Skip to content

fix(shader): link a table call whose descriptor load sits before its loop #7413

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adriadam10 merged 2 commits into from
Oct 19, 2026
Merged

fix(shader): link a table call whose descriptor load sits before its loop #7413

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
499e2db
fix(shader): link a table call whose descriptor load sits before its …
thuanquang Oct 18, 2026
cc69016
fix(shader): follow long branches in the hoisted descriptor search
thuanquang Oct 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions core/libs/prx/libSceAgcDriver/tests/execution/ComputeTableCalls.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ alignas(256) constexpr std::array<std::uint32_t, 64> Caller{
0x7e020280u, 0xf4080400u, 0xfa000000u, 0x8f148402u, 0xbf8cc07fu, 0xf4280208u, 0x28000000u, 0xbf8cc07fu,
0xbe8e0308u, 0xbe8f0309u, 0xbf068103u, 0xbe8e210eu, 0x34040082u, 0xe0701000u, 0x80010102u, 0xbf810000u,
0xbf9f0000u, 0x30306c73u, 0x00000040u, 0x00000008u};
alignas(256) constexpr std::array<std::uint32_t, 64> HoistedCaller{
0x7e020280u, 0xf4080400u, 0xfa000000u, 0xbf8cc07fu, 0xbf068203u, 0xbf850001u, 0x7e020280u, 0x8f148402u,
0xf4280208u, 0x28000000u, 0xbf8cc07fu, 0xbe8e0308u, 0xbe8f0309u, 0xbf068103u, 0xbe8e210eu, 0x34040082u,
0xe0701000u, 0x80010102u, 0xbf810000u, 0xbf9f0000u, 0x30306c73u, 0x00000040u, 0x00000008u};
alignas(256) constexpr std::array<std::uint32_t, 3> SelectSixteen{0x85159091u, 0x7e020215u, 0xbe80200eu};
alignas(256) constexpr std::array<std::uint32_t, 3> SelectThirtyTwo{0x8515a0a1u, 0x7e020215u, 0xbe80200eu};
alignas(16) std::array<std::uint32_t, 8> Table{};
Expand All @@ -49,7 +53,7 @@ std::array<std::uint32_t, 8> UserData(std::uint32_t index, bool scc) {
static_cast<std::uint32_t>(output), static_cast<std::uint32_t>((output >> 32u) & 0xffffu), static_cast<std::uint32_t>(sizeof(Output)), 0x31016facu};
}

std::vector<std::uint32_t> Commands(const std::array<std::uint32_t, 8>& data, bool wave32) {
std::vector<std::uint32_t> Commands(const std::array<std::uint32_t, 8>& data, bool wave32, const std::uint32_t* caller) {
std::vector<std::uint32_t> words;
const auto registers = [&](std::uint32_t first, std::span<const std::uint32_t> values) {
words.push_back(0xc0007600u | (static_cast<std::uint32_t>(values.size()) << 16u));
Expand All @@ -58,7 +62,7 @@ std::vector<std::uint32_t> Commands(const std::array<std::uint32_t, 8>& data, bo
};
const std::array<std::uint32_t, 3> shape{Threads, 1, 1};
registers(0x207, shape);
const auto address = reinterpret_cast<std::uintptr_t>(Caller.data());
const auto address = reinterpret_cast<std::uintptr_t>(caller);
const std::array<std::uint32_t, 2> program{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u)};
registers(0x20c, program);
const std::array<std::uint32_t, 1> resource{static_cast<std::uint32_t>(data.size()) << 1u};
Expand Down Expand Up @@ -105,9 +109,9 @@ class StderrCapture {
int saved = -1;
};

std::string Dispatch(std::uint32_t index, bool scc, bool wave32) {
std::string Dispatch(std::uint32_t index, bool scc, bool wave32, const std::uint32_t* caller = Caller.data()) {
Output.fill(Untouched);
const auto words = Commands(UserData(index, scc), wave32);
const auto words = Commands(UserData(index, scc), wave32, caller);
Packet packet{const_cast<std::uint32_t*>(words.data()), static_cast<std::uint32_t>(words.size()), 0, {}};
StderrCapture log;
std::string failure;
Expand All @@ -121,8 +125,8 @@ std::string Dispatch(std::uint32_t index, bool scc, bool wave32) {
return log.Finish() + failure;
}

