[milescoviello]

What

Forspoken (PPSA03984) stops on an indirect draw:

terminate called after throwing an instance of 'std::runtime_error'
  what():  AGC driver: guest memory is not readable at 0x103a03c000 (range 0x103703c000+0x3000050)

The draw is instanced, with six per-instance attributes (fetch index 1) in one buffer of 96-byte records, at offsets 0, 0x10, 0x20, 0x30, 0x40 and 0x50. Each descriptor has 0x80000 records, so records * stride is the 48 MiB buffer, and the 16 KiB after it are not readable (a ---p region in /proc/self/maps). Because an indirect draw's counts are unknown, prepareDrawInputs copies each descriptor's VertexBufferExtent, which was records * stride from the descriptor's own address. For the attribute at 0x50 that ends 0x50 bytes past the buffer. The last record's element ends at (records - 1) * stride plus the element's bytes from the descriptor's address, inside the buffer, and that is as far as the fetch can read.

VertexBufferExtent now ends there. That is what VertexBufferReadSize gives for a direct draw that reads the last record. A zero stride, a null descriptor and a descriptor without records are handled as before. The comment above VertexBufferOutOfBoundsSelect, which described the old extent, is removed.

agc_vertex_input now expects 32 * (records - 1) + 16 where it expected 32 * records, checks that the extent equals VertexBufferReadSize at the last record, and checks that an attribute at offset 16 of a 32-byte record ends with the descriptor's records. With main's VertexInput.hpp it stops at "cached layout froze the indirect descriptor extent".

Tested

Ubuntu 24.04, GCC 13.3 (CI's compiler), Release with CI's configure flags, on main db06cb4, then rebased onto main 8b8bfe0, RTX 4070 Ti with NVIDIA 595.99.02:

• All 548 tests in libSceAgcDriver pass after the rebase. agc_driver_stencil_ref_export is skipped because the device lacks VK_EXT_shader_stencil_export, and agc_host_import_sparse and agc_driver_sparse_dma_buf_import because /dev/udmabuf is not accessible here.
• Forspoken (PPSA03984), relinked with --to-intel and run on Linux under a 15 GiB memory cap. Both builds also carry fix(agc): accept a copy's sample selection on a draw that copies nothing #5937, without which the title stops at 43 s, and perf(shader): avoid redundancy traversal map copies #5511, without which a start from a filled shader cache runs out of memory within 10 s; they differ only in libSceAgcDriver.prx and share one shader cache:
  • Without this change, from an empty cache: stops with the error above at 146 s, and at 50 s in the next run.
  • With it, from the cache those runs filled: no "guest memory is not readable". The first run compiled 2,111 more shaders until it reached the memory cap at 143 s; the next reached 87 s, where it stops on a different unsupported path (a compute shader sampling the depth plane of a depth surface).
• tools/check_conventions.py --base upstream/main passes, and tools/pr_overlap.py --branch finds no overlap.
• Forspoken (PPSA03984, PPSA03984-app0) on current main 8856f18, 1920x1080, pad input, one run each: main stops at 22 s on the DB_RENDER_CONTROL check (fix(agc): accept a copy's sample selection on a draw that copies nothing #5937); with fix(agc): accept a copy's sample selection on a draw that copies nothing #5937 it stops at 61 s on the indirect vertex buffer read (fix(agc): copy an indirect draw's vertex buffer only up to its last element #5975); with fix(agc): accept a copy's sample selection on a draw that copies nothing #5937 and fix(agc): copy an indirect draw's vertex buffer only up to its last element #5975 at 116 s on the depth pyramid view (fix(agc): treat a view past a depth surface's first level as memory #5982); with all three it draws an in-game scene by 60 s (the lower half still black, about 4 FPS) and runs to 195 s, where vkAllocateMemory for a render target fails with VK_ERROR_OUT_OF_DEVICE_MEMORY on the 12 GB RTX 4070 Ti. The memory goes to retired depth surfaces that are never freed. With fix(agc): free retired depth surfaces nobody samples #6465 added as well, it reaches a 600 s limit (on main 0c4816f).

Not checked on Windows or on a console.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Unblocks: none
• AI-assisted: yes

🤖 Generated with Claude Code

[CnRJay]

The extent now matches what the fetch can actually reach: (records - 1) * stride plus the element's bytes, which is also what VertexBufferReadSize gives for the last record. The added check that the extent equals the read of the last record pins the two together. The Forspoken case (attribute at 0x50 of a 96-byte record, buffer followed by a ---p region) is exactly the one the old records * stride got wrong. It also shortens every indirect draw's copy by stride - elementBytes for each attribute past offset 0, though that's small.

[milescoviello]

@CnRJay thanks for reviewing this, and for checking the extent against VertexBufferReadSize for the last record.

AI-assisted: yes

[adriadam10]

Checked the new extent (records - 1) * stride + element bytes against VertexBufferReadSize for the last record (same value; VertexBufferExtent is only used for indirect draws, Draw.cpp:1163). Built and ran the libSceAgcDriver tests on RADV: agc_vertex_input passes and fails with VertexInput.hpp reverted. Merging once the full Build is green.

[milescoviello]

A re-check on current main 1b1f848, which now has #5937. Forspoken (PPSA03984), Linux, RTX 4070 Ti, 15 GiB cap, pad input, warm cache. #6814 is merged on top in both builds, because without it the title crashes at start-up on #6805's race.

• main + fix(agc): drain library prebuilds before device replacement #6814: 2 of 2 runs stop on this PR's error, at 36 s and 48 s: guest memory is not readable at 0x103a03c000 (range 0x103703c3c0+0x2fffc90) and ... at 0x1037024000 (range 0x1034024000+0x3000050).
• main + fix(agc): drain library prebuilds before device replacement #6814 + this PR + fix(agc): treat a view past a depth surface's first level as memory #5982 + fix(agc): free retired depth surfaces nobody samples #6465: runs the full 300 s (1 of 1).

So with #5937 merged, this is now the title's first stop on main after the start-up race.

AI-assisted: yes