Breath of the Wild's world-load crash: our command records were larger than the driver's; plain draws are compact and recordings have no BEGIN
About 1 run in 3 crashed about 3 s after Start (operator new at main+0x155a79c returned null, written through at main+0x155a7a4). Each model file gets a heap of its resource size table entry + 0x1008; the file goes in 4 KB aligned and the model's setup (main+0x155a2ac) takes the rest as a frame heap. Part of the setup is GPU memory for the model's prerecorded commands, which the game sizes by recording each mesh's draw and each shape's state for each render pass into a scratch command buffer and summing nvnCommandBufferGetCommandMemoryUsed. So our record sizes count against the table: draw records had grown to carry the indirect and multi-draw fields (0x38 -> 0x50 per recorded draw on 10-18 and 10-20), and every recording began with an 8-byte BEGIN record. Of the 497 models of the world load, Obj_TreeConiferous, Obj_TreeBroadleaf_B and FldObj_HyliaBridge_A-02 needed one 4 KB page more than their entries allow, which fit only when the file's alignment pad was small (about 15% of loads each failed); the others had about 0xd00 to spare for any pad. - Plain draws leave out the indirect / multi-draw fields (hle_nvn.c rec_draw); the replay reads draw records through draw_rec / draw_idx_rec (nvn_obj.h). - A recording starts with its first command, as in NVN: no BEGIN record, the handle is the first record, an empty recording takes only its END. - 0x30 per recorded draw now; all 510 models of the world load fit whatever the pad (probe check in docs/agents/03-bringup.md). World-load A/B on the Mac: main 2 crashes of 8 runs, this 0 of 8. Super Mario Bros. Wonder (opening course), Age of Calamity (first battle), Monster Hunter Rise and Three Houses boots behave as on main. t_nvn 74/74 (6 new checks on recording sizes). - DM_PROBE heap walk: layouts of other sead versions (DM_PROBE_HEAP), frame heaps (DM_PROBE_HEAPFRAME), a heap-name filter (DM_PROBE_HEAPNAME), block contents (DM_PROBE_HEAPWORDS), the raw heap object (DM_PROBE_HEAPRAW); each hit prints as one block. Mario's +16 KB resource-heap cut (a model 0x70 bytes short) may have the same cause; not checked, so the cut stays.
This commit is contained in:
seedds committed
1 parent
f5646efc47
commit
830ecde2a7
8 files changed
+119
-37
No files matched your search
+18
-11
@@ -647,7 +647,7 @@ static uint8_t *hostseg_take(const cmd_t *o) {
|
||||
pthread_mutex_lock(&g_hostseg_mu);
|
||||
int in_seg = 0;
|
||||
for (int i = 0; i < g_nhostseg && cur; i++) if (cur >= (uintptr_t)g_hostseg[i].mem && cur <= (uintptr_t)g_hostseg[i].mem + HOSTSEG_SZ) { lo = g_hostseg[i].org_lo; hi = g_hostseg[i].org_hi; in_seg = 1; break; }
|
||||
if (!in_seg && o && o->recording && o->cur) { lo = o->begin && (uintptr_t)o->begin <= cur ? (uintptr_t)o->begin : cur; hi = cur + 16; }
|
||||
if (!in_seg && o && o->recording && o->cur) { lo = o->recording == 1 && o->begin && (uintptr_t)o->begin <= cur ? (uintptr_t)o->begin : cur; hi = cur + 16; }
|
||||
for (int i = 0; i < g_nhostseg && !m; i++)
|
||||
if (!g_hostseg[i].busy) { g_hostseg[i] = (hostseg_t){ g_hostseg[i].mem, f, 1, lo, hi }; m = g_hostseg[i].mem; }
|
||||
if (!m && (uint64_t)(g_nhostseg + 1) * HOSTSEG_SZ <= HOSTSEG_CAP) {
|
||||
@@ -693,13 +693,17 @@ static uint8_t *cmd_alloc(cmd_t *o, uint32_t size) {
|
||||
o->cb((NVNcommandBuffer *)o, NVN_COMMAND_BUFFER_MEMORY_EVENT_OUT_OF_COMMAND_MEMORY, size + OP_RESERVE, o->cb_data);
|
||||
}
|
||||
if (cs_on()) { pthread_mutex_lock(&g_cs_mu); g_cs.bytes += size; g_cs.recs++; pthread_mutex_unlock(&g_cs_mu); }
|
||||
uint8_t *p = o->cur; o->cur += size; o->used += size; put_hdr(p, 0, size); return p;
|
||||
uint8_t *p = o->cur; o->cur += size; o->used += size; put_hdr(p, 0, size);
|
||||
if (o->recording == 2) { o->begin = p; o->recording = 1; } // The recording's first record is its handle
|
||||
return p;
|
||||
}
|
||||
// A recording starts with its first command, as in NVN: no BEGIN record, so an empty recording takes only its END. Games size command memory by GetCommandMemoryUsed
|
||||
// (nvn_obj.h draw_rec): Breath of the Wild sums one scratch recording per mesh and per shape and render pass into each model's prerecorded commands, and with an
|
||||
// 8-byte BEGIN on each of several hundred recordings a model came out a 4 KB page over its resource size table entry
|
||||
NVN(nvnCommandBufferBeginRecording, void, NVNcommandBuffer *c) {
|
||||
cmd_t *o = CB(c);
|
||||
if (o->recording) LOG("[RED] BeginRecording re-entered");
|
||||
o->recording = 1;
|
||||
uint8_t *p = cmd_alloc(o, 8); put_hdr(p, OP_BEGIN, 8); o->begin = p;
|
||||
o->recording = 2; // 2: recording, no command yet (cmd_alloc sets begin)
|
||||
}
|
||||
NVN(nvnCommandBufferEndRecording, NVNcommandHandle, NVNcommandBuffer *c) {
|
||||
cmd_t *o = CB(c);
|
||||
@@ -752,6 +756,9 @@ static void *rec(NVNcommandBuffer *c, uint32_t op, size_t payload) {
|
||||
// Binding records with arrays are allocated by the actual count: prefix fields + n elements (the replay side reads only the first n). Previously they were recorded at fixed length for the maximum count (bind vertex buffers 272 bytes, bind textures / samplers 280 bytes,
|
||||
// while there are usually only 1–2 in practice), and the empty tail took 40–50% of the command bytes per frame; the advanced stats page of the level 88 sorceress recorded 12.5 MB per frame, using up the game's own command memory pool (about 105 segments x 128 KB per frame)
|
||||
#define RECN(c, OP, T, ARR, N) ((T *)rec((c), (OP), offsetof(T, ARR) + sizeof(((T *)0)->ARR[0]) * (size_t)(N)))
|
||||
// Draws carry the indirect / multi-draw fields (ind onwards) only when they use them: a plain indexed draw record is 0x28 bytes instead of 0x40 (nvn_obj.h draw_rec)
|
||||
static void rec_draw(NVNcommandBuffer *c, p_draw d) { size_t n = d.ind || d.mdi_cnt ? sizeof d : offsetof(p_draw, ind); memcpy(rec(c, OP_DRAW, n), &d, n); }
|
||||
static void rec_draw_idx(NVNcommandBuffer *c, p_draw_idx d) { size_t n = d.ind || d.mdi_cnt ? sizeof d : offsetof(p_draw_idx, ind); memcpy(rec(c, OP_DRAW_IDX, n), &d, n); }
|
||||
static void copy_view(view_t *dst, uint8_t *has, const NVNtextureView *v) { *has = v != NULL; if (v) *dst = *(const view_t *)v; }
|
||||
// Records with textures snapshot the texture objects (0x80 bytes each, after the record struct) and replay reads the snapshots: an NVN command no longer depends on the API object once recorded, and the game may finalize, free or reuse it before submitting.
