backup before win11 reinstall (2026-05-11 08:57:18 +0200)

config/sddm/theme/forest-cyber/Main.qml

@@ -207,21 +207,26 @@ Rectangle {
 
             Item { Layout.fillHeight: true }
         }
-        Rectangle {
+        Popup {
             id: sessionDropdown
             visible: sessionPopup.opened
-            z: 200
+            parent: sessionField
+            x: 0
+            y: sessionField.height + 6
             width: sessionField.width
             height: Math.min(sessionRepeater.count * 42 + 12, 220)
-            x: panel.x + 30
-            y: panel.y + sessionField.y + 48 + 6
-            radius: 12
-            color: "#0d1713"
-            border.width: 1
-            border.color: "#355b4b"
-            clip: true
+            padding: 0
+            margins: 0
+            closePolicy: Popup.CloseOnEscape | Popup.CloseOnPressOutsideParent
 
-            Column {
+            background: Rectangle {
+                radius: 12
+                color: "#0d1713"
+                border.width: 1
+                border.color: "#355b4b"
+            }
+
+            contentItem: Column {
                 anchors.fill: parent
                 anchors.margins: 6
                 spacing: 0

docs/frostbay/status-2026-04-24-live-wmbb.md

@@ -0,0 +1,131 @@
+# Frostbay / SUPER X live WMBB notes – 2026-04-24
+
+## Summary
+Today’s live probing refined the WMBB/MMIO picture substantially.
+
+Main takeaways:
+- `\_SB.UMAA.WMBB` opcodes matter more than previously assumed; `op=7` is not behaving like a plain raw dword read.
+- The old hot state cluster around `0xFE800448/460/470/474/478` still tracks physical Frostbay state in the current runtime.
+- Within that cluster, `0xFE800470` is currently the best compact state/substate indicator.
+- `0xFE800474`/`0xFE800478` behave like mixed status/telemetry rather than primary write targets.
+- The `0xFE800498/49C` pair is state-/context-/command-adjacent and write-sensitive, but direct writes there did not cleanly commit physical cooling changes.
+- Repeated `op=8` writes clearly influence internal firmware state, but not in a directly controllable or obviously reversible way.
+
+## Strongest current state signatures (op=7)
+
+### Current stable-ish 3-state comparison
+
+#### All on
+- `0xFE800448 -> 0x0c000000`
+- `0xFE800460 -> 0x2c2900`
+- `0xFE800470 -> 0x28002b`
+- `0xFE800474 -> 0x7002f90b`
+- `0xFE800478 -> 0x7202`
+
+#### All off
+- `0xFE800448 -> 0x19000000`
+- `0xFE800460 -> 0x2d2900`
+- `0xFE800470 -> 0x28002d`
+- `0xFE800474 -> 0xef04f90b`
+- `0xFE800478 -> 0xf204`
+
+#### RGB on / cooling off
+- `0xFE800448 -> 0x0`
+- `0xFE800460 -> 0x222200`
+- `0xFE800470 -> 0x250022`
+- `0xFE800474 -> 0x0000f80b`
+- `0xFE800478 -> 0x0`
+
+## Interpretation of the hot cluster
+- `0xFE800470` remains the clearest state-near field.
+- `0xFE800460` is a strong secondary state field.
+- `0xFE800448` provides a coarse third anchor.
+- `0xFE800474` and `0xFE800478` move with state but still look like mixed status/telemetry fields.
+
+## Opcode behavior notes
+### 0xFE80049C (current all-off-ish baseline)
+- `op=3 -> 0x80`
+- `op=4 -> 0x80`
+- `op=5 -> 0x11`
+- `op=6 -> 0x80`
+- `op=7 -> 0x38113780`
+- `op=8 -> 0x0`
+
+This strongly suggests:
+- `op=3/4/6` behave like readiness/presence/attribute-style queries
+- `op=5` reads only a sub-field / byte lane
+- `op=7` returns a structured/composite value, not a raw raw-dword mirror
+- `op=8` is a write/command entrypoint, but not necessarily a direct raw store
+
+### Current RGB on / cooling off mini-sweep
+#### `0xFE800448`
+- `op=5 -> 0x0`
+- `op=7 -> 0x0`
+
+#### `0xFE800460`
+- `op=5 -> 0x0`
+- `op=7 -> 0x262400`
+
+#### `0xFE800470`
+- `op=5 -> 0x26`
+- `op=7 -> 0x240026`
+
+Interpretation:
+- `0xFE800470` is the best compact probe; `op=5` seems to expose a meaningful low/sub field there.
+- `0xFE800460` is useful via `op=7`, but `op=5` does not expose the relevant portion.
+- `0xFE800448` is too coarse for the `op=5` path in the tested state.
+
+## `0xFE800498/49C` block observations
+Recent stable-ish reads suggested:
+- `0xFE800498` often stays near a baseline/context value
+- `0xFE80049C` differentiates real physical states more clearly
+
+Example snapshot set:
+### All on
+- `0xFE80048C -> 0xc2000002`
+- `0xFE800490 -> 0x6144da15`
+- `0xFE800494 -> 0x0`
+- `0xFE800498 -> 0x37113711`
+- `0xFE80049C -> 0x39113611`
+- `0xFE8004A0 -> 0x64000000`
+
+### Cooling off / RGB on
+- `0xFE80048C -> 0xc2000002`
+- `0xFE800490 -> 0x6144da15`
+- `0xFE800494 -> 0x0`
+- `0xFE800498 -> 0x37113711`
+- `0xFE80049C -> 0x36113611`
+- `0xFE8004A0 -> 0x64000000`
+
+### All off
+- `0xFE80048C -> 0xc2000002`
+- `0xFE800490 -> 0x6144dd15`
+- `0xFE800494 -> 0x0`
+- `0xFE800498 -> 0x37113711`
+- `0xFE80049C -> 0x37113711`
+- `0xFE8004A0 -> 0x64000000`
+
+Interpretation:
+- `0xFE80049C` is a strong logical-state / desired-state / last-state carrier.
+- `0xFE800498` looks more like context/bank/pairing state.
+- Direct writes to `0xFE800498` and `0xFE80049C` caused internal state motion but did **not** reliably produce physical cooling changes.
+
+## Write-lane findings
+Test writes via `WMBB 0 8` to `0xFE800498/49C` were accepted (`0x0`) and often changed subsequent reads of nearby state words (`470/474/49C`), but:
+- physical cooling behavior did not track cleanly
+- readback often normalized, drifted, or collapsed to a different value
+- the pair appears command-/mailbox-/shadow-like rather than a simple raw MMIO state store
+
+## Practical current model
+Most likely:
+- `WMBB op=7` is a structured read path, not a plain raw dword fetch
+- `WMBB op=8` is a write/command entrypoint, but not the whole commit/apply path
+- the real physical control path probably still requires a more faithful AML buffer encoding or an additional selector/commit step
+
+## Recommended next move
+Do **not** continue blind writes into the hot cluster.
+Instead:
+1. document the current findings cleanly
+2. treat `0xFE800470` (`op=5` and `op=7`) as the best quick state probe
+3. re-focus on reconstructing WMBB buffer/opcode semantics from AML/DSDT rather than guessing target values
+4. only resume live writes once the command/apply semantics are better understood

