next3c refused at the loader (exit 2): the native Image4 path binds the resident q1n1 stage to its ELF (probes/stagebind.py), and the launch named only q1n1's build/uefi, while the A16 ran the gadget-NCM stage that tools/a16-link-rearm.py arms after a reset without a replug (q1n1 build/uefi-gadget-ncm, Q1N1_GADGET_NCM). SNAP_STAGE_BUILDS now also lists that build when it exists; each stage still binds only to its own ELF.
early-done-20261025 (9aff1d3e), linked from 822226c with KEXT_PROFILE=desktop-early-done I2C_PROFILE=desktop-fnkeys: the coherent backlight build (swap brightness, head rule, IOMFB trace, CS samplers) plus ADRENO_PRESENT_EARLY_DONE.
--present-early-done MODE (needs --edp-backlight and its chain) adds
the guest boot-arg adreno_present_early_done=MODE and
--present-early-hold-ms (mode 2 only) adreno_present_early_hold_ms;
both are refused with --present-hold on. --edp-backlight with
--present-early-done or --gpu-coherent now takes the collection
pinned as INPUT_AUXKC_DESKTOP_EARLY_DONE (SnapAdreno
desktop-early-done: the coherent desktop kext with the backlight
service and early completion) instead of the nocoherent
INPUT_AUXKC_DESKTOP_BACKLIGHT, and is refused until that collection
is linked and pinned. Without the new flags the boot arguments, the
AuxKC and the monitor are unchanged: the next3 argument list still
builds monitor 97be2b80 (459,904 bytes).
swap-path-20261024 (9e916a41), built by the backlight-path work from 8f9eeb5 / SnapAdreno e1cf072 / SnapI2CHID f0b7984 with KEXT_PROFILE=desktop-next I2C_PROFILE=desktop-fnkeys: AdrenoBacklight takes the brightness from the swap record instead of a brightness-nits write WindowServer's sandbox refuses. next2-20261024 (cc07dfd3) stays as the rollback.
The on-device CoreImage pixel test (tools/run-icon-pixels.py, compare-icon-pixels.py, SnapMetal harness/icon-pixels) and SnapMetal 8fe64cb's ADRENO_CS_TABLES=1 build (SP_CS_CONFIG NTEX equal to NSAMP, as Mesa programs every stage), trusted and deployable as metal-stage-iconfix-20261024 (AdrenoMetal ba3a3fd6, CDHash 11d5ff9a; the icon-pixels tool 25f07e86). next1/next1b showed partial System Settings icons with no plug-in or kext refusal.
The next installed run boots with the settings-icons executable
378ff525 installed and replaces it from single-user mode with SnapMetal
icon-pixels-next built the same way (lenient, ADRENO_PIPELINE,
ADRENO_SETTINGS_ICONS, runtime v7) plus ADRENO_CS_TABLES=1: AdrenoMetal
ba3a3fd6, CDHash 11d5ff9a. CoreImage's compute kernels then get
SP_CS_CONFIG NTEX = NSAMP = their T#/S# count and NUAV = their UAV
count; a process started with ADRENO_CS_TABLES=0 keeps the
settings-icons counts, so icon-pixels can compare both in one boot.
installed_fresh: the trust additions become the iconfix set's (the
settings-icons set's 47 rows plus 11d5ff9a and the icon-pixels probe
25f07e86: 501a90b6, payload 7857aabc); the settings-icons set stays as
ADDITIONS_SETTINGSICONS for rollback, and every earlier CDHash stays
trusted, so --restore (back to 378ff525) still boots. deploy-guest-
plugin: the executable's base is the settings-icons 378ff525 and its
payload the 27,627-byte AdrenoMetal-378ff525.bsdiff; the runtime and
CodeResources are already the installed ones and are skipped.
The probe's row: the guest's TXM service reports the code-signing
monitor disabled and answers only static trust-cache lookups
(compat/txm.h), so code outside the cache is left to in-kernel AMFI,
whose ad-hoc handling has never been observed in the guest; every
executable of ours that ran there (metal-triangle-probe,
metal-clear-probe) had its CDHash in the trust additions. The row costs
nothing and follows that pattern.
