STAR WARS: Galactic Racer (PPSA28416)

[CnRJay]

Tested

• Title: STAR WARS: Galactic Racer, PPSA28416, v01.003.001 (Unreal Engine 5)
• Host:
  • Windows 11 Pro, AMD Ryzen 9 9950X3D (16 cores), 64 GB RAM.
  • NVIDIA GeForce RTX 4080 16 GB, driver 617.14.
  • Relinked with --windows --registry. Built with WinLibs GCC 15.2.0 r7, Release, ANYPS5_ENABLE_SPIRV_TOOLS=OFF (with SPIR-V validation on, the per-shader cost makes UE's hang watchdog fire).
• Last update: 2026-10-10. 2 of the 11 pull requests opened for this title are merged; the rest are open, as are feat(agc): vertex clip and cull distances #423, feat(agc): depth surfaces read as textures and storage images #425 and feat(agc): storage images over a depth surface's stencil plane #2076 by other contributors, which the title also needs. Several later fixes are still local only (see "Local only").

Testing the branch

Everything below, merged, open and local only, is combined on CnRJay/AnyPS5 port/ppsa28416. It is a test branch, not for review: it carries work-in-progress commits, one shim (ZVZ++68nNI8) and a debug probe ([probe-indirect] lines in the log).

Every stop in the table below is handled on the branch, and everything under "Local only" is on it:

• the pull requests opened for this title are on it as the same commits, and fix(shader): guard shared loop exit routing and preserve valid fallbacks #2471 is merged in;
• feat(agc): depth surfaces read as textures and storage images #425 and feat(agc): storage images over a depth surface's stencil plane #2076 (other contributors) are not on it; the depth and stencil storage-image stop uses a local commit instead (2f9cee4d6: storage-image writes to a depth surface's planes are copied into its depth image);
• feat(agc): vertex clip and cull distances #423 is not on it; clip and cull distances are accepted and ignored (704dec9f8), so geometry is not clipped by them.

git clone --recursive -b port/ppsa28416 https://github.com/CnRJay/AnyPS5.git
cmake -S AnyPS5 -B AnyPS5/build -G Ninja -DCMAKE_BUILD_TYPE=Release -DANYPS5_ENABLE_SPIRV_TOOLS=OFF
cmake --build AnyPS5/build

Relink the title with --windows --registry and append -nothreadtimeout -HangDuration=1200 to app0/uecommandline.txt (see Status). Expect 0.04-0.14 FPS and the stop described in blocker A.

Status

Not in game. On a branch of main with the pull requests below and the local changes, the title:

• resolves all its imports (one NpManager NID, ZVZ++68nNI8, is a local shim);
• creates the Vulkan device and runs its UE5 renderer: compute-written scene depth, sparse descriptor heaps, ordered-append compute passes;
• presents frames and shows its boot splash (Simplygon / Microsoft / Azure PlayFab logos).

It runs at 0.04-0.14 FPS, and stops after a few minutes on garbage indirect dispatch arguments (blocker A).

Test-only setting: -nothreadtimeout -HangDuration=1200 is appended to app0/uecommandline.txt. First-time pipeline compiles of very large shaders (100k-2M SPIR-V words) and the slow frames otherwise make UE's FThreadHeartBeat crash the title on purpose.

Open blockers

	Stop	Seen
A	Indirect dispatches (USE_THREAD_DIMENSIONS, read on the CPU) get garbage group counts from the 12 bytes at +0x40 of a fresh 64 KiB block, e.g. 609717307x1x1, 66977792x1x1, 66978560x4286578689x1. With y and z in range the 67M-group dispatch runs for minutes and looks like a GPU hang (recorded batch ... still running). The read does not happen with APS5_TRACE_DISPATCH_IO, which only slows the CPU, so it looks like a missing sync between a GPU write of the arguments and the CPU read. The writer is not identified yet.	Every launch, 3-8 minutes in
B	Performance. A 4 GiB GPU heap (528 MiB committed) bound through descriptors is copied on every dispatch: about 70 GB of guest reads in 20 s, up to 300 ms of "B upload" per dispatch. #2992 cuts each copy to the committed part; a persistent mirror of the heap is written but not tested (see "Local only").	Always
C	[gpu] deferred write-back failed: BDA access failed ... reason=1 at 0x8000000000000000+... (pc 0x674, 0xbfc, 0xc74, 0xe48 of the same program): stores through a pointer with bit 63 set. Not fatal.	Every launch
D	guest snapshot differs from registered memory (compute shader 0x131d2a0000) and buffer descriptor uses an unsupported type (0x7ff710ad5600). Seen once each, after blocker A had already produced garbage; possibly follow-on damage.	Intermittent
E	Clip distances. The title draws with 4 clip distances (PA_CL_VS_OUT_CNTL = 0x0040000f); locally they are accepted and not applied. Covered by #423 (draft, conflicting).	Every launch

