Hardware Oddity Semaphore DMA Objects

Semaphore DMA object quirk

Evidence: NVIDIA-family reverse engineering, not yet an Xbox measurement. The envytools FIFO-puller documentation reports that pre-G80 DMA_SEMAPHORE binding accepts only nominally write-only class 0x0002 DMA objects, although acquire must observe memory. The older path uses a four-byte-aligned 12-bit offset; acquire waits for equality, and release writes a value. This is neither a general-purpose counter semaphore nor proof of a broad memory-permission exemption.

REF_CNT is separately described as waiting for prior execution before updating a reference value. Pusher GET advance is a different milestone from that completion marker.

Proposed test: vary DMA class, aperture endpoint, offset alignment, expected value, and acquire/release operation. Capture binding error, stall, completion marker, and memory change. Label each result with GPU generation and actual Xbox method sequence.

See also NV2A Graphics Architecture and Memory & DMA.