Skip to content

VERIFICATION.md

Latest commit

 

History

History
116 lines (86 loc) · 18.6 KB

VERIFICATION.md

File metadata and controls

116 lines (86 loc) · 18.6 KB
Raw

P3P3DS — Technical Claim Verification Registry

This registry tracks the verification status of all technical claims, hardware parameters, memory addresses, and architectural assumptions in the P3P3DS project, adhering to the MEASURE FIRST engineering principle.

Current execution and coverage measurements: CURRENT_STATE.md. Earlier milestone/decoder rows below record historical observations and must not be read as the latest frontier or current lowering coverage.

Thread-entry frontier provenance micro-sprint

  • [VERIFIED] The SceWaveMain UID 5 initial context switch installs its stored entry 0x08B64FE0 without a guest JAL to that address. Evidence: core/src/hle/threadman.cpp::start_thread, platform/pc/telemetry.hpp::blocker_type, .tmp/thread-entry-before.json and .tmp/thread-entry-check/report.json. The new thread_entry_transfer record is one-shot and is invalidated by guest execution/transfer or another switch.
  • [VERIFIED] The relocated ELF analyzer (.tmp/thread-entry-analysis_functions_auto.csv, sub_08B64FE0) and p3p_frontier_check --thread-entry report a closed supported CFG of 454 instructions and 107 blocks with an independent predecessor return/delay slot. The 21-seed AOT executes that entry and reaches missing sceAudioOutputBlocking, NID 0x136CAF51 (references/uofw/src/kd/audio/exports.exp:51). Full CTest 12/12 and two identical final replays (SHA-256 9999960D59DC3166FE03051390EAD0DA4139321DD3A79081AF1EDBC6034A629B) confirm this PC-host result; no hardware execution or audio output is claimed.

Audio reservation micro-sprint

  • [VERIFIED] ULUS-10512 first calls sceAudioChReserve(-1,448,0) at 0x08B64264; after return it tests the sign of V0 and stores the channel number. Evidence: build/generated/p3p_generated.cpp:L_08B64254/L_08B6426C, .tmp/audio-before.json, .tmp/audio-reserve-1.json. A temporary register probe established A3=0x08E10000 and V0_before=0x08E10CA0 and was removed.
  • [VERIFIED] uOFW references/uofw/src/kd/audio/audio.c:440-500, PSPSDK psp/pspsdk/src/audio/pspaudio.h:31-56,69-97 and inspected pspautotests references/pspautotests/tests/audio/sceaudio/reserve.expected:1-70 support descending free-channel selection and the implemented channel, size and format errors. The PC runtime reserves channels 7, 6, 5, 4 and resumes guest execution; focused test tests/test_hle_audio.cpp and two deterministic replays establish the limited host behavior. No hardware autotest was run, and no audio samples were played.

Observed UMD wait micro-sprint

  • [VERIFIED] The executed P3P call at 0x08AA1608 passes A0=0x20 to sceUmdWaitDriveStat and resumes at 0x08AA1610 without testing V0; evidence: build/generated/p3p_generated.cpp:L_08AA1608/L_08AA1610, .tmp/umd-wait-before.json, .tmp/umd-wait-final-1.json. uOFW calls this bit SCE_UMD_READABLE (references/uofw/include/mediaman.h:55-67); PSPSDK labels the same numeric bit PSP_UMD_READY (psp/pspsdk/src/umd/pspumd.h:46-53).
  • [VERIFIED] The limited host handler succeeds only for mask 0x20 with medium present and activation requested; otherwise it stops explicitly. Full CTest is 11/11; two final event files are identical at SHA-256 E9CBBB420D3549174813B41B762171D4C78E5F0392C6EBA5135386A758044368, reaching missing guest function 0x08A9B934 from 0x08AB29BC. [INFERRED] The existing flags approximate readable status for this PC launch; no physical drive or filesystem mount was verified. See docs/CURRENT_STATE.md for full evidence and limits.

