sceAmprAmmCommandBufferMapAsPrt, AllocatePaForPrt, RemapIntoPrt and
UnmapToPrt, with the MapAsPrt and AllocatePaForPrt measures. Signatures,
checks and their order follow ampr_emu.
The executor keeps the PRT pages of the AMM ranges. Unbacked PRT pages
are zero-filled with GPU read access; AllocatePaForPrt backs each
unbacked page with a pool page and changes the type and protection of
backed ones; RemapIntoPrt moves a mapped range into a PRT range; and
UnmapToPrt returns the pages to the pool and zero-fills them again. A
plain map, unmap or remap over a PRT range ends it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceVideoOutIsOutputSupported threw VIDEO_OUT_ERROR_UNSUPPORTED_OUTPUT_MODE
for every mode other than the default and 119.88 Hz, and
sceVideoOutConfigureOutput threw for an unavailable 119.88 Hz mode. Titles
probe and request modes the display may lack and handle the result:
PPSA12544 asks for 0xd000000a and falls back to 3840 pixels when it is not
supported, and its sceVideoOutConfigureOutput caller switches on the
returned error codes, including VIDEO_OUT_ERROR_UNAVAILABLE_OUTPUT_MODE.
Every mode except the default now reports 0, and configuring one returns
VIDEO_OUT_ERROR_UNAVAILABLE_OUTPUT_MODE.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libSceAmpr gains sceAmprAmmCommandBufferRemap, MultiMap, ModifyProtect
and ModifyMtypeProtect with their GPU mask forms and the eight measure
functions. Signatures and the protection and mask checks follow ampr_emu.
The executor keeps a page table of the AMM ranges: each page's physical
offset, protection, memory type and whether it came from the pool. A
remap moves the pages of a fully mapped range and leaves the old range
reserved; a multimap maps the same pages again; a pool page returns to
the pool only when its last mapping goes. A protection change applies
the masked bits page by page.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libSceAmpr gains the AMM command buffer (constructor, destructor, map,
map direct and unmap, with their GPU mask forms and measures),
sceAmprAmmGiveDirectMemory, sceAmprAmmGetVirtualAddressRanges, the three
submit forms and sceAmprAmmWaitCommandBufferCompletion. The APR
MapBegin, MapDirectBegin and MapEnd commands and their measures record
the same map commands.
The libkernel executor now maps: a plain map takes pages from the direct
memory given to the mapper with usage 1, a direct map uses the given
offset, and an unmap returns the pages to that pool and leaves the range
reserved. The AMM ranges are reserved in the guest arena on first use.
Commands are walked by the buffer's byte offset so an AMM submission can
run raw command memory.
Signatures, the protection mask and the APR map rules follow ampr_emu;
the mapper model follows PS5PCEM. While an APR map region is open, a
second begin and every completion write return EPERM.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAmprAprCommandBufferReadFileGather, ReadFileScatter,
ReadFileGatherScatter and ResetGatherScatterState, with their measure
functions. Signatures, argument checks and the read cursor follow
ampr_emu: each read leaves the file, the next offset and the next
destination; a gather reads at a new offset into the next destination, a
scatter continues in the file into a new destination, and a
gather-scatter takes both. Recording one needs a file read since the last
reset, tracked in the command buffer object next to its type.
sceAmprAprCommandBufferReadFile now applies the same length, offset and
destination checks and rejects a null command buffer instead of
dereferencing it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAmprCommandBufferWaitOnCounter_04_00 and WriteCounter_04_00 take the
counter access size and offset, the wait mask and the write operation,
with their measure functions; ConstructNop records a nop with an optional
leading word and a payload of up to 60 bytes, and ConstructMarker records
the set, push and pop markers by type. Signatures and checks follow
ampr_emu.
The executor now reads and writes counters by access: the 8-byte access
of counter n spans n and n + 1, the 2- and 1-byte accesses a half or a
byte of the counter. Waits compare at the access width, so the signed and
wrapped compares see the field's own sign bit, and the atomic writes wrap
within the field. The legacy counter commands record a 4-byte access.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SET_PREDICATION threw, and packets with the predicate header bit were
rejected. The executor now keeps the queue's predication: operations 3
and 4 read a 64- or 32-bit value and bit 8 selects whether predicated
packets run when it is non-zero or zero; operation 0 clears it. Before
a predicated packet runs while predication is active, queued labels are
recorded and the value is read, as for COND_EXEC; the packet is skipped
when the predicate fails.
Indirect buffers are inlined when a submission is copied, so a
predicated INDIRECT_BUFFER call keeps its header in front of the
inlined commands and records their end like a COND_EXEC range; the
block runs or is skipped on one evaluation, as on the command
processor. Query predication, a predicated COND_EXEC, predicated chains
and flips inside predicated command buffers throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title passes a work memory block and app type 0x20000000, and turns
voice chat off when initialization fails. Initialization now records
the library as initialized and succeeds. A null or empty memory block,
another app type and a second initialization throw, as their error
codes are unknown.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceKernelInstallExceptionHandler and sceKernelRemoveExceptionHandler threw.
