The Linux entry stub built a copy of the entry parameter block holding
argc and a pointer to the host argv array, so the guest read that pointer
as argv[0] and uninitialised stack as argv[1..]. The process stack at
entry already has the guest's layout (argc as a qword, then the argv
pointers and a null), so pass rsp itself.
Test: linux_entry_argv relinks a fixture whose entry checks argc and
argv and runs the output on Linux x86-64.
The draw resource key holds each read-only buffer's V# base and size and every
ShaderData/FlattenedSrt word, so draws whose buffers move per frame (constant and
vertex rings) never hit a template. The key now leaves those out; a hit checks every
moved read-only buffer (accessible, no pending or shadowed writes over it) and
rebinds it from its new address with the template's push adjustment, and data words
that changed get a fresh data buffer with the template's patches. A template whose
buffers cannot be rebound counts as a miss and is built fresh.
APS5_NO_MOVED_BUFFER_TEMPLATES=1 keys the words as before.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The source-handle memo poisoned only compute failures, so a draw stage whose resource
walk cannot resolve was recompiled, and threw, on every draw. Draw stages are now
poisoned too, keyed with the linked programs, and a memoized failure rejects the draw
without an exception.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Batch jobs were stored as a 72-byte header plus 16 bytes per buffer, so one decode
job took 104 bytes. GTA V initializes its MP3 batches with 0x40 bytes, every
sceAjmBatchJobDecode returned SCE_AJM_ERROR_OUT_OF_RESOURCES and its streamed
music and speech stayed silent. A job is now a 32-byte record, its buffers, and
its parameters only when it has any; the MP3 test decodes through a 64-byte batch.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
processFlip set lastFlipVblank to the vblank count after the host present
returned. When the acquire, the wait for an earlier presentation or the
present itself crossed the next vblank, the next flip's target moved out
by one vblank even when that flip was already queued: a frame ready in
17 ms was shown for 33 ms, and a title that advances its logic by a fixed
step per presented frame ran in slow motion.
A flip takes effect at the vblank it is released at, so that vblank is
now the one the next flip's interval counts from, recorded when the flip
is released. Flip events, flipStatus and flipPendingNum are unchanged.
Test: video_out_flip_tests pacing (needs a GPU and a display) submits
the first flip at flip rate 2, whose presentation opens the device and
spans several vblanks, and checks that lastFlipVblank is 3.
EmitSetAttribute read state.inputInfo.vertex->clipSpace for every
position export. A pixel shader has no vertex input info, so a pixel
program that exports a position dereferenced a null pointer and crashed
the process; three words (0xf80008cf, 0, s_endpgm) are enough.
EmitSetAttribute now throws "vertex input info is missing for a position
export", as EmitAuxPositionExport already does for auxiliary positions.
Found by fuzzing the recompiler with mutated pixel shaders.
agc_pixel_position_export recompiles that program and expects the error;
it segfaults without the change.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01R5WJS4ZdQynAJesCZKH5hb
V_WRITELANE_B32 writes the selected lane regardless of EXEC, but the
translation routed it through the exec-masked VGPR write, so a spill to an
inactive lane was dropped. The WriteLane test now writes lane 5 while only
lane 0 is active.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Every draw stage's capture walks the shader's SRT plan with an Evaluator
whose per-value memo was a std::unordered_map: a node allocation per
evaluated value, and out-of-line calls for Opcode, IsIdentity, Resolve
and Argument on every step. The walk took ~17 us of every capture at
PPSA21564's title (about 1.25 s of the queue worker's 10 s).
The memo is now an open-addressing table keyed by the value pointer,
and the accessors are inline. Evaluation order, results and failures
are unchanged. The capture walk drops to ~10 us.
A sampler (or texture) chosen by scalar control flow reaches the image
operation as a Phi of two ReadConst values. The SRT walker only accepts
invariant Phis, so GetHandle threw "GetSamplerResource dword 0 is not a
valid runtime value" and the draw was skipped (G-buffer and HDR draws
in PPSA21564).
Before tracking, a read-only image operation (sample, gather, LOD query,
size query, load) whose descriptor dwords are Phis of one block is
copied once per distinct incoming descriptor. Each copy gets its own
memory entry and descriptor handles whose dwords are the edge's values,
recomputed before the operation (SRT reads, user data, the shader base
and pure uniform arithmetic over them only). The results are selected
by a Bool Phi of the edge that entered the Phi block. The copies run
where the original did, so implicit derivatives are unchanged, and the
host binds every edge's descriptor. Any other shape (a nested Phi, a
dynamic read on an edge, a store or atomic) is left alone and still
throws.
A selection whose one arm only returns (kill or s_endpgm) and whose other
arm branches straight to the merge of an enclosing selection had no
structured merge, so the draw was skipped. PPSA21564's BotEye G-buffer
pixel shaders (eight variants) have this shape.
When no other split applies, the edge from such a header to the shared
join is now split into an empty block, which becomes the header's merge.
A RELEASE_MEM with an interrupt select drained the device: the queue
worker submitted everything recorded and waited for the GPU before it
stored the label and delivered the interrupt. PPSA21564 issues about 300
of them per frame, so the worker and the GPU took turns.
The label is now recorded like any other (on the GPU behind the work, or
as a completion action behind pending write-backs), and the delivery
becomes a completion action of the batch holding the work before the
packet (Recorder::AfterRecordedWork, after the batch's earlier
completions). It is counted with the completion labels, so idle workers
and pollers reap it, and it starts the label flush deadline. With draws
or dispatches recorded since the last submit the batch is submitted at
once. A batch holding only label stores stays open and goes out with the
next work, at the label flush deadline, at a wait, at a flip or at the
end of the submission, like any other pending label. A label the GPU
cannot store, or one that does not decode, still drains.
