PS4 firmware 10.71 converts "1.2.3.4" followed by a space, tab, LF,
VT, FF or CR, and anything after it ("1.2.3.4 x"), to 1.2.3.4 and
returns 1, where host inet_pton returns 0. Leading whitespace, other
trailing bytes (0x01, 0xa0), "1.2.3 " and IPv6 text with whitespace
still fail there.
A failed conversion leaves the destination and sceNetErrnoLoc
unchanged on the console; Winsock inet_pton writes the parsed prefix
before failing, so the conversion now goes through a local buffer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
v_mad_f32, v_mac_f32, v_madak_f32 and v_madmk_f32 exist only on gfx10.1,
so the RDNA2 oracle can't measure them. Measured on gfx1010 (RX 5700 XT)
in wave32 at IEEE 0 and 1, f32 denormal modes 0 to 3 and round modes 0
to 3, and in wave64, they round the product before the add, flush f32
sources, product (tiny after rounding with an unbounded exponent) and
result in every mode, and choose NaN results like the fma forms.
The behaviour stays left to the driver: translating it on every lane
cost about 15x main on the RX 5700 XT and 23x on an RTX 3070, and a
branch around the exact path still about 6x, so the lowering waits for
the SPIR-V float controls of #981.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A vertex shader exporting the render target index draws one value per
layer into a CB_COLOR_VIEW of slices 1 to 3 of a four-slice 2D array and
into slices 0 to 2 of a surface of one slice. After the write-back every
slice of guest memory must hold its layer's value, and the slices
outside the view (slice 0, and slice 3 of the one-slice surface) their
initial bytes.
AI-assisted: yes
The resident image of a 2D array color view only compared the view's own
slice offset with the image's layer pitch, which is trivially equal for
slice 0. Every slice of the array image is now checked against the slice
size DecodeColorBuffer offsets the view by. AttachmentView again requires
layer 0 for a 3D target, as it did before layered 2D array views.
AI-assisted: yes
A layered draw into a color view of slices 0 to 5 of a 2D surface whose
CB_COLOR_ATTRIB3 declares one slice was refused. The CB clamps the
render target array index to the view's SLICE_MAX, not to the surface's
slice count, so each layer is written one slice pitch further on.
PPSA01317 renders a 512x512 cube map this way. Such a view now renders as
a 2D array of the view's last slice + 1 slices.
AI-assisted: yes
A draw whose vertex shader exports the render target array index into a
color view of several slices of a 2D array target was refused. The view
now renders layers lastSlice - slice + 1 through a 2D array attachment
view of the array's resident image starting at its first slice, and the
draw marks every rendered slice dirty. A view of several slices of a
surface that is not a 2D array is still refused, as is a layered draw
without the array's resident image.
AI-assisted: yes
A host event cannot stay unsignaled across vkQueueSubmit, and vkSetEvent is illegal while that wait is still pending. The fixture now waits on a timeline semaphore and signals it only after the leased producer is submitted, so the earlier label stays pending and the indirect dispatch still takes the CPU fallback.
Export sceNpAuthGetAuthorizationCode (NID KxGkOrQJTqY) and
sceNpAuthGetIdToken (NID uaB-LoJqHis) in libSceNpAuth, delegating to the
corresponding V3 implementations.
Add test coverage in GuestNpAuth for both calls covering invalid
arguments, signed-out responses on sync requests, deferred async handling,
and unknown request IDs, as well as sceNpAuthGetAuthorizedAppCode. Update
technical debt documentation.
FreeBSD 11.4 rejects access mode 3 in kern_openat and
O_CREAT|O_EXCL|O_DIRECTORY in vn_open_cred before namei reads the path
or resolves the directory descriptor. open, _open and openat checked a
NULL or empty path first and returned EFAULT or ENOENT for those flags.
