Check module headers, instruction lengths and required operands before
scanning narrow types.
Cover malformed and byte-swapped modules while retaining the native
SPIR-V 1.3 conversion matrix.
Tested: Linux/llvmpipe CTest three times with SPIRV-Tools on and off,
cold-cache Vulkan regressions, and ASan/UBSan in all optimization modes.
Skip CCP and Simplification for storage-only narrow types while keeping
the remaining passes and arithmetic-capable folding.
Add compiler and Vulkan readback regressions for default/full/none modes.
Tested: Linux/llvmpipe, full CTest with SPIRV-Tools on/off, ASan/UBSan
optimizer checks, and cold-cache Vulkan wave32/wave64 readback.
Fixesboykopovar/AnyPS5#1276
Invoke the title callback on planar mixed samples and silence. Preserve per-voice callback data, reset registration on setup, and release the render guard on callback failure. Include behavioral tests and source references. Written with AI assistance.
A draw that sets STENCIL_CLEAR_ENABLE was rejected as a whole, so its
color output was lost as well. The draw is now rasterized with every
covered sample's stencil replaced by DB_STENCIL_CLEAR, whatever the
stencil and depth tests are, and its color outputs are written as usual.
The depth/stencil state is decoded for such a draw even when
DB_DEPTH_CONTROL enables no test. Depth clear, copy, resummarize and
decompress draws are still rejected.
describePages parsed the whole /proc/self/maps for every run it
reported. On kernels with the PROCMAP_QUERY ioctl (Linux 6.11+) each run
is now one ioctl on an open /proc/self/maps fd with
PROCMAP_QUERY_COVERING_OR_NEXT_VMA, which returns the covering or next
VMA and its read/write flags straight from the kernel, so the answer is
exact for host mappings too. A VMA starting above the cursor is a gap up
to its start and ENOENT is a gap to the end. Kernels without the ioctl
keep the line scan.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A V# whose base is not a multiple of 4 bytes from the start of its GPU
owner threw in GuestBufferMemory::Descriptor, because the shader added
the offset below the view only in whole dwords.
Descriptor now binds from the offset alignment below the view and
passes the whole remainder. Such a view's range covers the dwords
around it, and its descriptor region starts and ends on dword
boundaries, so a lone view copied to its own buffer binds the same way.
The buffer specialization records the V# base's low two bits. Raw
vector loads through such a V# join two dwords, glc dwordx2 loads
included, stores merge their bytes into both with compare-exchange
loops, and bounds checks include the second dword. s_buffer_load
ignores the low two bits, as SrtEvaluator does. Formatted accesses
whose element alignment (min(element bytes, 4)) the base breaks throw,
as they fault the wave on RDNA2, and so do atomics.
SleepUntil, PollSleepUntil and SleepNanosCoarse each wait on one
thread_local high-resolution timer. A sceKernelRaiseException handler
that runs as an APC inside a sleeping thread's wait and sleeps itself
re-armed that timer and consumed its signal, so the interrupted sleep
never returned. A nested TimerWait now waits on its own timer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Preserve files across unmount, block new lookups until remount, and validate mount-dependent operations. Keep prior-run storage inaccessible after initialization.
Written with AI assistance.
StorageTexture::MarkDirty skips the first write's uncompressed key
store while the image's filledKeys holds a clear code, and only an
upload or clearByKeysFill reset that fill. After a 0001 key fill, a
kernel storing 0000 over the keys and a storage write, the refresh of
write-watched memory read 0000, the keys the image was uploaded under,
so it did not upload again and kept the stale 0001. The write then
left the 0000 keys in memory, and a kernel reading them saw the clear
colour.
StorageTexture::ProvedKeys, the key read of Refresh and the fast
revalidation, now forgets the fill when it reads other keys while the
image has no results pending. An image with pending results keeps it,
since its write-backs treat those results as killed by that fill.
Since #1156 a title's bundled sce_module/libc.prx is loaded for its
exports but its init is suppressed, while titles still call its malloc,
which then returns NULL (#1500). On Linux, titles that bundle libc crash
at launch: one segfaults within 0.2 s, another stops with bad_alloc.
This reverts commit 2d6aff7a1e, reversing
changes made to e82e03f11e.
send, sendto and sendmsg rejected every flag with EOPNOTSUPP, so callers
that pass FreeBSD's MSG_NOSIGNAL (0x20000) could not send at all. Accept
it: Windows sockets never raise SIGPIPE, and on Linux it maps to the
native MSG_NOSIGNAL. Other flags still fail with EOPNOTSUPP.
DOOM (PPSA99666) sends its upload server replies with MSG_NOSIGNAL and
closed every connection without an answer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Translate the FreeBSD pollfd layout and flags to WSAPoll on Windows and
poll on Linux. Closed socket descriptors report POLLNVAL, a timeout below
-1 fails with EINVAL and a null array with EFAULT. Non-socket
descriptors, unknown event bits, POLLPRI on Windows and an infinite wait
without sockets throw; these are recorded in TechnicalDebt.
