SONIC THE HEDGEHOG (2006) renders only its HUD and skybox and flickers
everything else in and out of existence. That is upstream RPCS3 issue
#4122, open since 2018: a PPU/SPU race where an SNR is overwritten while
still non-empty, so the SPU jobs feeding geometry lose their signal.
Upstream never fixed it in code. The fix is elad335's canary patch, which
hooks RPCS3_HLE_LIBRARY:WaitForSPUsToEmptySNRs -- a function that already
exists in the core and has no other user. The patch is not in the official
feed: neither our stored database nor a fresh pull from rpcs3.net carries
a single BLUS30008 entry, jumpf op, or RPCS3_HLE_LIBRARY reference. Desktop
users add it by hand through the Patch Manager's import button, which has
no equivalent here, so on Android the game was simply broken.
Ship it as an asset and merge it into patch.yml at boot, before the core
reads that file and once the config directory is known to exist. Enable it
rather than only listing it: a user who has to find and tick a box before
the game renders has already decided the emulator is broken. Gated on a
stored revision, not run every boot, so turning it off sticks.
Everything ARM64 needs is already in this tree -- the calloc code-cave
registry, the is_faux_function guard that keeps the tail-call return trap
from firing on a patch-point, and the PPU LLVM filter for patched
functions -- so the patch applies here rather than crashing as it once did
on ARM.
Keyed by PPU hash, so it covers only the dump it was built for; other
regions and revisions need their own entry.
get_per_core_usage() fills the per-core vector with zeros and then wraps
the whole Linux /proc/stat body in #ifndef ANDROID, because an app cannot
read the per-cpu lines. The exclusion left the zeros in place, so the
monitor did not go quiet -- it reported an idle machine. On device it
logged "CPU Usage: Total: 0.0%, Cores: 0.0%, 0.0%, ..." while three
emulator threads were pegged at 100%, which hides exactly the class of
problem the monitor exists to surface.
Report process usage from times(), which is POSIX and readable by our own
process, and leave the per-core vector empty so perf_monitor prints no
"Cores:" list rather than a fabricated one.
When the transfer queue was drained the offload thread called
std::this_thread::yield() in a tight loop, which is a sched_yield()
spin rather than a wait. Measured on an Adreno 740 handheld it burned
1142s of CPU over a 1145s session, 85% of it system time, for no work
at all -- a whole core taken from the RSX and SPU threads that need it,
plus the battery and thermal budget that goes with it.
Wait on the queue instead. lf_queue::push notifies on the empty to
non-empty transition so a real job still wakes the thread immediately
and transfer latency is unchanged, and if a push lands between the
emptiness check and the wait the atomic is already non-zero so there is
no lost wakeup. The timeout is only there so the loop can re-check
thread_ctrl::state(): aborting pushes nothing, so an untimed wait would
never return and shutdown would hang instead of spin.
dma_manager::sync() is unaffected -- it only waits while work is
outstanding, which is exactly when the thread is not idle.
Ours was false against upstream's true, so the curated push wrote false over the
node on every boot and every install ran with an accuracy fixup disabled that
RPCS3 ships on. Games that depend on it get NaNs through vector maths, which
shows up as geometry behaving impossibly rather than as any kind of error.
The disagreement was not free either. The node feeds ppu_settings::fixup_vnan,
which is part of the compiled PPU object filename, so flipping it renames every
object and the next boot recompiles all of them. A device here carries both
variants, 76 modules under one key and 58 under the other, from one flip.
Audited the other two settings in that key: Accurate Cache Line Stores and Use
Accurate DFMA both already match upstream. This was the only one adrift.
All three now say that changing them rebuilds compiled PPU code, which is the
part that had no way of being known from the screen.
The unresponsive-stop callback reported that a stop was hanging but not what was
holding it, and that is the one thing that cannot be recovered afterwards: from
outside, a wedged shutdown looks like a sleeping thread with no CPU time and no
reason attached.
Enumerate the SPU threads still registered and log their cpu_flag state. Whether
exit was ever delivered, whether the thread is parked in a wait, or whether it
never left its initial stopped state are three different faults with three
different fixes, and the flags separate them.
This is what exposed the failed savestate: the thread that would not stop was
debris from a save that had already been abandoned, not a shutdown bug.
It was turned on so savestates could save at all, and savestates are no longer a
feature: a PS3 state runs 500MB to 3GB, which fills a phone in a handful of
saves. What is left is the cost, and it is a real one, which is why upstream
defaults it off.
Written as false rather than dropped from the push. It shipped as true for a
while, so installs from that window have it persisted in config.yml and would go
on paying SPU performance for something nothing uses.
Also drops the thumbnail read logging, which did its job: it proved the read
path was never called, because the in-game menu has its own numbered slot list
and only the touch overlay's picker asks for a preview.
Savestates could not work without it. Saving locks every SPU thread into a state
it can be serialised from, and with this off that lock fails on any title with
SPU work running. The save is abandoned with "failed to lock SPU threads
execution", and the SPU it gave up on then never answers the stop request, so
the join thread spins and the app hangs on the next save or load.
The deadlock chased through the SPU shutdown path was this setting all along.
The state on disk looked valid because a previous attempt had written one.
Upstream defaults it off for SPU performance, which suits a desktop where
savestates are optional. Here they are on the in-game menu and the touch
overlay, and a save that wedges the emulator costs more than slightly slower
SPU emulation.
RPCS3's stop watchdog calls on_emulation_stop_no_response once shutting the VM
down has taken about ten seconds. That callback was a no-op here, so the one
thing upstream does about a deadlocked stop, say so, did not happen: the join
thread went on spinning, the overlay sat at its last figure, and the app looked
frozen with nothing in the log to explain it.
Reported rather than aborted. The desktop build offers to terminate but asks
first, and slow is not the same as stuck: a savestate write was measured here
taking 71 seconds legitimately, so killing the process on a timer would trade a
hang for a corrupted save.
The core already renders the finished frame and hands it to take_screenshot
whenever a screenshot is asked for. That override was empty, so the picture was
built and thrown away and every slot tile had nothing to draw.
Cached rather than captured on demand: a save kills the VM, and the point where
the state is known to be on disk is after_kill_callback, by which time there is
no renderer left to ask. So the save requests a frame on its way in, the
override catches whatever the renderer produces, and the capture step writes it
out once the state has landed.
Stored downscaled to a ~320px edge as AX3T + width + height + RGBA, and
re-encoded to PNG on the Kotlin side, which is where a Bitmap can be built from
raw pixels directly. That keeps a compressor out of the core for something only
ever drawn as a tile. A slot with no picture still loads.
Loading a slot closed the game and dropped to the library. BootGame failed in
the same millisecond it was called, without ever reading the file, and the
Emulation Join Thread warnings then ran for seconds after: the previous VM was
still coming down while BootGame was already being asked to bring the next one
up, so it bailed.
boot_current_game_savestate gets away with that sequence because it runs from a
shortcut handler rather than from inside the emulation callback queue. Kill
first and boot from after_kill_callback, which is the shape the save path uses
and the reason that one works.
The boot result is logged too. A bare failure could not tell a corrupt state
from a version mismatch from a path the loader never accepted.
Every slot tile read as empty and Load was disabled on all ten, whatever was on
disk. Occupancy comes from getGamePathSlot, which was a stub returning the empty
string, so saving had been working with no way to see that it had.
Answer it from hasState, which was written for this and had no callers. The
subtitle is the title id rather than the state's path: the picker strips to the
last segment and drops the extension, which would render a real path as
slot0.SAVESTAT.
RetroArch shaders shifted the colours, pink over anything green. The output
image handed to librashader is the swapchain image but the format reported with
it was the source framebuffer's. librashader builds its output view and render
pass from that, so with a BGRA swapchain and an RGBA source it wrote through a
mismatched view and swapped red with blue instead of converting.