|
||||
// Unity (Engage) does so when it changes scenes; only the object pointer used to be recorded, and replay read other data (a texture 1869367126 high, a Metal assertion abort).
|
||||
@@ -863,13 +870,13 @@ NVN(nvnCommandBufferSetStencilRef, void, NVNcommandBuffer *c, NVNface f, int v)
|
||||
NVN(nvnCommandBufferSetPolygonOffsetClamp, void, NVNcommandBuffer *c, float fa, float un, float cl) {
|
||||
*REC(c, OP_POLY_OFFSET, p_poly_offset) = (p_poly_offset){fa, un, cl};
|
||||
}
|
||||
NVN(nvnCommandBufferDrawArrays, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, int first, int n) { *REC(c, OP_DRAW, p_draw) = (p_draw){pr, first, n, 1, 0, 0}; }
|
||||
NVN(nvnCommandBufferDrawArrays, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, int first, int n) { rec_draw(c, (p_draw){pr, first, n, 1, 0, 0}); }
|
||||
// Indirect: the {count, instances, first, base instance} record at ind is usually written by the GPU earlier in the frame (Hyrule Warriors: Age of Calamity's first battle), so the replay
|
||||
// issues a Metal indirect draw from the pool buffer instead of reading it at record or replay time (nvn_mtl.m draw)
|
||||
NVN(nvnCommandBufferDrawArraysIndirect, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, NVNbufferAddress ind) { *REC(c, OP_DRAW, p_draw) = (p_draw){pr, 0, 0, 1, 0, ind}; }
|
||||
NVN(nvnCommandBufferDrawArraysIndirect, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, NVNbufferAddress ind) { rec_draw(c, (p_draw){pr, 0, 0, 1, 0, ind}); }
|
||||
NVN(nvnCommandBufferDrawElementsInstanced, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, NVNindexType it, int n, NVNbufferAddress ib,
|
||||
int bv, int bi, int inst) {
|
||||
*REC(c, OP_DRAW_IDX, p_draw_idx) = (p_draw_idx){pr, it, n, bv, bi, inst, ib};
|
||||
rec_draw_idx(c, (p_draw_idx){pr, it, n, bv, bi, inst, ib});
|
||||
}
|
||||
NVN(nvnCommandBufferDispatchCompute, void, NVNcommandBuffer *c, int x, int y, int z) {
|
||||
// The thunk is a tail jump (br), so the return address here is the call site in the game
|
||||
@@ -1927,7 +1934,7 @@ NVN(nvnCommandBufferBindVertexBuffer, void, NVNcommandBuffer *c, int i, NVNbuffe
|
||||
NVN(nvnCommandBufferDrawElements, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, NVNindexType it, int n, NVNbufferAddress ib) { h_nvnCommandBufferDrawElementsInstanced(c, pr, it, n, ib, 0, 0, 1); }
|
||||
NVN(nvnCommandBufferDrawElementsBaseVertex, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, NVNindexType it, int n, NVNbufferAddress ib, int bv) { h_nvnCommandBufferDrawElementsInstanced(c, pr, it, n, ib, bv, 0, 1); }
|
||||
NVN(nvnCommandBufferDrawArraysInstanced, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, int first, int n, int bi, int inst) {
|
||||
*REC(c, OP_DRAW, p_draw) = (p_draw){pr, first, n, inst, bi};
|
||||
rec_draw(c, (p_draw){pr, first, n, inst, bi});
|
||||
}
|
||||
// Indirect, as DrawArraysIndirect: the record at ind is read by the GPU (nvn_mtl.m draw)
|
||||
// Indirect-count multi-draws (Monster Hunter Rise's GPU-driven scene: compute culling writes the draw records and a u32 count, then up to max draws are made from them; 1–49 per call,
|
||||
@@ -1936,11 +1943,11 @@ NVN(nvnCommandBufferDrawArraysInstanced, void, NVNcommandBuffer *c, NVNdrawPrimi
|
||||
enum { MDI_MAX = 1024 };
|
||||
NVN(nvnCommandBufferMultiDrawElementsIndirectCount, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, NVNindexType it, NVNbufferAddress ib, NVNbufferAddress ind, NVNbufferAddress cnt, int max, ptrdiff_t stride) {
|
||||
if (max > MDI_MAX) { ONCE_LOG("[RED] indirect-count multi-draw of up to %d draws: only the first %d are made", max, MDI_MAX); max = MDI_MAX; }
|
||||
for (int i = 0; i < max; i++) *REC(c, OP_DRAW_IDX, p_draw_idx) = (p_draw_idx){pr, it, 0, 0, 0, 1, ib, ind + (uint64_t)i * (uint64_t)stride, cnt, i};
|
||||
for (int i = 0; i < max; i++) rec_draw_idx(c, (p_draw_idx){pr, it, 0, 0, 0, 1, ib, ind + (uint64_t)i * (uint64_t)stride, cnt, i});
|
||||
}
|
||||
NVN(nvnCommandBufferMultiDrawArraysIndirectCount, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, NVNbufferAddress ind, NVNbufferAddress cnt, int max, ptrdiff_t stride) {
|
||||
if (max > MDI_MAX) { ONCE_LOG("[RED] indirect-count multi-draw of up to %d draws: only the first %d are made", max, MDI_MAX); max = MDI_MAX; }
|
||||
for (int i = 0; i < max; i++) *REC(c, OP_DRAW, p_draw) = (p_draw){pr, 0, 0, 1, 0, ind + (uint64_t)i * (uint64_t)stride, cnt, i};
|
||||
for (int i = 0; i < max; i++) rec_draw(c, (p_draw){pr, 0, 0, 1, 0, ind + (uint64_t)i * (uint64_t)stride, cnt, i});
|
||||
}
|
||||
// Whether the host can read n bytes at a guest address: outside a sparse virtual pool always; inside one only where pages are mapped (nvn_mtl.m reads multi-draw counts there)
|
||||
int nvn_host_readable(uint64_t a, uint64_t n) {
|
||||
