92 lines
3.6 KiB
Bash
92 lines
3.6 KiB
Bash
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
set -euo pipefail
|
|
|
|
readonly allowed_firmware="9.60"
|
|
readonly expected_sdk_commit="d2e2e585740362976a39fdd5ccf390f199a7bc37"
|
|
readonly script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
readonly root="$(cd "${script_dir}/.." && pwd)"
|
|
readonly sdk="${PS5_PAYLOAD_SDK:-${root}/work/toolchains/ps5-payload-sdk-v0.41}"
|
|
readonly sdk_source="${CHIMERA_GFX_SDK_SOURCE:-${root}/work/upstream/sdk}"
|
|
readonly build="${root}/build/probe-9.60"
|
|
readonly outputs="${root}/outputs"
|
|
readonly artifact_name="chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf"
|
|
readonly manifest_name="chimera-gfx-capability-probe-0.1.0-fw-9.60.json"
|
|
|
|
if [[ "${1:-}" != "${allowed_firmware}" || $# -ne 1 ]]; then
|
|
echo "usage: $0 9.60" >&2
|
|
exit 64
|
|
fi
|
|
if [[ ! -f "${sdk}/toolchain/prospero.cmake" ||
|
|
! -x "${sdk}/bin/prospero-nm" ]]; then
|
|
echo "missing verified PS5 Payload SDK v0.41 toolchain" >&2
|
|
exit 2
|
|
fi
|
|
if ! command -v llvm-readelf-18 >/dev/null 2>&1; then
|
|
echo "missing llvm-readelf-18 for the strict dynamic-table audit" >&2
|
|
exit 2
|
|
fi
|
|
if [[ ! -d "${sdk_source}/.git" ||
|
|
"$(git -C "${sdk_source}" rev-parse HEAD)" != "${expected_sdk_commit}" ]]; then
|
|
echo "SDK source checkout is not at the locked v0.41 commit" >&2
|
|
exit 2
|
|
fi
|
|
if ! git -C "${root}" diff --quiet ||
|
|
! git -C "${root}" diff --cached --quiet; then
|
|
echo "refusing provenance build from a dirty project tree" >&2
|
|
exit 2
|
|
fi
|
|
|
|
mkdir -p "${build}" "${outputs}"
|
|
python3 "${root}/tools/audit_ps5_sdk_runtime.py" \
|
|
--sdk-source "${sdk_source}" \
|
|
--project-root "${root}" \
|
|
--output "${build}/sdk-runtime-audit.json"
|
|
|
|
export LLVM_CONFIG="${LLVM_CONFIG:-/usr/bin/llvm-config-18}"
|
|
cmake -S "${root}" -B "${build}" -G Ninja \
|
|
-DCMAKE_TOOLCHAIN_FILE="${sdk}/toolchain/prospero.cmake" \
|
|
-DCMAKE_BUILD_TYPE=Release \
|
|
-DBUILD_TESTING=OFF \
|
|
-DCHIMERA_GFX_BUILD_PS5_PROBE=ON \
|
|
-DCHIMERA_GFX_BUILD_PHASE1_VIDEOOUT_CLEAR=OFF \
|
|
-DCHIMERA_GFX_PS5_ALLOWED_FIRMWARE="${allowed_firmware}"
|
|
cmake --build "${build}" --clean-first \
|
|
--target chimera-gfx-capability-probe
|
|
|
|
cmake -E copy_if_different \
|
|
"${build}/chimera-gfx-capability-probe.elf" \
|
|
"${outputs}/${artifact_name}"
|
|
cmake -E copy_if_different \
|
|
"${build}/sdk-runtime-audit.json" \
|
|
"${outputs}/sdk-runtime-audit-v0.41.json"
|
|
|
|
python3 "${root}/tools/audit_ps5_artifacts.py" \
|
|
--nm "${sdk}/bin/prospero-nm" \
|
|
--readelf "$(command -v llvm-readelf-18)" \
|
|
--probe "${outputs}/${artifact_name}" \
|
|
--symbol-manifest "${root}/manifests/ps5_gnm_symbols.json" \
|
|
--firmware "${allowed_firmware}"
|
|
|
|
readonly source_commit="$(git -C "${root}" rev-parse HEAD)"
|
|
python3 "${root}/tools/generate_artifact_manifest.py" \
|
|
--artifact "${outputs}/${artifact_name}" \
|
|
--output "${outputs}/${manifest_name}" \
|
|
--id "chimera-gfx-capability-probe-fw-9.60" \
|
|
--version "0.1.0" \
|
|
--source-repository \
|
|
"https://gitea.itworx.tech/Jens/chimera-gfx.git" \
|
|
--source-commit "${source_commit}" \
|
|
--target "ps5-x86_64" \
|
|
--firmware "${allowed_firmware}" \
|
|
--profile "symbol-discovery-only-offline-audit" \
|
|
--note "Transfer and execution are not authorized." \
|
|
--note "Project code calls no resolved GNM symbol and requests no rendering or GPU mutation." \
|
|
--note "SDK v0.41 CRT performs kernel credential and syscall-permission writes before main; execution is blocked by project policy."
|
|
python3 "${root}/tools/verify_artifact_manifest.py" \
|
|
--manifest "${outputs}/${manifest_name}" \
|
|
--artifact "${outputs}/${artifact_name}"
|
|
|
|
echo "Built and audited offline only: ${outputs}/${artifact_name}"
|
|
echo "Execution eligibility: false; do not transfer or execute this ELF."
|