VK: frame generation through Lossless Scaling, experimental

Interpolates frames between the ones the game draws, at x2/x3/x4. The shaders
come from the user's own Lossless.dll; nothing is bundled or downloaded.

framegen runs on its OWN VkDevice and statically links volk, which defines 655
globals named vkCreateImage, vkQueueSubmit and so on -- including all 124 our
loader declares. Linked into the core those either fail to link or, worse,
merge, and framegen's volkLoadDevice() then repoints the whole RSX renderer at
framegen's device. So it lives in libarmsx3_lsfg.so, reached only by dlopen
with RTLD_LOCAL, behind a C ABI and a version script that exports eleven
symbols and nothing else. Verify with llvm-nm --dynamic --defined-only: only
armsx3_lsfg_* may appear.

Two devices with no shared semaphore means images cross as AHardwareBuffer --
Adreno and Mali both refuse vkGetMemoryFdKHR(OPAQUE_FD) on AHB-imported memory,
so upstream's FD path does not work on this hardware. Capture costs 0.007
ms/frame CPU, measured; the cost is the synchronisation, not the copies.

Notes for anyone reading this later:

  * The shader loader's user pointer must outlive initialize(). framegen copies
    the callback into ShaderPool::source and resolves shaders lazily while
    BUILDING THE CONTEXT, so a stack local there is read back from a dead frame
    -- a segfault executing at a mapped, non-executable address.
  * The "device UUID" is not one. framegen matches (vendorID << 32) | deviceID.
    Zero matches nothing.
  * Imported shaders are cached to disk. They used to live only in the library's
    map, so every restart silently had none and generate() returned 0 before
    doing any work.
  * Capture takes the COMPOSITED swapchain image, after overlays. Capturing the
    game image put the perf overlay on real frames only, so it blinked at half
    the display rate.
  * generate() runs only on a frame the game actually drew, or the PPU/SPU
    compilation screen gets interpolated too.

The pipelined path that would take waitIdle off the critical path is present but
disabled behind k_framegen_pipelining_enabled: holding a frame back conflicts
with frame-context recycling, and at least one reclaim path has not been found.
The serialised path is what works. Frame generation costs some real framerate
and wants a steady one -- interpolating an unstable rate reads as judder -- so
it is labelled experimental in the UI.

3rdparty/CMakeLists.txt

@@ -373,6 +373,15 @@ add_subdirectory(fusion EXCLUDE_FROM_ALL)
 # FERAL INTERACTIVE
 add_subdirectory(feralinteractive EXCLUDE_FROM_ALL)
 
+# LSFG: Lossless Scaling frame generation. Android only, and deliberately NOT EXCLUDE_FROM_ALL --
+# libarmsx3_lsfg.so has to be built and packaged even though nothing links it, because the core
+# reaches it by dlopen rather than by linking. Marking it excluded produces a build that succeeds
+# and an APK with no frame generation in it.
+#
+# The subdir returns immediately when the submodule is absent, so a checkout without it still
+# builds; frame generation simply reports itself unavailable at runtime.
+add_subdirectory(lsfg)
+
 # add nice ALIAS targets for ease of use
 if(USE_SYSTEM_LIBUSB)
 	add_library(3rdparty::libusb ALIAS usb-1.0-shared)

