docs: publish device records from the shared catalog
This commit is contained in:
UniXNU Docs committed
1 parent
e721468d55
commit
57607bbf37
149 files changed
+19119
-1082
No files matched your search
+1798
-1
File diff suppressed because it is too large.
Load diff
+18
-208
@@ -1,5 +1,21 @@
|
||||
import { defineConfig } from 'vitepress'
|
||||
import { withMermaid } from 'vitepress-plugin-mermaid'
|
||||
import deviceCatalog from './device-catalog.json'
|
||||
|
||||
function deviceSidebar(zh: boolean) {
|
||||
const prefix = zh ? '/zh' : ''
|
||||
return [{
|
||||
text: zh ? '设备' : 'Devices',
|
||||
items: [
|
||||
{ text: zh ? '设备列表' : 'Device list', link: `${prefix}/devices/` },
|
||||
{ text: zh ? 'sheng 日志抓取示例' : 'sheng log capture example', link: `${prefix}/devices/sheng-unattended-test` },
|
||||
...deviceCatalog.map(device => ({
|
||||
text: zh ? device.title_zh : device.title,
|
||||
link: `${prefix}/devices/${device.name}`,
|
||||
})),
|
||||
],
|
||||
}]
|
||||
}
|
||||
|
||||
function taskSidebars(prefix: string, zh: boolean) {
|
||||
const item = (en: string, cn: string, path: string) => ({ text: zh ? cn : en, link: `${prefix}${path}` })
|
||||
@@ -135,110 +151,7 @@ export default withMermaid(defineConfig({
|
||||
'/zh/porting/': zhTasks.port,
|
||||
'/zh/drivers/': zhTasks.reference,
|
||||
'/zh/xnu/': zhTasks.reference,
|
||||
'/zh/devices/': [
|
||||
{
|
||||
text: '设备',
|
||||
items: [
|
||||
{ text: '设备列表', link: '/zh/devices/' },
|
||||
{ text: '小米平板 6S Pro（sheng）', link: '/zh/devices/sheng' },
|
||||
{ text: 'sheng 日志抓取示例', link: '/zh/devices/sheng-unattended-test' },
|
||||
{
|
||||
text: '社区移植',
|
||||
collapsed: true,
|
||||
items: [
|
||||
{ text: 'DroidVM 客户机', link: '/zh/devices/droidvm' },
|
||||
{ text: '小米 13 Ultra（ishtar）', link: '/zh/devices/ishtar' },
|
||||
{ text: '三星 Galaxy S7 Edge（hero2lte）', link: '/zh/devices/hero2lte' },
|
||||
{ text: '一加 Ace 2 / 11R（udon）', link: '/zh/devices/udon' },
|
||||
{ text: 'Redmi Note 10 5G（camellia）', link: '/zh/devices/camellia' },
|
||||
{ text: '小米 14（houji）', link: '/zh/devices/houji' },
|
||||
{ text: 'Redmi K30 Pro 变焦版（lmipro）', link: '/zh/devices/lmipro' },
|
||||
{ text: 'Rongyue E5（e5）', link: '/zh/devices/e5' },
|
||||
{ text: 'Redmi K40（alioth）', link: '/zh/devices/alioth' },
|
||||
{ text: '联想小新 Pad Pro 2021（j716f）', link: '/zh/devices/j716f' },
|
||||
{ text: '联想拯救者 Y700 四代（elden）', link: '/zh/devices/elden' },
|
||||
{ text: '小米平板 5 Pro Wi-Fi（elish）', link: '/zh/devices/elish' },
|
||||
{ text: 'Redmi K80（zorn）', link: '/zh/devices/zorn' },
|
||||
{ text: '一加 9R（lemonades）', link: '/zh/devices/lemonades' },
|
||||
{ text: '魅族 20 Classic（m2381）', link: '/zh/devices/m2381' },
|
||||
{ text: 'QEMU virt', link: '/zh/devices/qemu' },
|
||||
{ text: '联想小新 Pad 2022（tb128fu）', link: '/zh/devices/tb128fu' },
|
||||
{ text: '一加 10 Pro 5G（negroni）', link: '/zh/devices/negroni' },
|
||||
{ text: 'Nothing Phone (2)（pong）', link: '/zh/devices/pong' },
|
||||
{ text: '小米 17 Pro（pandora）', link: '/zh/devices/pandora' },
|
||||
{ text: '小米 13（fuxi）', link: '/zh/devices/fuxi' },
|
||||
{ text: '一加 7 Pro（guacamole）', link: '/zh/devices/guacamole' },
|
||||
{ text: '一加 Ace 5（giulia）', link: '/zh/devices/giulia' },
|
||||
{ text: '小米 10（umi）', link: '/zh/devices/umi' },
|
||||
{ text: '小米平板 7 / POCO Pad X1（uke）', link: '/zh/devices/uke' },
|
||||
{ text: '小米平板 8 Pro（piano）', link: '/zh/devices/piano' },
|
||||
{ text: '小米 13 Pro（nuwa）', link: '/zh/devices/nuwa' },
|
||||
{ text: '一加 13T（oneplus13t）', link: '/zh/devices/oneplus13t' },
|
||||
{ text: '一加平板 2 Pro（erhai）', link: '/zh/devices/erhai' },
|
||||
{ text: 'OPPO Find X7 Ultra（PHY120）', link: '/zh/devices/phy120' },
|
||||
{ text: 'Redmi K40 Pro（haydn）', link: '/zh/devices/haydn' },
|
||||
{ text: '小米平板 5（nabu）', link: '/zh/devices/nabu' },
|
||||
{ text: '一加 6T（fajita）', link: '/zh/devices/fajita' },
|
||||
{ text: 'Microsoft Surface Duo 2（zeta）', link: '/zh/devices/zeta' },
|
||||
{ text: '一加 Ace 5 Pro（hummer）', link: '/zh/devices/hummer' },
|
||||
{ text: '小米 10 Ultra（cas）', link: '/zh/devices/cas' },
|
||||
{ text: '小米 15（dada）', link: '/zh/devices/dada' },
|
||||
{ text: 'Redmi Note 14 Pro+ 5G（amethyst）', link: '/zh/devices/amethyst' },
|
||||
{ text: 'Redmi K90 Pro Max / Poco F8 Ultra（myron）', link: '/zh/devices/myron' },
|
||||
{ text: 'Redmi K70（vermeer）', link: '/zh/devices/vermeer' },
|
||||
{ text: '努比亚红魔 8 Pro / 8 Pro+（nx729j）', link: '/zh/devices/nx729j' },
|
||||
{ text: '小米平板 6（pipa）', link: '/zh/devices/pipa' },
|
||||
{ text: 'Galaxy Tab A7 10.4（gta4l）', link: '/zh/devices/gta4l' },
|
||||
{ text: 'Redmi Note 10 Pro（sweet）', link: '/zh/devices/sweet' },
|
||||
{ text: '小米 MIX 2S（polaris）', link: '/zh/devices/polaris' },
|
||||
{ text: '一加 5（cheeseburger）', link: '/zh/devices/cheeseburger' },
|
||||
{ text: 'Redmi K20 Pro / Mi 9T Pro（raphael）', link: '/zh/devices/raphael' },
|
||||
{ text: 'Galaxy Z Fold3（q2q）', link: '/zh/devices/q2q' },
|
||||
{ text: 'Redmi K30 5G（picasso）', link: '/zh/devices/picasso' },
|
||||
{ text: 'Redmi Note 9（merlinx）', link: '/zh/devices/merlinx' },
|
||||
{ text: 'Benesse TAB-A04-BR3（a04br3）', link: '/zh/devices/a04br3' },
|
||||
{ text: 'Redmi 9A（dandelion）', link: '/zh/devices/dandelion' },
|
||||
{ text: '小米 6（sagit）', link: '/zh/devices/sagit' },
|
||||
{ text: 'Galaxy Tab S7 FE Wi-Fi（SM-T733）', link: '/zh/devices/sm-t733' },
|
||||
{ text: '小米 8 SE（sirius）', link: '/zh/devices/sirius' },
|
||||
{ text: '小米 8（dipper）', link: '/zh/devices/dipper' },
|
||||
{ text: '小米平板 4 LTE（clover）', link: '/zh/devices/clover' },
|
||||
{ text: 'Redmi Note 12 Turbo / POCO F5（marble）', link: '/zh/devices/marble' },
|
||||
{ text: '小米 10S（thyme）', link: '/zh/devices/thyme' },
|
||||
{ text: 'Redmi K80 Ultra（dali）', link: '/zh/devices/dali' },
|
||||
{ text: '中兴努比亚 Z60 Ultra（nx721j）', link: '/zh/devices/nx721j' },
|
||||
{ text: 'Unisoc UMS512 / T610YP', link: '/zh/devices/t610yp' },
|
||||
{ text: 'Brave Ark 平板（braveark）', link: '/zh/devices/braveark' },
|
||||
{ text: '小米 MIX 2（chiron）', link: '/zh/devices/chiron' },
|
||||
{ text: 'Sony Xperia 1 II（pdx203）', link: '/zh/devices/pdx203' },
|
||||
{ text: 'Moto Z2 Force（nash）', link: '/zh/devices/nash' },
|
||||
{ text: 'Google Pixel 9 Pro XL（komodo）', link: '/zh/devices/komodo' },
|
||||
{ text: '小米 9（cepheus）', link: '/zh/devices/cepheus' },
|
||||
{ text: '小米 MIX Flip（ruyi）', link: '/zh/devices/ruyi' },
|
||||
{ text: '小米 Civi 5 Pro（luming）', link: '/zh/devices/luming' },
|
||||
{ text: '小米平板 6 Pro（liuqin）', link: '/zh/devices/liuqin' },
|
||||
{ text: '小米平板 5 Pro 5G（enuma）', link: '/zh/devices/enuma' },
|
||||
{ text: 'Redmi Turbo 3 / Poco F6（peridot）', link: '/zh/devices/peridot' },
|
||||
{ text: '一加 8 Pro（instantnoodlep）', link: '/zh/devices/instantnoodlep' },
|
||||
{ text: '一加 8T（kebab）', link: '/zh/devices/kebab' },
|
||||
{ text: '一加 6（enchilada）', link: '/zh/devices/enchilada' },
|
||||
{ text: '一加 15T（fairlady）', link: '/zh/devices/fairlady' },
|
||||
{ text: '一加平板 Pro（caihong）', link: '/zh/devices/caihong' },
|
||||
{ text: 'Nothing Phone (3a)（asteroids）', link: '/zh/devices/asteroids' },
|
||||
{ text: 'Galaxy Tab S9 Ultra Wi-Fi（gts9uwifi）', link: '/zh/devices/gts9uwifi' },
|
||||
{ text: 'Moto G9 Play（guamp）', link: '/zh/devices/guamp' },
|
||||
{ text: 'Moto G 5G（gauguin）', link: '/zh/devices/gauguin' },
|
||||
{ text: 'Microsoft Lumia 950', link: '/zh/devices/lumia950' },
|
||||
{ text: 'OPPO R11（r11）', link: '/zh/devices/r11' },
|
||||
{ text: 'OPPO Find X9（x9）', link: '/zh/devices/x9' },
|
||||
{ text: 'Unisoc 设备', link: '/zh/devices/unisoc' },
|
||||
{ text: 'unixnu-build', link: '/zh/devices/unixnu-build' },
|
||||
{ text: 'sheng 上的 macOS', link: '/zh/devices/sheng-macos' },
|
||||
],
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
'/zh/devices/': deviceSidebar(true),
|
||||
'/zh/reference/': zhTasks.reference,
|
||||
'/zh/contributing/': zhTasks.reference,
|
||||
},
|
||||
@@ -283,110 +196,7 @@ export default withMermaid(defineConfig({
|
||||
'/porting/': enTasks.port,
|
||||
'/drivers/': enTasks.reference,
|
||||
'/xnu/': enTasks.reference,
|
||||
'/devices/': [
|
||||
{
|
||||
text: 'Devices',
|
||||
items: [
|
||||
{ text: 'Devices', link: '/devices/' },
|
||||
{ text: 'Xiaomi Pad 6S Pro (sheng)', link: '/devices/sheng' },
|
||||
{ text: 'sheng log capture example', link: '/devices/sheng-unattended-test' },
|
||||
{
|
||||
text: 'Community ports',
|
||||
collapsed: true,
|
||||
items: [
|
||||
{ text: 'DroidVM guest', link: '/devices/droidvm' },
|
||||
{ text: 'Xiaomi 13 Ultra (ishtar)', link: '/devices/ishtar' },
|
||||
{ text: 'Samsung Galaxy S7 Edge (hero2lte)', link: '/devices/hero2lte' },
|
||||
{ text: 'OnePlus Ace 2 / 11R (udon)', link: '/devices/udon' },
|
||||
{ text: 'Redmi Note 10 5G (camellia)', link: '/devices/camellia' },
|
||||
{ text: 'Xiaomi 14 (houji)', link: '/devices/houji' },
|
||||
{ text: 'Redmi K30 Pro Zoom Edition (lmipro)', link: '/devices/lmipro' },
|
||||
{ text: 'Rongyue E5 (e5)', link: '/devices/e5' },
|
||||
{ text: 'Redmi K40 (alioth)', link: '/devices/alioth' },
|
||||
{ text: 'Lenovo Xiaoxin Pad Pro 2021 (j716f)', link: '/devices/j716f' },
|
||||
{ text: 'Lenovo Legion Y700 Gen 4 (elden)', link: '/devices/elden' },
|
||||
{ text: 'Xiaomi Pad 5 Pro Wi-Fi (elish)', link: '/devices/elish' },
|
||||
{ text: 'Redmi K80 (zorn)', link: '/devices/zorn' },
|
||||
{ text: 'OnePlus 9R (lemonades)', link: '/devices/lemonades' },
|
||||
{ text: 'Meizu 20 Classic (m2381)', link: '/devices/m2381' },
|
||||
{ text: 'QEMU virt', link: '/devices/qemu' },
|
||||
{ text: 'Lenovo Xiaoxin Pad 2022 (tb128fu)', link: '/devices/tb128fu' },
|
||||
{ text: 'OnePlus 10 Pro 5G (negroni)', link: '/devices/negroni' },
|
||||
{ text: 'Nothing Phone (2) (pong)', link: '/devices/pong' },
|
||||
{ text: 'Xiaomi 17 Pro (pandora)', link: '/devices/pandora' },
|
||||
{ text: 'Xiaomi 13 (fuxi)', link: '/devices/fuxi' },
|
||||
{ text: 'OnePlus 7 Pro (guacamole)', link: '/devices/guacamole' },
|
||||
{ text: 'OnePlus Ace 5 (giulia)', link: '/devices/giulia' },
|
||||
{ text: 'Xiaomi Mi 10 (umi)', link: '/devices/umi' },
|
||||
{ text: 'Xiaomi Pad 7 / POCO Pad X1 (uke)', link: '/devices/uke' },
|
||||
{ text: 'Xiaomi Pad 8 Pro (piano)', link: '/devices/piano' },
|
||||
{ text: 'Xiaomi 13 Pro (nuwa)', link: '/devices/nuwa' },
|
||||
{ text: 'OnePlus 13T (oneplus13t)', link: '/devices/oneplus13t' },
|
||||
{ text: 'OnePlus Pad 2 Pro (erhai)', link: '/devices/erhai' },
|
||||
{ text: 'OPPO Find X7 Ultra (PHY120)', link: '/devices/phy120' },
|
||||
{ text: 'Redmi K40 Pro (haydn)', link: '/devices/haydn' },
|
||||
{ text: 'Xiaomi Pad 5 (nabu)', link: '/devices/nabu' },
|
||||
{ text: 'OnePlus 6T (fajita)', link: '/devices/fajita' },
|
||||
{ text: 'Microsoft Surface Duo 2 (zeta)', link: '/devices/zeta' },
|
||||
{ text: 'OnePlus Ace 5 Pro (hummer)', link: '/devices/hummer' },
|
||||
{ text: 'Xiaomi 10 Ultra (cas)', link: '/devices/cas' },
|
||||
{ text: 'Xiaomi 15 (dada)', link: '/devices/dada' },
|
||||
{ text: 'Redmi Note 14 Pro+ 5G (amethyst)', link: '/devices/amethyst' },
|
||||
{ text: 'Redmi K90 Pro Max / Poco F8 Ultra (myron)', link: '/devices/myron' },
|
||||
{ text: 'Redmi K70 (vermeer)', link: '/devices/vermeer' },
|
||||
{ text: 'Nubia RedMagic 8 Pro / 8 Pro+ (nx729j)', link: '/devices/nx729j' },
|
||||
{ text: 'Xiaomi Pad 6 (pipa)', link: '/devices/pipa' },
|
||||
{ text: 'Galaxy Tab A7 10.4 (gta4l)', link: '/devices/gta4l' },
|
||||
{ text: 'Redmi Note 10 Pro (sweet)', link: '/devices/sweet' },
|
||||
{ text: 'Xiaomi Mi MIX 2S (polaris)', link: '/devices/polaris' },
|
||||
{ text: 'OnePlus 5 (cheeseburger)', link: '/devices/cheeseburger' },
|
||||
{ text: 'Redmi K20 Pro / Mi 9T Pro (raphael)', link: '/devices/raphael' },
|
||||
{ text: 'Galaxy Z Fold3 (q2q)', link: '/devices/q2q' },
|
||||
{ text: 'Redmi K30 5G (picasso)', link: '/devices/picasso' },
|
||||
{ text: 'Redmi Note 9 (merlinx)', link: '/devices/merlinx' },
|
||||
{ text: 'Benesse TAB-A04-BR3 (a04br3)', link: '/devices/a04br3' },
|
||||
{ text: 'Redmi 9A (dandelion)', link: '/devices/dandelion' },
|
||||
{ text: 'Xiaomi Mi 6 (sagit)', link: '/devices/sagit' },
|
||||
{ text: 'Galaxy Tab S7 FE Wi-Fi (SM-T733)', link: '/devices/sm-t733' },
|
||||
{ text: 'Xiaomi Mi 8 SE (sirius)', link: '/devices/sirius' },
|
||||
{ text: 'Xiaomi Mi 8 (dipper)', link: '/devices/dipper' },
|
||||
{ text: 'Xiaomi Mi Pad 4 LTE (clover)', link: '/devices/clover' },
|
||||
{ text: 'Redmi Note 12 Turbo / POCO F5 (marble)', link: '/devices/marble' },
|
||||
{ text: 'Xiaomi Mi 10S (thyme)', link: '/devices/thyme' },
|
||||
{ text: 'Redmi K80 Ultra (dali)', link: '/devices/dali' },
|
||||
{ text: 'ZTE Nubia Z60 Ultra (nx721j)', link: '/devices/nx721j' },
|
||||
{ text: 'Unisoc UMS512 / T610YP', link: '/devices/t610yp' },
|
||||
{ text: 'Brave Ark tablet (braveark)', link: '/devices/braveark' },
|
||||
{ text: 'Xiaomi MIX 2 (chiron)', link: '/devices/chiron' },
|
||||
{ text: 'Sony Xperia 1 II (pdx203)', link: '/devices/pdx203' },
|
||||
{ text: 'Moto Z2 Force (nash)', link: '/devices/nash' },
|
||||
{ text: 'Google Pixel 9 Pro XL (komodo)', link: '/devices/komodo' },
|
||||
{ text: 'Xiaomi Mi 9 (cepheus)', link: '/devices/cepheus' },
|
||||
{ text: 'Xiaomi MIX Flip (ruyi)', link: '/devices/ruyi' },
|
||||
{ text: 'Xiaomi Civi 5 Pro (luming)', link: '/devices/luming' },
|
||||
{ text: 'Xiaomi Pad 6 Pro (liuqin)', link: '/devices/liuqin' },
|
||||
{ text: 'Xiaomi Pad 5 Pro 5G (enuma)', link: '/devices/enuma' },
|
||||
{ text: 'Redmi Turbo 3 / Poco F6 (peridot)', link: '/devices/peridot' },
|
||||
{ text: 'OnePlus 8 Pro (instantnoodlep)', link: '/devices/instantnoodlep' },
|
||||
{ text: 'OnePlus 8T (kebab)', link: '/devices/kebab' },
|
||||
{ text: 'OnePlus 6 (enchilada)', link: '/devices/enchilada' },
|
||||
{ text: 'OnePlus 15T (fairlady)', link: '/devices/fairlady' },
|
||||
{ text: 'OnePlus Pad Pro (caihong)', link: '/devices/caihong' },
|
||||
{ text: 'Nothing Phone (3a) (asteroids)', link: '/devices/asteroids' },
|
||||
{ text: 'Galaxy Tab S9 Ultra Wi-Fi (gts9uwifi)', link: '/devices/gts9uwifi' },
|
||||
{ text: 'Moto G9 Play (guamp)', link: '/devices/guamp' },
|
||||
{ text: 'Moto G 5G (gauguin)', link: '/devices/gauguin' },
|
||||
{ text: 'Microsoft Lumia 950', link: '/devices/lumia950' },
|
||||
{ text: 'OPPO R11 (r11)', link: '/devices/r11' },
|
||||
{ text: 'OPPO Find X9 (x9)', link: '/devices/x9' },
|
||||
{ text: 'Unisoc devices', link: '/devices/unisoc' },
|
||||
{ text: 'unixnu-build', link: '/devices/unixnu-build' },
|
||||
{ text: 'macOS on sheng', link: '/devices/sheng-macos' },
|
||||
],
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
'/devices/': deviceSidebar(false),
|
||||
'/reference/': enTasks.reference,
|
||||
'/contributing/': enTasks.reference,
|
||||
},
|
||||
|
||||
@@ -0,0 +1,697 @@
|
||||
[
|
||||
{
|
||||
"name": "sheng",
|
||||
"title": "Xiaomi Pad 6S Pro (sheng)",
|
||||
"title_zh": "小米平板 6S Pro（sheng）"
|
||||
},
|
||||
{
|
||||
"name": "a04br3",
|
||||
"title": "Benesse TAB-A04-BR3 (a04br3)",
|
||||
"title_zh": "Benesse TAB-A04-BR3（a04br3）"
|
||||
},
|
||||
{
|
||||
"name": "alioth",
|
||||
"title": "Redmi K40 (alioth)",
|
||||
"title_zh": "Redmi K40（alioth）"
|
||||
},
|
||||
{
|
||||
"name": "alioth-yang232138",
|
||||
"title": "Xiaomi Redmi K40 (alioth, M2012K11AC) (yang232138)",
|
||||
"title_zh": "Xiaomi Redmi K40 (alioth, M2012K11AC) (yang232138)"
|
||||
},
|
||||
{
|
||||
"name": "amethyst",
|
||||
"title": "Redmi Note 14 Pro+ 5G (amethyst)",
|
||||
"title_zh": "Redmi Note 14 Pro+ 5G（amethyst）"
|
||||
},
|
||||
{
|
||||
"name": "amethyst-bluedmc-amethyst",
|
||||
"title": "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst)",
|
||||
"title_zh": "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst)"
|
||||
},
|
||||
{
|
||||
"name": "asteroids",
|
||||
"title": "Nothing Phone (3a) (asteroids)",
|
||||
"title_zh": "Nothing Phone (3a)（asteroids）"
|
||||
},
|
||||
{
|
||||
"name": "braveark",
|
||||
"title": "Brave Ark tablet (braveark)",
|
||||
"title_zh": "Brave Ark 平板（braveark）"
|
||||
},
|
||||
{
|
||||
"name": "caihong",
|
||||
"title": "OnePlus Pad Pro (caihong)",
|
||||
"title_zh": "一加平板 Pro（caihong）"
|
||||
},
|
||||
{
|
||||
"name": "camellia",
|
||||
"title": "Redmi Note 10 5G (camellia)",
|
||||
"title_zh": "Redmi Note 10 5G（camellia）"
|
||||
},
|
||||
{
|
||||
"name": "cas",
|
||||
"title": "Xiaomi 10 Ultra (cas)",
|
||||
"title_zh": "小米 10 Ultra（cas）"
|
||||
},
|
||||
{
|
||||
"name": "cas-pxl777806",
|
||||
"title": "Xiaomi Mi 10 Ultra (pxl777806)",
|
||||
"title_zh": "Xiaomi Mi 10 Ultra (pxl777806)"
|
||||
},
|
||||
{
|
||||
"name": "cepheus",
|
||||
"title": "Xiaomi Mi 9 (cepheus)",
|
||||
"title_zh": "小米 9（cepheus）"
|
||||
},
|
||||
{
|
||||
"name": "cheeseburger",
|
||||
"title": "OnePlus 5 (cheeseburger)",
|
||||
"title_zh": "一加 5（cheeseburger）"
|
||||
},
|
||||
{
|
||||
"name": "cheeseburger-lss717",
|
||||
"title": "OnePlus 5 (lss717)",
|
||||
"title_zh": "OnePlus 5 (lss717)"
|
||||
},
|
||||
{
|
||||
"name": "cheeseburger-maozedongae",
|
||||
"title": "OnePlus 5 (maozedongae)",
|
||||
"title_zh": "OnePlus 5 (maozedongae)"
|
||||
},
|
||||
{
|
||||
"name": "chiron",
|
||||
"title": "Xiaomi MIX 2 (chiron)",
|
||||
"title_zh": "小米 MIX 2（chiron）"
|
||||
},
|
||||
{
|
||||
"name": "chiron-sbccc1888",
|
||||
"title": "Xiaomi Mi MIX 2, 6 GB / 128 GB; measured revision 2.1 (sbccc1888)",
|
||||
"title_zh": "Xiaomi Mi MIX 2, 6 GB / 128 GB; measured revision 2.1 (sbccc1888)"
|
||||
},
|
||||
{
|
||||
"name": "clover",
|
||||
"title": "Xiaomi Mi Pad 4 LTE (clover)",
|
||||
"title_zh": "小米平板 4 LTE（clover）"
|
||||
},
|
||||
{
|
||||
"name": "dada",
|
||||
"title": "Xiaomi 15 (dada)",
|
||||
"title_zh": "小米 15（dada）"
|
||||
},
|
||||
{
|
||||
"name": "dali",
|
||||
"title": "Redmi K80 Ultra (dali)",
|
||||
"title_zh": "Redmi K80 Ultra（dali）"
|
||||
},
|
||||
{
|
||||
"name": "dandelion",
|
||||
"title": "Redmi 9A (dandelion)",
|
||||
"title_zh": "Redmi 9A（dandelion）"
|
||||
},
|
||||
{
|
||||
"name": "dipper",
|
||||
"title": "Xiaomi Mi 8 (dipper)",
|
||||
"title_zh": "小米 8（dipper）"
|
||||
},
|
||||
{
|
||||
"name": "droidvm",
|
||||
"title": "DroidVM guest (crosvm on Gunyah)",
|
||||
"title_zh": "DroidVM 客户机（Gunyah 上的 crosvm）"
|
||||
},
|
||||
{
|
||||
"name": "droidvm-lateautumn233",
|
||||
"title": "DroidVM guest (crosvm on Gunyah) (lateautumn233)",
|
||||
"title_zh": "DroidVM guest (crosvm on Gunyah) (lateautumn233)"
|
||||
},
|
||||
{
|
||||
"name": "droidvm-neko17awa",
|
||||
"title": "DroidVM guest (crosvm on Gunyah) (Neko17awa)",
|
||||
"title_zh": "DroidVM guest (crosvm on Gunyah) (Neko17awa)"
|
||||
},
|
||||
{
|
||||
"name": "e5",
|
||||
"title": "Rongyue E5 (e5)",
|
||||
"title_zh": "Rongyue E5（e5）"
|
||||
},
|
||||
{
|
||||
"name": "elden",
|
||||
"title": "Lenovo Legion Y700 Gen 4 (elden)",
|
||||
"title_zh": "联想拯救者 Y700 四代（elden）"
|
||||
},
|
||||
{
|
||||
"name": "elish",
|
||||
"title": "Xiaomi Pad 5 Pro Wi-Fi (elish)",
|
||||
"title_zh": "小米平板 5 Pro Wi-Fi（elish）"
|
||||
},
|
||||
{
|
||||
"name": "enchilada",
|
||||
"title": "OnePlus 6 (enchilada)",
|
||||
"title_zh": "一加 6（enchilada）"
|
||||
},
|
||||
{
|
||||
"name": "enuma",
|
||||
"title": "Xiaomi Pad 5 Pro 5G (enuma)",
|
||||
"title_zh": "小米平板 5 Pro 5G（enuma）"
|
||||
},
|
||||
{
|
||||
"name": "enuma-alghiffaryfa19",
|
||||
"title": "Xiaomi Pad 5 Pro 5G / iPadOS 17.7.11 bring-up (alghiffaryfa19)",
|
||||
"title_zh": "Xiaomi Pad 5 Pro 5G / iPadOS 17.7.11 bring-up (alghiffaryfa19)"
|
||||
},
|
||||
{
|
||||
"name": "enuma-tlrenhb",
|
||||
"title": "Xiaomi Pad 5 Pro 5G (Tlrenhb)",
|
||||
"title_zh": "Xiaomi Pad 5 Pro 5G (Tlrenhb)"
|
||||
},
|
||||
{
|
||||
"name": "erhai",
|
||||
"title": "OnePlus Pad 2 Pro (erhai)",
|
||||
"title_zh": "一加平板 2 Pro（erhai）"
|
||||
},
|
||||
{
|
||||
"name": "fairlady",
|
||||
"title": "OnePlus 15T (fairlady)",
|
||||
"title_zh": "一加 15T（fairlady）"
|
||||
},
|
||||
{
|
||||
"name": "fajita",
|
||||
"title": "OnePlus 6T (fajita)",
|
||||
"title_zh": "一加 6T（fajita）"
|
||||
},
|
||||
{
|
||||
"name": "fuxi",
|
||||
"title": "Xiaomi 13 (fuxi)",
|
||||
"title_zh": "小米 13（fuxi）"
|
||||
},
|
||||
{
|
||||
"name": "fuxi-0721gpt",
|
||||
"title": "Xiaomi 13 (0721GPT)",
|
||||
"title_zh": "Xiaomi 13 (0721GPT)"
|
||||
},
|
||||
{
|
||||
"name": "fuxi-hanzi123-bilp",
|
||||
"title": "Xiaomi 13 (hanzi123-bilp)",
|
||||
"title_zh": "Xiaomi 13 (hanzi123-bilp)"
|
||||
},
|
||||
{
|
||||
"name": "fuxi-ljhhkx529",
|
||||
"title": "Xiaomi 13 (ljhhkx529)",
|
||||
"title_zh": "Xiaomi 13 (ljhhkx529)"
|
||||
},
|
||||
{
|
||||
"name": "fuxi-minecraftvm",
|
||||
"title": "Xiaomi 13 (MinecraftVM)",
|
||||
"title_zh": "Xiaomi 13 (MinecraftVM)"
|
||||
},
|
||||
{
|
||||
"name": "fuxi-mouse233",
|
||||
"title": "Xiaomi 13 (mouse233)",
|
||||
"title_zh": "Xiaomi 13 (mouse233)"
|
||||
},
|
||||
{
|
||||
"name": "fuxi-sohytrs",
|
||||
"title": "Xiaomi 13 (Sohytrs)",
|
||||
"title_zh": "Xiaomi 13 (Sohytrs)"
|
||||
},
|
||||
{
|
||||
"name": "fuxi-xyvern08371",
|
||||
"title": "Xiaomi 13 (SM8550) (Xyvern08371)",
|
||||
"title_zh": "Xiaomi 13 (SM8550) (Xyvern08371)"
|
||||
},
|
||||
{
|
||||
"name": "gauguin",
|
||||
"title": "Motorola Moto G 5G (gauguin)",
|
||||
"title_zh": "摩托罗拉 Moto G 5G（gauguin）"
|
||||
},
|
||||
{
|
||||
"name": "giulia",
|
||||
"title": "OnePlus Ace 5 (giulia)",
|
||||
"title_zh": "一加 Ace 5（giulia）"
|
||||
},
|
||||
{
|
||||
"name": "gta4l",
|
||||
"title": "Samsung Galaxy Tab A7 10.4 (gta4l)",
|
||||
"title_zh": "三星 Galaxy Tab A7 10.4（gta4l）"
|
||||
},
|
||||
{
|
||||
"name": "gta4l-ilovemykedi",
|
||||
"title": "Samsung Galaxy Tab A7 10.4 (2020) (ilovemykedi)",
|
||||
"title_zh": "Samsung Galaxy Tab A7 10.4 (2020) (ilovemykedi)"
|
||||
},
|
||||
{
|
||||
"name": "gts9uwifi",
|
||||
"title": "Samsung Galaxy Tab S9 Ultra Wi-Fi (gts9uwifi)",
|
||||
"title_zh": "三星 Galaxy Tab S9 Ultra Wi-Fi（gts9uwifi）"
|
||||
},
|
||||
{
|
||||
"name": "guacamole",
|
||||
"title": "OnePlus 7 Pro (guacamole)",
|
||||
"title_zh": "OnePlus 7 Pro（guacamole）"
|
||||
},
|
||||
{
|
||||
"name": "guamp",
|
||||
"title": "Motorola Moto G9 Play (guamp)",
|
||||
"title_zh": "摩托罗拉 Moto G9 Play（guamp）"
|
||||
},
|
||||
{
|
||||
"name": "haydn",
|
||||
"title": "Redmi K40 Pro (haydn)",
|
||||
"title_zh": "Redmi K40 Pro（haydn）"
|
||||
},
|
||||
{
|
||||
"name": "haydn-xiaomi-haydn-dev",
|
||||
"title": "Xiaomi K40 Pro (xiaomi-haydn-dev)",
|
||||
"title_zh": "Xiaomi K40 Pro (xiaomi-haydn-dev)"
|
||||
},
|
||||
{
|
||||
"name": "hero2lte",
|
||||
"title": "Samsung Galaxy S7 Edge (hero2lte)",
|
||||
"title_zh": "三星 Galaxy S7 Edge（hero2lte）"
|
||||
},
|
||||
{
|
||||
"name": "houji",
|
||||
"title": "Xiaomi 14 (houji)",
|
||||
"title_zh": "小米 14（houji）"
|
||||
},
|
||||
{
|
||||
"name": "hummer",
|
||||
"title": "OnePlus Ace 5 Pro (hummer)",
|
||||
"title_zh": "一加 Ace 5 Pro（hummer）"
|
||||
},
|
||||
{
|
||||
"name": "instantnoodlep",
|
||||
"title": "OnePlus 8 Pro (instantnoodlep)",
|
||||
"title_zh": "一加 8 Pro（instantnoodlep）"
|
||||
},
|
||||
{
|
||||
"name": "ishtar",
|
||||
"title": "Xiaomi 13 Ultra (ishtar)",
|
||||
"title_zh": "小米 13 Ultra（ishtar）"
|
||||
},
|
||||
{
|
||||
"name": "ishtar-markakash",
|
||||
"title": "Xiaomi 13 Ultra - XNU (iOS 18) (markakash)",
|
||||
"title_zh": "Xiaomi 13 Ultra - XNU (iOS 18) (markakash)"
|
||||
},
|
||||
{
|
||||
"name": "j716f",
|
||||
"title": "Lenovo Xiaoxin Pad Pro 2021 (j716f)",
|
||||
"title_zh": "联想小新 Pad Pro 2021（j716f）"
|
||||
},
|
||||
{
|
||||
"name": "kebab",
|
||||
"title": "OnePlus 8T (kebab)",
|
||||
"title_zh": "一加 8T（kebab）"
|
||||
},
|
||||
{
|
||||
"name": "kebab-stevedang67889",
|
||||
"title": "OnePlus 8T (stevedang67889)",
|
||||
"title_zh": "OnePlus 8T (stevedang67889)"
|
||||
},
|
||||
{
|
||||
"name": "komodo",
|
||||
"title": "Google Pixel 9 Pro XL (komodo)",
|
||||
"title_zh": "Google Pixel 9 Pro XL（komodo）"
|
||||
},
|
||||
{
|
||||
"name": "lemonades",
|
||||
"title": "OnePlus 9R (lemonades)",
|
||||
"title_zh": "一加 9R（lemonades）"
|
||||
},
|
||||
{
|
||||
"name": "liuqin",
|
||||
"title": "Xiaomi Pad 6 Pro (liuqin)",
|
||||
"title_zh": "小米平板 6 Pro（liuqin）"
|
||||
},
|
||||
{
|
||||
"name": "lmipro",
|
||||
"title": "Redmi K30 Pro Zoom Edition (lmipro)",
|
||||
"title_zh": "Redmi K30 Pro 变焦版（lmipro）"
|
||||
},
|
||||
{
|
||||
"name": "lmipro-yang232138",
|
||||
"title": "Redmi K30 Pro Zoom Edition (lmipro, SM8250) (yang232138)",
|
||||
"title_zh": "Redmi K30 Pro Zoom Edition (lmipro, SM8250) (yang232138)"
|
||||
},
|
||||
{
|
||||
"name": "lumia950",
|
||||
"title": "Microsoft Lumia 950",
|
||||
"title_zh": "Microsoft Lumia 950"
|
||||
},
|
||||
{
|
||||
"name": "luming",
|
||||
"title": "Xiaomi Civi 5 Pro (luming)",
|
||||
"title_zh": "小米 Civi 5 Pro（luming）"
|
||||
},
|
||||
{
|
||||
"name": "m2381",
|
||||
"title": "Meizu 20 Classic (m2381)",
|
||||
"title_zh": "魅族 20 Classic（m2381）"
|
||||
},
|
||||
{
|
||||
"name": "malachite",
|
||||
"title": "POCO X7 / Redmi Note 14 Pro 5G (malachite)",
|
||||
"title_zh": "POCO X7 / Redmi Note 14 Pro 5G（malachite）"
|
||||
},
|
||||
{
|
||||
"name": "marble",
|
||||
"title": "Redmi Note 12 Turbo / POCO F5 (marble)",
|
||||
"title_zh": "Redmi Note 12 Turbo / POCO F5（marble）"
|
||||
},
|
||||
{
|
||||
"name": "merlinx",
|
||||
"title": "Xiaomi Redmi Note 9 (merlinx)",
|
||||
"title_zh": "Redmi Note 9（merlinx）"
|
||||
},
|
||||
{
|
||||
"name": "myron",
|
||||
"title": "Redmi K90 Pro Max / Poco F8 Ultra (myron)",
|
||||
"title_zh": "Redmi K90 Pro Max / Poco F8 Ultra（myron）"
|
||||
},
|
||||
{
|
||||
"name": "nabu",
|
||||
"title": "Xiaomi Pad 5 (nabu)",
|
||||
"title_zh": "小米平板 5（nabu）"
|
||||
},
|
||||
{
|
||||
"name": "nabu-3214791900-del",
|
||||
"title": "Xiaomi Pad 5 (3214791900-del)",
|
||||
"title_zh": "Xiaomi Pad 5 (3214791900-del)"
|
||||
},
|
||||
{
|
||||
"name": "nabu-lee-kenneth",
|
||||
"title": "Xiaomi Pad 5 (lee-kenneth)",
|
||||
"title_zh": "Xiaomi Pad 5 (lee-kenneth)"
|
||||
},
|
||||
{
|
||||
"name": "nabu-zzc775",
|
||||
"title": "Xiaomi Pad 5 (zzc775)",
|
||||
"title_zh": "Xiaomi Pad 5 (zzc775)"
|
||||
},
|
||||
{
|
||||
"name": "nash",
|
||||
"title": "Motorola Moto Z2 Force (nash)",
|
||||
"title_zh": "摩托罗拉 Moto Z2 Force（nash）"
|
||||
},
|
||||
{
|
||||
"name": "negroni",
|
||||
"title": "OnePlus 10 Pro 5G (negroni)",
|
||||
"title_zh": "一加 10 Pro 5G（negroni）"
|
||||
},
|
||||
{
|
||||
"name": "nuwa",
|
||||
"title": "Xiaomi 13 Pro (nuwa)",
|
||||
"title_zh": "小米 13 Pro（nuwa）"
|
||||
},
|
||||
{
|
||||
"name": "nuwa-alex-enix",
|
||||
"title": "Xiaomi 13 Pro (nuwa) (Alex-Enix)",
|
||||
"title_zh": "Xiaomi 13 Pro (nuwa) (Alex-Enix)"
|
||||
},
|
||||
{
|
||||
"name": "nuwa-pubglite55",
|
||||
"title": "Xiaomi 13 Pro (pubglite55)",
|
||||
"title_zh": "Xiaomi 13 Pro (pubglite55)"
|
||||
},
|
||||
{
|
||||
"name": "nx721j",
|
||||
"title": "ZTE Nubia Z60 Ultra (nx721j)",
|
||||
"title_zh": "中兴努比亚 Z60 Ultra（nx721j）"
|
||||
},
|
||||
{
|
||||
"name": "nx729j",
|
||||
"title": "Nubia RedMagic 8 Pro / 8 Pro+ (nx729j)",
|
||||
"title_zh": "努比亚红魔 8 Pro / 8 Pro+（nx729j）"
|
||||
},
|
||||
{
|
||||
"name": "oneplus13t",
|
||||
"title": "OnePlus 13T (oneplus13t)",
|
||||
"title_zh": "一加 13T（oneplus13t）"
|
||||
},
|
||||
{
|
||||
"name": "pandora",
|
||||
"title": "Xiaomi 17 Pro (pandora)",
|
||||
"title_zh": "小米 17 Pro（pandora）"
|
||||
},
|
||||
{
|
||||
"name": "pdx203",
|
||||
"title": "Sony Xperia 1 II (pdx203)",
|
||||
"title_zh": "Sony Xperia 1 II（pdx203）"
|
||||
},
|
||||
{
|
||||
"name": "peridot",
|
||||
"title": "Redmi Turbo 3 / Poco F6 (peridot)",
|
||||
"title_zh": "Redmi Turbo 3 / Poco F6（peridot）"
|
||||
},
|
||||
{
|
||||
"name": "peridot-wzy114514sb",
|
||||
"title": "Poco F6 / Redmi Turbo 3 (wzy114514sb)",
|
||||
"title_zh": "Poco F6 / Redmi Turbo 3 (wzy114514sb)"
|
||||
},
|
||||
{
|
||||
"name": "phy120",
|
||||
"title": "OPPO Find X7 Ultra (PHY120)",
|
||||
"title_zh": "OPPO Find X7 Ultra（PHY120）"
|
||||
},
|
||||
{
|
||||
"name": "piano",
|
||||
"title": "Xiaomi Pad 8 Pro (piano)",
|
||||
"title_zh": "小米平板 8 Pro（piano）"
|
||||
},
|
||||
{
|
||||
"name": "picasso",
|
||||
"title": "Redmi K30 5G (picasso)",
|
||||
"title_zh": "Redmi K30 5G（picasso）"
|
||||
},
|
||||
{
|
||||
"name": "picasso-minhtritt1996",
|
||||
"title": "Redmi K30 5G (minhtritt1996)",
|
||||
"title_zh": "Redmi K30 5G (minhtritt1996)"
|
||||
},
|
||||
{
|
||||
"name": "pipa",
|
||||
"title": "Xiaomi Pad 6 (pipa)",
|
||||
"title_zh": "小米平板 6（pipa）"
|
||||
},
|
||||
{
|
||||
"name": "pipa-fft-infra",
|
||||
"title": "Xiaomi Pad 6 (FFT-infra)",
|
||||
"title_zh": "Xiaomi Pad 6 (FFT-infra)"
|
||||
},
|
||||
{
|
||||
"name": "pipa-xvanturing",
|
||||
"title": "Xiaomi Pad 6 (xVanTuring)",
|
||||
"title_zh": "Xiaomi Pad 6 (xVanTuring)"
|
||||
},
|
||||
{
|
||||
"name": "polaris",
|
||||
"title": "Xiaomi Mi MIX 2S (polaris)",
|
||||
"title_zh": "小米 MIX 2S（polaris）"
|
||||
},
|
||||
{
|
||||
"name": "pong",
|
||||
"title": "Nothing Phone (2) (pong)",
|
||||
"title_zh": "Nothing Phone (2)（pong）"
|
||||
},
|
||||
{
|
||||
"name": "pong-y3d4",
|
||||
"title": "Nothing Phone (2): UniXNU UEFI bring-up (Y3d4)",
|
||||
"title_zh": "Nothing Phone (2): UniXNU UEFI bring-up (Y3d4)"
|
||||
},
|
||||
{
|
||||
"name": "q2q",
|
||||
"title": "Galaxy Z Fold3 (q2q)",
|
||||
"title_zh": "Galaxy Z Fold3（q2q）"
|
||||
},
|
||||
{
|
||||
"name": "qemu",
|
||||
"title": "QEMU virt",
|
||||
"title_zh": "QEMU virt"
|
||||
},
|
||||
{
|
||||
"name": "r11",
|
||||
"title": "OPPO R11 (r11)",
|
||||
"title_zh": "OPPO R11（r11）"
|
||||
},
|
||||
{
|
||||
"name": "raphael",
|
||||
"title": "Redmi K20 Pro / Mi 9T Pro (raphael)",
|
||||
"title_zh": "Redmi K20 Pro / Mi 9T Pro（raphael）"
|
||||
},
|
||||
{
|
||||
"name": "ruyi",
|
||||
"title": "Xiaomi MIX Flip (ruyi)",
|
||||
"title_zh": "小米 MIX Flip（ruyi）"
|
||||
},
|
||||
{
|
||||
"name": "ruyi-arnodorian123",
|
||||
"title": "Xiaomi MIX Flip (ArnoDorian123)",
|
||||
"title_zh": "Xiaomi MIX Flip (ArnoDorian123)"
|
||||
},
|
||||
{
|
||||
"name": "ruyi-ehunshuaige",
|
||||
"title": "Xiaomi MIX Flip (ehunshuaige)",
|
||||
"title_zh": "Xiaomi MIX Flip (ehunshuaige)"
|
||||
},
|
||||
{
|
||||
"name": "sagit",
|
||||
"title": "Xiaomi Mi 6 (sagit)",
|
||||
"title_zh": "小米 6（sagit）"
|
||||
},
|
||||
{
|
||||
"name": "sheng-16crow",
|
||||
"title": "Xiaomi Pad 6S Pro (16Crow)",
|
||||
"title_zh": "Xiaomi Pad 6S Pro (16Crow)"
|
||||
},
|
||||
{
|
||||
"name": "sheng-alghiffaryfa19",
|
||||
"title": "Xiaomi Pad 6S Pro (alghiffaryfa19)",
|
||||
"title_zh": "Xiaomi Pad 6S Pro (alghiffaryfa19)"
|
||||
},
|
||||
{
|
||||
"name": "sheng-fft-infra",
|
||||
"title": "Xiaomi Pad 6S Pro (FFT-infra)",
|
||||
"title_zh": "Xiaomi Pad 6S Pro (FFT-infra)"
|
||||
},
|
||||
{
|
||||
"name": "sheng-hxzbaka",
|
||||
"title": "Xiaomi Pad 6S Pro (hxzbaka)",
|
||||
"title_zh": "Xiaomi Pad 6S Pro (hxzbaka)"
|
||||
},
|
||||
{
|
||||
"name": "sheng-jn7163",
|
||||
"title": "Xiaomi Pad 6S Pro (jn7163)",
|
||||
"title_zh": "Xiaomi Pad 6S Pro (jn7163)"
|
||||
},
|
||||
{
|
||||
"name": "sheng-liangkam",
|
||||
"title": "Xiaomi Pad 6S Pro (LiangKam)",
|
||||
"title_zh": "Xiaomi Pad 6S Pro (LiangKam)"
|
||||
},
|
||||
{
|
||||
"name": "sheng-lilinnan",
|
||||
"title": "Xiaomi Pad 6S Pro (lilinnan)",
|
||||
"title_zh": "Xiaomi Pad 6S Pro (lilinnan)"
|
||||
},
|
||||
{
|
||||
"name": "sheng-macos",
|
||||
"title": "macOS on sheng",
|
||||
"title_zh": "sheng 上的 macOS"
|
||||
},
|
||||
{
|
||||
"name": "sheng-thearchitectengineer",
|
||||
"title": "Xiaomi Pad 6S Pro (TheArchitectEngineer)",
|
||||
"title_zh": "Xiaomi Pad 6S Pro (TheArchitectEngineer)"
|
||||
},
|
||||
{
|
||||
"name": "sheng-yuyaukong",
|
||||
"title": "Xiaomi Pad 6S Pro (yuyaukong)",
|
||||
"title_zh": "Xiaomi Pad 6S Pro (yuyaukong)"
|
||||
},
|
||||
{
|
||||
"name": "sirius",
|
||||
"title": "Xiaomi Mi 8 SE (sirius)",
|
||||
"title_zh": "小米 8 SE（sirius）"
|
||||
},
|
||||
{
|
||||
"name": "sm-t733",
|
||||
"title": "Samsung Galaxy Tab S7 FE Wi-Fi (SM-T733)",
|
||||
"title_zh": "三星 Galaxy Tab S7 FE Wi-Fi（SM-T733）"
|
||||
},
|
||||
{
|
||||
"name": "sweet",
|
||||
"title": "Redmi Note 10 Pro (sweet)",
|
||||
"title_zh": "Redmi Note 10 Pro（sweet）"
|
||||
},
|
||||
{
|
||||
"name": "sweet-zeroninevibedslop",
|
||||
"title": "Xiaomi Redmi Note 10 Pro (zeroninevibedslop)",
|
||||
"title_zh": "Xiaomi Redmi Note 10 Pro (zeroninevibedslop)"
|
||||
},
|
||||
{
|
||||
"name": "t610yp",
|
||||
"title": "Unisoc UMS512 / T610YP",
|
||||
"title_zh": "Unisoc UMS512 / T610YP"
|
||||
},
|
||||
{
|
||||
"name": "tb128fu",
|
||||
"title": "Lenovo Xiaoxin Pad 2022 (tb128fu)",
|
||||
"title_zh": "联想小新 Pad 2022（tb128fu）"
|
||||
},
|
||||
{
|
||||
"name": "thyme",
|
||||
"title": "Xiaomi Mi 10S (thyme)",
|
||||
"title_zh": "小米 10S（thyme）"
|
||||
},
|
||||
{
|
||||
"name": "thyme-coryyi",
|
||||
"title": "Xiaomi Mi 10S / SM8250-AC UniXNU bring-up (measured 2026-10-24) (Coryyi)",
|
||||
"title_zh": "Xiaomi Mi 10S / SM8250-AC UniXNU bring-up (measured 2026-10-24) (Coryyi)"
|
||||
},
|
||||
{
|
||||
"name": "udon",
|
||||
"title": "OnePlus Ace 2 / 11R (udon)",
|
||||
"title_zh": "一加 Ace 2 / 11R（udon）"
|
||||
},
|
||||
{
|
||||
"name": "uke",
|
||||
"title": "Xiaomi Pad 7 / POCO Pad X1 (uke)",
|
||||
"title_zh": "小米平板 7 / POCO Pad X1（uke）"
|
||||
},
|
||||
{
|
||||
"name": "uke-wuhaoran956-cyber",
|
||||
"title": "Xiaomi Pad 7 (wuhaoran956-cyber)",
|
||||
"title_zh": "Xiaomi Pad 7 (wuhaoran956-cyber)"
|
||||
},
|
||||
{
|
||||
"name": "umi",
|
||||
"title": "Xiaomi Mi 10 (umi)",
|
||||
"title_zh": "小米 10（umi）"
|
||||
},
|
||||
{
|
||||
"name": "umi-mouya-q",
|
||||
"title": "Xiaomi Mi 10 / SM8250 UniXNU bring-up (mouya-q)",
|
||||
"title_zh": "Xiaomi Mi 10 / SM8250 UniXNU bring-up (mouya-q)"
|
||||
},
|
||||
{
|
||||
"name": "unisoc",
|
||||
"title": "Unisoc devices",
|
||||
"title_zh": "Unisoc 设备"
|
||||
},
|
||||
{
|
||||
"name": "unixnu-build",
|
||||
"title": "unixnu-build",
|
||||
"title_zh": "unixnu-build"
|
||||
},
|
||||
{
|
||||
"name": "vermeer",
|
||||
"title": "Redmi K70 (vermeer)",
|
||||
"title_zh": "Redmi K70（vermeer）"
|
||||
},
|
||||
{
|
||||
"name": "vermeer-xyyyds0106",
|
||||
"title": "Redmi K70 (xyyyds0106)",
|
||||
"title_zh": "Redmi K70 (xyyyds0106)"
|
||||
},
|
||||
{
|
||||
"name": "vermeer-yyx2025",
|
||||
"title": "Redmi K70 (yyx2025)",
|
||||
"title_zh": "Redmi K70 (yyx2025)"
|
||||
},
|
||||
{
|
||||
"name": "x9",
|
||||
"title": "OPPO Find X9 (x9)",
|
||||
"title_zh": "OPPO Find X9（x9）"
|
||||
},
|
||||
{
|
||||
"name": "zeta",
|
||||
"title": "Microsoft Surface Duo 2 (zeta)",
|
||||
"title_zh": "Microsoft Surface Duo 2（zeta）"
|
||||
},
|
||||
{
|
||||
"name": "zorn",
|
||||
"title": "Redmi K80 (zorn)",
|
||||
"title_zh": "Redmi K80（zorn）"
|
||||
}
|
||||
]
|
||||
@@ -0,0 +1,244 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "elden"
|
||||
soc = "SM8750P"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Lenovo Legion Y700 Gen 4 format 2 migration. Phase 1 UEFI is device-verified; XNU, storage, display and touch remain bring-up work."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "host-verified"
|
||||
components = ["ArmDTPlatform", "ArmCpu", "SoftwareAES", "XnuPrelink", "DarwinBoot"]
|
||||
paths = ["board.toml", "feeds.toml", "soc/**", "configs/**", ".github/**", ".gitignore", "local.toml.example"]
|
||||
inputs = ["Use the ARM64 and iPadOS 17.7.11 profiles supplied by UniXNU.", "Select the shared platform, CPU and DarwinBoot components.", "Provide an SM8750 profile until an official shared SoC repository exists."]
|
||||
configuration = ["board.toml declares schema_version = 2, soc_source = sm8750 and os_profile = ipados-17.7.11-21H461.", "The complete component list is explicit because profile arrays replace inherited arrays.", "Configuration and patch roots are ordered as ARM64, SoC, OS and device.", "soc/sm8750 supplies the transition profile and is referenced from feeds.toml."]
|
||||
procedure = ["Run defconfig from a current UniXNU checkout.", "Inspect status JSON for profile order, component dependencies, patch order and output path.", "Replace the local SoC source with a reviewed UniXNU-sm8750-common commit before release."]
|
||||
findings = ["The repository was format 1 and did not select shared SoC or OS profiles.", "A public UniXNU-sm8750-common repository was not available during migration.", "Keeping a separate local SoC profile preserves parser validation without mislabelling unqualified hardware support as shared.", "Phase 2.0 resolved ARM64, local SM8750, iPadOS and device layers; the selected component order, 56 patches, 4 KiB page setting and separate format 2 output were checked with current UniXNU.", "Phase 2.1 keeps the XNU handoff and firmware memory description separate from the phase 1 dummy firmware DTB.", "Phase 2.2 resolved 57 patches after adding compile-time-disabled PMGR context required by the shared boot-progress patch. CONFIG_XNU_BOOT_PROGRESS is disabled for the minimum kernel because that diagnostic layer currently requires UFS, owner-root and Virtio."]
|
||||
completion = ["board.toml resolves four ordered configuration layers.", "All selected components come from the UniXNU catalog and include their dependencies.", "No array field depends accidentally on inheritance.", "The SoC source is a reviewed remote commit and unixnu.lock records it."]
|
||||
limits = ["soc/sm8750 is local and is not yet a release-quality shared source.", "The first resolution pass selects only platform, CPU, AES, prelink and DarwinBoot components."]
|
||||
next_action = ["Phase 2.3: validate the near-final-size Android v3 ramdisk, FDT/initrd and HOB path in an isolated candidate. Replace the local SM8750 source with a reviewed shared commit before release."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "board.toml", result = "Schema 2 profile, component, kernel, device-tree and payload declarations." },
|
||||
{ kind = "source", reference = "feeds.toml", result = "SM8750 transition source with the release replacement documented." },
|
||||
{ kind = "source", reference = "soc/sm8750/soc.toml", result = "Shared-profile-shaped SM8750 transition metadata." },
|
||||
{ kind = "source", reference = "docs/FORMAT2-MIGRATION.md", result = "Migration result, preserved phase 1 inputs and remaining release work." },
|
||||
{ kind = "host", reference = "docs/PHASE2-STATUS.md", command = ".venv/bin/python .cache/phase2-plan/UniXNU/unixnu status --json -D .", revision = "16e592abee8a550dec8154ed1f38b5ebc4f16213", result = "2026-10-25: fresh defconfig, tree and status runs resolved four profiles, five pinned components, 56 patches and 4 KiB pages under a format 2 output directory separate from phase 1. The local SM8750 source remains unpinned for release." },
|
||||
{ kind = "host", reference = "docs/PHASE2.2-STATUS.md", command = "PATH=.cache/phase2-plan/toolchain/bin:.venv/bin:$PATH .venv/bin/python .cache/phase2-plan/UniXNU/unixnu build kernel -D .", revision = "c91a2191fdf591a401a03027ed8b7fbfdbcad3a7", result = "2026-10-25: defconfig and status resolved five canonical components and 57 applied patches. The Command Line Tools host-shim build produced and prelinked the target kernel; release rebuilding still requires a full Xcode iPhoneOS SDK." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "device-verified"
|
||||
components = ["DarwinBoot"]
|
||||
paths = ["scripts/**", "drivers/**", "patches/overlays/**", "package/**", "proprietary-files.txt"]
|
||||
inputs = ["mu_wide_platforms lenovo-y700g4 UEFI source and patched PMIC binaries.", "UniXNU, UniXNUDxe, DarwinBoot and EldenRamDiskDxe firmware modules.", "A 4 MiB FAT16 payload containing package/unixnu.toml."]
|
||||
configuration = ["firmware.dsc points to PakalaPkg/PakalaNoSb.dsc.", "firmware.fd points to the DEBUG CLANGPDB SM8750_EFI.fd.", "payload volume is ELDENRAM and loader is firmware.", "panic_screen remains false because the phase 2 panic renderer is not integrated."]
|
||||
procedure = ["Build the phase 1 image with scripts/build_phase1.py.", "Run scripts/verify_artifact.py against the FD and Android v3 image.", "Owner performs two RAM cold boots with fastboot boot."]
|
||||
findings = ["The vendor UFSDxe crashed before the menu, so it was removed from the phase 1 APRIORI, DSC and FDF.", "The embedded FAT payload avoids persistent storage and makes the menu independent of UFS.", "The same image reached the visible menu twice and returned to stock Android after reset."]
|
||||
completion = ["Firmware contains UniXNU, UniXNUDxe, DarwinBoot and the RAM payload driver.", "The payload config is readable and the menu accepts volume-key input.", "Two RAM boots produce the same visible checkpoint and do not modify persistent partitions."]
|
||||
limits = ["The verified firmware is phase 1 and does not contain a bootable XNU payload.", "The new format 2 firmware command is not yet switched from the project build script."]
|
||||
next_action = ["Use the current phase 1 image as the accepted baseline. Phase 2.3: validate Android ramdisk/FDT/HOB handoff and the RAM disk driver only in a separately isolated candidate; measure inner/outer FV capacity before integrating kernel inputs."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/PHASE1-STATUS.md", result = "Accepted phase 1 artifact and firmware/module inventory." },
|
||||
{ kind = "source", reference = "scripts/verify_artifact.py", result = "Static FD, Android image and embedded FAT verification." },
|
||||
{ kind = "device", reference = "docs/PHASE2-STATUS.md", command = "fastboot boot out/elden-phase1.img", revision = "dffc3020a85830d0d981a85871d9ab31aac5827d", result = "2026-10-25: owner reported that the current image completed two RAM cold boots, reached the visible and operable UniXNU menu, and returned to stock Android." },
|
||||
{ kind = "device", reference = "docs/PHASE1-HANDOFF.md", command = "fastboot boot out/elden-phase1.img", revision = "c591b1a0a471f24978aba25c56c8f6ec9bd06668", result = "Two owner-run RAM cold boots reached the UniXNU menu and returned to Android." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "implemented"
|
||||
components = ["ArmCpu"]
|
||||
paths = ["soc/sm8750/dts/**", "dts/**"]
|
||||
inputs = ["SM8750 MPIDRs 0x0, 0x100, 0x200, 0x300, 0x400, 0x500, 0x10000 and 0x10100.", "GICv3 distributor 0x16000000, redistributor base 0x16080000 and stride 0x40000.", "19.2 MHz architectural timer and PSCI SMC conduit."]
|
||||
configuration = ["The SoC DTSI declares eight CPU nodes, timebase-frequency = 19200000 and psci method = smc.", "The GIC node exports unixnu,adt-name = intc.", "The device defconfig enables ARM DT platform, ArmCpu, native timer and PAN."]
|
||||
procedure = ["Compile dts/elden.dts with the SoC include path.", "Generate an ADT from the DTB and inspect /cpus, /psci and /arm-io/intc.", "Boot the smallest XNU payload and record the first CPU, GIC or timer failure."]
|
||||
findings = ["The board evidence documents the same eight MPIDR layout used by other SM8750 ports.", "The shared ADT generator emitted cpu0 as running and all other cores as waiting; ArmCpu does not probe secondary nubs unless sheng-smp is enabled.", "ArmCpu reads the GIC through /arm-io/intc and requires a complete two-range reg property.", "The old kernel argument set enabled armcpu-spi-ipi before elden had evidence that SGIs fail or that per-core SPI routing works. Phase 2.1 removed it from the single-boot-CPU milestone.", "Secondary CPU startup and both SGI and SPI IPI delivery are not device-verified for elden."]
|
||||
completion = ["The boot CPU reaches the ArmCpu checkpoint.", "GIC distributor and its own redistributor frame map successfully.", "Timer handling works before secondary cores or IPI transport are qualified."]
|
||||
limits = ["No elden XNU CPU, GIC or timer log exists yet.", "The eight-core topology is described, but SMP bring-up is not claimed."]
|
||||
next_action = ["Phase 2.5: prove ArmDTPlatform and the boot CPU ArmCpu/GIC/timer checkpoints using the audited CPU order and argument set. Defer SPI IPI, SGI delivery, secondary startup and SMP qualification to separate device checks."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "soc/sm8750/dts/sm8750.dtsi", result = "SM8750 CPU, PSCI, GICv3 and timer resources." },
|
||||
{ kind = "source", reference = "docs/PHASE2-HANDOFF.md", result = "Board CPU/GIC/timebase inventory and planned diagnostic sequence." },
|
||||
{ kind = "host", reference = "docs/PHASE2.1-STATUS.md", command = ".venv/bin/python scripts/phase2_1_audit.py --linux-dir .cache/elden-linux", revision = "16e592abee8a550dec8154ed1f38b5ebc4f16213", result = "2026-10-25: independently decoded ADT contains the eight expected MPIDRs, cpu0 running and seven CPUs waiting, 19.2 MHz timebase, SMC PSCI, and GIC distributor/redistributor bases with 0x40000 stride. No device CPU checkpoint is claimed." },
|
||||
{ kind = "host", reference = "docs/PHASE2.2-STATUS.md", command = "xcrun nm -g .cache/phase2-plan/UniXNU/out/elden/ipados-17.7.11-21H461/elden/kernel/kernel.macho", revision = "c91a2191fdf591a401a03027ed8b7fbfdbcad3a7", result = "2026-10-25: the prelinked kernel exports ArmCpu probe/start, GIC distributor and timer-related symbols and ArmDTPlatform configure/createDeviceNubs symbols. Symbol presence is source evidence, not a device checkpoint." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "implemented"
|
||||
components = ["ArmDTPlatform"]
|
||||
paths = ["dts/**", "soc/sm8750/dts/**", "scripts/phase2_1_audit.py"]
|
||||
inputs = ["The owner-captured live elden FDT, including the 12 GiB RAM map, initrd and reserved-memory nodes.", "The pinned Linux 16 GiB variant and the elden UEFI static memory map.", "A conservative 256 MiB XNU handoff window in UEFI DXE conventional memory."]
|
||||
configuration = ["dts/elden.dts declares one 256 MiB XNU handoff node at 0xC2400000.", "payload.dram_size and payload.adt.owned_memory_size both request 0x10000000.", "dts/elden-firmware-memory.dts records the sanitised live 12 GiB RAM map, reserved-memory ranges and expected GOP framebuffer.", "The format 2 generator creates a 64-byte seed, CHRP NVRAM proxy and optional-input memory-map placeholders."]
|
||||
procedure = ["Compile the hardware and firmware memory descriptions.", "Generate an ADT with the shared generator and decode it independently.", "Cross-check the XNU window against firmware RAM, reserved-memory and the pinned UEFI memory map."]
|
||||
findings = ["The previous [0x80000000, 0x100000000) candidate overlapped 44 recorded no-map reservations and was removed.", "The live FDT is 885,861 bytes with SHA-256 8a653a3e790f29bf2b0f3545135f06fe771360f31da3d37c04f648c26b95e26e and describes the current 12 GiB RAM map.", "The former A8000000+10000000 UEFI Kernel carveout overlaps the live initrd B74AC000-B7FFEE30 and is unsuitable for RAM-boot phase 2.", "C2400000+10000000 is covered by live RAM, avoids all live reservations and the initrd, and lies in UEFI DXE conventional memory.", "The flashed vendor FDT uses generic qcom,sun-qrd compatible strings but retains the elden 3K panel marker, 1904x3040 display and UFS path.", "The ADT has no optional RAMDisk, TrustCache or GPU addon placeholders because phase 2.1 has no matching inputs.", "The unique chip ID remains a local input and is not stored in the repository."]
|
||||
completion = ["The ADT contains exactly one continuous memory range.", "The range is covered by live firmware RAM and avoids recorded reservations, initrd, GOP and UEFI FD.", "DarwinBoot and the UEFI exit map confirm that same range is conventional memory before XNU entry."]
|
||||
limits = ["The raw live FDT remains local-only because it can contain device identifiers.", "Actual DarwinBoot ADT, boot_args and allocated-window addresses remain runtime evidence.", "The live vendor tree and pinned 16 GiB source differ in RAM size and generic compatible strings; both are tracked separately.", "SMMU and cache policy are not complete."]
|
||||
next_action = ["Phase 2.3: preserve .cache/device/elden-live.fdt locally and rerun the live audit if firmware or boot mode changes; never commit the raw tree. Keep the phase 2 hardware ADT separate from the firmware FDT."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "dts/elden.dts", result = "One 256 MiB XNU range in UEFI DXE conventional memory and board compatible values." },
|
||||
{ kind = "source", reference = "dts/elden-firmware-memory.dts", result = "Sanitised live 12 GiB RAM, reserved-memory and expected GOP framebuffer description." },
|
||||
{ kind = "source", reference = "docs/porting-analysis.md", result = "Documented DRAM base, fragmentation risk and memory handoff constraints." },
|
||||
{ kind = "device", reference = "docs/PHASE2.1-STATUS.md", command = "/Users/jerry/Library/Android/sdk/platform-tools/adb shell su -c 'cp /sys/firmware/fdt /data/local/tmp/elden-live.fdt'", revision = "c91a2191fdf591a401a03027ed8b7fbfdbcad3a7", result = "2026-10-25: owner-connected device produced an 885,861-byte live FDT with SHA-256 8a653a3e790f29bf2b0f3545135f06fe771360f31da3d37c04f648c26b95e26e. The flashed vendor tree reports generic qcom,sun-qrd compatible values but contains elden panel markers, 1904x3040 display, 1d84000 UFS and a 12 GiB RAM map. Raw bytes remain local-only." },
|
||||
{ kind = "host", reference = "docs/PHASE2.1-STATUS.md", command = ".venv/bin/python scripts/phase2_1_audit.py --firmware-dtb .cache/device/elden-live.fdt --output-dir .cache/phase2.1-live", revision = "16e592abee8a550dec8154ed1f38b5ebc4f16213", result = "2026-10-25: the live FDT audit passed with C2400000+10000000. It is in live RAM and UEFI DXE conventional memory, avoids all live reserved-memory and the B74AC000-B7FFEE30 initrd, and reproduces the eight-CPU ADT. No XNU entry is claimed." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["drivers/**", "patches/xnu/**", "docs/PHASE2-HANDOFF.md"]
|
||||
inputs = ["SM8750 UFS host at 0x1d84000 and PHY at 0x1d80000.", "4 KiB logical-sector partition geometry and a root-volume UUID.", "Clock, regulator, power-domain and SMMU stream ownership."]
|
||||
configuration = ["The phase 1 defconfig disables Native UFS.", "The format 2 component list does not select a storage transport."]
|
||||
procedure = ["Inventory GPT and logical block size without modifying the device.", "Bring up UFS in read-only mode and validate known blocks.", "Add an SM8750 storage component and root-window input before mounting."]
|
||||
findings = ["UFSDxe crashed in phase 1 and was removed from the menu path.", "There is no elden XNU UFS probe result yet.", "The phase 1 FAT payload intentionally bypasses persistent storage."]
|
||||
completion = ["Controller and PHY initialize.", "Read-only capacity, GPT and known-block checks match the device.", "The configured OS volume mounts and launchd starts."]
|
||||
limits = ["Storage is not selected or implemented.", "No owner-authored userdata image or root UUID exists."]
|
||||
next_action = ["Capture a read-only GPT and memory-resource audit, then implement an SM8750 UFS component."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/porting-analysis.md", result = "Storage addresses, missing root inputs and phase 1 bypass decision; implementation remains a later phase." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["soc/sm8750/dts/**", "dts/**"]
|
||||
inputs = ["1904x3040 bonded dual-DSI panel with DSC.", "UEFI GOP framebuffer and splash reservation.", "SM8750 DPU/DSI/PHY and backlight sequencing."]
|
||||
configuration = ["The phase 1 menu renders through UEFI GOP.", "XNU display and IOMobileFramebuffer components remain disabled."]
|
||||
procedure = ["Keep display handoff on GOP for the first kernel milestone.", "Record a visible checkpoint after DarwinBoot.", "Add DPU/DSI only after kernel entry is stable."]
|
||||
findings = ["GOP display is device-verified in the UniXNU menu.", "No XNU display provider has been validated.", "The panel path remains a known high-risk cold-boot area."]
|
||||
completion = ["XNU paints a known pattern through a declared framebuffer handoff.", "Userland presentation and backlight transitions work."]
|
||||
limits = ["No DPU, DSI, DSC or panel node is present in the hardware DTS.", "GOP success is not counted as XNU display support."]
|
||||
next_action = ["Carry GOP framebuffer properties into DarwinBoot and record the first kernel-visible screen checkpoint."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/PHASE1-STATUS.md", result = "GOP menu display was observed on hardware." },
|
||||
{ kind = "source", reference = "docs/porting-analysis.md", result = "Display topology, panel risk and GOP-first strategy." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["docs/**"]
|
||||
inputs = ["Novatek SPI touch on SPI4 and GPIO 162 interrupt.", "Volume and power keys used by the UEFI menu."]
|
||||
configuration = ["The phase 1 menu accepts volume-key input through UEFI.", "No XNU HID or Novatek transport is selected."]
|
||||
procedure = ["Preserve UEFI key navigation as the bring-up input path.", "Inventory the touch firmware and protocol from read-only sources.", "Add QCOM GENI SPI, touch protocol and HID input after XNU boots."]
|
||||
findings = ["Volume-key menu input is device-verified.", "Touch has not been initialized by XNU.", "The panel and touch controller share board state that must be validated together."]
|
||||
completion = ["Touch coordinates map to the display.", "Contact IDs, releases and multi-touch remain stable.", "Buttons produce expected HID events in XNU."]
|
||||
limits = ["No touch component is selected.", "The NT36536 firmware and ABI inputs are not yet integrated."]
|
||||
next_action = ["Read the touch controller model and firmware version without modifying flash, then define the board transport."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/PHASE1-STATUS.md", result = "Volume-key navigation reached the accepted menu." },
|
||||
{ kind = "source", reference = "docs/porting-analysis.md", result = "Novatek SPI wiring and input bring-up requirements." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["docs/**"]
|
||||
inputs = ["Adreno 830 / gen80000.", "GPU firmware, power votes, SMMU and display integration."]
|
||||
configuration = ["GPU and Metal components are not selected.", "The first XNU milestone targets CPU/console progress only."]
|
||||
procedure = ["Reach the XNU platform expert without GPU dependencies.", "Collect the GPU identity and firmware hashes.", "Select and implement a GPU component only after a display provider exists."]
|
||||
findings = ["The board has no validated XNU GPU path.", "Selecting SM8550 Adreno740 would misrepresent the Adreno 830 implementation scope."]
|
||||
completion = ["GPU submissions, fences and mapping work.", "A known image renders and Metal presentation is visible."]
|
||||
limits = ["GPU and Metal are explicitly out of the first milestone."]
|
||||
next_action = ["Keep GPU unselected until an SM8750-compatible component and firmware inputs exist."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/porting-analysis.md", result = "Adreno 830 scope and exclusion from the first milestone." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "not-applicable"
|
||||
components = []
|
||||
paths = ["proprietary-files.txt"]
|
||||
inputs = ["Wi-Fi is outside the current bring-up milestone."]
|
||||
configuration = ["No Wi-Fi or MHI component is selected."]
|
||||
procedure = ["Revisit after the USB or PCIe transport and firmware ownership are established."]
|
||||
findings = ["There is no verified Wi-Fi source or firmware path for elden."]
|
||||
completion = ["Not required for this milestone."]
|
||||
limits = ["Wi-Fi, Bluetooth and cellular are not implemented or claimed."]
|
||||
next_action = ["Open a separate network bring-up task when the base kernel and root volume are stable."]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "not-applicable"
|
||||
components = []
|
||||
paths = ["proprietary-files.txt"]
|
||||
inputs = ["Audio is outside the current bring-up milestone."]
|
||||
configuration = ["No ADSP, GLink, codec or audio component is selected."]
|
||||
procedure = ["Revisit after platform, storage and display are stable."]
|
||||
findings = ["There is no elden audio log or firmware inventory."]
|
||||
completion = ["Not required for this milestone."]
|
||||
limits = ["Speakers, microphone and DSP routing are not implemented or claimed."]
|
||||
next_action = ["Open a separate audio bring-up task with DSP and codec inputs."]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["soc/sm8750/**", "package/**"]
|
||||
inputs = ["PM8550-class PMIC, RPMh resources and device power domains.", "Volume and power key behavior."]
|
||||
configuration = ["The first DTS selects only CPU and GIC resources.", "No platform power component is selected."]
|
||||
procedure = ["Keep suspend and CPU power management disabled during first XNU entry.", "Record regulator and clock ownership.", "Add platform power only after the boot CPU reaches a stable checkpoint."]
|
||||
findings = ["UEFI power and key handling are verified only at the firmware layer.", "The selected OS profile does not supply sleep-disabled, so board.toml now adds it under [adt.defaults.u32].", "The final Phase 2.1 ADT was decoded with sleep-disabled=1.", "The XNU power topology is not complete."]
|
||||
completion = ["Declared power controls match readings.", "Sleep/resume or shutdown transitions restore dependent peripherals."]
|
||||
limits = ["Battery, charging, thermal and sleep are not implemented."]
|
||||
next_action = ["Phase 2.5: use armcpu-diagnostics=1 to observe boot-CPU quiesce/halt behavior. Audit RPMh ownership and keep suspend/secondary CPU power management out of initial qualification."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "board.toml", result = "Board hardware and payload policy values." },
|
||||
{ kind = "host", reference = "docs/PHASE2.1-STATUS.md", command = ".venv/bin/python scripts/phase2_1_audit.py --linux-dir .cache/elden-linux", revision = "16e592abee8a550dec8154ed1f38b5ebc4f16213", result = "2026-10-25: independent ADT decode found /defaults sleep-disabled=1. This is source/host evidence, not a device suspend test." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "host-verified"
|
||||
components = []
|
||||
paths = ["scripts/**", "package/**", "patches/**", "out/build.json", "unixnu.lock"]
|
||||
inputs = ["iPad7,1 iPadOS 17.7.11 build 21H461 restore inputs.", "Target kernelcache, XNU 10063.141.1, DriverKit and TrustCache ABI inputs.", "Android v3 RAM-boot image, a 4 MiB phase 1 embedded FAT payload and a measured 56 MiB phase 2 candidate."]
|
||||
configuration = ["The phase 1 image is produced by the project build script and verified against recorded hashes.", "Format 2 output is out/elden/ipados-17.7.11-21H461/elden/.", "The 2.2 prelink output is kernel/kernel.macho and its ADT sidecar; no phase 2 boot image is generated."]
|
||||
procedure = ["Run scripts/build_phase1.py for the accepted firmware path.", "Fetch the target IPSW components and build the patched 4 KiB XNU.", "Prelink against the pinned kernelcache and audit Mach-O, ABI, symbols and ADT.", "Package an isolated near-final-size payload only in Phase 2.3."]
|
||||
findings = ["The documented Phase 1 build was device-verified and the current procedure rebuilds and passes structural checks.", "The same current recipe produced 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a instead of the historical accepted image hash; byte-for-byte rebuild identity is not claimed, but the new image completed two owner RAM cold boots.", "The verified UniXNU third-party pin is intentionally retained for the accepted build.", "Phase 2.2 produced a 21,206,040-byte native kernel and a 54,050,816-byte prelinked kernel. The 57-patch sequence selects 30 executable Apple components, 7 kernel interfaces and 30 module entrypoints.", "A 56 MiB FAT16 host volume held the 54,063,968-byte kernel/config/ADT set with 3,734,016 bytes free and a byte-identical kernel readback.", "The prelink report remains runtime_qualified=false, abi_qualified=false and loadable=false until device execution evidence exists."]
|
||||
completion = ["All format 2 build steps run from the resolved output directory.", "The payload contains the kernel, ADT and declared optional inputs.", "The boot image matches the ABL header and size limits."]
|
||||
limits = ["The format 2 payload and bootimg pipeline is not yet connected to a phase 2 firmware candidate.", "The current 4 MiB board payload belongs to phase 1; the phase 2 candidate is 56 MiB and its ABL/initrd/FDT/HOB channel is unverified.", "The 2.2 host build used Command Line Tools with an iPhone platform shim because full Xcode is absent; release rebuilding still requires the official Xcode/iPhoneOS SDK."]
