthGetIdToken (NID uaB-LoJqHis) in libSceNpAuth, delegating to the
corresponding V3 implementations.
Add test coverage in GuestNpAuth for both calls covering invalid
arguments, signed-out responses on sync requests, deferred async handling,
and unknown request IDs, as well as sceNpAuthGetAuthorizedAppCode. Update
technical debt documentation.
A RELEASE_MEM with DATA_SEL 4 was refused as "GDS RELEASE_MEM data".
amdgpu's GFX10 packet header gives 4 as the 64-bit system counter and 5
as GDS data. Validation now refuses 4 as the system counter, whose
console frequency and epoch are not known, 5 as GDS data and 6 or 7 as
reserved, and the debt file records the system counter.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The name hashes to zBsgF0q8DIM. Signature and error order follow the
OS 10.01 system module: NOT_INITIALIZED, INVALID_ARG for a NULL output,
INVALID_HANDLE for a bad handle. The emulated pad is not an Access
controller and reports 0.
The OS 10.01 system module checks only that the library is initialised,
then sends a per-process value to ShellCore over Mbus and returns 0 when
that call succeeds. It does not look at pad handles, so the throw while a
pad is open is gone. 0x809200ff, measured in a process that is not a game,
is the failed Mbus call; a game process is assumed to get 0.
kevent threw for EV_CLEAR on a socket or the read end of a pipe; Boost.Asio's kqueue reactor, among others, registers every socket that way. On Linux such a knote now watches its host descriptor through an edge watch. It is armed when added, on every later EV_ADD or EV_ENABLE while enabled, and by each host wakeup; when armed it is checked with the level-triggered readiness test and reported with the current data and EV_EOF, or disarmed if no longer ready, as kqueue_scan re-runs the filter; reporting it disarms it until the next edge. Waits block on the watch's epoll descriptor, so a socket that stays readable does not wake them. Windows and macOS still throw. GuestSockets::NativeDescriptor exposes the host socket behind a guest one for the watch.
The guest's second-kind Bessel functions return -inf and raise the divide-by-zero exception for x = +-0 (see e_jn.c), but the UCRT returns NaN for y1 and yn. Route x == +-0 through a shared helper, cover ynf(2, 0) in the guest math test, and note the special case in the libc technical debt.
