The Smurfs - Dreams (PPSA21607) reads a 1x1 RGBA16F R64KBX storage image
on the CPU after a label. The label-time store took only linear images, so
the image stayed pending and the sky light read 0. Tiled images up to
SmallStoreBytes are stored before the label as well.
Reported and tested by Pacuka.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Over budget but within a quarter over it, the sampled texture cache refused no use of a texture it does not hold, so a cyclic scan over a working set larger than the budget rotated the whole cache and hit almost never. The first use of a key in a present is now refused (used for its draw, never cached) when the least recently used entry was used in this or the previous present. A later use of the key is refused only when that entry was used in this present, so a texture used several times per present is still admitted on a later use. The refusal does not apply past the quarter-over ceiling, so a budget that falls still evicts.
The test lowers the budget through OverrideCacheBudgetForTest instead of the environment. The debt entry records the unmeasured present window, that a texture used more than once still rotates the cache, and the one A-B-A measurement.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
When the list read at submission is invalid, the worker now always
executes the copy read again where the packet runs. With
APS5_SKIP_INVALID_INDIRECT_REGISTERS=1 only that copy's invalid entries
are skipped, so the valid entries of a partly updated list are written
instead of the stale ones from submission.
testPartlyUpdatedRegisterListSkipsOnlyItsInvalidEntries submits a list
that is invalid at submission, updates it to a valid entry plus an
invalid one before its packet runs, and reads the register back with
COPY_DATA.
SET_*_REG_INDIRECT lists are read when the command buffer is submitted.
When that copy holds an offset dword that is no register offset, the
queue worker now reads the list again where the packet executes (as the
console PFP does) and uses that copy if it is valid.
PPSA23566 (UFC 6) intermittently submits a SET_CONTEXT_REG_INDIRECT
whose first entry is 0x038f038f or 0x03900390 in both copies, followed by
180 valid pairs, and the title stopped with "extended register semantics
are not implemented". With APS5_SKIP_INVALID_INDIRECT_REGISTERS=1 the
invalid entries are skipped and the other registers are written; without
it the packet throws as before.
sceNgs2ReportRegisterHandler and sceNgs2ReportUnregisterHandler stop
being throwing stubs: they keep a registry of report handlers, so a
title that imports them can register and later drop its handler.
Register rejects a null handler with an invalid argument and returns
INVALID_OUT_ADDRESS for a null out handle, then stores the report
type, handler and user data under a freshly allocated opaque handle.
Unregister removes and frees the matching record and throws for a
handle that is not registered.
The signatures follow SharpProspero and shadPS4's ngs2_report.h, and
the 24-byte Ngs2ReportDataHeader passed to a handler is its
OrbisNgs2ReportDataHeader. No report is produced yet, so no registered
handler is ever invoked.
daily_commits grouped commits by %cs, the committer date in the
committer's own offset. With merges from +13:00 and +02:00 interleaved
on main, the newest commit labelled with the later date can be older
than the newest commit labelled with the earlier one, so the chart
ended on an older tree and showed a drop that did not happen.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GetModuleHandleExW and GetModuleFileNameW take loader locks the suspended
target may hold. While the target is suspended only VirtualQuery and a
lock-free cache of image bases are consulted; an image not yet cached is
classified after the target is resumed, and the target is sampled again.
The statics the checks use are initialized before the first suspend. The
host-code wait is recorded in the libkernel debt file, and the test raises
100 times so it fails on every run without the change.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
In a payload process on a PS5 (firmware 12.70), getrlimit returns
0x200000 for RLIMIT_STACK, infinity for RLIMIT_RSS and RLIMIT_MEMLOCK,
and 1604 for RLIMIT_NPROC, each as both soft and hard limit. These four
threw here. Whether a title process reads the same limits is not
measured.
setrlimit reads getrlimit first, so it now accepts RLIMIT_STACK,
RLIMIT_RSS and RLIMIT_MEMLOCK when the values do not change, as the
payload process does. RLIMIT_NPROC throws: in the payload process
setting it to its current value succeeds, but getrlimit then reads 1443,
and the limit is not stored here. Any other change still throws. The
getrlimit and setrlimit debt entries also record the payload process's
RLIMIT_DATA and RLIMIT_NOFILE readings, its 12555 clamp of RLIMIT_NOFILE
and its RLIMIT_NPROC reading after a same-value set.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Inside Gran Turismo 7 on a PS5 (firmware 13.40) parameters 7 (game parental level) and 1000 (enter button assignment) returned 0x80A10003 like every other unknown parameter; 1 to 5, 100 and 400 answered.
