CydandClaude Opus 4.8
6c7e9cf1dc
The coefficient-copy (0xf0411cd4) writes per-region DMA command lists; captured
from the cap7 death-cam they decode cleanly against DMAENGN.H ({addr,opcode}
pairs, SEND/SENDE/TXDN/TILE/GOTO/FLUSH). Every region references the same
tile-relative payloads and differs only in TILE(id) + the GOTO link.
Dumping the SEND payloads shows they are NOT opaque: they interleave control
words with embedded IEEE floats = the edge/plane/colour coefficients, loaded as
a bit-serial MEMpluseqMEM sweep (regular 4-word instruction: increment float +
length/bit-address control + dest plane). So the micro-code decode is now
extraction + bit-serial execution, not blind ISA reversing -- the remaining
blocker is the control-word field split (igc_opco.h is not in the dump).
Full findings + next steps in MICROCODE-DECODE-NOTES.md; probes coefdump.py
(DMA lists) + payload_dump.py (payload floats), restore from snapv2.pkl.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
48 lines
2.3 KiB
Python
48 lines
2.3 KiB
Python
"""Run the death-cam draw, then dump the actual SEND payloads referenced by the region
|
|
DMA lists (0x08015000 SEND4=edge, 0x08015020 SENDE0x45=z/color, 0x08015260, 0x08015380,
|
|
0x08014100). Words + float + double interpretations, to see if these are float
|
|
coefficients (A,B,C planes) or compiled bit-serial micro-code."""
|
|
import sys, time, struct, pickle
|
|
sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp')
|
|
import emu860, dis860, emu_main
|
|
emu860.Mem.log = lambda self, *a, **k: None
|
|
S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad'
|
|
snap = pickle.load(open(S + r'\snapv2.pkl', 'rb'))
|
|
r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000)
|
|
cpu = r.cpu
|
|
cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()}
|
|
cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl'])
|
|
cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc']
|
|
cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes()
|
|
cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe'])
|
|
cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t']
|
|
cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap'])
|
|
|
|
# run through the first full draw so the payloads are populated
|
|
t0 = time.time(); startq = r.qi
|
|
while time.time() - t0 < 60:
|
|
if r.qi >= startq + 2: # let one draw_scene complete
|
|
break
|
|
h = r.hooks.get(cpu.pc)
|
|
if h:
|
|
if h(cpu) == 'done': break
|
|
continue
|
|
if not cpu.step(): break
|
|
|
|
def rw(a): return cpu.mem.r32(a & 0xffffffff)
|
|
def rf(a): return struct.unpack('<f', struct.pack('<I', rw(a)))[0]
|
|
def rd(a):
|
|
return struct.unpack('<d', struct.pack('<II', rw(a), rw(a + 4)))[0]
|
|
|
|
for base, n, label in [(0x08015000, 8, 'SEND(4) edge'),
|
|
(0x08015020, 0x45, 'SENDE(0x45) z/color'),
|
|
(0x08015260, 0x21, 'SEND(0x21)'),
|
|
(0x08015380, 0x29, 'SEND(0x29)'),
|
|
(0x08014100, 8, 'TXDN 0x08014100')]:
|
|
print("\n=== %s @ %#010x (%d words) ===" % (label, base, n))
|
|
for i in range(min(n, 24)):
|
|
a = base + i * 4; w = rw(a)
|
|
f = struct.unpack('<f', struct.pack('<I', w))[0]
|
|
ftag = ("%12.4g" % f) if (1e-6 < abs(f) < 1e8) else ""
|
|
print(" +%03x %08x %s" % (i * 4, w, ftag))
|