StencilReplaySafe refused every program with usesDma, including pixel
shaders whose only BDA accesses are reads (Onimusha: Way of the Sword,
PPSA27836: one global load, then image and buffer reads). Replaying such
a shader per reference value is idempotent: its only side effect is the
first-fault record, a compare-exchange that keeps the first fault; a
fault is never retried but thrown by CheckFault, and replayed draws with
a BDA table already wait and check faults before publishing. Written-page
tracking exists only in programs with bdaWrites, which stay refused.
Compiled shaders now carry bdaWrites, and ShadersWriteMemory counts a BDA
page table as a memory write only for a program that writes through it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The firmware's shared system option validator checks the size and the
fields from +0x6c on, not flags at +0x68. Rise of the Ronin (PPSA04540)
creates its system with flags 2, which threw. Accept and ignore bit 1;
every other bit still throws, now naming the value.
sceAgcSetAmmSemaphoreMemory and sceAgcGetSemaphoreLabel return the
firmware's errors instead of throwing, registration clears the whole
memory, and sceAgcSetSemaphoreMemory shares the registration with its
1 GiB size limit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
Host logging opens its own FILE on the saved descriptor. The guest FILE stays on the replaced descriptor, so guest printf, puts and fprintf still reach the pipe.
sceAgcAcbSetWorkloadsActive, sceAgcAcbSetWorkloadComplete and
sceAgcAcbSetWorkloadStreamInactive build the same packets as the DCB calls,
and sceAgcDcbSetWorkloadStreamInactive writes a 9-dword IT_NOP with the
stream id, the size of the console's user-data packet. The debt entry now
records the console layout read from libSceAgcDriver.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
Follow FreeBSD 11's do_sem_wait and do_sem_wake (COMPAT_FREEBSD9/10) on
a struct _usem: a wait sets _has_waiters, returns at once while _count
is non-zero and otherwise sleeps on the semaphore's queue; a wake clears
_has_waiters when one waiter is left and releases one waiter.
Co-Authored-By: Claude Haiku 5.5 <[email protected]>
On RDNA 2, an S# with TRUNC_COORD 0 rounds the scaled coordinate to 8
fractional bits, ties to even, and one with TRUNC_COORD 1 truncates it,
for point and bilinear filters. The S# decoder ignores the bit, and
AMD's Windows driver truncates for nearest samplers and rounds for
linear ones, so a TRUNC_COORD 0 point sample just below a texel edge
reads the texel below it. The code comment said the bit moves texel
selection by half a texel at most; the debt entry records the measured
rule instead.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Capture evaluated every flattened scalar slot even when a clean scalar
branch skipped it, so an inaccessible direct user-data root refused the
draw. Record flat-slot uses on resource control-flow blocks and evaluate
only the reachable ones; keep refusing taken and unresolved paths.
Fixes#8272.
Implement sceRudpPollCreate, sceRudpPollControl, sceRudpPollWait and
sceRudpPollDestroy with the PS Vita signatures and argument checks.
sceRudpTerminate removes the context from every poll and sceRudpEnd
destroys the polls and wakes their waiters.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Federico Marras