On ds_ordered_count M0 holds the ordered wave ID, not a GDS address as
for ds_append: radeonsi and ACO pass the wave ID as the intrinsic's
pointer and keep the counter address in offset0. Reading M0 as the base
and size skipped the add whenever M0[15:0] was 0, so every wave got the
same range. The test now runs the ordered pass with M0 = 0 and M0 = 7.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
ds_ordered_count adds the first active lane's value to a GDS counter and
returns the previous value, like ds_append adds the lane count. Waves are
not serialized in launch order: each still gets its own range. Ordered
swap and multi-dword counts stay refused. DISPATCH_DIRECT and
DISPATCH_INDIRECT accept ORDERED_APPEND_ENBL (bit 3) of the initiator.
Compute shaders of MXGP 26 (PPSA30839) use both.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
VGT_TF_PARAM.PARTITIONING 3 now compiles to Vulkan's fractional-even
spacing, which radeonsi programs as PART_FRAC_EVEN. Its factors are
bounded at 64 like integer partitioning; Vulkan raises the remaining
ones to at least 2, the D3D11 range for this mode.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Since 794714983 every fiber ran on an mmap'd host stack so that host calls
cannot overrun the small contexts PPSA01341 packs next to each other. A
title that derives state from the stack pointer then reads the wrong
memory: PPSA05684's job fibers have 512 KiB contexts at 1 MiB-aligned
addresses and find their job record by masking rsp with ~0xfffff, so the
job system lost track of a GameInit job and the game waited forever
right after loading big4r/actor76.txt. Its 64 KiB fibers fault later on
a host stack too.
A fiber now gets a host stack only when its context is smaller than
64 KiB; a larger context is the stack again, as on the console. The
limit sits between the 16 KiB contexts that need protection and the
64 KiB ones that need the guest stack (technical debt entry). The fiber
test runs a 512 KiB fiber and checks that its stack is in its context;
it fails without this change.
AI-assisted: yes
The signature (uint32_t service label, const NpUnifiedEntitlementLabel*,
progress*) follows SharpProspero Interop/AppContent/AppContent.cs.
dlc_emu dlc_content.cpp (fcf69b16) answers PARAMETER for a null label or
progress and NOT_FOUND for a label that is not installed additional
content. No additional content is ever installed here, as
sceAppContentAddcontMount, sceAppContentAddcontEnqueueDownload and
sceAppContentAddcontDelete already model, so every other call answers
NOT_FOUND and the progress, whose 16-byte layout SharpProspero gives,
is never written.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceFontCharactersRefersTextCodes fills a 64-byte FontTextCodes with the
order and code of a text character and keeps the current, start and
term characters at +0x28, +0x30 and +0x38. The traversal follows the
PS4 11.00 libSceFont.sprx disassembly posted in the review of #4050,
which implemented the same rules: Refers never compares the character
with the term and returns null for a clustered or synthetic character,
sceFontTextCodesStepNext returns null at the term after visiting it,
sceFontTextCodesStepBack returns null at the start character, and both
steps skip synthetic characters. Null from StepNext at the end of the
chain and from StepBack at the head of the chain is assumed and not
covered by the report.
The signatures follow Orbital's IDA type database and SharpProspero. A
null cursor or output returns null as in KytyPS5; a null text character
throws. guest_font_tests gets configure_windows_unwind so the expected
exception reaches the test on Windows.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Mode 1 keeps subnormal inputs and flushes a result below 2^-126 to a
zero of its sign; mode 2 flushes subnormal inputs and rounds a subnormal
result in the f32 round mode, as measured on RDNA2 (gfx1030) in every
f32 round mode at IEEE=0 and IEEE=1. Both modes threw before.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
v_cmp_X_f32 and v_cmpx_X_f32 flush their denormal inputs by bit 0 of the
FLOAT_MODE f32 denormal field, as measured on RDNA2 (gfx1030): mode 1
keeps them and mode 2 flushes them. Both modes threw before.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A write-back stored on the GPU over memory outside the write watch left its
units without saved guest bytes (only the CPU path saved them), so the next
store of results landing there threw (#5711), and every refresh re-uploaded
the image. The stored ranges are now copied from the retile scratch into a
host-visible buffer behind the store and become the saved bytes when the
batch completes; a store or refresh that needs them first syncs that batch.
