SuspendThread returns before the thread has stopped, and GetThreadContext waits until it has. waitCount was read right after SuspendThread, so a thread that was leaving its wait could still decrement it and drain its APCs with NtTestAlert before QueueUserAPC queued the delivery, which then waited for an alertable wait that never came. The context is now read first, so waitCount is read from a stopped thread.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The new phase's vectored handler continues every exception the thread raises, so the thread spends much of its time in NtContinue, where a redirect is lost unless the raise retries. Without the retry the phase hangs in every run; with it the test passes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Linux guest module writer emitted DT_HASH with a single bucket, so
every symbol lookup that reached a guest module walked its whole symbol
table. Guest modules come first in the global scope, so each host prx
lookup paid that walk at load and on every lazy PLT call. Build the
standard SysV table from the final symbol names with one bucket per
symbol, as the console's modules ship it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
waitMemory's timeout report keeps a function-local static std::set of the
addresses already reported and a static counter. Two queue workers whose
waits time out at the same time insert into the set concurrently, which
is a data race on a std::set and can corrupt the tree. The set and the
counter are now updated under a mutex.
COMP_SWAP 2 and 3 store a four-component export as ABGR and ARGB from the
lowest bits. Render such targets as RGBA8 and permute the pixel shader's
exports through the existing component mapping (0x1b and 0x93), as the
one-component swaps already do. Blending into them throws: the alpha
factors would read the wrong export component.
A raised exception redirects the target thread to a stub that runs the handler and returns through RtlRestoreContext. On Windows 10 (19045) RtlRestoreContext restores in user mode only when the context flags are exactly CONTEXT_FULL | CONTEXT_SEGMENTS (CONTEXT_XSTATE aside); for the CONTEXT_FULL | CONTEXT_FLOATING_POINT context it was given, it calls NtContinue. When the next raise suspended the thread inside that system call, NtContinue then replaced the redirected context with the one it was restoring, so the handler never ran although sceKernelRaiseException had returned 0. guest_raise_exception lost such a delivery to its busy thread in about one run in five and hung until the ctest timeout.
The context is now read with CONTEXT_SEGMENTS, so the handler returns through the user-mode restore, and a raise that finds the thread inside NtContinue or NtContinueEx (an APC or an exception handler returning) resumes it and suspends it again.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Accept PA_SC_MODE_CNTL_0.ALTERNATE_RBS_PER_TILE, CB_COLOR_CONTROL.DISABLE_DUAL_QUAD
and VGT_SHADER_STAGES_EN.MAX_PRIMGRP_IN_WAVE on the vertex path. They tune how the
hardware distributes work between render backends and waves and do not change the
rendered result. Mesa sets all three on GFX10.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The patcher rewrites .dynstr in place and reorders .dynsym for
.gnu.hash, but .gnu.version_d kept pointing at name offsets that the
rewrite had recycled: a library carrying symbol version definitions
came out with renamed or blanked version names while its symbols
still advertised a version.
No library in the build defines symbol versions, so fail on
.gnu.version_d during the section scan and leave the input untouched
instead of carrying version remapping that nothing exercises. The
test covers the rejection and that a library without version
definitions is still patched.
Co-authored-by: arena-agent <[email protected]>
Measured on a PS5 (firmware 13.60) through dlopen of
libSceVoiceQoS.sprx: a null block, any size other than exactly 0x40000,
and an app type other than 0x20000000 or 0x10000000 all return
0x804E0902 without touching the block, instead of throwing. A second
initialization returns 0x804E0905, as prosper reads from the module.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Add scePadOpenExt for special ports, which return DEVICE_NOT_CONNECTED because the host has no special controller, and the extended read and report exports, which throw.
hypotf now widens both arguments to double and calls the double hypot.
The float-to-double conversion raises FE_INVALID for a signaling NaN and
quiets it, so hypotf(sNaN, inf) returns +inf with the invalid flag set in
either argument order, matching the PS5 libc routine. Before, MinGW UCRT's
hypotf returned +inf without the flag and glibc's returned NaN.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Scr6DkuJDqiUcJHr9mJv6T
Each in-place substitution went through X64InstructionRewriter::Rewrite,
which copies the whole code segment and decodes every instruction in it
to adjust references. The converter only accepts equal-length
replacements, so the adjustment is always zero and the copy and scan are
wasted: conversion time grew by one segment scan per substitution. Copy
the replacement bytes into the segment instead.