They now keep one handler per allowed signal (SIGHUP, SIGILL, SIGFPE,
SIGBUS, SIGSEGV, SIGUSR1, as in shadPS4): another signal or a null handler
returns EINVAL, a second handler for a signal returns EAGAIN, and removing
clears it. Delivery is not implemented and is recorded in the technical
debt; sceKernelRaiseException still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title's libc.prx calls it from __cxa_thread_atexit with flags 2 and
stores the returned module id in the destructor record. The 0x1A8-byte
info reports the name, id, TLS block, init and fini procedures,
eh_frame_hdr and eh_frame, and up to four load segments of the image
containing the address. The id is the loader handle when the image was
opened through sceKernelLoadStartModule and otherwise a stable id from
the same range. Unknown flags and st_size values throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rename the two unknown libSceSaveData.native stubs to
sceSaveDataTransferringMountPs4 (RjMlsR8EXrw) and
sceSaveDataDirNameSearchPs4 (X4MYzukPc3g). There is no PS4 save area:
the mount returns NOT_FOUND like sceSaveDataTransferringMount, and the
search reports zero hits.
Co-Authored-By: Claude <[email protected]>
OQ-dzhlnM28, qBS714-Jr3g and tB59hFLH3SA are _sceLibcInternalThreadDtors,
_sceLibcInternalThreadAtexit and _sceLibcInternalForceTlsDestructor,
implemented in libSceLibcInternal by #641. dbOlWdppb4o is implemented by
#651.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
NH6xARDOVv8 is the NID of sceKernelGetOperationMode. PPSA12544 passes two
int outputs and logs them as mode and submode; both are reported as 0.
B2n8aDorSH4 and PZQhiiLXRFs are sceKernelSyncOnAddressWait32 and
sceKernelSyncOnAddressWait64, implemented by #633, and are no longer added
as unimplemented exports.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Implement scePthreadGetschedparam and scePthreadSetschedparam on top of
the thread priority, POSIX utimes and fsync on top of sceKernelUtimes
and sceKernelFsync, and sceUserServiceGetAccessibilityZoomFollowFocus
like the other accessibility queries. Add the remaining imports of
PPSA12544 as unimplemented exports and record unknown NIDs and
signatures in the technical debt.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Report age level 0 for the initial user and reject other users and a null
output like the other user queries. The meaning of the value is unknown and
recorded in the technical debt; PPSA12544 only stores it for its user
profile.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceVideoOutRegisterBuffers2 and sceVideoOutSubmitChangeBufferAttribute2
threw for every buffer attribute option other than 0. PPSA26344 builds
its display buffers with option 8 through the libSceAgc helper linked
into it, so its first registration failed.
Option 8, VIDEO_OUT_BUFFER_ATTRIBUTE_OPTION_STRICT_COLORIMETRY (name
and value from KytyPS5), is now accepted and presented as option 0;
every other option still throws. What the console changes for it is
unknown and recorded in TechnicalDebt. The rejection now names the
tiling mode, pitch, aspect ratio and option it was given.
video_out_flip_tests decode checks that option 8 describes the same
buffer as option 0 and that options 1, 32 and 40 are rejected.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Ghost of Yotei (PPSA26344) imports both functions, so its import
resolution failed at startup. Markers only feed an attached Razor
capture. AnyPS5 hosts none and sceRazorCpuIsCapturing reports 0, so,
like the other libSceRazorCpu exports, both do nothing and return 0.
The push signature comes from the title's calls (a string literal,
0x80ffffff, 2). TechnicalDebt lists both functions with the assumed
signatures. guest_razor_cpu covers nested and unbalanced markers.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The export threw, and titles query the system name during startup.
Parameter 6 (the system name) now writes the fixed name "PS5" into a
buffer of at least SYSTEM_SERVICE_MAX_SYSTEM_NAME_LENGTH (65) bytes.
A null buffer or a zero size returns SYSTEM_SERVICE_ERROR_PARAMETER,
as in KytyPS5. Other parameter ids and buffers of 1 to 64 bytes still
throw, because no PS5 source gives their result. guest_system_service
covers the error rows, both throws and the returned name.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scePsmlMfsrGetContextBufferRequirement1100, scePsmlMfsrCreateContext1100
and scePsmlMfsrGetDispatchMfsrPacket1100 were not exported, so a title
importing them failed to load.
In Sony's libScePsml all three return 0x8A810001 (not initialized)
without writing their outputs until scePsmlMfsrInit has succeeded.
AnyPS5's scePsmlMfsrInit throws, so that is the only state a title can
reach, and the three calls now return that error.
The existing stubs for scePsmlMfsrInit, scePsmlMfsrReleaseContext and
scePsmlMfsrGetDispatchMfsrPacketSizeInDwords get their real names and
still throw. libScePsml_debug gets a CMakeLists.txt for the new
guest_psml test.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Titles set the PS Store icon layout before they show the icon, and a
title that imports the call stops at startup on the unresolved import.
No PS Store icon is drawn, so like the show and hide calls it accepts
every layout and returns 0 without effect. The signature follows
shadPS4 (a PS4 reference), which also returns OK for every layout.
The libSceNpCommerce entry under "Silent stubs" in TechnicalDebt now
names the function.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
