mirror of https://github.com/MobileGL-Dev/MobileGL synced 2026-11-07 18:13:23 +09:00

Files

T

swung0x48 aba329cc53 [Docs] (Disaggregated): P6's plan and contract draft; the working notes move from a local directory into the repository

Two things land together: the plan and contract draft P6 needs before it starts, and the
working notes that until now existed on exactly one machine.

1. P6's plan and contract draft (neither started; not one line of code)

docs/Disaggregated/P6-SPAWN-PLAN.md the package plan
docs/Disaggregated/P6-CONTRACT-DRAFT.md the contract draft (moves to
MG_Remote/CONTRACT-P6.md when c6 lands)

The three findings that mattered, all written into the documents:

a. P6 is SMALLER than its roadmap cell suggests. The transport primitives are already in
the tree and already tested: SocketDoorbell including hangup detection and the two
lost-wakeup fences (Doorbell.cpp:211-360, four cases in FdPassingTest), SCM_RIGHTS fd
passing, ShmSegment::Adopt, and the SurfaceOp / WindowKind schema already defined in
protocol.fbs. inproc uses a real second shm mapping rather than an alias, and
SessionRings.h:22-28 says that was done so today is not the first time it runs. P6 is
assembly plus a control plane plus a process, not "write a socket transport".

b. The evidence for "P6 is only a transport swap" has EXPIRED. It was bought by P5c, whose
audit found 59 direct memory accesses in a tree that already looked clean. P5e changed
the tree again. So the first package, a6, is a read-only audit that writes no code, and
every contract row that depends on it is marked PENDING a6 rather than decided in
advance.

c. P6 does not get a game running on the phone. ANativeWindow* is meaningless in the child,
and protocol.fbs:186-196's own comment says Android transfers the window out of band -
that band is P12. P6 lands pbuffer / surfaceless / offscreen, which is what HeadlessGL,
the split-equivalent lane and trace replay need, and which is exactly what P6's own exit
gate measures. A real window reaching the server is a named refusal. This gets its own
section because "P6 is done" would otherwise read as "the game runs now".

The contract adds rule G: a role may not name a process-local handle. It extends P5c's
rule E (a role may not name the other role's memory) from memory to identity - EGLDisplay /
EGLSurface / EGLContext / ANativeWindow* / fd number / pid / mapped address either cross as
a token this contract defines or they do not cross, and a descriptor crosses only through
SCM_RIGHTS, where the kernel renumbers it.

What P5e left for P6 gets its own section. The latch semantics are already designed
(ARCHITECTURE.md:504) and are copied unchanged. What is new is that after run-ahead the
client no longer waits while the peer process can DIE: the client holds records that were
published and will never be applied, and Android's freezer suspends the child without
closing anything. So slow and dead must be distinguishable WITHOUT a timeout threshold.
That is P6's only new design; everything else is carriage. It shares a predicate with E1's
outstanding re-specification (ID-122), and the two should be designed together.

Two gates carried over from P5e's lessons: G2 requires integration-spawn's test-name set to
match integration-split's name for name, because a differing set means the lane is quietly
running less; and the arm-proof gate requires every entry to record the child pid and
transport=spawn in its OWN private log - ID-124 established that this kind of false green
really happens, and a spawn lane that actually ran monolith would pass every other gate.
S2's shape must be settled before it is written, and the document says why: E1 is the
cautionary case.

2. The working notes move into the repository (docs/Disaggregated/notes/, 415 .md files)

ROADMAP / CURRENT_STAGE_PROGRESS / MEASUREMENTS cite ruling numbers, audit line numbers and
the provenance of gate figures from ~/w7/notes/, a directory that exists on one machine and
is under no version control. A record cited hundreds of times that lives only locally is not
a record, so it moves in whole, with its directory structure intact.

Only .md moves. Scripts, run logs, census and gate result JSON, patches, APKs and nm dumps
stay where they are: they are evidence DATA rather than documents - large, regenerated per
run, and mostly carrying absolute paths and device serials that mean something only on the
machine that produced them. The mapping and this split are written in
docs/Disaggregated/notes/README.md.

Two exceptions are recorded there too: P6's BRIEF has been promoted to a first-class
document and keeps no copy under notes/, so the two cannot drift apart; and recovered/ holds
material salvaged from failed workflow runs, which may duplicate the like-named phase
directories and is kept because a few of those were the only complete version at the time.

CI's citation lint takes docs/Disaggregated/*.md only (non-recursive), and notes/ is
deliberately outside it: those notes' file:line citations were written against their own
code heads, and resolving them against today's HEAD would fail wholesale - which is not an
error, it is their correct state as a historical record. To check one, use the revision it
declares (--rev).

3. Inconsistencies fixed in passing

- README.md's status line still said P5e was in progress while the stage table already said
closed.
- CURRENT_STAGE_PROGRESS's next-step item 1 still listed the exit gate as pending, though
(a) and (b) were run in the previous commit; rewritten to closed plus the one item that
actually remains (E1).
- ROADMAP's P6 row still had the pre-phase plan in three of its cells; it now carries the
package order, the scope boundary and the two new gates.

Checked with check_doc_citations.py: 125 citations across docs/Disaggregated/*.md, 0 problems.

2026-09-18 23:31:39 -04:00

5.7 KiB

Raw Blame History

Package sb — `set_shader_buffers`: the binding-point tables cross the wire (P5e wave 2)

Read in this order, all of it: PACKAGE-PREAMBLE-P5E.md, INTEGRATOR-DECISIONS-P5E.md (ID-89, ID-93 are yours), BRIEF-P5E.md (§0, §1, §2 "sb", §5, §6 rulings 3, 10, 11), CONTRACT-P5E.md §5.6 (and §2.1 for the barriered predicate's XFB input), your scout report scout-S5.md (all of it), and the binding-point / XFB rows of kimi-audit.md (rows 111-124) — report per row: retired / left barriered / not found. Notes: //wsl.localhost/Arch/home/swung/w7/notes/p5e/.