Only the shader path was affected because the bilinear and nearest passes reach
the swapchain through vkCmdBlitImage, which converts formats itself. Carry the
swapchain format through to the pass, refreshed per frame so a swapchain rebuilt
at a new format cannot leave a stale value behind.
RPCS3 keeps savestates as a rolling history addressed by age, 1 being the most
recent, and the app offers ten numbered slots. The slot was dropped on save and
read as an age on load, so saving to slot 3 pushed a new newest state and
loading slot 3 fetched the fourth-newest. States appeared to wander between
slots on their own.
The history stays RPCS3's. A slot is now a copy parked under
savestates/<title>/armsx3_slots/, in its own directory because get_savestate_file
derives the next auto id by listing the title's directory and must not be fed
names it never generated. Copy rather than move: the restart after a save boots
from the file the core just wrote.
At 0 the four direction keys meet in the middle, which only reads correctly on
the flat built-in drawables. The bundled skins draw four separate keys and they
came out as one clumped blob.
Migrated once for existing installs: the key is written by the bulk save, so
anyone who had ever opened a touch setting already had 0 stored and would never
have picked up a new default. Only a stored 0 is rewritten.
The button was always there. The LazyColumn above it had no weight, so in a
Column it took the whole remaining height and left nothing for the row below,
putting Back off the bottom of the screen. With a controller you could still
leave; on a touch-only device this was the one screen with no visible way out.
Weight the list so it shares the space instead of consuming it.
No preview rendered for any downloadable skin. The published manifest carries a
trailing comma before two of its closing braces, which org.json rejects, so
parseManifest returned null and fetch fell through to the git tree, which only
ever reported filenames and set previewPath to null for everything. One comma in
a file this app does not own cost the whole index.
Retry the parse with trailing commas dropped, string aware so a name containing
a comma survives, and pair Previews images to skins by name in the tree fallback
so a broken manifest costs detail rather than every thumbnail.
Changing DEFAULT_SKIN_ID moved nobody. resolveRaw only falls back to the default
when nothing was ever stored, and every install from before the change has a
stored value already, so existing users kept the old pad and reported the new
default as not applying.
Rewrite the stored global skin once, and only when it is absent or the explicit
no-skin sentinel. An install pointing at a real skin chose it on purpose. The
flag is set either way so picking the ARMSX2 row afterwards sticks.
The second row read 'Built-in (default)', which was accurate when the built-in
drawables were the default and wrong the moment a bundled pack took over: it
still claimed to be the default while ARMSX3 Textured actually was. Name it
'ARMSX2' for what it is and tag whichever row matches DEFAULT_SKIN_ID, so the
label follows the constant instead of restating it.
Adds two packs from bagas as app assets, ARMSX3 Textured and ARMSX1, and makes
ARMSX3 Textured what a fresh install gets. The order offered is ARMSX3 Textured,
ARMSX2, ARMSX1, NetherSX2, NetherSX2 Old. Their files arrive named plainly
(L1.png, cross.png), which the loader already handles: it strips ic_controller_
and a trailing _button, so they are renamed to the canonical form on the way in
and both packs land on exactly the key set nethersx2 uses.
The default needed untangling first. Null meant the built-in ARMSX2 drawables
AND was what an install with no stored choice got, so the two were the same
thing and nothing had to tell them apart. They are different now. Resolution
moved into one function both callers use, because ensureLoaded and
applyForSerial each resolved separately and disagreeing would have changed the
pad the first time a game started:
nothing stored the default, ARMSX3 Textured
NONE the ARMSX2 row was chosen, so the drawables
an id that skin, or the default if it names one no longer installed
setActive stores NONE at the global tier rather than removing the key. Removing
it used to mean the drawables; with a bundled default it would now mean "never
chose", so picking ARMSX2 would have silently handed back ARMSX3 Textured on the
next launch. Nobody's existing choice moves: only the absence of a stored value
resolves to the default, and that is not written back, so the default can change
again later without pinning every install to today's answer.
Every built-in now shows a preview strip beside its name, matching what the
downloader already does for remote skins. Baked in as preview.png per pack
rather than composed at runtime: the list draws several at once and compositing
ten bitmaps per row per recomposition is not worth it for a picture that never
changes. keyForFilename ignores the file, so it is not counted as a button. The
ARMSX2 look has no asset folder, so its strip is a drawable.
ARMSX3 Dark was offered and is deliberately not included. It ships 17 images
against the other packs' 18, with no start button.
Verified in the APK rather than assumed: four asset packs present, 18 images
each in the two new ones, four asset previews plus the drawable.
It was reachable only from the library drawer, which is a global screen. That
put the moment a core node is actually worth touching, a game that needs one
while that game is loaded, in the one place it could not be set without setting
it for every other game too.
Add it to the Options pane beside All Settings, opening over the paused game
like the other manager screens. Scope and serial come from the overlay's own
scope state, resolved for the running title when the menu opened, so an edit
made mid-session is remembered for that title alone.
The core settings screen recorded every edit into a single global store, so a
node set to get one title running was then set for every title that booted
afterwards, with nothing on screen to say so.
Give that store the two tiers ConfigStore already gives curated settings: a
global set, and a per-game set keyed on the same settingsKey, so both stores
agree on which title is being configured. Replay pushes global first and the
running title's set on top, so a per-game value wins where the two disagree and
every node a title never touched still follows global. With no game loaded the
per-game tier is skipped rather than guessed at, so the last title played cannot
leak into a BIOS boot.
The screen now takes its scope and serial from the caller instead of resolving
them itself: the drawer route is global and would otherwise inherit whatever
scope the last per-game settings visit left behind. It also states which tier
the next edit lands in, since the screen looks identical either way.
Ports ARMSX2's GitHub-release updater. The UI hooks and all seventeen update.*
strings were already here from the UI port; only the implementation was missing,
so both hooks were sitting behind IN_APP_UPDATER doing nothing.
A "Check for updates" panel at the top of the App tab queries the ARMSX3
releases API, semver-compares the tag against the installed build, downloads the
.apk asset with a progress bar into externalCacheDir/updates/, and hands it to
the system package installer through a FileProvider. The user confirms the
install; nothing happens silently. Two opt-in toggles come with it, both default
off: check on launch, which pops a prompt only when something newer exists, and
include nightly builds.
Points at ARMSX2/ARMSX3 releases, not ARMSX2's. Download goes to the app cache
directory, which the OS can evict, and each download clears the folder first, so
it never accumulates.
ONE DELIBERATE DIFFERENCE FROM ARMSX2, and it needs to be understood before any
Play build exists. ARMSX2 keeps this out of its bundle with a src/github versus
src/play flavor split plus a build script that fails closed if
REQUEST_INSTALL_PACKAGES appears in the bundle manifest. ARMSX3 has neither a
Play build nor flavors, so the code, the permission and the provider live in
src/main behind the runtime flag. That is fine today and NOT fine the moment a
Play target appears: Play rejects the permission in the bundle, and a runtime
flag does not remove a permission. Adding a Play build means doing the flavor
split first. The requirement is written at the manifest, at the buildConfigField
and in the file header, because one comment is easy to miss.
Verified in the produced APK rather than assumed: the permission is present, the
provider is registered as com.armsx3.updateprovider, and UpdaterEntry is in
classes18.dex.
Demon's Souls precompiles for 27 minutes and was killed partway through. The
trajectory says why serialising alone could not save it: the process sat between
4.3GB and 5.8GB for the whole run on a 7GB device, so this was sustained
footprint rather than a transient overlap the existing mutex could flatten. It
died when the system wanted memory back, and Zygote logged signal 9 for four
processes at once, so the pressure was not ours alone.
Adds a second tier. Below 2GB free, workers already compile one at a time; below
1GB free, the worker holding that lock now waits for the system to recover before
starting the next module, up to ten seconds, rechecking every 100ms.
