The per-descriptor lock exists only in the Windows transfer path, so ShareDescriptor calls SharePositionedTransfer under _WIN32 like GuestFileLockShare. Linux failed to link libkernel with an undefined reference to it.
swscanf (HNnWdT43ues) runs the swscanf_s scanner without the buffer
size arguments after %s, %c and %[, as FreeBSD's swscanf.c passes its
arguments to vswscanf. Both entry points share one engine with a flag
for the sizes; swscanf_s behaves as before.
Title: PS5CEMU-HAR PPSA99360 imports swscanf from libSceLibcInternal.prx
(import audit with --trap-sdk-syscall-stubs, registry index 292, right
after pthread_setaffinity_np at 276). Predicted stop line once
pthread_setaffinity_np resolves, without this change:
FAIL: unresolved ELF import HNnWdT43ues (swscanf) from libSceLibcInternal.prx
NID from tools/nid_names.py, confirmed in shadPS4 aerolib.inl:51950
(e0a466753a1a). Prototype in ps5-payload-dev include/freebsd/wchar.h:133,
export in sce_stubs/libSceLibcInternal.c:8582 (f5d40f02770e).
Co-Authored-By: Claude Fable 5.1 <[email protected]>
A family 255 instance with more than one channel carries no stream count
or mapping in its initialization words, so its decoder now opens on the
first packet: the multistream packet's self-delimited streams are counted
(RFC 6716 appendix B), each stream's TOC stereo flag marks it as coupled,
and the channels map in order. A packet whose streams do not make the
channel count throws.
Metal Gear Solid 4 Master Collection (PPSA18194) initializes a 4-channel
family 255 decoder for its intro movie.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
No additional content is ever installed, so deleting one finds nothing:
a null entitlement label answers PARAMETER and any other NOT_FOUND, the
same way sceAppContentAddcontEnqueueDownload does.
Metal Gear Solid 4 Master Collection (PPSA18194) imports it in its game
executable, which fails to load without it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
check_skips.py accepts a skip only when its message reads "skipped, the
device has no ...". Float16Native printed the reason before "skipped",
so the Linux job rejected its expected skip on llvmpipe. Use the wording
PackedFloat16Native already has.
FindF16x2Math read spirv[offset + 1] for every instruction once the f16 vector type was known, so a final one-word OpFunctionEnd read past the module. Check the opcode and its minimum word count before reading operands.
v_add_f16, v_sub_f16, v_subrev_f16 and v_mul_f16 converted their
sources to f32, computed in f32 and converted the result back. When the
device has native f16 that rounds to nearest even and keeps f16
denormals, and FLOAT_MODE does the same for f16 (or the shader has no
FLOAT_MODE), they are now one f16 add or mul on the source bits (sub
adds the negated subtrahend), followed by the FP16_OVFL and clamp rules
on the result bits. Other f16 modes, including the f16 denormal
flushes, keep the f32 path.
Results other than NaN payloads don't change, for the same reason as
for the packed instructions: rounding an f16 sum or product to f32 and
then to f16 gives the correctly rounded f16 result, which Vulkan
requires of f16 OpFAdd and OpFMul. A NaN result keeps the payload the
driver gives, as before (TechnicalDebt lists the NaN payloads of scalar
f16 arithmetic as the driver's); it is now the payload of the driver's
f16 arithmetic rather than of its f32 arithmetic.
v_fma_f16, v_fmac_f16, v_fmamk_f16 and v_fmaak_f16 keep their exact f32
path, since a native f16 Fma is not required to be fused.
New test agc_driver_float16_native compiles one shader with these
instructions and the fma forms (abs, neg, op_sel, clamp, inline
constant and literal variants) with and without Float16, checks that
only add and mul use f16 math, and compares the results bit for bit in
ten float modes, accepting another NaN payload only where both results
are NaN, and checks that a mode that flushes f16 denormals keeps the
f32 path.
VLC (PPSA85300) fails to load on the missing getdtablesize import now that
readdir_r is in. Its only call is in a spawn child that never runs, and the
console's descriptor limit is unknown, so the export throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Device buffers now choose their memory type as sampled textures and
storage images do since #4108: when the allocation does not fit in the
budget VK_EXT_memory_budget reports for the device-local heap, it goes
to a memory type on another heap. A buffer placed so is destroyed on
release instead of entering the device tier of the pool, so later
requests do not reuse host memory as device memory.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Check prefixed forbidden instructions at the segment end, outside its file range, and truncated before a byte that remains in the input file.
