swung0x48/MobileGL
1
0
Fork 0
mirror of https://github.com/MobileGL-Dev/MobileGL synced 2026-11-13 04:53:23 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
363fce247f59cd56cf641a8aee6a10876e7ffdd7
MobileGL/docs/Disaggregated/notes/p5c/BRIEF-p5c-audit.md
T
swung0x48 aba329cc53 [Docs] (Disaggregated): P6's plan and contract draft; the working notes move from a local directory into the repository 
Two things land together: the plan and contract draft P6 needs before it starts, and the
working notes that until now existed on exactly one machine.

1. P6's plan and contract draft (neither started; not one line of code)

     docs/Disaggregated/P6-SPAWN-PLAN.md      the package plan
     docs/Disaggregated/P6-CONTRACT-DRAFT.md  the contract draft (moves to
                                              MG_Remote/CONTRACT-P6.md when c6 lands)

   The three findings that mattered, all written into the documents:

   a. P6 is SMALLER than its roadmap cell suggests. The transport primitives are already in
      the tree and already tested: SocketDoorbell including hangup detection and the two
      lost-wakeup fences (Doorbell.cpp:211-360, four cases in FdPassingTest), SCM_RIGHTS fd
      passing, ShmSegment::Adopt, and the SurfaceOp / WindowKind schema already defined in
      protocol.fbs. inproc uses a real second shm mapping rather than an alias, and
      SessionRings.h:22-28 says that was done so today is not the first time it runs. P6 is
      assembly plus a control plane plus a process, not "write a socket transport".

   b. The evidence for "P6 is only a transport swap" has EXPIRED. It was bought by P5c, whose
      audit found 59 direct memory accesses in a tree that already looked clean. P5e changed
      the tree again. So the first package, a6, is a read-only audit that writes no code, and
      every contract row that depends on it is marked PENDING a6 rather than decided in
      advance.

   c. P6 does not get a game running on the phone. ANativeWindow* is meaningless in the child,
      and protocol.fbs:186-196's own comment says Android transfers the window out of band -
      that band is P12. P6 lands pbuffer / surfaceless / offscreen, which is what HeadlessGL,
      the split-equivalent lane and trace replay need, and which is exactly what P6's own exit
      gate measures. A real window reaching the server is a named refusal. This gets its own
      section because "P6 is done" would otherwise read as "the game runs now".

   The contract adds rule G: a role may not name a process-local handle. It extends P5c's
   rule E (a role may not name the other role's memory) from memory to identity - EGLDisplay /
   EGLSurface / EGLContext / ANativeWindow* / fd number / pid / mapped address either cross as
   a token this contract defines or they do not cross, and a descriptor crosses only through
   SCM_RIGHTS, where the kernel renumbers it.

   What P5e left for P6 gets its own section. The latch semantics are already designed
   (ARCHITECTURE.md:504) and are copied unchanged. What is new is that after run-ahead the
   client no longer waits while the peer process can DIE: the client holds records that were
   published and will never be applied, and Android's freezer suspends the child without
   closing anything. So slow and dead must be distinguishable WITHOUT a timeout threshold.
   That is P6's only new design; everything else is carriage. It shares a predicate with E1's
   outstanding re-specification (ID-122), and the two should be designed together.

   Two gates carried over from P5e's lessons: G2 requires integration-spawn's test-name set to
   match integration-split's name for name, because a differing set means the lane is quietly
   running less; and the arm-proof gate requires every entry to record the child pid and
   transport=spawn in its OWN private log - ID-124 established that this kind of false green
   really happens, and a spawn lane that actually ran monolith would pass every other gate.
   S2's shape must be settled before it is written, and the document says why: E1 is the
   cautionary case.

2. The working notes move into the repository (docs/Disaggregated/notes/, 415 .md files)

   ROADMAP / CURRENT_STAGE_PROGRESS / MEASUREMENTS cite ruling numbers, audit line numbers and
   the provenance of gate figures from ~/w7/notes/, a directory that exists on one machine and
   is under no version control. A record cited hundreds of times that lives only locally is not
   a record, so it moves in whole, with its directory structure intact.

   Only .md moves. Scripts, run logs, census and gate result JSON, patches, APKs and nm dumps
   stay where they are: they are evidence DATA rather than documents - large, regenerated per
   run, and mostly carrying absolute paths and device serials that mean something only on the
   machine that produced them. The mapping and this split are written in
   docs/Disaggregated/notes/README.md.

   Two exceptions are recorded there too: P6's BRIEF has been promoted to a first-class
   document and keeps no copy under notes/, so the two cannot drift apart; and recovered/ holds
   material salvaged from failed workflow runs, which may duplicate the like-named phase
   directories and is kept because a few of those were the only complete version at the time.

   CI's citation lint takes docs/Disaggregated/*.md only (non-recursive), and notes/ is
   deliberately outside it: those notes' file:line citations were written against their own
   code heads, and resolving them against today's HEAD would fail wholesale - which is not an
   error, it is their correct state as a historical record. To check one, use the revision it
   declares (--rev).

3. Inconsistencies fixed in passing

   - README.md's status line still said P5e was in progress while the stage table already said
     closed.
   - CURRENT_STAGE_PROGRESS's next-step item 1 still listed the exit gate as pending, though
     (a) and (b) were run in the previous commit; rewritten to closed plus the one item that
     actually remains (E1).
   - ROADMAP's P6 row still had the pre-phase plan in three of its cells; it now carries the
     package order, the scope boundary and the two new gates.

Checked with check_doc_citations.py: 125 citations across docs/Disaggregated/*.md, 0 problems.
2026-09-18 23:31:39 -04:00

9.2 KiB
Raw Blame History

Brief: p5c-audit — where the inproc split still reads the other role's memory

You are auditing the MobileGL disaggregation branch (feat/disaggregated, head a79a0af6), working tree = the current directory (C:\Users\geekerwan\AndroidStudioProjects\FoldCraftLauncher\MobileGL-disagg). This is a READ-ONLY audit: do not edit any repository file, do not run builds or tests, do not touch git (no commit/checkout/stash), do not touch any adb device, do not fetch git LFS. You may write scratch files only under C:/Users/GEEKER~1/AppData/Local/Temp/claude/C--Users-geekerwan-AndroidStudioProjects-FoldCraftLauncher-MobileGL-disagg/0614b2e9-9ce2-49e4-a44c-6d023a133184/scratchpad/. If you need Linux tooling, run it as wsl.exe -d Arch -- bash -lc "<cmd>"; the same tree is checked out at ~/w7/pipe inside that distro (also at a79a0af6), and the notes/evidence directories are ~/w7/notes/ — read-only for you as well.

The question

MGPipe splits the GL frontend (client role, the application's GL thread) from the backend (server role, the mgl-srv-apply thread). Under MOBILEGL_TRANSPORT=inproc (build flavour -DMOBILEGL_PIPE_PUSH=ON -DMOBILEGL_BUILD_DISAGGREGATED=ON -DMOBILEGL_BUILD_DISAGGREGATED_INPROC=ON) the two roles are two threads of one process. The intended design is that everything crosses as wire: records in the SEG_CMD ring, bulk bytes in SEG_STAGE blobs, answers in SEG_REPLY slots, the caps snapshot, and the one-slot control mailbox for rare EGL operations. The next phase (P6, spawn) puts the server in another process, where any read of the other role's memory that is not one of those carriers simply cannot work.

Find every place where, today, one role reads (or writes) the other role's memory directly instead of going through a carrier. Both directions, and the shared process globals that only work because the address space is shared. The verb barrier (ClientSession::EmitAndWait waits for appliedSeq == emitSeq on every class-B verb, MOBILEGL_IPC_VERB_BARRIER=1) is what makes these reads "safe" today — so anything that is only correct because of the barrier belongs in your inventory too.