The wait happens AFTER taking the serialisation lock deliberately. Waiting first
would have the other worker still allocating, so the wait would be watching
memory it is not allowed to influence.
Safe to wait here because precompilation writes each object to disk and links
none of them: the modules are not mapped into the VM, so is_being_used_in_emulation
is false and no JIT instance is created. Pausing costs time and nothing else.
Bounded rather than indefinite, because failing to compile is worse than
compiling under pressure, and it gives up cleanly if the emulator is stopping.
The readback in VKPresent was already gated on Video@@RSX Profiler, but
gpu_timer::begin and end were not. A release build with the profiler off, which
is the default and what everyone runs, still paid a vkCmdResetQueryPool and two
vkCmdWriteTimestamp calls per region per frame for results nothing would ever
read. Timestamp writes are not free on a tiled GPU; they are pipeline sync
points, which is the opposite of what a diagnostic should cost when disabled.
Both sides are gated now. end() deliberately clears m_open before returning
rather than bailing first: disarming between a region's begin and its end would
otherwise leave the flag set, and every later begin for that region would drop
itself as unbalanced, silently killing that region's timing for the rest of the
session. The timestamp is skipped, the bookkeeping is not.
The pool is still created at device init so arming mid-session works without a
restart. That is one small allocation, not a per-frame cost.
Arkham City runs about 83 render passes a frame for roughly 339 draws, and on a
tiled GPU every pass is a tile store plus a reload of the attachment. Attributing
every end site showed where they come from:
ImgHelper:43 37-48/frame change_image_layout
Barrier:inout 20-23/frame insert_texture_barrier
Draw:1093 13-18/frame subpass mismatch
Barrier:img 3-5/frame
insert_texture_barrier handles the feedback case, an attachment sampled while it
is still bound. It ended the pass because it had no choice: Vulkan forbids
vkCmdPipelineBarrier inside a render pass unless the subpass declares a
dependency on itself, and this render pass cache declared no dependencies at all.
The function already took a preserve_renderpass flag; there was simply no way for
a caller to use it legally.
So the pass now declares a by-region self-dependency, and the feedback barrier
opts in. Three parts that have to agree:
VKRenderPass.cpp declares the self-dependency, framebuffer-local stages
barriers.cpp drops the vertex stage when preserving, since
VK_DEPENDENCY_BY_REGION_BIT permits framebuffer-space
stages only and naming the vertex stage would make the
barrier invalid
VKRenderTargets.cpp passes preserve_renderpass at the cyclic-reference site
Correct for the use: the feedback case is a fragment shader sampling the
attachment its own fragments write. Anything needing vertex-stage visibility
leaves the flag false and still gets the pass ended.
Android only at the call site. The self-dependency itself is declared everywhere,
which is harmless where nothing issues an in-pass barrier.
Does not touch ImgHelper:43, the larger site. Layout transitions of
non-attachment images are illegal inside a pass whatever dependencies exist, so
that one needs resource preparation hoisted ahead of the pass instead.
Arkham City runs about 90 render passes a frame for roughly 339 draws, under four
draws per pass, on a tiled GPU where every pass costs a tile load and store. That
is worth attacking, since Fence wait is 24ms of a 53ms frame and disabling
culling to add GPU work pushed it to 43.8ms, which is what being GPU bound looks
like.
But only about 19 of those 90 ends were attributed: Draw:1093 at 16.1 and
Texture:921 at 2.9. The other 71 happened at sites with no counter, so the
report pointed at the wrong two.
Instruments the rest: the four barrier sites, both texture cache sites, the image
helper, and the occlusion query one in VKGSRender. The barrier sites are the ones
to watch, since every barrier that cannot preserve the pass ends it, and that is
the same mechanism as the Adreno leak fixed earlier: this driver does real work
on every vkCmdEndRenderPass.
Counters only. Which site dominates decides whether the fix is barrier batching,
texture cache scheduling, or something else, and guessing between those has a
poor record here.
A simpleperf profile of the RSX thread during Arkham City gameplay, 83261 samples:
24.91% vk::query_pool_manager::get_query_result
11.63% [kernel]
10.16% rsx::nv406e::semaphore_acquire
9.37% rsx::FIFO::FIFO_control::fetch_u32_refill
3.96% memcpy_opt
3.26% VKGSRender::do_local_task
get_query_result is a quarter of the thread on its own, and what it does is spin:
pause(), re-poke the query, repeat, until the GPU has the result. That is a
defensible trade on a desktop, where the answer lands in microseconds and there
are cores going spare. On a tiled mobile GPU the result is not available until
the tile pass resolves, so the wait is much longer, and this device runs eleven
hot emulator threads across five usable cores. The spin does not make the result
arrive sooner; it just denies the core to an SPU thread that had work.
Keeps a short 64-iteration spin so a nearly-ready result still returns without a
scheduler round trip, then yields. Android only.
Also scopes the wait as fence_wait, which is what it is. This was completely
invisible before: the bucket report attributed 0.072ms/frame to ZCULL and showed
nothing here, because the ZCULL scope covers zcull_ctrl->update and this is
reached by another path. A bucket reading zero means no scope reached it, not
that the work is free.
The per-command figure came back at 1017ns across 43870 commands per frame. That
is not a fair price for reading a word and calling a handler, so the cost is
concentrated in particular handlers rather than spread across the dispatch, and
the useful question is which.
Counts commands per method register and reports the top eight with their share,
named through gcm_printing so they read the same as the log's own FIFO traces.
A handful of methods dominating means a fast path is worth writing for them. An
even spread means the dispatch itself is the problem and this was the wrong tree.
Either way it is the last thing hidden inside fifo_decode, which now holds 44.6ms
of a 59.2ms frame with every sub-unit around it measured and small: ZCULL 0.111ms,
page protect 0.133ms, local tasks 1.357ms, the whole draw path under 6ms.
One increment behind the enabled() branch, no counter-timer read, 64KB of
counters touched only while armed.
Every sub-unit inside the RSX dispatch loop is now measured and every one is
small. ZCULL is 0.083ms/frame, page protection 0.094ms, local tasks 1.691ms,
and the entire draw path under 5ms of a 53.4ms frame. Fence wait takes 9.2ms.
That leaves 34.9ms in fifo_decode with nothing left to attribute it to except
the dispatch itself, and FIFO stalls at 1.0/frame say it is not waiting to be
fed either.
Which leaves one question worth asking: is that a lot of commands at a fair
cost each, or few commands at an unfair one. Those want opposite work. A lot of
commands means the volume is the problem and the answer is upstream of the
loop; an unfair per-command cost means the dispatch is the problem and can be
attacked directly.
So the loop counts its iterations, and the report divides fifo_decode by them.
An increment behind the enabled() branch with no counter-timer read: the
earlier attempt at a per-command SCOPE read cntvct_el0 twice per command and
took run_FIFO from 3% of samples to 35%, which is the mistake this avoids.
Page protection turned out to be 0.090ms/frame, 0.2%, so the 38ms sitting in
fifo_decode is not mprotect and not the drawing either: the entire draw path
comes to under 5ms of a 54ms frame, and fence wait accounts for 8.4ms more.
Roughly 38ms had no owner.
fifo_decode is scoped around the whole RSX loop rather than around run_FIFO,
deliberately, because a scope inside run_FIFO reads the counter-timer twice per
FIFO command and previously turned a 3% bucket into 35% of samples. So anything
in that loop without a scope of its own accumulates there, and the loop's
per-64-cycle sub-unit updates are the largest unmeasured things left in it.
Both now have buckets. They run once per 64 commands, so the counter read is
amortised and the earlier distortion does not apply.
ZCULL is the specific suspect: this title logs "Reports area at location
CELL_GCM_LOCATION_MAIN was accessed. ZCULL optimizations will be disabled" and
then runs the unoptimised path for the whole session, with Accurate ZCULL stats
on, while the game polls occlusion reports.
