Three interrupt delivery bugs fixed that were blocking shell progression: 1. RFE after handler exit: The exception handler's normal exit path (jmpbuf longjmp at 0xBFC10944) does not execute RFE. In our model the handler returns to psx_check_interrupts, not to the WaitEvent caller. Without RFE, IEc stays 0 forever after the first interrupt. Fix: apply RFE in psx_check_interrupts if IEc is still 0 after the handler returns. 2. GPR save/restore around handler dispatch: The handler's jmpbuf exit restores callee-saved registers from the kernel jmpbuf (intended for a non-local jump to WaitEvent's caller). In our model this corrupts the interrupted code's registers. Fix: save all GPRs before handler dispatch and restore them after, matching real hardware where the interrupted code's registers are preserved via TCB save/restore. 3. VBlank tick gated on !in_exception: The handler runs thousands of block leaders, each calling psx_check_interrupts. Without gating, dispatch_count advances inside the handler, firing new VBlanks that stack up and starve the main code. Fix: only increment dispatch_count and fire VBlank/timer ticks when not in exception handling. 4. DMA IRQ edge-triggered: update_master_irq() was level-triggered, re-asserting i_stat bit 3 on every call while master_flag=1. Combined with no BIOS callback to acknowledge DMA IRQs, this caused an interrupt storm. Fix: edge-detect master_flag 0->1 transition, and suppress DMA completion IRQs entirely since transfers are synchronous. Also adds GPU debug diagnostics: GP0 command counters (nop/fill/draw/ env/copy), draw area/offset in gpu_state, vram_peek debug command. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Current Milestone
The authoritative milestone document is FIRST_MILESTONE.md.
The authoritative phase plan is PLAN.md, Phase 1 section.
- Phase 1a — Boot Slice: COMPLETE (2026-04-06). Reset-vector slice
0xBFC00000..0xBFC00074, 30 instructions, terminating atj 0xBFC00150.generated/boot_slice.c,generated/boot_slice_manifest.json, and an emptygenerated/unsupported_ops.jsonare the proof artifacts. Do not redo. Do not extend. - Phase 1b — Instruction Coverage: NEXT. Every R3000A opcode the
BIOS uses must have a real implementation in
strict_translator, withgenerated/instruction_inventory.jsonandgenerated/instruction_coverage.jsonas proof. - Phase 1c — Function Discovery Pipeline: after 1b. Bounded walk
from explicit seed file, producing
function_manifest.json,function_edges.json,discovery_run.log.json. - Phase 1d — Indirect Control Flow Recording: after 1c. Records,
does not resolve. Produces
indirect_jumps.jsonand the Ghidra cross-reference. - Phase 1e — Relocation Planning (HARD GATE): after 1d. Produces
relocation_proofs/,address_aliases.json,normalization_rule.md. Full BIOS recompilation is forbidden until 1e is complete.
See PLAN.md → "Phase 1 — Controlled Recompiler Bring-up" for
required artifacts, failure conditions, and acceptance criteria per
sub-phase.
Non-Goals (Current Phase)
The following are explicitly out of scope for the entire Phase 1 window. Touching any of them is architectural drift and is not permitted regardless of how convenient it would be:
- No runtime. There is no
runtime/directory in v4 yet, and Phase 1 does not create one. - No MMIO. No
psx_mmio_read_*/psx_mmio_write_*entry points.generated/cpu_state.hstays compile-only. - No GPU. No GP0, no GP1, no software rasterizer, no VRAM.
- No interrupts. No I_STAT, no I_MASK, no COP0 IRQ delivery
hooks. (
mtc0/mfc0/rfeare translated as instructions in Phase 1b — they are not wired to any runtime delivery path.) - No DMA, no timers, no SIO, no memcard, no CD-ROM, no SPU.
- No full BIOS recompilation. Bounded walks only until Phase 1e closes.
- No game loading. No PS-X EXE ingestion. No ISO. No Tomba. The game side does not exist in v4 until Phase 5.
- No BIOS interpreter. Not as a fallback, not as a "temporary" bridge, not for "code we couldn't recompile yet".
- No HLE BIOS functions. No
bios.c, no A0/B0/C0 reimplementation in C. The recompiled BIOS is the BIOS.
Definition of Done (Current Phase)
Phase 1a (already met):
generated/boot_slice.ccompiles cleanly with-c.generated/boot_slice_manifest.jsonis complete.generated/unsupported_ops.jsonis empty.- Every instruction in the slice is accounted for in the manifest.
- No TODO / FIXME / XXX in any generated file.
Phase 1 as a whole (the gate that unlocks Phase 2):
- All Phase 1a artifacts above continue to regenerate identically.
generated/instruction_inventory.jsonandgenerated/instruction_coverage.jsonexist and show every BIOS-used opcode implemented instrict_translator.generated/function_manifest.json,generated/function_edges.json, andgenerated/discovery_run.log.jsonexist from a normalized Phase 1c re-run, with no duplicate functions under any normalized address.generated/indirect_jumps.json,generated/indirect_jump_classes.json, andgenerated/indirect_jump_ghidra_xref.jsonexist and cover every indirect jump site in every discovered function.generated/relocation_proofs/exists with one subdirectory per proven ROM→RAM copy operation, each containing both Ghidra and DuckStation evidence.generated/address_aliases.jsonandgenerated/normalization_rule.mdexist and are mechanically derived fromrelocation_proofs/.generated/unsupported_ops.jsonis still empty.- Nothing under
generated/was hand-edited.
PSXRecomp v4
A static MIPS-to-C recompiler for the PlayStation BIOS, with PS1 games as a follow-on layer. The BIOS runs as native compiled C, not as interpreted MIPS bytes.
This is a clean-slate restart after three failed prior attempts (v1, v2,
v3) all collapsed into emulator-with-HLE shape instead of true static
recompilation. See PLAN.md for the full background, the
architectural decision, the salvage list, the phase plan, and the open
questions we want outside review on.
Layout
psxrecomp-v4/
├── PLAN.md the document, hand to outside reviewers
├── CLAUDE.md rules for in-session work (Architecture A locked in)
├── README.md this file
├── bios/
│ └── SCPH1001.BIN the recompilation target, 524288 bytes
├── duckstation/ modified DuckStation, used as runtime oracle
└── recompiler/ MIPS->C translator, salvaged from v3
├── src/
├── include/
├── lib/ rabbitizer, fmt, toml11
└── CMakeLists.txt
The runtime is intentionally absent at this stage — it will be built up
fresh in Phase 2 once the recompiler can ingest the BIOS ROM and emit
SCPH1001_full.c.