agc_storage_kept_unit_settle checked that the GPU-mapped direct memory
was write-watched before it made the host import. On Linux, when host
imports resolve write protection and dma-buf imports keep it, the
host-pointer import is tried first in a window that does not stay
watched, and dma-buf only when it fails (importAllocation in
GuestBufferMemory.cpp). Where the host-pointer import of shared memory
succeeds, as on Intel's ANV, the import takes the direct memory out of
the write watch, so the case ran on the compared path: the upload saves
the guest bytes, the first write-back keeps unit 0 by comparison and
drops the saved bytes of every unit it selected, and the second
write-back has nothing to compare. Before e5449936f it stored every
unit whole, over the CPU's byte in unit 0, which is the failure
reported on Linux; on main it throws (technical debt: results over
memory outside the write watch without saved bytes). Neither depends
on the settle change. On Windows, importing watched private memory
(compared there) reproduces both: on 7e181fcc3, with or without this
branch's Texture.cpp change, the second check fails with that message;
on main the second write-back throws.
The case now checks the write watch again after the import and returns
77, naming the reason, when the import took the memory out of it. Where
the import keeps the memory watched (the Windows alias import, a Linux
dma-buf import) it runs as before.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On a host-imported surface a storage write-back keeps the 64 KiB blocks
the CPU wrote since their tracked layer's generation, stores the rest
and stamps the stored ranges with MarkWritten. Settling advanced the
stored layers' generations past those stamps only when no layer kept a
block (or when an adjacent pending surface needed the collect). When one
tracked layer kept a block, every other stored layer kept its old
generation, so the write-back's own stamps read as CPU writes: the next
write-back kept those layers as well and did not store the GPU's newer
results over them.
A tracked layer is one 64 KiB unit when the surface has block units:
tiled (not linear), 64 KiB-aligned base, not thick, with layer and block
tracking on. Otherwise it is an array layer (64 KiB-aligned layer
slices, layer tracking on) or the whole surface.
Settling now collects and advances each stored layer that kept no
block; a layer that kept a block keeps its old generation and
re-uploads at its next use, as before. When no stored layer advances
(nothing stored, or every selected layer kept a block, such as a single
tracked layer that kept one), no adjacent pending surface needs the collect
and no unit was retiled into the unit shadow, settling still skips the
collect, as main did. Units retiled into the unit shadow are now marked
at the settle collect's generation also when a block was kept; main
marked them at TrackerGeneration() there without collecting. The two
differ only for a CPU write to a stored unit made after the keep
decision: main left it to a later walk, which made the retiled unit
stale so the CPU's bytes won; now the walk stamps it at the marked
generation and the stored results win, as they already did when no
block was kept.
agc_storage_kept_unit_settle uses a 1024x512 RGBA8 surface in 64 KiB
tiling (32 block units): it writes one byte of unit 0 from the CPU,
stores a red clear, stores a blue clear, and requires units 1-31 to
hold blue and unit 0 to keep the CPU's byte after both stores. On main
the GPU-mapped direct memory case fails with unit 1 still red. The
watched-memory case (host imports off: the write-back that stores
through the CPU) passes on main; it guards the kept layer's old
generation and fails when settling also advances a layer that kept a
block. The test returns 77, naming the reason, when the direct-memory
case cannot run: no write watching, no host imports, direct memory not
write-watched, or its host import refused.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every library under core/libs/prx links the libc and libkernel import
libraries, and every NID patch step depended on the unpatched libc.prx.
GNU ld 2.46 rewrites the import library on every link with new archive
timestamps (the member headers and the symbol map header), so the restat
on the link edge never pruned anything: one libc or libkernel .cpp edit
relinked all 124 libraries and re-patched all of them.
On MinGW the shared library link now writes the import library to
<implib>.new with SOURCE_DATE_EPOCH=0 (ld then writes zero member
timestamps), makes the symbol map deterministic with ranlib -D and copies
the result over the import library only when its bytes differ
(cmake -E copy_if_different). The link edge keeps restat, so a link that
keeps the exports leaves the import library untouched and prunes every
dependent link. The SOURCE_DATE_EPOCH also zeroes the export directory
TimeDateStamp of the DLL; the COFF header TimeDateStamp that the unwinder
keys on is unchanged.
