When sceSaveDataDialogGetResult is passed a non-null dir_name pointer but no directory name was selected by the dialog, write the empty string into dir_name so the caller's output buffer is properly null-terminated instead of retaining uninitialized bytes.
sceAudioOutSetMainOutput threw "not implemented". In firmware 12.70
the export is `xor eax,eax; ret` (PS5-Audio-Passthrough-Research,
docs/FINDINGS.md line 25 at cf3c921): it reads no argument, changes
nothing and returns 0. It now does the same, defined in AudioOut.cpp
next to the Sys output calls.
Its parameters stay unknown and other firmware versions are
unverified. The debt file records this under Silent stubs, which
check_conventions requires for an export that returns a constant,
in place of the function's unknown-signature line.
The audio_out_sys test checks that the call does not throw and
returns 0; on main both checks fail.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
_openat now opens files as openat does. It reads the mode argument only
when O_CREAT is set, as openat and _open do, and calls openat with the
same descriptor, path, flags and mode, so it returns the same
descriptors and errors.
The PS5 3.20 libkernel_sys export list (DNNDHH/PS5-3.20_Libs) has
_openat, NID bGVEgWXy6dg, as well as openat (A8Yk5AhNDck). In FreeBSD
11.4, _openat is the openat system call stub (lib/libc/sys/Makefile.inc,
amd64/SYS.h) and only libthr's openat adds a cancellation point
(thr_syscalls.c). openat here is not a cancellation point, so
forwarding to it leaves _openat without one, as in FreeBSD.
The openat debt entry now names _openat and no longer says that
O_NOFOLLOW is ignored: open, and so openat, has returned EMLINK for
O_NOFOLLOW on a symbolic link since 9421484572.
The kernel_sys test opens a file through a directory descriptor with
_openat and reads it back, creates one with O_CREAT, O_EXCL and mode
0600, checks outside Windows that it has mode 0600, reopens it for
writing, and checks EEXIST, EINVAL, EBADF and ENOTDIR.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PS5 3.20 export inventory of libSceLibcInternal lists
__inet_ntoa_r next to inet_ntoa_r, and no AnyPS5 library exported it,
so a title importing it could not resolve it. It now runs inet_ntoa_r:
FreeBSD 11.4's arpa/inet.h names the function __inet_ntoa_r, and
inet_ntoa.c makes inet_ntoa_r a weak alias of it.
__inet_addr, __inet_aton and __inet_ntoa are in the same inventory,
but libc already exports them and the relinker also looks up
libSceLibcInternal imports in libc, so they are not added here.
guest_inet_address formats an address through __inet_ntoa_r into a
buffer of exactly the text's size, and checks that a buffer one byte
short is returned unchanged with ENOSPC and that inet_ntoa's buffer is
left alone.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on firmware 13.60: registering an id outside 1 to 31 or one
already registered returns 0x8a6c0033, checked before a null stream,
which returns 0x8a6c0035; unregistering an id outside 1 to 31 returns
0x8a6c0033 and one that is not registered 0x8a6c003a.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The console's compares return the difference of the first two bytes
that differ, read as unsigned char, as the prosper console oracle
measured. The host functions they called return only the sign on
Windows and differ by host C library.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A clean resident run was made read-only so that the next collect
could skip GetWriteWatch, and the first guest store into it was
resumed on the guest thread. The exception frame Windows builds for
that fault overwrites the System V red zone below rsp (#361), which
is what #5596 removed for singly mapped direct memory. Resident runs
are now never armed and are collected with GetWriteWatch only.
Refs #9136
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on firmware 13.60: a start whose rounding to 16 KiB overflows
finds nothing, and of two equal free ranges the lowest is returned.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on firmware 13.60: an alignment that is not zero or a power of
two returns EINVAL before anything else; bounds with nothing between
them return ENOMEM, a negative start searches from the bottom, only the
start is rounded up to 16 KiB and the end is used as given; null outputs
are skipped; errors leave both outputs untouched.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceNgs2RackCreate and sceNgs2RackCreateWithAllocator now return the firmware's errors for a custom rack whose buffer count is outside 1 to 4 or below the submixer's max_inputs, whose module buffer id is at or above the count, or whose submixer has more than 37 channels, and for the state sizes of the Gain, Reverb and PitchShift modules, the Reverb option size and word, and the PitchShift option word. Racks that pass these checks with one of these modules or Convolution, with more than one buffer, more than 8 channels or a submixer max_inputs other than 1 or 2 still throw, and so does sceNgs2RackQueryBufferSize for the rejected options.
