With pipelined draws, a DISPATCH_DIRECT on queue 0 whose dispatch-cache entry hits with a
recipe runs as an ordered commit item instead of draining the pipeline first. Misses, reads
that overlap writes still pending in the pipeline, verified data hits and writes that cannot
be ranged still drain. A dispatch that is resolved ahead (or adopted from a group resolved
ahead) and copy kernels keep the drained path; with the switch on, queue 0 does not resolve
dispatch groups ahead, since that drains the pipeline at every group. Off by default.
agc_driver_pipelined_dispatch counts drains per opcode (each dispatch drains with the switch
off); agc_driver_pipelined_dispatch_item checks that repeated dispatches do not drain, and that
a dispatch whose descriptor table a pending fill retargets drains and reads the new buffer.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With APS5_PIPELINE_DMA=1 a DMA_DATA was enqueued before the
packet path's metadata notes ran, so a fill of 0 over a depth surface's HTILE (#374) or a color
target's CMASK (#419) never reached the surface: agc_driver_depth_fast_clear_submit failed. The
queued commit now notes the fill in order before it stores it, and a DMA copy is checked against
multisampled targets at enqueue, as on the packet path.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
(cherry picked from commit fda7dbf041)
The pipelined label path treated every nonzero RELEASE_MEM INT_SEL as an end-of-pipe interrupt;
main's PacketMemory excludes 3 (send data after write confirm). agc_driver failed on it with
APS5_PIPELINED_DRAWS=1 ("release with INT_SEL send data after write confirm raised an interrupt").
Co-Authored-By: TheAggie <67454+TheAggie@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
DrawWriteRanges decoded every written storage image element, and DecodeTextureResource refuses a zero
base address, so a draw with a null storage image bound failed (PPSA01317) instead of skipping it.
The element is now skipped by the binder's own null rule (base address words zero) before it is
decoded. agc_driver_draw_write_ranges binds a null image next to a written one.
Co-Authored-By: Gjon Gojcevic <7807870+gjonn@users.noreply.github.com>
Co-Authored-By: SleglJan <90033145+SleglJan@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With APS5_PIPELINED_DRAWS=1, queue 0's worker decodes, captures and recompiles a draw and hands it to
a committer thread that records it (Graphics::Draw under the GPU lock), so the two run in parallel
instead of one after the other. Work the committer has not reached yet is tracked by the guest ranges
it will write; a later packet that reads or writes them, or one the pipeline cannot order, drains it.
Ordered as commit items instead of drains:
- labels (WRITE_DATA, RELEASE_MEM) and same-queue waits on them; APS5_PIPELINE_DRAIN_LABELS=1 drains;
- the end of a queue-0 submission and a released REWIND tail; APS5_PIPELINE_DRAIN_SUBMISSIONS=1 drains;
- the title's buffer fill kernels; APS5_PIPELINE_DRAIN_FILLS=1 drains;
- DMA_DATA immediates and copies (APS5_PIPELINE_DMA=1).
A draw's write ranges include the storage images it writes and its exact color and depth target
ranges (APS5_EXACT_DRAW_WRITES=1), not estimates.
Draw-path costs the pipeline exposed:
- ShaderMemory moves, so a commit owns its capture's pages;
- a submission made before the worker's current collect epoch began keeps the epoch, so a worker
behind a queue of submissions walks a surface once per catch-up (APS5_SUBMISSION_EPOCH_EACH=1 bumps
at every submission); a thread remembers the ranges it walked for the whole epoch;
- the pipeline signals only threads that wait; the pending-image and unit-shadow registries take a
spinning slim lock instead of std::mutex (winpthreads contention was kernel events); ScanPending skips
the registry walk when no pending image can overlap;
- fewer heap allocations per recorded draw (reused descriptor sets and scratch vectors, buffer pool
size classes kept).
GTA V Performance mode, prologue bank interior, RTX 5080: 11.7 -> about 20 fps together with the cheaper
captures below it.
Off by default here; the follow-up turns it on.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Gjon Gojcevic <7807870+gjonn@users.noreply.github.com>
A lazy page was found accessible whole when it was made, and its blocks are
copied from guest memory on demand; accessible() no longer asks
GuestMemory::Accessible for it again on every word the SRT walk checks. A read
looks up the code and header snapshots only when it can touch them, and the
read and page counters run only under APS5_PROFILE_DRAW, where the [capture]
line prints them.
Raghav314 measured the three on Hades II (PPSA36082, RTX 4090, Linux):
capture_resources 2.48 -> 2.14 ms per frame, frame p50 12.34 -> 11.60 ms.
Co-Authored-By: Raghav314 <71544502+Raghav314@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The per-draw capture of a shader's memory (the SRT walk and the guest pages it reads) cost about
15 us per draw packet in GTA V Performance mode; it now costs about 6.6.
- The SRT evaluator memoizes per plan value in a thread's reused, stamped array instead of a hash
table allocated and grown on every walk (evaluate 5.3 -> 3.6 us per capture).
- ExtractPlan also stores the plan's values as 32-byte records with argument ids, and the walk
evaluates that compact copy: the IR walk spent most of its time in cache misses (3.6 -> 2.7 us).