3rdparty/lsfg/CMakeLists.txt

@@ -0,0 +1,147 @@
+# libarmsx3_lsfg.so -- Lossless Scaling frame generation, sealed away from the emulator core.
+#
+# The entire reason this is a separate shared object is symbol collision. volk defines 655 globals
+# named vkCreateImage, vkQueueSubmit, ... and all 124 that our Vulkan loader declares in
+# rpcs3/Emu/RSX/VK/vk_android_loader.h are among them. Linked into libarmsx3-core.so this either
+# fails at link or, worse, merges -- and framegen's volkLoadDevice(itsOwnDevice) then repoints the
+# whole RSX renderer at framegen's VkDevice. See armsx3_lsfg_shim.h.
+#
+# Android only. framegen's non-Android path shares images by FD, which Adreno and Mali refuse for
+# AHB-imported memory, so there is nothing here worth building for desktop.
+
+if (NOT ANDROID)
+	return()
+endif()
+
+set(LSFG_ROOT "${CMAKE_CURRENT_SOURCE_DIR}/lsfg-vk-android")
+
+if (NOT EXISTS "${LSFG_ROOT}/framegen/CMakeLists.txt")
+	message(STATUS "LSFG: 3rdparty/lsfg/lsfg-vk-android is missing, frame generation will not be built")
+	return()
+endif()
+
+if (NOT EXISTS "${LSFG_ROOT}/thirdparty/volk/volk.c")
+	# Called out explicitly because the failure is otherwise mystifying: framegen links volk
+	# PUBLIC, so without it the error names framegen rather than the submodule that is missing.
+	message(STATUS "LSFG: thirdparty/volk is missing (git submodule update --init), skipping")
+	return()
+endif()
+
+# volk, built for Android.
+#
+# VK_USE_PLATFORM_ANDROID_KHR has to be set on VOLK ITSELF, not only on framegen. Without it volk
+# never defines vkGetAndroidHardwareBufferPropertiesANDROID, and the resulting undefined symbol
+# points at framegen -- sending you to debug the wrong target entirely.
+add_library(armsx3_lsfg_volk STATIC "${LSFG_ROOT}/thirdparty/volk/volk.c")
+target_include_directories(armsx3_lsfg_volk PUBLIC "${LSFG_ROOT}/thirdparty/volk")
+target_compile_definitions(armsx3_lsfg_volk PUBLIC VK_USE_PLATFORM_ANDROID_KHR VK_NO_PROTOTYPES)
+set_target_properties(armsx3_lsfg_volk PROPERTIES
+	POSITION_INDEPENDENT_CODE ON
+	C_VISIBILITY_PRESET hidden)
+
+# framegen.
+#
+# Its own CMakeLists expects a target called `volk`, so alias ours rather than patching upstream.
+if (NOT TARGET volk)
+	add_library(volk ALIAS armsx3_lsfg_volk)
+endif()
+
+add_subdirectory("${LSFG_ROOT}/framegen" "${CMAKE_CURRENT_BINARY_DIR}/framegen" EXCLUDE_FROM_ALL)
+
+# Undo the project-wide -fno-exceptions for framegen and the shim.
+#
+# The top-level build sets it with add_compile_options, which every later add_subdirectory
+# inherits. framegen has dozens of throw sites and they do not warn -- they fail to compile. The
+# shim needs exceptions for the opposite reason: it exists to CATCH them so none reach the dlopen
+# boundary.
+foreach (tgt lsfg-vk-framegen)
+	if (TARGET ${tgt})
+		target_compile_options(${tgt} PRIVATE -fexceptions)
+		set_target_properties(${tgt} PROPERTIES
+			POSITION_INDEPENDENT_CODE ON
+			CXX_VISIBILITY_PRESET hidden
+			VISIBILITY_INLINES_HIDDEN ON)
+		# PRIVATE, not PUBLIC: leaking this onto consumers collides with the valueless #define
+		# our own Vulkan headers use, in hundreds of RSX translation units.
+		target_compile_definitions(${tgt} PRIVATE VK_USE_PLATFORM_ANDROID_KHR)
+	endif()
+endforeach()
+
+# Shader extraction: DXBC out of the user's own Lossless.dll, translated to SPIR-V.
+#