@@ -1998,7 +2005,7 @@ int nvn_sparse_mapped(const void *pool, uint64_t a, uint64_t n) { // every pag
|
||||
}
|
||||
void nvn_sparse_protect(const void *pool, uint64_t a, uint64_t n) { vpt_walk(pool, a, n, ~0ull, run_protect, 0); }
|
||||
NVN(nvnCommandBufferDrawElementsIndirect, void, NVNcommandBuffer *c, NVNdrawPrimitive pr, NVNindexType it, NVNbufferAddress ib, NVNbufferAddress ind) {
|
||||
*REC(c, OP_DRAW_IDX, p_draw_idx) = (p_draw_idx){pr, it, 0, 0, 0, 1, ib, ind};
|
||||
rec_draw_idx(c, (p_draw_idx){pr, it, 0, 0, 0, 1, ib, ind});
|
||||
}
|
||||
|
||||
// Viewport / scissor / depth range: single and multiple forms
|
||||
|
||||
+10
-8
@@ -4356,9 +4356,9 @@ static void fz_probe_cov2(const p_set_rt *r2, const uint8_t *first, const int8_t
|
||||
static typeof(S) Ssave; memcpy(&Ssave, &S, sizeof S); typeof(R) Rsave = R;
|
||||
const p_draw *fdw = g_fd_dw; const p_draw_idx *fdi = g_fd_di; int fdwhy = g_fd_why;
|
||||
int pso_dirty = g_pso_dirty, dss_dirty = g_dss_dirty;
|
||||
op_hdr fh; memcpy(&fh, first, sizeof fh);
|
||||
g_fd_dw = fh.op == OP_DRAW ? (const p_draw *)(first + 8) : NULL;
|
||||
g_fd_di = fh.op == OP_DRAW_IDX ? (const p_draw_idx *)(first + 8) : NULL;
|
||||
op_hdr fh; memcpy(&fh, first, sizeof fh); p_draw fdw_t; p_draw_idx fdi_t;
|
||||
g_fd_dw = fh.op == OP_DRAW ? draw_rec(first + 8, fh.size, &fdw_t) : NULL;
|
||||
g_fd_di = fh.op == OP_DRAW_IDX ? draw_idx_rec(first + 8, fh.size, &fdi_t) : NULL;
|
||||
R.rt = *r2; R.has_rt = 1;
|
||||
fz_cursor cur = {.p = g_exec_next};
|
||||
for (;;) {
|
||||
@@ -5582,8 +5582,9 @@ static void ixc_run(const p_draw *dw, const p_draw_idx *di) {
|
||||
const uint8_t *q; op_hdr h; const void *a;
|
||||
for (int guard = 0; guard < 200000 && g_ixc_n < IXC_MAX && fz_next(&cur, &q, &h, &a); guard++) {
|
||||
if (h.op == OP_DISPATCH || h.op == OP_COPY_B2B || h.op == OP_UPDATE_UB || h.op == OP_CLEAR_BUF || h.op == OP_COPY_T2B) break;
|
||||
if (h.op == OP_DRAW && ixc_wanted(a, NULL)) ixc_take(a, NULL);
|
||||
else if (h.op == OP_DRAW_IDX && ixc_wanted(NULL, a)) ixc_take(NULL, a);
|
||||
p_draw dt; p_draw_idx it; const p_draw *d = h.op == OP_DRAW ? draw_rec(a, h.size, &dt) : NULL; const p_draw_idx *x = h.op == OP_DRAW_IDX ? draw_idx_rec(a, h.size, &it) : NULL;
|
||||
if (d && ixc_wanted(d, NULL)) ixc_take(d, NULL);
|
||||
else if (x && ixc_wanted(NULL, x)) ixc_take(NULL, x);
|
||||
}
|
||||
}
|
||||
if (g_enc) { g_ixc_splits++; PD("M %llu indirect draw conversion: render pass split here", g_stat_pass); rp_end(); }
|
||||
@@ -5659,7 +5660,8 @@ static void wide_run(const p_draw_idx *di) {
|
||||
const uint8_t *q; op_hdr h; const void *a;
|
||||
for (int guard = 0; guard < 200000 && g_wide_n < WIDE_MAX && fz_next(&cur, &q, &h, &a); guard++) {
|
||||
if (h.op == OP_DISPATCH || h.op == OP_COPY_B2B || h.op == OP_UPDATE_UB || h.op == OP_CLEAR_BUF || h.op == OP_COPY_T2B) break;
|
||||
if (h.op == OP_DRAW_IDX && wide_wanted(a)) wide_take(a);
|
||||
p_draw_idx it; const p_draw_idx *x = h.op == OP_DRAW_IDX ? draw_idx_rec(a, h.size, &it) : NULL;
|
||||
if (x && wide_wanted(x)) wide_take(x);
|
||||
}
|
||||
}
|
||||
int n = g_wide_n - n0; if (n <= 0) return;
|
||||
@@ -6786,8 +6788,8 @@ void mtl_exec(const uint8_t *p) {
|
||||
PD("c %llu depth-stencil clear recorded ser=%llu depth=%g depth_mask=%d stencil=%d stencil_mask=%#x", g_stat_pass, R.rt.depth ? (unsigned long long)R.rt.depth->serial : 0ull, c->depth, c->depth_mask, c->stencil, c->stencil_mask);
|
||||
break;
|
||||
}
|
||||
case OP_DRAW: if (g_rc_skip) break; g_exec_next = p + h.size; draw(a, NULL); g_exec_next = NULL; break; // Lookahead start point
|
||||
case OP_DRAW_IDX: if (g_rc_skip) break; g_exec_next = p + h.size; draw(NULL, a); g_exec_next = NULL; break;
|
||||
case OP_DRAW: { if (g_rc_skip) break; p_draw t; g_exec_next = p + h.size; draw(draw_rec(a, h.size, &t), NULL); g_exec_next = NULL; break; } // Lookahead start point
|
||||
case OP_DRAW_IDX: { if (g_rc_skip) break; p_draw_idx t; g_exec_next = p + h.size; draw(NULL, draw_idx_rec(a, h.size, &t)); g_exec_next = NULL; break; }
|
||||
// Do not mark dirty if the state did not change (the game often re-sends the same program / state block / vertex format before each draw; the dirty flag only decides whether to re-fetch the pipeline / depth-stencil object, and equal values mean the same object)
|
||||
case OP_SCISSOR: case OP_BIND_PROGRAM: case OP_BIND_STATE: case OP_BIND_VATTR: case OP_BIND_VSTREAM: case OP_BIND_VBUF:
|
||||
case OP_BIND_UBO: case OP_BIND_SSBO: case OP_BIND_TEX: case OP_BIND_SAMP: case OP_BIND_IMG: case OP_STENCIL:
|
||||
|
||||
@@ -70,7 +70,7 @@ typedef struct {
|
||||
// +0x10 is left to the game: its inlined NVN header code writes byte 1 here after AddCommandMemory and before BeginRecording / CallCommands (an internal flag of real NVN; main+0x4da5c, main+0xb8dec etc.).
