swung0x48/MobileGL
1
0
Fork 0
mirror of https://github.com/MobileGL-Dev/MobileGL synced 2026-11-07 18:13:23 +09:00
Code Issues Packages Projects Releases Wiki Activity

[MG_Remote] (P6/cp): a real trace retraces across two processes, pixel-for-pixel

Browse Source 
OpenRA.DirectGLES.SPAWN is green: ssim=1.000000, mismatchPixels=0, zero
Fatal{ lines, against a server in a process the client started by name. The
inproc SPLIT arm stays beside it as the control, so "did the transport break
it" and "did the phase break it" remain separately answerable.

Five defects stood between the handshake and that picture. Each one was
silent in its own way, and none of them looked like what it was.

1. THE DOORBELL COULD NOT WAKE ITSELF. SocketDoorbell's one-fd form sends on
   the end it polls, so a write is delivered to the PEER - correct for waking
   the other process, useless for waking a thread in this one. The server's
   control pump posts into the apply thread's mailbox and must ring the bell
   that thread parks on. Symptom: every eglInitialize crossed, landed in the
   mailbox, and timed out at 5 s. The two-fd form (park on [0], notify on [1])
   is restored here, and the bell handover goes from two descriptors to THREE
   - the client needs the same split for the same reason. Seven offers now.

2. InitCapabilities HAD NO WIRE KIND. CONTRACT-P6 §2 predicted this exactly
   ("the request has a live client caller and the codec refuses to encode
   it"). SurfaceOpKind gains 11, append-only; the decode range's upper bound
   moves with it, or the new tag reads as out-of-range and surfaces as
   Fatal{ProtocolCorruption} rather than the missing row it is. The op's name
   loses its InprocOnly suffix, which stopped being true here.

3. THE CHILD LOADED NO CONFIG AT ALL. mobilegl_server_main calls
   InitServerRoleForSpawn directly, and MG_ConfigLoader::Init is a step of
   MobileGL::Initialize - so every MG_Config value in the server was its
   static default. MOBILEGL_BACKEND_TYPE survives the launcher's scrub on
   purpose and was read by nobody: a DirectVulkan session would have brought
   up a DirectGLES server and then disagreed with its client about which
   backend the capability mask describes.

4. AND THEREFORE Transport READ AS Monolith, which CONTRACT-P6 §3.1 (D1)
   forbids in as many words. a6 measured the cost: 226 live lines test
   `Transport != Monolith` to select the SERVER arm, 148 in MG_Backend.
   Monolith flips all of them to frontend glue in the one process with no
   frontend. Observed precisely as predicted - UnitTexturesByHandle() answered
   false, Clear took the legacy arm that dereferences borrowed FRONTEND slot
   pointers, and the apply thread took a SIGSEGV inside SyncNeccessaryTextures
   on the first Clear record of the trace. It is pinned in-process rather than
   through the environment because the environment is where it must NOT be:
   LooksLikeAClientEnvironment exits 65 on a surviving MOBILEGL_TRANSPORT, and
   that check is anti-recursion catch (b). Dial, not Transport, is that axis.

5. THE LOG WAS CORRUPT, NOT MERELY INTERLEAVED. Two processes opened the same
   MOBILEGL_LOG_FILE_PATH with "w" and each carried its OWN file offset, so
   they overwrote each other's bytes - half-lines like `ote client: CapsMirror
   generation 1 adopted`, and the server's whole startup block vanishing under
   the client's later writes. This cost real diagnosis time twice, because a
   missing line read as a code path not taken. O_APPEND now; the client still
   truncates once so a fresh run is not a pile of old ones, and the server
   never does - it would delete the very startup lines a failed session needs.
   run_trace_case.cmake's Fatal{ census reads exactly this file, so it was
   also reading a lie.

