Skip to content

feat(libSceVideoOut): answer seven inventory calls as firmware 13.42 does - #14941

Merged
oneandonlydean merged 2 commits into
boykopovar:mainfrom
BunnyFl:feat/videoout-fw1342-constants
Nov 5, 2026
Merged

oneandonlydean merged 2 commits into
boykopovar:mainfrom
BunnyFl:feat/videoout-fw1342-constants

Conversation

@BunnyFl

@BunnyFl BunnyFl commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

What

Seven throwing inventory exports in libSceVideoOut/InventoryExports.cpp now return what firmware 13.42's libSceVideoOut returns:

Export NID Firmware 13.42
sceVideoOutAddBufferHdrPrivilege VAlir52gpQI returns 0
sceVideoOutRazorRecallCallbacks hGcTks-qqIU returns 0
sceVideoOutSysUpdateRenderingMode 4G37EIMMD+Q returns 0
sceVideoOutCurveSamplePointsCalc_ kazBRXPqR7c returns 0x8029001C
sceVideoOutDriverGetLatestEopHandle GL8+3RHW5vk returns 0x802900FF
sceVideoOutSysGetMonitorInfo_ vMLWuJckGv0 returns -1
sceVideoOutSysModeIsVr QEiuHxjungc returns bit 1 of the dword at offset 0x20 of its first argument

Each export is a defined entry in the module's dynamic symbol table, and each body is a single path with no calls, syscalls or globals. Read to the return, disassembly only, not measured on a console. sceVideoOutSysModeIsVr gains a const void* parameter, since the code reads through rdi. The other parameter lists stay as they were, because the code reads no arguments.

The seven rows leave the inventory table in docs/dev/debt/libSceVideoOut.md, and a new entry records what stays unverified (parameter lists, and the layout of the structure sceVideoOutSysModeIsVr reads apart from that dword). sceVideoOutDebugAddVrrPrivilege, which sets a module flag, is left throwing. The debt entry also records that sceVideoOutSysModeIsVr does not check its pointer.

Source: firmware 13.42 libSceVideoOut.sprx (sha256 975b229324655a2d2a945c755fc0339e7feecb62863efc28ad3b2d91a95ad215). Each NID is a defined entry at the address shown, and these are the complete bodies, each a single path:

0x06730 sceVideoOutAddBufferHdrPrivilege (VAlir52gpQI)     xor eax, eax ; ret
0x1abb0 sceVideoOutRazorRecallCallbacks (hGcTks-qqIU)      xor eax, eax ; ret
0x07220 sceVideoOutSysUpdateRenderingMode (4G37EIMMD+Q)    xor eax, eax ; ret
0x05c10 sceVideoOutCurveSamplePointsCalc_ (kazBRXPqR7c)    mov eax, 0x8029001c ; ret
0x13be0 sceVideoOutDriverGetLatestEopHandle (GL8+3RHW5vk)  mov eax, 0x802900ff ; ret
0x14730 sceVideoOutSysGetMonitorInfo_ (vMLWuJckGv0)        mov eax, 0xffffffff ; ret
0x17250 sceVideoOutSysModeIsVr (QEiuHxjungc)               mov eax, 0x101 ; bextr eax, dword [rdi+0x20], eax ; ret

The six constant returns read no argument register and write no memory. sceVideoOutSysModeIsVr has no check or branch before the load: bextr with control 0x101 (start 1, length 1) extracts bit 1 of the 32-bit value at rdi+0x20. A null argument therefore faults in the module as well.

Tested

Windows 11, WinLibs GCC 15.2.0 r7, Release, on upstream/main 93dbd0f:

Checklist

  • Based on current main; no other open PR implements the same functions
  • One topic per PR; follow-ups go in a new PR
  • No comments in code except technical debt
  • Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
  • No notes, investigation .md files or images added to the repository (attach them to this PR)
  • New third-party code is a submodule built from source
  • Generic behaviour, not specific to one title
  • Depends on: none
  • Fixes: none
  • Unblocks: none
  • GPUs tested: AMD Radeon RX 9070 XT, driver 32.0.32015.7029, Windows 11
  • AI-assisted: yes

🤖 Generated with Claude Code

…does

sceVideoOutAddBufferHdrPrivilege, sceVideoOutRazorRecallCallbacks and
sceVideoOutSysUpdateRenderingMode return 0, sceVideoOutCurveSamplePointsCalc_
returns 0x8029001C, sceVideoOutDriverGetLatestEopHandle 0x802900FF and
sceVideoOutSysGetMonitorInfo_ -1, and sceVideoOutSysModeIsVr returns bit 1 of
the dword at offset 0x20 of its argument, as firmware 13.42's libSceVideoOut
does (read to the return, disassembly only, not measured on a console).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Progress report (be24202 → 072371a)

