The C runtime allows 512 stdio streams by default, so after about 509
guest fopen/fdopen streams every further stream failed with EMFILE,
including the std::ifstream APR opens for each read, while getrlimit
reports 8192 open files. Raise the limit to 8192 when libkernel loads,
as the Linux build raises RLIMIT_NOFILE.
A picture deeper than 8 bits threw ("output deeper than 8 bits is not
implemented"), which stops Mortalfin (PPSA99141) as soon as it plays an HEVC
Main10 video (#6640).
A 10-bit picture is now written as 16-bit little-endian words with the sample
in the low 10 bits: Y rows, then interleaved UV rows at framePitchInBytes
times the height. framePitch is in samples and framePitchInBytes in bytes
(twice the width, aligned to 256). QueryDecoderMemoryInfo sizes a frame of an
HEVC or VP9 profile 2 configuration with two bytes per sample.
The layout and sizes follow EVO-PLAYER-PS5, which decodes and presents 1080p
HEVC Main10 on hardware through this path: its 10-bit check
(pitch_bytes >= pitch * 2), its UV offset, its low-bit sampling factor, and
the 1920x1088 Main10 frame buffer its hardware log reports (6128 KB after
rounding to 16 KiB).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Library functions and shader instructions were drawn on one y-axis with
ambiguous labels and overlapping fills. Each now gets its own panel and
scale, with implemented (solid) against declared (dashed); shaders gain
their declared total from the ISA list. Date labels are horizontal and
every day has a hover tooltip.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceVideoOutOpen with bus type 0x20, the PS VR2 output PPSA05666 opens as
SCE_VIDEO_OUT_BUS_TYPE_HMD2_MAIN after sceHmd2ReprojectionEnableVrMode, threw
VIDEO_OUT_ERROR_INVALID_VALUE and aborted the title. The console returns that
code to a process that is not a game, with the headset connected and worn or
not, for users 255 and 0 and for a null or zeroed open parameter, so the bus
is answered that way before the other argument checks and the title carries
on with the error as its handle, as it does on the console without a headset.
The debt entry records the sequence the title follows on that handle
(RegisterBuffers2 with category 16 and 4000x2040 descriptors that point at
Hmd2 per-eye textures, ConfigureOutput and IsOutputSupported with 0x2000F, a
GPU wait on buffer 0), which a VR backend will have to model, and the test
covers the bus and the HMD output modes 0x20001 and 0x2000C to 0x20010, which
the console and this implementation answer with VIDEO_OUT_ERROR_UNKNOWN_OUTPUT_MODE
on the TV bus.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Filled rectangles (VGT_PRIMITIVE_TYPE 7 and 17) use the same single-sample MSAA_ENABLE path as triangles; PPSA03541 stops on a rect-list draw otherwise.
Co-authored-by: Cursor <[email protected]>
The range starts at 0x10_0000_0000 on macOS 26.5 and at 0xF_C000_0000 on
macOS 27. The M2 Max on macOS 27.2 shows the same start as the M4 Pro on
27.0.1, so the line lists the macOS version first and the chips only as
the machines it was measured on.
PPSA15552 passes matching front/up after a listener move; pick a perpendicular up hint instead of throwing so Dead Cells can keep running.
Co-authored-by: Cursor <[email protected]>
Since #7323 sceHmd2Initialize succeeds and sceHmd2Open returns a handle,
so PPSA01317 runs its PS VR2 set-up and aborts on
sceHmd2ReprojectionQueryBufferSizeAlign, which is not implemented
(reported in #6350). AnyPS5 has no PS VR2 or PC VR support, so
initialization returns libSceHmd's UNSUPPORTED_FEATURE (0x81110016)
again, as before #7323, and titles skip their VR set-up. sceHmd2Open
then returns NotInitialized. The reprojection size queries stay
unimplemented.
Refs #6350
RADV initializes and fast-clears DCC keys with its fill_memory compute
kernel, which stores through a global address. Run as an ordinary
dispatch, its stores name no range. The DCC key tracking therefore saw
a key fill only once it had landed in guest memory, which could be
after later writes to the surface had already been recorded.
vkQuake (PPSA99010) hits this on every item pickup:
- the scene renders into a second color buffer;
- RADV's UNDEFINED -> GENERAL barrier fills color buffer 0's keys with
DCC_CLEAR_0000;
- a screen-effects compute pass writes color buffer 0;
- the UI pass draws on color buffer 0.
The keys landed while the UI pass was being recorded. The refresh took
them for a clear made after the compute pass, dropped its results and
cleared the image to black. For the length of the pickup flash the
scene was black, with only the HUD drawn.
The fill HLE now matches the 16-byte variant of the kernel as a fill of
min(threads * 16, user[4] + 16) bytes. The kernel takes its address in
user[2..3], its largest store offset in user[4] and its value in
user[5]. A key fill through it is handled where it is in the command
stream.
In a payload process on a PS5 (firmware 12.70), the strtod and wcstod
of libSceLibcInternal.sprx keep the payload of a NAN(...) sequence,
read as FreeBSD 11's gdtoa hexnan reads it, under the quiet bit and
with the sign. strtof, wcstof, strtold and wcstold return the positive
default quiet NaN whatever the sign and the sequence, and consume a
sequence of letters, digits and underscores up to its closing
parenthesis. Here every NaN lost its payload, and strtof and strtold
kept the sign.
The model reproduces the 64 NaN inputs that p11, p14, p27 and p33
measured, including blanks and other characters inside the parentheses
and unterminated sequences, and the test now pins them. It also pins
two p71 cases measured through strtod: nan(1 2), and "nan( " followed
by NUL and ")". In hexnan, a blank after a payload digit, while a
32-bit word of the payload is still free, starts a blank skip that has
no NUL check, so when only blanks follow up to the terminating NUL the
console reads past it (p71); that case throws here. A blank right after
"nan(" is skipped with a NUL check, and the console stopped at the NUL
there.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every unverified point of the libSceSsl debt entry was measured on a PS5 on
system software 13.40 with a ps5-payload-dev payload against a TLS 1.2 test
server presenting leaves issued by the test fixture root. The code follows the
console where it differed: initial verify options 0x25 with the date checks
off, bits outside 0x3F rejected, the verify callback called with the context
id and the bitmask of failed checks and re-run from every later call after a
negative return, sceSslRead flags 0 reading until the requested length,
streams that end without close_notify reading as 0, resets reported with the
libSceNet codes, receive timeouts as SSL_ERROR_WANT_POLLIN, a fatal alert
ending the transport, sceSslClose as a repeatable no-op before the handshake,
read and write before connect running the handshake, SSL_ERROR_INVALID_ID for
unknown or deleted handles and terminated contexts, sceSslSetMinSslVersion
accepting 2 to 5, an empty ALPN list rejected, long attribute names from
sceSslGetNameEntryInfo and sceSslGetSerialNumber leaving the caller's length.
The debt entries record the measured values and what stays unmeasured.
The summary line names the CPU, its thread count, physical memory and,
with param.json, the title ID, name and content version.
APS5_TRACE_BENCH=1 with APS5_TRACE_SUMMARY_EVERY rewrites
aps5-bench-<commit>-<pid>.json.gz at each interval with the time between
every two presents, so reports can be recomputed and checked from raw
frame times. param.json's contentVersion is read when present.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean Galvin