Over budget but within a quarter over it, the sampled texture cache refused no use of a texture it does not hold, so a cyclic scan over a working set larger than the budget rotated the whole cache and hit almost never. The first use of a key in a present is now refused (used for its draw, never cached) when the least recently used entry was used in this or the previous present. A later use of the key is refused only when that entry was used in this present, so a texture used several times per present is still admitted on a later use. The refusal does not apply past the quarter-over ceiling, so a budget that falls still evicts.
The test lowers the budget through OverrideCacheBudgetForTest instead of the environment. The debt entry records the unmeasured present window, that a texture used more than once still rotates the cache, and the one A-B-A measurement.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
When the list read at submission is invalid, the worker now always
executes the copy read again where the packet runs. With
APS5_SKIP_INVALID_INDIRECT_REGISTERS=1 only that copy's invalid entries
are skipped, so the valid entries of a partly updated list are written
instead of the stale ones from submission.
testPartlyUpdatedRegisterListSkipsOnlyItsInvalidEntries submits a list
that is invalid at submission, updates it to a valid entry plus an
invalid one before its packet runs, and reads the register back with
COPY_DATA.
SET_*_REG_INDIRECT lists are read when the command buffer is submitted.
When that copy holds an offset dword that is no register offset, the
queue worker now reads the list again where the packet executes (as the
console PFP does) and uses that copy if it is valid.
PPSA23566 (UFC 6) intermittently submits a SET_CONTEXT_REG_INDIRECT
whose first entry is 0x038f038f or 0x03900390 in both copies, followed by
180 valid pairs, and the title stopped with "extended register semantics
are not implemented". With APS5_SKIP_INVALID_INDIRECT_REGISTERS=1 the
invalid entries are skipped and the other registers are written; without
it the packet throws as before.
A pixel shader on the mesh path that reads barycentrics on a device with
neither VK_KHR_fragment_shader_barycentric nor VK_EXT_mesh_shader
reported only the missing mesh shaders. Say that the device has neither,
so reports from such devices are told apart from the case the emulation
covers.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
A pixel shader that reads barycentrics on a device without
VK_KHR_fragment_shader_barycentric used to need a vertex shader so a
generated geometry stage could follow it, which a mesh pipeline cannot
have. The mesh program is now compiled a second time with the layout
its pixel shader needs: it writes its clip position as a varying and the
three corner positions of each primitive as per-primitive outputs, and
the pixel shader solves for the weights, for both smooth and linear
interpolation.
The layout is part of the mesh cache key, the stored artifact and the
captured request. Without VK_EXT_mesh_shader the draw still throws, now
saying so. Per-vertex parameters on the mesh path still throw.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
writeBackWindows retiles the kept 64 KiB units through the windows of the
surface's (layer, mip) slices. A unit can lie outside every window: the
tracking grid spans the whole guest range flat, while the slices of a 3D
surface taper in depth (HasLayer), so the upper depth slices' higher-level
blocks belong to no window. The empty window set then sized the retile
linear and scratch buffers at zero, and the zero-sized device buffer threw
'AGC graphics: zero-sized device buffer', aborting the process.
Keep such units as the guest left them: there is no tiled data of the
surface to retile or store. The caller alone accounts for the unit.
Results that land in a unit whose store ran while its blocks were
watched, after those blocks left the watch while nothing was pending,
have neither saved bytes nor a watch: the unwatch hook found nothing to
save and the write-back refuses as before (#7017). The entry named only
the range that leaves the watch without the hook running over it.
A MarkWritten whose fresh collect fails (a no-access or unwatchable
resident page inside the 64 KiB block span) took the span out of the
write watch without running the unwatch hook, so pending storage-image
results over it kept no saved guest bytes and their write-back refused:
storing storage image results pending over memory outside the write
watch without the guest bytes saved before them is not implemented
(#7017, Palworld PPSA23126 among others).
The hook now runs over the block span before the blocks leave the
watch, as Unwatch and the import fallback do, with the tracker lock
released for it like #6308 does for imports. The debt entry drops the
failed collect from the unsaved cases.
