cmake: preserve spaces in clang-cl linker paths (#26)

Pass linker flags as individual options so CMake keeps the PDB and lld map paths intact when the build directory contains spaces.

src/CMakeLists.txt

@@ -312,6 +312,9 @@ function(add_kyty_full_emulator_test target source)
 		target_link_libraries(${target} onecore)
 		add_custom_command(TARGET ${target} POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy_if_different "${KYTY_THIRD_PARTY_DIR}/winpthread/bin/libwinpthread-1.dll" $<TARGET_FILE_DIR:${target}>/libwinpthread-1.dll)
 	endif()
+	# The macOS x86_64 guest address space needs its .zerofill segments anchored
+	# by linker flags, or the kernel kills the binary on load (posix_spawn EIO).
+	configure_macos_guest_address_space(${target})
 endfunction()
 
 function(configure_macos_guest_address_space target)
@@ -431,7 +434,6 @@ target_sources(shader_recompiler_compute_tests PRIVATE
 add_kyty_full_emulator_test(virtual_memory_allocation_tests ../tests/VirtualMemoryAllocationTests.cpp)
 target_compile_definitions(virtual_memory_allocation_tests PRIVATE
 	KYTY_VIRTUAL_MEMORY_ALLOCATION_TESTS=1)
-configure_macos_guest_address_space(virtual_memory_allocation_tests)
 
 # These tests use exceptions.
 if(NOT KYTY_CLANG_CL)
@@ -513,7 +515,12 @@ set(KYTY_EMULATOR_MAP_LINK_PATH "${CMAKE_CURRENT_BINARY_DIR}/${KYTY_EMULATOR_MAP
 set(KYTY_EMULATOR_PDB_LINK_PATH "${CMAKE_CURRENT_BINARY_DIR}/kyty_emulator.pdb")
 
 if(KYTY_CLANG_CL)
-	set_target_properties(kyty_emulator PROPERTIES LINK_FLAGS "/DYNAMICBASE:NO /DEBUG:FULL /PDB:${KYTY_EMULATOR_PDB_LINK_PATH} /lldmap:${KYTY_EMULATOR_MAP_LINK_PATH}")
+	target_link_options(kyty_emulator PRIVATE
+		"/DYNAMICBASE:NO"
+		"/DEBUG:FULL"
+		"/PDB:${KYTY_EMULATOR_PDB_LINK_PATH}"
+		"/lldmap:${KYTY_EMULATOR_MAP_LINK_PATH}"
+	)
 	add_custom_command(TARGET kyty_emulator POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy_if_different "${KYTY_THIRD_PARTY_DIR}/winpthread/bin/libwinpthread-1.dll" $<TARGET_FILE_DIR:kyty_emulator>/libwinpthread-1.dll)
 elseif(WIN32 OR LINUX)
 	set_target_properties(kyty_emulator PROPERTIES LINK_FLAGS "${KYTY_LD_OPTIONS} -Wl,-Map=${KYTY_EMULATOR_MAP_LINK_PATH}")

src/graphics/guest_gpu/command_processor/pm4Handlers.cpp

@@ -1917,17 +1917,23 @@ KYTY_CP_OP_PARSER(CpOpCopyData) {
 
 	EXIT_NOT_IMPLEMENTED(cmd_id != KYTY_PM4(6, Pm4::IT_COPY_DATA, 0u));
 
-	const uint32_t control       = buffer[0];
-	const uint32_t src_sel       = ((control & 0xfu) << 1u) | ((control >> 30u) & 0x1u);
-	const uint32_t dst_sel       = ((control >> 8u) & 0xfu) << 1u;
-	const uint8_t  src_cache     = static_cast<uint8_t>((control >> 13u) & 0x3u);
-	const uint8_t  dst_cache     = static_cast<uint8_t>((control >> 25u) & 0x3u);
-	const uint8_t  write_confirm = static_cast<uint8_t>((control >> 20u) & 0x1u);
-	const uint32_t num_bytes     = ((control >> 16u) & 0x1u) != 0 ? 8u : 4u;
-	const uint64_t src           = buffer[1] | (static_cast<uint64_t>(buffer[2]) << 32u);
-	const uint64_t dst           = buffer[3] | (static_cast<uint64_t>(buffer[4]) << 32u);
-	if (src_sel == (9u << 1u)) {
-		if (dst_sel != (2u << 1u) || dst == 0 || (dst & (num_bytes - 1u)) != 0) {
+	const uint32_t control             = buffer[0];
+	const uint32_t src_sel             = ((control & 0xfu) << 1u) | ((control >> 30u) & 0x1u);
+	const uint32_t dst_sel             = ((control >> 8u) & 0xfu) << 1u;
+	const uint8_t  src_cache           = static_cast<uint8_t>((control >> 13u) & 0x3u);
+	const uint8_t  dst_cache           = static_cast<uint8_t>((control >> 25u) & 0x3u);
+	const uint8_t  write_confirm       = static_cast<uint8_t>((control >> 20u) & 0x1u);
+	const uint32_t num_bytes           = ((control >> 16u) & 0x1u) != 0 ? 8u : 4u;
+	const uint64_t src                 = buffer[1] | (static_cast<uint64_t>(buffer[2]) << 32u);
+	const uint64_t dst                 = buffer[3] | (static_cast<uint64_t>(buffer[4]) << 32u);
+	uint32_t       reference_clock_dst = 0;
+	switch (src_sel) {
+		case 9u: reference_clock_dst = 2u; break;
+		case 18u: reference_clock_dst = 4u; break;
+		default: break;
+	}
+	if (reference_clock_dst != 0) {
+		if (dst_sel != reference_clock_dst || dst == 0 || (dst & (num_bytes - 1u)) != 0) {
 			EXIT("unsupported reference-clock copyData, src_sel=0x%02" PRIx32
 			     " dst_sel=0x%02" PRIx32 " dst=0x%016" PRIx64 " size=%u\n",
 			     src_sel, dst_sel, dst, num_bytes);
@@ -3390,6 +3396,12 @@ void GraphicsInitJmpTablesCxIndirect() {
 	g_hw_ctx_indirect_func[Pm4::DB_COUNT_CONTROL] = [](KYTY_HW_CTX_INDIRECT_ARGS) {
 		HwCtxIgnoreDepthMetadataRegister(cmd_offset, value);
 	};
+	for (auto cmd_offset = Pm4::DB_SRESULTS_COMPARE_STATE0;
+	     cmd_offset <= Pm4::DB_SRESULTS_COMPARE_STATE1; cmd_offset++) {
+		g_hw_ctx_indirect_func[cmd_offset] = [](KYTY_HW_CTX_INDIRECT_ARGS) {
+			HwCtxIgnoreDepthMetadataRegister(cmd_offset, value);
+		};
+	}
 	g_hw_ctx_indirect_func[Pm4::DB_RENDER_OVERRIDE] = [](KYTY_HW_CTX_INDIRECT_ARGS) {
 		HwCtxIgnoreDepthMetadataRegister(cmd_offset, value);
 	};

src/graphics/guest_gpu/gpu_defs.h

@@ -72,6 +72,7 @@ enum class ChannelLayout : uint32_t {
 	k32_32       = 11,
 	k16_16_16_16 = 12,
 	k32_32_32_32 = 14,
+	k5_6_5       = 16,
 	k5_5_5_1     = 17,
 	k4_4_4_4     = 19,
 	kBc1         = 35,

src/graphics/guest_gpu/gpu_format.cpp

@@ -39,6 +39,7 @@ constexpr FormatInfo kFormatInfo[] = {
     {GpuEnumValue(BufferFormat::k16_16Float), 4, 0, 4, true, false},
     {GpuEnumValue(BufferFormat::k11_11_10Float), 4, 0, 4, true, false},
     {GpuEnumValue(BufferFormat::k10_10_10_2UNorm), 4, 0, 4, true, false},
+    {GpuEnumValue(BufferFormat::k10_10_10_2UInt), 4, 0, 4, true, true},
     {GpuEnumValue(BufferFormat::k8_8_8_8UNorm), 4, 0, 4, true, false},
     {GpuEnumValue(BufferFormat::k8_8_8_8SNorm), 4, 0, 4, true, false},
     {GpuEnumValue(BufferFormat::k8_8_8_8UInt), 4, 0, 4, true, true},

src/graphics/guest_gpu/graphicsRun.cpp

@@ -407,11 +407,16 @@ void CommandProcessor::WriteData(uint32_t* dst, const uint32_t* src, uint32_t dw
                                  uint32_t write_control) {
 	const uint32_t dst_sel      = ((write_control >> 30u) & 0x1u) | ((write_control >> 7u) & 0x1eu);
 	const uint32_t cache_policy = (write_control >> 25u) & 0x3u;
-	const uint32_t increment    = (write_control >> 16u) & 0x1u;
+	const uint32_t increment     = (write_control >> 16u) & 0x1u;
 	const uint32_t write_confirm = (write_control >> 20u) & 0x1u;
 
-	if (dst_sel != 0 && dst_sel != 2 && dst_sel != 4 && dst_sel != 5) {
-		EXIT("unsupported writeData destination selector 0x%02" PRIx32 "\n", dst_sel);
+	switch (dst_sel) {
+		case 0:
+		case 2:
+		case 4:
+		case 5:
+		case 6: break;
+		default: EXIT("unsupported writeData destination selector 0x%02" PRIx32 "\n", dst_sel);
 	}
 	EXIT_NOT_IMPLEMENTED(increment != 0);
 

src/graphics/guest_gpu/pm4.cpp

@@ -110,7 +110,6 @@ void DumpPm4PacketStream(Common::File* file, uint32_t* cmd_buffer, uint32_t star
 	auto* cmd = cmd_buffer + start_dw;
 	auto  dw  = num_dw;
 	while (dw != 0) {
-		EXIT_NOT_IMPLEMENTED(dw < 2);
 		EXIT_NOT_IMPLEMENTED(dw > num_dw);
 
 		auto cmd_id = *cmd++;
@@ -120,6 +119,9 @@ void DumpPm4PacketStream(Common::File* file, uint32_t* cmd_buffer, uint32_t star
 		uint32_t len = 0;
 
 		const auto packet_type = static_cast<PacketType>(cmd_id >> 30u);
+		// Type-2 packets are header-only padding; every other packet type requires a body.
+		EXIT_NOT_IMPLEMENTED(dw < 2 && packet_type != PacketType::Type2);
+
 		switch (packet_type) {
 			case PacketType::Type3: {
 				const bool    sh_gx = (cmd_id & 0x2u) == 0;

src/graphics/host_gpu/memoryTracker.cpp

@@ -157,7 +157,6 @@ void MemoryTracker::UntrackMemoryLocked(uint64_t vaddr, uint64_t size) {
 		const auto changed =
 		    manager->ChangeState<DirtySource::Cpu, true>(manager->GetCpuAddr() + offset, bytes);
 		manager->ApplyProtection(changed, false);
-		manager->Untrack(manager->GetCpuAddr() + offset, bytes);
 	});
 	locks.clear();
 }
@@ -168,93 +167,4 @@ void MemoryTracker::UntrackMemory(uint64_t vaddr, uint64_t size) {
 	UntrackMemoryLocked(vaddr, size);
 }
 
-bool MemoryTracker::InvalidateRegion(uint64_t vaddr, uint64_t size, PageFaultPhase phase) noexcept {
-	switch (phase) {
-		case PageFaultPhase::Release: return true;
-		case PageFaultPhase::Invalidate: {
-			const auto action = BeginCpuFault(vaddr, size);
-			switch (action) {
-				case CpuFaultAction::Untracked: return false;
-				case CpuFaultAction::Continue: return true;
-				case CpuFaultAction::Download:
-					EXIT("generic region invalidation cannot download GPU-dirty memory\n");
-			}
-		}
-		case PageFaultPhase::Complete:
-			return CompleteCpuFault(vaddr, size, PageFaultAccess::Write, false);
-	}
-	EXIT("unsupported region invalidation phase\n");
-}
-
-bool MemoryTracker::InvalidateVirtualGpuWrite(PageFaultAccess access, uint64_t vaddr, uint64_t size,
-                                              PageFaultPhase phase) noexcept {
-	switch (phase) {
-		case PageFaultPhase::Release: return true;
-		case PageFaultPhase::Invalidate: {
-			const bool gpu_modified = Iterate<false>(
-			    vaddr, size, [](RegionManager* manager, uint64_t offset, uint64_t bytes) {
-				    std::scoped_lock lock(manager->lock);
-				    return manager->IsModified<DirtySource::Gpu>(offset, bytes);
-			    });
-			if (!gpu_modified) {
-				return false;
-			}
-			const auto action = BeginCpuFault(vaddr, size);
-			if (access != PageFaultAccess::Write || action != CpuFaultAction::Download) {
-				EXIT("virtual GPU write fault requires write access to GPU-dirty memory\n");
-			}
-			return true;
-		}
-		case PageFaultPhase::Complete: {
-			if (access != PageFaultAccess::Write) {
-				EXIT("virtual GPU write completion requires write access\n");
-			}
-			bool completed = false;
-			Iterate<false>(
-			    vaddr, size, [&completed](RegionManager* manager, uint64_t offset, uint64_t bytes) {
-				    std::scoped_lock lock(manager->lock);
-				    if (completed) {
-					    EXIT("virtual GPU write fault spans multiple tracked regions\n");
-				    }
-				    completed =
-				        manager->CompleteVirtualGpuWrite(manager->GetCpuAddr() + offset, bytes);
-			    });
-			return completed;
-		}
-	}
-	EXIT("unsupported virtual GPU write invalidation phase\n");
-}
-
-CpuFaultAction MemoryTracker::BeginCpuFault(uint64_t vaddr, uint64_t size,
-                                            PageFaultAccess access) noexcept {
-	CheckNotInUploadCallback();
-	CpuFaultAction action = CpuFaultAction::Untracked;
-	Iterate<false>(
-	    vaddr, size, [&action, access](RegionManager* manager, uint64_t offset, uint64_t bytes) {
-		    std::scoped_lock lock(manager->lock);
-		    if (action != CpuFaultAction::Untracked) {
-			    EXIT("CPU fault spans multiple tracked regions\n");
-		    }
-		    action = manager->BeginCpuFault(manager->GetCpuAddr() + offset, bytes, access);
-	    });
-	return action;
-}
-
-bool MemoryTracker::CompleteCpuFault(uint64_t vaddr, uint64_t size, PageFaultAccess access,
-                                     bool downloaded) noexcept {
-	CheckNotInUploadCallback();
-	bool found = false;
-	Iterate<false>(
-	    vaddr, size,
-	    [&found, access, downloaded](RegionManager* manager, uint64_t offset, uint64_t bytes) {
-		    std::scoped_lock lock(manager->lock);
-		    if (found) {
-			    EXIT("CPU fault completion spans multiple tracked regions\n");
-		    }
-		    found = manager->CompleteCpuFault(manager->GetCpuAddr() + offset, bytes, access,
-		                                      downloaded);
-	    });
-	return found;
-}
-
 } // namespace Libs::Graphics

src/graphics/host_gpu/memoryTracker.h

@@ -30,13 +30,6 @@ public:
 	void               MarkRegionAsGpuModified(uint64_t vaddr, uint64_t size);
 	void               UnmarkRegionAsGpuModified(uint64_t vaddr, uint64_t size);
 	void               UntrackMemory(uint64_t vaddr, uint64_t size);
-	[[nodiscard]] CpuFaultAction
-	                   BeginCpuFault(uint64_t vaddr, uint64_t size,
-	                                 PageFaultAccess access = PageFaultAccess::Write) noexcept;
-	[[nodiscard]] bool CompleteCpuFault(uint64_t vaddr, uint64_t size, PageFaultAccess access,
-	                                    bool downloaded) noexcept;
-	[[nodiscard]] bool InvalidateRegion(uint64_t vaddr, uint64_t size,
-	                                    PageFaultPhase phase) noexcept;
 	template <typename Flush>
 	void InvalidateRegion(uint64_t vaddr, uint64_t size, Flush&& on_flush) {
 		static_assert(std::is_invocable_v<Flush&>);
@@ -78,10 +71,8 @@ public:
 			EXIT("memory invalidation retained GPU-owned pages\n");
 		}
 	}
-	[[nodiscard]] bool InvalidateVirtualGpuWrite(PageFaultAccess access, uint64_t vaddr,
-	                                             uint64_t size, PageFaultPhase phase) noexcept;
-	void               ValidateGpuDirtyPages(const RangeSet& dirty, uint64_t vaddr, uint64_t size,
-	                                         const char* operation) const noexcept;
+	void ValidateGpuDirtyPages(const RangeSet& dirty, uint64_t vaddr, uint64_t size,
+	                           const char* operation) const noexcept;
 	void ValidateGpuDirtyOwnership(const RangeSet& dirty, uint64_t vaddr, uint64_t size,
 	                               const char* operation);
 
@@ -102,9 +93,6 @@ public:
 		}
 		Iterate<false>(vaddr, size, [&](RegionManager* manager, uint64_t offset, uint64_t bytes) {
 			const auto address = manager->GetCpuAddr() + offset;
-			if (manager->HasPendingFault(address, bytes)) {
-				EXIT("GPU download synchronization raced a pending CPU fault\n");
-			}
 			manager->template ForEachModifiedRange<DirtySource::Gpu, false>(address, bytes,
 			                                                                preflight);
 		});
@@ -141,7 +129,6 @@ public:
 		const auto* previous_upload_owner = std::exchange(s_upload_owner, this);
 		Iterate<false>(vaddr, size, [&](RegionManager* manager, uint64_t offset, uint64_t bytes) {
 			manager->lock.lock();
-			manager->Track(manager->GetCpuAddr() + offset, bytes);
 			manager->ForEachModifiedRange<DirtySource::Cpu, true>(manager->GetCpuAddr() + offset,
 			                                                      bytes, range_func);
 			if (!is_written) {

src/graphics/host_gpu/pageManager.cpp

@@ -56,8 +56,6 @@ constexpr uint32_t READ_WRITE_PROTECTION = PAGE_READWRITE;
 // Zero is the unknown protection sentinel.
 constexpr uint32_t UNKNOWN_PROTECTION = 0;
 
-thread_local bool g_in_fault_resolution = false;
-
 [[noreturn]] void FailFast(const char* reason = nullptr) noexcept {
 	std::fputs("PageManager fail-fast: ", stderr);
 	std::fputs(reason != nullptr ? reason : "invalid page state", stderr);
@@ -162,11 +160,8 @@ struct PageManager::Impl {
 		uint32_t         original_protection = 0;
 		uint32_t         backing_writer      = 0;
 		// Shadow the protection applied through Protect().
-		uint32_t current_protection   = UNKNOWN_PROTECTION;
-		bool     resolving            = false;
-		bool     resolving_read_write = false;
-		bool     late_read_pending    = false;
-		bool     late_write_pending   = false;
+		uint32_t current_protection = UNKNOWN_PROTECTION;
+		bool     resolving          = false;
 	};
 
 	struct Region {
@@ -193,10 +188,7 @@ struct PageManager::Impl {
 		std::span<PageState*> m_pages;
 	};
 
