The start-up f32 denormal flush probe already stays out of the pipeline
counters and the pipeline journal, but APS5_DUMP_COMPUTE_PIPELINES still
captured its pipelines. On a device that runs the probe, every capture
directory gained twelve driver-internal records that count toward the
128-record limit, and agc_compute_pipeline_capture_run found 14 captures
for a fixture with two programs.
A relocation or lea target outside the unwind functions of a PS4 image
is now decoded up to its first jump, return or trap, or to the start of
the next unwind function, which also bounds the transfer check of the
tail rule. A target whose run holds an fs:[disp32] access, the form the
linear TLS sweep roots, is followed as code. The other targets taken as
data are counted in one message and kept as entry points that the
Windows TLS rewrite may not overwrite. The analysis merges nested
unwind ranges like the scans.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The skip of syscall patterns outside the unwind functions let some real
syscalls through. The scan now merges nested and overlapping unwind
ranges with the instruction scanner's MergeCodeRanges, so a pattern
inside an outer function is refused. A constant syscall number is also
looked for in the bytes in front of the pattern, whatever alignment the
decoding took: a mov eax, mov rax or xor eax, eax that ends at the
pattern or before register moves and zeroings that leave rax alone. The
decoded lookback requires each instruction to end where the next one
starts. Guest modules without PT_SCE_DYNLIBDATA get no unwind ranges,
so their scan stays strict even when their unwind table is read.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rack locks and renders were tracked per system, so a voice callback
that locked a rack of another system could deadlock with that system's
render, or with a thread holding rack locks in both systems. Rack locks
and renders now exclude each other across threads and systems, as the
single internal lock did, while a thread nests them and other calls go
ahead.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Add the unversioned sceAgcCreateInterpolantMapping and
sceAgcUpdateInterpolantMapping and stop sceAgcUpdateInterpolantMapping_10000
throwing for split f16 defaults, all matching libSceAgc bit for bit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
The code analysis of the Windows and macOS outputs followed every
relocation and lea target inside the code range as code. PS4 images keep
read-only data between unwind functions, and strings and tables there
decoded into garbage, failing the conversion. Outside the unwind functions
such a target is now code only when it is 16-byte aligned, starts less
than 256 bytes after an unwind function and decodes to a jump, return or
trap; lea targets go through the same rule instead of the graph's own.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceNetCtlRegisterCallbackForNpToolkit, sceNetCtlUnregisterCallbackForNpToolkit
and sceNetCtlCheckCallbackForNpToolkit keep their own table of eight
callbacks next to the IPv4 and IPv6 ones and share the existing register,
unregister and event delivery, which sceNetCtlCheckCallback now also goes
through. sceNetCtlTerm clears the new table. The register signature and the
separate table follow shadPS4; the rest follows the IPv4 functions and is
recorded as unverified in the libSceNetCtl technical debt.
In a payload process on a PS5 (firmware 12.70), sysctlbyname returns -1
with ENOENT for thirteen names that threw here, and leaves the buffer and
the length alone, for a read, a size query, a null length and a null
buffer with a null length. sysctl does the same for the fixed MIBs of
seven of them. sysctlnametomib gives those seven MIBs and returns ENOENT
for hw.cacheline_size and hw.usermem, which threw too.
machdep.cacheline_size already returned ENOENT and is now tested with
the others. A write to the new names and MIBs throws, as the console's
answer to a write was not tried. The hw.realmem and vm.overcommit debt
entries now say that a payload process gets ENOENT for them as well.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
kevent threw for EVFILT_WRITE on any descriptor that is not a socket. On the write end of a pipe it now follows FreeBSD 11's filt_pipewrite: data is the free buffer space, and once the read end is closed the event reports EV_EOF with data 0. Adding the event after the read end is closed fails with EPIPE, as in pipe_kqfilter. EVFILT_WRITE on the read end still throws, because FreeBSD's pipe ends are bidirectional and host pipes are not.
A voice callback runs with the internal lock released, so another
thread could lock the rack being rendered and the render then finished
it under that lock. sceNgs2RackLock now also waits while another thread
renders the rack's system, as it did when the rack lock was the
internal lock.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
StorageTextureBudget reserved the larger of the sampled textures alive
and their 2 GiB floor. The sampled budget already reserves
TextureCacheBudget, at least the storage cap, for the storage cache, so
on an 8 GB card the two caches each kept the other's maximum: with
3936 MiB used outside the caches on a 7189 MiB budget and 49 MiB of
sampled textures, the storage budget came out at 306 MiB and sat at its
512 MiB floor while about 2.7 GB of the budget stayed free.
The storage budget now reserves the sampled textures alive and gives
room back as they grow, at its next read. Where they hold 2 GiB or more
the budget is unchanged.
On Windows, sceKernelPwrite, pwrite, sceKernelPwritev, pwritev and the AIO
write commands wrote at the given offset on a descriptor opened with
O_APPEND. FreeBSD's vn_write sets IO_APPEND for an O_APPEND regular file
whether or not an offset is given, the filesystem then writes at the end of
the file, and the file offset is left unchanged. Write at Windows'
end-of-file offset in that case, and gather a multi-buffer pwritev into one
write as writev already does.