DOOM (PPSA99666) imports poll for its upload server.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
ClassifyInstruction assumed a ModRM byte right after every opcode that
was not a near branch. A length-changing rewrite therefore adjusted
immediates such as MOVABS imm64 that looked like a RIP-relative ModRM,
and missed RIP-relative operands of VEX and 0F 38 / 0F 3A instructions
and the rel8 targets of LOOP and JRCXZ. Take the RIP-relative
displacement and branch target from DecodeInstruction instead.
Guest C built with -fexceptions binds __gcc_personality_v0 to
__gcc_personality_v0_nid_postfix, and the unwinder recognizes the frame
by that address. exception_c_cleanup links the host personality, so it
passed without the export.
The new test builds a call-site table by hand and drives the routine the
way the unwinder does: through the _nid_postfix symbol and through
CallPersonality. It covers the cleanup phase installing the landing pad,
the search phase continuing, ranges before and after the call site, a
call site with no landing pad, no LSDA, a signal frame, an unsupported
version, and an unknown personality. Without the export it fails to link.
On macOS the host keeps libc++abi: libc++ binds __cxa_throw two-level,
so moving only the personality into this runtime would leave the two
halves disagreeing on the exception header. The host personalities stay
libc++abi's and libunwind's, and libc.prx serves guest code:
- the guest's libstdc++ std::exception_ptr is modelled directly, since
libc++'s differs, and the Itanium type_info layouts that libc++abi
keeps private are declared for the runtime;
- guest frames are found through their PT_GNU_EH_FRAME, using a
dl_iterate_phdr emulation over the ELF program headers that relinked
images keep in __APS5DATA,__meta (written by relinker --macos, which
comes in a later pull request);
- host frames are found by scanning __TEXT,__eh_frame;
- sceKernelGetModuleInfoForUnwind uses the same emulation and falls back
to dladdr for host images.
The libc++ paths compile only with libc++/libc++abi and the rest only
on __APPLE__, so Linux and Windows builds are unchanged.
exception_c_cleanup throws from host code, which this runtime does not
serve on macOS, so it is not built there.
Guest C built with -fexceptions imports __gcc_personality_v0 for its
cleanup frames, and libc.prx did not export it. The routine becomes
__gcc_personality_v0_nid_postfix, the host __gcc_personality_v0
forwards to it as __gxx_personality_v0 already does, and
CallPersonality recognizes both names.
The GFX10 lowering of a wave64 reduction scans rows with DPP row_shr
1/2/4/8 and v_permlanex16_b32 under EXEC -1, then joins lanes 31 and 63
with a scalar op. The console fills lanes outside the entry EXEC with
the identity, but on the host they can be helpers that sit out subgroup
operations or invocations that were never launched: on 64 lanes (RADV)
the emulated chain reads 0 or stale values from them, and on 32 lanes
lane 63 throws since #997.
EmitReadLane now recognises the sequence on any host for UMin, UMax,
SMin, SMax, IAdd, AND and OR when the keys are the identity outside the
entry EXEC. On 64 lanes, lanes 31 and 63 become subgroup reductions of
the keys of invocations 0-31 and 32-63; on 32 lanes or fewer, lane 31
reduces all keys and lane 63 is the identity. It throws without
subgroup arithmetic or on a subgroup wider than the wave. VulkanDevice
reports GroupNonUniformArithmetic and ShaderValidation checks it.
guest_formatting_tests runs only on Windows and windows_exception_tests only
exists there, so the stale-entry check failed the Windows job.
Co-Authored-By: Claude <[email protected]>
sceKernelGetProcessTime and sceKernelGetProcessTimeCounter subtracted
GetStartNanos() from GetMonotonicNanos() in one expression. GCC reads the
clock first, so on the first call in a process the start was captured
after it and the result wrapped to about 2^64.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
UD1 (0F B9 /r) always raises #UD, like UD2, but DecodeInstruction
reported it as sequential. Reachability analysis then followed the
bytes after it, so an import reachable only through that fallthrough
was kept by the strict unused NID filter. UD1 keeps its ModRM, so a
RIP-relative operand is still reported.
#1398 and #1399 both rewrite the sceRtcParseDateTime entry that the s_sethalt entry followed. It now follows the libSceAudio3d entries, which no open pull request edits, so either can merge first without a conflict.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
#1372 adds its test after the vop1 decode tests and #1314 its debt entry after s_setkill, the places where this branch added its own. The wave control decode test now precedes the vop1 decode tests and the s_sethalt entry follows sceRtcParseDateTime, so either pull request can merge first without a conflict.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The test is added to ctest in its own BUILD_TESTING block, as agc_vop1_sdwa_move_decode is, instead of in the shared test list that #1187 also extends.
s_sethalt with SIMM16[0] clear is a no-op; s_sethalt 1, s_sendmsghalt, a reached s_code_end, s_rfe_b64, the ds_gws_* instructions and ds_ordered_count throw with the reason at translation. Linear decoding stops at s_code_end like at s_endpgm, so code padded with s_code_end after a final backward branch decodes. Encodings from LLVM SOPInstructions.td and DSInstructions.td, checked against the gfx10 MC tests; semantics from the RDNA 2 ISA guide.
Nikhil Panchal