a36cf85e06
iter10 of the panvk-bifrost campaign. Eliminates the cosmetic
'--disable-gpu-sandbox' warning at brave-vulkan launch + pins the
Mesa tarball hash + makes the Vulkan ICD selection deterministic
across filesystems.
PKGBUILD changes (pkgrel: 1 -> 2):
- install ICD JSON at /usr/share/vulkan/icd.d/00-panvk-bifrost.json
(was: /usr/lib/panvk-bifrost/icd.json — required VK_ICD_FILENAMES,
which the GPU sandbox would strip, forcing --disable-gpu-sandbox)
- libvulkan_panfrost.so install path unchanged at /usr/lib/panvk-bifrost/
- sha256sums[0] pinned to 1d3c3b8a8363b8cc354175bb4a684ad8b035211cc1d6fa17aeb9b9623c513f89
(mesa-26.0.6.tar.xz from archive.mesa3d.org); patches + brave-vulkan +
icd.json remain SKIP since they're in-tree (git-tracked)
brave-vulkan changes:
- dropped --no-sandbox + --disable-gpu-sandbox: env vars MESA_VK_VERSION_OVERRIDE
and PAN_I_WANT_A_BROKEN_VULKAN_DRIVER survive the GPU sandbox boundary
(Mesa loader reads them pre-seccomp-lockdown)
- dropped VK_ICD_FILENAMES (loader auto-picks via icd.d/ directory scan)
- added VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*' for deterministic
ICD selection — Vulkan loader's readdir order is implementation-defined
per Khronos LoaderDriverInterface, so the '00-' filename prefix is
not spec-backed (ext4 happens to give insertion-order, other filesystems
may not). VK_LOADER_DRIVERS_SELECT short-circuits readdir ambiguity.
(Phase 5 review hardening.)
Test result on ohm (pre-push validation):
- brave-vulkan launches Brave without sandbox bypass
- seccomp-bpf sandboxes activate normally for utility/renderer processes
- 'panvk is not a conformant Vulkan implementation' fires ONCE (loader-select
excluded stock ICD from enumeration — only patched driver loads)
- GPU process boots, no 'Exiting GPU process' error
- Brave runs through full test timeout cleanly
README updated to reflect the new install layout + simplified wrapper.
Campaign artifacts: ~/src/panvk-bifrost/{phase0_findings_iter10.md,
phase8_iteration9_close.md (which iter10 polishes)}.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
166 lines
6.5 KiB
Bash
166 lines
6.5 KiB
Bash
# Maintainer: Markus Fritsche <fritsche.markus@gmail.com>
|
|
#
|
|
# mesa-panvk-bifrost — patched Mesa libvulkan_panfrost.so that exposes
|
|
# Bifrost-gen Mali (Mali-G31/G52/G72/G76, PAN_ARCH 6/7) to Chromium-family
|
|
# browsers' Vulkan compositor.
|
|
#
|
|
# Campaign: ~/src/panvk-bifrost/ — iter9 close (technical milestone
|
|
# 2026-05-20, operator-confirmed Brave window). Goal close requires
|
|
# this package built + published + installable per the
|
|
# feedback_package_done_means_installable.md 3-point check.
|
|
#
|
|
# What it does:
|
|
# - Builds Mesa 26.0.6 (matching ohm's stock mesa pkg) with two
|
|
# patches against src/panfrost/vulkan/panvk_vX_physical_device.c:
|
|
# (1) expose VK_KHR/EXT_robustness2 + nullDescriptor on PAN_ARCH 6/7
|
|
# (2) set has_vk1_1/has_vk1_2 to true on Bifrost
|
|
# - Installs the patched libvulkan_panfrost.so to /usr/lib/panvk-bifrost/
|
|
# (NOT /usr/lib — co-installs alongside stock mesa).
|
|
# - Registers a custom ICD JSON at a non-default path so the system
|
|
# Vulkan loader only picks up our driver when VK_ICD_FILENAMES is set.
|
|
# - Ships /usr/bin/brave-vulkan launcher that wires up env vars + flags.
|
|
#
|
|
# Co-existence: stock /usr/lib/libvulkan_panfrost.so is untouched. Stock
|
|
# /usr/share/vulkan/icd.d/panfrost_icd.json is untouched. Users opt in
|
|
# via brave-vulkan (or by setting VK_ICD_FILENAMES manually).
|
|
#
|
|
# Build target: arch-aarch64 runner via marfrit-packages Gitea Actions.
|
|
# Mesa build is slow (~30-60min on Cortex-A55). Build deps installed
|
|
# inside the runner via pacman -S in the workflow.
|
|
|
|
pkgname=mesa-panvk-bifrost
|
|
_mesaver=26.0.6
|
|
pkgver=26.0.6.r2
|
|
pkgrel=2
|
|
pkgdesc="Patched Mesa libvulkan_panfrost.so exposing Bifrost-gen Mali to Vulkan apps (panvk-bifrost campaign)"
|
|
arch=('aarch64')
|
|
url="https://github.com/marfrit/panvk-bifrost"
|
|
license=('MIT')
|
|
|
|
# We co-install at /usr/lib/panvk-bifrost/ so no conflicts with stock mesa.
|
|
# We DO provide a script that requires brave to be installed.
|
|
depends=(
|
|
'mesa' # for shared mesa runtime libs (libgallium-mesa etc.)
