Files
psxrecomp/tools/search_ram.sh
Matthew Stanley 5b3c7dd08d phase4: freeze_check diagnostic + accumulated overnight infra
Today's session work
- runtime/src/debug_server.c: freeze_check TCP cmd snapshots all liveness
  counters (PC, exception entries, exception_reentry_blocks, dirty_ram
  blocks/insns, fn_entry total + top-K histogram, SIO IRQ pending +
  countdown, sio_stat/i_stat/i_mask, mc_max_state) for tight-loop
  diagnosis when the runtime hangs
- runtime/src/debug_server.c: wtrace slot 12 covering [0x72F0..0x72F4]
  (data-byte counter); measured peak=1 confirming setup_data_phase resets
  the counter mid-cycle
- runtime/src/interrupts.c: exception_entries_total + exception_reentry_blocks
  counters + psx_get_freeze_diag accessor
- runtime/src/sio.c: sio_get_freeze_diag accessor for IRQ pacing internals
- memory entries: phase4_card_gate_setup_writes_2026_04_28 (refutes the
  prior \"missing [0x7568+slot] clearer\" framing — setup functions write
  LSB=0 directly), phase4_72f0_one_byte_per_vblank_2026_04_28 (peak=1
  measurement)

Overnight session work bundled in
- runtime/src/dirty_ram_interp.{c,h}: small MIPS interpreter for
  install-at-runtime kernel RAM stubs (Rule 18; e.g., SIO data-byte
  handler the BIOS writes to RAM 0xCF0)
- recompiler/src/full_function_emitter.{cpp,h}: 3057 jal/jalr continuation
  return labels added to dispatch table (continuation fix); branch
  fall-through fix for conditional-branch delay slots
- recompiler/src/strict_translator.cpp: matching translator updates
- generated/: regenerated SCPH1001 dispatch + full C output reflecting
  the recompiler changes
- runtime/include/debug_server.h, src/memory.c: card_txn ring + SIO IRQ
  ring + EvCB walk ring + per-PC dirty_ram counters + always-on wtrace
  coverage for [0x755A], [0x7514], [0x7528], [0x7520], [0x74A4],
  [0x75C0..C8], [0x74B8..C0]
- recompiler/tests/, runtime/tests/: SIO/card protocol unit tests
- tools/: 60+ Python diagnostic scripts (chain_trace analysis, SIO trace
  diff, EvCB walker, wtrace dumpers, etc.)
- docs/: psx_bios_disasm reference + dynamic_handler_install rationale
- OVERNIGHT_2026_04_28.md, SUMMARY_20260412_2.md: session logs

Phase 4 status (still blocked, root cause better understood)
- BIOS card chain runs through R-handlers correctly (chain_trace shows
  R1..R11 cycling 26x); shell IS retriggering _card_read
- Install handler at ROM 0xBFC15F1C increments [0x72F0] correctly per
  SIO IRQ; gate at <0x80 / <0x7F is correct
- Bottleneck: SIO IRQ countdown is access-paced, fires ~1× per VBlank
  vs ~128× needed; setup_data_phase (called from outer coord on VBlank)
  zeroes [0x72F0] before counter reaches 128
- Both attempted fixes today caused freezes:
  * VBlank deferral on [0x75C0]==1 — pending VBlank already in i_stat
    delivered anyway; tighter dispatch gate also locked up
  * Cycle-paced sio_tick at rates 50, 200 (and gated on [0x75C0]==1) —
    runtime freezes once data phase activates, root cause unidentified
- delay=5 narrows the threshold (peak=2 vs peak=1, no freeze) but
  doesn't get to 0x80
- Real fix likely requires deeper instrumentation of the freeze (call
  stack / dispatch state at the moment of TCP starvation)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 21:29:19 -07:00

58 lines
1.8 KiB
Bash

#!/bin/bash
# Search PSX runtime RAM for 4-byte value 0x0000609C (LE: 9c600000)
NC='/c/Program Files (x86)/Nmap/ncat'
TARGET="9c600000"
search_chunk() {
local addr_hex="$1"
local addr_dec=$((16#$addr_hex))
local result
result=$( (printf '{"cmd":"read_ram","addr":"%s","len":4096}\n' "$addr_hex"; sleep 0.5) | "$NC" localhost 4370 2>/dev/null )
# Extract hex field using python
local hexdata
hexdata=$(echo "$result" | python3 -c "import sys,json; print(json.load(sys.stdin).get('hex',''))" 2>/dev/null)
if [ -z "$hexdata" ]; then
return
fi
local lower_hex
lower_hex=$(echo "$hexdata" | tr 'A-F' 'a-f')
# Search for all occurrences
local pos=0
local len=${#lower_hex}
while [ $pos -lt $len ]; do
local remaining="${lower_hex:$pos}"
# Find target in remaining string
local before="${remaining%%$TARGET*}"
if [ "$before" = "$remaining" ]; then
break # not found
fi
local char_offset=${#before}
# Check byte alignment (must be at even position)
if [ $(( (pos + char_offset) % 2 )) -ne 0 ]; then
pos=$((pos + char_offset + 1))
continue
fi
local byte_offset=$(( (pos + char_offset) / 2 ))
local ram_addr=$((addr_dec + byte_offset))
printf " FOUND at 0x%08X (chunk 0x%05X, offset 0x%03X)\n" "$ram_addr" "$addr_dec" "$byte_offset"
pos=$((pos + char_offset + ${#TARGET}))
done
}
echo "Searching for $TARGET in kernel range 0x0000-0x8000..."
for addr in 0000 1000 2000 3000 4000 5000 6000 7000; do
search_chunk "$addr"
done
echo "Searching for $TARGET in shell data range 0x30000-0x90000..."
for i in $(seq 0x30 0x8F); do
addr=$(printf "%X000" "$i")
search_chunk "$addr"
done
echo "=== Search complete ==="