Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ULUS10442 - Kenka Bancho Badass Rumble stuck #4523

Closed
reiclone opened this issue Nov 12, 2013 · 41 comments
Closed

ULUS10442 - Kenka Bancho Badass Rumble stuck #4523

reiclone opened this issue Nov 12, 2013 · 41 comments

Comments

@reiclone
Copy link

The game crashes at the loading after this scene(first fight with a bancho)
before

It gets stuck in the loading screen:
stuck

and it goes black after a while.

I tried it with PPSSPP v0.9.5-339 Windows7 64bit, but it's reported to happen at least since v0.7.6-816-g2c4254d on the forum thread.

Here is the log when it starts loading (taken with "Ignore Illegal Reads/Writes" off).
start
then there is a lot of "Invalid address" and it ends with:
end

Full Log (35MB): http://www59.zippyshare.com/v/37371141/file.html
The game works great otherwise.

edit: Added some Images, modified the title and added full log.

@unknownbrackets
Copy link
Collaborator

Just a heads up. After the first ~10 invalid address warnings, it's no longer interesting or useful. The 35MB log is like 99% invalid address errors, so just mentioning that you could've closed PPSSPP as soon as it started spitting out the errors and would've been fine (and also easier for me to look at the log.)

If you don't use savestates, and you just load a regular savegame and get to this point, does it still happen? Nothing looks wrong in the log, but it could've been something before you saved state, and I wouldn't be able to tell. Or it could be a bug in savestates.

-[Unknown]

@reiclone
Copy link
Author

reiclone commented Dec 8, 2013

This point is so early in the game you don't even have the ability to save beforehand. So I get to this point from a new game each time I try a new version. I do not use any kind of savestate.

Also just tried in v0.9.5-955-gd5147c4 and realized that Fast Memory on makes ppsspp stop responding without any kind of error (at the same point).

Also now the game doesn't crash it just gets into a blackscreen forever, and the invalid address have dissapeared, now only the final error shows up in the log. This is using default settings but with fast memory off, fast memory on is the same but without the last line.
v955

@unknownbrackets
Copy link
Collaborator

Well, I'm pretty sure the PC is wrong, but I don't know why.

If you open Log.bat, and change "PPSSPPWindows" to "PPSSPPDebug" every time, and then run it, you'll get a more detailed log. This might help narrow it down.

-[Unknown]

@reiclone
Copy link
Author

reiclone commented Dec 8, 2013

I had to download the 32 bits because I was missing some dll for the debug, so this test is with: v0.9.5-963-g08a0709 Windows 32bits with fast memory off.

I logged from the start of the game until the crash, and I got a 135mb log, I took your advice before so I'll post a log near the crash skipping most of the spam.

http://pastebin.com/16hLT8cn

do tell me if you need the initialization or any other part of the log I removed.

@unknownbrackets
Copy link
Collaborator

Hmm. Things seem to go south after sceKernelSetGPO(80)... which should do nothing on a release PSP anyway, I think, but I wonder why it's calling it.

-[Unknown]

@unknownbrackets
Copy link
Collaborator

Has this changed at all? A more recent log may help.

-[Unknown]

@reiclone
Copy link
Author

reiclone commented Feb 9, 2014

Sorry I didn't see the response until now.

I have tried with v0.9.6-815-ge5e4eba 64bits and the problem still persists.

Here is the last 400kb of the log with this version http://pastebin.com/fRM0qUYa. I used a savestate to avoid clogging up the log but I can make log from the start if it's needed.

@unknownbrackets
Copy link
Collaborator

Hm, I don't see GetPointer in this log. Did you turn off fast memory?

Not seeing anything obvious wrong in that log... darn...

-[Unknown]

@reiclone
Copy link
Author

No I didn't, and there isn't any GetPointer in the full log either.

@unknownbrackets
Copy link
Collaborator

Fast memory makes it crash instead of logging when it hits invalid addresses. A log with it off would be best.

-[Unknown]

@reiclone
Copy link
Author

oops, I forgot that.

Here you have the last 500kb of the log with fast memory off, without the spam http://pastebin.com/6M4Tnkak .

@unknownbrackets
Copy link
Collaborator

Somewhere after here:
49:48:436 MyThread-Mai D[KERNEL]: HLE\sceKernelThread.cpp:3207 Context switch: idle0 -> MyThread-Main (272->290, pc: 08000000->0894fc28, left interrupt) +0us

MyThread-Main seems to lose it. Just to confirm, this is with "Read Framebuffers to Memory" disabled? Sometimes that overwrites RAM in bad ways.