scripts/frostbay-dump-bank.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+import sys, subprocess, glob
+import hid
+
+def find_b000_if01():
+    for node in glob.glob('/dev/hidraw*'):
+        p = subprocess.run(
+            ['udevadm', 'info', '--query=property', f'--name={node}'],
+            capture_output=True, text=True
+        )
+        out = p.stdout
+        if 'ID_VENDOR_ID=1a2c' in out and 'ID_MODEL_ID=b000' in out and 'ID_USB_INTERFACE_NUM=01' in out:
+            return node
+    return None
+
+def hexdump_groups(data, group=4):
+    return ' '.join(data[i:i+group].hex() for i in range(0, len(data), group))
+
+path = sys.argv[1] if len(sys.argv) > 1 and sys.argv[1].startswith('/dev/') else find_b000_if01()
+argi = 2 if len(sys.argv) > 1 and sys.argv[1].startswith('/dev/') else 1
+
+bank = int(sys.argv[argi], 0) if len(sys.argv) > argi else 0
+start = int(sys.argv[argi+1], 0) if len(sys.argv) > argi+1 else 0
+count = int(sys.argv[argi+2], 0) if len(sys.argv) > argi+2 else 8
+
+if not path:
+    print('No b000 interface 01 hidraw device found')
+    sys.exit(1)
+
+dev = hid.device()
+dev.open_path(path.encode())
+dev.set_nonblocking(False)
+
+print(f'opened {path}, bank=0x{bank:02x}, start=0x{start:02x}, count={count}')
+
+for offset in range(start, start + count):
+    pkt = [0] * 64
+    pkt[0] = 0x08
+    pkt[1] = bank & 0xff
+    pkt[2] = offset & 0xff
+    pkt[3] = 0x00
+
+    written = dev.write(pkt)
+    data = bytes(dev.read(64))
+
+    print(f'bank=0x{bank:02x} offset=0x{offset:02x} write={written}')
+    print('  raw   :', data.hex())
+    print('  words :', hexdump_groups(data, 4))