Destroy locked the state's mutex through a reference into the map entry and
then erased the entry. When that held the last shared_ptr, the state was
freed before the lock guard unlocked its mutex. Take a shared_ptr copy
before the guard so the state outlives it.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Since #6678 a Windows host import under 1 MiB returns to the write watch
when its deferred settle completes (rewatchSettledImports). Grand Theft
Auto V (PPSA04264) imports buffers that are resident direct memory at that
point and later become shared 16 KiB views, when a second mapping of the
same direct memory demotes them. From then on the write watch arms them,
every guest store into them faults and is resumed, and the resumed faults
damage the red zone the game's zlib inflate_fast reloads its pointers
from, so the open world crashes in every run (#9136).
Before #6678 such a range stayed out of the write watch for good and was
compared. Rewatch now marks each range it returns to the watch with
GuestArenaCompareWhenShared first. While the memory stays resident it is
write-watched, as #6678 intends. Once it is shared its collects fail and
it is compared again, as before #6678, instead of being armed.
agc_rewatched_direct_shared maps direct memory resident, takes a block
out of the watch and rewatches it as a settle does, then maps the same
memory a second time. The rewatched block must collect while resident,
then collect as 0 through either mapping, stay unarmed and show the
store through both, while a block that never left the watch is still
collected.
On Windows a fault that AnyPS5 resumes in guest code can overwrite the
guest's red zone, [rsp-0x80, rsp-0x10) (#361). WindowsMappings arms every
alias of a shared page read-only when a clearing collect settles it, so
each guest store into that page faults and is resumed.
CompareWhenShared marks the pages of a range, and disarms any alias of
them that is already armed. Once a marked page is shared, collectable()
and the fresh pre-check refuse a clearing collect over it before anything
is armed, so its aliases are never armed and the caller compares the
range instead. While the page is still a resident run it is collected
through GetWriteWatch as before, which takes no fault.
windows_write_watch gains CheckComparedWhenShared: a marked resident
range stays collected, then a second mapping makes it shared, and from
then on its collects fail, neither mapping is armed and stores into it
take no fault, while the unmarked half of the same mapping is still
collected.
Add the GBK (CP936) and EUC-CN profiles, their scalar conversions to
and from UTF-8, UTF-16, UTF-32 and UCS-2, and accept both profiles in
the MBCS string conversions.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Implement sceCesSbcTo{Ucs2,Utf16,Utf32}* and their inverses, and the
UTF-16 and UTF-32 MBCS string conversions and length queries, on the
existing single-byte, CP932 and CP51932 profiles.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Implement the single-character conversions between the CP932 and
CP51932 profiles and UTF-8, UTF-16, UTF-32 and UCS-2 in both
directions, and the Shift-JIS to JIS X 0208 row/cell arithmetic.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on firmware 13.60: attribute 0x100 makes a flag openable by
name, and only such flags can be opened. Each open returns a new handle
on the same flag, which sceKernelCloseEventFlag releases. Closing a
creator handle and deleting through an opened one return EPERM. Two live
shared flags cannot share a name, names of 32 or more bytes return
ENAMETOOLONG, and a missing name returns ESRCH. After the creator
deletes the flag, an opened handle polls and waits with EACCES and sets,
clears and cancels with no effect.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
fdfawef324 notes that current LLVM spills SGPRs into VGPRs it allocates like any other
register, so one window register can be an ordinary register early in a
program and hold spill lanes later. ReadLaneEliminator only followed a
spilled lane across M0-indexed window stores for slots never used as
ordinary registers, so RESIDENT EVIL 4 (PPSA07411) and LEGO Horizon
Adventures (PPSA14632) kept their reloaded descriptors as run-time
values and stopped. A known lane can only come from a v_writelane chain,
so keep it across a computed-index store instead; a constant-index store
of the slot still ends the spill. This is fdfawef324's suggestion on
#6277.
That such a store misses the spill cannot be proven for these programs,
so it is checked at run time where a replaced read depends on it: a
backward liveness over each slot and lane whose known value a replaced
read used puts a WindowLaneGuard before every computed-index store at
which that lane is live, and the guard records a WindowLaneSpill fault
when the store changes that lane of the slot. The driver reads the fault
buffer back for every program with such a guard and reports the dispatch
or draw as failed, so a broken assumption is no longer silent. This also
covers the pure spill slots main already folds.
Co-authored-by: fdfawef324 <[email protected]>
Co-Authored-By: Claude <[email protected]>
lakhantheboss