bind, connect and sendto answered EFAULT for an address length below 2 and EAFNOSUPPORT for an AF_INET address below 16 or an AF_INET6 address below 28 bytes. FreeBSD 11.4's getsockaddr fails a length below 2 with EINVAL and above SOCK_MAXADDRLEN (255) with ENAMETOOLONG, and the protocols compare the length with sizeof(struct sockaddr_in) or sockaddr_in6 and fail with EINVAL.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
sceNpGetAccountId and sceNpSetGamePresenceOnline report NP as signed
out, and sceNpUnregisterPlusEventCallback returns 0 like the premium
form.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rosetta ends the process instead of raising SIGSEGV or SIGBUS when a
VMASKMOVPS, VMASKMOVPD, VPMASKMOVD or VPMASKMOVQ store faults on any
element other than an active first element ("rosetta error: unexpectedly
need to EmulateForward on a synchronous exception"). Measured on an M5
with macOS 27.0.1 for all eight 128- and 256-bit store forms. A masked
store into a page the macOS write watch keeps read-only therefore ends
the title.
--to-rosetta now moves each masked store to a stub that saves RAX, RCX
and RFLAGS below the red zone, computes the operand address with LEA,
reads the mask sign bits with VMOVMSKPS or VMOVMSKPD, and writes to the
first and last byte of every active element with LOCK OR of 0. Those
writes fault normally, so the write watch sees the page and unprotects
it, and they leave memory unchanged. The stub then restores the
registers and runs the original store. Segment and address-size
prefixes are kept on the probes, RSP-based operands skip the spill
frame, and RIP-relative operands are relocated. Masked loads, the
Intel target and a plain relink are unchanged.
masked_store_lowering decodes every form, register and extension,
checks the stub bytes, and on x86-64 Linux and macOS runs 1728 stubs
across all forms, six addressing modes, six offsets around a read-only
page and six mask patterns. It checks the stored bytes, that exactly one
fault reaches the handler when an active element touches the page,
that no register, flag or red-zone byte changes, and that RSP is
restored. Without the probes the x86-64 build aborts under Rosetta.
test_to_rosetta.py checks that only --to-rosetta lowers a VMASKMOVPS.
A domain program that picks one of its patch's control points from data
(Onimusha: Way of the Sword, PPSA27836, selects a corner with v_cmp and
v_cndmask before a buffer_load from the off-chip ring) was refused with
"the tessellation ring or LDS address is not affine in the control point
and relative patch". Computed indices were accepted only for hull LDS
reads.
- The address evaluator gives off-chip EvaluationInput reads the same
dynamic term as hull LDS reads, and a value read from the patch's own
ring or LDS no longer counts as depending on the relative patch index,
since the lowered read takes the patch implicitly.
- When the program also uses its relative patch index as data, the
index is replaced by the grouped patch instead of 0, which left a
computed read's address pointing into another patch. Such reads now
subtract their relative patch term, for hull and domain reads alike;
reads in programs that do not use the index as data keep their address.
- The computed offset must be a whole number of control points, and the
backend clamps the domain gl_in index to the last output control point
as it already does for hull reads.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The controller information reported 1920 by 943, the DualShock 4 height with
the DualSense pixel density, while the host controller's fingers were scaled to
1920 by 942 and the keyboard touch contacts sat on the 942 centre line. A title
that maps touch coordinates through the reported resolution lost the lower part
of the touchpad. The width and height now live beside the pad state and all
three places use them.
Resolve docs/dev/debt/shader.md: keep main's reworded guest memory load guard entry and add the descriptor web arm entry after it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceMoveOpen returned a new handle for any user, type and index, although
the console's result for a user other than the initial user and for a
type and index that are already open is not known. Both now throw, as
libSceHmd2 does for another user. Record which shadPS4 behaviour the
handle and open checks add to.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Arbzg9c2DA4DEFKVSvRgYv
MCOMMIT becomes STC plus NOP padding and RDPRU goes through a
runtime-checked stub returning the host TSC for MPERF/APERF while
other selectors yield zero, with converter and execution tests.
docs/dev/debt/relinker.md records the new lowering and its unverified
assumptions.
PS4 titles import both and do not load without them; every call throws and
the debt files list them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The fast proof of a cached ShaderResources proves each sampled texture
from write stamps, keys and the pending registry. It never asks whether
the sampled lookup would still return the bound Texture, so a template
whose surface memory is unchanged keeps binding an old object:
- After the sampled cache drops or replaces the entry (#6492 marks the
texture released), Find keeps serving the template until the next
Insert, and its fast proof passes.
- When the lookup's answer changes without any lookup running (a
snapshot whose surface became host-imported is viewed through its
storage image from then on), nothing replaces the entry and the
template keeps the snapshot until it leaves the resource cache.
The fast proof now fails with 'replaced texture' when a bound texture
is released. A template whose last full walk is older than
APS5_TEMPLATE_AUDIT_MS (default 1000, 0 turns it off) takes the full
walk instead of the fast proof ('audit'), so a different lookup answer
fails the proof and the template is rebuilt.
The entry stated that image atomics on 32_SINT and 32_FLOAT act on the
raw dword with no measurement behind it. On gfx1100 the 13 integer image
atomics return and store the same raw-dword results on 32_UINT, 32_SINT
and 32_FLOAT, while 16_UINT and 8_8_8_8_UINT controls differ. gfx1100
has no float image atomics, so that part stays open.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Prevent decimal-comma LC_NUMERIC from emitting invalid JSON and silently truncating decimal-point input. Keep 17-digit output, signed underflow and overflow rejection without changing the process locale.
AI-assisted: yes (OpenAI Codex). Windows WinLibs GCC15.2 Release: original shared Json2 fails the final locale regression; fixed guest_json and guest_json_numeric_locale pass (2/2, no skips). Final conventions pass. Only relevant runtime/test targets built; full build/full suite and game/console/Linux/macOS behavior unverified. No performance or coverage increase claimed.
Add libSceCamera with sceCameraIsAttached, which reports camera 0 as not
attached and rejects other indexes, and declare the ten camera functions
PS4 titles import without an implementation.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceNpGetAccountCountry, sceNpGetAccountDateOfBirth, sceNpGetAccountLanguage
and sceNpGetParentalControlInfo take an online id that matches no user,
sceNpGetUserIdByOnlineId and sceNpCheckPlus report NP as signed out, and
sceNpNotifyPlusFeature is declared and throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Track the handles sceMoveOpen issues. A handle that was never opened,
is closed or was opened before sceMoveTerm now throws instead of
succeeding, since the console's INVALID_HANDLE result and its order
against INVALID_ARG are not known. List the no-controller path under
Silent stubs, as libSceHmd and libSceBluetoothHid do, and check the
handle values in the test.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Arbzg9c2DA4DEFKVSvRgYv
The Linux entry stub now passes each traced import through libc.prx's
TraceImport_nid_no_patch before it calls the guest entry, and stores the
returned thunk in the import's slot. The same imports are traced as on
Windows: functions bound through a PLT slot or a GOT slot, without an
addend, and not weak. TraceImport_nid_no_patch is bound eagerly through
an added GLOB_DAT relocation, so a libc.prx without it fails at load.
Each slot's page is made writable with mprotect first, so slots inside a
PT_GNU_RELRO range can be replaced.
--trace-imports now requires libc.prx among the libraries on Linux too,
and is refused with --macos.
A thread that lost the race to write the report passed SIGABRT on straight away, and the default action ended the process while the first thread was still writing. It now waits for the report to finish, polling with nanosleep for at most 2 seconds, before it chains. guest_call_trace_abort_race aborts from two threads at once and checks the whole report; it failed 35 times in 50 without the wait. Reported by jotitadev.
The SIGABRT handler used stdio and dladdr, so an abort raised while another thread held the stderr lock or the loader lock hung instead of ending. The report is now formatted into a stack buffer and written with write(2). Callers are named from a module list taken with dl_iterate_phdr when imports are traced, and import counts are read without a lock from a fixed record array. The abort test now holds the stderr lock in another thread, which timed out before this change.
Build the call tracer for Linux as well as Windows. The thunk area is a
memfd mapped twice, writable and executable, and threads are named by
gettid. Linux has no crash report, so the first traced import installs a
SIGABRT handler that prints the last calls and the most called imports,
then passes the signal on to the previous handler.
guest_call_trace and guest_call_trace_abort now run on Linux too.
The 73 sceNpCppWebApiUnknown<nn> stubs carried an APS5_EXPORT alias because their
names were placeholders. aerolib names all of them, and each name recomputes to
the NID a title imports, so the alias is dropped and the loader derives the NID
from the real symbol name, as the rest of the library does. Behaviour is
unchanged: every one of them throws.
The stubs are ordered by demangled name instead of by NID, so the Common template
instantiations and the V1/V5 accessors sit together, as the rest of the file
does. No symbol changes: the built .prx exports the same 359 NIDs as main.
