fdl6_layout aligned an explicit linear layout's pitch to 16 pixels for
the 16x4 GMEM store, so an IOSurface whose rows are 24384 bytes (3048
RGBA16Float texels) could not be imported in place. An explicit layout
now takes the hardware's 64-byte alignment, and a linear host or
explicit-layout attachment whose size is not whole tile blocks renders
in SYSMEM, which reads and writes its texels alone. Bridge patch 0021.
The darwin backend now offers lazily allocated memory, as the msm
backend does with a settable GPU address: a sparse VMA reserves the
range and a BO is made there only when a pass needs the bytes. A pass
with such an attachment that has no memory yet renders in GMEM, where
the attachment lives in tile memory alone; the autotuner chose SYSMEM
for passes of few draws and so made the memory for good.
Core Animation's render server holds its intermediate targets as
memoryless textures: untagged-feaf29203 had twelve 3048x2032 RGBA16F
ones, 758 MiB, each memory of its own. On the host the same Liquid
Glass scene no longer allocates the 48 MiB attachment.
The darwin BO cache gave BOs back only on memory pressure or a failed
allocation. With BOs from system memory nothing fails, so it held what
the render server freed. It now frees an entry not reused within a
second of entering it, as freedreno's fd_bo_cache_cleanup does. Bridge
patch 0019 and the MEM telemetry row.
The translator pin moves to upstream development 624bab39 (the
inexact-math work) and records its branch; check-metal2vulkan-pin.py
checks the pin against the branch the record names. Bridge patch 0018
rounds heap texture sizes to their alignment. Adreno740 takes user BOs
from system memory, with no fixed pool.
- pin metal2vulkan at upstream 0dfdbcd5 with the rebased 16-patch series;
scripts/check-metal2vulkan-pin.py proves with git alone that the
checkout is upstream plus exactly those patches
- Turnip's pipeline cache UUID comes from its compiler source
(-Dtu-build-id), the same for the host and the tablet build
- scripts/make-pipeline-cache.py runs the render server's priming over
every library of the OS image on the host through the tablet's
compiler and packs the cache
Every client submits to the kernel's one in-order ring, and each job's
prologue flushes and invalidates the GPU caches and waits for idle, so
a wait on a sync already resolved to a ring fence is met by the ring,
as msm_gem_submit() skips its own ring's fences. Only an unresolved
sync is waited for, until it is submitted. The submitting thread no
longer stalls on the previous GPU work.
Also bumps AdrenoMetal and registers bridge patches 0024-0037.
Registers runtime patches 0022 (mipmaps outside the measured spread) and
0023 (heap texture size a multiple of its alignment). The frontend host
check counts the releasing surface import.
The retire queue and the BO cache grow with demand instead of holding
256 and 1024 entries. The cache gives everything back when libdispatch
reports memory pressure (DISPATCH_SOURCE_TYPE_MEMORYPRESSURE, warning
or critical) and when an allocation or GPU range cannot be had; the 2 s
idle eviction, the 100 ms kernel poll and the seven-eighths VA rule are
gone. Fence waits for idle and for ring space have no fixed bound: the
kernel's hangcheck ends a hang. TU_DARWIN_BO_CACHE=0 turns the cache off
for the host checks of the release paths.
Source-driver and source-storage builds, the arm64e PAC rewrite for the Rust bridge, the IOAccelerator base ABI of 24A446, the bridge with mimalloc and link-time optimisation, the plugin with the prime list, addon options for a prime list, a pipeline pack and cache export, wallpaper overlay and seed changes, and payload, kernel and userdata steps for the new profile.
A changed patch series re-clones the XNU work tree, which lacks the public
headers newer xnu omits (TrustCache among them), and archives built before
the kernel failed to compile against it.
Patches 0009 to 0016 touch files the earlier ones do, so the source is
checked against the tree each prefix of the patches leaves (a scratch
index per prefix) instead of a concatenated diff. The runtime id hashes
the final tree.
Show the OS cryptex where iPadOS looks for it, under /private/preboot,
and let a board option skip the launch constraints that refused App
cryptex daemons and owner-trusted binaries. The App cryptex trust module
joins the owner module of the trust bundle, and the lookup trace also
records lsd.
MGGetProductType() looks /product/product-id up in libMobileGestalt's
product table; without it the product type was 0, and the audio server
loaded no routing database ("Unknown product ID (0)"). The profile now
sets the J120 product id, puts J120AP first in the root compatible and
adds /product/audio. The ADT generator lets a profile prefix the root
compatible and declare child nodes.
The userdata step read each IPSW disk image through macOS hdiutil, so it
stopped on Linux with "hdiutil not found on PATH". It only needs the raw
disk bytes, so on hosts other than macOS it now decodes them with
scripts/unixnu/udif.py.
udif.py reads the koly trailer and the blkx (mish) tables of a UDIF
image and yields the disk in sector order: raw chunks are copied,
zero-fill and ignored chunks read as zeros, and zlib, bzip2 and LZFSE
chunks are decompressed (LZFSE with the lzfse tool the Linux toolchain
installs). It refuses gaps, unsupported chunk types and chunks that do
not decode to their size. A file without a koly trailer is a raw image
and is copied: the SystemOS cryptex is one, while the OS image is UDIF
with LZFSE chunks. test_udif.py checks this with synthetic images.
