Files
psxrecomp/tools/search_ram.py
T
Matthew Stanley 5b3c7dd08d phase4: freeze_check diagnostic + accumulated overnight infra
Today's session work
- runtime/src/debug_server.c: freeze_check TCP cmd snapshots all liveness
  counters (PC, exception entries, exception_reentry_blocks, dirty_ram
  blocks/insns, fn_entry total + top-K histogram, SIO IRQ pending +
  countdown, sio_stat/i_stat/i_mask, mc_max_state) for tight-loop
  diagnosis when the runtime hangs
- runtime/src/debug_server.c: wtrace slot 12 covering [0x72F0..0x72F4]
  (data-byte counter); measured peak=1 confirming setup_data_phase resets
  the counter mid-cycle
- runtime/src/interrupts.c: exception_entries_total + exception_reentry_blocks
  counters + psx_get_freeze_diag accessor
- runtime/src/sio.c: sio_get_freeze_diag accessor for IRQ pacing internals
- memory entries: phase4_card_gate_setup_writes_2026_04_28 (refutes the
  prior \"missing [0x7568+slot] clearer\" framing — setup functions write
  LSB=0 directly), phase4_72f0_one_byte_per_vblank_2026_04_28 (peak=1
  measurement)

Overnight session work bundled in
- runtime/src/dirty_ram_interp.{c,h}: small MIPS interpreter for
  install-at-runtime kernel RAM stubs (Rule 18; e.g., SIO data-byte
  handler the BIOS writes to RAM 0xCF0)
- recompiler/src/full_function_emitter.{cpp,h}: 3057 jal/jalr continuation
  return labels added to dispatch table (continuation fix); branch
  fall-through fix for conditional-branch delay slots
- recompiler/src/strict_translator.cpp: matching translator updates
- generated/: regenerated SCPH1001 dispatch + full C output reflecting
  the recompiler changes
- runtime/include/debug_server.h, src/memory.c: card_txn ring + SIO IRQ
  ring + EvCB walk ring + per-PC dirty_ram counters + always-on wtrace
  coverage for [0x755A], [0x7514], [0x7528], [0x7520], [0x74A4],
  [0x75C0..C8], [0x74B8..C0]
- recompiler/tests/, runtime/tests/: SIO/card protocol unit tests
- tools/: 60+ Python diagnostic scripts (chain_trace analysis, SIO trace
  diff, EvCB walker, wtrace dumpers, etc.)
- docs/: psx_bios_disasm reference + dynamic_handler_install rationale
- OVERNIGHT_2026_04_28.md, SUMMARY_20260412_2.md: session logs

Phase 4 status (still blocked, root cause better understood)
- BIOS card chain runs through R-handlers correctly (chain_trace shows
  R1..R11 cycling 26x); shell IS retriggering _card_read
- Install handler at ROM 0xBFC15F1C increments [0x72F0] correctly per
  SIO IRQ; gate at <0x80 / <0x7F is correct
- Bottleneck: SIO IRQ countdown is access-paced, fires ~1× per VBlank
  vs ~128× needed; setup_data_phase (called from outer coord on VBlank)
  zeroes [0x72F0] before counter reaches 128
- Both attempted fixes today caused freezes:
  * VBlank deferral on [0x75C0]==1 — pending VBlank already in i_stat
    delivered anyway; tighter dispatch gate also locked up
  * Cycle-paced sio_tick at rates 50, 200 (and gated on [0x75C0]==1) —
    runtime freezes once data phase activates, root cause unidentified
- delay=5 narrows the threshold (peak=2 vs peak=1, no freeze) but
  doesn't get to 0x80
- Real fix likely requires deeper instrumentation of the freeze (call
  stack / dispatch state at the moment of TCP starvation)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 21:29:19 -07:00

53 lines
1.7 KiB
Python

#!/usr/bin/env python3
"""Search PSX runtime RAM for a 4-byte value via TCP debug server."""
import subprocess
import json
import sys
NC = '/c/Program Files (x86)/Nmap/ncat'
TARGET = '9c600000' # 0x0000609C in little-endian hex
RANGES = [
(0x0000, 0x8000), # kernel
(0x30000, 0x90000), # shell data
]
found = []
for (start, end) in RANGES:
print(f"Scanning 0x{start:05X}-0x{end:05X}...")
for base in range(start, end, 0x1000):
addr_hex = format(base, 'x')
cmd = f"""(printf '{{"cmd":"read_ram","addr":"{addr_hex}","len":4096}}\\n'; sleep 0.5) | "{NC}" localhost 4370"""
try:
proc = subprocess.run(
['bash', '-c', cmd],
capture_output=True, text=True, timeout=10
)
d = json.loads(proc.stdout.strip())
hexdata = d.get('hex', '').lower()
pos = 0
while True:
idx = hexdata.find(TARGET, pos)
if idx == -1:
break
# Check alignment: idx must be even (byte-aligned)
if idx % 2 != 0:
pos = idx + 1
continue
byte_offset = idx // 2
ram_addr = base + byte_offset
found.append(ram_addr)
print(f" FOUND at 0x{ram_addr:08X} (chunk 0x{base:05X}, byte offset 0x{byte_offset:03X})")
pos = idx + len(TARGET)
except Exception as e:
print(f" Error at 0x{base:05X}: {e}", file=sys.stderr)
print()
if found:
print(f"=== {len(found)} match(es) found ===")
for addr in found:
print(f" 0x{addr:08X}")
else:
print("=== No matches found ===")