A V# with records but a base address of 0 threw at bind time ("null shader
buffer descriptor address"), although a shader that never reaches that slot
works on hardware; an access through it would fault there, so a working
title does not make one.
Such a V# is specialized empty like one without records (every access out of
bounds) and binds the placeholder buffer; the draw cache's alias check skips
it as the build does. The tests expecting the old rejections are dropped.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
findSelectionMerge took the nearest common post-dominator of a selection's
targets, computed across the loop's back edge. When one arm only continues
(reaching that block in a later iteration) and the other target is shared
with an enclosing selection, the shared merge was split off the header, the
post-dominator stayed where it was, and splitting repeated until the budget
threw.
Inside a loop, an arm that reaches the post-dominator only past the continue
or merge block now leaves the selection by continuing, and the merge is the
other arm's target; after one split that is the header's own synthetic merge.
agc_structurizer_tests builds the smallest such graph; it hit the budget
before.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A view whose offset in its GPU owner is not a multiple of
minStorageBufferOffsetAlignment could not be bound, and an address-based
build (its registered heaps imported whole) put descriptor-bound buffers at
arbitrary offsets inside them, so such dispatches failed.
GuestBufferMemory::Descriptor now binds from the aligned offset below the
view and reports the difference; ShaderResources stores it, per guest buffer
element, into the push constant block at the shader's memory byte offsets
(RecompileResult::memoryOffsetDword), which the shader already adds to every
access. Every push constant path (dispatches, recorded and synchronous draws,
draw recipes) takes the patches; the assembling overload of
Pipeline::PushConstants is gone. A shader whose shader data is a buffer fails
when it would need one.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A dispatch sized in threads (USE_THREAD_DIMENSIONS) launches a partial last
workgroup on RDNA2, but the host rounds it up to whole groups, so the extra
threads ran: past the end of a node list they read past it and wrote over
live records.
Such dispatches now compile a separate variant (ShaderComputeStageInfo::
partialThreads, keyed only on whether it is set) whose entry EXEC excludes
threads at or past the requested size. The size reaches the shader as three
shader data dwords after the memory offsets (StageInputKind::
DispatchThreadLimit), is mixed into the dispatch cache key and the result
memo hash, and serialized in recompile requests (version 3). Whole-group
dispatches keep their variant.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A V# without records (all zero, say, for a slot the taken path never
uses) makes every access out of bounds on hardware: loads read zero or the
format's default, stores and atomics are dropped. The recompiler now
specializes such a buffer as empty, so every access through it is out of
bounds, and the driver binds a small per-device placeholder buffer to the
element instead of rejecting the V#. A V# with records at address zero
still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A V# the SRT walker cannot compute (loaded from a descriptor heap at a
GPU offset, or built by the program) has no binding to hold it. Raw
dword loads and stores of 1-4 dwords through one now decode the V# in the
shader, apply the RDNA2 bounds rules (OOB_SELECT, stride, swizzle,
ADD_TID, format 0) and go through the BDA page table, as Kyty does.
Stores need Write permission, which only ranges that are a writable
allocation's host import get, so a store into a mirror or a copy faults
rather than being lost. The shader notes each written page in an
open-addressed set behind the fault record; once the work completed the
host marks those pages GPU-written, and an overflowing set throws.
Formatted, typed, sub-dword and atomic access through such a V#, and
their use outside compute shaders, still fail.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A sampled T# of a 32-bit integer format over a depth layout (a Z swizzle
mode) reads the raw bits of a depth plane, and a host cannot view a depth
image with an integer format. Such an image is specialized as float and
bound as the depth surface's float view: a fetch returns the same bits,
which the shader keeps as they are, and swizzle constants read as the
integers 0 and 1. Filtering is forced to point, as for integer formats.
