From 2e5004d2a32dbf29c798a4915313d881f9c16b6d Mon Sep 17 00:00:00 2001 From: klosixgaming-arch Date: Mon, 19 Oct 2026 07:09:47 -0500 Subject: [PATCH 1/2] fix(shader): resolve table column pointers through Phi nodes --- .../libSceAgcDriver/tests/ShaderMemory.cpp | 42 +++++++++++++++++ .../Optimization/src/ResourceTracker.cpp | 46 ++++++++++++++++++- 2 files changed, 87 insertions(+), 1 deletion(-) diff --git a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp index e788638438..058046a306 100644 --- a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp @@ -3042,6 +3042,18 @@ void verifyPointerImageTable() { require(!TableTouched(narrowTable.regions, root + (Palette + 32u) / 4u, 32u) && !TableTouched(narrowTable.regions, root + Committed / 4u, Reserved - Committed), "pointer image table: a record outside the key domain was read"); const std::vector> narrowReads{{base + Palette, 32u}, {base + Palette + 2u * 32u, 32u}, {base + Palette + 255u * 32u, 32u}, {base + Palette + 0x102u * 32u, 32u}}; require(narrowSnapshot.readRanges == narrowReads && narrowTable.result->imageTableReadRanges.size() == 1u && narrowTable.result->imageTableReadRanges[0] == narrowReads, "pointer image table: consumed ranges include skipped keys or the key-domain buffer"); + + auto phiCode = maskedCode; + phiCode.erase(phiCode.begin() + 8, phiCode.begin() + 10); + phiCode.insert(phiCode.begin() + 8, { + 0xbf068010u, 0xbf850003u, 0xf4200444u, 0x20000000u, 0xbf820002u, 0xf4200444u, 0x20000000u + }); + const auto phiRequest = request(phiCode, 0x36000u); + const auto phiPlan = GetResourcePlan(phiRequest); + require(phiPlan->info.images.size() == 1u && phiPlan->info.images[0].table == 0u, "pointer image table: a pointer read through a phi was not planned as a table"); + const auto phiTable = CompileTable(phiRequest); + require(phiTable.capture->snapshot.tables.tables.at(0).codes == snapshot.codes, "pointer image table: a pointer read through a phi captured different records"); + keys = {}; #ifdef _WIN32 VirtualFree(block, 0, MEM_RELEASE); @@ -3445,6 +3457,36 @@ void verifyPointerChainImageTable() { static_cast(ValidateAndOptimizeSpirv(compiled.result->spirv, request.target.vulkanVersion, request.target.spirvVersion)); #endif store(links[1].data() + 4u, address(descriptors[1].data())); + + auto phiCode = code; + phiCode.erase(phiCode.begin() + 15, phiCode.begin() + 17); + phiCode.insert(phiCode.begin() + 15, { + 0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xf4240b02u, 0x24000008u + }); + auto phiRequest = TableRequest(phiCode, userData); + phiRequest.shader.codeAddress = 0x38000u; + const auto phiPlan = GetResourcePlan(phiRequest); + require(phiPlan->info.images.size() == 1u && phiPlan->info.images[0].table == 0u, "pointer chain image table: a pointer read through a phi was not planned as a table"); + const auto phiTable = CompileTable(phiRequest); + require(phiTable.capture->snapshot.tables.tables.at(0).codes == snapshot.codes, "pointer chain image table: a pointer read through a phi captured different records"); + + auto divergentCode = code; + divergentCode.erase(divergentCode.begin() + 15, divergentCode.begin() + 17); + divergentCode.insert(divergentCode.begin() + 15, { + 0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xf4240b02u, 0x24000018u + }); + auto divergentRequest = TableRequest(divergentCode, userData); + divergentRequest.shader.codeAddress = 0x39000u; + expectFailure([&] { static_cast(GetResourcePlan(divergentRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi reading different table offsets was planned as a table"); + + auto nonTableCode = code; + nonTableCode.erase(nonTableCode.begin() + 15, nonTableCode.begin() + 17); + nonTableCode.insert(nonTableCode.begin() + 15, { + 0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xbe960380u, 0xbe970380u + }); + auto nonTableRequest = TableRequest(nonTableCode, userData); + nonTableRequest.shader.codeAddress = 0x3a000u; + expectFailure([&] { static_cast(GetResourcePlan(nonTableRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi with a non-table branch was planned as a table"); } void verifyDescriptorPhis() { diff --git a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp index 7306a87c0e..ceb8017633 100644 --- a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp +++ b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp @@ -691,6 +691,47 @@ private: return true; } + IrValue* UnwrapTableRead(IrValue* value) const { + if (value == nullptr) return nullptr; + value = value->Resolve(); + if (!value->IsPhi()) return value; + IrValue* candidate = nullptr; + std::vector pending{value}; + std::unordered_set visited; + while (!pending.empty()) { + auto* current = pending.back()->Resolve(); + pending.pop_back(); + if (!visited.insert(current).second) continue; + if (current->IsPhi()) { + for (std::size_t i = 0; i < current->ArgumentCount(); i++) { + pending.push_back(current->Argument(i)); + } + continue; + } + std::uint32_t memoryIndex = 0; + IrValue* key = nullptr; + std::uint32_t stride = 