Measurement only, no behaviour change.
Arkham City under load spends 36.9ms of a 46.5ms frame in fifo_decode, which is the
bucket the FIFO loop leaves active and therefore holds everything without a scope of
its own. The drawing is not the cost: draw_setup, vertex, pipeline, descriptors,
texture upload, RT prep, blit and submit together come to under 5ms. Fence wait falls
to 5.4% under load, so it is not waiting on the GPU either.
The one number in the report large enough to explain the hole is page protection:
16.8 mprotect calls covering 40MB every frame. That is on the order of ten thousand
pages of kernel page-table work plus TLB shootdowns across eight cores, and it is
reached from RSX state handling, so every microsecond of it lands in fifo_decode.
Counting it was not enough to know whether it is most of that 36.9ms or almost none
of it, and the two point at completely different work. So it gets a bucket and a
scope at the syscall itself, charged only on the RSX thread.
No behaviour change; the scope compiles to a branch on the profiler flag, which is
off by default.
Arkham City dies of SIGSEGV about 140ms after the game writes PS3Progress_Frame_1,
on both the Qualcomm driver and Turnip, with the database on or off, Multithreaded
RSX on or off, and the RSX profiler on or off. A table of ten runs showed no setting
correlates with it.
The reason it took so long to even establish that it WAS a segfault: nothing records
it. No tombstone (/data/tombstones is root-only, so its emptiness proves nothing), no
logcat crash-buffer entry, and no line from our own handler. The single witness
anywhere is Zygote:
I Zygote : Process <pid> exited due to signal 11 (Segmentation fault)
That combination is what a stack overflow looks like here. The handler is installed
with SA_SIGINFO alone, so it runs on the faulting thread's own stack; if that stack is
what overflowed there is nowhere to run, it faults again immediately, and the kernel
applies the default action having written nothing.
So: an alternate signal stack per thread in thread_base::initialize, and SA_ONSTACK on
the handler. Thread-local rather than shared, because two threads can fault at once and
a shared stack would corrupt whichever report lost the race.
This does not fix the fault. It makes the fault reportable, which is the thing that has
been missing all along: the next occurrence should log where it came from instead of
vanishing. Android only.
Arkham City's first RSX profile put 83.9% of a 33.45ms frame in FIFO decode and
essentially zero everywhere else. That was not a finding, it was a gap: fifo_decode
is the bucket the FIFO loop leaves active, so everything without a scope of its own
accumulates there, and draw_setup, vertex, texture_upload, shader_translate,
shader_compile, barrier and cmdbuf had no scope sites at all. They could only ever
read zero.
Adds the three that account for the draw path:
begin() -> draw_setup per-draw setup, with the existing pipeline,
descriptors and texcache_lookup scopes nesting
inside so each is charged to itself
emit_geometry() -> vertex vertex and index upload plus the draw
bind_texture_env() -> texture_upload sampler setup and any upload the bind forces
load_program already carried a pipeline scope and reported 0.006ms/frame, so shader
and pipeline work is genuinely negligible here rather than unmeasured, and is left
alone.
What the first profile did establish stands: Present wait and Fence wait at ~0 mean
the thread is not waiting on the GPU, Idle at 15.7% means it is not starved, and
FIFO stalls at 0/frame mean it is not waiting on the guest. The 28ms is real CPU
work in the draw path. This says which part.
The worker count is decided once, from a reading taken before the emulator has
mapped the PS3 address space or the game has loaded anything. On a cold cache
that reading goes stale almost immediately, and by the time it matters the
count is fixed and cannot respond.
Measured on Arkham City: a first boot peaked at 5228MB where the same session
with the modules already cached sits at 2636MB, and sampling RssAnon against
RssFile and RssShmem put the growth in anon, so it is the compilers holding
LLVM contexts rather than the GPU caches. The process was killed partway
through; on a warm cache the identical settings run fine.
So the number of workers is not really the problem, their overlap is. Below
2GB free, a worker now takes a mutex around a single module's compilation,
which makes it one at a time exactly when that is the difference between
finishing and being killed. Checked per module, at the point of use, because
rechecking is the entire point. With headroom the check fails and nothing is
serialised, so there is no cost in the common case.
The lock is scoped to the compile alone, so a worker waiting on it is never
holding a context while it waits.
Android only.
Follow-up to the previous commit, which lowered modules-per-JIT to a flat 25
on Android. That fixed the kill but paid for it everywhere, including on
devices with memory to spare and on titles that were never at risk. The two
things the constant governs are not the same concern: branch reachability is
about translated game code, while the symbol resolver is a one-shot boot-time
initialiser that fills the jumptable and never runs again. Only the second is
a memory problem, so only the second should be allowed to force a split.
The group is now sized from MemAvailable, the same way the compile worker
count already is. A quarter of what is free, with the ceiling set at what a
full group of 100 costs, since budgeting past the point where nothing would
be split buys nothing.
~2GB free -> 26 per JIT, resolver peak ~500MB
~4.4GB -> 57 per JIT, resolver peak ~1.1GB (this device)
8GB+ -> 100 per JIT, i.e. upstream, untouched
Two separate reasons this stays free in the common case. A device with room
lands on 100 and is not split at all. And a title whose parts fit in one group
gets a single JIT instance at any limit at or above its part count, so every
title below the threshold is unaffected regardless: same instances, same
codegen. At roughly 4000 functions per part that covers everything under about
100k analysed functions, which is most of the library. Arkham City, at ~457k,
is not, and that is the point.
The 5KB per function and 4000 functions per part are measured off the run that
died: 2.3GB across ~457k functions, with parts holding 2800 to 4900 each.
Arkham City was killed partway through compiling its PPU modules. Memory sat
level around 4GB for four minutes of ordinary compile-and-free, then went
4010MB -> 6323MB in seventeen seconds and the log stops mid-compile, no
tombstone: the kernel OOM killer on a 7GB device.
The module part that carries jit_bounds also builds the symbol resolver, and
GetSymbolResolver spans every function across its entire JIT instance rather
than its own part: an LLVM Function declaration and a constant-array entry per
function, then a relocation each through MCJIT. Arkham City analyses to about
457k functions, and at 100 modules per instance the first resolver covered all
of them at once. The log records it plainly, 457209 functions generated in one
module where every other module in the run reports between 2800 and 4900.
No new mechanism was needed. ppu_initialize already splits modules across JIT
instances and jit_mod.symbol_resolvers is already a vector with one entry per
instance, executed in a loop. The group size was simply tuned for a desktop.
Upstream's own comment on the constant names this exact trade: lowering it
lowers continuous memory requirements, at the cost of more branches unable to
reach with a direct B. The resolver's cost is linear in the functions it spans,
so a quarter of the group size is a quarter of the peak.
Android only. Desktop keeps 100.
Enable Time Stretching read true on the device, though upstream defaults it
false, Settings writes ps3.audioTimeStretch which is false, and no core
override touches it. Something later was setting it back.
Six PCSX2 keys reach RPCS3 nodes that a PS3/ key already owns:
Enable Time Stretching <- SPU2/Output/SyncMode
Desired Audio Buffer Duration <- SPU2/Output/OutputLatencyMS
Enable Buffering <- SPU2/Output/BufferMS
Anisotropic Filter Override <- EmuCore/GS/MaxAnisotropy
Clocks scale <- Framerate/NominalScalar
Frame limit <- EmuCore/GS/SyncToHostRefreshRate
They date from before the PS3/ pseudo-sections existed, which were added for
exactly this reason. Being unambiguous in the bridge was not enough: put()
calls setSetting immediately rather than collecting into a map, so applyTo's
source order is the call order, and every PS3 write lands first (L939-994)
with the PCSX2 one later (L1044-1765). The leftover won every time.
