Phase 4: seed VBlank chain handler + add RAM write-trace

EvCB write-trace instrumentation confirmed OpenEvent is never called for any event class during boot, not only VBlank. Static ROM analysis found that the only instruction in SCPH1001.BIN that stores to the VSync counter at 0x80079D9C lives in an unrecompiled 15-instruction function at 0xBFC425BC (identified as the VBlank chain handler: increments the counter, optionally calls the user callback at *0x800DFF40). Added as a seed so the function is now compiled and present in the dispatch table. Recompile alone does not unblock the boot — no JAL, literal, or lui 0xBFC4 exists in ROM that would load this address, so the kernel registrar that enqueues it on the root-counter chain is itself missing and needs to be found (next session, via DuckStation cross-reference). Changes: - recompiler/seeds: +0xBFC425BC (vblank_chain_handler), 825 seeds total - debug_server: wtrace_range / wtrace_dump / wtrace_clear TCP commands, 1024-entry ring buffer capturing (addr, old, new, ra, width); default range 0x0000E000..0x0000E1F0 active from process start so early-boot writes are captured before a TCP client can attach - memory.c: inline bounds check + hook call in psx_write_{word,half,byte} - tools: print_wtrace.py, sample_ra.py, sample_ra_long.py, scan_f2_sites.py — investigation helpers Runtime behaviour unchanged (still hangs in VSync spin at Sony logo) — the seed is a prerequisite; the upstream registrar is the next bug. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-10-26 02:11:36 -04:00 · 2026-04-13 21:19:32 -07:00
parent 6ce012df3e
commit e8094affb4
9 changed files with 410 additions and 5 deletions
@@ -1,7 +1,7 @@
 /* AUTO-GENERATED by psxrecomp-bios --emit-full. DO NOT EDIT.
 *
 * BIOS SHA256: 71af94d1e47a68c11e8fdb9f8368040601514a42a5a399cda48c7d3bff1e99d3
- * Dispatch entries: 1043
+ * Dispatch entries: 1045
 */

 #include "cpu_state.h"
@@ -1036,6 +1036,7 @@ extern void func_1FC41ED8(CPUState* cpu);
 extern void func_1FC41F10(CPUState* cpu);
 extern void func_1FC41F54(CPUState* cpu);
 extern void func_1FC41F88(CPUState* cpu);
+extern void func_1FC41FC0(CPUState* cpu);
 extern void func_1FC42014(CPUState* cpu);
 extern void func_1FC4203C(CPUState* cpu);
 extern void func_1FC42060(CPUState* cpu);
@@ -1048,6 +1049,7 @@ extern void func_1FC42380(CPUState* cpu);
 extern void func_1FC42424(CPUState* cpu);
 extern void func_1FC424A8(CPUState* cpu);
 extern void func_1FC42540(CPUState* cpu);
+extern void func_1FC425BC(CPUState* cpu);
 extern void func_1FC425FC(CPUState* cpu);
 extern void func_1FC42640(CPUState* cpu);
 extern void func_1FC426DC(CPUState* cpu);
@@ -1063,7 +1065,7 @@ typedef struct {
    PsxRecompFunc func;
 } DispatchEntry;

-static const DispatchEntry dispatch_table[1043] = {
+static const DispatchEntry dispatch_table[1045] = {
    { 0x00000500u, func_00000500 },
    { 0x00000510u, func_00000510 },
    { 0x00000520u, func_00000520 },
@@ -2088,6 +2090,7 @@ static const DispatchEntry dispatch_table[1043] = {
    { 0x1FC41F10u, func_1FC41F10 },
    { 0x1FC41F54u, func_1FC41F54 },
    { 0x1FC41F88u, func_1FC41F88 },
+    { 0x1FC41FC0u, func_1FC41FC0 },
    { 0x1FC42014u, func_1FC42014 },
    { 0x1FC4203Cu, func_1FC4203C },
    { 0x1FC42060u, func_1FC42060 },
@@ -2100,6 +2103,7 @@ static const DispatchEntry dispatch_table[1043] = {
    { 0x1FC42424u, func_1FC42424 },
    { 0x1FC424A8u, func_1FC424A8 },
    { 0x1FC42540u, func_1FC42540 },
+    { 0x1FC425BCu, func_1FC425BC },
    { 0x1FC425FCu, func_1FC425FC },
    { 0x1FC42640u, func_1FC42640 },
    { 0x1FC426DCu, func_1FC426DC },
@@ -2127,7 +2131,7 @@ void psx_dispatch(CPUState* cpu, uint32_t addr) {
    for (;;) {
        cpu->pc = 0;
        uint32_t phys = normalize(addr);
-        int lo = 0, hi = 1043 - 1;
+        int lo = 0, hi = 1045 - 1;
        int found = 0;
        while (lo <= hi) {
            int mid = (lo + hi) / 2;
@@ -1,7 +1,7 @@
 /* AUTO-GENERATED by psxrecomp-bios --emit-full. DO NOT EDIT.
 *
 * BIOS SHA256: 71af94d1e47a68c11e8fdb9f8368040601514a42a5a399cda48c7d3bff1e99d3
- * Functions: 1043
+ * Functions: 1045
 */