|
||||
// This used to be the low byte of end: rewritten to 01 it cut the segment end by up to 254 bytes, and SMBW's material setup handles (512-byte blocks at minimum) kept overflowing into host segments at the iPhone's addresses
|
||||
uint8_t *end; // End of the current command memory segment
|
||||
uint8_t *begin; // BEGIN record of this recording
|
||||
uint8_t *begin; // First record of this recording (its handle); recording 2 = not written yet
|
||||
PFNNVNCOMMANDBUFFERMEMORYCALLBACKPROC cb; void *cb_data;
|
||||
NVNdevice *dev;
|
||||
uint64_t used; // Bytes written since the game last added command memory, across recordings and host segments, including segment-switch JUMPs (returned by GetCommandMemoryUsed)
|
||||
@@ -94,7 +94,7 @@ typedef struct { uint32_t stride, divisor; } vs_st;
|
||||
// ---------- Command records: {op, size (including header, aligned to 8)} + payload ----------
|
||||
typedef struct { uint32_t op, size; } op_hdr;
|
||||
enum {
|
||||
OP_END, OP_JUMP, OP_BEGIN, OP_CALL,
|
||||
OP_END, OP_JUMP, OP_BEGIN, OP_CALL, // OP_BEGIN is no longer recorded (hle_nvn.c BeginRecording)
|
||||
OP_SIGNAL_EVENT, OP_REPORT_COUNTER, OP_COPY_B2B, OP_UPDATE_UB, // CPU-visible side effects
|
||||
OP_SET_RT, OP_CLEAR_COLOR, OP_CLEAR_DS, OP_VIEWPORTS, OP_SCISSOR, OP_DEPTH_RANGE,
|
||||
OP_BIND_PROGRAM, OP_BIND_STATE, OP_BIND_VATTR, OP_BIND_VSTREAM, OP_BIND_VBUF,
|
||||
@@ -126,6 +126,12 @@ typedef struct { int32_t face, value_mask, mask, ref, which; } p_stencil; // wh
|
||||
typedef struct { float factor, units, clamp; } p_poly_offset;
|
||||
typedef struct { int32_t prim, first, count, instances, base_instance; uint64_t ind; uint64_t mdi_cnt; int32_t mdi_i, pad; } p_draw; // instances 0 counts as 1; ind != 0: DrawArraysIndirect, the arguments are read by the GPU from that address; mdi_cnt != 0: draw mdi_i of an indirect-count multi-draw (drawn only while mdi_i < the u32 at mdi_cnt)
|
||||
typedef struct { int32_t prim, itype, count, base_vertex, base_instance, instances; uint64_t ibuf, ind; uint64_t mdi_cnt; int32_t mdi_i, pad; } p_draw_idx; // ind != 0: DrawElementsIndirect, {count, instances, first index, base vertex, base instance} read by the GPU from that address; mdi_cnt: as in p_draw
|
||||
// A draw record stops before ind unless it is an indirect draw or a multi-draw (hle_nvn.c rec_draw); read it with draw_rec / draw_idx_rec, which give the missing fields as 0.
|
||||
// Games size command memory by what nvnCommandBufferGetCommandMemoryUsed reports, so a plain draw must not take more of it than the real driver's commands do. Breath of the Wild
|
||||
// records each mesh's draw into a scratch command buffer and reserves that many bytes per mesh for the model's prerecorded draws, in the heap its resource size table sizes:
|
||||
// at 0x50 bytes per recorded draw (0x30 now, with its END) three models needed one 4 KB page more than their table entry, and loading them crashed (main+0x155a7a4)
|
||||
static inline const p_draw *draw_rec(const void *a, uint32_t size, p_draw *t) { if (size - 8 >= sizeof *t) return a; memset(t, 0, sizeof *t); memcpy(t, a, size - 8); return t; }
|
||||
static inline const p_draw_idx *draw_idx_rec(const void *a, uint32_t size, p_draw_idx *t) { if (size - 8 >= sizeof *t) return a; memset(t, 0, sizeof *t); memcpy(t, a, size - 8); return t; }
|
||||
typedef struct { int32_t x, y, z; uint64_t caller, ind; } p_dispatch; // caller: return address of the game call site (to locate the dispatcher); ind != 0: DispatchComputeIndirect, the group counts are read by the GPU from that address
|
||||
typedef struct { const dpool_t *pool; } p_set_pool;
|
||||
typedef struct { uint64_t src; const tex_t *tex; view_t view; uint8_t has_view; NVNcopyRegion r; int32_t flags; } p_copy_b2t;
|
||||
|
||||
@@ -165,6 +165,31 @@ int main(void) {
|
||||
uint64_t ts[2]; memcpy(ts, cnt, 16);
|
||||
EXPECT("counter timestamp written (non-zero)", 1, ts[0] != 0 && ts[0] == ts[1]);
|
||||
|
||||
// 5a. Command memory per recording, as GetCommandMemoryUsed reports it (games size prerecorded command blocks by it: Breath of the Wild records one scratch draw per mesh):
|
||||
// no BEGIN record, a plain indexed draw without the indirect / multi-draw fields, and the handle is the first record; an indirect draw keeps its address
|
||||
{
|
||||
static uint8_t m[4096] __attribute__((aligned(4096))); NVNmemoryPoolBuilder mb; NVNmemoryPool mp; NVNcommandBuffer c2;
|
||||
P(nvnMemoryPoolBuilderSetDefaults)(&mb); P(nvnMemoryPoolBuilderSetStorage)(&mb, m, sizeof m); P(nvnMemoryPoolInitialize)(&mp, &mb);
|
||||
P(nvnCommandBufferInitialize)(&c2, &dev);
|
||||
P(nvnCommandBufferAddCommandMemory)(&c2, &mp, 0, sizeof m); P(nvnCommandBufferBeginRecording)(&c2);
|
||||
P(nvnCommandBufferDrawElementsBaseVertex)(&c2, NVN_DRAW_PRIMITIVE_TRIANGLES, NVN_INDEX_TYPE_UNSIGNED_SHORT, 36, 0x10000, 5);
|
||||
NVNcommandHandle hd = P(nvnCommandBufferEndRecording)(&c2);
|
||||
EXPECT("plain indexed draw recording: 0x28 + END", 0x30, P(nvnCommandBufferGetCommandMemoryUsed)(&c2));
|
||||
op_hdr rh; memcpy(&rh, m, sizeof rh); p_draw_idx dt; const p_draw_idx *d = draw_idx_rec(m + 8, rh.size, &dt);
|
||||
EXPECT("its handle is the draw record", 1, (const uint8_t *)hd == m && rh.op == OP_DRAW_IDX);
|
||||
EXPECT("draw read back: count, base vertex, no indirect address", 1, d->count == 36 && d->base_vertex == 5 && d->ibuf == 0x10000 && !d->ind && !d->mdi_cnt);
|
||||
P(nvnCommandBufferAddCommandMemory)(&c2, &mp, 0, sizeof m); P(nvnCommandBufferBeginRecording)(&c2); NVNcommandHandle he = P(nvnCommandBufferEndRecording)(&c2);
|
||||
memcpy(&rh, m, sizeof rh);
|
||||
EXPECT("empty recording: its END only", 8, P(nvnCommandBufferGetCommandMemoryUsed)(&c2));
|
||||
EXPECT("empty recording's handle is its END", 1, (const uint8_t *)he == m && rh.op == OP_END);
|
||||
P(nvnCommandBufferAddCommandMemory)(&c2, &mp, 0, sizeof m); P(nvnCommandBufferBeginRecording)(&c2);
|
||||
P(nvnCommandBufferDrawElementsIndirect)(&c2, NVN_DRAW_PRIMITIVE_TRIANGLES, NVN_INDEX_TYPE_UNSIGNED_SHORT, 0x10000, 0x20000);
|
||||
P(nvnCommandBufferEndRecording)(&c2);
|
||||
memcpy(&rh, m, sizeof rh); d = draw_idx_rec(m + 8, rh.size, &dt);
|
||||
EXPECT("indirect draw keeps its address", 0x20000, d->ind);
|
||||
P(nvnCommandBufferFinalize)(&c2); P(nvnMemoryPoolFinalize)(&mp);
|
||||
}
|
||||
|
||||
// 5b. Sync must hold the CPU back: first queue 24 copies of 64 MiB to keep the GPU busy, with the last one copying src to dst;
|
||||
// the CPU rewrites src only after the fence wait returns. If the wait is released early, that last copy reads the rewritten src.