void Check(std::uint32_t index, bool scc, bool wave32, std::uint32_t expected, const std::string& what) {
const auto log = Dispatch(index, scc, wave32);
void Check(std::uint32_t index, bool scc, bool wave32, std::uint32_t expected, const std::string& what, const std::uint32_t* caller = Caller.data()) {
const auto log = Dispatch(index, scc, wave32, caller);
Require(log.find("no linked callee") == std::string::npos, what + ": a linked callee was reported missing: " + log);
for (std::uint32_t lane = 0; lane < Threads; ++lane) {
Require(Output[lane] == expected, what + (wave32 ? " (wave32)" : " (wave64)") + ": lane " + std::to_string(lane) + " is " + std::to_string(Output[lane]) + ", expected " + std::to_string(expected));
Expand All @@ -143,6 +147,8 @@ int main() {
Check(0u, true, wave32, 17u, "the first record's callee with SCC 1");
Check(1u, false, wave32, 32u, "the second record's callee with SCC 0");
Check(1u, true, wave32, 33u, "the second record's callee with SCC 1");
Check(0u, false, wave32, 16u, "the first record's callee through a descriptor loaded before a branch", HoistedCaller.data());
Check(1u, true, wave32, 33u, "the second record's callee through a descriptor loaded before a branch", HoistedCaller.data());
const auto log = Dispatch(2u, false, wave32);
Require(log.find("called address 0x0 at program counter") != std::string::npos && log.find("which no linked callee of that call matches") != std::string::npos,
std::string("a record past the table did not report an unlinked call") + (wave32 ? " (wave32)" : " (wave64)") + ": " + log);
Expand Down
78 changes: 78 additions & 0 deletions core/libs/tests/ScalarCall.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,6 +292,83 @@ static void CheckTableCalls() {
});
}

enum class HoistedShape { InLoop, Hoisted, SecondWriterOnArm, LoadOnArmOnly, WriterAfterCall, WriterAfterLoop, CallOnArm, ConstantPointer, SkipsNullTarget, LongBranchWriter };

static std::vector<std::uint32_t> HoistedTableCaller(HoistedShape shape) {
std::vector<std::uint32_t> code;
const auto descriptorLoad = [&] { code.insert(code.end(), {0xf4081800u, 0xfa000010u, 0xbf8cc07fu}); };
if (shape == HoistedShape::ConstantPointer) code.insert(code.end(), {0xbeea03ffu, 0xe0040000u, 0xbeeb038fu, 0xf4081835u, 0xfa000000u, 0xbf8cc07fu});
else if (shape != HoistedShape::InLoop && shape != HoistedShape::LoadOnArmOnly) descriptorLoad();
code.push_back(0xbf068002u);
code.push_back(shape == HoistedShape::LoadOnArmOnly ? 0xbf850003u : 0xbf850001u);
if (shape == HoistedShape::LoadOnArmOnly) descriptorLoad();
else code.push_back(shape == HoistedShape::SecondWriterOnArm ? 0xbee00380u : shape == HoistedShape::CallOnArm ? 0xbb1e0000u : shape == HoistedShape::LongBranchWriter ? 0xbf820000u : 0x7e020280u);
const auto arm = code.size() - 1u;
code.push_back(0xbee5037eu);
const auto loop = code.size();
code.push_back(0xbee4037eu);
if (shape == HoistedShape::InLoop) descriptorLoad();
code.insert(code.end(), {0x7ed40500u, 0x7da4006au, 0x8f6a846au, 0xf4280430u, 0xd4000000u, 0xbf8cc07fu, 0xbe8e0310u, 0xbe8f0311u, 0xbe900312u, 0xbe910313u});
if (shape == HoistedShape::SkipsNullTarget) code.insert(code.end(), {0xbf130e80u, 0xbf840001u});
code.push_back(0xbe8e210eu);
if (shape == HoistedShape::WriterAfterCall) code.push_back(0xbee10301u);
code.push_back(0x897e7e64u);
code.push_back(0xbf890000u | ((static_cast<std::uint32_t>(loop) - static_cast<std::uint32_t>(code.size()) - 1u) & 0xffffu));
code.push_back(0xbefe0365u);
if (shape == HoistedShape::WriterAfterLoop) code.push_back(0xbee00380u);
code.push_back(0xbf810000u);
if (shape == HoistedShape::CallOnArm) {
code[arm] |= static_cast<std::uint32_t>(code.size() - arm - 1u);
code.insert(code.end(), {0xbe80201eu, 0xbf9f0000u});
}
if (shape == HoistedShape::LongBranchWriter) {
code[arm] |= static_cast<std::uint32_t>(code.size() - arm - 1u);
const auto getpc = code.size() + 3u;
code.insert(code.end(), {0xf4081800u, 0xfa000020u, 0xbf8cc07fu, 0xbe841f00u, 0x8084ff04u, static_cast<std::uint32_t>((getpc - arm) * 4u), 0xbe802004u, 0xbf9f0000u});
}
return code;
}

