The mixing stage threw when a mastering voice and its render buffer had different channel counts. A 2-channel voice is now mixed into the first two channels of a 6- or 8-channel buffer; other mismatches still throw.
Driver::RegisterShader required the Shader header at an 8-byte
boundary (alignof(Shader)) and read its fields through the pointer.
PPSA26344 uses its shader packs in place: its compute shader objects
point at headers 4 and 1 bytes past an 8-byte boundary, so the first
sceAgcCreateShader of such a header threw "null or misaligned address".
The header is now checked for null and readable memory at any
address, and its fixed fields and the registers the trace prints are
copied out with memcpy. The code address must still be 256-byte
aligned, and the header and size checks are unchanged. The console's
rule is unknown and is listed in TechnicalDebt.
The call site of PPSA21402 sets only three argument registers, so the function has no size parameter. A data chunk that runs past the buffer or ends inside a frame returns INVALID_WAVEFORM_DATA instead of being shortened. The test no longer writes padding from a string literal.
Write the 2-dword CLEAR_STATE (0x12) packet with a 4-bit command, the
packet the driver already validates and executes by restoring the
initial context registers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Write SET_CONFIG_REG (0x68) packets like the context, shader and user
config register setters: one register from a ShaderRegister, or a range
of values at an offset.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Patch the mask of a wait packet like sceAgcWaitRegMemPatchReference
patches its reference: a 32-bit value written to the low mask word of a
32- or 64-bit WAIT_REG_MEM, rejected above 32 bits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The end-of-shader action is written by an inline SDK builder as a
RELEASE_MEM packet, so the size is the 32 bytes that
sceAgcCbReleaseMem writes and that sceAgcAcbQueueEndOfShaderActionGetSize
already returns.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reverb was a Freeverb-style approximation. It now follows the PS4
firmware 11.00 libSceNgs2.sprx, read and checked against its output: the
input mixed to mono with the library's fixed gains, a 14400-sample buffer
with four reflection taps from the reflection pattern tables and a late
feed, sixteen damped comb filters with a pre-emphasis stage, a signed
selection of combs and four allpasses per output channel, a two-pole room
HF filter, and the library's parameter clamps, crossfades and setup
defaults. The test values are the PS4 library's own output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 of the 31 NIDs have names in shadPS4's aerolib list. They are declared
under those names; POSIX sleep is implemented. The NpPartner001 and Psml
MFSR2 exports stay unnamed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A pixel, vertex or tessellation stage whose wave is wider than the host
subgroup runs one guest lane per invocation, so lanes at or above the
subgroup size have no invocation. v_readlane_b32 still shuffled from
them, which Vulkan leaves undefined; a wave64 pixel minimum loop that
reads lanes 31 and 63 can then wait for a value no live lane holds and
hang the GPU.
At one lane per invocation outside compute, a v_readlane_b32 of a
constant lane at or above the host subgroup size, and v_permlanex16_b32
on a subgroup of 16 lanes or fewer, now fail SPIR-V emission. Lanes in
registers still build, so s_ff1_i32_b64 waterfalls are unaffected,
and neither check applies to compute or to two lanes per invocation.
v_permlane16_b32 and v_permlanex16_b32 take the source lane's EXEC from
a ballot, as DPP does, instead of a shuffle from a possibly inactive
invocation.
GFX10 image format 30 (10_11_11_UNORM: X and Y are unorm11 in bits
0-21, Z is unorm10 in bits 22-31, per Mesa's gfx10 tables) has no
Vulkan format, so its sampled and storage descriptors threw at decode.
Format 30 now takes the R32_UINT route of 10_11_11_UINT: the driver
binds the raw dwords as R32_UINT and the shader extracts each field and
converts it with the buffer format helpers (NormalizeFormatComponent on
loads, EmitFormatStoreComponent on stores); DST_SEL 1 reads 1.0f.
Samples, gathers, LOD queries, 16-bit data and loads or stores whose
DST_SEL names the missing W channel throw.
Converted textures are now viewed with an identity component mapping,
since the shader applies DST_SEL itself: a 10_11_11_UINT view whose X
selector was not X lost the packed dword. DCC clear codes 0001 and 1110
of a converted texture throw instead of filling one R32_UINT channel.
RackGetInfo reports the rack's handles, buffer, id, uid, option limits,
render count and active voices. VoiceGetPortInfo reports a port's matrix,
volume and destination. VoiceQueryInfo answers info id 0x4001 with the
voice channel count and throws for other ids. Assumptions are recorded in
TechnicalDebt.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
sceLoginDialogGetResult zeroed 8 bytes of a result struct of unknown size and reported result 0
with user id 0. It now writes only the leading int32 (USER_CANCELED), like
sceWebBrowserDialogGetResult and like the sign-in dialog, so a title takes its "no user chosen"
path instead of reading an invalid user id. Records the dialog in the silent-stubs list in
docs/dev/TechnicalDebt.md.
Per review: sceUserServiceGetNpAccountId reports success with account id 0 and
sceUserServiceGetUserColor returns blue by default; both are assumptions. Records them under
"Unknown function info" in docs/dev/TechnicalDebt.md.
* feat(libkernel): implement sceKernelReleaseFlexibleMemory
Unmaps the range through sceKernelMunmap, which returns its pages to
the flexible memory budget, as fpPS4 and prosper do.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(libkernel): keep the flexible memory release check apart from the batch map checks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
sceAgcCbCondWrite writes the 9-dword COND_WRITE packet: poll a memory
dword, compare it masked with the reference, and write a dword to memory
on a match. sceAgcCbCondWriteGetSize returns its 36 bytes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dean