|
||||
{
|
||||
|
||||
+51
-12
@@ -18,23 +18,56 @@ void crash_set_trap_hook(int (*fn)(ucontext_t *uc));
|
||||
typedef void (*probe_fn)(ucontext_t *uc);
|
||||
static struct { uint64_t at; uint32_t *slot; unsigned hits; char name[40]; long dump; probe_fn fn; int freg; long foff; uint64_t fval; int hreg; } g_probe[MAX_PROBE];
|
||||
|
||||
// !xN: treat xN as a sead::ExpHeap and print its free and used blocks (SMBW layout: free list +0xb0, node offset +0xc4; used list +0xc8, node offset +0xdc; block size at block +0x18)
|
||||
// !xN: treat xN as a sead::ExpHeap and print its free and used blocks (block size at block +0x18, alignment pad at +0x12). Settings (docs/agents/05-debugging.md):
|
||||
// DM_PROBE_HEAP=<name>,<start>,<size>,<free list>,<used list> layout by sead version (hex; node offset at list +0x14), default SMBW 0,28,30,b0,c8 (no name), BotW 28,38,40,e0,f8;
|
||||
// DM_PROBE_HEAPNAME=<text> only heaps whose name contains it; DM_PROBE_HEAPWORDS=1 each used block's first two words; DM_PROBE_HEAPFRAME=<vtable offset in main> heaps of that class
|
||||
// are frame heaps (head +0xe0, tail +0xe8); DM_PROBE_HEAPRAW=1 the heap object's first 0x130 bytes
|
||||
static struct { int init, words, raw; long lay[5], frame_vt; const char *want; } g_hw = { .lay = { 0, 0x28, 0x30, 0xb0, 0xc8 } };
|
||||
static void probe_heapcfg(void) {
|
||||
if (g_hw.init) return; g_hw.init = 1;
|
||||
const char *e = getenv("DM_PROBE_HEAP"); if (e) sscanf(e, "%lx,%lx,%lx,%lx,%lx", &g_hw.lay[0], &g_hw.lay[1], &g_hw.lay[2], &g_hw.lay[3], &g_hw.lay[4]);
|
||||
e = getenv("DM_PROBE_HEAPFRAME"); g_hw.frame_vt = e ? strtol(e, 0, 16) : -1;
|
||||
g_hw.want = getenv("DM_PROBE_HEAPNAME"); g_hw.words = getenv("DM_PROBE_HEAPWORDS") != NULL; g_hw.raw = getenv("DM_PROBE_HEAPRAW") != NULL;
|
||||
}
|
||||
static int rd64(uint64_t a, uint64_t *v) { vm_size_t g = 0; return !vm_read_overwrite(mach_task_self(), a, 8, (vm_address_t)v, &g) && g == 8; }
|
||||
static void probe_word(uint64_t v) { // A word as module+offset when it points into a module (a vtable names the object)
|
||||
module_t *m = v > 0x10000 ? module_of((void *)v) : NULL;
|
||||
if (m) fprintf(stderr, "%s+%llx", m->name, (unsigned long long)(v - (uint64_t)m->base)); else fprintf(stderr, "%llx", (unsigned long long)v);
|
||||
}
|
||||
static void probe_heapname(uint64_t h, char *nm, size_t n) { // sead heaps are named (resource heaps after their file)
|
||||
uint64_t np = 0; nm[0] = 0;
|
||||
if (g_hw.lay[0] && rd64(h + g_hw.lay[0], &np) && np) { vm_size_t g = 0; vm_read_overwrite(mach_task_self(), np, n - 1, (vm_address_t)nm, &g); nm[g < n ? g : n - 1] = 0; for (int k = 0; nm[k]; k++) if (nm[k] < 0x20 || nm[k] > 0x7e) { nm[k] = 0; break; } }
|
||||
}
|
||||
static void probe_heapwalk(uint64_t h) {
|
||||
uint64_t start = 0, size = 0; rd64(h + 0x28, &start); rd64(h + 0x30, &size);
|
||||
fprintf(stderr, "[dm] ExpHeap %#llx start %#llx size %#llx\n", (unsigned long long)h, (unsigned long long)start, (unsigned long long)size);
|
||||
static const struct { int list, off; const char *nm; } L[2] = { { 0xb0, 0xc4, "free" }, { 0xc8, 0xdc, "used" } };
|
||||
char nm[128]; probe_heapname(h, nm, sizeof nm);
|
||||
uint64_t start = 0, size = 0, vt = 0; rd64(h + g_hw.lay[1], &start); rd64(h + g_hw.lay[2], &size); rd64(h, &vt);
|
||||
module_t *vm = vt ? module_of((void *)vt) : NULL;
|
||||
if (g_hw.frame_vt > 0 && vm && !strcmp(vm->name, "main") && vt - (uint64_t)vm->base == (uint64_t)g_hw.frame_vt) {
|
||||
uint64_t hd = 0, tl = 0; rd64(h + 0xe0, &hd); rd64(h + 0xe8, &tl);
|
||||
fprintf(stderr, "[dm] FrameHeap %#llx \"%s\" size %#llx head +%#llx tail +%#llx free %#llx\n", (unsigned long long)h, nm, (unsigned long long)size, (unsigned long long)(hd - start), (unsigned long long)(tl - start), (unsigned long long)(tl - hd));
|
||||
return;
|
||||
}
|
||||
fprintf(stderr, "[dm] ExpHeap %#llx \"%s\" start %#llx size %#llx\n", (unsigned long long)h, nm, (unsigned long long)start, (unsigned long long)size);
|
||||
if (g_hw.raw) { fprintf(stderr, "[dm] heap words:"); for (int k = 0; k < 0x130; k += 8) { uint64_t v = 0; rd64(h + k, &v); fprintf(stderr, "%s+%x=", k % 64 ? " " : "\n[dm] ", k); probe_word(v); } fputc('\n', stderr); }
|
||||
static const char *L[2] = { "free", "used" };
|
||||
for (int k = 0; k < 2; k++) {
|
||||
uint64_t offw = 0, node = 0, sum = 0; int n = 0; rd64(h + L[k].off, &offw); int32_t off = (int32_t)offw;
|
||||
rd64(h + L[k].list + 8, &node);
|
||||
fprintf(stderr, "[dm] %s:", L[k].nm);
|
||||
while (node && node != h + L[k].list && n < 2000) {
|
||||
uint64_t list = h + g_hw.lay[3 + k], offw = 0, node = 0, sum = 0, pads = 0; int n = 0; rd64(list + 0x14, &offw); int32_t off = (int32_t)offw;
|
||||
rd64(list + 8, &node);
|
||||
fprintf(stderr, "[dm] %s:", L[k]);
|