The NID patch steps only use the names libc exports. nid_patcher
--write-export-list writes those names, normalized and sorted, to
libc.exports and leaves the file untouched when they did not change; the
patch steps read it with --preserve-export-list and depend on it instead
of libc.prx, on every platform. A patched library is byte-identical to
one patched against libc.prx.
Measured on Windows (GCC 15.2, -j 4, loaded machine) after touching
libc/src/Strings.cpp: with CMAKE_LINK_DEPENDS_NO_SHARED off, 124 links and
124 patches in 74.9 s before, 1 compile, 1 link, the export list and the
libc patch in 4.3 s after; with it on, 124 patches in 7.8 s before and
the same four steps in 5.3 s after. Touching libkernel/Time/Time.cpp
runs 123 links and 123 patches (89.1 s) before and one compile, link and
patch (3.4 s) after. Removing a libc export still relinks and re-patches
all 124 libraries.
nid_patcher_macho covers --write-export-list (sorted normalized names, no
rewrite when unchanged, rewrite when changed) and --preserve-export-list
(the same exports kept as with --preserve-exports; malformed lists and
two references refused). It fails on main, where the option is unknown.
Sources: SOURCE_DATE_EPOCH, https://reproducible-builds.org/specs/source-date-epoch/;
ranlib -D and ld --out-implib, GNU binutils documentation; ninja restat,
https://ninja-build.org/manual.html#ref_rule.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The driver had no handler for the PFP INDEX_ATTRIBUTES_INDIRECT packet,
so a submission with it threw "opcode is not known in the reference".
The packet now reads the 16-byte record at attribute_base +
attribute_index * 16 when it executes and loads INDEX_BASE,
INDEX_BUFFER_SIZE and INDEX_TYPE from it as the direct packets do.
The packet encoding follows PAL's BuildIndexAttributesIndirect and the
record layout PAL's IndexAttribIndirect (gfx9Chip.h, c5e80007).
indirect_mode 1, reserved bits and record index types above 3 throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The front end rebuilds operand flushes, NaN checks and bitcasts for every
use of a register, and nothing merged them when SPIRV-Tools is off. A
dominator-scoped value numbering pass before SPIR-V emission replaces a
pure value with an earlier identical one in the same or a dominating
block. Only operations that are functions of their operands are merged;
loads, stores, atomics, barriers, phis and cross-lane reads are left
alone. A block the entry does not reach throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA03671 fails to load because no library exports NID zBsgF0q8DIM from
libScePad. The NID database has no name for it and no candidate pad name
hashes to it, so it is exported under its NID as
scePadUnknown_zBsgF0q8DIM, declared without parameters, and throws when
called. Adds an Unknown function info entry to the libScePad debt file.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A hang with threads in Driver::waitMemory takes a ten-minute boot to
reproduce, and the existing switches show only the first submissions of
one queue (APS5_DUMP_QUEUE) or a rejected one (APS5_DUMP_REJECTED).
Capture. APS5_DUMP_SUBMITS=<dir> writes every submission the driver
accepts. <dir>/index.txt starts with "aps5-submissions 1" and "ordinal
queue type serial time_us dwords kind file held conditional", then one
line per submission: acceptance ordinal, queue id, graphics or compute,
serial, microseconds on the APS5_TRACE_GPU clock, dword count, kind,
file name, the dword offsets of the waits held at submit
(Submission::heldAtSubmit) and the COND_EXEC and predicated indirect
buffer ranges (Submission::conditionalEnds) as start:end, "-" for none.
<dir>/submission_<ordinal>.bin holds the copied dwords, indirect
buffers inlined. REWIND tails are listed as rewind with the serial of
their submission, suspend points as suspend without a file.
