Files
vt1200/xie/evidence/three_wrong_assumptions.txt
T
arti d8d54bb990 feat(xie): a client-chosen XIE image is displayed on the VT1200
The XIE path now runs end to end: XieCreateImage -> XieCreatePhoto ->
XiePutTile -> XieExport(photomap -> depth-1 pixmap) -> XCopyArea(pixmap ->
window), and the client's tile appears on screen at the client's own window
position, pixel-exact.

TWO FAULTS BEHIND THE LONG DEAD END

1. Device model (harness/mame/vt1200.cpp, opt-in VT1200_ACCEL=1).  The
   accelerator's output port 0x5600200 returns the pixel stream the firmware
   pushed into the FIFO -- the firmware then stores it into the drawable itself
   (file 0x125528: MOVE *B6,*B1 ; ADDK 0x10,B1).  The FIFO read pointer was
   never reset between transfers, so consecutive exports read stale words and
   the same fill produced 759 then 516 set pixels.  Reset m_fifo_in/out on the
   data-register write; the export is now deterministic.

2. Measurement, not the device.
   - dwt/screenshot.py without --real reads 1024x1024 at a 128-byte row stride,
     but the VR319 default programs 1280x1024 at a 2048-bit (256-byte) pitch.
     That is the "shifted" picture; --real is the correct read.
   - The earlier "0 differing bytes over 128 KiB" VRAM comparison stepped peek
     by 1024 *bit* addresses, so it scanned rows 0..63 only -- never the window
     at rows 200..263.  Over the real raster the white/black diff is 576 bytes
     spanning exactly those rows.
   - New instrument: decclient does a server-side XGetImage readback of the
     pixmap and window and counts set pixels.  That separated "the server never
     drew it" from "the framebuffer view is wrong".

EVIDENCE (reproduced twice, the second time from a fresh machine)

  no export vs 0xFF : 4096 / 4096 pixels differ
  no export vs 0x00 :    0 / 4096   (the window background is black)
  0xFF      vs 0x00 : 4096 / 4096
  0xAA      vs 0x0F : 2048 / 4096   (the two stripe phases)

Tile byte 0xAA reproduces as 1-pixel vertical stripes, 0x0F as 4-pixel, with
no shear -- so the placement is right and the pixels are the client's.

Contents: xie/ holds DEC XIE 2.3 headers, 84 man pages and complete
client+server source; a libXie.a and decclient built from DEC's own code; the
XIE probes; and evidence/ with every measurement, including explicit
retractions of the earlier wrong readings (VRAM_IDENTICAL_FOR_BOTH_FILLS and
friends).  xie/evidence/XIE_IMAGE_DISPLAYED.md is the report; frames are in
xie/evidence/png/.

The accelerator model stays opt-in: it answers the status poll and relays the
pixel stream, but performs no compositing, so it is a stand-in and the verified
default configuration is unchanged (a no-env run still parks in the level-0
diagnostics menu at PC=3FDCE400).
2026-11-01 23:22:25 +02:00

35 lines
1.9 KiB
Plaintext

THREE STRUCTURAL ASSUMPTIONS TESTED THIS TURN -- ALL WRONG. Recorded so the
next person does not repeat them.
1) "0x7F638C2 is the resource allocator" -> WRONG.
file 0x1238C2 is a printf-style logger: it loads format descriptors
(MOVI 0x3fb1cea0 / 0x3fb1ce60 / 0x3fb1cf20 / 0x3fb1cf60), fetches args from
A11's fields and calls 0x7FC22DE / 0x7FC1BD2 / 0x7FC2F04. The real
allocation is the NEXT call, 0x7EACA82 -> file 0x6CA82.
2) "0x7F174A4 is the XIE resource-table lookup" -> WRONG.
file 0xD74A4 indexes a table at bit 0x21FFE0 by
N = (id & 0xFFF00000) >> 12
and bounds-checks N against the count at 0x225870, which reads 16.
For our client ids (0x40C000, 0x40D000) N = 1024, i.e. far out of range,
and the bucket slot (0x227FE0) reads 0.
(id & 0xFFF00000)>>12 is the CORE-X client index, so this is the core-X
resource lookup by XID, not anything to do with XIE resources.
3) "@0x1AD980 / @0x1AD990 / @0x1AD9A0 are the XIE resource list heads" -> WRONG.
Reading 32 bits at those bit addresses yields 0x02000002, 0x04000200 and
0x00000400 -- small 16-bit-field values, and following them as a pointer
chain reads zeros. They are not list heads; the arguments built around
them at 0x679B0E / 0x67B28 are something else (they are read with `MOVE
@addr,A11,0x0`, an 8-bit field, which is suspicious in itself).
WHY THIS MATTERS: the BadMatch(8) / BadAccess(10) / BadIDChoice(14) codes we
have been comparing all session were being attributed to structures I had
mis-identified. The measurements themselves are sound (S19LOOK a8 = 0x08 /
0x0A / 0x0E at 0x6A7B4 is a direct observation), but every explanation built on
top of these three functions is now void.
CONCLUSION: further static inference about the XIE resource model is producing
wrong answers faster than it produces progress. The remaining work needs the
protocol definition, not more guessing.