The dynamic-segment parsers refused a PT_DYNAMIC whose p_filesz is not a
multiple of 16 before reading it. elfldr v0.27 from ps5-payload-dev declares
0x1468 bytes, the tail of its PT_LOAD, with DT_NULL at entry 21; FreeBSD rtld
and glibc stop at DT_NULL and never read p_filesz. Read whole 16-byte entries
within the declared size, stop at DT_NULL, and keep refusing a segment that
ends without one, in the executable reader, the code analysis, the relative
relocation index, the strict NID filter and the guest module reader.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
The Linux patcher sorted the PT_LOAD segments by address but never
checked that their memory ranges are disjoint, while the Windows and
macOS images and guest modules reject overlapping loads. The Linux
output kept both headers, the kernel mapped the later segment over the
earlier one, and the program crashed at start. Adjacent loads whose
ranges overlap now fail with "Overlapping PT_LOAD memory ranges", the
message the other targets use.
The test declared its depth plane alignas(65536). WinLibs GCC 15.2
rejects static objects aligned above 8192 bytes ("requested alignment
'65536' exceeds object file maximum 8192"), so agc_driver_depth_copy_draw
did not build on Windows. The plane is now a 64 KiB aligned span inside
a larger array, as #8310 does for the array window test, and the test
checks the alignment.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A draw with DB_RENDER_CONTROL.DEPTH_COPY ran as a compute pass over the
whole surface, chosen when the viewport and scissor covered it. It now
runs as the title's own draw: the precheck rewrites the draw's registers
to bind no depth target and a driver-authored guest pixel program, then
draws it through the normal path. The program reads POS_FIXED_PT, loads
one sample of the Z_32_FLOAT plane through a T# built from the DB
registers (DepthCopySourceWords), and exports it to color target 0 as
32_R, so only the pixels the draw covers are written, and the normal draw
path orders it after the draws that rendered the plane.
- The plane is decoded by decodeDepthPlane, factored out of decodeDepth,
so its address, pipe-bank XOR and slice match the registered surface.
- Two programs, one per source kind: image_load 2D_MSAA with the sample in
s8, and image_load 2D. They are published with the null pixel program
and prepared at use.
- A multisampled plane is read from its host image or sample shadow
without the guest-memory import checks of native multisample sampling,
inside a DepthCopySourceScope opened by Graphics::Draw for draws whose
decode found the multisampled copy program (State::depthCopySource).
- The compute pass, its shader and the CopySample path are removed.
- A new execution test draws depth over a triangle, copies it with the
same triangle and compares the covered texels with a reference draw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The unchecked release passed its whole range to ForgetDirectMemory,
which throws on any page that is not allocated, so releasing a range
that is partly or wholly free aborted the process. Release only the
allocated runs, as shadPS4's unchecked free does; the checked variant
still returns ENOENT for them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The table searched all 255 candidates for each inverse, which exceeds the
constexpr step limit of AppleClang. The inverse is now computed as x^254 in
GF(2^8), which gives the same table.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
LocaleSupport.cpp: keep this branch's console class masks for the ctype
classifiers and main's new isascii and toascii.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
munmap failed with EINVAL for an address that is not page aligned.
FreeBSD 11's sys_munmap rejects only a zero length and an address wrap;
it moves the address down to its page and grows the length by the same
offset before rounding it up, so the pages the range touches are
unmapped.