The same T# over guest memory rather than a depth surface throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
EVENT_WRITE PIXEL_PIPE_STAT_DUMP (event 0x39) dumps the DB sample
counters. The recorder, once a title asks for them, keeps an occlusion
query open over each batch (precise when the device supports it) and adds
the result to a running count when the batch is reaped. A dump drains
recorded work like a label and writes the count in the PS5 layout: 16 DBs
16 bytes apart, begin and end counters interleaved, the count in the
first and bit 63 marking each ready. Kyty and SharpEmu write a fixed
"visible" result instead.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A depth target lives only in a GPU image (its guest surface is never
written), so a texture over its depth or stencil plane now samples that
image through a view of the plane's aspect: R32_SFLOAT for D32, R16_UNORM
for D16, R8_UINT for stencil, one level and slice at the surface's extent.
Other shapes, and storage access to a depth surface, throw. Depth images
get the sampled usage, and the barriers after a render pass and before a
dispatch include depth attachment writes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title maps physical pages at a new address while the GPU still reads them
through the old one. Every view of such a page gets the same contents and
loses write access while the page is shared; the last view left gets its
protection back. A CPU write to a shared page faults, and views that differ
when one is unmapped (a GPU write through an import) throw, instead of the
views silently diverging.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAgcQueueEndOfPipeActionPatchData is called with the packet and the new
64-bit label value only; reading a context id and a data selector from the
unused argument registers wrote garbage into the RELEASE_MEM, so fences
signalled with wrong values.
-KRzWekV120 is sceAgcDcbSetIndexSize with the per-instance object id flag
(VGT_INDEX_TYPE bit 14), as Kyty and SharpEmu build it. The no-op left the
previous index type in place, so 32-bit index buffers were read as 16-bit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- NP: signed-out callbacks and reachability; owned add-on entitlements
from anyps5-entitlements.ini next to the executable (or the file
ANYPS5_ENTITLEMENTS names)
- web browser, message, player invitation and player selection dialogs
finish without a UI; Remote Play, IME keyboard, SharePlay, live
streaming and video recording lifecycles for a console without them
- app content temporary data mount, format and free space (download data
quota from param.json); content export, search and delete lifecycles
- pad output-only calls, system service notice-screen flags, RazorCpu
markers, ulobjmgr
- throwing stubs for the remaining imports, so missing behavior fails
loudly
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- AJM codec 0 (MP3) decodes with FFmpeg, prebuilt through the
ffmpeg-core submodule as in Kyty; sceAjmBatchJobDecode and the Run job;
the PCM encoding follows the job flags; other codecs throw
- AudioOut2 ports of 16-bit integer samples, and the ambisonics speaker
array decode for the reported layout
- the voice library for a console with no headset, with a frame size for
voice ports
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Depth/stencil: draws that test depth or stencil against a bound surface
render with a GPU-only depth/stencil attachment (DepthSurface), cleared
to DB_DEPTH_CLEAR/DB_STENCIL_CLEAR when made. Z test/write/function and
per face the stencil function, operations and masks (BACKFACE_ENABLE);
replacements by another value where Vulkan's single reference can carry
them. Clear and copy draws, add/sub other than 1, array or mip views
and MSAA throw, and texture reads of a surface's memory are refused.
Scaleform menus mask with the stencil (REPLACE 0, ADD_CLAMP, EQUAL);
their masked content was skipped before.
- Mipmapped color targets render through the resident image of the whole
chain with a view of the mip, so mips in the packed tail are drawn too;
CB_COLOR_VIEW's mip level is read from bits 26-29 (GFX10).
- Color: SNORM targets, UNORM16/SNORM16 exports, one-component formats
honouring COMP_SWAP (A8), 32_R/32_GR/32_AR exports, linear rows padded
to 256 bytes, BLEND_BYPASS.
- INDIRECT_BUFFER jumps are followed when copying a submission; thin 3D
textures in display and rotated XOR swizzles; only the bytes the GPU
changed are written back; resource registration.
- VideoOut: a flip stalls the GPU queue while the flip queue is full and
holds the submitter back.
- APS5_DUMP_FRAMES_EVERY dumps every k-th presented frame.
