sceVideoOutGetOutputStatus derived resolution from the size of the
registered buffers, so a title that reads it right after sceVideoOutOpen
got 1 (1080p) whatever the display. In a payload process on a PS5
(firmware 12.70), with no buffer registered, the field changed with the
console's resolution setting: 2 with it on Automatic on a 4K display, 1
with it set to 1080p. Read it from the display mode SDL reports for the
window's display, next to the refresh rate, and keep it independent of
the registered buffers.
After sceNetInit, the console's sceNetUsleep prints
"[LIBNET] usleep <count>" to standard output for a negative count
before failing with EINVAL, as a payload measured on firmware 13.60
(#9076). AnyPS5 failed without printing it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On a discrete GPU a write-only V# element whose stride is wider than the
widest buffer store (16 bytes) and that a direct dispatch sweeps is staged
in a device-local shadow of up to 256 MiB, as read and written swept
elements are. Its stores no longer cross the bus into the host import.
AI-assisted. Tested by me on my own machine.
sceVrTracker2Initialize follows the order read from firmware 13.60
libSceVrTracker2.sprx (disassembly, not measured on a console). It
rejects with 0x8A740006, in order: a null record or a size other than
72; a mode other than 0, 1000 or 1001; a null work memory; a size below
the mode's 32 MiB, 7 MiB or 3 MiB; an alignment below 0x10000; a
non-zero reserved byte at 0x3a..0x47; a thread priority outside
256..767; an affinity mask outside bits 0..12 in mode 0 or outside
0xEA00 in modes 1000 and 1001. It then moves the module state from 0 to
1 and returns 0x8A740002 if it was not 0.
From there every failure undoes what the call opened and resets the
state to 0. Mode 0 clears the first 32 MiB of work memory first. The
application attribute checks on the sceKernelGetAppInfo2 record
(0x8A74001E, 0x8A740020) are skipped: the host has none, and a zeroed
record passes them. The signed option at 0x39 accepts -1 and 0,
and 1 only for titles compiled with SDK 7.00 or later. Modes 0 and 1000
then call libSceHmd2 TrackingOpen, TrackingStart, LedDetectorOpen and
LedDetectorStart and return the first non-zero result unchanged.
Without a headset main's libSceHmd2 answers 0 and -1 (its measured
pre-initialization answers), so Initialize returns -1 and every other
export keeps answering 0x8A740001.
Modes 1000 and 1001 need the application category, which the host does
not have, and a fully successful Hmd2 sequence would need the tracker
runtime; both throw. The eight tracking and LED-detector exports become
named functions in libSceHmd2 so that libSceVrTracker2 can import them
by name; their answers are unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A draw with DB_RENDER_CONTROL.DEPTH_COPY ran as a compute pass over the
whole surface, chosen when the viewport and scissor covered it. It now
runs as the title's own draw: the precheck rewrites the draw's registers
to bind no depth target and a driver-authored guest pixel program, then
draws it through the normal path. The program reads POS_FIXED_PT, loads
one sample of the Z_32_FLOAT plane through a T# built from the DB
registers (DepthCopySourceWords), and exports it to color target 0 as
32_R, so only the pixels the draw covers are written, and the normal draw
path orders it after the draws that rendered the plane.
- The plane is decoded by decodeDepthPlane, factored out of decodeDepth,
so its address, pipe-bank XOR and slice match the registered surface.
- Two programs, one per source kind: image_load 2D_MSAA with the sample in
s8, and image_load 2D. They are published with the null pixel program
and prepared at use.
- A multisampled plane is read from its host image or sample shadow
without the guest-memory import checks of native multisample sampling,
inside a DepthCopySourceScope opened by Graphics::Draw for draws whose
decode found the multisampled copy program (State::depthCopySource).
- The compute pass, its shader and the CopySample path are removed.
- A new execution test draws depth over a triangle, copies it with the
same triangle and compares the covered texels with a reference draw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The unchecked release passed its whole range to ForgetDirectMemory,
which throws on any page that is not allocated, so releasing a range
that is partly or wholly free aborted the process. Release only the
allocated runs, as shadPS4's unchecked free does; the checked variant
still returns ENOENT for them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Adrià