Where to start (read these first, they already name most of the debt)

  • MobileGL/MG_Remote/CONTRACT-P5.md §3 (field ownership: RECORD-SUPPLIED / APPLIER-DERIVED / BARRIER-PULLED / FATAL; the sticky forwards; "two sets with no field ids") and §4 (role and thread ownership of every process global).
  • MobileGL/MG_Remote/CONTRACT-P5B.md §3–§4 and §6.
  • docs/Disaggregated/ARCHITECTURE.md §17 (P5/P5b landed shape) and docs/Disaggregated/CURRENT_STAGE_PROGRESS.md §5 (open items: the three "inproc dependencies" P5b left — named blit's scoped client-shadow binding, the mip descriptor's barrier-held registry lookup, FBO death's inproc mailbox).
  • Generated tables: MobileGL/MG_Pipe/generated/PipeFieldOwnership.inc (36 rows are kBarrierPulled), PipeFilled.inc, MobileGL/MG_Pipe/FieldOwnership.def, Coverage.def, FillPoints.def.

Then the code:

  • Client role: MobileGL/MG_Remote/Client/* (EmitTables.cpp — the A/B/C slot partition and the pre-verb hooks; ClientSession.cpp; BackendObject_Remote.cpp; CapsMirror.cpp; PersistentMapTracker.cpp; GpuWritePending.cpp), MobileGL/MG_Impl/Pipe/PipeFill.cpp (the residual fill of gPipeInputs), MobileGL/MG_Pipe/PipeRoute.{h,cpp}.
  • Server role: MobileGL/MG_Remote/Server/* (PipeApplier.cpp incl. ServerVerbSink, ServerLoop.cpp, ServerSession.cpp, StagedShadow.h), MobileGL/MG_Remote/Wire/PipeWireCodec.cpp (WireVerbSink, the segment resolver, MGHostSpan decoding), MobileGL/MG_Pipe/PipeApply.cpp, MobileGL/MG_Backend/MGPipe/PipeInputs.{h,cpp}.
  • Backends' handle arms: MobileGL/MG_Backend/DirectGLES/{Managers.cpp,DirectGLES.cpp,Utils.cpp,BackendObject_DirectGLES.cpp} and MobileGL/MG_Backend/DirectVulkan/* — look for MGB_CTX->, MappedData(, GetStorage(, MipmapStorage, SharedPtr<, ProgramObject, TextureObject, BufferObject, pActiveBackendObject, pDefaultFramebufferInfo, MGPipeUnmigratedEmulation, liveHostBase, RequireStagedCoverageForPendingRanges, Fatal{StageSnapshotTooNarrow, Fatal{UncarriedInitialBytes, Fatal{InitialBytesNotCarried, Fatal{UnmigratedEmulation, registry lookups keyed by frontend identity.
  • Callbacks: MobileGL/MG_Pipe/MGPipeCallbacks.h and wherever the split build installs them — under inproc, does the apply thread call OnGlError / OnGpuWritten / OnBufferWriteback / OnTextureWriteback / OnMipLevelsGenerated / OnSurfaceChanged / OnCapsInvalidated / OnLog / OnXfbScatterReady / OnTexturePullRequest straight into client-owned MG_State objects? (SEG_EVENT exists in Transport/EventRing.h; is it used?)
  • Program artifacts: MobileGL/MG_Pipe/ProgramArtifactsCodec.{h,cpp} — under split, does CreateShaderState carry the archive as a blob, or does the server read the frontend ProgramObject's LinkArtifacts directly? (Fatal{ArtefactsMissing} / Fatal{ArchiveEmpty} exist somewhere.)
  • Caps: MobileGL/MG_Remote/CapsCodec.cpp and Client/CapsMirror.cpp — the format-capability table and the renderer string ("the two GetCaps blobrefs") — carried in the snapshot, or read from the shared pActiveBackendObject? Also BackendObject_DirectGLES.cpp / Utils.cpp format-capability lookups that CONTRACT-P5 §4 says are backend-internal reads of pActiveBackendObject.
  • Textures: how ResourceSubData bytes reach Espryt under split (blob in SEG_STAGE → StagedShadowStore? or a pointer into the client's MipmapStorage?); the mip-generation path (GenerateMipmap, "GLES mip storage descriptor"), CopyImageSubData's shadow mirror, GetTexImage, CopyTexImage2D/CopyTexSubImage2D.
  • Buffers: Ops_H_* in Managers.cpp, EnsureBufferResourceForHandle (its "frontend object held" arm), HasDefinedContent(), persistent maps (PersistentMapTracker, MOBILEGL_IPC_ADOPT_TIER=2 emulated tier), SyncGpuWrites / MarkGpuWritten, XFB capture / scatter.
  • Process globals under inproc: everything in CONTRACT-P5 §4's table plus anything it missed (e.g. MGPipeSlots() and the other MG_Impl/Pipe singletons — does any server-side code read them? g_syncedRenderStateParameters? Espryt twins that still hold a frontend pointer? g_rawDepthFetchSamplerState?).
  • Client reads of server memory: any MG_Impl / MG_Remote/Client read of g_applier / MGPipeApplierState / MGPipeGetResourceOps() / backend twins / pActiveBackendObject (beyond the caps mirror) under split; MG_IntegrationTest/Harness/Pipe*Peek are test-only — list them separately.