0; + std::uint32_t addend = 0; + if (ScalarReadMemory(*current, memoryIndex) == nullptr || !MemoryIndexBelongsTo(memoryIndex, *current) || + !MatchAffineOffset(current->Argument(1), key, stride, addend)) { + return nullptr; + } + if (candidate == nullptr) { + candidate = current; + } else if (!EquivalentValue(m_program.Resources(), candidate, current)) { + std::uint32_t candidateIndex = 0; + const auto* candMem = ScalarReadMemory(*candidate, candidateIndex); + const auto* curMem = ScalarReadMemory(*current, memoryIndex); + if (candMem == nullptr || curMem == nullptr || candMem->offset != curMem->offset || + !EquivalentValue(m_program.Resources(), candidate->Argument(0), current->Argument(0)) || + !EquivalentValue(m_program.Resources(), candidate->Argument(1), current->Argument(1))) { + return nullptr; + } + } + } + return candidate; + } + bool TryMakeIndirectColumn(IrValue& handle, IrValue& descriptorPointer, bool sampler, std::uint32_t words, std::uint32_t descriptorOffset, std::uint32_t descriptorImmediate, TableColumnPlan& plan) { std::vector hops; IrValue* pointer = &descriptorPointer; @@ -728,7 +769,10 @@ private: IrValue* offset = nullptr; std::uint32_t first = 0; for (std::uint32_t dword = 0; dword < 2u; dword++) { - IrValue* read = pointer->Argument(dword)->Resolve(); + IrValue* read = UnwrapTableRead(pointer->Argument(dword)); + if (read == nullptr) { + return false; + } std::uint32_t memoryIndex = 0; const MemoryInfo* memory = ScalarReadMemory(*read, memoryIndex); if (memory == nullptr || !MemoryIndexBelongsTo(memoryIndex, *read)) { From 64675a3756f3614ab33bf7664704f25183d9ca21 Mon Sep 17 00:00:00 2001 From: klosixgaming-arch Date: Wed, 21 Oct 2026 17:22:39 +0000 Subject: [PATCH 2/2] fix(shader): require the phi arm table offset to dominate the table read When a table column pointer is read through a phi, the offset taken from one arm is substituted into the image handle after the merge. An offset computed inside an arm does not dominate that use, so planning now refuses it instead of producing an invalid module. Adds a case where each arm computes its own offset; it plans as a table on the previous head and is refused with this change. AI-assisted: yes. Written with AI assistance and reviewed by me. --- .../libSceAgcDriver/tests/ShaderMemory.cpp | 9 +++++++ .../Optimization/src/ResourceTracker.cpp | 24 +++++++++++++++++++ 2 files changed, 33 insertions(+) diff --git a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp index 058046a306..cc24a594d9 100644 --- a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp +++ b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp @@ -3487,6 +3487,15 @@ void verifyPointerChainImageTable() { auto nonTableRequest = TableRequest(nonTableCode, userData); nonTableRequest.shader.codeAddress = 0x3a000u; expectFailure([&] { static_cast(GetResourcePlan(nonTableRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi with a non-table branch was planned as a table"); + + auto armOffsetCode = code; + armOffsetCode.erase(armOffsetCode.begin() + 14, armOffsetCode.begin() + 17); + armOffsetCode.insert(armOffsetCode.begin() + 14, { + 0xbf068010u, 0xbf850004u, 0x8f128411u, 0xf4240b02u, 0x24000008u, 0xbf820003u, 0x8f128411u, 0xf4240b02u, 0x24000008u + }); + auto armOffsetRequest = TableRequest(armOffsetCode, userData); + armOffsetRequest.shader.codeAddress = 0x3b000u; + expectFailure([&] { static_cast(GetResourcePlan(armOffsetRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi whose arms compute their own table offset was planned as a table"); } void verifyDescriptorPhis() { diff --git a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp index ceb8017633..04d2be4845 100644 --- a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp +++ b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp @@ -732,6 +732,27 @@ private: return candidate; } + bool BlockDominates(const IrBlock* dominator, const IrBlock* block) const { + if (dominator == block) return true; + std::vector pending{block}; + std::unordered_set visited{block}; + while (!pending.empty()) { + const IrBlock* current = pending.back(); + pending.pop_back(); + if (current->Predecessors().empty()) return false; + for (const IrBlock* predecessor : current->Predecessors()) { + if (predecessor != dominator && visited.insert(predecessor).second) pending.push_back(predecessor); + } + } + return true; + } + + bool AvailableAt(IrValue* value, const IrBlock* block) const { + value = value->Resolve(); + if (value->HasImmediate() || value->Parent() == nullptr) return true; + return BlockDominates(value->Parent(), block); + } + bool TryMakeIndirectColumn(IrValue& handle, IrValue& descriptorPointer, bool sampler, std::uint32_t words, std::uint32_t descriptorOffset, std::uint32_t descriptorImmediate, TableColumnPlan& plan) { std::vector hops; IrValue* pointer = &descriptorPointer; @@ -786,6 +807,9 @@ private: return false; } } + if (!AvailableAt(offset, handle.Parent())) { + return false; + } IrValue* key = nullptr; std::uint32_t stride = 0; std::uint32_t addend = 0;