A device that supports VK_EXT_device_fault reports, on the first
VK_ERROR_DEVICE_LOST a check sees, the fault description, the faulting
addresses (invalid reads and writes, or the instruction pointers of waves
still running when the device hung) and the vendor fault codes.
APS5_GPU_CHECKPOINTS=1 records a VK_NV_device_diagnostic_checkpoints
marker with the program address before each guest dispatch and prints the
last markers the GPU reached, which names the dispatch that hung. Without
either extension nothing changes.
Test: agc_device_fault drives the report through mock
vkGetDeviceFaultInfoEXT and vkGetQueueCheckpointDataNV entry points.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Co-authored-by: overlordxrz-source <[email protected]>
Ghost of Yotei (PPSA26344, v1.008, eboot 0x2e1cfc) creates an M4AAC
instance (codec 2) and calls sceAjmBatchJobControl with flags
0x200000006000 (RESET | INITIALIZE | SIDEBAND_GAPLESS_DECODE), 8 bytes of
gapless decode plus 8 bytes of M4AAC initialize parameters and an 8-byte
result (#884); INITIALIZE for M4AAC threw on main.
- INITIALIZE (control and sceAjmBatchJobInitialize) reads the 8-byte
{config type (1 ADTS, 2 raw), sampling frequency index} block of
shadPS4 ajm_aac.h at 443f0224; an invalid type or a raw index above 11
returns the invalid parameter result. Raw input is configured from the
instance channels (0 is stereo) as in shadPS4 ajm_aac.cpp.
- RUN decodes ADTS frames (length from the header) and raw access units
(the whole input, as fdk-aac's raw transport) with FFmpeg's AAC decoder
into the instance's S16, S32 or float PCM, with the framework's gapless,
resampling, stream, format and multiple-frames sidebands.
- Without ENABLE_NONDELAY_OUTPUT the first two frames after
initialization or reset produce no output, as in shadPS4. A decoder
error returns CODEC_ERROR | FATAL. The codec info is {heaac, reserved};
the format reports the last frame's bitrate with fdk-aac's formula.
- Throws for what the sources do not settle: ADTS resynchronization,
profiles other than AAC LC, several raw data blocks per frame, channel
configurations other than 1, 2 and 6, more channels than the instance,
HE-AAC without ENABLE_SBR_DECODE, raw input with RUN_MULTIPLE_FRAMES or
several access units, a frame longer than the reserved room, and
unknown codec flags.
guest_ajm decodes an embedded 5-frame stereo ADTS fixture (two chirps,
encoded by FFmpeg 6.1.1's aac encoder at 64 kbit/s) frame by frame, in
one multiple-frames run, as float, as raw access units and with gapless
trimming, and checks sample counts, format, codec info, the delay frames,
RESET, partial input, missing room and the correlation of each channel
with its input chirp at the 1024-sample encoder delay; plus the
INITIALIZE validation results and the refusals.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
A per-lane table V# with num_records 0, a null V# included, threw at dispatch
on its stride (0 is less than the record offset plus 32) although no lane can
hold a record, also when no lane enters the waterfall. With no records every
OOB_SELECT puts each load out of range (the GFX10 table in Mesa's
ac_descriptors.c), so such a table now binds no record and every lane that
runs the access reads zeros; the swizzle, ADD_TID, OOB_SELECT and stride
checks apply only to a V# with records.
The implicit-derivative mode check compared every bound record with record 0,
whose mode is 0 when it is null, so a table with a null record 0 and bound
records of one other mode was refused. Only bound records are compared now.
Lanes whose record is null or outside the table take the zero path under
record 0's mode, so their quad neighbours' derivatives can still be undefined;
the debt entry records this and the 16-record limit of the whole table.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A lane whose IDXEN load was skipped keeps the T# VGPRs it had before, and a
waterfall that reaches it uses that value as its T#. The fold refused only a
value that was itself a uniform descriptor or a table read, so a default T#
copied into the VGPRs under EXEC, or merged by a phi, was accepted and those
lanes read zeros. The skipped lanes' values are now followed through the masked
selects and phis that all eight dwords share, and the fold is refused when an
arm is a descriptor or a table read.