static void CheckHoistedTableCalls() {
const std::vector<std::uint32_t> callee{0x4a0202c0u, 0xbe80200eu};
const std::vector<std::vector<TableCallee>> callees{{{0x1122334455ull, callee}}};
for (const auto shape : {HoistedShape::InLoop, HoistedShape::Hoisted, HoistedShape::SecondWriterOnArm, HoistedShape::LoadOnArmOnly, HoistedShape::WriterAfterCall, HoistedShape::WriterAfterLoop, HoistedShape::CallOnArm,
HoistedShape::ConstantPointer, HoistedShape::SkipsNullTarget, HoistedShape::LongBranchWriter}) {
const bool linkable = shape == HoistedShape::InLoop || shape == HoistedShape::Hoisted || shape == HoistedShape::WriterAfterLoop || shape == HoistedShape::ConstantPointer ||
shape == HoistedShape::SkipsNullTarget;
for (const std::uint32_t waveSize : {32u, 64u}) {
const auto code = HoistedTableCaller(shape);
const auto program = RdnaInstructionDecoder{}.Decode(code);
SwappcInfo swappc{false, 0u, 16u, waveSize};
const auto calls = FindTableCalls(program, swappc);
if (!linkable) {
Require(calls.empty());
ExpectThrow("not statically resolvable", [&] { static_cast<void>(BuildCode(code, swappc)); });
continue;
}
const bool constant = shape == HoistedShape::ConstantPointer;
Require(calls.size() == 1u && calls[0].userDataRegister == 0u && calls[0].descriptorOffset == (constant ? 0u : 0x10u) && calls[0].entryOffset == 0u && calls[0].entryStride == 16u);
Require(calls[0].constantPointer == (constant ? std::optional<std::uint64_t>(0xfe0040000ull) : std::nullopt));
const auto linked = LinkCalls(program, {}, {}, calls, callees);
swappc.linkedCallFallbacks = linked.fallbacks;
static_cast<void>(TranslateCode(linked.code, swappc));
}
}
const std::vector<std::uint32_t> calledEntry{
0xf4081800u, 0xfa000000u, 0xbf8cc07fu, 0xbb1e0001u, 0xbf810000u, 0xbf840003u, 0xf4081800u, 0xfa000010u,
0xbf8cc07fu, 0xf4280430u, 0xfa000000u, 0xbf8cc07fu, 0xbe8e0310u, 0xbe8f0311u, 0xbe8e210eu, 0xbe80201eu, 0xbf9f0000u};
Require(FindTableCalls(RdnaInstructionDecoder{}.Decode(calledEntry), SwappcInfo{false, 0u, 16u}).empty());
const std::vector<std::uint32_t> fallsIntoEntry{
0xbf840002u, 0xbb1e0003u, 0xbf810000u, 0xf4081800u, 0xfa000010u, 0xbf8cc07fu, 0xf4280430u, 0xfa000000u,
0xbf8cc07fu, 0xbe8e0310u, 0xbe8f0311u, 0xbe8e210eu, 0xbe80201eu, 0xbf9f0000u};
Require(FindTableCalls(RdnaInstructionDecoder{}.Decode(fallsIntoEntry), SwappcInfo{false, 0u, 16u}).empty());
const std::vector<std::uint32_t> callBetween{
0xf4081800u, 0xfa000010u, 0xbf8cc07fu, 0xbb1e0007u, 0xf4280430u, 0xfa000000u, 0xbf8cc07fu, 0xbe8e0310u,
0xbe8f0311u, 0xbe8e210eu, 0xbf810000u, 0xbe80201eu, 0xbf9f0000u};
const auto between = FindTableCalls(RdnaInstructionDecoder{}.Decode(callBetween), SwappcInfo{false, 0u, 16u});
Require(between.size() == 1u && between[0].descriptorOffset == 0x10u);
}

static void CheckRejections() {
ExpectThrow("invalid instruction boundary", [] {
Build({Call(0u, 8u, 16u), Sopp(4u, 1u)});
Expand Down Expand Up @@ -392,6 +469,7 @@ int main(int argc, char** argv) {
CheckRejections();
CheckUserDataCalls();
CheckTableCalls();
CheckHoistedTableCalls();
CheckGuards("");
} else {
Require(argc == 2);
Expand Down
47 changes: 46 additions & 1 deletion core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
#include <cstdio>
#include <initializer_list>
#include <map>
#include <optional>
#include <set>
#include <stdexcept>
#include <string>
Expand Down Expand Up @@ -1310,6 +1311,49 @@ bool loadedDword(const RdnaProgram& program, std::uint32_t reg, std::uint32_t be
return false;
}