The check makes a collect fail over a no-access arena page and requires
the hook to have covered the block; it needs the WindowsMappings
protection failure, so it runs in the Windows-only section of the write
tracking test.
A layered draw into a color view of slices 0 to 5 of a 2D surface whose
CB_COLOR_ATTRIB3 declares one slice was refused. The CB clamps the
render target array index to the view's SLICE_MAX, not to the surface's
slice count, so each layer is written one slice pitch further on.
PPSA01317 renders a 512x512 cube map this way. Such a view now renders as
a 2D array of the view's last slice + 1 slices.
AI-assisted: yes
A RELEASE_MEM with DATA_SEL 4 was refused as "GDS RELEASE_MEM data".
amdgpu's GFX10 packet header gives 4 as the 64-bit system counter and 5
as GDS data. Validation now refuses 4 as the system counter, whose
console frequency and epoch are not known, 5 as GDS data and 6 or 7 as
reserved, and the debt file records the system counter.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A title can relocate a registered shader header, and the register, special and
semantic arrays it points at, into memory of its own and resolve the ABI with
that copy (Astro's Playroom, PPSA01325, #2914). SameHeader accepted such a copy
only while every pointer inside it stayed put, so a moved array left the
resolution throwing "refers to a replaced shader header".
Accept the copy when every array it names still holds the registered bytes: the
registered header then decodes what the copy describes, nothing is copied and
ShaderSnapshot stays immutable. A copy whose arrays differ or are unreadable
still throws.
A multisampled DCC color target imports its uniform DCC fast clear on
first use and then refuses any later change to its color, DCC or CMASK
memory. Titles built on the PS5 Mesa stack fast-clear such a target
every frame with two buffer fills, the CMASK to 0xcc (FMASK cleared,
color expanded) and the DCC to a uniform clear key, so the second
frame stopped on "writes to a resident multisampled DCC target or its
metadata are not implemented".
The fills of a resident DCC target's metadata are now noted. When a
fill covered the whole DCC range since the last use and the range holds
its key once pending writes land (LandedUniformMetadataByte, which
reads the bytes directly rather than through the resident read guard),
the next use clears every sample to that key's color, as the import
does, and takes the new DCC and CMASK generations. A CMASK written
since must have been filled whole too. Partial fills, other keys,
CMASK-only writes and any write to the color memory are still refused.
Fills of a DCC target's CMASK no longer go to the CMASK-only fast-clear
tracker, which refused the expanded code 0xcc.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The saver thread took the snapshot lock with a blocking exclusive lock. Behind
a pipeline creation that runs for minutes (an NVIDIA compile of a 1.5M-word
compute pipeline), the queued writer made the shared_mutex hold every later
pipeline creation on every queue until the compile ended. The periodic save now
tries the lock and waits for the next interval when it is busy; SaveNow and the
teardown save still wait.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A one-sample depth target under a multisampled rasterizer without
MSAA_ENABLE is drawn as a one-sample draw at the pixel center, but a pixel
program that runs with PS_ITER_SAMPLE threw. Ghost of Tsushima (PPSA02225)
draws its depth-only pass this way (2x PA_SC_AA_CONFIG, PA_SC_MODE_CNTL_1
0x06030000, KILL_ENABLE, no sample index or coverage input) and stops on it.
Every sample is taken to be at the pixel center on this path, so
invocations per sample would get the same inputs and give the same depth,
kill and color results, and the target keeps sample 0's. Such a program is
now drawn once per pixel, without sample shading. ANCILLARY and
SAMPLE_COVERAGE inputs still throw. The debt entry notes that only the
memory writes of such a program can differ.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A pipelined draw read its index buffer from guest memory at commit time,
after the packets behind it had run, so a later dispatch's deferred
storage-image write-back could land in the bytes first. Stellar Blade
recycles its full-screen quad's index buffer for a 66x66 image when the
menu loads, and aborted with "vertex fetch exceeds descriptor record count".
