CydandClaude Opus 4.8
6c7e9cf1dc
The coefficient-copy (0xf0411cd4) writes per-region DMA command lists; captured
from the cap7 death-cam they decode cleanly against DMAENGN.H ({addr,opcode}
pairs, SEND/SENDE/TXDN/TILE/GOTO/FLUSH). Every region references the same
tile-relative payloads and differs only in TILE(id) + the GOTO link.
Dumping the SEND payloads shows they are NOT opaque: they interleave control
words with embedded IEEE floats = the edge/plane/colour coefficients, loaded as
a bit-serial MEMpluseqMEM sweep (regular 4-word instruction: increment float +
length/bit-address control + dest plane). So the micro-code decode is now
extraction + bit-serial execution, not blind ISA reversing -- the remaining
blocker is the control-word field split (igc_opco.h is not in the dump).
Full findings + next steps in MICROCODE-DECODE-NOTES.md; probes coefdump.py
(DMA lists) + payload_dump.py (payload floats), restore from snapv2.pkl.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
59 lines
2.5 KiB
Python
59 lines
2.5 KiB
Python
"""Dump what the coefficient-copy (0xf0411cd4, fst.d f16) writes into the region queues
|
|
during the death-cam draw. If the payload is recognisable float coefficients (edge/plane
|
|
A,B,C in a sane range) we can reconstruct terrain triangles WITHOUT decoding micro-code.
|
|
If it's integer micro-code words, that confirms the hard path."""
|
|
import sys, time, struct, pickle
|
|
sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp')
|
|
import emu860, dis860, emu_main
|
|
emu860.Mem.log = lambda self, *a, **k: None
|
|
S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad'
|
|
snap = pickle.load(open(S + r'\snapv2.pkl', 'rb'))
|
|
r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000)
|
|
cpu = r.cpu
|
|
cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()}
|
|
cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl'])
|
|
cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc']
|
|
cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes()
|
|
cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe'])
|
|
cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t']
|
|
cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap'])
|
|
|
|
COPY = 0xf0411cd4 # fst.d f16, per session 6e: coefficient/command copy
|
|
writes = []
|
|
orig_w32 = emu860.Mem.w32
|
|
def w32(self, addr, val):
|
|
if cpu.pc == COPY:
|
|
writes.append((addr & 0xffffffff, val & 0xffffffff))
|
|
return orig_w32(self, addr, val)
|
|
emu860.Mem.w32 = w32
|
|
|
|
t0 = time.time()
|
|
target = r.qi + 1
|
|
while time.time() - t0 < 90:
|
|
if len(writes) >= 400:
|
|
break
|
|
h = r.hooks.get(cpu.pc)
|
|
if h:
|
|
if h(cpu) == 'done': break
|
|
continue
|
|
if not cpu.step(): break
|
|
emu860.Mem.w32 = orig_w32
|
|
|
|
print("captured %d word-writes at the coefficient copy" % len(writes))
|
|
# group into 8-byte doubles (fst.d = two 32-bit stores, addr and addr+4)
|
|
i = 0; n = 0
|
|
while i < len(writes) - 1 and n < 60:
|
|
a0, w0 = writes[i]; a1, w1 = writes[i + 1]
|
|
if a1 == a0 + 4:
|
|
dv = struct.unpack('<d', struct.pack('<II', w0, w1))[0]
|
|
f0 = struct.unpack('<f', struct.pack('<I', w0))[0]
|
|
f1 = struct.unpack('<f', struct.pack('<I', w1))[0]
|
|
note = ""
|
|
if -1e8 < dv < 1e8 and (abs(dv) > 1e-9 or w0 == 0):
|
|
note = "dbl=%.5g" % dv
|
|
print(" @%08x: %08x %08x %-16s f=(%.4g, %.4g)" % (a0, w0, w1, note, f0, f1))
|
|
i += 2; n += 1
|
|
else:
|
|
print(" @%08x: %08x (single)" % (a0, w0))
|
|
i += 1; n += 1
|