From 90fd3497d1f6ada22c17e236ff49a0f60e4c2d71 Mon Sep 17 00:00:00 2001 From: Cyd Date: Thu, 16 Jul 2026 15:24:03 -0500 Subject: [PATCH] =?UTF-8?q?Readout=20=C2=A702:=20real=20decoded=20DMA=20li?= =?UTF-8?q?st=20+=20embedded-float=20payload=20finding?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit §02 now shows the actual per-region DMA command list captured from the emulator (region 0x0801fa40: SEND/SENDE/TXDN/TILE/GOTO) and the real SENDE payload with its embedded float coefficients (bit-serial MEMpluseqMEM sweep). §05 + the last-mile list updated: the micro-code is partly decoded (lists clean, payloads carry recoverable floats), remaining work is the control-word field split. Co-Authored-By: Claude Opus 4.8 --- emulator/firmware-decomp/render-readout.html | 60 +++++++++++--------- 1 file changed, 33 insertions(+), 27 deletions(-) diff --git a/emulator/firmware-decomp/render-readout.html b/emulator/firmware-decomp/render-readout.html index a440546..b372c9b 100644 --- a/emulator/firmware-decomp/render-readout.html +++ b/emulator/firmware-decomp/render-readout.html @@ -228,35 +228,38 @@

02 The output, decoded

The firmware DMAs the render to the card as an opcode stream - (DMAENGN.H). Left: a real per-region command list captured - from the emulator. Right: where each SEND lands — bit-serial IGC micro-code, not - plain floats, which is why final pixels need the array simulator.

+ (DMAENGN.H). Both panels below are captured verbatim from the + emulator. Left: a real per-region command list — every region references the same + tile-relative payloads and differs only in its TILE id and the + GOTO link. Right: inside a SEND — the payload isn't opaque, it + interleaves control words with the actual float coefficients, swept bit-plane by + bit-plane into pixel memory.

-  region 0x0801f000 · DMA list
+  region 0x0801fa40 · DMA list
# addr            opcode
-0x08015800  SEND(4)      ; edge coeffs
+0x08015000  SEND(4)      ; edge coeffs
 0x00000000  FLUSH
-0x08015820  SENDE(0x35)  ; z / colour
-0x080159e0  SEND(0x18)
-0x08015aa0  SEND(6)
+0x08015020  SENDE(0x45)  ; z / colour
 0x00000000  FLUSH
-0x08015ae0  SENDE(0x5c)
-0x08015dc0  SEND(9)      ; …binned per 64×128 tile
+0x08014100 TXDN +0x08015260 SEND(0x21) +0x08015380 SEND(0x29) +0x00000020 TILE ; tile id +0x0801f008 GOTO ; → next region
-  SEND target 0x0801f100 · IGC micro-code
-
# bit-serial Pixel-Planes program
+           SENDE target 0x08015020 · payload
+
# bit-serial sweep (MEMpluseqMEM)
 +000  00000100   ; header
-+008  46800000   ; 16384.0 scale
-+01c  0610ff00  00401000
-+024  0610ff08  00401081
-+02c  0610ff10  00401102
-+034  0610ff18  00401183
-      ; MEM += MEM, bit-serial
-      ; eval Ax+By+C across the tile
++004 3a804834 ; = 9.79e-4 float ++008 8401213a ++00c 00000021 ; bit-plane 0x21 ++010 ba01253a ; = −4.93e-4 += A ++018 8381213a ++01c 00000022 ; bit-plane 0x22 …
@@ -331,10 +334,13 @@ -

What this is not, yet: a decode of the compiled - bit-serial micro-code the DMA actually ships (§02, right). That binary encoding is still - undecoded, and it is how the ground and sky — which carry no stored vertices — reach the array. - This is the array's computational model: the pixels that micro-code would produce.

+

What this is not, yet: execution of the compiled + micro-code the DMA actually ships (§02, right) — the form the ground and sky take, since + they carry no stored vertices. That stream is now partly decoded: the per-region command lists + read cleanly, and the SEND payloads turn out to carry the real float coefficients + interleaved with a regular bit-serial sweep — so what remains is pinning the control-word fields + and running that sweep, not reversing an opaque binary. This section is the array's + computational model: the pixels that micro-code produces.

@@ -369,10 +375,10 @@

The last mile to pixels

    -
  • The array's computational model runs and matches the reference — the piece left is the board's own compiled micro-code
    • -
  • The DMA's SEND payloads are bit-serial Pixel-Planes micro-code; that binary encoding is still undecoded
    • -
  • It is how the ground and sky — which carry no stored vertices — reach the array
    • -
  • Cross-referencing the 0x0610ff / 0x00401 words against IGCOPS.C + the PXPL5 assembler is the next decode
    • +
  • The array's computational model runs and matches the reference — the piece left is executing the board's own compiled micro-code
    • +
  • The per-region DMA command lists decode cleanly (§02) — SEND / SENDE / TXDN / TILE / GOTO, tile-relative
    • +
  • The SEND payloads carry real float coefficients in a regular bit-serial sweep — recoverable, not opaque
    • +
  • What's left: pin the control-word fields, run the sweep per tile → the ground and sky that carry no stored vertices