docs(drivers): describe the GPU memory path and the refusing encoder

Adreno740 gains a memory and TLB section, ArmSmmu4K its live batch
maps and unmap invalidation, AdrenoMetal the refusing render encoder
and list-only priming, ShengUfs its optional stage 1 windows.

docs/drivers/adreno-metal.md

@@ -21,7 +21,13 @@ desktop is idle: the payload carries the list (`NativeAdrenoMetal.primelist`) an
 a copy of the cryptex QuartzCore library, which the render server's sandbox
 cannot reach. The idle desktop submits about 6 command buffers per 250 ms at
 120 Hz, so priming waits only above 8. The PR log row shows its progress; all
-162 libraries are primed on sheng.
+162 libraries are primed on sheng. With the list present the render server does
+not scan directories, and each library is read only while the display is quiet.
+
+A render pass that cannot be encoded still returns an encoder, and its command
+buffer is refused: RenderBox caches encoder methods, so a nil encoder crashed
+WidgetRenderer. The first problem of each process is written to the driver's
+per-process text line from the thread that hit it.
 
 ```sh
 python3 scripts/build-turnip-darwin.py --target ios

docs/drivers/adreno740.md

@@ -71,6 +71,19 @@ Adreno740 serves one user-client core per connection. The render server gets a 1
 
 The GPU path covers discovery, command encoding, pipeline archives, IOSurface imports, fences, compositing and scanout. The render server and listed clients use the native device.
 
+## Memory and TLB
+
+| Item | Behavior |
+| --- | --- |
+| Objects per client | Up to 16384, found through a handle index |
+| Owned BOs | From the board's contiguous pool (1 GiB on sheng), else scattered pages. Mapped without the alias check against existing ranges |
+| Imported memory | Mapped without that check when every mapped import shares its cache class and it overlaps neither the pool nor an owned mapping; otherwise fully checked |
+| Unmap | Up to 512 pages invalidated one by one, larger unmaps by ASID |
+| Submission | No TLB invalidation; a stalled fence still invalidates |
+| Boot log rows | `[vm map]`, `[vm unmap]`, `[vm kinds]`, `[bo pool]` |
+
+On sheng a BO map costs 0.20 ms.
+
 ## Shader compilation
 
 The driver compiles the original UI shaders on the device:

docs/drivers/arm-smmu4k.md

@@ -12,6 +12,8 @@ ARM SMMUv2 native 4 KiB table kit. Builds and programs stage-1/stage-2 context t
 
 Used by Adreno740 and the storage drivers.
 
+Live updates map or unmap a batch of pages in one transaction: one page publication, one TLB synchronization and one recheck per batch. `ArmSmmu4KLiveMapContextBatchExclusive` maps pages the caller owns exclusively and skips the alias check against the existing ranges; the changes are still checked against each other. An unmap of up to 512 pages invalidates each removed page with TLBIVAL; a larger unmap invalidates the ASID.
+
 ## Build
 
 The consuming driver's recipe compiles the kit sources. sheng includes `ArmSmmu4K*.c` in its GPU archive. Supply MMIO, context/stream ownership and allocation callbacks as described in [platform adaptation](/porting/platform).

docs/drivers/sheng-ufs.md

@@ -4,7 +4,9 @@ Start with the [adaptation procedure](/porting/ufs) for board inputs, source cha
 
 ShengUfs provides the sheng UFS storage path for SM8550. It owns the host
 controller, SMMU mappings, command queues, and root reads. Its board integration
-includes clock resources and the persistent Data and log regions.
+includes clock resources and the persistent Data and log regions. On request it
+also gives the display bank (`sheng-dpu-scanout`) and the WiFi endpoint
+(`sheng-wifi=2` or more) stage 1 windows; both are off by default.
 
 | Field | Value |
 | --- | --- |

docs/zh/drivers/adreno-metal.md

@@ -19,7 +19,12 @@ render server 会预编译系统镜像中的全部 Metal 库：payload 带有库
 （`NativeAdrenoMetal.primelist`），以及一份 cryptex 中 QuartzCore 库的副本，因为
 render server 的沙盒访问不到 cryptex 路径。120 Hz 下空闲桌面每 250 ms 提交约
 6 个命令缓冲区，所以只有超过 8 个时预编译才会等待。日志 PR 行显示进度；sheng 上
-162 个库已全部预编译。
+162 个库已全部预编译。有列表时 render server 不扫描目录，并且只在显示空闲时读取
+每个库。
+
+无法编码的 render pass 仍返回 encoder，并拒绝其命令缓冲区：RenderBox 会缓存
+encoder 的方法，nil encoder 曾让 WidgetRenderer 崩溃。每个进程的第一个问题由出错
+的线程写入驱动的进程文本行。
 
 ```sh
 python3 scripts/build-turnip-darwin.py --target ios

docs/zh/drivers/adreno740.md

@@ -71,6 +71,19 @@ Adreno740 为每个连接提供一个 user-client core。render server 获得 `0
 
 GPU 路径覆盖发现、命令编码、pipeline archive、IOSurface 导入、fence、合成和 scanout。render server 和列入的客户端使用原生设备。
 
+## 内存与 TLB
+
+| 项目 | 行为 |
+| --- | --- |
+| 每客户端对象数 | 最多 16384 个，通过 handle 索引查找 |
+| 自有 BO | 来自板级连续池（sheng 为 1 GiB），否则为分散页。映射时不做与已有区间的别名检查 |
+| 导入内存 | 已映射的导入都属同一缓存类别，且不与池或自有映射重叠时，同样不做该检查；否则完整检查 |
+| 解除映射 | 不超过 512 页逐页失效，更多时按 ASID 失效 |
+| 提交 | 不做 TLB 失效；fence 卡住时仍会失效 |
+| 启动日志行 | `[vm map]`、`[vm unmap]`、`[vm kinds]`、`[bo pool]` |
+
+sheng 上映射一个 BO 约 0.20 ms。
+
 ## 着色器编译
 
 驱动在设备上编译原始 UI shader：

docs/zh/drivers/arm-smmu4k.md

@@ -12,6 +12,8 @@ ARM SMMUv2 原生 4 KiB 表 kit。构建并编程 stage-1/stage-2 context 表。
 
 Adreno740 和存储驱动使用它。
 
+live 更新在一个事务内映射或解除一批页：每批只发布一次页表页、同步一次 TLB、复查一次。`ArmSmmu4KLiveMapContextBatchExclusive` 映射调用方独占的物理页，跳过与已有区间的别名检查，批内各页之间仍互相检查。解除不超过 512 页时逐页发 TLBIVAL，更多时按 ASID 失效。
+
 ## 构建
 
 消费该 kit 的驱动配方编译其源码。sheng 将 `ArmSmmu4K*.c` 加入 GPU 归档。按[平台适配](/zh/porting/platform)提供 MMIO、context/stream 所有权和分配回调。