AI-assisted: OpenAI Codex
A 2D array storage view of a depth plane from slice 0 threw. It now gets
a storage image over all its slices: each slice with a depth surface at
the plane's address plus a whole depth slice per layer is copied from
that surface before every use and back after the work; the other slices
hold guest memory like any storage image. Cubes, stencil arrays, later
base slices and layer pitches other than the depth slice size still
throw.
GTA V (PPSA04264) stops at compute shader 0x242d4a200 on a 5-slice R32
Z_64KB_X array over its shadow depth surfaces.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01V1W4jdNSKTV7xwuS6xQPJV
SW_64KB_Z_X (0x18) color targets use the texture equations and 64 KiB
block geometry of that swizzle mode, including the equation bits above
the block that R_X targets already apply. PPSA12361 renders the R32
float copy of its depth into one.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD sysctl_find_oid returns ENOTDIR when the MIB continues below a leaf object. The supported hw.ncpu, hw.model, hw.physmem and kern.arandom MIBs threw an unsupported MIB error instead.
(cherry picked from commit 6968aea8af578c4d56dc614cbe449274bb6e76e7)
PS5MC (PPSA99420, Kodi 22) imports getpriority (miQ1wVwSexE) from
libkernel.prx, one reference, next to chflags in its import order.
Predicted stop once the imports ahead of it are covered (not a run):
FAIL: unresolved ELF import miQ1wVwSexE from libkernel.prx
The NID is computed with tools/nid_names.py and matches aerolib.
Follows FreeBSD 11.4 sys/kern/kern_resource.c sys_getpriority
(8c639945a44588f6cfdddfb057bb5aad88735da0) for the only guest process,
taken to run at nice 0 and to lead its own process group (as kill and
setsid already assume): PRIO_PROCESS and PRIO_PGRP with 0 or its pid,
and PRIO_USER with 0 or its uid 0, return 0; other ids give ESRCH and
an unknown which gives EINVAL. getpriority is a bare system call in
FreeBSD's libc (lib/libc/sys/Symbol.map), so errno is left unchanged
on success.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
(cherry picked from commit 63262245d274342b693fda146ae9feca3752b6e3)
Asynchronous GPU sample counter dumps record into command buffer runs that are submitted asynchronously, or queued when label runs per batch are active. Titles whose guest CPU visibility or occlusion query paths directly read sample dump buffers (such as Unreal Engine 4's visibility thread) poll memory without waiting on a GPU fence. Because guest memory uses write watching rather than read trapping, these CPU reads do not hit flush hooks, observing unready memory or zero passed samples and causing false-negative visibility culling and flickering geometry.
Allow falling back to synchronous CPU sample counter dumps via APS5_SYNC_SAMPLE_DUMPS or APS5_NO_GPU_SAMPLE_DUMPS, while keeping GPU sample dumps enabled by default to preserve performance on titles that benefit from asynchronous GPU evaluation.
A title can hand the GPU a buffer or descriptor V# based at an address above the
Windows user-mode address space (Kena: Bridge of Spirits, PPSA01746, bases a V#
at 0xf00000000000). VirtualQuery fails for any address above
lpMaximumApplicationAddress, so describePages returned "not queried" and the
driver aborted with "AGC driver: cannot query guest memory", although nothing can
ever be mapped there and the shader never dereferences it.
Above the user address limit, report the range as unmapped (as the Linux
procmap/maps path already does for an uncovered range) instead of failing the
query. The limit is read once from GetSystemInfo.
Tested: Windows 11, MinGW-w64 GCC 15.2.0, Release, agc_driver_graphics_tests
passes with the change and fails without it ("cannot query guest memory").
GPUs tested: NVIDIA GeForce RTX 4070 SUPER.
A captured word that no longer matches a live import or mirror only means the
capture raced a guest write; the GPU reads the live bytes either way, as the
hardware would. The compare now counts such mismatches and reports them with
the snapshot, the region and the first differing offset at most every 10 s
instead of throwing; APS5_SNAPSHOT_CHECK_FATAL=1 restores the throw, and a
snapshot-backed region still fails, now naming the snapshot, the region and
the first differing offset. PPSA15304 (engine: Unreal Engine 5) hit the throw
within 65 to 91 s of reaching its title screen.