New reference snapshot and oracle research (2026-09-28)

  • [VERIFIED] Seven source snapshots were imported with exact SHAs (registry docs/UPSTREAMS.md, removed on 2026-10-06 when the research sources stopped being tracked; see its git history). The imported directories have no nested .git; upstream license files remain present where supplied. GLASS has an MPL-2.0 notice in references/GLASS/Include/GLASS.h:4-8 but no root license file. The comparative evidence and limits are in docs/REPOSITORIES.md section 2.
  • [VERIFIED] PPSSPP's WebSocket debugger event protocol is implemented in references/ppsspp/Core/Debugger/WebSocket.cpp:30-50; CPU state, breakpoint and memory handlers are under Core/Debugger/WebSocket/. This confirms an API surface, not a successful P3P capture.
  • [UNVERIFIED] The proposed differential oracle has not yet observed original ULUS-10512 execution in PPSSPP. No HLE or runtime conclusion follows from the static API survey alone.
  • [VERIFIED] Research-sprint regression on this HEAD: cmake --build build --config Release --parallel 2, full ctest --test-dir build --output-on-failure (11/11 on rerun), build/p3p_pc_bootstrap.exe --verify-bootstrap (PASS), and two --run-until-blocker --dump-events .tmp/reference-replay-{1,2}.json runs. Both JSON files have SHA-256 33505F22B89F16D42B3EBCA31A2C808A550BA56DC68F0D33E55202BAD9861566; both final blockers are missing sceUmdActivate at 0x08B80124 from 0x08AA15F8 on thread UID 2. An initial sandboxed CTest run could not create a temporary CSV inside workspace .tmp; the full rerun with workspace file access passed. No runtime frontier changed.

UMD callback registration micro-sprint

  • [VERIFIED] Medium presence is explicit per-kernel state, absent by default and present by PC bootstrap configuration. sceUmdCheckMedium returns 0/1 from that state; tests exercise both states and removal. Contract: references/uofw/include/mediaman_user.h:74-79, psp/pspsdk/src/umd/pspumd.h:69-73. Native replay returns 1 to 0x08AA15EC, then stops at missing sceUmdActivate (0x08B80124). Two event traces match SHA-256 33505F22B89F16D42B3EBCA31A2C808A550BA56DC68F0D33E55202BAD9861566; see CURRENT_STATE. Presence does not imply implemented activation/readiness/mounting.

  • [VERIFIED] Registration requires a Callback-type UID; zero/invalid/non-callback return 0x80010016, valid/repeat return zero and retain one registered UID. Primary sources: references/uofw/src/kd/mediaman/mediaman.c:590-607, references/uofw/include/mediaman_user.h:54-62, references/pspautotests/tests/umd/register.expected:1-6. Implementation: core/include/p3p3ds/hle/umd.hpp::UmdState::register_callback; deterministic regression: tests/test_hle_umd.cpp.

  • [VERIFIED] P3P registers owned callback UID 4 at stub 0x08B80114, returns zero and enters guest 0x08AA15DC; next missing service is sceUmdCheckMedium at 0x08B800EC. Two native replays match SHA-256 26DD4607202D819D5516386AD7F4D5E7D73FDB266ED4C469A103A3F40DDEADFB. See CURRENT_STATE for reproduction and limitations; callback delivery and visual output remain unimplemented/unproven.

Status Classification

  • [VERIFIED]: Confirmed against primary source code, executable disassembly, or empirical hardware/runtime test.
  • [INFERRED]: Supported by architectural evidence, but not yet directly measured on target hardware.
  • [UNVERIFIED]: Hypothesis requiring experimental testing.
  • [WRONG]: Refuted claim (kept for historical record to prevent regressions).

1. Game & Executable (Persona 3 Portable ULUS-10512)

[VERIFIED] Automated frontier checkpoint: 17 execution-proven managed seeds, native user execution, stable bootstrap and 10/10 tests. First committed CPU VRAM store: 0x08AB2B38 (0xAE220004) -> 0x04154004, 4 bytes, UID 2. Sources: profiles/p3p/config/frontier_checkpoint.json, platform/pc/main.cpp VRAM observer, GuestMemory::store32; reproduction and hashes in CURRENT_STATE.md. [INFERRED] Allocator/resource metadata; not a verified pixel/frame.

