Repository navigation
feat(agc): run COND_INDIRECT_BUFFER branches whose comparison always passes - #898
Merged
adriadam10 merged 1 commit intoOct 7, 2026
Merged
Conversation
…passes PPSA14632 (Unreal Engine) writes sceAgcCbBranch(mode 1, compare function 0, mask 0, reference 0) with a then buffer and a null else buffer of 0 dwords. It leaves the compare address uninitialised, so it is sometimes only 4-byte aligned. The writer rejected the null else buffer and the misaligned compare address, and the driver accepted opcode 0x3f only as the 4-dword INDIRECT_BUFFER, so the 14-dword branch would have failed at submission. sceAgcCbBranch no longer checks the compare address of an always-pass branch, which reads nothing, or the address of a buffer of 0 dwords. The driver runs the first buffer of an always-pass COND_INDIRECT_BUFFER in modes 1 and 2 (if-then and if-then-else) in place of the packet. A comparison, a predicated branch and other modes throw. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9 tasks done
9 tasks done
Collaborator
|
Checked the packet layout, modes 1/2 and compare function 0 against AMD's |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Run
COND_INDIRECT_BUFFERbranches whose comparison always passes, and stopsceAgcCbBranchfrom rejecting fields that such a branch never reads.PPSA14632 (LEGO Horizon Adventures, Unreal Engine) calls
sceAgcCbBranch(cb, mode 1, compare function 0, compareAddress, mask 0, reference 0, 0, then, n, 0, nullptr, 0)from one place (eboot 0x5084ea4, through a wrapper at 0x50ff640). The caller never setsrcx, so the compare address is whatever the register holds: it was 0x300d5f4ac8 in one run and 0x300d5f4e84 (only 4-byte aligned) in another. Onmain:sceAgcCbBranch: null or misaligned address 0x0for the null else buffer, and, once that is relaxed, for the misaligned compare address.INDIRECT_BUFFER(invalid INDIRECT_BUFFER size), so the 14-dword branch would fail at submission.Changes:
sceAgcCbBranchchecks the compare address only when the compare function is not 0 (always), and a buffer address only when its size is not 0. The packet is written as before.copySegmentruns the first buffer of an always-passCOND_INDIRECT_BUFFERin modes 1 and 2 in place of the packet, as it does for a non-chainedINDIRECT_BUFFER. Modes 1 and 2 are assumed to be AMD's if-then and if-then-else. A real comparison, a predicated branch and other modes throw. A comparison would have to read memory that earlier packets of the queue may still write, so it is left for a title that needs it.TechnicalDebt lists both.
Tested
agc_branch_patch_tests: an always-pass branch with an unaligned compare address and a null else buffer of 0 dwords, and an empty branch, are written; a comparison with a misaligned address, or a null buffer with a size, still throws without advancing the buffer. Fails onmain.agc_driver_pm4: an always-pass if-then and if-then-else run only the first buffer, an empty branch skips to the next packet, and a comparison or mode 0 rejects the whole submission. Fails onmainwithinvalid INDIRECT_BUFFER size.storage image access to depth/stencil surface ... is not implemented, which feat(agc): depth planes sampled as 2D arrays, cubes and integer views #425 may address.Checklist
main; no other open PR implements the same functionsNotImplemented_nid_no_patch); silent stubs are listed in TechnicalDebt.mdfiles or images added to the repository (attach them to this PR)🤖 Generated with Claude Code