The initial import of a native multisampled depth target only proceeds
when every HTILE word proves the same clear value, so no compressed Z
planes are read from guest memory. ITERATE_256 only changes how the DB
and the texture unit walk compressed MSAA Z planes (Mesa
ac_descriptors.c: "TC-compatible MSAA HTILE requires ITERATE_256").
The HTILE footprint (Addrlib) and the HTILE clear words (Mesa
radv_get_htile_fast_clear_value) do not depend on it. The import no
longer requires it; the texture's ITERATE_256 must still match the
target's.
Unblocks PPSA27836 (Onimusha: Way of the Sword), which samples a
four-sample D32 target with pipe-aligned HTILE and ITERATE_256 off.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In PS4 executables and modules the bytes between unwind functions are
16-byte slots of function tails and padding, and a tail can begin inside
an instruction, such as a lone REX byte before a 15-byte NOP. The
syscall and call-site scans decode the executable segment linearly, so
such a slot failed the relink with "Cannot decode instruction".
For images with a PT_SCE_DYNLIBDATA segment the scans now receive the
unwind function ranges. Outside every range an undecodable byte is
skipped and decoding resumes at the next byte, and a decoding that would
cross into a range ends at its start, so gap bytes cannot change how a
function is decoded. Inside a range a decode failure still fails the
relink, and images without unwind ranges are scanned as before.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Resolves MultisampleTarget against #6635: the sampled view takes the requested view type and keeps the sampled-only usage when the target has a storage view for the guest's sample order.
In a payload process on a PS5 (firmware 12.70), I386_GET_FSBASE (7) and
I386_GET_GSBASE (9) wrote 4 bytes, the low 32 bits of the FS and GS
bases, and failed with EFAULT for a null argument; both threw here. On
Linux x86-64 hosts they now do the same.
The nine operation numbers tried that FreeBSD 11's amd64 sysarch has no
case for (2, 5, 6, 12, 127, 133, 134, 1000 and -1), each with a null
argument, failed with EINVAL there, as its default case does, and threw
here. Every such number now returns EINVAL on every host.
Threads made with pthread_create and scePthreadCreate started with their
creator's GS base there; the test now checks that a guest thread does so
on Linux. The sysarch debt entry records these measurements and what
AMD64_GET_XFPUSTATE and I386_GET_XFPUSTATE returned there; both still
throw here.
reachingWriter followed only fall-through and direct branches, so a V#
load on a path that reaches the loop through an s_setpc_b64 jump the
control flow analysis resolves was not seen, and another load could be
taken as the only writer. The walk now follows those jumps. It also
fails at s_call_b64 targets, whose callers it does not follow, instead
of walking from a function entry into the code above it.
Co-Authored-By: Claude <[email protected]>
The four guest_arena tests still pass with the mach_vm_region walk
disabled, because TryReserve marks every 1 GiB chunk it cannot reserve
as occupied. guest_arena_gap reads the host map before the arena
reserves its range and requires a fixed guest mapping in free space
that shares a chunk with a host region to be accepted.
The debt entry also records that on macOS 27.0.1 (M4 Pro) the
unmappable range starts at 0xF_C000_0000.
#7527's selected-record limit test reads a record's descriptor words through the
table snapshot's shared words list; this branch keeps a snapshot's words per column,
so the test reads them from its column instead.