📈 System libraries: 26.35% (+0.02%, +7 implemented functions)

✅ 7 implemented
Library Name
libSceVideoOut sceVideoOutAddBufferHdrPrivilege
libSceVideoOut sceVideoOutCurveSamplePointsCalc_
libSceVideoOut sceVideoOutDriverGetLatestEopHandle
libSceVideoOut sceVideoOutRazorRecallCallbacks
libSceVideoOut sceVideoOutSysGetMonitorInfo_
libSceVideoOut sceVideoOutSysModeIsVr
libSceVideoOut sceVideoOutSysUpdateRenderingMode
⚪ 6 behaviourally empty (constant return or throw)
Library Name
libSceVideoOut sceVideoOutAddBufferHdrPrivilege
libSceVideoOut sceVideoOutCurveSamplePointsCalc_
libSceVideoOut sceVideoOutDriverGetLatestEopHandle
libSceVideoOut sceVideoOutRazorRecallCallbacks
libSceVideoOut sceVideoOutSysGetMonitorInfo_
libSceVideoOut sceVideoOutSysUpdateRenderingMode

Changed libraries (implemented exports)

Library Before After Change
libSceVideoOut 55/253 (21.74%) 62/253 (24.51%) +2.77%

@oneandonlydean

Copy link
Copy Markdown
Collaborator

Thanks for this. The answers and the QEiuHxjungc bit test read consistently with the PR description; one evidence request and one small point.

At 50327e7c8c58014c0f549739963bd523d656e79a, could you add the short firmware instruction excerpts for these seven NIDs, with their entry addresses and the return path? docs/dev/REVERSE_ENGINEERING.md:78 asks for the observations and supporting instructions. The PR table and docs/dev/debt/libSceVideoOut.md:239 describe the answers, but do not include those excerpts.

For the six constant-return exports, please show the instructions establishing the return value and absence of argument checks or output writes. For sceVideoOutSysModeIsVr (QEiuHxjungc), please show the load width, offset, bit extraction and return, including any pointer validation or branches before the load. This would let us check core/libs/prx/libSceVideoOut/InventoryExports.cpp:471 against the module rather than against the same stated contract. The existing disclosure that this is disassembly only, with other parameter/layout details unverified, is useful and should remain.

Small point: sceVideoOutSysModeIsVr reads its argument without a null check, so a null pointer crashes the host where the console would return or fault. If the excerpt shows the module doesn't check either, a line in the debt entry saying so would be enough.

…ck its pointer

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@BunnyFl

BunnyFl commented Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

@oneandonlydean Thanks. I've added the excerpts to the description, and they're here too:

Source: firmware 13.42 libSceVideoOut.sprx (sha256 975b229324655a2d2a945c755fc0339e7feecb62863efc28ad3b2d91a95ad215). Each NID is a defined entry at the address shown, and these are the complete bodies, each a single path:

0x06730 sceVideoOutAddBufferHdrPrivilege (VAlir52gpQI)     xor eax, eax ; ret
0x1abb0 sceVideoOutRazorRecallCallbacks (hGcTks-qqIU)      xor eax, eax ; ret
0x07220 sceVideoOutSysUpdateRenderingMode (4G37EIMMD+Q)    xor eax, eax ; ret
0x05c10 sceVideoOutCurveSamplePointsCalc_ (kazBRXPqR7c)    mov eax, 0x8029001c ; ret
0x13be0 sceVideoOutDriverGetLatestEopHandle (GL8+3RHW5vk)  mov eax, 0x802900ff ; ret
0x14730 sceVideoOutSysGetMonitorInfo_ (vMLWuJckGv0)        mov eax, 0xffffffff ; ret
0x17250 sceVideoOutSysModeIsVr (QEiuHxjungc)               mov eax, 0x101 ; bextr eax, dword [rdi+0x20], eax ; ret

The six constant returns read no argument register and write no memory. sceVideoOutSysModeIsVr has no check or branch before the load: bextr with control 0x101 (start 1, length 1) extracts bit 1 of the 32-bit value at rdi+0x20. A null argument therefore faults in the module as well.

On the null pointer: as the excerpt shows, the module doesn't check it either. 072371afe9 adds that to the debt entry.

