Skip to content

sync(upstream): Batch 43, 938 upstream commits through a75292c7b - #584

Draft
RINNECODER wants to merge 996 commits into
team/upstream42from
team/upstream43
Draft

RINNECODER wants to merge 996 commits into
team/upstream42from
team/upstream43

Conversation

@RINNECODER

Copy link
Copy Markdown
Owner

Upstream sync Batch 43: upstream a4440ed93..a75292c7b (2,104 non-merge commits) on top of Batch 42 (#583). Stacked on team/upstream42, so merge #583 first.

  • 938 upstream commits cherry-picked (-x), 983 non-merge commits in total, including the fork adaptation commits.
  • 14 slices plus a retry pass and a by-hand core pass. Per-slice reports, skip lists and reasons are in the private ops notes (notes/upstream43/).
  • Skipped: Vulkan-only AGC/graphics code, Windows/Linux-host-only code, infrastructure the fork lacks, docs/CI, and the PRX libraries where the fork's implementation diverges (about 334 still skipped).
  • Shader cache FormatVersion 40 → 42.

Tested

  • Rosetta build: OK. CTest 24/25. rosetta_image_cache fails, as it does on main.
  • Guest-replay build: OK. CTest 63/63. anyps5_metal_presentation_replay failed once under -j4 and passed when rerun alone.
  • Not run: gameplay gate, replay/agc-map gate, Guest* library tests (not in the Rosetta CTest set), Vulkan driver tests. Do not merge without the gameplay gate.

Review hot spots

  • 0efe28a83: Metal now lets line draws through and refuses only points.
  • Depth-mip rendering is limited to mip > 0 (msaa_depth test).
  • DarwinPipeSpace.cpp: watching a pipe's write end on macOS is implemented with kqueue, where upstream throws "not implemented".
  • fstatfs on a pipe now returns EINVAL. The relinker no longer traps GS-prefixed instructions that don't touch memory.
  • Agent-written RejectGuestWideScan (libc Formatting.cpp) and the sceLoginDialogParamInitialize error code.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj

erickerxhalli and others added 30 commits October 23, 2026 08:37
sceMoveOpen returned a new handle for any user, type and index, although
the console's result for a user other than the initial user and for a
type and index that are already open is not known. Both now throw, as
libSceHmd2 does for another user. Record which shadPS4 behaviour the
handle and open checks add to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Arbzg9c2DA4DEFKVSvRgYv
(cherry picked from commit 95ea06e)
…ess_length

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
(cherry picked from commit a957b8c)
The bounded-history check expected an evicted possible-write interval
to read as untouched since the baseline. The tracker instead remembers
the eviction: it raises the possible ring's dropped generation to the
evicted piece's, and every byte of the block then reads as stored over
since any older baseline, which is what keeps a forgotten write from
being taken as unchanged memory. The check now requires that for the
evicted interval and for an untouched gap beside it, checks that the
newest and the re-recorded interval are retained against baselines
taken just before their writes, and keeps the no-complete-coverage
check.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
(cherry picked from commit 338ce07)
…f the nonblocking switch

(cherry picked from commit 585e42b)
sceHttpSetDefaultAcceptEncodingGZIPEnabled sets the value templates of that context start with; sceHttpSetAcceptEncodingGZIPEnabled and sceHttpGetAcceptEncodingGZIPEnabled set and read it per object.

(cherry picked from commit 32f0a80)
sceHttpSetEpoll and sceHttpUnsetEpoll now keep and clear the object's epoll and argument, which sceHttpGetEpoll returns.

(cherry picked from commit 2525578)
…bort calls

Without a network these change nothing, so they check their arguments and return 0, and the debt file lists them as silent stubs.

(cherry picked from commit c0f8251)
The handle calls and sceMoveClose threw for a handle never opened, already closed or opened before sceMoveTerm; they now return 0x80EE0004, checked before the other arguments.

(cherry picked from commit 808d67e)
The firmware's shared system option validator checks the size and the
fields from +0x6c on, not flags at +0x68. Rise of the Ronin (PPSA04540)
creates its system with flags 2, which threw. Accept and ignore bit 1;
every other bit still throws, now naming the value.

(cherry picked from commit 6539598)
…v/tzset

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
(cherry picked from commit 6eb1168)
…ad of classifying it

RenameDotError looked at the parent of a dot component with exists() and
is_directory(), so a stat failure other than a missing path, such as
permission denied, answered ENOENT or ENOTDIR. The parent is now read with
status(): a missing path is ENOENT (ENOTDIR when a component is a file), any
other error is mapped through FilesystemError, and only a successful status
decides between a directory (EINVAL) and a non-directory (ENOTDIR).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
(cherry picked from commit 1da2c0f)
Rename of file/. fails with ENOTDIR and of loop/. with ELOOP on Linux, where
status() of the parent reports the error instead of "not found"; the test also
runs the file case on Windows, where it passes with and without the change.
The loop case needs a symbolic link and runs on Linux only.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
(cherry picked from commit 34acda3)
Cleanup removed only the three directories, so a run that stopped between
creating the symbolic link and removing it left the link behind and every later
run failed at its creation with EEXIST. Cleanup now also removes the plain file
and the link, and the link name and plain file name moved to namespace scope.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
(cherry picked from commit faec856)
…ror from sceNgs2GeomCalcListener

A flags value above 1 returns 0x804A8463 and a null listener parameter returns 0x804A8461, both leaving the output untouched, instead of throwing.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
(cherry picked from commit 8420e13)
Videodec2 opens FFmpeg with apply_cropping = 0, so the frame it reports is
the coded picture and its crop fields describe the cropping rectangle. The
coded size was derived from the frame size and the crop, which counted the
crop a second time when it added up to a multiple of 16: a picture cropped
four units at the top and four at the bottom was reported 16 rows taller
than the coded picture, and every picture was then refused for a frame
buffer that was sized for the coded picture. The frame size is the coded
size, so the crop only fills the crop offsets.

The fixture's sequence parameter set is also decoded with a crop of four
units at the top and four at the bottom now, which covers the case in the
guest test.

(cherry picked from commit 51c6b38)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
(cherry picked from commit ad7d2a1)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
(cherry picked from commit 13a3897)
hypermist and others added 29 commits October 23, 2026 09:03
…tation and occlusion query size calls

sceAgcDriverRequestCaptureStart, sceAgcDriverRequestCaptureStop and
sceAgcDriverTriggerCapture return 0x8A6C1000 without doing anything.
sceAgcSetShaderInstrumentation keeps the flags and returns 0, and
sceAgcGetShaderInstrumentation returns them.
sceAgcDcbBeginOcclusionQueryGetSize is 0x10 for type 0, 0x120 for type 1
and 0 otherwise; sceAgcDcbEndOcclusionQueryGetSize is 0x10.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
(cherry picked from commit 22cd2ec)
On RDNA 2, an S# with TRUNC_COORD 0 rounds the scaled coordinate to 8
fractional bits, ties to even, and one with TRUNC_COORD 1 truncates it,
for point and bilinear filters. The S# decoder ignores the bit, and
AMD's Windows driver truncates for nearest samplers and rounds for
linear ones, so a TRUNC_COORD 0 point sample just below a texel edge
reads the texel below it. The code comment said the bit moves texel
selection by half a texel at most; the debt entry records the measured
rule instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit e3e91de)
Report the dword sizes of the workload state packets and of a NOP that
carries a given number of data bytes, as libSceAgcDriver computes them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
(cherry picked from commit c144ab1)
It is the payload size helper the workload packet sizes are built on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
(cherry picked from commit 5ca5c14)
(cherry picked from commit 7b05271, conflicts resolved by hand: fork's sysctlbyname kern.rng_pseudo handler kept (EPERM on write); MIB {1,50} added)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj
…sults

Export 24 absent driver calls with the constant results and output
zeroing of the retail libSceAgcDriver.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
(cherry picked from commit 9204f9d)
sceKernelTruncate's status query fails with too_many_symbolic_link_levels for a link loop and filename_too_long for an over-long name, and the call answered ENOENT for both. It now returns ELOOP or ENAMETOOLONG through PathLookupFailure, and truncate sets the same errno.

(cherry picked from commit 5057a9e, conflicts resolved by hand: fork keeps plain ENOENT for a missing path)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj
Decode DB_Z_INFO.MAXMIP and DB_DEPTH_VIEW.MIPID and render into the
selected level of a 64 KiB Z_X mip chain as a surface of its own, at
the level's offset and extent from ComputeElementMipLayout, as color
target mips do. Slices of a mip chain step by the size of the whole
chain. Multisampled depth mips, other swizzles, levels in the packed
mip tail and HTILE on a mip chain still throw. LEGO Builder's
Journey (PPSA05496) stopped at its first scene on
"depth mips (DB_DEPTH_VIEW MIP_LEVEL) is unsupported".

(cherry picked from commit cd1efc9)
…polls

GuestSockets::Ready only knew the read end of a pipe, and WaitAny asked the host for POLLIN on every descriptor that is not a socket, so a write interest on a pipe could never be reported or wake a wait. PipeWriteState gives the free space of the host buffer (F_GETPIPE_SZ less FIONREAD on Linux, the write quota on Windows), EOF once the read end is closed, and whether the host takes a write now; Ready reports the write end when it is writable or at EOF, and WaitAny asks for POLLOUT on it. macOS has no call for the capacity of a pipe and throws.

(cherry picked from commit 92e136a, conflicts resolved by hand: macOS implemented instead of NotImplemented: host kqueue EVFILT_WRITE gives the free space and EOF (new DarwinPipeSpace.cpp, kept apart from the guest EVFILT constants); verified 16384/15384/EOF with a host pipe)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj
A depth-only target has no stencil storage for STENCIL_CLEAR_ENABLE to
write. Titles that clear depth and stencil together on such a target
were rejected; the depth clear and colour writes now proceed. A
read-only stencil plane is still rejected.

(cherry picked from commit dc6da1b)
…rizes

HighestDrawIndex read each index through a branch on the index size and
kept the maximum in a std::optional, so neither clang nor GCC vectorized
it, and an indexed draw scans its whole index range when its range is not
kept (fewer than Recorder::KeptIndexRangeIndices indices, or a range
whose memory is not tracked). The scan now runs one loop per index type:
the maximum without restart, or with restart the maximum of the indices
masked by whether they are the restart index, plus an OR of those masks
for whether any index was not a restart index. Results are unchanged.

(cherry picked from commit f0fd092)
FlushForAccess checked the pending-write snapshot before it looked for
overlapping pending and flushing images. A flusher moves an image the
other way: pending, flushing, recorded into the open batch, landed. A
reader descheduled after the snapshot check while the store was recorded
and the image unregistered found nothing flushing and read guest memory
before the recorded copy ran. Sync again when the snapshot overlaps the
range after the image checks.

(cherry picked from commit 89f829b)
…t levels

An R128 image access reads only words 0-3 of its T#; the recompiler
passes words 4-7 as zero, so the decoder saw MAX_MIP 0 and refused a
128-bit T# with BASE_LEVEL above 0 ("starts past the surface's last mip
level at levels that would move the surface's own"). Streamed textures
such as a 2048x2048 BC3 T# naming its resident levels 2..11 hit this.

Where a T# with words 4-7 zero would be refused that way, it is now read
as a 128-bit T#: MAX_MIP = LAST_LEVEL, with levels BASE..LAST described
as their own chain (size and MIN_LOD rebased), but only for 1D and 2D
T#s whose rebased levels have the same offsets, sizes and tail slots as
in the full chain. Everything else still throws as before.

AI-assisted: yes
(cherry picked from commit 4c2dc2e)
AI-assisted: yes
(cherry picked from commit 74f2fcb)
kevent threw for EVFILT_WRITE on any descriptor that is not a socket. On the write end of a pipe it now follows FreeBSD 11's filt_pipewrite: data is the free buffer space, and once the read end is closed the event reports EV_EOF with data 0. Adding the event after the read end is closed fails with EPIPE, as in pipe_kqfilter. EVFILT_WRITE on the read end still throws, because FreeBSD's pipe ends are bidirectional and host pipes are not.

(cherry picked from commit bd8ee51, conflicts resolved by hand: macOS pipe write end supported through the ported PipeWriteState, so the macOS-only throw expectation is dropped; fork keeps EV_CLEAR on a pipe refused on every host)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj
lseek on a descriptor that is not open with an invalid whence answered EINVAL.
FreeBSD 11.4 kern_lseek looks the descriptor up first and only then lets the
file's seek operation judge the whence, so the answer is EBADF.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
(cherry picked from commit 06ee881)
(cherry picked from commit bbcce17, conflicts resolved by hand: fork has no Windows PipeReady wrapper; ioctl malformed-request checks belong to a later commit)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj
…on a PS5

In a payload process on a PS5 (firmware 12.70), sysctlbyname returns -1
with ENOENT for thirteen names that threw here, and leaves the buffer and
the length alone, for a read, a size query, a null length and a null
buffer with a null length. sysctl does the same for the fixed MIBs of
seven of them. sysctlnametomib gives those seven MIBs and returns ENOENT
for hw.cacheline_size and hw.usermem, which threw too.

machdep.cacheline_size already returned ENOENT and is now tested with
the others. A write to the new names and MIBs throws, as the console's
answer to a write was not tried. The hw.realmem and vm.overcommit debt
entries now say that a payload process gets ENOENT for them as well.

AI-assisted: yes

(cherry picked from commit dfa96f1, conflicts resolved by hand: kept beside the fork's measured-absent MIBs and SystemIntegers name lookup)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj
Drop the fork's sceAgcSet/GetShaderInstrumentation stubs in Platform.cpp:
upstream 22cd2ec defines them in Debug.cpp (Get returns the stored
flags), and both copies broke the libSceAgc link.

Take upstream cd1efc9's depth mip path only for a nonzero view level.
Level 0 of a mip chain keeps the fork path (anyps5_metal_msaa_depth draws
level 0 of a chain whose level 0 sits in the packed tail, which the
upstream path refuses), and slices of a mipmapped surface stay refused
outside the mip path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUR8Qmzp9aAJW4WTu3aRVj
@coderabbitai

coderabbitai Bot commented Oct 23, 2026

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.