StorageTexture::writeBackLayers keeps the CPU's bytes for an edge unit when StoredOver
reports that the CPU wrote it since the unit's generation. That check read one generation
per 64 KiB block, so a store to another allocation sharing the block counted as a store
over this surface and the whole block was kept, discarding GPU results written into it.
The driver path in the same check already compares range pieces; the CPU path now does
the same. Each collect records the generation of every page it found dirty, and StoredOver
tests only the pages its range overlaps. A block with no page record keeps the previous
whole-block answer.
Measured on an RTX 3080 Ti, main at df16c4c2:
- agc_write_tracking stores at base + Block + 8, outside the queried range but inside the
shared block. That case fails on main ("a CPU store outside the shared range counts for
it") and passes here.
- Full suite 408 of 408 (Linux, CachyOS, GCC, Release, BUILD_TESTING=ON).
This does not cover the other half of #865: the report's finding 2, where the stamps fall
on the surface's own pages and the bytes under them are unchanged, still keeps the block.
No title was run here, so the fix is offered for the report's own repro.
The LOD warning lwe adds to the texel status is texture-streaming feedback,
which is not reported for the T# MIN_LOD_WARN either. Accept lwe on sample
and gather instructions as it already is on loads and stores; lwe on
image_get_lod still throws.
PUSH GS, POP GS and RSM (0F A8, 0F A9, 0F AA) have no ModRM byte, but fell in the 0F A3-AB ModRM range, so the decoder read the next byte as a ModRM and sized its displacement. MOV to and from control and debug registers (0F 20-23) ignore the ModRM mod field and always name a register, but were sized and reported as memory forms, including a RIP-relative disp32 for mod 00 r/m 101.
ComputeThickLayout refused block-compressed formats. Compute the mip
chain, padding and mip tail from the volume's block dimensions, as the thin
layout does, so BC volumes in SW_4KB_S, SW_64KB_S and SW_64KB_S_X detile
like volumes of their blocks.
An image load whose DIM field encodes fewer coordinates than the resource
(image_load 2d on a 3D texture) was refused. Pad the missing components with
0 so the load reads the first slice.
In the host-blocked phase of guest_raise_exception, the redirected handler
runs as soon as the worker wakes inside pthread_mutex_lock, before it owns
hostLock. ExpectDelivery then returns and main relocks hostLock right away.
If main wins that race, the worker stays blocked in the previous round's
lock_guard, so it never sets started for the next round and main spins
forever. The run hangs until the 30 s ctest timeout, with only three
RunThread lines in the log.
The worker now publishes the round after it acquires the mutex, and main
waits for that before relocking.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libSceNet registers a socket poller with libkernel; select polls the requested descriptors through it until the timeout and rewrites the descriptor sets.
A fixed mapping without no-overwrite unmaps the registered pieces it overlaps before mapping, as it already did when the range lay inside registered allocations.
The driver created a windowless Vulkan device at the first dispatch and
replaced it with a windowed one at the first flip. The replacement built a
second device and re-imported every host import, and the first flip paid
for it.
VideoOut now creates its window when it starts (the first VideoOut call),
at the default 1920x1080 output, and attaches it to the driver
(AgcDriverAttachWindow) before the call returns. The driver creates its
device with that window, so GPU work and presentation use one device.
Present no longer creates or replaces a device. A device created by GPU
work before VideoOut started is still replaced, now in AttachWindow.
A failure to create the window or the device is thrown from that first
VideoOut call instead of terminating the presentation thread.
Tests:
- video_out_flip_tests onedevice: GPU work, then a flip, leaves one device.
- pacing makes its first presentation span vblanks with GPU work queued
ahead of the flip; it relied on the device being created at the flip.
- unavailable expects the failure from sceVideoOutOpen.
- guest_video_out_wqhd_detection writes a param.json for the window title
and is skipped without a display or Vulkan device unless
ANYPS5_REQUIRE_DISPLAY is set.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Nahuel Genchi