The field each UI row is bound to is the PS3 one in all six cases; the PCSX2
counterparts appear only in the reset-fields list or nowhere. So the Audio
tab's Time Stretching toggle did nothing at all: it wrote false, and SyncMode
wrote true ninety lines later.
Two were independently wrong. BufferMS turned a buffer size in milliseconds
into the boolean "buffering enabled". SyncToHostRefreshRate mapped to Frame
limit "Display", which resolves to the host panel's refresh, so on a 120Hz
handheld it asked for a 120fps cap, the same mistake just fixed in
setDisplayRefreshRate; and its `if (asBool(value))` guard could only ever set
the mode, never clear it, so turning the setting off left the cap in place.
All six now fall through to the unhandled path. Verified no RPCS3 setter is
left with more than one writer.
The frame rate still ran past 60. The live config on the device explains it:
Vblank Rate 120, Frame limit Auto, and Auto resolves to the vblank rate.
setDisplayRefreshRate was writing the HOST PANEL's refresh into
Video@@Vblank Rate. Those are not the same quantity. Vblank Rate is the
frequency of the emulated console's vblank, and a PS3 runs 60Hz whatever
display is attached, so a 120Hz handheld was asking the emulator for 120 frames
a second: twice the RSX command volume, twice the GPU work, for frames no PS3
game was ever written to produce.
It also could not be corrected from settings. EmulationSurface reports the panel
rate from surfaceChanged, which runs after ApplySettings on boot and again on
every rotation and resume, so it overwrote the pushed 60 every single time. That
is why recording 60 as a core override did not hold.
Dropped rather than redirected. RPCS3 reads the host rate itself through
get_display_refresh_rate() for Frame limit Display, and never wanted to be told.
Frame limit now goes through the curated push next to Vblank Rate, so the cap
does not depend on the vblank path holding. A deliberate choice on the core
screen still wins, since the overrides replay after.
Also drops the two core overrides the profiling work left behind. RSX Profiler
belongs at its false default in a build meant for playing, and Eager Surface
Readback names a node this build no longer has. Removed by path, because
clearing the store would take the user's real edits with it.
Rotating the device left the picture corrupt in both orientations.
Two independent faults, and both have to go.
m_swapchain_dims held the size passed to swapchain::init, but the WSI backend
replaces that with the surface's currentExtent whenever the platform reports
one, so after any window reshape the two disagreed. That value is not
bookkeeping: it sizes the framebuffer the swapchain image is attached to, and
the present blit region, so a frame was drawn at one size into images of
another. Nor did it recover, because flip() decides whether to rebuild by
comparing that same stale number, so it kept confirming itself. Both init sites
now adopt the size the swapchain actually got.
The other half is that nothing told the renderer the window had changed shape.
The activity handles orientation itself, so rotation keeps the same Surface and
the same ANativeWindow, leaving no new handle to notice; and once a swapchain is
connected, ANativeWindow_getWidth answers about buffers rather than about the
window. SurfaceHolder.Callback::surfaceChanged is the one authoritative source
and it was being discarded, so it now reaches the core and drives client_width().
Three smaller things on the same path. ANativeWindow_fromSurface returns an
already acquired reference and the old code acquired again on top of it, leaking
a window on every surfaceChanged. The event code was computed after
currentSurface had been overwritten, so SURFACE_CREATED could never be sent and
the resume paired with the surface loss pause was dead code. That resume now
undoes only a pause the surface loss itself caused, so it cannot fight the
overlay's.
The Qualcomm driver does not expose VK_EXT_conditional_rendering, which is why
the vendor gate added earlier never fired: the feature was already off, so
turning it off changed nothing.
But VKGSRender::begin_conditional_rendering does its work regardless of support.
It allocates the predicate buffer, copies query results into it and barriers it,
then falls through to the base implementation. Only vkCmdBeginConditionalRendering
reads that buffer, so without the extension all of it is discarded.
On Adreno the waste is not merely wasted. insert_buffer_memory_barrier ends the
open render pass, and that driver allocates on every vkCmdEndRenderPass and does
not release it. A heap profile of a Skate 3 session put its largest allocation
stacks, 157MB, 152MB, 150MB and more, on exactly this path through
qglinternal::vkCmdEndRenderPass into calloc, with the process killed at 4.3GB of
anonymous memory after about 2.4GB arrived in eight seconds.
Returns to the base implementation immediately when the extension is missing.
Behaviour is unchanged, since nothing was being predicated anyway; what goes is
the buffer traffic, the barriers and the render pass ends.
A heap profile of a Skate 3 session, sampled through the crash, put every one of
the top allocation stacks on the same path:
run_FIFO -> VKGSRender::begin -> begin_conditional_rendering
-> insert_buffer_memory_barrier -> end_renderpass
-> qglinternal::vkCmdEndRenderPass -> calloc
157MB, 152MB, 150MB and more from that single stack. begin_conditional_rendering
inserts a buffer memory barrier, which ends the render pass, and every
vkCmdEndRenderPass makes the Qualcomm driver allocate memory it never returns.
The process reached 4.3GB of anonymous memory, took the device to 54MB free with
3GB in swap, and was killed. About 2.4GB of it arrived in eight seconds.
Anonymous, so unreclaimable, and not ours to free: it belongs to the driver.
Without the extension RSX falls back to thread::begin_conditional_rendering,
which performs the draws instead of predicating them. Occlusion results stop
culling, which costs some GPU work, in exchange for sessions that do not end in
an OOM kill.
Scoped to the proprietary driver, which is what was measured. Turnip is a
separate implementation and is left alone until there is evidence about it.
Three earlier guesses at this, the texture cache quota, the SPU JIT and the
eager readback, were all wrong. This one came from allocation stacks.
Two separate fixes.
Memory: the texture and surface caches size their quotas from
device_local_total_bytes. On a discrete GPU that is right, a 3GB texture cache
out of 8GB of dedicated VRAM costs system RAM nothing. A phone has one pool for
both, so that figure is system RAM and the caches budget memory the OS also
needs. Here it reported 7446MB, which resolved the texture cache quota to
2978MB.
Watched a Skate 3 session die: steady around 1.6GB for two minutes, then 2GB
allocated in fourteen seconds, available memory down to 54MB, 3GB pushed into
swap, killed at a 4.3GB peak with no tombstone. That is the quota being honoured
on a device that cannot pay it.
Adds get_budgetable_device_memory, which is the device local heap everywhere
except Android, where it is what is actually free less room for the emulator,
clamped between 1GB and 2.5GB. Both caches now evict against that.
Rotation: getNativeWindow only re-read the window size when the window pointer
changed, and rotating keeps the same ANativeWindow while changing its
dimensions, so the cached size stayed at whatever the first orientation was and
the swapchain was rebuilt at portrait extent inside a landscape window. Size is
re-read on every query now.
Skate 3 still aborted in llvm::report_bad_alloc_error during PPU compilation with
4.6GB reported available, where the previous figures allowed three workers.
Both numbers were too optimistic. A single large PPU module can take well over a
gigabyte through MCJIT and relocation processing, so 1GB per worker does not
cover a big title, and the reading is taken before the emulator maps the PS3
address space, so some of what it counts is already spoken for.
Reserves 2GB for the emulator and budgets 1.5GB per worker. On a 7GB phone with
4.6GB free that is a single worker: slower to compile, but it finishes. Three was
faster right up to the point it killed the process, and a game that aborts during
compilation cannot be played at all.
Minecraft exposed this class of bug after a cache clear and Skate 3 exposed that
the first fix was not enough; neither is new, the original cap sized against
installed rather than available memory.
RSX and every SPU thread shared one affinity mask, so on a 4+3+1 phone that is
six hot threads over five cores. RSX is the thread the frame waits on, and it
was measured spending about 10ms per frame inside its own loop without running:
not blocked on the GPU, not faulting, just waiting for a core.