@github-actions

github-actions Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request Shared files not compared
PR 4040 docs/dev/debt/libSceVideoOut.md
PR 5021 core/libs/prx/libSceVideoOut/CMakeLists.txt
PR 6977 docs/dev/debt/libSceVideoOut.md
PR 9432 docs/dev/debt/libSceVideoOut.md
PR 9673 docs/dev/debt/libSceVideoOut.md
PR 9880 core/libs/prx/libSceVideoOut/CMakeLists.txt
docs/dev/debt/libSceVideoOut.md
PR 9898 docs/dev/debt/libSceVideoOut.md
PR 10112 core/libs/prx/libSceVideoOut/CMakeLists.txt
docs/dev/debt/libSceVideoOut.md
PR 12863 core/libs/prx/libSceVideoOut/CMakeLists.txt
docs/dev/debt/libSceVideoOut.md
PR 12930 core/libs/prx/libSceVideoOut/CMakeLists.txt
docs/dev/debt/libSceVideoOut.md
PR 13994 core/libs/prx/libSceVideoOut/InventoryExports.cpp
core/libs/prx/libSceVideoOut/include/InventoryExports.hpp
docs/dev/debt/libSceVideoOut.md
PR 14212 docs/dev/debt/libSceVideoOut.md

@TechLevelZero

Copy link
Copy Markdown
Contributor

✅ NVIDIA GPU test: passed

PR head 50327e7 merged onto main 93dbd0f · tested 2026-11-02 03:26 UTC · 25 min

GPU NVIDIA RTX 2000 Ada Generation, driver 595.99.02, Vulkan 1.4.329
Host Ubuntu 26.04.1 LTS, kernel 7.0.0-38-generic, container ubuntu:24.04
Logs build and test logs for this run
Build ✅ passed (Release, -DANYPS5_ENABLE_SPIRV_TOOLS=ON)
Tests ✅ 1,626 passed · 4 failed (0 new, 2 also fail on main, 2 unstable on main) · 7 skipped (ANYPS5_REQUIRE_VULKAN=1)
Test setup CPU-only tests without a GPU; GPU tests (and any CPU-only test that failed or skipped without one) once on the GPU with VK_LAYER_KHRONOS_validation and ANYPS5_NO_SHADER_CACHE=1; main ran the same way
Test selection 1,637 of 3,165 tests run: the ones this change can reach, chosen by tools/select_tests.py from main's build graph
Vulkan validation ✅ no new validation IDs vs main (743 tests run on the GPU)
Slow tests (>30 s, GPU tests timed with validation layers) ⚠️ agc_driver_pipeline_journal 120.1 s, ⚠️ agc_driver_bda_device 65.8 s
Unstable on main (2, these also failed in recent main runs on this machine; not counted against this PR)
agc_driver_pipeline_journal: failed in 1 of the last 10 main runs
agc_driver_submit_progress: failed in 6 of the last 10 main runs
Failing on main too (2, not counted against this PR)
agc_driver_image_table
guest_mmap_executable
Validation IDs already present on main (5 IDs in 605 tests)
VUID-VkDeviceCreateInfo-pNext-pNext (605 tests): agc_compute_pipeline_replay, agc_driver_address_passes, agc_driver_address_passes_draw_transitions, agc_driver_address_passes_targets_split, agc_driver_alias_copy_label, agc_driver_alpha_to_coverage, agc_driver_array_layer_target, agc_driver_array_layer_target_cpu, and 597 more