Anyway, it looks like it ends up scanning RAM upwards and never hits the end, eventually hitting outside RAM. Could potentially be an interrupt handling problem, I suppose... or scheduling...

-[Unknown]

@reiclone
Copy link
Author

This is with Buffered rendering.

@unknownbrackets
Copy link
Collaborator

Has this improved at all in the latest git build with default settings?

-[Unknown]

@reiclone
Copy link
Author

reiclone commented Jul 1, 2014

I just tried it with the build: v0.9.8-1514-g602daf5
And it didn't improve.
Still crashes at the same place with fast memory.
And does the ram scan ending in Unknown GetPointer with fast memory off.
This is the last part of the debug log with fast memory off, http://pastebin.com/wunEE1yG

@unknownbrackets
Copy link
Collaborator

Has there been any improvement with the various audio changes we've made since that version?

If not, an updated log might still help.

-[Unknown]

@reiclone
Copy link
Author

No changes.
Last part from a debug log from v0.9.9.1-1576-g4100163-windows-amd64
With fast memory off and buffered rending.
http://pastebin.com/DXAvL2Fh

@issuer
Copy link

issuer commented Feb 2, 2015

Still crashes in 1.0.

@rz5
Copy link

rz5 commented Jan 25, 2016

This is still happening in the latest Win64 git build (ppsspp-v1.1.1-863-g553e3f0-windows-amd64). Tested with Fast Memory off, here are the last 20 lines of the debug console:

38:37:815 MyThread-Dis I[IO]: HLE\sceIo.cpp:2234 sceIoIoctl: Asked for size of file 4
38:37:964 MyThread-Dis W[FileSys]: FileSystems\ISOFileSystem.cpp:573 Reading beyond end of file, clamping size 196608 to 97823
38:38:110 MyThread-Dis I[IO]: HLE\sceIo.cpp:2234 sceIoIoctl: Asked for size of file 4
38:38:111 MyThread-Sou I[ME]: HLE\sceAtrac.cpp:991 0=sceAtracGetAtracID(00001000)
38:38:115 MyThread-Mai I[G3D]: GLES\ShaderManager.cpp:162 Linked shader: vs 38 fs 39
38:38:116 MyThread-Mai I[G3D]: GLES\ShaderManager.cpp:162 Linked shader: vs 41 fs 42
38:38:118 MyThread-Mai I[G3D]: GLES\ShaderManager.cpp:162 Linked shader: vs 41 fs 44
38:38:118 MyThread-Mai I[G3D]: GLES\ShaderManager.cpp:162 Linked shader: vs 41 fs 46
38:38:131 MyThread-Mai I[G3D]: GLES\ShaderManager.cpp:162 Linked shader: vs 48 fs 46
38:38:133 MyThread-Mai I[G3D]: GLES\ShaderManager.cpp:162 Linked shader: vs 12 fs 50
38:38:183 MyThread-Dis I[IO]: HLE\sceIo.cpp:2234 sceIoIoctl: Asked for size of file 4
38:38:288 MyThread-Dis I[IO]: HLE\sceIo.cpp:2234 sceIoIoctl: Asked for size of file 4
38:38:389 MyThread-Dis W[FileSys]: FileSystems\ISOFileSystem.cpp:573 Reading beyond end of file, clamping size 196608 to 148980
38:38:417 MyThread-Sou I[ME]: HLE\sceAtrac.cpp:1896 0=sceAtracSetData(0, 08400000, 000b45f4): atrac3+ stereo audio
38:38:782 idle0        I[G3D]: GLES\ShaderManager.cpp:1039 Saving the shader cache to 'C:\Users\rz5\Emulators\ppsspp\memstick/PSP/SYSTEM/CACHE//ULUS10442.glshadercache'
38:40:996 MyThread-Mai I[HLE]: HLE\scePower.cpp:369 scePowerSetClockFrequency(222,222,111)
38:41:002 MyThread-Mai I[HLE]: HLE\scePower.cpp:369 scePowerSetClockFrequency(333,333,166)
38:41:051 MyThread-Dis I[IO]: HLE\sceIo.cpp:2234 sceIoIoctl: Asked for size of file 4
38:41:251 MyThread-Dis W[FileSys]: FileSystems\ISOFileSystem.cpp:573 Reading beyond end of file, clamping size 196608 to 138642
38:41:438 MyThread-Sou E[MM]: MemmapFunctions.cpp:55 Unknown GetPointer 116ff1c8 PC 116ff1c8 LR 116ff1c8

@unknownbrackets
Copy link
Collaborator

Can you open Debug -> Disassembly..., and paste 0894fc28 in the top left under "Go to", and press enter? And then take a screenshot and upload it here?