Carves the single fastest core out of the SPU mask and leaves it in the RSX one.
RSX keeps the whole fast cluster and only loses the contention for the best
core; the SPUs lose one core out of several. Skipped when it would leave the
SPUs with a single core, which would be worse than the problem.
Only takes effect under the alternative scheduler. On Operating System mode
Android places threads itself and this code does not run.
A PS3 runs a 60Hz vblank and every game was written against it. The stored value
was 120, which asks for twice the frames the hardware ever produced: twice the
RSX command volume, twice the vertex upload, twice the GPU work, on a handheld
chasing a panel refresh rate the games predate.
Recording it as a core override did not hold. The override is stored correctly
and the two beside it apply, but they only persist because toggling them in the
UI writes config.yml directly, and CoreSettingOverrides.replay never ran at boot
in any log taken today. So this goes through the curated push instead, which
runs on every apply.
A deliberate change in All Core Settings still wins, since the override replay
happens immediately after.
set_native_priority used pthread_setschedparam with sched_priority. Android
threads run under SCHED_OTHER, where sched_priority must be zero and
sched_get_priority_max returns zero, so the call succeeded and changed nothing.
The RSX thread asks for a boost when it starts and was still measured at nice 0,
taking about 5300 involuntary preemptions a second, roughly 130 per frame, from
the PPU, SPU and audio threads sharing its cores. It is the thread everything
else waits on.
Under SCHED_OTHER the scheduler weights by nice, which setpriority does set, and
Android gives apps enough RLIMIT_NICE headroom to go negative for their own
threads. Applies -8 for a raise and +8 for a drop, and warns rather than fails
if the headroom is not there.
Modest on purpose: a hint to be scheduled ahead of the other emulator threads,
not a bid to starve them.
Timing each render pass overran the GPU timer's per-frame event cap by two
orders of magnitude: 554600 events dropped over 300 frames, so no draw region
ever completed and the line was missing from the report entirely.
That failure is the finding. Roughly 1800 render pass begins per frame, for a
game that should need a handful. On a tiled GPU every pass boundary stores the
tile buffer to memory and reloads it, which is the most expensive thing the
architecture does, and it would account for the 20ms of GPU time on its own.
Counts them plainly instead, since a counter cannot be overrun. The blit,
upload and readback regions stay timed and are all tiny: 0.012, 0.463 and 0.144
ms per frame, so none of them is where the GPU time goes.
Clearing the shader cache forces every PPU module to recompile at once, and the
process aborted partway through: scudo internal map failure, NO MEMORY, in
RuntimeDyldELF relocation processing on a PPU worker thread.
The existing cap allowed one worker per 1.5GB of total RAM, so four on this
device. Total RAM is the wrong number. The same device reported 7.3GB installed
while sitting at 76MB actually free, because it is also holding everything else
the user is running. Four LLVM workers on top of the emulator's own couple of
gigabytes had nowhere to go.
Adds utils::get_avail_memory, reading MemAvailable from /proc/meminfo, which is
the kernel's own estimate of what can be handed out without swapping. Workers are
then budgeted against that with a 1.5GB floor reserved for the emulator, falling
back to a more conservative slice of total where it cannot be read.
At 4.9GB available that allows three workers instead of four, and near zero it
correctly allows one.
The texture cache now reports zero misses and zero hard faults, so the eager
readback is doing its job and the guest no longer faults on surfaces. Yet
submissions per frame are still around six, and GPU work plus fence wait still
sum to the whole frame, which is the serialisation keeping this at 40fps.
So the drains are not readback faults, which is what the last several changes
assumed. Counts the three remaining callers instead: GCM label release with
texture loads outstanding, the FIFO sync hint that declares a hard sync coming,
and flushes requested by another thread.
A refill pays a fixed cost regardless of size: read_put, the iotable lookup, the
reservation lock, and a reservation_acquire per line. Measured at about 10us per
refill against roughly 1us of actual copying, so nine tenths of it was that fixed
cost, and a heavy scene ran over 1200 refills per frame to move 1.29MB of FIFO,
which is around 324,000 command words.
Fetching 4KB at a time pays that cost a quarter as often for the same bytes.
The line mask was a u8 pinned to 8 lines, so it widens to u32 with the full-mask
case special-cased, since 1u << 32 is undefined. The traversal order was checked
against the original at both widths before changing it.
Also adds counters for refill stalls, which ruled out the alternative
explanation: the retry spin is 0.006 ms/frame, so the refill is doing real work
rather than waiting on the guest.
The expansion indices for primitives the host cannot draw natively depend only
on the index, never on the draw's data, so the buffer for N primitives is
exactly a prefix of the buffer for any larger N. They were regenerated on every
draw call anyway, one u16 at a time, written straight into mapped GPU memory.
Builds each table once and copies the prefix. Tens of thousands of dependent
scalar stores become a single bulk copy, which also suits write-combined memory
far better than a scatter of small writes.
Minecraft draws quads throughout, so this ran on essentially every draw and
measured 5.7% of RSX thread samples.
Patterns were diffed against the original loops across edge cases before
replacing them; u16 indices bound both tables at 65536 vertices and anything
larger keeps the old path.
fetch_u32 is called once per FIFO command word and the guest pushes about 52,000
of them per frame, while the cache refills only around 208 times. Better than
99% of calls are a compare and a load, but the function lived out of line in
RSXFIFO.cpp for the sake of the rare refill, so every one of those 52,000 was a
real call into another translation unit.
It measured 15.6% of RSX thread samples, which no amount of refill work
explains: 208 refills of a 1KB cache is a few tens of microseconds of copying.
The cost was call overhead, not work.
Splits the refill into fetch_u32_refill and leaves the hit path inline.
Two measurement faults, both mine, both of which sent this investigation at the
wrong targets.
The scope timing the swapchain acquire was declared at function scope, so it
lived until flip() returned and charged the whole present path against
present_wait. That bucket read 10.12 ms and looked like the largest cost in the
frame. It is now braced around the acquire alone.
The accounting was in thread locals, and under the generic TLS model every scope
enter and exit went through the linker's tlsdesc resolver: 21% of RSX thread
samples against 0.07% uninstrumented, landing hardest on the FIFO bucket, which
is why that number would not move when the FIFO fetch path was bypassed.
initial-exec removed the cost but stopped every game booting.
Since only the RSX thread is ever reported, there is now one copy of the
accounting and a thread-pointer check at the door instead of a copy per thread.
On ARM64 that is a single register read with no relocation, cheaper than one
tlsdesc access where a scope previously did six.
CPU profiling has taken this as far as it goes. With the readback wait backed
off, the RSX thread drops to ~22% host CPU while the Adreno holds 81-88% busy at
its maximum clock and nothing throttles, so the GPU is the limiter and every
remaining question is on its side.
A whole-frame GPU timestamp would not have been worth writing: the kernel
already exposes gpu_busy_percentage and it says the same thing. What no counter
exposes is the split, specifically how much GPU time goes to copying render
targets back for the guest to read rather than to drawing. So the regions are
labelled, and readback is bracketed where the copy is actually recorded.
Readback of the queries is deferred: results come from ring slots written frames
earlier, a slot that is not ready is retried later, and no path waits on the GPU.
Reading a query in the frame that wrote it would stall on exactly the thing being
measured. vkDeviceWaitIdle is never called.
Frames are retired from flip rather than from the frame region closing, because
the primary command buffer is submitted once per flush_command_queue and several
times per frame, which would divide every per-frame figure by the wrong number.
Untimed events past the per-frame cap are reported rather than dropped silently,
so a truncated frame cannot read as a cheap one.
vkCmdWriteTimestamp had to be added to the Android Vulkan loader, which resolves
an explicit list of entry points and did not include it.
vk::wait_for_event spun on vkGetEventStatus with nothing but an isb between
calls. Profiling the RSX thread put 44 to 53 percent of its samples in that
loop, on a build with no instrumentation in it, while the GPU sat at 88 percent
busy pinned at its maximum clock and nothing was thermally throttled.
