fix(agc): write sceAgcDcbResetQueue op bits 0x040 and 0x200 and accept their packets

[JAB-dev]

What

sceAgcDcbResetQueue now writes the packet groups measured on PS5 firmware 13.60 in #1581 for op bits 0x040 and 0x200 as well. The driver now accepts every packet in the measured sequence, so op = 0x3FF writes the console's 61 dwords and the queue runs them. Since #1629, those two bits throw. On top of that, the driver reads the envelope's first dword as a 16K-dword packet (PacketWords(0xffff1000) is 0x4001), so any reset fails at submission.

Driver (Pm4):

• 0xffff1000 is one dword. It is a type-3 NOP with count 0x3FFF. Linux amdgpu pads its rings with exactly this dword (.nop = PACKET3(PACKET3_NOP, 0x3FFF) in gfx_v10_0.c, written one dword at a time by amdgpu_ring_insert_nop), and libSceAgc's own packet-size table already counts it as 1 (tests/PacketInfo.cpp). Only this exact header is treated as filler.
• ACQUIRE_MEM ranges up to 48 bits (COHER_SIZE_HI, COHER_BASE_HI). The 0x040 group flushes the whole address space with COHER_SIZE_HI = 0xff. These are the same lines feat(agc): accept the GFX10 packet forms RADV emits #1917 changes, so whichever PR merges second gets a no-op rebase. The range is still not used when the packet runs.
• EVENT_WRITE PIXEL_PIPE_STAT_CONTROL (event 56, named in Linux navi10_enum.h) with event index 1. It is accepted only when it selects the layout the occlusion counter dump (event 57) already writes: Z-pass counter 0, 128-bit stride and the 16 render backends SampleCounter.comp stores. The field layout is Mesa's PIXEL_PIPE_STATE_CNTL_* in sid.h. The measured 07fffc00 00000000 is that value. Any other counter, stride, backend mask or reserved bit throws.

Builder (libSceAgc): the groups for bits 0x040 and 0x200, as measured in #1581. Bit 0x400 (opcode 0x1E, which the driver does not know) still throws.

Seen in PPSA22520 (Animal Well), which calls sceAgcDcbResetQueue(op = 0x3FF, state = 0) at boot. On main it stops with "unsupported op bit 0x40"; with this PR it boots and plays at 60 FPS.

Tested

Windows 11, WinLibs GCC 15.2.0, RTX 4070 SUPER.

• agc_command_tests: exact bytes for op 0x040, 0x200 and 0x3FF (the 61 measured dwords). 0x400 and 0x7FF still throw and leave the buffer untouched.
• agc_driver_pm4_tests:
  • the one-dword NOP and that neighbouring headers are not filler;
  • PIXEL_PIPE_STAT_CONTROL accepted with the measured payload, and rejected for each other counter, stride, backend mask, reserved bit, high dword, event index, packet size and the compute queue;
  • ACQUIRE_MEM over 48 bits and both ends of its limit;
  • the measured op = 0x3FF sequence submitted with sceAgcDriverSubmitDcb, followed by a write the queue must reach.
• On main both test executables fail.
• 22 mutations, all caught.
• Full ctest on this branch alone: 633/634. agc_driver_f32_arithmetic_nan fails the same way on main here (the NVIDIA driver quiets the NaN).
• Linux not tested.

Related: #1581, #1629, #1917 (same ACQUIRE_MEM lines).

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed in TechnicalDebt
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source — N/A, no third-party code
• Generic behaviour, not specific to one title
• Depends on: none
• AI-assisted: yes

🤖 Generated with Claude Code

[github-actions]

Thank you for your interest in the project! We are sorry, but we cannot accept more PRs while we work through the existing backlog. This PR has been automatically closed and labeled "intake paused". This is not a judgment of the quality of your changes.