The set, build/current-assets/metal-stage-iconfix-20261024, is a local
(ignored) input: AdrenoMetal, AdrenoMetal-378ff525.bsdiff,
trust-additions.json, trustcache.payload and SET.json.
Evidence: the prepare-time trust check (configure_guest, then
trust_cache_spec(ADDITIONS).load(FIRMWARE) against TRUST_PAYLOAD and
TRUST_SHA) passes for the installed, -input and -input-touchpad
profiles, for this set and the settings-icons rollback; the payload
holds 11d5ff9a, 25f07e86, c76a4677 and runtime v7's ab4ccbd4;
tools/test-deploy-guest-plugin.py PASS 21 checks (install, again,
restore, refuse) over the console stand-in with 3% loss.
next2-20261024 (cc07dfd3), built from fbed1ca with KEXT_PROFILE=desktop-next I2C_PROFILE=desktop-fnkeys: AdrenoX2 d88a2620 now publishes force-brightness-control and maps nits proportionally (SnapAdreno 9cc1e92). SnapI2CHID's code sections are identical to next-20261024's. next-20261024 (57965a84) stays as the rollback.
--watchdog SECONDS sets the run's watchdog from 1800 (the default, unchanged) to 7200 s; above 1800 the boot
preflight requires the A16 on AC. --session (with --console) leaves the guest trigger out of SNAP_EARLY_STOP, so the
kext never requests its first-present stop and a desktop session lasts until the watchdog, the thermal guard or
tools/request-stop.py. --early-stop-delay is checked against the run's watchdog. tools/test-session-watchdog.py
covers the default, the bounds, the delay check and the session's triggers.
installed-fresh --view-reclaim appends -DSNAP_VIEW_RECLAIM=1 after every
other monitor define. It is a monitor define only: no AuxKC, boot-arg
or loader change. docs/RUNNING.md describes it.
tools/test-edp-backlight.py's "appended last" check now lets this newer
define follow its own.
With next1's qualification flags plus the define the monitor is 459,904
bytes, 15,232 under the 464 KiB reservation; without it the monitor is
byte-identical to next1's (458,552 bytes, 16,584 under).
Hardware: not run.
With SNAP_VIEW_RECLAIM the report carries, behind "VIEWRCL1" and a word
of value bytes << 32, the kernel views' count, its high-water mark, the
reclaims that retired tables and how many, the refusals that found
nothing to retire, and the capacity. The record sits at a fixed place
just below the IB async slot (used or not); every chained record is
asserted to end before it. tools/perf_counters.py decode_view_reclaim
reads it (refusing a record whose counts disagree), decode_report adds
it as view_reclaim, the speed/installed-fresh summary keeps it, and
probes/run.py prints one line. 88 bytes of monitor code.
Hardware: not run.
probes/run.py's reservation note now gives the reclaim's exact cost with
this record: 1,352 bytes.
INPUT_AUXKC_DESKTOP_BACKLIGHT, the collection --edp-backlight selects
(the only route the next1 run's flags reach), becomes next-20261024:
KEXT_PROFILE=desktop-next I2C_PROFILE=desktop-fnkeys
tools/build-auxkc-desktop.sh at umbrella 78920c5, SnapAdreno b5bfcb4,
SnapI2CHID f0b7984 (sources.txt, no uncommitted changes).
adreno-input.kc 57965a84916986eed68988b174d699eba06050207945af742c6dd57f616cbd82
adreno-input.raw.kc 444b0cd1c732071075ca19668a16ca800cd0b752f6c84d072739251eb7e99f40
AdrenoX2 3202fd6f (desktop-next)
SnapI2CHID 4a81f74e (desktop-fnkeys)
The brightness branch named this pin for a PROFILE=desktop-backlight
AdrenoX2, which adds the service to desktop (coherent maintenance
skipping, for --gpu-coherent). The run has no --gpu-coherent, so the
pin holds desktop-next instead: desktop-nocoherent plus the service,
with the head rule, the IOMFB trace and the CS sampler opt-in. The
SnapI2CHID in it carries the Fn-key layer, so --input-fnkeys needs no
pin of its own. Both kexts are section-identical (12 of 12) to
separate builds of those profiles from the same tree.
