Following the PS5 3.20 module as read by prosper:
- a second sceGameUpdateInitialize returns 0x80412802, and
sceGameUpdateTerminate without initialization returns 0x80412801;
- sceGameUpdateCreateRequest returns 0x80412801 before initialization;
- sceGameUpdateCheck checks the id, the pointers, the 0x30 sizes and
the zero option and reserved words before initialization;
- sceGameUpdateAbortRequest and sceGameUpdateDeleteRequest return
0x80412805 for an id that was never created instead of success;
- sceGameUpdateGetAddcontLatestVersion checks its pointers before
initialization.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PS5 module checks max_image_width - 1 > 999999 in
scePngDecQueryMemorySize and scePngDecCreate and returns
0x80690003 (INVALID_PARAM). This returned 0x80690002 (INVALID_SIZE)
and accepted a width of 1000001.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Operation 1 threw as unverified, so a title whose call_once path reaches it
stopped. In a payload process on a PS5 (firmware 12.70) operations 0 and 1
fail with EOPNOTSUPP and leave the word unchanged for every word tried,
as FreeBSD 11's __umtx_op_unimpl does. Answer operation 1 like operation 0.
A PS5 (firmware 13.60) reports CPU write 0x2 with CPU read 0x1, 0x80 with 0x40 and 0x200 with 0x100 after a map, sceKernelMprotect, sceKernelMtypeprotect or POSIX mprotect; GPU write 0x20 keeps GPU read 0x10 clear. sceKernelVirtualQuery and sceKernelQueryMemoryProtection now report the protection that way.
NVIDIA's Windows driver reads a host import of guest memory far slower than a buffer it allocated.
Since draw vertex and index ranges are bound in place from host imports (#2253, measured on Linux), Astro
Bot's Crash Site on Windows 11 with an RTX 5070 Ti spends 164 ms of every frame in draws on the GPU, and
45 ms with the ranges copied as before; with the same build, 4.71 fps in place against 7.52 copied. An
RTX 3060 shows the same (draws 32.3 against 24.3 ms per frame), while AMD's Windows driver reads them in
place about as fast as a copy (RX 9070 XT: 69.8 against 73.1 ms), so copying there only costs CPU.
The device decides once (DrawInputsInPlaceUsable, Context::drawInputsInPlace): ranges are copied with
VK_DRIVER_ID_NVIDIA_PROPRIETARY on Windows and bound in place everywhere else. APS5_DRAW_INPUTS_IN_PLACE=1
binds them in place and APS5_NO_DRAW_INPUTS_IN_PLACE=1 copies them on any device, the second winning.
agc_draw_inputs_in_place_driver checks the decision per driver and host; agc_draw_inputs_copied checks
that an aligned imported range is copied and its read not noted when the context copies, whatever the
inherited environment.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GN8FJFTedayRXLHythXkZ4
Mark described image-table ranges explicitly and apply the eager color-target guard only to ordinary image bindings. Cover native multisample table validation and record the separate table registration gap.
The MinGW libstdc++ reports a dangling symbolic link as missing and clears
the error, so std::filesystem::remove neither deletes it nor fails, and
remove_all loops forever over a tree that contains one. Remove reparse
points with DeleteFileW and RemoveDirectoryW and the fixture through the
shell; record the gap in the libs technical debt.
sceNetUsleep fails with EINVAL for a negative count and otherwise sleeps
through libkernel's sceKernelUsleep, a cancellation point. sceNetInetPtonEx
converts as sceNetInetPton does when its flags are 0 and throws for any
other flags, whose meaning is unknown. The signatures follow shadPS4 and
are recorded as unverified in the libSceNet technical debt.
APS5_NO_GPL opened a device without VK_EXT_graphics_pipeline_library and
the five extensions that go with it. The AMD Windows driver shares its
on-disk pipeline cache between devices with and without those extensions,
so a compute pipeline compiled on one kind of device and loaded on the
other ran with the wrong descriptor layout. The startup f32 flush probe
(#6503) runs the same compute pipelines on every device. In a parallel
test run, every APS5_NO_GPL test therefore page-faulted at 0xbeefdeadbeef,
an address read from the probe's own 0xdeadbeef fill. Each fault reset the
GPU, and twice the reset hung the machine.
The device now enables the extensions and their features whenever the
GPU supports them. APS5_NO_GPL only turns off their use, so every device
on a GPU builds the same pipelines.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A CPU read of DISPATCH_INDIRECT arguments waited only through the flush
hook, which waits for the ranges recorded work noted as pending writes.
An address-based store (FLAT/GLOBAL, or through a descriptor the
recompiler cannot resolve to a static buffer) is not recorded as a
pending write: its batch leases the registered allocations, and only the
guest pin waiter finished that batch. So the thread-dimension,
misaligned and disabled paths, the fill-kernel path and the device's CPU
fallback read the arguments from before an address-based producer ran.
GTA V (PPSA04264) dies loading Story on such a read: a 64-thread clear
kernel read {160, 288, 0xffffffff} as thread dimensions
(3x288x4294967295 groups), bytes its 1-thread setup kernel had not yet
overwritten with {n, 1, 1}, and threw "workgroup count
3x288x4294967295 exceeds device limits".
Every CPU read of dispatch arguments at execution now first finishes the
recorder up to the newest batch recorded with a lease
(Graphics::FinishLeaseWork). The group read-ahead still reads without
waiting; a dispatch it resolved is adopted only when the execution-time
read gives the same counts, and one that differs is dropped and counted
in the [groupcap] line. The device limit error names the argument
address and cpuReason, and the driver adds the queue, path and
read-ahead outcome. The [indirect] read time includes the lease wait,
and the [recorder] sync-site table records the offset of
FinishLeaseWork's caller. The CPU reads that still miss address-based
writes (indirect draw arguments and count, the copy kernel's count
record, the awaits-title checks) are listed in the technical debt.
IndirectArgumentsPendingProducer covers the execution-time CPU argument
reads on compute queues and the pending-label CPU fallback in the Vulkan
device. Its sixth case records a real argument label behind a host Vulkan
event in an earlier batch and an address-based producer in the later open
batch. The event releases only after that producer batch is submitted;
a bounded watchdog releases for cleanup but fails the case. It requires
a deferred producer lease, an unsubmitted producer at the argument
decision, cpuReason 2 and the fresh arguments and counter result. Small
valid stale counts keep a broken-wait control finite on every driver.
Exact CPU-reason and watchdog diagnostics identify the failing path. This
replaces a spinning workload whose earlier label could retire before
the fallback decision on lavapipe, allowing a false green with cpuReason 0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Codex <[email protected]>
