AGC: BDA written-page tracking has bounded capacity and an eight-probe collision limit #3037

Current-main correction (2026-10-12)

On main 8fa5cc486, merged #3175 and #3472 have changed the tracker: 2,048 slots now record chunks of 32 pages (128KiB), with eight probes. The older 4,096 individual-page source/captures below remain historical evidence; they do not establish a current-main title overflow. Main still has an explicit overflow refusal, now more than 2048 chunks of 32 pages stored to through the BDA table in one use are not implemented. The old full-address fix is therefore already upstream. Reproducing the remaining bounded-collision case requires nine colliding chunk keys and fresh title evidence before proposing the older per-range bitmap as a fix. No current-main GPU/title reproduction of that remaining limit is claimed.

Capability gap

The BDA written-page tracker can overflow even while almost all of its 4,096 slots are empty. It probes only eight slots. The GPU store still succeeds, but BdaResources::markWrittenPages throws before publishing any recorded pages:

AGC graphics: more than 4096 pages stored to through the BDA table in one use are not implemented

That message is also misleading for a collision overflow. Both the capacity and probe limits prevent the host from safely completing write tracking. Suppressing the overflow check would lose tracking; increasing capacity alone would retain the bounded-collision failure.

Source / independent GPU reproduction

Main 262c031692a0ce538707436fa1587b671ace682b, Release / BUILD_TESTING=ON. Windows 11 Enterprise 26200, Ryzen 9950X3D, NVIDIA RTX 5080 (driver 32.0.16.1062), WinLibs GCC 15.2.0.

Relevant source:

• core/shader/recompiler/BdaAbi.hpp: WrittenPageSlots=4096, WrittenPageProbes=8, WrittenPageShift=12.
• core/shader/recompiler/SpirvBackend/src/SpirvBdaLookup.cpp, DefineBdaNoteWrite: hashes encoded page numbers, checks eight slots, then sets WrittenOverflowWord.
• core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp, markWrittenPages: refuses nonzero WrittenOverflowWord before visiting the recorded slots.

A new local test on that main uses the existing MakeBdaDwordWriteTestShader and Vulkan Pipeline helper in tests/BdaExecution.cpp:

1. Find nine page numbers with the same bucket: ((uint32_t(page + 1) * 0x9e3779b1u) >> 20) == bucket, starting at page 0x200000.
2. Build nine sorted writable BDA ranges, each exposing eight bytes backed by a distinct 16-byte portion of a real GPU buffer initialized to 0xa5. Guest address=uint64_t(page) << 12; each range points at its own device-buffer offset.
3. Initialize one fault buffer, then perform nine synchronized dispatches through the existing real BDA store emitter without clearing that fault buffer between dispatches. Each writes two known dwords. Repeat the first write once as a duplicate-page control.
4. After each dispatch, assert exact stored dwords, unchanged adjacent sentinel bytes, empty access fault record, occupied-slot count, and overflow flag.

Results for both bucket 0 and bucket 4095 (the latter exercises wraparound): writes 1–8 occupy 1–8 slots with overflow=0; write 9 leaves exactly 8 occupied slots and sets overflow=1. All nine writes reach their GPU-backed memory, adjacent bytes remain unchanged, and the access fault remains Empty.

agc_driver_bda_device and agc_driver_graphics passed five repetitions each after a full system-library build, with no skips and under 30 s per invocation. A mutation that changed only the overflow publication from 1 to 0 fails the new test with BDA write tracking did not report its probe limit. The source was restored byte-for-byte, full libraries rebuilt and both groups repeated five times successfully. These are native NVIDIA Vulkan BDA writes through AnyPS5's producer, not a CPU simulation or a console-semantics claim.

Conditional title observation: capacity also exhausted

PPSA99902 / Sonic Unleashed Recompiled 01.003.000, on the local prerequisite stack described in #2970 and the validation comments on #1825/#2756, based on main 43d2a7c (aggregate 60d016a). This is not clean-main startup evidence; clean main stops earlier at imports.

Five controlled post-partial-dispatch startup runs log the deferred write-back refusal before the later missing multisampled descriptor-shape fatal stop. Two temporary diagnostic captures save the whole 16,420-byte BDA fault buffer. Both contain:

• WrittenOverflowWord=1;
• all 4,096 slots occupied, with 4,096 distinct encoded pages;
• recorded page addresses between 0x407fa00000 and 0x4080a54000;
• recorded probe distances 0: 3,749 pages, 1: 209 pages, 2: 138 pages;
• all eight access-fault header dwords zero.

The capture proves 4,096 distinct recorded pages and overflow; it does not identify the unrecorded failed insertion or prove its address/count. The native nine-page test above separately proves the collision-limit case.

One diagnostic run timed out at 60.345 s and needed later manual baseline restoration after a file lock; the other completed at 29.909 s. Instrumentation was removed byte-for-byte, full libraries rebuilt, relevant restored tests repeated, and 123 baseline runtime files, guest libc and original eboot hashes verified. No rendering/gameplay claim. No new PR or branch push.

Existing work / fix boundary

Searched existing issues/PRs for WrittenPageSlots, WrittenOverflowWord, BDA+overflow, written-page, and the 4096-page refusal. No matching tracker-overflow issue or open implementation was found. #1265/#1280 optimize the existing probe loop; #2447 covers store boundary faults/written pages, and #2972 concerns Intel compiler scratch usage rather than this runtime overflow.

The fix needs lossless write accounting beyond the current capacity and collision limits, while preserving access faults, page invalidation and CPU/GPU coherence. A larger table is only a mitigation; turning this refusal into success without accounting for omitted writes is unsafe. Investigation of scalable tracking is continuing locally.

Investigated and written with AI assistance (Codex). No title shader or dump attached.

The later materialized MSAA image-shape refusal is separately tracked in #3036.