fix(gta): restore wiped GTA foundation and gameplay path (PPSA04264) (#650)

* fix(kernel): implement APR ResolveFilepathsWithPrefixToIdsAndFileSizes Resource streamers resolve relative paths against a shared prefix; without this HLE every call returned NOT_FOUND and assets never got real ids/sizes. * fix(remoteplay): stub Initialize and GetConnectionStatus as disconnected Titles probe Remote Play during pad/network bring-up; unresolved imports returned NOT_FOUND. Report initialized + disconnected so callers take the normal offline path. * fix(agc): accept Gen5 hull shaders that omit PGM_LO/HI in CreateShader Type-5 headers can start with RSRC1/RSRC2; rejecting them left null handles and Main Thread AVs. Scan the SH table and skip PGM patch when absent. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(kernel): reject getdents on file fds and emit . / .. for empty dirs Returning rax=0 for non-directory or empty listings looked like EOF and let GTA treat the fd as a pointer (fiWriteAsyncDataWorker AV at 0xB1). * fix(hle): enable GuestImageWriteTracker CPU sync on Windows Windows previously hard-disabled the tracker, so CPU-written guest planes never marked dirty and host textures stayed empty. Arm pages with VirtualProtect, handle write AVs in VEH, and warm/test on VirtualAlloc memory so protect cannot poison the CRT heap. * fix(agc): skip CB metadata draws for EliminateFastClear/Fmask/DCC CB_COLOR_CONTROL modes 2/5/6 are colour-buffer metadata ops; applying the bound shader as a normal colour draw corrupts subsequent composites. Decode MODE from bits [6:4] and return before translate. * fix(agc): merge Prospero attrib-table formats onto IR vertex inputs IR-discovered BufferLoadFormat often keeps a stale float sharp format; patch DataFormat/offset from the AGC attrib table (semantic index), allow offen fetches, and map quirks 113/121 through NarrowVk for host vertex input. * fix(audio): harden AudioOut2 stack out-buffer writes against canary smash Titles that stack-allocate AudioOut2 outs next to the frame canary were corrupted by oversized or mistyped HLE writes; keep ContextPush pacing. * Revert "fix(memory): reserve only large regions (#608)" This reverts commit 8f9456229a. * fix(gpu): decode Gen5 R16 and RG32 render-target formats * fix(audio): AudioOut2 host beds, deeper waveOut queue, AJM MP3 GTA V Enhanced routes intro/menu audio through AudioOut2 and FMOD's AJM MP3 path. Wire PortCreate/PortSetAttributes/ContextPush to dual host stereo streams, deepen WinMM queue to 128KiB, and decode AJM codec 0 with a stateful NLayer helper so menu music is not silent. * fix(agc): map PS interpolants via SPI_PS_INPUT_CNTL semantics Identity ATTR→param wiring ignored hardware remapping, so UI draws got wrong (or empty) interpolants. Pack CNTL from matched PS/GS semantics, thread it into Vulkan/Metal as Location/Flat, and fingerprint it in the graphics shader cache key. * fix(agc): rect-list/NGG strips, Index8 expand, and GE_INDX_OFFSET NGG single-rect UI needs triangle-strip expansion; Prospero Index8 must expand to host u16; glyphs need base vertex from GE_INDX_OFFSET. Skip param-less rect-lists instead of inventing colour draws. * fix(np): report GTA Story Mode addcont entitlements as owned NpEntitlementAccess was returning an empty add-on list, so GTA V Enhanced offered Buy Story Mode. Publish the installed license labels and stub premium-event registration so offline sessions take the owned path. * fix(cpu): prefer native workers for all guest entry stubs Route thread entry, continuation, and main entry through RunGuestEntryStub so guest stubs are not invoked above CLR-managed frames (UnmanagedCallersOnly FailFast). Keep requireNativeWorker for tbb_thead; other paths prefer workers with calli fallback. * fix(agc): implement Rewind/Jump writers and IT_REWIND waits GTA Subrender AVs came from AcbJumpGetSize / DcbRewind returning NOT_FOUND as packet sizes. Add IT_REWIND and INDIRECT_BUFFER writers, patch SetRewindState into the GPU wait registry, and nest-parse 4-dword jumps. * fix(gpu): use AddrLib ExactXor for Gen5 Standard256B (mode 1) Mode 5 already had Standard4K ExactXor; mode 1 still used the generic StandardSwizzle block table, which mis-detiles Gen5 UI atlases. * Revert "fix(cpu): prefer native workers for all guest entry stubs" This reverts commit 31c4db0d38. * fix(memory): commit-first