The evaluator is a template over the node view, so both walks share every opcode's semantics, memo,
cycle and failure rules. A plan that cannot be expressed compactly keeps the IR walk.
APS5_VERIFY_SRT_COMPACT=1 walks both and throws on any difference.
- ShaderMemory's valid/read/recent marks are arrays of 64-bit words scanned with countr_zero instead
of bitsets tested bit by bit (about 1 us per draw packet).
- Captured pages come from a per-thread pool, are found through a short vector with a last-page
shortcut, and a page no recorded GPU work writes gets the flush hook a whole-page read would make,
then has each 64-byte block copied when a word of it is first read (about 0.3 us per packet).
Pages with pending GPU writes and unmapped pages are read as before.
- APS5_PROFILE_DRAW splits the capture time into SRT evaluation and materialization, and prints the
[capture] line once per 10 s instead of every 500 captures (it cost about 2 us per capture).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Gjon Gojcevic <7807870+gjonn@users.noreply.github.com>
The pipelined label path treated every nonzero RELEASE_MEM INT_SEL as an end-of-pipe interrupt;
main's PacketMemory excludes 3 (send data after write confirm). agc_driver failed on it with
APS5_PIPELINED_DRAWS=1 ("release with INT_SEL send data after write confirm raised an interrupt").
Co-Authored-By: TheAggie <67454+TheAggie@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
DrawWriteRanges decoded every written storage image element, and DecodeTextureResource refuses a zero
base address, so a draw with a null storage image bound failed (PPSA01317) instead of skipping it.
The element is now skipped by the binder's own null rule (base address words zero) before it is
decoded. agc_driver_draw_write_ranges binds a null image next to a written one.
Co-Authored-By: Gjon Gojcevic <7807870+gjonn@users.noreply.github.com>
Co-Authored-By: SleglJan <90033145+SleglJan@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With APS5_PIPELINED_DRAWS=1, queue 0's worker decodes, captures and recompiles a draw and hands it to
a committer thread that records it (Graphics::Draw under the GPU lock), so the two run in parallel
instead of one after the other. Work the committer has not reached yet is tracked by the guest ranges
it will write; a later packet that reads or writes them, or one the pipeline cannot order, drains it.
Ordered as commit items instead of drains:
- labels (WRITE_DATA, RELEASE_MEM) and same-queue waits on them; APS5_PIPELINE_DRAIN_LABELS=1 drains;
- the end of a queue-0 submission and a released REWIND tail; APS5_PIPELINE_DRAIN_SUBMISSIONS=1 drains;
- the title's buffer fill kernels; APS5_PIPELINE_DRAIN_FILLS=1 drains;
- DMA_DATA immediates and copies (APS5_PIPELINE_DMA=1).
A draw's write ranges include the storage images it writes and its exact color and depth target
ranges (APS5_EXACT_DRAW_WRITES=1), not estimates.
Draw-path costs the pipeline exposed:
- ShaderMemory moves, so a commit owns its capture's pages;
- a submission made before the worker's current collect epoch began keeps the epoch, so a worker
behind a queue of submissions walks a surface once per catch-up (APS5_SUBMISSION_EPOCH_EACH=1 bumps
at every submission); a thread remembers the ranges it walked for the whole epoch;
- the pipeline signals only threads that wait; the pending-image and unit-shadow registries take a
spinning slim lock instead of std::mutex (winpthreads contention was kernel events); ScanPending skips
the registry walk when no pending image can overlap;
- fewer heap allocations per recorded draw (reused descriptor sets and scratch vectors, buffer pool
size classes kept).
GTA V Performance mode, prologue bank interior, RTX 5080: 11.7 -> about 20 fps together with the cheaper
captures below it.
Off by default here; the follow-up turns it on.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Gjon Gojcevic <7807870+gjonn@users.noreply.github.com>
With PA_SC_AA_MASK covering only some pixels of a quad, the uncovered pixels
run on the hardware as helper lanes, so derivatives of the covered pixels stay
defined. OpKill ends those invocations; OpDemoteToHelperInvocation keeps them
as helpers. The device enables VK_EXT_shader_demote_to_helper_invocation when
available and passes the DemoteToHelperInvocation capability and its SPIR-V
extension to the recompiler target and the graphics shader validation. A
demoted pixel also reads as a helper, so its initial EXEC bit is clear as on the
hardware. Without demote, OpKill stays for pixel programs that read no
neighbouring lanes; implicit-LOD sampling, LOD queries and cross-lane reads are
refused. The quad pixel mask execution test now also samples a mipmapped
texture with implicit LOD under the mask.
With one sample, PA_SC_AA_MASK leaves one coverage bit per pixel of the 2x2 quad,
so a draw can cover only some pixels of every quad (GTA V renders a target one
quarter of the pixels at a time this way). The pixel stage info carries that 4-bit
mask; a fragment shader whose mask is not full starts by killing the invocation
unless its gl_FragCoord quad position is covered, and runs without early fragment
tests. The mask is part of the recompile cache key and the serialized request
(version 24). Sample masks of multisampled draws stay refused.
The resolve decode keeps a SW_4KB_S, SW_64KB_S and SW_64KB_R_X destination's tile mode. An execution case
(ctest agc_tiled_resolve) fast-clears a 4x source through its CMASK and resolves it into each of those
targets, reading the resolved color back from guest memory; a linear destination still throws.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A multisample resolve writes into a resident 4 KiB or 64 KiB standard target as well as a 64 KiB render-target one (GTA V's fidelity mode resolves into a SW_64KB_S target).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The draw key now has a shape: the key without the user words the stages read.
A draw whose key misses but whose shape has an entry copies that entry's decode,
re-reads only the user words (and merged-stage pointers), and reuses each
compiled stage whose captured reads still hold, compiling the rest.
APS5_NO_DRAW_DATA_HITS=1 disables it; APS5_VERIFY_DRAW_DATA_HITS=1 also decodes
and compiles in full and throws when the results differ.
A shape keeps its previous entries and only points at its newest key, so
draws of one shape that alternate between stable user words keep their own
key hits. The shape is passed only when data hits are on, so
APS5_NO_DRAW_DATA_HITS=1 keeps the previous behaviour exactly.
Rebased onto main a8b032b2 by CouchRiv (the conflicts with #639 resolved; built and tested on Linux with an RTX 4070 Ti and RADV, and on Windows with an RTX 5080), and onto main 6ac63bf0c by gjonn (main's free-function decoder with its static-ABI mode, its incremental register key as the shape key).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: CouchRiv <270190108+CouchRiv@users.noreply.github.com>
Co-Authored-By: Gjon Gojcevic <7807870+gjonn@users.noreply.github.com>
agc_driver_depth_plane_sampling's refusal case becomes base-slice cases: a D32 2D array from base
slice 1 reads its slices 1 and 2, and through a 2D shader image slice 1; a D16 plane array read as
R16_UINT from base slice 1 reads slice 1 (the integer path Diablo II takes).
Co-Authored-By: EagleBearerYS <75296019+EagleBearerYS@users.noreply.github.com>
Co-Authored-By: mrfelek <17274927+mrfelek@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A T# reading a depth surface's planes as a 2D array whose BASE_ARRAY is past slice 0 views the plane
copy from that slice (the copy holds slices 0 to LAST_ARRAY), instead of being refused. A 2D binding
of such a plane array reads its base slice through a one-slice view. Resident Evil Village
(PPSA01556: a D32 array read as R32F from slice 1) and Diablo II: Resurrected (PPSA03912: a D16 array
read as R16_UINT from slice 1) stopped on the refusal.
Rebased onto main from EagleBearerYS's adaptation to the current DepthPlaneCopy.
Co-Authored-By: EagleBearerYS <75296019+EagleBearerYS@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A device that supports VK_EXT_device_fault reports, on the first
VK_ERROR_DEVICE_LOST a check sees, the fault description, the faulting
addresses (invalid reads and writes, or the instruction pointers of waves
still running when the device hung) and the vendor fault codes.
APS5_GPU_CHECKPOINTS=1 records a VK_NV_device_diagnostic_checkpoints
marker with the program address before each guest dispatch and prints the
last markers the GPU reached, which names the dispatch that hung. Without
either extension nothing changes.
Test: agc_device_fault drives the report through mock
vkGetDeviceFaultInfoEXT and vkGetQueueCheckpointDataNV entry points.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: overlordxrz-source <overlordxrz-source@users.noreply.github.com>
agc_driver_graphics (BdaResources.cpp), each failing without its change:
- a view in the last window of a range whose first window was imported
binds through an import of the whole range;
- an address-based build over the budget leaves the range's window in
place (3 builds, same import);
- two uses across neighbouring cell edges share one import over 10
rounds;
- a range mapped at the budget is refused at map time and retires
nothing.
agc_driver_host_import_windows: windows follow their range, and
ClearHostImports drops them.
A registered range larger than 64 MiB is imported one 64 MiB window at a
time for buffer and fill accesses instead of whole, and the live imports
stay under a budget: APS5_HOST_IMPORT_MIB, else the larger of 6 GiB and
half the physical memory, at most the largest host heap less 2 GiB
(imports and type-3 mirrors share it; #167's rule). An import past the budget
retires the least recently used imports not used in the last 256
lookups.
- An access across window edges imports the cells it touches, grown to
the union of the range's imports it overlaps, so uses across
neighbouring edges share one import instead of replacing each other.
- An address-based build (AcquireRegistered) imports the range whole; a
window over its first byte does not serve it.
- Every refusal (alignment, a failed run, a held import, the budget with
what may be evicted) is decided before anything is retired.
- An import made when a range is mapped never evicts: the map observer
holds no GPU lock.
The window size and the budget have setters for the tests.
The shader info collector refused an out-of-range interpolation parameter
reference without saying which one. The message now gives the attribute,
component and mode it read and the pixel input count it was checked
against, so a title's stop at this check names the attribute its pixel shader
reads past the inputs the draw declares.