A readback issued mid frame queues behind everything already submitted, so the
wait drains the whole pipeline and runs into milliseconds. Spinning through that
does not make the event arrive sooner. It holds a core at peak clock and, worse
on a tiled mobile part, keeps reading memory the GPU is writing, taking
bandwidth from the device we are blocked on.
Polls hot for a bounded window so short waits behave as before, then backs off
to 50us. Against a wait measured in milliseconds that granularity is noise.
Also pins the profiler's thread locals to initial-exec. Reading them through the
generic model routed every scope through the linker's tlsdesc resolver and cost
21 percent of RSX thread samples against 0.07 percent uninstrumented, which
inflated the FIFO bucket it was meant to measure.
The overlay's RSX percentage measures what the thread is not doing: get_load()
counts everything outside four idle sites, so a thread decoding commands and a
thread spinning on a Vulkan fence both read as fully loaded. That is exactly the
distinction that decides what is worth optimising, and it could not be read off
any existing counter.
Splits RSX thread time into exclusive buckets instead. Entering a scope charges
elapsed time to whatever was active and switches, so nesting attributes to the
innermost scope and the totals sum to wall clock rather than double counting a
caller with its callee. Reports to the log every 300 frames, including an
explicit unscoped remainder so the percentages cannot read as complete coverage
when they are not.
Behind the "RSX Profiler" video setting, dynamic, so it can be armed once a
slowdown has already started. Off by default, costing one predictable branch per
scope. Accounting is per thread because some of these paths run on whichever
guest thread faulted rather than on RSX; only the RSX thread's copy is reported.
No optimisation here, only measurement.
Adds an apply toggle and a remove action next to the download row, so a title can
be run with and without its database entry to compare. Disabling renames the split
files aside rather than deleting them, so flipping back does not mean re-fetching
two thousand titles; remove deletes both copies and returns to stock.
Also drops Multithreaded RSX from the deny list. It was listed on the belief that
it froze Minecraft, which was wrong: the freeze was Accurate SPU DMA plus Accurate
Cache Line Stores, and it reproduced with Multithreaded RSX off and an empty
database. It is a real upstream feature backed by the RSXOffload thread, so there
was never evidence against it, and the toggle is the honest way to settle whether
a database entry helps or hurts.
Accurate SPU DMA and Accurate Cache Line Stores were both on. Together they
route every 128-byte SPU DMA store through do_cell_atomic_128_store, turning
bulk DMA into one atomic reservation store per cache line. Reservation
contention then outruns the rate it can drain, an SPU spins in do_putllc
forever, and the PPU stalls behind it on a semaphore the SPU never signals
while the RSX idles.
Both default off upstream. Cache Line Stores was wrong in our defaults;
SPU DMA already defaulted off but was stored on, so a default change alone
would not reach anyone who had already run the app, hence the migration.
Seen on Minecraft, which froze loading world chunks, that being bulk SPU DMA
and little else. Load dependent, so it presented as an intermittent freeze.
It defers nothing on this port: the Android call_from_main_thread callback runs
the function inline on the caller's thread. All it added was RPCS3's state-guard
wrapper, a std::function allocation and a log call, on a path applyTo hits eleven
times per settings change.
The guard that skips the reset entirely while stopped is what actually prevents
the crash it was meant to fix, and that stays.
The recommended per-title settings the desktop build offers under "Download
Config Database". The core already knows how to use them: Emulator::Load asks
through the get_database_config callback and passes the result to BootGame as
db_config, which sits under the user's own settings.
That callback was returning a PATH, which was simply the wrong thing. The return
value is taken as the config CONTENT, so what it got back was a filename that
failed to parse and was discarded, and the feature has never done anything here.
It reads the config for the title now.
The download and the JSON parsing were the only parts missing, and they lived in
rpcs3qt, which this build does not compile. Those are done in the app instead:
api.rpcs3.net returns every title in one object, and it is split into one YAML
per title so the callback, which runs on the boot path, does not have to parse a
database of every PS3 game to find one entry.
Manual rather than automatic on launch, since it is a network call to a third
party. 2164 titles at the time of writing.
Emu.Kill() spawns an Emulation Join Thread that joins every emulator thread, and
nothing stopped two of those existing at once. They end up joining each other and
neither finishes, so the emulator never reaches stopped. On device that showed as
four live join threads and six leaked AudioTrack threads after a few close then
boot cycles, with the join thread logging that it was waiting on itself.
Boot took the lifecycle lock only after calling Kill, so a Close and the boot that
followed it each started a teardown and deadlocked. The lock is now taken first
and held across the whole boot, which is also what the disc probe and shutdown
already use, so probing, booting and killing can no longer overlap at all.
This is what was behind the reports of being kicked back to the library when
opening a game, of crashes when switching games quickly, and of the save screen
never appearing: all of them were the emulator failing to reach a stopped state
rather than anything wrong with booting or with saves.
Disc probing was the cause of the game switching crashes. probeDisc mounts the
image into the emulator's GLOBAL vfs to read its PARAM.SFO, vfs::mount begins
with g_fxo->need<vfs_manager>(), and the scan runs on a background thread. So a
scan overlapping a boot or a teardown aborted the process inside vfs::mount.
Closing a game does both at once: Emu.Kill() resets g_fxo and returning to the
library starts a rescan. Waiting ten seconds only worked because the scan had
finished by then.
Three parts. The probe cache is now seeded from the last scan, so a disc that
has been seen before is never mounted again, which removes almost all of the
window and stops rescans re-reading multi gigabyte images. Probing, booting and
killing take a shared lock, so what is left cannot overlap. Booting waits for the
previous VM to actually stop, since BootGame's failure path asserts IsStopped and
aborts otherwise, which is what killed PES 2018 on a failed boot.
The overlay reset that settingsSet performs is posted through CallFromMainThread
rather than run on the JNI caller's thread. It walks the overlay manager into
perf_metrics_overlay::update(), which is RSX-owned, and doing that inline is what
crashed when a setting was changed while a game was starting or closing.
All Core Settings edits are recorded and replayed at the tail of applyTo. The
curated store pushes about 165 nodes on every settings change and on every boot,
so anything set on that screen which overlapped one of them was reverted moments
later. Per-title required settings land just before them, so a game that needs a
workaround gets it while an explicit user choice still wins. Uncharted 3 needs
Stub PPU Traps to get past its own crash handler.
Also adds .rap and .edat licence installing, which routes to installKey rather
than install, and migrates the stored Scaling Mode value so PR 10's change of
meaning does not silently move everyone from Bilinear to Nearest.
Two sources, both writing real PNGs to shared storage where Android's media
scanner indexes them and they turn up in the camera roll.
The data root holds firmware assets: trophy icons under dev_hdd0/home, the whole
dev_flash VSH resource set, and an ICON0.PNG per installed game. That was 216
images. A .nomedia now goes in before the core initialises, since that is what
unpacks the firmware and creates most of them.
The ROM folder is the one people actually notice, and only since folder format
games started working. An .iso is a single opaque file so the scanner sees
nothing inside it, but a disc in folder form lays its ICON0.PNG, PIC1.PNG and
every DLC image out in the open. One Minecraft folder accounted for 245 images,
which was every image in the whole ROM tree.
The ROM marker goes at the configured directory root rather than inside a game
folder, so it covers current and future folder games with one file and never
leaves a stray file inside content that gets mounted as a disc. Writing it also
triggers a rescan, because the marker alone does not drop what MediaStore has
already indexed. Zero bytes and reversible either way.
Two rows under a Compiled Code Cache section on the Performance tab, next to the
recompiler settings and separate from the shader cache on the Renderer tab, which
holds GPU pipelines rather than recompiled code.