+# framegen asks for SPIR-V by name and does not read the DLL itself, so this chain is the caller's
+# responsibility. Building upstream's own libraries rather than writing a DXBC translator: dxbc is
+# DXVK's, and reimplementing it would be absurd.
+#
+# Optional. Without these the library still builds and frame generation still reports itself
+# available -- it just cannot initialize until shaders exist, which is also what happens when the
+# user has not supplied a DLL.
+set(LSFG_HAS_EXTRACT OFF)
+
+if (EXISTS "${LSFG_ROOT}/thirdparty/dxbc/CMakeLists.txt" AND
+    EXISTS "${LSFG_ROOT}/thirdparty/pe-parse/CMakeLists.txt")
+
+	# pe-parse defaults to a shared library and command-line tools, neither of which belongs in
+	# an APK. Forced here because its options are plain option(), so they take whatever is
+	# already in the cache unless overridden.
+	set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
+	set(BUILD_COMMAND_LINE_TOOLS OFF CACHE BOOL "" FORCE)
+	set(PEPARSE_ENABLE_EXAMPLES OFF CACHE BOOL "" FORCE)
+	set(PEPARSE_ENABLE_TESTING OFF CACHE BOOL "" FORCE)
+
+	add_subdirectory("${LSFG_ROOT}/thirdparty/dxbc" "${CMAKE_CURRENT_BINARY_DIR}/dxbc" EXCLUDE_FROM_ALL)
+	add_subdirectory("${LSFG_ROOT}/thirdparty/pe-parse" "${CMAKE_CURRENT_BINARY_DIR}/pe-parse" EXCLUDE_FROM_ALL)
+
+	foreach (tgt dxbc pe-parse)
+		if (TARGET ${tgt})
+			# Same -fno-exceptions problem as framegen: both throw, and inheriting the
+			# project-wide flag turns that into a compile error rather than a warning.
+			target_compile_options(${tgt} PRIVATE -fexceptions)
+			set_target_properties(${tgt} PROPERTIES
+				POSITION_INDEPENDENT_CODE ON
+				CXX_VISIBILITY_PRESET hidden)
+			set(LSFG_HAS_EXTRACT ON)
+		endif()
+	endforeach()
+endif()
+
+add_library(armsx3_lsfg SHARED armsx3_lsfg_shim.cpp)
+
+target_include_directories(armsx3_lsfg PRIVATE
+	"${CMAKE_CURRENT_SOURCE_DIR}"
+	"${LSFG_ROOT}/framegen/public")
+
+target_compile_options(armsx3_lsfg PRIVATE -fexceptions)
+target_compile_definitions(armsx3_lsfg PRIVATE VK_USE_PLATFORM_ANDROID_KHR)
+
+set_target_properties(armsx3_lsfg PROPERTIES
+	CXX_STANDARD 20
+	CXX_STANDARD_REQUIRED ON
+	CXX_VISIBILITY_PRESET hidden
+	VISIBILITY_INLINES_HIDDEN ON
+	OUTPUT_NAME "armsx3_lsfg")
+
+target_link_libraries(armsx3_lsfg PRIVATE lsfg-vk-framegen armsx3_lsfg_volk android log)
+
+if (LSFG_HAS_EXTRACT)
+	target_sources(armsx3_lsfg PRIVATE
+		"${LSFG_ROOT}/src/extract/trans.cpp"
+		"${LSFG_ROOT}/src/extract/extract.cpp")
+	target_include_directories(armsx3_lsfg PRIVATE "${LSFG_ROOT}/include")
+	target_link_libraries(armsx3_lsfg PRIVATE dxbc pe-parse)
+	target_compile_definitions(armsx3_lsfg PRIVATE ARMSX3_LSFG_HAVE_EXTRACT=1)
+	message(STATUS "LSFG: shader extraction enabled (dxbc + pe-parse)")
+else()
+	message(STATUS "LSFG: shader extraction NOT available, frame generation cannot initialize")
+endif()
+
+# Keep the exported surface to the shim alone.
+#
+# The version script is what makes the isolation real rather than aspirational: without it,
+# framegen's and volk's symbols are still dynamic and the loader can bind our renderer's vk* to
+# them. Verify with:
+#   llvm-nm --defined-only --extern-only libarmsx3_lsfg.so
+# Only armsx3_lsfg_* may appear. Any vk* or LSFG_3_1 symbol means this stopped working.
+target_link_options(armsx3_lsfg PRIVATE
+	"-Wl,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/armsx3_lsfg.map"
+	"-Wl,--no-undefined")