Test: interpolation_reference_range builds pixel programs with an
attribute past the inputs, a component past w and a reserved mode, and
checks the message names each.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: overlordxrz-source <overlordxrz-source@users.noreply.github.com>
PA_CL_VS_OUT_CNTL's clip and cull enables and its misc and distance vector bits reach the recompiler's vertex info (request version 20), the draw key, the vertex-info comparison and the recompile cache key. Registration and draw-time preparation set them the same way the draw does; a program without pos1..pos3 exports gets none, so its artifact does not depend on the register. Guest clip distances share main's gl_ClipDistance array with the all-zero position distance; cull distances need shaderCullDistance. Up to eight clip and cull distances are accepted.
Co-Authored-By: john.maia <hi@johnmaia.dev>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
image_load of row 0 through each view, against a live surface drawn at a
known depth and guest-memory slices filled with known values: a 3-slice
D32 2D array, a D32 cube (all six faces), a D16 plane as R16_UINT, and a
D16 depth-bits R16_UINT array (both slices' raw values). A plane array
from base slice 1 is still refused. Fails on main (the array is refused)
and without the depth-bits format gate (GTA V's refusal message).
A texture over a depth surface could only sample one 2D slice of the
plane's own format; 2D arrays, cubes and the R16_UINT view of a D16
plane were refused ("sampling the depth plane of depth surface ... is
not implemented"). A one-slice 2D array now views the depth image as an
array. Several slices, a cube, or an integer view of a D16 plane are
copied into a DepthPlaneCopy image at every use: each slice from the
depth surface bound at its address (base plus one 64 KiB-block depth
slice per layer), otherwise from guest memory, detiled. A depth-bits
R16_UINT view (a depth swizzle) keeps the depth copy, since the shader
converts the sampled depth to its bits itself (GTA V's compute
0x242d4a200 samples a D16 plane array that way, reported by
@tibzejoker). Such a texture is not kept in resource templates.
Storage-image access to depth surfaces is no longer part of this
change; #4500 implements it.
TechnicalDebt (Depth plane copies) and ARCHITECTURE describe the copy and
what still throws.
Vulkan's standard 8x sample 7 is (0.9375, 0.0625), (7, -7) in signed sixteenths; the table had (7, -8), so the
standard pattern (PPSA99902's PA_SC_AA_SAMPLE_LOCS words 0xbd153fd1 / 0x9773f95b) was refused as nonstandard.
Regression row with those words.
Reported by @Amoenus.
Co-Authored-By: Amoenus <5391396+Amoenus@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 9a1a0672ca)
A multisampled target's samples are only on the host, so its guest memory
never holds them: a CPU read through GuestMemory::Read/ReadCommitted, a
DMA_DATA copy from it and a texture or storage image lookup at its address
throw instead of returning bytes that were never written there. Asked by
oneandonlydean; the test reads a resolved-only target's memory each way.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The fragment shader and fragment output libraries are built with the
pipeline's rasterizationSamples, so a 1x and a 4x pipeline with the same
shaders and formats must not share them. Reported by adriadam10 (found by
Raghav314 in #2242).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Vulkan's standard 8x sample 7 is (0.9375, 0.0625), (7, -7) in signed sixteenths; the table had (7, -8), so the
standard pattern (PPSA99902's PA_SC_AA_SAMPLE_LOCS words 0xbd153fd1 / 0x9773f95b) was refused as nonstandard.
Regression row with those words.
Reported by @Amoenus.
Co-Authored-By: Amoenus <5391396+Amoenus@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The duplicate ColorTarget::cmaskAddress, decode and size helper are gone: multisampled targets
use main's cmaskAddress/cmaskBytes (whole metablocks). Single-sample targets keep main's rule
(CMASK under FAST_CLEAR); a multisampled one takes it under FAST_CLEAR or COMPRESSION. A zero
fill of the whole CMASK clears at the next use, 0xFFFFFFFF marks it expanded, any other or
partial fill refuses the next use; eliminate/DCC passes over a multisampled target and a CB
resolve into a fast-clear destination are refused. The draw key adds CMASK_BASE_EXT (0x398),
which main decodes but did not key.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Draws with PA_SC_AA_CONFIG multisampling (2, 4 or 8 samples, every target with as many
fragments, the standard sample locations, MSAA_ENABLE) render into host-only multisampled
color images and multisampled depth surfaces; the pipeline rasterizes with that sample
count. A CB_COLOR_CONTROL resolve over a multisampled CB0 runs as a render pass whose
resolve attachment is CB1's resident image. A zero fill over a target's CMASK fast-clears
it to the CB_COLOR_CLEAR_WORD values of its next use. EQAA, coverage conversion,
nonstandard sample locations, sampling a multisampled surface and multisampled mips stay
refused.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A fill was taken to cover the surface when it spanned ceil(w/8)*ceil(h/8)*4 bytes, a linear HTILE layout. In
the pipe-aligned SW_64KB_Z_X layout a surface's HTILE words lie across a 32 KiB metadata block per 1024x512
pixels (AMD PAL gfx10 addrlib: a 16x16 surface has a valid word at offset 260), so a fill of the linear size
cleared tiles it never wrote. HtileMetadataBytes gives that extent; the fast clear tests fill it (the compute
fixture now dispatches one group per KiB with TGID_X).