Runs without --edp-backlight keep the latch collection
org-desktop-nocoherent-20261023 (ccf0c8f4, 353756d), which is also
the rollback. docs/RUNNING.md says which profile the pin holds.
tools/test-edp-backlight.py test_cycle now takes its pinned branch
and passes.
installed-fresh --adreno-cs-samplers appends the guest boot-arg
adreno_cs_samplers=1, the run-time half of SnapAdreno's
ADRENO_IB_CS_SAMPLERS: the IB validator admits CS sampler loads of up
to 8 units and AdrenoX2 publishes AdrenoIBComputeSamplers, so the
ADRENO_SETTINGS_ICONS plug-in encodes CoreImage's multi-input kernels.
An AdrenoX2 built without the define ignores the boot-arg. Without the
option the boot-argument addition is unchanged.
tools/test-adreno-cs-samplers.py: the default addition is unchanged,
the flag adds the boot-arg once (also beside --edp-backlight,
--input-fnkeys and --single-user), cycle.py's parser reaches the
namespace, AdrenoX2 reads exactly this name under the define, and the
desktop, desktop-nocoherent, desktop-backlight and desktop-next
profiles build AdrenoX2 and adreno-ib-command with it. A misspelt
boot-arg in installed_fresh.py fails it. docs/RUNNING.md lists the
flag and drops "no option yet".
Merge feature/settings-icons (b9c12cb..22aad4b). docs/RUNNING.md and
tools/cycle_lib/installed_fresh.py merge without conflict: the
settings-icons trust set (ADDITIONS/TRUST_PAYLOAD, mirror-slab kept as
ADDITIONS_MIRRORSLAB for rollback) sits beside the brightness and
fn-keys options.
gpu/adreno-kext/kext: SnapAdreno next f54b9ec, the merge of all three
SnapAdreno feature branches; gpu/adreno-kext/plugin: SnapMetal 936d51b
(feature/settings-icons).
The next installed run boots with the mirror-slab executable 758535d9
installed and must replace it with SnapMetal's ADRENO_SETTINGS_ICONS
build (lenient, ADRENO_PIPELINE, runtime v7: AdrenoMetal 378ff525,
CDHash c76a4677) from single-user mode.
installed_fresh: the trust additions become the settings-icons set's
(the mirror-slab set's 46 rows plus c76a4677: cdc784df, payload
247598bc); the mirror-slab set stays as ADDITIONS_MIRRORSLAB for
rollback, and every earlier CDHash stays trusted, so --restore still
boots. deploy-guest-plugin: the executable's base is the mirror-slab
758535d9 and its payload the 36,670-byte AdrenoMetal-758535d9.bsdiff;
the runtime and CodeResources are already the installed (wsabort) ones
and are skipped.
The set, build/current-assets/metal-stage-settingsicons-20261024, is a
local (ignored) input: AdrenoMetal, AdrenoMetal-758535d9.bsdiff,
trust-additions.json, trustcache.payload and SET.json.
Evidence: the prepare-time trust check (configure_guest, then
trust_cache_spec(ADDITIONS).load(FIRMWARE) against TRUST_PAYLOAD and
TRUST_SHA) passes for the installed, -input and -input-touchpad
profiles, for this set and the mirror-slab rollback;
tools/test-deploy-guest-plugin.py PASS 21 checks (install, again,
restore, refuse) over the console stand-in with 3% loss.
installed-fresh --edp-backlight (needs --present-latch and its chain)
appends -DSNAP_EDP_BACKLIGHT=1 after every other monitor define, adds
the guest boot-arg adreno_backlight=1, and selects
INPUT_AUXKC_DESKTOP_BACKLIGHT (SnapAdreno PROFILE=desktop-backlight).
