StorageTexture::writeBackLayers keeps the CPU's bytes for an edge unit when StoredOver
reports that the CPU wrote it since the unit's generation. That check read one generation
per 64 KiB block, so a store to another allocation sharing the block counted as a store
over this surface and the whole block was kept, discarding GPU results written into it.
The driver path in the same check already compares range pieces; the CPU path now does
the same. Each collect records the generation of every page it found dirty, and StoredOver
tests only the pages its range overlaps. A block with no page record keeps the previous
whole-block answer.
Measured on an RTX 3080 Ti, main at df16c4c2:
- agc_write_tracking stores at base + Block + 8, outside the queried range but inside the
shared block. That case fails on main ("a CPU store outside the shared range counts for
it") and passes here.
- Full suite 408 of 408 (Linux, CachyOS, GCC, Release, BUILD_TESTING=ON).
This does not cover the other half of #865: the report's finding 2, where the stamps fall
on the surface's own pages and the bytes under them are unchanged, still keeps the block.
No title was run here, so the fix is offered for the report's own repro.
The LOD warning lwe adds to the texel status is texture-streaming feedback,
which is not reported for the T# MIN_LOD_WARN either. Accept lwe on sample
and gather instructions as it already is on loads and stores; lwe on
image_get_lod still throws.
PUSH GS, POP GS and RSM (0F A8, 0F A9, 0F AA) have no ModRM byte, but fell in the 0F A3-AB ModRM range, so the decoder read the next byte as a ModRM and sized its displacement. MOV to and from control and debug registers (0F 20-23) ignore the ModRM mod field and always name a register, but were sized and reported as memory forms, including a RIP-relative disp32 for mod 00 r/m 101.
ComputeThickLayout refused block-compressed formats. Compute the mip
chain, padding and mip tail from the volume's block dimensions, as the thin
layout does, so BC volumes in SW_4KB_S, SW_64KB_S and SW_64KB_S_X detile
like volumes of their blocks.
An image load whose DIM field encodes fewer coordinates than the resource
(image_load 2d on a 3D texture) was refused. Pad the missing components with
0 so the load reads the first slice.
In the host-blocked phase of guest_raise_exception, the redirected handler
runs as soon as the worker wakes inside pthread_mutex_lock, before it owns
hostLock. ExpectDelivery then returns and main relocks hostLock right away.
If main wins that race, the worker stays blocked in the previous round's
lock_guard, so it never sets started for the next round and main spins
forever. The run hangs until the 30 s ctest timeout, with only three
RunThread lines in the log.
The worker now publishes the round after it acquires the mutex, and main
waits for that before relocking.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libSceNet registers a socket poller with libkernel; select polls the requested descriptors through it until the timeout and rewrites the descriptor sets.
A fixed mapping without no-overwrite unmaps the registered pieces it overlaps before mapping, as it already did when the range lay inside registered allocations.
The driver created a windowless Vulkan device at the first dispatch and
replaced it with a windowed one at the first flip. The replacement built a
second device and re-imported every host import, and the first flip paid
for it.
VideoOut now creates its window when it starts (the first VideoOut call),
at the default 1920x1080 output, and attaches it to the driver
(AgcDriverAttachWindow) before the call returns. The driver creates its
device with that window, so GPU work and presentation use one device.
Present no longer creates or replaces a device. A device created by GPU
work before VideoOut started is still replaced, now in AttachWindow.
A failure to create the window or the device is thrown from that first
VideoOut call instead of terminating the presentation thread.
Tests:
- video_out_flip_tests onedevice: GPU work, then a flip, leaves one device.
- pacing makes its first presentation span vblanks with GPU work queued
ahead of the flip; it relied on the device being created at the flip.
- unavailable expects the failure from sceVideoOutOpen.
- guest_video_out_wqhd_detection writes a param.json for the window title
and is skipped without a display or Vulkan device unless
ANYPS5_REQUIRE_DISPLAY is set.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The dma-buf import probe corrupts the device on the NVIDIA proprietary Linux
driver: the import itself succeeds, the allocation right after it fails
(vkAllocateMemory, VK_ERROR_OUT_OF_DEVICE_MEMORY), and every later allocation on
that device fails with it. The probe runs while each device is set up, so every
GPU execution test on that driver fails.
