59 lines
2.5 KiB
Markdown
59 lines
2.5 KiB
Markdown
# Phase-1 hardware test plan
|
|
|
|
## Preconditions
|
|
|
|
Every item must be complete before transfer:
|
|
|
|
- exact firmware is recorded and allowlisted for one artifact;
|
|
- the discovery-only capability probe has already completed on that firmware;
|
|
- source commit, SDK/SDL commits, artifact SHA-256, and static imports match the
|
|
reviewed manifest;
|
|
- the console has no unsaved work and automatic retry/boot integration is off;
|
|
- an operator and observer have the redacted JSON-stage log visible;
|
|
- the bounded-wait blocker below has an accepted resolution.
|
|
|
|
## Proposed timeline
|
|
|
|
1. Verify digest again immediately before transfer.
|
|
2. Transfer manually using an existing approved userland loader workflow.
|
|
3. Start once, manually. No boot hook or retry.
|
|
4. Require `firmware_gate`, `video_init`, `window_create`, `surface_acquire`,
|
|
and `cpu_fill` within five seconds total.
|
|
5. Permit exactly one `single_present` and a one-second hold.
|
|
6. Require `cleanup` and process exit within five seconds after present.
|
|
7. Preserve logs and mark the firmware row pass, fail, or anomalous.
|
|
|
|
## Watchdog and timeout
|
|
|
|
The application stages are bounded except the pinned SDL call
|
|
`SDL_UpdateWindowSurface`, whose backend waits for a flip event without a
|
|
publicly proven finite timeout. A cooperative application thread cannot safely
|
|
cancel it. Force-killing a thread while it owns VideoOut or direct-memory state
|
|
is prohibited.
|
|
|
|
Before authorization, one of these must be proven and separately reviewed:
|
|
|
|
1. a public, licensed SDL/VideoOut change that supplies a bounded wait and
|
|
returns control for cleanup; or
|
|
2. a userland process supervisor whose termination semantics guarantee OS
|
|
cleanup of VideoOut, equeue, and direct-memory ownership.
|
|
|
|
Until then, the operator wall-clock limit is a detection mechanism only, not a
|
|
safe watchdog, and the hardware test remains blocked.
|
|
|
|
## Cleanup, rollback, and emergency stop
|
|
|
|
Normal cleanup is `SDL_DestroyWindow` followed by `SDL_Quit`; the pinned
|
|
backend then closes VideoOut, releases direct memory, and deletes its equeue.
|
|
No second flip is attempted during cleanup.
|
|
|
|
On any error, missing stage, display anomaly, or deadline:
|
|
|
|
- do not retry;
|
|
- request normal userland process termination only if responsive;
|
|
- do not kill an individual worker thread;
|
|
- if display ownership does not return, use the console's normal controlled
|
|
restart procedure; never patch firmware, registers, clocks, or fans;
|
|
- after restart, use the existing SDL software path and mark the artifact and
|
|
firmware combination failed/unknown pending review.
|