VUID-vkCmdCopyImage-srcImage-01548 (13 tests): agc_driver_depth_clear_hle, agc_driver_depth_plane_buffer_memory, agc_driver_depth_plane_cpu_write_after_memo, agc_driver_depth_plane_cpu_write_after_page_unwatch, agc_driver_depth_plane_cpu_write_after_partial_unwatch, agc_driver_depth_plane_partial_store, agc_driver_depth_plane_partial_store_unimported, agc_driver_depth_plane_sampling, and 5 more
VUID-vkCmdCopyImage-srcImage-01551 (13 tests): agc_driver_depth_clear_hle, agc_driver_depth_plane_buffer_memory, agc_driver_depth_plane_cpu_write_after_memo, agc_driver_depth_plane_cpu_write_after_page_unwatch, agc_driver_depth_plane_cpu_write_after_partial_unwatch, agc_driver_depth_plane_partial_store, agc_driver_depth_plane_partial_store_unimported, agc_driver_depth_plane_sampling, and 5 more
VUID-VkPipelineColorBlendStateCreateInfo-pAttachments-00605 (2 tests): agc_driver_prepared_exports, agc_driver_srgb8_color_target
VUID-VkShaderModuleCreateInfo-pCode-08737 (1 test): agc_driver_image_sample_derivatives
Skipped (7)
agc_driver_msaa_dcc_compared_import_2: skipped, the device reports host imports that keep write protection, so the write-watch probe compares none of them
agc_driver_msaa_dcc_compared_import_4: skipped, the device reports host imports that keep write protection, so the write-watch probe compares none of them
agc_driver_msaa_dcc_compared_import_8: skipped, the device reports host imports that keep write protection, so the write-watch probe compares none of them
agc_driver_sparse_dma_buf_import: skipped, host imports are unavailable: /dev/udmabuf is not accessible
agc_driver_stencil_ref_export: skipped, the device lacks VK_EXT_shader_stencil_export
agc_driver_vertex_elected_atomic_max: skipped, the device runs vertex programs in subgroups, so they keep their cross-lane reductions
video_out_flip_present: skipped, no display or Vulkan device: DisplayWindow: Vulkan support is either not configured in SDL or not available in current SDL video driver (offscreen) or platform
Reproduce
git fetch origin 50327e7c8c58014c0f549739963bd523d656e79a 93dbd0f82aea684e95f15f06e7d42c0064af18cf
git checkout 93dbd0f82aea684e95f15f06e7d42c0064af18cf && git merge --no-ff 50327e7c8c58014c0f549739963bd523d656e79a
git submodule update --init --recursive
cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON -DANYPS5_ENABLE_SPIRV_TOOLS=ON
cmake --build build && cmake --build build --target libs
VK_DRIVER_FILES=/nonexistent/icd.json ctest --test-dir build -E '^(agc|shader|recompiler|videoout|video_out|guest_video_out|vulkan)|gpu' --timeout 120 --parallel 32 --output-on-failure
ANYPS5_REQUIRE_VULKAN=1 ANYPS5_NO_SHADER_CACHE=1 VK_INSTANCE_LAYERS=VK_LAYER_KHRONOS_validation \
  ctest --test-dir build -R '^(agc|shader|recompiler|videoout|video_out|guest_video_out|vulkan)|gpu' --timeout 120 --parallel 4 --output-on-failure
# failures are then re-run alone: --timeout 360 --parallel 2; new validation IDs: the test alone, twice, --parallel 1

