rand/srand stubs use the host std::rand: the guest seed is lost and RAND_MAX changes (Tekken 4 CPU opponents never vary)

Open
  • Is something wrong?
#406 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 5 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
1-2 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
cpp
Domain
backend, operating-systems

Research direction

Start with ps2xRuntime/include/ps2_call_list.h and the rand/srand stubs in ps2xRuntime/src/lib/Kernel/Stubs/LibC.cpp; trace how resolveStubTarget selects them and how unmatched guest functions run. Check the guest reent state and EE newlib behavior described in the issue. Done when guest seeding, range, and sequence are preserved, including when only one symbol matches.

Written by the indexing model from the issue text.

Description

Summary

ps2_stubs::rand and ps2_stubs::srand (ps2xRuntime/src/lib/Kernel/Stubs/LibC.cpp) replace the game's libc rand/srand with the host's std::rand/std::srand:

void rand(...)  { setReturnS32(ctx, std::rand() & 0x7FFF); }
void srand(...) { std::srand(getRegU32(ctx, 4)); setReturnS32(ctx, 0); }

This changes guest behaviour in three ways:

  1. The guest seed is lost when only one of the pair is matched by name. The stub is chosen per function name (resolveStubTarget). In Tekken 4 (PAL, SCES-50878) the symbol match finds rand (0x2A3178) but not srand (0x2A3168, left as FUN_002a3168). So the guest srand runs as recompiled code and stores the seed in the libc reent struct. The stubbed rand then reads the host std::rand state, which nothing ever seeds, and gives the same sequence on every boot.
  2. Different range. The stub returns 0..0x7FFF, but the EE newlib RAND_MAX that games are compiled against is 0x7FFFFFFF. Code that scales by RAND_MAX (e.g. rand() / (float)RAND_MAX) gets values 65536 times too small, and rand() % n gets a different distribution.
  3. Different sequence. Even when both functions are stubbed, the host generator isn't newlib's. Seeded sequences (demos, replays, AI) then differ from PCSX2 and real hardware. The host std::rand state is also shared with anything else in the process that calls it.

Symptom

In Tekken 4 the CPU opponent was always the same character (Law in Arcade, Steve in Story mode), whatever the input timing. PCSX2 picks a different opponent each time. The CPU fighters' AI also draws from rand.

Workaround in our game override

We register an override on the game's rand address that runs the EE libc routine on the guest state:

// EE newlib rand: next = next * 1103515245 + 12345 (32-bit); return next & 0x7FFFFFFF.
// In this game the state is the 32-bit word at _impure_ptr + 88 (_impure_ptr at 0x3059D4).
void guestRand(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
{
    ctx->pc = getRegU32(ctx, 31);
    uint32_t reent = 0, next = 0;
    std::memcpy(&reent, rdram + 0x003059D4u, 4);
    uint8_t *state = getMemPtr(rdram, reent + 88u);
    if (!state) { setReturnS32(ctx, 0); return; }
    std::memcpy(&next, state, 4);
    next = next * 1103515245u + 12345u;
    std::memcpy(state, &next, 4);
    setReturnS32(ctx, static_cast<int32_t>(next & 0x7FFFFFFFu));
}

With it, the opponents vary as they do in PCSX2.

Suggested fix

rand and srand are pure integer code on guest memory with no host dependency. The simplest fix is to stop stubbing them: drop X(rand) and X(srand) from ps2xRuntime/include/ps2_call_list.h and let the recompiled guest code run. That keeps the game's own state, seed, range and sequence, whichever of the two the symbol match finds.

If a stub is preferred, it should at least keep its own state (not the host std::rand) and use newlib's LCG and RAND_MAX of 0x7FFFFFFF. It would still lose the seed whenever only one of the pair is matched by name, though, so not stubbing looks safer.

Checked against main at e563698.

Dominant language
C++
Stars
3.3k
Forks
149
Avg merge
8h 46m
Merged PRs (30d)
1

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ran-j/PS2Recomp

All issues in ran-j/PS2Recomp

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.