-	Impl(PageFaultHandler handler, void* context): fault_handler(handler), fault_context(context) {
-		if (fault_handler == nullptr) {
-			Fatal("null page-manager fault callback");
-		}
+	Impl() {
 #if KYTY_PLATFORM == KYTY_PLATFORM_WINDOWS
 		SYSTEM_INFO info {};
 		GetSystemInfo(&info);
@@ -268,17 +260,6 @@ struct PageManager::Impl {
 		return page.original_protection;
 	}
 
-	static void PublishDelayedFaults(PageState& page, uint32_t old_protection,
-	                                 uint32_t new_protection) {
-		if (old_protection == NO_ACCESS_PROTECTION && new_protection != NO_ACCESS_PROTECTION) {
-			page.late_read_pending = true;
-		}
-		if ((old_protection == NO_ACCESS_PROTECTION || old_protection == READ_ONLY_PROTECTION) &&
-		    new_protection == READ_WRITE_PROTECTION) {
-			page.late_write_pending = true;
-		}
-	}
-
 	static void InitializeProtection(std::span<PageState*> pages) {
 		for (auto* page: pages) {
 			page->original_protection = READ_WRITE_PROTECTION;
@@ -286,19 +267,8 @@ struct PageManager::Impl {
 		}
 	}
 
-	static bool AllowsAccess(const PageState& page, [[maybe_unused]] uint64_t vaddr,
-	                         PageFaultAccess access) noexcept {
-		switch (access) {
-			case PageFaultAccess::Read:
-				return page.current_protection == READ_ONLY_PROTECTION ||
-				       page.current_protection == READ_WRITE_PROTECTION;
-			case PageFaultAccess::Write: return page.current_protection == READ_WRITE_PROTECTION;
-			default: return false;
-		}
-	}
-
 	void ProtectRange(std::span<PageState*> pages, uint64_t vaddr, uint32_t protection,
-	                  std::span<const uint32_t> expected_old, bool fault_path) noexcept {
+	                  std::span<const uint32_t> expected_old) noexcept {
 		const auto size = pages.size() * PAGE_SIZE;
 		if (pages.size() != expected_old.size()) {
 			FailFast("protection range state size mismatch");
@@ -306,9 +276,6 @@ struct PageManager::Impl {
 		for (size_t i = 0; i < pages.size(); i++) {
 			const auto actual = pages[i]->current_protection;
 			if (actual != UNKNOWN_PROTECTION && actual != expected_old[i]) {
-				if (fault_path) {
-					FailFast("mprotect fault transition did not match expected protection");
-				}
 				Fatal("invalid protection transition at 0x%016" PRIx64 ", old=0x%08" PRIx32
 				      ", expected=0x%08" PRIx32 ", new=0x%08" PRIx32,
 				      vaddr + i * PAGE_SIZE, actual, expected_old[i], protection);
@@ -316,9 +283,6 @@ struct PageManager::Impl {
 		}
 		if (!Libs::LibKernel::Memory::ProtectGuestHostMemory(vaddr, size,
 		                                                     ToMemoryMode(protection))) {
-			if (fault_path) {
-				FailFast("address-space fault protection transition failed");
-			}
 			Fatal("address-space protection failed at 0x%016" PRIx64 ", new=0x%08" PRIx32, vaddr,
 			      protection);
 		}
@@ -327,47 +291,28 @@ struct PageManager::Impl {
 		}
 	}
 
-	void Protect(PageState& page, uint64_t vaddr, uint32_t protection, uint32_t expected_old,
-	             bool fault_path) noexcept {
+	void Protect(PageState& page, uint64_t vaddr, uint32_t protection,
+	             uint32_t expected_old) noexcept {
 		PageState* pages[]    = {&page};
 		uint32_t   expected[] = {expected_old};
-		ProtectRange(pages, vaddr, protection, expected, fault_path);
+		ProtectRange(pages, vaddr, protection, expected);
 	}
 
 	std::unique_ptr<std::atomic<Region*>[]> regions;
 	std::vector<std::unique_ptr<Region>>    region_storage;
 	std::mutex                              region_mutex;
-	PageFaultHandler                        fault_handler = nullptr;
-	void*                                   fault_context = nullptr;
 };
 
 static_assert(std::atomic<void*>::is_always_lock_free);
 
-PageManager::PageManager(PageFaultHandler fault_handler, void* fault_context)
-    : m_impl(std::make_unique<Impl>(fault_handler, fault_context)) {}
+PageManager::PageManager(): m_impl(std::make_unique<Impl>()) {}
 
 PageManager::~PageManager() = default;
 
 uint64_t PageManager::GetPageSize() const {
-	if (g_in_fault_resolution) {
-		FailFast("nested page fault while resolving a watched page");
-	}
 	return PAGE_SIZE;
 }
 
-bool PageManager::IsTracked(uint64_t vaddr) const noexcept {
-	if (g_in_fault_resolution) {
-		FailFast("IsTracked called during fault resolution");
-	}
-	auto* region = m_impl->FindRegion(vaddr);
-	if (region == nullptr) {
-		return false;
-	}
-	auto&     page = m_impl->GetPage(*region, vaddr);
-	SpinGuard lock(page.lock);
-	return page.write_watchers != 0 || page.access_watchers != 0;
-}
-
 void PageManager::UpdatePageWatchers(bool track, uint64_t vaddr, uint64_t size,
                                      PageWatchMode mode) {
 	if (mode != PageWatchMode::Write && mode != PageWatchMode::ReadWrite) {
@@ -473,27 +418,14 @@ void PageManager::UpdatePageWatchers(bool track, uint64_t vaddr, uint64_t size,
 			}
 			m_impl->ProtectRange(std::span {pages}.subspan(first, last - first),
 			                     chunk_begin + first * PAGE_SIZE, protection,
-			                     std::span {old_protections}.subspan(first, last - first), false);
+			                     std::span {old_protections}.subspan(first, last - first));
 			first = current;
 		}
 
-		for (size_t i = 0; i < page_count; i++) {
-			auto&      page       = *pages[i];
-			const auto protection = new_protections[i];
-			if (track) {
-				switch (protection) {
-					case NO_ACCESS_PROTECTION:
-						page.late_read_pending  = false;
-						page.late_write_pending = false;
-						break;
-					case READ_ONLY_PROTECTION: page.late_write_pending = false; break;
-					default: break;
-				}
-			} else if (page.backing_writer == 0) {
-				Impl::PublishDelayedFaults(page, old_protections[i], protection);
-				if (page.write_watchers == 0 && page.access_watchers == 0) {
-					page.original_protection = 0;
-				}
+		for (auto* page: pages) {
+			if (!track && page->backing_writer == 0 && page->write_watchers == 0 &&
+			    page->access_watchers == 0) {
+				page->original_protection = 0;
 			}
 		}
 		chunk_begin = chunk_end;
@@ -546,9 +478,6 @@ PageManager::ReserveBackingWrites(std::span<const RangeSet::Range> ranges) {
 }
 
 void PageManager::BeginBackingWrite(uint64_t vaddr, uint64_t size) noexcept {
-	if (g_in_fault_resolution) {
-		FailFast("backing write began during fault resolution");
-	}
 	const auto end    = PageEnd(vaddr, size);
 	const auto writer = CurrentThread();
 	for (auto address = PageStart(vaddr); address < end; address += PAGE_SIZE) {
@@ -561,16 +490,12 @@ void PageManager::BeginBackingWrite(uint64_t vaddr, uint64_t size) noexcept {
 		if (page.resolving || page.backing_writer != 0 || page.access_watchers == 0) {
 			Fatal("backing write races page resolution at 0x%016" PRIx64, address);
 		}
-		page.resolving            = true;
-		page.resolving_read_write = true;
-		page.backing_writer       = writer;
+		page.resolving      = true;
+		page.backing_writer = writer;
 	}
 }
 
 void PageManager::EndBackingWrite(uint64_t vaddr, uint64_t size) noexcept {
-	if (g_in_fault_resolution) {
-		FailFast("backing write ended during fault resolution");
-	}
 	const auto end    = PageEnd(vaddr, size);
 	const auto writer = CurrentThread();
 	for (auto address = PageStart(vaddr); address < end; address += PAGE_SIZE) {
@@ -586,127 +511,14 @@ void PageManager::EndBackingWrite(uint64_t vaddr, uint64_t size) noexcept {
 		const auto old_protection = NO_ACCESS_PROTECTION;
 		const auto new_protection = Impl::WatcherProtection(page);
 		if (new_protection != old_protection) {
-			m_impl->Protect(page, address, new_protection, old_protection, false);
+			m_impl->Protect(page, address, new_protection, old_protection);
 		}
-		Impl::PublishDelayedFaults(page, old_protection, new_protection);
 		if (page.write_watchers == 0 && page.access_watchers == 0) {
 			page.original_protection = 0;
 		}
-		page.backing_writer       = 0;
-		page.resolving            = false;
-		page.resolving_read_write = false;
+		page.backing_writer = 0;
+		page.resolving      = false;
 	}
 }
 
-bool PageManager::HandleFault(PageFaultAccess access, uint64_t fault_vaddr) noexcept {
-	if (g_in_fault_resolution) {
-		FailFast("nested HandleFault call");
-	}
-	auto* region = m_impl->FindRegion(fault_vaddr);
-	if (region == nullptr) {
-		return false;
-	}
-	auto& page   = m_impl->GetPage(*region, fault_vaddr);
-	bool  waited = false;
-	while (true) {
-		SpinGuard lock(page.lock);
-		if (access == PageFaultAccess::Read && page.late_read_pending &&
-		    Impl::AllowsAccess(page, fault_vaddr, access)) {
-			page.late_read_pending = false;
-			return true;
-		}
-		if (access == PageFaultAccess::Write && page.late_write_pending &&
-		    Impl::AllowsAccess(page, fault_vaddr, access)) {
-			page.late_write_pending = false;
-			return true;
-		}
-		if (page.resolving) {
-			if (page.backing_writer == CurrentThread()) {
-				FailFast("backing writer faulted on its own reserved page");
-			}
-			if ((!page.resolving_read_write && access != PageFaultAccess::Write) ||
-			    (page.resolving_read_write && access != PageFaultAccess::Read &&
-			     access != PageFaultAccess::Write)) {
-				FailFast("fault access is incompatible with the active resolver");
-			}
-			waited = true;
-			continue;
-		}
-		if (page.write_watchers == 0 && page.access_watchers == 0) {
-			if (access != PageFaultAccess::Read && access != PageFaultAccess::Write) {
-				return false;
-			}
-			bool&      pending = (access == PageFaultAccess::Read ? page.late_read_pending
-			                                                      : page.late_write_pending);
-			const bool allowed = Impl::AllowsAccess(page, fault_vaddr, access);
-			pending            = false;
-			if (waited && !allowed) {
-				FailFast("page remained inaccessible after waiting for its resolver");
-			}
-			// More than one CPU can fault before a protection transition becomes visible. The first
-			// delayed fault consumes the hint bit; later faults must also resume once the mapped
-			// page already permits the requested access. A genuinely read-only/no-access page still
-			// falls through to the guest exception path.
-			return allowed;
-		}
-		if ((access != PageFaultAccess::Read && access != PageFaultAccess::Write) ||
-		    (access == PageFaultAccess::Read && page.access_watchers == 0)) {
-			FailFast("fault access is incompatible with active page watchers");
-		}
-		page.resolving            = true;
-		page.resolving_read_write = page.access_watchers != 0;
-		break;
-	}
-	g_in_fault_resolution = true;
-	const bool handled    = m_impl->fault_handler(m_impl->fault_context, access, fault_vaddr, 1,
-	                                              PageFaultPhase::Invalidate);
-	g_in_fault_resolution = false;
-	{
-		SpinGuard lock(page.lock);
-		if (!handled || !page.resolving) {
-			FailFast("fault invalidation did not preserve the resolving state");
-		}
-	}
-	g_in_fault_resolution = true;
-	const bool completed  = m_impl->fault_handler(m_impl->fault_context, access, fault_vaddr, 1,
-	                                              PageFaultPhase::Complete);
-	g_in_fault_resolution = false;
-	{
-		SpinGuard lock(page.lock);
-		if (!completed || !page.resolving) {
-			FailFast("fault completion did not preserve the resolving state");
-		}
-		if (page.write_watchers != 0 || page.access_watchers != 0) {
-			const auto old_protection  = Impl::WatcherProtection(page);
-			const bool read_only_fault = access == PageFaultAccess::Read;
-			if (read_only_fault && page.access_watchers == 0) {
-				FailFast("read fault completed without a read/write watcher");
-			}
-			page.access_watchers = 0;
-			if (!read_only_fault) {
-				page.write_watchers = 0;
-			}
-			const auto restored_protection = Impl::WatcherProtection(page);
-			m_impl->Protect(page, PageStart(fault_vaddr), restored_protection, old_protection,
-			                true);
-			if (page.write_watchers == 0) {
-				page.original_protection = 0;
-			}
-			Impl::PublishDelayedFaults(page, old_protection, restored_protection);
-		} else if (!Impl::AllowsAccess(page, fault_vaddr, access)) {
-			FailFast("fault completion left the page inaccessible");
-		}
-		page.resolving            = false;
-		page.resolving_read_write = false;
-	}
-	g_in_fault_resolution = true;
-	const bool released   = m_impl->fault_handler(m_impl->fault_context, access, fault_vaddr, 1,
-	                                              PageFaultPhase::Release);
-	g_in_fault_resolution = false;
-	if (!released) {
-		FailFast("fault release callback failed");
-	}
-	return true;
-}
-
 } // namespace Libs::Graphics

src/graphics/host_gpu/pageManager.h

@@ -11,11 +11,8 @@
 namespace Libs::Graphics {
 
 enum class PageFaultAccess { Read, Write, Execute, Unknown };
-enum class PageFaultPhase { Invalidate, Complete, Release };
 enum class PageWatchMode { Write, ReadWrite };
 
-using PageFaultHandler = bool (*)(void* context, PageFaultAccess access, uint64_t vaddr,
-                                  uint64_t size, PageFaultPhase phase) noexcept;
 class PageManager final {
 public:
 	class BackingWrite final {
@@ -30,21 +27,19 @@ public:
 		uint64_t     m_size  = 0;
 	};
 
-	PageManager(PageFaultHandler fault_handler, void* fault_context);
+	PageManager();
 	// The owner must stop all PageManager callers before destruction.
 	~PageManager();
 
 	KYTY_CLASS_NO_COPY(PageManager);
 
 	[[nodiscard]] uint64_t GetPageSize() const;
-	[[nodiscard]] bool     IsTracked(uint64_t vaddr) const noexcept;
 
 	void UpdatePageWatchers(bool track, uint64_t vaddr, uint64_t size,
 	                        PageWatchMode mode = PageWatchMode::Write);
 	void OnGpuMap(uint64_t vaddr, uint64_t size);
 	void OnGpuUnmap(uint64_t vaddr, uint64_t size);
 
-	[[nodiscard]] bool HandleFault(PageFaultAccess access, uint64_t fault_vaddr) noexcept;
 	[[nodiscard]] std::vector<std::unique_ptr<BackingWrite>>
 	ReserveBackingWrites(std::span<const RangeSet::Range> ranges);
 

src/graphics/host_gpu/regionManager.h

@@ -25,8 +25,6 @@
 
 namespace Libs::Graphics {
 
-enum class CpuFaultAction { Untracked, Continue, Download };
-
 class TrackingSpinLock final {
 public:
 	void lock() noexcept {
@@ -85,18 +83,6 @@ public:
 	KYTY_CLASS_NO_COPY(RegionManager);
 
 	[[nodiscard]] uint64_t GetCpuAddr() const { return m_cpu_addr; }
-	void                   Track(uint64_t vaddr, uint64_t size) {
-		const auto [start, end] = GetPageRange(vaddr, size);
-		for (auto page = start; page < end; page++) {
-			m_tracked.set(page);
-		}
-	}
-	void Untrack(uint64_t vaddr, uint64_t size) {
-		const auto [start, end] = GetPageRange(vaddr, size);
-		for (auto page = start; page < end; page++) {
-			m_tracked.reset(page);
-		}
-	}
 	template <DirtySource source>
 	[[nodiscard]] bool IsModified(uint64_t offset, uint64_t size) const {
 		const auto [start, end] = GetPageRange(m_cpu_addr + offset, size);
@@ -126,15 +112,15 @@ public:
 		const auto [start, end] = GetPageRange(vaddr, size);
 		if constexpr (source == DirtySource::Cpu && enable) {
 			for (auto page = start; page < end; page++) {
-				if (m_gpu_dirty.test(page) || m_fault_pending.test(page)) {
-					EXIT("CPU dirty state conflicts with GPU dirty or pending fault state\n");
+				if (m_gpu_dirty.test(page)) {
+					EXIT("CPU dirty state conflicts with GPU dirty state\n");
 				}
 			}
 		}
 		if constexpr (source == DirtySource::Gpu && enable) {
 			for (auto page = start; page < end; page++) {
-				if (m_cpu_dirty.test(page) || m_fault_pending.test(page)) {
-					EXIT("GPU dirty state conflicts with CPU dirty or pending fault state\n");
+				if (m_cpu_dirty.test(page)) {
+					EXIT("GPU dirty state conflicts with CPU dirty state\n");
 				}
 			}
 		}
@@ -151,110 +137,10 @@ public:
 		return changed;
 	}
 