|
||||
next_action = ["Phase 2.3: build a near-final-size FAT16 payload in an isolated output and verify Android v3 ramdisk, FDT/initrd and HOB delivery before executing the kernel. Keep all phase 2 outputs separate from the accepted phase 1 baseline."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/PHASE1-HANDOFF.md", result = "Reproducible phase 1 build commands, hashes and verification checklist." },
|
||||
{ kind = "source", reference = "docs/FORMAT2-MIGRATION.md", result = "Preserved build inputs and remaining format 2 handoff work." },
|
||||
{ kind = "source", reference = "docs/PHASE2-HANDOFF.md", result = "Phase 2 gates mapped to the official porting steps, capacity and memory constraints, and separate loader/kernel acceptance criteria; planning only, with no new device qualification." },
|
||||
{ kind = "source", reference = "docs/PHASE2.1-STATUS.md", result = "Source-derived FDT, firmware RAM and reservation audit, decoded ADT checks, boot CPU parameter policy and remaining runtime evidence." },
|
||||
{ kind = "source", reference = "docs/PHASE2.2-STATUS.md", result = "Pinned kernelcache, 57-patch XNU build, prelink inventory, symbol/4 KiB audits and measured 56 MiB payload fit." },
|
||||
{ kind = "host", reference = "docs/PHASE2-STATUS.md", command = "test -e .cache/phase2-plan/UniXNU/out/elden/ipados-17.7.11-21H461/elden/tree", revision = "dffc3020a85830d0d981a85871d9ab31aac5827d", result = "Phase 2.0 established a rebuilt phase 1 baseline, preserved prior candidates, verified format 2 output isolation, and did not generate a phase 2 boot image." },
|
||||
{ kind = "host", reference = "docs/PHASE2.2-STATUS.md", command = "PATH=.cache/phase2-plan/toolchain/bin:.venv/bin:$PATH .venv/bin/python .cache/phase2-plan/UniXNU/unixnu build kernel -D .", revision = "c91a2191fdf591a401a03027ed8b7fbfdbcad3a7", result = "2026-10-25: kernelcache f18b4df865405f2a287b84977d7aca745e056d656d9fc9df1662970ce2969de7 produced native kernel 02f216348851ba9ce70616430ff7607be9d3305cbc8b2ae1186f0e7d6b20fce7 and prelinked kernel.macho 65a3e799e1eb7f631a3b146dfc890ef5a8147c8fc613ee383a1665b398fb1ef9; runtime qualification remains false." },
|
||||
{ kind = "host", reference = "docs/PHASE2.2-STATUS.md", command = "mformat -C -F -T 114688 -v ELDENPH2 -i .cache/phase2.2/payload-fit-56m-20261025-223638.img :: && mcopy -i .cache/phase2.2/payload-fit-56m-20261025-223638.img -s .cache/phase2-plan/UniXNU/out/elden/ipados-17.7.11-21H461/elden/payload/stage/EFI ::/", revision = "c91a2191fdf591a401a03027ed8b7fbfdbcad3a7", result = "2026-10-25: a 58,720,256-byte FAT16 volume held all 54,063,968 payload bytes, left 3,734,016 bytes free, and round-tripped kernel.macho with SHA-256 65a3e799e1eb7f631a3b146dfc890ef5a8147c8fc613ee383a1665b398fb1ef9." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "device-verified"
|
||||
components = []
|
||||
paths = ["scripts/check-*", "scripts/verify_*", "scripts/phase2_1_audit.py", "docs/**", "out/build.json", "assets/**"]
|
||||
inputs = ["RAM-only owner-operated boot procedure.", "Build and artifact SHA-256 values.", "UEFI screen output and recovery path."]
|
||||
configuration = ["verify_artifact.py checks the FD, Android image and embedded FAT.", "build.json records artifact sizes and hashes.", "The phase 1 acceptance requires two consecutive cold boots."]
|
||||
procedure = ["Build and verify the image.", "Owner runs fastboot boot twice and records the visible result.", "Power off and confirm stock Android before further work."]
|
||||
findings = ["The original accepted image is b56ef4b7e5a71382b8c279c4ee1560764fabd126ba37ac0fd6e495c80b9ec6e1.", "Earlier UFSDxe failure images are identified and must not be reused.", "Phase 2 requires separate kernel and DarwinBoot evidence.", "On 2026-10-25 a fresh phase 1 rebuild produced image SHA-256 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a and FD SHA-256 e5420517d55f4b638c07617a252d3a65c95cfb731584dcb10dd1d98bae412580. The build and prior local candidate were read-only preserved under .cache/phase2.0, and the owner then completed two RAM cold boots of the new image.", "Phase 2.1 host auditing now checks the ADT independently and records FDT, ADT, UEFI memory and boot argument sources under .cache/phase2.1 without replacing phase 1 artifacts.", "Phase 2.2 audits passed for 1,010 target objects, 7,730 prelink XML tags, iOS 17.0 deployment, 4 KiB TCR and the expected ArmDTPlatform/ArmCpu symbols. These are host-only checks."]
|
||||
completion = ["Every claimed checkpoint has a reproducible command, image hash and visible result.", "Failures reach a diagnosable screen or log instead of a silent hang."]
|
||||
limits = ["There is no phase 2 XNU log or ADT handoff evidence yet.", "The generated hardware ADT input is a minimal host candidate. The separate firmware memory description contains the source-derived reservation map, but neither is a live device FDT.", "The historical accepted image bytes are absent from the workspace, so they cannot be booted or byte-compared locally."]
|
||||
next_action = ["Proceed with phase 2.3 using isolated outputs. Before any phase 2 device boot, rerun the Phase 2.1 audit against the owner-captured live firmware FDT. Record source, host and device evidence separately for every gate; loader validation, kernel entry, platform expert and boot CPU require distinct checkpoints and two final-image cold boots."]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "out/build.json", result = "Recorded phase 1 artifact sizes and SHA-256 values." },
|
||||
{ kind = "source", reference = "unixnu.lock", result = "The elden Linux reference now matches soc/sm8750/soc.toml at h0cheung/tb322fc-linux-kernel 6f97250ead155fc3b980856323e99a4623dae73d." },
|
||||
{ kind = "host", reference = "docs/PHASE2-STATUS.md", command = ".venv/bin/python scripts/build_phase1.py --skip-submodules --crypto-path $PWD/.cache/phase1/basecrypto", revision = "dffc3020a85830d0d981a85871d9ab31aac5827d", result = "2026-10-25: a fresh phase 1 rebuild completed in 6:46 and passed static Android v3, shim, FD, embedded FAT and module checks. Image SHA-256 was 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a and FD SHA-256 was e5420517d55f4b638c07617a252d3a65c95cfb731584dcb10dd1d98bae412580; no device boot was performed." },
|
||||
{ kind = "device", reference = "docs/PHASE2-STATUS.md", command = "fastboot boot out/elden-phase1.img", revision = "dffc3020a85830d0d981a85871d9ab31aac5827d", result = "2026-10-25: owner confirmed two RAM cold boots of image 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a; both reached the usable UniXNU menu and stock Android resumed after exit. This evidence covers phase 1 only." },
|
||||
{ kind = "host", reference = "docs/PHASE2-STATUS.md", command = ".cache/dtc-src/dtc -I dts -O dtb -i soc/sm8750/dts -o /tmp/elden-phase2.0.dtb dts/elden.dts", revision = "f99e3af0ecb67a9085478a9b8ddbcc25aa64931d", result = "2026-10-25: DTC 1.8.1-gf99e3af0 generated a 1,557-byte DTB with SHA-256 60316b6d4e753610610126d691f6d39ba54edd21e9b02875ec034e81e27a4371; round-trip inspection found the expected compatible strings, CPU MPIDRs, PSCI, GICv3, timer and DRAM data." },
|
||||
{ kind = "host", reference = "docs/PHASE2.1-STATUS.md", command = ".venv/bin/python scripts/phase2_1_audit.py --firmware-dtb .cache/device/elden-live.fdt --output-dir .cache/phase2.1-live", revision = "16e592abee8a550dec8154ed1f38b5ebc4f16213", result = "2026-10-25: live-FDT audit produced a 13,152-byte ADT. Independent checks passed for C2400000+10000000 RAM/reservation/initrd coverage, UEFI DXE conventional memory, framebuffer, eight MPIDRs, one running boot CPU, GIC, timer, CHRP NVRAM, optional placeholders and sleep-disabled=1. Report: .cache/phase2.1-live/audit.json." },
|
||||
{ kind = "host", reference = "docs/PHASE2.2-STATUS.md", command = "python3 scripts/audit-xnu-kernel.py build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf && python3 scripts/audit-xnu-objects.py && python3 scripts/check-prelink-xml.py ../kernel/kernel.macho", revision = "c91a2191fdf591a401a03027ed8b7fbfdbcad3a7", result = "2026-10-25: native kernel audited as arm64/iOS 17 with 4 KiB TG0 and TG1; 1,010 target objects passed; the pinned prelink XML lexer accepted 7,730 tags. No device checkpoint is claimed." },
|
||||
{ kind = "device", reference = "docs/PHASE1-STATUS.md", command = "fastboot boot out/elden-phase1.img", revision = "c591b1a0a471f24978aba25c56c8f6ec9bd06668", result = "Two cold boots reached DISPLAY OK, INPUT OK, config loaded and menu shown." },
|
||||
{ kind = "device", reference = "assets/phase1-menu-20261025.jpg", command = "fastboot boot out/elden-phase1.img", revision = "c591b1a0a471f24978aba25c56c8f6ec9bd06668", result = "Screen capture shows the rendered UniXNU menu on the tablet." },
|
||||
]
|
||||
@@ -0,0 +1,441 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "hero2lte"
|
||||
soc = "Exynos 8890"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Samsung Galaxy S7 Edge (SM-G935F) on Exynos 8890. Phase 1 is a Mu-Silicium UEFI firmware with display and keypad input. XNU requires GICv2 support in ArmCpu, native storage, display, input and power drivers, and verified EFS/CPEFS backups before any wipe."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "host-verified"
|
||||
components = []
|
||||
paths = ["board.toml", "feeds.toml", "configs/**", "dts/**", ".github/**", ".gitignore"]
|
||||
inputs = [
|
||||
"SM-G935F (hero2lte), Exynos 8890, bootloader G935FXXS6ESI4, framebuffer at 0xE2A00000.",
|
||||
"iPadOS 17.7.11 build 21H461 is the only OS profile in this UniXNU revision.",
|
||||
]
|
||||
configuration = [
|
||||
"board.soc = Exynos 8890; board.soc_source = exynos8890; board.os_profile = ipados-17.7.11-21H461; schema_version = 2.",
|
||||
"Firmware paths select the DokuroMitsukai/Mu-Silicium hero2lte package and the five Mu_Basecore patches that package requires.",
|
||||
]
|
||||
procedure = [
|
||||
"Run ./unixnu defconfig hero2lte_defconfig -D ../UniXNU-hero2lte from UniXNU.",
|
||||
"Run ./unixnu fetch -D ../UniXNU-hero2lte to resolve base sources and write unixnu.lock.",
|
||||
"Run ./unixnu status --json -D ../UniXNU-hero2lte and review profiles, components, source pins and patch order.",
|
||||
]
|
||||
findings = [
|
||||
"The ARM64, SoC, OS and device tables merge in that order. Ordinary arrays replace inherited arrays, so board.toml repeats the complete component, fragment and patch-series lists.",
|
||||
"The SM-G935F keeps TWRP on RECOVERY. No configuration step touches that partition.",
|
||||
]
|
||||
completion = [
|
||||
"All source pins resolve; every selected component has an area; status shows the intended profiles and patch order.",
|
||||
]
|
||||
limits = [
|
||||
"The published SoC feed is pinned in feeds.toml and unixnu.lock; fetch succeeds without a local source override.",
|
||||
"No hardware checkpoint exists for this board.",
|
||||
]
|
||||
next_action = [
|
||||
"Keep the published SoC revision synchronized between feeds.toml and unixnu.lock.",
|
||||
]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Board identity, component selection, firmware paths and boot image parameters"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "unixnu.lock"
|
||||
command = "./unixnu status --json -D ../UniXNU-hero2lte"
|
||||
revision = "e9fb02f99c4cc2e6c882b1c2b6443fd342bc85e0"
|
||||
result = "schema_version 2 resolved the arch, exynos8890, iPadOS and device profiles with the selected components and patch series"
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "host-verified"
|
||||
components = ["DarwinBoot"]
|
||||
paths = ["proprietary-files.txt"]
|
||||
inputs = [
|
||||
"Mu-Silicium hero2lte firmware, S-Boot framebuffer at 0xE2A00000 with size 0xE10000, UEFI FD base 0xC9000000 and size 0x200000.",
|
||||
"Firmware version G935FXXS6ESI4 and the five Mu_Basecore patches used by the package.",
|
||||
]
|
||||
configuration = [
|
||||
"firmware.config = hero2lte; DSC = Platforms/Samsung/hero2ltePkg/hero2lte.dsc; FD = Build/hero2ltePkg/{target}_CLANGPDB/FV/SILICIUM_UEFI.fd.",
|
||||
"The package list mirrors the working Mu-Silicium build and adds {tree}/package and {tree}/drivers/DarwinBoot for UniXNU.",
|
||||
]
|
||||
procedure = [
|
||||
"The standalone build runs ./build-hero2lte.sh -c at the workspace root; test_bootshim.py and test_hero2lte_keypad.py pass.",
|
||||
"The DSC and DXE.inc add UniXNU.inf, UniXNUDxe.inf, UniXNURamDiskDxe.inf, DarwinBoot.inf, DiskIoDxe, PartitionDxe, EnglishDxe and Fat behind UNIXNU_PAYLOAD=1.",
|
||||
"./unixnu build firmware --uefi ../Mu-Silicium --target RELEASE -D ../UniXNU-hero2lte applies the five base patches and builds the 2 MiB FD.",
|
||||
]
|
||||
findings = [
|
||||
"The standalone image is an Android v0 header at 0x10000000 with kernel at 0x10008000 and tags at 0x10000100; the kernel field is exactly BootShim plus the 2 MiB FD.",
|
||||
"The standalone image omits the stock DTBH table and SEANDROIDENFORCE footer. S-Boot acceptance is untested.",
|
||||
"The standalone build is bit-for-bit reproducible and the DECON trigger is preserved instead of writing the Exynos 8895 value 0x1281.",
|
||||
"With UNIXNU_PAYLOAD=1 the UniXNU firmware build links UniXNU, UniXNUDxe, UniXNURamDiskDxe and DarwinBoot. FVMAIN grows from 0x20a000 to 0x235000 inside the 2 MiB FD.",
|
||||
]
|
||||
completion = [
|
||||
"Firmware builds, enters UniXNU, publishes the framebuffer, keeps the payload FAT readable and preserves the reserved-memory ranges.",
|
||||
]
|
||||
limits = [
|
||||
"No hardware boot attempt yet.",
|
||||
"The integrated firmware has no payload or boot image yet.",
|
||||
]
|
||||
next_action = [
|
||||
"Boot the integrated firmware and verify the UniXNU menu and payload FAT.",
|
||||
]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "https://github.com/DokuroMitsukai/Mu-Silicium/commit/5790015a98714044d72d5037cea300b40f66a2e0"
|
||||
result = "hero2lte firmware package, keypad library, host tests and optional UniXNU payload integration"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "board.toml"
|
||||
command = "./unixnu build firmware --uefi ../Mu-Silicium --target RELEASE -D ../UniXNU-hero2lte"
|
||||
revision = "5790015a98714044d72d5037cea300b40f66a2e0"
|
||||
result = "2 MiB SILICIUM_UEFI.fd contains UniXNU, UniXNUDxe, UniXNURamDiskDxe and DarwinBoot; FVMAIN used 0x235000 and FVMAIN_COMPACT kept 0x194998 free"
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "planned"
|
||||
components = ["ArmCpu", "ArmDTPlatform", "SoftwareAES"]
|
||||
paths = ["dts/**"]
|
||||
inputs = [
|
||||
"Four Mongoose cores at MPIDR 0x0-0x3 and four Cortex-A53 cores at MPIDR 0x100-0x103 with a 26 MHz generic timer.",
|
||||
"GIC-400 at 0x11001000: distributor 0x11001000, CPU interface 0x11002000, GICH 0x11004000 and GICV 0x11006000; PPIs 13, 14, 11 and 10.",
|
||||
]
|
||||
configuration = [
|
||||
"exynos8890.dtsi declares all eight CPUs, PSCI 0.2 over SMC, GICv2 and the generic timer. hero2lte.dts enables only cpu0 for the first bring-up.",
|
||||
"ArmCpu and ArmDTPlatform come from the UniXNU catalog. SoftwareAES keeps the shared ARM64 component set complete.",
|
||||
]
|
||||
procedure = [
|
||||
"Compile the board DTS and inspect /cpus, /psci, /arm-io/intc and timebase-frequency in the generated ADT.",
|
||||
"Record per-CPU entry, timer interrupts and IPI delivery on hardware.",
|
||||
]
|
||||
findings = [
|
||||
"ArmCpu registers only the compatible string arm,gic-v3 and requires a 32-byte reg property with a distributor and redistributors. GIC-400 exposes four ranges, so mapGic rejects this tree.",
|
||||
"The stock timer node sets use-clocksource-only and Android uses MCT ticks for events. The architectural timer PPI is unvalidated.",
|
||||
"Cluster 0 is Mongoose and cluster 1 is Cortex-A53 on this SoC, the opposite of the usual big-little numbering.",
|
||||
]
|
||||
completion = [
|
||||
"Every enabled CPU reaches its entry checkpoint and timer and IPI handling works on each enabled CPU.",
|
||||
]
|
||||
limits = [
|
||||
"GICv2 MMIO support and the timer interrupt path are not implemented.",
|
||||
"Only one CPU is enabled.",
|
||||
]
|
||||
next_action = [
|
||||
"Add GICv2 distributor, CPU-interface and timer handling to ArmCpu before enabling secondary CPUs.",
|
||||
]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/hero2lte.dts"
|
||||
result = "Board CPU selection on top of the shared exynos8890.dtsi"
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["dts/**"]
|
||||
inputs = [
|
||||
"RAM ranges from the stock DTB: 0x80000000 with size 0x7e400000 and 0x880000000 with size 0x80000000.",
|
||||
"S-Boot framebuffer at 0xE2A00000 with size 0xE10000; the DT video_frame and video_scaler regions also reserve display buffers.",
|
||||
]
|
||||
configuration = [
|
||||
"hero2lte.dts declares the low 0x7e400000 range as the XNU memory node and the framebuffer as reserved-memory.",
|
||||
"The upper 2 GiB range is not described yet because the common ADT generator currently expects one contiguous memory node.",
|
||||
]
|
||||
procedure = [
|
||||
"Compile the DTS and compare the generated ADT memory range with the stock DTB.",
|
||||
"Verify that DarwinBoot's owned window excludes the framebuffer and the DT video pools.",
|
||||
]
|
||||
findings = [
|
||||
"The provisional Mu-Silicium MemoryMapLib overlaps the DT video_frame and video_scaler pools; safety is unproven.",
|
||||
"The framebuffer lies inside the low RAM range, so the PMAP must reserve it before XNU maps RAM.",
|
||||
]
|
||||
completion = [
|
||||
"Every handoff and reserved range is accounted for and DMA masters use only their allocated windows.",
|
||||
]
|
||||
limits = [
|
||||
"Upper 2 GiB RAM is unused.",
|
||||
"Reserved-memory conversion and framebuffer exclusion are unverified.",
|
||||
]
|
||||
next_action = [
|
||||
"Decide how the ADT generator represents the second RAM range and the display reservations.",
|
||||
]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/hero2lte.dts"
|
||||
result = "Memory range and framebuffer reservation"
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/**", "dts/**"]
|
||||
inputs = [
|
||||
"UFS controller at 0x155A0000. The GPT uses 4096-byte logical sectors.",
|
||||
"USERDATA is partition 18, first LBA 2085544, last LBA 7806207.",
|
||||
]
|
||||
configuration = [
|
||||
"The SoC DTSI describes the UFS controller and leaves it disabled.",
|
||||
"userdata geometry is deliberately absent from board.toml until the EFS and CPEFS backups are verified.",
|
||||
]
|
||||
procedure = [
|
||||
"Capture EFS and CPEFS from TWRP with device-dump/capture-critical.py and verify both SHA-256 digests.",
|
||||
"Select or implement an Exynos UFS host driver before enabling the node.",
|
||||
]
|
||||
findings = [
|
||||
"ShengUfs targets Qualcomm UFS and cannot be reused directly.",
|
||||
"KernelSU is installed but adb shell has no root, so the critical backup needs TWRP or a root grant.",
|
||||
]
|
||||
completion = [
|
||||
"Host facts match the board; reads return the expected GPT; the configured root volume mounts and launchd starts.",
|
||||
]
|
||||
limits = [
|
||||
"No storage driver and no verified EFS/CPEFS backup.",
|
||||
"No wipe or repartition is allowed in this state.",
|
||||
]
|
||||
next_action = [
|
||||
"Obtain the EFS/CPEFS backup, then select or implement the UFS host driver.",
|
||||
]
|
||||
evidence = []
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/**", "dts/**"]
|
||||
inputs = [
|
||||
"s6e3hf4 SVC_OCTA panel at 1440x2560, 32 bpp, handed over at 0xE2A00000 by S-Boot.",
|
||||
"The stock DT reserves video_frame and video_scaler pools for the display pipeline.",
|
||||
]
|
||||
configuration = [
|
||||
"Mu-Silicium SimpleFbDxe publishes a GOP from the S-Boot framebuffer address. No native display driver is selected yet.",
|
||||
]
|
||||
procedure = [
|
||||
"Build the Phase 1 firmware and capture the menu on the panel.",
|
||||
"Record geometry, colors and backlight behavior before adding a native driver.",
|
||||
]
|
||||
findings = [
|
||||
"The standalone firmware builds, but the display path has no hardware checkpoint.",
|
||||
"DECON's trigger register is logged and left untouched because the Exynos 8895 value is not evidence for 8890.",
|
||||
]
|
||||
completion = [
|
||||
"A known frame appears with correct geometry and colors, then userland presentation and backlight controls work.",
|
||||
]
|
||||
limits = [
|
||||
"No display hardware checkpoint.",
|
||||
"No brightness or native scanout driver.",
|
||||
]
|
||||
next_action = [
|
||||
"Boot the Phase 1 firmware and record the display result.",
|
||||
]
|
||||
evidence = []
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/**", "dts/**"]
|
||||
inputs = [
|
||||
"gpio_keys from the stock DTB: volume up GPA0-3, volume down GPA0-4, home GPA0-5, power GPA2-4, all active low.",
|
||||
"The keypad banks are at 0x10580000 with DAT at offset 0x04.",
|
||||
]
|
||||
configuration = [
|
||||
"Mu-Silicium KeypadDeviceLib polls the GPA0 and GPA2 data registers, applies a 20 ms debounce and maps press-only events to the menu.",
|
||||
"The SoC DTSI does not export a pinctrl node because XNU has no Samsung pinctrl driver.",
|
||||
]
|
||||
procedure = [
|
||||
"Run Resources/Scripts/test_hero2lte_keypad.py in the firmware checkout.",
|
||||
"Hold Volume Up at reset and record the menu response on hardware.",
|
||||
]
|
||||
findings = [
|
||||
"The keypad host test passes. Device input is untested.",
|
||||
"Touch needs a separate component and has no driver yet.",
|
||||
]
|
||||
completion = [
|
||||
"Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports.",
|
||||
]
|
||||
limits = [
|
||||
"Only keypad logic exists; touch and XNU gpio-keys integration are pending.",
|
||||
]
|
||||
next_action = [
|
||||
"Validate keypad input in the Phase 1 firmware menu.",
|
||||
]
|
||||
evidence = []
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/**"]
|
||||
inputs = [
|
||||
"The stock DT exposes G3D power and DVS nodes but no Mali node.",
|
||||
"The GPU model, power sequence and SMMU inputs still need to be recorded from the vendor kernel.",
|
||||
]
|
||||
configuration = [
|
||||
"No GPU component is selected. The Adreno components target Qualcomm hardware and do not apply.",
|
||||
]
|
||||
procedure = [
|
||||
"Inventory the GPU from the vendor kernel and board files before selecting a component.",
|
||||
"Record power-domain and SMMU requirements in this area.",
|
||||
]
|
||||
findings = [
|
||||
"No UniXNU component currently supports the Exynos 8890 GPU.",
|
||||
]
|
||||
completion = [
|
||||
"GPU submissions complete, mapping and fence handling are correct, a known image renders, and the selected Metal client presents it.",
|
||||
]
|
||||
limits = [
|
||||
"No GPU inventory, driver or hardware result.",
|
||||
]
|
||||
next_action = [
|
||||
"Identify the GPU and its power and SMMU inputs from the vendor kernel.",
|
||||
]
|
||||
evidence = []
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/**"]
|
||||
inputs = [
|
||||
"The stock boot DT has no wireless controller node; the chip must be identified from the vendor kernel and board files.",
|
||||
]
|
||||
configuration = [
|
||||
"No network component is selected.",
|
||||
]
|
||||
procedure = [
|
||||
"Inventory the wireless chip, firmware files and bus before selecting a driver.",
|
||||
"Add firmware paths and hashes to proprietary-files.txt.",
|
||||
]
|
||||
findings = [
|
||||
"Wi-Fi firmware and driver inputs are not collected yet.",
|
||||
]
|
||||
completion = [
|
||||
"Scanning, association, address configuration and sustained receive and transmit traffic pass with the selected firmware.",
|
||||
]
|
||||
limits = [
|
||||
"No wireless inventory or driver.",
|
||||
]
|
||||
next_action = [
|
||||
"Identify the wireless chip and its firmware from the vendor kernel.",
|
||||
]
|
||||
evidence = []
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/**"]
|
||||
inputs = [
|
||||
"The stock boot DT describes no audio route; the codec and DSP inputs still need to be recorded.",
|
||||
]
|
||||
configuration = [
|
||||
"No audio component is selected.",
|
||||
]
|
||||
procedure = [
|
||||
"Inventory the codec, DSP and amplifier wiring before selecting a component.",
|
||||
]
|
||||
findings = [
|
||||
"Audio hardware and firmware inputs are not collected yet.",
|
||||
]
|
||||
completion = [
|
||||
"Each declared route carries the selected audio format through playback or capture and handles start and stop correctly.",
|
||||
]
|
||||
limits = [
|
||||
"No audio inventory or driver.",
|
||||
]
|
||||
next_action = [
|
||||
"Identify the audio hardware from the vendor kernel and schematics.",
|
||||
]
|
||||
evidence = []
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/**", "dts/**"]
|
||||
inputs = [
|
||||
"The stock DT names max77854 PMIC and MUIC, s2mpb02 sub-PMIC, max77838 and p9220 wireless charger.",
|
||||
"Battery and charger policy are not yet inventoried.",
|
||||
]
|
||||
configuration = [
|
||||
"No power component is selected and no regulator or charger driver runs.",
|
||||
]
|
||||
procedure = [
|
||||
"Inventory regulators, charger and battery reporting from the vendor kernel.",
|
||||
"Record sleep and resume dependencies before claiming a power transition.",
|
||||
]
|
||||
findings = [
|
||||
"The firmware leaves power management to S-Boot and UEFI defaults.",
|
||||
]
|
||||
completion = [
|
||||
"Declared power controls and battery readings match observations; each claimed sleep or resume transition restores dependent peripherals.",
|
||||
]
|
||||
limits = [
|
||||
"No battery, charger or power-domain driver.",
|
||||
]
|
||||
next_action = [
|
||||
"Inventory the PMIC and charger topology from the vendor kernel.",
|
||||
]
|
||||
evidence = []
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "planned"
|
||||
components = ["XnuPrelink"]
|
||||
paths = ["patches/**", "configs/**", "unixnu.lock"]
|
||||
inputs = [
|
||||
"XNU 10063.141.1 and Darwin 23.6.0 from the iPadOS profile.",
|
||||
"Android v0 boot image: base 0x10000000, kernel 0x10008000, tags 0x10000100, page size 2048.",
|
||||
]
|
||||
configuration = [
|
||||
"patch_series covers the arch, SoC, OS and device series in that order.",
|
||||
"kernel.defconfig = hero2lte_defconfig.",
|
||||
]
|
||||
procedure = [
|
||||
"Run ./unixnu build kernel, ./unixnu build package and ./unixnu build payload once the kernel inputs exist.",
|
||||
"Pack the image with ./unixnu bootimg and inspect boot.json before flashing.",
|
||||
]
|
||||
findings = [
|
||||
"The standalone Mu-Silicium boot image already uses the v0 layout and passes the BootShim host tests.",
|
||||
"No XNU kernel, payload or UniXNU boot image has been built for this board.",
|
||||
]
|
||||
completion = [
|
||||
"Kernel and prelink succeed, the payload contains all declared inputs, and the boot image matches the bootloader format and size limit.",
|
||||
]
|
||||
limits = [
|
||||
"No kernelcache, trust cache or data ramdisk is available.",
|
||||
]
|
||||
next_action = [
|
||||
"Build the kernel after ArmCpu GICv2 support and the first hardware checkpoint.",
|
||||
]
|
||||
evidence = []
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = [".github/**", "unixnu.lock"]
|
||||
inputs = [
|
||||
"Porting record CI, UniXNU status output and firmware or kernel logs.",
|
||||
]
|
||||
configuration = [
|
||||
"The record workflow from the template is kept. unixnu.lock pins the resolved sources.",
|
||||
]
|
||||
procedure = [
|
||||
"Run python3 scripts/porting-record.py check --device ../UniXNU-hero2lte after each record change.",
|
||||
"Capture the firmware log before kernel handoff once the log exporter is integrated.",
|
||||
]
|
||||
findings = [
|
||||
"Host build logs exist locally; no firmware or kernel log has been captured from the device.",
|
||||
]
|
||||
completion = [
|
||||
"Each claimed milestone has a reproducible command, a matching revision and an accessible result.",
|
||||
]
|
||||
limits = [
|
||||
"No QR log exporter or persistent capture in the firmware yet.",
|
||||
]
|
||||
next_action = [
|
||||
"Add the firmware log exporter before the first hardware boot.",
|
||||
]
|
||||
evidence = []
|
||||
@@ -0,0 +1,256 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "ishtar"
|
||||
soc = "SM8550"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Xiaomi 13 Ultra (ishtar) reuses shared SM8550 support and the sheng kit, and owns its board tree, partition geometry, firmware package and payload policy. This record states what is implemented, what is only configured, and what has not been observed on hardware."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["board.toml", "feeds.toml", "configs/**", "dts/**", "patches/**", ".github/**"]
|
||||
inputs = ["SM8550 shared source pinned in feeds.toml at 23b2049fcd9e30356161def84231334fb55ecca9.", "iPadOS 17.7.11 build 21H461 OS profile.", "Board identity xiaomi,ishtar and the sheng kit reused unchanged."]
|
||||
configuration = ["board.schema_version = 2; board.name = ishtar; board.soc = SM8550; board.kit = sheng; board.os_profile = ipados-17.7.11-21H461.", "kernel.defconfig = sheng_defconfig; config_fragments apply arch, soc then os, and the device defconfig applies last.", "kernel.patch_series is arch, soc, os then device, so a board patch cannot be shadowed by a shared one."]
|
||||
procedure = ["Run ./unixnu defconfig sheng_defconfig -D ../UniXNU-ishtar from UniXNU.", "Run ./unixnu status --json -D ../UniXNU-ishtar and confirm profiles resolve in ARM64, SoC, OS, device order.", "Run ./unixnu tree -D ../UniXNU-ishtar and confirm kits/sheng is selected and the device package lands in tree/package."]
|
||||
findings = ["The board reuses kit sheng because the package scripts, ADT generator and archive plan are shared with the SM8550 reference board; only board.toml values and the device tree differ.", "Arrays replace inherited selections rather than extending them, so kernel.archives lists every archive the link needs even though most entries come from sheng.", "Three defconfigs exist for different purposes: sheng_defconfig carries the board build, gpu_defconfig enables CONFIG_XNU_BOOT_PROGRESS, bringup_defconfig disables every optional component for early entry debugging."]
|
||||
completion = ["All source pins resolve, status reports the intended overrides, and tree/ contains the device package plus the shared scripts."]
|
||||
limits = ["The board does not yet carry its own kit; it inherits sheng's. A divergent board package would need kits/ishtar and a board.kit change.", "gpu_defconfig currently leaves CONFIG_XNU_NATIVE_UFS, CONFIG_XNU_NATIVE_LEGACY_DISPLAY and CONFIG_XNU_NATIVE_MOBILE_DISPLAY disabled."]
|
||||
next_action = ["Split the board-specific package code out of kit sheng once the bring-up stabilises, so the ishtar tree stops depending on sheng's file layout."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Board identity, partition geometry, archive order, firmware package, payload policy and ADT overrides"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "feeds.toml"
|
||||
result = "SM8550 shared source pinned to a full commit"
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["board.toml", "proprietary-files.txt", "scripts/extract-files.py", "scripts/build-uefi-sheng.sh"]
|
||||
inputs = ["ishtarPkg under uefi-sheng Platforms/Xiaomi, built from the sheng firmware tree.", "Stock ishtar firmware DTB for the boot-image step.", "Vendor firmware inventory in proprietary-files.txt, fetched from the recorded upstream commit."]
|
||||
configuration = ["firmware.config = ishtar; firmware.dsc = Platforms/Xiaomi/ishtarPkg/ishtar.dsc; firmware.fd = Build/ishtarPkg/{target}_CLANGPDB/FV/SILICIUM_UEFI.fd.", "firmware.defines sets DEVICE_MODEL = ishtar, ENABLE_SECUREBOOT = 1, MEMORY_PROTECTION = TRUE and SHIP_MODE = FALSE.", "firmware.patches applies Resources/MuPatches/Gic-Spurious.patch, shared with the SM8550 reference board."]
|
||||
procedure = ["Run ./unixnu firmware -D ../UniXNU-ishtar --uefi ../uefi-sheng.", "Record the firmware commit, the produced FD path and the handoff memory map before any boot attempt.", "Build the payload, then assemble the boot image with the firmware DTB and inspect boot.json for ramdisk_bytes and dtb_appended."]
|
||||
findings = ["The firmware package name and the device model are both ishtar, so the DSC, the FD path and the ADT product string must agree or the image builds under the wrong identity.", "The firmware DTB is an input to boot-image assembly only; XNU consumes the separately generated ADT, which is why device-tree and ADT values are maintained in different places.", "proprietary-files.txt fetches from a recorded upstream commit so the firmware inventory is reproducible without a local vendor dump."]
|
||||
completion = ["The firmware FD builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations."]
|
||||
limits = ["The firmware tree is uefi-sheng, not a dedicated uefi-ishtar repository; ishtarPkg lives inside it.", "No firmware revision or handoff memory map has been recorded from a device boot yet."]
|
||||
next_action = ["Capture the firmware revision, the FD size and the handoff memory map on the first successful device boot."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "proprietary-files.txt"
|
||||
result = "Firmware inventory with upstream commit and per-file SHA-256 digests"
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "implemented"
|
||||
components = ["ArmCpu", "ArmDTPlatform"]
|
||||
paths = ["patches/xnu/**", "dts/ishtar.dts", "configs/**"]
|
||||
inputs = ["SM8550 CPU affinities, GIC distributor and redistributor ranges and the 19.2 MHz timer, all from the shared SoC source.", "Board CPU selection and enablement in dts/ishtar.dts."]
|
||||
configuration = ["CONFIG_XNU_ARMCPU=y and CONFIG_XNU_ARM_DT_PLATFORM=y in the board defconfig.", "kernel_args select sheng-smp=1 and armcpu-spi-ipi=1, matching the shared platform's inter-processor interrupt path.", "dts/ishtar.dts includes sm8550.dtsi and overrides only board-level nodes."]
|
||||
procedure = ["Compile the board DTS with the shared SoC include path and inspect the enabled CPUs, GIC ranges and timer properties in the generated ADT.", "Record per-CPU entry, timer interrupts and inter-processor interrupt delivery."]
|
||||
findings = ["CPU affinity values are hardware identifiers read from the firmware, not logical indices; the enabled CPU count and the MPIDR affinities have to be checked together or secondary cores enter at the wrong offset.", "cpu_init() reaches the architecture switch through cpuid_info(), which returns the single global cpuid_cpu_info that do_cpuid() fills once on the boot CPU and stamps with CPU_ARCH_ARMv8, so a secondary CPU already sees a known architecture and never enters the panic arm; the board patch that called do_cpuid() per CPU was removed as redundant and as a write into a section that is read-only after the late lockdown.", "GIC register ranges must be translated physical addresses from the hardware tree; the raw SoC addresses are not valid once the firmware remaps them."]
|
||||
completion = ["Every enabled CPU reaches its entry checkpoint and timer and inter-processor interrupt handling works on each enabled CPU."]
|
||||
limits = ["CPU entry has not been observed on ishtar hardware; this area is implemented and host-verified only by the board DTS compiling.", "CPU frequency policy is inherited from the sheng kit and has not been retuned for ishtar thermal limits."]
|
||||
next_action = ["Record per-CPU entry and the secondary-core MPIDR values on the first device boot."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/ishtar.dts"
|
||||
result = "Board device tree including the shared SM8550 description"
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["dts/ishtar.dts", "board.toml"]
|
||||
inputs = ["8 GiB declared DRAM at 0x80000000.", "Splash framebuffer reserved region at 0xb8000000, size 0x2b00000.", "Payload DRAM size and owned memory size recorded in board.toml."]
|
||||
configuration = ["dts/ishtar.dts declares memory@80000000 with reg = <0 0x80000000 0x2 0x0>, which needs two size cells because a single 0x200000000 literal is truncated by dtc.", "reserved-memory/splash_region is labelled cont_splash_region and marked no-map so the kernel never allocates over the firmware's framebuffer.", "payload.dram_size = 0x200000000; payload.adt.owned_memory_size = 0x130000000."]
|
||||
procedure = ["Compile the board DTS and confirm the memory node size is 0x200000000 rather than a truncated value.", "Inspect the generated ADT for the owned memory size and the reserved region list before assembling the payload."]
|
||||
findings = ["Declaring less DRAM than the phone physically has is deliberate: the physmap and the page-table allocator will otherwise reach addresses no DRAM backs. The SM8550 reference boards declare less than the fitted DRAM for the same reason.", "The reserved splash region must stay no-map. Mapping it as normal memory lets the page-table allocator hand out the framebuffer and the firmware's splash output disappears.", "The size cell count is the single easiest value to get silently wrong; dtc truncates a 64-bit literal in a one-cell property without failing."]
|
||||
completion = ["The ADT reports the intended DRAM and owned memory sizes and the reserved splash region appears in the handoff list."]
|
||||
limits = ["Memory has not been validated on hardware; the declared size follows the reference board policy rather than a measurement of this unit.", "SMMU and DMA address-translation ownership is not configured for this board."]
|
||||
next_action = ["Compare the ADT memory description against the firmware's memory map on the first device boot."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/ishtar.dts"
|
||||
result = "Declared DRAM size and the reserved splash framebuffer region"
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "planned"
|
||||
components = ["ShengUfs", "VirtioMmioBlock", "VerifiedRoot"]
|
||||
paths = ["drivers/ShengUfs/**", "board.toml", "configs/**"]
|
||||
inputs = ["SM8550 UFS host controller and PHY resources from the shared SoC source.", "Board UFS and UFS PHY enablement in dts/ishtar.dts, both currently status = okay.", "Userdata partition geometry in board.toml."]
|
||||
configuration = ["CONFIG_XNU_NATIVE_UFS=n and CONFIG_XNU_NATIVE_VIRTIO_BLOCK=n in gpu_defconfig, so the storage path is selected as a component but not compiled into the kernel.", "board.userdata records first_lba = 3094592, last_lba = 64007162 and lba_bytes = 4096, with OS and SystemOS windows.", "dts/ishtar.dts sets ufs and ufsphy status = okay so the nodes are present in the hardware tree."]
|
||||
procedure = ["Read the UFS controller base address and the PHY register window from the vendor firmware DTB before writing board values.", "Build with CONFIG_XNU_NATIVE_UFS=y once the controller resources are confirmed, and record the boot attempt.", "Confirm the userdata geometry against the stock GPT before mounting anything."]
|
||||
findings = ["The UFS nodes are enabled in the device tree while the driver is compiled out, which is intentional: it keeps the hardware description complete so enabling the driver is a configuration change rather than a device-tree change.", "The partition geometry was taken from the stock GPT; first_lba and last_lba are absolute LBAs, so they are only valid for a device that has not been repartitioned.", "ShengUfs depends on VirtioMmioBlock and VerifiedRoot, so both appear in the component closure even though neither is compiled in yet."]
|
||||
completion = ["The kernel probes the UFS controller, reads the GPT and mounts the root volume."]
|
||||
limits = ["No controller address has been confirmed for ishtar; the value is expected to match the SM8550 reference board but that has not been checked against this unit's firmware.", "The root volume and the persistent Data volume are both unconfigured.", "No storage evidence of any kind exists for this board yet."]
|
||||
next_action = ["Read the UFS controller base and PHY window out of the stock ishtar firmware DTB and record them before enabling CONFIG_XNU_NATIVE_UFS."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Userdata partition geometry and the selected storage components"
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["dts/ishtar.dts", "board.toml", "package/BootProgressMin.c"]
|
||||
inputs = ["Panel resolution 1440x3200 with a 5760-byte stride, from the firmware framebuffer.", "Splash framebuffer physical base 0xb8000000 and size 0x2b00000."]
|
||||
configuration = ["payload.panic_framebuffer = { base = 0xb8000000, width = 1440, height = 3200, stride = 5760 } lets the panic path and the boot-progress renderer write pixels without a display driver.", "CONFIG_XNU_NATIVE_LEGACY_DISPLAY=n and CONFIG_XNU_NATIVE_MOBILE_DISPLAY=n, so no display driver is compiled in.", "kernel_args carry offline-legacy-gop=1 and offline-legacy-unit-scale=2 for the inherited legacy display path."]
|
||||
procedure = ["Record the framebuffer base, stride and format from the firmware before changing any display value.", "Confirm the panic framebuffer writes appear at the expected offset, since a wrong stride shifts every row.", "Enable CONFIG_XNU_NATIVE_MOBILE_DISPLAY only after the panel controller resources are confirmed."]
|
||||
findings = ["The only display output that works without a driver is the direct framebuffer path: panic screen and boot progress both write through the physical base, which is why they survive a hang before any display driver exists.", "Stride is not width times bytes per pixel. The panel reports 5760 bytes for 1440 pixels, so the renderer must use the reported stride or every row lands at the wrong address.", "The framebuffer is a reserved no-map region, so it is reachable only through the physical aperture once arm_vm_init has run."]
|
||||
completion = ["The panel shows kernel output through a real display driver rather than a direct framebuffer write."]
|
||||
limits = ["No display driver is compiled in; only the direct framebuffer path is available.", "Panel timing, backlight and the display controller have not been configured for this board.", "The framebuffer has not been observed on ishtar hardware."]
|
||||
next_action = ["Confirm the firmware framebuffer base and stride on the device, then enable CONFIG_XNU_NATIVE_MOBILE_DISPLAY with the panel resources filled in."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Panic framebuffer geometry used by the direct framebuffer path"
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["drivers/ShengHidInput/**", "drivers/ShengNovatekTouch/**", "proprietary-files.txt"]
|
||||
inputs = ["Novatek NT36532 touch controller firmware, recorded in proprietary-files.txt with its SHA-256 digest.", "Touch bus, GPIO and interrupt assignment, not yet read from the vendor firmware."]
|
||||
configuration = ["ShengHidInput and ShengNovatekTouch exist in the tree but are not listed in board.components.include, so neither is built.", "proprietary-files.txt carries the Novatek firmware blob so the touch driver has its firmware input available once selected."]
|
||||
procedure = ["Read the touch controller's bus, reset GPIO and interrupt line from the vendor firmware DTB.", "Add ShengHidInput and ShengNovatekTouch to board.components.include and rebuild.", "Record the first touch report and the coordinate mapping."]
|
||||
findings = ["The touch firmware blob is already pinned even though the driver is not selected, so enabling input does not require a new vendor dump.", "ShengNovatekTouch depends on QcomGeniSpi for the SPI transport, so enabling touch pulls in the GENI SPI component as well."]
|
||||
completion = ["Touch reports reach the HID stack with correct coordinates and the home gesture is recognised."]
|
||||
limits = ["No input component is selected for this board.", "Bus, GPIO and interrupt values are unconfirmed.", "No input evidence exists for this board."]
|
||||
next_action = ["Read the Novatek controller's bus and interrupt assignment from the vendor firmware DTB."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "proprietary-files.txt"
|
||||
result = "Novatek touch firmware pinned with its SHA-256 digest"
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "planned"
|
||||
components = ["Adreno740", "Sm8550Platform", "AdrenoPM4", "AdrenoFirmware", "ArmSmmu4K"]
|
||||
paths = ["drivers/**", "package/*Adreno*", "package/ArmSmmu4KProbe.c", "scripts/build-adreno-link-stubs.py", "configs/**"]
|
||||
inputs = ["Adreno 740 GPU and GMU resources from the shared SM8550 source.", "GPU firmware and PM4 microcode, audited by the probe builders in package/.", "GPU SMMU and GMU enablement in dts/ishtar.dts, all three currently status = okay."]
|
||||
configuration = ["CONFIG_XNU_NATIVE_ADRENO=y, but CONFIG_XNU_EXTRA_LD_ARCHIVES points at build/adreno-link-stubs/libAdrenoLinkStubs.a, so the kernel links against stubs rather than the full driver.", "kernel_args carry sheng-gpu-power=9, sheng-gpu-metal=1 and sheng-gpu-perf=8, inherited from the shared platform.", "dts/ishtar.dts enables gpu, gmu and gpu_smmu."]
|
||||
procedure = ["Run scripts/build-adreno-link-stubs.py to produce the stub archive the kernel link expects.", "Run the Adreno probe builders and compare the reported GPU identity against the expected Adreno 740 values.", "Record the first GPU command submission once the real driver replaces the stubs."]
|
||||
findings = ["The kernel links with Adreno link stubs on purpose: the full Adreno driver needs the AdrenoMetal accelerator ABI, which is a payload-stage component and has no kernel link variable. Selecting the component while linking stubs keeps the archive plan valid.", "GPU firmware and PM4 microcode are inputs, not build products; the probe builders audit the recorded candidates rather than regenerating them.", "Adreno740 pulls in Sm8550Platform, AdrenoPM4, AdrenoFirmware and ArmSmmu4K, which is why five components belong to this area."]
|
||||
completion = ["The GPU reports its identity, accepts a command submission and presents a frame through the Metal frontend."]
|
||||
limits = ["Only link stubs are compiled; no GPU command has been submitted on this board.", "The GPU and GMU have not been powered on outside the firmware.", "No GPU evidence exists for this board."]
|
||||
next_action = ["Run the Adreno probe builders against the ishtar firmware and record the reported GPU identity."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/build-adreno-link-stubs.py"
|
||||
result = "Builds the stub archive the kernel link uses while the full driver is unavailable"
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["drivers/Ath12kWifi/**"]
|
||||
inputs = ["Ath12k Wi-Fi hardware resources, not yet mapped for this board.", "Board Wi-Fi firmware and calibration data, not yet collected."]
|
||||
configuration = ["drivers/Ath12kWifi exists in the tree but is not listed in board.components.include, so it is not built.", "No network kernel arguments are set in board.toml."]
|
||||
procedure = ["Map the Wi-Fi PCIe or AHB window and the interrupt line from the vendor firmware.", "Collect the board calibration data and firmware before selecting the component.", "Add the component to board.components.include and record the first association attempt."]
|
||||
findings = ["The driver directory is present because the tree is derived from sheng, which does select it; ishtar does not, so the directory is currently unused by this board.", "Wi-Fi on this platform needs per-board calibration data that cannot be reused from a different board even on the same SoC."]
|
||||
completion = ["The interface associates and carries packets through the OS network stack."]
|
||||
limits = ["No network component is selected for this board.", "Calibration data has not been collected.", "No network evidence exists for this board."]
|
||||
next_action = ["Determine whether the Wi-Fi window is PCIe or AHB on this board before selecting the driver."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Component selection showing that no network component is included"
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/AudioProbe.cpp", "package/AdspFirmware.c", "package/AdspProbe.cpp"]
|
||||
inputs = ["ADSP firmware and the codec topology, neither collected for this board.", "Board audio routing, not yet documented."]
|
||||
configuration = ["No audio component is selected in board.components.include.", "The ADSP probe builders exist in package/ but are not part of the ishtar archive plan."]
|
||||
procedure = ["Collect the ADSP firmware image and record its hash.", "Map the codec and the amplifier enable GPIOs from the vendor firmware.", "Select the audio components and record playback and capture separately."]
|
||||
findings = ["ADSP firmware is a per-board input; the probe builders audit a recorded candidate rather than synthesising one.", "The audio path on this platform spans ADSP, codec and amplifier, so it cannot be enabled by a single component selection."]
|
||||
completion = ["Playback and capture both work through the OS audio stack."]
|
||||
limits = ["No audio component is selected.", "No firmware or routing data has been collected.", "No audio evidence exists for this board."]
|
||||
next_action = ["Collect the ADSP firmware image and record its hash before attempting audio bring-up."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Component selection showing that no audio component is included"
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["board.toml", "configs/**", "package/BatteryProbe.cpp"]
|
||||
inputs = ["Regulator and clock ownership from the shared SM8550 source.", "Battery fuel gauge configuration, not yet confirmed for this board."]
|
||||
configuration = ["CONFIG_XNU_SHENG_PMGR=y, inherited from the shared platform, but the power manager has not been exercised on this board.", "kernel_args carry sheng-cpufreq=3 and sheng-disable-watchdogd=1.", "payload.adt.defaults.u32 sets sleep-disabled = 1 so the device does not suspend during bring-up."]
|
||||
procedure = ["Record the regulator and clock state the firmware leaves behind before claiming ownership.", "Confirm the fuel gauge reports a plausible charge level before enabling battery reporting.", "Remove sleep-disabled = 1 only after suspend and resume are understood."]
|
||||
findings = ["sleep-disabled = 1 is a bring-up setting, not a shipping one; leaving it set hides suspend bugs rather than fixing them.", "The power manager is compiled in through the shared platform but has no board-specific regulator or clock table for ishtar yet.", "CPU frequency policy is inherited from the shared platform and has not been retuned for this board's thermal envelope."]
|
||||
completion = ["Regulators and clocks are owned by the OS, the battery reports a plausible charge, and suspend and resume work."]
|
||||
limits = ["No board-specific regulator or clock configuration exists.", "The fuel gauge has not been read on this board.", "No power evidence exists for this board."]
|
||||
next_action = ["Read the fuel gauge on the first device boot and compare it against the stock firmware's reported charge."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Power-related kernel arguments and the sleep-disabled bring-up default"
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "implemented"
|
||||
components = ["DarwinBoot", "XnuPrelink", "SoftwareAES"]
|
||||
paths = ["board.toml", "configs/**", "package/**", "scripts/**"]
|
||||
inputs = ["iPadOS 17.7.11 kernelcache as the prelink input.", "Firmware DTB for boot-image assembly.", "The recorded archive plan in board.kernel.archives."]
|
||||
configuration = ["kernel.archives lists the ordered archive plan, mixing component: entries and script filenames.", "payload.volume = ISHTARESP, size_mib = 54, loader = firmware, title = Boot iPadOS.", "bootimg.dtb_node adds reserved-memory/splash_region to the firmware DTB so the firmware hands the framebuffer over."]
|
||||
procedure = ["Run ./unixnu kernel -D ../UniXNU-ishtar and confirm kernel/kernel.macho is produced.", "Run ./unixnu payload -D ../UniXNU-ishtar and confirm payload/payload.img and payload/payload.json.", "Run ./unixnu bootimg -D ../UniXNU-ishtar and confirm the assembled image reports a passing round trip."]
|
||||
findings = ["The archive plan is explicit rather than inherited, so every kernel-stage recipe appears in order; a component: entry resolves through the component catalog and a bare filename runs a shared builder.", "build-adreno740-accelerator.py is deliberately absent from the archive plan because it needs a payload-stage header that the kernel link does not provide; adding it fails the link.", "Boot-image assembly needs the firmware DTB. Without it the payload is correct but the image cannot be produced.", "The container is larger than the payload because the boot image inlines a 64 MiB window at 0xF0000000 with ramdisk_bytes = 0 and no appended device tree."]
|
||||
completion = ["Kernel, payload and boot image all build, and the assembled image passes its own round-trip check."]
|
||||
limits = ["The boot image has never been loaded on ishtar hardware.", "The build has no recorded host verification entry yet because the device repository has no published commit to cite.", "Kernel build reliability is affected by an intermittent clang frontend crash on osfmk/vm/vm_kern.c, which is resolved by re-running the single translation unit rather than by a source change."]
|
||||
next_action = ["Publish the device repository, then record the kernel, payload and boot-image commands with the resulting commit as host evidence."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "configs/gpu_defconfig"
|
||||
result = "Board kernel configuration including the extra link archive and the boot-progress switch"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Archive plan, payload policy and boot-image device-tree overlay"
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["package/BootProgressMin.c", "package/BootProgress.c", "package/BootDiagExport.c", "scripts/build-boot-progress-min.py", "scripts/build-boot-progress.py", "scripts/xnu-panic-screen.c"]
|
||||
inputs = ["Framebuffer geometry from board.toml for direct pixel writes.", "The kernel symbol physmap_base for reaching the framebuffer after arm_vm_init.", "The 5x12 glyph table in the firmware Font.h."]
|
||||
configuration = ["CONFIG_XNU_BOOT_PROGRESS=y selects the boot-progress observer in gpu_defconfig.", "Two implementations provide the entry points: BootProgressMin.c is self-contained and links into any configuration, while BootProgress.c is the full monitor and requires the audited UFS, owner-root, Virtio and source-corecrypto build.", "payload.panic_screen = true and payload.panic_framebuffer give the panic path a place to draw."]
|
||||
procedure = ["Run scripts/build-boot-progress-min.py to build libBootProgress.a and confirm the undefined-symbol gate passes.", "Boot the image and photograph the panel; the last numbered log line identifies the stage the kernel did not survive.", "Compare the last stage against the checkpoint list to pick the next area to investigate."]
|
||||
findings = ["The observer must never fault: a diagnostic that faults turns a hang into a hang with no output. Every kernel pointer is probe-translated with AT S1E1R before it is read, and every framebuffer store is bounded by the geometry the console reported.", "boot_progress_active() stays false until a framebuffer has been validated, so a board with no usable framebuffer keeps its normal console output instead of going silent.", "Once the observer binds, the normal console output is suppressed; a rendering fault therefore leaves a half-drawn screen with no textual output. The panic screen is a separate mechanism and is unaffected.", "The self-contained implementation is chosen by default because the full monitor reads UFS and Virtio counters directly and fails the link in a reduced configuration.", "A fixed-size literal destination can be constant-folded into mov/movk immediates, so a string that is visibly in the source may not appear in __cstring. Verifying that a patch reached the image needs a string that is genuinely stored as a literal."]
|
||||
completion = ["The screen shows the boot-progress panel and the last logged stage identifies where the kernel stopped."]
|
||||
limits = ["The observer has never rendered on ishtar hardware; its layout has only been verified on the host with a synthetic framebuffer.", "The full monitor implementation cannot be selected without the audited storage, owner-root, Virtio and corecrypto build."]
|
||||
next_action = ["Boot the boot-progress image on ishtar and record the last logged stage together with a photograph of the panel."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/BootProgressMin.c"
|
||||
result = "Self-contained boot-progress observer that renders stages to the raw framebuffer"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/build-boot-progress-min.py"
|
||||
result = "Build script with an undefined-symbol gate that rejects the object when the kernel image cannot satisfy it"
|
||||
@@ -0,0 +1,269 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "j716f"
|
||||
soc = "SM8250"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Lenovo TB-J716F migration record for the UniXNU iPadOS 17.7.11 bring-up."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "host-verified"
|
||||
components = ["XnuPrelink", "DarwinBoot"]
|
||||
paths = ["board.toml", "feeds.toml", "configs/**", "dts/**", "socs/**", ".github/**", ".gitignore", "local.toml.example"]
|
||||
inputs = ["SM8250/Kona identity, iPadOS 17.7.11 profile candidate, source defconfig, and the local SoC evidence snapshot."]
|
||||
configuration = ["board.toml uses schema_version 2, soc_source sm8250, os_profile ipados-17.7.11-21H461, and device:dts/j716f.dts.", "The source qualification defconfig remains the reproducible kernel configuration; it does not claim a bootable XNU."]
|
||||
procedure = ["Run the latest UniXNU defconfig, status, tree, and porting-record checks from the UniXNU checkout."]
|
||||
findings = ["No reviewed public UniXNU-sm8250-common repository was available, so the board-local source is explicitly marked as a transition snapshot.", "The macOS source workflow is pinned to UniXNU 42bffe8 and keeps its J716F compatibility fixes in the device repository.", "The source qualification defconfig disables the profile's MOCKFS fixture because that fixture requires ArmCpu, while this board intentionally keeps ArmCpu disabled.", "The source-output sealing step discovers the migration-qualified report and tree instead of assuming the legacy out/j716f root."]
|
||||
completion = ["The format 2 identity, source paths, defconfig, and patch order resolve without ambiguous board fields."]
|
||||
limits = ["The SoC source is local and not yet a reusable fixed public commit; component ABI inputs remain incomplete."]
|
||||
next_action = ["Extract the shared SM8250 resources into a reviewed UniXNU-sm8250-common repository and pin its 40-character commit."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "board.toml"
|
||||
result = "Format 2 board identity and migration fields are present."
|
||||
command = "python3 scripts/porting-record.py check --device ../UniXNU-j716f"
|
||||
revision = "f82228a9e166603d6a8b522bf0214db3379fad0d"
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "device-verified"
|
||||
components = []
|
||||
paths = ["proprietary-files.txt", "scripts/check-j716f.py", "docs/V14_MEMORY_WINDOW.md", "docs/V15_ENTRY_DIAGNOSTIC.md", "docs/V16_SOURCE_ENTRY_RESULT.md", "docs/V17_POST_MMU_PLAN.md", "docs/V18_POST_MMU_CHECKPOINT.md", "docs/V21_RESET_DIAGNOSTICS.md"]
|
||||
inputs = ["Mu-Silicium J716F platform, inherited GOP, fixed ZUI memory map, and the board UEFI DSC/FDF."]
|
||||
configuration = ["The device board points to the j716f DSC/FD and keeps vendor inputs outside the public repository."]
|
||||
procedure = ["Build the diagnostic FD with the local UEFI checkout, audit its inputs, then boot only through boot_b for hardware checks."]
|
||||
findings = ["V14 reached the UniXNU menu and exercised the documented button and DarwinBoot protocol paths.", "V16 on boot_b displayed the green ExitBootServices bar, the blue MMU-off XNU entry probe and the magenta pre-MMU-enable probe; the screen also showed the normal CapsuleRuntimeDxe LockCapsuleInterface callback.", "V17 on boot_b waited through the post-MMU probe, executed PSCI reset, and returned to the UniXNU menu with the same three entry bars.", "V18 displayed the same three bars but later reset back to UniXNU despite replacing stage 3 with a WFE loop; the external reset/watchdog source is unresolved.", "V19/V20 added read-only reset diagnostics. V20 photographs showed the DarwinBoot pre-ExitBootServices message and a later menu, but no readable PMIC value.", "V21 was built and host-audited, flashed only to boot_b and rebooted. A photograph confirms its large-text V21 menu and PMIC RESET: 0x02000001; the V21 XNU attempt remains unobserved."]
|
||||
completion = ["The FD enters UniXNU, preserves the documented memory reservations, and exposes the framebuffer for the menu."]
|
||||
limits = ["MMU-on persistence, ArmCpu/ArmDTPlatform initialization, UFS/root, userspace and iPadOS remain unverified; TzDxe is out of scope."]
|
||||
next_action = ["Record a V21 XNU attempt, final text/color bars and any Lenovo logo reappearance; use the PMIC sample as historical baseline without assigning a reset cause."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "docs/V16_SOURCE_ENTRY_RESULT.md"
|
||||
result = "V16 device boot reached ExitBootServices and the XNU early-entry probes on boot_b; no other partition was written."
|
||||
command = "fastboot boot boot_b"
|
||||
revision = "b421b9bf8036fe89883f5e4987fb483eda45568b"
|
||||
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "research/v21-reset-diagnostics.json"
|
||||
result = "V21 boot_b menu photograph confirms readable enlarged text and PMIC 0x02000001; XNU attempt and reset attribution remain pending."
|
||||
command = "fastboot flash boot_b <V21_BOOT_IMAGE>; fastboot reboot; observe the V21 menu."
|
||||
revision = "2c13d875f8b3d38414f61443dc44b9b9559dfcb7"
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["dts/**", "socs/sm8250/dts/**", "configs/**"]
|
||||
inputs = ["CPU0 MPIDR affinity 0, PSCI SMC, and a 19.2 MHz timer from the firmware device-tree evidence."]
|
||||
configuration = ["The DTS describes one enabled CPU and the measured timer frequency; the source qualification defconfig keeps ArmCpu disabled."]
|
||||
procedure = ["Compile the DTS, enable the reviewed ArmCpu implementation, and verify CPU entry, timer and IPI checkpoints."]
|
||||
findings = ["Only the single boot CPU and shared resource addresses are currently audited; no multi-core XNU entry has been established.", "The source qualification keeps ArmCpu disabled, so the profile's MOCKFS executable-root fixture is disabled rather than claiming CPU component support."]
|
||||
completion = ["Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on the selected cores."]
|
||||
limits = ["No public SM8250 ArmCpu source or device-side CPU entry evidence is pinned yet."]
|
||||
next_action = ["Review the SM8250 CPU topology and ArmCpu ABI before enabling the component."]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "device-verified"
|
||||
components = []
|
||||
paths = ["dts/**", "socs/sm8250/dts/**", "research/**", "docs/V14_MEMORY_WINDOW.md"]
|
||||
inputs = ["Two firmware RAM banks, a 5 GiB primary contiguous bank, reserved ranges, and the qualified 256 MiB DarwinBoot window."]
|
||||
configuration = ["The board DTS records the primary 0xc0000000/0x140000000 bank; the diagnostic payload separately requests 0x10000000 owned bytes."]
|
||||
procedure = ["Audit the memory map on the host, then allocate, cache-maintain, read back and release the V14 window on boot_b."]
|
||||
findings = ["The V14 256 MiB physical window passed seven checks, including two complete write/read rounds with cache maintenance and release; this does not validate full DRAM ownership.", "V21 host audit confirms the same embedded FAT payload and module GUID set as V20; this does not add a new RAM qualification result."]
|
||||
completion = ["Handoff regions do not overlap and the requested DarwinBoot window is allocated, coherently accessed and released."]
|
||||
limits = ["The V15 larger FAT payload and runtime initrd allocation still need a device observation."]
|
||||
next_action = ["Repeat the memory check with V15 while recording the initrd range and final owned-memory result."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "docs/V14_MEMORY_WINDOW.md"
|
||||
result = "Seven V14 checks passed, including two full write/read rounds over one 256 MiB window, cache maintenance and release."
|
||||
command = "fastboot boot boot_b"
|
||||
revision = "3159b53f6fe197d661f1cf31fb2bc1b9e1128f42"
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["dts/**", "proprietary-files.txt", "README.md"]
|
||||
inputs = ["UFS controller, PHY, LUN and userdata geometry are not yet represented by a reviewed J716F component source."]
|
||||
configuration = ["No UFS node, root volume UUID, GPT window or Data seed is declared in the public board configuration."]
|
||||
procedure = ["Capture the UFS controller and GPT facts from recovery/TWRP, then select a compatible storage component and root policy."]
|
||||
findings = ["The current V15 payload is a diagnostic FAT volume and does not prove physical UFS access or root mounting."]
|
||||
completion = ["Controller reads, GPT windows, OS/SystemOS ranges and root persistence pass on the device."]
|
||||
limits = ["No storage ABI, trust cache or userdata seed is public or verified."]
|
||||
next_action = ["Record UFS register, LUN and userdata geometry before adding a storage component."]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "device-verified"
|
||||
components = []
|
||||
paths = ["dts/**", "README.md", "docs/V15_ENTRY_DIAGNOSTIC.md", "docs/V21_RESET_DIAGNOSTICS.md"]
|
||||
inputs = ["Inherited GOP at 2560x1600 with 10240 bytes per row and 32-bit pixels."]
|
||||
configuration = ["The UEFI platform keeps the inherited framebuffer and the board DTS does not invent a panel controller."]
|
||||
procedure = ["Enter the menu through boot_b, observe the framebuffer geometry, and preserve the last screen on a returned diagnostic path."]
|
||||
findings = ["The menu and diagnostic screens rendered on the device; panel, backlight and native display driver adaptation are not complete.", "V21 device photography confirms the scale-4 menu with hidden logo and readable PMIC summary. The active framebuffer log font was changed from scale 3 to 5, but its device effect has not yet been observed."]
|
||||
completion = ["A known frame has the measured geometry and format, followed by a native display provider and backlight result."]
|
||||
limits = ["Only GOP/menu output is verified; native display and backlight remain pending."]
|
||||
next_action = ["Capture the V21 DarwinBoot/entry screen and then identify panel/backlight resources from the vendor DT."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "docs/V15_ENTRY_DIAGNOSTIC.md"
|
||||
result = "The existing diagnostic series records a measured 2560x1600 GOP and menu rendering; V15 itself remains pending."
|
||||
command = "fastboot boot boot_b"
|
||||
revision = "f82228a9e166603d6a8b522bf0214db3379fad0d"
|
||||
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "research/v21-reset-diagnostics.json"
|
||||
result = "V21 boot_b menu photograph confirms readable enlarged text and PMIC 0x02000001; XNU attempt and reset attribution remain pending."
|
||||
command = "fastboot flash boot_b <V21_BOOT_IMAGE>; fastboot reboot; observe the V21 menu."
|
||||
revision = "2c13d875f8b3d38414f61443dc44b9b9559dfcb7"
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "device-verified"
|
||||
components = []
|
||||
paths = ["README.md", "docs/V15_ENTRY_DIAGNOSTIC.md"]
|
||||
inputs = ["Volume and power key paths provided by the Mu-Silicium platform and J716F key DXE."]
|
||||
configuration = ["The menu remains interactive only where the platform reports an input device; no touch component is selected yet."]
|
||||
procedure = ["Use volume keys to select and the power key to confirm, then record whether the selected entry returns or advances."]
|
||||
findings = ["Volume and power keys were observed in the diagnostic menu; touch coordinates and HID reports are not yet adapted."]
|
||||
completion = ["Touches map to the display and buttons produce stable reports through the selected input component."]
|
||||
limits = ["Only the hardware keys are verified; touch controller and HID ABI are pending."]
|
||||
next_action = ["Collect touch controller bus, interrupt and coordinate mapping from the vendor DT and recovery logs."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "README.md"
|
||||
result = "The existing bring-up record confirms volume and power key interaction in the UniXNU menu."
|
||||
command = "fastboot boot boot_b"
|
||||
revision = "f82228a9e166603d6a8b522bf0214db3379fad0d"
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["dts/**", "proprietary-files.txt", "README.md"]
|
||||
inputs = ["Adreno/GMU registers, firmware, SMMU streams and Metal ABI inputs are not public for this board."]
|
||||
configuration = ["No GPU component is selected; the source defconfig keeps native Adreno disabled."]
|
||||
procedure = ["Audit the SM8250 GPU resources, obtain matching firmware and ABI records, then add a component and package service."]
|
||||
findings = ["The current screen result comes from inherited GOP and does not establish GPU submission or Metal presentation."]
|
||||
completion = ["GPU submissions, mapping, fences, known rendering and the selected Metal client all pass."]
|
||||
limits = ["No GPU firmware or device-side submission evidence is available."]
|
||||
next_action = ["Inventory Adreno 650/SM8250 resources and firmware ownership before selecting a component."]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["dts/**", "proprietary-files.txt"]
|
||||
inputs = ["Wireless chipset, bus, firmware and DMA ownership are not identified in the public port."]
|
||||
configuration = ["No Wi-Fi component or network package is selected."]
|
||||
procedure = ["Identify the wireless controller and firmware, then follow the network adaptation guide and record association/traffic tests."]
|
||||
findings = ["No network path has been exercised by the diagnostic images."]
|
||||
completion = ["Scanning, association, address configuration and sustained traffic pass with the selected firmware."]
|
||||
limits = ["Wireless hardware and OS ABI inputs are missing."]
|
||||
next_action = ["Extract the wireless controller identity and firmware source from the stock system."]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["dts/**", "proprietary-files.txt"]
|
||||
inputs = ["DSP, codec, clocks and firmware service ownership are not yet described."]
|
||||
configuration = ["No audio component or board package service is selected."]
|
||||
procedure = ["Inventory the audio graph and DSP firmware, then validate playback and capture routes."]
|
||||
findings = ["The current bring-up stops before userspace audio and has no audio evidence."]
|
||||
completion = ["Declared routes carry the selected format through playback and capture with correct start/stop behavior."]
|
||||
limits = ["Audio inputs and firmware are unavailable."]
|
||||
next_action = ["Capture the codec/DSP graph and firmware interfaces from the stock device."]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["dts/**", "proprietary-files.txt", "README.md", "docs/V21_RESET_DIAGNOSTICS.md"]
|
||||
inputs = ["Regulators, clocks, battery units and firmware ownership are not yet modeled."]
|
||||
configuration = ["The port keeps vendor power initialization in UEFI and declares no XNU power component."]
|
||||
procedure = ["Document regulators and power domains, then validate battery readings and a controlled sleep/resume cycle."]
|
||||
findings = ["No sleep/resume or battery result has been obtained from the diagnostic image.", "The V20/V21 UEFI diagnostic provider reads PMIC history without clearing it. V21 displays 0x02000001; bit semantics and reset cause remain unclassified, and this does not validate an XNU power driver."]
|
||||
completion = ["Power readings and supported sleep/resume transitions restore dependent peripherals."]
|
||||
limits = ["Power resources and low-power ownership remain unknown."]
|
||||
next_action = ["Inventory PMIC and battery resources before adding a power component."]
|
||||
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "research/v21-reset-diagnostics.json"
|
||||
result = "V21 boot_b menu photograph confirms readable enlarged text and PMIC 0x02000001; XNU attempt and reset attribution remain pending."
|
||||
command = "fastboot flash boot_b <V21_BOOT_IMAGE>; fastboot reboot; observe the V21 menu."
|
||||
revision = "2c13d875f8b3d38414f61443dc44b9b9559dfcb7"
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "host-verified"
|
||||
components = ["XnuPrelink", "DarwinBoot"]
|
||||
paths = ["board.toml", "dts/**", "patches/**", "scripts/**", "package/**", "docs/V15_ENTRY_DIAGNOSTIC.md", "docs/V16_SOURCE_ENTRY_RESULT.md", "docs/V17_POST_MMU_PLAN.md", "docs/V18_POST_MMU_CHECKPOINT.md", "docs/V21_RESET_DIAGNOSTICS.md"]
|
||||
inputs = ["V15 FAT payload layout, Android boot image v2 parameters, UEFI FD and the real kernel/ADT private inputs."]
|
||||
configuration = ["The board declares a 64 MiB diagnostic volume, firmware DarwinBoot loader, measured DRAM and boot image v2 offsets.", "The UEFI repository now declares the shared RAM-disk DXE alongside DiskIoDxe and FAT while retaining the existing V15 embedded-FAT diagnostic path."]
|
||||
procedure = ["Run host image audits, verify kernel/ADT hashes and inspect the boot image before any boot_b test."]
|
||||
findings = ["V15 host packaging and static audits passed.", "V16 host packaging produced the source-prelinked kernel, J716F ADT and boot image used for the boot_b test.", "The source build applies a device-local patch-series compatibility fix before the pinned UniXNU resolver, so optional Sheng PMGR context is not required for J716F.", "V21 host checks passed FD/FV/FFS checksums, AARCH64 PE and linked-module identity, V21 markers, unchanged V20 embedded FAT, BootShim/gzip, both DTB copies and Android v2 header/SHA1/padding.", "The byte-identical local V21 DSC is preserved in the firmware repository; it retains the V15 FDF/output path and omits the public V15 DSC additional standard-initrd declarations. Device board.toml retains historical V17 payload settings and is not the complete V21 artifact recipe."]
|
||||
completion = ["Kernel and ADT inputs are reproducible, the payload contains declared files, and the boot image matches the platform header and size constraints."]
|
||||
limits = ["Private payload binaries and vendor inputs are intentionally excluded; MMU-on continuation and later platform stages remain unverified."]
|
||||
next_action = ["Keep the recorded V21 image/profile identity while collecting the pending XNU attempt and reset evidence."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "docs/V16_SOURCE_ENTRY_RESULT.md"
|
||||
result = "V16 kernel/ADT/payload packaging and host audits passed for the local diagnostic artifact used on boot_b."
|
||||
command = "python3 scripts/check-j716f.py"
|
||||
revision = "f82228a9e166603d6a8b522bf0214db3379fad0d"
|
||||
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "research/v21-reset-diagnostics.json"
|
||||
result = "V21 host image audits passed; hashes and source/profile identities are recorded separately from the menu observation."
|
||||
command = "python tools/package_j716f_v21.py (local workspace; generated artifacts remain private)"
|
||||
revision = "2c13d875f8b3d38414f61443dc44b9b9559dfcb7"
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "device-verified"
|
||||
components = []
|
||||
paths = ["scripts/**", "research/**", "docs/**", "unixnu.lock"]
|
||||
inputs = ["Host audit scripts, V14 memory evidence, V15 entry preparation, V16 boot_b observation, and source-build reports."]
|
||||
configuration = ["Diagnostic outputs are separated from private binaries and the record distinguishes host, device and planned evidence."]
|
||||
procedure = ["Run the preflight and record checks, preserve only text metadata in CI, and use the boot_b-only recovery procedure on hardware."]
|
||||
findings = ["V16 device evidence confirms ExitBootServices and XNU early-entry probes on boot_b; the result is preserved in docs/V16_SOURCE_ENTRY_RESULT.md.", "Source-build diagnostics record both device-local compatibility patches and keep patch preparation idempotent across repeated macOS runner attempts.", "V21 was built, audited and flashed to boot_b; the observed menu has V21 labels, enlarged text and PMIC RESET: 0x02000001.", "The current PMIC value is a boot-history baseline. Neither this sample nor the earlier exiting boot services message identifies the cause of a reset; no V21 XNU attempt has yet been observed."]
|
||||
completion = ["Each claimed milestone has a reproducible command, matching source/image revision and an accessible result."]
|
||||
limits = ["No UART capture is available; MMU-on persistence, platform drivers, UFS/root and userspace remain unverified."]
|
||||
next_action = ["Record the selected XNU diagnostic attempt, final text/color bars, possible Lenovo logo and final held screen or menu before changing the next checkpoint."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "docs/V16_SOURCE_ENTRY_RESULT.md"
|
||||
result = "V16 records the audited private-input hashes and the boot_b screen evidence for ExitBootServices and XNU early entry."
|
||||
command = "python3 scripts/porting-record.py check --device ../UniXNU-j716f"
|
||||
revision = "b421b9bf8036fe89883f5e4987fb483eda45568b"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "research/v21-reset-diagnostics.json"
|
||||
result = "V21 boot_b menu photograph confirms readable enlarged text and PMIC 0x02000001; XNU attempt and reset attribution remain pending."
|
||||
command = "fastboot flash boot_b <V21_BOOT_IMAGE>; fastboot reboot; observe the V21 menu."
|
||||
revision = "2c13d875f8b3d38414f61443dc44b9b9559dfcb7"
|
||||
@@ -0,0 +1,234 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "oneplus13t"
|
||||
soc = "SM8750"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "OnePlus 13T PKX110: format-2 migration of the single-core, read-only UFS root and CPU display port; volatile RAM Data."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "host-verified"
|
||||
components = ["PaganiArmDTPlatform", "NativeAES", "NativeKeyStoreEvents"]
|
||||
paths = ["board.toml", "feeds.toml", "configs/**", ".gitmodules", ".github/**", ".gitignore", "upstream.rev", "unixnu.lock", "drivers/*", "kits/*", "modules/*", "scripts/test-format2.py", "scripts/fixtures/**", "local.toml.example", "unixnu", "scripts/test-layout.py", "scripts/test-upstream.py", "scripts/prepare-xnu-source.py", "scripts/build-*.py", "scripts/build-*.sh", "scripts/audit-stage7-display.py", "scripts/original_stage7.py", "patches/unixnu-framework.patch"]
|
||||
inputs = ["Four layers: ARM64, pinned sm8750, ipados-17.7.11-21H461, OnePlus 13T. Arrays are complete replacements."]
|
||||
configuration = ["schema_version=2; soc_source=sm8750; complete component/fragment/archive arrays; configs/oneplus13t_defconfig."]
|
||||
procedure = ["From UniXNU: defconfig oneplus13t_defconfig -D ../UniXNU-Pagani_SM8750; fetch; status --json; tree; run scripts/test-format2.py with the main scripts on PYTHONPATH."]
|
||||
findings = ["Four profiles select 18 components. PaganiInput and PaganiPanel are embedded in the ABI-qualified display archive and depend on QcomGeniSpi plus Sm8750Platform. Build 48 passed the complete configuration checks, driver compilation, final kernel link and prelink. Its source pins are device e6435b2bda6e91431f3bc0c442d1ff9c47be1451, main 42ffa07e9b82f7ffc37499392b2751e146647a6a, drivers 143e958bea8ae8ad7f47723cd105a589084f913d and SoC 9e90b16861612c0251c453ccbf6cf10592ea87e2.", "The documentation workflow checks out pinned driver submodules so repository-relative evidence links resolve during validation."]
|
||||
completion = ["All source pins resolve; every selected component has a record; status shows the intended overrides and patch order."]
|
||||
limits = ["The main fork carries community catalog entries; stock upstream alone cannot resolve this selection."]
|
||||
next_action = ["Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568", command = "test-format2.py; ./unixnu status --json; ./unixnu kernel -j 3", revision = "e6435b2bda6e91431f3bc0c442d1ff9c47be1451", result = "All 18 selected components resolved at their pinned revisions; archive ordering, ADT checks, full kernel link and prelink passed. Downloaded kernel and report agree at 127778816 bytes; hardware remains untested." },
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304", command = "test-format2.py; ./unixnu status --json", revision = "af2ba2975a5f0f6dcedfdcc719a1c646876f5804", result = "Four layers, 15 pinned components, complete archive order and matching required ADT properties passed." },
|
||||
{ kind = "source", reference = "board.toml", result = "Current format-2 selection and board policy." },
|
||||
{ kind = "source", reference = "STAGE6.md", result = "Historical PKX110 observations through build 39; no claim of migrated-image hardware verification." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "host-verified"
|
||||
components = ["PaganiDarwinBoot"]
|
||||
paths = ["proprietary-files.txt", "patches/mu*", "patches/uefi*", "scripts/check-memory-map.py"]
|
||||
inputs = ["PKX110 ABL uses init_boot ramdisk during fastboot boot; embedded payload plus the BootPayload HOB remains necessary.", "Private firmware checkout: IssacL04/UEFI-Pagani_SM8750 at 50b7313f40684aa25481cd109d7f48b9a50663fa."]
|
||||
configuration = ["firmware.config=oneplus13t; firmware.packages points to PaganiDarwinBoot; bootimg.embed_payload=true."]
|
||||
procedure = ["From UniXNU after kernel inputs pass: build package; firmware; payload; bootimg using ignored local input paths."]
|
||||
findings = ["PKX110 ABL uses init_boot ramdisk during fastboot boot; embedded payload plus the BootPayload HOB remains necessary.", "UniXNURamDiskDxe, DiskIoDxe and FAT support the standard FDT handoff; the rebuilt FD contains both paths."]
|
||||
completion = ["Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations."]
|
||||
limits = ["The migrated FD and new standard initrd driver have not been booted on hardware."]
|
||||
next_action = ["Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "MIGRATION.md", command = "./unixnu build package; ./unixnu firmware", revision = "af2ba2975a5f0f6dcedfdcc719a1c646876f5804", result = "AARCH64 DEBUG package and 3145728-byte FD built locally, including UniXNURamDiskDxe and the retained embedded payload path; hardware boot remains untested." },
|
||||
{ kind = "source", reference = "board.toml", result = "Current format-2 selection and board policy." },
|
||||
{ kind = "source", reference = "STAGE6.md", result = "Historical PKX110 observations through build 39; no claim of migrated-image hardware verification." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "host-verified"
|
||||
components = ["PaganiArmCpu"]
|
||||
paths = ["dts/**", "scripts/test-kernel-source.py"]
|
||||
inputs = ["Only MPIDR affinity 0 is enabled. GICD=0x16000000/0x10000, GICR=0x16080000/0x200000, stride=0x40000, CNTFRQ=19200000."]