large maps; reserve only on failure Replace the #608 always-reserve-only exact-map path with allocate-first and lazy reserve fallback when a huge non-exec commit cannot be satisfied. Prime and widen GetPointer commit so the fallback path is safer for native walkers. Drops the need for a hard #608 revert. * [Agc] Implement fused shader half exports * fix(agc): accept optional hull state in CreatePrimState Port the CreatePrimState hull-optional path from #583 so fused HS pipelines (GTA) are not rejected with INVALID_ARGUMENT. Geometry-derived CX/UC writes are unchanged; hull is traced only. * fix(videoout): restore thread-safe VulkanHostBufferPool (#564) The 6db095e wipe dropped CasualcoderDev's lock-ordering-safe pool. Concurrent Return/TryTake without the gate races after the first present and can hang the submit path. * Revert "fix(agc): implement Rewind/Jump writers and IT_REWIND waits" This reverts commit bec77bf083. * test(memory): align lazy-commit expectations with commit-first policy Fake hosts must reject Allocate so reserve-only paths still run, and GetPointer asserts the 32 MiB prime range including AlignUp spill. * diag(gpu): log guest-queue backlog breakdown under backpressure Rate-limit top work types and ordered debugName prefixes when the Vulkan guest work queue stalls, so North Yankton logs show acquire/label vs draw traffic instead of only VulkanOrderedGuestAction. * perf(agc): coalesce acquire flushes and batch non-DMA label wakes Flush pending ACQUIRE_MEM invalidation at draw/dispatch/dma/flip boundaries instead of before every packet, and complete release/write-data producers in the same ordered action so load paths enqueue far fewer VulkanOrderedGuestAction items. * perf(gpu): wait for ordered-action fences and keep draining sync On Windows/Linux, block briefly for queue-visibility fences instead of deferring the whole logical queue for the tick. Prefer ordered sync/flip heads under backlog pressure, and keep macOS non-blocking defer behavior. * perf(gpu): raise sync-item ceiling above payload guest-work cap Apply SHARPEMU_PENDING_GUEST_WORK_ITEMS mainly to compute/draw/image payload work, and allow a higher SHARPEMU_PENDING_GUEST_SYNC_ITEMS ceiling for zero-payload ordered actions and flip markers. Keep the byte budget as the RAM safety valve. * fix(gta): stub Voice ports and implement sceKernelCheckReachability Resolve North Yankton-path Voice Create/Delete/Connect/Disconnect/End NIDs and EnumerationThread reachability checks so leftover unresolved imports are not on the critical path. * diag(gta): arm flip/present/wait probes after North Audio Rate-limited load_progress TRACE for flip submit, ordered flip enqueue, present taken/not-taken, and GPU wait backlog so North Yankton freezes can be classified without full AGC tracing. * fix(ampr): restore sequential offset=-1 reads for streamer packs Re-wire PakDirectoryTracker into sceAmprAprCommandBufferReadFile (dropped in #216) so RAGE sequential pack reads no longer fail while the North Yankton UI keeps flipping. Also rate-limit CheckReachability miss paths for EnumerationThread diagnosis. * fix(hle/videoout): Windows GuestImage opt-in and keep GTA intro without sync Default the tracker off on Windows to avoid VirtualProtect thrash, gate AGC texel-copy skips on Enabled so guest Bink planes keep shipping pixels, and drain CPU-written images on the present thread when sync is opted in. * fix(videoout): probe guest content when tracker off so UI can skip copies Restores upload-known/texture-cache skips for Dead Cells menus, and uses a sparse guest-memory fingerprint when GuestImageWriteTracker is disabled so CPU-updated Bink planes still force texel copies for GTA intro. * fix(audio): keep 128KiB host queue AudioOut2-only Restore the default 32 KiB (~171 ms) PCM bed for classic AudioOut so titles like Dreaming Sarah stay in sync; only AudioOut2 opens the deeper queue needed for bursty FMOD Push on GTA. --------- Co-authored-by: samto6 <123419830+samto6@users.noreply.github.com>
2026-08-01 15:39:47 +08:00 · 2026-07-26 23:58:55 +01:00
parent 0535783f46
commit db4339f698
58 changed files with 7301 additions and 642 deletions
@@ -89,7 +89,8 @@ internal sealed record GuestVertexBuffer(
    uint OffsetBytes,
    byte[] Data,
    int Length,
-    bool Pooled);
+    bool Pooled,
+    bool PerInstance = false);