The window layout, hashes, SHNGROOT manifest and report are unchanged,
and macOS keeps hdiutil. For iPadOS 17.7.11 (21H461) the image built on
Linux and the one built on macOS from the same disk images are byte
for byte identical (9382658048 bytes, sha256 fd43ee7035ce185c...), as
are the window hashes (OS e5634d04..., SystemOS b4908cde...).
The lzfse lookup that ipsw.py had for the kernelcache moves to util.py,
which both use. The Linux notice now names --skip-setup and
seed-data-grow as the steps that need macOS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
XNU reads the arm-io ranges parent address as the SoC base and skips
platform setup when it is zero; device registers are offsets from that
base. Derive the window from the exported registers (16 MiB aligned)
and emit child registers relative to it.
Introduce a generic Tools submenu plus a menu-plugin protocol so device
tools can be discovered at runtime instead of being hardcoded in UniXNU.
Structure:
- UniXNUPkg/Include/Protocol/UniXNUMenuPlugin.h: plugin protocol with a
Run callback, a content rect and a DrawStatus footer callback.
- UniXNUPkg/Library/UniXNULib: discover installed plugins, render a
Back + plugin list, and run the selected plugin between the header and
footer while keeping the upper UI visible.
- UniXNUPkg/Driver/AdvancedLogDxe: first plugin; exports the Advanced
Logger log as OneSend QR frames with 5 volume-key speed gears and a
5-segment level bar, drawn with a single Blt.
- UniXNUPkg.dec: adds the menu plugin GUID and PcdUniXNUDeviceModel so
exported log files are named with the device model.
- scripts/unixnu/payload.py, built-in config and docs: `tools = true`
appends a Tools entry and documents the `tools` action.
The exported QR frames are read with OneSend (扫传):
https://onesend.01mvp.com
Scope: loader and boot logic are unchanged. This commit only adds the
menu/UI plugin path and the Advanced Logger tool; device wiring lives in
the platform checkout and is not part of this change.
On a Linux host the driver sets the environment of the
scripts/linux/setup-toolchain.py toolchain: the xcrun shim answers SDK
queries with the build tree's fakeroot, clang targets plain arm64 for
iOS 17, and CCC_OVERRIDE_OPTIONS turns off two warnings upstream clang
has and Apple clang does not (the archive builders use -Werror and
replay xnu's compile records, so only the clang driver sees them).
- build-xnu-4k-baseline.sh runs scripts/linux/prepare-xnu.py: source
rewrites the xnu sources that assume Apple's tools (SHA/AES assembler
macros, makesyscalls.sh under mawk, kextsymboltool and /dev/null) and
installs TargetConditionals.h into the fakeroot; libs builds
libcc_kext.a from compiler-rt's cc_kext profile sources. xnu's make
also gets the host compiler, mig and the machine sizes a Mac supplies.
ditto becomes cp.
- build-firehose.sh compiles libfirehose_kernel from its xcconfig.
- build-corecrypto-14.py reads project.pbxproj with scripts/pbxproj.py
(same JSON as plutil for all 13,112 objects).
- The kernelcache is decoded with lzfse.
The macOS path is unchanged apart from ditto. Built from the same
sources and configuration on Linux and with Xcode 27.1, the kernels have
the same global symbols, linked objects, archive symbols, 1,265
kalloc_type signatures, and prelink bindings and kexts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
scripts/linux/setup-toolchain.py, run once as root, builds into
/opt/unixnu-linux (or PREFIX, or $UNIXNU_TOOLCHAIN):
- clang from llvm-project 58c46bae2118 with llvm-xnu-builtin-type.patch,
which adds __builtin_xnu_type_signature, __builtin_xnu_type_summary,
__builtin_xnu_types_compatible and xnu_usage_semantics; kalloc.h uses
the builtins with no fallback;
- cctools-port 1030.6.3-ld64-956.6 (its master, ld64-609, corrupts the
kernel link), with libdispatch for ld64;
- mig and migcom from bootstrap_cmds-138;
- iig-port, with iig-port-darwin-target.patch;
- xnu-host-cc, the host compiler for xnu's SETUP tools;
- lzfse for the kernelcache.
It installs the Command Line Tools shims (clang, clang++, cc, install,
gm4) under the prefix and xcrun, plutil and codesign in /usr/bin, where
xnu's makefiles call them. libmacho.a and libstuff.a go to /usr/lib and
libdispatch to /usr/local. Each step is skipped when its output exists.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The bridge build applies the padded-row alias patch and passes a runtime id derived from the translator pin and its patches, so primed shaders survive until the translator changes. Kernel argument values may now contain a slash.
prepare-xnu-source.py lists Apple's xnu tree through the GitHub API without credentials. Hosted runners share the anonymous per-address quota and the bootstrap pass stops with HTTP 403 rate limit exceeded. Send GITHUB_TOKEN or GH_TOKEN, when set, to api.github.com and raw.githubusercontent.com only.
The payload's unixnu.toml replaces the built-in menu, which held the only Restart and Power off entries; the generated configuration now ends with both.
board.toml [payload.install] adds a second boot menu entry with the same
kernel and Data seed behind a confirmation; each confirmation choice
appends its boot argument (the sheng board uses it for the Data reset).
The payload ran patch-xnu-entry-probe.py only for panic_screen, always
with --no-reset. [payload] entry_probe_reset_delay now keeps the reset
(--reset-delay), and entry_probe_reset_after, _in, _occurrence and
_before move it after a given call (--reset-after, --in, --occurrence,
--reset-before), with or without the panic screen. Before the kernel
can draw, a reboot after the delay is the only sign that it got that
far. Without the new keys the call is unchanged.
bluseliu50