The SDWA source extract and destination insert are applied independently in Translate.cpp, so a partial destination can combine with any source selector (PPSA10595 uses v_not_b32 v28.word0, v8.word1 with UNUSED_PRESERVE). The CFG test now covers that form instead of rejecting it.
Raise ShaderInfo::MaxBuffers from 32 to 64 for PPSA10595's compute shader 0x861b5c2f3b868f59; nothing else sizes or packs buffer indices to 32.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Jump tables usually sit in a read-only data segment, but the resolver
only accepted tables inside the executable segment being patched. Every
function with a switch was treated as having an unknown indirect branch,
which disables neighbour relocation, so its short memory instructions
stayed unprotected: 178406 of 520371 in PPSA10595's eboot.bin, including
the zstd decoder stores whose handled GPU-tracking faults wiped its red
zone. Accept tables anywhere in the loaded module once readable.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
sceKernelRaiseException delivers SIGUSR1 as a Windows special user APC.
Windows builds the APC frame directly below the interrupted RSP, which
overwrites live red-zone locals of SysV leaf functions. PPSA10595 (UE5)
signals worker threads while they run a zstd Huffman decoder whose
tableLog slot sits below RSP; the slot came back as zero and the decoder
faulted on a wild table index.
Suspend the target before queuing the APC and, when it is in guest code,
move RSP below the red zone with RIP parked on a "ret 0x80" stub that
restores it in one instruction. The APC handler unparks the context
first, so the guest handler sees and resumes at the real RIP/RSP.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Frame-pointer leaf functions address red-zone locals through RBP below
RSP (e.g. [rbp-0x108] with rsp = rbp-0xc8). The patcher only modeled
RSP-relative operands, so such functions were left unprotected and a
handled access fault overwrote their locals (PPSA10595 crash in a
decompressor on Background Worker #2).
Track RBP - RSP through the CFG, translate frame-relative operands into
the red-zone model, resolve mov rsp,rbp / lea rsp,[rbp+k] / leave deltas,
and fall back to conservative protection when the offset is unknown.
Also follow resolved jump-table successors in the liveness pass.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Hamza ShakirandClaude Opus 5.5