Units without a write generation pending when their range leaves the watch
save their bytes there too.
The second-store fixture waits for the GPU before its surface is freed on
every return, as #5790 does for the other cases.
With libSceNet sockets on ordinary descriptor numbers (#4391), poll on a
libSceNet socket threw "neither a socket nor a pipe": poll only knew
libkernel sockets and pipes, while select already asks libSceNet through
its poller. libSceNet now lends libkernel the host socket behind a
descriptor, together with an owner that keeps it open, so poll puts it in
the same WSAPoll or poll call as libkernel sockets. ProsperoLight
(PPSA99002) stopped here on Linux and now reaches its PC list.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EvDbpwUPTa78oCAJqe7m9K
v_cubeid_f32, v_cubesc_f32, v_cubetc_f32 and v_cubema_f32 refused any
output modifier with "VOP3 source modifiers are not implemented";
PPSA11386 stops there on v_cubeid_f32 v, v, -v, -v div:2.
On RDNA2 (gfx1036), over 2048 inputs in every combination of IEEE mode,
the four f32 denormal values and f16/f64 denormals flushed or kept, with
round to nearest even, the four instructions apply mul:2, mul:4 and
div:2 whenever IEEE mode is off, also with f32 output denormals kept,
where v_mul_f32_e64 in the same kernels ignores them, and ignore them
with IEEE mode on. Where applied, the result is the existing bit-level
f32 output modifier result, and clamp is applied after it.
The decoder accepts the modifier on the four instructions. floatCube
applies the shared f32 scaling, now scaleF32Result, in those modes and
writes with the modifier cleared, so clamp is still applied after it.
With IEEE mode on the signaling NaN quieting applies and the modifier is
ignored; with it off the quieting does nothing and the modifier is
applied. agc_driver_vop3_cube_clamp checks each instruction with each
modifier against tables captured on gfx1036.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Fnrk5Dazjb2tLooVSpdRQq
OpenOrbis modules keep read-only data after their code, as executables
do. The syscall scan of sce_module modules decoded it, and the module of
the OpenOrbis library sample (libExample.prx) failed with "Forbidden
syscall instruction". For modules with a PT_SCE_DYNLIBDATA segment, the
scan now stops at the end of the PLT after the last unwind function,
found by FindSceCodeEnd as for executables.
The same modules begin their executable segment with the
/libexec/ld-elf.so.1 string but have no PT_INTERP header, so code
analysis decoded the string and failed with "Unsupported Windows guest
TLS instruction (bytes: 64 2d 65 6c 66 2e)", which is the text "d-elf.".
When no PT_INTERP header covers the start of a PS4 code segment, code
analysis now starts after that exact string.
Add the PS4 functions sceVideoOutSetBufferAttribute and
sceVideoOutRegisterBuffers on top of the existing registration. The PS4
call uses the first free attribute set and returns its index. It
accepts linear A8R8G8B8_SRGB and A8B8G8R8_SRGB buffers, which map to the
PS5 B8G8R8A8 and R8G8B8A8 formats. It throws for tiled buffers, whose
PS4 layout differs from the PS5 one. Linear PS4 buffers may be 4 KiB
aligned: the OpenOrbis graphics sample places its second 1920x1080
buffer 8,294,400 bytes after the first. PS5 buffers keep the 64 KiB
rule. A handle with PS4 buffers writes the PS4 flip status (64 bytes)
and vblank status (32 bytes). Writing the 128-byte PS5 flip status into
the sample's stack structure overwrote its saved frame pointer.
