Wait8 and Wait16 compare the 1- or 2-byte value at the address with the
comparand and share the waiter queue of the other sizes.
sceKernelSyncOnAddressWake accepts any non-null address: libc's
__std_atomic_notify_one/all pass the atomic's own address, which for 8- and
16-bit atomics need not be 4-byte aligned.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Linux every module resolves its references through one global scope,
and the guest modules are listed ahead of the host prx. When a title
bundles its own libc.prx, the host libc and the other host prx bound
their references to their own NIDs to the guest libc, so the host libc
built its standard streams on top of the guest _Stdout.
The exports of guest modules, and the guest and executable imports that
a guest module satisfies, now carry a #guest suffix. The title's imports
still reach the guest modules first, and a host prx only sees host
definitions, as on Windows. sceKernelDlsym also looks for the suffixed
name.
A loop whose exits have no common post-dominator, such as a normal exit
to one s_endpgm tail beside an early-out to a kill tail, got no merge
block, and Structurize threw "loop at block N has no structured
merge/continue". With three or more exits, detectNaturalLoops threw
first, on a lookup of InvalidControlFlowId.
Such a loop now leaves through one new merge block that dispatches on
route variables. They are cleared before the header and set on each
exit edge to a target other than the latch's exit. Inner loops are
routed first; a routing that would change the natural loops throws.
A loop-exit tail branch whose in-body target is the continue block no
longer merges there, which spirv-val rejects ("Header block ... is
contained in the loop construct ..., but its merge block ... is not").
DecodeState, the draw precheck and DecodePixelStageInfo rejected every
nonzero CONSERVATIVE_Z_EXPORT (DB_SHADER_CONTROL bits 13-14).
EXPORT_LESS_THAN_Z (1) and EXPORT_GREATER_THAN_Z (2) promise that the
exported Z stays on one side of the interpolated Z. The value now
reaches the recompiler as a pixel stage field, and a pixel shader that
writes FragDepth declares DepthLess or DepthGreater next to
DepthReplacing, the SPIR-V modes RADV maps to these values. Vulkan lets
those modes only add a depth test of the interpolated Z before shading,
so a shader that keeps the promise renders the same. The reserved value
3 still throws.
The field is part of the recompile cache key, the draw key and the
serialized request (version 7), and ValidateShaders accepts both modes.
The FLAT decoder took a scalar base address (SADDR) only from a
numbered SGPR pair, so global loads, stores and atomics and
global_load/store_dword_addtid with SADDR = vcc (106) threw "FLAT
scalar address register range overflow". LLVM's GFX10 global saddr
operand accepts s, vcc, ttmp, null and off.
A two-register base may now be VCC. The address translation already
reads it as VCC_LO:VCC_HI through offsetOperand. The same helper
serves the scratch SADDR, where vcc_lo becomes the 32-bit offset.
VCC_HI, M0, EXEC and the trap temporaries still throw.
Initialize, PortOpen/Close, PortSetAttribute, PortGetQueueLevel,
PortAdvance and PortPush. One port, validation order and error codes from
the PS5 module as read by prosper; blocking push paced at granularity
samples per frame at 48 kHz like KytyPS5.
Co-Authored-By: Claude <[email protected]>
Recognize the read-direction ALU forms (add, or, adc, sbb, and, sub, xor,
cmp) that read a qword from fs:[disp32], such as the stack canary check
`xor rbx, fs:[0x28]` emitted by stack-protected functions. They were
rejected as unsupported, which blocked titles relinked on Windows.
The stub loads the TLS value and applies the operation in place, keeping
the final operation as the last flag-setting instruction and preserving
the accumulator and counter. A destination of rax uses rdx as the value
scratch so the original accumulator survives.
Refs #217
sceAjmBatchStart processes every job before it returns the batch id, so a
batch that has not been waited on is never pending: cancelling it returns 0.
A batch that was never issued or was already waited on returns INVALID_BATCH,
and a context id that was never issued returns INVALID_CONTEXT, as in shadPS4.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
F32 operands applied |x| and -x as FAbs and OpFNegate. The NVIDIA driver
returns its canonical NaN 0x7fffffff from FAbs of a NaN with a payload,
so an instruction that passes a NaN operand through on the bits, such as
v_div_fixup_f32 with |v5| = 0x7ff00000, loses the payload. RADV and
lavapipe keep it.
Clear or flip the sign bit instead, as readOperand already does for U32
operands. IEEE 754 defines abs and negate as sign-bit operations, so this
is exact for every input.
LayoutFor had no case for VK_FORMAT_A2R10G10B10_UNORM_PACK32, the format
of a COLOR_2_10_10_10 color target with the alternate component swap, so
FillDccClear could not encode its 0001, 1110 and 1111 clear codes. The
format now takes the A2B10G10R10 layout: the codes set the three color
channels alike, so both packings give the same words.
