de42fbd742
FormationSet_S<NN>.tbl records are slot lists -- 1 + 8*FrameCount fields, exactly. Resolving every squadron's FormationID and comparing gives sum(n) <= FrameCount holding 1159/1160 across all 28 stages, 0 unresolved, with 539 filling the formation exactly. The single violation is a debug leftover (S20, AI_Test / MessageSet_test, Formation_1_only with n=2) and is recorded. The old 'n is not the _NN suffix of FormationID' observation was right but drew the wrong conclusion: the suffix IS FrameCount, so n=9 against _30 just means 9 units in 9 of 30 slots. Also: FormationID does not hash into its table (0/16). FormationSet carries a name roster record -- no FrameCount, fields are (tag, name, '') with the tags being the record keys -- the same convention as Enumerate_Squadrons. Second occurrence of 'keys are resolved by an in-table roster, not by hashing'. Does not close the 387-vs-300 gap, and the key derivation stays open.
149 lines
6.5 KiB
Bash
Executable File
149 lines
6.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Read WHICH object the guest threads are waiting on, HEALTHY vs FROZEN.
|
|
#
|
|
# Groundwork (mission-freeze-resume-spin.md): the waiting functions keep their
|
|
# interesting argument in %rbx, and .eh_frame lets gdb restore callee-saved
|
|
# registers during the unwind, so no DWARF and no rebuild are needed.
|
|
#
|
|
# TWO functions end up in these backtraces and %rbx does NOT mean the same
|
|
# thing in each -- reading them as one set is what produced the earlier
|
|
# "8 of 18 threads have an unreadable rbx" claim (waitobj-two-functions.md):
|
|
#
|
|
# XObject::Wait(this, ...) 8fbc90: mov %rdi,%rbx -> rbx = this
|
|
# XObject::WaitMultiple(count, objects, .) 8fbfc0: mov %rsi,%rbx -> rbx = objects[]
|
|
# mov %edi,%ebp -> ebp = count
|
|
#
|
|
# So a Wait frame is read with one deref and a WaitMultiple frame with two, and
|
|
# every reading is checked by `info symbol`: a polymorphic object's first word
|
|
# is a vtable, so a value that does not resolve to a `vtable for ...` symbol is
|
|
# discarded rather than interpreted.
|
|
#
|
|
# Captures TWICE so the comparison is within-run: once while the mission is
|
|
# healthy, once frozen. The frozen one is reached by WAITING FOR THE EVENT, not
|
|
# by a clock -- measured onsets are 27/45/83/183/255s (median ~83), only about
|
|
# half of runs freeze at all, and the "~270s" figure this script used to sleep
|
|
# for was never a real bound.
|
|
#
|
|
# "Frozen" is frozen.py's test -- two byte-identical frames while the flight HUD
|
|
# is still up. It is NOT `screen_id == flight` being false: a frozen mission
|
|
# still classifies as `flight`, which is the whole reason frozen.py exists.
|
|
#
|
|
# Subcommands, because the boot and the wait do not fit one Bash call but the
|
|
# emulator survives BETWEEN calls in a turn:
|
|
# freeze_waitobj.sh boot [fly_s] boot, fly, capture `healthy`, leave running
|
|
# freeze_waitobj.sh watch [secs] poll for the freeze, capture `frozen`
|
|
# freeze_waitobj.sh run [fly_s] boot + healthy + watch, end to end
|
|
#
|
|
# `run` exists because the whole experiment does not fit one Bash call and a
|
|
# `timeout` kills the process group -- it took the emulator down once. Launch it
|
|
# detached (`nohup ... &`) and poll the log instead.
|
|
#
|
|
# SYLPH_INDUCE=1 starts heavy_read.py the moment flight begins, to test whether
|
|
# the freeze follows our instrument rather than the mission (see the n=1 entry in
|
|
# mission-freeze-resume-spin.md). The control is the same script without it.
|
|
set -u
|
|
export HOME=/sylph-home/re SDL_AUDIODRIVER=dummy DISPLAY=:98
|
|
export PYTHONPATH=/sylph-home/.local/lib/python3.12/site-packages
|
|
export XENIA_BIN=/sylph-home/re/bin/gdb-wrap/xenia_canary
|
|
SD="$(cd "$(dirname "$0")" && pwd)"
|
|
FLY1="${1:-200}" # healthy checkpoint
|
|
FLY2="${2:-140}" # extra seconds -> lands past the ~270s black-screen
|
|