Claim Status Primary Source / Citation Notes
P3P US Product Code is ULUS-10512 [VERIFIED] p3p/p3p-patches/ULUS10512.ini:1 Confirmed as primary target.
PSP User PRX Virtual Base is 0x08804000 [VERIFIED] psp/pspsdk/include/pspkerneltypes.h, recomp/PSP-recompilation-project/README.md:55 Standard base for decrypted game ELFs.
Runtime Entry Point is 0x08804108 (module_start) [VERIFIED] profiles/p3p/game/eboot.elf (header e_entry + base 0x08804000), experiments/p3p-analysis/independent_analysis.json Exact initial execution address.
Total relocations in executable: 178,513 [VERIFIED] recomp/PSPRecomp/src/elf32.cpp:206-296, experiments/p3p-analysis/analyze_elf.py 81,398 R_26, 45,148 R_LO16, 37,395 R_HI16, 14,572 R_32 (0 invalid, 0 unsupported).
Total library import stubs: 221 across 22 libraries [VERIFIED] experiments/p3p-analysis/compare_analysis.py Exact multiset match (Counter / canonical sorted tuples) between independent parser and PSPRecomp for all 221 import tuples.
Recompiled P3P module_start executes on PC [VERIFIED] platform/pc/main.cpp, runtime execution test build/p3p_pc_bootstrap.exe Recompiled C++ code executes guest blocks and branches natively.
Deterministic execution milestone reached [VERIFIED] build/p3p_pc_bootstrap.exe --verify-milestone Starts at 0x08804108, executes SysMemUserForUser::0x35669D4C (sceKernelSetCompiledSdkVersion600_602, SDK 0x06020010), returns to 0x0880413C, executes SysMemUserForUser::0xF77D77CB (sceKernelSetCompilerVersion, version 0x00030306), returns to 0x08804148, branches to out-of-line block 0x08804210, jumps back to 0x08804188, creates thread via ThreadManForUser::0x446D8DE6 (sceKernelCreateThread), starts thread via ThreadManForUser::0xF475845D (sceKernelStartThread), context switches to user_main [UID 2] at 0x0880421C, executes its prologue and initial blocks, and halts on call to uncompiled sub_08B4E6A0 at PC 0x08B4E6A0, $ra=0x08804268.
Control-flow target breakdown: J vs JAL [VERIFIED] experiments/p3p-analysis/analyze_elf.py 21,845 j sites (14,362 targets), 59,553 jal sites (7,698 targets), combined 81,398 sites (21,470 targets).
All .text instructions recognized by baseline decoder [WRONG] Empirical decoder test (psprecomp::decode_allegrex) 912,337 instructions (99.9209%) recognized; 722 instructions (0.0791%) currently unsupported in baseline (madd, break, msub).
Baseline decoder recognizes 99.92% of .text (912,337 / 913,059) [VERIFIED] historical (superseded: now 912,808 lowerable, 251 unsupported, all break; CURRENT_STATE.md) Empirical decoder pass over .text using verify_p3p_decoder Exactly 722 instructions unsupported: 468 madd (fn=0x1C), 251 break (fn=0x0D), 3 msub (fn=0x2E). Sum: 468 + 251 + 3 = 722.
Codegen lowering covers 99.91% of .text (912,275 / 913,059) [VERIFIED] Audit of codegen_main.cpp lowering rules in verify_p3p_decoder 912,275 instructions directly lowerable; 62 decoded instructions (10 vfpu1, 52 vfpu4) hit unlowered generic VFPU stub.
Intro Skip Hook address is 0x002594A4 (li $v0, 6) [VERIFIED] p3p/p3p-patches/ULUS10512.ini:4 Forces title screen state.
Mod Loader path prefix is ms0:/PSP/GAME/P3P/%s at 0x00395EE4 [WRONG] p3p/p3p-patches/ULUS10512.ini:6-9 The four words 0x3A30736D 0x5053502F 0x5033502F 0x0073252F (little-endian) spell ms0:/PSP/P3P/%s, as used by the runners and CURRENT_STATE.md.