||||
while (node && node != list && n < 4000) {
|
||||
uint64_t blk = node - off, bsz = 0, w2 = 0; rd64(blk + 0x18, &bsz); rd64(blk + 0x10, &w2);
|
||||
fprintf(stderr, "%s%llx+%llx", n % 8 ? " " : "\n[dm] ", (unsigned long long)(blk - start), (unsigned long long)bsz);
|
||||
sum += bsz; n++;
|
||||
unsigned pad = (unsigned)(w2 >> 16) & 0xffff;
|
||||
if (g_hw.words && k) {
|
||||
uint64_t a = 0, b = 0; rd64(blk + 0x20, &a); rd64(blk + 0x28, &b);
|
||||
fprintf(stderr, "\n[dm] %llx+%llx pad %x: ", (unsigned long long)(blk - start), (unsigned long long)bsz, pad); probe_word(a); fputc(' ', stderr); probe_word(b);
|
||||
} else {
|
||||
fprintf(stderr, "%s%llx+%llx", n % 8 ? " " : "\n[dm] ", (unsigned long long)(blk - start), (unsigned long long)bsz);
|
||||
if (pad) fprintf(stderr, "p%x", pad);
|
||||
}
|
||||
sum += bsz; pads += pad; n++;
|
||||
if (!rd64(node + 8, &node)) break;
|
||||
}
|
||||
fprintf(stderr, "\n[dm] %s %d blocks %#llx bytes\n", L[k].nm, n, (unsigned long long)sum);
|
||||
fprintf(stderr, "\n[dm] %s %d blocks %#llx bytes, alignment pads %#llx\n", L[k], n, (unsigned long long)sum, (unsigned long long)pads);
|
||||
}
|
||||
} // dump: on hit print 16 bytes at [x0+dump] (-1 = do not print); fn: dedicated handler (replaces the default print)
|
||||
static int g_nprobe;
|
||||
@@ -75,6 +108,11 @@ static int probe_hit(ucontext_t *uc) { // Registered by probe_install with the
|
||||
if (g_probe[i].foff >= 0 && vm_read_overwrite(mach_task_self(), v + g_probe[i].foff, 8, (vm_address_t)&v, &g)) v = ~g_probe[i].fval;
|
||||
if (v != g_probe[i].fval) { uc->uc_mcontext->__ss.__pc = (uint64_t)g_probe[i].slot; return 1; }
|
||||
}
|
||||
if (g_probe[i].hreg >= 0 && g_hw.want) { // !xN with DM_PROBE_HEAPNAME: report only hits on heaps of that name
|
||||
char nm[128]; probe_heapname(uc->uc_mcontext->__ss.__x[g_probe[i].hreg], nm, sizeof nm);
|
||||
if (!strstr(nm, g_hw.want)) { uc->uc_mcontext->__ss.__pc = (uint64_t)g_probe[i].slot; return 1; }
|
||||
}
|
||||
flockfile(stderr); // One block per hit when threads hit at once
|
||||
{ extern uint64_t g_t0_ns; uint64_t now_ns(void); uint32_t thr_cur_handle(void); fprintf(stderr, "[dm] PROBE %s #%u [%.4fs] T=%x", g_probe[i].name, ++g_probe[i].hits, (now_ns() - g_t0_ns) / 1e9, thr_cur_handle()); }
|
||||
for (int r = 0; r < 8; r++) { uint64_t v = uc->uc_mcontext->__ss.__x[r]; fprintf(stderr, " x%d=%#llx", r, v); probe_str(v); }
|
||||
for (int r = 19; r < 24; r++) fprintf(stderr, " x%d=%#llx", r, uc->uc_mcontext->__ss.__x[r]);
|
||||
@@ -96,6 +134,7 @@ static int probe_hit(ucontext_t *uc) { // Registered by probe_install with the
|
||||
if (!vm_read_overwrite(mach_task_self(), at, n, (vm_address_t)b, &got)) { fprintf(stderr, "[dm] [x2]:"); for (long k = 0; k < (long)got; k += 8) { uint64_t v; memcpy(&v, b + k, 8); fprintf(stderr, "%s%llx", k % 32 ? " " : "\n[dm] ", (unsigned long long)v); } fputc('\n', stderr); } } }
|
||||
if (g_probe[i].hreg >= 0) probe_heapwalk(uc->uc_mcontext->__ss.__x[g_probe[i].hreg]);
|
||||
dm_backtrace(uc->uc_mcontext->__ss.__fp);
|
||||
funlockfile(stderr);
|
||||
uc->uc_mcontext->__ss.__pc = (uint64_t)g_probe[i].slot;
|
||||
return 1;
|
||||
}
|
||||
@@ -145,7 +184,7 @@ void probe_install(void) {
|
||||
}
|
||||
char *qm = strchr(c + 1, '?'), *bang = strchr(c + 1, '!');
|
||||
probe_add(m, strtoull(c + 1, 0, 16), dump, NULL);
|
||||
if (bang && bang[1] == 'x') g_probe[g_nprobe - 1].hreg = (int)strtol(bang + 2, 0, 10) & 31;
|
||||
if (bang && bang[1] == 'x') { g_probe[g_nprobe - 1].hreg = (int)strtol(bang + 2, 0, 10) & 31; probe_heapcfg(); }
|
||||
if (qm) { // Filter: ?x0=706c400000 or ?[x0+38]=781548 (hex)
|
||||
const char *q = qm + 1; int br = *q == '[';
|
||||
if (br) q++;
|
||||
|
||||
@@ -175,8 +175,9 @@ Each entry: symptom → root cause → fix (where the fix lives). Check these fi
|
||||
- **`[RED] MapVirtual: non-contiguous mapping (true sparse) not implemented`** (Monster Hunter Rise) → RE Engine's GPU heap is one 64 GB virtual pool built from separately allocated 4 MB physical pools, each mapped at a virtual offset of its own (45 at boot, over the first 180 MB). A virtual pool larger than the application pool cannot be one alias of a physical pool, so it gets an address range of its own at `MemoryPoolInitialize` (reserved, inaccessible: 64 GB on the Mac, at most 1 GB on iOS), and each mapping request `vm_remap`s the physical pages over its part of the range, so virtual addresses read and write the same memory, as the GPU's page table does. Each run of mapped pages is registered with the replay like a pool of its own and rebuilt when a request joins or splits runs (`vpool_*` in `hle_nvn.c`). Mario's 128 MB pool, mapped whole onto one physical pool, keeps the alias. The log reports the mapped high-water mark per 128 MB.