Every lane of a per-lane table runs the access with its own record, and the
runtime image mode picks the SPIR-V path per lane, so lanes of one quad whose
records need different modes take different paths around an implicit-derivative
sample or LOD query, where derivatives are undefined. Such a table now throws
at dispatch; accesses of one table share the check, so they keep one table.
The test also covers v_readfirstlane and v_cmpx_eq_u64 waterfalls and refuses
loops that compare seven T# dwords, run the image instruction after EXEC is
restored, or store.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A waterfall loop (s_ff1 or v_readfirstlane picks a lane, v_readlane copies
its T# to SGPRs, v_cmpx_eq keeps the lanes whose T# VGPRs match, the image
instruction runs, the matched lanes leave the loop) reads the T# from VGPRs,
which no descriptor source evaluates, so planning failed with "GetImageResource
dword 0 is not a valid runtime value".
When every T# dword of an image read, sample, gather or query comes from
v_readlane_b32 or v_readfirstlane_b32 and the EXEC its results are written
under implies that each of them equals the lane's own VGPR, the access takes
each lane's own T#. A T# that each lane loaded with buffer_load_dword* (IDXEN)
from one evaluable V# becomes a bindless image table keyed by the lane's
index, addressed by the V# stride, and its slot is decorated NonUniform.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A descriptor heap that a shader binds whole while only the pieces from its
base are mapped (a sparse heap) is copied on the CPU for every build that
binds it unless a mirror serves it. The sparse heap mirror takes a heap whose
needed extent lies in one releasable registered range. A heap mapped piece by
piece, each mapping its own allocation and the pieces back to back from the
heap's base, is several registered ranges, so every build copied its mapped
run again.
Such a region is now bound in place from an import of that run: an import
already covering it, the run's own import, or one joined over exactly the run
(#4517). This applies to any sparse heap no mirror took, including under
APS5_NO_LEASE_MIRROR or APS5_NO_SPARSE_HEAP_MIRROR. A join is made only for a
region that starts at a registered range, once the previous bind of that
address saw the same last mapped byte: a heap that grows between every two of
its binds keeps the copy, and one bound more often than it grows is joined
again after each growth. Joins stop after 64 per joined run base, with a
message: the heap is then bound in place while an existing import covers its
run and copied otherwise. The records go with their range. The region's descriptor and BDA ranges end at the import's end, which
covers the mapped run and the last view, as the copy does. A region whose
mapped part does not start at its base, with a view past the run, written by
its shader, or whose run is not imported is copied as before. A direct
region whose import ends before it outside this path still fails in
Descriptor, as before.
A set over such a region stays reusable: DirectRegions and InPlaceReads name
the region up to its import's end, so the import's serial proves it, and a
reuse also requires the heap to be mapped exactly up to that end
(CutRegions), checked whenever the imports or the registry changed, so a
mapping past the cut makes the set miss. DirectRegions also refuses a set any
of whose regions bound in place no longer holds the import found at its base
(a later join in the same build retired it); this applies to every region
bound in place.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A storage view of the depth plane that starts above slice 0 was refused. The
layered storage image already spans slices 0..last, and the view starts at its
base slice, so the refusal is dropped and only the slices from the base slice to
the last are copied in and out. The base slice joins the cache key.
DepthStorageDispatch stores through a view from base slice 2 and checks the
other slices stay untouched; it fails without the change.
DecodeInstruction returned before reading the ModRM of FF /3 and FF /5,
so a far CALL or JMP through a RIP-relative pointer had no RIP-relative
displacement. A stub that moved such a JMP copied the displacement
without relocating it.
The decoder was compared with iced-x86 (AMD decoding) over 3.99 million
encodings: every opcode of the legacy, 0F, 0F38 and 0F3A maps under 34
prefix combinations and the VEX 0F, 0F38 and 0F3A maps, each with 48
ModRM forms. Apart from this, it agrees on length, RIP-relative offset,
control flow kind and branch target for every valid Zen 2 instruction
except near branches with a 66 prefix, recorded as technical debt, and
kernel-only returns, which it treats as sequential.
Add the comparison's metadata as cases: one RIP-relative encoding per
opcode, map and immediate size, every FF /r form, and the branch forms
with their flow kind and target. The existing cases check lengths only;
a loop or jrcxz decoded as an unconditional jump passed the whole suite.
Adrià