-	[[nodiscard]] CpuFaultAction BeginCpuFault(uint64_t vaddr, uint64_t size,
-	                                           PageFaultAccess access = PageFaultAccess::Write) {
-		if (access != PageFaultAccess::Read && access != PageFaultAccess::Write) {
-			EXIT("unsupported CPU fault access while beginning ownership transfer\n");
-		}
-		const auto [start, end] = GetPageRange(vaddr, size);
-		const bool tracked      = m_tracked.test(start);
-		for (auto page = start; page < end; page++) {
-			if (m_tracked.test(page) != tracked) {
-				EXIT("CPU fault spans mixed tracked and untracked pages\n");
-			}
-			if (m_fault_pending.test(page)) {
-				return CpuFaultAction::Untracked;
-			}
-			if (m_cpu_dirty.test(page) != m_writable.test(page) ||
-			    (m_gpu_dirty.test(page) && (m_cpu_dirty.test(page) || m_writable.test(page)))) {
-				EXIT("inconsistent CPU fault page state\n");
-			}
-		}
-		if (!tracked) {
-			return CpuFaultAction::Untracked;
-		}
-		bool gpu_dirty = m_gpu_dirty.test(start);
-		bool writable  = m_writable.test(start);
-		for (auto page = start + 1; page < end; page++) {
-			if (m_gpu_dirty.test(page) != gpu_dirty || m_writable.test(page) != writable) {
-				EXIT("CPU fault spans pages with incompatible dirty or writable state\n");
-			}
-		}
-		for (auto page = start; page < end; page++) {
-			if (!gpu_dirty && access == PageFaultAccess::Write) {
-				m_cpu_dirty.set(page);
-				m_writable.set(page);
-			}
-			m_fault_pending.set(page);
-		}
-		return gpu_dirty ? CpuFaultAction::Download : CpuFaultAction::Continue;
-	}
-
-	[[nodiscard]] bool CompleteCpuFault(uint64_t vaddr, uint64_t size, PageFaultAccess access,
-	                                    bool downloaded) {
-		const auto [start, end] = GetPageRange(vaddr, size);
-		for (auto page = start; page < end; page++) {
-			if (!m_fault_pending.test(page)) {
-				return false;
-			}
-		}
-		for (auto page = start; page < end; page++) {
-			const bool gpu_dirty = m_gpu_dirty.test(page);
-			if (gpu_dirty != downloaded) {
-				EXIT("CPU fault download result disagrees with GPU dirty state\n");
-			}
-			if (gpu_dirty) {
-				m_gpu_dirty.reset(page);
-				switch (access) {
-					case PageFaultAccess::Read: break;
-					case PageFaultAccess::Write:
-						m_cpu_dirty.set(page);
-						m_writable.set(page);
-						break;
-					default: EXIT("unsupported CPU fault access after GPU download\n");
-				}
-			}
-			m_fault_pending.reset(page);
-		}
-		return true;
-	}
-
-	[[nodiscard]] bool HasPendingFault(uint64_t vaddr, uint64_t size) const {
-		const auto [start, end] = GetPageRange(vaddr, size);
-		for (auto page = start; page < end; page++) {
-			if (m_fault_pending.test(page)) {
-				return true;
-			}
-		}
-		return false;
-	}
-
-	[[nodiscard]] bool CompleteVirtualGpuWrite(uint64_t vaddr, uint64_t size) {
-		const auto [start, end] = GetPageRange(vaddr, size);
-		for (auto page = start; page < end; page++) {
-			if (!m_fault_pending.test(page)) {
-				return false;
-			}
-			if (!m_gpu_dirty.test(page)) {
-				EXIT("virtual GPU write completion found a non-GPU-dirty page\n");
-			}
-		}
-		for (auto page = start; page < end; page++) {
-			m_gpu_dirty.reset(page);
-			m_cpu_dirty.set(page);
-			m_writable.set(page);
-			m_fault_pending.reset(page);
-		}
-		return true;
-	}
-
 	template <DirtySource source, bool clear, typename Func>
 	RegionBits ForEachModifiedRange(uint64_t vaddr, uint64_t size, Func&& func) {
 		const auto [start, end] = GetPageRange(vaddr, size);
 		auto mask               = GetBits<source>();
-		if constexpr (source == DirtySource::Cpu) {
-			mask &= ~m_fault_pending;
-		}
 		for (auto page = 0u; page < start; page++) {
 			mask.reset(page);
 		}
@@ -351,8 +237,6 @@ private:
 	RegionBits   m_cpu_dirty;
 	RegionBits   m_gpu_dirty;
 	RegionBits   m_writable;
-	RegionBits   m_fault_pending;
-	RegionBits   m_tracked;
 };
 
 } // namespace Libs::Graphics

src/graphics/host_gpu/renderer/cache/bufferCache.cpp

@@ -123,24 +123,6 @@ struct BufferCache::RetiredBuffer {
 	std::shared_ptr<Buffer> owner;
 };
 
-struct BufferCache::FaultReadback {
-	PageFaultAccess            access = PageFaultAccess::Unknown;
-	uint64_t                   vaddr  = 0;
-	uint64_t                   size   = 0;
-	std::vector<DownloadRange> ranges;
-	bool                       installed = false;
-
-	[[nodiscard]] bool Active() const noexcept { return !ranges.empty(); }
-
-	void Reset() {
-		access    = PageFaultAccess::Unknown;
-		vaddr     = 0;
-		size      = 0;
-		installed = false;
-		ranges.clear();
-	}
-};
-
 struct BufferCache::PendingBackingPublication {
 	uint64_t address = 0;
 	uint64_t size    = 0;
@@ -253,7 +235,7 @@ BufferCache::BufferCache(GraphicContext& graphics, CommandScheduler& scheduler,
                          ResourceMutex& resource_mutex)
     : m_graphics(graphics), m_scheduler(scheduler),
       m_gds_buffer(graphics, scheduler, MemoryUsage::Stream, 0, AllFlags, GdsBufferSize),
-      m_fault_readback(std::make_unique<FaultReadback>()), m_memory_tracker(page_manager),
+      m_memory_tracker(page_manager),
       m_staging_buffer(graphics, scheduler, MemoryUsage::Upload, 512 * MiB),
       m_stream_buffer(graphics, scheduler, MemoryUsage::Stream, 64 * MiB),
       m_download_buffer(graphics, scheduler, MemoryUsage::Download, 32 * MiB),
@@ -277,9 +259,6 @@ BufferCache::BufferCache(GraphicContext& graphics, CommandScheduler& scheduler,
 }
 
 BufferCache::~BufferCache() {
-	if (m_fault_readback->Active()) {
-		EXIT("BufferCache: destroyed with an active fault readback\n");
-	}
 	if (!m_gpu_modified_ranges.Empty()) {
 		EXIT("BufferCache: destroyed with pending GPU-modified ranges\n");
 	}
@@ -447,93 +426,6 @@ void BufferCache::ReadMemory(uint64_t vaddr, uint64_t size) {
 	}
 }
 
-bool BufferCache::InvalidateMemory(PageFaultAccess access, uint64_t vaddr, uint64_t size,
-                                   PageFaultPhase phase) noexcept {
-	const auto page = vaddr & ~(TRACKER_PAGE_SIZE - 1);
-	if (size == 0 || size > page + TRACKER_PAGE_SIZE - vaddr) {
-		EXIT("BufferCache: invalid page-fault range\n");
-	}
-
-	if (phase == PageFaultPhase::Complete) {
-		FaultSafeCacheLock lock(this, m_mutex);
-		auto&              fault = *m_fault_readback;
-		if (!fault.Active()) {
-			return m_memory_tracker.CompleteCpuFault(vaddr, size, access, false);
-		}
-		if (fault.access != access || fault.vaddr != vaddr || fault.size != size ||
-		    fault.installed) {
-			EXIT("BufferCache: mismatched fault readback completion\n");
-		}
-		PublishDownloads(fault.ranges);
-		if (!m_memory_tracker.CompleteCpuFault(vaddr, size, access, true)) {
-			EXIT("BufferCache: failed to complete downloaded CPU fault\n");
-		}
-		fault.installed = true;
-		return true;
-	}
-
-	if (phase == PageFaultPhase::Release) {
-		FaultSafeCacheLock lock(this, m_mutex);
-		auto&              fault = *m_fault_readback;
-		if (fault.Active()) {
-			if (fault.access != access || fault.vaddr != vaddr || fault.size != size ||
-			    !fault.installed) {
-				EXIT("BufferCache: mismatched fault readback release\n");
-			}
-			for (const auto& range: fault.ranges) {
-				m_gpu_modified_ranges.Subtract(range.address, range.size);
-			}
-			fault.Reset();
-		}
-		return true;
-	}
-
-	if (phase != PageFaultPhase::Invalidate) {
-		EXIT("BufferCache: unsupported page-fault phase\n");
-	}
-
-	const auto action = m_memory_tracker.BeginCpuFault(vaddr, size, access);
-	if (action != CpuFaultAction::Download) {
-		return action == CpuFaultAction::Continue;
-	}
-
-	auto&                     fault = *m_fault_readback;
-	std::vector<DownloadCopy> copies;
-	{
-		FaultSafeCacheLock lock(this, m_mutex);
-		if (fault.Active()) {
-			EXIT("BufferCache: nested fault readback\n");
-		}
-		fault.access = access;
-		fault.vaddr  = vaddr;
-		fault.size   = size;
-
-		m_gpu_modified_ranges.ForEachIntersection(
-		    page, TRACKER_PAGE_SIZE, [&](RangeSet::Range range) {
-			    auto owner = m_buffers.upper_bound(range.address);
-			    if (owner == m_buffers.begin()) {
-				    EXIT("BufferCache: fault readback has no buffer owner\n");
-			    }
-			    --owner;
-			    auto& cached = *owner->second;
-			    if (!cached.buffer->IsInBounds(range.address, range.size)) {
-				    EXIT("BufferCache: fault readback is outside its buffer owner\n");
-			    }
-			    copies.push_back({cached.buffer, cached.buffer->Offset(range.address),
-			                      range.address, range.size});
-		    });
-		if (copies.empty()) {
-			EXIT("BufferCache: GPU-dirty fault page has no dirty byte ranges\n");
-		}
-	}
-	fault.ranges = RecordDownloads(copies);
-	if (!fault.Active()) {
-		EXIT("BufferCache: GPU-dirty fault page has no dirty byte ranges\n");
-	}
-	m_scheduler.FinishCurrent();
-	return true;
-}
-
 void BufferCache::UnmapMemory(uint64_t vaddr, uint64_t size) {
 	if (vaddr == 0 || size == 0 || size > UINT64_MAX - vaddr) {
 		EXIT("BufferCache: invalid unmap range\n");
@@ -1201,7 +1093,7 @@ void BufferCache::RunGarbageCollector() {
 	if (m_graphics.CanReportMemoryUsage()) {
 		m_total_used_memory = m_graphics.GetDeviceMemoryUsage();
 	}
-	if (m_total_used_memory < m_trigger_gc_memory || m_fault_readback->Active()) {
+	if (m_total_used_memory < m_trigger_gc_memory) {
 		return;
 	}
 

src/graphics/host_gpu/renderer/cache/bufferCache.h

@@ -47,11 +47,9 @@ public:
 	~BufferCache();
 	KYTY_CLASS_NO_COPY(BufferCache);
 
-	[[nodiscard]] bool InvalidateMemory(PageFaultAccess access, uint64_t vaddr, uint64_t size,
-	                                    PageFaultPhase phase) noexcept;
-	void               InvalidateMemory(uint64_t vaddr, uint64_t size);
-	void               ReadMemory(uint64_t vaddr, uint64_t size);
-	void               UnmapMemory(uint64_t vaddr, uint64_t size);
+	void                        InvalidateMemory(uint64_t vaddr, uint64_t size);
+	void                        ReadMemory(uint64_t vaddr, uint64_t size);
+	void                        UnmapMemory(uint64_t vaddr, uint64_t size);
 	[[nodiscard]] BufferBinding ObtainBuffer(CommandBuffer& command, uint64_t vaddr, uint64_t size,
 	                                         bool is_written = false, bool is_read = true,
 	                                         bool is_formatted = false);
@@ -90,7 +88,6 @@ private:
 	struct DownloadCopy;
 	struct DownloadRange;
 	struct RetiredBuffer;
-	struct FaultReadback;
 	struct PendingBackingPublication;
 	static constexpr uint64_t               DOWNLOAD_ALIGNMENT = 64;
 	[[nodiscard]] static uint64_t           AlignDown(uint64_t value) noexcept;
@@ -120,7 +117,6 @@ private:
 	Common::Mutex                                     m_mutex;
 	std::shared_ptr<Buffer>                           m_null_buffer;
 	std::map<uint64_t, std::unique_ptr<CachedBuffer>> m_buffers;
-	std::unique_ptr<FaultReadback>                    m_fault_readback;
 	RangeSet                                          m_gpu_modified_ranges;
 	RangeSet                                          m_image_invalidated_ranges;
 	std::mutex                                        m_publication_mutex;

src/graphics/host_gpu/renderer/cache/gpuResourceManager.cpp

@@ -7,33 +7,11 @@
 namespace Libs::Graphics {
 
 GpuResourceManager::GpuResourceManager(GraphicContext& graphics, CommandScheduler& scheduler)
-    : m_page_manager(FaultThunk, this),
-      m_buffer_cache(graphics, scheduler, m_page_manager, m_texture_cache, m_resource_mutex),
+    : m_buffer_cache(graphics, scheduler, m_page_manager, m_texture_cache, m_resource_mutex),
       m_texture_cache(graphics, scheduler, m_page_manager, m_buffer_cache, m_resource_mutex) {}
 
 GpuResourceManager::~GpuResourceManager() = default;
 
-bool GpuResourceManager::FaultThunk(void* context, PageFaultAccess access, uint64_t vaddr,
-                                    uint64_t size, PageFaultPhase phase) noexcept {
-	return static_cast<GpuResourceManager*>(context)->InvalidateMemory(access, vaddr, size, phase);
-}
-
-bool GpuResourceManager::InvalidateMemory(PageFaultAccess access, uint64_t vaddr, uint64_t size,
-                                          PageFaultPhase phase) noexcept {
-	// Let the authoritative image materialize first. A clean overlapping buffer marks a write
-	// fault CPU-dirty when it begins ownership transfer; doing that before image preflight would
-	// make the image appear to race a real CPU write. Completion and release retain buffer-first
-	// ordering so its pending fault is gone before TextureCache publishes the downloaded backing.
-	if (phase == PageFaultPhase::Invalidate) {
-		const bool image_handled  = m_texture_cache.InvalidateMemory(access, vaddr, size, phase);
-		const bool buffer_handled = m_buffer_cache.InvalidateMemory(access, vaddr, size, phase);
-		return buffer_handled || image_handled;
-	}
-	const bool buffer_handled = m_buffer_cache.InvalidateMemory(access, vaddr, size, phase);
-	const bool image_handled  = m_texture_cache.InvalidateMemory(access, vaddr, size, phase);
-	return buffer_handled || image_handled;
-}
-
 bool GpuResourceManager::HandleFault(PageFaultAccess access, uint64_t fault_vaddr) noexcept {
 	constexpr uint64_t fault_size = 8;
 	if (!IsMapped(fault_vaddr, fault_size)) {

src/graphics/host_gpu/renderer/cache/gpuResourceManager.h

@@ -34,11 +34,6 @@ public:
 	void               RunGarbageCollector();
 
 private:
-	static bool FaultThunk(void* context, PageFaultAccess access, uint64_t vaddr, uint64_t size,
-	                       PageFaultPhase phase) noexcept;
-	[[nodiscard]] bool InvalidateMemory(PageFaultAccess access, uint64_t vaddr, uint64_t size,
-	                                    PageFaultPhase phase) noexcept;
-
 	PageManager               m_page_manager;
 	ResourceMutex             m_resource_mutex;
 	BufferCache               m_buffer_cache;

src/graphics/host_gpu/renderer/cache/samplerCache.cpp

@@ -56,7 +56,10 @@ vk::Sampler SamplerCache::GetSampler(const ShaderSamplerResource& r) {
 			case Prospero::SamplerAnisoRatio::kFour: aniso_ratio = 4.0f; break;
 			case Prospero::SamplerAnisoRatio::kEight: aniso_ratio = 8.0f; break;
 			case Prospero::SamplerAnisoRatio::kSixteen: aniso_ratio = 16.0f; break;
-			default: EXIT("unknown ratio: %d\n", static_cast<int>(r.MaxAnisoRatio()));
+			default:
+				EXIT("unknown ratio: %d dwords=%08x,%08x,%08x,%08x\n",
+				     static_cast<int>(r.MaxAnisoRatio()), r.fields[0], r.fields[1], r.fields[2],
+				     r.fields[3]);
 		}
 	}
 

src/graphics/host_gpu/renderer/cache/textureCache.cpp

@@ -1826,37 +1826,6 @@ bool TextureCache::TouchMeta(uint64_t address, uint32_t slice, bool is_clear) {
 	return true;
 }
 
-bool TextureCache::InvalidateMemory(PageFaultAccess access, uint64_t address, uint64_t size,
-                                    PageFaultPhase phase) noexcept {
-	if ((access != PageFaultAccess::Read && access != PageFaultAccess::Write) ||
-	    !GuestRange {address, size}.Valid()) {
-		return false;
-	}
-	if (access == PageFaultAccess::Read) {
-		return false;
-	}
-	if (phase == PageFaultPhase::Invalidate) {
-		CacheLock  lock(*this, m_lock);
-		const bool tracked =
-		    std::ranges::any_of(FindImagesInRegion(address, size, true), [&](ImageId id) {
-			    const auto owner = ResolveOwner(id);
-			    return owner != nullptr && !owner->depth_id && owner->IsTracked();
-		    });
-		if (tracked) {
-			InvalidateCpuAliases(address, size);
-		}
-		return tracked;
-	}
-	if (phase != PageFaultPhase::Complete && phase != PageFaultPhase::Release) {
-		return false;
-	}
-	CacheLock lock(*this, m_lock);
-	return std::ranges::any_of(FindImagesInRegion(address, size, true), [&](ImageId id) {
-		const auto owner = ResolveOwner(id);
-		return owner != nullptr && !owner->depth_id;
-	});
-}
-
 void TextureCache::UnmapMemory(uint64_t address, uint64_t size) {
 	if (!GuestRange {address, size}.Valid()) {
 		EXIT("TextureCache: invalid unmap range\n");

src/graphics/host_gpu/renderer/cache/textureCache.h

@@ -76,11 +76,9 @@ public:
 	[[nodiscard]] bool ClearMeta(uint64_t address);
 	[[nodiscard]] bool TouchMeta(uint64_t address, uint32_t slice, bool is_clear);
 
-	[[nodiscard]] bool InvalidateMemory(PageFaultAccess access, uint64_t address, uint64_t size,
-	                                    PageFaultPhase phase) noexcept;
-	void               UnmapMemory(uint64_t address, uint64_t size);
-	void               ProcessDownloadImages();
-	void               RunGarbageCollector();
+	void UnmapMemory(uint64_t address, uint64_t size);
+	void ProcessDownloadImages();
+	void RunGarbageCollector();
 
 private:
 	enum class TransferDirection { Upload, Download };

src/graphics/host_gpu/renderer/debug.cpp

@@ -497,7 +497,15 @@ static void ZPrint(const char* func, const HW::DepthRenderTarget& z) {
 }
 
 // NOLINTNEXTLINE(readability-function-cognitive-complexity)
-static void ZCheck(const HW::DepthRenderTarget& z) {
+static void ZCheck(const HW::DepthRenderTarget& z, const HW::DepthControl& dc,
+                   const HW::RenderControl& rc) {
+	const bool depth_active =
+	    dc.z_enable || dc.z_write_enable || dc.depth_bounds_enable || rc.depth_clear_enable;
+	const bool stencil_active = dc.stencil_enable || rc.stencil_clear_enable;
+	if (!depth_active && !stencil_active) {
+		return;
+	}
+
 	EXIT_NOT_IMPLEMENTED(!z.z_info.HasValidTextureCompatibility());
 	EXIT_NOT_IMPLEMENTED(!z.stencil_info.HasValidTextureCompatibility());
 	if (z.z_info.format == 0) {
@@ -1206,7 +1214,7 @@ void hw_check(const RenderCommandBuffer& buffer) {
 	log_phase("vp");
 	VpCheck(vp, smc);
 	log_phase("z");
-	ZCheck(z);
+	ZCheck(z, d, rc);
 	log_phase("clip");
 	ClipCheck(c);
 	log_phase("rc");

src/graphics/host_gpu/renderer/image/textureCommon.cpp

@@ -70,6 +70,10 @@ constexpr RenderTargetFormatMapping kRenderTargetFormats[] = {
      Prospero::ChannelType::kFloat,
      Prospero::ChannelOrder::kStandard,
      {vk::Format::eB10G11R11UfloatPack32, 4}},
+    {Prospero::ChannelLayout::k5_6_5,
+     Prospero::ChannelType::kUNorm,
+     Prospero::ChannelOrder::kStandard,
+     {vk::Format::eB5G6R5UnormPack16, 2}},
     {Prospero::ChannelLayout::k16,
      Prospero::ChannelType::kUNorm,
      Prospero::ChannelOrder::kStandard,

src/graphics/host_gpu/renderer/pipeline/descriptors.cpp

@@ -270,7 +270,7 @@ bool IsSupportedDepthTargetDescriptor(const ShaderTextureResource& descriptor, c
 	        supported_msaa_array) &&
 	       levels_ok && descriptor.MinLod() == 0 &&
 	       descriptor.TileMode() == Prospero::GpuEnumValue(Prospero::TileMode::kDepth) &&
-	       descriptor.BCSwizzle() == 0 && descriptor.MsaaDepth() == multisampled &&
+	       descriptor.BCSwizzle() == 0 && (!descriptor.MsaaDepth() || multisampled) &&
 	       pitch >= width && pitch == image.info.pitch;
 }
 