Measured on an RTX 3080 Ti, driver 615.71.09, main at df16c4c2, ctest -j 16:
- without this change: 84 of 408 tests fail, all 84 of them agc_driver
execution tests (84 of 166);
- APS5_WRITE_WATCH_IMPORTS=watch, which skips both probes but leaves
context.dmaBufImport set: 408 of 408 pass, which places the probe, not the
shared-backing imports, at the failure.
dma-buf import is now off on VK_DRIVER_ID_NVIDIA_PROPRIETARY, which stops the
probe and 815d2747's imports together. No test provides shared backing, so those
imports are not exercised here; they are left off rather than assumed to work on
this driver. The Recorder test device takes the same decision, so a developer
build behaves like the shipped one.
Tested: Linux (CachyOS, GCC, Release, BUILD_TESTING=ON), full suite 408 of 408
with the change, 324 of 408 without it. CI runs on lavapipe, whose driver id is
not NVIDIA, so the new condition does not fire there.
AMPR events were registered and raised as EVFILT_USER. Titles that
dispatch their AMPR queue by filter ignore those events, so reads that
complete through WriteKernelEventQueue never finish. Add, delete and
trigger them with EVFILT_AMPR (-25).
Release the registry mutex while yielding for an outstanding lease even before a GPU pin waiter is registered. This lets the lease holder finish a nested allocation lookup and release its lease instead of deadlocking against an unmap.
Validation: the deterministic concurrent unmap/lookup regression fails at the lease deadline before the fix and passes after it. Graphics and guest-memory CTests pass. Live Skyrim stacks captured this cycle in a compute upload flushing a storage texture.
AI-assisted implementation.
ElfReader::ReadHeader names 0x1D3D154F as a SELF container, but dumps also
carry a second container magic, 0xEEF51454 (bytes 54 14 f5 ee), which fell
through to "Invalid ELF magic number: 54 14 f5 ee". That message reads as a
corrupt input rather than an encrypted one, so a user cannot tell that
decryption is what stands between them and a relink.
Both magics now report the SELF message. Measured on two retail dumps:
PPSA03671's eboot.bin and libcohtml.Prospero.prx are 54 14 f5 ee; PPSA28997's
eboot and modules are 4f 15 3d 1d.
Tested: Linux (CachyOS, GCC, Release, BUILD_TESTING=ON), relinker rebuilt. The
new case fails on the revert of the reader change with the exact message above
and passes with it; elf_header, elf_offsets, dynamic_segment,
string_table_bounds, guest_needed_modules, guest_module_directories and
linux_load_alignment still pass.
Once an image has .ehmeta, an eh_frame_hdr version other than 1, an
eh_frame_ptr encoding other than absptr or pcrel, a 64-bit record length,
an eh_frame_ptr outside the image or a missing terminator now throw
instead of returning the empty answer. The test queries a fixture DLL
whose .ehmeta it can break, since the unwinder reads the same section.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Windows the call returned no eh_frame_hdr for every address, so a
title's own libc (its libunwind) found no frame information and
terminated on the first C++ exception thrown in guest code. PPSA12544
died that way after its intro cinematic: IL2CPP raised an
AmbiguousMatchException that Unity catches and logs, and the runtime
called terminate instead. For an address in a relinked guest image the
call now returns the PT_GNU_EH_FRAME segment named by .ehmeta, the
eh_frame it points to and its size, and the image as seg0; host images
keep the empty answer.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The decoder adds the TEST immediate of opcodes F6 and F7 when ModRM.reg
is 0 or 1. The check excluded VEX and two-byte opcodes but not EVEX, so
an EVEX.0F F6 (VPSADBW) whose ModRM.reg is 0 or 1 was given an extra
imm8 and decoded one byte too long. VPSADBW has no immediate (Intel SDM
Vol. 2B, VPSADBW).