Mod Loader path prefix is ms0:/PSP/P3P/%s at 0x00395EE4 [VERIFIED] p3p/p3p-patches/ULUS10512.ini:6-9; platform/pc/main.cpp, platform/3ds/main.cpp Memory string replacement for loose file redirection. The prefix is hardcoded in both runners instead of profiles/p3p/config/ (CLAUDE.md section 8).
Mod Loader search sequence is bind/ -> mod.cpk -> mod1.cpk -> mod2.cpk -> mod3.cpk [VERIFIED] p3p/p3p-patches/ULUS10512.ini:10-24 Verified from community CWCheat table.
P3P event scripts are compiled .bf bytecode, not native MIPS [VERIFIED] tools/Atlus-Script-Tools/Source/AtlusScriptCompiler/, p3p/Persona-3-Portable-Mod-Menu/ModMenu.flow Game engine uses an internal bytecode interpreter.
P3P uses CriWare CPK archives (data.cpk) [WRONG] for the name: ULUS-10512 uses USRDIR/umd0.cpk, umd1.cpk, MEMST.CPK (ISO9660 listing); CPK format itself [VERIFIED] tools/CriFsV2Lib, tools/CriPakTools, UMD file structure Main asset container.
P3P has exactly 21,965 individual functions [INFERRED] experiments/p3p-analysis/p3p_report.json 21,965 are heuristic analyzer seeds (prologue signatures / call targets); actual verified function boundaries require execution-driven discovery.
P3P has no self-modifying code [UNVERIFIED] Static inspection of .text No evidence observed so far; runtime proof across all gameplay states requires live execution tracking.
jal 0 at 0x0880433C is the executed source of the former PC-zero stop [WRONG] Generated-code probes in .tmp/p3p_generated_jal0_probe.cpp; fixed-run trace .tmp/sparse_dispatch_fixed_trace.txt The current path never enters 0x0880432C, 0x08804334, or 0x0880433C.
Runtime 0x0880433C contains an unrelocated literal jal 0 [VERIFIED] profiles/p3p/game/eboot.elf file offset 0x3DC; all 178,513 SHT_PRX_RELOC entries scanned; recomp/PSPRecomp/src/elf32.cpp:206-295 Raw and relocated words are both 0x0C000000; no relocation exists at PRX-relative offset 0x33C.
Sparse generated JR dispatch must select on local_pc [VERIFIED] recomp/PSPRecomp/tools/codegen_main.cpp; .tmp/jal0_probe_trace2.txt; .tmp/sparse_dispatch_fixed_trace.txt Stale ctx.pc repeated the 0x08B1D0B0 epilogue 2,048 times and manufactured PC zero. Selecting local_pc returns once to 0x08AB306C and advances to 0x08B17054.
Execution frontier advances through ten proven guest functions to 0x08B1C594 [VERIFIED] profiles/p3p/config/p3p_functions.csv; build/generated/p3p_generated.cpp; logs/p3p_bootstrap_latest.log; executable disassembly at 0x08AB315C and 0x08B1C594 The final run reaches executable word 0x0E2C7165 (jal 0x08B1C594) at 0x08AB315C with $ra = 0x08AB3164. The target is a distinct, currently unregistered function boundary. Runtime, HLE, and codegen semantics are unchanged; graphics counters remain zero.
P3P is 100% viable for static recompilation [INFERRED] Clean relocation handling + entry point execution milestone Bootstrap and entry point succeed; viability of remaining complex subsystems (VFPU, overlays, indirect jumps) requires incremental verification.
A new PSP thread starts with VFPU source/target prefixes 0xE4 and destination prefix 0 [VERIFIED] pspautotests cpu/vfpu/{callout,convert_scaled,minmax}.expected match exactly only with this initial state (tests/autotest_baseline.txt, 2026-10-08) Before: all-zero vfpu_ctrl, every lane read X on a thread's first prefixed VFPU op.
Russian fan translation is 100% asset-only with no EBOOT patches [UNVERIFIED] Community packaging analysis While scripts (.bmd) and fonts are asset-level, potential EBOOT localization patches (character spacing, glyph width) need empirical testing.