|
||||
- **`CRASH sig=10` in `memmove` from `pkg_upload` → `nvn_deswizzle`, at an address 32 GB into a sparse virtual pool** (Monster Hunter Rise) → the game's streamed textures (flag 0x20, packaged layout) live 32 GB into its virtual pool; it writes their tiles on the CPU into 4 MB physical pools and then maps them, with no GPU copy. NVN maps at 4 KB and the host aliases at its 16 KB page, so a request whose offsets differ modulo 16 KB cannot be aliased: the ASTC 6x6 textures' mip tail starts 0x81000 into the texture. Every request also goes into a 4 KB page table (`vpt_*` in `hle_nvn.c`: the physical page behind each virtual page and the generation of the request that set it). The replay reads a sparse pool's textures through it (`nvn_sparse_copy`, unmapped pages as 0) and uploads one again only when a mapping in its range changed or the CPU wrote a physical page behind it (`nvn_sparse_since`; the physical pools are dirty-tracked). Before that the untracked alias counted as written on every look: 32 textures, 18 MB, were uploaded again every frame, and those with unaliased tails came out magenta. Requests beyond the reserved range (iOS reserves 1 GB: the buffers stay under 0x20100000 through the opening) are kept in the table only, like unaligned ones: textures can read them, the GPU cannot address them.
|
||||
- **A null-pool buffer even with virtual pools working** → the game's own heap ran out. Trace it with probes ([05](05-debugging.md)): the gsys GPU allocator at `main+0x4290c0` and the heap's `tryAlloc` (vtable slot +0x30) show which heap, its size and every allocation into it; the `!xN` heap walk shows the free and used blocks at the moment of failure.
|
||||
- Mario: each resource gets its own `sead::ExpHeap` sized *resource-size-table value + 0x1008* (`main+0x1e603c` → `ExpHeap::create` `main+0x4aac38`). The table values are Nintendo's measured peaks with almost no margin (Yoshi's animation file uses 99 % of its budget). `Model/NpcCommonerA.bfres` in the opening course came up about 0x70 bytes short: its last GPU chunk (0x9000 bytes, 4 KB aligned) fit, but the chunk's 0x598-byte descriptor did not. Every allocation size before it is fixed by game code and data, so the difference from hardware is still unknown.
|
||||
- Mario: each resource gets its own `sead::ExpHeap` sized *resource-size-table value + 0x1008* (`main+0x1e603c` → `ExpHeap::create` `main+0x4aac38`). The table values are Nintendo's measured peaks with almost no margin (Yoshi's animation file uses 99 % of its budget). `Model/NpcCommonerA.bfres` in the opening course came up about 0x70 bytes short: its last GPU chunk (0x9000 bytes, 4 KB aligned) fit, but the chunk's 0x598-byte descriptor did not. Breath of the Wild's identical failure came from sizes the game takes from the host (below); whether Mario's chunk is sized the same way is not checked yet.
|
||||
- Fix: a registered code cut gives every resource heap +16 KB (`CUTS` in `dm/tools/patch_nso.py`, keyed by the module build ID, original bytes verified). Per-title code patches go there, with the reason.
|
||||
- Breath of the Wild (`main+0x155a7a4` writes through a null `operator new` at the world load, about 1 run in 3): each model's heap is its table entry + 0x1008, the file goes in 4 KB aligned, and the setup (`main+0x155a2ac`) takes the rest as a frame heap (vtable `main+0x1d4f950`, head `+0xe0`, tail `+0xe8`). Its use is the same in every run; only the file's alignment pad varies (0 to 0xff8), and the entries leave room for any pad, about 0xd00 to spare on most models. Three models were a 4 KB page short, so the loads with a large pad failed. The cause: the game sizes the model's prerecorded commands by recording each mesh's draw and each shape's per-pass state into a scratch command buffer and summing `GetCommandMemoryUsed` (`main+0xf9aeb4`, `main+0xf9bb54`), and our records were larger than the driver's (draws carried the indirect and multi-draw fields, every recording began with a BEGIN record). Plain draws now leave those fields out and recordings start with their first command. To check a whole scene, probe where the setup heap is cut (`main+0x155a520` with `!x21`, the resource heap) and the end of the setup (`main+0x155a5f4` with `!x2`, the frame heap), with `DM_PROBE_HEAP=28,38,40,e0,f8 DM_PROBE_HEAPFRAME=1d4f950 DM_PROBE_HEAPWORDS=1` ([05](05-debugging.md)). A model fits any placement when entry + 0x1008 covers the resource heap's header and object (0x310), the file, the frame heap's block header and its peak use, plus 0xff8 of pad.
|
||||
- Read the probe log carefully: `tryAlloc` probes show *requests*, not successes, so a running total that already exceeds the heap means an earlier request failed.
|
||||
|
||||
- **`FATAL NVN command memory: the game's pool is empty…`** → our command records are larger than real NVN commands, so command buffers the game sizes for hardware overflow; when the game's out-of-memory callback declines to add memory, the host lends a segment. Many small command buffers each overflowing once per frame exhausted a fixed pool of 64 × 1 MB. The pool now grows on demand (256 KB segments, abort only beyond 1 GB; `hostseg_take` in `hle_nvn.c`). A segment is released only when the game re-grants memory overlapping the guest bytes of the recording that jumped into it (`hostseg_release` in `AddCommandMemory`): the game records setup blocks once and keeps `CallCommands`-ing them for many frames, so recycling segments after a fixed number of frames would overwrite live recordings.
|
||||
|
||||
@@ -34,7 +34,7 @@ Map GOT slots to NVN names with the survey table (`census/*_nvn_slots.tsv`): a c
|
||||
|
||||
## Probes without a debugger (`DM_PROBE`)
|
||||
|
||||
`DM_PROBE=main:4290c0,main:9712c` (module:offset, comma-separated; `host/probe.c`, Mac only) replaces the instruction with `brk`, and on every hit prints the guest thread (`T=`), x0–x7 (and strings they point to), x19–x23, lr, x8 and a backtrace, then runs the original instruction from a trampoline. Put probes at function entries or where x16 is dead; the probed instruction must not be PC-relative (no `adrp`, `adr`, `b`, `bl`, literal `ldr`: probe the next instruction instead). Output from several threads interleaves; parse it with a regex rather than by line. Probes slow the game, which can shift heap addresses between runs.
|
||||
`DM_PROBE=main:4290c0,main:9712c` (module:offset, comma-separated; `host/probe.c`, Mac only) replaces the instruction with `brk`, and on every hit prints the guest thread (`T=`), x0–x7 (and strings they point to), x19–x23, lr, x8 and a backtrace, then runs the original instruction from a trampoline. Put probes at function entries or where x16 is dead; the probed instruction must not be PC-relative (no `adrp`, `adr`, `b`, `bl`, literal `ldr`: probe the next instruction instead). Each hit prints as one block even when several threads hit at once. Probes slow the game, which can shift heap addresses between runs.