 internal sealed record GuestIndexBuffer(
    byte[] Data,
@@ -54,6 +54,7 @@ internal interface IGuestGpuBackend
        int scalarRegisterBufferIndex = -1,
        uint pixelInputEnable = 0,
        uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
        ulong storageBufferOffsetAlignment = 1);

    bool TryCompileComputeShader(
@@ -108,7 +109,8 @@ internal interface IGuestGpuBackend
        GuestIndexBuffer? indexBuffer = null,
        IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
        GuestRenderState? renderState = null,
-        ulong shaderAddress = 0);
+        ulong shaderAddress = 0,
+        int baseVertex = 0);

    void SubmitOffscreenTranslatedDraw(
        IGuestCompiledShader pixelShader,
@@ -124,7 +126,8 @@ internal interface IGuestGpuBackend
        IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
        GuestRenderState? renderState = null,
        GuestDepthTarget? depthTarget = null,
-        ulong shaderAddress = 0);
+        ulong shaderAddress = 0,
+        int baseVertex = 0);

    void SubmitStorageTranslatedDraw(
        IGuestCompiledShader pixelShader,
@@ -236,6 +239,12 @@ internal interface IGuestGpuBackend

    void SubmitGuestImageWrite(ulong address, byte[] pixels);

+    /// <summary>
+    /// Asks the presenter to refresh CPU-dirty guest images on its render/present
+    /// drain. Must not enqueue retained plane copies on the producer path.
+    /// </summary>
+    void RequestCpuWrittenGuestImageSync(ulong scopeAddress = 0, ulong scopeByteCount = ulong.MaxValue);
+
    bool TryGetGuestImageExtent(ulong address, out uint width, out uint height, out ulong byteCount);

    IReadOnlyList<(ulong Address, uint Width, uint Height, ulong ByteCount)> GetGuestImageExtents();
@@ -218,6 +218,13 @@ internal static class MetalGuestFormats
    {
        var format = (dataFormat, numberType) switch
        {
+            // Early G-buffer / scene targets (R16 + RG32). Keep in sync with
+            // VulkanVideoPresenter.TryDecodeRenderTargetFormat.
+            (2, 0) => MtlPixelFormat.R16Unorm,
+            (2, 1) => MtlPixelFormat.R16Snorm,
+            (2, 4) => MtlPixelFormat.R16Uint,
+            (2, 5) => MtlPixelFormat.R16Sint,
+            (2, 7) => MtlPixelFormat.R16Float,
            (4, 4) => MtlPixelFormat.R32Uint,
            (4, 5) => MtlPixelFormat.R32Sint,
            (4, 7) => MtlPixelFormat.R32Float,
@@ -230,6 +237,8 @@ internal static class MetalGuestFormats
            (10, 5) => MtlPixelFormat.Rgba8Sint,
            (10, 9) => MtlPixelFormat.Rgba8UnormSrgb,
            (10, _) => MtlPixelFormat.Rgba8Unorm,
+            (11, 4) => MtlPixelFormat.Rg32Uint,
+            (11, 5) => MtlPixelFormat.Rg32Sint,
            (11, 7) => MtlPixelFormat.Rg32Float,
            (12, 4) => MtlPixelFormat.Rgba16Uint,
            (12, 5) => MtlPixelFormat.Rgba16Sint,
@@ -258,10 +267,12 @@ internal static class MetalGuestFormats

        var outputKind = format switch
        {
-            MtlPixelFormat.R8Uint or MtlPixelFormat.R32Uint or MtlPixelFormat.Rg16Uint or
-                MtlPixelFormat.Rgba8Uint or MtlPixelFormat.Rgba16Uint => Gen5PixelOutputKind.Uint,
-            MtlPixelFormat.R32Sint or MtlPixelFormat.Rg16Sint or MtlPixelFormat.Rgba8Sint or
-                MtlPixelFormat.Rgba16Sint => Gen5PixelOutputKind.Sint,
+            MtlPixelFormat.R8Uint or MtlPixelFormat.R16Uint or MtlPixelFormat.R32Uint or
+                MtlPixelFormat.Rg16Uint or MtlPixelFormat.Rg32Uint or MtlPixelFormat.Rgba8Uint or
+                MtlPixelFormat.Rgba16Uint => Gen5PixelOutputKind.Uint,
+            MtlPixelFormat.R16Sint or MtlPixelFormat.R32Sint or MtlPixelFormat.Rg16Sint or
+                MtlPixelFormat.Rg32Sint or MtlPixelFormat.Rgba8Sint or MtlPixelFormat.Rgba16Sint =>
+                Gen5PixelOutputKind.Sint,
            _ => Gen5PixelOutputKind.Float,
        };
        result = new MetalRenderTargetFormat(format, outputKind);
@@ -70,6 +70,7 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
        int scalarRegisterBufferIndex = -1,
        uint pixelInputEnable = 0,
        uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
        ulong storageBufferOffsetAlignment = 1)
    {
        shader = null;
@@ -85,6 +86,7 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
                scalarRegisterBufferIndex,
                pixelInputEnable,
                pixelInputAddress,
+                pixelInputCntl,
                storageBufferOffsetAlignment))
        {
            return false;
@@ -251,7 +253,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
        GuestIndexBuffer? indexBuffer = null,
        IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
        GuestRenderState? renderState = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
        MetalVideoPresenter.SubmitDepthOnlyTranslatedDraw(
            Msl(pixelShader),
            textures,
@@ -265,7 +268,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
            indexBuffer,
            vertexBuffers,
            renderState,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);

    public void SubmitOffscreenTranslatedDraw(
        IGuestCompiledShader pixelShader,
@@ -281,7 +285,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
        IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
        GuestRenderState? renderState = null,
        GuestDepthTarget? depthTarget = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
        MetalVideoPresenter.SubmitOffscreenTranslatedDraw(
            Msl(pixelShader),
            textures,
@@ -296,7 +301,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
            vertexBuffers,
            renderState,
            depthTarget,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);

    public void SubmitStorageTranslatedDraw(
        IGuestCompiledShader pixelShader,
@@ -395,6 +401,9 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
    public void SubmitGuestImageWrite(ulong address, byte[] pixels) =>
        MetalVideoPresenter.SubmitGuestImageWrite(address, pixels);

+    public void RequestCpuWrittenGuestImageSync(ulong scopeAddress = 0, ulong scopeByteCount = ulong.MaxValue) =>
+        MetalVideoPresenter.RequestCpuWrittenGuestImageSync(scopeAddress, scopeByteCount);
+
    public bool TryGetGuestImageExtent(ulong address, out uint width, out uint height, out ulong byteCount) =>
        MetalVideoPresenter.TryGetGuestImageExtent(address, out width, out height, out byteCount);

@@ -1,6 +1,7 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later

+using System.Buffers.Binary;
 using SharpEmu.Libs.Agc;
 using SharpEmu.ShaderCompiler;
 using SharpEmu.ShaderCompiler.Metal;
@@ -87,7 +88,8 @@ internal static partial class MetalVideoPresenter
        uint InstanceCount,
        uint PrimitiveType,
        GuestIndexBuffer? IndexBuffer,
-        GuestRenderState RenderState);
+        GuestRenderState RenderState,
+        int BaseVertex = 0);

    private sealed record OffscreenGuestDraw(
        TranslatedGuestDraw Draw,
@@ -245,7 +247,8 @@ internal static partial class MetalVideoPresenter
        IReadOnlyList<GuestVertexBuffer>? vertexBuffers,
        GuestRenderState? renderState,
        GuestDepthTarget? depthTarget,
-        ulong shaderAddress)
+        ulong shaderAddress,
+        int baseVertex = 0)
    {
        if (targets.Count == 0)
        {
@@ -293,7 +296,8 @@ internal static partial class MetalVideoPresenter
                        instanceCount,
                        primitiveType,
                        indexBuffer,
-                        effectiveRenderState),
+                        effectiveRenderState,
+                        baseVertex),
                    ToArray(targets),
                    depthTarget,
                    PublishTarget: true,
@@ -321,7 +325,8 @@ internal static partial class MetalVideoPresenter
        GuestIndexBuffer? indexBuffer,
        IReadOnlyList<GuestVertexBuffer>? vertexBuffers,
        GuestRenderState? renderState,
-        ulong shaderAddress)
+        ulong shaderAddress,
+        int baseVertex = 0)
    {
        if (depthTarget.Address == 0 || depthTarget.Width == 0 || depthTarget.Height == 0)
        {
@@ -348,7 +353,8 @@ internal static partial class MetalVideoPresenter
                        instanceCount,
                        primitiveType,
                        indexBuffer,
-                        renderState ?? GuestRenderState.Default),
+                        renderState ?? GuestRenderState.Default,
+                        baseVertex),
                    [new GuestRenderTarget(Address: 0, depthTarget.Width, depthTarget.Height, Format: 10, NumberType: 0)],
                    depthTarget,
                    PublishTarget: false,
@@ -981,17 +987,38 @@ internal static partial class MetalVideoPresenter

    private static void EncodeDrawCall(nint encoder, TranslatedGuestDraw draw)
    {
-        var primitive = GetPrimitiveType(draw.PrimitiveType);
-        var vertexCount = draw.PrimitiveType == 0x11 && draw.IndexBuffer is null
-            ? 4u
-            : draw.VertexCount;
+        var indexed = draw.IndexBuffer is not null;
+        var hasVertexBuffers = draw.VertexBuffers.Length > 0;
+        var primitive = GetPrimitiveType(
+            draw.PrimitiveType,
+            indexed,
+            draw.VertexCount,
+            hasVertexBuffers);
+        var vertexCount = AgcPrimitiveHelpers.GetRectListDrawVertexCount(
+            draw.PrimitiveType,
+            draw.VertexCount,
+            indexed,
+            hasVertexBuffers);
+        var baseVertex = (nuint)Math.Max(draw.BaseVertex, 0);
        if (draw.IndexBuffer is { } indexBuffer)
        {
            var device = MetalNative.Send(encoder, MetalNative.Selector("device"));
            var slice = AllocateUpload(
                device, Math.Max(indexBuffer.Length, 1), out var buffer, out var offset);
-            indexBuffer.Data.AsSpan(0, Math.Min(indexBuffer.Length, indexBuffer.Data.Length))
-                .CopyTo(slice);
+            var source = indexBuffer.Data.AsSpan(
+                0,
+                Math.Min(indexBuffer.Length, indexBuffer.Data.Length));
+            // Metal drawIndexed without baseVertex: bake GE_INDX_OFFSET into
+            // the uploaded indices so glyph batches still hit the right verts.
+            if (draw.BaseVertex != 0)
+            {
+                BakeBaseVertexIntoIndices(source, slice, indexBuffer.Is32Bit, draw.BaseVertex);
+            }
+            else
+            {
+                source.CopyTo(slice);
+            }
+
            MetalNative.SendDrawIndexedPrimitives(
                encoder,
                MetalNative.Selector("drawIndexedPrimitives:indexCount:indexType:indexBuffer:indexBufferOffset:instanceCount:"),
@@ -1012,12 +1039,46 @@ internal static partial class MetalVideoPresenter
                encoder,
                MetalNative.Selector("drawPrimitives:vertexStart:vertexCount:instanceCount:"),
                primitive,
-                0,
+                baseVertex,
                vertexCount,
                Math.Max(draw.InstanceCount, 1));
        }
    }

+    private static void BakeBaseVertexIntoIndices(
+        ReadOnlySpan<byte> source,
+        Span<byte> destination,
+        bool is32Bit,
+        int baseVertex)
+    {
+        if (is32Bit)
+        {
+            var count = source.Length / sizeof(uint);
+            for (var index = 0; index < count; index++)
+            {
+                var value = BinaryPrimitives.ReadUInt32LittleEndian(
+                    source.Slice(index * sizeof(uint), sizeof(uint)));
+                var adjusted = unchecked((uint)(value + baseVertex));
+                BinaryPrimitives.WriteUInt32LittleEndian(
+                    destination.Slice(index * sizeof(uint), sizeof(uint)),
+                    adjusted);
+            }
+
+            return;
+        }
+
+        var shortCount = source.Length / sizeof(ushort);
+        for (var index = 0; index < shortCount; index++)
+        {
+            var value = BinaryPrimitives.ReadUInt16LittleEndian(
+                source.Slice(index * sizeof(ushort), sizeof(ushort)));
+            var adjusted = unchecked((ushort)(value + baseVertex));
+            BinaryPrimitives.WriteUInt16LittleEndian(
+                destination.Slice(index * sizeof(ushort), sizeof(ushort)),
+                adjusted);
+        }
+    }
+
    private static bool TryGetDrawPipeline(
        nint device,
        TranslatedGuestDraw draw,
@@ -1226,8 +1287,11 @@ internal static partial class MetalVideoPresenter
                ? vertexBuffer.Stride
                : Math.Max(vertexBuffer.ComponentCount, 1) * 4;
            MetalNative.Send(layout, MetalNative.Selector("setStride:"), (nint)stride);
-            // MTLVertexStepFunction.PerVertex = 1.
-            MetalNative.Send(layout, MetalNative.Selector("setStepFunction:"), 1);
+            // MTLVertexStepFunction: PerVertex = 1, PerInstance = 2.
+            MetalNative.Send(
+                layout,
+                MetalNative.Selector("setStepFunction:"),
+                vertexBuffer.PerInstance ? 2 : 1);
        }

        return descriptor;
@@ -2059,13 +2123,30 @@ internal static partial class MetalVideoPresenter

                return 3;
            case 6:
-            case 0x11:
                return 4;
            default:
                return 3;
        }
    }

+    private static nuint GetPrimitiveType(
+        uint guestPrimitiveType,
+        bool indexed,
+        uint vertexCount,
+        bool hasVertexBuffers)
+    {
+        if (AgcPrimitiveHelpers.ShouldDrawRectListAsTriangleStrip(
+                guestPrimitiveType,
+                indexed,
+                vertexCount,
+                hasVertexBuffers))
+        {
+            return 4; // MTLPrimitiveTypeTriangleStrip
+        }
+
+        return GetPrimitiveType(guestPrimitiveType);
+    }
+
    private static bool IsIntegerFormat(Gen5PixelOutputKind kind) =>
        kind is Gen5PixelOutputKind.Uint or Gen5PixelOutputKind.Sint;

@@ -128,6 +128,7 @@ internal static partial class MetalVideoPresenter
    private static readonly Dictionary<long, GuestImage> _guestImageVersions = new();
    private static readonly Dictionary<(int Handle, int BufferIndex), long>
        _lastOrderedGuestFlipVersions = new();
+    private static readonly Dictionary<ulong, ulong> _untrackedGuestImageContentProbes = new();
    private static long _orderedGuestFlipVersionSequence;
    private static volatile ICpuMemory? _guestMemory;

@@ -162,6 +163,22 @@ internal static partial class MetalVideoPresenter
    public static void AttachGuestMemory(ICpuMemory memory) =>
        _guestMemory = memory;

+    private static int _cpuWrittenGuestImageSyncRequested;
+    private static long _guestImageCpuSyncTraceCount;
+
+    public static void RequestCpuWrittenGuestImageSync(
+        ulong scopeAddress = 0,
+        ulong scopeByteCount = ulong.MaxValue)
+    {
+        _ = scopeAddress;
+        if (scopeByteCount == 0 || !GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        Volatile.Write(ref _cpuWrittenGuestImageSyncRequested, 1);
+    }
+
    public static long SubmitOrderedGuestAction(Action action, string debugName)
    {
        ArgumentNullException.ThrowIfNull(action);
@@ -253,8 +270,110 @@ internal static partial class MetalVideoPresenter
        }
    }

-    public static bool IsGuestImageUploadKnown(ulong address, uint format, uint numberType) =>
-        IsGuestImageAvailable(address, format, numberType);
+    public static bool IsGuestImageUploadKnown(ulong address, uint format, uint numberType)
+    {
+        var guestFormat = GetGuestTextureFormat(format, numberType);
+        if (address == 0 || guestFormat == 0)
+        {
+            return false;
+        }
+
+        ulong probeByteCount = 0;
+        lock (_gate)
+        {
+            if (!_availableGuestImages.TryGetValue(address, out var availableFormat) ||
+                availableFormat != guestFormat)
+            {
+                return false;
+            }
+
+            if (GuestImageWriteTracker.Enabled)
+            {
+                return true;
+            }
+
+            if (_guestImageExtents.TryGetValue(address, out var extent))
+            {
+                probeByteCount = extent.ByteCount;
+            }
+        }
+
+        return IsUntrackedGuestImageContentUnchanged(address, probeByteCount);
+    }
+
+    private static bool IsUntrackedGuestImageContentUnchanged(ulong address, ulong byteCount)
+    {
+        var memory = _guestMemory;
+        if (memory is null || byteCount == 0)
+        {
+            return true;
+        }
+
+        var probe = ComputeSparseGuestContentProbe(memory, address, byteCount);
+        lock (_gate)
+        {
+            if (!_untrackedGuestImageContentProbes.TryGetValue(address, out var previous))
+            {
+                _untrackedGuestImageContentProbes[address] = probe;
+                return true;
+            }
+
+            if (previous == probe)
+            {
+                return true;
+            }
+
+            _untrackedGuestImageContentProbes[address] = probe;
+            return false;
+        }
+    }
+
+    private static ulong ComputeSparseGuestContentProbe(
+        ICpuMemory memory,
+        ulong address,
+        ulong byteCount)
+    {
+        Span<byte> sample = stackalloc byte[64];
+        ulong hash = 14695981039346656037UL;
+        Span<ulong> offsets = stackalloc ulong[3];
+        var offsetCount = 0;
+        offsets[offsetCount++] = 0;
+        if (byteCount > 128)
+        {
+            offsets[offsetCount++] = byteCount / 2;
+        }
+
+        if (byteCount > 64)
+        {
+            offsets[offsetCount++] = byteCount - 64;
+        }
+
+        for (var o = 0; o < offsetCount; o++)
+        {
+            var offset = offsets[o];
+            if (offset >= byteCount)
+            {
+                continue;
+            }
+
+            var length = (int)Math.Min(64UL, byteCount - offset);
+            if (!memory.TryRead(address + offset, sample[..length]))
+            {
+                hash ^= 0x9E3779B97F4A7C15UL + offset;
+                continue;
+            }
+
+            for (var i = 0; i < length; i++)
+            {
+                hash ^= sample[i];
+                hash *= 1099511628211UL;
+            }
+
+            hash ^= (ulong)length + offset;
+        }
+
+        return hash ^ byteCount;
+    }

    public static bool GuestImageWantsInitialData(ulong address)
    {
@@ -599,7 +718,7 @@ internal static partial class MetalVideoPresenter
        var completedWork = 0;
        RecycleCompletedUploadPages();
        RecycleCompletedSnapshotResources();
-        EvictDirtyCachedDrawTextures();
+        DrainGuestImageCpuSync(device);
        try
        {
            while (completedWork < MaxGuestWorkPerRender)
@@ -45,12 +45,11 @@ internal static partial class MetalVideoPresenter
        texture.Pitch,
        texture.Sampler);

-    /// <summary>Caching requires the write tracker: without page protection a
-    /// guest CPU write would never evict the entry and draws would sample
-    /// stale texels forever. Storage textures are shader-writable on the GPU,
-    /// so their content identity is not stable either.</summary>
+    /// <summary>Storage textures are shader-writable on the GPU, so their
+    /// content identity is not stable. CPU rewrites of protected/CPU-backed
+    /// images still evict via DrainGuestImageCpuSync when those addresses
+    /// are dirty.</summary>
    private static bool IsCacheableDrawTexture(GuestDrawTexture texture) =>
-        GuestImageWriteTracker.Enabled &&
        texture.Address != 0 &&
        !texture.IsStorage &&
        !texture.IsFallback;
@@ -69,20 +68,100 @@ internal static partial class MetalVideoPresenter
        _ = MetalNative.Send(handle, MetalNative.Selector("retain"));
        _drawTextureCache[key] = handle;
        _cachedDrawTextureIdentities[key] = 0;
-        GuestImageWriteTracker.Track(
-            texture.Address,
-            (ulong)texture.RgbaPixels.Length,
-            Volatile.Read(ref _executingGuestWorkSequence),
-            "metal.texture-cache");
+        // No GuestImageWriteTracker.Track: watch-only cache registrations
+        // widened the managed-write hot path. CPU-backed / protected images
+        // own dirty notifications used for eviction.
    }

-    /// <summary>Runs once per drain, before any queued draw executes: a draw
-    /// whose texels the submit thread skipped must never resolve to an entry
-    /// the guest has since rewritten.</summary>
-    private static void EvictDirtyCachedDrawTextures()
+    /// <summary>
+    /// Single dirty consumer per drain: re-upload CPU-written guest images,
+    /// evict matching draw-texture cache entries, then re-arm once per address.
+    /// </summary>
+    private static void DrainGuestImageCpuSync(nint device)
    {
+        if (!GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        _ = Interlocked.Exchange(ref _cpuWrittenGuestImageSyncRequested, 0);
+
+        HashSet<ulong>? dirtyAddresses = null;
+        List<(ulong Address, uint Width, uint Height, ulong ByteCount)>? extents = null;
+        lock (_gate)
+        {
+            if (_guestImageExtents.Count > 0)
+            {
+                extents = new(_guestImageExtents.Count);
+                foreach (var entry in _guestImageExtents)
+                {
+                    extents.Add((
+                        entry.Key,
+                        entry.Value.Width,
+                        entry.Value.Height,
+                        entry.Value.ByteCount));
+                }
+            }
+        }
+
+        var memory = _guestMemory;
+        if (extents is not null)
+        {
+            foreach (var (address, width, height, byteCount) in extents)
+            {
+                if (!GuestImageWriteTracker.ConsumeDirty(address))
+                {
+                    continue;
+                }
+
+                (dirtyAddresses ??= []).Add(address);
+                if (memory is null ||
+                    byteCount == 0 ||
+                    byteCount > 128UL * 1024UL * 1024UL)
+                {
+                    continue;
+                }
+
+                GuestImage? image;
+                lock (_gate)
+                {
+                    _guestImages.TryGetValue(address, out image);
+                }
+
+                if (image is null)
+                {
+                    continue;
+                }
+
+                var pixels = new byte[byteCount];
+                if (!memory.TryRead(address, pixels) ||
+                    pixels.AsSpan().IndexOfAnyExcept((byte)0) < 0)
+                {
+                    continue;
+                }
+
+                ExecuteGuestImageWrite(
+                    device,
+                    queue: 0,
+                    new GuestImageWrite(address, pixels, 0));
+                if (Interlocked.Increment(ref _guestImageCpuSyncTraceCount) <= 64)
+                {
+                    Console.Error.WriteLine(
+                        $"[SYNC] cpu-write-drain addr=0x{address:X} {width}x{height}");
+                }
+            }
+        }
+
        if (_drawTextureCache.Count == 0)
        {
+            if (dirtyAddresses is not null)
+            {
+                foreach (var address in dirtyAddresses)
+                {
+                    GuestImageWriteTracker.Rearm(address);
+                }
+            }
+
            return;
        }

@@ -90,17 +169,17 @@ internal static partial class MetalVideoPresenter
        // share one source address (same texels, different samplers), and
        // ConsumeDirty clears the flag on first read — evicting only the
        // first identity would leave the others sampling stale texels.
-        HashSet<ulong>? dirtyAddresses = null;
        foreach (var entry in _drawTextureCache)
        {
-            if (dirtyAddresses is not null && dirtyAddresses.Contains(entry.Key.Address))
+            var address = entry.Key.Address;
+            if (dirtyAddresses is not null && dirtyAddresses.Contains(address))
            {
                continue;
            }

-            if (GuestImageWriteTracker.ConsumeDirty(entry.Key.Address))
+            if (GuestImageWriteTracker.ConsumeDirty(address))
            {
-                (dirtyAddresses ??= []).Add(entry.Key.Address);
+                (dirtyAddresses ??= []).Add(address);
            }
        }

@@ -118,6 +197,14 @@ internal static partial class MetalVideoPresenter

            _drawTextureCache.Clear();
            _cachedDrawTextureIdentities.Clear();
+            if (dirtyAddresses is not null)
+            {
+                foreach (var address in dirtyAddresses)
+                {
+                    GuestImageWriteTracker.Rearm(address);
+                }
+            }
+
            return;
        }

@@ -64,6 +64,7 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
        int scalarRegisterBufferIndex = -1,
        uint pixelInputEnable = 0,
        uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
        ulong storageBufferOffsetAlignment = 1)
    {
        shader = null;
@@ -79,6 +80,7 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
                scalarRegisterBufferIndex,
                pixelInputEnable,
                pixelInputAddress,
+                pixelInputCntl,
                storageBufferOffsetAlignment))
        {
            return false;
@@ -179,7 +181,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
        GuestIndexBuffer? indexBuffer = null,
        IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
        GuestRenderState? renderState = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
        VulkanVideoPresenter.SubmitDepthOnlyTranslatedDraw(
            Spirv(pixelShader),
            textures,
@@ -193,7 +196,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
            indexBuffer,
            vertexBuffers,
            renderState,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);

    public void SubmitOffscreenTranslatedDraw(
        IGuestCompiledShader pixelShader,
@@ -209,7 +213,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
        IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
        GuestRenderState? renderState = null,
        GuestDepthTarget? depthTarget = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
        VulkanVideoPresenter.SubmitOffscreenTranslatedDraw(
            Spirv(pixelShader),
            textures,
@@ -224,7 +229,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
            vertexBuffers,
            renderState,
            depthTarget,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);

    public void SubmitStorageTranslatedDraw(
        IGuestCompiledShader pixelShader,
@@ -375,6 +381,9 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
    public void SubmitGuestImageWrite(ulong address, byte[] pixels) =>
        VulkanVideoPresenter.SubmitGuestImageWrite(address, pixels);

+    public void RequestCpuWrittenGuestImageSync(ulong scopeAddress = 0, ulong scopeByteCount = ulong.MaxValue) =>
+        VulkanVideoPresenter.RequestCpuWrittenGuestImageSync(scopeAddress, scopeByteCount);
+
    public bool TryGetGuestImageExtent(ulong address, out uint width, out uint height, out ulong byteCount) =>
        VulkanVideoPresenter.TryGetGuestImageExtent(address, out width, out height, out byteCount);