From b66e1d0e2b2847f9a16c8fae33d2c9f1790d384a Mon Sep 17 00:00:00 2001 From: Acelogic <7362641+Acelogic@users.noreply.github.com> Date: Sat, 24 Oct 2026 20:03:11 -0400 Subject: [PATCH] cycle: trust and deploy the iconfix plug-in set The next installed run boots with the settings-icons executable 378ff525 installed and replaces it from single-user mode with SnapMetal icon-pixels-next built the same way (lenient, ADRENO_PIPELINE, ADRENO_SETTINGS_ICONS, runtime v7) plus ADRENO_CS_TABLES=1: AdrenoMetal ba3a3fd6, CDHash 11d5ff9a. CoreImage's compute kernels then get SP_CS_CONFIG NTEX = NSAMP = their T#/S# count and NUAV = their UAV count; a process started with ADRENO_CS_TABLES=0 keeps the settings-icons counts, so icon-pixels can compare both in one boot. installed_fresh: the trust additions become the iconfix set's (the settings-icons set's 47 rows plus 11d5ff9a and the icon-pixels probe 25f07e86: 501a90b6, payload 7857aabc); the settings-icons set stays as ADDITIONS_SETTINGSICONS for rollback, and every earlier CDHash stays trusted, so --restore (back to 378ff525) still boots. deploy-guest- plugin: the executable's base is the settings-icons 378ff525 and its payload the 27,627-byte AdrenoMetal-378ff525.bsdiff; the runtime and CodeResources are already the installed ones and are skipped. The probe's row: the guest's TXM service reports the code-signing monitor disabled and answers only static trust-cache lookups (compat/txm.h), so code outside the cache is left to in-kernel AMFI, whose ad-hoc handling has never been observed in the guest; every executable of ours that ran there (metal-triangle-probe, metal-clear-probe) had its CDHash in the trust additions. The row costs nothing and follows that pattern. The set, build/current-assets/metal-stage-iconfix-20261024, is a local (ignored) input: AdrenoMetal, AdrenoMetal-378ff525.bsdiff, trust-additions.json, trustcache.payload and SET.json. Evidence: the prepare-time trust check (configure_guest, then trust_cache_spec(ADDITIONS).load(FIRMWARE) against TRUST_PAYLOAD and TRUST_SHA) passes for the installed, -input and -input-touchpad profiles, for this set and the settings-icons rollback; the payload holds 11d5ff9a, 25f07e86, c76a4677 and runtime v7's ab4ccbd4; tools/test-deploy-guest-plugin.py PASS 21 checks (install, again, restore, refuse) over the console stand-in with 3% loss. --- tools/cycle_lib/installed_fresh.py | 17 +++++++++++++---- tools/deploy-guest-plugin.py | 10 +++++++--- 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/tools/cycle_lib/installed_fresh.py b/tools/cycle_lib/installed_fresh.py index 7b2a5b7..746734c 100644 --- a/tools/cycle_lib/installed_fresh.py +++ b/tools/cycle_lib/installed_fresh.py @@ -332,10 +332,19 @@ QCC2072_INPUTS = 'qcc2072-inputs' # under the attempt's directory: the th # Settings-icons set (SnapMetal ADRENO_SETTINGS_ICONS): the mirror-slab rows plus the executable c76a4677 (CoreImage # compute kernels sampling sRGB and grey+alpha images; multi-input kernels behind AdrenoIBComputeSamplers), deployed by # tools/deploy-guest-plugin.py; the mirror-slab set remains for rollback as ADDITIONS_MIRRORSLAB. -ADDITIONS = 'build/current-assets/metal-stage-settingsicons-20261024/trust-additions.json' -ADDITIONS_SHA = 'cdc784df778f7544fac5b2c774c3b6ee49cc70a15670301f3c4515dfed5562ff' -TRUST_PAYLOAD = 'build/current-assets/metal-stage-settingsicons-20261024/trustcache.payload' -TRUST_SHA = '247598bc2b4b48c31124e6dde3b83a52b41aa59355f697416cec0e8420926636' +# Iconfix set (SnapMetal icon-pixels-next, ADRENO_CS_TABLES): the settings-icons rows plus the executable 