Stops on main, in the order they are hit

Stop	Covered by
Unresolved imports: scePsmlMfsrCreateContext1300, scePsmlMfsrGetDispatchMfsrPacket1300	#2888 (merged)
Unresolved import of party-ps5-shipping.prx: sceAudioOut2EnableChat	#2890 (merged)
Unresolved import ZVZ++68nNI8 (libSceNpManager, name unknown). OnlineSubsystemPS5 calls f(char* buf) with a 0x50-byte stack buffer and reads it as a string	Local shim only, semantics unknown
CB metadata pass over DCC keys that are mixed: comp-to-single DCC keys (0x10) in a DCC decompress	#2939
VOP1 SDWA destination selector 4 ... of opcode 0x50 (v_cvt_f16_u16 with a byte source)	#2940
CFG shared merge splitting exceeded budget	#2941 (#2471 alone does not fix it)
vkAllocateMemory -2: the sparse 4 GiB descriptor heap copied whole	#2992
storage image access to depth/stencil surface: UE writes scene depth (R32F) and stencil (R8) from compute	#425, #2076
Header: invalid packet header (one-dword NOP)	#2991
...RegistersIndirectGetSize: reserved bits (0xf5f5039c): the count argument holds leftover register contents	#2993
sceAgcBranchPatchSetThenTarget_0300 not implemented	#2995
dispatch modifiers 0x49 (ORDERED_APPEND_ENBL)	Local only
null or misaligned address in a prepared shader's SRT walk (s_load from a null pointer, skipped on hardware by s_cbranch_execz)	#2989
clip distances ... (0x207 = 0x0040000f)	#423 (draft, conflicting); locally accepted and ignored
workgroup count 16926492x1116079131x3241227624: the compute-queue look-ahead read indirect arguments before an earlier dispatch of the same run wrote them	#2990
computed/data-dependent s_swappc_b64 call target ... is not statically resolvable (ordered-append compute shaders, 0x131f420000)	Local only
ds_ordered_count ... not modeled	Local only
guest memory is not readable at 0xfe0040000	Local only
storage image access to the depth plane ... as a 1x1 image (a depth surface's memory reused for a smaller or differently sized image)	Local only
shader buffer exceeds descriptor range limit (a V# of 0x11e1a30160+0x3fdfffffc0, stride 64)	Local only
buffer atomic on a V# whose base is not DWORD aligned; also BDA access failed ... reason=7 (unaligned) at pc 0xa08	Local only

Local only (pull requests to follow)

• Computed s_swappc_b64 targets. The ordered-append shaders call a hook through a table at the fixed address 0xfe0040000, only when the table entry is non-null. Such a call now compiles; if it runs, it records a fault and the dispatch throws.
• Shader hook table at 0xfe0040000. A read-only page in the system-reserved range whose first qword points at a zeroed record, so the hook (+0x20) and its argument (+0x28) read as null. The shaders load the table unconditionally, so on the console it holds a valid pointer. What else it holds is unknown.
• ds_ordered_count. Implemented as one GDS add per wave of the first active lane's value; M0[31:16] is the address and M0[15:0] the ordered wave ID (LLVM SIISelLowering.cpp, IntrinsicsAMDGPU.td). Waves get their ranges in the order their atomics run, not in launch order. Swap, more than one dword, and wave_done without wave_release throw. ORDERED_APPEND_ENBL in the dispatch initiator is accepted.
• Depth surface reuse. A depth surface's memory viewed as a storage image of another size or element size (e.g. an 80x45 D16 surface reused as a 1x1 R32F image) makes the driver forget the depth surface.
• Oversized buffer descriptors. A V# larger than maxStorageBufferRange is clamped to the device limit, ending at its last committed byte; the uncommitted parts read as zero.
• Buffer atomics through a misaligned V# base or address. These now act on the containing aligned element. The Vega ISA says the two low bits of the address are ignored for dword and larger accesses ("Alignment"); not verified on hardware for atomics.
• Persistent mirror of a sparse descriptor heap (on top of fix(agc): copy a sparse descriptor heap only up to its last backed byte #2992), so the heap is not copied per dispatch. Written and unit-tested; not yet measured in the title.

Notes

• Module names: several modules in the eboot don't match their DT_NEEDED names (libSceAjm vs libSceAjm.native.prx, libSceJson vs libSceJson2.prx, libScePsml vs libScePsml_debug.prx, EOSSDK-PS5-Shipping vs .debug_prx, ...). Those imports are resolved by searching every library and load fine. import_audit.py lists Party.prx and libPlayFabMultiplayer.prx as missing, because the bundled files are named party-ps5-shipping.prx and libplayfabmultiplayer-ps5-shipping.prx.
• Shader prepare: 105 shaders can't be prepared at registration (its s_swappc_b64 ... calls a computed target) and are prepared when first used.
• First run: recompiling and creating pipelines on a run with no shader cache takes minutes (pipelines of up to 1.1M SPIR-V words).

[parl0v]

Nice work. The libSceNpManager unknown ZVZ++68nNI8 is sceNpGetSandboxInfo:

compute_nid("sceNpGetSandboxInfo") == "ZVZ++68nNI8"

(found with nidhunt, also in zecoxao/sce_symbols#23). I opened #3105 to name it as a throwing stub so the import resolves; the real behaviour is yours to keep in the bring-up. Keep up the good work!