A firmware only has the files of the model it was installed for, and its XMB looks for the files of
the model we report, so a mismatch brings back #22909's blank theme colors and 6.61's red error
screen. Which models an install is for shows in the names of its ipl/ files (nandipl_01g.bin,
nandipl_psp2000.ipl); an install for every model has all of them, and firmwares older than the
PSP-2000 have one ipl for every model.
Changing the PSP model to one the installed firmware doesn't fit now asks first, with a way to
cancel, and booting the XMB with a mismatch shows a warning.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The VSH goes by this to decide what the PSP has. With the PSP model set to PSP-1000, the firmware
installer only writes the PSP-1000's files, so a shell told it's on a Slim looked for the Slim's:
3.71's theme color list showed its extra colors (flash0:/vsh/resource/13-27.bmp) as blank entries,
and 6.61 stopped at its red error screen. Both reproduced with the reporter's NAND and a PSP-1000
install of 6.61, and both are gone with this.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An upgrade gets its own notice, informational rather than a warning, since the new shell migrates
the registry and nothing is lost. ReplaceFirmware stays for when a version can't be told.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Installing a firmware set category_version to the new firmware's schema, so no shell ever migrated
the settings PPSSPP keeps in its config. A shell upgrades the registry itself at its first boot: it
writes the default of every key added since the stored version and stores its own (seen booting
2.82, 3.71, 4.05, 5.50 and 6.61 from 1, and 3.71 and 6.61 from the previous firmware's version).
So an upgrade now leaves the version alone. A PSP can't be downgraded, and an older shell takes a
newer version for a corrupt registry, so a downgrade sets it back to 1; that shell's first boot then
rewrites everything added since 1.50, the theme, colour and wallpaper settings among them. Values a
newer shell left there across a downgrade and back broke the theme settings and then 6.61's boot.
The install screen says a downgrade resets the XMB's settings. Headless no longer sets the version
per boot either, so each boot migrates like a fresh config does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Colin McRae Rally 2005 interprets about 2 million of these each 10 emulated seconds, mostly vf2h.q.
vsrt1-4 become pairs of FMin/FMax, which order and break ties like the interpreter's vfpu_min and
vfpu_max, in the same operand order. The D prefix applies as usual (Colin masks half the lanes);
S and T prefixes, which vsrt rewrites, still go to the interpreter. vf2h gets an IR op of its own,
FFloatToHalf2, calling vfpu_f2h; the native backends call the IR interpreter's version of it.
vf2h with any prefix, and sizes other than pair and quad, still go to the interpreter.
The CPU equivalence fuzzer finds no differences on the IR interpreter or the ARM64 JIT, for these
ops alone, with random and unknown prefixes, and with the D prefixes Colin uses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The stencil follows the alpha after a reinterpret (89fabe21fb), but MX vs. ATV Untamed swaps one
buffer between 565 and 8888 about 30 times a frame, and rebuilt it about 60 times a frame. One of
those got stencil tested. Without stencil export (PowerVR GE8320), that's a clear and eight draws
each. On a Galaxy A21, 10 emulated seconds of MX now take 29 s instead of 45 s (1.20.4: 27 s).
Now a reinterpret marks the stencil pending, and the first draw to that buffer that reads it, or
writes it where the color isn't written, rebuilds it from the buffer's own alpha. That goes back to
the copy from 89fabe21fb, so the same-pass stencil variant of the reinterpret shader goes. Draws that
write the stencil along with the alpha can go first: God of War zeroes it every frame, and no longer
rebuilds at all. Of the 15 benchmark states, only MX still rebuilds, once a frame.
Of the 1141 dumps in ppsspp-framedumps, 113 rebuild a stencil, 877 times in all, and three of those
get read, all in Ultimate Ghosts 'n Goblins. They all render the same as before, on Vulkan and
OpenGL on macOS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Splatted, the matrix took sixteen vector registers, and on ARM64 the compiler reloaded them from the
stack every iteration. Multiplied by lane, it fits in four, with the same operations in the same order.
About 14% fewer samples in the function in Colin McRae on a Cortex-A53, where it's the top C++
function on the emu thread. Most of what's left is waiting for the vertex loads.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A draw with a write mask the hardware can't do reads the target from a copy, and takes a new copy
for every flush. But it only reads the bits its mask keeps, and doesn't change them, so while the
same mask draws on, without blending or a logic op, the first copy serves every draw. DBZ Tenkaichi
Tag Team draws its shadow map one bit of red at a time, about 26 copies a frame, now about 4.
The copy is dropped when the target or the mask changes, on any other draw, clear, block transfer or
stencil upload, and at the start of a frame. TEXFLUSH no longer drops it, only the self-texturing copy.
DBZ, 20 emulated seconds on an M1 Mac: 1.9 s to 1.1 s. On a Galaxy A21: 10.0 s to 9.7 s per 10.
The 1141 dumps in ppsspp-framedumps render the same, on Vulkan and OpenGL on macOS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The state is read and decompressed on a worker while the game keeps booting. On a slow host that
got far enough to reach different code, and with MX vs. ATV Untamed without a firmware, its boot
crash, before the state landed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sceMpeg runs the real mpeg.prx by default since #22309, and boot only puts the HLE back when neither
the firmware nor the disc has one. MX vs. ATV Untamed carries an mpeg.prx it never loads, so without a
firmware it got the real sceMpeg, then asked sceUtility for the firmware's module, which wasn't there.
Every sceMpeg import stayed a missing stub, and the game crashed at boot writing through what the
calls returned.
Now that load turns the library over to our HLE and resolves the waiting imports against it. The
latched HLE flags change with it, so a savestate made afterwards restores the HLE too. Atrac goes on
to set up its HLE memory the same way. For a library the user disabled themselves the warning still
shows; for one that's real by default, like the boot-time check, it's only logged. MX now plays its
intro video without a firmware, and still loads the real module with one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 1.5x music browser reads PSP/MUSIC through msoem0:, the memory stick
with 8.3 names in the OEM code page, which wasn't mounted. It lists folders
with ioctl 0x02425051 on an ordinary directory fd (sceIoDread plus the name
in UTF-16), and sets a value on fatmsOem0: with devctl 0x02405852 at boot.
Formats from fatmsmod.prx and music_plugin.prx in 1.50.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Fixes#22890
Before 3.80, the XMB's music browser doesn't list a folder with
sceIoDopen/sceIoDread. It asks the FAT driver directly, with the path as a
list of UTF-16 components: devctl 0x02415864 starts a directory search and
returns a dir fd, read entry by entry with ioctl 0x02425069. 0x02435865 and
0x02435860 are getstat and open, with the path given the same way. None of
these were implemented, so firmware 3.71 and older found no tracks.
The argument layouts are from fatmsmod.prx and music_browser.prx in 3.71.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
theme_type and CONFIG/SYSTEM/XMB/THEME's color_mode, wallpaper_mode,
system_color and custom_theme_mode now persist in the config. Their
defaults (0) are the firmware's schema defaults.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The shell writes the default of every registry key added after the stored
category_version, and some of those (umd_autoboot) are now mapped to our
config. Each firmware's version is the default in its registry schema
table, in vshmain.prx (common_util.prx before 2.00). Installing a firmware
now stores it, and headless sets it from the NAND's firmware.
Also builds the config setting lookup in headless and libretro: without
g_Config.Init(), sceReg served its static dump instead of the mapped
config values.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
owner_name and time_zone_area now read from and write to sNickName and
sTimeZoneArea. Also maps language, the date/time keys, summer_time and
parental_level. The config values are applied in the merged category view,
so reads by handle and the key info sizes see them too, not just
sceRegGetKeyValueByName. language reads through GetPSPLanguage() so that
the -1 'auto' setting reads as an actual language.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WaitIfWriting compared addresses as VRAM offsets, which mapped RAM addresses onto VRAM too. Midnight
Club L.A. Remix loads CLUTs from RAM that land on its depth buffer's range that way, and the emu thread
waited for the depth worker at each, about a quarter of its time on a Galaxy A21. The depth buffers are
all in VRAM, so other addresses now return at once.
Midnight Club, 10 emulated seconds: 39.6 s to 24.0 s on the A21 (32.9 s in 1.20.4), 2.67 s to 2.32 s on
an M1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The smart 2D filtering check and the exact one for depal walked the rectangles separately. Now one loop
does both, stopping once neither can hold, and a rect of no size ends both.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shader depal filters by hand, with four texel and four palette lookups per pixel. DBZ Tenkaichi Tag Team
does two full-screen through-mode depal passes per frame, and on a PowerVR GE8320 (Galaxy A21) they took
DBZ from 8.3 to 14.4 seconds per 10 emulated seconds once #22204 had made framebuffer depal work again.
They're 1:1, where bilinear gives the nearest texel anyway, so rectangles that put every pixel center on
a texel center (equal UV and position deltas, at a whole-texel offset) now count as pixel mapped for
depal, which turns the filter off. Unlike the smart 2D filtering check, this changes nothing on screen:
the frame dumps render identically on Vulkan and OpenGL, 69 of them through this path. DBZ is down to 9.2s.
The depal uniform is also repacked when pixelMapped changes between draws, rather than only when the
texture is reapplied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every instance after the first got PPSSPP_ID 1 on macOS, so they shared
the same ad hoc MAC and IP, and secondary instances saved the config.
- flock() on a shm object fails with ENOTSUP on Darwin, so the counter was
never updated. Lock with a named semaphore there; keep flock elsewhere.
- ftruncate() on a shm object that already has a size fails with EINVAL on
Darwin. Only size the object when it's new.
- Shutdown unlinked the shm object even while other instances were still
running, so the next one to start got a fresh counter and ID 1 again.
Only unlink when the last instance exits.
The loader streams it (HTTPFileLoader), but headless rejected anything File::Exists doesn't
find. This lets a phone run a game served from another machine, over adb reverse or the LAN.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A PSP never writes the info struct's length, and on a call without new data writes updated = 0 and
the last data's timestamp again, 0 before any came (pspautotests net/adhoc/pair/gamemodeinfo).
PPSSPP wrote the length and left the timestamp alone without new data. Shaun White Snowboarding
reads the timestamp either way, from a struct on its stack, and keeps the newest it has seen as the
time of the last update; stack garbage got in there, and the host gave up on the game a moment
after the match started ("The game is no longer available").
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On a PSP, with 8192 bytes in flight from an 8 KB send buffer, poll leaves out SEND and a
non-blocking send of 16 more returns WOULD_BLOCK until about half the buffer has drained, and poll
leaves out FLUSH until the data has arrived, which takes as long as a flush (pspautotests
net/adhoc/pair/ptpsendready). PPSSPP reported both at once and took any send. The in-flight bytes
from the flush model now drain linearly until their delivery time; sends that don't fit wait, and
GetPtpStat counts what's left. Relay PTP sockets now record their buffer size, which they didn't.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wait polled the emulated clock with a new connection every few milliseconds, thousands of them
in a long wait, each with its own thread and subscribers on the PPSSPP side.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Feed() held pendingLock_ across Core_RunOnCPUThread(). Once sendFeed_ was set, the CPU thread's
next flip waited for that lock in FlipListener(), while Feed() waited for the CPU thread.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DisplayFireFlip() copied the listener list and called the copy without the lock, so a debugger
connection closing on its own thread could free its GPU stats subscriber while the CPU thread was
about to call it. Headless crashed (or hung) in WebSocketGPUStatsState::FlipListener() with
scripts that open a connection per command. Hold the lock across the calls, as LogManager does for
its callbacks, so __DisplayForgetFlip() returns only once the listener can't be running.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A PSP returns size 0 without touching a buffer too small for one entry, and GetPeerList refuses
a negative size with INVALID_ARG (pspautotests net/adhoc/pair/listsizes). PPSSPP cleared the
whole buffer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
What a PSP does, where PPSSPP differed:
- A PtpOpen or PtpListen on a port in use uses up a socket ID, as PdpCreate's does.
- A connect to a MAC that isn't in the group would block or times out, and is refused once the
retransmits would have run out, (count + 1) * interval. It returned INVALID_ADDR at once.
- PtpAccept's flag must be 0 or 1.
- A blocking broadcast returns 0, so one the host can't take in time is dropped, not a TIMEOUT.
The FIXMEs and TODOs other tests already answer (socketids, adhocctl, gamemode, ptp) now say what
the PSP does instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pspautotests net/inet/calls measures what socket, bind, listen, connect,
accept, the socket options, getsockname and getpeername, shutdown, close
and the address conversions cost on a PSP when they don't wait: from 3
us for an address conversion to 76 us to close a TCP connection (95 us
with RST), and 4 us on a socket that isn't open. They cost about 1 us
each here.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On a PSP, select and poll with nothing ready return about 120 us after
their timeout (pspautotests net/inet/timing), wait at least about 330 us
for any timeout from 10 us up, and don't wait at all for a timeout of
1 us. We waited exactly the timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