A draw into a copied target under these keys now starts from the clear
value instead of the stored texels, and clearTexel (the CB metadata pass
and storeClearTexels) returns the texel instead of throwing. Textures
and resident targets, stored as A2B10G10R10, and DccAlphaOnMsb are
unchanged. Split out of #648.
sceVideoOutRegisterBuffers2 threw "DCC presentation is not implemented"
for category 1 (DCC-compressed) buffers, which PPSA26344 registers. Such
a buffer now needs DCC metadata and the tiled layout, and dcc_control may
only use the CB_DCC_CONTROL block layout bits 0x10026c.
At a flip the keys are read behind their recorded writers, one byte per
256 bytes as in the driver's DCC model. Uncompressed keys present the
stored texels as before; a uniform clear code presents its color with a
GPU clear of the scaler's source image; a pending storage image is used
when it serves the keys. Mixed or unreadable keys, clear codes the
display format has no DCC encoding for, register-clear keys over a
pending image and a clear color wider than 32 bits throw. Buffers
without DCC take the old path.
sceFontOpenFontSet failed for every set type, so PPSA21564 drew no text
in system fonts (the title screen copyright line, credits, button
guides). It now loads the set's primary font file from
ANYPS5_SYSTEM_FONTS, or anyps5-fonts beside the executable: console
files under their own names first, then openly licensed substitutes
(Noto Sans, Noto Sans Mono, Noto Sans Thai, Noto Sans CJK). The
PS5-only JG2 set types are accepted.
System font handles use the system font context. Their faces are
loaded by FreeType in host memory: about 1 MiB per CJK face does not
fit the font memory the title sizes for the console's fonts, and
sceFontCreateRenderer then failed with ALLOCATION_FAILED. Handles of
the same font file share one copy of its bytes.
Run the SIGUSR1 handler recorded by sceKernelInstallExceptionHandler on the
target thread with a PS5 ucontext (uc_mcontext at 0x40, FreeBSD amd64
layout) of its interrupted state:
- on the calling thread, directly;
- on a thread in a libkernel wait, from an APC: the TimedWait waits are
alertable and count themselves in a per-thread wait state, so the
handler runs inside the wait, which then continues;
- on a running thread, by suspending it and redirecting it to an entry
that calls the handler and restores the possibly modified context.
Other signals return EINVAL, as in shadPS4; raising without a handler
throws. Linux still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA12544's Media/Plugins modules (CommonDialog, PSN, Share) import
libSceVrSetupDialog, which no library provided, and Share, NpTrophy2,
WebBrowserDialog and NpEntitlementAccess functions that were not
exported. Add libSceVrSetupDialog and the missing functions as
unimplemented exports, except
sceNpEntitlementAccessRequestConsumeServiceEntitlement, which reports
SCE_NP_ERROR_SIGNED_OUT like
sceNpEntitlementAccessRequestConsumeUnifiedEntitlement. Their other
imports are covered by #734 and #369, and two by #407.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA12544's Unity plugins (CommonDialog, PSN) import
sceMsgDialogProgressBarInc, sceMsgDialogProgressBarSetMsg and
sceMsgDialogProgressBarSetValue from libSceMsgDialog.native, which did
not export them. As in libSceMsgDialog, they succeed while a dialog is
running and return COMMON_DIALOG_ERROR_NOT_RUNNING otherwise; the native
dialog finishes in sceMsgDialogOpen.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scePthreadAttrGet reported a null stack address and a zero size for an
adopted thread (the main thread), and for every guest thread on Linux,
where the stack range was never recorded. A garbage collector that scans
thread stacks through scePthreadAttrGetstackaddr and
scePthreadAttrGetstacksize (Unity IL2CPP in PPSA12544) then skipped the
main thread's stack and freed objects it still referenced. The range now
comes from the host thread: GetCurrentThreadStackLimits on Windows,
pthread_getattr_np on Linux.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The AMM test writes through one mapping of a physical page and reads it
through another. The two addresses are distinct to the compiler, so GCC
13 at -O2 moved the read ahead of the write and the Linux CI check saw
the old value. The test's At helper now returns a volatile reference.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceKernelInstallExceptionHandler and sceKernelRemoveExceptionHandler threw.