- The graphics test target builds again (missing sources, a hand-aligned
64 KiB buffer, stale expectations updated) and gains DepthStencilTests.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- packet sizes for the existing builders and the tessellation ring
config
- direct register writes and end-of-pipe action data, type and cache
patches
- GS/HS shader halves fused by merging their registers, after Kyty
- jump target patches; reserved jumps are allowed
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libkernel:
- direct memory keeps its contents per physical page across unmap and
remap; a page mapped at two live addresses at once throws
- sceKernelDirectMemoryQuery answers from tracked allocations
- SCE protections read back as set, GPU and AMPR bits included
- APR prefix path resolve, file size and stat by id, positional reads,
fsync/pread/pwrite; directories open as descriptors on Windows
- sceKernelCheckReachability, getpeername, shutdown
- Dinkumware C11 threads (_Mtx_*, _Cnd_*, _Thrd_*) in the title libc
layout; any pthread stack size, rounded at thread creation
libc:
- unaddressed guest mappings go to the system-managed area from
0x2_0000_0000, leaving the application area to fixed mappings
- the process starts in /app0
- guest sscanf on Windows; a null %s prints as (null) as on FreeBSD
- localeconv, _FNan, _FDtest, _FExp, __udivti3, wcsncpy_s, aligned
operator new, _Throw_Cpp_error
Tests: direct memory following physical pages, guest formatting.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- MIMG word0 bit 12 (UNORM) is accepted on every op without a sampler
(compute image stores set it, as the ISA asks); sample and gather still
reject it, and rejections name the instruction words.
- The image_sample_*_a opcodes keep the plain address layout, as in Kyty.
- The _cl LOD clamp becomes the MinLod image operand (or clamps an
explicit level) on devices with shaderResourceMinLod; a gather with a
clamp fails loudly.
- v_add_co_ci_u32, v_sub_co_ci_u32 and v_subrev_co_ci_u32 in VOP3 form
take their carry-in from the SGPR pair of their third source, not VCC:
a glyph upload's reciprocal division corrected its quotient on the
wrong lanes and UI text came out stippled.
- Pixel exports follow each MRT slot's component mapping and write only
the components of their export format (32_R, 32_GR, 32_AR).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- --exclude-sce-module <file> (repeatable) drops one title module from
guest conversion, e.g. a title libc.prx, while the rest of sce_module
is still relinked as guest modules
- the instruction scanner stops at zero padding that ends a code segment
with an odd byte instead of failing on a truncated `add [rax], al`
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Per maintainer feedback: PNG encode/decode belongs together in a
future core/Decoder/Png shared by the relinker (icon loading) and
PRX layer, not a one-off libScePngEnc-only encoder. Reverts
libScePngEnc/Export.cpp to the upstream stub and removes the vendored
stb_image_write.h dependency, leaving ConvertKeycode, VoiceChat and
the PlayGo chunk-id fix.
Strip inline explanatory comments (comments are restricted to
technical-debt markers, #endif, and namespace-close trailers) from
HitLog.hpp, libSceConvertKeycode, libSceVoiceChat, libScePngEnc, and
the new hunk in libScePlayGo; add the missing #endif trailer comment
to HitLog.hpp's include guard. Rename the local helpers/params that
didn't match the naming convention: log_soft -> logSoft and
Readable -> readable (private free functions, camelCase), and
snake_case arguments (user_id, request_id, memory_address,
memory_size, output_info) to camelCase. NID export functions and
pre-existing upstream code (libScePlayGo's existing snake_case
parameters, PngEnc's vendored stb_image_write.h) are left untouched.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Bring the pad-gamepad-haptics diff in line with docs/dev/CONVENTIONS.md:
strip explanatory/rationale comments (struct layouts, algorithm notes,
rewired-NID rationale) down to code only, and rename the anonymous-
namespace helpers in PadState.cpp (Normalize/Fuse/EncodeZones/MaxOf/
ScaleStrength) to camelCase to match upstream's free-function style.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