scripts/frostbay-scan-live.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+import glob
+import subprocess
+import sys
+import time
+import hid
+
+BANKS = [1, 2, 3, 4, 5, 6, 7]
+START = 0x00
+COUNT = 0x20
+
+def find_b000_if01():
+    for node in glob.glob('/dev/hidraw*'):
+        p = subprocess.run(['udevadm', 'info', '--query=property', f'--name={node}'], capture_output=True, text=True)
+        out = p.stdout
+        if 'ID_VENDOR_ID=1a2c' in out and 'ID_MODEL_ID=b000' in out and 'ID_USB_INTERFACE_NUM=01' in out:
+            return node
+    return None
+
+def read_block(dev, bank, offset):
+    pkt = [0] * 64
+    pkt[0] = 0x08
+    pkt[1] = bank & 0xff
+    pkt[2] = offset & 0xff
+    pkt[3] = 0x00
+    dev.write(pkt)
+    return bytes(dev.read(64))
+
+def snapshot(dev):
+    snap = {}
+    for bank in BANKS:
+        for offset in range(START, START + COUNT):
+            snap[(bank, offset)] = read_block(dev, bank, offset)
+    return snap
+
+def summarize_diff(before, after):
+    changed = []
+    for key in before:
+        if before[key] != after[key]:
+            changed.append(key)
+    return changed
+
+def first_diff_index(a, b):
+    for i, (x, y) in enumerate(zip(a, b)):
+        if x != y:
+            return i
+    return None
+
+path = sys.argv[1] if len(sys.argv) > 1 and sys.argv[1].startswith('/dev/') else find_b000_if01()
+load_seconds = int(sys.argv[2]) if len(sys.argv) > 2 and sys.argv[1].startswith('/dev/') else (int(sys.argv[1]) if len(sys.argv) > 1 and not sys.argv[1].startswith('/dev/') else 15)
+
+if not path:
+    print('No b000 interface 01 hidraw device found')
+    sys.exit(1)
+
+dev = hid.device()
+dev.open_path(path.encode())
+dev.set_nonblocking(False)
+print(f'opened {path}')
+print('Taking idle snapshot...')
+idle = snapshot(dev)
+
+print(f'Starting load for {load_seconds}s...')
+procs = []
+for _ in range(4):
+    procs.append(subprocess.Popen(['bash', '-lc', 'yes > /dev/null']))
+try:
+    time.sleep(load_seconds)
+finally:
+    for p in procs:
+        p.terminate()
+    for p in procs:
+        try:
+            p.wait(timeout=2)
+        except Exception:
+            p.kill()
+
+print('Taking load snapshot...')
+load = snapshot(dev)
+changed = summarize_diff(idle, load)
+print(f'Changed blocks: {len(changed)}')
+for bank, offset in changed:
+    a = idle[(bank, offset)]
+    b = load[(bank, offset)]
+    idx = first_diff_index(a, b)
+    print(f'bank=0x{bank:02x} offset=0x{offset:02x} first_diff_byte={idx}')
+    print('  idle:', a.hex())
+    print('  load:', b.hex())

scripts/frostbay-special-probe.py

@@ -1,20 +1,7 @@
 #!/usr/bin/env python3
-import glob
-import subprocess
-import sys
-import time
+import glob, subprocess, sys, time
 import hid
 
-
-def find_b000_if01():
-    for node in glob.glob('/dev/hidraw*'):
-        p = subprocess.run(['udevadm', 'info', '--query=property', f'--name={node}'], capture_output=True, text=True)
-        out = p.stdout
-        if 'ID_VENDOR_ID=1a2c' in out and 'ID_MODEL_ID=b000' in out and 'ID_USB_INTERFACE_NUM=01' in out:
-            return node
-    return None
-
-
 def state_lines():
     out = []
     for node in glob.glob('/dev/hidraw*'):
@@ -27,19 +14,14 @@ def state_lines():
             out.append(f'{node} model={model} if={iface} name={name}')
     return out
 
+path = sys.argv[1] if len(sys.argv) > 1 else '/dev/hidraw1'
+hexdata = sys.argv[2] if len(sys.argv) > 2 else '0a 00 00 00'
 
-path = sys.argv[1] if len(sys.argv) > 1 and sys.argv[1].startswith('/dev/') else find_b000_if01()
-argi = 2 if len(sys.argv) > 1 and sys.argv[1].startswith('/dev/') else 1
-hexdata = sys.argv[argi] if len(sys.argv) > argi else '0a 00 00 00'
 raw = bytes.fromhex(hexdata.replace(' ', ''))
 pkt = [0] * 64
 for i, b in enumerate(raw[:64]):
     pkt[i] = b
 
-if not path:
-    print('No b000 interface 01 hidraw device found')
-    sys.exit(1)
-
 print('STATE BEFORE:')
 for line in state_lines():
     print(' ', line)