@@ -424,10 +424,14 @@ void ValidateStorageTexture(const ShaderRecompiler::IR::ImageResource& resource,
 	const bool encoding_ok   = IsSupportedStorageTextureEncoding(descriptor);
 	const bool uint_resource =
 	    resource.kind == ShaderRecompiler::IR::ResourceKind::StorageImageUint;
+	const bool raw_sint_storage =
+	    format == Prospero::GpuEnumValue(Prospero::BufferFormat::k32SInt) && uint_resource &&
+	    resource.written && !resource.read && !resource.atomic;
 	const bool format_ok =
-	    Prospero::IsSupportedTextureFormat(format) &&
-	    uint_resource == Prospero::IsUintTextureFormat(format) &&
-	    (!resource.atomic || format == Prospero::GpuEnumValue(Prospero::BufferFormat::k32UInt));
+	    raw_sint_storage ||
+	    (Prospero::IsSupportedTextureFormat(format) &&
+	     uint_resource == Prospero::IsUintTextureFormat(format) &&
+	     (!resource.atomic || format == Prospero::GpuEnumValue(Prospero::BufferFormat::k32UInt)));
 	if (resource_ok && descriptor_ok && encoding_ok && format_ok && size != 0) {
 		return;
 	}
@@ -614,17 +618,23 @@ RenderExecutor::ResolveTexture(const ShaderRecompiler::IR::ImageResource&   reso
 	const bool multisampled = IsMultisampledTexture(type);
 	const auto levels       = multisampled ? 1u : static_cast<uint32_t>(descriptor.MaxMip()) + 1u;
 	const auto tile         = descriptor.TileMode();
+	const bool depth_tile = tile == Prospero::GpuEnumValue(Prospero::TileMode::kDepth);
 	const bool msaa_tile =
-	    tile == Prospero::GpuEnumValue(descriptor.MsaaDepth() ? Prospero::TileMode::kDepth
-	                                                          : Prospero::TileMode::kRenderTarget);
+	    depth_tile || tile == Prospero::GpuEnumValue(Prospero::TileMode::kRenderTarget);
 	const bool msaa_array = type == Prospero::ImageType::kColor2DMsaaArray;
 	if ((!multisampled && (base_level > last_level || last_level >= levels)) ||
 	    (multisampled &&
 	     (base_level != 0 || last_level == 0 || last_level > 3 ||
-	      descriptor.MaxMip() != last_level || !msaa_tile ||
+	      descriptor.MaxMip() != last_level || !msaa_tile || (descriptor.MsaaDepth() && !depth_tile) ||
 	      (!msaa_array && (descriptor.Depth() != 0 || descriptor.BaseArray5() != 0))))) {
-		EXIT("unsupported texture mip view: base=%u last=%u levels=%u\n", base_level, last_level,
-		     levels);
+		EXIT("unsupported texture mip view: base=%u last=%u levels=%u max=%u type=%u tile=%u "
+		     "kind=%u dimension=%u mip_mode=%u read=%d written=%d "
+		     "dwords=%08x,%08x,%08x,%08x,%08x,%08x,%08x,%08x\n",
+		     base_level, last_level, levels, descriptor.MaxMip(), descriptor.Type(), tile,
+		     static_cast<uint32_t>(resource.kind), static_cast<uint32_t>(resource.dimension),
+		     static_cast<uint32_t>(resource.mip_mode), resource.read, resource.written,
+		     descriptor.fields[0], descriptor.fields[1], descriptor.fields[2], descriptor.fields[3],
+		     descriptor.fields[4], descriptor.fields[5], descriptor.fields[6], descriptor.fields[7]);
 	}
 	const auto samples = multisampled ? 1u << last_level : 1u;
 	const auto view_levels =
@@ -651,7 +661,8 @@ RenderExecutor::ResolveTexture(const ShaderRecompiler::IR::ImageResource&   reso
 	TileSizeAlign size {};
 	if (multisampled) {
 		const auto bytes = Prospero::NumBytesPerElement(format);
-		pitch            = TileGetRenderTargetPitch(width, bytes, last_level);
+		pitch = depth_tile ? TileGetDepthPitch(width, bytes, last_level)
+		                   : TileGetRenderTargetPitch(width, bytes, last_level);
 		if (pitch == 0 || !TileGetRenderTargetSize(width, height, pitch, bytes, size, last_level) ||
 		    size.size > UINT32_MAX / image_layers) {
 			EXIT("unsupported multisample texture layout\n");
@@ -668,8 +679,11 @@ RenderExecutor::ResolveTexture(const ShaderRecompiler::IR::ImageResource&   reso
 		ValidateStorageTexture(resource, descriptor, size.size);
 	}
 
-	const auto              pixel_format        = TextureGetFormat(format);
-	const auto              storage_view_format = SrgbStorageViewFormat(pixel_format);
+	const auto              pixel_format = TextureGetFormat(format);
+	const auto              storage_view_format =
+	    storage && format == Prospero::GpuEnumValue(Prospero::BufferFormat::k32SInt)
+	        ? vk::Format::eR32Uint
+	        : SrgbStorageViewFormat(pixel_format);
 	const auto              view_format = storage && storage_view_format != vk::Format::eUndefined
 	                                          ? storage_view_format
 	                                          : pixel_format;

src/graphics/host_gpu/vulkanCommon.cpp

@@ -37,6 +37,7 @@ constexpr FormatMapping kFormatMappings[] = {
     {Prospero::BufferFormat::k16_16Float, vk::Format::eR16G16Sfloat},
     {Prospero::BufferFormat::k11_11_10Float, vk::Format::eB10G11R11UfloatPack32},
     {Prospero::BufferFormat::k10_10_10_2UNorm, vk::Format::eA2B10G10R10UnormPack32},
+    {Prospero::BufferFormat::k10_10_10_2UInt, vk::Format::eA2B10G10R10UintPack32},
     {Prospero::BufferFormat::k8_8_8_8UNorm, vk::Format::eR8G8B8A8Unorm},
     {Prospero::BufferFormat::k8_8_8_8SNorm, vk::Format::eR8G8B8A8Snorm},
     {Prospero::BufferFormat::k8_8_8_8UInt, vk::Format::eR8G8B8A8Uint},

src/graphics/shader/recompiler/cfg/ShaderCFG.cpp

@@ -871,19 +871,19 @@ std::vector<uint32_t> DominatedBlocks(const Graph& graph, uint32_t header,
 	return blocks;
 }
 
-uint32_t AppendSyntheticMergeBlock(Graph& graph, uint32_t old_merge) {
-	const auto* merge = graph.FindBlock(old_merge);
+uint32_t AppendSyntheticBranchBlock(Graph& graph, uint32_t target) {
+	const auto* target_block = graph.FindBlock(target);
 
 	BasicBlock block;
 	block.id                    = static_cast<uint32_t>(graph.blocks.size());
-	block.start_pc              = merge != nullptr ? merge->start_pc : 0u;
+	block.start_pc              = target_block != nullptr ? target_block->start_pc : 0u;
 	block.end_pc                = block.start_pc;
-	block.inst_begin            = merge != nullptr ? merge->inst_begin : 0u;
+	block.inst_begin            = target_block != nullptr ? target_block->inst_begin : 0u;
 	block.inst_end              = block.inst_begin;
-	block.successors            = {old_merge};
+	block.successors            = {target};
 	block.terminator.kind       = TerminatorKind::Branch;
 	block.terminator.condition  = BranchCondition::Always;
-	block.terminator.true_block = old_merge;
+	block.terminator.true_block = target;
 	graph.blocks.push_back(std::move(block));
 	return graph.blocks.back().id;
 }
@@ -897,15 +897,50 @@ bool IsSyntheticMergeForwarder(const Graph& graph, uint32_t block_id, uint32_t m
 	       block->terminator.true_block == merge;
 }
 
-bool IsInsideLoopConstruct(const Graph& graph, const NaturalLoop& loop, uint32_t block_id) {
-	return block_id != UINT32_MAX && block_id != loop.merge && block_id != loop.continue_block &&
-	       graph.Dominates(loop.header, block_id) &&
-	       (loop.merge == UINT32_MAX || !graph.Dominates(loop.merge, block_id));
+const NaturalLoop* FindInnermostContainingLoop(const Graph& graph, uint32_t block_id) {
+	const NaturalLoop* innermost = nullptr;
+	for (const auto& loop: graph.natural_loops) {
+		if (Contains(loop.body_blocks, block_id) &&
+		    (innermost == nullptr || loop.body_blocks.size() < innermost->body_blocks.size())) {
+			innermost = &loop;
+		}
+	}
+	return innermost;
 }
 
-bool SelectionMergeLeavesContainingLoop(const Graph& graph, uint32_t header, uint32_t merge) {
+bool IsInsideLoopConstruct(const Graph& graph, const NaturalLoop& loop, uint32_t block_id) {
+	return block_id != UINT32_MAX && block_id != loop.merge && block_id != loop.continue_block &&
+	       graph.Dominates(loop.header, block_id) && !graph.Dominates(loop.merge, block_id);
+}
+
+bool IsInnermostLoopControlConditional(const Graph& graph, const BasicBlock& block) {
+	if (block.terminator.kind != TerminatorKind::ConditionalBranch) {
+		return false;
+	}
+	const auto* loop = FindInnermostContainingLoop(graph, block.id);
+	if (loop == nullptr || loop->merge == UINT32_MAX || loop->continue_block == UINT32_MAX) {
+		return false;
+	}
+	const auto true_target  = block.terminator.true_block;
+	const auto false_target = block.terminator.false_block;
+	if (block.id == loop->continue_block) {
+		const auto is_repeat_target = [&](uint32_t target) {
+			return target == loop->header || target == loop->merge;
+		};
+		return is_repeat_target(true_target) && is_repeat_target(false_target);
+	}
+	const auto is_control_target = [&](uint32_t target) {
+		return target == loop->merge || target == loop->continue_block;
+	};
+	return (is_control_target(true_target) &&
+	        (is_control_target(false_target) ||
+	         IsInsideLoopConstruct(graph, *loop, false_target))) ||
+	       (is_control_target(false_target) && IsInsideLoopConstruct(graph, *loop, true_target));
+}
+
+bool MergeLeavesContainingLoop(const Graph& graph, uint32_t header, uint32_t merge) {
 	for (const auto& loop: graph.natural_loops) {
-		if (IsInsideLoopConstruct(graph, loop, header) &&
+		if (loop.header != header && IsInsideLoopConstruct(graph, loop, header) &&
 		    !IsInsideLoopConstruct(graph, loop, merge)) {
 			return true;
 		}
@@ -913,6 +948,80 @@ bool SelectionMergeLeavesContainingLoop(const Graph& graph, uint32_t header, uin
 	return false;
 }
 
+bool CanonicalizeNaturalLoops(Graph& graph, std::string* error) {
+	const auto rewrite_budget = graph.blocks.size() * 2u + 16u;
+	for (size_t rewrite = 0; rewrite < rewrite_budget; rewrite++) {
+		bool changed = false;
+		for (const auto& loop: graph.natural_loops) {
+			std::vector<uint32_t> latches;
+			for (const auto& edge: graph.back_edges) {
+				if (edge.to == loop.header) {
+					AddUnique(latches, edge.from);
+				}
+			}
+			if (latches.size() <= 1u) {
+				continue;
+			}
+
+			const auto continue_block = AppendSyntheticBranchBlock(graph, loop.header);
+			for (auto latch: latches) {
+				auto* block = graph.FindBlock(latch);
+				if (block != nullptr) {
+					ReplaceValue(block->successors, loop.header, continue_block);
+					ReplaceTerminatorTarget(block->terminator, loop.header, continue_block);
+				}
+			}
+			RebuildPredecessors(graph);
+			RecomputeAnalyses(graph);
+			changed = true;
+			break;
+		}
+		if (changed) {
+			continue;
+		}
+
+		for (const auto& loop: graph.natural_loops) {
+			const auto* header                 = graph.FindBlock(loop.header);
+			const auto  is_loop_control_target = [&](uint32_t target) {
+				return target == loop.merge || target == loop.continue_block;
+			};
+			if (header == nullptr || header->terminator.kind != TerminatorKind::ConditionalBranch ||
+			    is_loop_control_target(header->terminator.true_block) ||
+			    is_loop_control_target(header->terminator.false_block) ||
+			    !Contains(loop.body_blocks, header->terminator.true_block) ||
+			    !Contains(loop.body_blocks, header->terminator.false_block)) {
+				continue;
+			}
+
+			const auto old_header   = loop.header;
+			const auto predecessors = header->predecessors;
+			const auto new_header   = AppendSyntheticBranchBlock(graph, old_header);
+			for (auto pred: predecessors) {
+				auto* block = graph.FindBlock(pred);
+				if (block != nullptr) {
+					ReplaceValue(block->successors, old_header, new_header);
+					ReplaceTerminatorTarget(block->terminator, old_header, new_header);
+				}
+			}
+			if (graph.entry_block == old_header) {
+				graph.entry_block = new_header;
+			}
+			MoveBlockBefore(graph, new_header, old_header);
+			RebuildPredecessors(graph);
+			RecomputeAnalyses(graph);
+			changed = true;
+			break;
+		}
+		if (!changed) {
+			return true;
+		}
+	}
+
+	SetFailure(graph, FailureKind::StructuredControlFlow, graph.entry_block,
+	           "CFG loop canonicalization exceeded rewrite budget", error);
+	return false;
+}
+
 bool SplitSharedMergeBlock(Graph& graph, uint32_t merge,
                            const std::vector<uint32_t>& construct_blocks,
                            bool                         force_split = false) {
@@ -948,7 +1057,7 @@ bool SplitSharedMergeBlock(Graph& graph, uint32_t merge,
 		return false;
 	}
 
-	const auto synthetic_merge = AppendSyntheticMergeBlock(graph, merge);
+	const auto synthetic_merge = AppendSyntheticBranchBlock(graph, merge);
 	auto*      synthetic_block = graph.FindBlock(synthetic_merge);
 	if (synthetic_block != nullptr) {
 		synthetic_block->predecessors = predecessors_to_split;
@@ -980,14 +1089,111 @@ bool SplitSharedMergeBlock(Graph& graph, uint32_t merge,
 bool SplitOneLoopMerge(Graph& graph) {
 	const auto& loops = graph.natural_loops;
 	for (const auto& loop: loops) {
-		if (SplitSharedMergeBlock(graph, loop.merge, loop.body_blocks)) {
+		const auto construct_blocks = DominatedBlocks(graph, loop.header, loop.merge);
+		const auto force_split      = MergeLeavesContainingLoop(graph, loop.header, loop.merge);
+		if (SplitSharedMergeBlock(graph, loop.merge, construct_blocks, force_split)) {
 			return true;
 		}
 	}
 	return false;
 }
 
-bool SplitOneSelectionMerge(Graph& graph) {
+std::vector<uint32_t> SelectionRegion(const Graph& graph, const BasicBlock& header,
+                                      uint32_t merge) {
+	std::vector<uint32_t> region;
+	std::vector<uint32_t> pending = {header.terminator.true_block,
+	                                 header.terminator.false_block};
+	while (!pending.empty()) {
+		const auto block_id = pending.back();
+		pending.pop_back();
+		if (block_id == merge || Contains(region, block_id)) {
+			continue;
+		}
+		const auto* block = graph.FindBlock(block_id);
+		if (block == nullptr) {
+			continue;
+		}
+		AddUnique(region, block_id);
+		pending.insert(pending.end(), block->successors.begin(), block->successors.end());
+	}
+	SortUnique(region);
+	return region;
+}
+
+bool DuplicateSelectionRegion(Graph& graph, uint32_t header_id, uint32_t merge,
+                              const std::vector<uint32_t>& region, uint32_t block_budget) {
+	std::vector<uint32_t> cloned_blocks;
+	for (auto block_id: region) {
+		if (!graph.Dominates(header_id, block_id)) {
+			cloned_blocks.push_back(block_id);
+		}
+	}
+	if (cloned_blocks.empty() || graph.FindBlock(header_id) == nullptr || header_id >= merge ||
+	    graph.blocks.size() + cloned_blocks.size() + 1u > block_budget) {
+		return false;
+	}
+
+	const auto first_clone = static_cast<uint32_t>(graph.blocks.size());
+	std::map<uint32_t, uint32_t> clones;
+	for (uint32_t i = 0; i < cloned_blocks.size(); i++) {
+		clones.emplace(cloned_blocks[i], first_clone + i);
+	}
+
+	for (auto block_id: cloned_blocks) {
+		BasicBlock clone = *graph.FindBlock(block_id);
+		clone.id         = clones.at(block_id);
+		clone.predecessors.clear();
+		clone.dominators.clear();
+		clone.post_dominators.clear();
+		graph.blocks.push_back(std::move(clone));
+	}
+
+	const auto remap_block = [&](BasicBlock& block) {
+		const auto remap_target = [&](uint32_t& target) {
+			if (const auto it = clones.find(target); it != clones.end()) {
+				target = it->second;
+			}
+		};
+		for (auto& successor: block.successors) {
+			remap_target(successor);
+		}
+		remap_target(block.terminator.true_block);
+		remap_target(block.terminator.false_block);
+		remap_target(block.terminator.merge_block);
+		remap_target(block.terminator.continue_block);
+		for (auto& target: block.terminator.indirect_targets) {
+			remap_target(target);
+		}
+	};
+	for (auto block_id: region) {
+		const auto owned_id = clones.contains(block_id) ? clones.at(block_id) : block_id;
+		remap_block(*graph.FindBlock(owned_id));
+	}
+
+	const auto private_merge = AppendSyntheticBranchBlock(graph, merge);
+	auto&      header        = *graph.FindBlock(header_id);
+	remap_block(header);
+
+	for (auto block_id: region) {
+		const auto owned_id = clones.contains(block_id) ? clones.at(block_id) : block_id;
+		auto*      block    = graph.FindBlock(owned_id);
+		if (block != nullptr) {
+			ReplaceValue(block->successors, merge, private_merge);
+			ReplaceTerminatorTarget(block->terminator, merge, private_merge);
+		}
+	}
+	ReplaceValue(header.successors, merge, private_merge);
+	ReplaceTerminatorTarget(header.terminator, merge, private_merge);
+
+	for (uint32_t i = 0; i <= cloned_blocks.size(); i++) {
+		MoveBlockBefore(graph, first_clone + i, merge + i);
+	}
+	RebuildPredecessors(graph);
+	RecomputeAnalyses(graph);
+	return true;
+}
+
+bool SplitOneSelectionMerge(Graph& graph, uint32_t block_budget) {
 	std::vector<uint32_t> loop_headers;
 	loop_headers.reserve(graph.natural_loops.size());
 	for (const auto& loop: graph.natural_loops) {
@@ -1001,11 +1207,26 @@ bool SplitOneSelectionMerge(Graph& graph) {
 		    Contains(loop_headers, block_id)) {
 			continue;
 		}
+		if (IsInnermostLoopControlConditional(graph, *block)) {
+			continue;
+		}
 
 		const auto merge = graph.FindNearestCommonPostDominator(block->terminator.true_block,
 		                                                        block->terminator.false_block);
+		if (merge == UINT32_MAX || graph.FindBlock(merge) == nullptr) {
+			continue;
+		}
+		const auto region = SelectionRegion(graph, *block, merge);
+		if (std::any_of(region.begin(), region.end(),
+		                [&](uint32_t member) { return !graph.Dominates(block_id, member); })) {
+			if (graph.natural_loops.empty() &&
+			    DuplicateSelectionRegion(graph, block_id, merge, region, block_budget)) {
+				return true;
+			}
+			continue;
+		}
 		const auto construct_blocks = DominatedBlocks(graph, block_id, merge);
-		const auto force_split      = SelectionMergeLeavesContainingLoop(graph, block_id, merge);
+		const auto force_split      = MergeLeavesContainingLoop(graph, block_id, merge);
 		if (SplitSharedMergeBlock(graph, merge, construct_blocks, force_split)) {
 			return true;
 		}
@@ -1015,10 +1236,12 @@ bool SplitOneSelectionMerge(Graph& graph) {
 
 bool SplitSharedMergeBlocks(Graph& graph, std::string* error) {
 	const auto original_block_count = static_cast<uint32_t>(graph.blocks.size());
-	const auto split_budget =
-	    std::max<uint32_t>(16u, std::min<uint32_t>(128u, original_block_count));
+	const auto split_budget = std::max<uint32_t>(
+	    16u, std::min<uint32_t>(128u, original_block_count * 4u));
+	const auto block_budget = std::max<uint32_t>(
+	    32u, std::min<uint32_t>(512u, original_block_count * 8u));
 	for (uint32_t splits = 0; splits < split_budget; splits++) {
-		if (!SplitOneLoopMerge(graph) && !SplitOneSelectionMerge(graph)) {
+		if (!SplitOneLoopMerge(graph) && !SplitOneSelectionMerge(graph, block_budget)) {
 			return true;
 		}
 		RebuildPredecessors(graph);
@@ -1353,6 +1576,9 @@ bool Structurize(Graph& graph, std::string* error) {
 		return false;
 	}
 