3rdparty/lsfg/armsx3_lsfg.map

@@ -0,0 +1,32 @@
+/* Exported surface of libarmsx3_lsfg.so.
+ *
+ * This list IS the isolation. framegen and volk are statically linked into this library and
+ * between them define 655 globals named vkCreateImage, vkQueueSubmit, ... -- 124 of which are
+ * exactly the names libarmsx3-core.so's Vulkan loader declares. If any of those stay dynamic,
+ * the loader is free to bind the renderer's entry points to framegen's copies, and framegen's
+ * volkLoadDevice() has already pointed those at a different VkDevice.
+ *
+ * -fvisibility=hidden covers most of it; this covers the rest, including anything upstream marks
+ * __attribute__((visibility("default"))) -- which framegen's public API does.
+ *
+ * Check it, do not assume it:
+ *   llvm-nm --defined-only --extern-only libarmsx3_lsfg.so
+ * Nothing but armsx3_lsfg_* should be listed.
+ */
+{
+	global:
+		armsx3_lsfg_abi_version;
+		armsx3_lsfg_initialize;
+		armsx3_lsfg_create_context_ahb;
+		armsx3_lsfg_present;
+		armsx3_lsfg_destroy_context;
+		armsx3_lsfg_wait_idle;
+		armsx3_lsfg_finalize;
+		armsx3_lsfg_last_error;
+		armsx3_lsfg_import_shaders;
+		armsx3_lsfg_shader_count;
+		armsx3_lsfg_get_shader;
+
+	local:
+		*;
+};