SubmissionCapture::Prepare copies the commands before the driver lock;
Take, under it after reserveOutputs, sets only the ordinal, time and
held waits and does not allocate; the file and then its index line are
written after the lock. A failed write reports the failure to the driver
(Driver::ReportFailure) and throws, so every later driver call throws
too. Unset, Submit tests a static pointer. An index written before the
held and conditional columns ("ordinal queue type serial time_us dwords
kind file") is read with both unknown.
Analysis. agc_pm4_replay <dir> [--full] decodes each submission and
throws on a packet the driver rejects (a corrupt capture). It does not
model cross-queue timing: a wait is released only when the capture
alone proves that the driver releases it (WaitMemory.cpp,
LabelHistory.cpp), and unknown, with the reason, when its outcome
depends on when another queue's stores run. A memory wait is released
when its compare always passes, when it was held at submit, when the
last store to the awaited bytes before it on its queue covers them with
an accepted value, is not conditional and no other queue stores to
those bytes anywhere in the capture, or when a RELEASE_MEM or
WRITE_DATA label earlier in the waiting submission that the label
history keeps (KeepsLabelStore, not conditional) stores an accepted
value and fewer than LabelStoreHistory other stores to the awaited
bytes can run between it and the wait: those between them on the
waiting queue and every store of another queue to those bytes, since
the history keeps the last stores per dword over all queues and finds
only a store that ran after the waiting submission entered the driver.
A REWIND is released when its tail is in the capture; one valid at
submit without a captured tail is unknown, because the driver reads the
valid bit again when the queue reaches it. A wait is unreleased when it was not held at submit and no
store that can run before it may write an accepted value (a store of
part of the awaited bytes or of a run-time value may; a store later on
its queue runs after it): the GPU does not release it, a CPU or shader
store could. A REWIND without a tail that was not valid at submit is unreleased. Every other wait is
unknown: "depends on cross-queue timing (stores on queue X at #...)"
when another queue stores to the awaited bytes, otherwise because the
last store before it on its queue is conditional, stores a run-time
value or part of the bytes, or overwrites an accepted store the capture
does not prove still in the label history. Without the held column a
wait that would be unreleased is unknown; without the conditional
column every packet after a COND_EXEC or predicated INDIRECT_BUFFER is
conditional to the end of its submission. The outcomes depend on the
order of each queue's stores and on which stores other queues make, not
on the submit order across queues. The report counts the outcomes,
routes and cross-queue unknowns, says when the index lacks the columns,
lists up to 32 unreleased and then unknown waits newest first with the
packets around them and their stores, then the last submissions of
each queue; exit code 1 when a wait is unreleased, 2 on errors.
Pm4 gains DecodeStores, DecodeWait, DecodeConditionalWrite,
DecodeConstantRamDump, the COPY_DATA and DMA_DATA field helpers, the
sample dump layout and RewindValid; Execute, ResolveStore, Validate,
DecodeMemoryCopy, the driver's sample dump, noteHeldAtSubmit and
executeRewindTail use them. LabelStoreHistory and KeepsLabelStore move
to LabelStores.hpp, used by noteLabelStore and the analysis.
Test. agc_driver_pm4_replay submits command buffers built with the
libSceAgc builders through the driver with the switch set and checks the
index, the held waits, the COND_EXEC range, the dwords, the decode and
the outcome of eight waits, including WRITE_DATA 1, WRITE_DATA 0,
WAIT == 1 in one submission, which the driver releases through its
label history. Hand-made captures check each release route, a store of
another queue to the awaited bytes that entered before or after
(unknown), the label history limit with later stores on the waiting
queue or on another queue, a fill the history does not keep, a store
in an earlier submission overwritten later, later stores, rejected
values and a missing rewind tail (unreleased), the six captures of the
reviews (none released but the wait held at submit), five groups of
waits in eight submission orders with identical outcomes, an index
without the held and conditional columns and corrupt captures. A
directory in place of the next submission file makes the write fail,
and the submit, the next submit and shutdown throw.
agc_driver_pm4_replay_tool runs the tool through
tests/Pm4ReplayTool.cmake and checks exit codes 1 and 2.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Reading src_shared_base, src_shared_limit, src_private_base or
src_private_limit (scalar source codes 235-238) refused the shader since
#1940, because their values were unknown. They now read as the 64-bit
apertures that the flat routing from #1190 classifies: a base is the
aperture's high dword over a low dword of 0, a limit is the same high
dword over 0xffffffff (shared 0x80000000, private 0x70000000).