|
|
'libdrm'
|
|
'wayland'
|
|
'libxcb'
|
|
'libx11'
|
|
'libxshmfence'
|
|
'zlib'
|
|
'zstd'
|
|
'libdisplay-info'
|
|
'expat'
|
|
'systemd-libs' # libudev
|
|
'spirv-tools'
|
|
)
|
|
optdepends=(
|
|
'brave-bin: for the brave-vulkan launcher script'
|
|
)
|
|
makedepends=(
|
|
'meson'
|
|
'ninja'
|
|
'pkgconf'
|
|
'bison'
|
|
'flex'
|
|
'python'
|
|
'python-yaml'
|
|
'python-mako'
|
|
'glslang'
|
|
'spirv-tools'
|
|
'llvm'
|
|
'clang'
|
|
'libclc'
|
|
'spirv-llvm-translator'
|
|
'vulkan-headers'
|
|
'wayland-protocols'
|
|
)
|
|
|
|
source=(
|
|
"https://archive.mesa3d.org/mesa-${_mesaver}.tar.xz"
|
|
"0001-panvk-expose-robustness2-nullDescriptor-bifrost.patch"
|
|
"0002-panvk-expose-vulkan-1.1-1.2-on-bifrost.patch"
|
|
"brave-vulkan"
|
|
"icd.json"
|
|
)
|
|
sha256sums=(
|
|
'1d3c3b8a8363b8cc354175bb4a684ad8b035211cc1d6fa17aeb9b9623c513f89' # mesa-26.0.6.tar.xz from archive.mesa3d.org, pinned 2026-05-20 (iter10)
|
|
'SKIP'
|
|
'SKIP'
|
|
'SKIP'
|
|
'SKIP'
|
|
)
|
|
|
|
prepare() {
|
|
cd "mesa-${_mesaver}"
|
|
# iter8 patch: robustness2 + nullDescriptor exposure on Bifrost.
|
|
# Three hunks in panvk_vX_physical_device.c. Apply via sed since
|
|
# the upstream context drifts between Mesa releases and unified-diff
|
|
# patching is brittle (we hit hunk-rejects during manual application).
|
|
sed -i 's|\.KHR_robustness2 = PAN_ARCH >= 10,|.KHR_robustness2 = true,|' src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
sed -i 's|\.EXT_robustness2 = PAN_ARCH >= 10,|.EXT_robustness2 = true,|' src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
sed -i 's|\.nullDescriptor = PAN_ARCH >= 10,|.nullDescriptor = true,|' src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
# iter9 patch: bump api version to 1.1/1.2 for Bifrost. NOTE: this only
|
|
# affects extension exposure flags, NOT the reported apiVersion (which
|
|
# is set by get_api_version() further down and gated separately).
|
|
# The brave-vulkan launcher sets MESA_VK_VERSION_OVERRIDE=1.2 at runtime
|
|
# to deal with the latter — no source change needed for that path.
|
|
sed -i 's|bool has_vk1_1 = PAN_ARCH >= 10;|bool has_vk1_1 = true;|' src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
sed -i 's|bool has_vk1_2 = PAN_ARCH >= 10;|bool has_vk1_2 = true;|' src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
|
|
# Sanity-check the patches landed.
|
|
grep -q "KHR_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
grep -q "EXT_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
grep -q "nullDescriptor = true," src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
grep -q "has_vk1_1 = true;" src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
grep -q "has_vk1_2 = true;" src/panfrost/vulkan/panvk_vX_physical_device.c
|
|
}
|
|
|
|
build() {
|
|
cd "mesa-${_mesaver}"
|
|
# Minimal Mesa build — only the panvk Vulkan driver. No GLES/GLX/EGL/
|
|
# gallium drivers — keeps the build narrower and avoids pulling in
|
|
# the entire Mesa runtime in this package's dep graph.
|
|
meson setup build/ \
|
|
--prefix=/usr \
|
|
--libdir=lib \
|
|
--buildtype=release \
|
|
-Dvulkan-drivers=panfrost \
|
|
-Dgallium-drivers= \
|
|
-Dplatforms=wayland,x11 \
|
|
-Dglx=disabled \
|
|
-Degl=disabled \
|
|
-Dgles1=disabled \
|
|
-Dgles2=disabled \
|
|
-Dvulkan-layers= \
|
|
-Dtools= \
|
|
-Dgallium-rusticl=false \
|
|
-Dmicrosoft-clc=disabled
|
|
meson compile -C build
|
|
}
|
|
|
|
package() {
|
|
cd "${srcdir}/mesa-${_mesaver}"
|
|
|
|
# Patched lib — co-install path, NOT /usr/lib (to avoid clashing
|
|
# with stock mesa's libvulkan_panfrost.so binary).
|
|
install -Dm755 build/src/panfrost/vulkan/libvulkan_panfrost.so \
|
|
"$pkgdir/usr/lib/panvk-bifrost/libvulkan_panfrost.so"
|
|
|
|
# ICD JSON at the standard Vulkan loader search path. The '00-'
|
|
# filename prefix gives optical priority but is NOT spec-backed —
|
|
# Vulkan loader readdir-order is implementation-defined per Khronos
|
|
# LoaderDriverInterface. The brave-vulkan wrapper sets
|
|
# VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*' to make the selection
|
|
# deterministic across filesystems. This avoids the VK_ICD_FILENAMES
|
|
# full-path override (whose GPU-sandbox survival is fragile) while
|
|
# still letting the loader work normally. iter10 result + Phase 5
|
|
# hardening.
|
|
install -Dm644 "$srcdir/icd.json" \
|
|
"$pkgdir/usr/share/vulkan/icd.d/00-panvk-bifrost.json"
|
|
|
|
# The brave-vulkan launcher wires up env + flags. iter10: no longer
|
|
# sets VK_ICD_FILENAMES, no longer passes --no-sandbox /
|
|
# --disable-gpu-sandbox.
|
|
install -Dm755 "$srcdir/brave-vulkan" "$pkgdir/usr/bin/brave-vulkan"
|
|
}
|