|
||||
configuration = ["cpus=1; cpu0 status=okay; XNU_NATIVE_ARCH_TIMER and XNU_NATIVE_PAN enabled."]
|
||||
procedure = ["Compile the board DTS, compare the generated ADT, run test-stage6.py and test-kernel-source.py, then obtain a fresh boot log for CPU0/timer."]
|
||||
findings = ["Only MPIDR affinity 0 is enabled. GICD=0x16000000/0x10000, GICR=0x16080000/0x200000, stride=0x40000, CNTFRQ=19200000.", "The counter conversion uses the firmware CNTFRQ; the shared ARM64 patch preserves the Stage-6 timer correction. The source-kernel suite also executes the real RAMBlock link section with an alternate archive directory."]
|
||||
completion = ["Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU."]
|
||||
limits = ["SMP, other CPU affinities and CPU frequency control are unverified."]
|
||||
next_action = ["Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304", command = "test-kernel-source.py; test-stage6.py; ./unixnu kernel -j 3", revision = "af2ba2975a5f0f6dcedfdcc719a1c646876f5804", result = "Eight source-kernel regressions and production ARM64 assembly checks passed; the enabled CPU0 code linked successfully. IRQ/IPI behavior was not tested on hardware." },
|
||||
{ kind = "source", reference = "board.toml", result = "Current format-2 selection and board policy." },
|
||||
{ kind = "source", reference = "STAGE6.md", result = "Historical PKX110 observations through build 39; no claim of migrated-image hardware verification." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "host-verified"
|
||||
components = ["Sm8750Platform"]
|
||||
paths = ["dts/**", "scripts/check-memory-map.py"]
|
||||
inputs = ["The captured live DT has contiguous RAM at 0x980000000 of size 0x180000000. DarwinBoot requests 0x100000000 and rewrites chosen dram-base/size to its actual allocation."]
|
||||
configuration = ["payload.dram_size=0x180000000; payload.adt.owned_memory_size=0x100000000."]
|
||||
procedure = ["Run check-memory-map.py against the captured live.dtb and current UEFI map; inspect actual DarwinBoot allocation before allowing more RAM or DMA."]
|
||||
findings = ["The captured live DT has contiguous RAM at 0x980000000 of size 0x180000000. DarwinBoot requests 0x100000000 and rewrites chosen dram-base/size to its actual allocation.", "GIC register offsets remain unchanged; the common ADT converter rounds the arm-io window to 16 MiB. UFS uses the extracted SM8750 SMMU operations."]
|
||||
completion = ["All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy."]
|
||||
limits = ["Only the selected contiguous arena is handed to XNU; allocation size is a request. Other devices need their own RAM/reservation evidence."]
|
||||
next_action = ["Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304", command = "test-format2.py; test-stage6.py", revision = "af2ba2975a5f0f6dcedfdcc719a1c646876f5804", result = "DTS/ADT memory and GIC contracts and RAMBlock handoff address bounds passed on the host. DMA behavior was not tested on hardware." },
|
||||
{ kind = "source", reference = "board.toml", result = "Current format-2 selection and board policy." },
|
||||
{ kind = "source", reference = "STAGE6.md", result = "Historical PKX110 observations through build 39; no claim of migrated-image hardware verification." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "host-verified"
|
||||
components = ["NativeUfs", "NativeVirtioBlock", "NativeRamBlock", "PaganiVerifiedRoot"]
|
||||
paths = ["scripts/*ufs*", "scripts/test-stage6.py", "scripts/*storage*", "scripts/*root*", "scripts/prepare-ram-data.py", "scripts/test-ram-data.py", "scripts/prepare-original-trust.py"]
|
||||
inputs = ["The physical root is unixnu on LUN 0, 4096-byte LBAs 44928768..61705983; runtime UFS writes are disabled."]
|
||||
configuration = ["userdata.partition=unixnu; XNU_NATIVE_UFS, OWNER_ROOT_AUDIT, TRUST_CACHE_RUNTIME, OWNER_UNION_SYSTEMOS, NATIVE_RAM_BLOCK enabled."]
|
||||
procedure = ["Prepare UFS policy archives and original trust; prepare RAM Data on macOS; run test-stage6.py and test-root-audit.py; build the kernel."]
|
||||
findings = ["The physical root is unixnu on LUN 0, 4096-byte LBAs 44928768..61705983; runtime UFS writes are disabled.", "Read-only OS/SystemOS windows use the original APFS/AMFI path. Data is a 1 GiB RAM seed and loses changes on reboot. Virtio is an ABI dependency, not tested 13T hardware. The RAMBlock addon query is synchronized with upstream RamBlock 25c57e0e9b68bf452dd1986914525edc9d2320bc for the shared kernel ABI; missing and invalid handoff ranges are checked on the host. No GPU addon is packaged."]
|
||||
completion = ["Host: register, clock, link and SMMU facts match the board inventory.", "Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within the allocated unixnu partition.", "Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region."]
|
||||
limits = ["Physical writes and persistent Data are unsupported. Never deploy the historical userdata-root.img filename to Android userdata."]
|
||||
next_action = ["Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304", command = "test-stage6.py; test-root-audit.py; test-ram-data.py; ./unixnu kernel -j 3", revision = "af2ba2975a5f0f6dcedfdcc719a1c646876f5804", result = "Read-only partition bounds, root-window contracts, RAM Data preparation and original storage ABI qualification passed; UFS, Virtio and RAMBlock linked successfully." },
|
||||
{ kind = "source", reference = "board.toml", result = "Current format-2 selection and board policy." },
|
||||
{ kind = "source", reference = "STAGE6.md", result = "Historical PKX110 observations through build 39; no claim of migrated-image hardware verification." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "host-verified"
|
||||
components = ["NativeMobileDisplay", "PaganiPanel"]
|
||||
paths = ["scripts/test-stage7.py", "scripts/prepare-boot-logo.py", "package/PaganiPeripherals.h"]
|
||||
inputs = ["Firmware GOP: 1216x2640, 32 bpp, stride 4864. The active AA594_P_7_A0020 command-mode panel uses DSI0 at 0xae94000 and low-byte-first DCS brightness; normal max 0xdbb, initial level 0x599."]
|
||||
configuration = ["Native Legacy CPU framebuffer, sheng-vsync=60 and pagani-panel=1. Board constants are in PaganiPeripherals.h."]
|
||||
procedure = ["Run test-stage7.py and test-peripherals.py against the resolved tree; run build-pagani-peripherals.py --audit-only against the pinned kernelcache, then build the full display archive with XNU compiler records. After a separately authorized temporary boot, verify first brightness completion before testing slider and power transitions."]
|
||||
findings = ["PaganiPanel derives from the genuine original AppleARMBacklight class with qualified 0x370 storage and 169 virtual entries. It sends DCS 0x51/0x28/0x29 through the command FIFO and stops after a transport failure. The controller setup, DSC and panel timing stay as handed off by firmware.", "The 60 Hz software presentation timer pauses for logical display-off and resumes with a fresh deadline. Build 48 passed MMIO/timer tests, original and compiled-object ABI checks, full kernel link and prelink. PaganiPanel symbols are present in the downloaded kernel; physical display control remains unverified."]
|
||||
completion = ["A known frame appears with correct geometry and colors, then userland presentation and backlight controls work."]
|
||||
limits = ["No new hardware verification, physical refresh measurement, TE/vblank synchronization, high-refresh switching, brightness calibration, fade interpolation or full panel suspend/resume. CoreBrightness property access and coexistence with firmware scanout remain unverified."]
|
||||
next_action = ["Assemble a boot image from the build-48 kernel and matching inputs, then temporarily boot after authorization. Compare UI output with build 39, test brightness within the normal range, blank/unblank and inspect command errors. Measure TE cadence before adding physical refresh control."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568", command = "test-stage7.py; test-peripherals.py; ./unixnu kernel -j 3", revision = "e6435b2bda6e91431f3bc0c442d1ff9c47be1451", result = "Display timer and DSI transport checks passed. The owned panel object passed the original/compiled ABI audit, entered the display archive and linked into the prelinked kernel; no hardware result claimed." },
|
||||
{ kind = "source", reference = "drivers/PaganiPanel/README.md", result = "DSI command transport, genuine backlight ancestry, timer PM integration and explicit runtime limits; not a complete-kernel or device result." },
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304", command = "test-stage7.py; ./unixnu kernel -j 3", revision = "af2ba2975a5f0f6dcedfdcc719a1c646876f5804", result = "Display lifecycle checks and original Legacy ABI qualification passed; the CPU presentation archive compiled and linked. The migrated framebuffer has not been observed on hardware." },
|
||||
{ kind = "source", reference = "board.toml", result = "Current format-2 selection and board policy." },
|
||||
{ kind = "source", reference = "STAGE6.md", result = "Historical PKX110 observations through build 39; no claim of migrated-image hardware verification." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "host-verified"
|
||||
components = ["PaganiInput", "QcomGeniSpi"]
|
||||
paths = ["package/PaganiPeripherals.h", "scripts/test-peripherals.py"]
|
||||
inputs = ["S3910 HBP on GENI SPI QUP1 S4 at 0xa90000, wrapper 0xac0000, mode 0, maximum 19 MHz. GPIOs 48..51 carry SPI; reset 161 and ATTN 162 are active low. TLMM GPIO windows include the SM8750 0x100000 offset.", "SPMI v7 observer: PON SID 0 peripheral 0x13, bits 7/6 = Power/Volume Up; GPIO SID 1 peripheral 0x8d bit 0 active low = Volume Down."]
|
||||
configuration = ["pagani-touch=1 and pagani-buttons=1 select two original-ABI HID devices. Board wiring and timing are defined in PaganiPeripherals.h."]
|
||||
procedure = ["Run test-peripherals.py --tree <resolved-tree> and the original HID ABI audit; build the full archive. On hardware first check SPI protocol, ID/application status and LBP/configuration acknowledgements, then single contacts, coordinate orientation, simultaneous contacts, releases and physical key holds."]
|
||||
findings = ["The stock HBP driver exposes an LBP fallback through dynamic config 0x11=2. The new transport drains queued raw frames, installs and reads back a custom report format, filters palms and emits explicit releases with stable IDs. TouchComm CRC command suffixes are detected from identification.", "PMIC reads are bounded and keys use 32 ms debounce. Failed key reads release all keys; touch transport failure releases held contacts and disables further touch reads. ATTN is polled at 8 ms, keys at 16 ms. Build 48 passed portable tests, the original 207-slot HID and compiled-object ABI audits, C/C++ compilation, final link and prelink. Input, S3910 and GENI SPI symbols are present in the downloaded kernel; hardware input remains unverified."]
|
||||
completion = ["Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports."]
|
||||
limits = ["Retained regulator and GENI firmware state is required. No RPMh cold rail enable, GIC IRQ path, GPI DMA, TouchComm v2, oversized-command fragmentation, firmware recovery or system-sleep wake. Hardware must confirm LBP availability, FIFO access, coordinates and event routing. System edge gestures are not implemented."]
|
||||
next_action = ["Assemble the build-48 boot image, then capture the first S3910 identification and application response during an authorized temporary boot. Use the reported failure stage to choose rail/microcode, FIFO or protocol work; do not treat display output as touch verification."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568", command = "test-peripherals.py; test-stage7.py; ./unixnu kernel -j 3", revision = "e6435b2bda6e91431f3bc0c442d1ff9c47be1451", result = "TouchComm, contact lifecycle, key debounce/failure, SPMI and GENI tests passed. The HID object passed ABI checks and the S3910/GENI sources compiled as C; all three objects linked into the prelinked kernel. Hardware input remains untested." },
|
||||
{ kind = "source", reference = "drivers/PaganiInput/README.md", result = "Physical HID adapters, bounded TouchComm/SPMI paths, contact and key lifecycle tests; no hardware result claimed." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["board.toml"]
|
||||
inputs = ["Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected."]
|
||||
configuration = ["No driver is enabled for this subsystem."]
|
||||
procedure = ["Follow the subsystem guide to identify hardware, firmware and ABI inputs before enabling a component."]
|
||||
findings = ["Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected."]
|
||||
completion = ["GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it."]
|
||||
limits = ["No implemented or hardware-verified path is available for this subsystem."]
|
||||
next_action = ["Capture SM8750 GPU/GMU resources and the firmware manifest; qualify a matching implementation before enabling GPU components."]
|
||||
evidence = [
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["board.toml"]
|
||||
inputs = ["No verified Wi-Fi or cellular path is selected for PKX110."]
|
||||
configuration = ["No driver is enabled for this subsystem."]
|
||||
procedure = ["Follow the subsystem guide to identify hardware, firmware and ABI inputs before enabling a component."]
|
||||
findings = ["No verified Wi-Fi or cellular path is selected for PKX110."]
|
||||
completion = ["Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware."]
|
||||
limits = ["No implemented or hardware-verified path is available for this subsystem."]
|
||||
next_action = ["Identify the WLAN transport, firmware and IRQ/DMA requirements from the stock DTB before selecting a driver."]
|
||||
evidence = [
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["board.toml"]
|
||||
inputs = ["DSP/codec firmware interfaces, routes and playback/capture remain unimplemented."]
|
||||
configuration = ["No driver is enabled for this subsystem."]
|
||||
procedure = ["Follow the subsystem guide to identify hardware, firmware and ABI inputs before enabling a component."]
|
||||
findings = ["DSP/codec firmware interfaces, routes and playback/capture remain unimplemented."]
|
||||
completion = ["Each declared route carries the selected audio format through playback or capture and handles start/stop correctly."]
|
||||
limits = ["No implemented or hardware-verified path is available for this subsystem."]
|
||||
next_action = ["Map the DSP, codec, clock and firmware dependencies from the stock platform before implementing an audio route."]
|
||||
evidence = [
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "host-verified"
|
||||
components = ["ShengPlatformPower"]
|
||||
paths = ["patches/xnu/pagani-bootstrap.patch"]
|
||||
inputs = ["The component preserves the original Apple PMGR ABI and restricted boot-time operations."]
|
||||
configuration = ["XNU_SHENG_PMGR=y; sheng-pmgr=2; sleep-disabled=1."]
|
||||
procedure = ["Build the compatibility PMGR archive against the exact kernelcache; observe boot transitions before changing any firmware-owned vote."]
|
||||
findings = ["The existing PMGR compatibility behavior is unchanged. PaganiInput adds QUP1 S4 clock votes and GPIO reset while retaining firmware regulator state. PaganiPanel requests display blanking without turning off rails or replacing full suspend/resume.", "Battery, charging, suspend and frequency scaling remain unverified."]
|
||||
completion = ["Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals."]
|
||||
limits = ["Battery, charging, sleep and full regulator/clock control are unsupported."]
|
||||
next_action = ["Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304", command = "./unixnu kernel -j 3", revision = "af2ba2975a5f0f6dcedfdcc719a1c646876f5804", result = "The PMGR builder qualified the pinned original imports/provider dispatch and linked its archive. Physical power transitions, battery and frequency control remain unverified." },
|
||||
{ kind = "source", reference = "board.toml", result = "Current format-2 selection and board policy." },
|
||||
{ kind = "source", reference = "STAGE6.md", result = "Historical PKX110 observations through build 39; no claim of migrated-image hardware verification." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "host-verified"
|
||||
components = ["NativePrelink"]
|
||||
paths = ["scripts/test-bootimg.py", "scripts/test-adt.py", "scripts/*adt*", "scripts/fixtures/**", "patches/xnu/series"]
|
||||
inputs = ["Kernel ABI and IPSW stay at 21H461. NativePrelink stays pinned in the community bundle; the OS series selects its matching patches."]
|
||||
configuration = ["kernel.prelink roots preserve the previously qualified subset; payload.adt.root_match_volume_uuid=04769D26-2CA0-4825-B443-E2E5F88300F2."]
|
||||
procedure = ["Run ipsw fetch, kernel, build package, firmware, payload, bootimg in order; inspect payload.json and the ADT in FAT."]
|
||||
findings = ["Kernel ABI and IPSW stay at 21H461. NativePrelink stays pinned in the community bundle; the OS series selects its matching patches.", "Four byte-qualified userspace fixups now come from the shared OS profile and common validated-page implementation. Board root UUID and PackedRAMDisk/TrustCache placeholders are preserved.", "Android boot v4 packages gzip(BootShim+3 MiB FD+160 MiB FAT) followed by all stock DTBs; Android ramdisk remains empty."]
|
||||
completion = ["Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit."]
|
||||
limits = ["Host construction does not establish runtime equivalence to build 39."]
|
||||
next_action = ["Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "MIGRATION.md", command = "./unixnu kernel -j 3; ./unixnu build package; ./unixnu firmware; ./unixnu payload; ./unixnu bootimg", revision = "af2ba2975a5f0f6dcedfdcc719a1c646876f5804", result = "Kernel/prelink, 160 MiB FAT payload and 87928832-byte Android v4 boot image succeeded. Extracted ADT and payload kernel hashes match the reports; no GPU addon is supplied." },
|
||||
{ kind = "source", reference = "board.toml", result = "Current format-2 selection and board policy." },
|
||||
{ kind = "source", reference = "STAGE6.md", result = "Historical PKX110 observations through build 39; no claim of migrated-image hardware verification." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "host-verified"
|
||||
components = ["BootProgress", "Stage7Probe"]
|
||||
paths = ["patches/xnu/**", "scripts/test-kernel-source.py", "scripts/backup*", "scripts/p13-f2fs-shrink.c", "scripts/audit-original-pmgr.py", "scripts/test-root-audit.py"]
|
||||
inputs = ["Early framebuffer, root checkpoints and panic rendering remain enabled. Source-only diagnostics are separate from the prelinked userspace kernel."]
|
||||
configuration = ["XNU_BOOT_PROGRESS=y; XNU_EARLY_BOOT_PROGRESS=y; optional native-root-audit triggers the binding report."]
|
||||
procedure = ["Run the panic/ADT/boot container checks; preserve old run artifacts; capture the last completed checkpoint in a future explicitly authorized temporary boot."]
|
||||
findings = ["Early framebuffer, root checkpoints and panic rendering remain enabled. Source-only diagnostics are separate from the prelinked userspace kernel.", "Build 39 reached the iPadOS UI; see STAGE6.md. The complete driver archive plan passes on macOS. The early boot-logo builder now reads the IPSW from the format-2 output root and compiles successfully. A host regression checks that the final link selects the RAMBlock object beside the configured archive; the final kernel/prelink and local firmware, payload and boot-image assembly have now passed; the image remains untested on hardware."]
|
||||
completion = ["Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result."]
|
||||
limits = ["No device command is issued by the migration. Older observations are identified separately."]
|
||||
next_action = ["Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39."]
|
||||
evidence = [
|
||||
{ kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304", command = "test-kernel-source.py; drivers/BootProgress/Test/panic-entry.py", revision = "af2ba2975a5f0f6dcedfdcc719a1c646876f5804", result = "Source-kernel regressions, early console compilation and panic-entry contract passed in CI; runtime checkpoints still require a hardware boot." },
|
||||
{ kind = "source", reference = "board.toml", result = "Current format-2 selection and board policy." },
|
||||
{ kind = "source", reference = "STAGE6.md", result = "Historical PKX110 observations through build 39; no claim of migrated-image hardware verification." },
|
||||
]
|
||||
@@ -0,0 +1,246 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "sheng"
|
||||
soc = "SM8550"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Xiaomi Pad 6S Pro 12.4 uses shared SM8550 support and board-owned storage, input, firmware and power integration. This record describes implementation coverage and the evidence required for each milestone."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["board.toml", "feeds.toml", "configs/**", ".gitmodules", ".github/**", ".gitignore"]
|
||||
inputs = ["SM8550 profile, iPadOS 17.7.11 build 21H461, device defconfig, pinned component sources."]
|
||||
configuration = ["board.soc_source = sm8550; board.os_profile = ipados-17.7.11-21H461; schema_version = 2.", "The device owns ShengUfs, ShengHidInput, ShengNovatekTouch and ShengPreflight submodules."]
|
||||
procedure = ["Read https://unixnu.com/porting/device-repository and https://unixnu.com/porting/records.", "Run ./unixnu defconfig sheng_defconfig -D ../UniXNU-sheng from UniXNU.", "Run ./unixnu status --json -D ../UniXNU-sheng and review profiles, components, source pins and patch order."]
|
||||
findings = ["Tables merge in ARM64, SoC, OS, device order. Arrays replace inherited selections, so include every required component and fragment.", "The selected defconfig applies after the explicit configuration fragments. Keep OS ABI and IPSW pins in the OS profile."]
|
||||
completion = ["All source pins resolve; every selected component has a record; status shows the intended overrides and patch order."]
|
||||
limits = ["Local overrides can select a different source from the published pin; record the effective source in each verification result."]
|
||||
next_action = ["Compare the effective status output whenever a profile, source or component selection changes."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "implemented"
|
||||
components = ["ShengPreflight"]
|
||||
paths = ["proprietary-files.txt", "scripts/extract-files.py", "scripts/gen-touch-firmware.py"]
|
||||
inputs = ["uefi-sheng firmware, stock firmware DTB, GOP handoff, PSCI SMC interface and vendor firmware inventory."]
|
||||
configuration = ["firmware.dsc = Platforms/Xiaomi/shengPkg/sheng.dsc; firmware.config = sheng.", "proprietary-files.txt records input paths and provenance.", "The firmware DSC and FDF embed UniXNU, UniXNUDxe, DarwinBoot, UniXNURamDiskDxe, DiskIoDxe and FAT support."]
|
||||
procedure = ["Run ./unixnu build firmware -D ../UniXNU-sheng --uefi ../uefi-sheng.", "Record the firmware commit, output FD and handoff memory map before a boot attempt.", "Build the payload, then run ./unixnu bootimg with the firmware DTB. Inspect boot.json ramdisk_bytes and the required firmware modules."]
|
||||
findings = ["The firmware DTB is an input to boot-image assembly. XNU consumes the separately generated ADT.", "The sheng preflight component belongs with board integration and its firmware requirements.", "The shared UniXNURamDiskDxe reads the Mu-Silicium entry-argument HOB and FDT initrd range to publish the payload block device. ShengBootMemoryDxe owns memory expansion.", "Configured menu entries require a payload FAT filesystem containing EFI/UniXNU/unixnu.toml. Check the UNIXNURAMDISK initrd block-device status when entries are absent."]
|
||||
completion = ["Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations."]
|
||||
limits = ["Boot-image assembly requires the selected firmware DTB and proprietary input files."]
|
||||
next_action = ["Capture firmware revision and memory reservations with the next image verification."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "proprietary-files.txt"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "https://github.com/UniXNU/UniXNU/blob/8d157ee18ae9c4d518aba28cb3040a84e860dcd1/package/UniXNUPkg/Driver/UniXNURamDiskDxe/UniXNURamDiskDxe.c"
|
||||
result = "Shared FDT initrd block-device publication; board memory policy remains in uefi-sheng."
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "implemented"
|
||||
components = ["ArmCpu", "ArmDTPlatform"]
|
||||
paths = ["package/CpuFreq*", "scripts/*armcpu*"]
|
||||
inputs = ["SM8550 CPU affinities, GIC distributor at 0x17100000, redistributors at 0x17180000, 0x40000 stride and 19.2 MHz timer.", "PSCI uses SMC. The board disables cpu1 and cpu2 in its DTS."]
|
||||
configuration = ["dts/sheng.dts includes sm8550.dtsi; shared CPU and interrupt definitions come from the SoC source.", "Kernel arguments select sheng-smp=1 and armcpu-spi-ipi=1."]
|
||||
procedure = ["Compile the board DTS and inspect enabled CPUs, GIC ranges and timer properties in the ADT.", "Record per-CPU entry, timer interrupts and inter-processor interrupt delivery."]
|
||||
findings = ["CPU affinity values are hardware identifiers. Enabled CPU count and MPIDR affinities must be checked together.", "GIC register ranges must use translated physical addresses from the hardware tree."]
|
||||
completion = ["Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU."]
|
||||
limits = ["CPU selection and frequency policy are board inputs; SoC topology describes all cores."]
|
||||
next_action = ["Attach per-CPU and interrupt observations for the selected firmware and image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/sheng.dts"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["dts/**", "package/*Smmu*", "package/*Memory*", "scripts/*smmu*", "scripts/*memory*"]
|
||||
inputs = ["Handoff DRAM at 0x80000000 with size 0x80000000; splash reservation at 0xb8000000 with size 0x2b00000.", "Payload owned-memory request is 0x130000000. Device DMA requires controller stream IDs, address widths and ownership."]
|
||||
configuration = ["device_tree.source = device:dts/sheng.dts; include_dirs = [soc:dts].", "payload.adt.owned_memory_size and firmware reservations describe separate allocations."]
|
||||
procedure = ["Compare firmware RAM ranges, reserved regions, DTS ranges and ADT memory-map entries.", "Check DMA buffers against controller address width, cache policy and SMMU mapping before submitting work."]
|
||||
findings = ["Physical register translation and CPU virtual mappings have different purposes. Preserve physical resource ranges in hardware descriptions.", "GPU and UFS use different SMMU instances and stream assignments."]
|
||||
completion = ["All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy."]
|
||||
limits = ["The DTS declares the current handoff window and splash region; memory sizing requires the selected firmware map."]
|
||||
next_action = ["Record the firmware memory map and each DMA consumer when changing reserved memory."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/sheng.dts"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "implemented"
|
||||
components = ["ShengUfs", "VirtioMmioBlock", "RamBlock", "VerifiedRoot"]
|
||||
paths = ["drivers/ShengUfs", "scripts/*ufs*", "scripts/*storage*", "scripts/*userdata*", "scripts/*root*"]
|
||||
inputs = ["UFS host 0x01d84000/0x3000; PHY 0x01d80000/0x2000; GCC base 0x00100000.", "GCC AXI, AHB, UniPro, symbol and PHY auxiliary branches; power domains and firmware link state.", "Apps SMMU at 0x15000000, UFS stream 0x60, context-bank ownership, DMA width and cache maintenance.", "LUN 0 uses 4096-byte blocks; userdata spans LBAs 3094592 through 64007162."]
|
||||
configuration = ["Select ShengUfs and CONFIG_XNU_NATIVE_UFS=y; native-ufs-root=1 enables the root path.", "userdata defines OS and SystemOS windows. payload.adt.root_match_volume_uuid = 04769D26-2CA0-4825-B443-E2E5F88300F2."]
|
||||
procedure = ["Read https://unixnu.com/porting/ufs with this storage record.", "Inspect clock enables, power state, HCE/HCS, link state, request-list base and SMMU mappings before changing controller ownership.", "Validate SCSI capacity and GPT reads, then publish root windows and mount the configured root UUID.", "Verify persistent Data writes on the documented Data allocation with a recovery image available."]
|
||||
findings = ["An idle AHB branch may report CLK_OFF with hardware gating enabled. Check enable and gating bits together.", "SMMU bypass still has address-width constraints. Validate every DMA range and context-bank assignment.", "ShengUfs contains controller access, GPT/window parsing and sheng Data/log policy. Reuse each layer according to its inputs."]
|
||||
completion = ["Host: register, clock, link and SMMU facts match the board inventory.", "Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within userdata.", "Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region."]
|
||||
limits = ["The SoC DTSI exports host and PHY ranges. GCC and UFS SMMU handling currently use constants and operations in ShengUfs.", "The root transport uses a polled request slot. Its firmware adoption path requires a usable existing request list."]
|
||||
next_action = ["Record clock/PHY/reset initialization ownership and the SMMU stream before adapting this driver to another board."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "https://github.com/UniXNU/ShengUfs/blob/e2b32cc429e8cf1501161c1d8c517f8994ceb9b2/NativeUfs.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "implemented"
|
||||
components = ["GopFramebuffer"]
|
||||
paths = ["package/*Display*", "package/*Framebuffer*", "package/*Backlight*", "package/AppleARMBacklight.cpp", "package/GeniI2c*", "scripts/*display*", "scripts/*gop*", "scripts/*framebuffer*"]
|
||||
inputs = ["UEFI GOP framebuffer, stride, pixel format, splash reservation and board panel/backlight controls."]
|
||||
configuration = ["Select GopFramebuffer; CONFIG_XNU_NATIVE_LEGACY_DISPLAY=y; artwork-display-gamut = sRGB.", "sheng-vsync=120 requests board display timing."]
|
||||
procedure = ["Verify GOP address, dimensions, stride and pixel layout before enabling presentation.", "Build the late display archive with the selected OS ABI records, then check display publication and frame presentation."]
|
||||
findings = ["The display source and ABI binding are selected independently from the physical panel configuration.", "The board configuration declares sRGB for the current 8-bit framebuffer path."]
|
||||
completion = ["A known frame appears with correct geometry and colors, then userland presentation and backlight controls work."]
|
||||
limits = ["The late display builder needs qualified prelink candidates and ABI records. A timing request requires a measured presentation result."]
|
||||
next_action = ["Record frame timing, pixel format and presentation evidence for each image used to qualify display."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/LegacyDisplayProbe.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "implemented"
|
||||
components = ["ShengHidInput", "ShengNovatekTouch", "QcomGeniSpi"]
|
||||
paths = ["drivers/ShengHidInput", "drivers/ShengNovatekTouch", "package/*Touch*", "package/*Button*", "scripts/*touch*", "scripts/*hid*"]
|
||||
inputs = ["Novatek NT36532 sensor, GENI SPI controller, pin configuration, reset/interrupt lines, firmware and touch coordinate geometry."]
|
||||
configuration = ["Select ShengHidInput, ShengNovatekTouch and QcomGeniSpi; sheng-touch=4 and sheng-touch-hid=1 select board integration."]
|
||||
procedure = ["Read TouchBoard.h and verify the SPI clock and mode against the controller setup.", "Validate protocol reports, contact tracking and coordinate orientation before publishing HID events."]
|
||||
findings = ["Controller transfer logic, sensor protocol and board sensor geometry are separate inputs.", "Track contact IDs across movement and lift events; a register read alone covers only transport access."]
|
||||
completion = ["Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports."]
|
||||
limits = ["Sensor firmware and board dimensions remain sheng inputs."]
|
||||
next_action = ["Attach contact and orientation observations when firmware or geometry changes."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/TouchBoard.h"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "implemented"
|
||||
components = ["Adreno740", "AdrenoMetal", "AirNir", "Sm8550Platform", "AdrenoPM4", "AdrenoFirmware", "ArmSmmu4K"]
|
||||
paths = ["package/*Gpu*", "package/*Gmu*", "package/*Adreno*", "scripts/*adreno*", "scripts/*gpu*", "scripts/*metal*", "scripts/*turnip*", "scripts/*air*"]
|
||||
inputs = ["A740 GPU/GMU registers, GPU SMMU streams 0/1 and GMU stream 5, signed ZAP firmware and board power votes.", "Turnip, metal2vulkan, AIR translation and the selected OS GPU/Metal ABI."]
|
||||
configuration = ["Select Adreno740, AdrenoMetal and AirNir; shared SM8550 operations arrive through component dependencies.", "Board scripts combine shared GMU code with package/ShengGmuVotes.c."]
|
||||
procedure = ["Qualify power, firmware, SMMU and GMU startup before command submission.", "Check memory mapping, command completion and a known rendered image before staging the Metal plugin."]
|
||||
findings = ["GPU generation and the frontend ABI define component scope. Firmware, votes and display integration remain board inputs.", "Shared platform code and board votes require separate include paths during archive assembly."]
|
||||
completion = ["GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it."]
|
||||
limits = ["A740 coverage depends on the selected firmware and OS ABI; board qualification requires its own memory and power evidence."]
|
||||
next_action = ["Record the exact firmware, compiler inputs, driver revision and rendered output for the next qualification."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/build-adreno740-kits.py"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "implemented"
|
||||
components = ["Ath12kWifi"]
|
||||
paths = ["drivers/Ath12kWifi", "package/*Wifi*", "package/MhiBoot*", "scripts/*wifi*", "scripts/*mhi*"]
|
||||
inputs = ["Ath12k device on PCIe, BAR windows, MSI routing, DMA callbacks, firmware, MHI and QRTR services."]
|
||||
configuration = ["Select Ath12kWifi. build-gop-legacy-display.py compiles its objects through build-ath12k-wifi.py."]
|
||||
procedure = ["Verify PCIe enumeration and MSI delivery before MHI startup.", "Record firmware startup, scan, association, address configuration and bidirectional packet delivery separately."]
|
||||
findings = ["The reusable Wi-Fi stack consumes board callbacks; PCIe and the OS network interface are owned by the device integration.", "MHI startup and network traffic are separate completion points."]
|
||||
completion = ["Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware."]
|
||||
limits = ["The source implements the station path through WifiNet.cpp and board PCIe integration. Device evidence must identify the firmware and access point."]
|
||||
next_action = ["Attach association and receive/transmit observations for the current firmware and image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/WifiNet.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["package/*Adsp*", "package/*Audio*", "package/*Gpr*", "package/QcomGlink*", "package/QcomMdt*", "package/QcomSmem*", "package/QcomSmp2p*", "scripts/*adsp*", "scripts/*audio*", "scripts/*gpr*"]
|
||||
inputs = ["ADSP firmware, SMEM, SMP2P, GLINK, GPR services, board codec and audio routing."]
|
||||
configuration = ["The board display archive includes ADSP and audio probe objects."]
|
||||
procedure = ["Check firmware loading and ADSP service readiness before configuring audio endpoints.", "Record route, format and playback/capture observations for each enabled endpoint."]
|
||||
findings = ["Firmware startup, service registration and audible playback require separate evidence.", "The GPR client and firmware loading helpers can be inspected independently from codec routing."]
|
||||
completion = ["Each declared route carries the selected audio format through playback or capture and handles start/stop correctly."]
|
||||
limits = ["Current source contains ADSP bring-up and audio framework probes. Endpoint playback qualification needs route-specific evidence."]
|
||||
next_action = ["Document the codec, clocks and endpoint routing before claiming playback completion."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/AudioProbe.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "implemented"
|
||||
components = ["AppleKeyStoreState"]
|
||||
paths = ["package/*Battery*", "package/*Battmgr*", "package/*Power*", "package/*PlatformPower*", "package/QcomQmp*", "package/QcomRpmh*", "package/QcomScm.h", "scripts/*power*", "scripts/*battery*", "scripts/*pmgr*"]
|
||||
inputs = ["Board PMGR integration, clocks/regulators, ADSP battery manager and per-peripheral power requirements."]
|
||||
configuration = ["CONFIG_XNU_SHENG_PMGR=y; sheng-pmgr=2 selects the board integration.", "AppleKeyStoreState is selected with the OS event integration."]
|
||||
procedure = ["Document each clock, regulator and firmware-owned state before enabling power transitions.", "Check battery units and update behavior separately from suspend/resume and peripheral power."]
|
||||
findings = ["Battery reporting uses the ADSP battery-manager path. It depends on firmware/service readiness.", "Power policy belongs to the board even when controller operations are shared."]
|
||||
completion = ["Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals."]
|
||||
limits = ["Per-peripheral controls and battery publication have separate coverage from system suspend."]
|
||||
next_action = ["Record each supported transition and its dependent peripherals in this section."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/ShengBattery.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "implemented"
|
||||
components = ["DarwinBoot", "XnuPrelink", "SoftwareAES"]
|
||||
paths = ["scripts/*payload*", "scripts/*image*", "scripts/*flash*", "patches/**", "package/Kit.toml"]
|
||||
inputs = ["Prelinked kernel, hardware DTB, generated ADT, trust cache, Data seed, platform identity and firmware DTB."]
|
||||
configuration = ["Payload volume is 208 MiB. kernel.patch_series selects ARM64, SoC, OS and device series in order."]
|
||||
procedure = ["Build kernel and package, then payload with --unique-chip-id and the selected trust-cache/Data inputs.", "Run ./unixnu bootimg -D ../UniXNU-sheng --uefi ../uefi-sheng --dtb <firmware.dtb> and inspect the assembly report."]
|
||||
findings = ["The OS boot-progress integration follows the SoC hooks in patch order.", "The payload carries kernel.macho.adt; the boot image carries the firmware FDT. Keep the two inputs named explicitly."]
|
||||
completion = ["Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit."]
|
||||
limits = ["Image output depends on the selected ABI audits, firmware and volume policy inputs."]
|
||||
next_action = ["Attach artifact paths and exact source revisions to the next image build record."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "patches/xnu/series"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["scripts/check-*", "scripts/probe-*", "scripts/audit-*", "scripts/read-*", "scripts/prepare-*", "scripts/data/**", "package/tests/**", "package/*Tests*", "package/*Diagnostic*", "package/*Probe*", "package/Boot*", "package/linux-log/**", "unixnu.lock"]
|
||||
inputs = ["Serial or framebuffer diagnostics, panic region, boot checkpoints and a recovery path."]
|
||||
configuration = ["boot-progress=2 enables checkpoints; source and image revisions accompany every log."]
|
||||
procedure = ["Run the existing check for the changed area and keep its command, output and input revision.", "Record the last completed checkpoint and the first failing operation; link the captured output."]
|
||||
findings = ["A source implementation, a host check and a device observation establish different completion levels.", "Keep an unresolved cause explicit and record the next measurement that can distinguish it."]
|
||||
completion = ["Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result."]
|
||||
limits = ["Source references in this record describe implemented behavior. Host and device status require their respective evidence entries."]
|
||||
next_action = ["Add captured host or device evidence when repeating a checkpoint on a known image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
result = "Implementation and configuration described in this section"
|
||||
@@ -0,0 +1,260 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "sheng"
|
||||
soc = "SM8550"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Xiaomi Pad 6S Pro 12.4 uses shared SM8550 support and board-owned storage, input, firmware and power integration. This record describes implementation coverage and the evidence required for each milestone."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["board.toml", "feeds.toml", "configs/**", ".gitmodules", ".github/**", ".gitignore"]
|
||||
inputs = ["SM8550 profile, iPadOS 17.7.11 build 21H461, device defconfig, pinned component sources."]
|
||||
configuration = ["board.soc_source = sm8550; board.os_profile = ipados-17.7.11-21H461; schema_version = 2.", "The device owns ShengUfs, ShengHidInput, ShengNovatekTouch and ShengPreflight submodules."]
|
||||
procedure = ["Read https://unixnu.com/porting/device-repository and https://unixnu.com/porting/records.", "Run ./unixnu defconfig sheng_defconfig -D ../UniXNU-sheng from UniXNU.", "Run ./unixnu status --json -D ../UniXNU-sheng and review profiles, components, source pins and patch order."]
|
||||
findings = ["Tables merge in ARM64, SoC, OS, device order. Arrays replace inherited selections, so include every required component and fragment.", "The selected defconfig applies after the explicit configuration fragments. Keep OS ABI and IPSW pins in the OS profile."]
|
||||
completion = ["All source pins resolve; every selected component has a record; status shows the intended overrides and patch order."]
|
||||
limits = ["Local overrides can select a different source from the published pin; record the effective source in each verification result."]
|
||||
next_action = ["Compare the effective status output whenever a profile, source or component selection changes."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "implemented"
|
||||
components = ["ShengPreflight"]
|
||||
paths = ["proprietary-files.txt", "scripts/extract-files.py", "scripts/gen-touch-firmware.py"]
|
||||
inputs = ["uefi-sheng firmware, stock firmware DTB, GOP handoff, PSCI SMC interface and vendor firmware inventory."]
|
||||
configuration = ["firmware.dsc = Platforms/Xiaomi/shengPkg/sheng.dsc; firmware.config = sheng.", "proprietary-files.txt records input paths and provenance.", "The firmware DSC and FDF embed UniXNU, UniXNUDxe, DarwinBoot, UniXNURamDiskDxe, DiskIoDxe and FAT support."]
|
||||
procedure = ["Run ./unixnu build firmware -D ../UniXNU-sheng --uefi ../uefi-sheng.", "Record the firmware commit, output FD and handoff memory map before a boot attempt.", "Build the payload, then run ./unixnu bootimg with the firmware DTB. Inspect boot.json ramdisk_bytes and the required firmware modules."]
|
||||
findings = ["The firmware DTB is an input to boot-image assembly. XNU consumes the separately generated ADT.", "The sheng preflight component belongs with board integration and its firmware requirements.", "The shared UniXNURamDiskDxe reads the Mu-Silicium entry-argument HOB and FDT initrd range to publish the payload block device. ShengBootMemoryDxe owns memory expansion.", "Configured menu entries require a payload FAT filesystem containing EFI/UniXNU/unixnu.toml. Check the UNIXNURAMDISK initrd block-device status when entries are absent."]
|
||||
completion = ["Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations."]
|
||||
limits = ["Boot-image assembly requires the selected firmware DTB and proprietary input files."]
|
||||
next_action = ["Capture firmware revision and memory reservations with the next image verification."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "proprietary-files.txt"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "https://github.com/UniXNU/UniXNU/blob/8d157ee18ae9c4d518aba28cb3040a84e860dcd1/package/UniXNUPkg/Driver/UniXNURamDiskDxe/UniXNURamDiskDxe.c"
|
||||
result = "Shared FDT initrd block-device publication; board memory policy remains in uefi-sheng."
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "implemented"
|
||||
components = ["ArmCpu", "ArmDTPlatform"]
|
||||
paths = ["package/CpuFreq*", "scripts/*armcpu*"]
|
||||
inputs = ["SM8550 CPU affinities, GIC distributor at 0x17100000, redistributors at 0x17180000, 0x40000 stride and 19.2 MHz timer.", "PSCI uses SMC. The board disables cpu1 and cpu2 in its DTS."]
|
||||
configuration = ["dts/sheng.dts includes sm8550.dtsi; shared CPU and interrupt definitions come from the SoC source.", "Kernel arguments select sheng-smp=1 and armcpu-spi-ipi=1."]
|
||||
procedure = ["Compile the board DTS and inspect enabled CPUs, GIC ranges and timer properties in the ADT.", "Record per-CPU entry, timer interrupts and inter-processor interrupt delivery."]
|
||||
findings = ["CPU affinity values are hardware identifiers. Enabled CPU count and MPIDR affinities must be checked together.", "GIC register ranges must use translated physical addresses from the hardware tree."]
|
||||
completion = ["Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU."]
|
||||
limits = ["CPU selection and frequency policy are board inputs; SoC topology describes all cores."]
|
||||
next_action = ["Attach per-CPU and interrupt observations for the selected firmware and image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/sheng.dts"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["dts/**", "package/*Smmu*", "package/*Memory*", "scripts/*smmu*", "scripts/*memory*"]
|
||||
inputs = ["Handoff DRAM at 0x80000000 with size 0x80000000; splash reservation at 0xb8000000 with size 0x2b00000.", "Payload owned-memory request is 0x130000000. Device DMA requires controller stream IDs, address widths and ownership."]
|
||||
configuration = ["device_tree.source = device:dts/sheng.dts; include_dirs = [soc:dts].", "payload.adt.owned_memory_size and firmware reservations describe separate allocations."]
|
||||
procedure = ["Compare firmware RAM ranges, reserved regions, DTS ranges and ADT memory-map entries.", "Check DMA buffers against controller address width, cache policy and SMMU mapping before submitting work."]
|
||||
findings = ["Physical register translation and CPU virtual mappings have different purposes. Preserve physical resource ranges in hardware descriptions.", "GPU and UFS use different SMMU instances and stream assignments."]
|
||||
completion = ["All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy."]
|
||||
limits = ["The DTS declares the current handoff window and splash region; memory sizing requires the selected firmware map."]
|
||||
next_action = ["Record the firmware memory map and each DMA consumer when changing reserved memory."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/sheng.dts"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "implemented"
|
||||
components = ["ShengUfs", "VirtioMmioBlock", "RamBlock", "VerifiedRoot"]
|
||||
paths = ["drivers/ShengUfs", "scripts/*ufs*", "scripts/*storage*", "scripts/*userdata*", "scripts/*root*"]
|
||||
inputs = ["UFS host 0x01d84000/0x3000; PHY 0x01d80000/0x2000; GCC base 0x00100000.", "GCC AXI, AHB, UniPro, symbol and PHY auxiliary branches; power domains and firmware link state.", "Apps SMMU at 0x15000000, UFS stream 0x60, context-bank ownership, DMA width and cache maintenance.", "LUN 0 uses 4096-byte blocks; userdata spans LBAs 3094592 through 64007162."]
|
||||
configuration = ["Select ShengUfs and CONFIG_XNU_NATIVE_UFS=y; native-ufs-root=1 enables the root path.", "userdata defines OS and SystemOS windows. payload.adt.root_match_volume_uuid = 04769D26-2CA0-4825-B443-E2E5F88300F2."]
|
||||
procedure = ["Read https://unixnu.com/porting/ufs with this storage record.", "Inspect clock enables, power state, HCE/HCS, link state, request-list base and SMMU mappings before changing controller ownership.", "Validate SCSI capacity and GPT reads, then publish root windows and mount the configured root UUID.", "Verify persistent Data writes on the documented Data allocation with a recovery image available."]
|
||||
findings = ["An idle AHB branch may report CLK_OFF with hardware gating enabled. Check enable and gating bits together.", "SMMU bypass still has address-width constraints. Validate every DMA range and context-bank assignment.", "ShengUfs contains controller access, GPT/window parsing and sheng Data/log policy. Reuse each layer according to its inputs."]
|
||||
completion = ["Host: register, clock, link and SMMU facts match the board inventory.", "Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within userdata.", "Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region."]
|
||||
limits = ["The SoC DTSI exports host and PHY ranges. GCC and UFS SMMU handling currently use constants and operations in ShengUfs.", "The root transport uses a polled request slot. Its firmware adoption path requires a usable existing request list."]
|
||||
next_action = ["Record clock/PHY/reset initialization ownership and the SMMU stream before adapting this driver to another board."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "https://github.com/UniXNU/ShengUfs/blob/e2b32cc429e8cf1501161c1d8c517f8994ceb9b2/NativeUfs.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "implemented"
|
||||
components = ["GopFramebuffer"]
|
||||
paths = ["package/*Display*", "package/*Framebuffer*", "package/*Backlight*", "package/AppleARMBacklight.cpp", "package/GeniI2c*", "scripts/*display*", "scripts/*gop*", "scripts/*framebuffer*"]
|
||||
inputs = ["UEFI GOP framebuffer, stride, pixel format, splash reservation and board panel/backlight controls."]
|
||||
configuration = ["Select GopFramebuffer; CONFIG_XNU_NATIVE_LEGACY_DISPLAY=y; artwork-display-gamut = sRGB.", "sheng-vsync=120 requests board display timing."]
|
||||
procedure = ["Verify GOP address, dimensions, stride and pixel layout before enabling presentation.", "Build the late display archive with the selected OS ABI records, then check display publication and frame presentation."]
|
||||
findings = ["The display source and ABI binding are selected independently from the physical panel configuration.", "The board configuration declares sRGB for the current 8-bit framebuffer path.", "scripts/build-gop-legacy-display.py also builds the board driver objects in the display archive, including the ADSP, IPC router, FAT reader and battery manager."]
|
||||
completion = ["A known frame appears with correct geometry and colors, then userland presentation and backlight controls work."]
|
||||
limits = ["The late display builder needs qualified prelink candidates and ABI records. A timing request requires a measured presentation result."]
|
||||
next_action = ["Record frame timing, pixel format and presentation evidence for each image used to qualify display."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/LegacyDisplayProbe.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "implemented"
|
||||
components = ["ShengHidInput", "ShengNovatekTouch", "QcomGeniSpi"]
|
||||
paths = ["drivers/ShengHidInput", "drivers/ShengNovatekTouch", "package/*Touch*", "package/*Button*", "scripts/*touch*", "scripts/*hid*"]
|
||||
inputs = ["Novatek NT36532 sensor, GENI SPI controller, pin configuration, reset/interrupt lines, firmware and touch coordinate geometry."]
|
||||
configuration = ["Select ShengHidInput, ShengNovatekTouch and QcomGeniSpi; sheng-touch=4 and sheng-touch-hid=1 select board integration."]
|
||||
procedure = ["Read TouchBoard.h and verify the SPI clock and mode against the controller setup.", "Validate protocol reports, contact tracking and coordinate orientation before publishing HID events."]
|
||||
findings = ["Controller transfer logic, sensor protocol and board sensor geometry are separate inputs.", "Track contact IDs across movement and lift events; a register read alone covers only transport access."]
|
||||
completion = ["Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports."]
|
||||
limits = ["Sensor firmware and board dimensions remain sheng inputs."]
|
||||
next_action = ["Attach contact and orientation observations when firmware or geometry changes."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/TouchBoard.h"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "implemented"
|
||||
components = ["Adreno740", "AdrenoMetal", "AirNir", "Sm8550Platform", "AdrenoPM4", "AdrenoFirmware", "ArmSmmu4K"]
|
||||
paths = ["package/*Gpu*", "package/*Gmu*", "package/*Adreno*", "scripts/*adreno*", "scripts/*gpu*", "scripts/*metal*", "scripts/*turnip*", "scripts/*air*"]
|
||||
inputs = ["A740 GPU/GMU registers, GPU SMMU streams 0/1 and GMU stream 5, signed ZAP firmware and board power votes.", "Turnip, metal2vulkan, AIR translation and the selected OS GPU/Metal ABI."]
|
||||
configuration = ["Select Adreno740, AdrenoMetal and AirNir; shared SM8550 operations arrive through component dependencies.", "Board scripts combine shared GMU code with package/ShengGmuVotes.c."]
|
||||
procedure = ["Qualify power, firmware, SMMU and GMU startup before command submission.", "Check memory mapping, command completion and a known rendered image before staging the Metal plugin."]
|
||||
findings = ["GPU generation and the frontend ABI define component scope. Firmware, votes and display integration remain board inputs.", "Shared platform code and board votes require separate include paths during archive assembly."]
|
||||
completion = ["GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it."]
|
||||
limits = ["A740 coverage depends on the selected firmware and OS ABI; board qualification requires its own memory and power evidence."]
|
||||
next_action = ["Record the exact firmware, compiler inputs, driver revision and rendered output for the next qualification."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/build-adreno740-kits.py"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "implemented"
|
||||
components = ["Ath12kWifi"]
|
||||
paths = ["drivers/Ath12kWifi", "package/*Wifi*", "package/MhiBoot*", "scripts/*wifi*", "scripts/*mhi*"]
|
||||
inputs = ["Ath12k device on PCIe, BAR windows, MSI routing, DMA callbacks, firmware, MHI and QRTR services."]
|
||||
configuration = ["Select Ath12kWifi. build-gop-legacy-display.py compiles its objects through build-ath12k-wifi.py."]
|
||||
procedure = ["Verify PCIe enumeration and MSI delivery before MHI startup.", "Record firmware startup, scan, association, address configuration and bidirectional packet delivery separately."]
|
||||
findings = ["The reusable Wi-Fi stack consumes board callbacks; PCIe and the OS network interface are owned by the device integration.", "MHI startup and network traffic are separate completion points."]
|
||||
completion = ["Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware."]
|
||||
limits = ["The source implements the station path through WifiNet.cpp and board PCIe integration. Device evidence must identify the firmware and access point."]
|
||||
next_action = ["Attach association and receive/transmit observations for the current firmware and image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/WifiNet.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["package/*Adsp*", "package/*Audio*", "package/*Gpr*", "package/FatVolume*", "package/QcomGlink*", "package/QcomMdt*", "package/QcomQrtr*", "package/ShengQrtr*", "package/QcomSmem*", "package/QcomSmp2p*", "scripts/*adsp*", "scripts/*audio*", "scripts/*gpr*", "scripts/*modem-fw*", "scripts/*qrtr*"]
|
||||
inputs = ["ADSP firmware, SMEM, SMP2P, GLINK, GPR services, board codec and audio routing."]
|
||||
configuration = ["The board display archive includes ADSP and audio probe objects."]
|
||||
procedure = ["Check firmware loading and ADSP service readiness before configuring audio endpoints.", "Record route, format and playback/capture observations for each enabled endpoint."]
|
||||
findings = ["The ADSP image loads in place from the split adsp and adsp_dtb files in /image of the modem_a FAT volume (modem_b as fallback); sheng-adsp-fw=DIR reads adsp.mbn and adsp_dtb.mbn from DIR instead.", "The DSP reaches GLINK and opens the battery manager and IPCRTR channels. The IPC router answers the DSP's service locator requests.", "Firmware startup, service registration and audible playback require separate evidence.", "The GPR client and firmware loading helpers can be inspected independently from codec routing."]
|
||||
completion = ["Each declared route carries the selected audio format through playback or capture and handles start/stop correctly."]
|
||||
limits = ["Current source contains ADSP bring-up and audio framework probes. Endpoint playback qualification needs route-specific evidence."]
|
||||
next_action = ["Document the codec, clocks and endpoint routing before claiming playback completion."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/AudioProbe.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "implemented"
|
||||
components = ["AppleKeyStoreState"]
|
||||
paths = ["package/*Battery*", "package/*Battmgr*", "package/*Power*", "package/*PlatformPower*", "package/QcomQmp*", "package/QcomRpmh*", "package/QcomScm.h", "scripts/*power*", "scripts/*battery*", "scripts/*pmgr*"]
|
||||
inputs = ["Board PMGR integration, clocks/regulators and per-peripheral power requirements.", "ADSP battery manager: PMIC GLINK owner 32778 on PMIC_RTR_ADSP_APPS; board properties use opcode 0x50; fuel gauges 0x8a/0x8b and 0xa6/0xa7."]
|
||||
configuration = ["CONFIG_XNU_SHENG_PMGR=y; sheng-pmgr=2 selects the board integration.", "AppleKeyStoreState is selected with the OS event integration.", "sheng-adsp=2 sheng-battery=1 publish the battery as an IOPMPowerSource.", "sheng-usb-sdp-ma sets the input limit on a standard computer port (default 900; 0 keeps the firmware limit)."]
|
||||
procedure = ["Document each clock, regulator and firmware-owned state before enabling power transitions.", "Check battery units and update behavior separately from suspend/resume and peripheral power.", "Read the [battery], [battery-raw] and [charger] log lines with scripts/read-sheng-log.py."]
|
||||
findings = ["The ADSP firmware runs charging and PD/PPS negotiation without host requests.", "Battery properties after 11 are shifted by one: charge current 12, temperature 13, charge counter 15, cycles 16, design 17, full 18, time to full 20, time to empty 21.", "Charge is the sum of both fuel gauges' remaining over full capacity. Battery current is reported discharge-positive.", "USB property 6 reads SDP on every port. Property 7 carries the adapter type (6 PD, 8 PD PPS).", "A PPS adapter gets a 3 A input limit at about 8.7 V; the battery charges at the 2000 mA charge current with the charge pump off.", "Both cells and the PD adapter read unauthenticated.", "A Mac USB-C port negotiates PD 5 V with a 1.2 A input limit, below the load during boot.", "Power policy belongs to the board even when controller operations are shared."]
|
||||
completion = ["Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals."]
|
||||
limits = ["Adapter details shown to iOS come from USB property 6, so every adapter reads as a computer port.", "Charge current stays at 2 A without fuel gauge and adapter authentication.", "A low-battery shutdown panics in vnode_rele_ext during unmount.", "Per-peripheral controls and battery publication have separate coverage from system suspend."]
|
||||
next_action = ["Take adapter details from property 7.", "Authenticate both fuel gauges, then qualify PPS charge pump charging; Xiaomi adapter authentication follows."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/ShengBattery.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "scripts/check-battery-host.py"
|
||||
command = "python3 scripts/check-battery-host.py"
|
||||
revision = "8719a19294bc79eed72366a19070acfd8e131737"
|
||||
result = "PASS battery manager: 4074 checks"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot.img; python3 scripts/read-sheng-log.py --wait 240"
|
||||
revision = "8719a19294bc79eed72366a19070acfd8e131737"
|
||||
result = "PPS adapter: 8.72 V at 1.3 A in, battery +1.99 A, 1 to 3 percent in 3 minutes. Mac: PD 5 V, 1.2 A limit, battery -0.9 to -1.2 A. Temperature 31.4 to 32.9 C; full 9353 mAh, design 9800 mAh, 172 cycles."
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "implemented"
|
||||
components = ["DarwinBoot", "XnuPrelink", "SoftwareAES"]
|
||||
paths = ["scripts/*payload*", "scripts/*image*", "scripts/*flash*", "patches/**", "package/Kit.toml"]
|
||||
inputs = ["Prelinked kernel, hardware DTB, generated ADT, trust cache, Data seed, platform identity and firmware DTB."]
|
||||
configuration = ["Payload volume is 208 MiB. kernel.patch_series selects ARM64, SoC, OS and device series in order."]
|
||||
procedure = ["Build kernel and package, then payload with --unique-chip-id and the selected trust-cache/Data inputs.", "Run ./unixnu bootimg -D ../UniXNU-sheng --uefi ../uefi-sheng --dtb <firmware.dtb> and inspect the assembly report."]
|
||||
findings = ["The OS boot-progress integration follows the SoC hooks in patch order.", "The payload carries kernel.macho.adt; the boot image carries the firmware FDT. Keep the two inputs named explicitly."]
|
||||
completion = ["Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit."]
|
||||
limits = ["Image output depends on the selected ABI audits, firmware and volume policy inputs."]
|
||||
next_action = ["Attach artifact paths and exact source revisions to the next image build record."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "patches/xnu/series"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["scripts/check-*", "scripts/probe-*", "scripts/audit-*", "scripts/read-*", "scripts/prepare-*", "scripts/data/**", "package/tests/**", "package/*Tests*", "package/*Diagnostic*", "package/*Probe*", "package/Boot*", "package/linux-log/**", "unixnu.lock"]
|
||||
inputs = ["Serial or framebuffer diagnostics, panic region, boot checkpoints and a recovery path."]
|
||||
configuration = ["boot-progress=2 enables checkpoints; source and image revisions accompany every log."]
|
||||
procedure = ["Run the existing check for the changed area and keep its command, output and input revision.", "Record the last completed checkpoint and the first failing operation; link the captured output."]
|
||||
findings = ["A source implementation, a host check and a device observation establish different completion levels.", "Keep an unresolved cause explicit and record the next measurement that can distinguish it.", "The UFS log carries [adsp], [qrtr], [battery], [battery-raw] and [charger] lines for the DSP, the IPC router and the charger.", "Host checks for the ADSP path: check-adsp-host.py, check-modem-fw-host.py, check-qrtr-host.py and check-battery-host.py."]
|
||||
completion = ["Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result."]
|
||||
limits = ["Source references in this record describe implemented behavior. Host and device status require their respective evidence entries."]
|
||||
next_action = ["Add captured host or device evidence when repeating a checkpoint on a known image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
result = "Implementation and configuration described in this section"
|
||||
@@ -0,0 +1,288 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "sheng"
|
||||
soc = "SM8550"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Xiaomi Pad 6S Pro 12.4 uses shared SM8550 support and board-owned storage, input, firmware and power integration. This record describes implementation coverage and the evidence required for each milestone."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["board.toml", "feeds.toml", "configs/**", ".gitmodules", ".github/**", ".gitignore"]
|
||||
inputs = ["SM8550 profile, iPadOS 17.7.11 build 21H461, device defconfig, pinned component sources."]
|
||||
configuration = ["board.soc_source = sm8550; board.os_profile = ipados-17.7.11-21H461; schema_version = 2.", "The device owns ShengUfs, ShengHidInput, ShengNovatekTouch and ShengPreflight submodules."]
|
||||
procedure = ["Read https://unixnu.com/porting/device-repository and https://unixnu.com/porting/records.", "Run ./unixnu defconfig sheng_defconfig -D ../UniXNU-sheng from UniXNU.", "Run ./unixnu status --json -D ../UniXNU-sheng and review profiles, components, source pins and patch order."]
|
||||
findings = ["Tables merge in ARM64, SoC, OS, device order. Arrays replace inherited selections, so include every required component and fragment.", "The selected defconfig applies after the explicit configuration fragments. Keep OS ABI and IPSW pins in the OS profile.", "board.toml names the model J120AP, the Apple board of the iPadOS identity, and its kernel arguments enable Wi-Fi (sheng-wifi=5) and the CPU and GPU governors."]
|
||||
completion = ["All source pins resolve; every selected component has a record; status shows the intended overrides and patch order."]
|
||||
limits = ["Local overrides can select a different source from the published pin; record the effective source in each verification result."]
|
||||
next_action = ["Compare the effective status output whenever a profile, source or component selection changes."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "implemented"
|
||||
components = ["ShengPreflight"]
|
||||
paths = ["proprietary-files.txt", "scripts/extract-files.py", "scripts/gen-touch-firmware.py"]
|
||||
inputs = ["uefi-sheng firmware, stock firmware DTB, GOP handoff, PSCI SMC interface and vendor firmware inventory."]
|
||||
configuration = ["firmware.dsc = Platforms/Xiaomi/shengPkg/sheng.dsc; firmware.config = sheng.", "proprietary-files.txt records input paths and provenance.", "The firmware DSC and FDF embed UniXNU, UniXNUDxe, DarwinBoot, UniXNURamDiskDxe, DiskIoDxe and FAT support."]
|
||||
procedure = ["Run ./unixnu build firmware -D ../UniXNU-sheng --uefi ../uefi-sheng.", "Record the firmware commit, output FD and handoff memory map before a boot attempt.", "Build the payload, then run ./unixnu bootimg with the firmware DTB. Inspect boot.json ramdisk_bytes and the required firmware modules."]
|
||||
findings = ["The firmware DTB is an input to boot-image assembly. XNU consumes the separately generated ADT.", "The sheng preflight component belongs with board integration and its firmware requirements.", "The shared UniXNURamDiskDxe reads the Mu-Silicium entry-argument HOB and FDT initrd range to publish the payload block device. ShengBootMemoryDxe owns memory expansion.", "Configured menu entries require a payload FAT filesystem containing EFI/UniXNU/unixnu.toml. Check the UNIXNURAMDISK initrd block-device status when entries are absent."]
|
||||
completion = ["Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations."]
|
||||
limits = ["Boot-image assembly requires the selected firmware DTB and proprietary input files."]
|
||||
next_action = ["Capture firmware revision and memory reservations with the next image verification."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "proprietary-files.txt"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "https://github.com/UniXNU/UniXNU/blob/8d157ee18ae9c4d518aba28cb3040a84e860dcd1/package/UniXNUPkg/Driver/UniXNURamDiskDxe/UniXNURamDiskDxe.c"
|
||||
result = "Shared FDT initrd block-device publication; board memory policy remains in uefi-sheng."
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "implemented"
|
||||
components = ["ArmCpu", "ArmDTPlatform"]
|
||||
paths = ["package/CpuFreq*", "scripts/*armcpu*"]
|
||||
inputs = ["SM8550 CPU affinities, GIC distributor at 0x17100000, redistributors at 0x17180000, 0x40000 stride and 19.2 MHz timer.", "PSCI uses SMC. The board disables cpu1 and cpu2 in its DTS."]
|
||||
configuration = ["dts/sheng.dts includes sm8550.dtsi; shared CPU and interrupt definitions come from the SoC source.", "Kernel arguments select sheng-smp=1 and armcpu-spi-ipi=1."]
|
||||
procedure = ["Compile the board DTS and inspect enabled CPUs, GIC ranges and timer properties in the ADT.", "Record per-CPU entry, timer interrupts and inter-processor interrupt delivery."]
|
||||
findings = ["CPU affinity values are hardware identifiers. Enabled CPU count and MPIDR affinities must be checked together.", "GIC register ranges must use translated physical addresses from the hardware tree.", "XNU accepts work interval operations 6, 7 and 8 (interval start, update and finish) through patches/xnu/native-work-interval-instance.patch in UniXNU; without a performance controller they only succeed."]
|
||||
completion = ["Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU."]
|
||||
limits = ["CPU selection and frequency policy are board inputs; SoC topology describes all cores."]
|
||||
next_action = ["Attach per-CPU and interrupt observations for the selected firmware and image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/sheng.dts"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["dts/**", "package/*Smmu*", "package/*Memory*", "scripts/*smmu*", "scripts/*memory*"]
|
||||
inputs = ["Handoff DRAM at 0x80000000 with size 0x80000000; splash reservation at 0xb8000000 with size 0x2b00000.", "Payload owned-memory request is 0x130000000. Device DMA requires controller stream IDs, address widths and ownership."]
|
||||
configuration = ["device_tree.source = device:dts/sheng.dts; include_dirs = [soc:dts].", "payload.adt.owned_memory_size and firmware reservations describe separate allocations."]
|
||||
procedure = ["Compare firmware RAM ranges, reserved regions, DTS ranges and ADT memory-map entries.", "Check DMA buffers against controller address width, cache policy and SMMU mapping before submitting work."]
|
||||
findings = ["Physical register translation and CPU virtual mappings have different purposes. Preserve physical resource ranges in hardware descriptions.", "GPU and UFS use different SMMU instances and stream assignments."]
|
||||
completion = ["All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy."]
|
||||
limits = ["The DTS declares the current handoff window and splash region; memory sizing requires the selected firmware map."]
|
||||
next_action = ["Record the firmware memory map and each DMA consumer when changing reserved memory."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/sheng.dts"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "implemented"
|
||||
components = ["ShengUfs", "VirtioMmioBlock", "RamBlock", "VerifiedRoot"]
|
||||
paths = ["drivers/ShengUfs", "scripts/*ufs*", "scripts/*storage*", "scripts/*userdata*", "scripts/*root*"]
|
||||
inputs = ["UFS host 0x01d84000/0x3000; PHY 0x01d80000/0x2000; GCC base 0x00100000.", "GCC AXI, AHB, UniPro, symbol and PHY auxiliary branches; power domains and firmware link state.", "Apps SMMU at 0x15000000, UFS stream 0x60, context-bank ownership, DMA width and cache maintenance.", "LUN 0 uses 4096-byte blocks; userdata spans LBAs 3094592 through 64007162."]
|
||||
configuration = ["Select ShengUfs and CONFIG_XNU_NATIVE_UFS=y; native-ufs-root=1 enables the root path.", "userdata defines OS and SystemOS windows. payload.adt.root_match_volume_uuid = 04769D26-2CA0-4825-B443-E2E5F88300F2."]
|
||||
procedure = ["Read https://unixnu.com/porting/ufs with this storage record.", "Inspect clock enables, power state, HCE/HCS, link state, request-list base and SMMU mappings before changing controller ownership.", "Validate SCSI capacity and GPT reads, then publish root windows and mount the configured root UUID.", "Verify persistent Data writes on the documented Data allocation with a recovery image available."]
|
||||
findings = ["An idle AHB branch may report CLK_OFF with hardware gating enabled. Check enable and gating bits together.", "SMMU bypass still has address-width constraints. Validate every DMA range and context-bank assignment.", "ShengUfs contains controller access, GPT/window parsing and sheng Data/log policy. Reuse each layer according to its inputs."]
|
||||
completion = ["Host: register, clock, link and SMMU facts match the board inventory.", "Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within userdata.", "Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region."]
|
||||
limits = ["The SoC DTSI exports host and PHY ranges. GCC and UFS SMMU handling currently use constants and operations in ShengUfs.", "The root transport uses a polled request slot. Its firmware adoption path requires a usable existing request list."]
|
||||
next_action = ["Record clock/PHY/reset initialization ownership and the SMMU stream before adapting this driver to another board."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "https://github.com/UniXNU/ShengUfs/blob/e2b32cc429e8cf1501161c1d8c517f8994ceb9b2/NativeUfs.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "implemented"
|
||||
components = ["GopFramebuffer"]
|
||||
paths = ["package/*Display*", "package/*Framebuffer*", "package/*Backlight*", "package/AppleARMBacklight.cpp", "package/GeniI2c*", "scripts/*display*", "scripts/*gop*", "scripts/*framebuffer*"]
|
||||
inputs = ["UEFI GOP framebuffer, stride, pixel format, splash reservation and board panel/backlight controls."]
|
||||
configuration = ["Select GopFramebuffer; CONFIG_XNU_NATIVE_LEGACY_DISPLAY=y; artwork-display-gamut = sRGB.", "sheng-vsync=120 requests board display timing."]
|
||||
procedure = ["Verify GOP address, dimensions, stride and pixel layout before enabling presentation.", "Build the late display archive with the selected OS ABI records, then check display publication and frame presentation."]
|
||||
findings = ["The display source and ABI binding are selected independently from the physical panel configuration.", "The board configuration declares sRGB for the current 8-bit framebuffer path.", "scripts/build-gop-legacy-display.py also builds the board driver objects in the display archive, including the ADSP, IPC router, FAT reader and battery manager.", "The GENI I2C core also moves 1 to 8 byte writes and 1 to 4 byte reads (the audio amplifiers use 32-bit registers); the backlight keeps its 8-bit transfers."]
|
||||
completion = ["A known frame appears with correct geometry and colors, then userland presentation and backlight controls work."]
|
||||
limits = ["The late display builder needs qualified prelink candidates and ABI records. A timing request requires a measured presentation result."]
|
||||
next_action = ["Record frame timing, pixel format and presentation evidence for each image used to qualify display."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/LegacyDisplayProbe.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "implemented"
|
||||
components = ["ShengHidInput", "ShengNovatekTouch", "QcomGeniSpi"]
|
||||
paths = ["drivers/ShengHidInput", "drivers/ShengNovatekTouch", "package/*Touch*", "package/*Button*", "scripts/*touch*", "scripts/*hid*"]
|
||||
inputs = ["Novatek NT36532 sensor, GENI SPI controller, pin configuration, reset/interrupt lines, firmware and touch coordinate geometry."]
|
||||
configuration = ["Select ShengHidInput, ShengNovatekTouch and QcomGeniSpi; sheng-touch=4 and sheng-touch-hid=1 select board integration."]
|
||||
procedure = ["Read TouchBoard.h and verify the SPI clock and mode against the controller setup.", "Validate protocol reports, contact tracking and coordinate orientation before publishing HID events."]
|
||||
findings = ["Controller transfer logic, sensor protocol and board sensor geometry are separate inputs.", "Track contact IDs across movement and lift events; a register read alone covers only transport access.", "sheng_buttons_press() holds a button mask for a given time through the HID sink, for unattended tests (the audio lock sound test uses it)."]
|
||||
completion = ["Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports."]
|
||||
limits = ["Sensor firmware and board dimensions remain sheng inputs."]
|
||||
next_action = ["Attach contact and orientation observations when firmware or geometry changes."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/TouchBoard.h"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "implemented"
|
||||
components = ["Adreno740", "AdrenoMetal", "AirNir", "Sm8550Platform", "AdrenoPM4", "AdrenoFirmware", "ArmSmmu4K"]
|
||||
paths = ["package/*Gpu*", "package/*Gmu*", "package/*Adreno*", "scripts/*adreno*", "scripts/*gpu*", "scripts/*metal*", "scripts/*turnip*", "scripts/*air*"]
|
||||
inputs = ["A740 GPU/GMU registers, GPU SMMU streams 0/1 and GMU stream 5, signed ZAP firmware and board power votes.", "Turnip, metal2vulkan, AIR translation and the selected OS GPU/Metal ABI."]
|
||||
configuration = ["Select Adreno740, AdrenoMetal and AirNir; shared SM8550 operations arrive through component dependencies.", "Board scripts combine shared GMU code with package/ShengGmuVotes.c."]
|
||||
procedure = ["Qualify power, firmware, SMMU and GMU startup before command submission.", "Check memory mapping, command completion and a known rendered image before staging the Metal plugin."]
|
||||
findings = ["GPU generation and the frontend ABI define component scope. Firmware, votes and display integration remain board inputs.", "Shared platform code and board votes require separate include paths during archive assembly.", "A frame is one submission of up to 128 IBs (24 at most observed). WPTR writes check the GMU AHB fence status; none were dropped. Jobs take about 5 ms against the client's 1 ms waits, so the stall handler's write-pointer and TLB recovery runs on ordinary jobs: mapping-time TLB invalidation did not change it.", "The render server primes all 162 Metal libraries of the OS image while the desktop is idle (the PR log row). The payload carries the library list and a copy of the cryptex QuartzCore library. The idle desktop submits 6 command buffers per 250 ms at 120 Hz, so priming waits only above 8."]
|
||||
completion = ["GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it."]
|
||||
limits = ["A740 coverage depends on the selected firmware and OS ABI; board qualification requires its own memory and power evidence."]
|
||||
next_action = ["Record the exact firmware, compiler inputs, driver revision and rendered output for the next qualification."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/build-adreno740-kits.py"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "implemented"
|
||||
components = ["Ath12kWifi"]
|
||||
paths = ["drivers/Ath12kWifi", "package/*Wifi*", "package/MhiBoot*", "scripts/*wifi*", "scripts/*mhi*"]
|
||||
inputs = ["Ath12k device on PCIe, BAR windows, MSI routing, DMA callbacks, firmware, MHI and QRTR services."]
|
||||
configuration = ["Select Ath12kWifi. build-gop-legacy-display.py compiles its objects through build-ath12k-wifi.py.", "board.toml sets sheng-wifi=5 in the kernel arguments; WifiProbe and the UFS driver read it."]
|
||||
procedure = ["Verify PCIe enumeration and MSI delivery before MHI startup.", "Record firmware startup, scan, association, address configuration and bidirectional packet delivery separately."]
|
||||
findings = ["The reusable Wi-Fi stack consumes board callbacks; PCIe and the OS network interface are owned by the device integration.", "MHI startup and network traffic are separate completion points."]
|
||||
completion = ["Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware."]
|
||||
limits = ["The source implements the station path through WifiNet.cpp and board PCIe integration. Device evidence must identify the firmware and access point."]
|
||||
next_action = ["Attach association and receive/transmit observations for the current firmware and image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/WifiNet.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["package/*Adsp*", "package/*Audio*", "package/*Gpr*", "package/*Cs35l43*", "package/GeniI2c*", "package/FatVolume*", "package/QcomGlink*", "package/QcomMdt*", "package/QcomQrtr*", "package/ShengQrtr*", "package/QcomSmem*", "package/QcomSmp2p*", "package/tests/audioreach*", "package/tests/cs35l43*", "package/tests/geni_i2c*", "hal/**", "patches/xnu/zzyd-*", "scripts/*adsp*", "scripts/*audio*", "scripts/*gpr*", "scripts/*cs35l43*", "scripts/*geni*", "scripts/*modem-fw*", "scripts/*qrtr*"]
|
||||
inputs = ["ADSP firmware from modem_a, SMEM, SMP2P, GLINK, the GPR channel adsp_apps.", "Speakers: six CS35L43 amplifiers on QUP1 SE5 and QUP2 SE0 (I2C 0x40 to 0x42), shared reset gpio90, secondary MI2S (gpio121 to 124).", "Microphones: WCD938x codec on the TX SoundWire master (0x6d30000), reset gpio108, supply ldob15; TX and VA macros."]
|
||||
configuration = ["sheng-audio takes bits (sheng-adsp=2 is required): any nonzero value serves the audio service, 2 plays a 1.5 s 750 Hz test tone at boot, 4 brings up the microphone path and reads two seconds of capture, 8 runs the lock sound test.", "sheng-audio-pa moves the DSP period buffer (default 0xd0000000); sheng-audio-tone-ms and sheng-audio-atten set the tone.", "The payload addon carries hal/ShengAudio.driver under audio/; patches/xnu/zzyd-sheng-audio-addon-mount.patch mounts it over /System/Library/Audio/Plug-Ins/HAL. Its CDHash joins the owner trust cache."]
|
||||
procedure = ["Read the [audio], [amps], [audio-glink], [audio-buffer], [mic], [mic regs] and [mic capture] log lines with scripts/read-sheng-log.py.", "Read [audio-props], [audio-service], [audio-io], [audio-thread], [audio-clock], [audio-requests] and [audio-sync] for the iOS path: the plug-in's volume and peak, late and silent periods, write-ahead and read-behind, IO cycle intervals, clock skew, the audio server's IO thread scheduling and host clock, and the plug-in's last start and stop requests.", "Run scripts/check-audioreach-host.py, scripts/check-cs35l43-host.py and scripts/check-geni-i2c-host.py after changing the codecs."]
|
||||
findings = ["The ADSP image loads in place from the split adsp and adsp_dtb files in /image of the modem_a FAT volume.", "The DSP offers 24 intents of 128 bytes on adsp_apps and grants a 4 KiB one on request; the GLINK remote intent table keeps it.", "The amplifiers play ASP RX1 directly (DSP bypassed, no amplifier firmware): top three slot 0, bottom three slot 1, gain 18 dB, 16-bit I2S at 48 kHz from the SoC as clock master.", "The DSP takes buffers as a 32-bit address with the stream index (0x1001 & 0xf) in the upper word. The period buffer is low DRAM outside the kernel's window, mapped write-combined; the audio streams stay in SMMU pass-through.", "Programming a translating SMMU context for the audio streams resets the board; the hypervisor keeps those context banks.", "PRM commands go from the PRM port (2) and use PRM clock ids: the TX core clock is 0x30c. The macro and digital codec votes make the LPASS registers accessible.", "The VA macro gates the TX SoundWire master's clock on SM8550; with its gate and the TX macro's on, the link comes up and the codec enumerates as device 1.", "The primary microphone is AMIC3 on micbias 3 into ADC2, codec data port 1 channel 2, master port 2, TX decimator 0 from SWR_MIC1 and codec DMA TX3, mono 48 kHz.", "iOS sees the plug-in device only with the Thunderbolt transport type: VirtualAudio makes it a driver device with one output and one input port. Built-in devices need Apple port descriptions, and a USB device needs a location the audio server does not take from a plug-in.", "The plug-in and the service share one timeline anchored at boot on the 19.2 MHz host timer (400 ticks per frame, computed in 128-bit). Playback and capture rings hold 65536 frames; the service takes 480-frame periods and keeps four in flight.", "The DSP answers a playback buffer once it has copied it, so the steady lead is measured per run (about 1600 to 2000 frames) and the published lead is at least 300 ms.", "Capture answers carry a byte count and an offset; only those bytes are taken, and a short period is normal.", "CoreAudio takes the host clock to be 24 MHz (one constant behind AudioGetHostClockFrequency). The plug-in finds that constant and the service sets it to 19.2 MHz on its shared page; without it the audio server's IO cycles ran 25 percent long and playback and recording stuttered.", "The zero time stamps start at the frame IO starts on, every 65536 frames, with the raw clock algorithm. A period under the safety offset stops the audio server's IO.", "The audio server's IO thread runs with a time constraint (priority 97, period 409600 ticks, computation 204800)."]
|
||||
completion = ["Each declared route carries the selected audio format through playback or capture and handles start/stop correctly."]
|
||||
limits = ["Playback sounds harsh in places; no speaker equalization or protection runs."]
|
||||
next_action = ["Qualify iOS playback and capture across apps and routes, then add speaker equalization and protection."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/AudioProbe.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "scripts/check-audioreach-host.py"
|
||||
command = "python3 scripts/check-audioreach-host.py; python3 scripts/check-cs35l43-host.py; python3 scripts/check-geni-i2c-host.py"
|
||||
revision = "9e9971883be72b2fd76b8fb552367a9e4940aa63"
|
||||
result = "PASS audioreach: 182 checks; PASS cs35l43: 225 checks; PASS GENI I2C: 2169 checks"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot.img (sheng-adsp=2 sheng-audio=6); python3 scripts/read-sheng-log.py --wait 240"
|
||||
revision = "9e2e6de1e63d9493e841d51c6b41108e75c7d537"
|
||||
result = "Speaker test tone: DSP mapped the buffer, 155 periods sent and 151 returned, all six amplifiers PLL-locked with no error interrupts. WCD938x enumerated (manufacturer 0x0217, part 0x010d). Capture: 200 of 200 periods returned, 191328 bytes, 97 percent non-zero samples, peak 128 in a quiet room."
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot.img (sheng-adsp=2 sheng-audio=14); play music and record in Voice Memos; python3 scripts/read-sheng-log.py --wait 240"
|
||||
revision = "dea464ef093349dd746582691b0eaa3807fe1441"
|
||||
result = "Playback and recording smooth from the start. Host clock set to 19200000 Hz, IO thread period 409600 ticks. 4822 of 4843 IO cycles 15 to 25 ms apart. Write-ahead 16501 to 19638 frames, skew -474 to 1 frames, 0 late periods."