CMD=/tmp/gdb-cmd; OUT=/tmp/gdb-out.log
|
|
|
|
sleepfor(){ python3 -c "import time,sys; time.sleep(float(sys.argv[1]))" "$1"; }
|
|
|
|
capture(){ # capture <tag>
|
|
local tag="$1" pid before
|
|
pid=$(pgrep -x gdb | head -1)
|
|
[ -n "$pid" ] || { echo "[$tag] no gdb"; return 2; }
|
|
before=$(wc -c < "$OUT")
|
|
screenshot "/tmp/fz-$tag.png" >/dev/null 2>&1
|
|
echo "[$tag] screen: $(python3 "$SD/screen_id.py" "/tmp/fz-$tag.png" 2>/dev/null | head -1)"
|
|
kill -INT "$pid"; sleepfor 3
|
|
{ echo 'echo === BT '"$tag"' ===\n'; echo 'thread apply all bt 6'
|
|
echo 'echo === END BT ===\n'; } >> "$CMD"
|
|
sleepfor 10
|
|
tail -c +$((before + 1)) "$OUT" > "/tmp/fz-bt-$tag.txt"
|
|
# emit per-thread reads, with the frame index and the function taken from the
|
|
# backtrace itself rather than assumed
|
|
TAG="$tag" python3 - "/tmp/fz-bt-$tag.txt" <<'PY' >> "$CMD"
|
|
import os,re,sys
|
|
txt=open(sys.argv[1],errors='replace').read(); tag=os.environ['TAG']
|
|
cur=None; n=0
|
|
for line in txt.splitlines():
|
|
m=re.match(r'Thread (\d+) ',line)
|
|
if m: cur=m.group(1); continue
|
|
if not cur: continue
|
|
f=re.search(r'#(\d+)\s+0x[0-9a-f]+ in xe::kernel::XObject::(WaitMultiple|Wait)\(',line)
|
|
if not f: continue
|
|
fr,kind=f.group(1),f.group(2)
|
|
print(r'echo === %s T%s %s f%s ===\n'%(tag,cur,kind,fr))
|
|
print('thread %s'%cur); print('frame %s'%fr)
|
|
if kind=='Wait':
|
|
print('info registers rbx')
|
|
print('info symbol *(unsigned long*)$rbx')
|
|
else:
|
|
print('info registers rbx rbp')
|
|
for i in range(4):
|
|
print('info symbol *(unsigned long*)*(unsigned long*)($rbx+%d)'%(8*i))
|
|
cur=None; n+=1
|
|
print(r'echo === END OBJ %s ===\n'%tag); print('continue')
|
|
sys.stderr.write('[%s] %d wait frames\n'%(tag,n))
|
|
PY
|
|
sleepfor 14
|
|
tail -c +$((before + 1)) "$OUT" > "/tmp/fz-obj-$tag.txt"
|
|
local epid; epid=$(pgrep -x xenia_canary | head -1)
|
|
[ -n "$epid" ] && cp "/proc/$epid/maps" "/tmp/fz-maps-$tag.txt" 2>/dev/null
|
|
echo "[$tag] captured"
|
|
}
|
|
|
|
MODE="${1:-boot}"
|
|
FLY="${2:-}"
|
|
|
|
if [ "$MODE" = watch ]; then
|
|
SECS="${FLY:-500}"
|
|
pgrep -x xenia_canary >/dev/null || { echo "NO EMULATOR"; exit 1; }
|
|
end=$((SECONDS + SECS))
|
|
while [ $SECONDS -lt $end ]; do
|
|
pgrep -x xenia_canary >/dev/null || { echo "EMULATOR GONE at ${SECONDS}s"; exit 4; }
|
|
if python3 "$SD/frozen.py" 5 >/dev/null 2>&1; then
|
|
if python3 -c "import sys;sys.path.insert(0,'$SD');import frozen;sys.exit(0 if frozen.in_flight() else 1)"; then
|
|
echo "FROZEN IN FLIGHT at ${SECONDS}s of this watch"
|
|
capture frozen
|
|
python3 "$SD/waitobj_report.py" healthy frozen
|
|
echo "FREEZE WAITOBJ DONE"; exit 0
|
|
fi
|
|
echo "frozen but NOT in flight (mission over) at ${SECONDS}s"; exit 5
|
|
fi
|
|
sleepfor 12
|
|
done
|
|
echo "NO FREEZE within ${SECS}s (still animating)"; exit 1
|
|
fi
|
|
|
|
# ---- boot / run mode ----
|
|
FLY="${FLY:-150}"
|
|
"$SD/launch_mission.sh" fly || { echo "BOOT FAILED"; exit 1; }
|
|
CFG=/tmp/nav-fz.json
|
|
for t in 1 2 3; do
|
|
python3 "$SD/pad.py" set "rt=1" >/dev/null 2>&1 || true; sleepfor 3
|
|
python3 "$SD/pad.py" clear >/dev/null 2>&1 || true
|
|
if python3 "$SD/entities2.py" self 0x130 "$CFG" >/dev/null 2>&1; then
|
|
SYLPH_HUNT=1 SYLPH_KEEPOUT=1400 nohup python3 "$SD/pilot.py" "$CFG" 3000 \
|
|
</dev/null >/tmp/fz-pilot.log 2>&1 & echo "--- pilot flying"; break
|
|
fi
|
|
done
|
|
if [ "${SYLPH_INDUCE:-0}" = 1 ]; then
|
|
nohup python3 "$SD/heavy_read.py" 4000 2 cpu </dev/null >/tmp/heavy.log 2>&1 &
|
|
echo "--- INDUCER ON from flight start ($(date +%T))"
|
|
else
|
|
echo "--- inducer OFF (control run)"
|
|
fi
|
|
echo "--- flying ${FLY}s to the healthy control capture"
|
|
sleepfor "$FLY"; capture healthy
|
|
python3 "$SD/waitobj_report.py" healthy
|
|
echo "BOOT PHASE DONE -- emulator left running"
|
|
if [ "$MODE" = run ]; then
|
|
echo "--- watching for the freeze ($(date +%T))"
|
|
exec "$0" watch "${WATCH_S:-1500}"
|
|
fi
|