3rdparty/lsfg/armsx3_lsfg_shim.cpp

@@ -0,0 +1,404 @@
+// Implementation of the C ABI in armsx3_lsfg_shim.h.
+//
+// This translation unit is the ONLY thing in libarmsx3_lsfg.so that anyone outside it may touch.
+// Everything else -- framegen, volk, and volk's 655 vk* globals -- stays hidden behind
+// -fvisibility=hidden so the dynamic linker cannot bind our renderer's vkCmdDraw to framegen's
+// copy. See the header for why that matters.
+//
+// Rules for every entry point here:
+//   * no C++ type crosses the boundary (separate libc++ per .so under c++_static),
+//   * no exception crosses the boundary (framegen throws; dlopen'd code must not),
+//   * a failure returns a code and leaves a message in armsx3_lsfg_last_error().
+
+#include "armsx3_lsfg_shim.h"
+
+#include <lsfg_3_1.hpp>
+#include <lsfg_3_1p.hpp>
+
+#ifdef ARMSX3_LSFG_HAVE_EXTRACT
+#include <extract/extract.hpp>
+#include <extract/trans.hpp>
+#include <config/config.hpp>
+#endif
+
+#include <exception>
+#include <map>
+#include <string>
+#include <vector>
+
+namespace
+{
+	// thread_local because the renderer and whatever calls initialize() are not the same thread,
+	// and a shared buffer would let one overwrite the other's message mid-report.
+	thread_local std::string g_last_error;
+
+	bool g_initialized = false;
+
+	// Which shader family initialize() chose. Fixed until finalize(): LSFG_3_1 and LSFG_3_1P keep
+	// entirely separate device state and context tables, so a context created by one cannot be
+	// presented or destroyed through the other -- every entry point below has to dispatch on this.
+	bool g_performance = false;
+
+	void clear_error()
+	{
+		g_last_error.clear();
+	}
+
+	void set_error(const char* what)
+	{
+		g_last_error = what ? what : "unknown error";
+	}
+
+	void set_error(const std::string& what)
+	{
+		g_last_error = what.empty() ? "unknown error" : what;
+	}
+}
+
+// Wrap a call so nothing escapes.
+//
+// catch (...) rather than catching LSFG's types: framegen throws several, they are not part of
+// its public header, and an exception reaching the dlopen boundary is undefined behaviour -- so
+// the exact type matters less than the guarantee that none of them get out.
+#define ARMSX3_LSFG_GUARD(expr, failure_result)                       \
+	try                                                               \
+	{                                                                 \
+		clear_error();                                                \
+		expr;                                                         \
+	}                                                                 \
+	catch (const std::exception& e)                                   \
+	{                                                                 \
+		set_error(e.what());                                          \
+		return (failure_result);                                      \
+	}                                                                 \
+	catch (...)                                                       \
+	{                                                                 \
+		set_error("unknown exception from framegen");                 \
+		return (failure_result);                                      \
+	}
+
+extern "C" uint32_t armsx3_lsfg_abi_version(void)
+{
+	return ARMSX3_LSFG_ABI_VERSION;
+}
+
+extern "C" const char* armsx3_lsfg_last_error(void)
+{
+	return g_last_error.c_str();
+}
+
+extern "C" int armsx3_lsfg_initialize(uint64_t device_uuid, int is_hdr, float flow_scale,
+	uint64_t generation_count, int performance, armsx3_lsfg_shader_loader loader, void* user)
+{
+	if (!loader)
+	{
+		set_error("no shader loader supplied");
+		return ARMSX3_LSFG_ERR_BAD_ARGUMENT;
+	}
+
+	// The std::function is built HERE, on framegen's side of the boundary, from a plain C
+	// function pointer. That is the whole point of taking a function pointer in the header: an
+	// std::function constructed by the core would be a different type under a different libc++.
+	//
+	// Throwing out of this lambda is how a missing shader is reported to framegen, which is what
