COMP_SWAP 2 and 3 store a four-component export as ABGR and ARGB from the
lowest bits. Render such targets as RGBA8 and permute the pixel shader's
exports through the existing component mapping (0x1b and 0x93), as the
one-component swaps already do. Blending into them throws: the alpha
factors would read the wrong export component.
A raised exception redirects the target thread to a stub that runs the handler and returns through RtlRestoreContext. On Windows 10 (19045) RtlRestoreContext restores in user mode only when the context flags are exactly CONTEXT_FULL | CONTEXT_SEGMENTS (CONTEXT_XSTATE aside); for the CONTEXT_FULL | CONTEXT_FLOATING_POINT context it was given, it calls NtContinue. When the next raise suspended the thread inside that system call, NtContinue then replaced the redirected context with the one it was restoring, so the handler never ran although sceKernelRaiseException had returned 0. guest_raise_exception lost such a delivery to its busy thread in about one run in five and hung until the ctest timeout.
The context is now read with CONTEXT_SEGMENTS, so the handler returns through the user-mode restore, and a raise that finds the thread inside NtContinue or NtContinueEx (an APC or an exception handler returning) resumes it and suspends it again.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Accept PA_SC_MODE_CNTL_0.ALTERNATE_RBS_PER_TILE, CB_COLOR_CONTROL.DISABLE_DUAL_QUAD
and VGT_SHADER_STAGES_EN.MAX_PRIMGRP_IN_WAVE on the vertex path. They tune how the
hardware distributes work between render backends and waves and do not change the
rendered result. Mesa sets all three on GFX10.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The patcher rewrites .dynstr in place and reorders .dynsym for
.gnu.hash, but .gnu.version_d kept pointing at name offsets that the
rewrite had recycled: a library carrying symbol version definitions
came out with renamed or blanked version names while its symbols
still advertised a version.
No library in the build defines symbol versions, so fail on
.gnu.version_d during the section scan and leave the input untouched
instead of carrying version remapping that nothing exercises. The
test covers the rejection and that a library without version
definitions is still patched.
Co-authored-by: arena-agent <[email protected]>
Measured on a PS5 (firmware 13.60) through dlopen of
libSceVoiceQoS.sprx: a null block, any size other than exactly 0x40000,
and an app type other than 0x20000000 or 0x10000000 all return
0x804E0902 without touching the block, instead of throwing. A second
initialization returns 0x804E0905, as prosper reads from the module.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Add scePadOpenExt for special ports, which return DEVICE_NOT_CONNECTED because the host has no special controller, and the extended read and report exports, which throw.
hypotf now widens both arguments to double and calls the double hypot.
The float-to-double conversion raises FE_INVALID for a signaling NaN and
quiets it, so hypotf(sNaN, inf) returns +inf with the invalid flag set in
either argument order, matching the PS5 libc routine. Before, MinGW UCRT's
hypotf returned +inf without the flag and glibc's returned NaN.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Scr6DkuJDqiUcJHr9mJv6T
Each in-place substitution went through X64InstructionRewriter::Rewrite,
which copies the whole code segment and decodes every instruction in it
to adjust references. The converter only accepts equal-length
replacements, so the adjustment is always zero and the copy and scan are
wasted: conversion time grew by one segment scan per substitution. Copy
the replacement bytes into the segment instead.
StorageTexture::writeBackLayers keeps the CPU's bytes for an edge unit when StoredOver
reports that the CPU wrote it since the unit's generation. That check read one generation
per 64 KiB block, so a store to another allocation sharing the block counted as a store
over this surface and the whole block was kept, discarding GPU results written into it.
The driver path in the same check already compares range pieces; the CPU path now does
the same. Each collect records the generation of every page it found dirty, and StoredOver
tests only the pages its range overlaps. A block with no page record keeps the previous
whole-block answer.
Measured on an RTX 3080 Ti, main at df16c4c2:
- agc_write_tracking stores at base + Block + 8, outside the queried range but inside the
shared block. That case fails on main ("a CPU store outside the shared range counts for
it") and passes here.
- Full suite 408 of 408 (Linux, CachyOS, GCC, Release, BUILD_TESTING=ON).
This does not cover the other half of #865: the report's finding 2, where the stamps fall
on the surface's own pages and the bytes under them are unchanged, still keeps the block.
No title was run here, so the fix is offered for the report's own repro.
The LOD warning lwe adds to the texel status is texture-streaming feedback,
which is not reported for the T# MIN_LOD_WARN either. Accept lwe on sample
and gather instructions as it already is on loads and stores; lwe on
image_get_lod still throws.
PUSH GS, POP GS and RSM (0F A8, 0F A9, 0F AA) have no ModRM byte, but fell in the 0F A3-AB ModRM range, so the decoder read the next byte as a ModRM and sized its displacement. MOV to and from control and debug registers (0F 20-23) ignore the ModRM mod field and always name a register, but were sized and reported as memory forms, including a RIP-relative disp32 for mod 00 r/m 101.