Forspoken (PPSA03984) has a pixel shader with
v_interp_p2_f16 v1, ..., v7 op_sel:[0,0,0,1], and main throws
"VOP3 interpolation modifiers are not implemented" one second after
start.
On GFX10, op_sel[3] of a 16-bit VOP3 result selects the high half of
the destination and keeps the other half. The decoder already maps
that bit to destination.sdwaSel 5 for the other 16-bit VOP3 ops, and
write16Bits/writeRawU32 then insert the result into bits 31:16 and
keep bits 15:0. v_interp_p2_f16 is the only 16-bit-result
interpolation instruction, so only it accepts the bit; other op_sel
bits and the bit on the 32-bit-result p1ll/p1lv forms are still
refused.
agc_vop3_interp_decode checks the decoded selector with and without
the bit, and that v_interp_p1ll_f16 still refuses it. In
agc_driver_interpolation_f16 the second v_interp_p2_f16 now writes the
high half of a register holding 0x00001234, and the GPU result must
keep 0x1234 in the low half.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
v_cvt_f32_ubyte0 accepts every SDWA source selector, but the other three byte
conversions had no VOP1 SDWA rule, so any SDWA source select on them was refused
("VOP1 SDWA source selector 4 of opcode 0x12 at pc 0xfcc is not supported").
The selected and optionally sign-extended source goes through the same operand
path as for ubyte0 before byte N is extracted: SDWA supplies source 0 (RDNA 2 ISA
guide 6.8 and 13.3.7) and the opcode reads S0.u[8N+7:8N] (12.8).
agc_driver_sdwa_cvt_f32_ubyte: WORD_0 and WORD_1 selects on ubyte1, and
sign-extended WORD_1 and BYTE_3 selects on ubyte2 and ubyte3.
GetEnvironmentVariableA leaves the buffer undefined when the value does not fit, so a 16-byte read disabled longer settings. A size query treats every nonempty value as enabled and still leaves unset and empty disabled.
Co-authored-by: Cursor <[email protected]>
Dead Cells (PPSA15552) calls sceNgs2VoiceGetState on custom sampler
voices with a 48-byte buffer and reads the 64-bit value at offset 16 as
a running counter. Fill it with the decoded sample count, keep the
common state flags, and return INVALID_OUT_SIZE for other sizes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Crimson Desert (PPSA25286) calls sceKernelStat with a null buffer at
start-up, and main throws "sceKernelStat: sb is null", which ends the
title in its first second.
FreeBSD 11.4 looks the path up first and only then copies the result
out, so a null buffer gets EFAULT for a path that exists and the lookup
error for one that does not (sys/kern/vfs_syscalls.c, sys_stat):
error = kern_statat(td, 0, AT_FDCWD, uap->path, UIO_USERSPACE,
&sb, NULL);
if (error == 0)
error = copyout(&sb, uap->ub, sizeof (sb));
sceKernelStat now does the same: the lookup and its errors are as
before, and a null buffer returns SCE_KERNEL_ERROR_EFAULT where the
status would be copied.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The shader info collector refused an out-of-range interpolation parameter
reference without saying which one. The message now gives the attribute,
component and mode it read and the pixel input count it was checked
against, so a title's stop at this check names the attribute its pixel shader
reads past the inputs the draw declares.
Test: interpolation_reference_range builds pixel programs with an
attribute past the inputs, a component past w and a reserved mode, and
checks the message names each.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Co-authored-by: overlordxrz-source <[email protected]>
On Linux and macOS every guest module listed the converting executable's
own DT_NEEDED system libraries, so its bytes could depend on which
executable converted it. --executable then failed with "Guest modules
convert differently" when the executables need different system
libraries that the modules do not, or the same ones in another order.
It is the error METAL GEAR SOLID: Peace Walker (PPSA18216, #5268)
reports on Linux for its launcher and mgspw.elf. Guest modules now list
only the system libraries the guest modules themselves need, with the
libSceLibcInternal.prx to libc.prx rule. The executable's own DT_NEEDED
is unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
David