 #include "cpu_state.h"
@@ -1034,6 +1034,7 @@ void func_1FC41ED8(CPUState* cpu);
 void func_1FC41F10(CPUState* cpu);
 void func_1FC41F54(CPUState* cpu);
 void func_1FC41F88(CPUState* cpu);
+void func_1FC41FC0(CPUState* cpu);
 void func_1FC42014(CPUState* cpu);
 void func_1FC4203C(CPUState* cpu);
 void func_1FC42060(CPUState* cpu);
@@ -1046,6 +1047,7 @@ void func_1FC42380(CPUState* cpu);
 void func_1FC42424(CPUState* cpu);
 void func_1FC424A8(CPUState* cpu);
 void func_1FC42540(CPUState* cpu);
+void func_1FC425BC(CPUState* cpu);
 void func_1FC425FC(CPUState* cpu);
 void func_1FC42640(CPUState* cpu);
 void func_1FC426DC(CPUState* cpu);
@@ -159730,6 +159732,62 @@ label_BFC41FA0:
    return;
 }

+void func_1FC41FC0(CPUState* cpu) {
+label_BFC41FC0:
+    psx_check_interrupts(cpu);
+    /* 0xBFC41FC0: 3C018008  lui $at, 0x8008 */
+    cpu->gpr[1] = 0x80080000u;
+    /* 0xBFC41FC4: AC249F30  sw $a0, -24784($at) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[1] + (-24784)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC41FC4u); return; } cpu->write_word(psx_addr, cpu->gpr[4]); }
+    /* 0xBFC41FC8: 3C01800E  lui $at, 0x800E */
+    cpu->gpr[1] = 0x800E0000u;
+    /* 0xBFC41FCC: 27BDFFE8  addiu $sp, $sp, -24 */
+    cpu->gpr[29] = (uint32_t)((int32_t)cpu->gpr[29] + (-24));
+    /* 0xBFC41FD0: AC20EED4  sw $zero, -4396($at) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[1] + (-4396)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC41FD0u); return; } cpu->write_word(psx_addr, cpu->gpr[0]); }
+    /* 0xBFC41FD4: AFBF0014  sw $ra, 20($sp) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[29] + (20)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC41FD4u); return; } cpu->write_word(psx_addr, cpu->gpr[31]); }
+    /* 0xBFC41FD8: 3C01800E  lui $at, 0x800E */
+    cpu->gpr[1] = 0x800E0000u;
+    /* 0xBFC41FDC: 240EFFFF  addiu $t6, $zero, -1 */
+    cpu->gpr[14] = (uint32_t)((int32_t)cpu->gpr[0] + (-1));
+    /* 0xBFC41FE0: 0C016818  jal 0xB005A060 */
+    /* 0xBFC41FE4: AC2EEED0  sw $t6, -4400($at) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[1] + (-4400)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC41FE4u); return; } cpu->write_word(psx_addr, cpu->gpr[14]); }
+    cpu->gpr[31] = 0xBFC41FE8u;
+    psx_dispatch(cpu, 0x8005A060u);
+label_BFC41FE8:
+    psx_check_interrupts(cpu);
+    /* 0xBFC41FE8: 3C042000  lui $a0, 0x2000 */
+    cpu->gpr[4] = 0x20000000u;
+    /* 0xBFC41FEC: 3C05800E  lui $a1, 0x800E */
+    cpu->gpr[5] = 0x800E0000u;
+    /* 0xBFC41FF0: 24A5EED0  addiu $a1, $a1, -4400 */
+    cpu->gpr[5] = (uint32_t)((int32_t)cpu->gpr[5] + (-4400));
+    /* 0xBFC41FF4: 0C016AEC  jal 0xB005ABB0 */
+    /* 0xBFC41FF8: 34840001  ori $a0, $a0, 0x1 */
+    cpu->gpr[4] = cpu->gpr[4] | 0x1u;
+    cpu->gpr[31] = 0xBFC41FFCu;
+    psx_dispatch(cpu, 0x8005ABB0u);
+label_BFC41FFC:
+    psx_check_interrupts(cpu);
+    /* 0xBFC41FFC: 0C016A60  jal 0xB005A980 */
+    /* 0xBFC42000: 00002021  addu $a0, $zero, $zero */
+    cpu->gpr[4] = cpu->gpr[0] + cpu->gpr[0];
+    cpu->gpr[31] = 0xBFC42004u;
+    psx_dispatch(cpu, 0x8005A980u);
+label_BFC42004:
+    psx_check_interrupts(cpu);
+    /* 0xBFC42004: 8FBF0014  lw $ra, 20($sp) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[29] + (20)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC42004u); return; } cpu->gpr[31] = cpu->read_word(psx_addr); }
+    /* 0xBFC42008: 27BD0018  addiu $sp, $sp, 24 */
+    cpu->gpr[29] = (uint32_t)((int32_t)cpu->gpr[29] + (24));
+    /* 0xBFC4200C: 03E00008  jr $ra */
+    /* 0xBFC42010: 00000000  nop */
+    /* nop */
+    return;
+}
+
 void func_1FC42014(CPUState* cpu) {
 label_BFC42014:
    psx_check_interrupts(cpu);
@@ -160662,6 +160720,50 @@ label_BFC425AC:
    return;
 }