11d5ff9a +# (CoreImage compute kernels get SP_CS_CONFIG NTEX = NSAMP = their T#/S# count, as Mesa programs them; +# ADRENO_CS_TABLES=0 in a process's environment keeps the settings-icons counts), deployed by +# tools/deploy-guest-plugin.py, and the icon-pixels probe 25f07e86 that tools/run-icon-pixels.py pushes; the +# settings-icons set remains for rollback as ADDITIONS_SETTINGSICONS. +ADDITIONS = 'build/current-assets/metal-stage-iconfix-20261024/trust-additions.json' +ADDITIONS_SHA = '501a90b6e6fe79b346bcb81c1bddee315ae9fbe3d369ff6b5f44b115aeecc4de' +TRUST_PAYLOAD = 'build/current-assets/metal-stage-iconfix-20261024/trustcache.payload' +TRUST_SHA = '7857aabcda2814974193c24dbc3245312c3ba02d1de46848b8be60a332571af0' +ADDITIONS_SETTINGSICONS = 'build/current-assets/metal-stage-settingsicons-20261024/trust-additions.json' +ADDITIONS_SETTINGSICONS_SHA = 'cdc784df778f7544fac5b2c774c3b6ee49cc70a15670301f3c4515dfed5562ff' +TRUST_PAYLOAD_SETTINGSICONS = 'build/current-assets/metal-stage-settingsicons-20261024/trustcache.payload' +TRUST_SHA_SETTINGSICONS = '247598bc2b4b48c31124e6dde3b83a52b41aa59355f697416cec0e8420926636' ADDITIONS_MIRRORSLAB = 'build/current-assets/metal-stage-mirrorslab-20261021/trust-additions.json' ADDITIONS_MIRRORSLAB_SHA = '4802847aef13e6e46ebc50cd03b1e35ebafe929d5ae46f44f4de6a8d4fb64ae7' TRUST_PAYLOAD_MIRRORSLAB = 'build/current-assets/metal-stage-mirrorslab-20261021/trustcache.payload' diff --git a/tools/deploy-guest-plugin.py b/tools/deploy-guest-plugin.py index 17c5203..136c4f1 100755 --- a/tools/deploy-guest-plugin.py +++ b/tools/deploy-guest-plugin.py @@ -113,6 +113,10 @@ MIRRORSLAB = ROOT / 'build/current-assets/metal-stage-mirrorslab-20261021' # inside System Settings panes; multi-input kernels only when the kext publishes AdrenoIBComputeSamplers): only the # executable changes, over the mirror-slab 758535d9; runtime v7 and its CodeResources stay installed. SETTINGSICONS = ROOT / 'build/current-assets/metal-stage-settingsicons-20261024' +# Iconfix set (SnapMetal icon-pixels-next: ADRENO_SETTINGS_ICONS plus ADRENO_CS_TABLES, built with ADRENO_LENIENT=1 +# ADRENO_PIPELINE=1 and runtime v7: CoreImage's compute kernels get Mesa's SP_CS_CONFIG texture/sampler/UAV counts): +# only the executable changes, over the settings-icons 378ff525; runtime v7 and its CodeResources stay installed. +ICONFIX = ROOT / 'build/current-assets/metal-stage-iconfix-20261024' PREVIOUS = ASSETS ORIGINAL = ROOT / 'build/current-assets/metal-stage/AdrenoMetal.bundle/Contents' CONTENTS = 'System/Volumes/Data/Library/GPUBundles/AdrenoMetal.bundle/Contents' @@ -122,9 +126,9 @@ FILES = [ # installed in this order: the executable last patch=WSABORT / 'libAdrenoCompiler-059fcc6e.bsdiff', cdhash='ab4ccbd4806696e30cbe8ca6f8ff271e89cea7cd'), dict(name='CodeResources', path=f'{CONTENTS}/_CodeSignature/CodeResources', base=COMPILESPEED / 'CodeResources', new=WSABORT / 'CodeResources', patch=None, cdhash=None), - dict(name='AdrenoMetal', path=f'{CONTENTS}/MacOS/AdrenoMetal', base=MIRRORSLAB / 'AdrenoMetal', - new=SETTINGSICONS / 'AdrenoMetal', patch=SETTINGSICONS / 'AdrenoMetal-758535d9.bsdiff', - cdhash='c76a4677c74623d78f51f578cc4f2978ea73ff26'), + dict(name='AdrenoMetal', path=f'{CONTENTS}/MacOS/AdrenoMetal', base=SETTINGSICONS / 'AdrenoMetal', + new=ICONFIX / 'AdrenoMetal', patch=ICONFIX / 'AdrenoMetal-378ff525.bsdiff', + cdhash='11d5ff9ae3c796ef3ac5c9fec5853e0f8deaec7b'), ] PLUGIN, BASE, NEW, NEW_CDHASH = FILES[-1]['path'], FILES[-1]['base'], FILES[-1]['new'], FILES[-1]['cdhash'] WORK = 'System/Volumes/Data/private/var/tmp/snapintosh-plugin'