+	// it expects -- and the throw stays inside this .so, caught by the guard below.
+	const auto bridge = [loader, user](const std::string& name) -> std::vector<uint8_t>
+	{
+		const uint8_t* data = nullptr;
+		uint32_t size = 0;
+
+		if (loader(name.c_str(), &data, &size, user) != ARMSX3_LSFG_OK || !data || !size)
+		{
+			throw std::runtime_error("shader not available: " + name);
+		}
+
+		return std::vector<uint8_t>(data, data + size);
+	};
+
+	// Recorded BEFORE the call so the guard's failure path cannot leave the two disagreeing.
+	g_performance = performance != 0;
+
+	if (g_performance)
+	{
+		ARMSX3_LSFG_GUARD(
+			LSFG_3_1P::initialize(device_uuid, is_hdr != 0, flow_scale, generation_count, bridge),
+			ARMSX3_LSFG_ERR_SHADERS)
+	}
+	else
+	{
+		ARMSX3_LSFG_GUARD(
+			LSFG_3_1::initialize(device_uuid, is_hdr != 0, flow_scale, generation_count, bridge),
+			ARMSX3_LSFG_ERR_SHADERS)
+	}
+
+	g_initialized = true;
+	return ARMSX3_LSFG_OK;
+}
+
+extern "C" int32_t armsx3_lsfg_create_context_ahb(void* in0, void* in1, void* const* out_n,
+	uint32_t out_count, uint32_t width, uint32_t height, int32_t format)
+{
+	if (!g_initialized)
+	{
+		set_error("not initialized");
+		return ARMSX3_LSFG_ERR_NOT_INITIALIZED;
+	}
+
+	if (!in0 || !in1 || !out_n || !out_count)
+	{
+		set_error("null image or empty output set");
+		return ARMSX3_LSFG_ERR_BAD_ARGUMENT;
+	}
+
+	int32_t id = ARMSX3_LSFG_ERR_UNKNOWN;
+
+	// AHardwareBuffer* arrives as void* so the header stays free of android/hardware_buffer.h,
+	// which the core has no reason to include.
+	std::vector<AHardwareBuffer*> outs;
+	outs.reserve(out_count);
+
+	for (uint32_t i = 0; i < out_count; ++i)
+	{
+		outs.push_back(static_cast<AHardwareBuffer*>(out_n[i]));
+	}
+
+	if (g_performance)
+	{
+		ARMSX3_LSFG_GUARD(
+			id = LSFG_3_1P::createContextFromAHB(
+				static_cast<AHardwareBuffer*>(in0), static_cast<AHardwareBuffer*>(in1), outs,
+				VkExtent2D{width, height}, static_cast<VkFormat>(format)),
+			ARMSX3_LSFG_ERR_VULKAN)
+	}
+	else
+	{
+		ARMSX3_LSFG_GUARD(
+			id = LSFG_3_1::createContextFromAHB(
+				static_cast<AHardwareBuffer*>(in0), static_cast<AHardwareBuffer*>(in1), outs,
+				VkExtent2D{width, height}, static_cast<VkFormat>(format)),
+			ARMSX3_LSFG_ERR_VULKAN)
+	}
+
+	return id;
+}
+
+extern "C" int armsx3_lsfg_present(int32_t ctx, int in_sem, const int* out_sems, uint32_t out_count)
+{
+	if (!g_initialized)
+	{
+		set_error("not initialized");
+		return ARMSX3_LSFG_ERR_NOT_INITIALIZED;
+	}
+
+	std::vector<int> outs;
+	outs.reserve(out_count);
+
+	for (uint32_t i = 0; i < out_count; ++i)
+	{
+		outs.push_back(out_sems ? out_sems[i] : -1);
+	}
+
+	if (g_performance)
+	{
+		ARMSX3_LSFG_GUARD(LSFG_3_1P::presentContext(ctx, in_sem, outs), ARMSX3_LSFG_ERR_VULKAN)
+	}
+	else
+	{
+		ARMSX3_LSFG_GUARD(LSFG_3_1::presentContext(ctx, in_sem, outs), ARMSX3_LSFG_ERR_VULKAN)
+	}
+
+	return ARMSX3_LSFG_OK;
+}
+
+extern "C" int armsx3_lsfg_destroy_context(int32_t ctx)
+{
+	if (!g_initialized)
+	{
+		return ARMSX3_LSFG_OK; // nothing to release
+	}
+
+	if (g_performance)
+	{
+		ARMSX3_LSFG_GUARD(LSFG_3_1P::deleteContext(ctx), ARMSX3_LSFG_ERR_UNKNOWN)
+	}
+	else
+	{
+		ARMSX3_LSFG_GUARD(LSFG_3_1::deleteContext(ctx), ARMSX3_LSFG_ERR_UNKNOWN)
+	}
+
+	return ARMSX3_LSFG_OK;
+}
+
+extern "C" void armsx3_lsfg_wait_idle(void)
+{
+	if (!g_initialized)
+	{
+		return;
+	}
+
+	try
+	{
+		if (g_performance) LSFG_3_1P::waitIdle(); else LSFG_3_1::waitIdle();
+	}
+	catch (...)
+	{
+		// Deliberately swallowed and not recorded: this is called on the present path, and a
+		// failure to wait is reported by whatever uses the images next. Setting the error string
+		// here would overwrite a more useful message from the call that actually failed.
+	}
+}
+
+extern "C" void armsx3_lsfg_finalize(void)
+{
+	if (!g_initialized)
+	{
+		return;
+	}
+
+	try
+	{
+		if (g_performance) LSFG_3_1P::finalize(); else LSFG_3_1::finalize();
+	}
+	catch (...)
+	{
+	}
+
+	g_initialized = false;
+}
+
+#ifdef ARMSX3_LSFG_HAVE_EXTRACT
+// Satisfy the one symbol upstream's extract.cpp needs from its config layer.
+//