+void func_1FC425BC(CPUState* cpu) {
+label_BFC425BC:
+    psx_check_interrupts(cpu);
+    /* 0xBFC425BC: 3C0E8008  lui $t6, 0x8008 */
+    cpu->gpr[14] = 0x80080000u;
+    /* 0xBFC425C0: 8DCE9D9C  lw $t6, -25188($t6) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[14] + (-25188)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC425C0u); return; } cpu->gpr[14] = cpu->read_word(psx_addr); }
+    /* 0xBFC425C4: 3C02800E  lui $v0, 0x800E */
+    cpu->gpr[2] = 0x800E0000u;
+    /* 0xBFC425C8: 8C42FF40  lw $v0, -192($v0) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[2] + (-192)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC425C8u); return; } cpu->gpr[2] = cpu->read_word(psx_addr); }
+    /* 0xBFC425CC: 27BDFFE8  addiu $sp, $sp, -24 */
+    cpu->gpr[29] = (uint32_t)((int32_t)cpu->gpr[29] + (-24));
+    /* 0xBFC425D0: 3C018008  lui $at, 0x8008 */
+    cpu->gpr[1] = 0x80080000u;
+    /* 0xBFC425D4: 25CF0001  addiu $t7, $t6, 1 */
+    cpu->gpr[15] = (uint32_t)((int32_t)cpu->gpr[14] + (1));
+    /* 0xBFC425D8: AFBF0014  sw $ra, 20($sp) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[29] + (20)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC425D8u); return; } cpu->write_word(psx_addr, cpu->gpr[31]); }
+    /* 0xBFC425DC: 10400003  beq $v0, $zero, 0xBFC425EC */
+    uint32_t psx_brA_BFC425DC = cpu->gpr[2]; uint32_t psx_brB_BFC425DC = cpu->gpr[0];
+    int psx_taken_BFC425DC = (psx_brA_BFC425DC == psx_brB_BFC425DC);
+    /* 0xBFC425E0: AC2F9D9C  sw $t7, -25188($at) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[1] + (-25188)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC425E0u); return; } cpu->write_word(psx_addr, cpu->gpr[15]); }
+    if (psx_taken_BFC425DC) goto label_BFC425EC;
+label_BFC425E4:
+    psx_check_interrupts(cpu);
+    /* 0xBFC425E4: 0040F809  jalr $ra, $v0 */
+    /* 0xBFC425E8: 00000000  nop */
+    /* nop */
+    cpu->gpr[31] = 0xBFC425ECu;
+    psx_dispatch(cpu, cpu->gpr[2]);
+label_BFC425EC:
+    psx_check_interrupts(cpu);
+    /* 0xBFC425EC: 8FBF0014  lw $ra, 20($sp) */
+    { uint32_t psx_addr = (uint32_t)((int32_t)cpu->gpr[29] + (20)); if (psx_addr & 3u) { psx_unaligned_access(cpu, psx_addr, 0xBFC425ECu); return; } cpu->gpr[31] = cpu->read_word(psx_addr); }
+    /* 0xBFC425F0: 27BD0018  addiu $sp, $sp, 24 */
+    cpu->gpr[29] = (uint32_t)((int32_t)cpu->gpr[29] + (24));
+    /* 0xBFC425F4: 03E00008  jr $ra */
+    /* 0xBFC425F8: 00000000  nop */
+    /* nop */
+    return;
+}
+
 void func_1FC425FC(CPUState* cpu) {
 label_BFC425FC:
    psx_check_interrupts(cpu);