+	if (!CanonicalizeNaturalLoops(graph, error)) {
+		return false;
+	}
 	if (!SplitSharedMergeBlocks(graph, error)) {
 		return false;
 	}
@@ -1395,6 +1621,9 @@ bool Structurize(Graph& graph, std::string* error) {
 		    block.terminator.loop_header) {
 			continue;
 		}
+		if (IsInnermostLoopControlConditional(graph, block)) {
+			continue;
+		}
 
 		const auto merge = graph.FindNearestCommonPostDominator(block.terminator.true_block,
 		                                                        block.terminator.false_block);

src/graphics/shader/recompiler/ir/ResourceMaterialization.cpp

@@ -47,8 +47,9 @@ bool NullImageDescriptor(const DescriptorValue& descriptor) {
 }
 
 bool ValidImageDescriptor(const DescriptorValue& descriptor) {
-	const auto type = static_cast<Prospero::ImageType>((descriptor.dwords[3] >> 28u) & 0xfu);
-	if (type < Prospero::ImageType::kColor1D) {
+	const auto type   = static_cast<Prospero::ImageType>((descriptor.dwords[3] >> 28u) & 0xfu);
+	const auto format = static_cast<Prospero::BufferFormat>((descriptor.dwords[1] >> 20u) & 0x1ffu);
+	if (type < Prospero::ImageType::kColor1D || format == Prospero::BufferFormat::kInvalid) {
 		return false;
 	}
 	if (type == Prospero::ImageType::kColor2DMsaa ||
@@ -199,8 +200,12 @@ bool ValidateResourceSpecialization(const Program& program, const ResourceSnapsh
 		if (dimension == Decoder::ImageDimension::Unknown || dimension != image.dimension ||
 		    DescriptorIsCube(descriptor) != image.cube) {
 			if (error != nullptr) {
-				*error =
-				    fmt::format("image descriptor {} no longer matches specialized dimension", i);
+				*error = fmt::format(
+				    "image descriptor {} no longer matches specialized dimension: "
+				    "{:08x},{:08x},{:08x},{:08x},{:08x},{:08x},{:08x},{:08x}",
+				    i, descriptor.dwords[0], descriptor.dwords[1], descriptor.dwords[2],
+				    descriptor.dwords[3], descriptor.dwords[4], descriptor.dwords[5],
+				    descriptor.dwords[6], descriptor.dwords[7]);
 			}
 			return false;
 		}
@@ -215,8 +220,12 @@ bool ValidateResourceSpecialization(const Program& program, const ResourceSnapsh
 				}
 				return false;
 			}
-			const auto uint_descriptor =
-			    Prospero::IsUintTextureFormat((descriptor.dwords[1] >> 20u) & 0x1ffu);
+			const auto format = (descriptor.dwords[1] >> 20u) & 0x1ffu;
+			const bool raw_sint_storage =
+			    storage && format == Prospero::GpuEnumValue(Prospero::BufferFormat::k32SInt) &&
+			    !image.read && !image.atomic;
+			const bool uint_descriptor =
+			    Prospero::IsUintTextureFormat(format) || raw_sint_storage;
 			const auto uint_program = image.kind == ResourceKind::ImageUint ||
 			                          image.kind == ResourceKind::StorageImageUint;
 			if (uint_descriptor != uint_program && !(image.atomic && uint_program)) {
@@ -403,7 +412,14 @@ bool SpecializeResources(Program& program, const ResourceSnapshot& snapshot, std
 		    image.kind == ResourceKind::StorageImageUint) {
 			image.storage_swizzle = DescriptorImageSwizzle(descriptor);
 		}
-		if (Prospero::IsUintTextureFormat((descriptor.dwords[1] >> 20u) & 0x1ffu)) {
+		const auto format  = (descriptor.dwords[1] >> 20u) & 0x1ffu;
+		const bool storage = image.kind == ResourceKind::StorageImage ||
+		                     image.kind == ResourceKind::StorageImageUint;
+		const bool raw_sint_storage =
+		    storage && format == Prospero::GpuEnumValue(Prospero::BufferFormat::k32SInt) &&
+		    !image.read && !image.atomic;
+		const bool uint_image = Prospero::IsUintTextureFormat(format) || raw_sint_storage;
+		if (uint_image) {
 			switch (image.kind) {
 				case ResourceKind::Image: image.kind = ResourceKind::ImageUint; break;
 				case ResourceKind::StorageImage: image.kind = ResourceKind::StorageImageUint; break;

src/graphics/shader/recompiler/ir/ScalarProvenance.cpp

@@ -45,6 +45,8 @@ namespace {
 
 constexpr uint32_t ScalarRegisters = 128;
 constexpr uint32_t VectorRegisters = 256;
+// Clamp X/Y/Z are consecutive three-bit fields; the high bit of each selects a border mode.
+constexpr uint32_t SamplerBorderClampMask = (1u << 2u) | (1u << 5u) | (1u << 8u);
 
 struct ScalarState {
 	std::array<uint32_t, ScalarRegisters> regs          = {};
@@ -647,6 +649,24 @@ private:
 		return AddDescriptor(descriptor);
 	}
 
+	uint32_t AddSamplerDescriptor(const ScalarState& state, uint32_t base) {
+		if (base >= ScalarRegisters || 4u > ScalarRegisters - base) {
+			return ScalarProvenance::Unknown;
+		}
+		DescriptorValue descriptor;
+		descriptor.dword_count = 4;
+		for (uint32_t i = 0; i < 4; i++) {
+			descriptor.dwords[i] = state.regs[base + i];
+		}
+		if (auto d0 = descriptor.dwords[0];
+		    d0 < m_graph.values.size() && m_graph.values[d0].op == ScalarValueOp::Constant &&
+		    (m_graph.values[d0].imm & SamplerBorderClampMask) == 0) {
+			// Without a border clamp, the border color and table index in dword 3 are unused.
+			descriptor.dwords[3] = Constant(0);
+		}
+		return AddDescriptor(descriptor);
+	}
+
 	uint32_t AddFlatAddressDescriptor(const Instruction& inst, const ScalarState& state) {
 		const uint32_t first = FlatStore(inst.op) ? 1u : 0u;
 		if (inst.src_count < first + 2u) {
@@ -704,7 +724,7 @@ private:
 			inst.memory.resource_source = AddDescriptor(state, inst.memory.resource * 4u, 8);
 			if (inst.op == Opcode::ImageSample || inst.op == Opcode::ImageGather4 ||
 			    inst.op == Opcode::ImageGetLod) {
-				inst.memory.sampler_source = AddDescriptor(state, inst.memory.sampler * 4u, 4);
+				inst.memory.sampler_source = AddSamplerDescriptor(state, inst.memory.sampler * 4u);
 			}
 		}
 	}

src/kernel/memory.cpp

@@ -18,6 +18,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <map>
+#include <memory>
 #include <mutex>
 #include <vector>
 
@@ -805,18 +806,23 @@ private:
 	Common::Mutex              m_mutex;
 };
 
-static PhysicalMemory*       g_physical_memory       = nullptr;
-static FlexibleMemory*       g_flexible_memory       = nullptr;
-static PooledMemory*         g_pooled_memory         = nullptr;
-static VirtualRanges*        g_virtual_ranges        = nullptr;
-static GuestAddressSpace*    g_guest_address_space   = nullptr;
-static callback_func_t       g_alloc_callback        = nullptr;
-static callback_func_t       g_free_callback         = nullptr;
-static std::atomic<uint64_t> g_memory_pool_committed = 0;
-static void                  MemoryPoolSubtractCommitted(uint64_t len);
+static std::unique_ptr<PhysicalMemory>    g_physical_memory;
+static std::unique_ptr<FlexibleMemory>    g_flexible_memory;
+static std::unique_ptr<PooledMemory>      g_pooled_memory;
+static std::unique_ptr<VirtualRanges>     g_virtual_ranges;
+static std::unique_ptr<GuestAddressSpace> g_guest_address_space;
+static callback_func_t                    g_alloc_callback        = nullptr;
+static callback_func_t                    g_free_callback         = nullptr;
+static std::atomic<uint64_t>              g_memory_pool_committed = 0;
+static void                               MemoryPoolSubtractCommitted(uint64_t len);
 // Keep host mappings, physical blocks, placeholders, and virtual ranges in step.
 static std::recursive_mutex g_memory_operation_mutex;
 
+// The base address the PS5 kernel hands out for hint-less user mappings. Guest code can
+// assume mappings it did not place explicitly are at or above this (Sony's libc rejects a
+// heap below it), so hint-less searches must not fall back to the low system-managed range.
+static constexpr uint64_t GUEST_DEFAULT_MAP_BASE = 0x200000000ull;
+
 static uint64_t FindGuestFreeRange(uint64_t search_addr, uint64_t size, uint64_t alignment) {
 	EXIT_IF(g_guest_address_space == nullptr || g_virtual_ranges == nullptr);
 
@@ -844,8 +850,11 @@ static uint64_t FindGuestFreeRange(uint64_t search_addr, uint64_t size, uint64_t
 	if (search_addr != 0) {
 		return find_in(search_addr, HOST_USER_MAX + 1u);
 	}
-	auto addr = find_in(HOST_SYSTEM_MANAGED_MIN, HOST_SYSTEM_MANAGED_MAX + 1u);
-	return addr != 0 ? addr : find_in(HOST_USER_MIN, HOST_USER_MAX + 1u);
+	auto addr = find_in(GUEST_DEFAULT_MAP_BASE, HOST_SYSTEM_MANAGED_MAX + 1u);
+	if (addr == 0) {
+		addr = find_in(HOST_USER_MIN, HOST_USER_MAX + 1u);
+	}
+	return addr;
 }
 
 bool TryWriteBacking(uint64_t vaddr, const void* data, uint64_t size) {
@@ -970,11 +979,11 @@ static bool ReplaceFixedRangeWithReserved(uint64_t start, uint64_t size);
 KYTY_SUBSYSTEM_INIT(Memory) {
 	g_flexible_memory_size_frozen = true;
 	VirtualMemory::Init();
-	g_guest_address_space = new GuestAddressSpace(PhysicalMemory::TotalSize());
-	g_physical_memory     = new PhysicalMemory;
-	g_flexible_memory     = new FlexibleMemory;
-	g_pooled_memory       = new PooledMemory;
-	g_virtual_ranges      = new VirtualRanges;
+	g_guest_address_space = std::make_unique<GuestAddressSpace>(PhysicalMemory::TotalSize());
+	g_physical_memory     = std::make_unique<PhysicalMemory>();
+	g_flexible_memory     = std::make_unique<FlexibleMemory>();
+	g_pooled_memory       = std::make_unique<PooledMemory>();
+	g_virtual_ranges      = std::make_unique<VirtualRanges>();
 	EXIT_IF(!g_guest_address_space->SelfTest());
 	EXIT_IF(!SelfTestSub64SharedPlaceholderAlias());
 }
@@ -982,16 +991,11 @@ KYTY_SUBSYSTEM_INIT(Memory) {
 KYTY_SUBSYSTEM_UNEXPECTED_SHUTDOWN(Memory) {}
 
 KYTY_SUBSYSTEM_DESTROY(Memory) {
-	delete g_pooled_memory;
-	g_pooled_memory = nullptr;
-	delete g_flexible_memory;
-	g_flexible_memory = nullptr;
-	delete g_physical_memory;
-	g_physical_memory = nullptr;
-	delete g_virtual_ranges;
-	g_virtual_ranges = nullptr;
-	delete g_guest_address_space;
-	g_guest_address_space = nullptr;
+	g_pooled_memory.reset();
+	g_flexible_memory.reset();
+	g_physical_memory.reset();
+	g_virtual_ranges.reset();
+	g_guest_address_space.reset();
 }
 
 struct AlignedPos {

src/kernel/memoryAddressSpace.inc

@@ -1058,6 +1058,76 @@ private:
 		    {HOST_SYSTEM_RESERVED_MIN, HOST_SYSTEM_RESERVED_MAX + 1u},
 		    {HOST_USER_MIN, HOST_USER_MAX + 1u},
 		}};
+
+#if KYTY_PLATFORM == KYTY_PLATFORM_LINUX && !defined(__APPLE__)
+		std::vector<std::pair<uint64_t, uint64_t>> occupied;
+		FILE*                                      maps = fopen("/proc/self/maps", "r");
+		EXIT_IF(maps == nullptr);
+
+		char line[512];
+		while (fgets(line, sizeof(line), maps) != nullptr) {
+			unsigned long long mapping_start = 0;
+			unsigned long long mapping_end   = 0;
+			if (sscanf(line, "%llx-%llx", &mapping_start, &mapping_end) == 2) {
+				occupied.emplace_back(static_cast<uint64_t>(mapping_start),
+				                      static_cast<uint64_t>(mapping_end));
+			}
+		}
+		fclose(maps);
+
+		auto reserve_range = [this](uint64_t start, uint64_t end) {
+			start = AlignUp(start, PageSize());
+			end   = AlignDown(end, PageSize());
+			if (start == 0 || end <= start) {
+				return;
+			}
+
+			const auto size = end - start;
+			int        flags = MAP_PRIVATE | MAP_ANON | MAP_NORESERVE;
+#if defined(KYTY_LINKED_GUEST_ADDRESS_SPACE)
+			flags |= MAP_FIXED;
+#elif defined(MAP_FIXED_NOREPLACE)
+			flags |= MAP_FIXED_NOREPLACE;
+#endif
+
+			void* ptr = mmap(reinterpret_cast<void*>(start), size, PROT_NONE, flags, -1, 0);
+			if (ptr == MAP_FAILED || reinterpret_cast<uint64_t>(ptr) != start) {
+				if (ptr != MAP_FAILED) {
+					munmap(ptr, size);
+				}
+				return;
+			}
+
+			AddFreeUnlocked(start, size);
+			m_owned.emplace_back(start, size);
+		};
+
+		for (const auto& [region_start, region_end]: regions) {
+			auto current = region_start;
+
+			for (const auto& [mapping_start, mapping_end]: occupied) {
+				if (mapping_end <= current) {
+					continue;
+				}
+				if (mapping_start >= region_end) {
+					break;
+				}
+
+				if (mapping_start > current) {
+					reserve_range(current, std::min(mapping_start, region_end));
+				}
+
+				current = std::max(current, mapping_end);
+				if (current >= region_end) {
+					break;
+				}
+			}
+
+			if (current < region_end) {
+				reserve_range(current, region_end);
+			}
+		}
+#else
 		for (const auto& [start, end]: regions) {
 			int flags = MAP_PRIVATE | MAP_ANON | MAP_NORESERVE;
 #if defined(KYTY_LINKED_GUEST_ADDRESS_SPACE)
@@ -1070,13 +1140,14 @@ private:
 				if (ptr != MAP_FAILED) {
 					munmap(ptr, end - start);
 				}
-				EXIT("failed to reserve guest address space at 0x%016" PRIx64 ", size 0x%016" PRIx64
-				     "\n",
+				EXIT("failed to reserve guest address space at 0x%016" PRIx64
+				     ", size 0x%016" PRIx64 "\n",
 				     start, end - start);
 			}
 			AddFreeUnlocked(start, end - start);
 			m_owned.emplace_back(start, end - start);
 		}
+#endif
 #endif
 	}
 

src/kernel/pthread.cpp

@@ -65,6 +65,10 @@
 
 namespace Libs {
 
+namespace LibcInternalExt {
+void RunThreadAtexitDestructors();
+} // namespace LibcInternalExt
+
 namespace LibKernel {
 
 LIB_NAME("libkernel", "libkernel");
@@ -3347,6 +3351,8 @@ int PthreadGetCurrentPriorityForKernel() {
 static void CleanupThread(void* arg) {
 	auto* thread = static_cast<Pthread>(arg);
 
+	LibcInternalExt::RunThreadAtexitDestructors();
+
 	auto thread_dtors = g_pthread_context->GetThreadDtors();
 
 	if (thread_dtors != nullptr) {

src/libs/audio.cpp

@@ -1416,6 +1416,12 @@ struct Ngs2CustomSubmixerRackOption {
 	uint32_t             max_inputs   = 0;
 };
 
