This commit is contained in:
Chimera GFX release export
@@ -0,0 +1,53 @@
|
||||
# Hardware approval package
|
||||
|
||||
Status: **not authorized; offline review artifacts only**.
|
||||
|
||||
## Current offline review artifacts
|
||||
|
||||
| Artifact | Firmware | SHA-256 | Transfer/execution |
|
||||
|---|---|---|---|
|
||||
| `chimera-gfx-capability-probe.elf` | `NONE` | `f0f74978ac62490ff2482386e9c4efa3ad6d6cc46e10d54c41cb8669b4449f36` | false / false |
|
||||
| `chimera-gfx-phase1-videoout-clear.elf` | `NONE` | `2e826ac4ea2bffb626d82e370f98909bb508417d92b1ac3796e9f5a902e975c9` | false / false |
|
||||
| `chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf` | `9.60` | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` | false / false; permanently denylisted |
|
||||
|
||||
The two `NONE` artifacts are tied to source commit
|
||||
`72292f2d5788ad643e9d1816ce28ab754ef739b5`. The offline test and import
|
||||
evidence is in `docs/evidence/phase0-build-2026-07-17.md`. These exact artifacts
|
||||
cannot enter the project-requested GNM module open or SDL initialization because
|
||||
their firmware gate is `NONE`. The SDK payload CRT still initializes before
|
||||
`main`.
|
||||
|
||||
## First hardware gate
|
||||
|
||||
The first console action, if it ever becomes safe and receives new permission,
|
||||
must be the non-rendering capability probe, not the VideoOut experiment.
|
||||
Project code would call only `dlopen`, `dlsym`, `dlclose`, and standard output
|
||||
functions. It would resolve the 21 manifest names, record only booleans, invoke
|
||||
no resolved pointer, and request no submit, draw, dispatch, flip, or GPU-memory
|
||||
operation.
|
||||
|
||||
Jens reported exact firmware `9.60` and authorized only its offline build and
|
||||
audit. The pinned SDK v0.41 payload CRT performs prohibited kernel process-state
|
||||
writes before `main`, so the resulting ELF is not execution-eligible even
|
||||
though the project gate precedes `dlopen`. A kernelwrite-free startup route and
|
||||
a newly built digest are required before execution can be considered.
|
||||
|
||||
## VideoOut gate after successful discovery
|
||||
|
||||
The later experiment would execute the exact SDL sequence and indirect API
|
||||
inventory in `VIDEOOUT_CLEAR_EXPERIMENT.md`. Likely failures are a clean error,
|
||||
payload crash, stuck payload, lost display ownership, or required controlled
|
||||
console restart. Automatic retry is prohibited. The unbounded SDL flip wait is
|
||||
an unresolved blocker even after symbol discovery.
|
||||
|
||||
## Authorization state
|
||||
|
||||
The 9.60 offline build authorization has been received. No transfer or execution
|
||||
authorization has been received. No execution-permission wording is offered
|
||||
while the SDK CRT blocker remains. The firmware-specific evidence and blocked
|
||||
approval package must record the filename, SHA-256, exact source commit, all
|
||||
imports, startup/loader/cleanup call chain, and offline tests. Approval never
|
||||
carries forward to the VideoOut test.
|
||||
|
||||
The completed firmware-specific package is
|
||||
`docs/approvals/probe-9.60-transfer-execution.md`.
|
||||
@@ -0,0 +1,39 @@
|
||||
# Firmware and ABI checklist
|
||||
|
||||
## Firmware identity
|
||||
|
||||
- [ ] Exact user-visible firmware identifier supplied by Jens
|
||||
- [ ] Reproducible identification method documented without kernel access
|
||||
- [ ] Identifier added to one candidate build only
|
||||
- [ ] `FIRMWARE_COMPATIBILITY.md` row created as untested
|
||||
- [ ] No compatibility inferred from another revision
|
||||
|
||||
## Discovery gate
|
||||
|
||||
- [ ] Capability-probe artifact manifest and SHA-256 reviewed
|
||||
- [ ] Explicit artifact-specific execution permission recorded
|
||||
- [ ] Probe resolves names only and invokes no resolved pointer
|
||||
- [ ] Redacted result log archived
|
||||
- [ ] Runtime module candidate confirmed or rejected for this firmware
|
||||
|
||||
## SDL/VideoOut evidence
|
||||
|
||||
- [x] SDL source commit pinned
|
||||
- [x] Zlib license and overlay notice recorded
|
||||
- [x] Project code uses public SDL2 APIs only
|
||||
- [x] Keyboard/IME initialization removed from the staged build
|
||||
- [x] Direct GNM imports forbidden
|
||||
- [ ] Bounded flip-wait or safe supervisor proven
|
||||
- [ ] Cleanup behavior observed on this exact firmware
|
||||
|
||||
## Artifact review
|
||||
|
||||
- [ ] Clean source commit matches manifest
|
||||
- [ ] SDK and SDL commits match locks
|
||||
- [ ] Firmware is not `NONE`
|
||||
- [ ] ELF filename, size, and SHA-256 match
|
||||
- [ ] Imports match the API inventory
|
||||
- [ ] Offline host, static-analysis, cross-compile, and secret tests pass
|
||||
- [ ] Transfer and execution remain false until separately approved
|
||||
|
||||
Any unchecked runtime item blocks execution.