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "implemented"
|
||||
components = ["AppleKeyStoreState"]
|
||||
paths = ["package/*Battery*", "package/*Battmgr*", "package/*Power*", "package/*PlatformPower*", "package/QcomQmp*", "package/QcomRpmh*", "package/QcomScm.h", "scripts/*power*", "scripts/*battery*", "scripts/*pmgr*"]
|
||||
inputs = ["Board PMGR integration, clocks/regulators and per-peripheral power requirements.", "ADSP battery manager: PMIC GLINK owner 32778 on PMIC_RTR_ADSP_APPS; board properties use opcode 0x50; fuel gauges 0x8a/0x8b and 0xa6/0xa7."]
|
||||
configuration = ["CONFIG_XNU_SHENG_PMGR=y; sheng-pmgr=2 selects the board integration.", "AppleKeyStoreState is selected with the OS event integration.", "sheng-adsp=2 publishes the battery as an IOPMPowerSource; sheng-battery=0 leaves it off.", "sheng-usb-sdp-ma sets the input limit on a standard computer port (default 900; 0 keeps the firmware limit).", "sheng-cpufreq=4 scales the CPU domains with load (sheng-cpufreq-min sets a floor in MHz); sheng-cpufreq=3 fixes the highest non-turbo level.", "sheng-gpu-dcvs=1 scales the GPU clock with its busy time (sheng-gpu-dcvs-min sets the floor level, default 3); sheng-gpu-perf fixes a level instead."]
|
||||
procedure = ["Document each clock, regulator and firmware-owned state before enabling power transitions.", "Check battery units and update behavior separately from suspend/resume and peripheral power.", "Read the [battery], [battery-raw] and [charger] log lines with scripts/read-sheng-log.py."]
|
||||
findings = ["The ADSP firmware runs charging and PD/PPS negotiation without host requests.", "Battery properties after 11 are shifted by one: charge current 12, temperature 13, charge counter 15, cycles 16, design 17, full 18, time to full 20, time to empty 21.", "Charge is the sum of both fuel gauges' remaining over full capacity. Battery current is reported discharge-positive.", "USB property 6 reads SDP on every port. Property 7 carries the adapter type (6 PD, 8 PD PPS).", "A PPS adapter gets a 3 A input limit at about 8.7 V; the battery charges at the 2000 mA charge current with the charge pump off.", "Both cells and the PD adapter read unauthenticated.", "A Mac USB-C port negotiates PD 5 V with a 1.2 A input limit: about 1.1 A in, and the battery gains 0.25 to 0.4 A on the desktop.", "Power policy belongs to the board even when controller operations are shared.", "The GPU power probe hands the ring its register window without a GMU fence callback: only the GPU service checks fenced WPTR writes.", "The CPU governor reads each CPU idle time through patches/xnu/zzye-sheng-cpu-idle.patch. Domain 0 holds the parked boot core and stays at its top level.", "The GPU governor reads the GMU XO busy counter and votes over HFI with the level bandwidth."]
|
||||
completion = ["Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals."]
|
||||
limits = ["Adapter details shown to iOS come from USB property 6, so every adapter reads as a computer port.", "Charge current stays at 2 A without fuel gauge and adapter authentication.", "A low-battery shutdown panics in vnode_rele_ext during unmount.", "Per-peripheral controls and battery publication have separate coverage from system suspend.", "The GPU governor changes level several times a second and spends most busy time at 680 MHz; its effect on frame times is not measured."]
|
||||
next_action = ["Take adapter details from property 7.", "Authenticate both fuel gauges, then qualify PPS charge pump charging; Xiaomi adapter authentication follows."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/ShengBattery.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "scripts/check-battery-host.py"
|
||||
command = "python3 scripts/check-battery-host.py"
|
||||
revision = "8719a19294bc79eed72366a19070acfd8e131737"
|
||||
result = "PASS battery manager: 4074 checks"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot.img; python3 scripts/read-sheng-log.py --wait 240"
|
||||
revision = "8f5d921d7a3b71a20a97f551cad546dc8e2f3700"
|
||||
result = "PPS adapter: 8.72 V at 1.3 A in, battery +1.99 A, 1 to 3 percent in 3 minutes. Mac: PD 5 V at 1.1 A in (1.2 A limit), battery +0.25 to +0.4 A on the desktop, 20 to 21 percent. Temperature 31.4 to 32.9 C; full 9353 mAh, design 9800 mAh, 172 cycles."
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot.img (sheng-cpufreq=4 sheng-gpu-dcvs=1); python3 scripts/read-sheng-log.py --wait 240"
|
||||
revision = "a338c71a6f83809c84686b4996478f1c4cd3f3ab"
|
||||
result = "CPU: domain 1 between 499 and 2803 MHz, domain 2 between 595 and 2956 MHz, about 1.2 GHz and 620 MHz mean when idle. GPU: every vote accepted, 61 percent of the time at 680 MHz at 7 percent mean busy."
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "implemented"
|
||||
components = ["DarwinBoot", "XnuPrelink", "SoftwareAES"]
|
||||
paths = ["scripts/*payload*", "scripts/*image*", "scripts/*flash*", "patches/**", "package/Kit.toml"]
|
||||
inputs = ["Prelinked kernel, hardware DTB, generated ADT, trust cache, Data seed, platform identity and firmware DTB."]
|
||||
configuration = ["Payload volume is 208 MiB. kernel.patch_series selects ARM64, SoC, OS and device series in order."]
|
||||
procedure = ["Build kernel and package, then payload with --unique-chip-id and the selected trust-cache/Data inputs.", "Run ./unixnu bootimg -D ../UniXNU-sheng --uefi ../uefi-sheng --dtb <firmware.dtb> and inspect the assembly report."]
|
||||
findings = ["The OS boot-progress integration follows the SoC hooks in patch order.", "The payload carries kernel.macho.adt; the boot image carries the firmware FDT. Keep the two inputs named explicitly.", "The device patch series adds zzyd-sheng-audio-addon-mount.patch: the payload addon's audio directory is union-mounted over /System/Library/Audio/Plug-Ins/HAL (mount4 in the A log line)."]
|
||||
completion = ["Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit."]
|
||||
limits = ["Image output depends on the selected ABI audits, firmware and volume policy inputs."]
|
||||
next_action = ["Attach artifact paths and exact source revisions to the next image build record."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "patches/xnu/series"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["scripts/check-*", "scripts/probe-*", "scripts/audit-*", "scripts/read-*", "scripts/prepare-*", "scripts/data/**", "package/tests/**", "package/*Tests*", "package/*Diagnostic*", "package/*Probe*", "package/Boot*", "package/linux-log/**", "unixnu.lock"]
|
||||
inputs = ["Serial or framebuffer diagnostics, panic region, boot checkpoints and a recovery path."]
|
||||
configuration = ["boot-progress=2 enables checkpoints; source and image revisions accompany every log."]
|
||||
procedure = ["Run the existing check for the changed area and keep its command, output and input revision.", "Record the last completed checkpoint and the first failing operation; link the captured output."]
|
||||
findings = ["A source implementation, a host check and a device observation establish different completion levels.", "Keep an unresolved cause explicit and record the next measurement that can distinguish it.", "The UFS log carries [adsp], [qrtr], [battery], [battery-raw] and [charger] lines for the DSP, the IPC router and the charger.", "BatteryProbe starts the battery with sheng-adsp=2, so the [battery] and [charger] lines appear on every DSP image; a missing [battery] line on such an image means sheng-battery=0 or a failed start.", "Host checks for the ADSP path: check-adsp-host.py, check-modem-fw-host.py, check-qrtr-host.py and check-battery-host.py.", "The log carries [audio], [amps], [audio-glink], [audio-buffer], [mic] and [mic regs] for the audio path, and [gpu wptr] for fenced GPU write pointer writes."]
|
||||
completion = ["Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result."]
|
||||
limits = ["Source references in this record describe implemented behavior. Host and device status require their respective evidence entries."]
|
||||
next_action = ["Add captured host or device evidence when repeating a checkpoint on a known image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
result = "Implementation and configuration described in this section"
|
||||
@@ -0,0 +1,295 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "sheng"
|
||||
soc = "SM8550"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Xiaomi Pad 6S Pro 12.4 uses shared SM8550 support and board-owned storage, input, firmware and power integration. This record describes implementation coverage and the evidence required for each milestone."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["board.toml", "feeds.toml", "configs/**", ".gitmodules", ".github/**", ".gitignore"]
|
||||
inputs = ["SM8550 profile, iPadOS 17.7.11 build 21H461, device defconfig, pinned component sources."]
|
||||
configuration = ["board.soc_source = sm8550; board.os_profile = ipados-17.7.11-21H461; schema_version = 2.", "The device owns ShengUfs, ShengHidInput, ShengNovatekTouch and ShengPreflight submodules."]
|
||||
procedure = ["Read https://unixnu.com/porting/device-repository and https://unixnu.com/porting/records.", "Run ./unixnu defconfig sheng_defconfig -D ../UniXNU-sheng from UniXNU.", "Run ./unixnu status --json -D ../UniXNU-sheng and review profiles, components, source pins and patch order."]
|
||||
findings = ["Tables merge in ARM64, SoC, OS, device order. Arrays replace inherited selections, so include every required component and fragment.", "The selected defconfig applies after the explicit configuration fragments. Keep OS ABI and IPSW pins in the OS profile.", "board.toml names the model J120AP, the Apple board of the iPadOS identity, and its kernel arguments enable Wi-Fi (sheng-wifi=5) and the CPU and GPU governors."]
|
||||
completion = ["All source pins resolve; every selected component has a record; status shows the intended overrides and patch order."]
|
||||
limits = ["Local overrides can select a different source from the published pin; record the effective source in each verification result."]
|
||||
next_action = ["Compare the effective status output whenever a profile, source or component selection changes."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "board.toml"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "implemented"
|
||||
components = ["ShengPreflight"]
|
||||
paths = ["proprietary-files.txt", "scripts/extract-files.py", "scripts/gen-touch-firmware.py"]
|
||||
inputs = ["uefi-sheng firmware, stock firmware DTB, GOP handoff, PSCI SMC interface and vendor firmware inventory."]
|
||||
configuration = ["firmware.dsc = Platforms/Xiaomi/shengPkg/sheng.dsc; firmware.config = sheng.", "proprietary-files.txt records input paths and provenance.", "The firmware DSC and FDF embed UniXNU, UniXNUDxe, DarwinBoot, UniXNURamDiskDxe, DiskIoDxe and FAT support."]
|
||||
procedure = ["Run ./unixnu build firmware -D ../UniXNU-sheng --uefi ../uefi-sheng.", "Record the firmware commit, output FD and handoff memory map before a boot attempt.", "Build the payload, then run ./unixnu bootimg with the firmware DTB. Inspect boot.json ramdisk_bytes and the required firmware modules."]
|
||||
findings = ["The firmware DTB is an input to boot-image assembly. XNU consumes the separately generated ADT.", "The sheng preflight component belongs with board integration and its firmware requirements.", "The shared UniXNURamDiskDxe reads the Mu-Silicium entry-argument HOB and FDT initrd range to publish the payload block device. ShengBootMemoryDxe owns memory expansion.", "Configured menu entries require a payload FAT filesystem containing EFI/UniXNU/unixnu.toml. Check the UNIXNURAMDISK initrd block-device status when entries are absent."]
|
||||
completion = ["Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations."]
|
||||
limits = ["Boot-image assembly requires the selected firmware DTB and proprietary input files."]
|
||||
next_action = ["Capture firmware revision and memory reservations with the next image verification."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "proprietary-files.txt"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "https://github.com/UniXNU/UniXNU/blob/8d157ee18ae9c4d518aba28cb3040a84e860dcd1/package/UniXNUPkg/Driver/UniXNURamDiskDxe/UniXNURamDiskDxe.c"
|
||||
result = "Shared FDT initrd block-device publication; board memory policy remains in uefi-sheng."
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "implemented"
|
||||
components = ["ArmCpu", "ArmDTPlatform"]
|
||||
paths = ["package/CpuFreq*", "scripts/*armcpu*"]
|
||||
inputs = ["SM8550 CPU affinities, GIC distributor at 0x17100000, redistributors at 0x17180000, 0x40000 stride and 19.2 MHz timer.", "PSCI uses SMC. All eight CPUs are enabled; the DTS tags cpu0 to cpu2 (A510) as an E cluster and cpu3 to cpu7 as a P cluster with unixnu,cluster-type."]
|
||||
configuration = ["dts/sheng.dts includes sm8550.dtsi; shared CPU and interrupt definitions come from the SoC source.", "Kernel arguments select sheng-smp=1 and armcpu-spi-ipi=1."]
|
||||
procedure = ["Compile the board DTS and inspect enabled CPUs, GIC ranges and timer properties in the ADT.", "Record per-CPU entry, timer interrupts and inter-processor interrupt delivery."]
|
||||
findings = ["CPU affinity values are hardware identifiers. Enabled CPU count and MPIDR affinities must be checked together.", "GIC register ranges must use translated physical addresses from the hardware tree.", "XNU accepts work interval operations 6, 7 and 8 (interval start, update and finish) through patches/xnu/native-work-interval-instance.patch in UniXNU; without a performance controller they only succeed.", "patches/xnu/zzyf-sheng-amp.patch runs the Edge scheduler with the E and P clusters from the ADT; UI work stays on the P cluster and coreduetd is stopped."]
|
||||
completion = ["Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU."]
|
||||
limits = ["CPU selection and frequency policy are board inputs; SoC topology describes all cores."]
|
||||
next_action = ["Attach per-CPU and interrupt observations for the selected firmware and image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/sheng.dts"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["dts/**", "package/*Smmu*", "package/*Memory*", "scripts/*smmu*", "scripts/*memory*"]
|
||||
inputs = ["Handoff DRAM at 0x80000000 with size 0x80000000; splash reservation at 0xb8000000 with size 0x2b00000.", "Payload owned-memory request is 0x130000000. Device DMA requires controller stream IDs, address widths and ownership."]
|
||||
configuration = ["device_tree.source = device:dts/sheng.dts; include_dirs = [soc:dts].", "payload.adt.owned_memory_size and firmware reservations describe separate allocations."]
|
||||
procedure = ["Compare firmware RAM ranges, reserved regions, DTS ranges and ADT memory-map entries.", "Check DMA buffers against controller address width, cache policy and SMMU mapping before submitting work."]
|
||||
findings = ["Physical register translation and CPU virtual mappings have different purposes. Preserve physical resource ranges in hardware descriptions.", "GPU and UFS use different SMMU instances and stream assignments.", "The DTS carries each CPU's cluster type for the ADT (see the cpu area)."]
|
||||
completion = ["All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy."]
|
||||
limits = ["The DTS declares the current handoff window and splash region; memory sizing requires the selected firmware map."]
|
||||
next_action = ["Record the firmware memory map and each DMA consumer when changing reserved memory."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "dts/sheng.dts"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "implemented"
|
||||
components = ["ShengUfs", "VirtioMmioBlock", "RamBlock", "VerifiedRoot"]
|
||||
paths = ["drivers/ShengUfs", "scripts/*ufs*", "scripts/*storage*", "scripts/*userdata*", "scripts/*root*"]
|
||||
inputs = ["UFS host 0x01d84000/0x3000; PHY 0x01d80000/0x2000; GCC base 0x00100000.", "GCC AXI, AHB, UniPro, symbol and PHY auxiliary branches; power domains and firmware link state.", "Apps SMMU at 0x15000000, UFS stream 0x60, context-bank ownership, DMA width and cache maintenance.", "LUN 0 uses 4096-byte blocks; userdata spans LBAs 3094592 through 64007162."]
|
||||
configuration = ["Select ShengUfs and CONFIG_XNU_NATIVE_UFS=y; native-ufs-root=1 enables the root path.", "userdata defines OS and SystemOS windows. payload.adt.root_match_volume_uuid = 04769D26-2CA0-4825-B443-E2E5F88300F2."]
|
||||
procedure = ["Read https://unixnu.com/porting/ufs with this storage record.", "Inspect clock enables, power state, HCE/HCS, link state, request-list base and SMMU mappings before changing controller ownership.", "Validate SCSI capacity and GPT reads, then publish root windows and mount the configured root UUID.", "Verify persistent Data writes on the documented Data allocation with a recovery image available."]
|
||||
findings = ["ShengUfs also owns the apps SMMU stage 1 windows for the display bank (sheng-dpu-scanout) and the WiFi endpoint (sheng-wifi=2 or more); both are off by default.", "An idle AHB branch may report CLK_OFF with hardware gating enabled. Check enable and gating bits together.", "SMMU bypass still has address-width constraints. Validate every DMA range and context-bank assignment.", "ShengUfs contains controller access, GPT/window parsing and sheng Data/log policy. Reuse each layer according to its inputs."]
|
||||
completion = ["Host: register, clock, link and SMMU facts match the board inventory.", "Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within userdata.", "Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region."]
|
||||
limits = ["The SoC DTSI exports host and PHY ranges. GCC and UFS SMMU handling currently use constants and operations in ShengUfs.", "The root transport uses a polled request slot. Its firmware adoption path requires a usable existing request list."]
|
||||
next_action = ["Record clock/PHY/reset initialization ownership and the SMMU stream before adapting this driver to another board."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "https://github.com/UniXNU/ShengUfs/blob/e2b32cc429e8cf1501161c1d8c517f8994ceb9b2/NativeUfs.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "implemented"
|
||||
components = ["GopFramebuffer"]
|
||||
paths = ["package/*Display*", "package/*Framebuffer*", "package/*Backlight*", "package/AppleARMBacklight.cpp", "package/GeniI2c*", "scripts/*display*", "scripts/*gop*", "scripts/*framebuffer*"]
|
||||
inputs = ["UEFI GOP framebuffer, stride, pixel format, splash reservation and board panel/backlight controls."]
|
||||
configuration = ["Select GopFramebuffer; CONFIG_XNU_NATIVE_LEGACY_DISPLAY=y; artwork-display-gamut = sRGB.", "sheng-vsync=120 requests board display timing.", "sheng-dpu-scanout=2 lets the display pipes fetch the compositor surface through a stage 1 window of the display bank; off by default."]
|
||||
procedure = ["Verify GOP address, dimensions, stride and pixel layout before enabling presentation.", "Build the late display archive with the selected OS ABI records, then check display publication and frame presentation."]
|
||||
findings = ["The display source and ABI binding are selected independently from the physical panel configuration.", "The board configuration declares sRGB for the current 8-bit framebuffer path.", "scripts/build-gop-legacy-display.py also builds the board driver objects in the display archive, including the ADSP, IPC router, FAT reader and battery manager.", "With sheng-dpu=2 DisplayTimingProbe reads the VIG 0 and 1 pipes, CTL 0 and the tear checks; sheng-dpu=3 also rewrites the pipe addresses and times the flush latch (5.4 ms, no start needed: the panel refreshes by itself).", "The GENI I2C core also moves 1 to 8 byte writes and 1 to 4 byte reads (the audio amplifiers use 32-bit registers); the backlight keeps its 8-bit transfers."]
|
||||
completion = ["A known frame appears with correct geometry and colors, then userland presentation and backlight controls work."]
|
||||
limits = ["The late display builder needs qualified prelink candidates and ABI records. A timing request requires a measured presentation result."]
|
||||
next_action = ["Record frame timing, pixel format and presentation evidence for each image used to qualify display."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/LegacyDisplayProbe.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "implemented"
|
||||
components = ["ShengHidInput", "ShengNovatekTouch", "QcomGeniSpi"]
|
||||
paths = ["drivers/ShengHidInput", "drivers/ShengNovatekTouch", "package/*Touch*", "package/*Button*", "scripts/*touch*", "scripts/*hid*"]
|
||||
inputs = ["Novatek NT36532 sensor, GENI SPI controller, pin configuration, reset/interrupt lines, firmware and touch coordinate geometry."]
|
||||
configuration = ["Select ShengHidInput, ShengNovatekTouch and QcomGeniSpi; sheng-touch=4 and sheng-touch-hid=1 select board integration."]
|
||||
procedure = ["Read TouchBoard.h and verify the SPI clock and mode against the controller setup.", "Validate protocol reports, contact tracking and coordinate orientation before publishing HID events."]
|
||||
findings = ["Controller transfer logic, sensor protocol and board sensor geometry are separate inputs.", "Track contact IDs across movement and lift events; a register read alone covers only transport access.", "sheng_buttons_press() holds a button mask for a given time through the HID sink, for unattended tests (the audio lock sound test uses it)."]
|
||||
completion = ["Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports."]
|
||||
limits = ["Sensor firmware and board dimensions remain sheng inputs."]
|
||||
next_action = ["Attach contact and orientation observations when firmware or geometry changes."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/TouchBoard.h"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "implemented"
|
||||
components = ["Adreno740", "AdrenoMetal", "AirNir", "Sm8550Platform", "AdrenoPM4", "AdrenoFirmware", "ArmSmmu4K"]
|
||||
paths = ["package/*Gpu*", "package/*Gmu*", "package/*Adreno*", "scripts/*adreno*", "scripts/*gpu*", "scripts/*metal*", "scripts/*turnip*", "scripts/*air*"]
|
||||
inputs = ["A740 GPU/GMU registers, GPU SMMU streams 0/1 and GMU stream 5, signed ZAP firmware and board power votes.", "Turnip, metal2vulkan, AIR translation and the selected OS GPU/Metal ABI."]
|
||||
configuration = ["Select Adreno740, AdrenoMetal and AirNir; shared SM8550 operations arrive through component dependencies.", "Board scripts combine shared GMU code with package/ShengGmuVotes.c."]
|
||||
procedure = ["Qualify power, firmware, SMMU and GMU startup before command submission.", "Check memory mapping, command completion and a known rendered image before staging the Metal plugin."]
|
||||
findings = ["GPU generation and the frontend ABI define component scope. Firmware, votes and display integration remain board inputs.", "Shared platform code and board votes require separate include paths during archive assembly.", "A frame is one submission of up to 128 IBs (24 at most observed). WPTR writes check the GMU AHB fence status; none were dropped. Jobs take about 5 ms against the client's 1 ms waits, so the stall handler's write-pointer and TLB recovery runs on ordinary jobs: mapping-time TLB invalidation did not change it.", "The render server primes all 162 Metal libraries of the OS image while the desktop is idle (the PR log row). The payload carries the library list and a copy of the cryptex QuartzCore library. The idle desktop submits 6 command buffers per 250 ms at 120 Hz, so priming waits only above 8.", "Each client holds up to 16384 objects. Owned BOs and imports that share one cache class and overlap no owned page map without the alias check against existing ranges; an unmap of up to 512 pages invalidates page by page; a submission no longer invalidates the GPU TLB.", "A render pass the bridge cannot encode returns a refusing encoder, not nil: WidgetRenderer crashed at PC 0 on the nil and lost its device after 8 crashes (Apple TV widget drawn wrong)."]
|
||||
completion = ["GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it."]
|
||||
limits = ["A740 coverage depends on the selected firmware and OS ABI; board qualification requires its own memory and power evidence."]
|
||||
next_action = ["Record the exact firmware, compiler inputs, driver revision and rendered output for the next qualification."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/build-adreno740-kits.py"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot-i570.img; python3 scripts/read-sheng-log.py"
|
||||
revision = "eb026be0b22dff2a32f9a161a5547657122276c0"
|
||||
result = "325 BO maps at 0.20 ms each (0.66 ms in i568), 1024 MiB pool with 0 fallbacks, WidgetRenderer reported a refused command buffer and did not crash; 130 fps idle, delay 4.9 ms mean, 14 ms max."
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "implemented"
|
||||
components = ["Ath12kWifi"]
|
||||
paths = ["drivers/Ath12kWifi", "package/*Wifi*", "package/MhiBoot*", "scripts/*wifi*", "scripts/*mhi*"]
|
||||
inputs = ["Ath12k device on PCIe, BAR windows, MSI routing, DMA callbacks, firmware, MHI and QRTR services."]
|
||||
configuration = ["Select Ath12kWifi. build-gop-legacy-display.py compiles its objects through build-ath12k-wifi.py.", "board.toml sets sheng-wifi=5 in the kernel arguments; WifiProbe and the UFS driver read it."]
|
||||
procedure = ["Verify PCIe enumeration and MSI delivery before MHI startup.", "Record firmware startup, scan, association, address configuration and bidirectional packet delivery separately."]
|
||||
findings = ["The reusable Wi-Fi stack consumes board callbacks; PCIe and the OS network interface are owned by the device integration.", "MHI startup and network traffic are separate completion points."]
|
||||
completion = ["Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware."]
|
||||
limits = ["The source implements the station path through WifiNet.cpp and board PCIe integration. Device evidence must identify the firmware and access point."]
|
||||
next_action = ["Attach association and receive/transmit observations for the current firmware and image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/WifiNet.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["package/*Adsp*", "package/*Audio*", "package/*Gpr*", "package/*Cs35l43*", "package/GeniI2c*", "package/FatVolume*", "package/QcomGlink*", "package/QcomMdt*", "package/QcomQrtr*", "package/ShengQrtr*", "package/QcomSmem*", "package/QcomSmp2p*", "package/tests/audioreach*", "package/tests/cs35l43*", "package/tests/geni_i2c*", "hal/**", "patches/xnu/zzyd-*", "scripts/*adsp*", "scripts/*audio*", "scripts/*gpr*", "scripts/*cs35l43*", "scripts/*geni*", "scripts/*modem-fw*", "scripts/*qrtr*"]
|
||||
inputs = ["ADSP firmware from modem_a, SMEM, SMP2P, GLINK, the GPR channel adsp_apps.", "Speakers: six CS35L43 amplifiers on QUP1 SE5 and QUP2 SE0 (I2C 0x40 to 0x42), shared reset gpio90, secondary MI2S (gpio121 to 124).", "Microphones: WCD938x codec on the TX SoundWire master (0x6d30000), reset gpio108, supply ldob15; TX and VA macros."]
|
||||
configuration = ["sheng-audio takes bits (sheng-adsp=2 is required): any nonzero value serves the audio service, 2 plays a 1.5 s 750 Hz test tone at boot, 4 brings up the microphone path and reads two seconds of capture, 8 runs the lock sound test.", "sheng-audio-pa moves the DSP period buffer (default 0xd0000000); sheng-audio-tone-ms and sheng-audio-atten set the tone.", "The payload addon carries hal/ShengAudio.driver under audio/; patches/xnu/zzyd-sheng-audio-addon-mount.patch mounts it over /System/Library/Audio/Plug-Ins/HAL. Its CDHash joins the owner trust cache."]
|
||||
procedure = ["Read the [audio], [amps], [audio-glink], [audio-buffer], [mic], [mic regs] and [mic capture] log lines with scripts/read-sheng-log.py.", "Read [audio-props], [audio-service], [audio-io], [audio-thread], [audio-clock], [audio-requests] and [audio-sync] for the iOS path: the plug-in's volume and peak, late and silent periods, write-ahead and read-behind, IO cycle intervals, clock skew, the audio server's IO thread scheduling and host clock, and the plug-in's last start and stop requests.", "Run scripts/check-audioreach-host.py, scripts/check-cs35l43-host.py and scripts/check-geni-i2c-host.py after changing the codecs."]
|
||||
findings = ["The ADSP image loads in place from the split adsp and adsp_dtb files in /image of the modem_a FAT volume.", "The DSP offers 24 intents of 128 bytes on adsp_apps and grants a 4 KiB one on request; the GLINK remote intent table keeps it.", "The amplifiers play ASP RX1 directly (DSP bypassed, no amplifier firmware): top three slot 0, bottom three slot 1, gain 18 dB, 16-bit I2S at 48 kHz from the SoC as clock master.", "The DSP takes buffers as a 32-bit address with the stream index (0x1001 & 0xf) in the upper word. The period buffer is low DRAM outside the kernel's window, mapped write-combined; the audio streams stay in SMMU pass-through.", "Programming a translating SMMU context for the audio streams resets the board; the hypervisor keeps those context banks.", "PRM commands go from the PRM port (2) and use PRM clock ids: the TX core clock is 0x30c. The macro and digital codec votes make the LPASS registers accessible.", "The VA macro gates the TX SoundWire master's clock on SM8550; with its gate and the TX macro's on, the link comes up and the codec enumerates as device 1.", "The primary microphone is AMIC3 on micbias 3 into ADC2, codec data port 1 channel 2, master port 2, TX decimator 0 from SWR_MIC1 and codec DMA TX3, mono 48 kHz.", "iOS sees the plug-in device only with the Thunderbolt transport type: VirtualAudio makes it a driver device with one output and one input port. Built-in devices need Apple port descriptions, and a USB device needs a location the audio server does not take from a plug-in.", "The plug-in and the service share one timeline anchored at boot on the 19.2 MHz host timer (400 ticks per frame, computed in 128-bit). Playback and capture rings hold 65536 frames; the service takes 480-frame periods and keeps four in flight.", "The DSP answers a playback buffer once it has copied it, so the steady lead is measured per run (about 1600 to 2000 frames) and the published lead is at least 300 ms.", "Capture answers carry a byte count and an offset; only those bytes are taken, and a short period is normal.", "CoreAudio takes the host clock to be 24 MHz (one constant behind AudioGetHostClockFrequency). The plug-in finds that constant and the service sets it to 19.2 MHz on its shared page; without it the audio server's IO cycles ran 25 percent long and playback and recording stuttered.", "The zero time stamps start at the frame IO starts on, every 65536 frames, with the raw clock algorithm. A period under the safety offset stops the audio server's IO.", "The audio server's IO thread runs with a time constraint (priority 97, period 409600 ticks, computation 204800)."]
|
||||
completion = ["Each declared route carries the selected audio format through playback or capture and handles start/stop correctly."]
|
||||
limits = ["Playback sounds harsh in places; no speaker equalization or protection runs."]
|
||||
next_action = ["Qualify iOS playback and capture across apps and routes, then add speaker equalization and protection."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/AudioProbe.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "scripts/check-audioreach-host.py"
|
||||
command = "python3 scripts/check-audioreach-host.py; python3 scripts/check-cs35l43-host.py; python3 scripts/check-geni-i2c-host.py"
|
||||
revision = "9e9971883be72b2fd76b8fb552367a9e4940aa63"
|
||||
result = "PASS audioreach: 182 checks; PASS cs35l43: 225 checks; PASS GENI I2C: 2169 checks"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot.img (sheng-adsp=2 sheng-audio=6); python3 scripts/read-sheng-log.py --wait 240"
|
||||
revision = "9e2e6de1e63d9493e841d51c6b41108e75c7d537"
|
||||
result = "Speaker test tone: DSP mapped the buffer, 155 periods sent and 151 returned, all six amplifiers PLL-locked with no error interrupts. WCD938x enumerated (manufacturer 0x0217, part 0x010d). Capture: 200 of 200 periods returned, 191328 bytes, 97 percent non-zero samples, peak 128 in a quiet room."
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot.img (sheng-adsp=2 sheng-audio=14); play music and record in Voice Memos; python3 scripts/read-sheng-log.py --wait 240"
|
||||
revision = "dea464ef093349dd746582691b0eaa3807fe1441"
|
||||
result = "Playback and recording smooth from the start. Host clock set to 19200000 Hz, IO thread period 409600 ticks. 4822 of 4843 IO cycles 15 to 25 ms apart. Write-ahead 16501 to 19638 frames, skew -474 to 1 frames, 0 late periods."
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "implemented"
|
||||
components = ["AppleKeyStoreState"]
|
||||
paths = ["package/*Battery*", "package/*Battmgr*", "package/*Power*", "package/*PlatformPower*", "package/QcomQmp*", "package/QcomRpmh*", "package/QcomScm.h", "scripts/*power*", "scripts/*battery*", "scripts/*pmgr*"]
|
||||
inputs = ["Board PMGR integration, clocks/regulators and per-peripheral power requirements.", "ADSP battery manager: PMIC GLINK owner 32778 on PMIC_RTR_ADSP_APPS; board properties use opcode 0x50; fuel gauges 0x8a/0x8b and 0xa6/0xa7."]
|
||||
configuration = ["CONFIG_XNU_SHENG_PMGR=y; sheng-pmgr=2 selects the board integration.", "AppleKeyStoreState is selected with the OS event integration.", "sheng-adsp=2 publishes the battery as an IOPMPowerSource; sheng-battery=0 leaves it off.", "sheng-usb-sdp-ma sets the input limit on a standard computer port (default 900; 0 keeps the firmware limit).", "sheng-cpufreq=4 scales the CPU domains with load (sheng-cpufreq-min sets a floor in MHz); sheng-cpufreq=3 fixes the highest non-turbo level.", "sheng-gpu-dcvs=1 scales the GPU clock with its busy time (sheng-gpu-dcvs-min sets the floor level, default 3); sheng-gpu-perf fixes a level instead."]
|
||||
procedure = ["Document each clock, regulator and firmware-owned state before enabling power transitions.", "Check battery units and update behavior separately from suspend/resume and peripheral power.", "Read the [battery], [battery-raw] and [charger] log lines with scripts/read-sheng-log.py."]
|
||||
findings = ["The ADSP firmware runs charging and PD/PPS negotiation without host requests.", "Battery properties after 11 are shifted by one: charge current 12, temperature 13, charge counter 15, cycles 16, design 17, full 18, time to full 20, time to empty 21.", "Charge is the sum of both fuel gauges' remaining over full capacity. Battery current is reported discharge-positive.", "USB property 6 reads SDP on every port. Property 7 carries the adapter type (6 PD, 8 PD PPS).", "A PPS adapter gets a 3 A input limit at about 8.7 V; the battery charges at the 2000 mA charge current with the charge pump off.", "Both cells and the PD adapter read unauthenticated.", "A Mac USB-C port negotiates PD 5 V with a 1.2 A input limit: about 1.1 A in, and the battery gains 0.25 to 0.4 A on the desktop.", "Power policy belongs to the board even when controller operations are shared.", "The GPU power probe hands the ring its register window without a GMU fence callback: only the GPU service checks fenced WPTR writes.", "The CPU governor reads each CPU idle time through patches/xnu/zzye-sheng-cpu-idle.patch. Domain 0, the E cluster, scales with load like the other domains.", "The GPU governor reads the GMU XO busy counter and votes over HFI with the level bandwidth.", "A touch holds the P CPU domains and the GPU at their top level for sheng-cpufreq-boost-ms and sheng-gpu-dcvs-boost-ms (1000) after the last report. GPU submits in 2 of 4 windows keep every CPU domain at 60 percent of its top for 300 ms. A fence waiter sleeps up to sheng-gpu-pause-us (1000) and the fence interrupt wakes it."]
|
||||
completion = ["Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals."]
|
||||
limits = ["Adapter details shown to iOS come from USB property 6, so every adapter reads as a computer port.", "Charge current stays at 2 A without fuel gauge and adapter authentication.", "A low-battery shutdown panics in vnode_rele_ext during unmount.", "Per-peripheral controls and battery publication have separate coverage from system suspend.", "The GPU governor changes level several times a second and spends most busy time at 680 MHz; its effect on frame times is not measured."]
|
||||
next_action = ["Take adapter details from property 7.", "Authenticate both fuel gauges, then qualify PPS charge pump charging; Xiaomi adapter authentication follows."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "package/ShengBattery.cpp"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "host"
|
||||
reference = "scripts/check-battery-host.py"
|
||||
command = "python3 scripts/check-battery-host.py"
|
||||
revision = "8719a19294bc79eed72366a19070acfd8e131737"
|
||||
result = "PASS battery manager: 4074 checks"
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot.img; python3 scripts/read-sheng-log.py --wait 240"
|
||||
revision = "8f5d921d7a3b71a20a97f551cad546dc8e2f3700"
|
||||
result = "PPS adapter: 8.72 V at 1.3 A in, battery +1.99 A, 1 to 3 percent in 3 minutes. Mac: PD 5 V at 1.1 A in (1.2 A limit), battery +0.25 to +0.4 A on the desktop, 20 to 21 percent. Temperature 31.4 to 32.9 C; full 9353 mAh, design 9800 mAh, 172 cycles."
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "device"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
command = "fastboot boot boot.img (sheng-cpufreq=4 sheng-gpu-dcvs=1); python3 scripts/read-sheng-log.py --wait 240"
|
||||
revision = "a338c71a6f83809c84686b4996478f1c4cd3f3ab"
|
||||
result = "CPU: domain 1 between 499 and 2803 MHz, domain 2 between 595 and 2956 MHz, about 1.2 GHz and 620 MHz mean when idle. GPU: every vote accepted, 61 percent of the time at 680 MHz at 7 percent mean busy."
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "implemented"
|
||||
components = ["DarwinBoot", "XnuPrelink", "SoftwareAES"]
|
||||
paths = ["scripts/*payload*", "scripts/*image*", "scripts/*flash*", "patches/**", "package/Kit.toml"]
|
||||
inputs = ["Prelinked kernel, hardware DTB, generated ADT, trust cache, Data seed, platform identity and firmware DTB."]
|
||||
configuration = ["Payload volume is 208 MiB. kernel.patch_series selects ARM64, SoC, OS and device series in order."]
|
||||
procedure = ["Build kernel and package, then payload with --unique-chip-id and the selected trust-cache/Data inputs.", "Run ./unixnu bootimg -D ../UniXNU-sheng --uefi ../uefi-sheng --dtb <firmware.dtb> and inspect the assembly report."]
|
||||
findings = ["The OS boot-progress integration follows the SoC hooks in patch order.", "The payload carries kernel.macho.adt; the boot image carries the firmware FDT. Keep the two inputs named explicitly.", "The device patch series adds zzyd-sheng-audio-addon-mount.patch: the payload addon's audio directory is union-mounted over /System/Library/Audio/Plug-Ins/HAL (mount4 in the A log line).", "zzyf-sheng-amp.patch follows it: the AMP Edge scheduler for the E and P clusters (see the cpu area)."]
|
||||
completion = ["Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit."]
|
||||
limits = ["Image output depends on the selected ABI audits, firmware and volume policy inputs."]
|
||||
next_action = ["Attach artifact paths and exact source revisions to the next image build record."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "patches/xnu/series"
|
||||
result = "Implementation and configuration described in this section"
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["scripts/check-*", "scripts/probe-*", "scripts/audit-*", "scripts/read-*", "scripts/prepare-*", "scripts/data/**", "package/tests/**", "package/*Tests*", "package/*Diagnostic*", "package/*Probe*", "package/Boot*", "package/linux-log/**", "unixnu.lock"]
|
||||
inputs = ["Serial or framebuffer diagnostics, panic region, boot checkpoints and a recovery path."]
|
||||
configuration = ["boot-progress=2 enables checkpoints; source and image revisions accompany every log."]
|
||||
procedure = ["Run the existing check for the changed area and keep its command, output and input revision.", "Record the last completed checkpoint and the first failing operation; link the captured output."]
|
||||
findings = ["A source implementation, a host check and a device observation establish different completion levels.", "Keep an unresolved cause explicit and record the next measurement that can distinguish it.", "The UFS log carries [adsp], [qrtr], [battery], [battery-raw] and [charger] lines for the DSP, the IPC router and the charger.", "BatteryProbe starts the battery with sheng-adsp=2, so the [battery] and [charger] lines appear on every DSP image; a missing [battery] line on such an image means sheng-battery=0 or a failed start.", "Host checks for the ADSP path: check-adsp-host.py, check-modem-fw-host.py, check-qrtr-host.py and check-battery-host.py.", "The log carries [audio], [amps], [audio-glink], [audio-buffer], [mic] and [mic regs] for the audio path, and [gpu wptr] for fenced GPU write pointer writes.", "GPU memory rows: [vm map], [vm unmap], [vm kinds] (time per owned map, fast and full import, unmap by page and by ASID) and [bo pool]. Governor rows: [cpu gov] with boost and frame-floor counts, [cpu throttle] and [gpu dcvs] with touch and wake boosts. Display rows (sheng-dpu=2 or 3, sheng-dpu-scanout): [dpu vig0], [dpu vig1], [dpu ctl0], [swap surfaces], [direct scanout] and [dpu smmu]."]
|
||||
completion = ["Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result."]
|
||||
limits = ["Source references in this record describe implemented behavior. Host and device status require their respective evidence entries."]
|
||||
next_action = ["Add captured host or device evidence when repeating a checkpoint on a known image."]
|
||||
|
||||
[[area.evidence]]
|
||||
kind = "source"
|
||||
reference = "scripts/read-sheng-log.py"
|
||||
result = "Implementation and configuration described in this section"
|
||||
@@ -0,0 +1,448 @@
|
||||
schema_version = 1
|
||||
|
||||
# Machine-checked record of the sirius port. `python3 scripts/porting-record.py check
|
||||
# --device <this repository>` from a UniXNU checkout validates it, and the Device
|
||||
# documentation workflow runs the same check.
|
||||
#
|
||||
# Status vocabulary: planned, implemented, host-verified, device-verified, not-applicable.
|
||||
# Every claim here is backed by docs/HANDOFF.zh-CN.md, by the board sources listed in paths,
|
||||
# or by a device observation recorded with its commit.
|
||||
|
||||
[device]
|
||||
name = "sirius"
|
||||
soc = "SDM710"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: entry, MMU, timer, PSCI, platform expert and the boot-progress console work on hardware; IOKit is blocked on AppleARMCPU claiming /cpus."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "implemented"
|
||||
components = ["ArmDTPlatform", "DarwinBoot"]
|
||||
paths = ["board.toml", "feeds.toml", "dts/**", "configs/**", ".github/**", ".gitignore", "local.toml.example"]
|
||||
inputs = [
|
||||
"SoC: SDM710 (Kryo 360, 2x Cortex-A75 + 6x Cortex-A55), GIC-500 GICv3, 19.2 MHz Qualcomm XO counter, PSCI over SMC.",
|
||||
"DRAM: 6 GiB model, 2 GiB at 0x80000000 plus 0xfd6c0000 at 0x100000000, 0x17d6c0000 usable.",
|
||||
"Target OS: the unchanged iPad7,1 iPadOS 17.7.11 (21H461) restore image, the same kernelcache as fajita and sheng.",
|
||||
"Hardware sources: mainline sdm670.dtsi, the vendor kernel tree and measurements on the phone.",
|
||||
]
|
||||
configuration = [
|
||||
"board.toml is format 2 (schema_version = 2) and selects soc_source = sdm710 and os_profile = ipados-17.7.11-21H461.",
|
||||
"dts/sirius.dts describes memory, the eight cores and their affinities, and includes the SoC DTSI for the GIC, PSCI and counter.",
|
||||
"configs/sirius_defconfig keeps the first-console kernel configuration and turns off the profile settings the image does not use yet.",
|
||||
"The prelink roots, slide, early security initializer and Apple device-tree identity come from the OS profile; the board adds sleep-disabled, the product model and the button set.",
|
||||
]
|
||||
procedure = [
|
||||
"From a UniXNU checkout: ./unixnu defconfig sirius_defconfig -D ../UniXNU-sirius.",
|
||||
"Then ./unixnu fetch, ./unixnu status --json and ./unixnu tree; the output is out/sirius/ipados-17.7.11-21H461/sirius/.",
|
||||
"Compile the hardware tree through the payload step (prototype: dtc -I dts -O dtb -i <soc>/dts dts/sirius.dts).",
|
||||
]
|
||||
findings = [
|
||||
"Format 2 replaced the hand-written ADT generator of the legacy port (scripts/make-sirius-adt.py) with a board DTS: the payload step compiles the tree and derives kernel.macho.adt from it.",
|
||||
"The arm-io base is derived from the exported nodes, not written by hand: the GIC at 0x17a00000 makes the window start at 0x17000000, which XNU reads as the SoC base.",
|
||||
"The legacy port set ipad_identity = true; in format 2 the same identity is the OS profile's [adt] tables, so the board only states its deviations.",
|
||||
]
|
||||
completion = [
|
||||
"status --json resolves the ARM64, sdm710, iPadOS and device layers, prints a non-empty patch order and shows the device package as kits/sirius.",
|
||||
"The compiled hardware tree carries one contiguous memory range equal to payload.dram_size, eight enabled CPUs and a PSCI method.",
|
||||
]
|
||||
limits = [
|
||||
"The SoC profile is new: only the GIC, PSCI, counter and the timer INTID are shared, everything else is still board-local.",
|
||||
"No device-verified configuration has been recorded against a commit of this repository yet; the evidence is the legacy port's handoff document.",
|
||||
]
|
||||
next_action = [
|
||||
"Run status --json and tree against this repository and commit the resulting unixnu.lock.",
|
||||
"Rebuild the payload from dts/sirius.dts and compare the generated ADT with the legacy one before the next hardware boot.",
|
||||
]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "Hardware values, the boot chain and the bring-up history of the legacy port, from which this configuration is carried over." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "implemented"
|
||||
components = ["DarwinBoot"]
|
||||
paths = ["scripts/make-uboot-payload.py", "drivers/DarwinBoot/**", "board.toml"]
|
||||
inputs = [
|
||||
"The device runs sirius-distro (mainline Linux) and its boot partition carries U-Boot 2026.07 with EFI_LOADER, the UEFI boot manager, GOP through vidconsole and EFI block volumes over FAT.",
|
||||
"UniXNU.efi is built on the host by ./unixnu build package; DarwinBoot.efi is built from drivers/DarwinBoot.",
|
||||
"The payload volume goes to the unused vendor partition mmcblk0p80 (3 GiB) and is selected by a marker file.",
|
||||
]
|
||||
configuration = [
|
||||
"board.toml has no [firmware] table: there is no Mu-Silicium firmware and no boot image on this port.",
|
||||
"[payload] loader = \"payload\" makes the generated unixnu.toml load Payloads/DarwinBoot.efi as a [[driver]] instead of expecting it in the firmware volume.",
|
||||
"scripts/make-uboot-payload.py adds \\EFI\\BOOT\\BOOTAA64.EFI (UniXNU.efi) and the DarwinBoot.efi driver to the payload FAT volume.",
|
||||
]
|
||||
procedure = [
|
||||
"fastboot flash boot the U-Boot image, fastboot flash vendor the finished payload volume, then select the UniXNU menu entry in U-Boot.",
|
||||
"U-Boot boots UniXNU when /EFI/UniXNU/BOOTUNIXNU exists on the vendor partition and boots Linux otherwise.",
|
||||
]
|
||||
findings = [
|
||||
"U-Boot's UEFI services are enough for UniXNU, DarwinBoot and XNU: no Mu-Silicium platform port is needed for this board.",
|
||||
"DarwinBoot's GIC-500 pre-configuration (the iBoot role) is what lets the kernel pass lockdown and start kexts on this SoC.",
|
||||
"The pre-configuration must not enable the EL1 virtual timer PPI early: on SDM710 that is INTID 19 and it fires before ArmCpu installs its handler.",
|
||||
]
|
||||
completion = [
|
||||
"U-Boot starts UniXNU from the FAT volume, the menu lists the xnu entry, and DarwinBoot hands control to the kernel with the device tree, framebuffer and command line.",
|
||||
]
|
||||
limits = [
|
||||
"The boot chain is U-Boot specific: it is not reproducible with the Mu-Silicium flow of the other ports and is not covered by ./unixnu firmware or ./unixnu bootimg.",
|
||||
]
|
||||
next_action = [
|
||||
"Keep the U-Boot side (sirius-distro) pinned by revision in the handoff document; it is the firmware for this port.",
|
||||
]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "Boot-chain diagram, the marker-file boot rule and the DarwinBoot GIC pre-configuration rationale." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "implemented"
|
||||
components = ["ArmCpu"]
|
||||
paths = ["drivers/ArmCpu/**", "dts/sirius.dts", "board.toml"]
|
||||
inputs = [
|
||||
"Eight Kryo 360 cores at Affinity1 0x000..0x700, boot CPU cpu0; cpu0-5 Cortex-A55, cpu6-7 Cortex-A75.",
|
||||
"GIC-500 distributor 0x17a00000/0x10000, redistributor 0x17a60000/0x100000, stride 0x20000.",
|
||||
"The EL1 virtual timer is GIC PPI 3 / INTID 19 (Apple uses PPI 11 / INTID 27); the SoC counter runs at 19.2 MHz.",
|
||||
]
|
||||
configuration = [
|
||||
"dts/sirius.dts lists all eight cores in boot order with their compatible strings; the ADT carries the same order.",
|
||||
"The kernel command line selects the board behaviour: sheng-smp=1, cpus=8, armcpu-self-ipi=1, armcpu-timer-intid=19.",
|
||||
"drivers/ArmCpu/ArmCpu.cpp is the board copy of the component: it adds the non-Apple timer INTID, the /cpus probe counters and the sheng-smp claim path.",
|
||||
]
|
||||
procedure = [
|
||||
"Build the kernel, then read the boot-progress TOPO line to confirm the topology and the probe decision.",
|
||||
]
|
||||
findings = [
|
||||
"The boot-progress TOPO row confirms the kernel topology on hardware: boot=0 max=7 nums=01234567.",
|
||||
"With sheng-smp=1 the native ArmCpu claims every /cpus nub; without it the kernelcache AppleARMCPU takes the nubs and panics with \"CPU configuration in device tree is invalid\" because it requires /cpus/max_cpus.",
|
||||
"AppleARMCPU still wins the nubs at the current stage, which is the open IOKit blocker.",
|
||||
]
|
||||
completion = [
|
||||
"Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU with the board INTID.",
|
||||
]
|
||||
limits = [
|
||||
"IOKit attach of the native ArmCpu is not yet proven; the last trusted snapshot shows AppleARMCPU holding /cpus.",
|
||||
]
|
||||
next_action = [
|
||||
"Stop pre-enabling the timer PPI in DarwinBoot, re-read the probe row, and confirm ArmCpu installs its IRQ handler before the timer fires.",
|
||||
]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "Timer INTID measurement, the TOPO checkpoint and the AppleARMCPU panic analysis." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["dts/sirius.dts", "board.toml"]
|
||||
inputs = [
|
||||
"Usable DRAM 0x17d6c0000 from 0x80000000 (6 GiB model: 2 GiB then 0xfd6c0000 at 0x100000000).",
|
||||
"The framebuffer handed over by U-Boot sits at 0x9c000000 (1080x2240 splash).",
|
||||
]
|
||||
configuration = [
|
||||
"The DTS memory node is a single contiguous range and board.toml repeats the size as [payload] dram_size; the driver refuses a mismatch.",
|
||||
"The ADT receives dram-base, dram-size and the CHRP NVRAM proxy from the payload step.",
|
||||
]
|
||||
procedure = [
|
||||
"Read the MEM row of the boot-progress panel and compare it with the DTS range.",
|
||||
]
|
||||
findings = [
|
||||
"The single contiguous range is what DarwinBoot's window allocation and the ADT handoff require; the two physical banks are described as one range on purpose.",
|
||||
]
|
||||
completion = [
|
||||
"The kernel memory map accounts for every handoff region, and no DMA engine or framebuffer range overlaps the kernel window.",
|
||||
]
|
||||
limits = [
|
||||
"DMA and SMMU behaviour is untested: there is no storage or GPU driver yet.",
|
||||
]
|
||||
next_action = [
|
||||
"Capture the kernel's memory map row after the next IOKit break-through and reconcile it with the DTS.",
|
||||
]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "DRAM split, framebuffer address and the memory-map checkpoint." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/**", "docs/HANDOFF.zh-CN.md"]
|
||||
inputs = [
|
||||
"The reference unit is eMMC, not UFS: the UFS transport and its sheng integration points do not apply to this board.",
|
||||
"No native storage driver exists yet; the expected first stop of the kernel is the root device wait.",
|
||||
]
|
||||
configuration = [
|
||||
"No storage component is selected in board.toml; CONFIG_XNU_NATIVE_UFS is off in the defconfig.",
|
||||
]
|
||||
procedure = [
|
||||
"Follow the storage guide to choose an eMMC driver path, then select it and record the checkpoint.",
|
||||
]
|
||||
findings = [
|
||||
"The legacy port deliberately kept every UFS and owner-root flag off; the boot-progress interlock of UniXNU had to be relaxed for that reason.",
|
||||
]
|
||||
completion = [
|
||||
"The eMMC registers, GPT and the OS/SystemOS windows are correct, the root volume mounts and launchd starts.",
|
||||
]
|
||||
limits = [
|
||||
"No storage driver and no root filesystem: the port currently stops before the root device.",
|
||||
]
|
||||
next_action = [
|
||||
"Inventory the eMMC controller (SDCC/MSDC) registers and interrupt lines from the vendor tree before selecting an implementation.",
|
||||
]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["package/BootProgress.c", "package/BootLog.c", "package/Font.h", "scripts/build-boot-progress.py"]
|
||||
inputs = [
|
||||
"U-Boot hands over a 1080x2240 splash framebuffer at 0x9c000000 through GOP (vidconsole).",
|
||||
"The panel is 1080x2244 DSI; there is no backlight or display driver in the kernel yet.",
|
||||
]
|
||||
configuration = [
|
||||
"CONFIG_XNU_BOOT_PROGRESS=y links the boot-progress layer; boot-progress=2 on the command line draws the kernel console lines.",
|
||||
"package/Font.h is vendored from Mu-Silicium, so the archive builds without a UEFI checkout.",
|
||||
]
|
||||
procedure = [
|
||||
"Build kernel, payload and volume, boot, and read the panel: stage lines, TOPO, PROBE, MEM and panic text.",
|
||||
]
|
||||
findings = [
|
||||
"The panel is the readable kernel log of this port: it renders the console, the TOPO/PROBE rows and panic() output.",
|
||||
"Since the panic snapshot patch the panel re-renders at panic time, so the rows are not a stale frame.",
|
||||
]
|
||||
completion = [
|
||||
"A known frame appears with correct geometry, and the kernel console and panic output stay readable on the panel.",
|
||||
]
|
||||
limits = [
|
||||
"This is a firmware framebuffer text surface, not a Darwin display driver: no IOMobileFramebuffer, no backlight, no modesetting.",
|
||||
]
|
||||
next_action = [
|
||||
"Keep the panel as the diagnostic surface until a display provider exists, and record each new row it prints.",
|
||||
]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "Boot-progress panel behaviour, the panic snapshot fix and the geometry of the U-Boot framebuffer." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["docs/HANDOFF.zh-CN.md"]
|
||||
inputs = [
|
||||
"The board has no Home button; volume keys are reported by the button node of the ADT.",
|
||||
"The touch controller is not identified for this unit yet.",
|
||||
]
|
||||
configuration = [
|
||||
"board.toml writes [adt.buttons] with hold, voldown, volup and home-button-type = 2.",
|
||||
]
|
||||
procedure = [
|
||||
"Follow the input guide once a touch controller is known, then select an implementation.",
|
||||
]
|
||||
findings = [
|
||||
"No input component is selected; the button node exists so that BSPlatform and MobileGestalt read a coherent product.",
|
||||
]
|
||||
completion = [
|
||||
"Touches map to the display with stable contacts and the volume keys produce the expected HID reports.",
|
||||
]
|
||||
limits = [
|
||||
"No touch support and no IOHIDDevice provider.",
|
||||
]
|
||||
next_action = [
|
||||
"Identify the touch controller from the vendor DTS and the panel firmware.",
|
||||
]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["docs/HANDOFF.zh-CN.md"]
|
||||
inputs = [
|
||||
"Adreno 616 with the SDM710 GPU firmware; no GPU component is selected yet.",
|
||||
]
|
||||
configuration = [
|
||||
"Nothing is configured: the CPU renders the boot-progress panel through the firmware framebuffer.",
|
||||
]
|
||||
procedure = [
|
||||
"Follow the GPU guide to evaluate Adreno740/AdrenoMetal for this revision; the A616 is not the A740 the component targets.",
|
||||
]
|
||||
findings = [
|
||||
"The Adreno family components in the catalog target the A740 of SM8550; a different implementation would be needed here.",
|
||||
]
|
||||
completion = [
|
||||
"GPU submissions complete, fences work and a known image renders.",
|
||||
]
|
||||
limits = [
|
||||
"No GPU bring-up has been attempted on this port.",
|
||||
]
|
||||
next_action = [
|
||||
"Decide whether an A616 implementation is in scope after IOKit and storage; do not assume the A740 path applies.",
|
||||
]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["docs/HANDOFF.zh-CN.md"]
|
||||
inputs = [
|
||||
"The Wi-Fi chip of this unit is not identified in the port record yet.",
|
||||
]
|
||||
configuration = [
|
||||
"No network component is selected.",
|
||||
]
|
||||
procedure = [
|
||||
"Follow the network guide once the chip and its firmware are known.",
|
||||
]
|
||||
findings = [
|
||||
"No network work has started; the first console image does not need it.",
|
||||
]
|
||||
completion = [
|
||||
"Scanning, association and sustained traffic pass with the selected firmware.",
|
||||
]
|
||||
limits = [
|
||||
"No network support at any layer.",
|
||||
]
|
||||
next_action = [
|
||||
"Identify the WCN chip from the vendor DTS and the firmware partition before selecting a driver.",
|
||||
]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["docs/HANDOFF.zh-CN.md"]
|
||||
inputs = [
|
||||
"No audio path is documented for this unit yet.",
|
||||
]
|
||||
configuration = [
|
||||
"No audio component is selected.",
|
||||
]
|
||||
procedure = [
|
||||
"Follow the audio guide once the codec and DSP path are known.",
|
||||
]
|
||||
findings = [
|
||||
"No audio work has started.",
|
||||
]
|
||||
completion = [
|
||||
"Each declared route carries the selected format through playback or capture.",
|
||||
]
|
||||
limits = [
|
||||
"No audio support at any layer.",
|
||||
]
|
||||
next_action = [
|
||||
"Inventory the codec and the DSP layout from the vendor tree.",
|
||||
]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["dts/sirius.dts", "board.toml"]
|
||||
inputs = [
|
||||
"No suspend/resume path exists; the boot-progress panel is the only power-facing behaviour so far.",
|
||||
]
|
||||
configuration = [
|
||||
"board.toml writes [adt.defaults] sleep-disabled = 1 so the CPU does not park forever.",
|
||||
"PSCI is declared in the SoC DTSI and used for reset and secondary-core start.",
|
||||
]
|
||||
procedure = [
|
||||
"Follow the power guide to add the PMIC and battery controls once the platform expert is stable.",
|
||||
]
|
||||
findings = [
|
||||
"Reset works through PSCI (the stage-3 reset loop proved it).",
|
||||
]
|
||||
completion = [
|
||||
"Declared power controls and battery readings match observations and sleep/resume restores the dependent peripherals.",
|
||||
]
|
||||
limits = [
|
||||
"No battery reporting, no CPU frequency policy and no PMIC driver.",
|
||||
]
|
||||
next_action = [
|
||||
"Defer until IOKit and storage are stable; keep sleep-disabled until a resume path exists.",
|
||||
]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "PSCI reset evidence and the reason sleep is disabled." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "implemented"
|
||||
components = ["XnuPrelink"]
|
||||
paths = ["board.toml", "scripts/make-uboot-payload.py", "scripts/build-xnu-4k-baseline.sh", "dts/**"]
|
||||
inputs = [
|
||||
"The payload FAT volume is the flashed artifact of this port; there is no boot.img.",
|
||||
"The prelink inputs (kernel path, roots, slide, early security initializer) come from the OS profile; the board does not override them.",
|
||||
]
|
||||
configuration = [
|
||||
"[payload] sets volume SIRIUSESP, 256 MiB, loader = payload, dram_size and the kernel command line.",
|
||||
"[payload.adt] keeps only chip_id: the platform seed is supplied per build with --unique-chip-id when the userland stages need it.",
|
||||
]
|
||||
procedure = [
|
||||
"./unixnu build kernel, ./unixnu build package, then bash scripts/build-darwinboot.sh (or the CI workflow), ./unixnu build payload, and finally make-uboot-payload.py --output the volume to flash.",
|
||||
]
|
||||
findings = [
|
||||
"Format 2 generates kernel.macho.adt from the DTS, so the legacy ADT script is retired; make-uboot-payload.py still finishes the volume because U-Boot needs the EFI binaries inside it.",
|
||||
"scripts/build-xnu-4k-baseline.sh is a copy of the UniXNU script with one board deviation: the boot-progress interlock only requires the source crypto provider.",
|
||||
"The legacy build applied patches/xnu/*.patch by glob (56 files); format 2 applies only what the series list names, and the ARM64 and OS series assume the two files they omit are present. native-smp-secondary.patch sets MAX_CPUS 8 and Affinity1 core numbering; sheng-platform-power.patch supplies the bsd_init.c block that zzz-boot-progress.patch quotes as context (CONFIG_XNU_SHENG_PMGR is off, so its code compiles to nothing). Both now live in the sdm710 SoC series, which applies before the OS series.",
|
||||
"The first format 2 kernel build on Linux failed at the last patch, zzz-boot-progress.patch, with a bsd_init.c context mismatch: the missing piece was sheng-platform-power.patch, not the moved native-smp-secondary. With both in the SoC series the whole series applies and the kernel prelinks: kernel.macho 50 MB, __TEXT 0xfffffff007004000, 30 kernelcache components, 69294 bindings.",
|
||||
"The kernel step also runs on Linux through UniXNU's toolchain installer, which builds a patched LLVM, cctools-port ld64, MIG, iig and lzfse. That installer writes /opt/unixnu-linux, /usr/bin shims and distribution packages, so this port runs it inside a Podman image (containers/xnu-linux/) and leaves the host untouched. The alternative, Allenwdk/xnu-linux-toolchain, uses the system clang with portable-kalloc-type-builtins.patch and cctools-port, but needs a path-layout adapter for the driver's checks.",
|
||||
"The first flashed build hung on hardware with the entry probe's blue bar and no magenta bar. The cause was a defconfig override, not the kernel sources: CONFIG_XNU_NATIVE_ARCH_TIMER=n. build-xnu-4k-baseline.sh sets NATIVE_ARCH_TIMER=${XNU_NATIVE_ARCH_TIMER:-${XNU_ARMCPU:-0}}, so the legacy build ran with 1; at 0, architectural-timer-entry.patch compiles the BCM2837 local interrupt router write (0x40000040 + cpu*4, Raspberry Pi local peripherals) into start.s. SDM710 has nothing at that address, and the store aborts before the MMU is on. The defconfig now leaves the ARM64 profile value (y) alone and documents why.",
|
||||
"Diagnosis method worth repeating: the legacy kernel from payload-full.img boots with this repository's new UniXNU.efi, DarwinBoot.efi and DTS-generated ADT (it reaches _sleh_irq and panics on the known early timer PPI), so the EFI side and the ADT are sound and the regression is in the kernel build. Comparing the two kernels' start_first_cpu bodies then showed the extra router write as the only semantic difference.",
|
||||
"With the timer override removed the Linux-built kernel boots past the MMU on hardware: the boot-progress panel reports TOPO boot=0 max=7 nums=01234567, the console reaches IOKit (PE_init_iokit, IONVRAM initImageFormat) and then the CPU takes an IRQ it cannot dispatch. lr 0xfffffff00741754c is _sleh_irq+0x70, the same NULL per-CPU handler the legacy kernel hit.",
|
||||
"That IRQ is DarwinBoot's early timer PPI. GIC_SGI_PPI_ENABLE included bit 19, so the EL1 virtual timer fired before ArmCpu::start installed the handler. DarwinBoot now enables SGIs 0..15 only and leaves INTID 19 to ArmCpu (armcpu-timer-intid=19), which is what the handoff's next step asked for.",
|
||||
"With the timer PPI left to ArmCpu the next stop was AppleARMPlatform's CPU class: it matches cpu0..cpu7 because IODTPlatformExpert compares IONameMatch by prefix ('cpu' matches 'cpu0'), starts first, and panics with 'CPU configuration in device tree is invalid' (its AppleARMCPU.cpp validates max_cpus, cpu-id, interrupts and function-* properties that an Apple device tree carries). The native ArmCpu personality (IOPlatformDevice, probe score 2000) did not win that match even after probe() added 40000, so make-uboot-payload.py rewrites the AppleARMCPU IONameMatch from cpu to xpu in the personality plist inside kernel.macho (equal length, nothing moves).",
|
||||
"A frozen panel is not proof of a hang: the panel repaints from the timer interrupt, so before ArmCpu enables the timer PPI the last painted second stays on screen while the kernel may still be running. Checkpoints (armcpu-panic=N, panics at entry/prepareGic/registration/controller/initCPU/registerService) are what distinguish the two.",
|
||||
"ArmCpu::start then failed inside initDistributor: it re-ran the quiesce sequence (GICD_CTLR &= ~3, wait, restore with ARE) over the state DarwinBoot had already programmed, which clears the group enables and leaves the core with no interrupts at all; the boot then sits in IOKit matching with a frozen panel. The fix keeps the firmware state when GICD_CTLR already reports affinity routing plus group 1 and only quiesces the SPIs. After it the panel advances (time=31s, IRQ=1076) and the kernel reaches bsd_init with TOPO boot=0 max=7, PROBE calls=17 acc=8 num=7 reg=700 - eight CPUs online.",
|
||||
"The next blocker is AMFI: 'AMFI: No PMGR?' @ConfigurationSettings.cpp:235. The unchanged target AMFI finds the PMGR through IOService::serviceMatching(\"ApplePMGRNub\") + waitForMatchingService, then reads the provider at nub+0x88 and calls its readAon/writeAon slots (OR bit 2). The original classes are ApplePMGR (storage 0x4b8a8) and ApplePMGRNub (0x740); UniXNU/scripts/audit-amfi-pmgr-contract.py pins the exact instructions. amfi_get_out_of_my_way=1 does not skip the check. Two routes remain: instantiate the original classes the way UniXNU-sheng does (OSKextLoadKextWithIdentifier + a generated OriginalPMGRABI.h + a published nub), or patch the AMFI block in the prelinked kernel.",
|
||||
"AMFI is cleared without touching the target kernel: the nub helpers behind AMFI's readAon/writeAon return 0 when the provider stored at nub+0x88 is NULL, so publishing a real but provider-less ApplePMGRNub satisfies the latch (read 0, OR 4, write no-op). package/SiriusPmgr.cpp allocates the class through OSMetaClass::getMetaClassWithName + alloc + init, attaches it to the platform and registers it from the sheng_pmgr_run hook in bsd_init (CONFIG_XNU_SHENG_PMGR=1, sheng-pmgr=2), and its build script writes the archive to build/sheng-platform-power/libShengPlatformPower.a because build-xnu-4k-baseline.sh force-loads exactly that path.",
|
||||
"With AMFI satisfied the boot passes bsd_init and stops at 'Failed to mount root device' @IOKitBSDInit.cpp:984 with 8 CPUs, IRQ=2145, 61 s of live uptime: the kernel now runs to the point where it needs a storage driver and a root filesystem, which this board does not have yet (no UFS or VirtIO block component, no APFS container on the payload volume).",
|
||||
]
|
||||
completion = [
|
||||
"The kernel prelinks against the pinned 21H461 kernelcache, the payload contains the kernel, the ADT and the DarwinBoot driver, and the flashed volume boots from U-Boot.",
|
||||
]
|
||||
limits = [
|
||||
"The kernel step needs macOS and Xcode, or the container image with UniXNU's Linux toolchain; the board script must be re-based on the upstream script when UniXNU changes it.",
|
||||
]
|
||||
next_action = [
|
||||
"Run the new payload once and diff the generated ADT against the legacy one before flashing.",
|
||||
"Boot the prelinked kernel on the phone and record the stage rows; the build side is now reproducible on Linux (container image, see downloads).",
|
||||
]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "Build and deploy loop, the CI kernel artifact and the payload layout on the vendor partition." },
|
||||
]
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["package/**", "scripts/patch-xnu-entry-probe.py", "scripts/xnu-panic-screen.c", "docs/HANDOFF.zh-CN.md"]
|
||||
inputs = [
|
||||
"The panel and the serial console are the two evidence channels; there is no storage for logs yet.",
|
||||
]
|
||||
configuration = [
|
||||
"panic_screen = true patches the entry probe and the panic screen into the payload kernel.",
|
||||
"boot-progress=2 draws the kernel console lines; debug=0x14e keeps the debug output on.",
|
||||
]
|
||||
procedure = [
|
||||
"Record the last checkpoint printed on the panel and in the U-Boot/XNU log for every boot, with the kernel and payload hashes of that run.",
|
||||
]
|
||||
findings = [
|
||||
"Stage bands (entry, pre-MMU, panic) and the TOPO/PROBE/MEM rows replaced the LED and UART guessing of earlier bring-up.",
|
||||
"A panic snapshot forces a panel re-render at panic time; before it, rows could show a stale frame.",
|
||||
]
|
||||
completion = [
|
||||
"Each claimed milestone has a reproducible command, a matching source and image revision and an accessible result.",
|
||||
]
|
||||
limits = [
|
||||
"No persistent log capture: the evidence lives in photographs of the panel and in the run's hashes.",
|
||||
]
|
||||
next_action = [
|
||||
"Add the boot row and hash triple to every hardware result recorded here.",
|
||||
]
|
||||
evidence = [
|
||||
{ kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "Entry probe, panic screen, panel rows and the evidence convention of the port." },
|
||||
]
|
||||
@@ -0,0 +1,189 @@
|
||||
schema_version = 1
|
||||
|
||||
[device]
|
||||
name = "gts7fewifi"
|
||||
soc = "SM7325"
|
||||
os_profile = "ipados-17.7.11-21H461"
|
||||
summary = "Samsung SM-T733 format 2 baseline48f records eight CPUs, UFS, CPU display and touch. A642L driver and Turnip tooling compiled and deployed as49h with verbose diagnostics; GPU hardware execution remains pending. The49g IODT interrupt-parent panic is addressed by emitting AAPL,phandle in the shared converter."
|
||||
|
||||
[[area]]
|
||||
id = "configuration"
|
||||
status = "implemented"
|
||||
components = ["ArmDTPlatform", "device"]
|
||||
paths = ["README.md", "AGENTS.md", "docs/**", "board*.toml", "feeds.toml", "components.toml", "configs/**", "dts/**", ".gitmodules", "porting.toml", ".github/**"]
|
||||
inputs = ["SM-T733 uses the SM7325 profile and the iPad7,1 21H461 restore inputs.", "The device's 14 driver and kit submodules retain their community repositories and adaptation revisions."]
|
||||
configuration = ["Both boards select schema_version 2, sm7325 and ipados-17.7.11-21H461.", "The component list and archive list are complete arrays; device components.toml supplies community identities and board-specific recipes.", "Public payload.adt.chip_id is hexadecimal 733; private local.toml hardware.unique_chip_id enters the official UNIXNU_UNIQUE_CHIP_ID environment variable."]
|
||||
procedure = ["Run bash scripts/build.sh TAG for the system configuration or add --platform for the platform configuration.", "The official driver resolves output paths from the selected OS profile and defconfig."]
|
||||
findings = ["Format 2 arrays replace inherited arrays, so every selected component, configuration fragment, patch series and archive remains explicit.", "The SM7325 profile owns common CPU, interrupt, timer, PSCI and UFS facts; the device owns memory span, identity and board policies.", "system-format2-48f completed configure, resolve, kernel, menu, wallpaper, debug-tools and payload with exit code 0."]
|
||||
completion = ["The selected components and source revisions resolve and the unified build produces the requested payload."]
|
||||
limits = ["The format 2 observations cover the recorded eight-core, UFS, display and touch boot activity; other hardware observations retain their earlier build TAGs."]
|
||||
next_action = ["Record subsequent system operations under the current build TAG."]
|
||||
evidence = [{ kind = "source", reference = "board.toml", result = "The system board selects all four configuration layers and the complete component and archive lists." }, { kind = "source", reference = "docs/archive/FORMAT2_2026-10-25.md", result = "The delivery record names the seven successful stages, FAT deployment and specific USB boot observations for 48f." }]
|
||||
|
||||
[[area]]
|
||||
id = "firmware"
|
||||
status = "implemented"
|
||||
components = ["DarwinBoot", "EarlyEntry"]
|
||||
paths = ["proprietary-files.txt", "scripts/extract-files.py", "support/Mu-Silicium.rev", "drivers/DarwinBoot", "board*.toml"]
|
||||
inputs = ["Samsung bootloader is unlocked; BOOT/recovery use memory-input-display-46.", "DarwinBoot receives the actual UEFI memory map, framebuffer and loaded sidecar addresses."]
|
||||
configuration = ["gts7fewifi.dsc supplies the Samsung firmware package and userdata payload driver.", "The normal system menu entry is Boot UniXNU."]
|
||||
procedure = ["Use the device build entry with --firmware when firmware source changes require a matching image.", "Ordinary system updates write only the userdata FAT and restart the firmware."]
|
||||
findings = ["The 47a runtime reaches the Apple logo, lock screen and USB with the existing 46 firmware.", "48f also booted with the existing 46 firmware and produced its own USB record.", "The firmware's actual conventional-memory allocations define BootArgs memory ownership."]
|
||||
completion = ["Firmware enters the menu, loads the payload and publishes the inherited framebuffer and UEFI reservations."]
|
||||
limits = ["Samsung recovery and PARAM handling remain device-specific."]
|
||||
next_action = ["Retain the existing firmware and record any new firmware-dependent behavior with its build TAG."]
|
||||
evidence = [{ kind = "source", reference = "drivers/DarwinBoot/DarwinBootPkg/Driver/DarwinBoot.c", result = "DarwinBoot implements the UEFI allocation and XNU handoff used by the current device build." }]
|
||||
|
||||
[[area]]
|
||||
id = "cpu"
|
||||
status = "implemented"
|
||||
components = ["ArmCpu", "NativeQcomTsens"]
|
||||
paths = ["drivers/ArmCpu", "drivers/NativeQcomTsens", "package/T733CpuPower*", "package/T733Thermal*", "scripts/build-cpu-power.py", "configs/**"]
|
||||
inputs = ["CPU affinities are 0 through 0x700 in 0x100 steps.", "GIC distributor is 0x17a00000; redistributors begin at 0x17a60000 with 0x20000 stride; the architectural counter is 19.2 MHz."]
|
||||
configuration = ["The SM7325 DTSI records four efficiency cores, three performance cores and one highest-performance core across three scheduler clusters.", "The current CPU power code reads the three hardware EPSS LUTs and the 27 TSENS channels."]
|
||||
procedure = ["The kernel build applies the SM7325 startup and scheduler patches before generating compiler records.", "build-cpu-power.py compiles the scheduler adapter, EPSS policy and TSENS reader from those records."]
|
||||
findings = ["The 45f runtime started all eight CPUs, used three Edge scheduler clusters and registered perfcontrol.", "The 48f USB record confirms all eight CPUs online=1 with fail=0.", "Thermal policy uses the actual stock sensor groups and EPSS rows."]
|
||||
completion = ["All enabled CPUs start, timer/IPI delivery works and policy chooses hardware LUT rows for each frequency domain."]
|
||||
limits = ["Format 2 must preserve the cluster-type, die-cluster-id and cluster-core-id properties consumed by XNU."]
|
||||
next_action = ["Record further scheduler and thermal observations under the current build TAG."]
|
||||
evidence = [{ kind = "source", reference = "package/T733CpuPower.cpp", result = "The board implementation reads EPSS frequency domains and applies scheduler demand to hardware rows." }]
|
||||
|
||||
[[area]]
|
||||
id = "memory"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["dts/**", "board*.toml", "drivers/DarwinBoot", "configs/**"]
|
||||
inputs = ["The device DRAM address span is 0x80000000 through 0x200000000 and contains reserved holes.", "UEFI conventional-memory ranges exclude firmware, TZ, framebuffer and DMA reservations."]
|
||||
configuration = ["payload.adt.owned_memory_size remains auto.", "The shared converter emits darwinboot-memory-range with a 1 GiB minimum and the existing 2 MiB-aligned maximum."]
|
||||
procedure = ["DarwinBoot chooses a real contiguous UEFI allocation, then reports the successful base and size in BootArgs."]
|
||||
findings = ["The 46b runtime reported 4548722688 bytes of XNU-managed memory, approximately 4.236 GiB; 48f has no separate LLDB memory probe.", "The 6 GiB physical capacity is a DRAM span input; reservations and contiguous allocation still determine XNU ownership."]
|
||||
completion = ["The owned window fits one successful UEFI allocation and preserves every reserved range."]
|
||||
limits = ["Available contiguous memory depends on the live UEFI memory map."]
|
||||
next_action = ["Record the actual allocated range during the format 2 boot."]
|
||||
evidence = [{ kind = "source", reference = "dts/board.dts", result = "The board supplies the physical span while retaining automatic conventional-memory allocation." }]
|
||||
|
||||
[[area]]
|
||||
id = "storage"
|
||||
status = "implemented"
|
||||
components = ["NativeUfs", "NativeRamBlock", "SoftwareAES", "VirtioMmioBlock", "VerifiedRoot"]
|
||||
paths = ["drivers/NativeUfs", "drivers/NativeRamBlock", "package/data-layout.toml", "scripts/build-data-storage.py", "scripts/build-root-policy-archive.py", "configs/**", "board*.toml"]
|
||||
inputs = ["SM7325 UFS MMIO is 0x01d84000, SMMU MMIO is 0x15000000, stream ID is 0x80 and GIC INTID is 297.", "USERDATA LBAs are 2320896 through 31099898 with 4096-byte sectors."]
|
||||
configuration = ["The NativeUfs community component retains its native-ufs-smmu-reg, native-ufs-stream-id and native-ufs-interrupt ABI.", "The Data UUID remains 09A342FC-CB72-44DE-A10E-B89F14508869; its logical size remains 103079215104 bytes.", "VirtioMmioBlock supplies storage ABI declarations to the existing archive builder."]
|
||||
procedure = ["The ordered archive plan builds verified-root policies, original AES bindings, NativeUfs and NativeRamBlock before final kernel linking.", "Ordinary deployment replaces the 512 MiB FAT at userdata offset 9382658048 and preserves the existing Data location and seed."]
|
||||
findings = ["The 45f runtime completed 1213669 UFS requests with zero failures or timeouts and peak queue depth 16.", "The 48f USB record shows 300788 completed UFS requests, failed=0, both timeout counts 0 and peak queue depth 14.", "The existing Data implementation persists changes across ordinary FAT updates."]
|
||||
completion = ["UFS publishes the signed OS/SystemOS windows, root mounts, launchd starts and Data writes survive reboot at the fixed offset."]
|
||||
limits = ["Install / erase Data intentionally initializes the fixed Data region and requires the explicit menu action."]
|
||||
next_action = ["Retain the layout and associate further storage activity with its build TAG."]
|
||||
evidence = [{ kind = "source", reference = "package/data-layout.toml", result = "The committed layout fixes the 512 MiB FAT and 96 GiB Data positions and UUID." }]
|
||||
|
||||
[[area]]
|
||||
id = "display"
|
||||
status = "implemented"
|
||||
components = ["NativeMobileDisplay", "NativeGeniI2c", "NativeQcomDsi"]
|
||||
paths = ["drivers/NativeMobileDisplay", "drivers/NativeGeniI2c", "drivers/NativeQcomDsi", "package/T733Display/**", "scripts/build-software-display.py", "scripts/build-display-power.py", "board.toml"]
|
||||
inputs = ["UEFI leaves the panel, DSI PHY and video scanout running.", "The original 21H461 AppleARMBacklight and MobileFramebuffer classes supply the runtime ABI."]
|
||||
configuration = ["Software rendering and CPU framebuffer copies remain enabled.", "The current payload retains the CoreGraphics and CoreUI text fixups, framebuffer write-combine and display binding arguments."]
|
||||
procedure = ["build-software-display.py emits original ABI bindings and the software display archive.", "The board display coordinator sends DSI commands and controls panel power through the existing I2C resources."]