+struct Ngs2CustomMasteringRackOption {
+	Ngs2CustomRackOption custom_rack_option;
+	uint32_t             max_channels = 0;
+	uint32_t             max_inputs   = 0;
+};
+
 struct Ngs2CustomSamplerRackOption {
 	Ngs2CustomRackOption custom_rack_option;
 	uint32_t             max_channel_works        = 0;
@@ -1433,6 +1439,7 @@ union Ngs2RackOptionUnion {
 	Ngs2SubmixerRackOption       submixer;
 	Ngs2ReverbRackOption         reverb;
 	Ngs2CustomSubmixerRackOption custom_submixer;
+	Ngs2CustomMasteringRackOption custom_mastering;
 	Ngs2CustomSamplerRackOption  custom_sampler;
 };
 
@@ -1588,6 +1595,7 @@ enum class Ngs2RackType {
 	Mastering,
 	Reverb,
 	CustomSubmixer,
+	CustomMastering,
 	CustomSampler,
 };
 
@@ -1665,6 +1673,20 @@ struct Ngs2VoiceCallbackParam {
 
 struct Ngs2VoiceState {
 	uint32_t state_flags;
+	int32_t  error_code;
+};
+
+struct Ngs2SubmixerVoiceState {
+	Ngs2VoiceState voice_state;
+	float          envelope_height;
+	float          peak_height;
+	float          compressor_height;
+};
+
+struct Ngs2CustomMasteringVoiceState {
+	Ngs2VoiceState voice_state;
+	uint32_t       reserved;
+	uint32_t       reserved2;
 };
 
 struct Ngs2SamplerVoiceState {
@@ -1683,6 +1705,10 @@ static Ngs2RackInternal* g_racks_list = nullptr;
 
 static_assert(sizeof(Ngs2SystemOption) == 144);
 static_assert(sizeof(Ngs2RackOption) == 176);
+static_assert(sizeof(Ngs2VoiceState) == 8);
+static_assert(sizeof(Ngs2SubmixerVoiceState) == 20);
+static_assert(sizeof(Ngs2CustomMasteringVoiceState) == 16);
+static_assert(sizeof(Ngs2SamplerVoiceState) == 56);
 
 static uint32_t Ngs2GetStateFlags(const Ngs2VoiceInternal* voice) {
 	switch (voice->state) {
@@ -1726,6 +1752,7 @@ static Ngs2Internal* Ngs2CreateSystemInternal(const Ngs2SystemOption* option, vo
 static bool Ngs2RackIsCustom(Ngs2RackType type) {
 	switch (type) {
 		case Ngs2RackType::CustomSubmixer:
+		case Ngs2RackType::CustomMastering:
 		case Ngs2RackType::CustomSampler: return true;
 		default: return false;
 	}
@@ -2037,6 +2064,12 @@ int KYTY_SYSV_ABI Ngs2RackCreate(uintptr_t system_handle, uint32_t rack_id,
 			    *reinterpret_cast<const Ngs2CustomSubmixerRackOption*>(option);
 			rack->type = Ngs2RackType::CustomSubmixer;
 			break;
+		case 0x4003:
+			EXIT_NOT_IMPLEMENTED(option->size != sizeof(Ngs2CustomMasteringRackOption));
+			rack->option.custom_mastering =
+			    *reinterpret_cast<const Ngs2CustomMasteringRackOption*>(option);
+			rack->type = Ngs2RackType::CustomMastering;
+			break;
 		case 0x4001:
 			EXIT_NOT_IMPLEMENTED(option->size != sizeof(Ngs2CustomSamplerRackOption));
 			rack->option.custom_sampler =
@@ -2550,6 +2583,9 @@ int KYTY_SYSV_ABI Ngs2VoiceControl(uintptr_t voice_handle, const Ngs2VoiceParamH
 			case 0x4002:
 				EXIT_NOT_IMPLEMENTED(voice->rack->type != Ngs2RackType::CustomSubmixer);
 				break;
+			case 0x4003:
+				EXIT_NOT_IMPLEMENTED(voice->rack->type != Ngs2RackType::CustomMastering);
+				break;
 			default: EXIT("unknown rack_id: 0x%" PRIx32 "\n", rack_id);
 		}
 
@@ -2587,6 +2623,25 @@ int KYTY_SYSV_ABI Ngs2VoiceGetState(uintptr_t voice_handle, Ngs2VoiceState* stat
 	Common::LockGuard lock(voice->rack->ngs->mutex);
 
 	switch (voice->rack->type) {
+		case Ngs2RackType::Submixer: {
+			EXIT_NOT_IMPLEMENTED(state_size != sizeof(Ngs2SubmixerVoiceState));
+			auto* submixer = reinterpret_cast<Ngs2SubmixerVoiceState*>(state);
+			*submixer     = {};
+			submixer->voice_state.state_flags = Ngs2GetStateFlags(voice);
+			LOGF("\t state_flags = %u\n", submixer->voice_state.state_flags);
+			break;
+		}
+		case Ngs2RackType::CustomMastering: {
+			const auto configured_size =
+			    voice->rack->option.custom_mastering.custom_rack_option.state_size;
+			EXIT_NOT_IMPLEMENTED(configured_size < sizeof(Ngs2CustomMasteringVoiceState));
+			EXIT_NOT_IMPLEMENTED(state_size != configured_size);
+			std::memset(state, 0, state_size);
+			auto* mastering = reinterpret_cast<Ngs2CustomMasteringVoiceState*>(state);
+			mastering->voice_state.state_flags = Ngs2GetStateFlags(voice);
+			LOGF("\t state_flags = %u\n", mastering->voice_state.state_flags);
+			break;
+		}
 		case Ngs2RackType::Sampler:
 		case Ngs2RackType::CustomSampler: {
 			if (state_size != sizeof(Ngs2SamplerVoiceState)) {

src/libs/libC.cpp

@@ -633,6 +633,15 @@ LIB_VERSION("LibcInternalExt", 1, "LibcInternal", 1, 1);
 static uint64_t g_mspace_atomic_id_mask = 0;
 static uint64_t g_mstate_table[64]      = {0};
 
+using thread_atexit_destructor_t = KYTY_SYSV_ABI void (*)(void*);
+
+struct ThreadAtexitDestructor {
+	thread_atexit_destructor_t destructor;
+	void*                      object;
+};
+
+static thread_local std::vector<ThreadAtexitDestructor> g_thread_atexit_destructors;
+
 struct Info {
 	uint64_t  size;
 	uint32_t  unknown1;
@@ -650,25 +659,29 @@ void KYTY_SYSV_ABI LibcHeapGetTraceInfo(Info* info) {
 	info->mstate_table          = g_mstate_table;
 }
 
-uint64_t KYTY_SYSV_ABI LibcInternalExtUnknownQBS714Jr3g(uint64_t arg0, uint64_t arg1, uint64_t arg2,
-                                                        uint64_t arg3, uint64_t arg4,
-                                                        uint64_t arg5) {
+int KYTY_SYSV_ABI LibcInternalExtCxaThreadAtexit(thread_atexit_destructor_t destructor, void* object,
+                                                 void* /*module_id*/) {
 	PRINT_NAME();
 
-	LOGF("\t arg0 = 0x%016" PRIx64 "\n"
-	     "\t arg1 = 0x%016" PRIx64 "\n"
-	     "\t arg2 = 0x%016" PRIx64 "\n"
-	     "\t arg3 = 0x%016" PRIx64 "\n"
-	     "\t arg4 = 0x%016" PRIx64 "\n"
-	     "\t arg5 = 0x%016" PRIx64 "\n",
-	     arg0, arg1, arg2, arg3, arg4, arg5);
+	g_thread_atexit_destructors.push_back({destructor, object});
 
 	return 0;
 }
 
+void RunThreadAtexitDestructors() {
+	while (!g_thread_atexit_destructors.empty()) {
+		auto destructor = g_thread_atexit_destructors.back();
+		g_thread_atexit_destructors.pop_back();
+
+		if (destructor.destructor != nullptr) {
+			destructor.destructor(destructor.object);
+		}
+	}
+}
+
 LIB_DEFINE(InitLibcInternalExt_1) {
 	LIB_FUNC("NWtTN10cJzE", LibcInternalExt::LibcHeapGetTraceInfo);
-	LIB_FUNC("qBS714-Jr3g", LibcInternalExt::LibcInternalExtUnknownQBS714Jr3g);
+	LIB_FUNC("qBS714-Jr3g", LibcInternalExt::LibcInternalExtCxaThreadAtexit);
 }
 
 } // namespace LibcInternalExt

src/libs/libSaveData.cpp

@@ -375,7 +375,8 @@ int KYTY_SYSV_ABI SaveDataDirNameSearch(const SaveDataDirNameSearchCond* cond,
 
 	if (Common::File::IsDirectoryExisting(root)) {
 		for (const auto& entry: Common::File::GetDirEntries(root)) {
-			if (!entry.is_file && !Common::StartsWith(entry.name, "sce_")) {
+			if (!entry.is_file && entry.name != "." && entry.name != ".." &&
+			    !Common::StartsWith(entry.name, "sce_")) {
 				if (cond->dir_name == nullptr || cond->dir_name->data[0] == '\0' ||
 				    dir_name_match(Common::ToLower(entry.name).c_str(),
 				                   Common::ToLower(std::string(cond->dir_name->data)).c_str())) {

src/loader/runtimeLinker.cpp

@@ -38,7 +38,10 @@
 #include <windows.h>
 #else
 #include <dlfcn.h>
-#if KYTY_PLATFORM == KYTY_PLATFORM_LINUX && !defined(__APPLE__)
+#if defined(__APPLE__)
+#include <mach/mach.h>
+#include <mach/mach_vm.h>
+#elif KYTY_PLATFORM == KYTY_PLATFORM_LINUX
 #include <sys/uio.h>
 #include <unistd.h>
 #endif
@@ -722,7 +725,26 @@ static bool IsReadableRange(uint64_t addr, uint64_t size) {
 		}
 		current = std::min(region_end, end);
 	}
-#elif KYTY_PLATFORM == KYTY_PLATFORM_LINUX && !defined(__APPLE__)
+#elif defined(__APPLE__)
+	// Walk the Mach regions covering the range and require read permission. The fatal
+	// report dumps memory behind raw register values, and a fault inside the reporter
+	// re-enters the signal handler and wedges the reporting thread.
+	uint64_t current = addr;
+	while (current < end) {
+		mach_vm_address_t              region_addr = current;
+		mach_vm_size_t                 region_size = 0;
+		vm_region_basic_info_data_64_t info {};
+		mach_msg_type_number_t         count       = VM_REGION_BASIC_INFO_COUNT_64;
+		mach_port_t                    object_name = MACH_PORT_NULL;
+		if (mach_vm_region(mach_task_self(), &region_addr, &region_size, VM_REGION_BASIC_INFO_64,
+		                   reinterpret_cast<vm_region_info_t>(&info), &count,
+		                   &object_name) != KERN_SUCCESS ||
+		    region_addr > current || (info.protection & VM_PROT_READ) == 0) {
+			return false;
+		}
+		current = region_addr + region_size;
+	}
+#elif KYTY_PLATFORM == KYTY_PLATFORM_LINUX
 	const auto page_size = static_cast<uint64_t>(sysconf(_SC_PAGESIZE));
 	if (page_size == 0) {
 		return false;
@@ -752,7 +774,7 @@ static bool IsReadableRange(uint64_t addr, uint64_t size) {
 }
 
 static bool IsDumpableRange(uint64_t addr, uint64_t size) {
-#if KYTY_PLATFORM == KYTY_PLATFORM_LINUX && !defined(__APPLE__)
+#if KYTY_PLATFORM == KYTY_PLATFORM_LINUX
 	return IsReadableRange(addr, size);
 #else
 	(void)size;

tests/ResourceTrackingTests.cpp

@@ -870,6 +870,7 @@ void TestMaterializationSharesReadConstEvaluation() {
 	for (uint32_t i = 0; i < memory.words.size(); i++) {
 		memory.words[i] = 0x100 + i;
 	}
+	memory.words[1] |= Prospero::GpuEnumValue(Prospero::BufferFormat::k8UNorm) << 20u;
 	memory.words[3] |= Prospero::GpuEnumValue(Prospero::ImageType::kColor2D) << 28u;
 	std::array<uint32_t, 32> user_data {};
 	user_data[16] = static_cast<uint32_t>(memory.base);
@@ -910,6 +911,7 @@ void TestInvalidImagesMaterializeAsNull() {
 	std::string                       error;
 	for (uint32_t type = 0; type < 8; type++) {
 		auto descriptor = stale;
+		descriptor[1] |= Prospero::GpuEnumValue(Prospero::BufferFormat::k8UNorm) << 20u;
 		descriptor[3]   = (descriptor[3] & 0x0fffffffu) | (type << 28u);
 		ResourceSnapshot snapshot;
 		Check(MaterializeResources(sampled, {descriptor}, snapshot, &error) &&
@@ -966,7 +968,18 @@ void TestInvalidImagesMaterializeAsNull() {
 		}
 	}
 
+	std::array<uint32_t, 8> invalid_format {};
+	invalid_format[0] = 1;
+	invalid_format[3] = Prospero::GpuEnumValue(Prospero::ImageType::kColor2D) << 28u;
+	ResourceSnapshot invalid_format_snapshot;
+	Check(MaterializeResources(sampled, {invalid_format}, invalid_format_snapshot, &error) &&
+	          std::all_of(invalid_format_snapshot.images[0].dwords.begin(),
+	                      invalid_format_snapshot.images[0].dwords.end(),
+	                      [](uint32_t word) { return word == 0; }),
+	      "invalid-format image descriptor was not normalized to null");
+
 	auto valid = stale;
+	valid[1] |= Prospero::GpuEnumValue(Prospero::BufferFormat::k8UNorm) << 20u;
 	valid[3] =
 	    (valid[3] & 0x0fffffffu) | (Prospero::GpuEnumValue(Prospero::ImageType::kColor2D) << 28u);
 	ResourceSnapshot valid_snapshot;

tests/ShaderRecompilerComputeTests.cpp

@@ -3135,10 +3135,7 @@ public:
 			Require(name, "partial image unmap tracking",
 			        partial_unmap_image_id &&
 			            !texture_cache.FindImageFromRange(partial_unmap_image.info.data.address,
-			                                              0x2000, false) &&
-			            !texture_cache.InvalidateMemory(
-			                PageFaultAccess::Write, partial_unmap_image.info.data.address + 0x1000,
-			                0x1000, PageFaultPhase::Invalidate),
+			                                              0x2000, false),
 			        "partial unmap left the deleted image's mapped tail tracked");
 
 			constexpr uint64_t unformatted_alias_offset = 0x2500000;
@@ -4733,6 +4730,45 @@ public:
 			        "storage descriptor did not preserve its sRGB backing and "
 			        "select an UNORM Vulkan view");
 
+			ShaderTextureResource sint_storage {{0x01514b00u, 0xc1500000u, 0x000bc00bu,
+			                                     0x91b00204u, 0x00000000u, 0x00700000u,
+			                                     0x102b0000u, 0x0001514au}};
+			Require(name, "PPSA06888 R32 SINT descriptor",
+			        sint_storage.Base40() == 0x1514b0000ull && sint_storage.Width5() + 1u == 48 &&
+			            sint_storage.Height5() + 1u == 48 && sint_storage.Depth() + 1u == 1 &&
+			            sint_storage.Format() ==
+			                Prospero::GpuEnumValue(Prospero::BufferFormat::k32SInt) &&
+			            sint_storage.Type() ==
+			                Prospero::GpuEnumValue(Prospero::ImageType::kColor2D) &&
+			            sint_storage.TileMode() ==
+			                Prospero::GpuEnumValue(Prospero::TileMode::kRenderTarget) &&
+			            sint_storage.DstSelXYZW() == DstSel(4, 0, 0, 1),
+			        "captured write-only signed storage descriptor was decoded incorrectly");
+			const uint64_t mapped_sint_address = base + 0xe0000;
+			const auto     encoded_sint_address = mapped_sint_address >> 8u;
+			sint_storage.fields[0] = static_cast<uint32_t>(encoded_sint_address);
+			sint_storage.fields[1] =
+			    (sint_storage.fields[1] & ~0xffu) |
+			    static_cast<uint32_t>(encoded_sint_address >> 32u);
+			ShaderRecompiler::IR::DescriptorValue sint_storage_descriptor {};
+			std::copy(std::begin(sint_storage.fields), std::end(sint_storage.fields),
+			          sint_storage_descriptor.dwords.begin());
+			sint_storage_descriptor.dword_count = 8;
+			auto sint_storage_resource           = srgb_storage_resource;
+			sint_storage_resource.kind = ShaderRecompiler::IR::ResourceKind::StorageImageUint;
+			const auto sint_storage_binding      = RenderExecutorTestAccess::ResolveTexture(
+			    executor, sint_storage_resource, sint_storage_descriptor);
+			const auto sint_storage_view =
+			    texture_cache.FindTexture(sint_storage_binding.image_id, sint_storage_binding.desc);
+			Require(name, "PPSA06888 raw R32 SINT storage view",
+			        sint_storage_view != nullptr &&
+			            sint_storage_binding.desc.info.data.size == 0x10000 &&
+			            sint_storage_binding.desc.info.pixel_format == vk::Format::eR32Sint &&
+			            sint_storage_binding.desc.view_info.format == vk::Format::eR32Uint &&
+			            texture_cache.GetImage(sint_storage_binding.image_id).backing.format ==
+			                vk::Format::eR32Sint,
+			        "write-only R32 SINT storage did not select a bit-compatible uint view");
+
 			auto               narrowed_storage         = storage;
 			constexpr uint64_t narrowed_storage_address = base + 0xd0000;
 			const auto         encoded_narrowed_address = narrowed_storage_address >> 8u;
@@ -13604,6 +13640,33 @@ TestCase ImageStoreR32FloatUsesFormatlessStorageImage() {
 	return test;
 }
 
+TestCase ImageStoreR32SintUsesRawUintView() {
+	using O = ShaderOpcode;
+
+	std::vector<u32> code;
+	AppendVMovU32(&code, 20, 2);
+	AppendVMovU32(&code, 21, 1);
+	AppendVMovU32(&code, 22, 0);
+	AppendVMovLiteral(&code, 0, 0x80000001u);
+	code.push_back(EncodeMimg0(0x08, 0x1));
+	code.push_back(EncodeMimg1(0, 20));
+	AppendEnd(&code);
+
+	std::vector<u32> expected_image(16, 0);
+	expected_image[1 * 4 + 2] = 0x80000001u;
+
+	TestCase test;
+	test.name                         = "ImageStoreR32SintUsesRawUintView";
+	test.code                         = code;
+	test.opcodes                      = {O::VMovB32, O::ImageStore, O::SEndpgm};
+	test.user_data                    = MakeStorageTextureData(Prospero::BufferFormat::k32SInt);
+	test.has_user_data                = true;
+	test.storage_image_r32ui          = std::vector<u32>(16, 0);
+	test.expected_storage_image_r32ui = expected_image;
+	test.required_spirv               = {"storage_uint_2d"};
+	return test;
+}
+
 TestCase ImageStoreR32UintUsesUintStorageImage() {
 	using O = ShaderOpcode;
 