Not sure if it will help, but maybe if I can see the code in the area I can come up with some idea of why it's wigging out.

-[Unknown]

@daniel229
Copy link
Collaborator

@daniel229
Copy link
Collaborator

This happen when the first cutscene finish and then load the second sutscene.#6813 is the same.The demos don't have the second cutscene,so it would hang.

@rz5
Copy link

rz5 commented Jan 26, 2016

My game crashes in a spot which is different from the OP, but the situation is the same: a cutscene reaches the end, I reach a 'Now Loading...' screen and the game freezes.

@unknownbrackets, here's the requested screenshot:
image

@LunaMoo
Copy link
Collaborator

LunaMoo commented Feb 22, 2016

To shed a bit more light on this - direct/immediate reason of the freeze is pretty simple - the game goes through a function to generate pointers for cutscene dialogues starting from a table of offsets and adding base to those then writing resulting pointers at same address, we get bugged since the function runs again when pointers are already there and effectively breakes them by adding base to pointers again without checking it in any way, seems like a bad coding to me I mean game side.

I'm able to hack it pretty easily to the point of loading map and dialogues alright, but still npc's are missing from the cutscene. My theory on it would be this is a timing issue which causes the game to load some cutscenes too fast - before freeing up memory for it and since it re-creates that pointer list(which has like 3600 positions, one for each dialogue box for all cutscenes) before every cutscene it must expect it to be cleared earlier. Missing npc's when trying code hacks like I did might just be result of not having enough memory as they likely to load last.
Unfortunately no features related to cpu/io(or any other for that matter) we have affected it as of yet.

@unknownbrackets
Copy link
Collaborator

If you look at the memory those functions change - does any other function also change that memory? Maybe we can find the cleanup function, at least, and figure out what's supposed to trigger it.

Do any memory allocations fail? They should be logged.

-[Unknown]

@LunaMoo
Copy link
Collaborator

LunaMoo commented Feb 22, 2016

clearing
Well the highlited opcodes in this function are writing FF clearing memory I guess and later also those offsets to the list I mentioned earlier, before the cutscene affected by this issue this function never runs which is causing all the problems. Edit: just my luck - I posted that, immediately wanted to edit it - and git died on me for a while, ugh anyway to clarify - that function does run, just doesn't clear/write anything to the addresses storing those pointers that get bugged for the affected cutscene.

Also when I hack it in a way that it doesn't load npc's I just see a few read from and write to hardware invalid addresses which are all small numbers offsets to some pointer or other random values, without any hackery I just get the unknown get pointer as in the log above since it fails at those broken pointers.

@sum2012
Copy link
Collaborator

sum2012 commented Sep 4, 2016

Update the log to v1.2.2-907-g2d838f7
https://gist.github.com/sum2012/f427d9079e3874f2f99c64f04a842d5e

@LunaMoo
Copy link
Collaborator

LunaMoo commented Sep 4, 2016

Real psp with cfw when cpu clock get's forced to 333mhz apparently crashes in same places, treating it as a hint, we can see game quickly changes cpu clock twice right before the crash so maybe it could be something similar to #2104 ~ althrough that was already fixed long ago.

@sum2012
Copy link
Collaborator

sum2012 commented Sep 5, 2016

Do we have a cpu clock check cfw plugin to check this game 's clock (edit:) in real time in real psp ?

@hrydgard
Copy link
Owner

hrydgard commented Sep 5, 2016

So it's definitely some timing issue. I think we handle clock changes mostly correctly now, but it could be as simple as some Atrac or Mpeg function not taking enough time or taking more time than expected, or rescheduling when they shouldn't, etc. If there was a way to log all context switches on the real PSP that might help...

