The export threw, and titles query the system name during startup.
Parameter 6 (the system name) now writes the fixed name "PS5" into a
buffer of at least SYSTEM_SERVICE_MAX_SYSTEM_NAME_LENGTH (65) bytes.
A null buffer or a zero size returns SYSTEM_SERVICE_ERROR_PARAMETER,
as in KytyPS5. Other parameter ids and buffers of 1 to 64 bytes still
throw, because no PS5 source gives their result. guest_system_service
covers the error rows, both throws and the returned name.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PE writer marked relocatable executables HIGH_ENTROPY_VA. Windows
then places the main thread stack, TEB, PEB and the loader threads'
stacks, which exist before libc reserves the guest arena from
0x2_0000_0000, anywhere in the first TiB. Nearly half the time they
land inside the arena and stay there as holes that fixed guest
mappings cannot use.
DllCharacteristics is now 0x140 (DYNAMIC_BASE, NX_COMPAT). The image
is still relocated and bottom-up allocations keep the 8-bit
randomization, but they start near the bottom of the address space,
far below the arena. DLL placement does not depend on this flag.
windows_address_space checks the flags and, on Windows, runs a
relinked guest that returns the high dword of its stack pointer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scePsmlMfsrGetContextBufferRequirement1100, scePsmlMfsrCreateContext1100
and scePsmlMfsrGetDispatchMfsrPacket1100 were not exported, so a title
importing them failed to load.
In Sony's libScePsml all three return 0x8A810001 (not initialized)
without writing their outputs until scePsmlMfsrInit has succeeded.
AnyPS5's scePsmlMfsrInit throws, so that is the only state a title can
reach, and the three calls now return that error.
The existing stubs for scePsmlMfsrInit, scePsmlMfsrReleaseContext and
scePsmlMfsrGetDispatchMfsrPacketSizeInDwords get their real names and
still throw. libScePsml_debug gets a CMakeLists.txt for the new
guest_psml test.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Without network a signaling context is never prepared. Like
ActivateSession, ActivateUser and GetConnectionInfo,
sceNpSessionSignalingRequestPrepare returns 0x80552D06 (UNAVAILABLE)
and writes no request id. sceNpSessionSignalingGetLocalNetInfo no
longer throws: it returns 0x80552D06 and leaves the info unchanged, as
libSceNetCtl reports neither an address nor NAT info offline. A null
request id or info returns 0x80552D02, as a null context id does in
CreateContext2. GetConnectionStatus still throws.
The new guest_np_session_signaling test checks the error codes and
that failed calls leave the request id and info unchanged; it is
registered in a new libSceNpSessionSignaling CMakeLists.txt.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Titles set the PS Store icon layout before they show the icon, and a
title that imports the call stops at startup on the unresolved import.
No PS Store icon is drawn, so like the show and hide calls it accepts
every layout and returns 0 without effect. The signature follows
shadPS4 (a PS4 reference), which also returns OK for every layout.
The libSceNpCommerce entry under "Silent stubs" in TechnicalDebt now
names the function.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title that loads libSceMsgDialog.native without libSceMsgDialog
imports sceMsgDialogClose from it, so without the export it stops at
startup on an unresolved import.
Close turns a running dialog into a finished one and returns
NOT_RUNNING in every other state, as libSceMsgDialog's Close does.
The module keeps its own dialog status, so it cannot reuse that
export. Open in this module finishes the dialog at once, so Close
after Open returns NOT_RUNNING and leaves the result unchanged.
The module is now listed under silent stubs in TechnicalDebt, and a
CMakeLists.txt registers the guest_msg_dialog_native test.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title's own libc.prx implements __cxa_thread_atexit and the
destructor pass of exit() through _sceLibcInternalThreadAtexit and
_sceLibcInternalThreadDtors. Its __cxa_finalize calls
_sceLibcInternalForceTlsDestructor.
Destructors are kept per thread and run newest first, including those
registered while they run, as FreeBSD's __cxa_thread_call_dtors does.
A null destructor or one outside every loaded image throws instead of
being skipped. The first registration installs the pass as the
libkernel thread exit hook, so it runs on every guest thread before
the thread can be joined. _sceLibcInternalForceTlsDestructor throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libc's __std_atomic_wait_direct_32 and __std_atomic_wait_direct_64
import these functions, so a libc.prx that contains the C++20 atomic
wait wrappers does not load without them. Wait32 compares a 4-byte
value and Wait64 the full 8-byte value. Both share the waiter queue
of sceKernelSyncOnAddressWait, so sceKernelSyncOnAddressWake releases
waiters of every size on the address. A null address, or one not
aligned to the value size, throws. The by-value comparand, the return
values and the 8-byte alignment of Wait64 are assumed and recorded in
TechnicalDebt.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Titles import sceHttpParseStatusLine from libSceHttp to read the
status line of a response; without the export they fail at startup.
Parse the HTTP/x.y version, the three-digit code and the reason phrase
up to the line feed, and return the library's PARSE_HTTP error codes.