|
||||
findings = ["The 46l runtime's backlight control and normal shutdown were confirmed by the user.", "The 47a runtime reaches the graphical lock screen with CPU rendering.", "The 48f USB record reports display ready=1 and awake=1 with continuing CPU display frames."]
|
||||
completion = ["Frames have correct geometry and colors, userland presentation advances and brightness/shutdown controls work."]
|
||||
limits = ["GPU acceleration is a separate hardware implementation stage."]
|
||||
next_action = ["Record subsequent brightness and presentation operations with the current build TAG."]
|
||||
evidence = [{ kind = "source", reference = "package/T733Display/DisplayPower.cpp", result = "The board coordinates current panel power, brightness and DSI command operations." }]
|
||||
|
||||
[[area]]
|
||||
id = "input"
|
||||
status = "implemented"
|
||||
components = ["NativeFocaltechTouch", "NativeGeniSpi", "NativeQcomSpmi", "NativePmicKeys"]
|
||||
paths = ["drivers/NativeFocaltechTouch", "drivers/NativeGeniSpi", "drivers/NativeQcomSpmi", "drivers/NativePmicKeys", "package/T733Touch*", "package/T733PmicKeys*", "package/T733Tlmm*", "scripts/build-touch-input.py", "scripts/build-pmic-keys.py"]
|
||||
inputs = ["The touch controller is FT8203 on GENI SPI and uses GPIO81.", "PM7325 supplies the power, volume-down and volume-up inputs through SPMI arbiter v5."]
|
||||
configuration = ["The board touch HID descriptor retains multitouch IDs and grouped digitizer dispatch.", "The original button ADT names remain hold, voldown and volup."]
|
||||
procedure = ["The touch archive compiles the FT8203 protocol, GENI SPI transport and original IOHIDDevice subclass.", "The PMIC archive compiles the SPMI controller, key protocol and board Consumer Control subclass."]
|
||||
findings = ["Earlier runtime records contain complete power/volume DOWN and UP events.", "The 48f USB record contains continuing touch DOWN/UP events.", "The TLMM owner services registered GPIO sources and the PMIC transport preserves inherited hardware reset policy."]
|
||||
completion = ["Touch coordinates and contact releases arrive, and all three physical buttons produce press/release HID reports."]
|
||||
limits = ["Firmware and board electrical routing remain SM-T733 inputs."]
|
||||
next_action = ["Associate further touch and physical-button operations with the current build TAG."]
|
||||
evidence = [{ kind = "source", reference = "package/T733PmicKeys.cpp", result = "The board binds the PMIC resources to the existing key and HID drivers." }]
|
||||
|
||||
[[area]]
|
||||
id = "gpu"
|
||||
status = "implemented"
|
||||
components = ["Adreno6xx", "ArmSmmu4K", "AdrenoPM4", "AdrenoFirmware"]
|
||||
paths = ["drivers/Adreno6xx", "package/T733GpuResources.cpp", "scripts/build-adreno6xx.py", "tools/gpu", "board.toml"]
|
||||
inputs = ["SM7325 A642L chip ID 0x06030500, 512 KiB GMEM and A660 GMU/SQE/ZAP inputs."]
|
||||
configuration = ["The independent Adreno6xx archive is force-loaded with native-adreno-a6xx=1.", "GPU classes register after IOBSD; screen and early diagnostics are enabled."]
|
||||
procedure = ["Initialize live command-db votes, clocks, GPU/GMU SMMU and HFI, then require CP fence and GPU memory readback before publication.", "Run the raw ABI command followed by Turnip fill, compute and triangle readback."]
|
||||
findings = ["49h completed eight build stages and its FAT was written and synced; GPU runtime results are pending.", "49g panicked in IODTGetICellCounts because interrupt-parent resolution requires AAPL,phandle;49h includes the shared converter correction."]
|
||||
completion = ["Actual A642L submissions and rendering succeed before enabling system Metal composition and direct DPU scanout."]
|
||||
limits = ["No successful A642L GPU hardware execution has been recorded.", "Final display presentation uses GPU-rendered surfaces directly; framebuffer copies remain a diagnostic fallback."]
|
||||
next_action = ["Collect 49h screen and USB initialization results."]
|
||||
evidence = [{ kind = "source", reference = "scripts/build-adreno6xx.py", result = "The component is compiled into a dedicated archive with deferred IOKit constructors; hardware execution remains pending." }]
|
||||
|
||||
[[area]]
|
||||
id = "network"
|
||||
status = "implemented"
|
||||
components = ["NativeUsbNetwork"]
|
||||
paths = ["drivers/NativeUsbNetwork/**", "scripts/build-usb-network.py", "package/T733DebugNetwork.c", "tools/t733-ios-diagnostics.py"]
|
||||
inputs = ["The DWC3 device transport supplies the current USB ECM link."]
|
||||
configuration = ["The system archive plan includes NativeUsbNetwork and retains native-usb-debug=1."]
|
||||
procedure = ["The existing USB implementation exposes ECM and the XNU ifnet adapter exchanges frames with the host.", "Pairing and RSD setup use the native iOS diagnostics tool when required."]
|
||||
findings = ["The current ECM connection supports native debugserver capture and detach."]
|
||||
completion = ["The host connects through ECM and completes the requested native diagnostics session."]
|
||||
limits = ["Wi-Fi transport is pending; this area records the implemented USB network."]
|
||||
next_action = ["Record the USB network connection after the format 2 boot."]
|
||||
evidence = [{ kind = "source", reference = "drivers/NativeUsbNetwork/native_usb_network.c", result = "The board's XNU ifnet adapter implements the existing USB network transport." }]
|
||||
|
||||
[[area]]
|
||||
id = "audio"
|
||||
status = "planned"
|
||||
components = []
|
||||
paths = ["package/**", "board.toml"]
|
||||
inputs = ["SM-T733 audio requires its ADSP, transport, codec and board routes."]
|
||||
configuration = ["The current component list selects the implemented CPU, storage, display, input, power and USB services."]
|
||||
procedure = ["Inventory the stock audio paths and firmware before adding an audio component."]
|
||||
findings = ["The current working baseline reaches the graphical interface without an implemented audio route."]
|
||||
completion = ["Each implemented playback or capture route carries its declared audio format and handles start/stop."]
|
||||
limits = ["No audio playback or capture support is claimed."]
|
||||
next_action = ["Implement audio after its hardware and firmware dependencies are collected."]
|
||||
evidence = []
|
||||
|
||||
[[area]]
|
||||
id = "power"
|
||||
status = "implemented"
|
||||
components = []
|
||||
paths = ["package/ShengPlatformPower.cpp", "package/T733Battery*", "package/T733FuelGauge*", "package/T733CpuPower*", "package/T733Thermal*", "package/T733Display/**", "scripts/build-battery.py", "scripts/build-platform-power.py"]
|
||||
inputs = ["The board uses the SM5714 fuel gauge, TLMM GPIO54 notification and existing panel power resources.", "CPU demand and temperature policy use EPSS and TSENS hardware."]
|
||||
configuration = ["The current battery, CPU DVFS, display power and managed-memory arguments remain enabled.", "The system archive plan retains platform power, battery, thermal and display power ordering."]
|
||||
procedure = ["The battery worker reads the fuel gauge and publishes the original IOPMPowerSource properties.", "The platform shutdown implementation powers down the panel and invokes the existing firmware/PMIC path."]
|
||||
findings = ["The 46l runtime's normal shutdown and brightness control were confirmed by the user.", "The implemented battery service reports readings from the actual device resources."]
|
||||
completion = ["Battery readings and charging changes update, brightness control works and normal shutdown completes."]
|
||||
limits = ["Suspend/resume requires separate implementation and runtime evidence."]
|
||||
next_action = ["Record the power services after the format 2 boot."]
|
||||
evidence = [{ kind = "source", reference = "package/T733Battery.cpp", result = "The existing board battery service connects gauge readings and GPIO updates to IOPMPowerSource." }]
|
||||
|
||||
[[area]]
|
||||
id = "packaging"
|
||||
status = "implemented"
|
||||
components = ["NativePrelink"]
|
||||
paths = ["scripts/build.py", "scripts/build.sh", "scripts/package-t733-system.py", "package/data-layout.toml", "patches/**", "board*.toml"]
|
||||
inputs = ["The system payload contains the original Apple inputs, kernel, ADT, fixed Data seed and board addon files."]
|
||||
configuration = ["The payload remains a 512 MiB FAT with the existing menu, binary text replacements and root UUID.", "The platform configuration retains its 64 MiB diagnostic payload."]
|
||||
procedure = ["The official kernel builder owns prelinking; the unified device entry owns the dependent kernel, package and payload stages.", "The coordinating agent deploys the complete resulting FAT with the existing MSC writer."]
|
||||
findings = ["48f completed all seven build stages, a full 536870912-byte FAT write and sync, followed by a USB boot record identifying its TAG.", "Format 2 output directories include the OS profile and selected defconfig; build.py reads status --json output before copying artifacts."]
|
||||
completion = ["All stages finish and the selected output contains a complete deployable payload for its TAG."]
|
||||
limits = ["Deployment only replaces the ordinary FAT window; Data is preserved."]
|
||||
next_action = ["Keep the delivered package and associate further runtime observations with system-format2-48f."]
|
||||
evidence = [{ kind = "source", reference = "scripts/build.py", result = "The device entry drives the official build stages and obtains the resolved output directory." }, { kind = "source", reference = "docs/archive/FORMAT2_2026-10-25.md", result = "The recorded stage table, complete MSC write and USB boot observation identify the 48f delivery." }]
|
||||
|
||||
[[area]]
|
||||
id = "diagnostics"
|
||||
status = "implemented"
|
||||
components = ["NativeUsbDebug"]
|
||||
paths = ["drivers/NativeUsbDebug/**", "package/BootLog.c", "patches/t733-xnu/diagnostics.list", "tools/t733-usb-console.py", "tools/t733-ios-diagnostics.py", "tools/t733-lldb.py"]
|
||||
inputs = ["USB logging remains enabled, including the original opaque USB resource property in /chosen.", "Native debugserver provides one attach session per normal boot."]
|
||||
configuration = ["The selected patch list includes process, page-table and SMP diagnostics.", "Early framebuffer markers and regular screen startup logs remain disabled in the current normal configuration."]
|
||||
procedure = ["Collect USB logs with the existing console tools.", "Prepare symbols before a native attach, perform short reads, then continue and detach."]
|
||||
findings = ["The 47a debugger entry records reason and caller before parsing the optional panic argument.", "Native debugserver capture and detach have completed on the device.", "48f USB raw logs identify the current build and capture CPU, UFS, display and touch observations."]
|
||||
completion = ["The build's selected patch list matches the delivered kernel and the requested logs or native capture are recorded with the build TAG."]
|
||||
limits = ["A new native debugserver session requires a normal reboot after the prior session is consumed."]
|
||||
next_action = ["Record further requested diagnostics with the current build TAG and its actual capture method."]
|
||||
evidence = [{ kind = "source", reference = "patches/t733-xnu/native-debugger-entry-state.patch", result = "The selected debugger patch preserves the 47a null-panic handling and entry-state records." }]
|
||||
@@ -51,6 +51,8 @@ docs/
|
||||
|
||||
## Add a page
|
||||
|
||||
Format 2 device pages follow [record publication](/porting/records#publishing-and-reuse). Use these steps for authored guides.
|
||||
|
||||
1. Create the Markdown file under the matching section.
|
||||
2. Add the page to the sidebar in `docs/.vitepress/config.mts`.
|
||||
3. Add the Chinese page under `docs/zh/` and to the Chinese sidebar.
|
||||
@@ -99,11 +101,12 @@ VitePress fails the build on a broken internal link.
|
||||
|
||||
## Device records
|
||||
|
||||
Site builds require Python 3.11 or newer. `npm run build` fetches the device
|
||||
revisions in `devices.toml`, validates their records and renders device pages.
|
||||
Edit `porting.toml` in the device repository and update its registry revision
|
||||
after publication. Both language editions include the same record. See the
|
||||
[record guide](/porting/records).
|
||||
Site builds require Python 3.11 or newer. `npm run build` renders the committed
|
||||
catalog and record snapshots. The twice-daily catalog workflow discovers sources,
|
||||
pins revisions and refreshes format 2 pages, the index and navigation.
|
||||
Edit `porting.toml` in the device repository and publish it. Both language
|
||||
editions use the same record. Existing legacy pages retain their authored text;
|
||||
new legacy entries contain a repository link. See the [record guide](/porting/records#publishing-and-reuse).
|
||||
|
||||
## Driver guides
|
||||
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
# Xiaomi Redmi K40 \(alioth, M2012K11AC\) \(yang232138\)
|
||||
|
||||
[yang232138/UniXNU-alioth](https://github.com/yang232138/UniXNU-alioth)
|
||||
|
||||
Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.
|
||||
|
||||
yang232138/UniXNU-alioth: components without an area: \['AppleKeyStoreState', 'RamBlock', 'ShengUfs', 'VerifiedRoot', 'VirtioMmioBlock'\]
|
||||
+4
-29
@@ -1,32 +1,7 @@
|
||||
# Redmi K40 (alioth)
|
||||
# Redmi K40 \(alioth\)
|
||||
|
||||
A community port for SM8250-AC, maintained by FFT-infra.
|
||||
[FFT-infra/UniXNU-alioth](https://github.com/FFT-infra/UniXNU-alioth)
|
||||
|
||||
- [FFT-infra/UniXNU-alioth](https://github.com/FFT-infra/UniXNU-alioth)
|
||||
- [FFT-infra/UniXNU-sm8250-common](https://github.com/FFT-infra/UniXNU-sm8250-common)
|
||||
- [FFT-infra/uefi-alioth](https://github.com/FFT-infra/uefi-alioth)
|
||||
- [FFT-infra/UniXNU](https://github.com/FFT-infra/UniXNU)
|
||||
Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.
|
||||
|
||||
## State
|
||||
|
||||
The format 2 tree selects shared SM8250 support and iPad7,1 / iPadOS 17.7.11 (21H461). The firmware includes display, buttons, UFS and USB integration. Kernel and boot-image production, followed by hardware validation of this layout, remain pending.
|
||||
|
||||
## Use this port
|
||||
|
||||
1. Read the pinned source and validation records below. Prepare the required firmware and system inputs.
|
||||
2. Clone the device repository and follow its build guide from the checkout:
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/FFT-infra/UniXNU-alioth.git
|
||||
cd UniXNU-alioth
|
||||
git checkout 32988f00809d629721d69a34967a384710f929fd
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
|
||||
3. Complete the build for that revision, follow the [bring-up order](/porting/bring-up), and use [log capture](/porting/log-capture) to record the last confirmed stage.
|
||||
4. Save results in the [porting record](/porting/records). See [Port a device](/porting/steps) for board structure and component selection.
|
||||
|
||||
## Sources
|
||||
|
||||
- [Board configuration: FFT-infra/UniXNU-alioth](https://github.com/FFT-infra/UniXNU-alioth/blob/edb4f63f42e75d1f855943d7a58cc7c55ee21327/board.toml)
|
||||
- [fjcx555/UniXNU-alioth](https://github.com/fjcx555/UniXNU-alioth)
|
||||
FFT-infra/UniXNU-alioth: components without an area: \['AppleKeyStoreState', 'RamBlock', 'ShengUfs', 'VerifiedRoot', 'VirtioMmioBlock'\]
|
||||
@@ -0,0 +1 @@
|
||||
[BluedMC-Amethyst/UniXNU-amethyst](https://github.com/BluedMC-Amethyst/UniXNU-amethyst)
|
||||
@@ -1,30 +1,5 @@
|
||||
# Redmi Note 10 5G (camellia)
|
||||
# Redmi Note 10 5G \(camellia\)
|
||||
|
||||
A community device port for MT6833.
|
||||
[stanveyjiang/UniXNU-camellia](https://github.com/stanveyjiang/UniXNU-camellia)
|
||||
|
||||
- [stanveyjiang/UniXNU-camellia](https://github.com/stanveyjiang/UniXNU-camellia)
|
||||
|
||||
## State
|
||||
|
||||
The board provides a bootstrap defconfig, iPadOS 17.7.11 identity, prelink roots and a diagnostic package for MT6833 early boot. The kernel recipe reuses shared prelink and diagnostic helpers.
|
||||
|
||||
Target firmware, native storage, display, input, GPU and power integration require their own build and device records. Use the device README for the bootstrap kernel inputs.
|
||||
|
||||
## Use this port
|
||||
|
||||
1. Read the pinned instructions and records below. Prepare the firmware, system inputs and build tools they specify.
|
||||
2. Clone the device sources and prepare the matching core and firmware checkouts described by its README:
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/stanveyjiang/UniXNU-camellia.git
|
||||
cd UniXNU-camellia
|
||||
git checkout 7b83a3b41e4ae906130837cac37fdd718a258e4b
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
|
||||
3. Run the build from the working directory specified by that revision's instructions. Check its documented outputs and remaining inputs.
|
||||
4. Follow the [bring-up order](/porting/bring-up), save [logs](/porting/log-capture) and complete the [porting record](/porting/records). See [porting steps](/porting/steps) for board structure and component selection.
|
||||
|
||||
## Sources
|
||||
|
||||
- [README: stanveyjiang/UniXNU-camellia](https://github.com/stanveyjiang/UniXNU-camellia/blob/7b83a3b41e4ae906130837cac37fdd718a258e4b/README.md)
|
||||
Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.
|
||||
@@ -0,0 +1 @@
|
||||
[pxl777806/UniXNU-cas](https://github.com/pxl777806/UniXNU-cas)
|
||||
@@ -0,0 +1 @@
|
||||
[lss717/UniXNU-cheeseburger](https://github.com/lss717/UniXNU-cheeseburger)
|
||||
@@ -0,0 +1 @@
|
||||
[maozedongae/UniXNU-cheeseburger](https://github.com/maozedongae/UniXNU-cheeseburger)
|
||||
@@ -0,0 +1 @@
|
||||
[sbccc1888/ios-party](https://github.com/sbccc1888/ios-party)
|
||||
@@ -0,0 +1 @@
|
||||
[lateautumn233/UniXNU-droidvm](https://github.com/lateautumn233/UniXNU-droidvm)
|
||||
@@ -0,0 +1 @@
|
||||
[Neko17awa/UniXNU-droidvm](https://github.com/Neko17awa/UniXNU-droidvm)
|
||||
+3
-30
@@ -1,32 +1,5 @@
|
||||
# Rongyue E5 (e5)
|
||||
# Rongyue E5 \(e5\)
|
||||
|
||||
A community device port for UMS9621.
|
||||
[Enceka/UniXNU-e5](https://github.com/Enceka/UniXNU-e5)
|
||||
|
||||
- [Enceka/UniXNU-e5](https://github.com/Enceka/UniXNU-e5)
|
||||
- [Enceka/unixnu-ums9621](https://github.com/Enceka/unixnu-ums9621)
|
||||
- [Enceka/unixnu-e5-kernel-builder](https://github.com/Enceka/unixnu-e5-kernel-builder)
|
||||
|
||||
## State
|
||||
|
||||
The format 2 board selects shared UMS9621 support, ArmDTPlatform, ArmCpu and a RAM block device. The source describes eight Cortex-A53 cores, GICv3, PSCI SMC and a 26 MHz timer. Early-entry and MMU-transition probes are in development.
|
||||
|
||||
Use the board's own UEFI/DarwinBoot path and the pinned SoC feed. Storage, display, input and sustained XNU execution require device validation.
|
||||
|
||||
## Use this port
|
||||
|
||||
1. Read the pinned instructions and records below. Prepare the firmware, system inputs and build tools they specify.
|
||||
2. Clone the device sources and prepare the matching core and firmware checkouts described by its README:
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/Enceka/UniXNU-e5.git
|
||||
cd UniXNU-e5
|
||||
git checkout b73c144ecb19c07e287f7a5c59ebcd7c72edfefa
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
|
||||
3. Run the build from the working directory specified by that revision's instructions. Check its documented outputs and remaining inputs.
|
||||
4. Follow the [bring-up order](/porting/bring-up), save [logs](/porting/log-capture) and complete the [porting record](/porting/records). See [porting steps](/porting/steps) for board structure and component selection.
|
||||
|
||||
## Sources
|
||||
|
||||
- [README: Enceka/UniXNU-e5](https://github.com/Enceka/UniXNU-e5/blob/b73c144ecb19c07e287f7a5c59ebcd7c72edfefa/README.md)
|
||||
Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.
|
||||
+677
-20
@@ -1,31 +1,688 @@
|
||||
# Lenovo Legion Y700 Gen 4 (elden)
|
||||
# Lenovo Legion Y700 Gen 4 \(elden\)
|
||||
|
||||
A community port for SM8750P, maintained by jerry-2009.
|
||||
[jerry-2009/UNIXNU_elden](https://github.com/jerry-2009/UNIXNU_elden)
|
||||
|
||||
- [jerry-2009/UNIXNU_elden](https://github.com/jerry-2009/UNIXNU_elden)
|
||||
<div v-pre>
|
||||
|
||||
## State
|
||||
Lenovo Legion Y700 Gen 4 format 2 migration. Phase 1 UEFI is device-verified; XNU, storage, display and touch remain bring-up work.
|
||||
|
||||
TB322FC passes repeated RAM boots of the menu, 1904x3040 GOP display, volume keys and FAT payload. The format 2 configuration, live FDT, memory reservations, ADT and boot-CPU inputs pass host review.
|
||||
Source record: [porting.toml](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/porting.toml), `57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd`.
|
||||
|
||||
The 4 KiB XNU kernel, prelinked `kernel.macho` and host ADT are generated and audited. The next device stage is the 56 MiB RAM payload transport, followed by DarwinBoot and XNU entry.
|
||||
This page is generated from the device record.
|
||||
|
||||
## Use this port
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [Configuration](#configuration) | `host-verified` |
|
||||
| [Firmware and boot](#firmware) | `device-verified` |
|
||||
| [CPU and interrupts](#cpu) | `implemented` |
|
||||
| [Memory and DMA](#memory) | `implemented` |
|
||||
| [Storage and root](#storage) | `planned` |
|
||||
| [Display](#display) | `planned` |
|
||||
| [Input](#input) | `planned` |
|
||||
| [GPU](#gpu) | `planned` |
|
||||
| [Network](#network) | `not-applicable` |
|
||||
| [Audio](#audio) | `not-applicable` |
|
||||
| [Power](#power) | `planned` |
|
||||
| [Image assembly](#packaging) | `host-verified` |
|
||||
| [Diagnostics](#diagnostics) | `device-verified` |
|
||||
|
||||
1. Read the pinned source and validation records below. Prepare the required firmware and system inputs.
|
||||
2. Clone the device repository and follow its build guide from the checkout:
|
||||
## Configuration {#configuration}
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/jerry-2009/UNIXNU_elden.git
|
||||
cd UNIXNU_elden
|
||||
git checkout c591b1a0a471f24978aba25c56c8f6ec9bd06668
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
`host-verified`
|
||||
|
||||
3. Complete the build for that revision, follow the [bring-up order](/porting/bring-up), and use [log capture](/porting/log-capture) to record the last confirmed stage.
|
||||
4. Save results in the [porting record](/porting/records). See [Port a device](/porting/steps) for board structure and component selection.
|
||||
Components: `ArmDTPlatform`, `ArmCpu`, `SoftwareAES`, `XnuPrelink`, `DarwinBoot`.
|
||||
|
||||
## Sources
|
||||
### Hardware and dependencies
|
||||
|
||||
- [README: jerry-2009/UNIXNU_elden](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/README.md)
|
||||
- [Kernel inputs: jerry-2009/UNIXNU_elden](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
- Use the ARM64 and iPadOS 17.7.11 profiles supplied by UniXNU.
|
||||
- Select the shared platform, CPU and DarwinBoot components.
|
||||
- Provide an SM8750 profile until an official shared SoC repository exists.
|
||||
|
||||
### Configuration
|
||||
|
||||
- board.toml declares schema\_version = 2, soc\_source = sm8750 and os\_profile = ipados-17.7.11-21H461.
|
||||
- The complete component list is explicit because profile arrays replace inherited arrays.
|
||||
- Configuration and patch roots are ordered as ARM64, SoC, OS and device.
|
||||
- soc/sm8750 supplies the transition profile and is referenced from feeds.toml.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run defconfig from a current UniXNU checkout.
|
||||
- Inspect status JSON for profile order, component dependencies, patch order and output path.
|
||||
- Replace the local SoC source with a reviewed UniXNU-sm8750-common commit before release.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The repository was format 1 and did not select shared SoC or OS profiles.
|
||||
- A public UniXNU-sm8750-common repository was not available during migration.
|
||||
- Keeping a separate local SoC profile preserves parser validation without mislabelling unqualified hardware support as shared.
|
||||
- Phase 2.0 resolved ARM64, local SM8750, iPadOS and device layers; the selected component order, 56 patches, 4 KiB page setting and separate format 2 output were checked with current UniXNU.
|
||||
- Phase 2.1 keeps the XNU handoff and firmware memory description separate from the phase 1 dummy firmware DTB.
|
||||
- Phase 2.2 resolved 57 patches after adding compile-time-disabled PMGR context required by the shared boot-progress patch. CONFIG\_XNU\_BOOT\_PROGRESS is disabled for the minimum kernel because that diagnostic layer currently requires UFS, owner-root and Virtio.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- board.toml resolves four ordered configuration layers.
|
||||
- All selected components come from the UniXNU catalog and include their dependencies.
|
||||
- No array field depends accidentally on inheritance.
|
||||
- The SoC source is a reviewed remote commit and unixnu.lock records it.
|
||||
|
||||
### Current limits
|
||||
|
||||
- soc/sm8750 is local and is not yet a release-quality shared source.
|
||||
- The first resolution pass selects only platform, CPU, AES, prelink and DarwinBoot components.
|
||||
|
||||
### Next action
|
||||
|
||||
- Phase 2.3: validate the near-final-size Android v3 ramdisk, FDT/initrd and HOB path in an isolated candidate. Replace the local SM8750 source with a reviewed shared commit before release.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Schema 2 profile, component, kernel, device-tree and payload declarations.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/board.toml)
|
||||
- `source`: [SM8750 transition source with the release replacement documented.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/feeds.toml)
|
||||
- `source`: [Shared-profile-shaped SM8750 transition metadata.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/soc/sm8750/soc.toml)
|
||||
- `source`: [Migration result, preserved phase 1 inputs and remaining release work.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/FORMAT2-MIGRATION.md)
|
||||
- `host`: [2026-10-25: fresh defconfig, tree and status runs resolved four profiles, five pinned components, 56 patches and 4 KiB pages under a format 2 output directory separate from phase 1. The local SM8750 source remains unpinned for release.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>.venv/bin/python .cache/phase2-plan/UniXNU/unixnu status --json -D .</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
- `host`: [2026-10-25: defconfig and status resolved five canonical components and 57 applied patches. The Command Line Tools host-shim build produced and prelinked the target kernel; release rebuilding still requires a full Xcode iPhoneOS SDK.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>PATH=.cache/phase2-plan/toolchain/bin:.venv/bin:$PATH .venv/bin/python .cache/phase2-plan/UniXNU/unixnu build kernel -D .</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`device-verified`
|
||||
|
||||
Components: `DarwinBoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- mu\_wide\_platforms lenovo-y700g4 UEFI source and patched PMIC binaries.
|
||||
- UniXNU, UniXNUDxe, DarwinBoot and EldenRamDiskDxe firmware modules.
|
||||
- A 4 MiB FAT16 payload containing package/unixnu.toml.
|
||||
|
||||
### Configuration
|
||||
|
||||
- firmware.dsc points to PakalaPkg/PakalaNoSb.dsc.
|
||||
- firmware.fd points to the DEBUG CLANGPDB SM8750\_EFI.fd.
|
||||
- payload volume is ELDENRAM and loader is firmware.
|
||||
- panic\_screen remains false because the phase 2 panic renderer is not integrated.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build the phase 1 image with scripts/build\_phase1.py.
|
||||
- Run scripts/verify\_artifact.py against the FD and Android v3 image.
|
||||
- Owner performs two RAM cold boots with fastboot boot.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The vendor UFSDxe crashed before the menu, so it was removed from the phase 1 APRIORI, DSC and FDF.
|
||||
- The embedded FAT payload avoids persistent storage and makes the menu independent of UFS.
|
||||
- The same image reached the visible menu twice and returned to stock Android after reset.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Firmware contains UniXNU, UniXNUDxe, DarwinBoot and the RAM payload driver.
|
||||
- The payload config is readable and the menu accepts volume-key input.
|
||||
- Two RAM boots produce the same visible checkpoint and do not modify persistent partitions.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The verified firmware is phase 1 and does not contain a bootable XNU payload.
|
||||
- The new format 2 firmware command is not yet switched from the project build script.
|
||||
|
||||
### Next action
|
||||
|
||||
- Use the current phase 1 image as the accepted baseline. Phase 2.3: validate Android ramdisk/FDT/HOB handoff and the RAM disk driver only in a separately isolated candidate; measure inner/outer FV capacity before integrating kernel inputs.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Accepted phase 1 artifact and firmware/module inventory.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-STATUS.md)
|
||||
- `source`: [Static FD, Android image and embedded FAT verification.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/scripts/verify_artifact.py)
|
||||
- `device`: [2026-10-25: owner reported that the current image completed two RAM cold boots, reached the visible and operable UniXNU menu, and returned to stock Android.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `dffc3020a85830d0d981a85871d9ab31aac5827d`.
|
||||
- `device`: [Two owner-run RAM cold boots reached the UniXNU menu and returned to Android.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-HANDOFF.md)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `c591b1a0a471f24978aba25c56c8f6ec9bd06668`.
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ArmCpu`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8750 MPIDRs 0x0, 0x100, 0x200, 0x300, 0x400, 0x500, 0x10000 and 0x10100.
|
||||
- GICv3 distributor 0x16000000, redistributor base 0x16080000 and stride 0x40000.
|
||||
- 19.2 MHz architectural timer and PSCI SMC conduit.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The SoC DTSI declares eight CPU nodes, timebase-frequency = 19200000 and psci method = smc.
|
||||
- The GIC node exports unixnu,adt-name = intc.
|
||||
- The device defconfig enables ARM DT platform, ArmCpu, native timer and PAN.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile dts/elden.dts with the SoC include path.
|
||||
- Generate an ADT from the DTB and inspect /cpus, /psci and /arm-io/intc.
|
||||
- Boot the smallest XNU payload and record the first CPU, GIC or timer failure.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The board evidence documents the same eight MPIDR layout used by other SM8750 ports.
|
||||
- The shared ADT generator emitted cpu0 as running and all other cores as waiting; ArmCpu does not probe secondary nubs unless sheng-smp is enabled.
|
||||
- ArmCpu reads the GIC through /arm-io/intc and requires a complete two-range reg property.
|
||||
- The old kernel argument set enabled armcpu-spi-ipi before elden had evidence that SGIs fail or that per-core SPI routing works. Phase 2.1 removed it from the single-boot-CPU milestone.
|
||||
- Secondary CPU startup and both SGI and SPI IPI delivery are not device-verified for elden.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The boot CPU reaches the ArmCpu checkpoint.
|
||||
- GIC distributor and its own redistributor frame map successfully.
|
||||
- Timer handling works before secondary cores or IPI transport are qualified.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No elden XNU CPU, GIC or timer log exists yet.
|
||||
- The eight-core topology is described, but SMP bring-up is not claimed.
|
||||
|
||||
### Next action
|
||||
|
||||
- Phase 2.5: prove ArmDTPlatform and the boot CPU ArmCpu/GIC/timer checkpoints using the audited CPU order and argument set. Defer SPI IPI, SGI delivery, secondary startup and SMP qualification to separate device checks.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [SM8750 CPU, PSCI, GICv3 and timer resources.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/soc/sm8750/dts/sm8750.dtsi)
|
||||
- `source`: [Board CPU/GIC/timebase inventory and planned diagnostic sequence.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-HANDOFF.md)
|
||||
- `host`: [2026-10-25: independently decoded ADT contains the eight expected MPIDRs, cpu0 running and seven CPUs waiting, 19.2 MHz timebase, SMC PSCI, and GIC distributor/redistributor bases with 0x40000 stride. No device CPU checkpoint is claimed.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/phase2_1_audit.py --linux-dir .cache/elden-linux</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
- `host`: [2026-10-25: the prelinked kernel exports ArmCpu probe/start, GIC distributor and timer-related symbols and ArmDTPlatform configure/createDeviceNubs symbols. Symbol presence is source evidence, not a device checkpoint.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>xcrun nm -g .cache/phase2-plan/UniXNU/out/elden/ipados-17.7.11-21H461/elden/kernel/kernel.macho</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ArmDTPlatform`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The owner-captured live elden FDT, including the 12 GiB RAM map, initrd and reserved-memory nodes.
|
||||
- The pinned Linux 16 GiB variant and the elden UEFI static memory map.
|
||||
- A conservative 256 MiB XNU handoff window in UEFI DXE conventional memory.
|
||||
|
||||
### Configuration
|
||||
|
||||
- dts/elden.dts declares one 256 MiB XNU handoff node at 0xC2400000.
|
||||
- payload.dram\_size and payload.adt.owned\_memory\_size both request 0x10000000.
|
||||
- dts/elden-firmware-memory.dts records the sanitised live 12 GiB RAM map, reserved-memory ranges and expected GOP framebuffer.
|
||||
- The format 2 generator creates a 64-byte seed, CHRP NVRAM proxy and optional-input memory-map placeholders.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the hardware and firmware memory descriptions.
|
||||
- Generate an ADT with the shared generator and decode it independently.
|
||||
- Cross-check the XNU window against firmware RAM, reserved-memory and the pinned UEFI memory map.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The previous \[0x80000000, 0x100000000\) candidate overlapped 44 recorded no-map reservations and was removed.
|
||||
- The live FDT is 885,861 bytes with SHA-256 8a653a3e790f29bf2b0f3545135f06fe771360f31da3d37c04f648c26b95e26e and describes the current 12 GiB RAM map.
|
||||
- The former A8000000+10000000 UEFI Kernel carveout overlaps the live initrd B74AC000-B7FFEE30 and is unsuitable for RAM-boot phase 2.
|
||||
- C2400000+10000000 is covered by live RAM, avoids all live reservations and the initrd, and lies in UEFI DXE conventional memory.
|
||||
- The flashed vendor FDT uses generic qcom,sun-qrd compatible strings but retains the elden 3K panel marker, 1904x3040 display and UFS path.
|
||||
- The ADT has no optional RAMDisk, TrustCache or GPU addon placeholders because phase 2.1 has no matching inputs.
|
||||
- The unique chip ID remains a local input and is not stored in the repository.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The ADT contains exactly one continuous memory range.
|
||||
- The range is covered by live firmware RAM and avoids recorded reservations, initrd, GOP and UEFI FD.
|
||||
- DarwinBoot and the UEFI exit map confirm that same range is conventional memory before XNU entry.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The raw live FDT remains local-only because it can contain device identifiers.
|
||||
- Actual DarwinBoot ADT, boot\_args and allocated-window addresses remain runtime evidence.
|
||||
- The live vendor tree and pinned 16 GiB source differ in RAM size and generic compatible strings; both are tracked separately.
|
||||
- SMMU and cache policy are not complete.
|
||||
|
||||
### Next action
|
||||
|
||||
- Phase 2.3: preserve .cache/device/elden-live.fdt locally and rerun the live audit if firmware or boot mode changes; never commit the raw tree. Keep the phase 2 hardware ADT separate from the firmware FDT.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [One 256 MiB XNU range in UEFI DXE conventional memory and board compatible values.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/dts/elden.dts)
|
||||
- `source`: [Sanitised live 12 GiB RAM, reserved-memory and expected GOP framebuffer description.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/dts/elden-firmware-memory.dts)
|
||||
- `source`: [Documented DRAM base, fragmentation risk and memory handoff constraints.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
- `device`: [2026-10-25: owner-connected device produced an 885,861-byte live FDT with SHA-256 8a653a3e790f29bf2b0f3545135f06fe771360f31da3d37c04f648c26b95e26e. The flashed vendor tree reports generic qcom,sun-qrd compatible values but contains elden panel markers, 1904x3040 display, 1d84000 UFS and a 12 GiB RAM map. Raw bytes remain local-only.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>/Users/jerry/Library/Android/sdk/platform-tools/adb shell su -c 'cp /sys/firmware/fdt /data/local/tmp/elden-live.fdt'</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
- `host`: [2026-10-25: the live FDT audit passed with C2400000+10000000. It is in live RAM and UEFI DXE conventional memory, avoids all live reserved-memory and the B74AC000-B7FFEE30 initrd, and reproduces the eight-CPU ADT. No XNU entry is claimed.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/phase2_1_audit.py --firmware-dtb .cache/device/elden-live.fdt --output-dir .cache/phase2.1-live</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8750 UFS host at 0x1d84000 and PHY at 0x1d80000.
|
||||
- 4 KiB logical-sector partition geometry and a root-volume UUID.
|
||||
- Clock, regulator, power-domain and SMMU stream ownership.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The phase 1 defconfig disables Native UFS.
|
||||
- The format 2 component list does not select a storage transport.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Inventory GPT and logical block size without modifying the device.
|
||||
- Bring up UFS in read-only mode and validate known blocks.
|
||||
- Add an SM8750 storage component and root-window input before mounting.
|
||||
|
||||
### Development findings
|
||||
|
||||
- UFSDxe crashed in phase 1 and was removed from the menu path.
|
||||
- There is no elden XNU UFS probe result yet.
|
||||
- The phase 1 FAT payload intentionally bypasses persistent storage.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Controller and PHY initialize.
|
||||
- Read-only capacity, GPT and known-block checks match the device.
|
||||
- The configured OS volume mounts and launchd starts.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Storage is not selected or implemented.
|
||||
- No owner-authored userdata image or root UUID exists.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture a read-only GPT and memory-resource audit, then implement an SM8750 UFS component.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Storage addresses, missing root inputs and phase 1 bypass decision; implementation remains a later phase.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- 1904x3040 bonded dual-DSI panel with DSC.
|
||||
- UEFI GOP framebuffer and splash reservation.
|
||||
- SM8750 DPU/DSI/PHY and backlight sequencing.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The phase 1 menu renders through UEFI GOP.
|
||||
- XNU display and IOMobileFramebuffer components remain disabled.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Keep display handoff on GOP for the first kernel milestone.
|
||||
- Record a visible checkpoint after DarwinBoot.
|
||||
- Add DPU/DSI only after kernel entry is stable.
|
||||
|
||||
### Development findings
|
||||
|
||||
- GOP display is device-verified in the UniXNU menu.
|
||||
- No XNU display provider has been validated.
|
||||
- The panel path remains a known high-risk cold-boot area.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- XNU paints a known pattern through a declared framebuffer handoff.
|
||||
- Userland presentation and backlight transitions work.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No DPU, DSI, DSC or panel node is present in the hardware DTS.
|
||||
- GOP success is not counted as XNU display support.
|
||||
|
||||
### Next action
|
||||
|
||||
- Carry GOP framebuffer properties into DarwinBoot and record the first kernel-visible screen checkpoint.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [GOP menu display was observed on hardware.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-STATUS.md)
|
||||
- `source`: [Display topology, panel risk and GOP-first strategy.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Novatek SPI touch on SPI4 and GPIO 162 interrupt.
|
||||
- Volume and power keys used by the UEFI menu.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The phase 1 menu accepts volume-key input through UEFI.
|
||||
- No XNU HID or Novatek transport is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Preserve UEFI key navigation as the bring-up input path.
|
||||
- Inventory the touch firmware and protocol from read-only sources.
|
||||
- Add QCOM GENI SPI, touch protocol and HID input after XNU boots.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Volume-key menu input is device-verified.
|
||||
- Touch has not been initialized by XNU.
|
||||
- The panel and touch controller share board state that must be validated together.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touch coordinates map to the display.
|
||||
- Contact IDs, releases and multi-touch remain stable.
|
||||
- Buttons produce expected HID events in XNU.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No touch component is selected.
|
||||
- The NT36536 firmware and ABI inputs are not yet integrated.
|
||||
|
||||
### Next action
|
||||
|
||||
- Read the touch controller model and firmware version without modifying flash, then define the board transport.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Volume-key navigation reached the accepted menu.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-STATUS.md)
|
||||
- `source`: [Novatek SPI wiring and input bring-up requirements.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Adreno 830 / gen80000.
|
||||
- GPU firmware, power votes, SMMU and display integration.
|
||||
|
||||
### Configuration
|
||||
|
||||
- GPU and Metal components are not selected.
|
||||
- The first XNU milestone targets CPU/console progress only.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Reach the XNU platform expert without GPU dependencies.
|
||||
- Collect the GPU identity and firmware hashes.
|
||||
- Select and implement a GPU component only after a display provider exists.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The board has no validated XNU GPU path.
|
||||
- Selecting SM8550 Adreno740 would misrepresent the Adreno 830 implementation scope.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- GPU submissions, fences and mapping work.
|
||||
- A known image renders and Metal presentation is visible.
|
||||
|
||||
### Current limits
|
||||
|
||||
- GPU and Metal are explicitly out of the first milestone.
|
||||
|
||||
### Next action
|
||||
|
||||
- Keep GPU unselected until an SM8750-compatible component and firmware inputs exist.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Adreno 830 scope and exclusion from the first milestone.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`not-applicable`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Wi-Fi is outside the current bring-up milestone.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No Wi-Fi or MHI component is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Revisit after the USB or PCIe transport and firmware ownership are established.
|
||||
|
||||
### Development findings
|
||||
|
||||
- There is no verified Wi-Fi source or firmware path for elden.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Not required for this milestone.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Wi-Fi, Bluetooth and cellular are not implemented or claimed.
|
||||
|
||||
### Next action
|
||||
|
||||
- Open a separate network bring-up task when the base kernel and root volume are stable.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`not-applicable`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Audio is outside the current bring-up milestone.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No ADSP, GLink, codec or audio component is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Revisit after platform, storage and display are stable.
|
||||
|
||||
### Development findings
|
||||
|
||||
- There is no elden audio log or firmware inventory.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Not required for this milestone.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Speakers, microphone and DSP routing are not implemented or claimed.
|
||||
|
||||
### Next action
|
||||
|
||||
- Open a separate audio bring-up task with DSP and codec inputs.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- PM8550-class PMIC, RPMh resources and device power domains.
|
||||
- Volume and power key behavior.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The first DTS selects only CPU and GIC resources.
|
||||
- No platform power component is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Keep suspend and CPU power management disabled during first XNU entry.
|
||||
- Record regulator and clock ownership.
|
||||
- Add platform power only after the boot CPU reaches a stable checkpoint.
|
||||
|
||||
### Development findings
|
||||
|
||||
- UEFI power and key handling are verified only at the firmware layer.
|
||||
- The selected OS profile does not supply sleep-disabled, so board.toml now adds it under \[adt.defaults.u32\].
|
||||
- The final Phase 2.1 ADT was decoded with sleep-disabled=1.
|
||||
- The XNU power topology is not complete.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Declared power controls match readings.
|
||||
- Sleep/resume or shutdown transitions restore dependent peripherals.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Battery, charging, thermal and sleep are not implemented.
|
||||
|
||||
### Next action
|
||||
|
||||
- Phase 2.5: use armcpu-diagnostics=1 to observe boot-CPU quiesce/halt behavior. Audit RPMh ownership and keep suspend/secondary CPU power management out of initial qualification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Board hardware and payload policy values.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/board.toml)
|
||||
- `host`: [2026-10-25: independent ADT decode found /defaults sleep-disabled=1. This is source/host evidence, not a device suspend test.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/phase2_1_audit.py --linux-dir .cache/elden-linux</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`host-verified`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- iPad7,1 iPadOS 17.7.11 build 21H461 restore inputs.
|
||||
- Target kernelcache, XNU 10063.141.1, DriverKit and TrustCache ABI inputs.
|
||||
- Android v3 RAM-boot image, a 4 MiB phase 1 embedded FAT payload and a measured 56 MiB phase 2 candidate.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The phase 1 image is produced by the project build script and verified against recorded hashes.
|
||||
- Format 2 output is out/elden/ipados-17.7.11-21H461/elden/.
|
||||
- The 2.2 prelink output is kernel/kernel.macho and its ADT sidecar; no phase 2 boot image is generated.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run scripts/build\_phase1.py for the accepted firmware path.
|
||||
- Fetch the target IPSW components and build the patched 4 KiB XNU.
|
||||
- Prelink against the pinned kernelcache and audit Mach-O, ABI, symbols and ADT.
|
||||
- Package an isolated near-final-size payload only in Phase 2.3.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The documented Phase 1 build was device-verified and the current procedure rebuilds and passes structural checks.
|
||||
- The same current recipe produced 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a instead of the historical accepted image hash; byte-for-byte rebuild identity is not claimed, but the new image completed two owner RAM cold boots.
|
||||
- The verified UniXNU third-party pin is intentionally retained for the accepted build.
|
||||
- Phase 2.2 produced a 21,206,040-byte native kernel and a 54,050,816-byte prelinked kernel. The 57-patch sequence selects 30 executable Apple components, 7 kernel interfaces and 30 module entrypoints.
|
||||
- A 56 MiB FAT16 host volume held the 54,063,968-byte kernel/config/ADT set with 3,734,016 bytes free and a byte-identical kernel readback.
|
||||
- The prelink report remains runtime\_qualified=false, abi\_qualified=false and loadable=false until device execution evidence exists.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All format 2 build steps run from the resolved output directory.
|
||||
- The payload contains the kernel, ADT and declared optional inputs.
|
||||
- The boot image matches the ABL header and size limits.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The format 2 payload and bootimg pipeline is not yet connected to a phase 2 firmware candidate.
|
||||
- The current 4 MiB board payload belongs to phase 1; the phase 2 candidate is 56 MiB and its ABL/initrd/FDT/HOB channel is unverified.
|
||||
- The 2.2 host build used Command Line Tools with an iPhone platform shim because full Xcode is absent; release rebuilding still requires the official Xcode/iPhoneOS SDK.
|
||||
|
||||
### Next action
|
||||
|
||||
- Phase 2.3: build a near-final-size FAT16 payload in an isolated output and verify Android v3 ramdisk, FDT/initrd and HOB delivery before executing the kernel. Keep all phase 2 outputs separate from the accepted phase 1 baseline.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Reproducible phase 1 build commands, hashes and verification checklist.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-HANDOFF.md)
|
||||
- `source`: [Preserved build inputs and remaining format 2 handoff work.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/FORMAT2-MIGRATION.md)
|
||||
- `source`: [Phase 2 gates mapped to the official porting steps, capacity and memory constraints, and separate loader/kernel acceptance criteria; planning only, with no new device qualification.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-HANDOFF.md)
|
||||
- `source`: [Source-derived FDT, firmware RAM and reservation audit, decoded ADT checks, boot CPU parameter policy and remaining runtime evidence.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
- `source`: [Pinned kernelcache, 57-patch XNU build, prelink inventory, symbol/4 KiB audits and measured 56 MiB payload fit.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
- `host`: [Phase 2.0 established a rebuilt phase 1 baseline, preserved prior candidates, verified format 2 output isolation, and did not generate a phase 2 boot image.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>test -e .cache/phase2-plan/UniXNU/out/elden/ipados-17.7.11-21H461/elden/tree</code>. Revision: `dffc3020a85830d0d981a85871d9ab31aac5827d`.
|
||||
- `host`: [2026-10-25: kernelcache f18b4df865405f2a287b84977d7aca745e056d656d9fc9df1662970ce2969de7 produced native kernel 02f216348851ba9ce70616430ff7607be9d3305cbc8b2ae1186f0e7d6b20fce7 and prelinked kernel.macho 65a3e799e1eb7f631a3b146dfc890ef5a8147c8fc613ee383a1665b398fb1ef9; runtime qualification remains false.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>PATH=.cache/phase2-plan/toolchain/bin:.venv/bin:$PATH .venv/bin/python .cache/phase2-plan/UniXNU/unixnu build kernel -D .</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
- `host`: [2026-10-25: a 58,720,256-byte FAT16 volume held all 54,063,968 payload bytes, left 3,734,016 bytes free, and round-tripped kernel.macho with SHA-256 65a3e799e1eb7f631a3b146dfc890ef5a8147c8fc613ee383a1665b398fb1ef9.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>mformat -C -F -T 114688 -v ELDENPH2 -i .cache/phase2.2/payload-fit-56m-20261025-223638.img :: && mcopy -i .cache/phase2.2/payload-fit-56m-20261025-223638.img -s .cache/phase2-plan/UniXNU/out/elden/ipados-17.7.11-21H461/elden/payload/stage/EFI ::/</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`device-verified`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- RAM-only owner-operated boot procedure.
|
||||
- Build and artifact SHA-256 values.
|
||||
- UEFI screen output and recovery path.
|
||||
|
||||
### Configuration
|
||||
|
||||
- verify\_artifact.py checks the FD, Android image and embedded FAT.
|
||||
- build.json records artifact sizes and hashes.
|
||||
- The phase 1 acceptance requires two consecutive cold boots.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build and verify the image.
|
||||
- Owner runs fastboot boot twice and records the visible result.
|
||||
- Power off and confirm stock Android before further work.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The original accepted image is b56ef4b7e5a71382b8c279c4ee1560764fabd126ba37ac0fd6e495c80b9ec6e1.
|
||||
- Earlier UFSDxe failure images are identified and must not be reused.
|
||||
- Phase 2 requires separate kernel and DarwinBoot evidence.
|
||||
- On 2026-10-25 a fresh phase 1 rebuild produced image SHA-256 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a and FD SHA-256 e5420517d55f4b638c07617a252d3a65c95cfb731584dcb10dd1d98bae412580. The build and prior local candidate were read-only preserved under .cache/phase2.0, and the owner then completed two RAM cold boots of the new image.
|
||||
- Phase 2.1 host auditing now checks the ADT independently and records FDT, ADT, UEFI memory and boot argument sources under .cache/phase2.1 without replacing phase 1 artifacts.
|
||||
- Phase 2.2 audits passed for 1,010 target objects, 7,730 prelink XML tags, iOS 17.0 deployment, 4 KiB TCR and the expected ArmDTPlatform/ArmCpu symbols. These are host-only checks.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every claimed checkpoint has a reproducible command, image hash and visible result.
|
||||
- Failures reach a diagnosable screen or log instead of a silent hang.
|
||||
|
||||
### Current limits
|
||||
|
||||
- There is no phase 2 XNU log or ADT handoff evidence yet.
|
||||
- The generated hardware ADT input is a minimal host candidate. The separate firmware memory description contains the source-derived reservation map, but neither is a live device FDT.
|
||||
- The historical accepted image bytes are absent from the workspace, so they cannot be booted or byte-compared locally.
|
||||
|
||||
### Next action
|
||||
|
||||
- Proceed with phase 2.3 using isolated outputs. Before any phase 2 device boot, rerun the Phase 2.1 audit against the owner-captured live firmware FDT. Record source, host and device evidence separately for every gate; loader validation, kernel entry, platform expert and boot CPU require distinct checkpoints and two final-image cold boots.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Recorded phase 1 artifact sizes and SHA-256 values.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/out/build.json)
|
||||
- `source`: [The elden Linux reference now matches soc/sm8750/soc.toml at h0cheung/tb322fc-linux-kernel 6f97250ead155fc3b980856323e99a4623dae73d.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/unixnu.lock)
|
||||
- `host`: [2026-10-25: a fresh phase 1 rebuild completed in 6:46 and passed static Android v3, shim, FD, embedded FAT and module checks. Image SHA-256 was 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a and FD SHA-256 was e5420517d55f4b638c07617a252d3a65c95cfb731584dcb10dd1d98bae412580; no device boot was performed.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/build_phase1.py --skip-submodules --crypto-path $PWD/.cache/phase1/basecrypto</code>. Revision: `dffc3020a85830d0d981a85871d9ab31aac5827d`.
|
||||
- `device`: [2026-10-25: owner confirmed two RAM cold boots of image 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a; both reached the usable UniXNU menu and stock Android resumed after exit. This evidence covers phase 1 only.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `dffc3020a85830d0d981a85871d9ab31aac5827d`.
|
||||
- `host`: [2026-10-25: DTC 1.8.1-gf99e3af0 generated a 1,557-byte DTB with SHA-256 60316b6d4e753610610126d691f6d39ba54edd21e9b02875ec034e81e27a4371; round-trip inspection found the expected compatible strings, CPU MPIDRs, PSCI, GICv3, timer and DRAM data.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>.cache/dtc-src/dtc -I dts -O dtb -i soc/sm8750/dts -o /tmp/elden-phase2.0.dtb dts/elden.dts</code>. Revision: `f99e3af0ecb67a9085478a9b8ddbcc25aa64931d`.
|
||||
- `host`: [2026-10-25: live-FDT audit produced a 13,152-byte ADT. Independent checks passed for C2400000+10000000 RAM/reservation/initrd coverage, UEFI DXE conventional memory, framebuffer, eight MPIDRs, one running boot CPU, GIC, timer, CHRP NVRAM, optional placeholders and sleep-disabled=1. Report: .cache/phase2.1-live/audit.json.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/phase2_1_audit.py --firmware-dtb .cache/device/elden-live.fdt --output-dir .cache/phase2.1-live</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
- `host`: [2026-10-25: native kernel audited as arm64/iOS 17 with 4 KiB TG0 and TG1; 1,010 target objects passed; the pinned prelink XML lexer accepted 7,730 tags. No device checkpoint is claimed.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>python3 scripts/audit-xnu-kernel.py build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf && python3 scripts/audit-xnu-objects.py && python3 scripts/check-prelink-xml.py ../kernel/kernel.macho</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
- `device`: [Two cold boots reached DISPLAY OK, INPUT OK, config loaded and menu shown.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-STATUS.md)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `c591b1a0a471f24978aba25c56c8f6ec9bd06668`.
|
||||
- `device`: [Screen capture shows the rendered UniXNU menu on the tablet.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/assets/phase1-menu-20261025.jpg)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `c591b1a0a471f24978aba25c56c8f6ec9bd06668`.
|
||||
|
||||
</div>
|
||||
@@ -0,0 +1 @@
|
||||
[alghiffaryfa19/UniXNU-enuma-5g](https://github.com/alghiffaryfa19/UniXNU-enuma-5g)
|
||||
@@ -0,0 +1 @@
|
||||
[Tlrenhb/UniXNU-enuma](https://github.com/Tlrenhb/UniXNU-enuma)
|
||||
@@ -0,0 +1 @@
|
||||
[0721GPT/UniXNU-fuxi](https://github.com/0721GPT/UniXNU-fuxi)
|
||||
@@ -0,0 +1 @@
|
||||
[hanzi123-bilp/unixnu-fuxi](https://github.com/hanzi123-bilp/unixnu-fuxi)
|
||||
@@ -0,0 +1 @@
|
||||
[ljhhkx529/unixnu-fuxi](https://github.com/ljhhkx529/unixnu-fuxi)
|
||||
@@ -0,0 +1 @@
|
||||
[MinecraftVM/UniXNU-fuxi](https://github.com/MinecraftVM/UniXNU-fuxi)
|
||||
@@ -0,0 +1 @@
|
||||
[mouse233/unixnu-fuxi](https://github.com/mouse233/unixnu-fuxi)
|
||||
@@ -0,0 +1 @@
|
||||
[Sohytrs/UniXNU-fuxi](https://github.com/Sohytrs/UniXNU-fuxi)
|
||||
@@ -0,0 +1 @@
|
||||
[Xyvern08371/UniXNU-sheng](https://github.com/Xyvern08371/UniXNU-sheng)
|
||||
@@ -0,0 +1 @@
|
||||
[ilovemykedi/UniXNU-gta4l](https://github.com/ilovemykedi/UniXNU-gta4l)
|
||||
@@ -0,0 +1 @@
|
||||
[xiaomi-haydn-dev/UniXNU-haydn4](https://github.com/xiaomi-haydn-dev/UniXNU-haydn4)
|
||||
+544
-20
@@ -1,31 +1,555 @@
|
||||
# Samsung Galaxy S7 Edge (hero2lte)
|
||||
# Samsung Galaxy S7 Edge \(hero2lte\)
|
||||
|
||||
A community device port for Exynos 8890.
|
||||
[DokuroMitsukai/UniXNU-hero2lte](https://github.com/DokuroMitsukai/UniXNU-hero2lte)
|
||||
|
||||
- [DokuroMitsukai/UniXNU-hero2lte](https://github.com/DokuroMitsukai/UniXNU-hero2lte)
|
||||
- [DokuroMitsukai/UniXNU-exynos8890-common](https://github.com/DokuroMitsukai/UniXNU-exynos8890-common)
|
||||
<div v-pre>
|
||||
|
||||
## State
|
||||
Samsung Galaxy S7 Edge \(SM-G935F\) on Exynos 8890. Phase 1 is a Mu-Silicium UEFI firmware with display and keypad input. XNU requires GICv2 support in ArmCpu, native storage, display, input and power drivers, and verified EFS/CPEFS backups before any wipe.
|
||||
|
||||
The format 2 tree selects shared Exynos 8890 support: GIC-400, PSCI and the 26 MHz timer, with CPU0 enabled. Mu-Silicium firmware builds with UniXNU, the RAM payload driver and DarwinBoot in the firmware volume. BootShim and keypad host checks pass.
|
||||
Source record: [porting.toml](https://github.com/DokuroMitsukai/UniXNU-hero2lte/blob/53ccc853aefa388215504ddc75ca8f602917e6e3/porting.toml), `53ccc853aefa388215504ddc75ca8f602917e6e3`.
|
||||
|
||||
Hardware boot and payload validation remain pending. The selected ArmCpu path needs GICv2 support before XNU startup; storage, display, input and power drivers require board integration.
|
||||
This page is generated from the device record.
|
||||
|
||||
## Use this port
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [Configuration](#configuration) | `host-verified` |
|
||||
| [Firmware and boot](#firmware) | `host-verified` |
|
||||
| [CPU and interrupts](#cpu) | `planned` |
|
||||
| [Memory and DMA](#memory) | `planned` |
|
||||
| [Storage and root](#storage) | `planned` |
|
||||
| [Display](#display) | `planned` |
|
||||
| [Input](#input) | `planned` |
|
||||
| [GPU](#gpu) | `planned` |
|
||||
| [Network](#network) | `planned` |
|
||||
| [Audio](#audio) | `planned` |
|
||||
| [Power](#power) | `planned` |
|
||||
| [Image assembly](#packaging) | `planned` |
|
||||
| [Diagnostics](#diagnostics) | `planned` |
|
||||
|
||||
1. Read the pinned instructions and records below. Prepare the firmware, system inputs and build tools they specify.
|
||||
2. Clone the device sources and prepare the matching core and firmware checkouts described by its README:
|
||||
## Configuration {#configuration}
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/DokuroMitsukai/UniXNU-hero2lte.git
|
||||
cd UniXNU-hero2lte
|
||||
git checkout 53ccc853aefa388215504ddc75ca8f602917e6e3
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
`host-verified`
|
||||
|
||||
3. Run the build from the working directory specified by that revision's instructions. Check its documented outputs and remaining inputs.
|
||||
4. Follow the [bring-up order](/porting/bring-up), save [logs](/porting/log-capture) and complete the [porting record](/porting/records). See [porting steps](/porting/steps) for board structure and component selection.
|
||||
### Hardware and dependencies
|
||||
|
||||
## Sources
|
||||
- SM-G935F \(hero2lte\), Exynos 8890, bootloader G935FXXS6ESI4, framebuffer at 0xE2A00000.
|
||||
- iPadOS 17.7.11 build 21H461 is the only OS profile in this UniXNU revision.
|
||||
|
||||
- [README: DokuroMitsukai/UniXNU-hero2lte](https://github.com/DokuroMitsukai/UniXNU-hero2lte/blob/53ccc853aefa388215504ddc75ca8f602917e6e3/README.md)
|
||||
### Configuration
|
||||
|
||||
- board.soc = Exynos 8890; board.soc\_source = exynos8890; board.os\_profile = ipados-17.7.11-21H461; schema\_version = 2.
|
||||
- Firmware paths select the DokuroMitsukai/Mu-Silicium hero2lte package and the five Mu\_Basecore patches that package requires.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ./unixnu defconfig hero2lte\_defconfig -D ../UniXNU-hero2lte from UniXNU.
|
||||
- Run ./unixnu fetch -D ../UniXNU-hero2lte to resolve base sources and write unixnu.lock.
|
||||
- Run ./unixnu status --json -D ../UniXNU-hero2lte and review profiles, components, source pins and patch order.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The ARM64, SoC, OS and device tables merge in that order. Ordinary arrays replace inherited arrays, so board.toml repeats the complete component, fragment and patch-series lists.
|
||||
- The SM-G935F keeps TWRP on RECOVERY. No configuration step touches that partition.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All source pins resolve; every selected component has an area; status shows the intended profiles and patch order.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The published SoC feed is pinned in feeds.toml and unixnu.lock; fetch succeeds without a local source override.
|
||||
- No hardware checkpoint exists for this board.
|
||||
|
||||
### Next action
|
||||
|
||||
- Keep the published SoC revision synchronized between feeds.toml and unixnu.lock.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Board identity, component selection, firmware paths and boot image parameters](https://github.com/DokuroMitsukai/UniXNU-hero2lte/blob/53ccc853aefa388215504ddc75ca8f602917e6e3/board.toml)
|
||||
- `host`: [schema\_version 2 resolved the arch, exynos8890, iPadOS and device profiles with the selected components and patch series](https://github.com/DokuroMitsukai/UniXNU-hero2lte/blob/53ccc853aefa388215504ddc75ca8f602917e6e3/unixnu.lock)
|
||||
Command: <code>./unixnu status --json -D ../UniXNU-hero2lte</code>. Revision: `e9fb02f99c4cc2e6c882b1c2b6443fd342bc85e0`.
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `DarwinBoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Mu-Silicium hero2lte firmware, S-Boot framebuffer at 0xE2A00000 with size 0xE10000, UEFI FD base 0xC9000000 and size 0x200000.
|
||||
- Firmware version G935FXXS6ESI4 and the five Mu\_Basecore patches used by the package.
|
||||
|
||||
### Configuration
|
||||
|
||||
- firmware.config = hero2lte; DSC = Platforms/Samsung/hero2ltePkg/hero2lte.dsc; FD = Build/hero2ltePkg/&\#123;target&\#125;\_CLANGPDB/FV/SILICIUM\_UEFI.fd.
|
||||
- The package list mirrors the working Mu-Silicium build and adds &\#123;tree&\#125;/package and &\#123;tree&\#125;/drivers/DarwinBoot for UniXNU.
|
||||
|
||||
### Procedure
|
||||
|
||||
- The standalone build runs ./build-hero2lte.sh -c at the workspace root; test\_bootshim.py and test\_hero2lte\_keypad.py pass.
|
||||
- The DSC and DXE.inc add UniXNU.inf, UniXNUDxe.inf, UniXNURamDiskDxe.inf, DarwinBoot.inf, DiskIoDxe, PartitionDxe, EnglishDxe and Fat behind UNIXNU\_PAYLOAD=1.
|
||||
- ./unixnu build firmware --uefi ../Mu-Silicium --target RELEASE -D ../UniXNU-hero2lte applies the five base patches and builds the 2 MiB FD.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The standalone image is an Android v0 header at 0x10000000 with kernel at 0x10008000 and tags at 0x10000100; the kernel field is exactly BootShim plus the 2 MiB FD.
|
||||
- The standalone image omits the stock DTBH table and SEANDROIDENFORCE footer. S-Boot acceptance is untested.
|
||||
- The standalone build is bit-for-bit reproducible and the DECON trigger is preserved instead of writing the Exynos 8895 value 0x1281.
|
||||
- With UNIXNU\_PAYLOAD=1 the UniXNU firmware build links UniXNU, UniXNUDxe, UniXNURamDiskDxe and DarwinBoot. FVMAIN grows from 0x20a000 to 0x235000 inside the 2 MiB FD.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Firmware builds, enters UniXNU, publishes the framebuffer, keeps the payload FAT readable and preserves the reserved-memory ranges.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No hardware boot attempt yet.
|
||||
- The integrated firmware has no payload or boot image yet.
|
||||
|
||||
### Next action
|
||||
|
||||
- Boot the integrated firmware and verify the UniXNU menu and payload FAT.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [hero2lte firmware package, keypad library, host tests and optional UniXNU payload integration](https://github.com/DokuroMitsukai/Mu-Silicium/commit/5790015a98714044d72d5037cea300b40f66a2e0)
|
||||
- `host`: [2 MiB SILICIUM\_UEFI.fd contains UniXNU, UniXNUDxe, UniXNURamDiskDxe and DarwinBoot; FVMAIN used 0x235000 and FVMAIN\_COMPACT kept 0x194998 free](https://github.com/DokuroMitsukai/UniXNU-hero2lte/blob/53ccc853aefa388215504ddc75ca8f602917e6e3/board.toml)
|
||||
Command: <code>./unixnu build firmware --uefi ../Mu-Silicium --target RELEASE -D ../UniXNU-hero2lte</code>. Revision: `5790015a98714044d72d5037cea300b40f66a2e0`.
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`planned`
|
||||
|
||||
Components: `ArmCpu`, `ArmDTPlatform`, `SoftwareAES`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Four Mongoose cores at MPIDR 0x0-0x3 and four Cortex-A53 cores at MPIDR 0x100-0x103 with a 26 MHz generic timer.
|
||||
- GIC-400 at 0x11001000: distributor 0x11001000, CPU interface 0x11002000, GICH 0x11004000 and GICV 0x11006000; PPIs 13, 14, 11 and 10.
|
||||
|
||||
### Configuration
|
||||
|
||||
- exynos8890.dtsi declares all eight CPUs, PSCI 0.2 over SMC, GICv2 and the generic timer. hero2lte.dts enables only cpu0 for the first bring-up.
|
||||
- ArmCpu and ArmDTPlatform come from the UniXNU catalog. SoftwareAES keeps the shared ARM64 component set complete.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the board DTS and inspect /cpus, /psci, /arm-io/intc and timebase-frequency in the generated ADT.
|
||||
- Record per-CPU entry, timer interrupts and IPI delivery on hardware.
|
||||
|
||||
### Development findings
|
||||
|
||||
- ArmCpu registers only the compatible string arm,gic-v3 and requires a 32-byte reg property with a distributor and redistributors. GIC-400 exposes four ranges, so mapGic rejects this tree.
|
||||
- The stock timer node sets use-clocksource-only and Android uses MCT ticks for events. The architectural timer PPI is unvalidated.
|
||||
- Cluster 0 is Mongoose and cluster 1 is Cortex-A53 on this SoC, the opposite of the usual big-little numbering.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every enabled CPU reaches its entry checkpoint and timer and IPI handling works on each enabled CPU.
|
||||
|
||||
### Current limits
|
||||
|
||||
- GICv2 MMIO support and the timer interrupt path are not implemented.
|
||||
- Only one CPU is enabled.
|
||||
|
||||
### Next action
|
||||
|
||||
- Add GICv2 distributor, CPU-interface and timer handling to ArmCpu before enabling secondary CPUs.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Board CPU selection on top of the shared exynos8890.dtsi](https://github.com/DokuroMitsukai/UniXNU-hero2lte/blob/53ccc853aefa388215504ddc75ca8f602917e6e3/dts/hero2lte.dts)
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- RAM ranges from the stock DTB: 0x80000000 with size 0x7e400000 and 0x880000000 with size 0x80000000.
|
||||
- S-Boot framebuffer at 0xE2A00000 with size 0xE10000; the DT video\_frame and video\_scaler regions also reserve display buffers.
|
||||
|
||||
### Configuration
|
||||
|
||||
- hero2lte.dts declares the low 0x7e400000 range as the XNU memory node and the framebuffer as reserved-memory.
|
||||
- The upper 2 GiB range is not described yet because the common ADT generator currently expects one contiguous memory node.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the DTS and compare the generated ADT memory range with the stock DTB.
|
||||
- Verify that DarwinBoot's owned window excludes the framebuffer and the DT video pools.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The provisional Mu-Silicium MemoryMapLib overlaps the DT video\_frame and video\_scaler pools; safety is unproven.
|
||||
- The framebuffer lies inside the low RAM range, so the PMAP must reserve it before XNU maps RAM.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every handoff and reserved range is accounted for and DMA masters use only their allocated windows.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Upper 2 GiB RAM is unused.
|
||||
- Reserved-memory conversion and framebuffer exclusion are unverified.
|
||||
|
||||
### Next action
|
||||
|
||||
- Decide how the ADT generator represents the second RAM range and the display reservations.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Memory range and framebuffer reservation](https://github.com/DokuroMitsukai/UniXNU-hero2lte/blob/53ccc853aefa388215504ddc75ca8f602917e6e3/dts/hero2lte.dts)
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UFS controller at 0x155A0000. The GPT uses 4096-byte logical sectors.
|
||||
- USERDATA is partition 18, first LBA 2085544, last LBA 7806207.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The SoC DTSI describes the UFS controller and leaves it disabled.
|
||||
- userdata geometry is deliberately absent from board.toml until the EFS and CPEFS backups are verified.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Capture EFS and CPEFS from TWRP with device-dump/capture-critical.py and verify both SHA-256 digests.
|
||||
- Select or implement an Exynos UFS host driver before enabling the node.
|
||||
|
||||
### Development findings
|
||||
|
||||
- ShengUfs targets Qualcomm UFS and cannot be reused directly.
|
||||
- KernelSU is installed but adb shell has no root, so the critical backup needs TWRP or a root grant.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Host facts match the board; reads return the expected GPT; the configured root volume mounts and launchd starts.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No storage driver and no verified EFS/CPEFS backup.
|
||||
- No wipe or repartition is allowed in this state.
|
||||
|
||||
### Next action
|
||||
|
||||
- Obtain the EFS/CPEFS backup, then select or implement the UFS host driver.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- s6e3hf4 SVC\_OCTA panel at 1440x2560, 32 bpp, handed over at 0xE2A00000 by S-Boot.
|
||||
- The stock DT reserves video\_frame and video\_scaler pools for the display pipeline.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Mu-Silicium SimpleFbDxe publishes a GOP from the S-Boot framebuffer address. No native display driver is selected yet.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build the Phase 1 firmware and capture the menu on the panel.
|
||||
- Record geometry, colors and backlight behavior before adding a native driver.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The standalone firmware builds, but the display path has no hardware checkpoint.
|
||||
- DECON's trigger register is logged and left untouched because the Exynos 8895 value is not evidence for 8890.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- A known frame appears with correct geometry and colors, then userland presentation and backlight controls work.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No display hardware checkpoint.
|
||||
- No brightness or native scanout driver.
|
||||
|
||||
### Next action
|
||||
|
||||
- Boot the Phase 1 firmware and record the display result.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- gpio\_keys from the stock DTB: volume up GPA0-3, volume down GPA0-4, home GPA0-5, power GPA2-4, all active low.
|
||||
- The keypad banks are at 0x10580000 with DAT at offset 0x04.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Mu-Silicium KeypadDeviceLib polls the GPA0 and GPA2 data registers, applies a 20 ms debounce and maps press-only events to the menu.
|
||||
- The SoC DTSI does not export a pinctrl node because XNU has no Samsung pinctrl driver.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run Resources/Scripts/test\_hero2lte\_keypad.py in the firmware checkout.
|
||||
- Hold Volume Up at reset and record the menu response on hardware.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The keypad host test passes. Device input is untested.
|
||||
- Touch needs a separate component and has no driver yet.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Only keypad logic exists; touch and XNU gpio-keys integration are pending.
|
||||
|
||||
### Next action
|
||||
|
||||
- Validate keypad input in the Phase 1 firmware menu.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The stock DT exposes G3D power and DVS nodes but no Mali node.
|
||||
- The GPU model, power sequence and SMMU inputs still need to be recorded from the vendor kernel.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No GPU component is selected. The Adreno components target Qualcomm hardware and do not apply.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Inventory the GPU from the vendor kernel and board files before selecting a component.
|
||||
- Record power-domain and SMMU requirements in this area.
|
||||
|
||||
### Development findings
|
||||
|
||||
- No UniXNU component currently supports the Exynos 8890 GPU.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- GPU submissions complete, mapping and fence handling are correct, a known image renders, and the selected Metal client presents it.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No GPU inventory, driver or hardware result.
|
||||
|
||||
### Next action
|
||||
|
||||
- Identify the GPU and its power and SMMU inputs from the vendor kernel.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The stock boot DT has no wireless controller node; the chip must be identified from the vendor kernel and board files.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No network component is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Inventory the wireless chip, firmware files and bus before selecting a driver.
|
||||
- Add firmware paths and hashes to proprietary-files.txt.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Wi-Fi firmware and driver inputs are not collected yet.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Scanning, association, address configuration and sustained receive and transmit traffic pass with the selected firmware.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No wireless inventory or driver.
|
||||
|
||||
### Next action
|
||||
|
||||
- Identify the wireless chip and its firmware from the vendor kernel.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The stock boot DT describes no audio route; the codec and DSP inputs still need to be recorded.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No audio component is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Inventory the codec, DSP and amplifier wiring before selecting a component.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Audio hardware and firmware inputs are not collected yet.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each declared route carries the selected audio format through playback or capture and handles start and stop correctly.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No audio inventory or driver.
|
||||
|
||||
### Next action
|
||||
|
||||
- Identify the audio hardware from the vendor kernel and schematics.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The stock DT names max77854 PMIC and MUIC, s2mpb02 sub-PMIC, max77838 and p9220 wireless charger.
|
||||
- Battery and charger policy are not yet inventoried.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No power component is selected and no regulator or charger driver runs.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Inventory regulators, charger and battery reporting from the vendor kernel.
|
||||
- Record sleep and resume dependencies before claiming a power transition.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The firmware leaves power management to S-Boot and UEFI defaults.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Declared power controls and battery readings match observations; each claimed sleep or resume transition restores dependent peripherals.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No battery, charger or power-domain driver.
|
||||
|
||||
### Next action
|
||||
|
||||
- Inventory the PMIC and charger topology from the vendor kernel.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`planned`
|
||||
|
||||
Components: `XnuPrelink`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- XNU 10063.141.1 and Darwin 23.6.0 from the iPadOS profile.
|
||||
- Android v0 boot image: base 0x10000000, kernel 0x10008000, tags 0x10000100, page size 2048.
|
||||
|
||||
### Configuration
|
||||
|
||||
- patch\_series covers the arch, SoC, OS and device series in that order.
|
||||
- kernel.defconfig = hero2lte\_defconfig.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ./unixnu build kernel, ./unixnu build package and ./unixnu build payload once the kernel inputs exist.
|
||||
- Pack the image with ./unixnu bootimg and inspect boot.json before flashing.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The standalone Mu-Silicium boot image already uses the v0 layout and passes the BootShim host tests.
|
||||
- No XNU kernel, payload or UniXNU boot image has been built for this board.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Kernel and prelink succeed, the payload contains all declared inputs, and the boot image matches the bootloader format and size limit.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No kernelcache, trust cache or data ramdisk is available.
|
||||
|
||||
### Next action
|
||||
|
||||
- Build the kernel after ArmCpu GICv2 support and the first hardware checkpoint.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Porting record CI, UniXNU status output and firmware or kernel logs.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The record workflow from the template is kept. unixnu.lock pins the resolved sources.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run python3 scripts/porting-record.py check --device ../UniXNU-hero2lte after each record change.
|
||||
- Capture the firmware log before kernel handoff once the log exporter is integrated.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Host build logs exist locally; no firmware or kernel log has been captured from the device.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each claimed milestone has a reproducible command, a matching revision and an accessible result.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No QR log exporter or persistent capture in the firmware yet.
|
||||
|
||||
### Next action
|
||||
|
||||
- Add the firmware log exporter before the first hardware boot.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
</div>
|
||||
+145
-136
@@ -1,144 +1,153 @@
|
||||
# Devices
|
||||
|
||||
Each entry identifies a board or virtual target, its maintained sources and its reported build and boot results. Devices sharing a SoC have separate entries for their board configuration and peripherals.
|
||||
Open a device page for its sources, configuration and porting record. Format 2 pages use porting.toml at the pinned source revision.
|
||||
|
||||
## Select and use a device
|
||||
Follow [Build and boot](/building), [porting steps](/porting/steps) and [log capture](/porting/log-capture) for build and validation procedures.
|
||||
|
||||
1. Open the target device below and confirm its product, SoC and maintained repositories.
|
||||
2. Read its inputs, current results and unfinished areas. Use the firmware, OS profile and partition values specified by that port.
|
||||
3. Follow [Build and boot](/building) to build it, [Port a device](/porting/steps) to adapt new hardware, or [Migration](/porting/migration) to update the repository format.
