The depth plane copy budget (APS5_DEPTH_PLANE_COPY_MIB, 256 MiB) evicted
the least recently used copy even when it had been sampled in the same
frame. When one frame samples more than the budget, every use evicts a
copy the next use needs, so each copy is made and refilled again on every
use. ASTRO BOT (PPSA21564) samples a 1536x1536x16 D32 copy (288 MiB with
its staging buffer) and a 2048x2048x3 D16 copy (48 MiB) alternately in
its intro and thrashes this way.
A copy sampled in the current or the previous present now stays while
all copies hold at most twice the budget. Past that, the least recently
used copies leave whenever they were sampled, so the copies never hold
more than twice the budget, or the one copy being sampled if it is
larger. Older copies still leave first by least recent use down to the
budget.
DepthPlaneCopyBytes reports the bytes the copies hold, for the tests.
The pooled-memory rounds of agc_driver_depth_plane_guest_layers now
advance two presents between samples, since two copies sampled in one
present may now be kept together.
In a leaf without a frame pointer, --frame-red-zone lowers RSP after
the prologue and adds the shift to every RSP operand in the body,
assuming RSP does not move between the prologue and the exits. It
refused explicit RSP arithmetic but not opcode-encoded pushes and pops,
so after "push rax" in the body the read of the pushed slot at [rsp]
became [rsp+0x10], a red-zone slot, and "pushfq; and qword [rsp], -2;
popfq" changed that slot instead of the saved flags. Such a leaf now
keeps its red zone and is reported as "push or pop inside the body":
push and pop of a register, push imm, push r/m, pop r/m, pushf, popf
and push or pop of fs or gs outside the exits. The pops of an exit
still frame, and leaves with a frame pointer, whose RSP operands are
already refused, still frame when they push and pop.
The eleven sceNetCtlApRp* exports return 0 as their firmware bodies do
since db2575839 (#8307); none of them is a stub any more, so the
sentence saying their stub bodies are unchanged no longer describes a
gap.
ProsperoEden declares the setter with the mode as its argument and the
getter with an int output, and measured on a PS5 that modes 0 and 1 are
accepted, 2 to 7 return 0x80020016 and 1 is the default. Both threw as
discovered stubs. Other modes and a null output throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
rand and rand_r both used FreeBSD's do_rand (Park and Miller on
state % 0x7ffffffe + 1, minus one), so rand returned values up to
0x7ffffffd and rand(), rand_r() and every seeded sequence differed
from the console. The libc.prx that titles ship (the same code in the
copies of PPSA13934, PPSA07923 and PPSA05916, read from disassembly)
uses two different generators:
- rand steps a 64-bit state, initially 1, as
state * 0x5851F42D4C957F2D + 1 and returns (state >> 32) & 0x3FFFFFFF,
so its results stay at or below 0x3FFFFFFF. srand stores the seed
zero-extended as that state.
- rand_r is the minimal standard generator, state * 16807 modulo
2^31 - 1 on the signed 32-bit state (1 gives 16807, 282475249,
1622650073), and a zero state becomes 0x2AE1B767.
guest_math now expects those results: the rand_r chain from 1, the
zero and 0x7FFFFFFF states, rand after srand(1), srand(0) and
srand(0xFFFFFFFF), and rand's range over 1000 calls. Its previous
checks expected FreeBSD's values and rand matching rand_r.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Add the BSD "quad" `strtoq` export for the libc PRX as a thin wrapper
around `strtoll`, as FreeBSD 11.4 lib/libc/stdlib/strtoq.c does. The
unsigned sibling `strtouq` is already here as the same alias of
`strtoull`. Extend the guest wide strings test to probe the signed
path on an under/overflow run and a short positive run with a trailing
non-digit. Document the export in docs/dev/debt/libc.md with the
registry NID `yUUOxgk8Dmc`; console behavior is unverified beyond the
existing `strtoll` contract.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