The interrupt so never arrives before the work ahead of it completed and
its label landed; it can only arrive later, by at most the flush
deadline plus the work recorded into the same batch.
Every vertex attribute copied its own range of guest memory, so a draw
over an interleaved buffer copied it once per attribute (seven or eleven
times for PPSA21564's level meshes). Attributes with the same stride and
input rate whose first elements lie within one record now share one copy
of their union, each bound at its offset into it.
Every SET_*_REG packet stored each register into a std::map, and every
draw read dozens of them back through map lookups (the decoders, the
draw key's range walks, the prechecks). PPSA21564 sends ~350k register
packets per 10 s at the title, and the map's node allocations and tree
walks were a visible share of the graphics queue worker's time.
Registers is now a flat value array with a presence bitmap per bank. It
keeps the map's interface and semantics: absent registers stay absent,
iteration and lower_bound walk the present registers in offset order,
emplace does not overwrite and at() throws for an unset register.
PPSA21564's final composite renders into 4K 10-bit scanout buffers
(COLOR_2_10_10_10 with the alternate swap, A2R10G10B10). No guest texture
format matched that color format, so the target stayed non-resident:
every frame's composite draw ran synchronously (about 11 ms, 143 per 10 s
at the title) and the flip read the frame back through guest memory.
The blue-low 10-bit color target now keeps its bits in the storage image
of its surface's red-low 2-10-10-10 format, as B8G8R8A8 targets map to
R8G8B8A8.
Presenting it: DisplayTexelFormat names a display buffer's texel order as
the guest-memory path reads it (R8G8B8A8 base: red low, else blue low;
the 10-bit variant: A2B10G10R10 or A2R10G10B10). ResidentPresentPath
blits a resident image only when it holds the display's 8-bit texel
format (an exact copy). A 10-bit image (whose blit would round where the
guest path drops the low two bits), the other 8-bit order or an sRGB type
is converted instead: GpuColorTransfer::DetileImage copies the image's
texels raw and runs the guest path's own conversion shader on them, so
both paths present the same pixels.
The image's write-back is unchanged: its results stay pending like any
resident target's and are stored when a reader of the memory flushes
them.
Tests: agc_driver_recorder_tests checks the format decision for both
8-bit and both 10-bit orders, and converts an image in each order,
comparing it with the CPU decode and the GPU detile of the same words in
guest memory.
ColorTargetLayout built its SW_64KB_R_X offset tables in every
constructor, and every draw constructs a layout per color target while
decoding and again while setting the target up. The tables depend only on
the element size; they are now built once per size under std::call_once
and the layout points into them.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Replace the decoder-less AvPlayer with a player that demuxes MP4 sources
with FFmpeg (opened by path or through the title's file replacement),
decodes H.264 and AAC on their own threads, and hands out NV12 frames and
interleaved 16-bit PCM in buffers from the title's allocators, presented
on a media clock that audio drives when it is enabled.
Both libSceAvPlayer and libSceAvPlayer.native are built from the same
sources and link the shared ffmpeg target. The struct size checks stay,
next to the types in SceTypes.hpp. ChangeStream and GetStreamInfoEx are
implemented; Init without allocators, StartEx, SetAvailableBandwidth,
SetLogCallback and negative trick speeds succeed as before and are listed
in TechnicalDebt. HLS sources throw.
guest_avplayer plays an embedded 6 KB MP4 (H.264 plus two AAC tracks).
Every guest memory read checks the pending storage images for results it
must store first (FlushPending, overlappingPending and the overlap test of
shader resources), each by a scan of the whole registry, and each scan read
the thread-local `refreshing` once per image (an emutls call with MinGW).
The registry now keeps a sorted, merged index of the ranges its images
cover, rebuilt on the first query after a change: a query that overlaps
none of them returns without a scan. The scans read `refreshing` once.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
sceSaveDataDelete appended the title's directory name to the save root
without any check and passed the result to std::filesystem::remove_all.
"../victim" removed a directory beside the save root, ".." the directory
holding the save root, and an empty name or "." every save. The name
now has to be terminated within its field, non-empty, not "." or "..",
and free of "/", "\" and ":", as sceSaveDataMount3 already requires;
otherwise the call returns SAVE_DATA_ERROR_PARAMETER and deletes nothing.
The native library gains its own CMakeLists.txt, with the same library
definition as the generic one, to register guest_savedata_delete.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01R5WJS4ZdQynAJesCZKH5hb
Take scanned every retained slot of its tier for one with the same size,
usage and memory properties, so the slot bound stayed at 512. With 512
slots GTA V's in-game builds overflowed the small tier: each draw evicted
and recreated buffers, and the submission thread spent most of its time
in the driver's allocation and free calls. The slots are now kept in
lists per key, oldest first: Take pops the newest of its key, eviction
takes the oldest front. The bound is 4096 slots per tier, held to a sixth
of maxMemoryAllocationCount.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
MIMG opcode 0x33 samples with explicit derivatives, an LOD clamp and a
texel offset. The three address flags already exist; only the opcode was
missing from the decoder table.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The LOD clamp of an image sample looked for the MinLod capability in the
emitter's own requirement list, which nothing fills, so every sample with
a clamp failed to compile on every device. The check now reads the
capabilities of the target, and a sample that takes the MinLod operand
declares the capability in its module.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
RomainROCH