|
||||
4. Verify the checkpoints in its record and save the source, firmware and image revisions actually used.
|
||||
|
||||
## Organization-maintained devices
|
||||
|
||||
| Device | SoC | Support | Device repository | Firmware |
|
||||
| Device | SoC | Format | Documentation | Repository |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| [Xiaomi Pad 6S Pro (sheng)](/devices/sheng) | SM8550 | [Implementation and evidence by area](/devices/sheng) | [UniXNU-sheng](https://github.com/UniXNU/UniXNU-sheng) | [uefi-sheng](https://github.com/UniXNU/uefi-sheng) |
|
||||
| [Xiaomi Pad 6S Pro \(sheng\)](/devices/sheng) | SM8550 | 2 | Porting record | [UniXNU/UniXNU-sheng](https://github.com/UniXNU/UniXNU-sheng) |
|
||||
| [Benesse TAB-A04-BR3 \(a04br3\)](/devices/a04br3) | MT8167 | 1 | Device notes | [mouseos/UniXNU-a04br3](https://github.com/mouseos/UniXNU-a04br3) |
|
||||
| [Redmi K40 \(alioth\)](/devices/alioth) | SM8250 | 2 | Record pending | [FFT-infra/UniXNU-alioth](https://github.com/FFT-infra/UniXNU-alioth) |
|
||||
| [Xiaomi Redmi K40 \(alioth, M2012K11AC\) \(yang232138\)](/devices/alioth-yang232138) | SM8250 | 2 | Record pending | [yang232138/UniXNU-alioth](https://github.com/yang232138/UniXNU-alioth) |
|
||||
| [Redmi Note 14 Pro+ 5G \(amethyst\)](/devices/amethyst) | SM7635 | 1 | Device notes | [andr0d1v/UniXNU-amethyst](https://github.com/andr0d1v/UniXNU-amethyst) |
|
||||
| [Xiaomi Redmi Note 14 Pro+ 5G \(BluedMC-Amethyst\)](/devices/amethyst-bluedmc-amethyst) | SM7635 | 1 | Repository link | [BluedMC-Amethyst/UniXNU-amethyst](https://github.com/BluedMC-Amethyst/UniXNU-amethyst) |
|
||||
| [Nothing Phone \(3a\) \(asteroids\)](/devices/asteroids) | SM7635 | 1 | Device notes | [rootstockos/UniXNU-asteroids](https://github.com/rootstockos/UniXNU-asteroids) |
|
||||
| [Brave Ark tablet \(braveark\)](/devices/braveark) | SM8635 | 1 | Device notes | [tattwamashi/UniXNU-braveark](https://github.com/tattwamashi/UniXNU-braveark) |
|
||||
| [OnePlus Pad Pro \(caihong\)](/devices/caihong) | SM8650 | 1 | Device notes | [Axiang-dev/UniXNU-caihong](https://github.com/Axiang-dev/UniXNU-caihong) |
|
||||
| [Redmi Note 10 5G \(camellia\)](/devices/camellia) | MT6833 | 2 | Record pending | [stanveyjiang/UniXNU-camellia](https://github.com/stanveyjiang/UniXNU-camellia) |
|
||||
| [Xiaomi 10 Ultra \(cas\)](/devices/cas) | | 1 | Device notes | [ht94911/UniXNU-cas](https://github.com/ht94911/UniXNU-cas) |
|
||||
| [Xiaomi Mi 10 Ultra \(pxl777806\)](/devices/cas-pxl777806) | SM8250 | 1 | Repository link | [pxl777806/UniXNU-cas](https://github.com/pxl777806/UniXNU-cas) |
|
||||
| [Xiaomi Mi 9 \(cepheus\)](/devices/cepheus) | SM8150 | 1 | Device notes | [sxl47/UniXNU-cepheus](https://github.com/sxl47/UniXNU-cepheus) |
|
||||
| [OnePlus 5 \(cheeseburger\)](/devices/cheeseburger) | MSM8998 | 1 | Device notes | [DinnerABC/UniXNU-cheeseburger](https://github.com/DinnerABC/UniXNU-cheeseburger) |
|
||||
| [OnePlus 5 \(lss717\)](/devices/cheeseburger-lss717) | MSM8998 | 1 | Repository link | [lss717/UniXNU-cheeseburger](https://github.com/lss717/UniXNU-cheeseburger) |
|
||||
| [OnePlus 5 \(maozedongae\)](/devices/cheeseburger-maozedongae) | MSM8998 | 1 | Repository link | [maozedongae/UniXNU-cheeseburger](https://github.com/maozedongae/UniXNU-cheeseburger) |
|
||||
| [Xiaomi MIX 2 \(chiron\)](/devices/chiron) | MSM8998 | 1 | Device notes | [to-mid/ios-party](https://github.com/to-mid/ios-party) |
|
||||
| [Xiaomi Mi MIX 2, 6 GB / 128 GB; measured revision 2.1 \(sbccc1888\)](/devices/chiron-sbccc1888) | MSM8998 | 1 | Repository link | [sbccc1888/ios-party](https://github.com/sbccc1888/ios-party) |
|
||||
| [Xiaomi Mi Pad 4 LTE \(clover\)](/devices/clover) | SDM660 | 1 | Device notes | [qine233/UniXNU-clover](https://github.com/qine233/UniXNU-clover) |
|
||||
| [Xiaomi 15 \(dada\)](/devices/dada) | SM8750 | 1 | Device notes | [7Night-kqx/UniXNU-dada](https://github.com/7Night-kqx/UniXNU-dada) |
|
||||
| [Redmi K80 Ultra \(dali\)](/devices/dali) | MT6991 | 1 | Device notes | [localhosts-A/UniXNU-Dali](https://github.com/localhosts-A/UniXNU-Dali) |
|
||||
| [Redmi 9A \(dandelion\)](/devices/dandelion) | MT6765 | 1 | Device notes | [licg89/UniXNU-dandelion](https://github.com/licg89/UniXNU-dandelion) |
|
||||
| [Xiaomi Mi 8 \(dipper\)](/devices/dipper) | SDM845 | 1 | Device notes | [hanyaa380/UniXNU-dipper](https://github.com/hanyaa380/UniXNU-dipper) |
|
||||
| [DroidVM guest \(crosvm on Gunyah\)](/devices/droidvm) | crosvm-gunyah | 1 | Device notes | [Droid-VM/UniXNU-droidvm](https://github.com/Droid-VM/UniXNU-droidvm) |
|
||||
| [DroidVM guest \(crosvm on Gunyah\) \(lateautumn233\)](/devices/droidvm-lateautumn233) | crosvm-gunyah | 1 | Repository link | [lateautumn233/UniXNU-droidvm](https://github.com/lateautumn233/UniXNU-droidvm) |
|
||||
| [DroidVM guest \(crosvm on Gunyah\) \(Neko17awa\)](/devices/droidvm-neko17awa) | crosvm-gunyah | 1 | Repository link | [Neko17awa/UniXNU-droidvm](https://github.com/Neko17awa/UniXNU-droidvm) |
|
||||
| [Rongyue E5 \(e5\)](/devices/e5) | UMS9621 | 2 | Record pending | [Enceka/UniXNU-e5](https://github.com/Enceka/UniXNU-e5) |
|
||||
| [Lenovo Legion Y700 Gen 4 \(elden\)](/devices/elden) | SM8750P | 2 | Porting record | [jerry-2009/UNIXNU_elden](https://github.com/jerry-2009/UNIXNU_elden) |
|
||||
| [Xiaomi Pad 5 Pro Wi-Fi \(elish\)](/devices/elish) | SM8250-AC | 1 | Device notes | [hpadmx/UniXNU-elish](https://github.com/hpadmx/UniXNU-elish) |
|
||||
| [OnePlus 6 \(enchilada\)](/devices/enchilada) | SDM845 | 1 | Device notes | [keyfan/UniXNU-enchilada](https://github.com/keyfan/UniXNU-enchilada) |
|
||||
| [Xiaomi Pad 5 Pro 5G \(enuma\)](/devices/enuma) | SM8250 | 1 | Device notes | [wh1stl3/UniXNU-enuma](https://github.com/wh1stl3/UniXNU-enuma) |
|
||||
| [Xiaomi Pad 5 Pro 5G / iPadOS 17.7.11 bring-up \(alghiffaryfa19\)](/devices/enuma-alghiffaryfa19) | SM8250 | 1 | Repository link | [alghiffaryfa19/UniXNU-enuma-5g](https://github.com/alghiffaryfa19/UniXNU-enuma-5g) |
|
||||
| [Xiaomi Pad 5 Pro 5G \(Tlrenhb\)](/devices/enuma-tlrenhb) | SM8250-AC | 1 | Repository link | [Tlrenhb/UniXNU-enuma](https://github.com/Tlrenhb/UniXNU-enuma) |
|
||||
| [OnePlus Pad 2 Pro \(erhai\)](/devices/erhai) | SM8750 | 1 | Device notes | [wally001012-cyber/UniXNU-erhai](https://github.com/wally001012-cyber/UniXNU-erhai) |
|
||||
| [OnePlus 15T \(fairlady\)](/devices/fairlady) | SM8850 | 1 | Device notes | [Osilvfe/UniXNU-fairlady](https://github.com/Osilvfe/UniXNU-fairlady) |
|
||||
| [OnePlus 6T \(fajita\)](/devices/fajita) | SDM845 | 1 | Device notes | [johnpanos/UniXNU-fajita](https://github.com/johnpanos/UniXNU-fajita) |
|
||||
| [Xiaomi 13 \(fuxi\)](/devices/fuxi) | SM8550 | 1 | Device notes | [matejkoo217/UniXNU-fuxi](https://github.com/matejkoo217/UniXNU-fuxi) |
|
||||
| [Xiaomi 13 \(0721GPT\)](/devices/fuxi-0721gpt) | SM8550 | 1 | Repository link | [0721GPT/UniXNU-fuxi](https://github.com/0721GPT/UniXNU-fuxi) |
|
||||
| [Xiaomi 13 \(hanzi123-bilp\)](/devices/fuxi-hanzi123-bilp) | SM8550 | 1 | Repository link | [hanzi123-bilp/unixnu-fuxi](https://github.com/hanzi123-bilp/unixnu-fuxi) |
|
||||
| [Xiaomi 13 \(ljhhkx529\)](/devices/fuxi-ljhhkx529) | SM8550 | 1 | Repository link | [ljhhkx529/unixnu-fuxi](https://github.com/ljhhkx529/unixnu-fuxi) |
|
||||
| [Xiaomi 13 \(MinecraftVM\)](/devices/fuxi-minecraftvm) | SM8550 | 1 | Repository link | [MinecraftVM/UniXNU-fuxi](https://github.com/MinecraftVM/UniXNU-fuxi) |
|
||||
| [Xiaomi 13 \(mouse233\)](/devices/fuxi-mouse233) | SM8550 | 1 | Repository link | [mouse233/unixnu-fuxi](https://github.com/mouse233/unixnu-fuxi) |
|
||||
| [Xiaomi 13 \(Sohytrs\)](/devices/fuxi-sohytrs) | SM8550 | 1 | Repository link | [Sohytrs/UniXNU-fuxi](https://github.com/Sohytrs/UniXNU-fuxi) |
|
||||
| [Xiaomi 13 \(SM8550\) \(Xyvern08371\)](/devices/fuxi-xyvern08371) | SM8550 | 1 | Repository link | [Xyvern08371/UniXNU-sheng](https://github.com/Xyvern08371/UniXNU-sheng) |
|
||||
| [Motorola Moto G 5G \(gauguin\)](/devices/gauguin) | SM7125 | 1 | Device notes | [lvyufeng/UniXNU-gauguin](https://github.com/lvyufeng/UniXNU-gauguin) |
|
||||
| [OnePlus Ace 5 \(giulia\)](/devices/giulia) | SM8650 | 1 | Device notes | [tycykp/UniXNU-OnePlus-Ace5](https://github.com/tycykp/UniXNU-OnePlus-Ace5) |
|
||||
| [Samsung Galaxy Tab A7 10.4 \(gta4l\)](/devices/gta4l) | SM6115 | 1 | Device notes | [NoNameBuilder/UniXNU-gta4l](https://github.com/NoNameBuilder/UniXNU-gta4l) |
|
||||
| [Samsung Galaxy Tab A7 10.4 \(2020\) \(ilovemykedi\)](/devices/gta4l-ilovemykedi) | SM6115 | 1 | Repository link | [ilovemykedi/UniXNU-gta4l](https://github.com/ilovemykedi/UniXNU-gta4l) |
|
||||
| [Samsung Galaxy Tab S9 Ultra Wi-Fi \(gts9uwifi\)](/devices/gts9uwifi) | SM8550 | 1 | Device notes | [zc47796741-pixel/UniXNU-gts9uwifi](https://github.com/zc47796741-pixel/UniXNU-gts9uwifi) |
|
||||
| [OnePlus 7 Pro \(guacamole\)](/devices/guacamole) | SM8150 | 1 | Device notes | [wochgn/UniXNU-guacamole](https://github.com/wochgn/UniXNU-guacamole) |
|
||||
| [Motorola Moto G9 Play \(guamp\)](/devices/guamp) | SM6115 | 1 | Device notes | [itsChris122/UniXNU-guamp](https://github.com/itsChris122/UniXNU-guamp) |
|
||||
| [Redmi K40 Pro \(haydn\)](/devices/haydn) | SM8350 | 1 | Device notes | [xiaomi-haydn-dev/UniXNU-haydn](https://github.com/xiaomi-haydn-dev/UniXNU-haydn) |
|
||||
| [Xiaomi K40 Pro \(xiaomi-haydn-dev\)](/devices/haydn-xiaomi-haydn-dev) | SM8350 | 1 | Repository link | [xiaomi-haydn-dev/UniXNU-haydn4](https://github.com/xiaomi-haydn-dev/UniXNU-haydn4) |
|
||||
| [Samsung Galaxy S7 Edge \(hero2lte\)](/devices/hero2lte) | Exynos 8890 | 2 | Porting record | [DokuroMitsukai/UniXNU-hero2lte](https://github.com/DokuroMitsukai/UniXNU-hero2lte) |
|
||||
| [Xiaomi 14 \(houji\)](/devices/houji) | SM8650 | 1 | Device notes | [lonzzi/UniXNU-houji](https://github.com/lonzzi/UniXNU-houji) |
|
||||
| [OnePlus Ace 5 Pro \(hummer\)](/devices/hummer) | SM8750 | 1 | Device notes | [2426120557/UniXNU-hummer](https://github.com/2426120557/UniXNU-hummer) |
|
||||
| [OnePlus 8 Pro \(instantnoodlep\)](/devices/instantnoodlep) | SM8250 | 2 | Record pending | [zhangp996/UniXNU-instantnoodlep](https://github.com/zhangp996/UniXNU-instantnoodlep) |
|
||||
| [Xiaomi 13 Ultra \(ishtar\)](/devices/ishtar) | SM8550 | 2 | Porting record | [peter8889/UniXNU-ishtar](https://github.com/peter8889/UniXNU-ishtar) |
|
||||
| [Xiaomi 13 Ultra - XNU \(iOS 18\) \(markakash\)](/devices/ishtar-markakash) | SM8550 | 1 | Repository link | [markakash/UniXNU-ishtar](https://github.com/markakash/UniXNU-ishtar) |
|
||||
| [Lenovo Xiaoxin Pad Pro 2021 \(j716f\)](/devices/j716f) | SM8250 | 2 | Porting record | [Denis0x00/UniXNU-j716f](https://github.com/Denis0x00/UniXNU-j716f) |
|
||||
| [OnePlus 8T \(kebab\)](/devices/kebab) | SM8250 | 1 | Device notes | [GFander/UniXNU-kebab](https://github.com/GFander/UniXNU-kebab) |
|
||||
| [OnePlus 8T \(stevedang67889\)](/devices/kebab-stevedang67889) | SM8250 | 2 | Record pending | [stevedang67889/UniXNU-kebab](https://github.com/stevedang67889/UniXNU-kebab) |
|
||||
| [Google Pixel 9 Pro XL \(komodo\)](/devices/komodo) | zumapro | 1 | Device notes | [Trijal08/UniXNU-komodo](https://github.com/Trijal08/UniXNU-komodo) |
|
||||
| [OnePlus 9R \(lemonades\)](/devices/lemonades) | SM8250 | 1 | Device notes | [soooink/UniXNU-lemonades](https://github.com/soooink/UniXNU-lemonades) |
|
||||
| [Xiaomi Pad 6 Pro \(liuqin\)](/devices/liuqin) | SM8475 | 1 | Device notes | [1696108518/UniXNU-liuqin](https://github.com/1696108518/UniXNU-liuqin) |
|
||||
| [Redmi K30 Pro Zoom Edition \(lmipro\)](/devices/lmipro) | SM8250 | 2 | Record pending | [yang232138/UniXNU-lmipro-v2](https://github.com/yang232138/UniXNU-lmipro-v2) |
|
||||
| [Redmi K30 Pro Zoom Edition \(lmipro, SM8250\) \(yang232138\)](/devices/lmipro-yang232138) | SM8250 | 1 | Repository link | [yang232138/UniXNU-lmipro](https://github.com/yang232138/UniXNU-lmipro) |
|
||||
| [Microsoft Lumia 950](/devices/lumia950) | MSM8992 | 1 | Device notes | [ManGuy-Legend/UniXNU-lumia950](https://github.com/ManGuy-Legend/UniXNU-lumia950) |
|
||||
| [Xiaomi Civi 5 Pro \(luming\)](/devices/luming) | SM8735 | 1 | Device notes | [infinityEX-RSXQ/-UniXNU-luming](https://github.com/infinityEX-RSXQ/-UniXNU-luming) |
|
||||
| [Meizu 20 Classic \(m2381\)](/devices/m2381) | SM8550 | 1 | Device notes | [RiverKawa271828/ios-m2381-unixnu](https://github.com/RiverKawa271828/ios-m2381-unixnu) |
|
||||
| [POCO X7 / Redmi Note 14 Pro 5G \(malachite\)](/devices/malachite) | MT6878 | 1 | Device notes | [ghidgdsr/uefi-malachite](https://github.com/ghidgdsr/uefi-malachite) |
|
||||
| [Redmi Note 12 Turbo / POCO F5 \(marble\)](/devices/marble) | SM7475 | 1 | Device notes | [sing0626/UniXNU-marble](https://github.com/sing0626/UniXNU-marble) |
|
||||
| [Xiaomi Redmi Note 9 \(merlinx\)](/devices/merlinx) | MT6768 | 1 | Device notes | [Dracen-W/UniXNU-merlinx](https://github.com/Dracen-W/UniXNU-merlinx) |
|
||||
| [Redmi K90 Pro Max / Poco F8 Ultra \(myron\)](/devices/myron) | SM8850 | 1 | Device notes | [zg7681/UniXNU-myron](https://github.com/zg7681/UniXNU-myron) |
|
||||
| [Xiaomi Pad 5 \(nabu\)](/devices/nabu) | SM8150 | 1 | Device notes | [Lux12138/unixnu-nabu](https://github.com/Lux12138/unixnu-nabu) |
|
||||
| [Xiaomi Pad 5 \(3214791900-del\)](/devices/nabu-3214791900-del) | SM8150 | 1 | Repository link | [3214791900-del/unixnu-nabu-build](https://github.com/3214791900-del/unixnu-nabu-build) |
|
||||
| [Xiaomi Pad 5 \(lee-kenneth\)](/devices/nabu-lee-kenneth) | SM8150 | 1 | Repository link | [lee-kenneth/unixnu-nabu](https://github.com/lee-kenneth/unixnu-nabu) |
|
||||
| [Xiaomi Pad 5 \(zzc775\)](/devices/nabu-zzc775) | SM8150 | 1 | Repository link | [zzc775/unixnu-nabu](https://github.com/zzc775/unixnu-nabu) |
|
||||
| [Motorola Moto Z2 Force \(nash\)](/devices/nash) | MSM8998 | 1 | Device notes | [fcxuhaq3/UniXNU-nash](https://github.com/fcxuhaq3/UniXNU-nash) |
|
||||
| [OnePlus 10 Pro 5G \(negroni\)](/devices/negroni) | SM8450 | 1 | Device notes | [pawlickerr/UniXNU-negroni](https://github.com/pawlickerr/UniXNU-negroni) |
|
||||
| [Xiaomi 13 Pro \(nuwa\)](/devices/nuwa) | SM8550 | 1 | Device notes | [wh1stl3/UniXNU-nuwa](https://github.com/wh1stl3/UniXNU-nuwa) |
|
||||
| [Xiaomi 13 Pro \(nuwa\) \(Alex-Enix\)](/devices/nuwa-alex-enix) | SM8550 | 1 | Repository link | [Alex-Enix/nuwa-dev](https://github.com/Alex-Enix/nuwa-dev) |
|
||||
| [Xiaomi 13 Pro \(pubglite55\)](/devices/nuwa-pubglite55) | SM8550 | 1 | Repository link | [pubglite55/UniXNU-nuwa](https://github.com/pubglite55/UniXNU-nuwa) |
|
||||
| [ZTE Nubia Z60 Ultra \(nx721j\)](/devices/nx721j) | Pineapple | 1 | Device notes | [SangLuoCN/UniXNU-Nubia-Z60U](https://github.com/SangLuoCN/UniXNU-Nubia-Z60U) |
|
||||
| [Nubia RedMagic 8 Pro / 8 Pro+ \(nx729j\)](/devices/nx729j) | SM8550 | 1 | Device notes | [2713385115/UniXNU-nx729j](https://github.com/2713385115/UniXNU-nx729j) |
|
||||
| [OnePlus 13T \(oneplus13t\)](/devices/oneplus13t) | SM8750 | 2 | Porting record | [IssacL04/UniXNU-Pagani_SM8750](https://github.com/IssacL04/UniXNU-Pagani_SM8750) |
|
||||
| [Xiaomi 17 Pro \(pandora\)](/devices/pandora) | SM8850 | 1 | Device notes | [ShueiTsuki/data-a-live](https://github.com/ShueiTsuki/data-a-live) |
|
||||
| [Sony Xperia 1 II \(pdx203\)](/devices/pdx203) | SM8250 | 1 | Device notes | [chardidathing/UniXNU-pdx203](https://github.com/chardidathing/UniXNU-pdx203) |
|
||||
| [Redmi Turbo 3 / Poco F6 \(peridot\)](/devices/peridot) | SM8635 | 1 | Device notes | [kvfsrl/UniXNU-peridot](https://github.com/kvfsrl/UniXNU-peridot) |
|
||||
| [Poco F6 / Redmi Turbo 3 \(wzy114514sb\)](/devices/peridot-wzy114514sb) | SM8635 | 2 | Record pending | [wzy114514sb/UniXNU-peridot](https://github.com/wzy114514sb/UniXNU-peridot) |
|
||||
| [OPPO Find X7 Ultra \(PHY120\)](/devices/phy120) | SM8650 | 1 | Device notes | [peiyuesheng666/UniXNU-PHY120](https://github.com/peiyuesheng666/UniXNU-PHY120) |
|
||||
| [Xiaomi Pad 8 Pro \(piano\)](/devices/piano) | SM8750 | 1 | Device notes | [code002-2/UniXNU-piano](https://github.com/code002-2/UniXNU-piano) |
|
||||
| [Redmi K30 5G \(picasso\)](/devices/picasso) | SM7250 | 1 | Device notes | [YinCQL/UniXNU-picasso](https://github.com/YinCQL/UniXNU-picasso) |
|
||||
| [Redmi K30 5G \(minhtritt1996\)](/devices/picasso-minhtritt1996) | SM7250 | 1 | Repository link | [minhtritt1996/UniXNU-picasso](https://github.com/minhtritt1996/UniXNU-picasso) |
|
||||
| [Xiaomi Pad 6 \(pipa\)](/devices/pipa) | SM8250 | 1 | Device notes | [xVanTuring/uefi-pipa](https://github.com/xVanTuring/uefi-pipa) |
|
||||
| [Xiaomi Pad 6 \(FFT-infra\)](/devices/pipa-fft-infra) | SM8250 | 1 | Repository link | [FFT-infra/UniXNU-alioth-ARCHIVE](https://github.com/FFT-infra/UniXNU-alioth-ARCHIVE) |
|
||||
| [Xiaomi Pad 6 \(xVanTuring\)](/devices/pipa-xvanturing) | SM8250 | 1 | Repository link | [xVanTuring/UniXNU-pipa](https://github.com/xVanTuring/UniXNU-pipa) |
|
||||
| [Xiaomi Mi MIX 2S \(polaris\)](/devices/polaris) | SDM845 | 1 | Device notes | [luuu20309/UniXNU-polaris](https://github.com/luuu20309/UniXNU-polaris) |
|
||||
| [Nothing Phone \(2\) \(pong\)](/devices/pong) | SM8475 | 1 | Device notes | [Chengdong-Yu/UniXNU-pong](https://github.com/Chengdong-Yu/UniXNU-pong) |
|
||||
| [Nothing Phone \(2\): UniXNU UEFI bring-up \(Y3d4\)](/devices/pong-y3d4) | SM8475 | 1 | Repository link | [Y3d4/UniXNU-pong-clean](https://github.com/Y3d4/UniXNU-pong-clean) |
|
||||
| [Galaxy Z Fold3 \(q2q\)](/devices/q2q) | SM8350 | 1 | Device notes | [agcarbajo/UniXNU-q2q](https://github.com/agcarbajo/UniXNU-q2q) |
|
||||
| [QEMU virt](/devices/qemu) | QEMU virt | 1 | Device notes | [xVanTuring/UniXNU-qemu](https://github.com/xVanTuring/UniXNU-qemu) |
|
||||
| [OPPO R11 \(r11\)](/devices/r11) | SDM660 | 1 | Device notes | [huhaitao1136-cpu/unixnu-r11](https://github.com/huhaitao1136-cpu/unixnu-r11) |
|
||||
| [Redmi K20 Pro / Mi 9T Pro \(raphael\)](/devices/raphael) | SM8150 | 1 | Device notes | [penYo22/UniXNU-raphael](https://github.com/penYo22/UniXNU-raphael) |
|
||||
| [Xiaomi MIX Flip \(ruyi\)](/devices/ruyi) | SM8650 | 1 | Device notes | [ArnoDorian123/UniXNU-ruyi](https://github.com/ArnoDorian123/UniXNU-ruyi) |
|
||||
| [Xiaomi MIX Flip \(ArnoDorian123\)](/devices/ruyi-arnodorian123) | SM8650 | 1 | Repository link | [ArnoDorian123/UniXNU-ruyi-min](https://github.com/ArnoDorian123/UniXNU-ruyi-min) |
|
||||
| [Xiaomi MIX Flip \(ehunshuaige\)](/devices/ruyi-ehunshuaige) | SM8650 | 1 | Repository link | [ehunshuaige/UniXNU-ruyi](https://github.com/ehunshuaige/UniXNU-ruyi) |
|
||||
| [Xiaomi Mi 6 \(sagit\)](/devices/sagit) | MSM8998 | 1 | Device notes | [dmnakzkahziamnk-a11y/UniXNU-sagit](https://github.com/dmnakzkahziamnk-a11y/UniXNU-sagit) |
|
||||
| [Xiaomi Pad 6S Pro \(16Crow\)](/devices/sheng-16crow) | SM8550 | 1 | Repository link | [16Crow/UniXNU-sheng](https://github.com/16Crow/UniXNU-sheng) |
|
||||
| [Xiaomi Pad 6S Pro \(alghiffaryfa19\)](/devices/sheng-alghiffaryfa19) | SM8550 | 1 | Repository link | [alghiffaryfa19/UniXNU-sheng](https://github.com/alghiffaryfa19/UniXNU-sheng) |
|
||||
| [Xiaomi Pad 6S Pro \(FFT-infra\)](/devices/sheng-fft-infra) | SM8550 | 2 | Porting record | [FFT-infra/UniXNU-alioth-sheng-template](https://github.com/FFT-infra/UniXNU-alioth-sheng-template) |
|
||||
| [Xiaomi Pad 6S Pro \(hxzbaka\)](/devices/sheng-hxzbaka) | SM8550 | 2 | Porting record | [hxzbaka/UniXNU-sheng](https://github.com/hxzbaka/UniXNU-sheng) |
|
||||
| [Xiaomi Pad 6S Pro \(jn7163\)](/devices/sheng-jn7163) | SM8550 | 1 | Repository link | [jn7163/UniXNU-sheng](https://github.com/jn7163/UniXNU-sheng) |
|
||||
| [Xiaomi Pad 6S Pro \(LiangKam\)](/devices/sheng-liangkam) | SM8550 | 1 | Repository link | [LiangKam/UniXNU-sheng](https://github.com/LiangKam/UniXNU-sheng) |
|
||||
| [Xiaomi Pad 6S Pro \(lilinnan\)](/devices/sheng-lilinnan) | SM8550 | 1 | Repository link | [lilinnan/UniXNU-sheng](https://github.com/lilinnan/UniXNU-sheng) |
|
||||
| [macOS on sheng](/devices/sheng-macos) | SM8550 | 1 | Device notes | [Jelly10086/macOS-ForSheng](https://github.com/Jelly10086/macOS-ForSheng) |
|
||||
| [Xiaomi Pad 6S Pro \(TheArchitectEngineer\)](/devices/sheng-thearchitectengineer) | SM8550 | 2 | Porting record | [TheArchitectEngineer/UniXNU-sheng](https://github.com/TheArchitectEngineer/UniXNU-sheng) |
|
||||
| [Xiaomi Pad 6S Pro \(yuyaukong\)](/devices/sheng-yuyaukong) | SM8550 | 1 | Repository link | [yuyaukong/UniXNU-sheng](https://github.com/yuyaukong/UniXNU-sheng) |
|
||||
| [Xiaomi Mi 8 SE \(sirius\)](/devices/sirius) | SDM710 | 2 | Porting record | [57UU/UniXNU-sirius](https://github.com/57UU/UniXNU-sirius) |
|
||||
| [Samsung Galaxy Tab S7 FE Wi-Fi \(SM-T733\)](/devices/sm-t733) | SM7325 | 2 | Porting record | [RigoLigoRLC/unixnu-sm-t733](https://github.com/RigoLigoRLC/unixnu-sm-t733) |
|
||||
| [Redmi Note 10 Pro \(sweet\)](/devices/sweet) | SM7150 | 1 | Device notes | [CrackerCat/UniXNU-sweet](https://github.com/CrackerCat/UniXNU-sweet) |
|
||||
| [Xiaomi Redmi Note 10 Pro \(zeroninevibedslop\)](/devices/sweet-zeroninevibedslop) | SM7150 | 2 | Record pending | [zeroninevibedslop/UniXNU-sweet](https://github.com/zeroninevibedslop/UniXNU-sweet) |
|
||||
| [Unisoc UMS512 / T610YP](/devices/t610yp) | unisoc-ums512-sharkl5pro-t610yp | 1 | Device notes | [hxzbaka/UniXNU-t610yp](https://github.com/hxzbaka/UniXNU-t610yp) |
|
||||
| [Lenovo Xiaoxin Pad 2022 \(tb128fu\)](/devices/tb128fu) | SM6225 | 1 | Device notes | [xVanTuring/UniXNU-tb128fu](https://github.com/xVanTuring/UniXNU-tb128fu) |
|
||||
| [Xiaomi Mi 10S \(thyme\)](/devices/thyme) | SM8250 | 1 | Device notes | [tobyfox1640/UniXNU-thyme](https://github.com/tobyfox1640/UniXNU-thyme) |
|
||||
| [Xiaomi Mi 10S / SM8250-AC UniXNU bring-up \(measured 2026-10-24\) \(Coryyi\)](/devices/thyme-coryyi) | SM8250 | 1 | Repository link | [Coryyi/UniXNU-thyme](https://github.com/Coryyi/UniXNU-thyme) |
|
||||
| [OnePlus Ace 2 / 11R \(udon\)](/devices/udon) | SM8475 | 1 | Device notes | [takasugl/UniXNU-udon](https://github.com/takasugl/UniXNU-udon) |
|
||||
| [Xiaomi Pad 7 / POCO Pad X1 \(uke\)](/devices/uke) | SM7675 | 1 | Device notes | [Allenwdk/UniXNU-uke](https://github.com/Allenwdk/UniXNU-uke) |
|
||||
| [Xiaomi Pad 7 \(wuhaoran956-cyber\)](/devices/uke-wuhaoran956-cyber) | SM7675 | 1 | Repository link | [wuhaoran956-cyber/UniXNU-uke](https://github.com/wuhaoran956-cyber/UniXNU-uke) |
|
||||
| [Xiaomi Mi 10 \(umi\)](/devices/umi) | SM8250 | 1 | Device notes | [reAAAq/UniXNU-umi](https://github.com/reAAAq/UniXNU-umi) |
|
||||
| [Xiaomi Mi 10 / SM8250 UniXNU bring-up \(mouya-q\)](/devices/umi-mouya-q) | SM8250 | 1 | Repository link | [mouya-q/UniXNU-umi](https://github.com/mouya-q/UniXNU-umi) |
|
||||
| [Unisoc devices](/devices/unisoc) | Unisoc | 1 | Device notes | [hxzbaka/UniXNU-Unisoc](https://github.com/hxzbaka/UniXNU-Unisoc) |
|
||||
| [unixnu-build](/devices/unixnu-build) | build tree | 1 | Device notes | [iskssksjjsjjzjs/unixnu-build](https://github.com/iskssksjjsjjzjs/unixnu-build) |
|
||||
| [Redmi K70 \(vermeer\)](/devices/vermeer) | SM8550 | 1 | Device notes | [mansar1337/UniXNU-vermeer](https://github.com/mansar1337/UniXNU-vermeer) |
|
||||
| [Redmi K70 \(xyyyds0106\)](/devices/vermeer-xyyyds0106) | SM8550 | 1 | Repository link | [xyyyds0106/UniXNU-vermeer](https://github.com/xyyyds0106/UniXNU-vermeer) |
|
||||
| [Redmi K70 \(yyx2025\)](/devices/vermeer-yyx2025) | SM8550 | 1 | Repository link | [yyx2025/UniXNU-vermeer](https://github.com/yyx2025/UniXNU-vermeer) |
|
||||
| [OPPO Find X9 \(x9\)](/devices/x9) | MT6993 | 1 | Device notes | [tosasitill/unixnu_x9](https://github.com/tosasitill/unixnu_x9) |
|
||||
| [Microsoft Surface Duo 2 \(zeta\)](/devices/zeta) | SM8350 | 1 | Device notes | [none24smu/UniXNU-zeta](https://github.com/none24smu/UniXNU-zeta) |
|
||||
| [Redmi K80 \(zorn\)](/devices/zorn) | SM8650 | 1 | Device notes | [kerrinz/UniXNU-zorn](https://github.com/kerrinz/UniXNU-zorn) |
|
||||
|
||||
## Community ports
|
||||
## Maintain device records {#adding-a-device}
|
||||
|
||||
Community ports are maintained by the people listed below. Each page distinguishes source, host-build and device results and links their records. Discovery covers the UniXNU organization, the `unixnu` topic, public repositories matching UniXNU in name or description, and existing source links. Entries require target-specific board configuration or implementation.
|
||||
Publish device configuration and records using the [record guide](/porting/records#publishing-and-reuse).
|
||||
|
||||
| Device | SoC | State | Maintainer |
|
||||
| --- | --- | --- | --- |
|
||||
| [DroidVM guest (crosvm on Gunyah)](/devices/droidvm) | crosvm-gunyah | iPadOS 17 home screen; Metal widgets and icons; keychain and Bluetooth; virtio-net works | Droid-VM |
|
||||
| [QEMU virt](/devices/qemu) | QEMU virt | iPadOS 17 home screen and Settings; Metal on the Mac GPU with `--metal` | xVanTuring |
|
||||
| [Lenovo Xiaoxin Pad 2022 (tb128fu)](/devices/tb128fu) | SM6225 | iPadOS 17 home screen with touch; Metal frames presented by the GPU; Adreno 610 runs | xVanTuring |
|
||||
| [Galaxy Tab S7 FE Wi-Fi (SM-T733)](/devices/sm-t733) | SM7325 | Desktop, touch, keys, brightness, shutdown, USB diagnostics and persistent Data | RigoLigoRLC |
|
||||
| [OnePlus 10 Pro 5G (negroni)](/devices/negroni) | SM8450 | SpringBoard and touch; independent iOSPlus10 Metal compositor results | pawlickerr, akshaynexus |
|
||||
| [Nothing Phone (2) (pong)](/devices/pong) | SM8475 | iOS 16.6.1 home screen with display and touch; UFS and GPU partial | Chengdong-Yu |
|
||||
| [Xiaomi 17 Pro (pandora)](/devices/pandora) | SM8850 | GPU-composited UI and apps, touch and CPU frequency control; audio/network pending | ShueiTsuki |
|
||||
| [Xiaomi Mi 8 SE (sirius)](/devices/sirius) | SDM710 | Platform and panel console; AppleARMCPU matching panic, eMMC pending | 57UU |
|
||||
| [Xiaomi 13 (fuxi)](/devices/fuxi) | SM8550 | Kernel links and prelinks; stage B archive chain near complete; no hardware run | matejkoo217, hanzi123-bilp, 0721GPT |
|
||||
| [OnePlus 7 Pro (guacamole)](/devices/guacamole) | SM8150 | iOS 16.7.16 userland reached; GPU pending | wochgn |
|
||||
| [OnePlus Ace 5 (giulia)](/devices/giulia) | SM8650 | Hello/Setup, display, touch and keys; GPU, Wi-Fi and audio pending | tycykp |
|
||||
| [Xiaomi Mi 10 (umi)](/devices/umi) | SM8250 | iPadOS 17.7.11 Hello/Setup with touch; CPU display, UFS and persistent Data | reAAAq |
|
||||
| [Xiaomi MIX 2 (chiron)](/devices/chiron) | SDM835 | Minimal 4 KiB XNU and PID 1 heartbeat on hardware | to-mid |
|
||||
| [Xiaomi Pad 7 / POCO Pad X1 (uke)](/devices/uke) | SM7675 | Apple logo and early userland; reboot under investigation | Allenwdk |
|
||||
| [POCO X7 / Redmi Note 14 Pro 5G (malachite)](/devices/malachite) | MT6878 | UEFI works, UFS works, XNU rootfs loaded; USB, touch and the rest not implemented | ghidgdsr |
|
||||
| [Brave Ark tablet (braveark)](/devices/braveark) | SM8635 | XNU BSD init on 8 CPUs; iPadOS root in progress | tattwamashi |
|
||||
| [Xiaomi Pad 8 Pro (piano)](/devices/piano) | SM8750 | Kernel builds and prelinks in CI; not run on the tablet | code002-2 |
|
||||
| [Xiaomi 13 Pro (nuwa)](/devices/nuwa) | SM8550 | Hardware XNU output through IODTNVRAM; reboot under investigation | wh1stl3 |
|
||||
| [OnePlus 13T (oneplus13t)](/devices/oneplus13t) | SM8750 | UI verified on hardware baseline; format 2 and peripheral builds await device checks | IssacL04 |
|
||||
| [OnePlus Pad 2 Pro (erhai)](/devices/erhai) | SM8750 | XNU entry bring-up; root and userland not configured | wally001012-cyber |
|
||||
| [OPPO Find X7 Ultra (PHY120)](/devices/phy120) | SM8650 | Boot manager menu works; kernel builds in CI | peiyuesheng666 |
|
||||
| [Sony Xperia 1 II (pdx203)](/devices/pdx203) | SM8250 | Kernel builds and prelinks in CI; not booted | chardidathing |
|
||||
| [Moto Z2 Force (nash)](/devices/nash) | MSM8998 | Board configuration and early ARM patches; target hardware evidence pending | fcxuhaq3 |
|
||||
| [Redmi K40 Pro (haydn)](/devices/haydn) | SM8350 | Firmware, payload and boot image built; haydn4 imported from guacamole | xiaomi-haydn-dev |
|
||||
| [Xiaomi Pad 5 (nabu)](/devices/nabu) | SM8150 | launchd exec returns ENOENT; Linux kernel builds | Lux12138 |
|
||||
| [OnePlus 6T (fajita)](/devices/fajita) | SDM845 | XNU reaches root mount; no storage driver | johnpanos |
|
||||
| [Xiaomi Mi 8 (dipper)](/devices/dipper) | SDM845 | UEFI, menu and payload; XNU reaches BSD init, no root | hanyaa380 |
|
||||
| [Microsoft Surface Duo 2 (zeta)](/devices/zeta) | SM8350 | APFS root and rewritten PID 1; shared-cache pointer fault | none24smu |
|
||||
| [OnePlus Ace 5 Pro (hummer)](/devices/hummer) | SM8750 | Hello, six CPUs and physical root; touch and GPU pending | 2426120557 |
|
||||
| [Xiaomi 10 Ultra (cas)](/devices/cas) | SM8250 | UEFI and UniXNU menu verified; DarwinBoot and XNU not tested | ht94911 |
|
||||
| [Xiaomi 15 (dada)](/devices/dada) | SM8750 | UEFI works; UFS UIC and MCQ probes; UniXNU and XNU not run | 7Night-kqx |
|
||||
| [Redmi Note 14 Pro+ 5G (amethyst)](/devices/amethyst) | SM7635 | Kernel/payload preparation; target UEFI integration pending | andr0d1v |
|
||||
| [Redmi K90 Pro Max / Poco F8 Ultra (myron)](/devices/myron) | SM8850 | Core and driver forks; device repository and hardware result pending | zg7681 |
|
||||
| [Redmi K70 (vermeer)](/devices/vermeer) | SM8550 | Platform kernel CI passes; hardware UEFI menu verified | mansar1337, yyx2025, wuan0039, xyyyds0106 |
|
||||
| [Nubia RedMagic 8 Pro / 8 Pro+ (nx729j)](/devices/nx729j) | SM8550 | Hardware UEFI and panel logs; XNU/root results pending | 2713385115 |
|
||||
| [Xiaomi Pad 6 (pipa)](/devices/pipa) | SM8250 | Hardware XNU boot; root mount fails, storage integration pending | xVanTuring |
|
||||
| [Galaxy Tab A7 10.4 (gta4l)](/devices/gta4l) | SM6115 | Board, ADT and firmware build; second repository builds a kernel in CI | NoNameBuilder, ilovemykedi |
|
||||
| [Redmi Note 10 Pro (sweet)](/devices/sweet) | SM7150 | Independent iOS 16 UFS/userland/display results; GPU acceleration pending | CrackerCat, zeroninevibedslop |
|
||||
| [Xiaomi Mi MIX 2S (polaris)](/devices/polaris) | SDM845 | Platform stage verified on hardware: firmware, UniXNU, DarwinBoot and the source kernel through BSD/IOKit; no root yet | luuu20309 |
|
||||
| [OnePlus 5 (cheeseburger)](/devices/cheeseburger) | MSM8998 | Root, PID 1 and RAM Data; watchdogd SIGTRAP under investigation | DinnerABC, lss717 |
|
||||
| [Redmi K20 Pro / Mi 9T Pro (raphael)](/devices/raphael) | SM8150 | Public source access pending; current build and device state unconfirmed | penYo22 |
|
||||
| [Galaxy Z Fold3 (q2q)](/devices/q2q) | SM8350 | Source kernel build harness only | agcarbajo |
|
||||
| [Redmi K30 5G (picasso)](/devices/picasso) | SM7250 | XNU BSD initialization and APFS registration; waiting for root | YinCQL |
|
||||
| [Redmi Note 9 (merlinx)](/devices/merlinx) | MT6768 | UEFI boots and custom menu works; storage init blocks UniXNU and XNU | Dracen-W |
|
||||
| [Xiaomi Mi Pad 4 LTE (clover)](/devices/clover) | SDM660 | eMMC-backed mockfs root and EL0 test init; APFS probes in development | qine233 |
|
||||
| [Benesse TAB-A04-BR3 (a04br3)](/devices/a04br3) | MT8167 | Home screen, four CPUs and eMMC DMA; Vulkan transfer/readback | mouseos |
|
||||
| [Redmi 9A (dandelion)](/devices/dandelion) | MT6765 | Early bring-up; UEFI port in progress | licg89 |
|
||||
| [Xiaomi Mi 6 (sagit)](/devices/sagit) | MSM8998 | Public source access pending; current build and device state unconfirmed | dmnakzkahziamnk-a11y |
|
||||
| [Redmi Note 12 Turbo / POCO F5 (marble)](/devices/marble) | SM7475 | Maintainer reports Hello; touch and public reproducible sources pending | sing0626 |
|
||||
| [Xiaomi Mi 10S (thyme)](/devices/thyme) | SM8250-AC | Measured board inputs and early traces; hardware boot evidence pending | tobyfox1640, Coryyi |
|
||||
| [Redmi K80 Ultra (dali)](/devices/dali) | MT6991 | Single-core XNU early boot; root and userland out of scope | localhosts-A |
|
||||
| [ZTE Nubia Z60 Ultra (nx721j)](/devices/nx721j) | Pineapple | Pineapple kernel and passive UFS probe; device boot pending | SangLuoCN |
|
||||
| [Unisoc UMS512 / T610YP](/devices/t610yp) | UMS512 | Board, kernel config and ADT; no hardware result | hxzbaka |
|
||||
| [Google Pixel 9 Pro XL (komodo)](/devices/komodo) | Tensor G4 | Menu and borrowed-kernel entry probes on hardware; native platform pending | Trijal08 |
|
||||
| [Xiaomi Mi 9 (cepheus)](/devices/cepheus) | SDM855 | Device repository and boot chain prepared; no hardware result | sxl47 |
|
||||
| [Xiaomi MIX Flip (ruyi)](/devices/ruyi) | SM8650 | Board, kernel configuration and firmware repository; hardware results pending | ArnoDorian123 |
|
||||
| [Xiaomi Civi 5 Pro (luming)](/devices/luming) | SM8735 | Measured inputs and host ADT checks; kernel and firmware builds pending | infinityEX-RSXQ |
|
||||
| [Xiaomi Pad 6 Pro (liuqin)](/devices/liuqin) | SM8475 | Board, defconfig and kernel USB debug port; UEFI next | 1696108518, boomoodxf |
|
||||
| [Xiaomi Pad 5 Pro 5G (enuma)](/devices/enuma) | SM8250-AC | Host image checks and EL1 read diagnostics; visible menu pending | wh1stl3, Tlrenhb |
|
||||
| [Redmi Turbo 3 / Poco F6 (peridot)](/devices/peridot) | SM8635 | WIP device repositories; no hardware result | kvfsrl, hoshikv, wzy114514sb |
|
||||
| [OnePlus 8 Pro (instantnoodlep)](/devices/instantnoodlep) | SM8250 | UEFI platform and kernel baseline; status not documented | zhangp996 |
|
||||
| [OnePlus 8T (kebab)](/devices/kebab) | SM8250 | HFS root and static EL0 test init; full iOS userland pending | GFander |
|
||||
| [OnePlus 6 (enchilada)](/devices/enchilada) | SDM845 | Device repository; status not documented | keyfan |
|
||||
| [OnePlus 15T (fairlady)](/devices/fairlady) | SM8850 | Early port with S1 to S6 diagnostics; no hardware result | Osilvfe |
|
||||
| [OnePlus Pad Pro (caihong)](/devices/caihong) | SM8650 | APFS restore RAM root and launchd; display and full system root pending | Axiang-dev |
|
||||
| [Nothing Phone (3a) (asteroids)](/devices/asteroids) | SM7635 | Eight CPUs, UFS root and userland; display presentation pending | rootstockos |
|
||||
| [Galaxy Tab S9 Ultra Wi-Fi (gts9uwifi)](/devices/gts9uwifi) | SM-X910 | Device repository; status not documented | zc47796741-pixel |
|
||||
| [Moto G9 Play (guamp)](/devices/guamp) | SM6115 | UEFI menu boots; kernel not built | itsChris122 |
|
||||
| [Moto G 5G (gauguin)](/devices/gauguin) | SM7125 | Device repository; status not documented | lvyufeng |
|
||||
| [Microsoft Lumia 950](/devices/lumia950) | MSM8992 | Device repository; uses the phone's own UEFI; no boot | ManGuy-Legend |
|
||||
| [OPPO R11 (r11)](/devices/r11) | SDM660 | Measured board inputs and Synaptics I2C touch identity; boot result pending | huhaitao1136-cpu |
|
||||
| [OPPO Find X9 (x9)](/devices/x9) | MT6993 | UEFI not reached; about 25 to 30 percent | tosasitill |
|
||||
| [Unisoc devices](/devices/unisoc) | Unisoc | Core fork; no device-specific port yet | hxzbaka |
|
||||
| [unixnu-build](/devices/unixnu-build) | build tree | Build tree only; device not documented | iskssksjjsjjzjs |
|
||||
| [macOS on sheng](/devices/sheng-macos) | SM8550 | macOS 26.5 launchd on sheng hardware; graphical Recovery pending | Jelly10086 |
|
||||
| [Redmi K40 (alioth)](/devices/alioth) | SM8250-AC | Format 2 board, DTS and SM8250 shared support; kernel and image integration pending | FFT-infra, fjcx555 |
|
||||
| [Lenovo Xiaoxin Pad Pro 2021 (j716f)](/devices/j716f) | SM8250 | XNU entry and post-MMU probes; reset diagnosis in progress | Denis0x00 |
|
||||
| [Lenovo Legion Y700 Gen 4 (elden)](/devices/elden) | SM8750P | Firmware hardware checks and prelinked XNU host build; XNU boot pending | jerry-2009 |
|
||||
| [Xiaomi Pad 5 Pro Wi-Fi (elish)](/devices/elish) | SM8250-AC | Board scaffold passes static checks; measured inputs and firmware pending | hpadmx |
|
||||
| [Redmi K80 (zorn)](/devices/zorn) | SM8650-AB | Read-only UFS APFS root; user mapping stops at MEND | kerrinz |
|
||||
| [OnePlus 9R (lemonades)](/devices/lemonades) | SM8250-AC | Firmware builds on Linux; board and payload preparation; hardware checks pending | soooink |
|
||||
| [Meizu 20 Classic (m2381)](/devices/m2381) | SM8550 | Device configuration and firmware overlay; kernel/prelink bring-up | RiverKawa271828 |
|
||||
| [Xiaomi 13 Ultra (ishtar)](/devices/ishtar) | SM8550 | Host image builds; separate iOS 18 port verifies hardware UEFI menu | peter8889, markakash |
|
||||
| [Samsung Galaxy S7 Edge (hero2lte)](/devices/hero2lte) | Exynos 8890 | Integrated firmware builds; GICv2 and hardware boot pending | DokuroMitsukai |
|
||||
| [OnePlus Ace 2 / 11R (udon)](/devices/udon) | SM8475 | UFS root and 117-process userland run; UI diagnosis in progress | takasugl |
|
||||
| [Redmi Note 10 5G (camellia)](/devices/camellia) | MT6833 | Bootstrap board and kernel recipe; hardware qualification pending | stanveyjiang |
|
||||
| [Xiaomi 14 (houji)](/devices/houji) | SM8650 | Desktop, eight CPUs, UFS/HFSX and touch; GPU submission pending | lonzzi |
|
||||
| [Redmi K30 Pro Zoom Edition (lmipro)](/devices/lmipro) | SM8250 | Format 2 board and measured DTS; kernel-focused workflow | yang232138 |
|
||||
| [Rongyue E5 (e5)](/devices/e5) | UMS9621 | Format 2 UMS9621 configuration and early-entry/MMU probes | Enceka |
|
||||
|
||||
## What a device page records
|
||||
|
||||
| Item | Example |
|
||||
| --- | --- |
|
||||
| Board identity | Product name, SoC, codename |
|
||||
| IPSW | Product, version, build, device class, chip and board ID |
|
||||
| Partition geometry | `first_lba`, `last_lba`, block size |
|
||||
| Kernel prelink | Slide, roots, early security initializer, kernelcache pin |
|
||||
| Firmware | Mu-Silicium config, DSC, firmware volume path, defines |
|
||||
| Payload | Volume label, size, DRAM size, kernel arguments |
|
||||
| ADT | Generator script, identity, CPU registers, PSCI method |
|
||||
| Device tree additions | Reserved memory nodes for the stock bootloader |
|
||||
| Build commands | The exact driver commands |
|
||||
| Boot commands | The exact fastboot commands |
|
||||
| Observed state | Which stages have run on the device |
|
||||
|
||||
## Adding a device
|
||||
|
||||
1. Follow [Porting](/porting/steps).
|
||||
2. Create the device repository and the UEFI repository.
|
||||
3. Build and bring up in stages.
|
||||
4. Add a page under `docs/devices/` with the values and commands.
|
||||
5. Add the device to the table above.
|
||||
|
||||
Device pages are the place for board specific values. The general guide uses placeholders and links here.
|
||||
|
||||
## sheng
|
||||
|
||||
The [sheng page](/devices/sheng) records the Xiaomi Pad 6S Pro port. It is one device entry. The [Novatek touch driver](/drivers/sheng-novatek-touch) uses the sheng touch driver as a worked example of a built-in XNU driver.
|
||||
|
||||
Official device pages render each repository's `porting.toml`. See the [record workflow](/porting/records).
|
||||
[sheng log-capture example](/devices/sheng-unattended-test)
|
||||
@@ -1,19 +1,5 @@
|
||||
# OnePlus 8 Pro (instantnoodlep)
|
||||
# OnePlus 8 Pro \(instantnoodlep\)
|
||||
|
||||
OnePlus 8 Pro (instantnoodlep) is a SM8250 device. The port below is an independent community project. The UniXNU organization does not maintain it.
|
||||
[zhangp996/UniXNU-instantnoodlep](https://github.com/zhangp996/UniXNU-instantnoodlep)
|
||||
|
||||
| Repository | Maintainer |
|
||||
| --- | --- |
|
||||
| [UniXNU-instantnoodlep](https://github.com/zhangp996/UniXNU-instantnoodlep) | [zhangp996](https://github.com/zhangp996) |
|
||||
|
||||
## State
|
||||
|
||||
The repository contains a UEFI platform and a kernel baseline. It does not document a hardware result.
|
||||
|
||||
## Maintenance
|
||||
|
||||
The maintainer owns the repository and its release decisions. UniXNU documentation lists the port and its state; it does not take over maintenance.
|
||||
|
||||
## Sources
|
||||
|
||||
- [Board configuration: zhangp996/UniXNU-instantnoodlep](https://github.com/zhangp996/UniXNU-instantnoodlep/blob/ef203b51fd9df78b0e3e764804ebadf829fd1179/board.toml)
|
||||
Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.
|
||||
@@ -0,0 +1 @@
|
||||
[markakash/UniXNU-ishtar](https://github.com/markakash/UniXNU-ishtar)
|
||||
+611
-22
@@ -1,33 +1,622 @@
|
||||
# Xiaomi 13 Ultra (ishtar)
|
||||
# Xiaomi 13 Ultra \(ishtar\)
|
||||
|
||||
A community device port for SM8550.
|
||||
[peter8889/UniXNU-ishtar](https://github.com/peter8889/UniXNU-ishtar)
|
||||
|
||||
- [peter8889/UniXNU-ishtar](https://github.com/peter8889/UniXNU-ishtar)
|
||||
- [markakash/UniXNU-ishtar](https://github.com/markakash/UniXNU-ishtar)
|
||||
<div v-pre>
|
||||
|
||||
## State
|
||||
Xiaomi 13 Ultra \(ishtar\) reuses shared SM8550 support and the sheng kit, and owns its board tree, partition geometry, firmware package and payload policy. This record states what is implemented, what is only configured, and what has not been observed on hardware.
|
||||
|
||||
The peter8889 format 2 port selects shared SM8550 support and iPadOS 17.7.11. Kernel, payload and image builds pass host checks. Storage, display, input and GPU device qualification remain pending.
|
||||
Source record: [porting.toml](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/porting.toml), `65592496e814ede46cc89721ee792b31912d38bd`.
|
||||
|
||||
The independent markakash port targets XNU 11215 and iPhone XR iOS 18.7.8. Its firmware menu works on hardware; kernel patches pass application checks and the first kernel build remains pending. Use the OS inputs and firmware belonging to the selected implementation.
|
||||
This page is generated from the device record.
|
||||
|
||||
## Use this port
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [Configuration](#configuration) | `implemented` |
|
||||
| [Firmware and boot](#firmware) | `implemented` |
|
||||
| [CPU and interrupts](#cpu) | `implemented` |
|
||||
| [Memory and DMA](#memory) | `implemented` |
|
||||
| [Storage and root](#storage) | `planned` |
|
||||
| [Display](#display) | `planned` |
|
||||
| [Input](#input) | `planned` |
|
||||
| [GPU](#gpu) | `planned` |
|
||||
| [Network](#network) | `planned` |
|
||||
| [Audio](#audio) | `planned` |
|
||||
| [Power](#power) | `planned` |
|
||||
| [Image assembly](#packaging) | `implemented` |
|
||||
| [Diagnostics](#diagnostics) | `implemented` |
|
||||
|
||||
1. Read the pinned instructions and records below. Prepare the firmware, system inputs and build tools they specify.
|
||||
2. Clone the device sources and prepare the matching core and firmware checkouts described by its README:
|
||||
## Configuration {#configuration}
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/peter8889/UniXNU-ishtar.git
|
||||
cd UniXNU-ishtar
|
||||
git checkout 65592496e814ede46cc89721ee792b31912d38bd
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
`implemented`
|
||||
|
||||
3. Run the build from the working directory specified by that revision's instructions. Check its documented outputs and remaining inputs.
|
||||
4. Follow the [bring-up order](/porting/bring-up), save [logs](/porting/log-capture) and complete the [porting record](/porting/records). See [porting steps](/porting/steps) for board structure and component selection.
|
||||
### Hardware and dependencies
|
||||
|
||||
## Sources
|
||||
- SM8550 shared source pinned in feeds.toml at 23b2049fcd9e30356161def84231334fb55ecca9.
|
||||
- iPadOS 17.7.11 build 21H461 OS profile.
|
||||
- Board identity xiaomi,ishtar and the sheng kit reused unchanged.
|
||||
|
||||
- [README: peter8889/UniXNU-ishtar](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/README.md)
|
||||
- [Porting record: peter8889/UniXNU-ishtar](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/porting.toml)
|
||||
- [iOS 18 port: markakash/UniXNU-ishtar](https://github.com/markakash/UniXNU-ishtar/blob/e9ffc3f413375f11c365b7f03837ebcdb08913c5/README.md)
|
||||
### Configuration
|
||||
|
||||
- board.schema\_version = 2; board.name = ishtar; board.soc = SM8550; board.kit = sheng; board.os\_profile = ipados-17.7.11-21H461.
|
||||
- kernel.defconfig = sheng\_defconfig; config\_fragments apply arch, soc then os, and the device defconfig applies last.
|
||||
- kernel.patch\_series is arch, soc, os then device, so a board patch cannot be shadowed by a shared one.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ./unixnu defconfig sheng\_defconfig -D ../UniXNU-ishtar from UniXNU.
|
||||
- Run ./unixnu status --json -D ../UniXNU-ishtar and confirm profiles resolve in ARM64, SoC, OS, device order.
|
||||
- Run ./unixnu tree -D ../UniXNU-ishtar and confirm kits/sheng is selected and the device package lands in tree/package.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The board reuses kit sheng because the package scripts, ADT generator and archive plan are shared with the SM8550 reference board; only board.toml values and the device tree differ.
|
||||
- Arrays replace inherited selections rather than extending them, so kernel.archives lists every archive the link needs even though most entries come from sheng.
|
||||
- Three defconfigs exist for different purposes: sheng\_defconfig carries the board build, gpu\_defconfig enables CONFIG\_XNU\_BOOT\_PROGRESS, bringup\_defconfig disables every optional component for early entry debugging.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All source pins resolve, status reports the intended overrides, and tree/ contains the device package plus the shared scripts.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The board does not yet carry its own kit; it inherits sheng's. A divergent board package would need kits/ishtar and a board.kit change.
|
||||
- gpu\_defconfig currently leaves CONFIG\_XNU\_NATIVE\_UFS, CONFIG\_XNU\_NATIVE\_LEGACY\_DISPLAY and CONFIG\_XNU\_NATIVE\_MOBILE\_DISPLAY disabled.
|
||||
|
||||
### Next action
|
||||
|
||||
- Split the board-specific package code out of kit sheng once the bring-up stabilises, so the ishtar tree stops depending on sheng's file layout.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Board identity, partition geometry, archive order, firmware package, payload policy and ADT overrides](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/board.toml)
|
||||
- `source`: [SM8550 shared source pinned to a full commit](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/feeds.toml)
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- ishtarPkg under uefi-sheng Platforms/Xiaomi, built from the sheng firmware tree.
|
||||
- Stock ishtar firmware DTB for the boot-image step.
|
||||
- Vendor firmware inventory in proprietary-files.txt, fetched from the recorded upstream commit.
|
||||
|
||||
### Configuration
|
||||
|
||||
- firmware.config = ishtar; firmware.dsc = Platforms/Xiaomi/ishtarPkg/ishtar.dsc; firmware.fd = Build/ishtarPkg/&\#123;target&\#125;\_CLANGPDB/FV/SILICIUM\_UEFI.fd.
|
||||
- firmware.defines sets DEVICE\_MODEL = ishtar, ENABLE\_SECUREBOOT = 1, MEMORY\_PROTECTION = TRUE and SHIP\_MODE = FALSE.
|
||||
- firmware.patches applies Resources/MuPatches/Gic-Spurious.patch, shared with the SM8550 reference board.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ./unixnu firmware -D ../UniXNU-ishtar --uefi ../uefi-sheng.
|
||||
- Record the firmware commit, the produced FD path and the handoff memory map before any boot attempt.
|
||||
- Build the payload, then assemble the boot image with the firmware DTB and inspect boot.json for ramdisk\_bytes and dtb\_appended.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The firmware package name and the device model are both ishtar, so the DSC, the FD path and the ADT product string must agree or the image builds under the wrong identity.
|
||||
- The firmware DTB is an input to boot-image assembly only; XNU consumes the separately generated ADT, which is why device-tree and ADT values are maintained in different places.
|
||||
- proprietary-files.txt fetches from a recorded upstream commit so the firmware inventory is reproducible without a local vendor dump.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The firmware FD builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The firmware tree is uefi-sheng, not a dedicated uefi-ishtar repository; ishtarPkg lives inside it.
|
||||
- No firmware revision or handoff memory map has been recorded from a device boot yet.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture the firmware revision, the FD size and the handoff memory map on the first successful device boot.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Firmware inventory with upstream commit and per-file SHA-256 digests](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/proprietary-files.txt)
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ArmCpu`, `ArmDTPlatform`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 CPU affinities, GIC distributor and redistributor ranges and the 19.2 MHz timer, all from the shared SoC source.
|
||||
- Board CPU selection and enablement in dts/ishtar.dts.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_ARMCPU=y and CONFIG\_XNU\_ARM\_DT\_PLATFORM=y in the board defconfig.
|
||||
- kernel\_args select sheng-smp=1 and armcpu-spi-ipi=1, matching the shared platform's inter-processor interrupt path.
|
||||
- dts/ishtar.dts includes sm8550.dtsi and overrides only board-level nodes.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the board DTS with the shared SoC include path and inspect the enabled CPUs, GIC ranges and timer properties in the generated ADT.
|
||||
- Record per-CPU entry, timer interrupts and inter-processor interrupt delivery.
|
||||
|
||||
### Development findings
|
||||
|
||||
- CPU affinity values are hardware identifiers read from the firmware, not logical indices; the enabled CPU count and the MPIDR affinities have to be checked together or secondary cores enter at the wrong offset.
|
||||
- cpu\_init\(\) reaches the architecture switch through cpuid\_info\(\), which returns the single global cpuid\_cpu\_info that do\_cpuid\(\) fills once on the boot CPU and stamps with CPU\_ARCH\_ARMv8, so a secondary CPU already sees a known architecture and never enters the panic arm; the board patch that called do\_cpuid\(\) per CPU was removed as redundant and as a write into a section that is read-only after the late lockdown.
|
||||
- GIC register ranges must be translated physical addresses from the hardware tree; the raw SoC addresses are not valid once the firmware remaps them.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every enabled CPU reaches its entry checkpoint and timer and inter-processor interrupt handling works on each enabled CPU.
|
||||
|
||||
### Current limits
|
||||
|
||||
- CPU entry has not been observed on ishtar hardware; this area is implemented and host-verified only by the board DTS compiling.
|
||||
- CPU frequency policy is inherited from the sheng kit and has not been retuned for ishtar thermal limits.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record per-CPU entry and the secondary-core MPIDR values on the first device boot.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Board device tree including the shared SM8550 description](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/dts/ishtar.dts)
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- 8 GiB declared DRAM at 0x80000000.
|
||||
- Splash framebuffer reserved region at 0xb8000000, size 0x2b00000.
|
||||
- Payload DRAM size and owned memory size recorded in board.toml.
|
||||
|
||||
### Configuration
|
||||
|
||||
- dts/ishtar.dts declares memory@80000000 with reg = <0 0x80000000 0x2 0x0>, which needs two size cells because a single 0x200000000 literal is truncated by dtc.
|
||||
- reserved-memory/splash\_region is labelled cont\_splash\_region and marked no-map so the kernel never allocates over the firmware's framebuffer.
|
||||
- payload.dram\_size = 0x200000000; payload.adt.owned\_memory\_size = 0x130000000.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the board DTS and confirm the memory node size is 0x200000000 rather than a truncated value.
|
||||
- Inspect the generated ADT for the owned memory size and the reserved region list before assembling the payload.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Declaring less DRAM than the phone physically has is deliberate: the physmap and the page-table allocator will otherwise reach addresses no DRAM backs. The SM8550 reference boards declare less than the fitted DRAM for the same reason.
|
||||
- The reserved splash region must stay no-map. Mapping it as normal memory lets the page-table allocator hand out the framebuffer and the firmware's splash output disappears.
|
||||
- The size cell count is the single easiest value to get silently wrong; dtc truncates a 64-bit literal in a one-cell property without failing.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The ADT reports the intended DRAM and owned memory sizes and the reserved splash region appears in the handoff list.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Memory has not been validated on hardware; the declared size follows the reference board policy rather than a measurement of this unit.
|
||||
- SMMU and DMA address-translation ownership is not configured for this board.
|
||||
|
||||
### Next action
|
||||
|
||||
- Compare the ADT memory description against the firmware's memory map on the first device boot.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Declared DRAM size and the reserved splash framebuffer region](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/dts/ishtar.dts)
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`planned`
|
||||
|
||||
Components: `ShengUfs`, `VirtioMmioBlock`, `VerifiedRoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 UFS host controller and PHY resources from the shared SoC source.
|
||||
- Board UFS and UFS PHY enablement in dts/ishtar.dts, both currently status = okay.
|
||||
- Userdata partition geometry in board.toml.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_NATIVE\_UFS=n and CONFIG\_XNU\_NATIVE\_VIRTIO\_BLOCK=n in gpu\_defconfig, so the storage path is selected as a component but not compiled into the kernel.
|
||||
- board.userdata records first\_lba = 3094592, last\_lba = 64007162 and lba\_bytes = 4096, with OS and SystemOS windows.
|
||||
- dts/ishtar.dts sets ufs and ufsphy status = okay so the nodes are present in the hardware tree.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read the UFS controller base address and the PHY register window from the vendor firmware DTB before writing board values.
|
||||
- Build with CONFIG\_XNU\_NATIVE\_UFS=y once the controller resources are confirmed, and record the boot attempt.
|
||||
- Confirm the userdata geometry against the stock GPT before mounting anything.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The UFS nodes are enabled in the device tree while the driver is compiled out, which is intentional: it keeps the hardware description complete so enabling the driver is a configuration change rather than a device-tree change.
|
||||
- The partition geometry was taken from the stock GPT; first\_lba and last\_lba are absolute LBAs, so they are only valid for a device that has not been repartitioned.
|
||||
- ShengUfs depends on VirtioMmioBlock and VerifiedRoot, so both appear in the component closure even though neither is compiled in yet.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The kernel probes the UFS controller, reads the GPT and mounts the root volume.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No controller address has been confirmed for ishtar; the value is expected to match the SM8550 reference board but that has not been checked against this unit's firmware.
|
||||
- The root volume and the persistent Data volume are both unconfigured.
|
||||
- No storage evidence of any kind exists for this board yet.
|
||||
|
||||
### Next action
|
||||
|
||||
- Read the UFS controller base and PHY window out of the stock ishtar firmware DTB and record them before enabling CONFIG\_XNU\_NATIVE\_UFS.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Userdata partition geometry and the selected storage components](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/board.toml)
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Panel resolution 1440x3200 with a 5760-byte stride, from the firmware framebuffer.
|
||||
- Splash framebuffer physical base 0xb8000000 and size 0x2b00000.
|
||||
|
||||
### Configuration
|
||||
|
||||
- payload.panic\_framebuffer = &\#123; base = 0xb8000000, width = 1440, height = 3200, stride = 5760 &\#125; lets the panic path and the boot-progress renderer write pixels without a display driver.
|
||||
- CONFIG\_XNU\_NATIVE\_LEGACY\_DISPLAY=n and CONFIG\_XNU\_NATIVE\_MOBILE\_DISPLAY=n, so no display driver is compiled in.
|
||||
- kernel\_args carry offline-legacy-gop=1 and offline-legacy-unit-scale=2 for the inherited legacy display path.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Record the framebuffer base, stride and format from the firmware before changing any display value.
|
||||
- Confirm the panic framebuffer writes appear at the expected offset, since a wrong stride shifts every row.
|
||||
- Enable CONFIG\_XNU\_NATIVE\_MOBILE\_DISPLAY only after the panel controller resources are confirmed.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The only display output that works without a driver is the direct framebuffer path: panic screen and boot progress both write through the physical base, which is why they survive a hang before any display driver exists.
|
||||
- Stride is not width times bytes per pixel. The panel reports 5760 bytes for 1440 pixels, so the renderer must use the reported stride or every row lands at the wrong address.
|
||||
- The framebuffer is a reserved no-map region, so it is reachable only through the physical aperture once arm\_vm\_init has run.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The panel shows kernel output through a real display driver rather than a direct framebuffer write.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No display driver is compiled in; only the direct framebuffer path is available.
|
||||
- Panel timing, backlight and the display controller have not been configured for this board.
|
||||
- The framebuffer has not been observed on ishtar hardware.
|
||||
|
||||
### Next action
|
||||
|
||||
- Confirm the firmware framebuffer base and stride on the device, then enable CONFIG\_XNU\_NATIVE\_MOBILE\_DISPLAY with the panel resources filled in.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Panic framebuffer geometry used by the direct framebuffer path](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/board.toml)
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Novatek NT36532 touch controller firmware, recorded in proprietary-files.txt with its SHA-256 digest.
|
||||
- Touch bus, GPIO and interrupt assignment, not yet read from the vendor firmware.
|
||||
|
||||
### Configuration
|
||||
|
||||
- ShengHidInput and ShengNovatekTouch exist in the tree but are not listed in board.components.include, so neither is built.
|
||||
- proprietary-files.txt carries the Novatek firmware blob so the touch driver has its firmware input available once selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read the touch controller's bus, reset GPIO and interrupt line from the vendor firmware DTB.
|
||||
- Add ShengHidInput and ShengNovatekTouch to board.components.include and rebuild.
|
||||
- Record the first touch report and the coordinate mapping.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The touch firmware blob is already pinned even though the driver is not selected, so enabling input does not require a new vendor dump.
|
||||
- ShengNovatekTouch depends on QcomGeniSpi for the SPI transport, so enabling touch pulls in the GENI SPI component as well.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touch reports reach the HID stack with correct coordinates and the home gesture is recognised.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No input component is selected for this board.
|
||||
- Bus, GPIO and interrupt values are unconfirmed.
|
||||
- No input evidence exists for this board.
|
||||
|
||||
### Next action
|
||||
|
||||
- Read the Novatek controller's bus and interrupt assignment from the vendor firmware DTB.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Novatek touch firmware pinned with its SHA-256 digest](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/proprietary-files.txt)
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`planned`
|
||||
|
||||
Components: `Adreno740`, `Sm8550Platform`, `AdrenoPM4`, `AdrenoFirmware`, `ArmSmmu4K`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Adreno 740 GPU and GMU resources from the shared SM8550 source.
|
||||
- GPU firmware and PM4 microcode, audited by the probe builders in package/.
|
||||
- GPU SMMU and GMU enablement in dts/ishtar.dts, all three currently status = okay.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_NATIVE\_ADRENO=y, but CONFIG\_XNU\_EXTRA\_LD\_ARCHIVES points at build/adreno-link-stubs/libAdrenoLinkStubs.a, so the kernel links against stubs rather than the full driver.
|
||||
- kernel\_args carry sheng-gpu-power=9, sheng-gpu-metal=1 and sheng-gpu-perf=8, inherited from the shared platform.
|
||||
- dts/ishtar.dts enables gpu, gmu and gpu\_smmu.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run scripts/build-adreno-link-stubs.py to produce the stub archive the kernel link expects.
|
||||
- Run the Adreno probe builders and compare the reported GPU identity against the expected Adreno 740 values.
|
||||
- Record the first GPU command submission once the real driver replaces the stubs.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The kernel links with Adreno link stubs on purpose: the full Adreno driver needs the AdrenoMetal accelerator ABI, which is a payload-stage component and has no kernel link variable. Selecting the component while linking stubs keeps the archive plan valid.
|
||||
- GPU firmware and PM4 microcode are inputs, not build products; the probe builders audit the recorded candidates rather than regenerating them.
|
||||
- Adreno740 pulls in Sm8550Platform, AdrenoPM4, AdrenoFirmware and ArmSmmu4K, which is why five components belong to this area.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The GPU reports its identity, accepts a command submission and presents a frame through the Metal frontend.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Only link stubs are compiled; no GPU command has been submitted on this board.
|
||||
- The GPU and GMU have not been powered on outside the firmware.
|
||||
- No GPU evidence exists for this board.
|
||||
|
||||
### Next action
|
||||
|
||||
- Run the Adreno probe builders against the ishtar firmware and record the reported GPU identity.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Builds the stub archive the kernel link uses while the full driver is unavailable](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/scripts/build-adreno-link-stubs.py)
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Ath12k Wi-Fi hardware resources, not yet mapped for this board.
|
||||
- Board Wi-Fi firmware and calibration data, not yet collected.
|
||||
|
||||
### Configuration
|
||||
|
||||
- drivers/Ath12kWifi exists in the tree but is not listed in board.components.include, so it is not built.
|
||||
- No network kernel arguments are set in board.toml.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Map the Wi-Fi PCIe or AHB window and the interrupt line from the vendor firmware.
|
||||
- Collect the board calibration data and firmware before selecting the component.
|
||||
- Add the component to board.components.include and record the first association attempt.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The driver directory is present because the tree is derived from sheng, which does select it; ishtar does not, so the directory is currently unused by this board.
|
||||
- Wi-Fi on this platform needs per-board calibration data that cannot be reused from a different board even on the same SoC.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The interface associates and carries packets through the OS network stack.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No network component is selected for this board.
|
||||
- Calibration data has not been collected.
|
||||
- No network evidence exists for this board.
|
||||
|
||||
### Next action
|
||||
|
||||
- Determine whether the Wi-Fi window is PCIe or AHB on this board before selecting the driver.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Component selection showing that no network component is included](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/board.toml)
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- ADSP firmware and the codec topology, neither collected for this board.
|
||||
- Board audio routing, not yet documented.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No audio component is selected in board.components.include.
|
||||
- The ADSP probe builders exist in package/ but are not part of the ishtar archive plan.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Collect the ADSP firmware image and record its hash.
|
||||
- Map the codec and the amplifier enable GPIOs from the vendor firmware.
|
||||
- Select the audio components and record playback and capture separately.
|
||||
|
||||
### Development findings
|
||||
|
||||
- ADSP firmware is a per-board input; the probe builders audit a recorded candidate rather than synthesising one.
|
||||
- The audio path on this platform spans ADSP, codec and amplifier, so it cannot be enabled by a single component selection.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Playback and capture both work through the OS audio stack.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No audio component is selected.
|
||||
- No firmware or routing data has been collected.
|
||||
- No audio evidence exists for this board.
|
||||
|
||||
### Next action
|
||||
|
||||
- Collect the ADSP firmware image and record its hash before attempting audio bring-up.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Component selection showing that no audio component is included](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/board.toml)
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Regulator and clock ownership from the shared SM8550 source.
|
||||
- Battery fuel gauge configuration, not yet confirmed for this board.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_SHENG\_PMGR=y, inherited from the shared platform, but the power manager has not been exercised on this board.
|
||||
- kernel\_args carry sheng-cpufreq=3 and sheng-disable-watchdogd=1.
|
||||
- payload.adt.defaults.u32 sets sleep-disabled = 1 so the device does not suspend during bring-up.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Record the regulator and clock state the firmware leaves behind before claiming ownership.
|
||||
- Confirm the fuel gauge reports a plausible charge level before enabling battery reporting.
|
||||
- Remove sleep-disabled = 1 only after suspend and resume are understood.
|
||||
|
||||
### Development findings
|
||||
|
||||
- sleep-disabled = 1 is a bring-up setting, not a shipping one; leaving it set hides suspend bugs rather than fixing them.
|
||||
- The power manager is compiled in through the shared platform but has no board-specific regulator or clock table for ishtar yet.
|
||||
- CPU frequency policy is inherited from the shared platform and has not been retuned for this board's thermal envelope.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Regulators and clocks are owned by the OS, the battery reports a plausible charge, and suspend and resume work.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No board-specific regulator or clock configuration exists.
|
||||
- The fuel gauge has not been read on this board.
|
||||
- No power evidence exists for this board.
|
||||
|
||||
### Next action
|
||||
|
||||
- Read the fuel gauge on the first device boot and compare it against the stock firmware's reported charge.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Power-related kernel arguments and the sleep-disabled bring-up default](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/board.toml)
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `DarwinBoot`, `XnuPrelink`, `SoftwareAES`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- iPadOS 17.7.11 kernelcache as the prelink input.
|
||||
- Firmware DTB for boot-image assembly.
|
||||
- The recorded archive plan in board.kernel.archives.
|
||||
|
||||
### Configuration
|
||||
|
||||
- kernel.archives lists the ordered archive plan, mixing component: entries and script filenames.
|
||||
- payload.volume = ISHTARESP, size\_mib = 54, loader = firmware, title = Boot iPadOS.
|
||||
- bootimg.dtb\_node adds reserved-memory/splash\_region to the firmware DTB so the firmware hands the framebuffer over.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ./unixnu kernel -D ../UniXNU-ishtar and confirm kernel/kernel.macho is produced.
|
||||
- Run ./unixnu payload -D ../UniXNU-ishtar and confirm payload/payload.img and payload/payload.json.
|
||||
- Run ./unixnu bootimg -D ../UniXNU-ishtar and confirm the assembled image reports a passing round trip.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The archive plan is explicit rather than inherited, so every kernel-stage recipe appears in order; a component: entry resolves through the component catalog and a bare filename runs a shared builder.
|
||||
- build-adreno740-accelerator.py is deliberately absent from the archive plan because it needs a payload-stage header that the kernel link does not provide; adding it fails the link.
|
||||
- Boot-image assembly needs the firmware DTB. Without it the payload is correct but the image cannot be produced.
|
||||
- The container is larger than the payload because the boot image inlines a 64 MiB window at 0xF0000000 with ramdisk\_bytes = 0 and no appended device tree.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Kernel, payload and boot image all build, and the assembled image passes its own round-trip check.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The boot image has never been loaded on ishtar hardware.
|
||||
- The build has no recorded host verification entry yet because the device repository has no published commit to cite.
|
||||
- Kernel build reliability is affected by an intermittent clang frontend crash on osfmk/vm/vm\_kern.c, which is resolved by re-running the single translation unit rather than by a source change.
|
||||
|
||||
### Next action
|
||||
|
||||
- Publish the device repository, then record the kernel, payload and boot-image commands with the resulting commit as host evidence.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Board kernel configuration including the extra link archive and the boot-progress switch](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/configs/gpu_defconfig)
|
||||
- `source`: [Archive plan, payload policy and boot-image device-tree overlay](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/board.toml)
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Framebuffer geometry from board.toml for direct pixel writes.
|
||||
- The kernel symbol physmap\_base for reaching the framebuffer after arm\_vm\_init.
|
||||
- The 5x12 glyph table in the firmware Font.h.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_BOOT\_PROGRESS=y selects the boot-progress observer in gpu\_defconfig.
|
||||
- Two implementations provide the entry points: BootProgressMin.c is self-contained and links into any configuration, while BootProgress.c is the full monitor and requires the audited UFS, owner-root, Virtio and source-corecrypto build.
|
||||
- payload.panic\_screen = true and payload.panic\_framebuffer give the panic path a place to draw.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run scripts/build-boot-progress-min.py to build libBootProgress.a and confirm the undefined-symbol gate passes.
|
||||
- Boot the image and photograph the panel; the last numbered log line identifies the stage the kernel did not survive.
|
||||
- Compare the last stage against the checkpoint list to pick the next area to investigate.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The observer must never fault: a diagnostic that faults turns a hang into a hang with no output. Every kernel pointer is probe-translated with AT S1E1R before it is read, and every framebuffer store is bounded by the geometry the console reported.
|
||||
- boot\_progress\_active\(\) stays false until a framebuffer has been validated, so a board with no usable framebuffer keeps its normal console output instead of going silent.
|
||||
- Once the observer binds, the normal console output is suppressed; a rendering fault therefore leaves a half-drawn screen with no textual output. The panic screen is a separate mechanism and is unaffected.
|
||||
- The self-contained implementation is chosen by default because the full monitor reads UFS and Virtio counters directly and fails the link in a reduced configuration.
|
||||
- A fixed-size literal destination can be constant-folded into mov/movk immediates, so a string that is visibly in the source may not appear in \_\_cstring. Verifying that a patch reached the image needs a string that is genuinely stored as a literal.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The screen shows the boot-progress panel and the last logged stage identifies where the kernel stopped.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The observer has never rendered on ishtar hardware; its layout has only been verified on the host with a synthetic framebuffer.
|
||||
- The full monitor implementation cannot be selected without the audited storage, owner-root, Virtio and corecrypto build.
|
||||
|
||||
### Next action
|
||||
|
||||
- Boot the boot-progress image on ishtar and record the last logged stage together with a photograph of the panel.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Self-contained boot-progress observer that renders stages to the raw framebuffer](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/package/BootProgressMin.c)
|
||||
- `source`: [Build script with an undefined-symbol gate that rejects the object when the kernel image cannot satisfy it](https://github.com/peter8889/UniXNU-ishtar/blob/65592496e814ede46cc89721ee792b31912d38bd/scripts/build-boot-progress-min.py)
|
||||
|
||||
</div>
|
||||
+527
-21
@@ -1,32 +1,538 @@
|
||||
# Lenovo Xiaoxin Pad Pro 2021 (j716f)
|
||||
# Lenovo Xiaoxin Pad Pro 2021 \(j716f\)
|
||||
|
||||
A community port for SM8250, maintained by Denis0x00.
|
||||
[Denis0x00/UniXNU-j716f](https://github.com/Denis0x00/UniXNU-j716f)
|
||||
|
||||
- [Denis0x00/UniXNU-j716f](https://github.com/Denis0x00/UniXNU-j716f)
|
||||
<div v-pre>
|
||||
|
||||
## State
|
||||
Lenovo TB-J716F migration record for the UniXNU iPadOS 17.7.11 bring-up.
|
||||
|
||||
The format 2 tree selects board-local SM8250 data and the iPadOS 17.7.11 profile. The menu, GOP and physical keys work. V14 verifies a 256 MiB window; V16 reaches ExitBootServices and early XNU probes, and V17 records a post-MMU reset checkpoint.
|
||||
Source record: [porting.toml](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/porting.toml), `f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87`.
|
||||
|
||||
V18 resets at a WFE stop, with the cause undetermined. V21 reaches the enlarged menu and records a PMIC reset baseline; its XNU attempt remains pending. Sustained MMU-on execution, physical UFS/root and userland require further validation. Use the V21 recipe for its firmware inputs.
|
||||
This page is generated from the device record.
|
||||
|
||||
## Use this port
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [Configuration](#configuration) | `host-verified` |
|
||||
| [Firmware and boot](#firmware) | `device-verified` |
|
||||
| [CPU and interrupts](#cpu) | `planned` |
|
||||
| [Memory and DMA](#memory) | `device-verified` |
|
||||
| [Storage and root](#storage) | `planned` |
|
||||
| [Display](#display) | `device-verified` |
|
||||
| [Input](#input) | `device-verified` |
|
||||
| [GPU](#gpu) | `planned` |
|
||||
| [Network](#network) | `planned` |
|
||||
| [Audio](#audio) | `planned` |
|
||||
| [Power](#power) | `planned` |
|
||||
| [Image assembly](#packaging) | `host-verified` |
|
||||
| [Diagnostics](#diagnostics) | `device-verified` |
|
||||
|
||||
1. Read the pinned source and validation records below. Prepare the required firmware and system inputs.
|
||||
2. Clone the device repository and follow its build guide from the checkout:
|
||||
## Configuration {#configuration}
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/Denis0x00/UniXNU-j716f.git
|
||||
cd UniXNU-j716f
|
||||
git checkout f82228a9e166603d6a8b522bf0214db3379fad0d
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
`host-verified`
|
||||
|
||||
3. Complete the build for that revision, follow the [bring-up order](/porting/bring-up), and use [log capture](/porting/log-capture) to record the last confirmed stage.
|
||||
4. Save results in the [porting record](/porting/records). See [Port a device](/porting/steps) for board structure and component selection.
|
||||
Components: `XnuPrelink`, `DarwinBoot`.
|
||||
|
||||
## Sources
|
||||
### Hardware and dependencies
|
||||
|
||||
- [V21 diagnostics: Denis0x00/UniXNU-j716f](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/docs/V21_RESET_DIAGNOSTICS.md)
|
||||
- [README: Denis0x00/UniXNU-j716f](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/README.md)
|
||||
- [Denis0x00/uefi-j716f](https://github.com/Denis0x00/uefi-j716f)
|
||||
- SM8250/Kona identity, iPadOS 17.7.11 profile candidate, source defconfig, and the local SoC evidence snapshot.
|
||||
|
||||
### Configuration
|
||||
|
||||
- board.toml uses schema\_version 2, soc\_source sm8250, os\_profile ipados-17.7.11-21H461, and device:dts/j716f.dts.
|
||||
- The source qualification defconfig remains the reproducible kernel configuration; it does not claim a bootable XNU.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run the latest UniXNU defconfig, status, tree, and porting-record checks from the UniXNU checkout.
|
||||
|
||||
### Development findings
|
||||
|
||||
- No reviewed public UniXNU-sm8250-common repository was available, so the board-local source is explicitly marked as a transition snapshot.
|
||||
- The macOS source workflow is pinned to UniXNU 42bffe8 and keeps its J716F compatibility fixes in the device repository.
|
||||
- The source qualification defconfig disables the profile's MOCKFS fixture because that fixture requires ArmCpu, while this board intentionally keeps ArmCpu disabled.
|
||||
- The source-output sealing step discovers the migration-qualified report and tree instead of assuming the legacy out/j716f root.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The format 2 identity, source paths, defconfig, and patch order resolve without ambiguous board fields.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The SoC source is local and not yet a reusable fixed public commit; component ABI inputs remain incomplete.
|
||||
|
||||
### Next action
|
||||
|
||||
- Extract the shared SM8250 resources into a reviewed UniXNU-sm8250-common repository and pin its 40-character commit.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [Format 2 board identity and migration fields are present.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/board.toml)
|
||||
Command: <code>python3 scripts/porting-record.py check --device ../UniXNU-j716f</code>. Revision: `f82228a9e166603d6a8b522bf0214db3379fad0d`.
