sceKernelInstallExceptionHandler and sceKernelRemoveExceptionHandler threw.
They now keep one handler per allowed signal (SIGHUP, SIGILL, SIGFPE,
SIGBUS, SIGSEGV, SIGUSR1, as in shadPS4): another signal or a null handler
returns EINVAL, a second handler for a signal returns EAGAIN, and removing
clears it. Delivery is not implemented and is recorded in the technical
debt; sceKernelRaiseException still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title's libc.prx calls it from __cxa_thread_atexit with flags 2 and
stores the returned module id in the destructor record. The 0x1A8-byte
info reports the name, id, TLS block, init and fini procedures,
eh_frame_hdr and eh_frame, and up to four load segments of the image
containing the address. The id is the loader handle when the image was
opened through sceKernelLoadStartModule and otherwise a stable id from
the same range. Unknown flags and st_size values throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Release direct memory only when the whole range is allocated: a misaligned
start or length returns EINVAL, a zero length succeeds, and a range that
leaves direct memory or covers an unallocated page returns ENOENT without
releasing anything, as in shadPS4. The check and the release run under
the pool lock.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Unity titles keep modules the executable needs in Media/Modules
(PPSA12544: Il2cppUserAssemblies.prx and PS5Util.prx), outside sce_module
and prx, so they were left as host libraries and startup failed to load
them. A DT_NEEDED module of the executable that is not in a module
directory is now searched for under the input directory and relinked like
the others; two ELF files with the name are ambiguous. Guest outputs keep
their directory relative to the input instead of only its last component.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rename the two unknown libSceSaveData.native stubs to
sceSaveDataTransferringMountPs4 (RjMlsR8EXrw) and
sceSaveDataDirNameSearchPs4 (X4MYzukPc3g). There is no PS4 save area:
the mount returns NOT_FOUND like sceSaveDataTransferringMount, and the
search reports zero hits.
Co-Authored-By: Claude <[email protected]>
dlopen and sceKernelLoadStartModule passed the guest path to the host
loader, which cannot load the original ELF module. When a relinked module
<path>.guest.prx exists beside it, that module is loaded instead; for a
module the executable already loaded at startup the host loader returns
the same module. PPSA12544 loads /app0/Media/Modules/Il2CppUserAssemblies.prx
at startup and resolves IL2CPP functions through it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
OQ-dzhlnM28, qBS714-Jr3g and tB59hFLH3SA are _sceLibcInternalThreadDtors,
_sceLibcInternalThreadAtexit and _sceLibcInternalForceTlsDestructor,
implemented in libSceLibcInternal by #641. dbOlWdppb4o is implemented by
#651.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
NH6xARDOVv8 is the NID of sceKernelGetOperationMode. PPSA12544 passes two
int outputs and logs them as mode and submode; both are reported as 0.
B2n8aDorSH4 and PZQhiiLXRFs are sceKernelSyncOnAddressWait32 and
sceKernelSyncOnAddressWait64, implemented by #633, and are no longer added
as unimplemented exports.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Implement scePthreadGetschedparam and scePthreadSetschedparam on top of
the thread priority, POSIX utimes and fsync on top of sceKernelUtimes
and sceKernelFsync, and sceUserServiceGetAccessibilityZoomFollowFocus
like the other accessibility queries. Add the remaining imports of
PPSA12544 as unimplemented exports and record unknown NIDs and
signatures in the technical debt.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Track the stack range of each running guest thread and answer
sceKernelIsStack from the calling thread's stack (the host limits for an
adopted thread) or from that registry. A mapped address outside every
stack succeeds with null bounds and an unmapped one returns EACCES; the
output pointers may be null.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Report age level 0 for the initial user and reject other users and a null
output like the other user queries. The meaning of the value is unknown and
recorded in the technical debt; PPSA12544 only stores it for its user
profile.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A range reserved with sceKernelReserveVirtualRange is registered as not
readable, and sceKernelVirtualQuery only searched readable registrations,
so a query inside a reservation fell back to the host and returned EACCES.