The PS5 references count save data differently from the PS4: SharpEmu
uses a 64 KiB block, and SharpEmu and KytyPS5 allow 48 to 16384 blocks
per save, which at 64 KiB a block is 3 MiB to 1 GiB, the PS4's byte
range. The module used the PS4 values, 32 KiB blocks and a 32768-block
maximum. At 64 KiB a block, sceSaveDataDirNameSearch and
sceSaveDataGetMountInfo therefore counted up to twice the blocks a
save's files use, and a save without a recorded size reported 32768
blocks, which is 2 GiB.
The search test now expects 64 KiB blocks and the 16384 maximum, and
the block accounting gets its own technical debt entry.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A pixel shader on the mesh path that reads barycentrics on a device with
neither VK_KHR_fragment_shader_barycentric nor VK_EXT_mesh_shader
reported only the missing mesh shaders. Say that the device has neither,
so reports from such devices are told apart from the case the emulation
covers.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
A pixel shader that reads barycentrics on a device without
VK_KHR_fragment_shader_barycentric used to need a vertex shader so a
generated geometry stage could follow it, which a mesh pipeline cannot
have. The mesh program is now compiled a second time with the layout
its pixel shader needs: it writes its clip position as a varying and the
three corner positions of each primitive as per-primitive outputs, and
the pixel shader solves for the weights, for both smooth and linear
interpolation.
The layout is part of the mesh cache key, the stored artifact and the
captured request. Without VK_EXT_mesh_shader the draw still throws, now
saying so. Per-vertex parameters on the mesh path still throw.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The OpenOrbis net_http sample stops on 0x5413, the Linux TIOCGWINSZ
that musl sends to standard output; the carried cases covered 0x5401
but not that word, so the test adds it to the malformed words. It also
pins the two boundary words the check takes as well-formed, 0x20046601
(IOC_VOID, length 4) and 0x80006601 (IOC_IN, length 0): on a guest
socket with a null argument they fail with EFAULT, not ENOTTY.
The debt sentence now states the open gap: an input request with
length 0 is not rejected as malformed, while sys_ioctl rejects it in a
kernel built without COMPAT_FREEBSD4, COMPAT_FREEBSD5 and COMPAT_43,
and which of these the PS5 kernel has is unknown.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD's sys_ioctl rejects a request with no direction bit, an output request with no length, or a void request whose length is not an int before it reads the argument or resolves the descriptor. ioctl threw on such a request for a file, pipe or directory, failed with EBADF for a closed descriptor and with EFAULT for a socket given no argument.
(cherry picked from commit 501518f321ac5d0b45ce1090af39c680927edf49)
(cherry picked from commit 3eb7edd9cf)
scePthreadAttrGet copied the attributes of any non-null handle, so a
thread that was joined or had finished still answered 0, and a thread
that ended detached was read after its object had been freed. FreeBSD
11.4's _pthread_attr_get_np returns ESRCH for a dead or reclaimed thread,
and Monster Hunter Wilds (PPSA24191) reuses a slot of its thread table
only when scePthreadAttrGet returns 0x80020003.
After the EINVAL checks it now returns ESRCH unless the handle is a live
guest thread, and copies the fields while holding the thread registry
lock (LockLiveGuestThread), so a detached thread exiting during the call
is not freed under the copy. GuestThreadIsLive uses the same lookup.
pthread_attr_get_np, which the title does not import, is left as it is;
the debt entry records the difference.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A search range with no free direct memory returned EAGAIN (0x80020023).
A PS5 returns ENOMEM (0x8002000c) for an occupied range, as the
PS5_RetroArch author's console capture records, and PS5_PayloadSDK's
ps5_memory_query, which RetroArch uses for its memory status, gives up
on any other error.
LargestFree now returns the error: ENOMEM when no block is found, and
EAGAIN as before for a negative start, an end at or below the start and
an alignment that overflows when rounded to a page. guest_memory expects
ENOMEM for an occupied range and EAGAIN for those arguments. The
unmeasured argument handling is recorded in the libkernel debt file.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
writeBackWindows retiles the kept 64 KiB units through the windows of the
surface's (layer, mip) slices. A unit can lie outside every window: the
tracking grid spans the whole guest range flat, while the slices of a 3D
surface taper in depth (HasLayer), so the upper depth slices' higher-level
blocks belong to no window. The empty window set then sized the retile
linear and scratch buffers at zero, and the zero-sized device buffer threw
'AGC graphics: zero-sized device buffer', aborting the process.
Keep such units as the guest left them: there is no tiled data of the
surface to retile or store. The caller alone accounts for the unit.
Dean