Use representable viewport endpoints only when the draw has no depth attachment and its pixel shader does not read PositionZ. Preserve XY coverage, clip-space mode, depth clamping, and validation of non-finite inputs.
Balatro (PPSA21402) reaches rendering on Apple M1 with MoltenVK after this change instead of stopping at VK_EXT_depth_range_unrestricted. Depth-dependent draws retain their original behavior.
The range starts at 0x10_0000_0000 on macOS 26.5 and at 0xF_C000_0000 on
macOS 27. The M2 Max on macOS 27.2 shows the same start as the M4 Pro on
27.0.1, so the line lists the macOS version first and the chips only as
the machines it was measured on.
agc_driver_flip_stores_small_results waits 2 s for the flip and the
stored texels. That window also holds the driver's start and the
compute program's compilation at dispatch, so on a loaded host the
flip arrives late and the test reports that it did not reach the GPU.
Wait 10 s, as the other execution tests do.
WindowsTlsBuilder allocated the whole TLS block and thread control block
for .gtls, so a large p_memsz cost that much memory even though only the
p_filesz template is written. Store the template and reserve the rest as
the section's virtual size; the TLS directory still covers the whole
block, which the loader copies from the zeroed image.
PPSA15552 passes matching front/up after a listener move; pick a perpendicular up hint instead of throwing so Dead Cells can keep running.
Co-authored-by: Cursor <[email protected]>
Titles that import libSceNpTus failed to load because the library did
not exist. Title contexts and requests are tracked, arguments are
validated, and every storage operation completes as signed out, matching
how libSceNpManager reports PSN.
Since #7323 sceHmd2Initialize succeeds and sceHmd2Open returns a handle,
so PPSA01317 runs its PS VR2 set-up and aborts on
sceHmd2ReprojectionQueryBufferSizeAlign, which is not implemented
(reported in #6350). AnyPS5 has no PS VR2 or PC VR support, so
initialization returns libSceHmd's UNSUPPORTED_FEATURE (0x81110016)
again, as before #7323, and titles skip their VR set-up. sceHmd2Open
then returns NotInitialized. The reprojection size queries stay
unimplemented.
Refs #6350
RADV initializes and fast-clears DCC keys with its fill_memory compute
kernel, which stores through a global address. Run as an ordinary
dispatch, its stores name no range. The DCC key tracking therefore saw
a key fill only once it had landed in guest memory, which could be
after later writes to the surface had already been recorded.
vkQuake (PPSA99010) hits this on every item pickup:
- the scene renders into a second color buffer;
- RADV's UNDEFINED -> GENERAL barrier fills color buffer 0's keys with
DCC_CLEAR_0000;
- a screen-effects compute pass writes color buffer 0;
- the UI pass draws on color buffer 0.
The keys landed while the UI pass was being recorded. The refresh took
them for a clear made after the compute pass, dropped its results and
cleared the image to black. For the length of the pickup flash the
scene was black, with only the HUD drawn.
The fill HLE now matches the 16-byte variant of the kernel as a fill of
min(threads * 16, user[4] + 16) bytes. The kernel takes its address in
user[2..3], its largest store offset in user[4] and its value in
user[5]. A key fill through it is handled where it is in the command
stream.
In a payload process on a PS5 (firmware 12.70), the strtod and wcstod
of libSceLibcInternal.sprx keep the payload of a NAN(...) sequence,
read as FreeBSD 11's gdtoa hexnan reads it, under the quiet bit and
with the sign. strtof, wcstof, strtold and wcstold return the positive
default quiet NaN whatever the sign and the sequence, and consume a
sequence of letters, digits and underscores up to its closing
parenthesis. Here every NaN lost its payload, and strtof and strtold
kept the sign.
The model reproduces the 64 NaN inputs that p11, p14, p27 and p33
measured, including blanks and other characters inside the parentheses
and unterminated sequences, and the test now pins them. It also pins
two p71 cases measured through strtod: nan(1 2), and "nan( " followed
by NUL and ")". In hexnan, a blank after a payload digit, while a
32-bit word of the payload is still free, starts a blank skip that has
no NUL check, so when only blanks follow up to the terminating NUL the
console reads past it (p71); that case throws here. A blank right after
"nan(" is skipped with a NUL check, and the console stopped at the NUL
there.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FlushPending moves the overlapping images from the pending list to the
flushing list and stores them under the GPU mutex. A FlushPending or a
flush hook on another thread for the same range found nothing pending and
returned while the store was still running, so the host read saw guest
memory before the store; the queue-idle store hits this with any host read.
When an overlapping image is being stored and this thread does not hold
the GPU mutex, take it and check again until no overlapping image is left
being stored, and report the range as stored so the hook syncs the
recorded store.
Fixes#7744
Every unverified point of the libSceSsl debt entry was measured on a PS5 on
system software 13.40 with a ps5-payload-dev payload against a TLS 1.2 test
server presenting leaves issued by the test fixture root. The code follows the
console where it differed: initial verify options 0x25 with the date checks
off, bits outside 0x3F rejected, the verify callback called with the context
id and the bitmask of failed checks and re-run from every later call after a
negative return, sceSslRead flags 0 reading until the requested length,
streams that end without close_notify reading as 0, resets reported with the
libSceNet codes, receive timeouts as SSL_ERROR_WANT_POLLIN, a fatal alert
ending the transport, sceSslClose as a repeatable no-op before the handshake,
read and write before connect running the handshake, SSL_ERROR_INVALID_ID for
unknown or deleted handles and terminated contexts, sceSslSetMinSslVersion
accepting 2 to 5, an empty ALPN list rejected, long attribute names from
sceSslGetNameEntryInfo and sceSslGetSerialNumber leaving the caller's length.
The debt entries record the measured values and what stays unmeasured.
Adrià Franch