A DISPATCH_INDIRECT read on the GPU took its group counts unchecked. A count
buffer that a skipped producer never wrote (PPSA08427: 0xffffffff left by
skipped depth-plane passes) launched up to 2^32 groups and kept the GPU busy
until the title hung. The CPU path already refuses counts above
maxComputeWorkGroupCount.
- Recorder::RecordDispatchArguments copies the three counts from the import
into a 12-byte indirect buffer with a one-thread kernel
(DispatchArguments.comp), all three 0 when one exceeds the device limit, as
RecordMeshArguments does for mesh indirect records.
- VulkanDevice records the dispatch from that buffer; without the kernel the
import is read directly, as before.
- agc_driver_indirect_dispatch_limit: 0xffffffff groups run nothing, one group
still runs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Q8tinbP1MUpUaDsbNWnGnu
Since #5364, Draw/DrawRegisterKey.hpp includes Shaders/ShaderRegistry.hpp,
which reaches ShaderMemory.hpp and its "Recompiler.hpp". tests/Pm4.cpp
includes DrawRegisterKey.hpp, but agc_driver_pm4_tests only links
libSceAgcDriver, libc and libkernel, so the recompiler's include
directories are not on its path and Pm4.cpp no longer compiles. The test
targets that already reach ShaderMemory.hpp link shader_recompiler_agc_driver;
this one now does too.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Windows the write watch is dropped in whole 64 KiB blocks
(WriteWatchCoverage::Exclude), but the unwatch hook was given the page
range of the import. An image with results pending in the same block as
an imported page, outside that page, lost the watch without its guest
bytes saved, and storing its results threw.
The hook now gets the span of blocks Exclude drops (ExcludedSpan, the same
block math), so every image with results pending in those blocks saves its
bytes first.
A multisampled depth target is created as, or already is, the native depth owner, and a target whose HTILE overlaps a resident depth guard aliases one. Neither may have its HTILE read or rewritten by the generic store-back: the expanded words would be a guest write over the owner's range. DepthSurfaceView decides this before the store-back, which still runs before GpuMutex() and the surfaces mutex are taken. NativeMultisampleDepth binds the owner and a single-sample alias of its HTILE and checks the words stay untouched.
A fill or clear the driver recognizes over an HTILE drops the range's last-read generation, so the
next bind reads the words and stores them back even when the write tracker did not see the fill's
stores. A depth view of slice 1 or later reads the HTILE at its own address
(DB_HTILE_DATA_BASE + slice * HtileMetadataBytes); the HTILE word layout is only modelled for slice 0,
so such a slice takes the clear and the store-back only when all its words are equal and keeps its
fill-time fast clears otherwise. DepthTarget::slice carries DB_DEPTH_VIEW SLICE_START.
agc_driver_depth_fast_clear_submit: an unrecognized kernel clears the HTILE on two frames in a row and
both clears are taken; slice 1 with words that are not all equal is refused and stored back untouched;
slice 1 with equal words takes the clear. agc_driver_graphics checks the decoded slice.
The bind-time HTILE read covered one word per 8x8 tile from DB_HTILE_DATA_BASE, but main models the
HTILE as the pipe-aligned SW_64KB_Z_X metadata (HtileMetadataBytes, the extent HtileFillCovers takes):
at 1920x1080, 1856 of the 32400 tile words lie past the first tiles*4 bytes, so they kept ZMask 0
after a store-back. The read and the store-back now cover the whole metadata and run before the
surfaces mutex is taken, since both wait for recorded work over the range. The tests' HTILE arrays
hold the whole metadata.
PPSA25344 (Unreal Engine 5) decodes its depth through HTILE in its Nanite depth export after the
depth prepass and takes ZMask 0 as a tile holding the clear value; the new
agc_driver_depth_fast_clear_submit case checks that a draw after a fast clear leaves every word
expanded.
A sampler voice set up with an all-zero format has no channels. Adding no
waveform blocks to it, or setting a matrix with no levels, threw
std::invalid_argument, which ends the title.
Accept both on such a voice: the empty add only applies RESET and the
CONTINUE state, and the empty matrix clears that matrix, which rendering
already treats as unset. Blocks with data, APPEND, and an empty matrix on
a voice with a format are still refused.
Steins;Gate Re:Boot (PPSA36591) clears a voice this way when a button is
pressed at its title screen.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
LibAtrac9 defines six channel configurations but indexed the table with all eight values of the 3-bit field, so indices 6 and 7 read past it and initialized a decoder from the bytes that follow. The config data check now fails for them, which sceAjmDecAt9ParseConfigData, AJM initialization, libSceAudiodec and NGS2 already report as invalid config data.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The settle queue on another family is only created under _WIN32, so on
Linux the test always skipped with a reason check_skips does not accept
and the linux job failed on every main build since #6060.
Co-Authored-By: Claude <[email protected]>
