A CPU read of DISPATCH_INDIRECT arguments waited only through the flush
hook, which waits for the ranges recorded work noted as pending writes.
An address-based store (FLAT/GLOBAL, or through a descriptor the
recompiler cannot resolve to a static buffer) is not recorded as a
pending write: its batch leases the registered allocations, and only the
guest pin waiter finished that batch. So the thread-dimension,
misaligned and disabled paths, the fill-kernel path and the device's CPU
fallback read the arguments from before an address-based producer ran.
GTA V (PPSA04264) dies loading Story on such a read: a 64-thread clear
kernel read {160, 288, 0xffffffff} as thread dimensions
(3x288x4294967295 groups), bytes its 1-thread setup kernel had not yet
overwritten with {n, 1, 1}, and threw "workgroup count
3x288x4294967295 exceeds device limits".
Every CPU read of dispatch arguments at execution now first finishes the
recorder up to the newest batch recorded with a lease
(Graphics::FinishLeaseWork). The group read-ahead still reads without
waiting; a dispatch it resolved is adopted only when the execution-time
read gives the same counts, and one that differs is dropped and counted
in the [groupcap] line. The device limit error names the argument
address and cpuReason, and the driver adds the queue, path and
read-ahead outcome. The [indirect] read time includes the lease wait,
and the [recorder] sync-site table records the offset of
FinishLeaseWork's caller. The CPU reads that still miss address-based
writes (indirect draw arguments and count, the copy kernel's count
record, the awaits-title checks) are listed in the technical debt.
IndirectArgumentsPendingProducer covers the execution-time CPU argument
reads on compute queues and the pending-label CPU fallback in the Vulkan
device. Its sixth case records a real argument label behind a host Vulkan
event in an earlier batch and an address-based producer in the later open
batch. The event releases only after that producer batch is submitted;
a bounded watchdog releases for cleanup but fails the case. It requires
a deferred producer lease, an unsubmitted producer at the argument
decision, cpuReason 2 and the fresh arguments and counter result. Small
valid stale counts keep a broken-wait control finite on every driver.
Exact CPU-reason and watchdog diagnostics identify the failing path. This
replaces a spinning workload whose earlier label could retire before
the fallback decision on lavapipe, allowing a false green with cpuReason 0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Codex <[email protected]>
The C runtime allows 512 stdio streams by default, so after about 509
guest fopen/fdopen streams every further stream failed with EMFILE,
including the std::ifstream APR opens for each read, while getrlimit
reports 8192 open files. Raise the limit to 8192 when libkernel loads,
as the Linux build raises RLIMIT_NOFILE.
A picture deeper than 8 bits threw ("output deeper than 8 bits is not
implemented"), which stops Mortalfin (PPSA99141) as soon as it plays an HEVC
Main10 video (#6640).
A 10-bit picture is now written as 16-bit little-endian words with the sample
in the low 10 bits: Y rows, then interleaved UV rows at framePitchInBytes
times the height. framePitch is in samples and framePitchInBytes in bytes
(twice the width, aligned to 256). QueryDecoderMemoryInfo sizes a frame of an
HEVC or VP9 profile 2 configuration with two bytes per sample.
The layout and sizes follow EVO-PLAYER-PS5, which decodes and presents 1080p
HEVC Main10 on hardware through this path: its 10-bit check
(pitch_bytes >= pitch * 2), its UV offset, its low-bit sampling factor, and
the 1920x1088 Main10 frame buffer its hardware log reports (6128 KB after
rounding to 16 KiB).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceVideoOutOpen with bus type 0x20, the PS VR2 output PPSA05666 opens as
SCE_VIDEO_OUT_BUS_TYPE_HMD2_MAIN after sceHmd2ReprojectionEnableVrMode, threw
VIDEO_OUT_ERROR_INVALID_VALUE and aborted the title. The console returns that
code to a process that is not a game, with the headset connected and worn or
not, for users 255 and 0 and for a null or zeroed open parameter, so the bus
is answered that way before the other argument checks and the title carries
on with the error as its handle, as it does on the console without a headset.