That collection is not built or pinned yet, so the flag refuses until
KEXT_PROFILE=desktop-backlight tools/build-auxkc-desktop.sh links it
and its two lines are pinned. --edp-backlight-mode adds
adreno_backlight_mode=1. Boot checks compare the AuxKC as for the
other present-path flags. docs/RUNNING.md describes both.
tools/test-edp-backlight.py: the model (PASS), twelve weakened engines
it must reject (all rejected), the opt-in wiring, and with --build /
--kext-reference the identity proofs. On the final code the org2
monitor is 458,552 bytes with the define (200 bytes of headroom; the
probes commit's 216 predates its event-field change), byte-identical
without it. Hardware: not run.
installed-fresh --input-fnkeys FLAGS (with --input) appends the guest
boot-arg snap_i2c_fnkeys=FLAGS, which a SnapI2CHID built with
SNAP_I2C_HID_FNKEYS (PROFILE=desktop-fnkeys) reads; other builds
ignore it. The sets the kext would refuse are refused here: 0, bits
above 0x1f, brightness encoding 3, the host Fn-lock (0x4) without
translation (0x1), an encoding alone. Without the option the boot
argument addition is unchanged.
python3 tools/test-input-fnkeys.py: 4 tests OK;
python3 tools/test-zone-log.py: 4 tests OK.
A fresh q1n1 checkout has no build/ tree, so the org1 boot was refused when
a16gpu() opened its first step log. The record directory is now created first.
Built by tools/build-auxkc-desktop.sh with KEXT_PROFILE=desktop-nocoherent at
SnapAdreno 79de60e, which includes the re-pin log fix. SnapI2CHID is
section-identical to the deployed d90e0199; AdrenoX2 differs from the deployed
981e0b88 only by the removed raw-offset task lookup. --gpu-coherent stays off
until the display path handles coherent surfaces.
pins.example.json pinned the integration tree's
tools/run-sks-transport-candidate.py (52fe215a) and
tools/capture-apfs-persistence.py (4d59b3df). This repository's copies
differ from those only in the SPDX line the public release added, so
installed_fresh's launcher_steps refused every --prepare from a
pins.json copied from the example ("... changed"), and storage's
pinned_tool refused the persistence capture. Pin this tree's bytes
(c967ab84, f2d49308); the STEPS the launcher yields are unchanged.
The observers pinned under build/ (panel/GUI collectors and captures,
the stopped-run helper, the installed snapshot) are run scripts that
were never exported; those pins stay as examples for a local pins.json.
pins.example.json pinned q1n1-stage.bin 752b4ab7 and q1n1-stage-alt.bin
e6276e5a, which no current q1n1 build produces, so `cycle.py retire`
(stage_pair) refused every checkout started from the example. `make
uefi` in the Snapintosh q1n1 repository at 7872398 (migrate-private)
builds 56f57510 / 5d6f7df0, the same bytes as the integration tree's
q1n1 build; b12v23 recorded running that q1n1-stage.bin. A
stages_source entry says where the pair comes from. The per-machine
pins.json stays local and untracked.
The --present-latch desktop collection the A16 boots since b12v23:
AdrenoX2 c66edb6b (re-pin, aligned live copies and IO-coherent
maintenance skipping; SnapAdreno PROFILE=desktop at its profiles
commit) and SnapI2CHID d90e0199 (PROFILE=desktop), AuxKC bd057773.
The previous pin, latch2-pipe2-recover-nosparse 2cb7b6cc (b12v17), is
four collections back; the history comment lists each step.
The collection itself stays a local, never-committed input under
build/current-assets/. tools/build-auxkc-desktop.sh rebuilds one from
this checkout and prints the pin lines; its bytes differ from
bd057773 (kext UUIDs, staging paths), so a rebuilt collection needs
its own pin.
--gpu-coherent appends -DSNAP_ADRENO_COHERENT=1 after every earlier
flag, refuses to run without --gpu-va-wide (the self-test's scratch is
the q1n1 arena's Stage 4 pool region) and --root-cache-wide (its state
is in root_ext), adds the guest boot-arg adreno_coherent=1, and asks
q1n1 `adopt --coherent` to prove CB0 MAIR0/CBAR read-only before the
monitor relies on them.
