agc: break the graphics boot blocker — real sceAgcCreateShader + shader-derived pipeline state

[mattias800]

What

Resolves the libSceAgc boot blocker (the CreateWorkload register-context null-deref chain 0x3b5ea6 → 0x3b1562 → 0x3b1533) that docs/GRAPHICS.md had parked as "SDK-gated." No SDK headers needed — and no fabricated objects: the game supplies everything itself.

Root cause

The null "register source" global [eboot+0x2048c60] is slot+0x10 of Unity's built-in shader registry (~30 0x28-byte slots). At graphics init, eboot+0x14e74c0 parses shader ELFs embedded in eboot rodata (EM_AMDGPU, .shader_header/.shader_text) and calls sceAgcCreateShader(&slot->shader, header, code) per shader. Our stub returned 0 without writing *dst → every slot stayed null → SetSource fed null into the register-context sub-objects. The earlier "no writer exists" static scan missed the store because it goes through a register base (slot+0x10), not the literal address — the RGCTX blind spot again.

Key insight: the register-source object IS the SDK Shader (SetSource reads +0x08 user_data / +0x28 specials / +0x5a type). The classify tables ship inside the game's own shader blobs.

Implemented (hle_agc.cpp)

NID	Function	Notes
f3dg2CSgRKY	sceAgcCreateShader	relocates self-relative header ptrs, binds code, patches SPI/COMPUTE_PGM_LO/HI (all 5 stage pairs — Kyty supports only ES/PS and aborts otherwise), double-relocation guard, host-side registry prosper_agc_shader_count() for the AGC→Vulkan pipeline
V++UgBtQhn0	sceAgcGetDataPacketPayloadAddress	register banks [sub+0x10]/[sub+0x18] = Dcb data-packet payloads
n2fD4A+pb+g	sceAgcCbSetShRegisterRangeDirect	IT_SET_SH_REG range packet + the real lib's marker NOP
D9sr1xGUriE	sceAgcCreatePrimState	prim registers from gs specials; logs (not aborts) on tessellation
HV4j+E0MBHE	sceAgcCreateInterpolantMapping	generalized semantic matching for SPI_PS_INPUT_CNTL_* (Kyty hard-asserts identity layout)

Semantics per Kyty (MIT) but layout-verified against this title's blobs and eboot disassembly — note the game passes AGC interface version 13 vs Kyty's 8, so Kyty was treated as a reference, not ground truth.

Result

• All 36 built-in shaders register (PROSPER_GFXLOG: pgm_patched=1 each)
• Zero unimplemented libSceAgc calls remain in the boot
• Boot advances far past graphics init; next fault is a separate frontier at eboot+0xba6e08 (addr=0x8, non-AGC backtrace through 0xd3xxxx/0x15fxxxx) — will chase next
• Tests 20/20 green (WSL2)

For the back-half pipeline (heads-up @recompiler-agent)

• prosper_agc_shader_count() + the internal shader registry give you header+code pointers for every game shader — the .shader_text payloads are real gfx1030 streams for the recompiler
• The register banks now fill with real values inside the game's own Dcb data packets — your CommandProcessor will start seeing real SET_*_REG traffic once the boot reaches submits
• New tool: imgdump <module> <out.img> (flat image for objdump -b binary offline disassembly)

🤖 Generated with Claude Code