InvalidOpenFlags moves to FileFlags.hpp and runs first in all three.
unused-filter=1 kept a non-PLT import only when reachable code addresses its relocation exactly through a RIP-relative operand. That test only fits GLOB_DAT slots. An R_X86_64_64 import in a table read at an offset, such as a vtable entry called through lea rax,[rip+table]; call [rax+8], was dropped although it is used, and of a general dynamic TLS pair only DTPMOD64 was kept, so DTPOFF64 lost its relocation. The GOT access check now applies to GLOB_DAT relocations only; other import relocations are kept.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
APS5_VIDEOOUT_TELEMETRY_DIR=<directory> appends one JSON object per line to <directory>/videoout.jsonl: a contract line for the run (commit and pid), a pad line whenever the published pad state changes in its buttons, sticks, L2 or R2, a present line after the first present and every 30 after that with the count and rate the window title shows, and a drops line with the number of lines the writer discarded, reported every ten seconds while it grows and once at a normal exit. A bounded queue of 4096 lines and one writer thread batch the file, so neither the present nor the input path waits for it; a pad change that the full queue refused stays pending for a later publish, and the frame count moves from UpdateTitle's function-static to DisplayWindow so the input path can name the present it belongs to.
Without the variable no file is opened and no thread is started: a present or an input update costs one call that checks a guard variable and returns null.
Revalidate rebuilt the cached texture of an image table element from the raw
T# words, while resolveImageTables binds the first-layer texture for a 2D
read of a 2D array. The whole array was rebuilt and compared against the
narrowed texture, so revalidation always failed. Narrow the words with
firstLayerWords before decoding, as the other paths do.
Add imageTableFirstLayerRevalidateTests, run by agc_draw_descriptors: it
fails with "an image table holding a 2D read of a 2D array did not
revalidate" without the fix.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
A shader that declares a 2D image reads only the base slice of a 2D array
T# (the first-layer view), but the texture was built from every slice the
T# names. In Ghost of Yotei (PPSA26344) such a read names 1537 slices of a
3328x1872 R_X surface: a 12.4 GiB image that does not fit the 4090's
device-local budget and stalls 11-14 s on each rebuild.
The sampled lookups (stage A records, stage B bindings, revalidation and
image tables) now narrow such a T# to its base slice before the cache key,
the decode and the image are made, so a whole-array read of the same T#
keeps its own entry. Views of 1 GiB or more that stay whole are logged with
the guest allocation they lie in and how many of their slices fit it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A sampled 2D array, 1D array or cube view created and snapshotted the whole
array from slice 0 to its last viewed slice. Ghost of Yotei views six faces
at slice 7227 of a 256x256 cube array (3.8 GB built for 3 MB) and one slice
at 1536 of a 3328x1872 R8 array (12.4 GiB built for 8 MiB).
SampledArrayWindow describes the viewed slices as an array of their own at
the first viewed slice when the layout of those slices does not depend on
their index: a thin array without DCC metadata, and for an XOR swizzle a
first slice that keeps the slice bits the equation mixes in.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A RELEASE_MEM with DATA_SEL 4 was refused as "GDS RELEASE_MEM data".
amdgpu's GFX10 packet header gives 4 as the 64-bit system counter and 5
as GDS data. Validation now refuses 4 as the system counter, whose
console frequency and epoch are not known, 5 as GDS data and 6 or 7 as
reserved, and the debt file records the system counter.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The name hashes to zBsgF0q8DIM. Signature and error order follow the
OS 10.01 system module: NOT_INITIALIZED, INVALID_ARG for a NULL output,
INVALID_HANDLE for a bad handle. The emulated pad is not an Access
controller and reports 0.
The OS 10.01 system module checks only that the library is initialised,
then sends a per-process value to ShellCore over Mbus and returns 0 when
that call succeeds. It does not look at pad handles, so the throw while a
pad is open is gone. 0x809200ff, measured in a process that is not a game,
is the failed Mbus call; a game process is assumed to get 0.
An EV_CLEAR read knote on a pipe fires once per write and reports EV_EOF with no data once the write end closes. Combined with EV_DISPATCH it reports once and disables itself; EV_ENABLE re-runs the filter as kqueue_register does, so data that arrived while disabled is reported, and an enable with nothing buffered reports nothing.
An EV_CLEAR write knote fires once when added to a writable socket, stays quiet after the guest's own send, fires again when the peer drains the data and frees the send space, fires on a fresh EV_ADD, and reports EV_EOF when the peer closes.
On a Unix stream socketpair an EV_CLEAR read knote fires once per arrival with the full byte count, stays quiet while data sits unread, without the wait spinning on the readable socket, fires again when re-added, is dropped when an arrival was read before the next scan, wakes a blocking kevent, and reports EV_EOF once when the peer closes.
ShinMalphur