Reported with a PAL reproducer by @Amoenus.
Co-Authored-By: Amoenus <5391396+Amoenus@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
`Recorder::Active()` is process-wide. With two devices (agc_driver_depth_fast_clear_submit draws on its
own device; its compute-fill DCB makes the driver create a second one, whose recorder becomes the
active one) a surface's fast clear was recorded into the other device's command buffer, unordered with
the draw: the compute-fill case failed about once in 60-90 runs. A surface now records into the active
recorder only when that recorder is its own device's, and submits on its own device otherwise.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Rebased onto main as one commit (the six commits of #374). A uniform fill over a depth surface's whole
HTILE (DMA_DATA, the fill kernels or a CPU store) clears the depth and stencil aspects its ZMask and
SMem fields say, to DB_DEPTH_CLEAR / DB_STENCIL_CLEAR, when the surface is next bound or sampled.
Main's RADV clear_htile_mask recognition (#2229) now goes through the same pending clear: an HTILE clear
marks the matching surfaces' depth aspect, and one for a surface not created yet is applied when it is
first bound. Main's HTILE address decode and this one are merged into one (TILE_SURFACE_ENABLE, a
nonzero DB_HTILE_DATA_BASE and a depth format).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Measured on RDNA2 (gfx1035) in review:
- the shared and private apertures are 4 GB windows (the gfx9+ layout of kfd_flat_memory.c), so a flat
address routes by its whole high dword, 0x80000000 or 0x70000000, not by its top 16 bits;
- a dword or short access whose last byte is past the end of LDS reads 0 or writes nothing as a whole;
multi-dword accesses are checked per dword.
The aperture test gets rows that straddle and pass the end of LDS; the TechnicalDebt line names the
public source of the layout and keeps only the PS5's base values as inferred.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Main's StoreAddressU32x2..x4 (one BDA lookup per wide store, b95842597) bypassed the aperture routing:
a flat_store_dwordx2 into the shared aperture went to BDA at 0x8000000000000000 and LDS kept its old
value. The wide store now stores each component through the aperture like the 32-bit store, and keeps
the single BDA lookup outside the apertures.
The aperture test's V# word 3 is 0x31016fac (OOB_SELECT 3, raw), as in main's other execution tests:
with OOB_SELECT 0 its output buffer read as out of range after #639, which was the failure reported on
four drivers.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sub-dword stores and unaligned dword accesses go byte-wise; 32- and 64-bit FLAT atomics
route to LDS (64-bit under the workgroup lock), scratch (read-modify-write) or BDA.
agc_driver_flat_apertures covers them in 121 rows, with mixed-address waves and wave64.
The aperture bases and the unmodelled operands 235-238 are listed as inferred.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A compute FLAT access whose address has the console's shared aperture in its high dword (0x8000xxxx)
reads or writes the workgroup's LDS at its low dword, and one in the private aperture (0x7000xxxx)
the lane's scratch; other addresses stay guest memory through BDA. GTA V's ray traversal keeps its
stack in LDS and spills it to scratch through such addresses; treated as guest memory the pushes were
lost and the traversal never ended (device lost). An execution test round-trips both apertures.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A use of the packed ancillary VGPR other than a constant field extract (the word passed through a
select before its sample number is extracted) reads the word rebuilt from the sample number (bit 8)
and the render target index (bit 16). Extracts of other bits straight from the word stay refused, and
the refusal now names the uses.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
When another live image overlaps the fill, a fill at a live image's dccAddress is a key fill
only while it stays within DccKeyCount (the pipe-aligned key count); with nothing overlapping
the length rule is unchanged. ClassifyFill, NoteKeysFill and ClearByKeysFill share the match.
agc_driver_fill_cover_keys pins Keys, Inside and Several for fills at and beside the keys.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A compute program with COMPUTE_PGM_RSRC2.SCRATCH_EN takes its per-lane private size from the AGC
shader header (scratch_size_dw_per_thread) instead of being refused. The size travels in
ShaderComputeStageInfo (cache key, request serialization version 10) to the translator, whose
scratch accesses already lower to a per-invocation Function array of that many dwords.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Color targets with the SW_64KB_S swizzle (CB_COLOR_ATTRIB3 tile mode 9) use the standard element
order of the 4 KiB mode extended by the texture detiler's 64 KiB bits, and are resident like the
other tiled targets. The standard blocks are now wider than tall for 2- and 8-byte elements, as the
standard swizzle and the texture layout have them (they were transposed, aliasing texels).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A context that never wrote SPI_PS_INPUT_ENA or SPI_PS_INPUT_ADDR after CLEAR_STATE reads them as
zero, like the hardware, instead of refusing the draw for a missing register (a depth-only draw
whose pixel shader takes no inputs).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The validator takes the geometryShader and sampleRateShading enables from the
context (set where #295 enables them), so a device without them refuses the
draw instead of creating a module that needs features it never enabled.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Pixel shaders that export a coverage mask write gl_SampleMask, an
int[1] (or uint[1]) output. The validator rejected array interface
types; it now spells them elem[N] and accepts SampleMask as int[1] or
uint[1].