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`device-verified`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Mu-Silicium J716F platform, inherited GOP, fixed ZUI memory map, and the board UEFI DSC/FDF.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The device board points to the j716f DSC/FD and keeps vendor inputs outside the public repository.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build the diagnostic FD with the local UEFI checkout, audit its inputs, then boot only through boot\_b for hardware checks.
|
||||
|
||||
### Development findings
|
||||
|
||||
- V14 reached the UniXNU menu and exercised the documented button and DarwinBoot protocol paths.
|
||||
- V16 on boot\_b displayed the green ExitBootServices bar, the blue MMU-off XNU entry probe and the magenta pre-MMU-enable probe; the screen also showed the normal CapsuleRuntimeDxe LockCapsuleInterface callback.
|
||||
- V17 on boot\_b waited through the post-MMU probe, executed PSCI reset, and returned to the UniXNU menu with the same three entry bars.
|
||||
- V18 displayed the same three bars but later reset back to UniXNU despite replacing stage 3 with a WFE loop; the external reset/watchdog source is unresolved.
|
||||
- V19/V20 added read-only reset diagnostics. V20 photographs showed the DarwinBoot pre-ExitBootServices message and a later menu, but no readable PMIC value.
|
||||
- V21 was built and host-audited, flashed only to boot\_b and rebooted. A photograph confirms its large-text V21 menu and PMIC RESET: 0x02000001; the V21 XNU attempt remains unobserved.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The FD enters UniXNU, preserves the documented memory reservations, and exposes the framebuffer for the menu.
|
||||
|
||||
### Current limits
|
||||
|
||||
- MMU-on persistence, ArmCpu/ArmDTPlatform initialization, UFS/root, userspace and iPadOS remain unverified; TzDxe is out of scope.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record a V21 XNU attempt, final text/color bars and any Lenovo logo reappearance; use the PMIC sample as historical baseline without assigning a reset cause.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `device`: [V16 device boot reached ExitBootServices and the XNU early-entry probes on boot\_b; no other partition was written.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/docs/V16_SOURCE_ENTRY_RESULT.md)
|
||||
Command: <code>fastboot boot boot_b</code>. Revision: `b421b9bf8036fe89883f5e4987fb483eda45568b`.
|
||||
- `device`: [V21 boot\_b menu photograph confirms readable enlarged text and PMIC 0x02000001; XNU attempt and reset attribution remain pending.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/research/v21-reset-diagnostics.json)
|
||||
Command: <code>fastboot flash boot_b <V21_BOOT_IMAGE>; fastboot reboot; observe the V21 menu.</code>. Revision: `2c13d875f8b3d38414f61443dc44b9b9559dfcb7`.
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- CPU0 MPIDR affinity 0, PSCI SMC, and a 19.2 MHz timer from the firmware device-tree evidence.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The DTS describes one enabled CPU and the measured timer frequency; the source qualification defconfig keeps ArmCpu disabled.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the DTS, enable the reviewed ArmCpu implementation, and verify CPU entry, timer and IPI checkpoints.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Only the single boot CPU and shared resource addresses are currently audited; no multi-core XNU entry has been established.
|
||||
- The source qualification keeps ArmCpu disabled, so the profile's MOCKFS executable-root fixture is disabled rather than claiming CPU component support.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on the selected cores.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No public SM8250 ArmCpu source or device-side CPU entry evidence is pinned yet.
|
||||
|
||||
### Next action
|
||||
|
||||
- Review the SM8250 CPU topology and ArmCpu ABI before enabling the component.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`device-verified`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Two firmware RAM banks, a 5 GiB primary contiguous bank, reserved ranges, and the qualified 256 MiB DarwinBoot window.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The board DTS records the primary 0xc0000000/0x140000000 bank; the diagnostic payload separately requests 0x10000000 owned bytes.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Audit the memory map on the host, then allocate, cache-maintain, read back and release the V14 window on boot\_b.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The V14 256 MiB physical window passed seven checks, including two complete write/read rounds with cache maintenance and release; this does not validate full DRAM ownership.
|
||||
- V21 host audit confirms the same embedded FAT payload and module GUID set as V20; this does not add a new RAM qualification result.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Handoff regions do not overlap and the requested DarwinBoot window is allocated, coherently accessed and released.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The V15 larger FAT payload and runtime initrd allocation still need a device observation.
|
||||
|
||||
### Next action
|
||||
|
||||
- Repeat the memory check with V15 while recording the initrd range and final owned-memory result.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `device`: [Seven V14 checks passed, including two full write/read rounds over one 256 MiB window, cache maintenance and release.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/docs/V14_MEMORY_WINDOW.md)
|
||||
Command: <code>fastboot boot boot_b</code>. Revision: `3159b53f6fe197d661f1cf31fb2bc1b9e1128f42`.
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UFS controller, PHY, LUN and userdata geometry are not yet represented by a reviewed J716F component source.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No UFS node, root volume UUID, GPT window or Data seed is declared in the public board configuration.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Capture the UFS controller and GPT facts from recovery/TWRP, then select a compatible storage component and root policy.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The current V15 payload is a diagnostic FAT volume and does not prove physical UFS access or root mounting.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Controller reads, GPT windows, OS/SystemOS ranges and root persistence pass on the device.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No storage ABI, trust cache or userdata seed is public or verified.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record UFS register, LUN and userdata geometry before adding a storage component.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`device-verified`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Inherited GOP at 2560x1600 with 10240 bytes per row and 32-bit pixels.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The UEFI platform keeps the inherited framebuffer and the board DTS does not invent a panel controller.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Enter the menu through boot\_b, observe the framebuffer geometry, and preserve the last screen on a returned diagnostic path.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The menu and diagnostic screens rendered on the device; panel, backlight and native display driver adaptation are not complete.
|
||||
- V21 device photography confirms the scale-4 menu with hidden logo and readable PMIC summary. The active framebuffer log font was changed from scale 3 to 5, but its device effect has not yet been observed.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- A known frame has the measured geometry and format, followed by a native display provider and backlight result.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Only GOP/menu output is verified; native display and backlight remain pending.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture the V21 DarwinBoot/entry screen and then identify panel/backlight resources from the vendor DT.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `device`: [The existing diagnostic series records a measured 2560x1600 GOP and menu rendering; V15 itself remains pending.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/docs/V15_ENTRY_DIAGNOSTIC.md)
|
||||
Command: <code>fastboot boot boot_b</code>. Revision: `f82228a9e166603d6a8b522bf0214db3379fad0d`.
|
||||
- `device`: [V21 boot\_b menu photograph confirms readable enlarged text and PMIC 0x02000001; XNU attempt and reset attribution remain pending.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/research/v21-reset-diagnostics.json)
|
||||
Command: <code>fastboot flash boot_b <V21_BOOT_IMAGE>; fastboot reboot; observe the V21 menu.</code>. Revision: `2c13d875f8b3d38414f61443dc44b9b9559dfcb7`.
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`device-verified`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Volume and power key paths provided by the Mu-Silicium platform and J716F key DXE.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The menu remains interactive only where the platform reports an input device; no touch component is selected yet.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Use volume keys to select and the power key to confirm, then record whether the selected entry returns or advances.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Volume and power keys were observed in the diagnostic menu; touch coordinates and HID reports are not yet adapted.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touches map to the display and buttons produce stable reports through the selected input component.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Only the hardware keys are verified; touch controller and HID ABI are pending.
|
||||
|
||||
### Next action
|
||||
|
||||
- Collect touch controller bus, interrupt and coordinate mapping from the vendor DT and recovery logs.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `device`: [The existing bring-up record confirms volume and power key interaction in the UniXNU menu.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/README.md)
|
||||
Command: <code>fastboot boot boot_b</code>. Revision: `f82228a9e166603d6a8b522bf0214db3379fad0d`.
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Adreno/GMU registers, firmware, SMMU streams and Metal ABI inputs are not public for this board.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No GPU component is selected; the source defconfig keeps native Adreno disabled.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Audit the SM8250 GPU resources, obtain matching firmware and ABI records, then add a component and package service.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The current screen result comes from inherited GOP and does not establish GPU submission or Metal presentation.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- GPU submissions, mapping, fences, known rendering and the selected Metal client all pass.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No GPU firmware or device-side submission evidence is available.
|
||||
|
||||
### Next action
|
||||
|
||||
- Inventory Adreno 650/SM8250 resources and firmware ownership before selecting a component.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Wireless chipset, bus, firmware and DMA ownership are not identified in the public port.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No Wi-Fi component or network package is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Identify the wireless controller and firmware, then follow the network adaptation guide and record association/traffic tests.
|
||||
|
||||
### Development findings
|
||||
|
||||
- No network path has been exercised by the diagnostic images.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Scanning, association, address configuration and sustained traffic pass with the selected firmware.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Wireless hardware and OS ABI inputs are missing.
|
||||
|
||||
### Next action
|
||||
|
||||
- Extract the wireless controller identity and firmware source from the stock system.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- DSP, codec, clocks and firmware service ownership are not yet described.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No audio component or board package service is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Inventory the audio graph and DSP firmware, then validate playback and capture routes.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The current bring-up stops before userspace audio and has no audio evidence.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Declared routes carry the selected format through playback and capture with correct start/stop behavior.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Audio inputs and firmware are unavailable.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture the codec/DSP graph and firmware interfaces from the stock device.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Regulators, clocks, battery units and firmware ownership are not yet modeled.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The port keeps vendor power initialization in UEFI and declares no XNU power component.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Document regulators and power domains, then validate battery readings and a controlled sleep/resume cycle.
|
||||
|
||||
### Development findings
|
||||
|
||||
- No sleep/resume or battery result has been obtained from the diagnostic image.
|
||||
- The V20/V21 UEFI diagnostic provider reads PMIC history without clearing it. V21 displays 0x02000001; bit semantics and reset cause remain unclassified, and this does not validate an XNU power driver.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Power readings and supported sleep/resume transitions restore dependent peripherals.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Power resources and low-power ownership remain unknown.
|
||||
|
||||
### Next action
|
||||
|
||||
- Inventory PMIC and battery resources before adding a power component.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `device`: [V21 boot\_b menu photograph confirms readable enlarged text and PMIC 0x02000001; XNU attempt and reset attribution remain pending.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/research/v21-reset-diagnostics.json)
|
||||
Command: <code>fastboot flash boot_b <V21_BOOT_IMAGE>; fastboot reboot; observe the V21 menu.</code>. Revision: `2c13d875f8b3d38414f61443dc44b9b9559dfcb7`.
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `XnuPrelink`, `DarwinBoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- V15 FAT payload layout, Android boot image v2 parameters, UEFI FD and the real kernel/ADT private inputs.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The board declares a 64 MiB diagnostic volume, firmware DarwinBoot loader, measured DRAM and boot image v2 offsets.
|
||||
- The UEFI repository now declares the shared RAM-disk DXE alongside DiskIoDxe and FAT while retaining the existing V15 embedded-FAT diagnostic path.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run host image audits, verify kernel/ADT hashes and inspect the boot image before any boot\_b test.
|
||||
|
||||
### Development findings
|
||||
|
||||
- V15 host packaging and static audits passed.
|
||||
- V16 host packaging produced the source-prelinked kernel, J716F ADT and boot image used for the boot\_b test.
|
||||
- The source build applies a device-local patch-series compatibility fix before the pinned UniXNU resolver, so optional Sheng PMGR context is not required for J716F.
|
||||
- V21 host checks passed FD/FV/FFS checksums, AARCH64 PE and linked-module identity, V21 markers, unchanged V20 embedded FAT, BootShim/gzip, both DTB copies and Android v2 header/SHA1/padding.
|
||||
- The byte-identical local V21 DSC is preserved in the firmware repository; it retains the V15 FDF/output path and omits the public V15 DSC additional standard-initrd declarations. Device board.toml retains historical V17 payload settings and is not the complete V21 artifact recipe.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Kernel and ADT inputs are reproducible, the payload contains declared files, and the boot image matches the platform header and size constraints.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Private payload binaries and vendor inputs are intentionally excluded; MMU-on continuation and later platform stages remain unverified.
|
||||
|
||||
### Next action
|
||||
|
||||
- Keep the recorded V21 image/profile identity while collecting the pending XNU attempt and reset evidence.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [V16 kernel/ADT/payload packaging and host audits passed for the local diagnostic artifact used on boot\_b.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/docs/V16_SOURCE_ENTRY_RESULT.md)
|
||||
Command: <code>python3 scripts/check-j716f.py</code>. Revision: `f82228a9e166603d6a8b522bf0214db3379fad0d`.
|
||||
- `host`: [V21 host image audits passed; hashes and source/profile identities are recorded separately from the menu observation.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/research/v21-reset-diagnostics.json)
|
||||
Command: <code>python tools/package_j716f_v21.py (local workspace; generated artifacts remain private)</code>. Revision: `2c13d875f8b3d38414f61443dc44b9b9559dfcb7`.
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`device-verified`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Host audit scripts, V14 memory evidence, V15 entry preparation, V16 boot\_b observation, and source-build reports.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Diagnostic outputs are separated from private binaries and the record distinguishes host, device and planned evidence.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run the preflight and record checks, preserve only text metadata in CI, and use the boot\_b-only recovery procedure on hardware.
|
||||
|
||||
### Development findings
|
||||
|
||||
- V16 device evidence confirms ExitBootServices and XNU early-entry probes on boot\_b; the result is preserved in docs/V16\_SOURCE\_ENTRY\_RESULT.md.
|
||||
- Source-build diagnostics record both device-local compatibility patches and keep patch preparation idempotent across repeated macOS runner attempts.
|
||||
- V21 was built, audited and flashed to boot\_b; the observed menu has V21 labels, enlarged text and PMIC RESET: 0x02000001.
|
||||
- The current PMIC value is a boot-history baseline. Neither this sample nor the earlier exiting boot services message identifies the cause of a reset; no V21 XNU attempt has yet been observed.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each claimed milestone has a reproducible command, matching source/image revision and an accessible result.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No UART capture is available; MMU-on persistence, platform drivers, UFS/root and userspace remain unverified.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the selected XNU diagnostic attempt, final text/color bars, possible Lenovo logo and final held screen or menu before changing the next checkpoint.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `device`: [V16 records the audited private-input hashes and the boot\_b screen evidence for ExitBootServices and XNU early entry.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/docs/V16_SOURCE_ENTRY_RESULT.md)
|
||||
Command: <code>python3 scripts/porting-record.py check --device ../UniXNU-j716f</code>. Revision: `b421b9bf8036fe89883f5e4987fb483eda45568b`.
|
||||
- `device`: [V21 boot\_b menu photograph confirms readable enlarged text and PMIC 0x02000001; XNU attempt and reset attribution remain pending.](https://github.com/Denis0x00/UniXNU-j716f/blob/f7f9f4a315e2f467d5a9dfe7fdf70c34c917fc87/research/v21-reset-diagnostics.json)
|
||||
Command: <code>fastboot flash boot_b <V21_BOOT_IMAGE>; fastboot reboot; observe the V21 menu.</code>. Revision: `2c13d875f8b3d38414f61443dc44b9b9559dfcb7`.
|
||||
|
||||
</div>
|
||||
@@ -0,0 +1,5 @@
|
||||
# OnePlus 8T \(stevedang67889\)
|
||||
|
||||
[stevedang67889/UniXNU-kebab](https://github.com/stevedang67889/UniXNU-kebab)
|
||||
|
||||
Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.
|
||||
@@ -0,0 +1 @@
|
||||
[yang232138/UniXNU-lmipro](https://github.com/yang232138/UniXNU-lmipro)
|
||||
+3
-30
@@ -1,32 +1,5 @@
|
||||
# Redmi K30 Pro Zoom Edition (lmipro)
|
||||
# Redmi K30 Pro Zoom Edition \(lmipro\)
|
||||
|
||||
A community device port for SM8250.
|
||||
[yang232138/UniXNU-lmipro-v2](https://github.com/yang232138/UniXNU-lmipro-v2)
|
||||
|
||||
- [yang232138/UniXNU-lmipro-v2](https://github.com/yang232138/UniXNU-lmipro-v2)
|
||||
- [yang232138/UniXNU-lmipro](https://github.com/yang232138/UniXNU-lmipro)
|
||||
- [FFT-infra/UniXNU-sm8250-common](https://github.com/FFT-infra/UniXNU-sm8250-common)
|
||||
|
||||
## State
|
||||
|
||||
The format 2 repository selects shared SM8250 support, iPadOS 17.7.11 and generic CPU, timer, platform and crypto components. Its DTS memory banks and splash reservations come from the handset's live FDT.
|
||||
|
||||
The format 1 kernel repository provides a separate format 1 recipe. Firmware, payload, boot-image and peripheral inputs remain to be completed and qualified for the target device.
|
||||
|
||||
## Use this port
|
||||
|
||||
1. Read the pinned instructions and records below. Prepare the firmware, system inputs and build tools they specify.
|
||||
2. Clone the device sources and prepare the matching core and firmware checkouts described by its README:
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/yang232138/UniXNU-lmipro-v2.git
|
||||
cd UniXNU-lmipro-v2
|
||||
git checkout 07c2d714a1b02dba7264c9c0120bb66588714908
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
|
||||
3. Run the build from the working directory specified by that revision's instructions. Check its documented outputs and remaining inputs.
|
||||
4. Follow the [bring-up order](/porting/bring-up), save [logs](/porting/log-capture) and complete the [porting record](/porting/records). See [porting steps](/porting/steps) for board structure and component selection.
|
||||
|
||||
## Sources
|
||||
|
||||
- [README: yang232138/UniXNU-lmipro-v2](https://github.com/yang232138/UniXNU-lmipro-v2/blob/07c2d714a1b02dba7264c9c0120bb66588714908/README.md)
|
||||
Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.
|
||||
@@ -0,0 +1 @@
|
||||
[3214791900-del/unixnu-nabu-build](https://github.com/3214791900-del/unixnu-nabu-build)
|
||||
@@ -0,0 +1 @@
|
||||
[lee-kenneth/unixnu-nabu](https://github.com/lee-kenneth/unixnu-nabu)
|
||||
@@ -0,0 +1 @@
|
||||
[zzc775/unixnu-nabu](https://github.com/zzc775/unixnu-nabu)
|
||||
@@ -0,0 +1 @@
|
||||
[Alex-Enix/nuwa-dev](https://github.com/Alex-Enix/nuwa-dev)
|
||||
@@ -0,0 +1 @@
|
||||
[pubglite55/UniXNU-nuwa](https://github.com/pubglite55/UniXNU-nuwa)
|
||||
+552
-26
@@ -1,40 +1,566 @@
|
||||
# OnePlus 13T (oneplus13t)
|
||||
# OnePlus 13T \(oneplus13t\)
|
||||
|
||||
A community-maintained port for SM8750. Current results are based on the maintainer records at the revisions linked below.
|
||||
[IssacL04/UniXNU-Pagani_SM8750](https://github.com/IssacL04/UniXNU-Pagani_SM8750)
|
||||
|
||||
| Repository | Maintainer |
|
||||
<div v-pre>
|
||||
|
||||
OnePlus 13T PKX110: format-2 migration of the single-core, read-only UFS root and CPU display port; volatile RAM Data.
|
||||
|
||||
Source record: [porting.toml](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/porting.toml), `fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac`.
|
||||
|
||||
This page is generated from the device record.
|
||||
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [UniXNU-Pagani_SM8750](https://github.com/IssacL04/UniXNU-Pagani_SM8750) | [IssacL04](https://github.com/IssacL04) |
|
||||
| [UniXNU-sm8750-common](https://github.com/IssacL04/UniXNU-sm8750-common) | [IssacL04](https://github.com/IssacL04) |
|
||||
| [UniXNU-Pagani-Drivers](https://github.com/IssacL04/UniXNU-Pagani-Drivers) | [IssacL04](https://github.com/IssacL04) |
|
||||
| [Configuration](#configuration) | `host-verified` |
|
||||
| [Firmware and boot](#firmware) | `host-verified` |
|
||||
| [CPU and interrupts](#cpu) | `host-verified` |
|
||||
| [Memory and DMA](#memory) | `host-verified` |
|
||||
| [Storage and root](#storage) | `host-verified` |
|
||||
| [Display](#display) | `host-verified` |
|
||||
| [Input](#input) | `host-verified` |
|
||||
| [GPU](#gpu) | `planned` |
|
||||
| [Network](#network) | `planned` |
|
||||
| [Audio](#audio) | `planned` |
|
||||
| [Power](#power) | `host-verified` |
|
||||
| [Image assembly](#packaging) | `host-verified` |
|
||||
| [Diagnostics](#diagnostics) | `host-verified` |
|
||||
|
||||
## State
|
||||
## Configuration {#configuration}
|
||||
|
||||
The verified hardware configuration reaches the iPadOS UI with UFS root reads and CPU framebuffer presentation. Data uses a volatile RAM seed.
|
||||
`host-verified`
|
||||
|
||||
The format 2 kernel, firmware, payload and image pass host builds. The current source includes S3910 touch, physical keys and DSI brightness/blanking; the kernel link, prelink and HID/backlight ABI checks pass. The migrated image and these peripheral additions await device validation. GPU, network, audio and full power management remain pending.
|
||||
Components: `PaganiArmDTPlatform`, `NativeAES`, `NativeKeyStoreEvents`.
|
||||
|
||||
## Sources
|
||||
### Hardware and dependencies
|
||||
|
||||
- [README: IssacL04/UniXNU-Pagani_SM8750](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/README.md)
|
||||
- Four layers: ARM64, pinned sm8750, ipados-17.7.11-21H461, OnePlus 13T. Arrays are complete replacements.
|
||||
|
||||
## Dual-system storage
|
||||
### Configuration
|
||||
|
||||
The layout below is recorded from the 256 GB model.
|
||||
- schema\_version=2; soc\_source=sm8750; complete component/fragment/archive arrays; configs/oneplus13t\_defconfig.
|
||||
|
||||
| Item | Captured value |
|
||||
| --- | --- |
|
||||
| Recovery kernel | `6.6.118-android15-8-o-g4d611c32bedc-enc3l-4k` |
|
||||
| Disk / logical sector | `/dev/block/sda` / 4096 bytes |
|
||||
| Remaining userdata | Partition 15, LBA 4020972 to 44928767 |
|
||||
| UniXNU partition | Partition 16, LBA 44928768 to 61705983 |
|
||||
| F2FS shrink request / expected result | 40907264 / 40907535 blocks of 4096 bytes |
|
||||
### Procedure
|
||||
|
||||
Calculate and inspect the target layout with the [dual-system partition guide](/porting/dual-system-partition). Measure the connected device before selecting partition boundaries.
|
||||
- From UniXNU: defconfig oneplus13t\_defconfig -D ../UniXNU-Pagani\_SM8750; fetch; status --json; tree; run scripts/test-format2.py with the main scripts on PYTHONPATH.
|
||||
|
||||
## Use this port
|
||||
### Development findings
|
||||
|
||||
1. Read the repository build instructions and pinned records. Prepare its firmware, system images and board inputs.
|
||||
2. Build with that repository's commands. Use [Build and boot](/building) for common configuration.
|
||||
3. Follow the [bring-up order](/porting/bring-up) and save results through [log capture](/porting/log-capture).
|
||||
4. Update the [porting record](/porting/records) with the source revisions and last confirmed stage.
|
||||
- Four profiles select 18 components. PaganiInput and PaganiPanel are embedded in the ABI-qualified display archive and depend on QcomGeniSpi plus Sm8750Platform. Build 48 passed the complete configuration checks, driver compilation, final kernel link and prelink. Its source pins are device e6435b2bda6e91431f3bc0c442d1ff9c47be1451, main 42ffa07e9b82f7ffc37499392b2751e146647a6a, drivers 143e958bea8ae8ad7f47723cd105a589084f913d and SoC 9e90b16861612c0251c453ccbf6cf10592ea87e2.
|
||||
- The documentation workflow checks out pinned driver submodules so repository-relative evidence links resolve during validation.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All source pins resolve; every selected component has a record; status shows the intended overrides and patch order.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The main fork carries community catalog entries; stock upstream alone cannot resolve this selection.
|
||||
|
||||
### Next action
|
||||
|
||||
- Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [All 18 selected components resolved at their pinned revisions; archive ordering, ADT checks, full kernel link and prelink passed. Downloaded kernel and report agree at 127778816 bytes; hardware remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568)
|
||||
Command: <code>test-format2.py; ./unixnu status --json; ./unixnu kernel -j 3</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
|
||||
- `host`: [Four layers, 15 pinned components, complete archive order and matching required ADT properties passed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
|
||||
Command: <code>test-format2.py; ./unixnu status --json</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
|
||||
- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/board.toml)
|
||||
- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/STAGE6.md)
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `PaganiDarwinBoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- PKX110 ABL uses init\_boot ramdisk during fastboot boot; embedded payload plus the BootPayload HOB remains necessary.
|
||||
- Private firmware checkout: IssacL04/UEFI-Pagani\_SM8750 at 50b7313f40684aa25481cd109d7f48b9a50663fa.
|
||||
|
||||
### Configuration
|
||||
|
||||
- firmware.config=oneplus13t; firmware.packages points to PaganiDarwinBoot; bootimg.embed\_payload=true.
|
||||
|
||||
### Procedure
|
||||
|
||||
- From UniXNU after kernel inputs pass: build package; firmware; payload; bootimg using ignored local input paths.
|
||||
|
||||
### Development findings
|
||||
|
||||
- PKX110 ABL uses init\_boot ramdisk during fastboot boot; embedded payload plus the BootPayload HOB remains necessary.
|
||||
- UniXNURamDiskDxe, DiskIoDxe and FAT support the standard FDT handoff; the rebuilt FD contains both paths.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The migrated FD and new standard initrd driver have not been booted on hardware.
|
||||
|
||||
### Next action
|
||||
|
||||
- Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [AARCH64 DEBUG package and 3145728-byte FD built locally, including UniXNURamDiskDxe and the retained embedded payload path; hardware boot remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/MIGRATION.md)
|
||||
Command: <code>./unixnu build package; ./unixnu firmware</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
|
||||
- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/board.toml)
|
||||
- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/STAGE6.md)
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `PaganiArmCpu`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Only MPIDR affinity 0 is enabled. GICD=0x16000000/0x10000, GICR=0x16080000/0x200000, stride=0x40000, CNTFRQ=19200000.
|
||||
|
||||
### Configuration
|
||||
|
||||
- cpus=1; cpu0 status=okay; XNU\_NATIVE\_ARCH\_TIMER and XNU\_NATIVE\_PAN enabled.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the board DTS, compare the generated ADT, run test-stage6.py and test-kernel-source.py, then obtain a fresh boot log for CPU0/timer.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Only MPIDR affinity 0 is enabled. GICD=0x16000000/0x10000, GICR=0x16080000/0x200000, stride=0x40000, CNTFRQ=19200000.
|
||||
- The counter conversion uses the firmware CNTFRQ; the shared ARM64 patch preserves the Stage-6 timer correction. The source-kernel suite also executes the real RAMBlock link section with an alternate archive directory.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU.
|
||||
|
||||
### Current limits
|
||||
|
||||
- SMP, other CPU affinities and CPU frequency control are unverified.
|
||||
|
||||
### Next action
|
||||
|
||||
- Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [Eight source-kernel regressions and production ARM64 assembly checks passed; the enabled CPU0 code linked successfully. IRQ/IPI behavior was not tested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
|
||||
Command: <code>test-kernel-source.py; test-stage6.py; ./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
|
||||
- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/board.toml)
|
||||
- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/STAGE6.md)
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `Sm8750Platform`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The captured live DT has contiguous RAM at 0x980000000 of size 0x180000000. DarwinBoot requests 0x100000000 and rewrites chosen dram-base/size to its actual allocation.
|
||||
|
||||
### Configuration
|
||||
|
||||
- payload.dram\_size=0x180000000; payload.adt.owned\_memory\_size=0x100000000.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run check-memory-map.py against the captured live.dtb and current UEFI map; inspect actual DarwinBoot allocation before allowing more RAM or DMA.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The captured live DT has contiguous RAM at 0x980000000 of size 0x180000000. DarwinBoot requests 0x100000000 and rewrites chosen dram-base/size to its actual allocation.
|
||||
- GIC register offsets remain unchanged; the common ADT converter rounds the arm-io window to 16 MiB. UFS uses the extracted SM8750 SMMU operations.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Only the selected contiguous arena is handed to XNU; allocation size is a request. Other devices need their own RAM/reservation evidence.
|
||||
|
||||
### Next action
|
||||
|
||||
- Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [DTS/ADT memory and GIC contracts and RAMBlock handoff address bounds passed on the host. DMA behavior was not tested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
|
||||
Command: <code>test-format2.py; test-stage6.py</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
|
||||
- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/board.toml)
|
||||
- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/STAGE6.md)
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `NativeUfs`, `NativeVirtioBlock`, `NativeRamBlock`, `PaganiVerifiedRoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The physical root is unixnu on LUN 0, 4096-byte LBAs 44928768..61705983; runtime UFS writes are disabled.
|
||||
|
||||
### Configuration
|
||||
|
||||
- userdata.partition=unixnu; XNU\_NATIVE\_UFS, OWNER\_ROOT\_AUDIT, TRUST\_CACHE\_RUNTIME, OWNER\_UNION\_SYSTEMOS, NATIVE\_RAM\_BLOCK enabled.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Prepare UFS policy archives and original trust; prepare RAM Data on macOS; run test-stage6.py and test-root-audit.py; build the kernel.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The physical root is unixnu on LUN 0, 4096-byte LBAs 44928768..61705983; runtime UFS writes are disabled.
|
||||
- Read-only OS/SystemOS windows use the original APFS/AMFI path. Data is a 1 GiB RAM seed and loses changes on reboot. Virtio is an ABI dependency, not tested 13T hardware. The RAMBlock addon query is synchronized with upstream RamBlock 25c57e0e9b68bf452dd1986914525edc9d2320bc for the shared kernel ABI; missing and invalid handoff ranges are checked on the host. No GPU addon is packaged.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Host: register, clock, link and SMMU facts match the board inventory.
|
||||
- Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within the allocated unixnu partition.
|
||||
- Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Physical writes and persistent Data are unsupported. Never deploy the historical userdata-root.img filename to Android userdata.
|
||||
|
||||
### Next action
|
||||
|
||||
- Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [Read-only partition bounds, root-window contracts, RAM Data preparation and original storage ABI qualification passed; UFS, Virtio and RAMBlock linked successfully.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
|
||||
Command: <code>test-stage6.py; test-root-audit.py; test-ram-data.py; ./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
|
||||
- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/board.toml)
|
||||
- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/STAGE6.md)
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `NativeMobileDisplay`, `PaganiPanel`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Firmware GOP: 1216x2640, 32 bpp, stride 4864. The active AA594\_P\_7\_A0020 command-mode panel uses DSI0 at 0xae94000 and low-byte-first DCS brightness; normal max 0xdbb, initial level 0x599.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Native Legacy CPU framebuffer, sheng-vsync=60 and pagani-panel=1. Board constants are in PaganiPeripherals.h.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run test-stage7.py and test-peripherals.py against the resolved tree; run build-pagani-peripherals.py --audit-only against the pinned kernelcache, then build the full display archive with XNU compiler records. After a separately authorized temporary boot, verify first brightness completion before testing slider and power transitions.
|
||||
|
||||
### Development findings
|
||||
|
||||
- PaganiPanel derives from the genuine original AppleARMBacklight class with qualified 0x370 storage and 169 virtual entries. It sends DCS 0x51/0x28/0x29 through the command FIFO and stops after a transport failure. The controller setup, DSC and panel timing stay as handed off by firmware.
|
||||
- The 60 Hz software presentation timer pauses for logical display-off and resumes with a fresh deadline. Build 48 passed MMIO/timer tests, original and compiled-object ABI checks, full kernel link and prelink. PaganiPanel symbols are present in the downloaded kernel; physical display control remains unverified.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- A known frame appears with correct geometry and colors, then userland presentation and backlight controls work.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No new hardware verification, physical refresh measurement, TE/vblank synchronization, high-refresh switching, brightness calibration, fade interpolation or full panel suspend/resume. CoreBrightness property access and coexistence with firmware scanout remain unverified.
|
||||
|
||||
### Next action
|
||||
|
||||
- Assemble a boot image from the build-48 kernel and matching inputs, then temporarily boot after authorization. Compare UI output with build 39, test brightness within the normal range, blank/unblank and inspect command errors. Measure TE cadence before adding physical refresh control.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [Display timer and DSI transport checks passed. The owned panel object passed the original/compiled ABI audit, entered the display archive and linked into the prelinked kernel; no hardware result claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568)
|
||||
Command: <code>test-stage7.py; test-peripherals.py; ./unixnu kernel -j 3</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
|
||||
- `source`: [DSI command transport, genuine backlight ancestry, timer PM integration and explicit runtime limits; not a complete-kernel or device result.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/drivers/PaganiPanel/README.md)
|
||||
- `host`: [Display lifecycle checks and original Legacy ABI qualification passed; the CPU presentation archive compiled and linked. The migrated framebuffer has not been observed on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
|
||||
Command: <code>test-stage7.py; ./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
|
||||
- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/board.toml)
|
||||
- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/STAGE6.md)
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `PaganiInput`, `QcomGeniSpi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- S3910 HBP on GENI SPI QUP1 S4 at 0xa90000, wrapper 0xac0000, mode 0, maximum 19 MHz. GPIOs 48..51 carry SPI; reset 161 and ATTN 162 are active low. TLMM GPIO windows include the SM8750 0x100000 offset.
|
||||
- SPMI v7 observer: PON SID 0 peripheral 0x13, bits 7/6 = Power/Volume Up; GPIO SID 1 peripheral 0x8d bit 0 active low = Volume Down.
|
||||
|
||||
### Configuration
|
||||
|
||||
- pagani-touch=1 and pagani-buttons=1 select two original-ABI HID devices. Board wiring and timing are defined in PaganiPeripherals.h.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run test-peripherals.py --tree <resolved-tree> and the original HID ABI audit; build the full archive. On hardware first check SPI protocol, ID/application status and LBP/configuration acknowledgements, then single contacts, coordinate orientation, simultaneous contacts, releases and physical key holds.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The stock HBP driver exposes an LBP fallback through dynamic config 0x11=2. The new transport drains queued raw frames, installs and reads back a custom report format, filters palms and emits explicit releases with stable IDs. TouchComm CRC command suffixes are detected from identification.
|
||||
- PMIC reads are bounded and keys use 32 ms debounce. Failed key reads release all keys; touch transport failure releases held contacts and disables further touch reads. ATTN is polled at 8 ms, keys at 16 ms. Build 48 passed portable tests, the original 207-slot HID and compiled-object ABI audits, C/C++ compilation, final link and prelink. Input, S3910 and GENI SPI symbols are present in the downloaded kernel; hardware input remains unverified.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Retained regulator and GENI firmware state is required. No RPMh cold rail enable, GIC IRQ path, GPI DMA, TouchComm v2, oversized-command fragmentation, firmware recovery or system-sleep wake. Hardware must confirm LBP availability, FIFO access, coordinates and event routing. System edge gestures are not implemented.
|
||||
|
||||
### Next action
|
||||
|
||||
- Assemble the build-48 boot image, then capture the first S3910 identification and application response during an authorized temporary boot. Use the reported failure stage to choose rail/microcode, FIFO or protocol work; do not treat display output as touch verification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [TouchComm, contact lifecycle, key debounce/failure, SPMI and GENI tests passed. The HID object passed ABI checks and the S3910/GENI sources compiled as C; all three objects linked into the prelinked kernel. Hardware input remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568)
|
||||
Command: <code>test-peripherals.py; test-stage7.py; ./unixnu kernel -j 3</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
|
||||
- `source`: [Physical HID adapters, bounded TouchComm/SPMI paths, contact and key lifecycle tests; no hardware result claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/drivers/PaganiInput/README.md)
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No driver is enabled for this subsystem.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Follow the subsystem guide to identify hardware, firmware and ABI inputs before enabling a component.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No implemented or hardware-verified path is available for this subsystem.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture SM8750 GPU/GMU resources and the firmware manifest; qualify a matching implementation before enabling GPU components.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- No verified Wi-Fi or cellular path is selected for PKX110.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No driver is enabled for this subsystem.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Follow the subsystem guide to identify hardware, firmware and ABI inputs before enabling a component.
|
||||
|
||||
### Development findings
|
||||
|
||||
- No verified Wi-Fi or cellular path is selected for PKX110.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No implemented or hardware-verified path is available for this subsystem.
|
||||
|
||||
### Next action
|
||||
|
||||
- Identify the WLAN transport, firmware and IRQ/DMA requirements from the stock DTB before selecting a driver.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- DSP/codec firmware interfaces, routes and playback/capture remain unimplemented.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No driver is enabled for this subsystem.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Follow the subsystem guide to identify hardware, firmware and ABI inputs before enabling a component.
|
||||
|
||||
### Development findings
|
||||
|
||||
- DSP/codec firmware interfaces, routes and playback/capture remain unimplemented.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each declared route carries the selected audio format through playback or capture and handles start/stop correctly.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No implemented or hardware-verified path is available for this subsystem.
|
||||
|
||||
### Next action
|
||||
|
||||
- Map the DSP, codec, clock and firmware dependencies from the stock platform before implementing an audio route.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `ShengPlatformPower`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The component preserves the original Apple PMGR ABI and restricted boot-time operations.
|
||||
|
||||
### Configuration
|
||||
|
||||
- XNU\_SHENG\_PMGR=y; sheng-pmgr=2; sleep-disabled=1.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build the compatibility PMGR archive against the exact kernelcache; observe boot transitions before changing any firmware-owned vote.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The existing PMGR compatibility behavior is unchanged. PaganiInput adds QUP1 S4 clock votes and GPIO reset while retaining firmware regulator state. PaganiPanel requests display blanking without turning off rails or replacing full suspend/resume.
|
||||
- Battery, charging, suspend and frequency scaling remain unverified.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Battery, charging, sleep and full regulator/clock control are unsupported.
|
||||
|
||||
### Next action
|
||||
|
||||
- Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [The PMGR builder qualified the pinned original imports/provider dispatch and linked its archive. Physical power transitions, battery and frequency control remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
|
||||
Command: <code>./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
|
||||
- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/board.toml)
|
||||
- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/STAGE6.md)
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `NativePrelink`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Kernel ABI and IPSW stay at 21H461. NativePrelink stays pinned in the community bundle; the OS series selects its matching patches.
|
||||
|
||||
### Configuration
|
||||
|
||||
- kernel.prelink roots preserve the previously qualified subset; payload.adt.root\_match\_volume\_uuid=04769D26-2CA0-4825-B443-E2E5F88300F2.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ipsw fetch, kernel, build package, firmware, payload, bootimg in order; inspect payload.json and the ADT in FAT.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Kernel ABI and IPSW stay at 21H461. NativePrelink stays pinned in the community bundle; the OS series selects its matching patches.
|
||||
- Four byte-qualified userspace fixups now come from the shared OS profile and common validated-page implementation. Board root UUID and PackedRAMDisk/TrustCache placeholders are preserved.
|
||||
- Android boot v4 packages gzip\(BootShim+3 MiB FD+160 MiB FAT\) followed by all stock DTBs; Android ramdisk remains empty.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Host construction does not establish runtime equivalence to build 39.
|
||||
|
||||
### Next action
|
||||
|
||||
- Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [Kernel/prelink, 160 MiB FAT payload and 87928832-byte Android v4 boot image succeeded. Extracted ADT and payload kernel hashes match the reports; no GPU addon is supplied.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/MIGRATION.md)
|
||||
Command: <code>./unixnu kernel -j 3; ./unixnu build package; ./unixnu firmware; ./unixnu payload; ./unixnu bootimg</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
|
||||
- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/board.toml)
|
||||
- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/STAGE6.md)
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`host-verified`
|
||||
|
||||
Components: `BootProgress`, `Stage7Probe`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Early framebuffer, root checkpoints and panic rendering remain enabled. Source-only diagnostics are separate from the prelinked userspace kernel.
|
||||
|
||||
### Configuration
|
||||
|
||||
- XNU\_BOOT\_PROGRESS=y; XNU\_EARLY\_BOOT\_PROGRESS=y; optional native-root-audit triggers the binding report.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run the panic/ADT/boot container checks; preserve old run artifacts; capture the last completed checkpoint in a future explicitly authorized temporary boot.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Early framebuffer, root checkpoints and panic rendering remain enabled. Source-only diagnostics are separate from the prelinked userspace kernel.
|
||||
- Build 39 reached the iPadOS UI; see STAGE6.md. The complete driver archive plan passes on macOS. The early boot-logo builder now reads the IPSW from the format-2 output root and compiles successfully. A host regression checks that the final link selects the RAMBlock object beside the configured archive; the final kernel/prelink and local firmware, payload and boot-image assembly have now passed; the image remains untested on hardware.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No device command is issued by the migration. Older observations are identified separately.
|
||||
|
||||
### Next action
|
||||
|
||||
- Temporarily boot the exact migrated image only after separate authorization; record its image/source revisions and compare the affected runtime checkpoints with build 39.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `host`: [Source-kernel regressions, early console compilation and panic-entry contract passed in CI; runtime checkpoints still require a hardware boot.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
|
||||
Command: <code>test-kernel-source.py; drivers/BootProgress/Test/panic-entry.py</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
|
||||
- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/board.toml)
|
||||
- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac/STAGE6.md)
|
||||
|
||||
</div>
|
||||
@@ -0,0 +1,7 @@
|
||||
# Poco F6 / Redmi Turbo 3 \(wzy114514sb\)
|
||||
|
||||
[wzy114514sb/UniXNU-peridot](https://github.com/wzy114514sb/UniXNU-peridot)
|
||||
|
||||
Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.
|
||||
|
||||
wzy114514sb/UniXNU-peridot: device.name must match board.toml
|
||||
@@ -0,0 +1 @@
|
||||
[minhtritt1996/UniXNU-picasso](https://github.com/minhtritt1996/UniXNU-picasso)
|
||||
@@ -0,0 +1 @@
|
||||
[FFT-infra/UniXNU-alioth-ARCHIVE](https://github.com/FFT-infra/UniXNU-alioth-ARCHIVE)
|
||||
@@ -0,0 +1 @@
|
||||
[xVanTuring/UniXNU-pipa](https://github.com/xVanTuring/UniXNU-pipa)
|
||||
@@ -0,0 +1 @@
|
||||
[Y3d4/UniXNU-pong-clean](https://github.com/Y3d4/UniXNU-pong-clean)
|
||||
@@ -0,0 +1 @@
|
||||
[ArnoDorian123/UniXNU-ruyi-min](https://github.com/ArnoDorian123/UniXNU-ruyi-min)
|
||||
@@ -0,0 +1 @@
|
||||
[ehunshuaige/UniXNU-ruyi](https://github.com/ehunshuaige/UniXNU-ruyi)
|
||||
@@ -0,0 +1 @@
|
||||
[16Crow/UniXNU-sheng](https://github.com/16Crow/UniXNU-sheng)
|
||||
@@ -0,0 +1 @@
|
||||
[alghiffaryfa19/UniXNU-sheng](https://github.com/alghiffaryfa19/UniXNU-sheng)
|
||||
@@ -0,0 +1,567 @@
|
||||
# Xiaomi Pad 6S Pro \(FFT-infra\)
|
||||
|
||||
[FFT-infra/UniXNU-alioth-sheng-template](https://github.com/FFT-infra/UniXNU-alioth-sheng-template)
|
||||
|
||||
<div v-pre>
|
||||
|
||||
Xiaomi Pad 6S Pro 12.4 uses shared SM8550 support and board-owned storage, input, firmware and power integration. This record describes implementation coverage and the evidence required for each milestone.
|
||||
|
||||
Source record: [porting.toml](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/porting.toml), `516a780473a2ac59c8b438e132bb60204dda9e22`.
|
||||
|
||||
This page is generated from the device record.
|
||||
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [Configuration](#configuration) | `implemented` |
|
||||
| [Firmware and boot](#firmware) | `implemented` |
|
||||
| [CPU and interrupts](#cpu) | `implemented` |
|
||||
| [Memory and DMA](#memory) | `implemented` |
|
||||
| [Storage and root](#storage) | `implemented` |
|
||||
| [Display](#display) | `implemented` |
|
||||
| [Input](#input) | `implemented` |
|
||||
| [GPU](#gpu) | `implemented` |
|
||||
| [Network](#network) | `implemented` |
|
||||
| [Audio](#audio) | `implemented` |
|
||||
| [Power](#power) | `implemented` |
|
||||
| [Image assembly](#packaging) | `implemented` |
|
||||
| [Diagnostics](#diagnostics) | `implemented` |
|
||||
|
||||
## Configuration {#configuration}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 profile, iPadOS 17.7.11 build 21H461, device defconfig, pinned component sources.
|
||||
|
||||
### Configuration
|
||||
|
||||
- board.soc\_source = sm8550; board.os\_profile = ipados-17.7.11-21H461; schema\_version = 2.
|
||||
- The device owns ShengUfs, ShengHidInput, ShengNovatekTouch and ShengPreflight submodules.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read https://unixnu.com/porting/device-repository and https://unixnu.com/porting/records.
|
||||
- Run ./unixnu defconfig sheng\_defconfig -D ../UniXNU-sheng from UniXNU.
|
||||
- Run ./unixnu status --json -D ../UniXNU-sheng and review profiles, components, source pins and patch order.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Tables merge in ARM64, SoC, OS, device order. Arrays replace inherited selections, so include every required component and fragment.
|
||||
- The selected defconfig applies after the explicit configuration fragments. Keep OS ABI and IPSW pins in the OS profile.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All source pins resolve; every selected component has a record; status shows the intended overrides and patch order.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Local overrides can select a different source from the published pin; record the effective source in each verification result.
|
||||
|
||||
### Next action
|
||||
|
||||
- Compare the effective status output whenever a profile, source or component selection changes.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/board.toml)
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengPreflight`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- uefi-sheng firmware, stock firmware DTB, GOP handoff, PSCI SMC interface and vendor firmware inventory.
|
||||
|
||||
### Configuration
|
||||
|
||||
- firmware.dsc = Platforms/Xiaomi/shengPkg/sheng.dsc; firmware.config = sheng.
|
||||
- proprietary-files.txt records input paths and provenance.
|
||||
- The firmware DSC and FDF embed UniXNU, UniXNUDxe, DarwinBoot, UniXNURamDiskDxe, DiskIoDxe and FAT support.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ./unixnu build firmware -D ../UniXNU-sheng --uefi ../uefi-sheng.
|
||||
- Record the firmware commit, output FD and handoff memory map before a boot attempt.
|
||||
- Build the payload, then run ./unixnu bootimg with the firmware DTB. Inspect boot.json ramdisk\_bytes and the required firmware modules.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The firmware DTB is an input to boot-image assembly. XNU consumes the separately generated ADT.
|
||||
- The sheng preflight component belongs with board integration and its firmware requirements.
|
||||
- The shared UniXNURamDiskDxe reads the Mu-Silicium entry-argument HOB and FDT initrd range to publish the payload block device. ShengBootMemoryDxe owns memory expansion.
|
||||
- Configured menu entries require a payload FAT filesystem containing EFI/UniXNU/unixnu.toml. Check the UNIXNURAMDISK initrd block-device status when entries are absent.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Boot-image assembly requires the selected firmware DTB and proprietary input files.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture firmware revision and memory reservations with the next image verification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/proprietary-files.txt)
|
||||
- `source`: [Shared FDT initrd block-device publication; board memory policy remains in uefi-sheng.](https://github.com/UniXNU/UniXNU/blob/8d157ee18ae9c4d518aba28cb3040a84e860dcd1/package/UniXNUPkg/Driver/UniXNURamDiskDxe/UniXNURamDiskDxe.c)
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ArmCpu`, `ArmDTPlatform`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 CPU affinities, GIC distributor at 0x17100000, redistributors at 0x17180000, 0x40000 stride and 19.2 MHz timer.
|
||||
- PSCI uses SMC. The board disables cpu1 and cpu2 in its DTS.
|
||||
|
||||
### Configuration
|
||||
|
||||
- dts/sheng.dts includes sm8550.dtsi; shared CPU and interrupt definitions come from the SoC source.
|
||||
- Kernel arguments select sheng-smp=1 and armcpu-spi-ipi=1.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the board DTS and inspect enabled CPUs, GIC ranges and timer properties in the ADT.
|
||||
- Record per-CPU entry, timer interrupts and inter-processor interrupt delivery.
|
||||
|
||||
### Development findings
|
||||
|
||||
- CPU affinity values are hardware identifiers. Enabled CPU count and MPIDR affinities must be checked together.
|
||||
- GIC register ranges must use translated physical addresses from the hardware tree.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU.
|
||||
|
||||
### Current limits
|
||||
|
||||
- CPU selection and frequency policy are board inputs; SoC topology describes all cores.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach per-CPU and interrupt observations for the selected firmware and image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/dts/sheng.dts)
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Handoff DRAM at 0x80000000 with size 0x80000000; splash reservation at 0xb8000000 with size 0x2b00000.
|
||||
- Payload owned-memory request is 0x130000000. Device DMA requires controller stream IDs, address widths and ownership.
|
||||
|
||||
### Configuration
|
||||
|
||||
- device\_tree.source = device:dts/sheng.dts; include\_dirs = \[soc:dts\].
|
||||
- payload.adt.owned\_memory\_size and firmware reservations describe separate allocations.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compare firmware RAM ranges, reserved regions, DTS ranges and ADT memory-map entries.
|
||||
- Check DMA buffers against controller address width, cache policy and SMMU mapping before submitting work.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Physical register translation and CPU virtual mappings have different purposes. Preserve physical resource ranges in hardware descriptions.
|
||||
- GPU and UFS use different SMMU instances and stream assignments.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The DTS declares the current handoff window and splash region; memory sizing requires the selected firmware map.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the firmware memory map and each DMA consumer when changing reserved memory.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/dts/sheng.dts)
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengUfs`, `VirtioMmioBlock`, `RamBlock`, `VerifiedRoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UFS host 0x01d84000/0x3000; PHY 0x01d80000/0x2000; GCC base 0x00100000.
|
||||
- GCC AXI, AHB, UniPro, symbol and PHY auxiliary branches; power domains and firmware link state.
|
||||
- Apps SMMU at 0x15000000, UFS stream 0x60, context-bank ownership, DMA width and cache maintenance.
|
||||
- LUN 0 uses 4096-byte blocks; userdata spans LBAs 3094592 through 64007162.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select ShengUfs and CONFIG\_XNU\_NATIVE\_UFS=y; native-ufs-root=1 enables the root path.
|
||||
- userdata defines OS and SystemOS windows. payload.adt.root\_match\_volume\_uuid = 04769D26-2CA0-4825-B443-E2E5F88300F2.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read https://unixnu.com/porting/ufs with this storage record.
|
||||
- Inspect clock enables, power state, HCE/HCS, link state, request-list base and SMMU mappings before changing controller ownership.
|
||||
- Validate SCSI capacity and GPT reads, then publish root windows and mount the configured root UUID.
|
||||
- Verify persistent Data writes on the documented Data allocation with a recovery image available.
|
||||
|
||||
### Development findings
|
||||
|
||||
- An idle AHB branch may report CLK\_OFF with hardware gating enabled. Check enable and gating bits together.
|
||||
- SMMU bypass still has address-width constraints. Validate every DMA range and context-bank assignment.
|
||||
- ShengUfs contains controller access, GPT/window parsing and sheng Data/log policy. Reuse each layer according to its inputs.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Host: register, clock, link and SMMU facts match the board inventory.
|
||||
- Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within userdata.
|
||||
- Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The SoC DTSI exports host and PHY ranges. GCC and UFS SMMU handling currently use constants and operations in ShengUfs.
|
||||
- The root transport uses a polled request slot. Its firmware adoption path requires a usable existing request list.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record clock/PHY/reset initialization ownership and the SMMU stream before adapting this driver to another board.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/ShengUfs/blob/e2b32cc429e8cf1501161c1d8c517f8994ceb9b2/NativeUfs.cpp)
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `GopFramebuffer`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UEFI GOP framebuffer, stride, pixel format, splash reservation and board panel/backlight controls.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select GopFramebuffer; CONFIG\_XNU\_NATIVE\_LEGACY\_DISPLAY=y; artwork-display-gamut = sRGB.
|
||||
- sheng-vsync=120 requests board display timing.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Verify GOP address, dimensions, stride and pixel layout before enabling presentation.
|
||||
- Build the late display archive with the selected OS ABI records, then check display publication and frame presentation.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The display source and ABI binding are selected independently from the physical panel configuration.
|
||||
- The board configuration declares sRGB for the current 8-bit framebuffer path.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- A known frame appears with correct geometry and colors, then userland presentation and backlight controls work.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The late display builder needs qualified prelink candidates and ABI records. A timing request requires a measured presentation result.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record frame timing, pixel format and presentation evidence for each image used to qualify display.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/package/LegacyDisplayProbe.cpp)
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengHidInput`, `ShengNovatekTouch`, `QcomGeniSpi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Novatek NT36532 sensor, GENI SPI controller, pin configuration, reset/interrupt lines, firmware and touch coordinate geometry.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select ShengHidInput, ShengNovatekTouch and QcomGeniSpi; sheng-touch=4 and sheng-touch-hid=1 select board integration.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read TouchBoard.h and verify the SPI clock and mode against the controller setup.
|
||||
- Validate protocol reports, contact tracking and coordinate orientation before publishing HID events.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Controller transfer logic, sensor protocol and board sensor geometry are separate inputs.
|
||||
- Track contact IDs across movement and lift events; a register read alone covers only transport access.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Sensor firmware and board dimensions remain sheng inputs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach contact and orientation observations when firmware or geometry changes.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/package/TouchBoard.h)
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `Adreno740`, `AdrenoMetal`, `AirNir`, `Sm8550Platform`, `AdrenoPM4`, `AdrenoFirmware`, `ArmSmmu4K`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- A740 GPU/GMU registers, GPU SMMU streams 0/1 and GMU stream 5, signed ZAP firmware and board power votes.
|
||||
- Turnip, metal2vulkan, AIR translation and the selected OS GPU/Metal ABI.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select Adreno740, AdrenoMetal and AirNir; shared SM8550 operations arrive through component dependencies.
|
||||
- Board scripts combine shared GMU code with package/ShengGmuVotes.c.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Qualify power, firmware, SMMU and GMU startup before command submission.
|
||||
- Check memory mapping, command completion and a known rendered image before staging the Metal plugin.
|
||||
|
||||
### Development findings
|
||||
|
||||
- GPU generation and the frontend ABI define component scope. Firmware, votes and display integration remain board inputs.
|
||||
- Shared platform code and board votes require separate include paths during archive assembly.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it.
|
||||
|
||||
### Current limits
|
||||
|
||||
- A740 coverage depends on the selected firmware and OS ABI; board qualification requires its own memory and power evidence.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the exact firmware, compiler inputs, driver revision and rendered output for the next qualification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/scripts/build-adreno740-kits.py)
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `Ath12kWifi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Ath12k device on PCIe, BAR windows, MSI routing, DMA callbacks, firmware, MHI and QRTR services.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select Ath12kWifi. build-gop-legacy-display.py compiles its objects through build-ath12k-wifi.py.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Verify PCIe enumeration and MSI delivery before MHI startup.
|
||||
- Record firmware startup, scan, association, address configuration and bidirectional packet delivery separately.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The reusable Wi-Fi stack consumes board callbacks; PCIe and the OS network interface are owned by the device integration.
|
||||
- MHI startup and network traffic are separate completion points.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The source implements the station path through WifiNet.cpp and board PCIe integration. Device evidence must identify the firmware and access point.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach association and receive/transmit observations for the current firmware and image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/package/WifiNet.cpp)
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- ADSP firmware, SMEM, SMP2P, GLINK, GPR services, board codec and audio routing.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The board display archive includes ADSP and audio probe objects.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Check firmware loading and ADSP service readiness before configuring audio endpoints.
|
||||
- Record route, format and playback/capture observations for each enabled endpoint.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Firmware startup, service registration and audible playback require separate evidence.
|
||||
- The GPR client and firmware loading helpers can be inspected independently from codec routing.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each declared route carries the selected audio format through playback or capture and handles start/stop correctly.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Current source contains ADSP bring-up and audio framework probes. Endpoint playback qualification needs route-specific evidence.
|
||||
|
||||
### Next action
|
||||
|
||||
- Document the codec, clocks and endpoint routing before claiming playback completion.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/package/AudioProbe.cpp)
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `AppleKeyStoreState`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Board PMGR integration, clocks/regulators, ADSP battery manager and per-peripheral power requirements.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_SHENG\_PMGR=y; sheng-pmgr=2 selects the board integration.
|
||||
- AppleKeyStoreState is selected with the OS event integration.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Document each clock, regulator and firmware-owned state before enabling power transitions.
|
||||
- Check battery units and update behavior separately from suspend/resume and peripheral power.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Battery reporting uses the ADSP battery-manager path. It depends on firmware/service readiness.
|
||||
- Power policy belongs to the board even when controller operations are shared.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Per-peripheral controls and battery publication have separate coverage from system suspend.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record each supported transition and its dependent peripherals in this section.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/package/ShengBattery.cpp)
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `DarwinBoot`, `XnuPrelink`, `SoftwareAES`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Prelinked kernel, hardware DTB, generated ADT, trust cache, Data seed, platform identity and firmware DTB.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Payload volume is 208 MiB. kernel.patch\_series selects ARM64, SoC, OS and device series in order.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build kernel and package, then payload with --unique-chip-id and the selected trust-cache/Data inputs.
|
||||
- Run ./unixnu bootimg -D ../UniXNU-sheng --uefi ../uefi-sheng --dtb <firmware.dtb> and inspect the assembly report.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The OS boot-progress integration follows the SoC hooks in patch order.
|
||||
- The payload carries kernel.macho.adt; the boot image carries the firmware FDT. Keep the two inputs named explicitly.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Image output depends on the selected ABI audits, firmware and volume policy inputs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach artifact paths and exact source revisions to the next image build record.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/patches/xnu/series)
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Serial or framebuffer diagnostics, panic region, boot checkpoints and a recovery path.
|
||||
|
||||
### Configuration
|
||||
|
||||
- boot-progress=2 enables checkpoints; source and image revisions accompany every log.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run the existing check for the changed area and keep its command, output and input revision.
|
||||
- Record the last completed checkpoint and the first failing operation; link the captured output.
|
||||
|
||||
### Development findings
|
||||
|
||||
- A source implementation, a host check and a device observation establish different completion levels.
|
||||
- Keep an unresolved cause explicit and record the next measurement that can distinguish it.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Source references in this record describe implemented behavior. Host and device status require their respective evidence entries.
|
||||
|
||||
### Next action
|
||||
|
||||
- Add captured host or device evidence when repeating a checkpoint on a known image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/FFT-infra/UniXNU-alioth-sheng-template/blob/516a780473a2ac59c8b438e132bb60204dda9e22/scripts/read-sheng-log.py)
|
||||
|
||||
</div>
|
||||
@@ -0,0 +1,590 @@
|
||||
# Xiaomi Pad 6S Pro \(hxzbaka\)
|
||||
|
||||
[hxzbaka/UniXNU-sheng](https://github.com/hxzbaka/UniXNU-sheng)
|
||||
|
||||
<div v-pre>
|
||||
|
||||
Xiaomi Pad 6S Pro 12.4 uses shared SM8550 support and board-owned storage, input, firmware and power integration. This record describes implementation coverage and the evidence required for each milestone.
|
||||
|
||||
Source record: [porting.toml](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/porting.toml), `0e1f6e52638137db15905db8d775ad73757f39fa`.
|
||||
|
||||
This page is generated from the device record.
|
||||
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [Configuration](#configuration) | `implemented` |
|
||||
| [Firmware and boot](#firmware) | `implemented` |
|
||||
| [CPU and interrupts](#cpu) | `implemented` |
|
||||
| [Memory and DMA](#memory) | `implemented` |
|
||||
| [Storage and root](#storage) | `implemented` |
|
||||
| [Display](#display) | `implemented` |
|
||||
| [Input](#input) | `implemented` |
|
||||
| [GPU](#gpu) | `implemented` |
|
||||
| [Network](#network) | `implemented` |
|
||||
| [Audio](#audio) | `implemented` |
|
||||
| [Power](#power) | `implemented` |
|
||||
| [Image assembly](#packaging) | `implemented` |
|
||||
| [Diagnostics](#diagnostics) | `implemented` |
|
||||
|
||||
## Configuration {#configuration}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 profile, iPadOS 17.7.11 build 21H461, device defconfig, pinned component sources.
|
||||
|
||||
### Configuration
|
||||
|
||||
- board.soc\_source = sm8550; board.os\_profile = ipados-17.7.11-21H461; schema\_version = 2.
|
||||
- The device owns ShengUfs, ShengHidInput, ShengNovatekTouch and ShengPreflight submodules.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read https://unixnu.com/porting/device-repository and https://unixnu.com/porting/records.
|
||||
- Run ./unixnu defconfig sheng\_defconfig -D ../UniXNU-sheng from UniXNU.
|
||||
- Run ./unixnu status --json -D ../UniXNU-sheng and review profiles, components, source pins and patch order.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Tables merge in ARM64, SoC, OS, device order. Arrays replace inherited selections, so include every required component and fragment.
|
||||
- The selected defconfig applies after the explicit configuration fragments. Keep OS ABI and IPSW pins in the OS profile.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All source pins resolve; every selected component has a record; status shows the intended overrides and patch order.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Local overrides can select a different source from the published pin; record the effective source in each verification result.
|
||||
|
||||
### Next action
|
||||
|
||||
- Compare the effective status output whenever a profile, source or component selection changes.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/board.toml)
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengPreflight`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- uefi-sheng firmware, stock firmware DTB, GOP handoff, PSCI SMC interface and vendor firmware inventory.
|
||||
|
||||
### Configuration
|
||||
|
||||
- firmware.dsc = Platforms/Xiaomi/shengPkg/sheng.dsc; firmware.config = sheng.
|
||||
- proprietary-files.txt records input paths and provenance.
|
||||
- The firmware DSC and FDF embed UniXNU, UniXNUDxe, DarwinBoot, UniXNURamDiskDxe, DiskIoDxe and FAT support.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ./unixnu build firmware -D ../UniXNU-sheng --uefi ../uefi-sheng.
|
||||
- Record the firmware commit, output FD and handoff memory map before a boot attempt.
|
||||
- Build the payload, then run ./unixnu bootimg with the firmware DTB. Inspect boot.json ramdisk\_bytes and the required firmware modules.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The firmware DTB is an input to boot-image assembly. XNU consumes the separately generated ADT.
|
||||
- The sheng preflight component belongs with board integration and its firmware requirements.
|
||||
- The shared UniXNURamDiskDxe reads the Mu-Silicium entry-argument HOB and FDT initrd range to publish the payload block device. ShengBootMemoryDxe owns memory expansion.
|
||||
- Configured menu entries require a payload FAT filesystem containing EFI/UniXNU/unixnu.toml. Check the UNIXNURAMDISK initrd block-device status when entries are absent.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Boot-image assembly requires the selected firmware DTB and proprietary input files.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture firmware revision and memory reservations with the next image verification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/proprietary-files.txt)
|
||||
- `source`: [Shared FDT initrd block-device publication; board memory policy remains in uefi-sheng.](https://github.com/UniXNU/UniXNU/blob/8d157ee18ae9c4d518aba28cb3040a84e860dcd1/package/UniXNUPkg/Driver/UniXNURamDiskDxe/UniXNURamDiskDxe.c)
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ArmCpu`, `ArmDTPlatform`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 CPU affinities, GIC distributor at 0x17100000, redistributors at 0x17180000, 0x40000 stride and 19.2 MHz timer.
|
||||
- PSCI uses SMC. The board disables cpu1 and cpu2 in its DTS.
|
||||
|
||||
### Configuration
|
||||
|
||||
- dts/sheng.dts includes sm8550.dtsi; shared CPU and interrupt definitions come from the SoC source.
|
||||
- Kernel arguments select sheng-smp=1 and armcpu-spi-ipi=1.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the board DTS and inspect enabled CPUs, GIC ranges and timer properties in the ADT.
|
||||
- Record per-CPU entry, timer interrupts and inter-processor interrupt delivery.
|
||||
|
||||
### Development findings
|
||||
|
||||
- CPU affinity values are hardware identifiers. Enabled CPU count and MPIDR affinities must be checked together.
|
||||
- GIC register ranges must use translated physical addresses from the hardware tree.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU.
|
||||
|
||||
### Current limits
|
||||
|
||||
- CPU selection and frequency policy are board inputs; SoC topology describes all cores.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach per-CPU and interrupt observations for the selected firmware and image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/dts/sheng.dts)
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Handoff DRAM at 0x80000000 with size 0x80000000; splash reservation at 0xb8000000 with size 0x2b00000.
|
||||
- Payload owned-memory request is 0x130000000. Device DMA requires controller stream IDs, address widths and ownership.
|
||||
|
||||
### Configuration
|
||||
|
||||
- device\_tree.source = device:dts/sheng.dts; include\_dirs = \[soc:dts\].
|
||||
- payload.adt.owned\_memory\_size and firmware reservations describe separate allocations.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compare firmware RAM ranges, reserved regions, DTS ranges and ADT memory-map entries.
|
||||
- Check DMA buffers against controller address width, cache policy and SMMU mapping before submitting work.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Physical register translation and CPU virtual mappings have different purposes. Preserve physical resource ranges in hardware descriptions.
|
||||
- GPU and UFS use different SMMU instances and stream assignments.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The DTS declares the current handoff window and splash region; memory sizing requires the selected firmware map.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the firmware memory map and each DMA consumer when changing reserved memory.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/dts/sheng.dts)
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengUfs`, `VirtioMmioBlock`, `RamBlock`, `VerifiedRoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UFS host 0x01d84000/0x3000; PHY 0x01d80000/0x2000; GCC base 0x00100000.
|
||||
- GCC AXI, AHB, UniPro, symbol and PHY auxiliary branches; power domains and firmware link state.
|
||||
- Apps SMMU at 0x15000000, UFS stream 0x60, context-bank ownership, DMA width and cache maintenance.
|
||||
- LUN 0 uses 4096-byte blocks; userdata spans LBAs 3094592 through 64007162.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select ShengUfs and CONFIG\_XNU\_NATIVE\_UFS=y; native-ufs-root=1 enables the root path.
|
||||
- userdata defines OS and SystemOS windows. payload.adt.root\_match\_volume\_uuid = 04769D26-2CA0-4825-B443-E2E5F88300F2.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read https://unixnu.com/porting/ufs with this storage record.
|
||||
- Inspect clock enables, power state, HCE/HCS, link state, request-list base and SMMU mappings before changing controller ownership.
|
||||
- Validate SCSI capacity and GPT reads, then publish root windows and mount the configured root UUID.
|
||||
- Verify persistent Data writes on the documented Data allocation with a recovery image available.
|
||||
|
||||
### Development findings
|
||||
|
||||
- An idle AHB branch may report CLK\_OFF with hardware gating enabled. Check enable and gating bits together.
|
||||
- SMMU bypass still has address-width constraints. Validate every DMA range and context-bank assignment.
|
||||
- ShengUfs contains controller access, GPT/window parsing and sheng Data/log policy. Reuse each layer according to its inputs.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Host: register, clock, link and SMMU facts match the board inventory.
|
||||
- Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within userdata.
|
||||
- Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The SoC DTSI exports host and PHY ranges. GCC and UFS SMMU handling currently use constants and operations in ShengUfs.
|
||||
- The root transport uses a polled request slot. Its firmware adoption path requires a usable existing request list.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record clock/PHY/reset initialization ownership and the SMMU stream before adapting this driver to another board.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/ShengUfs/blob/e2b32cc429e8cf1501161c1d8c517f8994ceb9b2/NativeUfs.cpp)
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `GopFramebuffer`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UEFI GOP framebuffer, stride, pixel format, splash reservation and board panel/backlight controls.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select GopFramebuffer; CONFIG\_XNU\_NATIVE\_LEGACY\_DISPLAY=y; artwork-display-gamut = sRGB.
|
||||
- sheng-vsync=120 requests board display timing.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Verify GOP address, dimensions, stride and pixel layout before enabling presentation.
|
||||
- Build the late display archive with the selected OS ABI records, then check display publication and frame presentation.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The display source and ABI binding are selected independently from the physical panel configuration.
|
||||
- The board configuration declares sRGB for the current 8-bit framebuffer path.
|
||||
- scripts/build-gop-legacy-display.py also builds the board driver objects in the display archive, including the ADSP, IPC router, FAT reader and battery manager.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- A known frame appears with correct geometry and colors, then userland presentation and backlight controls work.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The late display builder needs qualified prelink candidates and ABI records. A timing request requires a measured presentation result.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record frame timing, pixel format and presentation evidence for each image used to qualify display.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/package/LegacyDisplayProbe.cpp)
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengHidInput`, `ShengNovatekTouch`, `QcomGeniSpi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Novatek NT36532 sensor, GENI SPI controller, pin configuration, reset/interrupt lines, firmware and touch coordinate geometry.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select ShengHidInput, ShengNovatekTouch and QcomGeniSpi; sheng-touch=4 and sheng-touch-hid=1 select board integration.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read TouchBoard.h and verify the SPI clock and mode against the controller setup.
|
||||
- Validate protocol reports, contact tracking and coordinate orientation before publishing HID events.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Controller transfer logic, sensor protocol and board sensor geometry are separate inputs.
|
||||
- Track contact IDs across movement and lift events; a register read alone covers only transport access.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Sensor firmware and board dimensions remain sheng inputs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach contact and orientation observations when firmware or geometry changes.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/package/TouchBoard.h)
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `Adreno740`, `AdrenoMetal`, `AirNir`, `Sm8550Platform`, `AdrenoPM4`, `AdrenoFirmware`, `ArmSmmu4K`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- A740 GPU/GMU registers, GPU SMMU streams 0/1 and GMU stream 5, signed ZAP firmware and board power votes.
|
||||
- Turnip, metal2vulkan, AIR translation and the selected OS GPU/Metal ABI.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select Adreno740, AdrenoMetal and AirNir; shared SM8550 operations arrive through component dependencies.
|
||||
- Board scripts combine shared GMU code with package/ShengGmuVotes.c.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Qualify power, firmware, SMMU and GMU startup before command submission.
|
||||
- Check memory mapping, command completion and a known rendered image before staging the Metal plugin.
|
||||
|
||||
### Development findings
|
||||
|
||||
- GPU generation and the frontend ABI define component scope. Firmware, votes and display integration remain board inputs.
|
||||
- Shared platform code and board votes require separate include paths during archive assembly.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it.
|
||||
|
||||
### Current limits
|
||||
|
||||
- A740 coverage depends on the selected firmware and OS ABI; board qualification requires its own memory and power evidence.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the exact firmware, compiler inputs, driver revision and rendered output for the next qualification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/scripts/build-adreno740-kits.py)
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `Ath12kWifi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Ath12k device on PCIe, BAR windows, MSI routing, DMA callbacks, firmware, MHI and QRTR services.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select Ath12kWifi. build-gop-legacy-display.py compiles its objects through build-ath12k-wifi.py.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Verify PCIe enumeration and MSI delivery before MHI startup.
|
||||
- Record firmware startup, scan, association, address configuration and bidirectional packet delivery separately.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The reusable Wi-Fi stack consumes board callbacks; PCIe and the OS network interface are owned by the device integration.
|
||||
- MHI startup and network traffic are separate completion points.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The source implements the station path through WifiNet.cpp and board PCIe integration. Device evidence must identify the firmware and access point.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach association and receive/transmit observations for the current firmware and image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/package/WifiNet.cpp)
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- ADSP firmware, SMEM, SMP2P, GLINK, GPR services, board codec and audio routing.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The board display archive includes ADSP and audio probe objects.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Check firmware loading and ADSP service readiness before configuring audio endpoints.
|
||||
- Record route, format and playback/capture observations for each enabled endpoint.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The ADSP image loads in place from the split adsp and adsp\_dtb files in /image of the modem\_a FAT volume \(modem\_b as fallback\); sheng-adsp-fw=DIR reads adsp.mbn and adsp\_dtb.mbn from DIR instead.
|
||||
- The DSP reaches GLINK and opens the battery manager and IPCRTR channels. The IPC router answers the DSP's service locator requests.
|
||||
- Firmware startup, service registration and audible playback require separate evidence.
|
||||
- The GPR client and firmware loading helpers can be inspected independently from codec routing.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each declared route carries the selected audio format through playback or capture and handles start/stop correctly.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Current source contains ADSP bring-up and audio framework probes. Endpoint playback qualification needs route-specific evidence.
|
||||
|
||||
### Next action
|
||||
|
||||
- Document the codec, clocks and endpoint routing before claiming playback completion.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/package/AudioProbe.cpp)
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `AppleKeyStoreState`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Board PMGR integration, clocks/regulators and per-peripheral power requirements.
|
||||
- ADSP battery manager: PMIC GLINK owner 32778 on PMIC\_RTR\_ADSP\_APPS; board properties use opcode 0x50; fuel gauges 0x8a/0x8b and 0xa6/0xa7.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_SHENG\_PMGR=y; sheng-pmgr=2 selects the board integration.
|
||||
- AppleKeyStoreState is selected with the OS event integration.
|
||||
- sheng-adsp=2 sheng-battery=1 publish the battery as an IOPMPowerSource.
|
||||
- sheng-usb-sdp-ma sets the input limit on a standard computer port \(default 900; 0 keeps the firmware limit\).
|
||||
|
||||
### Procedure
|
||||
|
||||
- Document each clock, regulator and firmware-owned state before enabling power transitions.
|
||||
- Check battery units and update behavior separately from suspend/resume and peripheral power.
|
||||
- Read the \[battery\], \[battery-raw\] and \[charger\] log lines with scripts/read-sheng-log.py.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The ADSP firmware runs charging and PD/PPS negotiation without host requests.
|
||||
- Battery properties after 11 are shifted by one: charge current 12, temperature 13, charge counter 15, cycles 16, design 17, full 18, time to full 20, time to empty 21.
|
||||
- Charge is the sum of both fuel gauges' remaining over full capacity. Battery current is reported discharge-positive.
|
||||
- USB property 6 reads SDP on every port. Property 7 carries the adapter type \(6 PD, 8 PD PPS\).
|
||||
- A PPS adapter gets a 3 A input limit at about 8.7 V; the battery charges at the 2000 mA charge current with the charge pump off.
|
||||
- Both cells and the PD adapter read unauthenticated.
|
||||
- A Mac USB-C port negotiates PD 5 V with a 1.2 A input limit, below the load during boot.
|
||||
- Power policy belongs to the board even when controller operations are shared.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Adapter details shown to iOS come from USB property 6, so every adapter reads as a computer port.
|
||||
- Charge current stays at 2 A without fuel gauge and adapter authentication.
|
||||
- A low-battery shutdown panics in vnode\_rele\_ext during unmount.
|
||||
- Per-peripheral controls and battery publication have separate coverage from system suspend.
|
||||
|
||||
### Next action
|
||||
|
||||
- Take adapter details from property 7.
|
||||
- Authenticate both fuel gauges, then qualify PPS charge pump charging; Xiaomi adapter authentication follows.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/package/ShengBattery.cpp)
|
||||
- `host`: [PASS battery manager: 4074 checks](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/scripts/check-battery-host.py)
|
||||
Command: <code>python3 scripts/check-battery-host.py</code>. Revision: `8719a19294bc79eed72366a19070acfd8e131737`.
|
||||
- `device`: [PPS adapter: 8.72 V at 1.3 A in, battery +1.99 A, 1 to 3 percent in 3 minutes. Mac: PD 5 V, 1.2 A limit, battery -0.9 to -1.2 A. Temperature 31.4 to 32.9 C; full 9353 mAh, design 9800 mAh, 172 cycles.](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot.img; python3 scripts/read-sheng-log.py --wait 240</code>. Revision: `8719a19294bc79eed72366a19070acfd8e131737`.