2. PSP Architecture & Emulation

Claim Status Primary Source / Citation Notes
Standard PSP has 32 MiB User RAM + 2 MiB VRAM + 16 KiB Scratchpad [VERIFIED] recomp/PSPRecomp/src/guest_memory.cpp:74-76, references/ppsspp/Core/MemMap.h:20 Fixed physical layout; no TLB page walking.
PSP CPU Allegrex is MIPS32r2 with VFPU coprocessor [VERIFIED] psp/vfpu-docs/README.md, references/ppsspp/Core/MIPS/ VFPU instructions use custom opcodes and prefix registers.
Yakumo successfully statically recompiled all 355 MHP3rd HD overlays [VERIFIED] recomp/Yakumo/README.ru.md:49, recomp/Yakumo/AGENTS.md:7 Proves viability of large-scale PSP static recompilation.
sal063 static recompiler utilizes pure C runtime (src/rt/) [VERIFIED] recomp/PSP-recompilation-project/src/rt/recomp.c Lightweight runtime reference without heavy C++ dependencies.

3. Nintendo 3DS Hardware & Platform

Claim Status Primary Source / Citation Notes
New 3DS CPU clock boost to 804 MHz enabled via osSetSpeedupEnable(true) [VERIFIED] 3ds/libctru/include/3ds/os.h:58 Triples CPU frequency and enables L2 cache.
New 3DS exposes Core 2 to user applications via APT_SetAppCpuTimeLimit [WRONG] 3ds/libctru/libctru/include/3ds/thread.h (threadCreate notes) APT_SetAppCpuTimeLimit allows one thread on Core 1 (system core). Core 2 needs exheader kernel flag 0x2000 or the BASE memory region. The runtime uses no second core yet.
Core 2 is usable by the .3dsx under the Homebrew Launcher [VERIFIED] New 2DS XL, build 7eabbb8 (2026-10-11): start probe core2 ok, parallel x1.98; DaedalusX64-3DS also creates a Core 2 thread (Source/SysCTR/HLEAudio/AudioPluginCTR.cpp) platform/3ds/main.cpp probe_cores; docs/CURRENT_STATE.md, "Hardware: GE on core 2".
Multi-threaded worker thread affinity (Core 0 vs Core 2) yields performance gain [VERIFIED] New 2DS XL, 0.3.0 build 7eabbb8: battle 16-25 fps (0.2.7: 5-7.5 fps), the game's thread waits for the worker 0.0-4.3 % of the time GE back end (not list parsing) on Core 2. Audio on Core 2 not tested yet.
New 3DS has 256 MB FCRAM with 124 MB application mode [VERIFIED] 3ds/libctru/include/3ds/os.h:40 Ample headroom for 34 MB guest arena and recompiled code.
PICA200 texture sampling requires Morton 8x8 tiled layout [VERIFIED] 3ds/citro3d/source/texture.c:12, references/DaedalusX64-3DS/Source/SysCTR/Graphics/NativeTextureCTR.cpp:115 Native GPU sampler layout requirement.
Optimal texture conversion pipeline (CPU swizzle vs C3D display transfer) [UNVERIFIED] Needs citro3d benchmark Must profile texture cache overhead vs GPU display transfer on real hardware.
3DS DSP (ndsp) supports 24 hardware-mixed audio channels [VERIFIED] 3ds/libctru/include/3ds/ndsp/ndsp.h:18 Hardware mixing for music and sound effects.
Recompiled P3P code will fit in New 3DS memory [VERIFIED] Hardware run, CURRENT_STATE.md (2026-10-02) .3dsx on a New 3DS: APPLICATION region 126,976 KiB, heap 71,220 KiB with 60,284 KiB in use (about 10.7 MiB free).
Recompiled P3P will run at 90-100% native speed on New 3DS [WRONG] Hardware and Azahar reports, CURRENT_STATE.md Measured: about 90 % of real time in the field, 18-25 % (hardware, 0.2.7) and 33 % (Azahar, 0.2.8) in the first battle.
PICA200 can maintain 30 FPS for Tartarus 3D dungeons [UNVERIFIED] Needs citro3d benchmark Working hypothesis based on geometry complexity vs DaedalusX64-3DS.

Run logs (logs/, written by tools/run_p3p_trace.sh) and generated AOT code (build/generated/) are not tracked: the logs and evidence cited above are local artifacts of those runs, and generated code is rebuilt from the user's EBOOT.