// xref 0462
//
// This code is using the shot counter as an index into the ROM
// (where some code resides), for the purposes of random number generation.
//
// For the saucer direction logic, only bit 0 of each bytecode is used.
//
// The 256 bytes used reside at 0800 -> 08FF
//
// If you check bit 0 of each byte in that ROM section, you will find that there is no bias,
// and there are exactly 128 0's and 128 1's.
//
// It seems unlikely that this was an accident, I think Nishikado deliberately constructed
// the ROM this way, and used some well placed NOPs to achieve fair balance.
//
// E.g. these NOPs
//
// 0854: 00 00 00
// 0883: 00 00 00
//
// This information can be exploited to the player's advantage.
//
// If using the shot counting trick to get high scores, the
// expected saucer direction for the first 6 saucers (if counting),
// will be as follows:
//
// [22,37,52,67,82,97]
// [0, 1, 1, 0, 1, 1]
// [L, R, R, L, R, R]
There's indeed a connection between record/replay and deterministic execution, but there's a difference worth mentioning, too. Both can tell you about the past, but only deterministic execution can tell you about alternate histories. And that's very valuable both for bug search (fuzzing works better) and for debugging (see for example the graphs where we show when a bug became likely to occur, seconds before it actually occurred).
(Also, you won't be able to usefully record a hypervisor with jockey or rr, because those operate in userspace and the actual execution of guest code does not. You could probably record software cpu execution with qemu, but it would be slow)
I have been down this road a little bit, applying the ideas from jockey to write and ship a deterministic HFT system, so I have some understanding of the difficulties here.
We needed that for fault tolerance, so we could have a hot synced standby. We did have to record all inputs (and outputs for sanity checking) though.
We did also get a good taste of the debugging superpowers you mention in your blog article. We could pull down a trace from a days trading and replay on our own machines, and skip back and forth in time and find the root cause of anything.
It sounds like what you have done is something similar, but with your own (AMD64) virtual machine implementation, making it fully deterministic and replayable, and providing useful and custom hardware impls (networking, clock, etc).
That sounds like a lot of hard but also fun work.
I am missing something though, in that you are not using it just for lockstep sync or deterministic replays, but you are using it for fuzzing. That is, you are altering the replay somehow to find crashes or assertion failures.
Ah, I think perhaps you are running a large number of sims with a different seed (for injecting faults or whatnot) for your VM, and then just recording that seed when something fails.
I assume deterministic execution also lets you do failing test case reduction.
I've found this sort of high volume random testing w. test case reduction is just a game changer for compiler testing, where there's much the same effect at quickly flushing out newly introduced bugs.
Birdi runs drone capture projects across Australia. We acquire and process drone imagery, and provide an online platform for our customers to interact with rich geospatial data.
We are a fully remote, growing and highly experienced team that moves fast and builds flexible and powerful solutions to real problems.
Birdi | Senior Front-End | Remote | Full-time | https://www.birdi.io/careers | Australian working rights required.
Birdi runs drone capture projects across Australia. We acquire and process drone imagery, and provide an online platform for our customers to interact with rich geospatial data.
We are a fully remote, growing and highly experienced team that moves fast and builds flexible and powerful solutions to real problems.
Birdi runs drone capture projects across Australia. We acquire and
process drone imagery, and provide an online platform for our customers to interact with rich geospatial data.
We are a fully remote, growing and highly experienced team that moves fast and builds flexible and powerful solutions to real problems.
reply