Emulator Issues #266
closed
Metroid Prime 1 TLB/Error Crash
Added by Anonymous about 16 years ago.
0%
Description
What steps will reproduce the problem?
- Load Up Dolphin
- Boot Metroid Prime 1.
- Wait untill you get ingame, try to walk around. Crashes with a TLB most
of the time.
What is the expected output? What do you see instead?
I expect to at LEAST get INSIDE the frigate, but the crash prevents me.
What version of the product are you using? On what operating system?
r1027, Windows XP Pro, SP3, SSE1, 2, and 3.
Please provide any additional information below.
Please get this working, I realy wish to try out prime 1.
Updated by Anonymous about 16 years ago
Also here.. same revision, Windows Vista x64 SP1, SSE, 2 and 3.
System:
Intel Core 2 Quad Q6600
2GB memory
Leadtek Winfast PX8800GT ZL (8800GT, 512MB)
Crashes instantly every time.
Updated by windypower about 16 years ago
Same here. Windows Vista SP1 32-bit, Intel Core 2 Quad Q6600 @ 3.00 GHz, SSE2&3, 4 GB
RAM, NVIDIA GeForce 9800 GT. However, I can't move around at all; the TLB happens
just when the HUD appears.
Updated by slink_3_ about 16 years ago
which version are you all using ? PAL i guess ?
Updated by Anonymous about 16 years ago
see issue 103. If your game gets a TLB error after booting, it is probably actually
some other error, just being reported as a TLB error.
Updated by memberTwo.mb2 about 16 years ago
- Status changed from New to Accepted
First of all, it happens with jit and interpreter.
With MP1 PAL, when the crash occurs, I noticed that code at address 0x8000f060 has
been overwrited by something.
Before (ie. at game start):
op c0410854 @8000f060 (which is "lfs f2, 0x0854 (sp)") <- GOOD
After (first try):
op d6a3ebd1 @8000f060 ("stfsu f21, -0x142F (r3)") <- RANDOM OPCODE
After (second try (restart game)):
op 15178b8b @8000f060 (mean nothing, not an opcode) <- RANDOM OPCODE
this is where I put the assert_msg(...):
PPCAnalyst.cpp -> Flatten(...)
...
code[i].x86ptr = 0;
assert_msg(GEKKO,code[i].address!=0x8000f060,"op %08x @%08x",inst,code[i].address);
GekkoOPInfo *opinfo = GetOpInfo(inst);
...
Serious bug... not a clue atm.
Updated by memberTwo.mb2 about 16 years ago
- Status changed from Accepted to Accepted
Just to be clear in interpreter mode the game crash but not at the same address as
with jit.
I'm focusing on jit since this code corruption is repeatable at that address for me.
Programm code overwrite in jited code:¶
02F0CB59 E8 28 12 0C 00 call 02FCDD86
02F0CB5E 8B 4C 24 18 mov ecx,dword ptr [esp+18h]
02F0CB62 89 44 24 14 mov dword ptr [esp+14h],eax
02F0CB66 DB 44 24 14 fild dword ptr [esp+14h]
02F0CB6A D9 7C 24 14 fnstcw word ptr [esp+14h]
02F0CB6E 0F B7 44 24 14 movzx eax,word ptr [esp+14h]
02F0CB73 DC 0D A0 76 03 03 fmul qword ptr ds:[30376A0h]
02F0CB79 0D 00 0C 00 00 or eax,0C00h
02F0CB7E 89 44 24 28 mov dword ptr [esp+28h],eax
02F0CB82 DC 0D 98 76 03 03 fmul qword ptr ds:[3037698h]
02F0CB88 D9 6C 24 28 fldcw word ptr [esp+28h]
02F0CB8C DF 7C 24 28 fistp qword ptr [esp+28h]
02F0CB90 8B 44 24 28 mov eax,dword ptr [esp+28h]
02F0CB94 8B 56 10 mov edx,dword ptr [esi+10h]
02F0CB97 8D 0C 91 lea ecx,[ecx+edx*4]
02F0CB9A D9 6C 24 14 fldcw word ptr [esp+14h]
02F0CB9E 89 46 08 mov dword ptr [esi+8],eax
02F0CBA1 89 6E 0C mov dword ptr [esi+0Ch],ebp
02F0CBA4 8B 11 mov edx,dword ptr [ecx]
02F0CBA6 89 56 14 mov dword ptr [esi+14h],edx
!!! code @ 8000f060 overwrite:
02F0CBA9 89 01 mov dword ptr [ecx],eax
Breakpoint stop:
02F0CBAB 8B 84 24 48 01 00 00 mov eax,dword ptr [esp+148h]
02F0CBB2 8D 4B FF lea ecx,[ebx-1]
02F0CBB5 89 46 04 mov dword ptr [esi+4],eax
02F0CBB8 C6 46 2C 00 mov byte ptr [esi+2Ch],0
02F0CBBC 85 CB test ebx,ecx
02F0CBBE 75 59 jne 02F0CC19
02F0CBC0 8B 84 24 50 01 00 00 mov eax,dword ptr [esp+150h]
02F0CBC7 8D 50 FF lea edx,[eax-1]
02F0CBCA 85 D0 test eax,edx
Regs:
EAX = 8B8B1715 EBX = 00000282 ECX = 0391F060 EDX = 5E250000 ESI = 0A66B770
EDI = 00000288 EIP = 02F0CBAB ESP = 0908FC88 EBP = C0DEBABE EFL = 00000202
0908FDD0 = 0000F060¶
Mem:
-
&Memory::m_pRAM[0xf060] 0x0391f060 "" unsigned char *
0x0391F060 15 17 8b 8b 38 61 03 c8 c0 21 08 34 c0 01 08 44 d0 ....8a.ÈÀ!.4À..Dж
see:
ecx == 0x0391F060 == 0x8000F060 (gc RAM)
eax == 8B8B1715
and later...¶
PANIC! Continue?¶
IntCPU: Unknown instr 15178b8b at PC = 8000f060 last_PC = 812fffc8 LR = 8000f060
Oui Non¶
I wonder if this game can compile or change some of his code. Is this unswapped
8B8B1715 a valid instruction? TOCHECK.