The seven-argument signature is the one SharpProspero declares; the
behaviour follows the shadPS4 reimplementation of the PS4 library,
except that no byte past lineLen is read. A consumed count above
INT32_MAX cannot be returned and throws. guest_http covers valid lines
and each error path.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Windows the guest arena ended at 0x72_0000_0000: #231 kept its
448 GiB size after #153 had moved its start down to 0x2_0000_0000.
Titles map fixed addresses up to the application map area end,
0xFC_0000_0000 (SCE_KERNEL_APP_MAP_AREA_END_ADDR on the PS4), and a
direct memory mapping above the old end threw "shared mapping outside
the guest arena".
The arena is now reserved up to 0xFC_0000_0000. The out-of-arena
errors name the address and length, and a fixed mapping over a used
arena range says whether it hit a host region. guest_memory maps
direct memory at the last two pages below the end, reads it through
an alias and checks that a mapping at the end is refused.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA26344 calls sceAudioOut2Set3DLatency(0xFF, 2) right after
sceAudioOut2Initialize and fails its audio initialization on a negative
return; the export was missing, so the import did not resolve. Its
audio subsystem setup also calls sceAudioOut2MasteringInit(0), which
threw.
sceAudioOut2Set3DLatency accepts a latency of 2 for the system user
(0xFF) and throws for any other user or latency, as the unit and range
are unknown. sceAudioOut2MasteringInit accepts flags 0 and throws for
other flags. There is no 3D rendering or mastering stage, so neither
call changes the output; TechnicalDebt lists this under Functional and
the assumed signatures under Unknown function info.
The new audio_out2_latency test covers the accepted and thrown values.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
WRITE_DATA's control dword carries a two-bit cache policy in bits
26:25 (LRU, stream, no-allocate, bypass). Validate refused it, so a
submission with a WRITE_DATA built with a non-zero policy was rejected
as a whole.
The policy only steers how the GPU L2 keeps the written lines; the
stored words are the same, and Execute already writes them to guest
memory in queue order. The mask now accepts bits 26:25, as was done
for DMA_DATA's cache policy hints. The CE engine and the remaining
reserved bits still throw, and the message no longer names the cache.
agc_driver_pm4 stores both dwords of a WRITE_DATA with control
0x04100200 and checks that reserved bit 27 is still refused.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Validate refused every COND_EXEC, so a submission that uses one was
rejected as a whole. The packet now reads the dword at its address once
the earlier packets of its queue and their GPU writes have completed,
and skips the exec_count dwords after it when the dword is zero.
The command copy that inlines INDIRECT_BUFFERs records where each range
ends, so a range over an INDIRECT_BUFFER skips the whole buffer.
Unaligned addresses, address bits 48 and up, and reserved control and
count bits throw; the cache policy is accepted on compute queues only,
as the MEC defines it. A flip inside a range, a range that ends inside
a packet or past its command buffer, and a chained INDIRECT_BUFFER or
REWIND inside a range throw.
agc_driver_pm4 and agc_driver_flip cover the skips and the rejections.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA26344 imports libSceAgc NID dbOlWdppb4o, whose name is unknown,
and calls it with the (regs, gs, ps) arguments of
sceAgcCreateInterpolantMapping to fill the 32 SPI_PS_INPUT_CNTL
registers. It is exported as sceAgcUnknownCreateInterpolantMapping.
It differs from sceAgcCreateInterpolantMapping only for inputs that
carry the high f16 half alone (is_f16 2): these take the default bit
and DEFAULT_VAL from the high half, as KytyPS5 does.
Both exports share validation and the register loop. More than 32
pixel shader inputs now throw; before, they were written past the
32-register block. agc_interpolant_mapping covers both exports.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The resource materializer refused every atomic image descriptor whose
format was not 32_UINT. RDNA2 image atomics act on the raw dword and
the numeric format only affects addressing, so 32_SINT and 32_FLOAT
surfaces are now accepted with the Uint numeric class and run through
the existing integer atomics and float compare-exchange loops. Other
formats still throw, and the message now names the format.
DescriptorBinding gains imageAtomic, carried through the shader disk
cache (format version 4) and the resource content key. The driver
binds those elements through a cached R32_UINT view of R32_SINT and
R32_SFLOAT storage images.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAgcGetIsTrinityMode takes a pointer to a one-byte flag; the only
known caller ignores the return value. The export took no argument and
never wrote the flag. That caller's flag is in zero-initialised .bss,
so this corrects the signature; it does not fix a visible failure.
The function now stores false, as sceKernelIsTrinityMode reports a base
PS5, returns 0 and throws on a null pointer, whose error code is
unknown. It moves from Unimplemented.cpp to Misc/src/Platform.cpp, and
the new agc_platform_tests ctest target covers it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
EmitDppTargetLane threw "DPP control 336 is not supported" for the
DPP16 row_share controls 0x150-0x15f. row_share:sel now reads lane
sel of the reading lane's own row, (lane & ~15) | sel, as the RDNA2
ISA defines it. The source never leaves the row, so the target is
always valid and an inactive source follows the existing fi and
bound_ctrl rule, as for row_xmask.
