A multisampled DCC color target imports its uniform DCC fast clear on
first use and then refuses any later change to its color, DCC or CMASK
memory. Titles built on the PS5 Mesa stack fast-clear such a target
every frame with two buffer fills, the CMASK to 0xcc (FMASK cleared,
color expanded) and the DCC to a uniform clear key, so the second
frame stopped on "writes to a resident multisampled DCC target or its
metadata are not implemented".
The fills of a resident DCC target's metadata are now noted. When a
fill covered the whole DCC range since the last use and the range holds
its key once pending writes land (LandedUniformMetadataByte, which
reads the bytes directly rather than through the resident read guard),
the next use clears every sample to that key's color, as the import
does, and takes the new DCC and CMASK generations. A CMASK written
since must have been filled whole too. Partial fills, other keys,
CMASK-only writes and any write to the color memory are still refused.
Fills of a DCC target's CMASK no longer go to the CMASK-only fast-clear
tracker, which refused the expanded code 0xcc.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
An indirect draw drained queue 0's draw pipeline on entry and recorded every
record on the worker, so titles that draw mostly through DRAW_INDIRECT,
DRAW_INDEX_INDIRECT and DRAW_INDEX_INDIRECT_MULTI got no overlap between the
worker's capture of one draw and the committer's recording of the previous.
The draw now drains only when its records or its count overlap a write still
queued on the pipeline. Records drawn inline drain first, so they stay in
order, and the last drawn record is queued like a direct draw, carrying its
write ranges. APS5_NO_PIPELINED_INDIRECT=1 restores the drain on every
indirect draw.
agc_driver_pipelined_indirect_draw holds the committer with a blocking item and
checks that two indirect draws queue behind it and draw what a direct draw
does, and that a draw whose record a queued label writes waits for it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The saver thread took the snapshot lock with a blocking exclusive lock. Behind
a pipeline creation that runs for minutes (an NVIDIA compile of a 1.5M-word
compute pipeline), the queued writer made the shared_mutex hold every later
pipeline creation on every queue until the compile ended. The periodic save now
tries the lock and waits for the next interval when it is busy; SaveNow and the
teardown save still wait.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA26578 (issue #7624) imports _ZSt26_Throw_bad_optional_accessv (NID
KwzEip7m6TM) from libc, and its bundled libc.prx does not export it,
causing the process to exit with 0xC0000139 (GetLastError: 127).
Implement std::bad_optional_access type record and vtable deriving from
std::exception, thrown through ThrowPlain, with what() returning
"bad_optional_access", and add unit test coverage in ExceptionRuntime.
v_add_f64 and v_mul_f64 ignored the FLOAT_MODE f16/f64 denormal field.
On RDNA2 (gfx1031) bit 6 clear flushes both inputs to a zero of their
sign, and bit 7 clear flushes a sum below 2^-1022 and a product whose
exact value rounded to 53 significant bits with an unbounded exponent
is below 2^-1022. The product test scales one source by 2^64 and
compares the host product with 2^-958.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In a payload process on a PS5 (firmware 12.70),
sysctlbyname("kern.rng_pseudo") answers a size query with 64 and gives
at most 64 bytes per call, up to a 65536-byte buffer. A buffer smaller
than 64 bytes gets as many bytes as its length and a null length gets
none, both with -1 and ENOMEM; a null buffer with a null length returns
0, and errno is kept when the call succeeds. Here the whole buffer was
filled, a size query threw and the length was never changed. The 64
random bytes are now drawn only for a read that passes both a buffer
and a length.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
v_floor_f64, v_ceil_f64, v_fract_f64, v_frexp_mant_f64 and
v_frexp_exp_i32_f64 ignored the FLOAT_MODE f16/f64 denormal field. On
RDNA2 (gfx1031) bit 6 clear flushes a denormal input to a zero of its
sign, so v_ceil_f64 of 2^-1074 is 0 instead of 1, and bit 7 clear
flushes the denormal result v_fract_f64 gives for a positive denormal.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Windows crash report walks every other thread's rbp chain only, so
a thread waiting inside ntdll or in code built without frame pointers
showed no frames at all. For a thread whose chain yields fewer than two
frames, scan the 32 KiB above its rsp while it is suspended and print
up to 24 words that point at executable memory.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T86KdkUbEv7m5hrCbPbkAp
Review of the benchmark report:
- The file is written to `<name>.tmp` and moved over the previous one, so a
crash or kill during a rewrite keeps the last complete report.
- A dedicated writer keeps only the newest pending snapshot, so two reports
can no longer be joined into one file when the writer falls behind.
- The report is formatted on the writer thread. The presenter hands over the
kept intervals, which are shared and never copied, so the interval that
closes no longer pays for formatting every earlier one.
- Hosts that are not x86 or report no CPU brand string leave the host fields
out instead of failing every summary line.
- A `contentVersion` that is not a string, or does not fit, is left empty
instead of failing the title's metadata.
- Tests cover the 240-interval rotation and `intervals_dropped`, the
newest-only writer, the pending write on stop and the atomic replace.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
libSceNetCtl exports sceNetCtlGetStateV6, sceNetCtlRegisterCallbackV6
and sceNetCtlUnregisterCallbackV6 but not sceNetCtlGetInfoV6 (NID
Jy1EO5GdlcM). Dragon Ball Xenoverse 2 (PPSA08587) imports it, and an
import that no system library exports stops a title before its entry
point: on Linux ld.so refuses the relinked executable with "undefined
symbol: Jy1EO5GdlcM", and on Windows the entry stub prints "FAIL:
unresolved ELF import Jy1EO5GdlcM from libSceNetCtl.prx" and raises
0xC0000139. The title's tester reports that it does not call the
function before its loading screen.
It is a Sony network-control call with no FreeBSD counterpart, and
neither its parameters nor the IPv6 info layout are known, so it is
declared without parameters and throws through
NotImplemented_nid_no_patch, as CONTRIBUTING.md asks of exports that
cannot be implemented. The gap is recorded in
docs/dev/debt/libSceNetCtl.md.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A one-sample depth target under a multisampled rasterizer without
MSAA_ENABLE is drawn as a one-sample draw at the pixel center, but a pixel
program that runs with PS_ITER_SAMPLE threw. Ghost of Tsushima (PPSA02225)
draws its depth-only pass this way (2x PA_SC_AA_CONFIG, PA_SC_MODE_CNTL_1
0x06030000, KILL_ENABLE, no sample index or coverage input) and stops on it.
Every sample is taken to be at the pixel center on this path, so
invocations per sample would get the same inputs and give the same depth,
kill and color results, and the target keeps sample 0's. Such a program is
now drawn once per pixel, without sample shading. ANCILLARY and
SAMPLE_COVERAGE inputs still throw. The debt entry notes that only the
memory writes of such a program can differ.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
RTP_LOOKUP threw for every thread made with the sce attributes, which
allow only SCHED_FIFO and SCHED_RR, since the rtprio mapping was
unmeasured. In a payload process on a PS5 (firmware 12.70) the lookup
reports type 10 for SCHED_FIFO and 2 for SCHED_RR with prio equal to the
scheduling priority, for the calling thread and for another live thread
by its id; an unknown id fails with ESRCH, and so did function 2. Report
that, and keep RTP_SET throwing for real-time and other threads, where no
accepted value was measured.
Copy the guest TZ under the guest environment lock so a concurrent setenv
cannot free it while it is read, and hold one lock across the zone switch
and the conversion so the fields of two zones are never mixed. Document the
host rejection, Windows zone name and stale tm_zone limits.
Guest setenv, putenv and unsetenv only change the guest environment, while
the time conversions read the host TZ, so a guest that set TZ and called
tzset still got host local time. Copy a changed guest TZ to the host before
each local conversion and call tzset again.
Monster Hunter Wilds imports sceVoicePausePort, sceVoiceResumePort and
sceImeSetConsecutiveClauseConversionEnabled, which no library exported,
so the loader stopped at the first of them.
sceVoicePausePort and sceVoiceResumePort check the library and the port
like sceVoiceResetPort. sceImeSetConsecutiveClauseConversionEnabled has
no public reference and throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