Deferred write-backs now wait while a queued draw still holds a read of the
range. APS5_NO_QUEUED_DRAW_READ_ORDER=1 restores the old order; [draw]
reports held read ranges and stores.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
With DB_SHADER_CONTROL.STENCIL_OP_VAL_EXPORT_ENABLE the pixel shader
supplies the value that REPLACE_OP and the add and subtract operations
use in place of DB_STENCILREFMASK.STENCILOPVAL. The bit was refused as a
whole, which stopped Onimusha: Way of the Sword (PPSA27836) at a
DB_SHADER_CONTROL 0x45 draw with DB_STENCIL_CONTROL 0x40040 (REPLACE_OP
on depth pass, both faces), write mask 0xff and compare ALWAYS.
The export is accepted with the 32_GR and 32_ABGR Z formats. When no
reachable operation through a non-zero write mask reads the value, it
cannot change the result and is ignored. Without a test value export, a
reachable REPLACE_OP becomes REPLACE with the exported value as
FragStencilRefEXT (or the bounded replay on devices without the
extension), provided both faces compare without the test value and use
no ONES or REPLACE_TEST; early tests throw. The add and subtract
operations, and REPLACE_OP with a test value export, still throw.
The value is read from bits 8-15 of the second MRTZ channel: the
title's pixel shader shifts it left by 8 right before exp mrtz
(v_lshlrev_b32 v0, 8, v0). That is the only evidence for the layout and
it is listed as technical debt. The pixel stage info carries the new
flag into the cache key, the draw keys and request serialization
version 31.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Mark described image-table ranges explicitly and apply the eager color-target guard only to ordinary image bindings. Cover native multisample table validation and record the separate table registration gap.
A CPU read of DISPATCH_INDIRECT arguments waited only through the flush
hook, which waits for the ranges recorded work noted as pending writes.
An address-based store (FLAT/GLOBAL, or through a descriptor the
recompiler cannot resolve to a static buffer) is not recorded as a
pending write: its batch leases the registered allocations, and only the
guest pin waiter finished that batch. So the thread-dimension,
misaligned and disabled paths, the fill-kernel path and the device's CPU
fallback read the arguments from before an address-based producer ran.
GTA V (PPSA04264) dies loading Story on such a read: a 64-thread clear
kernel read {160, 288, 0xffffffff} as thread dimensions
(3x288x4294967295 groups), bytes its 1-thread setup kernel had not yet
overwritten with {n, 1, 1}, and threw "workgroup count
3x288x4294967295 exceeds device limits".
Every CPU read of dispatch arguments at execution now first finishes the
recorder up to the newest batch recorded with a lease
(Graphics::FinishLeaseWork). The group read-ahead still reads without
waiting; a dispatch it resolved is adopted only when the execution-time
read gives the same counts, and one that differs is dropped and counted
in the [groupcap] line. The device limit error names the argument
address and cpuReason, and the driver adds the queue, path and
read-ahead outcome. The [indirect] read time includes the lease wait,
and the [recorder] sync-site table records the offset of
FinishLeaseWork's caller. The CPU reads that still miss address-based
writes (indirect draw arguments and count, the copy kernel's count
record, the awaits-title checks) are listed in the technical debt.
IndirectArgumentsPendingProducer covers the execution-time CPU argument
reads on compute queues and the pending-label CPU fallback in the Vulkan
device. Its sixth case records a real argument label behind a host Vulkan
event in an earlier batch and an address-based producer in the later open
batch. The event releases only after that producer batch is submitted;
a bounded watchdog releases for cleanup but fails the case. It requires
a deferred producer lease, an unsubmitted producer at the argument
decision, cpuReason 2 and the fresh arguments and counter result. Small
valid stale counts keep a broken-wait control finite on every driver.
Exact CPU-reason and watchdog diagnostics identify the failing path. This
replaces a spinning workload whose earlier label could retire before
the fallback decision on lavapipe, allowing a false green with cpuReason 0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Codex <[email protected]>
Dean Galvin