@@ -14181,6 +14244,7 @@ std::vector<TestCase> MakeCases() {
 	AddCase(ImageStoreBgraUsesInverseSwizzle);
 	AddCase(ImageStoreYzwxUsesInverseSwizzle);
 	AddCase(ImageStoreR32FloatUsesFormatlessStorageImage);
+	AddCase(ImageStoreR32SintUsesRawUintView);
 	AddCase(ImageStoreR32UintUsesUintStorageImage);
 	AddCase(ComputeTgSizeSgprUsesWaveMetadata);
 	AddCase(ImageAtomicVariants);
@@ -14392,17 +14456,6 @@ void CheckEmbeddedFetchVertexOffset() {
 	std::printf("[host]    %-32s ok\n", "EmbeddedFetchVertexOffset");
 }
 
-struct CacheFaultContext {
-	TextureCache* texture = nullptr;
-};
-
-bool CacheFault(void* opaque, PageFaultAccess access, uint64_t vaddr, uint64_t size,
-                PageFaultPhase phase) noexcept {
-	auto* context = static_cast<CacheFaultContext*>(opaque);
-	return context != nullptr && context->texture != nullptr &&
-	       context->texture->InvalidateMemory(access, vaddr, size, phase);
-}
-
 [[noreturn]] void RunReverseRenderTargetDeathCase() {
 	(void)TextureGetRenderTargetFormat(12u, 7u, 3u);
 	std::_Exit(0x7f);
@@ -14410,6 +14463,12 @@ bool CacheFault(void* opaque, PageFaultAccess access, uint64_t vaddr, uint64_t s
 
 #if KYTY_PLATFORM == KYTY_PLATFORM_WINDOWS
 void CheckRenderTargetFormatContract() {
+	const auto rgb565 = TextureGetRenderTargetFormat(16u, 0u, 0u);
+	Require("RenderTargetFormat", "RGB565 UNorm",
+	        rgb565.format == vk::Format::eB5G6R5UnormPack16 &&
+	            rgb565.bytes_per_element == 2u && rgb565.export_mapping.IsIdentity(),
+	        "RGB565 UNorm render-target tuple was rejected");
+
 	const auto uint_format = TextureGetRenderTargetFormat(12u, 4u, 0u);
 	Require("RenderTargetFormat", "RGBA16 uint",
 	        uint_format.format == vk::Format::eR16G16B16A16Uint &&
@@ -15108,7 +15167,7 @@ void CheckSampledDepthDescriptor(RenderContext& renderer) {
 	auto&            context = renderer.GetGraphics();
 	CommandScheduler scheduler(renderer, context);
 	const auto make_info = [](uint32_t width, uint32_t height, uint32_t pitch, uint32_t layers,
-	                          vk::Format format, Prospero::ImageType type) {
+	                          vk::Format format, Prospero::ImageType type, uint32_t samples = 1) {
 		ImageInfo info {};
 		info.pixel_format    = format;
 		info.guest_format    = Prospero::GpuEnumValue(Prospero::BufferFormat::k32Float);
@@ -15117,7 +15176,7 @@ void CheckSampledDepthDescriptor(RenderContext& renderer) {
 		info.resources       = {1, layers};
 		info.pitch           = pitch;
 		info.bytes_per_block = 4;
-		info.samples         = 1;
+		info.samples         = samples;
 		info.tile_mode       = Prospero::GpuEnumValue(Prospero::TileMode::kDepth);
 		info.mip_layout[0] = {0, static_cast<uint64_t>(pitch) * height * layers * 4, pitch, height};
 		return info;
@@ -15135,6 +15194,20 @@ void CheckSampledDepthDescriptor(RenderContext& renderer) {
 	            IsSupportedDepthTargetDescriptor(descriptor, image),
 	        "normalized depth image rejected a valid padded descriptor");
 
+	const ShaderTextureResource uncompressed_msaa {{
+	    0x00705d00u, 0xc1600000u, 0x010dc1dfu, 0xe1810924u,
+	    0x00000000u, 0x00700010u, 0x00000000u, 0x00000000u,
+	}};
+	auto msaa_info =
+	    make_info(1920, 1080, 1920, 1, vk::Format::eD32Sfloat, Prospero::ImageType::kColor2D, 2);
+	msaa_info.mip_layout[0] = {0, 0x010e0000, 1920, 1152};
+	Image msaa_image(context, scheduler, msaa_info);
+	msaa_image.usage.depth_target = true;
+	Require("SampledDepthDescriptor", "uncompressed 2x MSAA depth",
+	        IsSupportedDepthTargetDescriptor(uncompressed_msaa, msaa_image) &&
+	            IsSupportedDepthTextureEncoding(uncompressed_msaa, msaa_image),
+	        "valid uncompressed MSAA depth descriptor required an HTILE compatibility flag");
+
 	descriptor.fields[3] = (descriptor.fields[3] & ~(0xfu << 28u)) |
 	                       (Prospero::GpuEnumValue(Prospero::ImageType::kColor2DArray) << 28u);
 	Require("SampledDepthDescriptor", "singleton array descriptor",
@@ -16023,7 +16096,7 @@ void CheckStorageTextureGpuOwnedRebindState() {
 	auto* memory = reinterpret_cast<uint8_t*>(guest_memory);
 	Require("StorageTextureGpuOwnedRebind", "allocation", guest_memory == base,
 	        "fixed guest-owner allocation failed");
-	PageManager   page_manager(CacheFault, nullptr);
+	PageManager   page_manager;
 	MemoryTracker tracker(page_manager);
 	page_manager.OnGpuMap(base, size);
 	tracker.ForEachUploadRange(

tests/VirtualMemoryAllocationTests.cpp

@@ -1356,6 +1356,135 @@ void TestLargeDirectMapAliasesAcrossChunks() {
 	std::printf("[host]    %-48s ok\n", test);
 }
 
+void TestHintlessDirectMapUsesCanonicalGuestBase() {
+	// Mirrors the allocation Sony's libc.prx makes for its internal heap: 4 MiB of
+	// direct memory, 2 MiB aligned, mapped with no address hint. The PS5 kernel never
+	// places hint-less user mappings below 0x200000000 and guest code relies on that
+	// (libc fails its mspace setup for a lower heap address, and the first malloc then
+	// dereferences a null mspace). Writes through the mapping must also stick.
+	const char* test = "HintlessDirectMapUsesCanonicalGuestBase";
+
+	constexpr uint64_t Len   = 0x400000;
+	constexpr uint64_t Align = 0x200000;
+
+	int64_t phys_addr = 0;
+	CheckOk(test,
+	        Libs::LibKernel::Memory::KernelAllocateDirectMemory(0, 0x260000000ull, Len, Align, 12,
+	                                                            &phys_addr),
+	        "KernelAllocateDirectMemory");
+
+	void* address = nullptr;
+	CheckOk(test,
+	        Libs::LibKernel::Memory::KernelMapNamedDirectMemory(&address, Len, SceKernelProtCpuRw,
+	                                                            0, phys_addr, Align, "libc_heap"),
+	        "KernelMapNamedDirectMemory");
+	const auto base = reinterpret_cast<uint64_t>(address);
+	{
+		char message[128] = {};
+		std::snprintf(message, sizeof(message),
+		              "hint-less direct map landed below the PS5 base: 0x%016" PRIx64, base);
+		Check(test, base >= 0x200000000ull, message);
+	}
+
+	auto* header = reinterpret_cast<uint64_t*>(base);
+	header[0]    = 0x4d53504143453030ull; // "MSPACE00"
+	header[7]    = 0x58585858ull;         // magic at +0x38, like the libc mspace
+	*reinterpret_cast<uint64_t*>(base + Len - 8) = 0x454e444d41524bull;
+
+	Check(test, header[0] == 0x4d53504143453030ull, "immediate readback of header[0] failed");
+	Check(test, header[7] == 0x58585858ull, "immediate readback of header[7] failed");
+	Check(test, *reinterpret_cast<const uint64_t*>(base + Len - 8) == 0x454e444d41524bull,
+	      "immediate readback of tail failed");
+
+	uint64_t backing = 0;
+	Check(test, Libs::LibKernel::Memory::TryReadBacking(base + 0x38, &backing, sizeof(backing)),
+	      "TryReadBacking(header+0x38)");
+	Check(test, backing == 0x58585858ull, "backing store does not see the guest write at +0x38");
+
+	CheckOk(test, Libs::LibKernel::Memory::KernelMunmap(base, Len), "KernelMunmap");
+	CheckOk(test, Libs::LibKernel::Memory::KernelReleaseDirectMemory(phys_addr, Len),
+	        "KernelReleaseDirectMemory");
+
+	std::printf("[host]    %-48s ok\n", test);
+}
+
+void TestDirectMemoryContentPersistsAcrossRemap() {
+	const char* test = "DirectMemoryContentPersistsAcrossRemap";
+
+	constexpr uint64_t MapSize = SceKernelPageSize * 4;
+
+	int64_t phys_addr = 0;
+	CheckOk(test,
+	        Libs::LibKernel::Memory::KernelAllocateDirectMemory(
+	            SceKernelDirectMemoryStart, Libs::LibKernel::Memory::KernelGetDirectMemorySize(),
+	            MapSize, SceKernelPageSize, SceKernelMtypeC, &phys_addr),
+	        "KernelAllocateDirectMemory");
+
+	// Direct memory is physical: contents must survive unmapping and remapping, including
+	// a remap of a sub-range at a nonzero physical offset.
+	void* address = nullptr;
+	CheckOk(test,
+	        Libs::LibKernel::Memory::KernelMapNamedDirectMemory(&address, MapSize,
+	                                                            SceKernelProtCpuRw, 0, phys_addr,
+	                                                            SceKernelPageSize, "persist_a"),
+	        "KernelMapNamedDirectMemory(first)");
+	const auto base = reinterpret_cast<uint64_t>(address);
+	for (uint64_t offset = 0; offset < MapSize; offset += sizeof(uint64_t)) {
+		*reinterpret_cast<uint64_t*>(base + offset) = offset ^ 0x4b5954595045525aull; // "KYTYPERZ"
+	}
+	CheckOk(test, Libs::LibKernel::Memory::KernelMunmap(base, MapSize), "KernelMunmap(first)");
+
+	void* remap = nullptr;
+	CheckOk(test,
+	        Libs::LibKernel::Memory::KernelMapNamedDirectMemory(&remap, MapSize,
+	                                                            SceKernelProtCpuRw, 0, phys_addr,
+	                                                            SceKernelPageSize, "persist_b"),
+	        "KernelMapNamedDirectMemory(remap)");
+	const auto remap_base = reinterpret_cast<uint64_t>(remap);
+	for (uint64_t offset = 0; offset < MapSize; offset += sizeof(uint64_t)) {
+		const auto expected = offset ^ 0x4b5954595045525aull;
+		const auto actual   = *reinterpret_cast<const uint64_t*>(remap_base + offset);
+		if (actual != expected) {
+			char message[160] = {};
+			std::snprintf(message, sizeof(message),
+			              "content lost across remap at offset 0x%" PRIx64 ": expected 0x%016" PRIx64
+			              ", read 0x%016" PRIx64,
+			              offset, expected, actual);
+			Fail(test, message);
+		}
+	}
+	CheckOk(test, Libs::LibKernel::Memory::KernelMunmap(remap_base, MapSize), "KernelMunmap(remap)");
+
+	// Sub-range remap at a nonzero physical offset: page 2 of the original allocation.
+	void* partial = nullptr;
+	CheckOk(test,
+	        Libs::LibKernel::Memory::KernelMapNamedDirectMemory(
+	            &partial, SceKernelPageSize, SceKernelProtCpuRw, 0,
+	            phys_addr + static_cast<int64_t>(SceKernelPageSize * 2), SceKernelPageSize,
+	            "persist_c"),
+	        "KernelMapNamedDirectMemory(partial)");
+	const auto partial_base = reinterpret_cast<uint64_t>(partial);
+	for (uint64_t offset = 0; offset < SceKernelPageSize; offset += sizeof(uint64_t)) {
+		const auto expected = (SceKernelPageSize * 2 + offset) ^ 0x4b5954595045525aull;
+		const auto actual   = *reinterpret_cast<const uint64_t*>(partial_base + offset);
+		if (actual != expected) {
+			char message[160] = {};
+			std::snprintf(message, sizeof(message),
+			              "content lost in partial remap at offset 0x%" PRIx64
+			              ": expected 0x%016" PRIx64 ", read 0x%016" PRIx64,
+			              offset, expected, actual);
+			Fail(test, message);
+		}
+	}
+	CheckOk(test, Libs::LibKernel::Memory::KernelMunmap(partial_base, SceKernelPageSize),
+	        "KernelMunmap(partial)");
+
+	CheckOk(test, Libs::LibKernel::Memory::KernelReleaseDirectMemory(phys_addr, MapSize),
+	        "KernelReleaseDirectMemory");
+
+	std::printf("[host]    %-48s ok\n", test);
+}
+
 void TestDirectMapUnmapReusesHostAddress() {
 	const char* test = "DirectMapUnmapReusesHostAddress";
 
@@ -2150,6 +2279,8 @@ int main() {
 	RunTest(TestDirectAlignmentStaysWithinSearchRange);
 	RunTest(TestDefaultDirectMapUsesSystemAddressRange);
 	RunTest(TestLargeDirectMapAliasesAcrossChunks);
+	RunTest(TestHintlessDirectMapUsesCanonicalGuestBase);
+	RunTest(TestDirectMemoryContentPersistsAcrossRemap);
 	RunTest(TestDirectMapUnmapReusesHostAddress);
 	RunTest(TestFixedReserveReplacesPartialDirectMapping);
 	RunTest(TestFixedReserveRollbackConsumesRestoredPlaceholder);

tests/shaderCfgTests.cpp

@@ -5394,7 +5394,224 @@ void TestNewShaderRecompilerCfgSharedOuterAndLoopMerge() {
 	CheckSpirvBinaryValidates(result.spirv);
 }
 