|
||||
@@ -0,0 +1,58 @@
|
||||
# Phase-1 hardware test plan
|
||||
|
||||
## Preconditions
|
||||
|
||||
Every item must be complete before transfer:
|
||||
|
||||
- exact firmware is recorded and allowlisted for one artifact;
|
||||
- the discovery-only capability probe has already completed on that firmware;
|
||||
- source commit, SDK/SDL commits, artifact SHA-256, and static imports match the
|
||||
reviewed manifest;
|
||||
- the console has no unsaved work and automatic retry/boot integration is off;
|
||||
- an operator and observer have the redacted JSON-stage log visible;
|
||||
- the bounded-wait blocker below has an accepted resolution.
|
||||
|
||||
## Proposed timeline
|
||||
|
||||
1. Verify digest again immediately before transfer.
|
||||
2. Transfer manually using an existing approved userland loader workflow.
|
||||
3. Start once, manually. No boot hook or retry.
|
||||
4. Require `firmware_gate`, `video_init`, `window_create`, `surface_acquire`,
|
||||
and `cpu_fill` within five seconds total.
|
||||
5. Permit exactly one `single_present` and a one-second hold.
|
||||
6. Require `cleanup` and process exit within five seconds after present.
|
||||
7. Preserve logs and mark the firmware row pass, fail, or anomalous.
|
||||
|
||||
## Watchdog and timeout
|
||||
|
||||
The application stages are bounded except the pinned SDL call
|
||||
`SDL_UpdateWindowSurface`, whose backend waits for a flip event without a
|
||||
publicly proven finite timeout. A cooperative application thread cannot safely
|
||||
cancel it. Force-killing a thread while it owns VideoOut or direct-memory state
|
||||
is prohibited.
|
||||
|
||||
Before authorization, one of these must be proven and separately reviewed:
|
||||
|
||||
1. a public, licensed SDL/VideoOut change that supplies a bounded wait and
|
||||
returns control for cleanup; or
|
||||
2. a userland process supervisor whose termination semantics guarantee OS
|
||||
cleanup of VideoOut, equeue, and direct-memory ownership.
|
||||
|
||||
Until then, the operator wall-clock limit is a detection mechanism only, not a
|
||||
safe watchdog, and the hardware test remains blocked.
|
||||
|
||||
## Cleanup, rollback, and emergency stop
|
||||
|
||||
Normal cleanup is `SDL_DestroyWindow` followed by `SDL_Quit`; the pinned
|
||||
backend then closes VideoOut, releases direct memory, and deletes its equeue.
|
||||
No second flip is attempted during cleanup.
|
||||
|
||||
On any error, missing stage, display anomaly, or deadline:
|
||||
|
||||
- do not retry;
|
||||
- request normal userland process termination only if responsive;
|
||||
- do not kill an individual worker thread;
|
||||
- if display ownership does not return, use the console's normal controlled
|
||||
restart procedure; never patch firmware, registers, clocks, or fans;
|
||||
- after restart, use the existing SDL software path and mark the artifact and
|
||||
firmware combination failed/unknown pending review.