The new agc_driver_dpp16_row_share_xmask execution test covers
v_mov_b32, v_add_nc_u32, v_sub_nc_u32 and v_max_f32 with row_share
and row_xmask under a partial exec mask, with fi, bound_ctrl and
row/bank masks, as wave32 and wave64; row_xmask had no test before.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
DecodeState and the draw precheck rejected PA_CL_CLIP_CNTL bit 24
(DX_LINEAR_ATTR_CLIP_ENA), so every draw that sets it was skipped.
Vulkan requires clipped NoPerspective outputs to vary linearly in
framebuffer space, and RADV and radeonsi set this bit for every draw
they emit. With the bit set the console therefore clips the way the
host driver already does, and the pipeline needs no extra state.
Clip space, depth clamping and the viewport depth range decode as
with the bit clear. Every other unsupported bit still rejects the
draw, with or without bit 24.
TechnicalDebt records that a clear bit, which was already accepted,
gets the same clipping.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
ForgetDirectMemory erased the physical pages but left g_directMappings entries pointing at the dead backing, so sceKernelVirtualQuery kept reporting is_direct with a stale physical offset. Erase (and split, on the phys axis) the affected mapping tracking on release; mapped views are untouched, so no new faults are introduced.
Any other live use of the packed register keeps throwing, as on main, instead of
reading SampleId << 8 | Layer << 16 with the other bits zero. The field range
check no longer underflows for an extract that starts past a field's end.
Adds the pixel_ancillary recompiler test.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Bit-field extracts of the packed ancillary VGPR become gl_SampleID and gl_Layer reads. A pixel
shader reading gl_Layer needs the Geometry capability instead of ShaderLayer and SPIR-V 1.5, and
the Geometry capability is available whenever the geometryShader feature is. 32-bit
SPI_SHADER_Z_FORMATs and 32_ABGR are accepted with the depth and sample-mask export enables.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
sceAjmBatchStart records the batch id it hands out and sceAjmBatchWait
removes it. Waiting on a batch id that was never issued or was already
waited on returns INVALID_BATCH instead of 0, as in shadPS4.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GLOBAL opcode 0x34 subtracts the data register from a global dword and
clamps the result to zero, returning the previous value. It only exists
in the global segment, so the flat form throws in the decoder, and the
form without glc throws like buffer_atomic_csub does. The clamped
subtract is now a shared helper used by both opcodes.
Single rounding of the whole sum, f32 accumulator denormals flushed, NaN
picked on the bits, clamp ignored and the v_dot2c accumulator read from
the lane itself under DPP, all as measured on hardware.
Co-Authored-By: Claude <[email protected]>
AMD hardware compares a sample_c reference against a color texture's red
channel; Vulkan defines comparison sampling only for depth formats, so the
driver refused any compare-sampled texture that is not R32 float or R16
unorm. PPSA21567 compares the same LESSEQUAL, clamp-to-border (opaque
white) sampler against a shadow map and against a 1x1 RGBA8 texture.
For a compare-sampled image whose format is not natively comparable, the
specialization records the paired sampler's compare function, filter,
addressing and border, and the view's reference clamp kind; the image then
binds as an ordinary color texture. The backend fetches the red channel,
applies wrap, clamp-to-edge or clamp-to-border addressing with the
sampler's texel-centre convention (border taps take the border's red),
compares, and blends four comparisons for bilinear filtering. Real depth
formats keep the native path.
Only sample_c / sample_c_lz on 2D and 2D array views, float/unorm/snorm
formats, wrap, clamp-to-edge or clamp-to-border, point or bilinear at one
level are implemented; half-border, the border color table and everything
else on this path throw. The reference clamp for unorm/snorm color formats
is not documented by AMD and is recorded in the technical debt.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The output modifier was a separate multiply by 2, 4 or 0.5. On NVIDIA
that multiply behaves as if folded into the instruction's own v_mul_f32
despite NoContraction, so a product that overflows comes back finite
after div:2 (FLT_MAX * 2.0 div:2 gave FLT_MAX instead of +inf).
Scale a normal result by adding to or subtracting from its exponent
field instead: mul:2/mul:4 saturate to signed infinity when the exponent
overflows, div:2 keeps the existing signed-zero flush below 2^-125, and
infinities and NaNs pass through unchanged. Over all 2^32 inputs the
results are bit-identical to the previous IEEE multiply and selects.
Titles that list libSceUsbd.prx as a needed module stop in the
startup stub with "Failed to load module: libs\libSceUsbd.prx"
(GetLastError 126), even when they import no function from it.
Add libSceUsbd with an Export.cpp that contains only APS5_DUMMY_FUN,
like libkernel_sys, libkernel_web, libSceAgcVsh, libSceAjm and
libSceNgs2. The module now loads, exports no sceUsbd function and
guesses no signature, so a title that does import one still stops
with "FAIL: unresolved ELF import" for that NID.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
IntrusivePtr<T> is three pointers: object, deleter, LibContext. The default
constructors zero them, the copy constructors copy them and take a reference
on the object, operator-> and operator* return the object, and the destructors
drop a reference and hand the object to the deleter when it was the last one.
The last-reference release of a pointer without a deleter needs the object's
destructor and the LibContext memory pool and still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