@sum2012
Copy link
Collaborator

sum2012 commented Sep 5, 2016

Small finding from jpcsptrace of scePowerSetClockFrequency
The timing is 0.150 second

07:13:11.471 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:13:11.621 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:13:16.362 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:13:16.510 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:13:17.777 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:13:17.927 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:13:40.634 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:13:40.784 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:13:40.817 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:13:40.967 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:13:44.908 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:13:45.055 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:13:46.272 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:13:46.422 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:15:18.099 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:15:18.248 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:15:18.281 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:15:18.431 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:15:23.073 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:15:23.220 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
07:15:23.246 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
07:15:23.386 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0

@unknownbrackets
Copy link
Collaborator

Are those in and out (one call per clock speed), or successive calls? My fork had used < and > to indicate this - I think you're saying it's in and out, i.e. scePowerSetClockFrequency takes 0.15 seconds.

That could definitely explain timing issues, especially if it's calling that often. Nice find.

-[Unknown]

@sum2012
Copy link
Collaborator

sum2012 commented Sep 6, 2016

Yes, those in and out,gid15 's jpcsptrace don't have "<" ,">" for in & out.

OH Yes,I fix the game

@sum2012
Copy link
Collaborator

sum2012 commented Sep 6, 2016

Thanks @LunaMoo for the hint

@rz5
Copy link

rz5 commented Sep 6, 2016

Congrats @sum2012 and everyone involved, this was a long standing bug which affected a game I liked on the handheld.

@sum2012 sum2012 reopened this Sep 6, 2016
@sum2012
Copy link
Collaborator

sum2012 commented Sep 6, 2016

oop,find two problem

Case 1:
After kill enemy,
In the menu,press move ,Will raise invalid address.

Case 2:
Load save,Press move,Will get infinite loading
edit:Add save https://drive.google.com/file/d/0B3OaSdeV0L8kVDJvaG4tbmI4VkU/view?usp=sharing

@LunaMoo
Copy link
Collaborator

LunaMoo commented Sep 7, 2016

Thanks for fixing it @sum2012, also "moves" menu is broken for people with bad dump so not an emulation problem anymore, this would happen on real psp as well.

Works fine with correctly dumped iso's:
ulus10442_00000

@sum2012
Copy link
Collaborator

sum2012 commented Sep 7, 2016 via email

@LunaMoo
Copy link
Collaborator

LunaMoo commented Sep 7, 2016

Well by google about it, there're lots of people with the problem from before PSP emulation was a thing when there was some bug with iso dumping in cfw's.

Here's some info about proper dump of UMD release:
Iso size: 524 222 464 bytes
CRC32: cd74299d
MD5: a9f2095cd6120c5cd4f1964732773b80
SHA-1: ef7fb4b5b0365dfce126e8b18c300fe51cb499b9

The only file the game reads when entering this menu is disc0:/PSP_GAME/USRDIR/TESTDATA/WAZAEDIT.LZS which isn't very big, but checking with UMDGen it's the last file on the iso ~ easily broken by incomplete dumps, maybe even unfinished transfer when you copied it from your psp which would explain why works there and not on ppsspp. Don't know what else could be happening, also tried cso without problems.

@sum2012
Copy link
Collaborator

sum2012 commented Sep 7, 2016

I redo jpcsptrace log:maybe I added scePowerGetCpuClockFrequencyInt
now the timing is 0.139-0.142s

19:51:20.085 MyThread-Main - scePowerGetCpuClockFrequencyInt = 0x0
19:51:20.085 MyThread-Main - scePowerGetCpuClockFrequencyInt = 0xDE
19:51:20.093 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
19:51:20.235 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
19:51:23.925 MyThread-Main - scePowerGetCpuClockFrequencyInt = 0x0
19:51:23.925 MyThread-Main - scePowerGetCpuClockFrequencyInt = 0x14D
19:51:23.934 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
19:51:24.073 MyThread-Main - scePowerSetClockFrequency 0xDE, 0xDE, 0x6F = 0x0
19:51:25.340 MyThread-Main - scePowerGetCpuClockFrequencyInt = 0x0
19:51:25.340 MyThread-Main - scePowerGetCpuClockFrequencyInt = 0xDE
19:51:25.348 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0
19:51:25.490 MyThread-Main - scePowerSetClockFrequency 0x14D, 0x14D, 0xA6 = 0x0

@sum2012
Copy link
Collaborator

sum2012 commented Sep 10, 2016

I get correct dump of this game from my friend.Closing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

8 participants