Your slug is sb; your tree is ~/w7/p5e-sb (branch p5e/sb, based on the landed id head, built). c0e has already landed the row's WaitClass, subsystem bit 13, the three suppressor slots, the applier field declarations (BoundShaderBuffers[3], Start/Count/WritableMask[3], ShaderBuffersSerial) and MGPipeApplySetShaderBuffers's declaration with an asserting body — you write the bodies.

What "done" means for this family

set_shader_buffers (MGPShaderBuffers, opcode 38, kCtxState, catalogued since P5 and never emitted) is EMITTED for the first time: one record per class (Uniform=0, ShaderStorage=1, AtomicCounter=2), the window is the touched high-water mark per target, capacity 84 on the wire, the backend clamps to the driver's limit. On the server, SyncBufferBindingPoints, SyncAtomicCounterBuffers, MarkShaderStorageBuffersGpuWritten and the point half of the UBO loop in BindCurrentProgramWithResources read the applier's arrays instead of MGB_CTX->GetBufferBindingPoint(...), resolving every buffer with EnsureBufferResourceForHandle(nullptr, handle). The backend's GPU-write marks (which reach into client objects) are deleted under a transport — the client's own MarkGpuWritesForDraw already covers them (verify, and say so).

Scope

Client: MG_State/GLState/BufferState/BufferState.h (bind-point generations, push-only), MG_Impl/GLImpl/Buffer/GL_Buffer.cpp (the bumps at every bind-point mutator, including the named XFB binding), MG_Impl/Pipe/Tracker.h (bits 15/16/17 shutters), new MG_Impl/Pipe/ShaderBufferEmit.h, MG_Impl/Pipe/PipeFill.cpp (SubsystemForEmitter row, the pairing asserts, the validate order, the reset list, the kMGPipeMaxBufferBindingPoints/84 pin). Wire/apply: MG_Pipe/PipeApply.{h,cpp} (MGPipeApplySetShaderBuffers), MG_Pipe/PipeRoute.{h,cpp}

MG_Remote/Client/WireTables.cpp (route rows), MG_Remote/Server/PipeApplier.cpp (OnSetShaderBuffers only). Backend: DirectGLES.cpp SyncBufferBindingPoints → SyncBufferBindingPointsByRecord, MarkShaderStorageBuffersGpuWritten, SyncAtomicCounterBuffers, their call lines, and the POINT half of the UBO loop (the GetUniformBlockBinding line above it is pg's — do not touch it; coordinate through the report). Gates: scripts/gen_pipe_dirty_surface.py
DirtySurface.def rows. Tests: TrackerTest.cpp, new ShaderBufferEmitTest.cpp, PipeCatalogueTest.cpp (invert the "not emitted" pins).

Rulings that bind you

ID-104 (found by c0e after the brief was written, and it is a WIRE change you own): MGPShaderBuffers::WritableMask is a Uint32 while the window capacity is 84 points, so the mask can only describe the first 32. Widen the field so the mask covers the declared window (Uint32 WritableMask[3], or Uint64 + Uint32 — your choice, say why); do NOT narrow the window, which would change what applications can bind. The POD grows; that is fine (opcode 80 already moved the ABI fingerprint this phase) — pin the new size in PipeCatalogueTest. This is a named exemption to the file-ownership rule: you edit MG_Pipe/MGPipeTypes.h (c0e's file) in the same commit as the emitter, and nobody else touches that struct.
ID-106: MG_Backend/Init.cpp's ConsumedSubsystemsFor does NOT yet carry bit 13 — c0e deliberately withheld it (no emitter existed, and withholding is the safe direction). You add it in the same commit that sets ShaderBufferEmit.h's wired constant, or the client's R-8 liveness gate withholds the whole family and your emission never runs.
ID-89 / rulings 10, 11: high-water window (TouchedBufferBindingPointCount per target), 84 on the wire, backend clamps; three suppressor slots (one per class).
kMGPipeWholeBuffer as the wire token for a base binding needs its contract row — c0e landed the table-0 row; make the emitter use it so a glBufferData between emission and apply cannot bind a stale extent.
XFB stays lockstep (contract §5.7): the XFB capture points are NOT part of your emission unless your scout's design says they are — if you emit them, the barriered predicate must keep XFB draws barriered regardless.

Red-once (execute, revert, quote)

Revert the handle walk under a live wire → Fatal{UnmigratedPipeInput, "GetBufferBindingPoint@DrawVbo"} under strict on SsboArrayDynamicIndexScenario / StorageBufferRegrowScenario / AtomicCounterScenario.
TrackerTest: glBindBufferBase(UNIFORM,1,A); Update(); glBindBufferBase(UNIFORM,1,B); Update() must set bit 15 on the second update — red against today's tracker.
GetBufferBindingPointCount's rsp non-zero before your change, 0 after, on AtomicCounterScenario.
Delete the backend marks and show ProducerMarkCount(ShaderStorageBinding) still non-zero while SsboArrayLengthScenario's readback sees the writes.

Gate

build, unit, isplit, gens (the dirty-surface generator must stay green — you are adding mutators), one on the four SSBO/atomic scenarios and the three XFB ones, strict (record the markers that disappeared). Also run the subsystem A/B with bit 13 cleared and confirm it reproduces today's picture — that is the arm that proves the emission is what the server consumes.

5.7 KiB Raw Blame History

Package sb — set_shader_buffers: the binding-point tables cross the wire (P5e wave 2)