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The recompiler emits SampleId and Layer fragment inputs (pixel ancillary
data) and a FragDepth output with the DepthReplacing execution mode
(depth export), but the validator refused them, so those draws were
skipped. They are now accepted, as are the Geometry and SampleRateShading
capabilities those inputs need in fragment shaders. The device enables
both features when it has them.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The draw key mixed all 32 user data words of every stage. It now mixes only the
words a stage's RSRC2 counts, so draws that differ only in words their programs
never read share an entry. The RSRC2 registers stay in the key.
APS5_DRAW_KEY_ALL_USER_WORDS=1 mixes all 32 again.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
LookBackScan runs a 43-instruction decoupled look-back written for the
test: one aggregate per block, the block index from an atomic counter,
{flag, value} published with buffer_atomic_swap_x2 and read back with
glc buffer_load_dwordx2. Seven single look-backs and 50 scans of 4096
blocks are checked against a CPU prefix sum; without the recompiler
change the first whole scan fails (3 of 3 runs).
TechnicalDebt records that only glc, aligned, in-bounds dwordx2 loads
in programs with the 64-bit storage view are one atomic load: loads
without glc, and loads in programs without 64-bit buffer atomics, can
still tear against a concurrent swap_x2.
A glc buffer_load_dwordx2 is one 64-bit access on the GPU, so it never
sees half of a buffer_atomic_swap_x2. It was emitted as two dword loads,
which can: the first can read the flag from before the swap and the
second the value from after it.
GTA V gives its BVH nodes their record indices with a single-pass
decoupled look-back prefix sum. Each workgroup publishes a {flag, value}
pair for its block with buffer_atomic_swap_x2 and reads the previous 64
blocks' pairs with glc dwordx2 loads. A torn read counts earlier blocks
twice, two nodes then share records, the BVH is corrupt and the ray
tracing refit hangs. It only happens in scans of more than 64 blocks (the
largest BVHs) and depends on timing.
In a program that has the u64 storage-buffer view (it uses 64-bit buffer
atomics), a coherent raw two-dword buffer load that is 8-byte aligned and
in bounds is now read with one device-scope OpAtomicLoad on that view and
split with OpUConvert and a shift (not OpBitcast to a uvec2, which
crashes NVIDIA's shader compiler). All other loads keep the per-dword
path.
tests/execution/LookBackScan runs the game's scan kernel: the look-back
from given blocks, and 50 whole 125-block scans checked against a CPU
prefix sum. Without this change the first whole scan fails.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
DrawRejection read 0x1c4 with read(), which throws when the register is
absent, against the function's rule that a missing register gives no
verdict there; it now reuses the value read with value() for the
DB_SHADER_CONTROL check. Tests pin the Z-export rules: formats 1, 2, 3
and 9 with Z_EXPORT_ENABLE accepted, format 0 rejected, the sample-mask
export accepted with 32_ABGR and rejected with 32_R, formats 4 to 8
rejected, and a missing 0x1c4 accepted.
s_movrels and s_movrelsd_2 read the source register through a chain of
selects keyed on the M0 offset, and the relative destination write is a
select between that value and the old register. When the old register
also appears in the chain, the NVIDIA compiler (RTX 5080, 610.74)
evaluates select(a, select(b, x, y), x) as select(a || b, y, x) instead
of select(a && !b, y, x), so s_movrelsd_2_b32 clobbered s13 whenever the
source offset was 3. Rewriting the select, a branch with a phi, a masked
xor or a small function array all fold back into the same form.
Build the read as an OR of select(offset == k, s[base + k], 0) terms, with
the base register used for offsets outside [1, count) as before. The
result is unchanged, and the select nesting the compiler mishandles no
longer forms.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Any other live use of the packed register keeps throwing, as on main, instead of
reading SampleId << 8 | Layer << 16 with the other bits zero. The field range
check no longer underflows for an extract that starts past a field's end.