A 64-bit read (s_mov_b64, a 64-bit VALU source, a wave64 lane mask)
gets the whole value and a 32-bit read gets the low dword. A flat
pointer built from the high dword therefore reaches LDS or scratch, and
64-bit compares against the limits order as on the hardware. The flat
routing and the reads share one definition of the two high dwords.
Sources: LLVM SIRegisterInfo.td (aperture registers are 64-bit, their
low 32 bits are always 0 for a base and -1 for a limit) and
getSegmentAperture in AMDGPULegalizerInfo.cpp and SIISelLowering.cpp
(a 64-bit read whose high half is the aperture); the RDNA 2 ISA guide,
sections 5.2, 5.8 (SH_MEM_BASES holds 16-bit bases) and 9.3; the KFD's
MAKE_LDS_APP_LIMIT (limit = base | 0xffffffff); the gfx1030 and gfx1035
readouts on #1190 and #3803. The PS5's two high dwords stay inferred,
as the shader technical debt records.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAgcCreateInterpolantMapping resolved the pixel shader's ABI, which takes
the process-wide shader preparation lock until the scope ends, and then
waited under that lock for the vertex shader's background registration
preparation. sceAgcCreatePrimState and sceAgcLinkShaders could wait the same
way. Every other shader registration and ABI resolution queued behind that
one compile: on PPSA07411 the lock was held 8 to 10 s of every 10 s, almost
all of it waiting for registration preparations, while its loader threads
waited 13 to 45 s per 10 s to take it.
A preparation scope now names the shaders it resolves and waits for their
registration preparations before it can take the lock.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A depth plane copy reads every guest layer that no depth surface holds
into a host-visible upload buffer, which the recording batch keeps until
it completes. The batch kept the uploads without their size, so
Recorder::BoundKeptBytes neither submitted the open batch nor waited for
older batches while uploads piled up: with the GPU behind, thousands of
them stayed in flight and host-visible allocations failed with
VK_ERROR_OUT_OF_DEVICE_MEMORY once the host heap's budget was used up.
Keep each upload with its size, as texture uploads are kept.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A weak import is optional: the entry stub leaves it unresolved and the loader sees null, so the title runs. The relinker now records the symbol binding in the call registry and import_audit skips weak imports when computing the current stop. regie5 (PPSA99520) weak-links sceLncUtilLaunchApp and was reported as stopping there while it runs past it.
PPSA50011 imports setpriority and stops at start-up once getpriority is implemented. Accept PRIO_PROCESS, PRIO_PGRP and PRIO_USER for the guest's own process and fail with ESRCH for any other id and EINVAL for any other which, leaving errno unchanged on success like FreeBSD's libc; the value is not applied, since the guest nice is not the host's scheduling class.
PPSA30601 imports these without a known signature. The mangled names
give them: Pair's constructor deep-copies its key and value into the
layout Object iteration already returns and its destructor frees both,
Array::iterator gets its default constructor, copy assignment and
post-increment (returning the copy through a result pointer, as begin
does), and MemAllocator::notifyError is the base class's empty virtual.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Dh1MhYBFyzxRceoAxrepZ6
The zero fill kernel (v_mov_b32 v1, 0; buffer_store_format_x) is also emitted with other inline
integer constants as its source. Run as compute dispatches, those writes are pending writes of
unknown value, so a later read of DCC keys over their range waits for the dispatch. A constant of
0 to 64 or -1 to -16 is now matched like the zero fill and stored as a buffer fill of that value.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean