HEAERS

Yxzx presumes this:
// The NVN driver buffer (index 0) is known to pack the SSBO address followed by its size.
But in MCI i`ve discovered that there are no sizes, both registers are GPU addresses (hence the 2.8gb allocation, it was an address actually)

Method could be much simpler but for safety i`ve routed both old and new worlds.

Reviewed-on: https://git.eden-emu.dev/eden-emu/eden/pulls/3206
Reviewed-by: Caio Oliveira <caiooliveirafarias0@gmail.com>
Reviewed-by: Lizzie <lizzie@eden-emu.dev>
Co-authored-by: xbzk <xbzk@eden-emu.dev>
Co-committed-by: xbzk <xbzk@eden-emu.dev>

src/core/hle/service/hle_ipc.cpp

@@ -1,8 +1,12 @@
+// SPDX-FileCopyrightText: Copyright 2025 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
 // SPDX-FileCopyrightText: Copyright 2018 yuzu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include <algorithm>
 #include <array>
+#include <cstring>
 #include <sstream>
 
 #include <boost/range/algorithm_ext/erase.hpp>
@@ -187,7 +191,7 @@ void HLERequestContext::ParseCommandBuffer(u32_le* src_cmdbuf, bool incoming) {
         buffer_w_descriptors.push_back(rp.PopRaw<IPC::BufferDescriptorABW>());
     }
 
-    const auto buffer_c_offset = rp.GetCurrentOffset() + command_header->data_size;
+    buffer_c_offset = rp.GetCurrentOffset() + command_header->data_size;
 
     if (!command_header->IsTipc()) {
         // Padding to align to 16 bytes
@@ -294,7 +298,15 @@ Result HLERequestContext::WriteToOutgoingCommandBuffer() {
     }
 
     // Write the domain objects to the command buffer, these go after the raw untranslated data.
-    // TODO(Subv): This completely ignores C buffers.
+
+    if (buffer_c_offset != 0 && !buffer_c_descriptors.empty()) {
+        constexpr u32 WORDS_PER_DESCRIPTOR = sizeof(IPC::BufferDescriptorC) / sizeof(u32);
+        u32 descriptor_offset = buffer_c_offset;
+        for (const auto& descriptor : buffer_c_descriptors) {
+            std::memcpy(&cmd_buf[descriptor_offset], &descriptor, sizeof(descriptor));
+            descriptor_offset += WORDS_PER_DESCRIPTOR;
+        }
+    }
 
     if (GetManager()->IsDomain()) {
         current_offset = domain_offset - static_cast<u32>(outgoing_domain_objects.size());
@@ -393,10 +405,14 @@ std::size_t HLERequestContext::WriteBuffer(const void* buffer, std::size_t size,
     const bool is_buffer_b{BufferDescriptorB().size() > buffer_index &&
                            BufferDescriptorB()[buffer_index].Size()};
     const std::size_t buffer_size{GetWriteBufferSize(buffer_index)};
+    if (buffer_size == 0) {
+        LOG_WARNING(Core, "WriteBuffer target index {} has zero capacity", buffer_index);
+        return 0;
+    }
     if (size > buffer_size) {
-        LOG_CRITICAL(Core, "size ({:016X}) is greater than buffer_size ({:016X})", size,
-                     buffer_size);
-        size = buffer_size; // TODO(bunnei): This needs to be HW tested
+        LOG_WARNING(Core, "size ({:016X}) is greater than buffer_size ({:016X}); clamping",
+                    size, buffer_size);
+        size = buffer_size;
     }
 
     if (is_buffer_b) {
@@ -418,15 +434,25 @@ std::size_t HLERequestContext::WriteBuffer(const void* buffer, std::size_t size,
 
 std::size_t HLERequestContext::WriteBufferB(const void* buffer, std::size_t size,
                                             std::size_t buffer_index) const {
-    if (buffer_index >= BufferDescriptorB().size() || size == 0) {
+    if (buffer_index >= BufferDescriptorB().size()) {
+        LOG_WARNING(Core, "WriteBufferB invalid buffer index {}", buffer_index);
+        return 0;
+    }
+
+    if (size == 0) {
+        LOG_WARNING(Core, "skip empty buffer write (B)");
         return 0;
     }
 
     const auto buffer_size{BufferDescriptorB()[buffer_index].Size()};
+    if (buffer_size == 0) {
+        LOG_WARNING(Core, "WriteBufferB target index {} has zero capacity", buffer_index);
+        return 0;
+    }
     if (size > buffer_size) {
-        LOG_CRITICAL(Core, "size ({:016X}) is greater than buffer_size ({:016X})", size,
-                     buffer_size);
-        size = buffer_size; // TODO(bunnei): This needs to be HW tested
+        LOG_WARNING(Core, "size ({:016X}) is greater than buffer_size ({:016X}); clamping",
+                    size, buffer_size);
+        size = buffer_size;
     }
 
     memory.WriteBlock(BufferDescriptorB()[buffer_index].Address(), buffer, size);
@@ -435,15 +461,25 @@ std::size_t HLERequestContext::WriteBufferB(const void* buffer, std::size_t size
 