They now keep one handler per allowed signal (SIGHUP, SIGILL, SIGFPE,
SIGBUS, SIGSEGV, SIGUSR1, as in shadPS4): another signal or a null handler
returns EINVAL, a second handler for a signal returns EAGAIN, and removing
clears it. Delivery is not implemented and is recorded in the technical
debt; sceKernelRaiseException still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A PS5 param.json keeps defaultLanguage inside localizedParameters, next to
the language entries. The parser looked for it at the root only, then fell
back to en-US and to the first member, which is the defaultLanguage string
when no en-US entry exists (PPSA12544 has only en-GB), and threw
"expected JSON object". defaultLanguage is now read from
localizedParameters first, and the fallback takes the first language
object.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAmprAmmCommandBufferMapAsPrt, AllocatePaForPrt, RemapIntoPrt and
UnmapToPrt, with the MapAsPrt and AllocatePaForPrt measures. Signatures,
checks and their order follow ampr_emu.
The executor keeps the PRT pages of the AMM ranges. Unbacked PRT pages
are zero-filled with GPU read access; AllocatePaForPrt backs each
unbacked page with a pool page and changes the type and protection of
backed ones; RemapIntoPrt moves a mapped range into a PRT range; and
UnmapToPrt returns the pages to the pool and zero-fills them again. A
plain map, unmap or remap over a PRT range ends it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceVideoOutIsOutputSupported threw VIDEO_OUT_ERROR_UNSUPPORTED_OUTPUT_MODE
for every mode other than the default and 119.88 Hz, and
sceVideoOutConfigureOutput threw for an unavailable 119.88 Hz mode. Titles
probe and request modes the display may lack and handle the result:
PPSA12544 asks for 0xd000000a and falls back to 3840 pixels when it is not
supported, and its sceVideoOutConfigureOutput caller switches on the
returned error codes, including VIDEO_OUT_ERROR_UNAVAILABLE_OUTPUT_MODE.
Every mode except the default now reports 0, and configuring one returns
VIDEO_OUT_ERROR_UNAVAILABLE_OUTPUT_MODE.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The AMM submit forms now return EINVAL for a priority above 2 and EPERM
for a null command buffer, in that order, as ampr_emu's
amm_validate_submit_args does, instead of EINVAL for a null buffer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SOP1 opcode 33 with SDST null keeps no return address, so it is exactly
s_setpc_b64; the decoder now reads it that way, as KytyPS5 does. A call
with a real destination still throws "unsupported SOP1 opcode 33".
GraphBuilder resolves two more jump shapes. A long branch is
s_getpc_b64 and s_add_u32/s_addc_u32 or s_sub_u32/s_subb_u32
immediates, also through vcc, all in one block. A dword jump table
branches to the table base minus an entry that s_load_dword reads at an
index bounded by s_min_u32 and scaled by 4; the resolver follows
register writes back through straight-line code, and anything else is
still refused. The code table load now also handles one-dword entries.
agc_shader_control_flow checks the decode, the graphs and the refusals;
the new agc_driver_scalar_swappc runs all shapes on the GPU.
libSceAmpr gains sceAmprAmmCommandBufferRemap, MultiMap, ModifyProtect
and ModifyMtypeProtect with their GPU mask forms and the eight measure
functions. Signatures and the protection and mask checks follow ampr_emu.
The executor keeps a page table of the AMM ranges: each page's physical
offset, protection, memory type and whether it came from the pool. A
remap moves the pages of a fully mapped range and leaves the old range
reserved; a multimap maps the same pages again; a pool page returns to
the pool only when its last mapping goes. A protection change applies
the masked bits page by page.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libSceAmpr gains the AMM command buffer (constructor, destructor, map,
map direct and unmap, with their GPU mask forms and measures),
sceAmprAmmGiveDirectMemory, sceAmprAmmGetVirtualAddressRanges, the three
submit forms and sceAmprAmmWaitCommandBufferCompletion. The APR
MapBegin, MapDirectBegin and MapEnd commands and their measures record
the same map commands.
The libkernel executor now maps: a plain map takes pages from the direct
memory given to the mapper with usage 1, a direct map uses the given
offset, and an unmap returns the pages to that pool and leaves the range
reserved. The AMM ranges are reserved in the guest arena on first use.
Commands are walked by the buffer's byte offset so an AMM submission can
run raw command memory.
Signatures, the protection mask and the APR map rules follow ampr_emu;
the mapper model follows PS5PCEM. While an APR map region is open, a
second begin and every completion write return EPERM.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAmprAprCommandBufferReadFileGather, ReadFileScatter,
ReadFileGatherScatter and ResetGatherScatterState, with their measure
functions. Signatures, argument checks and the read cursor follow
ampr_emu: each read leaves the file, the next offset and the next
destination; a gather reads at a new offset into the next destination, a
scatter continues in the file into a new destination, and a
gather-scatter takes both. Recording one needs a file read since the last
reset, tracked in the command buffer object next to its type.
sceAmprAprCommandBufferReadFile now applies the same length, offset and
destination checks and rejects a null command buffer instead of
dereferencing it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean