v_cvt_pk_u8_f32 rounds its source in the f32 round mode of FLOAT_MODE
and flushes a denormal source when f32 denormals are flushed, as
measured on RDNA2 (gfx1030). It was always rounded to nearest even, so
the three directed modes gave wrong bytes for non-integer sources.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD's socket fails with EPROTONOSUPPORT when the protocol belongs to
another socket type, such as IPPROTO_UDP for SOCK_STREAM, and
guest_sce_net expects that error from sceNetSocket. XNU fails with
EPROTOTYPE instead. sceNetSocket only passes the stream, datagram and raw
types, which XNU supports with protocol 0, so a host EPROTOTYPE there is
always a protocol of another type.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD's inet_pton refuses an IPv4 address with a component that has a
leading zero, such as "01.2.3.4", and guest_sce_net expects
sceNetInetPton to refuse it. macOS's inet_pton accepts it as 1.2.3.4, so
sceNetInetPton refuses it there before calling the host.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Windows a host import under 1 MiB leaves the write watch when it is
made, and comes back only when its deferred settle read completes.
retireImport drops the pending settle and never restores the watch, so
an import retired before it settled left its range outside the write
watch for good. Once no import fit the budget, an address-based build
could neither import such a range nor heap mirror it (CollectWrites
returned 0), and copied it.
Since aligned block imports (#6457), this happens to every 64 KiB piece
a title maps one at a time: the piece is imported by the map, and when
its neighbour is registered its run grows into a larger aligned block,
so refreshImports retires the piece's import ("the range was mapped
again", though the range is unchanged). Resident Evil Village
(PPSA01556) on main 6696def6e6 aborted in its intro at 0:43 to 6:37
with "an address-based build copies 185 MiB of 2960 registered ranges,
past 64 MiB (APS5_ADDRESS_COPY_MAX_MIB); the largest: 0x20c0c20000+
0x10000 (0.1 MiB committed, outside the write-watched arena) ...". An
import trace showed each copied page imported by the map, retired when
its run grew, and never imported or watched again.
refreshImports and the budget eviction now note the ranges of each
unwatched import they retire that are still registered as the same
range, and rewatch them once the import is gone: as a settled import
does, except where another unwatched import or a live storage texture
still covers them. Rewatch stamps the range as written, so the next
build reads it in full. Ranges the guest mapped again or released keep
the existing path.
Tested: agc_driver_graphics gains retiredImportWatchTests (Windows):
a 64 KiB piece imported on its own, then its neighbour registered and
the budget cut below one piece. The piece must be back in the write
watch and both pieces heap mirrored. Without the fix the piece stays
unwatched and is copied.
Co-authored-by: keravyn-ops <[email protected]>
A custom submixer rack now accepts the Gain module (0x15). Its voice
parameter 0x40001500 | module index sets one linear level per channel
(37 levels, default 0), and each grain multiplies the voice's samples
by a level that ramps linearly from the previous one to the new one,
following fma-rc's reading of the PS5 12.70 module (#8039). Gain on a
custom sampler rack, whose parameter index is offset, still throws, as
do levels outside -32 to 32.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Validate relocation types using validationPolicy immediately upon reading rInfo in extractRela, ensuring unsupported relocation types are rejected at their table offset before symbol table index lookups or TLS checks occur. Reject non-JUMP_SLOT relocation types in DT_JMPREL to prevent invalid PLT dispatch and downstream filter/builder errors.
Since #8162 a --module-dir module that the executable needs is deferred
on Windows: the entry stub maps it and the title starts it with
sceKernelLoadStartModule. A module the executable imports from but the
title never loads gets no module_start and no initializers, silently.
The entry stub now prints one line at startup for each deferred guest
module that an import of the executable names. Guest module bytes are
unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Write the low 32 bits of the SDK version field at offset 0x10 of the
title's process parameters and return EINVAL (0x80020016) for a null
output, following shadPS4.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WYjMwvLdPR8iX8EP8tQYWa
When the startup probe chose the hardware f32 flush, every module declared
DenormFlushToZero 32, also shaders whose FLOAT_MODE keeps f32 denormals
(f32 denormal field 1, 2 or 3), so the device flushed what they keep and
DenormPreserve 32 was never declared. The hardware flush now applies to
shaders that flush f32 denormals (field 0, or no float mode); the others
declare DenormPreserve 32 where the device supports it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Two threads writing to the same stream each ran FileStream::SyncStatus
after their stdio call, outside the FILE lock, with plain writes to the
read and write counters and a read-modify-write of the flag word, so the
flags of one thread could be lost. Publish the counters with atomic
stores and the flags with a compare-exchange loop; the values stay the
same.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Both were missing from libkernel.prx, so a title importing either
(dYv-+If2GPk, RRnSj8h8VR4) failed to load. They take a relative timeout
in microseconds and are scePthreadRwlockTimedrdlock and
scePthreadRwlockTimedwrlock with POSIX error numbers; a zero lock is
initialized as by pthread_rwlock_rdlock. The signature comes from
shadPS4, which registers one function for each NID and its
scePthreadRwlockTimed* twin; FreeBSD 11.4 has no such calls. The throwing
libkernel_sys copies are removed, as an export may live in one library
only. Recorded in the libkernel debt file.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Follow FreeBSD 11.4 sys_setresuid and sys_setresgid (sys/kern/kern_prot.c):
accept real, effective, and saved user and group IDs for the guest process,
which is assumed to run as root with IDs 0. Setting an ID to 0 or -1 (unchanged)
is accepted without changing credentials and returns 0; any other value throws.
Cover both in guest_credentials test and update libkernel debt documentation.
TakeSnapshot read the file information and then the path. A delete
between the two left a snapshot whose path was already under
\$Extend\$Deleted\ but whose link count and delete flag were not, so
IsDeleted was false and the watch thread asked for a parent watch of
\$Extend\$Deleted\. FindFirstChangeNotification refuses it with
ERROR_ACCESS_DENIED, and the exception on the detached watch thread
ended the process. guest_kqueue hit this when FileWatch removed its
file while a watch thread was still polling.
The path is now read first. A path under \$Extend\$Deleted\ is only
returned after the delete, so the information read after it reports
the delete and the parent watch is skipped.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The executable's relocation allowlist accepted R_X86_64_GOT32, PLT32,
GOTPCREL, 32S, GOTPCRELX and REX_GOTPCRELX, which the linker resolves
and glibc's ld.so does not apply. The default and --lazy-binding Linux
output copied them from DT_RELA into its dynamic relocation table, and
--linux-fixed-base did so for 32S, so the relink succeeded and ld.so
then refused to load the program ("unexpected reloc type"). They are
now rejected when the executable is validated, for every target.
tools/hw-oracle needed Linux with ROCm, so Windows measurements went
through private runners. oracle_hip.py assembles and links template.s
kernels with the driver's amd_comgr and dispatches them with its HIP
runtime, with the same rows, padding, dispatch splitting and report as
oracle.c. hw_oracle.py selects it with HW_ORACLE_RUNTIME, by default on
Windows, and loads it in-process so the DLLs are loaded once per run.
The driver's comgr 2.9 numbers its assemble and link actions 0x8 and
0x7, not 0xA and 0x9, so each step tries both and keeps the one that
returns exactly one output of the expected kind.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PS5 3.20 export inventory lists _err, _warn and _getprogname in
libSceLibcInternal next to err, warn and getprogname, with the NIDs
UhKI6z9WWuo, XQFE8Y58WZM and iI6kGxgXzcU. In FreeBSD 11.4 libc the
underscore names are the definitions and the public names are weak
references to them (lib/libc/gen/err.c, lib/libc/gen/getprogname.c),
and libthr interposes none of them, so each pair is one function.
_err and _warn now hand their arguments to verr and vwarn, which use
errno at the call as err and warn do; _getprogname returns
getprogname(). The debt file records that the console's module was not
read.
guest_err checks the _warn and _err text for errno 13 with a formatted
message, that _err passes its status to the err_set_exit hook, and that
_warn without a format returns without calling the hook.
guest_program_name checks that _getprogname returns the current
__progname pointer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PS5 libkernel exports _accept, _bind, _connect, _getdirentries,
_getpeername, _getsockname, _getsockopt, _listen, _recvfrom, _recvmsg,
_sendmsg, _sendto, _setsockopt, _sigaction and _sigsuspend (PS5 3.20
export list, DNNDHH/PS5-3.20_Libs b2a77c0 libkernel.c), and main
exports none of them, so a title importing one fails at startup. Each
now forwards to the export without the underscore, as _close, _ioctl
and _nanosleep already do.
In FreeBSD 11.4 (8c639945a4) these are libc's plain system call
entries: lib/libc/amd64/SYS.h makes bind, getdirentries, getpeername,
getsockname, getsockopt, listen and setsockopt one stub under both
names, and lib/libc/sys/Makefile.inc gives accept, connect, recvfrom,
recvmsg, sendmsg, sendto, sigaction and sigsuspend a separate public
name that goes through libthr's interposing table, which adds the
cancellation points and the sigaction wrapper. The exports without the
underscore have no libthr layer here, so forwarding gives the system
call. docs/dev/debt/libkernel.md records what stays unverified: the
console is not measured, _sigaction shares the handler table of
sigaction, and a null set throws in _sigsuspend as in sigsuspend,
where FreeBSD's system call returns EFAULT.
guest_underscore_entries calls every new export: a loopback TCP
connection, UDP datagrams with scatter, truncation and sender
addresses, a directory listing compared with getdirentries, a SIGTERM
handler set by _sigaction, and a pending SIGUSR1 that _sigsuspend
delivers before returning EINTR with the mask restored. It checks the
errors they pass on (EBADF, EINVAL, EFAULT, ENOPROTOOPT, EOPNOTSUPP)
and that outputs stay untouched on failure.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The sync tolerance test asked for the next frame once, without waiting, so on a loaded runner a decoder that had not queued frame 1 yet failed the delivery check, and the premature-delivery check passed for the same reason. Poll for the frame in both checks: with a bounded wait for the premature case and the usual wait for delivery.
lchmod forwards to fchmodat with AT_FDCWD and AT_SYMLINK_NOFOLLOW, as
FreeBSD 11.4's sys_lchmod does. On Linux and Windows, which cannot change
the mode of a symbolic link itself, a symbolic link throws instead of
succeeding without a change.
Since #8172, a host import that stays in the write watch keeps each of
its watched runs in the watch instead of taking the whole import out
when part of it was unwatched. Grand Theft Auto V (PPSA04264) imports
resident direct memory that way, and later maps the same memory at a
second address, which turns it into shared views. From then on the write
watch arms them, and the game's own stores fault and are resumed, the
red zone hazard of #361 (#9136, eboot 0x162b9e4 and 0x28f413a).
ImportWatched now marks the resident pages of each run it keeps in the
watch with GuestArenaCompareResidentWhenShared. They stay write-watched
while they are private, as #8172 needs for resident DCC targets. Once
they are shared, their collects fail and they are compared, as before
#8172, instead of being armed. Memory that is already shared when it is
imported is not marked and stays tracked as before.
agc_rewatched_direct_shared gains the imported case: resident direct
memory imported with the watch kept, then mapped a second time, must
collect as 0 through either mapping, stay writable and show a store
through both, while unimported shared direct memory is still collected.
windows_write_watch gains CheckResidentOnlyComparedWhenShared: a
resident-only mark leaves a shared view armed and collected, and still
keeps a resident page compared once a second mapping makes it shared.
An RX 6700 XT hands a geometry shader odd strip triangle i as
(i+1, i, i+2) with the last provoking vertex, which is the order the
translator already uses, and since #7374 last mode takes the flat
outputs of the program's primitives from their last index. Keep the
last-mode refusal for fans only, which reach the program as
(i+1, i+2, 0) while the hardware gives (0, i+1, i+2). TEKKEN DARK
RESURRECTION (PPSA31371) stops on such a strip draw.
Co-Authored-By: Claude <[email protected]>
Verify that sceSaveDataDialogGetResult writes an empty null-terminated directory name string when a selection dialog finishes with no selected directory items.
WindowsMappings keys its physical pages by the section handle's value. A
handle value that an earlier case closed without ForgetSection can come
back from CreateFileMappingW with that case's stored pages, and then the
first mapping is shared from the start instead of resident, so
CheckComparedWhenShared would fail its residency check. It passes today
only because the case before it forgets its section. The case now
forgets its own handle value before it maps.
sceCesRefersUcsProfile threw for every code page except 1250, 1251 and
1252. Twenty-seven more now return a profile that sceCesSbcToUtf8,
sceCesUtf8ToSbc and the MBCS context conversions accept: ISO 8859-1,
-2, -4, -5, -9, -10, -13, -14, -15 and -16, code pages 437, 737, 775,
850, 852, 855, 860, 861, 862, 863, 865 and 866, KOI8-R, KOI8-U and
Windows 1254, 1256 and 1258.
SingleByte.hpp holds the high half of each table, taken from the
public mapping files at unicode.org: ISO8859, Microsoft's PC tables,
VENDORS/MISC for KOI8 and Microsoft's best-fit tables for 1254, 1256
and 1258, the same source and derivation as the existing Cp1250 table,
whose high half equals bestfit1250's byte table. Bytes 0x00-0x7F are
unchanged in all of them, and every table maps its 256 bytes to 256
distinct BMP characters. The three existing profiles keep their
tables; one lookup now serves them all.
Profiles whose public table leaves bytes undefined (ISO 8859-3, -6, -7,
-8, -11, code pages 857, 864, 869), maps bytes to private use (874,
1253, 1255, 1257) or has no public table here still throw.
guest_ces checks that each new profile is a distinct, stable pointer,
four bytes per table against the source, a round trip of every byte
through sceCesSbcToUtf8 and sceCesUtf8ToSbc, UNASSIGNED_CODE for a
character outside the table, and a KOI8-R string through an MBCS
context in both directions.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