An s_swappc_b64 whose target is not resolved compiles to a faulting call
only at the fallback the table-call linker emits; the linker lists those
calls in the request (GuestContext::linkedCallFallbacks), and every other
computed call is refused at compile time again, as on main. The new
agc_driver_compute_table_calls test runs a linked two-record table on
Vulkan in wave32 and wave64, with SCC 0 and 1 reaching the callee, and a
record past the table reporting the UnlinkedCall fault.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
An s_swappc_b64 whose target pair comes from an s_buffer_load of a buffer
whose descriptor is loaded from user data now calls the targets that buffer
holds: at dispatch the driver reads the buffer, links one copy of each
distinct callee after the caller and rewrites the call into a compare chain
that s_call_b64s the matching copy. A target that matches no copy, and any
other computed call, records an UnlinkedCall fault that the driver reports,
instead of failing the shader at compile time.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Decode and Flush let FFmpeg crop every picture to its display size, so a
1080p H.264 stream came out as 1920x1080 with the chroma after 1080 luma
rows. The console reports and writes the coded picture: EVO-PLAYER-PS5's
hardware run of a 1080p H.264 IDR returned 1920x1088 with pitch 2048 and
the chroma after the 1088 luma rows, and ProsperoLight rejects a 1080p
H.264 or HEVC picture whose height is not 1088. FFmpeg's cropping is now
off, so the frame size, the chroma offset and the sizes in the AVC
picture info are those of the coded picture. The pitch is unchanged, and
the frame size QueryDecoderMemoryInfo reports, which aligns the maximum
height to 32 rows, still holds a picture coded within the maximum and the
macroblock-padded H.264 picture of a maximum given as the display size.
libSceVdecsw derived its crop offsets from the difference between that
size and the macroblock grid, which is now zero. It takes the crop FFmpeg
exports for the picture from libSceVideodec2 instead.
The H.264 fixture is coded at 64x48 with frame_crop_bottom_offset 4: its
pictures are checked at 64x48 and the crop through Vdecsw. The HEVC and
VP9 fixtures are coded at 64x40 and keep their hashes. The new hashes come
from FFmpeg 8.1 decoding with apply_cropping 0, hashed as the tests do;
the same method reproduces every previous H.264, HEVC and VP9 hash.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
A 3D image access bound to a 1D T# matched no runtime image mode and threw
"image descriptor is incompatible with the static runtime image interface"
(SONIC SUPERSTARS, PPSA06888, which reads a 1x1 1D T# as 3D with a plain
image_sample and an image_load). Add a 1D mode for 3D accesses whose only
uses are image_sample_lz, plain image_sample or mip-less image_load.
Measured on RDNA1 (RX 5700 XT, gfx1010) with the hardware oracle:
image_sample_lz reads the texel u selects and ignores v and r with every
addressing mode; a plain image_sample takes its texel and LOD from u alone;
image_load reads the x texel for any y when z is 0 and returns zero for any
other z, as the 3D-on-2D load measured in #2023 does.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01QQNVXyqeecpyneonkYL6H1
fcntl on a guest socket handled F_GETFL and F_SETFL only and failed every other command with EINVAL, so libcurl's fcntl(fd, F_SETFD, FD_CLOEXEC) on a new socket failed (ProsperoRadio PPSA99001, traced by screamm on #4796). Record FD_CLOEXEC per socket descriptor: F_SETFD sets or clears it, F_GETFD reads it, SOCK_CLOEXEC sets it at creation, and dup, dup2 and close start without it, as FreeBSD's kern_fcntl and kern_dup do.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Since registered shaders are prepared in the background, a draw whose shader
was registered just before could wait seconds for its preparation inside the
queue worker. Under CPU load Goat Simulator 3's first submissions took ~3.7 s;
the title treated the GPU as hung, stopped submitting, and its 10 s garbage
collection timeout crashed it on every launch. Driver::Submit now waits for
the preparations queued before it, on the submitting thread, before the
commands reach the GPU.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Leonardo