From 943d6e1090fc67552b86d64b21cd7f19f3071092 Mon Sep 17 00:00:00 2001 From: Cyd Date: Thu, 16 Jul 2026 15:48:22 -0500 Subject: [PATCH] Decode the SENDE (z/color) micro-code instruction format Full SENDE dump (ctrl_split.py) resolves into a regular 4-word instruction, one per bit-plane: word0 = constant increment float, word1 = [length countdown, source bit-addr] with op field 0x3a, word2 = the coefficient's place-value (the x2 chain, -1.009..-0.00788), word3 = destination bit-plane (0x21..0x31 = a 17-bit fixed-point z/color). A MEMpluseqMEM bit-serial accumulation. SEND edge payloads use the same value encoding with a different (header + 3-word group) framing. Control-word split for the z/color path is now decoded; from-scratch render still needs numeric reconstruction + plane mapping + the C term. Co-Authored-By: Claude Opus 4.8 --- .../firmware-decomp/MICROCODE-DECODE-NOTES.md | 32 +++++++++++++ emulator/firmware-decomp/ctrl_split.py | 48 +++++++++++++++++++ 2 files changed, 80 insertions(+) create mode 100644 emulator/firmware-decomp/ctrl_split.py diff --git a/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md b/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md index e09802a..a1e40cf 100644 --- a/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md +++ b/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md @@ -104,6 +104,38 @@ The value layer is decoded; what's left for a from-scratch full-frame run is the control-word field split (which chain → which plane/edge, + the C constant term) and walking every region's DMA chain. +## SENDE control-word split (z/colour sweep) — decoded + +Full SENDE dump (`scratchpad/ctrl_split.py`) shows a perfectly regular **4-word +instruction**, repeated once per bit-plane: + +``` +word0 FLOAT constant accumulator increment (e.g. -4.9265e-4), same every instr +word1 00 LL 3a AA LL = length countdown (0x14,0x13,…,0x00); AA = source bit-addr + (0x21,0x22,…); 0x3a = op field +word2 the coefficient's value at this bit-plane -> the x2 chain + (…8401213a,8381213a for the tiny low planes; then bf81213a=-1.009, + bf01213a=-0.504, be81213a=-0.252, … bc01213a=-0.00788) +word3 00 00 00 NN destination bit-plane (0x21..0x31 => a 17-bit fixed-point value) +``` + +So SENDE writes one z-or-colour value bit-serially: 17 bit-planes (0x21..0x31), +each carrying `coeff * 2^k` (word2), with a constant carry/increment (word0) and a +length countdown (word1 LL) — a `MEMpluseqMEM` accumulation. The `0x3a`/`0x21` +fields in words 1&2 are the opcode + operand selector (the exact bit split of +`3a`/`21`/`81-vs-01` still to be pinned against IGCOPS.C op numbers, but the +operand roles are clear). + +SEND(0x21)/SEND(0x29) (edge/setup) differ: they carry `00000100` headers +interspersed with 3-word `[float, ctrl, ctrl]` groups (e.g. 0.125275, 0.126196, +0.00110586 = the edge/plane bases) — same value encoding, different framing. + +To render z from a SENDE from scratch: read word2 across the 17 planes to +reconstruct the coefficient (or just take the recognisable float planes), apply +`.Czscale`=2^20, that is the per-pixel z increment; the base/C term is the plane's +value at the tile origin (still to be located in the stream). Then it is a plain +`igc_array.py` z-plane. + ## What this changes The micro-code decode is now **extraction + bit-serial execution**, not blind diff --git a/emulator/firmware-decomp/ctrl_split.py b/emulator/firmware-decomp/ctrl_split.py new file mode 100644 index 0000000..dffeffc --- /dev/null +++ b/emulator/firmware-decomp/ctrl_split.py @@ -0,0 +1,48 @@ +"""Dump the full SENDE (z/color) payload with each word broken into byte fields, and +try to identify the instruction unit: float increment, op, src/dst bit-address, length. +Goal = the control-word field split for the z/color sweep.""" +import sys, time, struct, pickle +sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp') +import emu860, dis860, emu_main +emu860.Mem.log = lambda self, *a, **k: None +S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad' +snap = pickle.load(open(S + r'\snapv2.pkl', 'rb')) +r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000) +cpu = r.cpu +cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()} +cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl']) +cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc'] +cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes() +cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe']) +cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t'] +cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap']) +t0 = time.time(); startq = r.qi +while time.time() - t0 < 60: + if r.qi >= startq + 2: break + h = r.hooks.get(cpu.pc) + if h: + if h(cpu) == 'done': break + continue + if not cpu.step(): break +def rw(a): return cpu.mem.r32(a & 0xffffffff) +def asf(w): return struct.unpack('> 23) & 0xff + return (1e-6 < abs(f) < 1e6) and (1 < e < 254) + +for base, n, tag in [(0x08015020, 0x45, 'SENDE z/color'), (0x08015260, 0x21, 'SEND 0x21'), + (0x08015380, 0x29, 'SEND 0x29'), (0x08015000, 4, 'SEND(4) edge')]: + print("\n===== %s @ %#010x (%d words) =====" % (tag, base, n)) + print(" off word b3 b2 b1 b0 interpretation") + for i in range(n): + w = rw(base + i * 4) + b = [(w >> 24) & 0xff, (w >> 16) & 0xff, (w >> 8) & 0xff, w & 0xff] + note = "" + if isfloat(w): + note = "FLOAT %.6g" % asf(w) + elif w == 0x00000100: + note = "
" + elif w < 0x100: + note = "addr/int %d (0x%x)" % (w, w) + print(" +%03x %08x %02x %02x %02x %02x %s" % (i * 4, w, b[0], b[1], b[2], b[3], note))