The debt entry records the sequence the title follows on that handle
(RegisterBuffers2 with category 16 and 4000x2040 descriptors that point at
Hmd2 per-eye textures, ConfigureOutput and IsOutputSupported with 0x2000F, a
GPU wait on buffer 0), which a VR backend will have to model, and the test
covers the bus and the HMD output modes 0x20001 and 0x2000C to 0x20010, which
the console and this implementation answer with VIDEO_OUT_ERROR_UNKNOWN_OUTPUT_MODE
on the TV bus.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Filled rectangles (VGT_PRIMITIVE_TYPE 7 and 17) use the same single-sample MSAA_ENABLE path as triangles; PPSA03541 stops on a rect-list draw otherwise.
Co-authored-by: Cursor <[email protected]>
The range starts at 0x10_0000_0000 on macOS 26.5 and at 0xF_C000_0000 on
macOS 27. The M2 Max on macOS 27.2 shows the same start as the M4 Pro on
27.0.1, so the line lists the macOS version first and the chips only as
the machines it was measured on.
PPSA15552 passes matching front/up after a listener move; pick a perpendicular up hint instead of throwing so Dead Cells can keep running.
Co-authored-by: Cursor <[email protected]>
Since #7323 sceHmd2Initialize succeeds and sceHmd2Open returns a handle,
so PPSA01317 runs its PS VR2 set-up and aborts on
sceHmd2ReprojectionQueryBufferSizeAlign, which is not implemented
(reported in #6350). AnyPS5 has no PS VR2 or PC VR support, so
initialization returns libSceHmd's UNSUPPORTED_FEATURE (0x81110016)
again, as before #7323, and titles skip their VR set-up. sceHmd2Open
then returns NotInitialized. The reprojection size queries stay
unimplemented.
Refs #6350
RADV initializes and fast-clears DCC keys with its fill_memory compute
kernel, which stores through a global address. Run as an ordinary
dispatch, its stores name no range. The DCC key tracking therefore saw
a key fill only once it had landed in guest memory, which could be
after later writes to the surface had already been recorded.
vkQuake (PPSA99010) hits this on every item pickup:
- the scene renders into a second color buffer;
- RADV's UNDEFINED -> GENERAL barrier fills color buffer 0's keys with
DCC_CLEAR_0000;
- a screen-effects compute pass writes color buffer 0;
- the UI pass draws on color buffer 0.
The keys landed while the UI pass was being recorded. The refresh took
them for a clear made after the compute pass, dropped its results and
cleared the image to black. For the length of the pickup flash the
scene was black, with only the HUD drawn.
The fill HLE now matches the 16-byte variant of the kernel as a fill of
min(threads * 16, user[4] + 16) bytes. The kernel takes its address in
user[2..3], its largest store offset in user[4] and its value in
user[5]. A key fill through it is handled where it is in the command
stream.
In a payload process on a PS5 (firmware 12.70), the strtod and wcstod
of libSceLibcInternal.sprx keep the payload of a NAN(...) sequence,
read as FreeBSD 11's gdtoa hexnan reads it, under the quiet bit and
with the sign. strtof, wcstof, strtold and wcstold return the positive
default quiet NaN whatever the sign and the sequence, and consume a
sequence of letters, digits and underscores up to its closing
parenthesis. Here every NaN lost its payload, and strtof and strtold
kept the sign.
The model reproduces the 64 NaN inputs that p11, p14, p27 and p33
measured, including blanks and other characters inside the parentheses
and unterminated sequences, and the test now pins them. It also pins
two p71 cases measured through strtod: nan(1 2), and "nan( " followed
by NUL and ")". In hexnan, a blank after a payload digit, while a
32-bit word of the payload is still free, starts a blank skip that has
no NUL check, so when only blanks follow up to the terminating NUL the
console reads past it (p71); that case throws here. A blank right after
"nan(" is skipped with a NUL check, and the console stopped at the NUL
there.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