Automated build and test on a contributor's NVIDIA machine; it does not replace upstream CI. A new comment is posted for each new push. Full logs.

@TechLevelZero

Copy link
Copy Markdown
Contributor

✅ NVIDIA GPU test: passed

PR head 072371a merged onto main 93dbd0f · tested 2026-11-02 03:47 UTC · 18 min

GPU NVIDIA RTX 2000 Ada Generation, driver 595.99.02, Vulkan 1.4.329
Host Ubuntu 26.04.1 LTS, kernel 7.0.0-38-generic, container ubuntu:24.04
Logs build and test logs for this run
Build ✅ passed (Release, -DANYPS5_ENABLE_SPIRV_TOOLS=ON)
Tests ✅ 1,626 passed · 4 failed (0 new, 2 also fail on main, 2 unstable on main) · 7 skipped (ANYPS5_REQUIRE_VULKAN=1)
Test setup CPU-only tests without a GPU; GPU tests (and any CPU-only test that failed or skipped without one) once on the GPU with VK_LAYER_KHRONOS_validation and ANYPS5_NO_SHADER_CACHE=1; main ran the same way
Test selection 1,637 of 3,165 tests run: the ones this change can reach, chosen by tools/select_tests.py from main's build graph
Vulkan validation ✅ no new validation IDs vs main (743 tests run on the GPU)
Slow tests (>30 s, GPU tests timed with validation layers) ⚠️ agc_driver_pipeline_journal 120.1 s, ⚠️ agc_driver_bda_device 64.0 s
Unstable on main (2, these also failed in recent main runs on this machine; not counted against this PR)
agc_driver_pipeline_journal: failed in 1 of the last 10 main runs
agc_driver_submit_progress: failed in 6 of the last 10 main runs
Failing on main too (2, not counted against this PR)
agc_driver_image_table
guest_mmap_executable
Validation IDs already present on main (5 IDs in 605 tests)
VUID-VkDeviceCreateInfo-pNext-pNext (605 tests): agc_compute_pipeline_replay, agc_driver_address_passes, agc_driver_address_passes_draw_transitions, agc_driver_address_passes_targets_split, agc_driver_alias_copy_label, agc_driver_alpha_to_coverage, agc_driver_array_layer_target, agc_driver_array_layer_target_cpu, and 597 more
VUID-vkCmdCopyImage-srcImage-01548 (13 tests): agc_driver_depth_clear_hle, agc_driver_depth_plane_buffer_memory, agc_driver_depth_plane_cpu_write_after_memo, agc_driver_depth_plane_cpu_write_after_page_unwatch, agc_driver_depth_plane_cpu_write_after_partial_unwatch, agc_driver_depth_plane_partial_store, agc_driver_depth_plane_partial_store_unimported, agc_driver_depth_plane_sampling, and 5 more
VUID-vkCmdCopyImage-srcImage-01551 (13 tests): agc_driver_depth_clear_hle, agc_driver_depth_plane_buffer_memory, agc_driver_depth_plane_cpu_write_after_memo, agc_driver_depth_plane_cpu_write_after_page_unwatch, agc_driver_depth_plane_cpu_write_after_partial_unwatch, agc_driver_depth_plane_partial_store, agc_driver_depth_plane_partial_store_unimported, agc_driver_depth_plane_sampling, and 5 more
VUID-VkPipelineColorBlendStateCreateInfo-pAttachments-00605 (2 tests): agc_driver_prepared_exports, agc_driver_srgb8_color_target
VUID-VkShaderModuleCreateInfo-pCode-08737 (1 test): agc_driver_image_sample_derivatives
Skipped (7)
agc_driver_msaa_dcc_compared_import_2: skipped, the device reports host imports that keep write protection, so the write-watch probe compares none of them
agc_driver_msaa_dcc_compared_import_4: skipped, the device reports host imports that keep write protection, so the write-watch probe compares none of them
agc_driver_msaa_dcc_compared_import_8: skipped, the device reports host imports that keep write protection, so the write-watch probe compares none of them
agc_driver_sparse_dma_buf_import: skipped, host imports are unavailable: /dev/udmabuf is not accessible
agc_driver_stencil_ref_export: skipped, the device lacks VK_EXT_shader_stencil_export
agc_driver_vertex_elected_atomic_max: skipped, the device runs vertex programs in subgroups, so they keep their cross-lane reductions
video_out_flip_present: skipped, no display or Vulkan device: DisplayWindow: Vulkan support is either not configured in SDL or not available in current SDL video driver (offscreen) or platform
Reproduce
git fetch origin 072371afe905abbb8a1aa0296d43c7e67cfffe22 93dbd0f82aea684e95f15f06e7d42c0064af18cf
git checkout 93dbd0f82aea684e95f15f06e7d42c0064af18cf && git merge --no-ff 072371afe905abbb8a1aa0296d43c7e67cfffe22
git submodule update --init --recursive
cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON -DANYPS5_ENABLE_SPIRV_TOOLS=ON
cmake --build build && cmake --build build --target libs
VK_DRIVER_FILES=/nonexistent/icd.json ctest --test-dir build -E '^(agc|shader|recompiler|videoout|video_out|guest_video_out|vulkan)|gpu' --timeout 120 --parallel 32 --output-on-failure
ANYPS5_REQUIRE_VULKAN=1 ANYPS5_NO_SHADER_CACHE=1 VK_INSTANCE_LAYERS=VK_LAYER_KHRONOS_validation \
  ctest --test-dir build -R '^(agc|shader|recompiler|videoout|video_out|guest_video_out|vulkan)|gpu' --timeout 120 --parallel 4 --output-on-failure
# failures are then re-run alone: --timeout 360 --parallel 2; new validation IDs: the test alone, twice, --parallel 1

Automated build and test on a contributor's NVIDIA machine; it does not replace upstream CI. A new comment is posted for each new push. Full logs.

@oneandonlydean oneandonlydean self-assigned this Nov 5, 2026
oneandonlydean added a commit to BunnyFl/AnyPS5 that referenced this pull request Nov 5, 2026
The branch removes twelve rows from the inventory table, the seven of boykopovar#14941 and the five mode helpers, so the table holds 170 of the original 182 rows and the file has 178 throwing bodies, 170 for the table and 8 outside it. The line still carried the 175 left by boykopovar#14941.

Co-authored-by: BunnyFl <166477956+BunnyFl@users.noreply.github.com>
@oneandonlydean
oneandonlydean merged commit 9805c44 into boykopovar:main Nov 5, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants