sceKernelGetSystemExVersion, sysKernelGetLowerLimitSysexVersion,
sysKernelGetLowerLimitUpdVersion and sceKernelGetTraceMemoryStats were
NotImplemented stubs in libkernel_sys. libkernel, libkernel_sys and
libkernel_web of firmware 13.42 answer them without asking the kernel:
empty strings, a zero version and zero statistics, with the null checks
and return codes the firmware uses, including the plain 22 of
sceKernelGetSystemExVersion.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
AppMetadata throws length_error for a title or title ID that does not fit its
buffer, which the title ID lookup did not catch, so a homebrew title with a long
ID made sceConvertKeycodeGetImeKeyboardType throw instead of using the PS5
fallback. Catch it with the other metadata failures and cover oversized,
malformed and missing metadata at the export. sceUserServiceGetKeyboardType also
gets a test that a malformed ANYPS5_LANGUAGE is rejected with the output left
untouched, and the debt entries say so.
A linear color target got a resident image only when its memory already
had a host import (#6892). Every other draw into it was synchronous:
copied in, drawn, waited for on the CPU and copied back. #6892 only
looked the import up because a first version that made it broke
agc_driver_pixel_ancillary_word and agc_driver_pixel_fixed_point_position:
the import over a short-lived block was compared, and the next block
allocated at the same address stayed outside the write watch. A page
committed again inside an excluded block is watched again since #6759.
On a lookup miss the draw now makes the import itself, with the new
ColorTarget requester, when its registered ranges are writable, the
whole import run is write-watched and the import keeps it watched: a
separate alias of shared memory, a direct import of private memory that
settles on Windows (1 MiB or more, when the import probe keeps the
watch and a settle queue exists), or an import the probe keeps watched
on other systems, where a dma-buf import must stay watched too if the
range has shared backing. Private pages that the write watch armed
read-only count as writable when their guest protection is, because the
import opens them (a resident direct-memory run the CPU has not stored
to since its last collect). The gate's scan stops at the first page
that decides a refusal, and a run of private memory whose direct import
would be compared is refused after one page query. A refusal is
remembered for its run until the registry, the committed pages
(Windows) or the write watch change, or a shared alias is mapped over
the run, so a target that stays synchronous costs a lookup per draw.
importRunAt checks this after its remembered failures and refusals and
before it retires or evicts anything, through the helpers its own
decision now uses: importWatching (settled, watched host-pointer and
dma-buf imports) and importPages (the Windows page scan). A target whose
import would be compared stays synchronous, because a compared import
makes every refresh of the resident image compare the whole target. A
target over an import that already exists is resident as before, with
ExistingHostImportFor as the fast path, and APS5_NO_RESIDENT_LINEAR=1
still keeps every linear target synchronous.
This is the case draft #1191 (MichonGoddijn231849) was to bring back
on top of #6892 once partial-block write-watch coverage existed.
agc_driver_linear_target_import_creation covers a target in freshly
registered, write-watched memory (the draw is recorded, the target is
imported and stays watched), a block freed and allocated again at the
same address (it is watched, and the next draw starts from the CPU's
bytes), a resident direct-memory run armed read-only by the write watch
(the draw is recorded and the target imported; Windows), the gate over
armed and read-only private memory (a compared import of an armed run is
refused without opening it, memory committed read-only behind a writable
registry range is refused without a count, an armed run is imported
where imports stay watched; Windows), a 64 KiB block whose import would
be compared (no import, a synchronous draw, the block stays watched), a
1 MiB block the guest registered read-only (no import, a synchronous
draw), a 1 MiB run with one 64 KiB block outside the write watch
(refused, the target stays watched), and the same run once that block is
committed again (the refused run is imported; Windows).
On other systems the test forces ImportWatch::Watch, so the watched
cases also run where imports are compared (lavapipe in CI). The import
requester tests count the new requester and check that it makes no
compared import, no import of a range the guest cannot write and no
import of memory outside the write watch.
Co-Authored-By: Claude <[email protected]>
A drawn target kept the bounding box of its draws' scissors, so a store
at a completion point also wrote the pixels between two disjoint
scissors, over CPU stores made there after the draws.
- The target keeps the clipped scissor rectangles. Two merge only when
their union is a rectangle: one inside the other, or the same columns
overlapping or touching in rows, or the same rows overlapping or
touching in columns.
- The store still copies the rectangles' bounding box out of the image,
but writes to guest memory, for each row, only the union of the
column runs of the rectangles that cover that row.
- At most 16 rectangles wait for a completion point: the draw that
brings a 17th stores the target right after it, with all of them.
- A target the rectangle store does not cover (attachment proxy, several
mips or layers, 3D or DCC surface, results of a dispatch, fill or
copy) is stored after each draw again, instead of whole at the next
completion point.
- LinearTargetRectangleBound draws and waits once before its draws, so
the target's upload runs before the CPU stores instead of in the same
batch, adds CPU stores between the two scissors, and adds a case with
17 one-row scissors and a CPU store between two of them.
Co-Authored-By: Claude <[email protected]>
- MarkDrawn registers the scissor while any layer is pending instead of
while the image is dirty. A flush on another thread can take the image
out of the pending set between MarkSliceDirty and the registration;
layerPending changes only under the GPU lock, so the flusher, which
reads the drawn area after taking that lock, stores the widened area.
- AccessKeptByCpu no longer skips or evicts a drawn target. Its store
writes CPU-stamped blocks inside the drawn rectangle, so the hook's
CPU-kept rule would drop the draw's results.
- A drawn target that is stored whole keeps main's rule that CPU-written
64 KiB blocks stay the CPU's.
- A linear target that is no longer cached is stored after its draw, as
before: the pending registry holds raw pointers.
- LinearTargetCompletionPoints skips without host import, where the
target is never resident. LinearTargetCpuWrites adds a driver read of
the target between the CPU stores and the store.
Co-Authored-By: Claude <[email protected]>
- A flush from a thread without the GPU lock takes the lock before it takes a drawn target out of the pending set, so a flip, label or interrupt on the queue worker cannot run between the two and get ahead of the target's store.
- A label written on the GPU stores the drawn targets first and submits that store with the label, so the label's end-of-pipe interrupt is not held back to a later submission.
- The pending-writer check skips the target's own earlier stores only when the flush stores that target alone.
Co-Authored-By: Claude <[email protected]>
A type 0 signal read the semaphore, added one and wrote it back, so an
increment made by a CPU thread or another queue in between was lost.
Signals now store or add with atomic operations and a wait takes one
with a compare-exchange. The new test races two queues and a CPU thread
incrementing the same word.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Santhosh Kumar