re: sub_822737C8 is the coroutine spawner; the record's third word is the MAIN ENTRY
Asking who calls the function the timeline calls enumerates every way an ISL routine
can begin. sub_822737C8(phase, base, offset) computes base + offset early on, and has
seven real call sites: the phase initialiser sub_82270DF8, the built-in stub region
(start_coroutine), the timeline walker sub_822748D0, TWICE inside sub_8226D740 -- the
per-frame engine->script drain -- and two unread, sub_82273910 and sub_82264058.
CORRECTION to my own write-up: the 0x1883 record's third word is the phase's MAIN
ENTRY, not a "size". The initialiser hands it straight to the spawner:
8227101C or r5, r22, r22 ; the record's third word
82271020 or r4, r26, r26 ; the code base
82271030 bl 0x822737C8
44 of 44 records land on the instruction stream (100%) against a 25.0% control, and
all three Stage-02 targets open with the identical prologue
`special[0]=0 ; local[0]=0 ; call builtin116(0)` -- a routine entry, not a length.
So the record is 0x1883, base, MAIN_ENTRY, 0, code_end, force_end_handler.
Seeding the main entries moves no coverage number: every one was already among the
CFG's entry points by another route. This corrects a field's meaning, not the graph.
Lead recorded rather than claimed: both of the drain's spawns take their offset from
[node+112], the first field of a drained node to be located, and the best remaining
angle on the ~15% of code nothing appears to start. It is NOT shown that those nodes
come from the trigger queue at phase+272 -- that is precisely the over-reach
isl-builtins.md already made and withdrew, so it is not asserted here.
All artefacts regenerate byte-identical; this is documentation only.
This commit is contained in:
60
docs/re/isl-coroutine-spawner.md
Normal file
60
docs/re/isl-coroutine-spawner.md
Normal file
@@ -0,0 +1,60 @@
|
||||
# ✅ `sub_822737C8` is the coroutine spawner — and its seven callers name the whole start-up path
|
||||
|
||||
Asking *who calls the thing the timeline calls* turns out to enumerate every way
|
||||
an ISL routine can begin.
|
||||
|
||||
`sub_822737C8(phase, base, offset)` — `add r9, r4, r28` computes `base + offset`
|
||||
early on, so the third argument is a phase-relative code offset.
|
||||
|
||||
## The seven call sites
|
||||
|
||||
| site | in | what it starts |
|
||||
|---|---|---|
|
||||
| `0x82271030` | **`sub_82270DF8`** — the phase initialiser | the phase's **main entry** (the `0x1883` record's third word) |
|
||||
| `0x822724D0` | the built-in stub region | `start_coroutine`'s target |
|
||||
| `0x82274934` | **`sub_822748D0`** — the timeline walker | a scheduled routine |
|
||||
| **`0x8226D8D0`** | **`sub_8226D740`** — the per-frame engine→script drain | an offset from **`[node+112]`** |
|
||||
| **`0x8226DA10`** | the same drain, second path | the same `[node+112]` |
|
||||
| `0x82273938` | `sub_82273910` | not read |
|
||||
| `0x82264080` | `sub_82264058` | not read |
|
||||
|
||||
## ✅ The phase's main entry — a correction
|
||||
|
||||
`isl-stream-entry-points.md` called the record's third word a **size**. It is
|
||||
not: the initialiser hands it to the spawner as an offset.
|
||||
|
||||
* **44 of 44 records land on the instruction stream — 100 %, against a 25.0 %
|
||||
control.**
|
||||
* All three of Stage 02's targets begin with the same prologue,
|
||||
`special[0] = 0 ; local[0] = 0 ; call builtin116(0)`, which is a routine entry
|
||||
and not a length.
|
||||
|
||||
So the record reads `0x1883, base, MAIN_ENTRY, 0, code_end, force_end_handler`.
|
||||
|
||||
🟡 Seeding it changes nothing measurable — every main entry was **already**
|
||||
among the CFG's entry points by another route — so this corrects the *meaning*
|
||||
of a field without moving any coverage number.
|
||||
|
||||
## 🔑 The drain spawns from `[node+112]`
|
||||
|
||||
The two calls inside `sub_8226D740` both do
|
||||
|
||||
```
|
||||
lwz r5, 112(r31) ; the routine offset, out of the node
|
||||
lwz r4, 232(r29) ; the phase's code base
|
||||
bl 0x822737C8
|
||||
```
|
||||
|
||||
`isl-builtins.md` describes `sub_8226D740` as the per-frame engine→script drain,
|
||||
and here it is spawning routines from a **code offset carried in the drained
|
||||
node at `+112`**. That is the first field of a trigger-style node to be located,
|
||||
and it is the most promising remaining lead on the routines nothing else starts.
|
||||
|
||||
## 🟡 Not settled
|
||||
|
||||
* **`+112` is a field of *some* node** — this does not show the node comes from
|
||||
the trigger queue at `phase+272`. That link is exactly the over-reach
|
||||
`isl-builtins.md` already recorded and withdrew once; it is not asserted here.
|
||||
* **Two callers unread**: `sub_82273910` and `sub_82264058`.
|
||||
* **Whether the drain's nodes explain the unreached routines** is untested. It
|
||||
is a lead, not a result.
|
||||
Reference in New Issue
Block a user