Use grep aggressively (ripgrep is available on Windows as rg, or grep -rn); then open each hit and decide. Do not trust the contracts' line numbers — they are from older heads; re-resolve every site on a79a0af6 and cite file:line exactly (the repo has scripts/check_doc_citations.py which checks path:line citations against HEAD; your citations must resolve).

What to write: p5c-audit-v1.md in the scratchpad directory named above (write it FIRST, before your final message)

  1. Inventory table, one row per site or per tightly-coupled family (aim for completeness over brevity; 30–60 rows is plausible). Columns: # · direction (S→C read = server reads client memory, C→S read, S→C write, C→S write, shared global) · what memory (object/field) · reader/writer site (file:line, function) · owner of that memory · when it happens (verb class / call / frequency: per draw, per upload, once) · why it works today (barrier / same address space / single writer) · what breaks under spawn · current guard (Fatal{...} name, MOBILEGL_IPC_STRICT_ERRORS, MOBILEGL_IPC_AUDIT, rsp counter, none) · the natural carrier (a new/extended record field, a SEG_STAGE blob, a reply slot, a SEG_EVENT event, the caps snapshot, the control mailbox, or "server-derived — no carrier needed") · suggested phase (P5c now / P6 / P7 / P8 / P9 / P10) — with one line of reasoning.
  2. Summary counts by direction and by carrier, and the top 10 by frequency (per-draw first).
  3. Already wire-clean: a short list of the paths you checked that DO go through a carrier (buffers via StagedShadowStore, ReadPixels reply, DrawVbo user indices, fence handles, …), so the plan is bounded by evidence, not assumption.
  4. Surprises / disagreements with what the contracts and ARCHITECTURE.md §17 claim (e.g. a field the tables call RECORD-SUPPLIED that the backend still pulls; a callback delivered directly; a gMGPipeSegmentResolver or MGHostSpan::Ptr short-cut).
  5. Existing numbers you found without running anything: any rsp= values in ~/w7/notes/p5b/p5b-results/*.md, ~/w7/notes/p5/p5-results/*.md or ~/w7/p5b-final-census-348d22a4/ logs (cite the file), so the plan can size the debt.

Keep prose minimal; tables over paragraphs. Be precise: if you are not sure a site is reached under inproc (e.g. it is inside #if !MOBILEGL_BUILD_DISAGGREGATED or behind a class-C refusal), say so in the row rather than dropping it. Cite the git head you read (git rev-parse HEAD).

When the report file is written, reply with at most 150 words: the row count, the top three findings, and anything you could not resolve.

Reference in New Issue View Git Blame Copy Permalink