--gpu-coherent-force (debug only, needs --gpu-coherent) appends
-DSNAP_ADRENO_COHERENT_FORCE=1 and the boot-arg adreno_coherent_force=1.
Without the options nothing changes. b12v20's argv reproduces its
qualification's flags, environment and boot-args, and b12v23's argv
(--gpu-coherent) reproduces its own.
Pass the AdrenoX2 resident-map budget to the guest as the boot-arg
adreno_resident_mib=MIB (0 disables residency, at most 4096). An
ADRENO_RESIDENT_REPIN kext reads it; older kexts ignore the boot-arg.
Without the option the boot-args are unchanged.
The A16 desktop runs since b12v19r pass --resident-mib 1536. With this
option b12v20's argv reproduces its qualification's
boot_argument_addition exactly.
Phase 1 of decomposing the 15,770-line monitor unit: move contiguous
top-level ranges verbatim into probes/xnuboot/*.c, and have
probes/xnuboot.c #include them in their original order. The compiler
still sees one translation unit. Every #include of a header stays in
probes/xnuboot.c, because quoted includes resolve beside the including
file and the monitor build has no -Icompat.
Cuts fall only between top-level declarations; no function, struct,
initializer or conditional is split, and every part has balanced
#if/#endif. Two exceptions are recorded for phase 2:
- monitor_call_impl is 1,318 lines on its own, so
probes/xnuboot/sptm_dispatch.c is 1,370 lines.
- The 1,894-line #if SNAP_FINE_LOCKS region is split into three
consecutive identical #if SNAP_FINE_LOCKS blocks (fine_locks_*.c).
SNAP_FINE_LOCKS is not defined or undefined inside the region, and
nothing inside it includes a header.
The parts that carry the m1n1-derived SPTM endpoint numbers and return
codes (report_layout.c, sptm_dispatch.c) keep the file's notice.
Tools that read xnuboot.c as text now read the whole unit through
tools/source_text.py read_source(); tools that hash or pin monitor
sources add every part through source_files() (generic over each .c
in their lists, so later splits are covered the same way).
Verification (base 84dd208 vs this commit, clang 23.1.3):
- clang -c, qualification flags (b12v20 qualification.json, no -flto)
plus -I shadow -I q1n1/platform/uefi: probes/xnuboot.c objects
byte-identical (cmp). PASS
- clang -c, probes/run.py FLAGS plus the same -I: byte-identical. PASS
- Qualification flags with -flto: llvm-dis output equal; the full IR
differs only in 468 inline-asm !srcloc source-location cookies. PASS
- probes/run.py build('xnuboot'), every unit linked: xnuboot.bin and
xnuboot.elf byte-identical with the qualification flags (LTO,
bin sha256 0d8b9ec3...) and with run.py FLAGS (2b5d5f6b...). PASS
- Reconstruction: expanding the includes and dropping the part headers
and the duplicated #if/#endif lines reproduces xnuboot.c exactly.
- Host battery (63 commands: the two gcc SPTM suites, test-idregs,
test-audit-sptm-refs and every tools/test-*.py that reads these
sources, plus the edited tools), 300 s limit, base vs split:
no new failure. 76 of 78 outcomes equal; test-audit-sparse and
test-monitor-perf timed out (NOT RUN) on split under host load and
on rerun match base (PASS; FAIL with the same record). Per-class
reruns of the long suites (21 commands) equal on both trees.
Pre-existing failures (missing private inputs or stale checks) are
unchanged.
- wc -l: xnuboot.c 918, every part under 1,000 except sptm_dispatch.c
(1,370).
An EL2 monitor/hypervisor and toolchain that boots macOS 27 on the ASUS A16
(Snapdragon X2 Elite), with an Adreno Metal plug-in and IOGPU kext, and
air2ir3, an AIR to Mesa ir3 shader compiler.
MIT, with GPL-2.0 components listed in LICENSE and THIRD_PARTY_NOTICES.md.
No Apple, Qualcomm, ASUS or Microsoft binaries are included.
Acelogic