PPSA14632 (Unreal Engine) writes sceAgcCbBranch(mode 1, compare
function 0, mask 0, reference 0) with a then buffer and a null else
buffer of 0 dwords. It leaves the compare address uninitialised, so it
is sometimes only 4-byte aligned. The writer rejected the null else
buffer and the misaligned compare address, and the driver accepted
opcode 0x3f only as the 4-dword INDIRECT_BUFFER, so the 14-dword branch
would have failed at submission.
sceAgcCbBranch no longer checks the compare address of an always-pass
branch, which reads nothing, or the address of a buffer of 0 dwords.
The driver runs the first buffer of an always-pass COND_INDIRECT_BUFFER
in modes 1 and 2 (if-then and if-then-else) in place of the packet. A
comparison, a predicated branch and other modes throw.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sceAgcBranchPatchSetCompareAddress, sceAgcBranchPatchSetThenTarget and
sceAgcBranchPatchSetElseTarget rewrite the compare address and the two
buffer targets of the packet sceAgcCbBranch emits. The then target is
the first buffer and the else target the second, as in AMD's
COND_INDIRECT_BUFFER packet. The cache policy bits are kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Chad
alfalfa-star
DotDebian