Use dlsym to avoid identifying the executable PLT entry as the shared-library function in non-PIE builds. Fedora 44 Release guest_force_tls_destructor passes. Written with AI assistance.
Opening a save progress dialog immediately reported FINISHED. Skyrim
waited for RUNNING before writing SAVEDATA.DAT and never resumed. Keep
progress-bar mode running through polling and progress updates until
Close, retaining the existing automatic responses for other dialog modes.
Add lifecycle regression coverage for repeated polling, completion,
reopening, result metadata and ordinary selection dialogs. The test
failed on the previous implementation and passes with the fix on Fedora
44 Release. Correcting the live dialog state recovered a blocked Skyrim
save without restarting its session.
Written with AI assistance.
The 36-byte SceSaveDataDirName declaration placed every search result
after the first at the wrong address and could overrun guest arrays.
Skyrim read an empty directory name for its second save and aborted
when mounting it. Use the 32-byte layout also used by the native dialog,
KytyPS5 src/libs/libSaveData.cpp and fpPS4 ps4_libscesavedata.pas.
Add a regression using two maximum-length names, a guest buffer guard,
and mounts of both returned records. It detects the previous overrun.
Fedora 44 Release search, dialog, delete and PS4-save tests pass. Skyrim
now mounts and reads the second save instead of rejecting its name.
Written with AI assistance.
Measured on a PS5 (firmware 13.60) through dlopen of libSceRtc.sprx.
The weekday is required in any case or length, month names may be
full, RFC 2822 and RFC 850 share one lenient grammar with 2-digit years
split at 50, and the asctime zone is ignored. Zones come from a name
table, a military letter, or +HHMM without a range check. Text the
console rejects returns a parse error with the tick untouched, and an
invalid calendar date returns 0 with only the offset applied to the
tick, as the console does.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On a PS5 (firmware 13.60) every input that starts with a digit gets the
same result and tick from sceRtcParseDateTime as from
sceRtcParseRFC3339, except that leading spaces and tabs are skipped
first. A string without a zone, or with a space instead of T, is a
parse error rather than UTC.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on a PS5 (firmware 13.60) through dlopen of libSceRtc.sprx:
an empty fraction is accepted, any digits past the sixth are dropped,
text after the zone is ignored, the offset is applied without a range
check, and a 60th second returns 0 with the tick only shifted by the
offset.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Without the host import release, a device created after another was
destroyed freed the leftover imports through the destroyed device and
the process crashed (SIGILL on NVIDIA). The teardown test now runs a
second device over the same guest block once the first is gone.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_018RNrNcixatky8U4LfC7Ew5
The host import registry is a function-local static that device
teardown never emptied, so every import still registered kept its
VkBuffer and VkDeviceMemory past vkDestroyDevice
(VUID-vkDestroyDevice-device-05137 in 23 execution tests).
ClearHostImports destroys the device's imports and resets the
registry; ~State calls it next to ClearImageMirrors.
Closes#1236
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_018RNrNcixatky8U4LfC7Ew5
A storage image uploaded under fast-clear DCC keys left the clear code
in guest memory until its write-back, so a title kernel that read the
keys after a draw or dispatch into the image saw the clear code.
PPSA26344's DCC retile kernel copies such keys into its display
buffer's metadata every frame, and the flip presented the clear color.
MarkDirty now stores uncompressed keys the first time an image uploaded
under a clear code is written, unless the title filled the keys with a
clear code since, and the image's uploaded keys become uncompressed.
While they are, Refresh and the fast revalidation read the keys as the
recorded work writing them leaves them: from the bytes pending uniform
fills and driver key stores note (NotePendingFill) when those already
make the keys read uncompressed (bytes that differ, 0xff, or a byte the
format can't use as a clear code), otherwise after waiting for that work.
A year before 1980 or after 2107 cannot be packed into the DOS time, so
GetDosTime threw. Following the disassembly-derived fpPS4
reimplementation of the PS4 library, it now returns INVALID_YEAR after
writing 0 for an earlier year and 0xff9fbf7d, the largest encodable
time, for a later one. The TechnicalDebt entry now records fpPS4 as the
source for the SetDosTime year decode as well.
Dean