|
||||
|
||||
Per-probe suffixes, in this order:
|
||||
|
||||
@@ -42,7 +42,9 @@ Per-probe suffixes, in this order:
|
||||
|---|---|
|
||||
| `@off`, `@*off`, `@xN+off`, `@*xN+off` | Print 16 bytes at x0+off (or xN+off); `*` dereferences that address first |
|
||||
| `?xN=val`, `?[xN+off]=val` | Only report hits where the register (or the 64-bit word at xN+off) equals `val` (hex); others pass silently. E.g. `main:4743c0?[x0+30]=781548` = only allocations into the heap whose size field is 0x781548 |
|
||||
| `!xN` | Treat xN as a `sead::ExpHeap` and print its free and used blocks (offset+size) |
|
||||
| `!xN` | Treat xN as a `sead::ExpHeap` and print its free and used blocks (offset+size, `p` + alignment pad) |
|
||||
|
||||
The `!xN` heap walk takes the layout of the game's sead version from `DM_PROBE_HEAP=<name>,<start>,<size>,<free list>,<used list>` (hex offsets in the heap object; default Mario's `0,28,30,b0,c8`, Breath of the Wild's `28,38,40,e0,f8`; find them in the heap's constructor and `tryAlloc`). `DM_PROBE_HEAPNAME=<text>` reports only hits whose heap name contains the text (resource heaps are named after their file), `DM_PROBE_HEAPWORDS=1` adds the first two words of each used block (a vtable names the object), `DM_PROBE_HEAPFRAME=<vtable offset in main>` prints heaps of that class as frame heaps (head, tail, free), and `DM_PROBE_HEAPRAW=1` dumps the heap object's first 0x130 bytes, to find another class's fields.
|
||||
|
||||
`DM_PROBE_ALL=1` adds x9–x18; `DM_PROBE_X2=<bytes>` dumps the memory x2 points to.
|
||||
|
||||
|
||||
+1
-1
@@ -176,7 +176,7 @@ The game's own work and its frame rate stay as they are; the host avoids work of
|
||||
- **The game's own interval controller** (at `DM_FPS_TARGET=0`, and the interval the framework keeps while the VFR override holds): patches to it lift its floor from 2 to 1. The game's time step follows its frame interval, so the speed is right at a steady 60, 30 or 20. The game picks the interval from the frame's CPU time and its GPU time, which it reads from two GPU timestamps around the frame; the host gives each timestamp the GPU time of the work around it (profile key `gpu_timestamps`, which its dynamic resolution needs too). Before that it saw only the main thread's CPU time (about 3 ms a frame in the first shrine) and stayed at 60 in slow motion: at 40 fps, about two thirds of the normal speed (an iPhone 16 Pro Max in handheld mode, GitHub issue #9; [04](agents/04-graphics.md)). Under load it still ran at 0.93–0.98 of real time.
|
||||
- **Outdoors on the Mac (M4 Pro, the Great Plateau):** about 165 render passes a frame instead of 386 and GPU p50 about 6.5 ms instead of 9.3 since a partly updated uniform block no longer ends the pass (the game updates 64 bytes of a 64 KB block before each draw group), and the G-buffer clears ride on its first pass ([04](agents/04-graphics.md)). The frame still loads and stores about 800 MB of attachments, most of it where compute dispatches of the GPU particles split passes.
|
||||
- **Render scale:** `DM_RENDER_SCALE=0.5`–`1.0` (also from `Documents/env.txt`) fixes the 3D views at that fraction of 1600×900 docked (1280×720 handheld) and turns the game's own dynamic resolution off; 1.0, the default, keeps it. A stub sets the scale where the game applies its own (`main+0x1266880`), so every scene pass, the shader's resolution ratio and the LOD check follow it: at 0.5 the 1600×900 passes become 800×450 and the 800×450, 400×225, 200×112 and 100×56 chains halve too, while the shadow maps and the 1920×1080 output keep their size and the HUD stays sharp. It holds in handheld mode too (960×540 at 0.75). On the Mac (M4 Pro) the GPU time does not change (about 13 ms in the first shrine at 1.0 and at 0.5): a frame has about 650 passes, most of them tiny, whose fixed cost outweighs their pixels there. Whether it helps an iPhone, whose GPU loads and stores each pass's attachments, is what the setting is for.
|
||||
- **Open: an intermittent crash at the world load on the Mac.** About 3 s after Start, a task worker's `operator new[]` (`main+0x155a79c`) gets null from a game heap and writes through it (`main+0x155a7a4`). It happened with the earlier, elapsed-time frame step too (1 of 8 runs), so the frame step does not cause it, though it may make it likelier: 12 of 33 runs across the variants tried (each stub alone, no pay-back, the game's interval as a floor), solo or beside other runs. None of the about 95 earlier logs (up to 2026-10-19) has it. PR #27 traced it to the resource heap of `Model/Obj_TreeConiferous.bfres`: while the game sets the model up, a 0x78-byte allocation finds 0x70 free in the heap its resource size table entry sizes (0x29e520 for the 0x19b010-byte file). Raising the model entries through `DM_ROMFS_OVERLAY` (the PR's overlay: +64 KB each, +512 KB for this model) avoided it in 0 of 8 runs, against 3 of 9 on 89b608d (2026-10-21, 110 s runs, four at a time). A Switch runs with the original table, so the host makes the setup take more of that heap than the hardware does; that difference is still to be found, and the overlay is not in the repository.
|
||||
- **The world-load crash (about 1 run in 3 on the Mac) came from the host's command record sizes.** About 3 s after Start, a task worker's `operator new` (`main+0x155a79c`) got null and the game wrote through it (`main+0x155a7a4`). Each model file gets a heap of its resource size table entry + 0x1008; the file goes in 4 KB aligned, and the model's setup (`main+0x155a2ac`) takes the rest as a frame heap. Part of that setup is GPU memory for the model's prerecorded commands, which the game sizes by recording each mesh's draw and each shape's state for each render pass into a scratch command buffer and adding up `nvnCommandBufferGetCommandMemoryUsed`, so the host's own record sizes count against the table. Draw records had grown to carry the indirect and multi-draw fields (0x38 → 0x50 per recorded draw on 2026-10-18 and 10-20), and every recording began with an 8-byte BEGIN record. `Obj_TreeConiferous`, `Obj_TreeBroadleaf_B` and `FldObj_HyliaBridge_A-02` then needed one 4 KB page more than their entries allow, which fit only when the file's alignment pad happened to be small (about 15% of loads each failed). Plain draws now leave those fields out and recordings have no BEGIN (0x30 per recorded draw, `nvn_obj.h` `draw_rec`): all 510 models of the world load fit whatever the pad. How it was measured: [03](agents/03-bringup.md).
|
||||
- **Memory:** about 2.8 GB in the first shrine in handheld mode, idle or walking (Mac measurement), against the 3.4 GB an 8 GB iPhone gives the app.
|
||||
- The game waits for each frame's GPU work before submitting the next, so the host hands its translated commands to the GPU in segments ([04](agents/04-graphics.md)).
|
||||
- **HUD prompt shadows and glows, stamina wheel, System menu background:** the game rebuilds each layout capture (a blurred mask of a prompt bar, the menu's background) on the same storage with its own channel mapping and keeps the new texture only if `nvnTextureCompare` calls the two different; the host's comparison ignored the mapping, so captures read alpha 1 (hard-edged dark boxes, cream cloud rectangles, a black menu background). It compares the mapping now ([04](agents/04-graphics.md)).
|
||||
|
||||
Reference in new issue
Block a user