bool reachingWriter(const RdnaProgram& program, std::uint32_t reader, std::initializer_list<std::uint32_t> indices, std::uint32_t& writer, std::uint32_t waveSize) {
std::multimap<std::uint32_t, std::uint32_t> branches;
std::set<std::uint32_t> callTargets;
for (std::uint32_t index = 0; index < program.instructions.size(); ++index) {
const auto& instruction = program.instructions[index];
std::uint32_t target = 0;
if (IsDirectBranchOpcode(instruction.op)) branches.emplace(instruction.branchTarget, index);
else if (instruction.op == RdnaOpcode::SSetpcB64 && resolveSetpcTarget(program, index, target)) branches.emplace(target, index);
else if (instruction.op == RdnaOpcode::SCallB64) callTargets.insert(instruction.branchTarget);
}
std::vector<bool> seen(program.instructions.size());
std::vector<std::uint32_t> pending;
const auto predecessors = [&](std::uint32_t index) {
if (index == 0u || callTargets.contains(program.instructions[index].programCounter)) return false;
const auto before = pending.size();
const auto op = program.instructions[index - 1u].op;
if (op != RdnaOpcode::SBranch && op != RdnaOpcode::SEndpgm && op != RdnaOpcode::SCodeEnd && op != RdnaOpcode::SSetpcB64) pending.push_back(index - 1u);
const auto [first, last] = branches.equal_range(program.instructions[index].programCounter);
for (auto branch = first; branch != last; ++branch) pending.push_back(branch->second);
return pending.size() != before;
};
if (!predecessors(reader)) return false;
std::optional<std::uint32_t> found;
while (!pending.empty()) {
const auto index = pending.back();
pending.pop_back();
if (seen[index]) continue;
seen[index] = true;
const auto& instruction = program.instructions[index];
std::uint32_t target = 0;
if (instruction.op == RdnaOpcode::SCallB64 || (instruction.op == RdnaOpcode::SSwappcB64 && resolveSetpcTarget(program, index, target))) return false;
if (std::ranges::any_of(indices, [&](std::uint32_t reg) { return writesScalar(instruction, reg, waveSize); })) {
if (found.has_value() && *found != index) return false;
found = index;
continue;
}
if (!predecessors(index)) return false;
}
if (!found.has_value()) return false;
writer = *found;
return true;
}

std::uint32_t branchWord(std::uint32_t opcode, std::size_t from, std::size_t to, const char* what) {
const auto offset = static_cast<std::int64_t>(to) - static_cast<std::int64_t>(from) - 1;
if (offset < -0x8000 || offset > 0x7fff) throw std::invalid_argument(std::string(what) + " lands out of the 16-bit branch range");
Expand Down Expand Up @@ -1453,7 +1497,8 @@ std::vector<TableCall> FindTableCalls(const RdnaProgram& program, const SwappcIn
const auto descriptor = scalarIndex(load.source0);
if (load.source0.kind != RdnaOperandKind::ScalarRegister || descriptor % 4u != 0u || load.memoryOffset >= 0x100000u || (load.memoryOffset & 3u) != 0u) continue;
std::uint32_t descriptorLoad = 0;
if (!findLastWriter(program, lowLoad, {descriptor, descriptor + 1u, descriptor + 2u, descriptor + 3u}, descriptorLoad, swappc.waveSize, reader) || !sameBlock(descriptorLoad, index)) continue;
const bool sameBlockWriter = findLastWriter(program, lowLoad, {descriptor, descriptor + 1u, descriptor + 2u, descriptor + 3u}, descriptorLoad, swappc.waveSize, reader) && sameBlock(descriptorLoad, index);
if (!sameBlockWriter && !reachingWriter(program, lowLoad, {descriptor, descriptor + 1u, descriptor + 2u, descriptor + 3u}, descriptorLoad, swappc.waveSize)) continue;
const auto& table = program.instructions[descriptorLoad];
const auto pointer = scalarIndex(table.source0);
if (table.op != RdnaOpcode::SLoadDwordx4 || !isScalar(table.destination, descriptor) || pointer == NoScalarRegister || pointer % 2u != 0u || table.source1.kind != RdnaOperandKind::Null ||
Expand Down
Loading
Loading