Adds the pixel_ancillary recompiler test.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Bit-field extracts of the packed ancillary VGPR become gl_SampleID and gl_Layer reads. A pixel
shader reading gl_Layer needs the Geometry capability instead of ShaderLayer and SPIR-V 1.5, and
the Geometry capability is available whenever the geometryShader feature is. 32-bit
SPI_SHADER_Z_FORMATs and 32_ABGR are accepted with the depth and sample-mask export enables.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
image_sample_cd takes its derivatives in the image_sample_d address
layout; only the hardware LOD selection differs (one LOD per quad instead
of per pixel). The decoder refused it. It now samples with the given
gradients per lane, which matches whenever the lanes of a quad pass equal
derivatives.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Color targets with the SW_4KB_S swizzle (CB_COLOR_ATTRIB3 tile mode 5) are laid out in 4 KiB
blocks with the standard element order the texture detiler uses, and are resident through the
same storage images as 64 KiB targets. A CB_COLOR_VIEW selecting one slice (SLICE_START equal to
SLICE_MAX) renders into that slice: the target starts one slice size per slice after the surface,
the slice size being the surface's mip chain as a texture of the same tile mode lays it out. Views
of several slices are still rejected.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
v_mov_b32 accepted SDWA destination selectors for the words only; a byte
destination (dst_sel BYTE_0..3) threw 'VOP1 SDWA destination selector is not
supported'. The write itself already handles bytes and every dst_unused mode
(TranslationContext::writeRawU32). GTA V aborted during boot on such a move
(dst_sel BYTE_0, dst_unused UNUSED_PRESERVE) in one of its eboot compute
shaders. The error now names the selector, opcode and pc. The SDWA destination
execution test covers BYTE_0 and BYTE_2 with UNUSED_PRESERVE and BYTE_1 with
UNUSED_PAD.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
addrlib sizes a non-tail level with ShiftCeil; the layout used the image's
rounded-down extent, so volumes with a non-power-of-two width or height (33x20x12
in the new test) got a different layout.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
3D textures with more than one mip level were refused. Each slab of
blockDepth slices of a thick (SW_4KB_S / SW_64KB_S) volume now holds the
whole mip chain, smallest level first and level 0 last, as 2D chains are
laid out. A level's depth halves per level, so the texture loops skip the
slices a level does not have. Thin 3D (D/R 64KB_X) chains use the 2D mip
layout per depth slice. Thick mip tails still throw.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
DB_DEPTH_CONTROL's DEPTH_BOUNDS_ENABLE now runs the Vulkan depth bounds
test with DB_DEPTH_BOUNDS_MIN/MAX, and PA_SU_SC_MODE_CNTL's
POLY_OFFSET_FRONT/BACK_ENABLE enable depth bias from
PA_SU_POLY_OFFSET_FRONT/BACK_SCALE/OFFSET and _CLAMP. Both are dynamic
state, so draws that differ only in their values share a pipeline.
The hardware slope scale is in 1/16 units. Depth bias with units other
than the depth format's (PA_SU_POLY_OFFSET_DB_FMT_CNTL), or that differs
between front and back faces that are both drawn, is refused. The
registers join the draw key. Depth-conditional color writes are still
refused.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The draw resource key holds each read-only buffer's V# base and size and every
ShaderData/FlattenedSrt word, so draws whose buffers move per frame (constant and
vertex rings) never hit a template. The key now leaves those out; a hit checks every
moved read-only buffer (accessible, no pending or shadowed writes over it) and
rebinds it from its new address with the template's push adjustment, and data words
that changed get a fresh data buffer with the template's patches. A template whose
buffers cannot be rebound counts as a miss and is built fresh.
APS5_NO_MOVED_BUFFER_TEMPLATES=1 keys the words as before.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The source-handle memo poisoned only compute failures, so a draw stage whose resource
walk cannot resolve was recompiled, and threw, on every draw. Draw stages are now
poisoned too, keyed with the linked programs, and a memoized failure rejects the draw
without an exception.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Batch jobs were stored as a 72-byte header plus 16 bytes per buffer, so one decode
job took 104 bytes. GTA V initializes its MP3 batches with 0x40 bytes, every
sceAjmBatchJobDecode returned SCE_AJM_ERROR_OUT_OF_RESOURCES and its streamed
music and speech stayed silent. A job is now a 32-byte record, its buffers, and
its parameters only when it has any; the MP3 test decodes through a 64-byte batch.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
V_WRITELANE_B32 writes the selected lane regardless of EXEC, but the
translation routed it through the exec-masked VGPR write, so a spill to an
inactive lane was dropped. The WriteLane test now writes lane 5 while only
lane 0 is active.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
ColorTargetLayout built its SW_64KB_R_X offset tables in every
constructor, and every draw constructs a layout per color target while
decoding and again while setting the target up. The tables depend only on
the element size; they are now built once per size under std::call_once
and the layout points into them.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Every guest memory read checks the pending storage images for results it
must store first (FlushPending, overlappingPending and the overlap test of
shader resources), each by a scan of the whole registry, and each scan read
the thread-local `refreshing` once per image (an emutls call with MinGW).
The registry now keeps a sorted, merged index of the ranges its images
cover, rebuilt on the first query after a change: a query that overlaps
none of them returns without a scan. The scans read `refreshing` once.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Take scanned every retained slot of its tier for one with the same size,
usage and memory properties, so the slot bound stayed at 512. With 512
slots GTA V's in-game builds overflowed the small tier: each draw evicted
and recreated buffers, and the submission thread spent most of its time
in the driver's allocation and free calls. The slots are now kept in
lists per key, oldest first: Take pops the newest of its key, eviction
takes the oldest front. The bound is 4096 slots per tier, held to a sixth
of maxMemoryAllocationCount.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
When the windowless device is replaced at the first present, its unit
shadows were published but stayed registered. Lookups take the shadow
whose import starts nearest below an address, so such a stale entry
could hide the live import's shadow. The write-back results it held then
looked absent, and an upload read the import's stale bytes instead.