The layout is <files>/cache/cache/, with ppu-<hash>-<name> directories for
firmware modules at the top level and <TITLEID>/ppu-<hash>-EBOOT.BIN per game.
The SPU cache is a spu-*.dat inside those, so the two options are not symmetric
and are worded accordingly: clearing SPU removes only those files and leaves
booting as fast as it was, while clearing PPU removes the directories outright
and necessarily takes the SPU caches with them.
Both report how much was freed, and both refuse while a game is loaded, since a
running VM holds those files open and is still writing to them.
fs::unix_dir::read is a bare readdir passthrough, so a listing is whatever the
host filesystem reports, in whatever order. ext4 conventionally yields . and ..
first; Android's FUSE layer over exFAT does not emit them at all. A directory
holding one file therefore left a single entry, and the stable_sort that follows
starts at data.begin() + 2, so it ran with first past last. That is undefined
behaviour rather than a no-op: it corrupted memory and the guest died later
inside libfs reading a wild pointer, with nothing at the crash site pointing back
at the cause.
Not only a crash guard. The PS3 returns both entries from opendir, so any game
walking a directory on the host filesystem was getting a listing the console
would never produce. iso_device synthesises them already, which is why the same
game booted from an .iso was unaffected and every folder format game on an SD
card was exposed. Found by booting Minecraft both ways.
Boot audio aborted the process. init_audio does ensure() on
Emu.GetCallbacks().make_video_source(), and the Android callbacks return nullptr
because there is no media backend, so ensure() killed the app outright. It fired
for any game whose folder holds a SND0.AT3, which is every folder format game:
for an .iso the fs::is_file check in rsx::thread::thread looks inside the mounted
virtual device and never finds one, so every .iso booted so far dodged it by
accident. A null source is now handled and logged. Boot music does not play,
which it could not have anyway. PKG installed games were exposed to this too,
since they also sit on the real filesystem.
PPU compilation ran out of memory. jit_core_allocator::limit() sizes the LLVM
compile workers on core count alone, which is right on a desktop and fatal on a
handheld: eight workers on a 7 GB device aborted inside
llvm::report_bad_alloc_error partway through a large title, with Max LLVM
Compile Threads left at 0 for "use every core". The limit is now bounded by
physical memory as well, roughly one worker per 1.5 GB and never below one. It
only caps the automatic default; an explicit setting is still honoured.
The progress dialog server only leaves its loop when the counters match AND
g_progr_text is empty. That text is refcounted across nested progress scopes, so
a leaked reference leaves the loop spinning forever: the dialog is never closed,
and the cleanup that resets g_progr_ptotal never runs either, which is what
ppu_thread::cpu_task waits on before switching to overlay-message mode.
Seen on device with a fully booted, running game sitting behind a "Building SPU
Cache... 941 of 941" dialog for over ten minutes. The RSX thread and two SPU
threads were at 97%, syscall counters were climbing, and nothing had compiled
since six minutes in. Note the label is stale in that state: the server only
overwrites its cached text when it receives a non-empty one, so the last
meaningful message stays on screen and says nothing about which scope leaked.
Closes the dialog once the counters are complete and have been completely idle
for roughly five seconds. wait_no_update_count resets on any change to any
counter or to the text, so work in progress can never reach the threshold. The
warning names the held text, which is what will identify the leaking scope.
This is a safety net. The reference leak itself is still there.
The aspect ratio rows did nothing because Rpcs3Bridge's PS3/Video branch has an
explicit key list ending in `else -> return false`, and neither the new Display
Aspect Override nor Stretch To Display Area was in it, so both were dropped into
Unsupported.note(). Stretch had only ever reached the core through the legacy
EmuCore/GS AspectRatio key, which is why Display Mode looked inert too. Audited
the rest: all 66 PS3 keys applyTo writes are handled now. Screen aspect is also
in the in-game menu, where you can see what you are changing.
Installing a package crashed because a successful install queued the new title
for precompilation, and that path calls Emu.SetState(running), g_fxo->init<> and
vm::init(). Those are safe once, during onboarding, and not in a process that has
already booted a game. Extraction had finished by then, so the title still showed
up on the next launch. Nothing precompiles on install now; it happens on first
boot like any other game.
Installed titles booted to a black screen because BootGame was handed the game
directory. RPCSX boots them by the bootable path the installer reports, which is
the EBOOT, so directories are resolved through locateEbootPath first.
Split packages can now be installed. package_reader::extract_data always took a
deque of readers, only the entry point was single file, so a game split into
parts could not be installed at all. Select all the parts and confirm; they are
sorted by name and handed over together.
Installed titles can be uninstalled from the same screen. The path is checked
against dev_hdd0/game before anything is deleted, so it cannot touch a ROM folder.
Settings that would not stick: the eleven Ps3Settings overlay fields were
wired into the Overlay tab but missing from all four of Settings.kt's
serialisation paths, so they only ever lived in memory and reverted the next
time the screen re-read the store. Added them to toJson, fromJson, diffFrom,
merge and the per-tab reset list.
In-game menu lag: every settingsSet ended in SaveSettings(g_cfg.to_string()),
which serialises the whole config and writes it out. applyTo pushes about 165
keys per change, so one toggle cost 165 whole-config writes on the UI thread.
Added settingsBeginBatch/settingsEndBatch and wrapped applyTo in it.
Folder format games are now detected, both the disc layout with PS3_GAME and
an installed game folder with PARAM.SFO next to USRDIR, and probeDiscInfo
reads either without mounting anything. The emulator's own dev_hdd0/game and
games directories are scanned alongside the user's ROM folders, which is why
nothing installed was ever showing up.
Package installer: the native side already handled pkg, pup, edat and iso,
but nothing in the app ever called it. Added a screen and a drawer entry.
Screen aspect ratio: the PS3 only signalled 4:3 or 16:9 so there was no way
to fill a handheld panel without stretching. Added an output aspect override
with presets and a custom slider.
All core settings screen, generated from the config tree rather than written
by hand, so nodes added upstream are editable with no app change.
Also: 176 of the 245 settings search entries still named PCSX2 settings, the
tagline still said PlayStation 2, and a missing fw.json on first run printed
a stack trace that read as a crash.
What's New was reading releases from the ARMSX2 repo, and the About page
credited PCSX2 and linked to it. The navigation drawer had the same stale
GitHub link.
The website entry in the drawer still goes to armsx2.net since there is no
ARMSX3 site yet.
BUILDING.md was RPCS3's desktop build guide and had nothing about Android, so it
was misleading here. Removed it and put real Android build steps in the README
instead. Also dropped the status file, it was working notes and not much use to
anyone reading the repo.
Adds an Android build of the RPCS3 core plus a Compose UI, and fixes several
things that stopped it working on ARM64.
Renderer:
- Emit concrete bounds for runtime sized arrays in uniform blocks when
VK_EXT_shader_uniform_buffer_unsized_array is missing. Adreno does not have
the extension, so every game pipeline failed with VK_ERROR_UNKNOWN and only
overlays drew.
- Probe and request that extension properly instead of chaining its feature
struct unconditionally.
- Hand VMA the Vulkan function pointers it needs under VK_NO_PROTOTYPES.
- Rebuild the surface and swapchain when the window is lost instead of killing
the RSX thread.
- Only create a GLES context when the GL renderer is actually selected.
SPU:
- Sum instead of taking an absolute difference in the ARM64 block verification
checksum. The difference collides on the near identical job binaries an SPU
job manager streams through one local store address, so a cached block could
run against another job's code.
Threading:
- Implement thread affinity on Android using sched_setaffinity.
- Add an ARM big.LITTLE core arrangement so SPU and RSX threads land on the
fast cores.
Misc:
- Detect the host CPU for the LLVM JIT instead of pinning cortex-a34.
- Fall back to the default audio device when cubeb cannot enumerate.
jpolo1224