The retrace runner's split assertions become transport-aware: one row per
transport it admits, and a transport with no row is a FATAL rather than a
fall-through, because the fall-through is the accident the block exists to
prevent. The spawn row carries a SECOND sentence and it is the stronger half
- ConfigLoader's marker proves the value RESOLVED, while `spawn ARMED - the
server role runs in pid N` is written only after the launch, the connect and
the handshake all succeeded, and carries a pid that is not this process's.
inproc resolves its own marker while running the server role on a thread
here; nothing on that path can write this one.

G14: one test name added (TheEleventhFramedOpIsInitCapabilitiesAndItCrosses-
TheWire), none removed. The ten-op table keeps its name and its scope rather
than being renamed to eleven.

Two unit failures predate this change and are environmental in this tree:
PipeCatalogue.FrontendNeverTakesAnApplierAddress (the frontend source root
resolves empty) and SessionHandshakeTest.TheAbiFingerprintChangesWhenAnyOf-
ItsInputsDoes (GIT_COMMIT_HASH_SHORT is empty here, which a6 already recorded
as red in this configuration).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
swung0x48
2026-09-21 12:23:41 -04:00
co-authored by Claude Opus 5
parent b0f4f8b744
commit ea9fc7fa71
17 changed files with 443 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MobileGL/MG_Remote/Server/ServerMain.cpp
+64 -9
View File
@@ -43,7 +43,9 @@
#include "ServerSession.h"
#include "SurfaceControlFrame.h"
#include <Config.h> // MG_Config::Transport - D1 pins it to Spawn in this process
#include <MG_Backend/ServerRole.h>
#include <Init.h> // MG_ConfigLoader::Init - the child loads its own config (step 1.5)
#include <cstdio>
#include <cstdlib>
@@ -147,6 +149,40 @@ extern "C" __attribute__((visibility("default"))) int mobilegl_server_main(int a
}
WireLogError("MG_Remote server: pid=%d listening on \"%s\"", selfPid, endpoint.c_str());
// ---- 1.5. CONFIG, AND THEN D1.
//
// TWO SEPARATE DEFECTS LIVED HERE, and both were silent.
//
// (a) NOTHING LOADED THE CONFIG AT ALL. mobilegl_server_main calls
// InitServerRoleForSpawn directly rather than MobileGL::Initialize, and
// MG_ConfigLoader::Init is a step of the latter - so every MG_Config
// value in this process was its STATIC DEFAULT. MOBILEGL_BACKEND_TYPE
// survives the launcher's scrub on purpose, and it was being read by
// nobody: a DirectVulkan session would have brought up a DirectGLES
// server and then disagreed with its client about which backend the
// capability mask describes.
//
// (b) THE CHILD RESOLVED Transport == Monolith. CONTRACT-P6 §3.1 (D1) says
// it must read as Spawn, and a6 measured the cost of getting it wrong:
// 226 live lines test `Transport != Monolith` to select the SERVER arm,
// 148 of them in MG_Backend. Monolith flips all of them to frontend glue
// in the one process that has no frontend. Observed, exactly as
// predicted: TextureImpl::UnitTexturesByHandle() answered false, Clear
// took the legacy arm that dereferences borrowed FRONTEND slot pointers,
// and the apply thread took a SIGSEGV inside SyncNeccessaryTextures on
// the first Clear record of the OpenRA retrace.
//
// IT IS SET HERE AND NOT THROUGH THE ENVIRONMENT because the environment is
// where it must NOT appear: LooksLikeAClientEnvironment above exits 65 if
// MOBILEGL_TRANSPORT survived into this process, and that check is
// anti-recursion catch (b). D1's own answer is that Dial - not Transport -
// is the anti-recursion axis, so Transport is free to say what is true.
MobileGL::MG_ConfigLoader::Init();
MobileGL::MG_Config::Transport = MobileGL::MG_Config::TransportMode::Spawn;