The replaced device's shadows are now dropped once it is idle.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
An MRT slot below the highest written one that the draw does not write is a VK_ATTACHMENT_UNUSED
reference with a disabled blend; color targets keep their slot for export mappings, pipeline and
pass keys. DB_DEPTH_VIEW SLICE_START moves the depth and stencil planes by whole slices, so each
slice of a depth array is its own depth surface.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sign-in, web browser and player dialogs finish cancelled; the message dialog finishes at once;
NpAuth, entitlement consumption, reachability, account age and the NpUtility bandwidth test
report signed out; sceKernelMtypeprotect changes the protection (the memory type has no host
equivalent); the APR ForEach resolvers resolve every path and report each failure in its own
result entry. vswprintf's stub is dropped in favor of the existing wide-formatter
implementation, which already covers it on every platform.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Explicit v_interp_p1/p2 interpolation (fragment-shader barycentrics) reads every interpolated
parameter per vertex, and the rect-list shaders refused every per-vertex parameter. Their
tessellation stage emits each corner's parameter value, which is what a per-vertex read of the
generated triangles needs. Only custom parameters (custom interpolation or passthrough), whose
fourth vertex has no value of its own, stay refused; FragmentParameter carries that flag.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A sampled read through a surface's keys after a uniform key fill with a clear code reads the
fill's clear value, not the image's pending results (cachedTexture's clear-through-keys). The
stage-A fast path returned the record's view of the pending image without that check, so a
read between the fill and the image's next refresh saw the previous results.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A file read into guest memory is a host write: before the I/O it pins the shared pages it
covers, which reopens any page armed for write tracking and keeps write tracking from arming
it again until the read ends, when the pages count as written. A destination the guest cannot
write fails with EFAULT before any I/O; read and pread throw as for any failed read, AIO
reports SCE_KERNEL_ERROR_EFAULT, and APR throws. APR also throws when a read ends before the
requested size.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The arena is always [0x200000000, 0x7200000000). Every free, allocation-granularity-aligned
piece of the range is reserved as a placeholder; what lies between the pieces (thread stacks
and other reservations Windows made before libc starts, unaligned slivers) and the
system-reserved range are holes, used ranges a release never frees. A failed query or
reservation of the range throws.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A command buffer with fewer free dwords than reserved_dw (an empty one whose
title allocates its storage in the callback, as Marvel's Wolverine does)
threw "reserved space exceeds command buffer capacity" before its callback ran.
Its available space is now 0, so the allocation goes to the callback with the
reserved words added, as for any other full buffer.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Both ignored the flags and the requested address and reserved wherever the arena
had room, so a title that reserves a fixed range (Marvel's Wolverine passes
0x400010, MAP_FIXED | MAP_NO_COALESCE) and then uses the address it asked for
touched memory it never reserved. A fixed reservation now lands at the address,
after checking the range is free; other reservations are placed as before.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
MapViewOfFile3 takes an offset that is a multiple of the allocation granularity
(64 KiB), while shared guest pages are 16 KiB. An alias of a range starting at
a 16 KiB page that is not 64 KiB aligned was refused ("the section offset is not
a multiple of the allocation granularity"), so its host import failed. The view
now starts at the granularity boundary below the offset, the alias points past
the lead, and unmapping rounds back to the view's base.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The Windows loader sets up TLS for a dynamically loaded DLL only when it snaps
the DLL's imports. Guest modules had no import directory, so their TLS
directory was never processed: every guest module kept TLS index 0 and read
and wrote the executable's TLS block. A guest libc's thread-locals (gmtime's
buffer at +0x39c in Marvel's Wolverine) then ran past the executable's
0x150-byte block into the process heap, and corrupted a loader node that
crashed the next thread start in ntdll. Guest modules with TLS now import from
KERNEL32, as the executable does.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A buffer fill that starts at a surface's DCC keys and covers at least its key range (titles fill
the padding too) is a key fill. A uniform key fill leaves the image's texels and pending results
in place and records the fill's code: a sampled read through the surface's keys binds the clear
value, a color target through the keys starts from it at its next refresh, and reads that bypass
the keys still see the texels. Key scans return the fill's code until its write lands, and a
write-back of results drawn before the fill keeps the keys holding that code. The immediate clear
of the covered images is opt-in (APS5_KEYS_FILL_CLEAR=1): it fixes titles whose sampled reads
reach the pending image before a refresh, at the cost of reads that bypass the keys (Astro Bot's
title logo, reported by @oneandonlydean).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
As on FreeBSD, a munmap range covering more than one registered allocation (or gaps between them)
is unmapped allocation by allocation instead of throwing "unmap crosses allocation boundaries".
GTA V unmaps such ranges in its Story Mode prologue.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
mingw's fprintf writes an unbuffered stderr a character at a time: a title skipping many draws
spent seconds per frame printing 17 KB RecompileRequest dumps (GTA V ran at 0.1 fps). Reports are
built into one string and written once; dumps stop after 8 per reason (APS5_SKIP_REQUEST_DUMPS,
-1 for all).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A float inline constant (4.0, 2.0, -4.0...) read by an f16 operation is the half value in the low
16 bits (LLVM getInlineEncodingV216); it was the low half of the f32 bits, 0. op_sel[0..2] now
selects the high half of v_fma/min3/max3/med3_f16 sources. GTA V's CAS sharpen computed
rcp(1 + 4w) as rcp(0) and stored black.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