Reserved ranges are now tracked until a direct or flexible mapping or an
unmap covers them, and a query inside one succeeds with the reserved piece
as its extent, protection 0 and is_committed clear. PPSA12544's allocator
queries a reservation before committing it and treated the error as a
failed commit, then wrote to the inaccessible range.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceVideoOutRegisterBuffers2 and sceVideoOutSubmitChangeBufferAttribute2
threw for every buffer attribute option other than 0. PPSA26344 builds
its display buffers with option 8 through the libSceAgc helper linked
into it, so its first registration failed.
Option 8, VIDEO_OUT_BUFFER_ATTRIBUTE_OPTION_STRICT_COLORIMETRY (name
and value from KytyPS5), is now accepted and presented as option 0;
every other option still throws. What the console changes for it is
unknown and recorded in TechnicalDebt. The rejection now names the
tiling mode, pitch, aspect ratio and option it was given.
video_out_flip_tests decode checks that option 8 describes the same
buffer as option 0 and that options 1, 32 and 40 are rejected.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libSceVoiceQoS exported only sceVoiceQoSInit, so a title that imports
the rest of the library failed at load on unresolved imports.
Declare sceVoiceQoSEnd, the local and remote endpoint create and delete
functions, sceVoiceQoSConnect, sceVoiceQoSDisconnect, both endpoint
attribute setters, sceVoiceQoSReadPacket and sceVoiceQoSWritePacket.
Each calls NotImplemented_nid_no_patch and reads no arguments, so the
imports resolve and a call still stops with the function's name.
sceVoiceQoSInit is unchanged. Their behaviour follows in a later change,
once a title is seen to reach them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Ghost of Yotei (PPSA26344) imports both functions, so its import
resolution failed at startup. Markers only feed an attached Razor
capture. AnyPS5 hosts none and sceRazorCpuIsCapturing reports 0, so,
like the other libSceRazorCpu exports, both do nothing and return 0.
The push signature comes from the title's calls (a string literal,
0x80ffffff, 2). TechnicalDebt lists both functions with the assumed
signatures. guest_razor_cpu covers nested and unbalanced markers.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Guest modules may define symbols in SHN_ABS (0xfff1), for example the
151 library marker symbols of PPSA12544's Il2cppUserAssemblies.prx.
The reader no longer rejects them or checks their value as a mapped
address, relocations against them write the absolute value without a
base relocation, and they are not exported: a PE export is an RVA, so an
import of one fails at startup as an unresolved import. Other special
sections are still rejected.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Both submit each DCB of the address and size arrays to the graphics queue
in array order, as sceAgcDriverSubmitDcb does for one. A count of 0 is
accepted without reading the arrays; null arrays with a non-zero count and
arrays outside guest memory throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Windows each direct memory allocation is backed by a page-file
section that CreateFileMappingW commits in full. When the system commit
limit cannot cover it, the title stopped with "create direct memory
backing: Insufficient system resources exist to complete the requested
service", which did not say how much was requested.
The error now states the requested size in bytes and MiB, and the
runtime layout notes in USAGE.md describe the commit requirement and
the page file. Allocation behaviour is unchanged: committing at
allocation matches the console, where allocated direct memory is
always backed by physical memory.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The export threw, and titles query the system name during startup.
Parameter 6 (the system name) now writes the fixed name "PS5" into a
buffer of at least SYSTEM_SERVICE_MAX_SYSTEM_NAME_LENGTH (65) bytes.
A null buffer or a zero size returns SYSTEM_SERVICE_ERROR_PARAMETER,
as in KytyPS5. Other parameter ids and buffers of 1 to 64 bytes still
throw, because no PS5 source gives their result. guest_system_service
covers the error rows, both throws and the returned name.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PE writer marked relocatable executables HIGH_ENTROPY_VA. Windows
then places the main thread stack, TEB, PEB and the loader threads'
stacks, which exist before libc reserves the guest arena from
0x2_0000_0000, anywhere in the first TiB. Nearly half the time they
land inside the arena and stay there as holes that fixed guest
mappings cannot use.
DllCharacteristics is now 0x140 (DYNAMIC_BASE, NX_COMPAT). The image
is still relocated and bottom-up allocations keep the 8-bit
randomization, but they start near the bottom of the address space,
far below the arena. DLL placement does not depend on this flag.
windows_address_space checks the flags and, on Windows, runs a
relinked guest that returns the high dword of its stack pointer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scePsmlMfsrGetContextBufferRequirement1100, scePsmlMfsrCreateContext1100
and scePsmlMfsrGetDispatchMfsrPacket1100 were not exported, so a title
importing them failed to load.
In Sony's libScePsml all three return 0x8A810001 (not initialized)
without writing their outputs until scePsmlMfsrInit has succeeded.
AnyPS5's scePsmlMfsrInit throws, so that is the only state a title can
reach, and the three calls now return that error.
The existing stubs for scePsmlMfsrInit, scePsmlMfsrReleaseContext and
scePsmlMfsrGetDispatchMfsrPacketSizeInDwords get their real names and
still throw. libScePsml_debug gets a CMakeLists.txt for the new
guest_psml test.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Without network a signaling context is never prepared. Like
ActivateSession, ActivateUser and GetConnectionInfo,
sceNpSessionSignalingRequestPrepare returns 0x80552D06 (UNAVAILABLE)
and writes no request id. sceNpSessionSignalingGetLocalNetInfo no
longer throws: it returns 0x80552D06 and leaves the info unchanged, as
libSceNetCtl reports neither an address nor NAT info offline. A null
request id or info returns 0x80552D02, as a null context id does in
CreateContext2. GetConnectionStatus still throws.
The new guest_np_session_signaling test checks the error codes and
that failed calls leave the request id and info unchanged; it is
registered in a new libSceNpSessionSignaling CMakeLists.txt.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Titles set the PS Store icon layout before they show the icon, and a
title that imports the call stops at startup on the unresolved import.
No PS Store icon is drawn, so like the show and hide calls it accepts
every layout and returns 0 without effect. The signature follows
shadPS4 (a PS4 reference), which also returns OK for every layout.
The libSceNpCommerce entry under "Silent stubs" in TechnicalDebt now
names the function.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title that loads libSceMsgDialog.native without libSceMsgDialog
imports sceMsgDialogClose from it, so without the export it stops at
startup on an unresolved import.
Close turns a running dialog into a finished one and returns
NOT_RUNNING in every other state, as libSceMsgDialog's Close does.
The module keeps its own dialog status, so it cannot reuse that
export. Open in this module finishes the dialog at once, so Close
after Open returns NOT_RUNNING and leaves the result unchanged.
The module is now listed under silent stubs in TechnicalDebt, and a
CMakeLists.txt registers the guest_msg_dialog_native test.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title's own libc.prx implements __cxa_thread_atexit and the
destructor pass of exit() through _sceLibcInternalThreadAtexit and
_sceLibcInternalThreadDtors. Its __cxa_finalize calls
_sceLibcInternalForceTlsDestructor.
Destructors are kept per thread and run newest first, including those
registered while they run, as FreeBSD's __cxa_thread_call_dtors does.
A null destructor or one outside every loaded image throws instead of
being skipped. The first registration installs the pass as the
libkernel thread exit hook, so it runs on every guest thread before
the thread can be joined. _sceLibcInternalForceTlsDestructor throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libc's __std_atomic_wait_direct_32 and __std_atomic_wait_direct_64
import these functions, so a libc.prx that contains the C++20 atomic
wait wrappers does not load without them. Wait32 compares a 4-byte
value and Wait64 the full 8-byte value. Both share the waiter queue
of sceKernelSyncOnAddressWait, so sceKernelSyncOnAddressWake releases
waiters of every size on the address. A null address, or one not
aligned to the value size, throws. The by-value comparand, the return
values and the 8-byte alignment of Wait64 are assumed and recorded in
TechnicalDebt.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Titles import sceHttpParseStatusLine from libSceHttp to read the
status line of a response; without the export they fail at startup.
Parse the HTTP/x.y version, the three-digit code and the reason phrase
up to the line feed, and return the library's PARSE_HTTP error codes.
The seven-argument signature is the one SharpProspero declares; the
behaviour follows the shadPS4 reimplementation of the PS4 library,
except that no byte past lineLen is read. A consumed count above
INT32_MAX cannot be returned and throws. guest_http covers valid lines
and each error path.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Windows the guest arena ended at 0x72_0000_0000: #231 kept its
448 GiB size after #153 had moved its start down to 0x2_0000_0000.
Titles map fixed addresses up to the application map area end,
0xFC_0000_0000 (SCE_KERNEL_APP_MAP_AREA_END_ADDR on the PS4), and a
direct memory mapping above the old end threw "shared mapping outside
the guest arena".
The arena is now reserved up to 0xFC_0000_0000. The out-of-arena
errors name the address and length, and a fixed mapping over a used
arena range says whether it hit a host region. guest_memory maps
direct memory at the last two pages below the end, reads it through
an alias and checks that a mapping at the end is refused.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA26344 calls sceAudioOut2Set3DLatency(0xFF, 2) right after
sceAudioOut2Initialize and fails its audio initialization on a negative
return; the export was missing, so the import did not resolve. Its
audio subsystem setup also calls sceAudioOut2MasteringInit(0), which
threw.
sceAudioOut2Set3DLatency accepts a latency of 2 for the system user
(0xFF) and throws for any other user or latency, as the unit and range
are unknown. sceAudioOut2MasteringInit accepts flags 0 and throws for
other flags. There is no 3D rendering or mastering stage, so neither
call changes the output; TechnicalDebt lists this under Functional and
the assumed signatures under Unknown function info.
The new audio_out2_latency test covers the accepted and thrown values.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
WRITE_DATA's control dword carries a two-bit cache policy in bits
26:25 (LRU, stream, no-allocate, bypass). Validate refused it, so a
submission with a WRITE_DATA built with a non-zero policy was rejected
as a whole.
The policy only steers how the GPU L2 keeps the written lines; the
stored words are the same, and Execute already writes them to guest
memory in queue order. The mask now accepts bits 26:25, as was done
for DMA_DATA's cache policy hints. The CE engine and the remaining
reserved bits still throw, and the message no longer names the cache.
agc_driver_pm4 stores both dwords of a WRITE_DATA with control
0x04100200 and checks that reserved bit 27 is still refused.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Validate refused every COND_EXEC, so a submission that uses one was
rejected as a whole. The packet now reads the dword at its address once
the earlier packets of its queue and their GPU writes have completed,
and skips the exec_count dwords after it when the dword is zero.
The command copy that inlines INDIRECT_BUFFERs records where each range
ends, so a range over an INDIRECT_BUFFER skips the whole buffer.
Unaligned addresses, address bits 48 and up, and reserved control and
count bits throw; the cache policy is accepted on compute queues only,
as the MEC defines it. A flip inside a range, a range that ends inside
a packet or past its command buffer, and a chained INDIRECT_BUFFER or
REWIND inside a range throw.
agc_driver_pm4 and agc_driver_flip cover the skips and the rejections.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA26344 imports libSceAgc NID dbOlWdppb4o, whose name is unknown,
and calls it with the (regs, gs, ps) arguments of
sceAgcCreateInterpolantMapping to fill the 32 SPI_PS_INPUT_CNTL
registers. It is exported as sceAgcUnknownCreateInterpolantMapping.
It differs from sceAgcCreateInterpolantMapping only for inputs that
carry the high f16 half alone (is_f16 2): these take the default bit
and DEFAULT_VAL from the high half, as KytyPS5 does.
Both exports share validation and the register loop. More than 32
pixel shader inputs now throw; before, they were written past the
32-register block. agc_interpolant_mapping covers both exports.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The resource materializer refused every atomic image descriptor whose
format was not 32_UINT. RDNA2 image atomics act on the raw dword and
the numeric format only affects addressing, so 32_SINT and 32_FLOAT
surfaces are now accepted with the Uint numeric class and run through
the existing integer atomics and float compare-exchange loops. Other
formats still throw, and the message now names the format.
DescriptorBinding gains imageAtomic, carried through the shader disk
cache (format version 4) and the resource content key. The driver
binds those elements through a cached R32_UINT view of R32_SINT and
R32_SFLOAT storage images.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