|
||||
@@ -0,0 +1,13 @@
|
||||
# Offline Phase-1 preparation
|
||||
|
||||
No Phase-1 artifact has been transferred or executed. This directory contains
|
||||
the review package for the first CPU-framebuffer/VideoOut experiment:
|
||||
|
||||
- `VIDEOOUT_CLEAR_EXPERIMENT.md`: exact design and API inventory;
|
||||
- `HARDWARE_TEST_PLAN.md`: staging, timeout, cleanup, rollback, and stop rules;
|
||||
- `FIRMWARE_ABI_CHECKLIST.md`: evidence that must be completed per firmware;
|
||||
- `APPROVAL_PACKAGE.md`: artifact-specific authorization gate.
|
||||
|
||||
The compile target is off by default and the produced review artifact embeds
|
||||
firmware `NONE`, so it refuses before `SDL_Init`. This preparation does not
|
||||
authorize a hardware test.
|
||||
@@ -0,0 +1,62 @@
|
||||
# Minimal VideoOut clear-frame experiment
|
||||
|
||||
## Goal and non-goals
|
||||
|
||||
Display exactly one fixed 1920x1080 solid frame through the existing pinned
|
||||
PS5 SDL2 CPU-framebuffer backend, hold it for one second, and cleanly release
|
||||
SDL. This experiment does not use `libchimera-gfx` hardware contexts, GNM,
|
||||
shaders, command buffers, compute, custom tiling code, input, audio, OpenGL,
|
||||
OSMesa, or a render loop.
|
||||
|
||||
## Application sequence
|
||||
|
||||
Project code performs the following calls only after exact compile-time and
|
||||
runtime firmware identifiers match and the literal acknowledgement is present:
|
||||
|
||||
1. `SDL_SetMainReady`
|
||||
2. `SDL_Init(SDL_INIT_VIDEO)`
|
||||
3. `SDL_CreateWindow`
|
||||
4. `SDL_GetWindowSurface`
|
||||
5. `SDL_MapRGBA`
|
||||
6. `SDL_FillRect`
|
||||
7. `SDL_UpdateWindowSurface` exactly once
|
||||
8. `SDL_Delay(1000)`
|
||||
9. `SDL_DestroyWindow`
|
||||
10. `SDL_Quit`
|
||||
|
||||
The fixed color is RGBA `(0x18, 0x2a, 0x41, 0xff)`. Logs contain stage names
|
||||
and booleans only.
|
||||
|
||||
## Indirect pinned-SDL behavior
|
||||
|
||||
At commit `0baf4ac49382b537ba449901b5b6d0d189bb1fbb`, the reviewed PS5 video
|
||||
backend indirectly uses these public export names:
|
||||
|
||||
- initialization: `sceSystemServiceHideSplashScreen`, `sceVideoOutOpen`,
|
||||
`sceKernelAllocateMainDirectMemory`, `sceKernelMapDirectMemory`,
|
||||
`sceKernelCreateEqueue`, `sceVideoOutAddFlipEvent`,
|
||||
`sceVideoOutSetFlipRate`, `sceVideoOutSetBufferAttribute2`, and
|
||||
`sceVideoOutRegisterBuffers2`;
|
||||
- single present: `sceVideoOutSubmitFlip` and `sceKernelWaitEqueue`;
|
||||
- cleanup: `sceVideoOutDeleteFlipEvent`, `sceVideoOutClose`,
|
||||
`sceKernelReleaseDirectMemory`, and `sceKernelDeleteEqueue`.
|
||||
|
||||
These are indirect implementation observations, not independently proven
|
||||
`chimera-gfx` ABI declarations. The overlay removes keyboard and IME setup.
|
||||
|
||||
## Build boundary
|
||||
|
||||
`tools/build-phase1-videoout.sh` verifies both upstream commits, stages the
|
||||
reviewed SDL overlay, disables SDL2main plus unrelated SDL subsystems, and
|
||||
cross-compiles the probe and candidate. It then statically requires the exact
|
||||
15-name Sce import inventory above and zero GNM, keyboard, IME, or UserService
|
||||
imports. It contains no upload, run, host, port, or boot command. The default
|
||||
firmware identifier is `NONE`.
|
||||
|
||||
## Known blocker
|
||||
|
||||
The pinned SDL backend waits inside `sceKernelWaitEqueue` with no publicly
|
||||
proven bounded timeout in this call path. Project code cannot safely cancel
|
||||
that wait. The artifact is suitable for offline inspection, but not yet for
|
||||
hardware authorization until `HARDWARE_TEST_PLAN.md` records an accepted
|
||||
supervisor/recovery mechanism and an exact firmware.
|
||||
Reference in New Issue
Block a user