+// It reads exactly one field, Config::activeConf.dll, to find the file. Defining the object here
+// rather than compiling their config module avoids dragging in toml11 and a config-file format
+// that has no meaning inside an APK -- the path comes from the user's file picker instead.
+namespace Config { Configuration activeConf; }
+
+namespace
+{
+	// name -> SPIR-V, translated once at import.
+	std::map<std::string, std::vector<uint8_t>> g_shaders;
+}
+
+extern "C" int armsx3_lsfg_import_shaders(const char* dll_path)
+{
+	if (!dll_path || !*dll_path)
+	{
+		set_error("no file selected");
+		return ARMSX3_LSFG_ERR_BAD_ARGUMENT;
+	}
+
+	clear_error();
+	g_shaders.clear();
+
+	// Upstream's own shader names, both families.
+	//
+	// Taken verbatim from nameIdxTable in extract.cpp rather than guessed -- a made-up name fails
+	// as "Shader hash not found", which reads like a corrupt DLL and is not.
+	//
+	// Two sets: the plain names are LSFG 3.1 and the p_ prefixed ones are 3.1p. Which family gets
+	// used depends on which framegen entry point runs, so both are extracted and whatever the DLL
+	// actually contains is kept. Missing names are skipped rather than fatal, because a given
+	// Lossless Scaling version legitimately ships only one family.
+	static const char* const k_names[] = {
+		"mipmaps", "alpha[0]", "alpha[1]", "alpha[2]", "alpha[3]",
+		"beta[0]", "beta[1]", "beta[2]", "beta[3]", "beta[4]",
+		"gamma[0]", "gamma[1]", "gamma[2]", "gamma[3]", "gamma[4]",
+		"delta[0]", "delta[1]", "delta[2]", "delta[3]", "delta[4]",
+		"delta[5]", "delta[6]", "delta[7]", "delta[8]", "delta[9]",
+		"generate",
+		"p_mipmaps", "p_alpha[0]", "p_alpha[1]", "p_alpha[2]", "p_alpha[3]",
+		"p_beta[0]", "p_beta[1]", "p_beta[2]", "p_beta[3]", "p_beta[4]",
+		"p_gamma[0]", "p_gamma[1]", "p_gamma[2]", "p_gamma[3]", "p_gamma[4]",
+		"p_delta[0]", "p_delta[1]", "p_delta[2]", "p_delta[3]", "p_delta[4]",
+		"p_delta[5]", "p_delta[6]", "p_delta[7]", "p_delta[8]", "p_delta[9]",
+		"p_generate",
+	};
+
+	try
+	{
+		Config::activeConf.dll = dll_path;
+
+		Extract::extractShaders();
+
+		for (const char* name : k_names)
+		{
+			// getShader hands back DXBC; framegen wants SPIR-V. Translating at import rather than
+			// on demand keeps the cost off the present path entirely.
+			//
+			// Individually guarded: a DLL that ships only one shader family throws on every name
+			// in the other, and that is normal rather than a failure of the import.
+			try
+			{
+				auto spirv = Extract::translateShader(Extract::getShader(name));
+
+				if (!spirv.empty())
+				{
+					g_shaders[name] = std::move(spirv);
+				}
+			}
+			catch (const std::exception&)
+			{
+				// Not in this DLL. Keep going.
+			}
+		}
+
+		if (g_shaders.empty())
+		{
+			set_error("no usable shaders in that file -- is it Lossless.dll from Lossless Scaling?");
+			return ARMSX3_LSFG_ERR_SHADERS;
+		}
+	}
+	catch (const std::exception& e)
+	{
+		g_shaders.clear();
+		set_error(e.what());
+		return ARMSX3_LSFG_ERR_SHADERS;
+	}
+	catch (...)
+	{
+		g_shaders.clear();
+		set_error("unknown failure reading the file");
+		return ARMSX3_LSFG_ERR_SHADERS;
+	}
+
+	return static_cast<int>(g_shaders.size());
+}
+
+extern "C" int armsx3_lsfg_shader_count(void)
+{
+	return static_cast<int>(g_shaders.size());
+}
+
+extern "C" int armsx3_lsfg_get_shader(const char* name, const uint8_t** out_data, uint32_t* out_size)
+{
+	if (!name || !out_data || !out_size)
+	{
+		return ARMSX3_LSFG_ERR_BAD_ARGUMENT;
+	}
+
+	const auto it = g_shaders.find(name);
+
+	if (it == g_shaders.end() || it->second.empty())
+	{
+		return ARMSX3_LSFG_ERR_SHADERS;
+	}
+
+	*out_data = it->second.data();
+	*out_size = static_cast<uint32_t>(it->second.size());
+	return ARMSX3_LSFG_OK;
+}
+#else
+extern "C" int armsx3_lsfg_import_shaders(const char*)
+{
+	set_error("this build has no shader extraction support");
+	return ARMSX3_LSFG_ERR_SHADERS;
+}
+
+extern "C" int armsx3_lsfg_shader_count(void) { return 0; }
+
+extern "C" int armsx3_lsfg_get_shader(const char*, const uint8_t**, uint32_t*)
+{
+	return ARMSX3_LSFG_ERR_SHADERS;
+}
+#endif

3rdparty/lsfg/armsx3_lsfg_shim.h

@@ -0,0 +1,142 @@
+// C ABI for Lossless Scaling frame generation.
+//
+// framegen CANNOT be linked into libarmsx3-core.so. It links volk, which defines 655 globals
+// named vkCreateImage, vkQueueSubmit, ... and 124 of those are byte-for-byte the names our own
+// Vulkan loader declares in rpcs3/Emu/RSX/VK/vk_android_loader.h -- every single symbol the RSX
+// renderer uses. Two ways that goes wrong, and the second is the one that costs a week:
+//
+//   1. duplicate symbol at link time (clang defaults to -fno-common), or
+//   2. the linker merges them, and framegen's volkLoadDevice(itsOwnDevice) then repoints every
+//      entry point the renderer uses at framegen's VkDevice. Every later vkCmdDraw goes to the
+//      wrong device, and it presents as a driver crash with nothing pointing at frame generation.
+//
+// So framegen and volk live in their own libarmsx3_lsfg.so, reached by dlopen + dlsym through
+// this header. Nothing here is C++: the CMake project builds ANDROID_STL=c++_static, so each .so
+// carries its own libc++ and an std::vector or std::function crossing the boundary would be two
+// unrelated types that happen to share a name. The shim builds those on its own side.
+//
+// framegen also throws (LSFG::vulkan_error and friends). Exceptions must not cross a dlopen
+// boundary either, so every entry point here catches everything and returns a code; the message
+// is retrievable with armsx3_lsfg_last_error().
+#pragma once
+
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// Bump when anything below changes shape. The loader refuses a library whose version it does not
+// recognise, so a stale libarmsx3_lsfg.so on a user's device fails loudly at load instead of
+// quietly passing mismatched structs.
+#define ARMSX3_LSFG_ABI_VERSION 2u
+
+// Mark the exported surface explicitly.
+//
+// The library is built -fvisibility=hidden so framegen's and volk's symbols stay in, and a
+// version script narrows the dynamic table further. Neither of those can PROMOTE a symbol: a
+// function hidden at compile time is local in the object, and `global:` in the linker script
+// cannot bring it back. Without this attribute the .so builds and exports nothing at all, and
+// the failure only shows up as dlsym returning null at runtime.
+#if defined(__GNUC__) || defined(__clang__)
+#define ARMSX3_LSFG_API __attribute__((visibility("default")))
+#else
+#define ARMSX3_LSFG_API
+#endif
+
+enum armsx3_lsfg_result
+{
+	ARMSX3_LSFG_OK = 0,
+	ARMSX3_LSFG_ERR_UNKNOWN = -1,
+	ARMSX3_LSFG_ERR_NOT_INITIALIZED = -2,
+	ARMSX3_LSFG_ERR_BAD_ARGUMENT = -3,
+	ARMSX3_LSFG_ERR_SHADERS = -4,
+	ARMSX3_LSFG_ERR_VULKAN = -5,
+};
+
+// Hand back the SPIR-V for a named shader.
+//
+// framegen does NOT read Lossless.dll -- it asks for shaders by name and expects SPIR-V back.
+// Extracting them from the user's own copy (PE resource -> DXBC -> SPIR-V) is the caller's job,
+// which is deliberate: the shaders are THS's property and nothing here ships or downloads them.
+//
+// Return ARMSX3_LSFG_OK and set *out_data / *out_size on success. The buffer must stay valid
+// until the initialize() call that triggered this returns. Any other return means "no such
+// shader" and fails initialization.
+typedef int (*armsx3_lsfg_shader_loader)(const char* name, const uint8_t** out_data,
+	uint32_t* out_size, void* user);
+
+// Version of the loaded library. Call first; anything else on a mismatched library is undefined.
+ARMSX3_LSFG_API uint32_t armsx3_lsfg_abi_version(void);
+
+// Bring up framegen on the adapter identified by device_uuid (VkPhysicalDeviceIDProperties
+// deviceUUID, 16 bytes, passed as the first 8 -- that is what framegen matches on).
+//
+// framegen creates its OWN VkDevice on that adapter. It does not share ours, which is why images
+// have to be handed over as AHardwareBuffer below rather than as VkImage.
+// performance selects framegen's 3.1p shader family instead of 3.1: a cheaper pipeline at lower
+// quality, which is the difference between usable and not on a mobile GPU. It is fixed for the
+// lifetime of the library state -- every context, present and teardown after this call goes to the
+// family chosen here, because the two keep separate contexts and separate device state.
+//
+// flow_scale is the optical-flow resolution as a fraction of full: 1.0 is upstream's default and
+// lower is cheaper. Note the sense is inverted from upstream's own config file, which stores a
+// divisor and passes 1.0f/value here.
+ARMSX3_LSFG_API int armsx3_lsfg_initialize(uint64_t device_uuid, int is_hdr, float flow_scale,
+	uint64_t generation_count, int performance, armsx3_lsfg_shader_loader loader, void* user);
+
+// Create a context over a set of shared images.
+//
+// AHardwareBuffer rather than the FD path framegen also offers, because Adreno and Mali both
+// refuse vkGetMemoryFdKHR(OPAQUE_FD) on AHB-imported memory -- the FD path simply does not work
+// on the hardware this port runs on.
+//
+// The caller keeps ownership of every AHardwareBuffer and must keep them alive until the context
+// is destroyed. Returns a context id >= 0, or a negative armsx3_lsfg_result.
+ARMSX3_LSFG_API int32_t armsx3_lsfg_create_context_ahb(void* in0, void* in1, void* const* out_n,
+	uint32_t out_count, uint32_t width, uint32_t height, int32_t format);
+
+// Generate frames for one presented pair.
+//
+// Semaphores are sync file descriptors, not VkSemaphore: framegen is on a different device and a
+// VkSemaphore handle would be meaningless to it. in_sem is waited on before generation starts;
+// each out_sems[i] is signalled when output image i is ready. Pass -1 for an unused slot.
+ARMSX3_LSFG_API int armsx3_lsfg_present(int32_t ctx, int in_sem, const int* out_sems, uint32_t out_count);
+
+ARMSX3_LSFG_API int armsx3_lsfg_destroy_context(int32_t ctx);
+
+// Read the user's own Lossless.dll and keep the shaders it contains.
+//
+// Nothing is bundled or downloaded: the shaders are THS's property and the user must supply a
+// legitimately purchased copy. Only the extracted SPIR-V is kept -- the DLL itself is not needed
+// afterwards and the caller may delete its copy.
+//
+// The work is PE resource walk -> DXBC -> SPIR-V, and it is slow enough to be worth doing once
+// and caching rather than at every boot. Returns the number of shaders extracted, or a negative
+// armsx3_lsfg_result; armsx3_lsfg_last_error() explains a failure in terms a user can act on
+// ("is Lossless Scaling up to date?" rather than a resource id).
+ARMSX3_LSFG_API int armsx3_lsfg_import_shaders(const char* dll_path);
+
+// How many shaders are currently held. Zero means frame generation cannot start.
+ARMSX3_LSFG_API int armsx3_lsfg_shader_count(void);
+
+// Serve a previously imported shader by name, for initialize()'s loader.
+//
+// Pass a null loader to armsx3_lsfg_initialize to use these instead of supplying your own.
+ARMSX3_LSFG_API int armsx3_lsfg_get_shader(const char* name, const uint8_t** out_data, uint32_t* out_size);
+
+// Block until framegen's device is idle.
+//
+// Needed on Android because framegen's device reads AHBs that OUR device writes, and there is no
+// semaphore shared between the two. Without this the read races the write. It is also the reason
+// frame generation cannot be free here: this is a device-level stall, not a queue wait.
+ARMSX3_LSFG_API void armsx3_lsfg_wait_idle(void);
+
+ARMSX3_LSFG_API void armsx3_lsfg_finalize(void);
+
+// Message for the last failing call on this thread, or "" if none. Never null.
+ARMSX3_LSFG_API const char* armsx3_lsfg_last_error(void);
+
+#ifdef __cplusplus
+}
+#endif