 std::size_t HLERequestContext::WriteBufferC(const void* buffer, std::size_t size,
                                             std::size_t buffer_index) const {
-    if (buffer_index >= BufferDescriptorC().size() || size == 0) {
+    if (buffer_index >= BufferDescriptorC().size()) {
+        LOG_WARNING(Core, "WriteBufferC invalid buffer index {}", buffer_index);
+        return 0;
+    }
+
+    if (size == 0) {
+        LOG_WARNING(Core, "skip empty buffer write (C)");
         return 0;
     }
 
     const auto buffer_size{BufferDescriptorC()[buffer_index].Size()};
+    if (buffer_size == 0) {
+        LOG_WARNING(Core, "WriteBufferC target index {} has zero capacity", buffer_index);
+        return 0;
+    }
     if (size > buffer_size) {
-        LOG_CRITICAL(Core, "size ({:016X}) is greater than buffer_size ({:016X})", size,
-                     buffer_size);
-        size = buffer_size; // TODO(bunnei): This needs to be HW tested
+        LOG_WARNING(Core, "size ({:016X}) is greater than buffer_size ({:016X}); clamping",
+                    size, buffer_size);
+        size = buffer_size;
     }
 
     memory.WriteBlock(BufferDescriptorC()[buffer_index].Address(), buffer, size);
@@ -473,12 +509,20 @@ std::size_t HLERequestContext::GetWriteBufferSize(std::size_t buffer_index) cons
         ASSERT_OR_EXECUTE_MSG(
             BufferDescriptorB().size() > buffer_index, { return 0; },
             "BufferDescriptorB invalid buffer_index {}", buffer_index);
-        return BufferDescriptorB()[buffer_index].Size();
+        const auto size = BufferDescriptorB()[buffer_index].Size();
+        if (size == 0) {
+            LOG_WARNING(Core, "BufferDescriptorB index {} has zero size", buffer_index);
+        }
+        return size;
     } else {
         ASSERT_OR_EXECUTE_MSG(
             BufferDescriptorC().size() > buffer_index, { return 0; },
             "BufferDescriptorC invalid buffer_index {}", buffer_index);
-        return BufferDescriptorC()[buffer_index].Size();
+        const auto size = BufferDescriptorC()[buffer_index].Size();
+        if (size == 0) {
+            LOG_WARNING(Core, "BufferDescriptorC index {} has zero size", buffer_index);
+        }
+        return size;
     }
     return 0;
 }

src/core/hle/service/hle_ipc.h

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
 // SPDX-FileCopyrightText: Copyright 2018 yuzu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -422,6 +425,7 @@ private:
     u32 data_payload_offset{};
     u32 handles_offset{};
     u32 domain_offset{};
+    u32 buffer_c_offset{};
 
     std::weak_ptr<SessionRequestManager> manager{};
     bool is_deferred{false};

src/video_core/buffer_cache/buffer_cache.h

@@ -1705,21 +1705,26 @@ Binding BufferCache<P>::StorageBufferBinding(GPUVAddr ssbo_addr, u32 cbuf_index,
         return NULL_BINDING;
     }
 
+    // xbzk: New size logic. Fixes MCI.
+    // If ever the * comment below prove wrong, the 'if' block may be removed.
     const auto size = [&]() {
         const bool is_nvn_cbuf = cbuf_index == 0;
-        // The NVN driver buffer (index 0) is known to pack the SSBO address followed by its size.
         if (is_nvn_cbuf) {
-            const u32 ssbo_size = gpu_memory->Read<u32>(ssbo_addr + 8);
-            if (ssbo_size != 0) {
-                return ssbo_size;
+            // * The NVN driver buffer (index 0) is known to pack the SSBO address followed by its size.
+            const u64 next_qword = gpu_memory->Read<u64>(ssbo_addr + 8);
+            const u32 upper_32 = static_cast<u32>(next_qword >> 32);
+            // Hardware-based detection: GPU addresses have non-zero upper bits
+            if (upper_32 == 0) {
+                // This is a size field, not a GPU address
+                return static_cast<u32>(next_qword);  // Return lower_32
             }
         }
-        // Other titles (notably Doom Eternal) may use STG/LDG on buffer addresses in custom defined
-        // cbufs, which do not store the sizes adjacent to the addresses, so use the fully
-        // mapped buffer size for now.
+        // Fall through: either not NVN cbuf (Doom Eternal & +), or NVN but ssbo_addr+8 is a GPU address (MCI)
         const u32 memory_layout_size = static_cast<u32>(gpu_memory->GetMemoryLayoutSize(gpu_addr));
+        // Cap at 8MB to prevent allocator overflow from misinterpreted addresses
         return (std::min)(memory_layout_size, static_cast<u32>(8_MiB));
     }();
+
     // Alignment only applies to the offset of the buffer
     const u32 alignment = runtime.GetStorageBufferAlignment();
     const GPUVAddr aligned_gpu_addr = Common::AlignDown(gpu_addr, alignment);