BTW, if someone recognize the jited instruction in the asm, it would be helpful :D
PS: Status accepted due to this really twisted bug.
Updated by memberTwo.mb2 about 16 years ago
My bad again. Reminder to self: don't forget to switch plugins to debug version when
debugging. This is not jited code it's in ogl plugin >>
Updated by memberTwo.mb2 about 16 years ago
oops forgot to precise:
The code that overwrite this gc-code address is in the texture hash stuff in
textureMnrg iirc. It's the hash value that overwrite the gc-code.
Seriously who could guess that a consumer videoplugin can write stuff in GC ram.
Anyway, I understand why now :p
Updated by hrydgard about 16 years ago
Strange. Does MP try to texture out of code memory for some reason? :P Probably
should come up with a saner alternative to the texture hash overwrite scheme...
Updated by memberTwo.mb2 about 16 years ago
Yup the current implementation of the texture cache is a bit "border line" but it's
ok when you now that :p
Anyway, the bug happens before IMO maybe an wrong CPReadPointer with an ambiguous
GXopcode for value.
This texture cache bug could be useful actually.
I'm thinking about adding a special debug ptr table for this hash write.
- add hash write ptr in this global table
- in interpreter mode: compare for each instruction ptr with those in the table then
assert some info if it turn bad
Updated by Anonymous almost 16 years ago
Will this ever be fixed? Its been awhile...
Updated by
Updated by AHeinerm almost 16 years ago
Last I tried Metroid Prime 1 on Dolphin, there was no crash.
Updated by DarkGhostHunter almost 16 years ago
Metroid Prime PAL versión does crash after de first cutscene (Samus Landing), no
gameplay.
Updated by hrydgard almost 16 years ago
No, it doesn't crash, if you set the GL plugin to use Safe Texture Cache. This may
become the default soon, but it's still somewhat unreliable for videos.
Updated by memberTwo.mb2 almost 16 years ago
ector, I didn't read the change you made but, was it really a bug in texture cache mng?
If not, I thought texture hash was written in the texture data so it shouldn't be a
problem though. I mean, program PC shouldn't fall in this data address. So, in that
case, this bug is bypassed by "Safe Texture Cache" but not fixed yet... Or I miss
something :p
Updated by federelli almost 16 years ago
Definitely much much better, i've yet to see it crash. It does bring up some panics
upon loading states, but the state loads anyway.
Also when loading some times sound issues happen, like sound loss, or sound repeating
itself.
Updated by hrydgard almost 16 years ago
mb2, there is indeed some sort of collision between the jit and the texture cache.
Haven't yet determined exactly how it can happen, but the metroid disc has lots of
.rel files on it, which is dynamically loadable code.
Updated by memberTwo.mb2 almost 16 years ago
Ok, very plausible explanation for me. I let you close this issue when you feel like it.
Updated by BhaaL almost 16 years ago
Not sure, but is the Safe Texture Cache also responsible for fixing the fonts?
Just tried it on r2339, without it I can barely/not read the text, with it activated
the game is rather playable (no crashes that were reported by other people earlier).
Updated by tinctorius almost 16 years ago
It appears so. For me, MP1 has bad fonts with unsafe TC, and good fonts with safe TC.
Updated by Anonymous over 15 years ago
can this be considered "fixed" since the creation of safe(r) texture cache? :}
Updated by federelli over 15 years ago
STC kills game performance and makes it crash in other ways, but i guess u can close
this, isn't there another way to fix this?
Updated by
Updated by federelli over 15 years ago
If having to enable STC for it not crash is considered a fix, i guess.
Updated by omegadox over 15 years ago
- Status changed from Accepted to Fixed
The STC hack fixes this game.