ComputeThickLayout refused block-compressed formats. Compute the mip
chain, padding and mip tail from the volume's block dimensions, as the thin
layout does, so BC volumes in SW_4KB_S, SW_64KB_S and SW_64KB_S_X detile
like volumes of their blocks.
An image load whose DIM field encodes fewer coordinates than the resource
(image_load 2d on a 3D texture) was refused. Pad the missing components with
0 so the load reads the first slice.
In the host-blocked phase of guest_raise_exception, the redirected handler
runs as soon as the worker wakes inside pthread_mutex_lock, before it owns
hostLock. ExpectDelivery then returns and main relocks hostLock right away.
If main wins that race, the worker stays blocked in the previous round's
lock_guard, so it never sets started for the next round and main spins
forever. The run hangs until the 30 s ctest timeout, with only three
RunThread lines in the log.
The worker now publishes the round after it acquires the mutex, and main
waits for that before relocking.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libSceNet registers a socket poller with libkernel; select polls the requested descriptors through it until the timeout and rewrites the descriptor sets.
A fixed mapping without no-overwrite unmaps the registered pieces it overlaps before mapping, as it already did when the range lay inside registered allocations.
The driver created a windowless Vulkan device at the first dispatch and
replaced it with a windowed one at the first flip. The replacement built a
second device and re-imported every host import, and the first flip paid
for it.
VideoOut now creates its window when it starts (the first VideoOut call),
at the default 1920x1080 output, and attaches it to the driver
(AgcDriverAttachWindow) before the call returns. The driver creates its
device with that window, so GPU work and presentation use one device.
Present no longer creates or replaces a device. A device created by GPU
work before VideoOut started is still replaced, now in AttachWindow.
A failure to create the window or the device is thrown from that first
VideoOut call instead of terminating the presentation thread.
Tests:
- video_out_flip_tests onedevice: GPU work, then a flip, leaves one device.
- pacing makes its first presentation span vblanks with GPU work queued
ahead of the flip; it relied on the device being created at the flip.
- unavailable expects the failure from sceVideoOutOpen.
- guest_video_out_wqhd_detection writes a param.json for the window title
and is skipped without a display or Vulkan device unless
ANYPS5_REQUIRE_DISPLAY is set.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The dma-buf import probe corrupts the device on the NVIDIA proprietary Linux
driver: the import itself succeeds, the allocation right after it fails
(vkAllocateMemory, VK_ERROR_OUT_OF_DEVICE_MEMORY), and every later allocation on
that device fails with it. The probe runs while each device is set up, so every
GPU execution test on that driver fails.
Measured on an RTX 3080 Ti, driver 615.71.09, main at df16c4c2, ctest -j 16:
- without this change: 84 of 408 tests fail, all 84 of them agc_driver
execution tests (84 of 166);
- APS5_WRITE_WATCH_IMPORTS=watch, which skips both probes but leaves
context.dmaBufImport set: 408 of 408 pass, which places the probe, not the
shared-backing imports, at the failure.
dma-buf import is now off on VK_DRIVER_ID_NVIDIA_PROPRIETARY, which stops the
probe and 815d2747's imports together. No test provides shared backing, so those
imports are not exercised here; they are left off rather than assumed to work on
this driver. The Recorder test device takes the same decision, so a developer
build behaves like the shipped one.
Tested: Linux (CachyOS, GCC, Release, BUILD_TESTING=ON), full suite 408 of 408
with the change, 324 of 408 without it. CI runs on lavapipe, whose driver id is
not NVIDIA, so the new condition does not fire there.
AMPR events were registered and raised as EVFILT_USER. Titles that
dispatch their AMPR queue by filter ignore those events, so reads that
complete through WriteKernelEventQueue never finish. Add, delete and
trigger them with EVFILT_AMPR (-25).
Release the registry mutex while yielding for an outstanding lease even before a GPU pin waiter is registered. This lets the lease holder finish a nested allocation lookup and release its lease instead of deadlocking against an unmap.
Validation: the deterministic concurrent unmap/lookup regression fails at the lease deadline before the fix and passes after it. Graphics and guest-memory CTests pass. Live Skyrim stacks captured this cycle in a compute upload flushing a storage texture.
AI-assisted implementation.
ElfReader::ReadHeader names 0x1D3D154F as a SELF container, but dumps also
carry a second container magic, 0xEEF51454 (bytes 54 14 f5 ee), which fell
through to "Invalid ELF magic number: 54 14 f5 ee". That message reads as a
corrupt input rather than an encrypted one, so a user cannot tell that
decryption is what stands between them and a relink.
Both magics now report the SELF message. Measured on two retail dumps:
PPSA03671's eboot.bin and libcohtml.Prospero.prx are 54 14 f5 ee; PPSA28997's
eboot and modules are 4f 15 3d 1d.
Tested: Linux (CachyOS, GCC, Release, BUILD_TESTING=ON), relinker rebuilt. The
new case fails on the revert of the reader change with the exact message above
and passes with it; elf_header, elf_offsets, dynamic_segment,
string_table_bounds, guest_needed_modules, guest_module_directories and
linux_load_alignment still pass.
Dean