v_floor_f64, v_ceil_f64, v_fract_f64, v_frexp_mant_f64 and
v_frexp_exp_i32_f64 ignored the FLOAT_MODE f16/f64 denormal field. On
RDNA2 (gfx1031) bit 6 clear flushes a denormal input to a zero of its
sign, so v_ceil_f64 of 2^-1074 is 0 instead of 1, and bit 7 clear
flushes the denormal result v_fract_f64 gives for a positive denormal.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Review of the benchmark report:
- The file is written to `<name>.tmp` and moved over the previous one, so a
crash or kill during a rewrite keeps the last complete report.
- A dedicated writer keeps only the newest pending snapshot, so two reports
can no longer be joined into one file when the writer falls behind.
- The report is formatted on the writer thread. The presenter hands over the
kept intervals, which are shared and never copied, so the interval that
closes no longer pays for formatting every earlier one.
- Hosts that are not x86 or report no CPU brand string leave the host fields
out instead of failing every summary line.
- A `contentVersion` that is not a string, or does not fit, is left empty
instead of failing the title's metadata.
- Tests cover the 240-interval rotation and `intervals_dropped`, the
newest-only writer, the pending write on stop and the atomic replace.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libSceNetCtl exports sceNetCtlGetStateV6, sceNetCtlRegisterCallbackV6
and sceNetCtlUnregisterCallbackV6 but not sceNetCtlGetInfoV6 (NID
Jy1EO5GdlcM). Dragon Ball Xenoverse 2 (PPSA08587) imports it, and an
import that no system library exports stops a title before its entry
point: on Linux ld.so refuses the relinked executable with "undefined
symbol: Jy1EO5GdlcM", and on Windows the entry stub prints "FAIL:
unresolved ELF import Jy1EO5GdlcM from libSceNetCtl.prx" and raises
0xC0000139. The title's tester reports that it does not call the
function before its loading screen.
It is a Sony network-control call with no FreeBSD counterpart, and
neither its parameters nor the IPv6 info layout are known, so it is
declared without parameters and throws through
NotImplemented_nid_no_patch, as CONTRIBUTING.md asks of exports that
cannot be implemented. The gap is recorded in
docs/dev/debt/libSceNetCtl.md.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A one-sample depth target under a multisampled rasterizer without
MSAA_ENABLE is drawn as a one-sample draw at the pixel center, but a pixel
program that runs with PS_ITER_SAMPLE threw. Ghost of Tsushima (PPSA02225)
draws its depth-only pass this way (2x PA_SC_AA_CONFIG, PA_SC_MODE_CNTL_1
0x06030000, KILL_ENABLE, no sample index or coverage input) and stops on it.
Every sample is taken to be at the pixel center on this path, so
invocations per sample would get the same inputs and give the same depth,
kill and color results, and the target keeps sample 0's. Such a program is
now drawn once per pixel, without sample shading. ANCILLARY and
SAMPLE_COVERAGE inputs still throw. The debt entry notes that only the
memory writes of such a program can differ.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
RTP_LOOKUP threw for every thread made with the sce attributes, which
allow only SCHED_FIFO and SCHED_RR, since the rtprio mapping was
unmeasured. In a payload process on a PS5 (firmware 12.70) the lookup
reports type 10 for SCHED_FIFO and 2 for SCHED_RR with prio equal to the
scheduling priority, for the calling thread and for another live thread
by its id; an unknown id fails with ESRCH, and so did function 2. Report
that, and keep RTP_SET throwing for real-time and other threads, where no
accepted value was measured.
Copy the guest TZ under the guest environment lock so a concurrent setenv
cannot free it while it is read, and hold one lock across the zone switch
and the conversion so the fields of two zones are never mixed. Document the
host rejection, Windows zone name and stale tm_zone limits.
Guest setenv, putenv and unsetenv only change the guest environment, while
the time conversions read the host TZ, so a guest that set TZ and called
tzset still got host local time. Copy a changed guest TZ to the host before
each local conversion and call tzset again.
Monster Hunter Wilds imports sceVoicePausePort, sceVoiceResumePort and
sceImeSetConsecutiveClauseConversionEnabled, which no library exported,
so the loader stopped at the first of them.
sceVoicePausePort and sceVoiceResumePort check the library and the port
like sceVoiceResetPort. sceImeSetConsecutiveClauseConversionEnabled has
no public reference and throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A pipelined draw read its index buffer from guest memory at commit time,
after the packets behind it had run, so a later dispatch's deferred
storage-image write-back could land in the bytes first. Stellar Blade
recycles its full-screen quad's index buffer for a 66x66 image when the
menu loads, and aborted with "vertex fetch exceeds descriptor record count".
Deferred write-backs now wait while a queued draw still holds a read of the
range. APS5_NO_QUEUED_DRAW_READ_ORDER=1 restores the old order; [draw]
reports held read ranges and stores.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
With DB_SHADER_CONTROL.STENCIL_OP_VAL_EXPORT_ENABLE the pixel shader
supplies the value that REPLACE_OP and the add and subtract operations
use in place of DB_STENCILREFMASK.STENCILOPVAL. The bit was refused as a
whole, which stopped Onimusha: Way of the Sword (PPSA27836) at a
DB_SHADER_CONTROL 0x45 draw with DB_STENCIL_CONTROL 0x40040 (REPLACE_OP
on depth pass, both faces), write mask 0xff and compare ALWAYS.
The export is accepted with the 32_GR and 32_ABGR Z formats. When no
reachable operation through a non-zero write mask reads the value, it
cannot change the result and is ignored. Without a test value export, a
reachable REPLACE_OP becomes REPLACE with the exported value as
FragStencilRefEXT (or the bounded replay on devices without the
extension), provided both faces compare without the test value and use
no ONES or REPLACE_TEST; early tests throw. The add and subtract
operations, and REPLACE_OP with a test value export, still throw.
The value is read from bits 8-15 of the second MRTZ channel: the
title's pixel shader shifts it left by 8 right before exp mrtz
(v_lshlrev_b32 v0, 8, v0). That is the only evidence for the layout and
it is listed as technical debt. The pixel stage info carries the new
flag into the cache key, the draw keys and request serialization
version 31.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceUserServiceInitialize reads the thread priority from the first int
of its parameters, and sceUserServiceInitialize2 takes it as its
argument. A PS5 returns 0x80960005 for a priority outside 0x100 to
0x2FF, and 0x80960003 when Initialize2 is called on an initialized
service, where this returned success.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Following the PS5 3.20 module as read by prosper:
- a second sceGameUpdateInitialize returns 0x80412802, and
sceGameUpdateTerminate without initialization returns 0x80412801;
- sceGameUpdateCreateRequest returns 0x80412801 before initialization;
- sceGameUpdateCheck checks the id, the pointers, the 0x30 sizes and
the zero option and reserved words before initialization;
- sceGameUpdateAbortRequest and sceGameUpdateDeleteRequest return
0x80412805 for an id that was never created instead of success;
- sceGameUpdateGetAddcontLatestVersion checks its pointers before
initialization.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PS5 module checks max_image_width - 1 > 999999 in
scePngDecQueryMemorySize and scePngDecCreate and returns
0x80690003 (INVALID_PARAM). This returned 0x80690002 (INVALID_SIZE)
and accepted a width of 1000001.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Operation 1 threw as unverified, so a title whose call_once path reaches it
stopped. In a payload process on a PS5 (firmware 12.70) operations 0 and 1
fail with EOPNOTSUPP and leave the word unchanged for every word tried,
as FreeBSD 11's __umtx_op_unimpl does. Answer operation 1 like operation 0.
A PS5 (firmware 13.60) reports CPU write 0x2 with CPU read 0x1, 0x80 with 0x40 and 0x200 with 0x100 after a map, sceKernelMprotect, sceKernelMtypeprotect or POSIX mprotect; GPU write 0x20 keeps GPU read 0x10 clear. sceKernelVirtualQuery and sceKernelQueryMemoryProtection now report the protection that way.
NVIDIA's Windows driver reads a host import of guest memory far slower than a buffer it allocated.
Since draw vertex and index ranges are bound in place from host imports (#2253, measured on Linux), Astro
Bot's Crash Site on Windows 11 with an RTX 5070 Ti spends 164 ms of every frame in draws on the GPU, and
45 ms with the ranges copied as before; with the same build, 4.71 fps in place against 7.52 copied. An
RTX 3060 shows the same (draws 32.3 against 24.3 ms per frame), while AMD's Windows driver reads them in
place about as fast as a copy (RX 9070 XT: 69.8 against 73.1 ms), so copying there only costs CPU.
The device decides once (DrawInputsInPlaceUsable, Context::drawInputsInPlace): ranges are copied with
VK_DRIVER_ID_NVIDIA_PROPRIETARY on Windows and bound in place everywhere else. APS5_DRAW_INPUTS_IN_PLACE=1
binds them in place and APS5_NO_DRAW_INPUTS_IN_PLACE=1 copies them on any device, the second winning.
agc_draw_inputs_in_place_driver checks the decision per driver and host; agc_draw_inputs_copied checks
that an aligned imported range is copied and its read not noted when the context copies, whatever the
inherited environment.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GN8FJFTedayRXLHythXkZ4
Adrià