WireLogError("MG_Remote server: pid=%d config loaded, backend=%d, Transport pinned to Spawn "
"(D1: this process IS the server arm)",
selfPid, static_cast<int>(MobileGL::MG_Config::ActiveBackendType));
// ---- 2. the backend, through the SAME entry point the inproc server role
// uses (MG_Backend/ServerRole.h). No EGL yet: the context is created on the
// apply thread when the client's first eglMakeCurrent crosses.
@@ -188,8 +224,21 @@ extern "C" __attribute__((visibility("default"))) int mobilegl_server_main(int a
std::fflush(nullptr);
::_exit(74);
}
SocketDoorbell selfBell(serverBell[0], /*code=*/1, /*ownsFd=*/true);
SocketDoorbell peerBell(clientBell[0], /*code=*/1, /*ownsFd=*/true);
// PARK AND NOTIFY ON DIFFERENT DESCRIPTORS, and this is not a refinement -
// the single-fd form CANNOT WAKE ITSELF. send() on one end of a socketpair
// is delivered to the OTHER end, so a one-fd bell built on serverBell[0]
// writes to serverBell[1] and polls serverBell[0]: correct for waking a
// PEER, useless for waking a thread in this process. The server needs
// exactly that, because the control pump posts into the apply thread's
// mailbox and then has to ring the bell that thread is parked on. Measured
// symptom when it was wrong: every eglInitialize crossed, landed in the
// mailbox, and timed out at 5 s because nothing ever woke mgl-srv-apply.
SocketDoorbell selfBell(/*parkFd=*/serverBell[0], /*notifyFd=*/serverBell[1], /*code=*/1,
/*ownsFds=*/true);
// RINGS ONLY. The client parks on clientBell[0]; writing clientBell[1] is
// what reaches it. parkFd = -1 says in the type that this side never waits.
SocketDoorbell peerBell(/*parkFd=*/-1, /*notifyFd=*/clientBell[1], /*code=*/1,
/*ownsFds=*/true);
Server::ServerSession& session = Server::ServerSessionInstance();
session.SetExternalDoorbells(&selfBell, &peerBell);
@@ -237,10 +286,15 @@ extern "C" __attribute__((visibility("default"))) int mobilegl_server_main(int a
::_exit(69);
}
}
// Slots 4 and 5 are the bells. The client gets the OTHER end of each pair:
// it writes to the server's bell and polls its own.
const int bellFds[2] = {serverBell[1], clientBell[1]};
for (std::uint32_t index = 0; index < 2; ++index) {
// SLOTS 4, 5 AND 6 ARE THE BELLS - three, not two, and the third is the
// one the two-fd form above forces:
// 4 serverBell[1] the client's handle to RING THE SERVER
// 5 clientBell[0] the client's PARK end
// 6 clientBell[1] the client's handle to ring ITSELF, for the same
// reason the server needs serverBell[1]
// Sharing DUPs, so the descriptors these bells own stay valid here.
const int bellFds[3] = {serverBell[1], clientBell[0], clientBell[1]};
for (std::uint32_t index = 0; index < 3; ++index) {
Sideband sideband{4 + index, 0};
if (control->ShareFd(bellFds[index], MobileGLByteSpan{&sideband, sizeof(sideband)}) !=
MOBILEGL_OK) {
@@ -250,8 +304,9 @@ extern "C" __attribute__((visibility("default"))) int mobilegl_server_main(int a
::_exit(69);
}
}
::close(serverBell[1]);
::close(clientBell[1]);
// clientBell[0] is the CLIENT's park end and no bell here owns it; the
// other three belong to selfBell and peerBell and are closed with them.
::close(clientBell[0]);
}
// ---- 7. the apply thread. It holds the native context for its whole life,
@@ -264,7 +319,7 @@ extern "C" __attribute__((visibility("default"))) int mobilegl_server_main(int a
}
WireLogError("MG_Remote server: pid=%d transport=spawn role=server ready "
"(backend up, six descriptors handed over, apply thread running)",
"(backend up, seven descriptors handed over, apply thread running)",
selfPid);
// ---- 8. the control pump. EOF is the whole exit condition: no timeout may