-void TestNewShaderRecompilerCfgLoopSharedContinueSelectionMerges() {
+void TestNewShaderRecompilerCfgLoopEarlyBreakNoSelection() {
+	const uint32_t shader[] = {
+	    EncodeSopc(0x0a, 0, 129),    // loop: s_cmp_lt_u32 s0, 1
+	    EncodeSopp(0x04, 4),         // loop exit -> end
+	    EncodeSopc(0x06, 1, 1),      // s_cmp_eq_u32 s1, s1
+	    EncodeSopp(0x04, 2),         // early break -> same loop end
+	    EncodeSop2(0x00, 0, 0, 129), // s_add_u32 s0, s0, 1
+	    EncodeSopp(0x02, 0xfffau),   // backedge -> loop header
+	    0xbf810000u,
+	};
+
+	ShaderRecompiler::CompileOptions options;
+	options.stage   = ShaderType::Compute;
+	options.dump_ir = true;
+
+	ShaderRecompiler::CompileResult result;
+	std::string                     error;
+	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
+	Check(Common::ContainsStr(result.ir_dump, "mode=structured"),
+	      "loop early-break CFG did not stay on structured path");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 246) != 0,
+	      "loop early-break SPIR-V lacks OpLoopMerge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 247) == 0,
+	      "loop early-break SPIR-V unexpectedly used OpSelectionMerge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) == 0,
+	      "loop early-break CFG unexpectedly used dispatcher OpSwitch");
+	CheckSpirvBinaryValidates(result.spirv);
+}
+
+void TestNewShaderRecompilerCfgNestedLoopNonlocalExitDispatcher() {
+	const uint32_t shader[] = {
+	    EncodeSopc(0x0a, 0, 129),    // outer loop: s_cmp_lt_u32 s0, 1
+	    EncodeSopp(0x04, 9),         // outer exit -> end
+	    EncodeSopc(0x0a, 1, 129),    // inner loop: s_cmp_lt_u32 s1, 1
+	    EncodeSopp(0x04, 5),         // inner exit -> outer continue
+	    EncodeSopc(0x06, 2, 2),      // s_cmp_eq_u32 s2, s2
+	    EncodeSopp(0x05, 5),         // nonlocal exit -> outer end
+	    EncodeSMovB32(3, 129),       // inner work
+	    EncodeSop2(0x00, 1, 1, 129), // s_add_u32 s1, s1, 1
+	    EncodeSopp(0x02, 0xfff9u),   // inner backedge
+	    EncodeSop2(0x00, 0, 0, 129), // outer continue: s_add_u32 s0, s0, 1
+	    EncodeSopp(0x02, 0xfff5u),   // outer backedge
+	    0xbf810000u,
+	};
+
+	ShaderRecompiler::CompileOptions options;
+	options.stage   = ShaderType::Compute;
+	options.dump_ir = true;
+
+	ShaderRecompiler::CompileResult result;
+	std::string                     error;
+	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
+	Check(Common::ContainsStr(result.ir_dump, "mode=dispatcher"),
+	      "nested-loop nonlocal exit did not select dispatcher fallback");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) != 0,
+	      "nested-loop nonlocal exit dispatcher SPIR-V lacks OpSwitch");
+	CheckSpirvBinaryValidates(result.spirv);
+}
+
+void TestNewShaderRecompilerCfgNestedLoopLocalExitNoSelection() {
+	const uint32_t shader[] = {
+	    EncodeSopc(0x0a, 0, 129),    // outer loop: s_cmp_lt_u32 s0, 1
+	    EncodeSopp(0x04, 6),         // outer exit -> end
+	    EncodeSopc(0x0a, 1, 129),    // inner loop: s_cmp_lt_u32 s1, 1
+	    EncodeSopp(0x04, 2),         // inner exit -> outer continue
+	    EncodeSMovB32(2, 129),       // inner work
+	    EncodeSopp(0x02, 0xfffcu),   // inner backedge
+	    EncodeSop2(0x00, 0, 0, 129), // outer continue: s_add_u32 s0, s0, 1
+	    EncodeSopp(0x02, 0xfff8u),   // outer backedge
+	    0xbf810000u,
+	};
+
+	ShaderRecompiler::CompileOptions options;
+	options.stage   = ShaderType::Compute;
+	options.dump_ir = true;
+
+	ShaderRecompiler::CompileResult result;
+	std::string                     error;
+	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
+	Check(Common::ContainsStr(result.ir_dump, "mode=structured"),
+	      "nested local loop exit did not stay on structured path");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 246) >= 2,
+	      "nested local loop exit SPIR-V lacks both OpLoopMerge instructions");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 247) == 0,
+	      "nested local loop exit SPIR-V unexpectedly used OpSelectionMerge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) == 0,
+	      "nested local loop exit unexpectedly used dispatcher OpSwitch");
+	CheckSpirvBinaryValidates(result.spirv);
+}
+
+void TestNewShaderRecompilerCfgNestedLoopExitTailMergeSplit() {
+	const uint32_t shader[] = {
+	    EncodeSopc(0x0a, 0, 129),    // outer loop: s_cmp_lt_u32 s0, 1
+	    EncodeSopp(0x04, 11),        // outer exit -> end
+	    EncodeSopc(0x06, 1, 1),      // inner loop first exit condition
+	    EncodeSopp(0x05, 3),         // first inner exit -> tail A
+	    EncodeSopc(0x06, 2, 2),      // inner loop second exit condition
+	    EncodeSopp(0x05, 3),         // second inner exit -> tail B
+	    EncodeSopp(0x02, 0xfffbu),   // inner backedge
+	    EncodeSMovB32(3, 129),       // tail A
+	    EncodeSopp(0x02, 2),         // tail A -> outer continue
+	    EncodeSMovB32(4, 129),       // tail B
+	    EncodeSopp(0x02, 0),         // tail B -> outer continue
+	    EncodeSop2(0x00, 0, 0, 129), // outer continue: s_add_u32 s0, s0, 1
+	    EncodeSopp(0x02, 0xfff3u),   // outer backedge
+	    0xbf810000u,
+	};
+
+	ShaderRecompiler::Decoder::Program program;
+	std::string                        error;
+	Check(ShaderRecompiler::Decoder::DecodeProgram(std::span {shader}, program, &error),
+	      error.c_str());
+
+	ShaderRecompiler::CFG::Graph graph;
+	Check(ShaderRecompiler::CFG::BuildGraph(program, graph, &error), error.c_str());
+	const auto original_block_count = graph.blocks.size();
+	Check(ShaderRecompiler::CFG::Structurize(graph, &error), error.c_str());
+	Check(graph.blocks.size() > original_block_count,
+	      "nested loop exit tails did not create a private inner merge");
+
+	const auto* outer_header = graph.FindBlockByPc(0);
+	const auto* inner_header = graph.FindBlockByPc(8);
+	Check(outer_header != nullptr && inner_header != nullptr &&
+	          outer_header->terminator.loop_header && inner_header->terminator.loop_header,
+	      "nested loop exit-tail fixture did not retain both loop headers");
+	Check(inner_header->terminator.merge_block != outer_header->terminator.continue_block,
+	      "inner loop merge still aliases the outer continue target");
+	const auto* inner_merge = graph.FindBlock(inner_header->terminator.merge_block);
+	Check(inner_merge != nullptr && inner_merge->inst_begin == inner_merge->inst_end &&
+	          inner_merge->terminator.kind == ShaderRecompiler::CFG::TerminatorKind::Branch &&
+	          inner_merge->terminator.true_block == outer_header->terminator.continue_block,
+	      "private inner merge does not forward to the outer continue target");
+}
+
+void TestNewShaderRecompilerCfgMixedContinueNonmergeExitDispatcher() {
+	const uint32_t shader[] = {
+	    EncodeSopc(0x06, 7, 7),      // entry branch bypasses loop -> exit X
+	    EncodeSopp(0x05, 5),         // entry -> X
+	    EncodeSopc(0x0a, 0, 129),    // loop: s_cmp_lt_u32 s0, 1
+	    EncodeSopp(0x04, 5),         // loop exit -> Y
+	    EncodeSopc(0x06, 1, 1),      // inner condition
+	    EncodeSopp(0x05, 1),         // nonmerge exit -> X, else continue
+	    EncodeSopp(0x02, 0xfffbu),   // loop backedge
+	    EncodeSMovB32(2, 129),       // X
+	    EncodeSopp(0x02, 2),         // X -> end
+	    EncodeSMovB32(3, 129),       // Y
+	    EncodeSopp(0x02, 0),         // Y -> end
+	    0xbf810000u,
+	};
+
+	ShaderRecompiler::CompileOptions options;
+	options.stage   = ShaderType::Compute;
+	options.dump_ir = true;
+
+	ShaderRecompiler::CompileResult result;
+	std::string                     error;
+	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
+	Check(Common::ContainsStr(result.ir_dump, "mode=dispatcher"),
+	      "mixed continue/nonmerge exit did not select dispatcher fallback");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) != 0,
+	      "mixed continue/nonmerge exit dispatcher SPIR-V lacks OpSwitch");
+	CheckSpirvBinaryValidates(result.spirv);
+}
+
+void TestNewShaderRecompilerCfgConditionalLatchNoSelection() {
+	const uint32_t shader[] = {
+	    EncodeSopp(0x02, 0),       // loop header -> conditional block
+	    EncodeSopc(0x06, 0, 0),    // s_cmp_eq_u32 s0, s0
+	    EncodeSopp(0x05, 1),       // loop exit -> end
+	    EncodeSopp(0x02, 0xfffcu), // separate latch -> loop header
+	    0xbf810000u,
+	};
+
+	ShaderRecompiler::CompileOptions options;
+	options.stage   = ShaderType::Compute;
+	options.dump_ir = true;
+
+	ShaderRecompiler::CompileResult result;
+	std::string                     error;
+	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
+	Check(Common::ContainsStr(result.ir_dump, "mode=structured"),
+	      "conditional latch did not stay on structured path");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 246) != 0,
+	      "conditional latch SPIR-V lacks OpLoopMerge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 247) == 0,
+	      "conditional latch SPIR-V unexpectedly used OpSelectionMerge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) == 0,
+	      "conditional latch unexpectedly used dispatcher OpSwitch");
+	CheckSpirvBinaryValidates(result.spirv);
+}
+
+void TestNewShaderRecompilerCfgDirectConditionalLatchNoSelection() {
+	const uint32_t shader[] = {
+	    EncodeSopp(0x02, 0),       // loop header -> conditional latch
+	    EncodeSopc(0x06, 0, 0),    // s_cmp_eq_u32 s0, s0
+	    EncodeSopp(0x05, 0xfffdu), // direct latch backedge -> loop header
+	    0xbf810000u,
+	};
+
+	ShaderRecompiler::CompileOptions options;
+	options.stage   = ShaderType::Compute;
+	options.dump_ir = true;
+
+	ShaderRecompiler::CompileResult result;
+	std::string                     error;
+	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
+	Check(Common::ContainsStr(result.ir_dump, "mode=structured"),
+	      "direct conditional latch did not stay on structured path");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 246) != 0,
+	      "direct conditional latch SPIR-V lacks OpLoopMerge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 247) == 0,
+	      "direct conditional latch SPIR-V unexpectedly used OpSelectionMerge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) == 0,
+	      "direct conditional latch unexpectedly used dispatcher OpSwitch");
+	CheckSpirvBinaryValidates(result.spirv);
+}
+
+void TestNewShaderRecompilerCfgLoopEarlyContinuesNoSelection() {
 	const uint32_t shader[] = {
 	    EncodeSMovB32(0, 128),       // s0 = 0
 	    EncodeSopc(0x0a, 0, 130),    // loop: s_cmp_lt_u32 s0, 2
@@ -5419,15 +5636,111 @@ void TestNewShaderRecompilerCfgLoopSharedContinueSelectionMerges() {
 	std::string                     error;
 	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
 	Check(Common::ContainsStr(result.ir_dump, "mode=structured"),
-	      "shared loop continue selections should stay on structured path");
-	Check(!Common::ContainsStr(result.ir_dump, "duplicate structured merge block"),
-	      "shared loop continue selections were not split before structurization");
-	Check(SpirvContainsOpcode(result.spirv, 246),
-	      "shared loop continue selections SPIR-V lacks OpLoopMerge");
-	Check(SpirvContainsOpcode(result.spirv, 247),
-	      "shared loop continue selections SPIR-V lacks OpSelectionMerge");
-	Check(!SpirvContainsOpcode(result.spirv, 251),
-	      "shared loop continue selections unexpectedly used dispatcher OpSwitch");
+	      "loop early continues should stay on structured path");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 246) != 0,
+	      "loop early continues SPIR-V lacks OpLoopMerge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 247) == 0,
+	      "loop early continues SPIR-V unexpectedly used OpSelectionMerge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) == 0,
+	      "loop early continues unexpectedly used dispatcher OpSwitch");
+	CheckSpirvBinaryValidates(result.spirv);
+}
+
+void TestNewShaderRecompilerCfgConditionalLoopHeaderSelection() {
+	const uint32_t shader[] = {
+	    EncodeSopc(0x06, 0, 0),    // loop body selection condition
+	    EncodeSopp(0x05, 2),       // select path B
+	    EncodeSMovB32(1, 129),     // path A
+	    EncodeSopp(0x02, 1),       // path A -> join
+	    EncodeSMovB32(2, 129),     // path B
+	    EncodeSMovB32(3, 129),     // join
+	    EncodeSopc(0x06, 4, 4),    // repeat condition
+	    EncodeSopp(0x05, 0xfff8u), // repeat -> guest header
+	    0xbf810000u,
+	};
+
+	ShaderRecompiler::Decoder::Program decoded;
+	std::string                        error;
+	Check(ShaderRecompiler::Decoder::DecodeProgram(std::span {shader}, decoded, &error),
+	      error.c_str());
+	ShaderRecompiler::CFG::Graph graph;
+	Check(ShaderRecompiler::CFG::BuildGraph(decoded, graph, &error), error.c_str());
+	const auto original_block_count = graph.blocks.size();
+	Check(ShaderRecompiler::CFG::Structurize(graph, &error), error.c_str());
+	Check(graph.blocks.size() > original_block_count,
+	      "conditional guest loop header did not create a synthetic header");
+
+	uint32_t loop_headers      = 0;
+	uint32_t selection_headers = 0;
+	for (const auto& block: graph.blocks) {
+		if (block.terminator.loop_header) {
+			loop_headers++;
+			Check(block.inst_begin == block.inst_end &&
+			          block.terminator.kind == ShaderRecompiler::CFG::TerminatorKind::Branch,
+			      "canonical loop header is not an empty unconditional block");
+		} else if (block.terminator.kind ==
+		               ShaderRecompiler::CFG::TerminatorKind::ConditionalBranch &&
+		           block.terminator.merge_block != UINT32_MAX) {
+			selection_headers++;
+		}
+	}
+	Check(loop_headers == 1u && selection_headers == 1u,
+	      "guest conditional was not separated from the loop header");
+
+	ShaderRecompiler::CompileOptions options;
+	options.stage = ShaderType::Compute;
+	ShaderRecompiler::CompileResult result;
+	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
+	Check(SpirvInstructionOpcodeCount(result.spirv, 246) == 1u,
+	      "conditional loop-header SPIR-V has the wrong loop-merge count");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 247) == 1u,
+	      "conditional loop-header SPIR-V has the wrong selection-merge count");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) == 0u,
+	      "conditional loop-header unexpectedly used dispatcher OpSwitch");
+	CheckSpirvBinaryValidates(result.spirv);
+}
+
+void TestNewShaderRecompilerCfgMultipleLoopLatches() {
+	const uint32_t shader[] = {
+	    EncodeSopc(0x0a, 0, 129),  // loop condition
+	    EncodeSopp(0x04, 5),       // loop exit -> end
+	    EncodeSopc(0x06, 1, 1),    // early repeat condition
+	    EncodeSopp(0x05, 0xfffcu), // early repeat -> header
+	    EncodeSMovB32(2, 129),     // body
+	    EncodeSMovB32(3, 129),     // body tail
+	    EncodeSopp(0x02, 0xfff9u), // ordinary latch -> header
+	    0xbf810000u,
+	};
+
+	ShaderRecompiler::Decoder::Program decoded;
+	std::string                        error;
+	Check(ShaderRecompiler::Decoder::DecodeProgram(std::span {shader}, decoded, &error),
+	      error.c_str());
+	ShaderRecompiler::CFG::Graph graph;
+	Check(ShaderRecompiler::CFG::BuildGraph(decoded, graph, &error), error.c_str());
+	const auto original_block_count = graph.blocks.size();
+	Check(graph.back_edges.size() == 2u, "multiple-latch fixture lacks two native backedges");
+	Check(ShaderRecompiler::CFG::Structurize(graph, &error), error.c_str());
+	Check(graph.blocks.size() == original_block_count + 1u,
+	      "multiple native latches did not create one synthetic continue");
+	Check(graph.back_edges.size() == 1u && graph.natural_loops.size() == 1u,
+	      "multiple native latches were not coalesced to one SPIR-V backedge");
+	const auto& loop           = graph.natural_loops.front();
+	const auto* continue_block = graph.FindBlock(loop.continue_block);
+	Check(continue_block != nullptr && continue_block->inst_begin == continue_block->inst_end &&
+	          continue_block->predecessors.size() == 2u,
+	      "canonical continue does not join both native latches");
+
+	ShaderRecompiler::CompileOptions options;
+	options.stage = ShaderType::Compute;
+	ShaderRecompiler::CompileResult result;
+	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
+	Check(SpirvInstructionOpcodeCount(result.spirv, 246) == 1u,
+	      "multiple-latch SPIR-V has the wrong loop-merge count");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 247) == 0u,
+	      "multiple-latch SPIR-V unexpectedly used a selection merge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) == 0u,
+	      "multiple-latch SPIR-V unexpectedly used dispatcher OpSwitch");
 	CheckSpirvBinaryValidates(result.spirv);
 }
 
@@ -5457,6 +5770,85 @@ void TestNewShaderRecompilerCfgDuplicateMergeStructuredSplit() {
 	CheckSpirvBinaryValidates(result.spirv);
 }
 
+void TestNewShaderRecompilerCfgOverlappingEarlyExitLadder() {
+	const uint32_t shader[] = {
+	    EncodeSopc(0x06, 0, 0), // block 0
+	    EncodeSopp(0x04, 2),    // block 0 -> 2 or 1
+	    EncodeSopc(0x06, 1, 1), // block 1
+	    EncodeSopp(0x04, 6),    // block 1 -> 5 or 2
+	    EncodeSopc(0x06, 2, 2), // block 2
+	    EncodeSopp(0x04, 4),    // block 2 -> 5 or 3
+	    EncodeSopc(0x06, 3, 3), // block 3
+	    EncodeSopp(0x04, 2),    // block 3 -> 5 or 4
+	    EncodeSMovB32(4, 129),  // block 4
+	    0xbf810000u,             // block 4 -> 6
+	    EncodeSMovB32(5, 129),  // block 5
+	    0xbf810000u,             // block 5 -> 6
+	};
+
+	ShaderRecompiler::Decoder::Program decoded;
+	std::string                        error;
+	Check(ShaderRecompiler::Decoder::DecodeProgram(std::span {shader}, decoded, &error),
+	      error.c_str());
+	ShaderRecompiler::CFG::Graph graph;
+	Check(ShaderRecompiler::CFG::BuildGraph(decoded, graph, &error), error.c_str());
+	Check(graph.blocks.size() == 7u && graph.blocks[0].successors == std::vector<uint32_t>({1, 2}) &&
+	          graph.blocks[0].terminator.true_block == 2u &&
+	          graph.blocks[0].terminator.false_block == 1u &&
+	          graph.blocks[1].successors == std::vector<uint32_t>({2, 5}) &&
+	          graph.blocks[1].terminator.true_block == 5u &&
+	          graph.blocks[1].terminator.false_block == 2u &&
+	          graph.blocks[2].successors == std::vector<uint32_t>({3, 5}) &&
+	          graph.blocks[2].terminator.true_block == 5u &&
+	          graph.blocks[2].terminator.false_block == 3u &&
+	          graph.blocks[3].successors == std::vector<uint32_t>({4, 5}) &&
+	          graph.blocks[3].terminator.true_block == 5u &&
+	          graph.blocks[3].terminator.false_block == 4u &&
+	          graph.blocks[4].successors == std::vector<uint32_t>({6}) &&
+	          graph.blocks[5].successors == std::vector<uint32_t>({6}),
+	      "overlapping early-exit fixture does not match the observed shader CFG");
+	Check(ShaderRecompiler::CFG::Structurize(graph, &error), error.c_str());
+	std::vector<bool>     reachable(graph.blocks.size());
+	std::vector<uint32_t> pending = {graph.entry_block};
+	while (!pending.empty()) {
+		const auto block_id = pending.back();
+		pending.pop_back();
+		if (reachable[block_id]) {
+			continue;
+		}
+		reachable[block_id] = true;
+		pending.insert(pending.end(), graph.blocks[block_id].successors.begin(),
+		               graph.blocks[block_id].successors.end());
+	}
+	Check(std::all_of(reachable.begin(), reachable.end(), [](bool value) { return value; }),
+	      "overlapping early-exit structurization left unreachable blocks");
+	std::vector<uint32_t> merges;
+	for (const auto& block: graph.blocks) {
+		if (block.terminator.kind == ShaderRecompiler::CFG::TerminatorKind::ConditionalBranch) {
+			Check(block.terminator.merge_block != UINT32_MAX &&
+			          std::find(merges.begin(), merges.end(), block.terminator.merge_block) ==
+			              merges.end(),
+			      "overlapping early-exit structurization retained a shared merge");
+			merges.push_back(block.terminator.merge_block);
+		}
+	}
+
+	ShaderRecompiler::CompileOptions options;
+	options.stage   = ShaderType::Pixel;
+	options.dump_ir = true;
+	ShaderRecompiler::CompileResult result;
+	Check(ShaderRecompiler::TryRecompile(shader, options, result, &error), error.c_str());
+	Check(Common::ContainsStr(result.ir_dump, "mode=structured"),
+	      "overlapping early-exit ladder did not stay on the structured path");
+	Check(!Common::ContainsStr(result.ir_dump, "duplicate structured merge block"),
+	      "overlapping early-exit ladder retained a shared merge");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 247) >= 4u,
+	      "overlapping early-exit ladder lost its selections");
+	Check(SpirvInstructionOpcodeCount(result.spirv, 251) == 0u,
+	      "overlapping early-exit ladder used dispatcher OpSwitch");
+	CheckSpirvBinaryValidates(result.spirv);
+}
+
 void TestNewShaderRecompilerCfgIrreducibleDispatcher() {
 	const uint32_t shader[] = {
 	    EncodeSopp(0x05, 2),       // entry -> B, fallthrough A
@@ -7014,7 +7406,6 @@ int main() {
 	using namespace Libs::Graphics;
 
 	EnsureConfigInitialized();
-
 	TestResourceDescriptorClassification();
 	TestNativeShaderResourceDependencies();
 	TestNormalizedImageContracts();
@@ -7086,8 +7477,18 @@ int main() {
 	TestNewShaderRecompilerCfgLoopHeaderBufferLoadDispatcher();
 	TestNewShaderRecompilerCfgLoopHeaderDsAppendConsumeDispatcher();
 	TestNewShaderRecompilerCfgSharedOuterAndLoopMerge();
-	TestNewShaderRecompilerCfgLoopSharedContinueSelectionMerges();
+	TestNewShaderRecompilerCfgLoopEarlyBreakNoSelection();
+	TestNewShaderRecompilerCfgNestedLoopNonlocalExitDispatcher();
+	TestNewShaderRecompilerCfgNestedLoopLocalExitNoSelection();
+	TestNewShaderRecompilerCfgNestedLoopExitTailMergeSplit();
+	TestNewShaderRecompilerCfgMixedContinueNonmergeExitDispatcher();
+	TestNewShaderRecompilerCfgConditionalLatchNoSelection();
+	TestNewShaderRecompilerCfgDirectConditionalLatchNoSelection();
+	TestNewShaderRecompilerCfgLoopEarlyContinuesNoSelection();
+	TestNewShaderRecompilerCfgConditionalLoopHeaderSelection();
+	TestNewShaderRecompilerCfgMultipleLoopLatches();
 	TestNewShaderRecompilerCfgDuplicateMergeStructuredSplit();
+	TestNewShaderRecompilerCfgOverlappingEarlyExitLadder();
 	TestNewShaderRecompilerCfgIrreducibleDispatcher();
 	TestNewShaderRecompilerExecMaskHelpers();
 	TestComputeShaderInputWaveSize();