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `DarwinBoot`, `XnuPrelink`, `SoftwareAES`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Prelinked kernel, hardware DTB, generated ADT, trust cache, Data seed, platform identity and firmware DTB.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Payload volume is 208 MiB. kernel.patch\_series selects ARM64, SoC, OS and device series in order.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build kernel and package, then payload with --unique-chip-id and the selected trust-cache/Data inputs.
|
||||
- Run ./unixnu bootimg -D ../UniXNU-sheng --uefi ../uefi-sheng --dtb <firmware.dtb> and inspect the assembly report.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The OS boot-progress integration follows the SoC hooks in patch order.
|
||||
- The payload carries kernel.macho.adt; the boot image carries the firmware FDT. Keep the two inputs named explicitly.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Image output depends on the selected ABI audits, firmware and volume policy inputs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach artifact paths and exact source revisions to the next image build record.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/patches/xnu/series)
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Serial or framebuffer diagnostics, panic region, boot checkpoints and a recovery path.
|
||||
|
||||
### Configuration
|
||||
|
||||
- boot-progress=2 enables checkpoints; source and image revisions accompany every log.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run the existing check for the changed area and keep its command, output and input revision.
|
||||
- Record the last completed checkpoint and the first failing operation; link the captured output.
|
||||
|
||||
### Development findings
|
||||
|
||||
- A source implementation, a host check and a device observation establish different completion levels.
|
||||
- Keep an unresolved cause explicit and record the next measurement that can distinguish it.
|
||||
- The UFS log carries \[adsp\], \[qrtr\], \[battery\], \[battery-raw\] and \[charger\] lines for the DSP, the IPC router and the charger.
|
||||
- Host checks for the ADSP path: check-adsp-host.py, check-modem-fw-host.py, check-qrtr-host.py and check-battery-host.py.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Source references in this record describe implemented behavior. Host and device status require their respective evidence entries.
|
||||
|
||||
### Next action
|
||||
|
||||
- Add captured host or device evidence when repeating a checkpoint on a known image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/hxzbaka/UniXNU-sheng/blob/0e1f6e52638137db15905db8d775ad73757f39fa/scripts/read-sheng-log.py)
|
||||
|
||||
</div>
|
||||
@@ -0,0 +1 @@
|
||||
[jn7163/UniXNU-sheng](https://github.com/jn7163/UniXNU-sheng)
|
||||
@@ -0,0 +1 @@
|
||||
[LiangKam/UniXNU-sheng](https://github.com/LiangKam/UniXNU-sheng)
|
||||
@@ -0,0 +1 @@
|
||||
[lilinnan/UniXNU-sheng](https://github.com/lilinnan/UniXNU-sheng)
|
||||
@@ -0,0 +1,630 @@
|
||||
# Xiaomi Pad 6S Pro \(TheArchitectEngineer\)
|
||||
|
||||
[TheArchitectEngineer/UniXNU-sheng](https://github.com/TheArchitectEngineer/UniXNU-sheng)
|
||||
|
||||
<div v-pre>
|
||||
|
||||
Xiaomi Pad 6S Pro 12.4 uses shared SM8550 support and board-owned storage, input, firmware and power integration. This record describes implementation coverage and the evidence required for each milestone.
|
||||
|
||||
Source record: [porting.toml](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/porting.toml), `d76556b8909e380961309e970d87b919a74e411e`.
|
||||
|
||||
This page is generated from the device record.
|
||||
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [Configuration](#configuration) | `implemented` |
|
||||
| [Firmware and boot](#firmware) | `implemented` |
|
||||
| [CPU and interrupts](#cpu) | `implemented` |
|
||||
| [Memory and DMA](#memory) | `implemented` |
|
||||
| [Storage and root](#storage) | `implemented` |
|
||||
| [Display](#display) | `implemented` |
|
||||
| [Input](#input) | `implemented` |
|
||||
| [GPU](#gpu) | `implemented` |
|
||||
| [Network](#network) | `implemented` |
|
||||
| [Audio](#audio) | `implemented` |
|
||||
| [Power](#power) | `implemented` |
|
||||
| [Image assembly](#packaging) | `implemented` |
|
||||
| [Diagnostics](#diagnostics) | `implemented` |
|
||||
|
||||
## Configuration {#configuration}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 profile, iPadOS 17.7.11 build 21H461, device defconfig, pinned component sources.
|
||||
|
||||
### Configuration
|
||||
|
||||
- board.soc\_source = sm8550; board.os\_profile = ipados-17.7.11-21H461; schema\_version = 2.
|
||||
- The device owns ShengUfs, ShengHidInput, ShengNovatekTouch and ShengPreflight submodules.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read https://unixnu.com/porting/device-repository and https://unixnu.com/porting/records.
|
||||
- Run ./unixnu defconfig sheng\_defconfig -D ../UniXNU-sheng from UniXNU.
|
||||
- Run ./unixnu status --json -D ../UniXNU-sheng and review profiles, components, source pins and patch order.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Tables merge in ARM64, SoC, OS, device order. Arrays replace inherited selections, so include every required component and fragment.
|
||||
- The selected defconfig applies after the explicit configuration fragments. Keep OS ABI and IPSW pins in the OS profile.
|
||||
- board.toml names the model J120AP, the Apple board of the iPadOS identity, and its kernel arguments enable Wi-Fi \(sheng-wifi=5\) and the CPU and GPU governors.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All source pins resolve; every selected component has a record; status shows the intended overrides and patch order.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Local overrides can select a different source from the published pin; record the effective source in each verification result.
|
||||
|
||||
### Next action
|
||||
|
||||
- Compare the effective status output whenever a profile, source or component selection changes.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/board.toml)
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengPreflight`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- uefi-sheng firmware, stock firmware DTB, GOP handoff, PSCI SMC interface and vendor firmware inventory.
|
||||
|
||||
### Configuration
|
||||
|
||||
- firmware.dsc = Platforms/Xiaomi/shengPkg/sheng.dsc; firmware.config = sheng.
|
||||
- proprietary-files.txt records input paths and provenance.
|
||||
- The firmware DSC and FDF embed UniXNU, UniXNUDxe, DarwinBoot, UniXNURamDiskDxe, DiskIoDxe and FAT support.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ./unixnu build firmware -D ../UniXNU-sheng --uefi ../uefi-sheng.
|
||||
- Record the firmware commit, output FD and handoff memory map before a boot attempt.
|
||||
- Build the payload, then run ./unixnu bootimg with the firmware DTB. Inspect boot.json ramdisk\_bytes and the required firmware modules.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The firmware DTB is an input to boot-image assembly. XNU consumes the separately generated ADT.
|
||||
- The sheng preflight component belongs with board integration and its firmware requirements.
|
||||
- The shared UniXNURamDiskDxe reads the Mu-Silicium entry-argument HOB and FDT initrd range to publish the payload block device. ShengBootMemoryDxe owns memory expansion.
|
||||
- Configured menu entries require a payload FAT filesystem containing EFI/UniXNU/unixnu.toml. Check the UNIXNURAMDISK initrd block-device status when entries are absent.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Boot-image assembly requires the selected firmware DTB and proprietary input files.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture firmware revision and memory reservations with the next image verification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/proprietary-files.txt)
|
||||
- `source`: [Shared FDT initrd block-device publication; board memory policy remains in uefi-sheng.](https://github.com/UniXNU/UniXNU/blob/8d157ee18ae9c4d518aba28cb3040a84e860dcd1/package/UniXNUPkg/Driver/UniXNURamDiskDxe/UniXNURamDiskDxe.c)
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ArmCpu`, `ArmDTPlatform`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 CPU affinities, GIC distributor at 0x17100000, redistributors at 0x17180000, 0x40000 stride and 19.2 MHz timer.
|
||||
- PSCI uses SMC. The board disables cpu1 and cpu2 in its DTS.
|
||||
|
||||
### Configuration
|
||||
|
||||
- dts/sheng.dts includes sm8550.dtsi; shared CPU and interrupt definitions come from the SoC source.
|
||||
- Kernel arguments select sheng-smp=1 and armcpu-spi-ipi=1.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the board DTS and inspect enabled CPUs, GIC ranges and timer properties in the ADT.
|
||||
- Record per-CPU entry, timer interrupts and inter-processor interrupt delivery.
|
||||
|
||||
### Development findings
|
||||
|
||||
- CPU affinity values are hardware identifiers. Enabled CPU count and MPIDR affinities must be checked together.
|
||||
- GIC register ranges must use translated physical addresses from the hardware tree.
|
||||
- XNU accepts work interval operations 6, 7 and 8 \(interval start, update and finish\) through patches/xnu/native-work-interval-instance.patch in UniXNU; without a performance controller they only succeed.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU.
|
||||
|
||||
### Current limits
|
||||
|
||||
- CPU selection and frequency policy are board inputs; SoC topology describes all cores.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach per-CPU and interrupt observations for the selected firmware and image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/dts/sheng.dts)
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Handoff DRAM at 0x80000000 with size 0x80000000; splash reservation at 0xb8000000 with size 0x2b00000.
|
||||
- Payload owned-memory request is 0x130000000. Device DMA requires controller stream IDs, address widths and ownership.
|
||||
|
||||
### Configuration
|
||||
|
||||
- device\_tree.source = device:dts/sheng.dts; include\_dirs = \[soc:dts\].
|
||||
- payload.adt.owned\_memory\_size and firmware reservations describe separate allocations.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compare firmware RAM ranges, reserved regions, DTS ranges and ADT memory-map entries.
|
||||
- Check DMA buffers against controller address width, cache policy and SMMU mapping before submitting work.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Physical register translation and CPU virtual mappings have different purposes. Preserve physical resource ranges in hardware descriptions.
|
||||
- GPU and UFS use different SMMU instances and stream assignments.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The DTS declares the current handoff window and splash region; memory sizing requires the selected firmware map.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the firmware memory map and each DMA consumer when changing reserved memory.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/dts/sheng.dts)
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengUfs`, `VirtioMmioBlock`, `RamBlock`, `VerifiedRoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UFS host 0x01d84000/0x3000; PHY 0x01d80000/0x2000; GCC base 0x00100000.
|
||||
- GCC AXI, AHB, UniPro, symbol and PHY auxiliary branches; power domains and firmware link state.
|
||||
- Apps SMMU at 0x15000000, UFS stream 0x60, context-bank ownership, DMA width and cache maintenance.
|
||||
- LUN 0 uses 4096-byte blocks; userdata spans LBAs 3094592 through 64007162.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select ShengUfs and CONFIG\_XNU\_NATIVE\_UFS=y; native-ufs-root=1 enables the root path.
|
||||
- userdata defines OS and SystemOS windows. payload.adt.root\_match\_volume\_uuid = 04769D26-2CA0-4825-B443-E2E5F88300F2.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read https://unixnu.com/porting/ufs with this storage record.
|
||||
- Inspect clock enables, power state, HCE/HCS, link state, request-list base and SMMU mappings before changing controller ownership.
|
||||
- Validate SCSI capacity and GPT reads, then publish root windows and mount the configured root UUID.
|
||||
- Verify persistent Data writes on the documented Data allocation with a recovery image available.
|
||||
|
||||
### Development findings
|
||||
|
||||
- An idle AHB branch may report CLK\_OFF with hardware gating enabled. Check enable and gating bits together.
|
||||
- SMMU bypass still has address-width constraints. Validate every DMA range and context-bank assignment.
|
||||
- ShengUfs contains controller access, GPT/window parsing and sheng Data/log policy. Reuse each layer according to its inputs.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Host: register, clock, link and SMMU facts match the board inventory.
|
||||
- Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within userdata.
|
||||
- Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The SoC DTSI exports host and PHY ranges. GCC and UFS SMMU handling currently use constants and operations in ShengUfs.
|
||||
- The root transport uses a polled request slot. Its firmware adoption path requires a usable existing request list.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record clock/PHY/reset initialization ownership and the SMMU stream before adapting this driver to another board.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/ShengUfs/blob/e2b32cc429e8cf1501161c1d8c517f8994ceb9b2/NativeUfs.cpp)
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `GopFramebuffer`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UEFI GOP framebuffer, stride, pixel format, splash reservation and board panel/backlight controls.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select GopFramebuffer; CONFIG\_XNU\_NATIVE\_LEGACY\_DISPLAY=y; artwork-display-gamut = sRGB.
|
||||
- sheng-vsync=120 requests board display timing.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Verify GOP address, dimensions, stride and pixel layout before enabling presentation.
|
||||
- Build the late display archive with the selected OS ABI records, then check display publication and frame presentation.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The display source and ABI binding are selected independently from the physical panel configuration.
|
||||
- The board configuration declares sRGB for the current 8-bit framebuffer path.
|
||||
- scripts/build-gop-legacy-display.py also builds the board driver objects in the display archive, including the ADSP, IPC router, FAT reader and battery manager.
|
||||
- The GENI I2C core also moves 1 to 8 byte writes and 1 to 4 byte reads \(the audio amplifiers use 32-bit registers\); the backlight keeps its 8-bit transfers.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- A known frame appears with correct geometry and colors, then userland presentation and backlight controls work.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The late display builder needs qualified prelink candidates and ABI records. A timing request requires a measured presentation result.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record frame timing, pixel format and presentation evidence for each image used to qualify display.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/package/LegacyDisplayProbe.cpp)
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengHidInput`, `ShengNovatekTouch`, `QcomGeniSpi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Novatek NT36532 sensor, GENI SPI controller, pin configuration, reset/interrupt lines, firmware and touch coordinate geometry.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select ShengHidInput, ShengNovatekTouch and QcomGeniSpi; sheng-touch=4 and sheng-touch-hid=1 select board integration.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read TouchBoard.h and verify the SPI clock and mode against the controller setup.
|
||||
- Validate protocol reports, contact tracking and coordinate orientation before publishing HID events.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Controller transfer logic, sensor protocol and board sensor geometry are separate inputs.
|
||||
- Track contact IDs across movement and lift events; a register read alone covers only transport access.
|
||||
- sheng\_buttons\_press\(\) holds a button mask for a given time through the HID sink, for unattended tests \(the audio lock sound test uses it\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Sensor firmware and board dimensions remain sheng inputs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach contact and orientation observations when firmware or geometry changes.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/package/TouchBoard.h)
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `Adreno740`, `AdrenoMetal`, `AirNir`, `Sm8550Platform`, `AdrenoPM4`, `AdrenoFirmware`, `ArmSmmu4K`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- A740 GPU/GMU registers, GPU SMMU streams 0/1 and GMU stream 5, signed ZAP firmware and board power votes.
|
||||
- Turnip, metal2vulkan, AIR translation and the selected OS GPU/Metal ABI.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select Adreno740, AdrenoMetal and AirNir; shared SM8550 operations arrive through component dependencies.
|
||||
- Board scripts combine shared GMU code with package/ShengGmuVotes.c.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Qualify power, firmware, SMMU and GMU startup before command submission.
|
||||
- Check memory mapping, command completion and a known rendered image before staging the Metal plugin.
|
||||
|
||||
### Development findings
|
||||
|
||||
- GPU generation and the frontend ABI define component scope. Firmware, votes and display integration remain board inputs.
|
||||
- Shared platform code and board votes require separate include paths during archive assembly.
|
||||
- A frame is one submission of up to 128 IBs \(24 at most observed\). WPTR writes check the GMU AHB fence status; none were dropped. Jobs take about 5 ms against the client's 1 ms waits, so the stall handler's write-pointer and TLB recovery runs on ordinary jobs: mapping-time TLB invalidation did not change it.
|
||||
- The render server primes all 162 Metal libraries of the OS image while the desktop is idle \(the PR log row\). The payload carries the library list and a copy of the cryptex QuartzCore library. The idle desktop submits 6 command buffers per 250 ms at 120 Hz, so priming waits only above 8.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it.
|
||||
|
||||
### Current limits
|
||||
|
||||
- A740 coverage depends on the selected firmware and OS ABI; board qualification requires its own memory and power evidence.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the exact firmware, compiler inputs, driver revision and rendered output for the next qualification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/scripts/build-adreno740-kits.py)
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `Ath12kWifi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Ath12k device on PCIe, BAR windows, MSI routing, DMA callbacks, firmware, MHI and QRTR services.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select Ath12kWifi. build-gop-legacy-display.py compiles its objects through build-ath12k-wifi.py.
|
||||
- board.toml sets sheng-wifi=5 in the kernel arguments; WifiProbe and the UFS driver read it.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Verify PCIe enumeration and MSI delivery before MHI startup.
|
||||
- Record firmware startup, scan, association, address configuration and bidirectional packet delivery separately.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The reusable Wi-Fi stack consumes board callbacks; PCIe and the OS network interface are owned by the device integration.
|
||||
- MHI startup and network traffic are separate completion points.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The source implements the station path through WifiNet.cpp and board PCIe integration. Device evidence must identify the firmware and access point.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach association and receive/transmit observations for the current firmware and image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/package/WifiNet.cpp)
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- ADSP firmware from modem\_a, SMEM, SMP2P, GLINK, the GPR channel adsp\_apps.
|
||||
- Speakers: six CS35L43 amplifiers on QUP1 SE5 and QUP2 SE0 \(I2C 0x40 to 0x42\), shared reset gpio90, secondary MI2S \(gpio121 to 124\).
|
||||
- Microphones: WCD938x codec on the TX SoundWire master \(0x6d30000\), reset gpio108, supply ldob15; TX and VA macros.
|
||||
|
||||
### Configuration
|
||||
|
||||
- sheng-audio takes bits \(sheng-adsp=2 is required\): any nonzero value serves the audio service, 2 plays a 1.5 s 750 Hz test tone at boot, 4 brings up the microphone path and reads two seconds of capture, 8 runs the lock sound test.
|
||||
- sheng-audio-pa moves the DSP period buffer \(default 0xd0000000\); sheng-audio-tone-ms and sheng-audio-atten set the tone.
|
||||
- The payload addon carries hal/ShengAudio.driver under audio/; patches/xnu/zzyd-sheng-audio-addon-mount.patch mounts it over /System/Library/Audio/Plug-Ins/HAL. Its CDHash joins the owner trust cache.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read the \[audio\], \[amps\], \[audio-glink\], \[audio-buffer\], \[mic\], \[mic regs\] and \[mic capture\] log lines with scripts/read-sheng-log.py.
|
||||
- Read \[audio-props\], \[audio-service\], \[audio-io\], \[audio-thread\], \[audio-clock\], \[audio-requests\] and \[audio-sync\] for the iOS path: the plug-in's volume and peak, late and silent periods, write-ahead and read-behind, IO cycle intervals, clock skew, the audio server's IO thread scheduling and host clock, and the plug-in's last start and stop requests.
|
||||
- Run scripts/check-audioreach-host.py, scripts/check-cs35l43-host.py and scripts/check-geni-i2c-host.py after changing the codecs.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The ADSP image loads in place from the split adsp and adsp\_dtb files in /image of the modem\_a FAT volume.
|
||||
- The DSP offers 24 intents of 128 bytes on adsp\_apps and grants a 4 KiB one on request; the GLINK remote intent table keeps it.
|
||||
- The amplifiers play ASP RX1 directly \(DSP bypassed, no amplifier firmware\): top three slot 0, bottom three slot 1, gain 18 dB, 16-bit I2S at 48 kHz from the SoC as clock master.
|
||||
- The DSP takes buffers as a 32-bit address with the stream index \(0x1001 & 0xf\) in the upper word. The period buffer is low DRAM outside the kernel's window, mapped write-combined; the audio streams stay in SMMU pass-through.
|
||||
- Programming a translating SMMU context for the audio streams resets the board; the hypervisor keeps those context banks.
|
||||
- PRM commands go from the PRM port \(2\) and use PRM clock ids: the TX core clock is 0x30c. The macro and digital codec votes make the LPASS registers accessible.
|
||||
- The VA macro gates the TX SoundWire master's clock on SM8550; with its gate and the TX macro's on, the link comes up and the codec enumerates as device 1.
|
||||
- The primary microphone is AMIC3 on micbias 3 into ADC2, codec data port 1 channel 2, master port 2, TX decimator 0 from SWR\_MIC1 and codec DMA TX3, mono 48 kHz.
|
||||
- iOS sees the plug-in device only with the Thunderbolt transport type: VirtualAudio makes it a driver device with one output and one input port. Built-in devices need Apple port descriptions, and a USB device needs a location the audio server does not take from a plug-in.
|
||||
- The plug-in and the service share one timeline anchored at boot on the 19.2 MHz host timer \(400 ticks per frame, computed in 128-bit\). Playback and capture rings hold 65536 frames; the service takes 480-frame periods and keeps four in flight.
|
||||
- The DSP answers a playback buffer once it has copied it, so the steady lead is measured per run \(about 1600 to 2000 frames\) and the published lead is at least 300 ms.
|
||||
- Capture answers carry a byte count and an offset; only those bytes are taken, and a short period is normal.
|
||||
- CoreAudio takes the host clock to be 24 MHz \(one constant behind AudioGetHostClockFrequency\). The plug-in finds that constant and the service sets it to 19.2 MHz on its shared page; without it the audio server's IO cycles ran 25 percent long and playback and recording stuttered.
|
||||
- The zero time stamps start at the frame IO starts on, every 65536 frames, with the raw clock algorithm. A period under the safety offset stops the audio server's IO.
|
||||
- The audio server's IO thread runs with a time constraint \(priority 97, period 409600 ticks, computation 204800\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each declared route carries the selected audio format through playback or capture and handles start/stop correctly.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Playback sounds harsh in places; no speaker equalization or protection runs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Qualify iOS playback and capture across apps and routes, then add speaker equalization and protection.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/package/AudioProbe.cpp)
|
||||
- `host`: [PASS audioreach: 182 checks; PASS cs35l43: 225 checks; PASS GENI I2C: 2169 checks](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/scripts/check-audioreach-host.py)
|
||||
Command: <code>python3 scripts/check-audioreach-host.py; python3 scripts/check-cs35l43-host.py; python3 scripts/check-geni-i2c-host.py</code>. Revision: `9e9971883be72b2fd76b8fb552367a9e4940aa63`.
|
||||
- `device`: [Speaker test tone: DSP mapped the buffer, 155 periods sent and 151 returned, all six amplifiers PLL-locked with no error interrupts. WCD938x enumerated \(manufacturer 0x0217, part 0x010d\). Capture: 200 of 200 periods returned, 191328 bytes, 97 percent non-zero samples, peak 128 in a quiet room.](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot.img (sheng-adsp=2 sheng-audio=6); python3 scripts/read-sheng-log.py --wait 240</code>. Revision: `9e2e6de1e63d9493e841d51c6b41108e75c7d537`.
|
||||
- `device`: [Playback and recording smooth from the start. Host clock set to 19200000 Hz, IO thread period 409600 ticks. 4822 of 4843 IO cycles 15 to 25 ms apart. Write-ahead 16501 to 19638 frames, skew -474 to 1 frames, 0 late periods.](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot.img (sheng-adsp=2 sheng-audio=14); play music and record in Voice Memos; python3 scripts/read-sheng-log.py --wait 240</code>. Revision: `dea464ef093349dd746582691b0eaa3807fe1441`.
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `AppleKeyStoreState`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Board PMGR integration, clocks/regulators and per-peripheral power requirements.
|
||||
- ADSP battery manager: PMIC GLINK owner 32778 on PMIC\_RTR\_ADSP\_APPS; board properties use opcode 0x50; fuel gauges 0x8a/0x8b and 0xa6/0xa7.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_SHENG\_PMGR=y; sheng-pmgr=2 selects the board integration.
|
||||
- AppleKeyStoreState is selected with the OS event integration.
|
||||
- sheng-adsp=2 publishes the battery as an IOPMPowerSource; sheng-battery=0 leaves it off.
|
||||
- sheng-usb-sdp-ma sets the input limit on a standard computer port \(default 900; 0 keeps the firmware limit\).
|
||||
- sheng-cpufreq=4 scales the CPU domains with load \(sheng-cpufreq-min sets a floor in MHz\); sheng-cpufreq=3 fixes the highest non-turbo level.
|
||||
- sheng-gpu-dcvs=1 scales the GPU clock with its busy time \(sheng-gpu-dcvs-min sets the floor level, default 3\); sheng-gpu-perf fixes a level instead.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Document each clock, regulator and firmware-owned state before enabling power transitions.
|
||||
- Check battery units and update behavior separately from suspend/resume and peripheral power.
|
||||
- Read the \[battery\], \[battery-raw\] and \[charger\] log lines with scripts/read-sheng-log.py.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The ADSP firmware runs charging and PD/PPS negotiation without host requests.
|
||||
- Battery properties after 11 are shifted by one: charge current 12, temperature 13, charge counter 15, cycles 16, design 17, full 18, time to full 20, time to empty 21.
|
||||
- Charge is the sum of both fuel gauges' remaining over full capacity. Battery current is reported discharge-positive.
|
||||
- USB property 6 reads SDP on every port. Property 7 carries the adapter type \(6 PD, 8 PD PPS\).
|
||||
- A PPS adapter gets a 3 A input limit at about 8.7 V; the battery charges at the 2000 mA charge current with the charge pump off.
|
||||
- Both cells and the PD adapter read unauthenticated.
|
||||
- A Mac USB-C port negotiates PD 5 V with a 1.2 A input limit: about 1.1 A in, and the battery gains 0.25 to 0.4 A on the desktop.
|
||||
- Power policy belongs to the board even when controller operations are shared.
|
||||
- The GPU power probe hands the ring its register window without a GMU fence callback: only the GPU service checks fenced WPTR writes.
|
||||
- The CPU governor reads each CPU idle time through patches/xnu/zzye-sheng-cpu-idle.patch. Domain 0 holds the parked boot core and stays at its top level.
|
||||
- The GPU governor reads the GMU XO busy counter and votes over HFI with the level bandwidth.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Adapter details shown to iOS come from USB property 6, so every adapter reads as a computer port.
|
||||
- Charge current stays at 2 A without fuel gauge and adapter authentication.
|
||||
- A low-battery shutdown panics in vnode\_rele\_ext during unmount.
|
||||
- Per-peripheral controls and battery publication have separate coverage from system suspend.
|
||||
- The GPU governor changes level several times a second and spends most busy time at 680 MHz; its effect on frame times is not measured.
|
||||
|
||||
### Next action
|
||||
|
||||
- Take adapter details from property 7.
|
||||
- Authenticate both fuel gauges, then qualify PPS charge pump charging; Xiaomi adapter authentication follows.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/package/ShengBattery.cpp)
|
||||
- `host`: [PASS battery manager: 4074 checks](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/scripts/check-battery-host.py)
|
||||
Command: <code>python3 scripts/check-battery-host.py</code>. Revision: `8719a19294bc79eed72366a19070acfd8e131737`.
|
||||
- `device`: [PPS adapter: 8.72 V at 1.3 A in, battery +1.99 A, 1 to 3 percent in 3 minutes. Mac: PD 5 V at 1.1 A in \(1.2 A limit\), battery +0.25 to +0.4 A on the desktop, 20 to 21 percent. Temperature 31.4 to 32.9 C; full 9353 mAh, design 9800 mAh, 172 cycles.](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot.img; python3 scripts/read-sheng-log.py --wait 240</code>. Revision: `8f5d921d7a3b71a20a97f551cad546dc8e2f3700`.
|
||||
- `device`: [CPU: domain 1 between 499 and 2803 MHz, domain 2 between 595 and 2956 MHz, about 1.2 GHz and 620 MHz mean when idle. GPU: every vote accepted, 61 percent of the time at 680 MHz at 7 percent mean busy.](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot.img (sheng-cpufreq=4 sheng-gpu-dcvs=1); python3 scripts/read-sheng-log.py --wait 240</code>. Revision: `a338c71a6f83809c84686b4996478f1c4cd3f3ab`.
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `DarwinBoot`, `XnuPrelink`, `SoftwareAES`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Prelinked kernel, hardware DTB, generated ADT, trust cache, Data seed, platform identity and firmware DTB.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Payload volume is 208 MiB. kernel.patch\_series selects ARM64, SoC, OS and device series in order.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build kernel and package, then payload with --unique-chip-id and the selected trust-cache/Data inputs.
|
||||
- Run ./unixnu bootimg -D ../UniXNU-sheng --uefi ../uefi-sheng --dtb <firmware.dtb> and inspect the assembly report.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The OS boot-progress integration follows the SoC hooks in patch order.
|
||||
- The payload carries kernel.macho.adt; the boot image carries the firmware FDT. Keep the two inputs named explicitly.
|
||||
- The device patch series adds zzyd-sheng-audio-addon-mount.patch: the payload addon's audio directory is union-mounted over /System/Library/Audio/Plug-Ins/HAL \(mount4 in the A log line\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Image output depends on the selected ABI audits, firmware and volume policy inputs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach artifact paths and exact source revisions to the next image build record.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/patches/xnu/series)
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Serial or framebuffer diagnostics, panic region, boot checkpoints and a recovery path.
|
||||
|
||||
### Configuration
|
||||
|
||||
- boot-progress=2 enables checkpoints; source and image revisions accompany every log.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run the existing check for the changed area and keep its command, output and input revision.
|
||||
- Record the last completed checkpoint and the first failing operation; link the captured output.
|
||||
|
||||
### Development findings
|
||||
|
||||
- A source implementation, a host check and a device observation establish different completion levels.
|
||||
- Keep an unresolved cause explicit and record the next measurement that can distinguish it.
|
||||
- The UFS log carries \[adsp\], \[qrtr\], \[battery\], \[battery-raw\] and \[charger\] lines for the DSP, the IPC router and the charger.
|
||||
- BatteryProbe starts the battery with sheng-adsp=2, so the \[battery\] and \[charger\] lines appear on every DSP image; a missing \[battery\] line on such an image means sheng-battery=0 or a failed start.
|
||||
- Host checks for the ADSP path: check-adsp-host.py, check-modem-fw-host.py, check-qrtr-host.py and check-battery-host.py.
|
||||
- The log carries \[audio\], \[amps\], \[audio-glink\], \[audio-buffer\], \[mic\] and \[mic regs\] for the audio path, and \[gpu wptr\] for fenced GPU write pointer writes.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Source references in this record describe implemented behavior. Host and device status require their respective evidence entries.
|
||||
|
||||
### Next action
|
||||
|
||||
- Add captured host or device evidence when repeating a checkpoint on a known image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/TheArchitectEngineer/UniXNU-sheng/blob/d76556b8909e380961309e970d87b919a74e411e/scripts/read-sheng-log.py)
|
||||
|
||||
</div>
|
||||
@@ -0,0 +1 @@
|
||||
[yuyaukong/UniXNU-sheng](https://github.com/yuyaukong/UniXNU-sheng)
|
||||
+638
-12
@@ -1,16 +1,642 @@
|
||||
# Xiaomi Pad 6S Pro (sheng)
|
||||
# Xiaomi Pad 6S Pro \(sheng\)
|
||||
|
||||
[Device repository](https://github.com/UniXNU/UniXNU-sheng),
|
||||
[SM8550 support](/porting/soc-support#sm8550),
|
||||
[firmware](https://github.com/UniXNU/uefi-sheng).
|
||||
[UniXNU/UniXNU-sheng](https://github.com/UniXNU/UniXNU-sheng)
|
||||
|
||||
The device repository owns board drivers, hardware configuration and the
|
||||
porting record. Use the [record guide](/porting/records),
|
||||
[repository specification](/porting/device-repository) and
|
||||
[UFS guide](/porting/ufs) with the relevant section below.
|
||||
<div v-pre>
|
||||
|
||||
Follow [log capture and boot tests](/porting/log-capture) in bring-up order.
|
||||
The [sheng example](/devices/sheng-unattended-test) gives the reader inputs,
|
||||
storage region and reset commands for this board.
|
||||
Xiaomi Pad 6S Pro 12.4 uses shared SM8550 support and board-owned storage, input, firmware and power integration. This record describes implementation coverage and the evidence required for each milestone.
|
||||
|
||||
<!--@include: ../.vitepress/records/sheng.md-->
|
||||
Source record: [porting.toml](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/porting.toml), `88b11aeb4b0ffc414e5992e77194e210be475a27`.
|
||||
|
||||
This page is generated from the device record.
|
||||
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [Configuration](#configuration) | `implemented` |
|
||||
| [Firmware and boot](#firmware) | `implemented` |
|
||||
| [CPU and interrupts](#cpu) | `implemented` |
|
||||
| [Memory and DMA](#memory) | `implemented` |
|
||||
| [Storage and root](#storage) | `implemented` |
|
||||
| [Display](#display) | `implemented` |
|
||||
| [Input](#input) | `implemented` |
|
||||
| [GPU](#gpu) | `implemented` |
|
||||
| [Network](#network) | `implemented` |
|
||||
| [Audio](#audio) | `implemented` |
|
||||
| [Power](#power) | `implemented` |
|
||||
| [Image assembly](#packaging) | `implemented` |
|
||||
| [Diagnostics](#diagnostics) | `implemented` |
|
||||
|
||||
## Configuration {#configuration}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 profile, iPadOS 17.7.11 build 21H461, device defconfig, pinned component sources.
|
||||
|
||||
### Configuration
|
||||
|
||||
- board.soc\_source = sm8550; board.os\_profile = ipados-17.7.11-21H461; schema\_version = 2.
|
||||
- The device owns ShengUfs, ShengHidInput, ShengNovatekTouch and ShengPreflight submodules.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read https://unixnu.com/porting/device-repository and https://unixnu.com/porting/records.
|
||||
- Run ./unixnu defconfig sheng\_defconfig -D ../UniXNU-sheng from UniXNU.
|
||||
- Run ./unixnu status --json -D ../UniXNU-sheng and review profiles, components, source pins and patch order.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Tables merge in ARM64, SoC, OS, device order. Arrays replace inherited selections, so include every required component and fragment.
|
||||
- The selected defconfig applies after the explicit configuration fragments. Keep OS ABI and IPSW pins in the OS profile.
|
||||
- board.toml names the model J120AP, the Apple board of the iPadOS identity, and its kernel arguments enable Wi-Fi \(sheng-wifi=5\) and the CPU and GPU governors.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All source pins resolve; every selected component has a record; status shows the intended overrides and patch order.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Local overrides can select a different source from the published pin; record the effective source in each verification result.
|
||||
|
||||
### Next action
|
||||
|
||||
- Compare the effective status output whenever a profile, source or component selection changes.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/board.toml)
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengPreflight`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- uefi-sheng firmware, stock firmware DTB, GOP handoff, PSCI SMC interface and vendor firmware inventory.
|
||||
|
||||
### Configuration
|
||||
|
||||
- firmware.dsc = Platforms/Xiaomi/shengPkg/sheng.dsc; firmware.config = sheng.
|
||||
- proprietary-files.txt records input paths and provenance.
|
||||
- The firmware DSC and FDF embed UniXNU, UniXNUDxe, DarwinBoot, UniXNURamDiskDxe, DiskIoDxe and FAT support.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run ./unixnu build firmware -D ../UniXNU-sheng --uefi ../uefi-sheng.
|
||||
- Record the firmware commit, output FD and handoff memory map before a boot attempt.
|
||||
- Build the payload, then run ./unixnu bootimg with the firmware DTB. Inspect boot.json ramdisk\_bytes and the required firmware modules.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The firmware DTB is an input to boot-image assembly. XNU consumes the separately generated ADT.
|
||||
- The sheng preflight component belongs with board integration and its firmware requirements.
|
||||
- The shared UniXNURamDiskDxe reads the Mu-Silicium entry-argument HOB and FDT initrd range to publish the payload block device. ShengBootMemoryDxe owns memory expansion.
|
||||
- Configured menu entries require a payload FAT filesystem containing EFI/UniXNU/unixnu.toml. Check the UNIXNURAMDISK initrd block-device status when entries are absent.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Boot-image assembly requires the selected firmware DTB and proprietary input files.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture firmware revision and memory reservations with the next image verification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/proprietary-files.txt)
|
||||
- `source`: [Shared FDT initrd block-device publication; board memory policy remains in uefi-sheng.](https://github.com/UniXNU/UniXNU/blob/8d157ee18ae9c4d518aba28cb3040a84e860dcd1/package/UniXNUPkg/Driver/UniXNURamDiskDxe/UniXNURamDiskDxe.c)
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ArmCpu`, `ArmDTPlatform`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM8550 CPU affinities, GIC distributor at 0x17100000, redistributors at 0x17180000, 0x40000 stride and 19.2 MHz timer.
|
||||
- PSCI uses SMC. All eight CPUs are enabled; the DTS tags cpu0 to cpu2 \(A510\) as an E cluster and cpu3 to cpu7 as a P cluster with unixnu,cluster-type.
|
||||
|
||||
### Configuration
|
||||
|
||||
- dts/sheng.dts includes sm8550.dtsi; shared CPU and interrupt definitions come from the SoC source.
|
||||
- Kernel arguments select sheng-smp=1 and armcpu-spi-ipi=1.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compile the board DTS and inspect enabled CPUs, GIC ranges and timer properties in the ADT.
|
||||
- Record per-CPU entry, timer interrupts and inter-processor interrupt delivery.
|
||||
|
||||
### Development findings
|
||||
|
||||
- CPU affinity values are hardware identifiers. Enabled CPU count and MPIDR affinities must be checked together.
|
||||
- GIC register ranges must use translated physical addresses from the hardware tree.
|
||||
- XNU accepts work interval operations 6, 7 and 8 \(interval start, update and finish\) through patches/xnu/native-work-interval-instance.patch in UniXNU; without a performance controller they only succeed.
|
||||
- patches/xnu/zzyf-sheng-amp.patch runs the Edge scheduler with the E and P clusters from the ADT; UI work stays on the P cluster and coreduetd is stopped.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU.
|
||||
|
||||
### Current limits
|
||||
|
||||
- CPU selection and frequency policy are board inputs; SoC topology describes all cores.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach per-CPU and interrupt observations for the selected firmware and image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/dts/sheng.dts)
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Handoff DRAM at 0x80000000 with size 0x80000000; splash reservation at 0xb8000000 with size 0x2b00000.
|
||||
- Payload owned-memory request is 0x130000000. Device DMA requires controller stream IDs, address widths and ownership.
|
||||
|
||||
### Configuration
|
||||
|
||||
- device\_tree.source = device:dts/sheng.dts; include\_dirs = \[soc:dts\].
|
||||
- payload.adt.owned\_memory\_size and firmware reservations describe separate allocations.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Compare firmware RAM ranges, reserved regions, DTS ranges and ADT memory-map entries.
|
||||
- Check DMA buffers against controller address width, cache policy and SMMU mapping before submitting work.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Physical register translation and CPU virtual mappings have different purposes. Preserve physical resource ranges in hardware descriptions.
|
||||
- GPU and UFS use different SMMU instances and stream assignments.
|
||||
- The DTS carries each CPU's cluster type for the ADT \(see the cpu area\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The DTS declares the current handoff window and splash region; memory sizing requires the selected firmware map.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the firmware memory map and each DMA consumer when changing reserved memory.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/dts/sheng.dts)
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengUfs`, `VirtioMmioBlock`, `RamBlock`, `VerifiedRoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UFS host 0x01d84000/0x3000; PHY 0x01d80000/0x2000; GCC base 0x00100000.
|
||||
- GCC AXI, AHB, UniPro, symbol and PHY auxiliary branches; power domains and firmware link state.
|
||||
- Apps SMMU at 0x15000000, UFS stream 0x60, context-bank ownership, DMA width and cache maintenance.
|
||||
- LUN 0 uses 4096-byte blocks; userdata spans LBAs 3094592 through 64007162.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select ShengUfs and CONFIG\_XNU\_NATIVE\_UFS=y; native-ufs-root=1 enables the root path.
|
||||
- userdata defines OS and SystemOS windows. payload.adt.root\_match\_volume\_uuid = 04769D26-2CA0-4825-B443-E2E5F88300F2.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read https://unixnu.com/porting/ufs with this storage record.
|
||||
- Inspect clock enables, power state, HCE/HCS, link state, request-list base and SMMU mappings before changing controller ownership.
|
||||
- Validate SCSI capacity and GPT reads, then publish root windows and mount the configured root UUID.
|
||||
- Verify persistent Data writes on the documented Data allocation with a recovery image available.
|
||||
|
||||
### Development findings
|
||||
|
||||
- ShengUfs also owns the apps SMMU stage 1 windows for the display bank \(sheng-dpu-scanout\) and the WiFi endpoint \(sheng-wifi=2 or more\); both are off by default.
|
||||
- An idle AHB branch may report CLK\_OFF with hardware gating enabled. Check enable and gating bits together.
|
||||
- SMMU bypass still has address-width constraints. Validate every DMA range and context-bank assignment.
|
||||
- ShengUfs contains controller access, GPT/window parsing and sheng Data/log policy. Reuse each layer according to its inputs.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Host: register, clock, link and SMMU facts match the board inventory.
|
||||
- Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within userdata.
|
||||
- Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The SoC DTSI exports host and PHY ranges. GCC and UFS SMMU handling currently use constants and operations in ShengUfs.
|
||||
- The root transport uses a polled request slot. Its firmware adoption path requires a usable existing request list.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record clock/PHY/reset initialization ownership and the SMMU stream before adapting this driver to another board.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/ShengUfs/blob/e2b32cc429e8cf1501161c1d8c517f8994ceb9b2/NativeUfs.cpp)
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `GopFramebuffer`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UEFI GOP framebuffer, stride, pixel format, splash reservation and board panel/backlight controls.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select GopFramebuffer; CONFIG\_XNU\_NATIVE\_LEGACY\_DISPLAY=y; artwork-display-gamut = sRGB.
|
||||
- sheng-vsync=120 requests board display timing.
|
||||
- sheng-dpu-scanout=2 lets the display pipes fetch the compositor surface through a stage 1 window of the display bank; off by default.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Verify GOP address, dimensions, stride and pixel layout before enabling presentation.
|
||||
- Build the late display archive with the selected OS ABI records, then check display publication and frame presentation.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The display source and ABI binding are selected independently from the physical panel configuration.
|
||||
- The board configuration declares sRGB for the current 8-bit framebuffer path.
|
||||
- scripts/build-gop-legacy-display.py also builds the board driver objects in the display archive, including the ADSP, IPC router, FAT reader and battery manager.
|
||||
- With sheng-dpu=2 DisplayTimingProbe reads the VIG 0 and 1 pipes, CTL 0 and the tear checks; sheng-dpu=3 also rewrites the pipe addresses and times the flush latch \(5.4 ms, no start needed: the panel refreshes by itself\).
|
||||
- The GENI I2C core also moves 1 to 8 byte writes and 1 to 4 byte reads \(the audio amplifiers use 32-bit registers\); the backlight keeps its 8-bit transfers.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- A known frame appears with correct geometry and colors, then userland presentation and backlight controls work.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The late display builder needs qualified prelink candidates and ABI records. A timing request requires a measured presentation result.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record frame timing, pixel format and presentation evidence for each image used to qualify display.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/package/LegacyDisplayProbe.cpp)
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ShengHidInput`, `ShengNovatekTouch`, `QcomGeniSpi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Novatek NT36532 sensor, GENI SPI controller, pin configuration, reset/interrupt lines, firmware and touch coordinate geometry.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select ShengHidInput, ShengNovatekTouch and QcomGeniSpi; sheng-touch=4 and sheng-touch-hid=1 select board integration.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read TouchBoard.h and verify the SPI clock and mode against the controller setup.
|
||||
- Validate protocol reports, contact tracking and coordinate orientation before publishing HID events.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Controller transfer logic, sensor protocol and board sensor geometry are separate inputs.
|
||||
- Track contact IDs across movement and lift events; a register read alone covers only transport access.
|
||||
- sheng\_buttons\_press\(\) holds a button mask for a given time through the HID sink, for unattended tests \(the audio lock sound test uses it\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Sensor firmware and board dimensions remain sheng inputs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach contact and orientation observations when firmware or geometry changes.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/package/TouchBoard.h)
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `Adreno740`, `AdrenoMetal`, `AirNir`, `Sm8550Platform`, `AdrenoPM4`, `AdrenoFirmware`, `ArmSmmu4K`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- A740 GPU/GMU registers, GPU SMMU streams 0/1 and GMU stream 5, signed ZAP firmware and board power votes.
|
||||
- Turnip, metal2vulkan, AIR translation and the selected OS GPU/Metal ABI.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select Adreno740, AdrenoMetal and AirNir; shared SM8550 operations arrive through component dependencies.
|
||||
- Board scripts combine shared GMU code with package/ShengGmuVotes.c.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Qualify power, firmware, SMMU and GMU startup before command submission.
|
||||
- Check memory mapping, command completion and a known rendered image before staging the Metal plugin.
|
||||
|
||||
### Development findings
|
||||
|
||||
- GPU generation and the frontend ABI define component scope. Firmware, votes and display integration remain board inputs.
|
||||
- Shared platform code and board votes require separate include paths during archive assembly.
|
||||
- A frame is one submission of up to 128 IBs \(24 at most observed\). WPTR writes check the GMU AHB fence status; none were dropped. Jobs take about 5 ms against the client's 1 ms waits, so the stall handler's write-pointer and TLB recovery runs on ordinary jobs: mapping-time TLB invalidation did not change it.
|
||||
- The render server primes all 162 Metal libraries of the OS image while the desktop is idle \(the PR log row\). The payload carries the library list and a copy of the cryptex QuartzCore library. The idle desktop submits 6 command buffers per 250 ms at 120 Hz, so priming waits only above 8.
|
||||
- Each client holds up to 16384 objects. Owned BOs and imports that share one cache class and overlap no owned page map without the alias check against existing ranges; an unmap of up to 512 pages invalidates page by page; a submission no longer invalidates the GPU TLB.
|
||||
- A render pass the bridge cannot encode returns a refusing encoder, not nil: WidgetRenderer crashed at PC 0 on the nil and lost its device after 8 crashes \(Apple TV widget drawn wrong\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it.
|
||||
|
||||
### Current limits
|
||||
|
||||
- A740 coverage depends on the selected firmware and OS ABI; board qualification requires its own memory and power evidence.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the exact firmware, compiler inputs, driver revision and rendered output for the next qualification.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/scripts/build-adreno740-kits.py)
|
||||
- `device`: [325 BO maps at 0.20 ms each \(0.66 ms in i568\), 1024 MiB pool with 0 fallbacks, WidgetRenderer reported a refused command buffer and did not crash; 130 fps idle, delay 4.9 ms mean, 14 ms max.](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot-i570.img; python3 scripts/read-sheng-log.py</code>. Revision: `eb026be0b22dff2a32f9a161a5547657122276c0`.
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `Ath12kWifi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Ath12k device on PCIe, BAR windows, MSI routing, DMA callbacks, firmware, MHI and QRTR services.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Select Ath12kWifi. build-gop-legacy-display.py compiles its objects through build-ath12k-wifi.py.
|
||||
- board.toml sets sheng-wifi=5 in the kernel arguments; WifiProbe and the UFS driver read it.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Verify PCIe enumeration and MSI delivery before MHI startup.
|
||||
- Record firmware startup, scan, association, address configuration and bidirectional packet delivery separately.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The reusable Wi-Fi stack consumes board callbacks; PCIe and the OS network interface are owned by the device integration.
|
||||
- MHI startup and network traffic are separate completion points.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The source implements the station path through WifiNet.cpp and board PCIe integration. Device evidence must identify the firmware and access point.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach association and receive/transmit observations for the current firmware and image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/package/WifiNet.cpp)
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- ADSP firmware from modem\_a, SMEM, SMP2P, GLINK, the GPR channel adsp\_apps.
|
||||
- Speakers: six CS35L43 amplifiers on QUP1 SE5 and QUP2 SE0 \(I2C 0x40 to 0x42\), shared reset gpio90, secondary MI2S \(gpio121 to 124\).
|
||||
- Microphones: WCD938x codec on the TX SoundWire master \(0x6d30000\), reset gpio108, supply ldob15; TX and VA macros.
|
||||
|
||||
### Configuration
|
||||
|
||||
- sheng-audio takes bits \(sheng-adsp=2 is required\): any nonzero value serves the audio service, 2 plays a 1.5 s 750 Hz test tone at boot, 4 brings up the microphone path and reads two seconds of capture, 8 runs the lock sound test.
|
||||
- sheng-audio-pa moves the DSP period buffer \(default 0xd0000000\); sheng-audio-tone-ms and sheng-audio-atten set the tone.
|
||||
- The payload addon carries hal/ShengAudio.driver under audio/; patches/xnu/zzyd-sheng-audio-addon-mount.patch mounts it over /System/Library/Audio/Plug-Ins/HAL. Its CDHash joins the owner trust cache.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read the \[audio\], \[amps\], \[audio-glink\], \[audio-buffer\], \[mic\], \[mic regs\] and \[mic capture\] log lines with scripts/read-sheng-log.py.
|
||||
- Read \[audio-props\], \[audio-service\], \[audio-io\], \[audio-thread\], \[audio-clock\], \[audio-requests\] and \[audio-sync\] for the iOS path: the plug-in's volume and peak, late and silent periods, write-ahead and read-behind, IO cycle intervals, clock skew, the audio server's IO thread scheduling and host clock, and the plug-in's last start and stop requests.
|
||||
- Run scripts/check-audioreach-host.py, scripts/check-cs35l43-host.py and scripts/check-geni-i2c-host.py after changing the codecs.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The ADSP image loads in place from the split adsp and adsp\_dtb files in /image of the modem\_a FAT volume.
|
||||
- The DSP offers 24 intents of 128 bytes on adsp\_apps and grants a 4 KiB one on request; the GLINK remote intent table keeps it.
|
||||
- The amplifiers play ASP RX1 directly \(DSP bypassed, no amplifier firmware\): top three slot 0, bottom three slot 1, gain 18 dB, 16-bit I2S at 48 kHz from the SoC as clock master.
|
||||
- The DSP takes buffers as a 32-bit address with the stream index \(0x1001 & 0xf\) in the upper word. The period buffer is low DRAM outside the kernel's window, mapped write-combined; the audio streams stay in SMMU pass-through.
|
||||
- Programming a translating SMMU context for the audio streams resets the board; the hypervisor keeps those context banks.
|
||||
- PRM commands go from the PRM port \(2\) and use PRM clock ids: the TX core clock is 0x30c. The macro and digital codec votes make the LPASS registers accessible.
|
||||
- The VA macro gates the TX SoundWire master's clock on SM8550; with its gate and the TX macro's on, the link comes up and the codec enumerates as device 1.
|
||||
- The primary microphone is AMIC3 on micbias 3 into ADC2, codec data port 1 channel 2, master port 2, TX decimator 0 from SWR\_MIC1 and codec DMA TX3, mono 48 kHz.
|
||||
- iOS sees the plug-in device only with the Thunderbolt transport type: VirtualAudio makes it a driver device with one output and one input port. Built-in devices need Apple port descriptions, and a USB device needs a location the audio server does not take from a plug-in.
|
||||
- The plug-in and the service share one timeline anchored at boot on the 19.2 MHz host timer \(400 ticks per frame, computed in 128-bit\). Playback and capture rings hold 65536 frames; the service takes 480-frame periods and keeps four in flight.
|
||||
- The DSP answers a playback buffer once it has copied it, so the steady lead is measured per run \(about 1600 to 2000 frames\) and the published lead is at least 300 ms.
|
||||
- Capture answers carry a byte count and an offset; only those bytes are taken, and a short period is normal.
|
||||
- CoreAudio takes the host clock to be 24 MHz \(one constant behind AudioGetHostClockFrequency\). The plug-in finds that constant and the service sets it to 19.2 MHz on its shared page; without it the audio server's IO cycles ran 25 percent long and playback and recording stuttered.
|
||||
- The zero time stamps start at the frame IO starts on, every 65536 frames, with the raw clock algorithm. A period under the safety offset stops the audio server's IO.
|
||||
- The audio server's IO thread runs with a time constraint \(priority 97, period 409600 ticks, computation 204800\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each declared route carries the selected audio format through playback or capture and handles start/stop correctly.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Playback sounds harsh in places; no speaker equalization or protection runs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Qualify iOS playback and capture across apps and routes, then add speaker equalization and protection.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/package/AudioProbe.cpp)
|
||||
- `host`: [PASS audioreach: 182 checks; PASS cs35l43: 225 checks; PASS GENI I2C: 2169 checks](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/scripts/check-audioreach-host.py)
|
||||
Command: <code>python3 scripts/check-audioreach-host.py; python3 scripts/check-cs35l43-host.py; python3 scripts/check-geni-i2c-host.py</code>. Revision: `9e9971883be72b2fd76b8fb552367a9e4940aa63`.
|
||||
- `device`: [Speaker test tone: DSP mapped the buffer, 155 periods sent and 151 returned, all six amplifiers PLL-locked with no error interrupts. WCD938x enumerated \(manufacturer 0x0217, part 0x010d\). Capture: 200 of 200 periods returned, 191328 bytes, 97 percent non-zero samples, peak 128 in a quiet room.](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot.img (sheng-adsp=2 sheng-audio=6); python3 scripts/read-sheng-log.py --wait 240</code>. Revision: `9e2e6de1e63d9493e841d51c6b41108e75c7d537`.
|
||||
- `device`: [Playback and recording smooth from the start. Host clock set to 19200000 Hz, IO thread period 409600 ticks. 4822 of 4843 IO cycles 15 to 25 ms apart. Write-ahead 16501 to 19638 frames, skew -474 to 1 frames, 0 late periods.](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot.img (sheng-adsp=2 sheng-audio=14); play music and record in Voice Memos; python3 scripts/read-sheng-log.py --wait 240</code>. Revision: `dea464ef093349dd746582691b0eaa3807fe1441`.
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `AppleKeyStoreState`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Board PMGR integration, clocks/regulators and per-peripheral power requirements.
|
||||
- ADSP battery manager: PMIC GLINK owner 32778 on PMIC\_RTR\_ADSP\_APPS; board properties use opcode 0x50; fuel gauges 0x8a/0x8b and 0xa6/0xa7.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_SHENG\_PMGR=y; sheng-pmgr=2 selects the board integration.
|
||||
- AppleKeyStoreState is selected with the OS event integration.
|
||||
- sheng-adsp=2 publishes the battery as an IOPMPowerSource; sheng-battery=0 leaves it off.
|
||||
- sheng-usb-sdp-ma sets the input limit on a standard computer port \(default 900; 0 keeps the firmware limit\).
|
||||
- sheng-cpufreq=4 scales the CPU domains with load \(sheng-cpufreq-min sets a floor in MHz\); sheng-cpufreq=3 fixes the highest non-turbo level.
|
||||
- sheng-gpu-dcvs=1 scales the GPU clock with its busy time \(sheng-gpu-dcvs-min sets the floor level, default 3\); sheng-gpu-perf fixes a level instead.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Document each clock, regulator and firmware-owned state before enabling power transitions.
|
||||
- Check battery units and update behavior separately from suspend/resume and peripheral power.
|
||||
- Read the \[battery\], \[battery-raw\] and \[charger\] log lines with scripts/read-sheng-log.py.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The ADSP firmware runs charging and PD/PPS negotiation without host requests.
|
||||
- Battery properties after 11 are shifted by one: charge current 12, temperature 13, charge counter 15, cycles 16, design 17, full 18, time to full 20, time to empty 21.
|
||||
- Charge is the sum of both fuel gauges' remaining over full capacity. Battery current is reported discharge-positive.
|
||||
- USB property 6 reads SDP on every port. Property 7 carries the adapter type \(6 PD, 8 PD PPS\).
|
||||
- A PPS adapter gets a 3 A input limit at about 8.7 V; the battery charges at the 2000 mA charge current with the charge pump off.
|
||||
- Both cells and the PD adapter read unauthenticated.
|
||||
- A Mac USB-C port negotiates PD 5 V with a 1.2 A input limit: about 1.1 A in, and the battery gains 0.25 to 0.4 A on the desktop.
|
||||
- Power policy belongs to the board even when controller operations are shared.
|
||||
- The GPU power probe hands the ring its register window without a GMU fence callback: only the GPU service checks fenced WPTR writes.
|
||||
- The CPU governor reads each CPU idle time through patches/xnu/zzye-sheng-cpu-idle.patch. Domain 0, the E cluster, scales with load like the other domains.
|
||||
- The GPU governor reads the GMU XO busy counter and votes over HFI with the level bandwidth.
|
||||
- A touch holds the P CPU domains and the GPU at their top level for sheng-cpufreq-boost-ms and sheng-gpu-dcvs-boost-ms \(1000\) after the last report. GPU submits in 2 of 4 windows keep every CPU domain at 60 percent of its top for 300 ms. A fence waiter sleeps up to sheng-gpu-pause-us \(1000\) and the fence interrupt wakes it.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Adapter details shown to iOS come from USB property 6, so every adapter reads as a computer port.
|
||||
- Charge current stays at 2 A without fuel gauge and adapter authentication.
|
||||
- A low-battery shutdown panics in vnode\_rele\_ext during unmount.
|
||||
- Per-peripheral controls and battery publication have separate coverage from system suspend.
|
||||
- The GPU governor changes level several times a second and spends most busy time at 680 MHz; its effect on frame times is not measured.
|
||||
|
||||
### Next action
|
||||
|
||||
- Take adapter details from property 7.
|
||||
- Authenticate both fuel gauges, then qualify PPS charge pump charging; Xiaomi adapter authentication follows.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/package/ShengBattery.cpp)
|
||||
- `host`: [PASS battery manager: 4074 checks](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/scripts/check-battery-host.py)
|
||||
Command: <code>python3 scripts/check-battery-host.py</code>. Revision: `8719a19294bc79eed72366a19070acfd8e131737`.
|
||||
- `device`: [PPS adapter: 8.72 V at 1.3 A in, battery +1.99 A, 1 to 3 percent in 3 minutes. Mac: PD 5 V at 1.1 A in \(1.2 A limit\), battery +0.25 to +0.4 A on the desktop, 20 to 21 percent. Temperature 31.4 to 32.9 C; full 9353 mAh, design 9800 mAh, 172 cycles.](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot.img; python3 scripts/read-sheng-log.py --wait 240</code>. Revision: `8f5d921d7a3b71a20a97f551cad546dc8e2f3700`.
|
||||
- `device`: [CPU: domain 1 between 499 and 2803 MHz, domain 2 between 595 and 2956 MHz, about 1.2 GHz and 620 MHz mean when idle. GPU: every vote accepted, 61 percent of the time at 680 MHz at 7 percent mean busy.](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/scripts/read-sheng-log.py)
|
||||
Command: <code>fastboot boot boot.img (sheng-cpufreq=4 sheng-gpu-dcvs=1); python3 scripts/read-sheng-log.py --wait 240</code>. Revision: `a338c71a6f83809c84686b4996478f1c4cd3f3ab`.
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `DarwinBoot`, `XnuPrelink`, `SoftwareAES`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Prelinked kernel, hardware DTB, generated ADT, trust cache, Data seed, platform identity and firmware DTB.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Payload volume is 208 MiB. kernel.patch\_series selects ARM64, SoC, OS and device series in order.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build kernel and package, then payload with --unique-chip-id and the selected trust-cache/Data inputs.
|
||||
- Run ./unixnu bootimg -D ../UniXNU-sheng --uefi ../uefi-sheng --dtb <firmware.dtb> and inspect the assembly report.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The OS boot-progress integration follows the SoC hooks in patch order.
|
||||
- The payload carries kernel.macho.adt; the boot image carries the firmware FDT. Keep the two inputs named explicitly.
|
||||
- The device patch series adds zzyd-sheng-audio-addon-mount.patch: the payload addon's audio directory is union-mounted over /System/Library/Audio/Plug-Ins/HAL \(mount4 in the A log line\).
|
||||
- zzyf-sheng-amp.patch follows it: the AMP Edge scheduler for the E and P clusters \(see the cpu area\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Image output depends on the selected ABI audits, firmware and volume policy inputs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Attach artifact paths and exact source revisions to the next image build record.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/patches/xnu/series)
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Serial or framebuffer diagnostics, panic region, boot checkpoints and a recovery path.
|
||||
|
||||
### Configuration
|
||||
|
||||
- boot-progress=2 enables checkpoints; source and image revisions accompany every log.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run the existing check for the changed area and keep its command, output and input revision.
|
||||
- Record the last completed checkpoint and the first failing operation; link the captured output.
|
||||
|
||||
### Development findings
|
||||
|
||||
- A source implementation, a host check and a device observation establish different completion levels.
|
||||
- Keep an unresolved cause explicit and record the next measurement that can distinguish it.
|
||||
- The UFS log carries \[adsp\], \[qrtr\], \[battery\], \[battery-raw\] and \[charger\] lines for the DSP, the IPC router and the charger.
|
||||
- BatteryProbe starts the battery with sheng-adsp=2, so the \[battery\] and \[charger\] lines appear on every DSP image; a missing \[battery\] line on such an image means sheng-battery=0 or a failed start.
|
||||
- Host checks for the ADSP path: check-adsp-host.py, check-modem-fw-host.py, check-qrtr-host.py and check-battery-host.py.
|
||||
- The log carries \[audio\], \[amps\], \[audio-glink\], \[audio-buffer\], \[mic\] and \[mic regs\] for the audio path, and \[gpu wptr\] for fenced GPU write pointer writes.
|
||||
- GPU memory rows: \[vm map\], \[vm unmap\], \[vm kinds\] \(time per owned map, fast and full import, unmap by page and by ASID\) and \[bo pool\]. Governor rows: \[cpu gov\] with boost and frame-floor counts, \[cpu throttle\] and \[gpu dcvs\] with touch and wake boosts. Display rows \(sheng-dpu=2 or 3, sheng-dpu-scanout\): \[dpu vig0\], \[dpu vig1\], \[dpu ctl0\], \[swap surfaces\], \[direct scanout\] and \[dpu smmu\].
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Source references in this record describe implemented behavior. Host and device status require their respective evidence entries.
|
||||
|
||||
### Next action
|
||||
|
||||
- Add captured host or device evidence when repeating a checkpoint on a known image.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Implementation and configuration described in this section](https://github.com/UniXNU/UniXNU-sheng/blob/88b11aeb4b0ffc414e5992e77194e210be475a27/scripts/read-sheng-log.py)
|
||||
|
||||
</div>
|
||||
+548
-12
@@ -1,22 +1,558 @@
|
||||
# Xiaomi Mi 8 SE (sirius)
|
||||
# Xiaomi Mi 8 SE \(sirius\)
|
||||
|
||||
Xiaomi Mi 8 SE (sirius) is a SDM710 device. The port below is an independent community project. The UniXNU organization does not maintain it.
|
||||
[57UU/UniXNU-sirius](https://github.com/57UU/UniXNU-sirius)
|
||||
|
||||
| Repository | Maintainer |
|
||||
<div v-pre>
|
||||
|
||||
Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: entry, MMU, timer, PSCI, platform expert and the boot-progress console work on hardware; IOKit is blocked on AppleARMCPU claiming /cpus.
|
||||
|
||||
Source record: [porting.toml](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/porting.toml), `e51069a970f81a3c48588041a0caa3087a1ebbbc`.
|
||||
|
||||
This page is generated from the device record.
|
||||
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [UniXNU-sirius](https://github.com/57UU/UniXNU-sirius) | [57UU](https://github.com/57UU) |
|
||||
| [UniXNU-sdm710-common](https://github.com/57UU/UniXNU-sdm710-common) | [57UU](https://github.com/57UU) |
|
||||
| [Configuration](#configuration) | `implemented` |
|
||||
| [Firmware and boot](#firmware) | `implemented` |
|
||||
| [CPU and interrupts](#cpu) | `implemented` |
|
||||
| [Memory and DMA](#memory) | `implemented` |
|
||||
| [Storage and root](#storage) | `planned` |
|
||||
| [Display](#display) | `implemented` |
|
||||
| [Input](#input) | `planned` |
|
||||
| [GPU](#gpu) | `planned` |
|
||||
| [Network](#network) | `planned` |
|
||||
| [Audio](#audio) | `planned` |
|
||||
| [Power](#power) | `planned` |
|
||||
| [Image assembly](#packaging) | `implemented` |
|
||||
| [Diagnostics](#diagnostics) | `implemented` |
|
||||
|
||||
## State
|
||||
## Configuration {#configuration}
|
||||
|
||||
The format 2 port selects shared SDM710 support. U-Boot UEFI, the payload, XNU entry probes, MMU, the 19.2 MHz timer, PSCI reset and the panel console have device results.
|
||||
`implemented`
|
||||
|
||||
IOKit currently selects AppleARMCPU from the kernelcache, which panics in `_validateConfiguration()`. Native ArmCpu matching and the eMMC root driver remain pending.
|
||||
Components: `ArmDTPlatform`, `DarwinBoot`.
|
||||
|
||||
## Maintenance
|
||||
### Hardware and dependencies
|
||||
|
||||
The maintainer owns the repository and its release decisions. UniXNU documentation lists the port and its state; it does not take over maintenance.
|
||||
- SoC: SDM710 \(Kryo 360, 2x Cortex-A75 + 6x Cortex-A55\), GIC-500 GICv3, 19.2 MHz Qualcomm XO counter, PSCI over SMC.
|
||||
- DRAM: 6 GiB model, 2 GiB at 0x80000000 plus 0xfd6c0000 at 0x100000000, 0x17d6c0000 usable.
|
||||
- Target OS: the unchanged iPad7,1 iPadOS 17.7.11 \(21H461\) restore image, the same kernelcache as fajita and sheng.
|
||||
- Hardware sources: mainline sdm670.dtsi, the vendor kernel tree and measurements on the phone.
|
||||
|
||||
## Sources
|
||||
### Configuration
|
||||
|
||||
- [README: 57UU/UniXNU-sirius](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/README.md)
|
||||
- board.toml is format 2 \(schema\_version = 2\) and selects soc\_source = sdm710 and os\_profile = ipados-17.7.11-21H461.
|
||||
- dts/sirius.dts describes memory, the eight cores and their affinities, and includes the SoC DTSI for the GIC, PSCI and counter.
|
||||
- configs/sirius\_defconfig keeps the first-console kernel configuration and turns off the profile settings the image does not use yet.
|
||||
- The prelink roots, slide, early security initializer and Apple device-tree identity come from the OS profile; the board adds sleep-disabled, the product model and the button set.
|
||||
|
||||
### Procedure
|
||||
|
||||
- From a UniXNU checkout: ./unixnu defconfig sirius\_defconfig -D ../UniXNU-sirius.
|
||||
- Then ./unixnu fetch, ./unixnu status --json and ./unixnu tree; the output is out/sirius/ipados-17.7.11-21H461/sirius/.
|
||||
- Compile the hardware tree through the payload step \(prototype: dtc -I dts -O dtb -i <soc>/dts dts/sirius.dts\).
|
||||
|
||||
### Development findings
|
||||
|
||||
- Format 2 replaced the hand-written ADT generator of the legacy port \(scripts/make-sirius-adt.py\) with a board DTS: the payload step compiles the tree and derives kernel.macho.adt from it.
|
||||
- The arm-io base is derived from the exported nodes, not written by hand: the GIC at 0x17a00000 makes the window start at 0x17000000, which XNU reads as the SoC base.
|
||||
- The legacy port set ipad\_identity = true; in format 2 the same identity is the OS profile's \[adt\] tables, so the board only states its deviations.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- status --json resolves the ARM64, sdm710, iPadOS and device layers, prints a non-empty patch order and shows the device package as kits/sirius.
|
||||
- The compiled hardware tree carries one contiguous memory range equal to payload.dram\_size, eight enabled CPUs and a PSCI method.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The SoC profile is new: only the GIC, PSCI, counter and the timer INTID are shared, everything else is still board-local.
|
||||
- No device-verified configuration has been recorded against a commit of this repository yet; the evidence is the legacy port's handoff document.
|
||||
|
||||
### Next action
|
||||
|
||||
- Run status --json and tree against this repository and commit the resulting unixnu.lock.
|
||||
- Rebuild the payload from dts/sirius.dts and compare the generated ADT with the legacy one before the next hardware boot.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Hardware values, the boot chain and the bring-up history of the legacy port, from which this configuration is carried over.](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/docs/HANDOFF.zh-CN.md)
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `DarwinBoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The device runs sirius-distro \(mainline Linux\) and its boot partition carries U-Boot 2026.07 with EFI\_LOADER, the UEFI boot manager, GOP through vidconsole and EFI block volumes over FAT.
|
||||
- UniXNU.efi is built on the host by ./unixnu build package; DarwinBoot.efi is built from drivers/DarwinBoot.
|
||||
- The payload volume goes to the unused vendor partition mmcblk0p80 \(3 GiB\) and is selected by a marker file.
|
||||
|
||||
### Configuration
|
||||
|
||||
- board.toml has no \[firmware\] table: there is no Mu-Silicium firmware and no boot image on this port.
|
||||
- \[payload\] loader = "payload" makes the generated unixnu.toml load Payloads/DarwinBoot.efi as a \[\[driver\]\] instead of expecting it in the firmware volume.
|
||||
- scripts/make-uboot-payload.py adds \\EFI\\BOOT\\BOOTAA64.EFI \(UniXNU.efi\) and the DarwinBoot.efi driver to the payload FAT volume.
|
||||
|
||||
### Procedure
|
||||
|
||||
- fastboot flash boot the U-Boot image, fastboot flash vendor the finished payload volume, then select the UniXNU menu entry in U-Boot.
|
||||
- U-Boot boots UniXNU when /EFI/UniXNU/BOOTUNIXNU exists on the vendor partition and boots Linux otherwise.
|
||||
|
||||
### Development findings
|
||||
|
||||
- U-Boot's UEFI services are enough for UniXNU, DarwinBoot and XNU: no Mu-Silicium platform port is needed for this board.
|
||||
- DarwinBoot's GIC-500 pre-configuration \(the iBoot role\) is what lets the kernel pass lockdown and start kexts on this SoC.
|
||||
- The pre-configuration must not enable the EL1 virtual timer PPI early: on SDM710 that is INTID 19 and it fires before ArmCpu installs its handler.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- U-Boot starts UniXNU from the FAT volume, the menu lists the xnu entry, and DarwinBoot hands control to the kernel with the device tree, framebuffer and command line.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The boot chain is U-Boot specific: it is not reproducible with the Mu-Silicium flow of the other ports and is not covered by ./unixnu firmware or ./unixnu bootimg.
|
||||
|
||||
### Next action
|
||||
|
||||
- Keep the U-Boot side \(sirius-distro\) pinned by revision in the handoff document; it is the firmware for this port.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Boot-chain diagram, the marker-file boot rule and the DarwinBoot GIC pre-configuration rationale.](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/docs/HANDOFF.zh-CN.md)
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ArmCpu`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Eight Kryo 360 cores at Affinity1 0x000..0x700, boot CPU cpu0; cpu0-5 Cortex-A55, cpu6-7 Cortex-A75.
|
||||
- GIC-500 distributor 0x17a00000/0x10000, redistributor 0x17a60000/0x100000, stride 0x20000.
|
||||
- The EL1 virtual timer is GIC PPI 3 / INTID 19 \(Apple uses PPI 11 / INTID 27\); the SoC counter runs at 19.2 MHz.
|
||||
|
||||
### Configuration
|
||||
|
||||
- dts/sirius.dts lists all eight cores in boot order with their compatible strings; the ADT carries the same order.
|
||||
- The kernel command line selects the board behaviour: sheng-smp=1, cpus=8, armcpu-self-ipi=1, armcpu-timer-intid=19.
|
||||
- drivers/ArmCpu/ArmCpu.cpp is the board copy of the component: it adds the non-Apple timer INTID, the /cpus probe counters and the sheng-smp claim path.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build the kernel, then read the boot-progress TOPO line to confirm the topology and the probe decision.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The boot-progress TOPO row confirms the kernel topology on hardware: boot=0 max=7 nums=01234567.
|
||||
- With sheng-smp=1 the native ArmCpu claims every /cpus nub; without it the kernelcache AppleARMCPU takes the nubs and panics with "CPU configuration in device tree is invalid" because it requires /cpus/max\_cpus.
|
||||
- AppleARMCPU still wins the nubs at the current stage, which is the open IOKit blocker.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU with the board INTID.
|
||||
|
||||
### Current limits
|
||||
|
||||
- IOKit attach of the native ArmCpu is not yet proven; the last trusted snapshot shows AppleARMCPU holding /cpus.
|
||||
|
||||
### Next action
|
||||
|
||||
- Stop pre-enabling the timer PPI in DarwinBoot, re-read the probe row, and confirm ArmCpu installs its IRQ handler before the timer fires.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Timer INTID measurement, the TOPO checkpoint and the AppleARMCPU panic analysis.](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/docs/HANDOFF.zh-CN.md)
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Usable DRAM 0x17d6c0000 from 0x80000000 \(6 GiB model: 2 GiB then 0xfd6c0000 at 0x100000000\).
|
||||
- The framebuffer handed over by U-Boot sits at 0x9c000000 \(1080x2240 splash\).
|
||||
|
||||
### Configuration
|
||||
|
||||
- The DTS memory node is a single contiguous range and board.toml repeats the size as \[payload\] dram\_size; the driver refuses a mismatch.
|
||||
- The ADT receives dram-base, dram-size and the CHRP NVRAM proxy from the payload step.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Read the MEM row of the boot-progress panel and compare it with the DTS range.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The single contiguous range is what DarwinBoot's window allocation and the ADT handoff require; the two physical banks are described as one range on purpose.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The kernel memory map accounts for every handoff region, and no DMA engine or framebuffer range overlaps the kernel window.
|
||||
|
||||
### Current limits
|
||||
|
||||
- DMA and SMMU behaviour is untested: there is no storage or GPU driver yet.
|
||||
|
||||
### Next action
|
||||
|
||||
- Capture the kernel's memory map row after the next IOKit break-through and reconcile it with the DTS.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [DRAM split, framebuffer address and the memory-map checkpoint.](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/docs/HANDOFF.zh-CN.md)
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The reference unit is eMMC, not UFS: the UFS transport and its sheng integration points do not apply to this board.
|
||||
- No native storage driver exists yet; the expected first stop of the kernel is the root device wait.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No storage component is selected in board.toml; CONFIG\_XNU\_NATIVE\_UFS is off in the defconfig.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Follow the storage guide to choose an eMMC driver path, then select it and record the checkpoint.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The legacy port deliberately kept every UFS and owner-root flag off; the boot-progress interlock of UniXNU had to be relaxed for that reason.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The eMMC registers, GPT and the OS/SystemOS windows are correct, the root volume mounts and launchd starts.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No storage driver and no root filesystem: the port currently stops before the root device.
|
||||
|
||||
### Next action
|
||||
|
||||
- Inventory the eMMC controller \(SDCC/MSDC\) registers and interrupt lines from the vendor tree before selecting an implementation.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- U-Boot hands over a 1080x2240 splash framebuffer at 0x9c000000 through GOP \(vidconsole\).
|
||||
- The panel is 1080x2244 DSI; there is no backlight or display driver in the kernel yet.
|
||||
|
||||
### Configuration
|
||||
|
||||
- CONFIG\_XNU\_BOOT\_PROGRESS=y links the boot-progress layer; boot-progress=2 on the command line draws the kernel console lines.
|
||||
- package/Font.h is vendored from Mu-Silicium, so the archive builds without a UEFI checkout.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Build kernel, payload and volume, boot, and read the panel: stage lines, TOPO, PROBE, MEM and panic text.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The panel is the readable kernel log of this port: it renders the console, the TOPO/PROBE rows and panic\(\) output.
|
||||
- Since the panic snapshot patch the panel re-renders at panic time, so the rows are not a stale frame.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- A known frame appears with correct geometry, and the kernel console and panic output stay readable on the panel.
|
||||
|
||||
### Current limits
|
||||
|
||||
- This is a firmware framebuffer text surface, not a Darwin display driver: no IOMobileFramebuffer, no backlight, no modesetting.
|
||||
|
||||
### Next action
|
||||
|
||||
- Keep the panel as the diagnostic surface until a display provider exists, and record each new row it prints.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Boot-progress panel behaviour, the panic snapshot fix and the geometry of the U-Boot framebuffer.](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/docs/HANDOFF.zh-CN.md)
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The board has no Home button; volume keys are reported by the button node of the ADT.
|
||||
- The touch controller is not identified for this unit yet.
|
||||
|
||||
### Configuration
|
||||
|
||||
- board.toml writes \[adt.buttons\] with hold, voldown, volup and home-button-type = 2.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Follow the input guide once a touch controller is known, then select an implementation.
|
||||
|
||||
### Development findings
|
||||
|
||||
- No input component is selected; the button node exists so that BSPlatform and MobileGestalt read a coherent product.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touches map to the display with stable contacts and the volume keys produce the expected HID reports.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No touch support and no IOHIDDevice provider.
|
||||
|
||||
### Next action
|
||||
|
||||
- Identify the touch controller from the vendor DTS and the panel firmware.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Adreno 616 with the SDM710 GPU firmware; no GPU component is selected yet.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Nothing is configured: the CPU renders the boot-progress panel through the firmware framebuffer.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Follow the GPU guide to evaluate Adreno740/AdrenoMetal for this revision; the A616 is not the A740 the component targets.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The Adreno family components in the catalog target the A740 of SM8550; a different implementation would be needed here.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- GPU submissions complete, fences work and a known image renders.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No GPU bring-up has been attempted on this port.
|
||||
|
||||
### Next action
|
||||
|
||||
- Decide whether an A616 implementation is in scope after IOKit and storage; do not assume the A740 path applies.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The Wi-Fi chip of this unit is not identified in the port record yet.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No network component is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Follow the network guide once the chip and its firmware are known.
|
||||
|
||||
### Development findings
|
||||
|
||||
- No network work has started; the first console image does not need it.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Scanning, association and sustained traffic pass with the selected firmware.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No network support at any layer.
|
||||
|
||||
### Next action
|
||||
|
||||
- Identify the WCN chip from the vendor DTS and the firmware partition before selecting a driver.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- No audio path is documented for this unit yet.
|
||||
|
||||
### Configuration
|
||||
|
||||
- No audio component is selected.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Follow the audio guide once the codec and DSP path are known.
|
||||
|
||||
### Development findings
|
||||
|
||||
- No audio work has started.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each declared route carries the selected format through playback or capture.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No audio support at any layer.
|
||||
|
||||
### Next action
|
||||
|
||||
- Inventory the codec and the DSP layout from the vendor tree.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- No suspend/resume path exists; the boot-progress panel is the only power-facing behaviour so far.
|
||||
|
||||
### Configuration
|
||||
|
||||
- board.toml writes \[adt.defaults\] sleep-disabled = 1 so the CPU does not park forever.
|
||||
- PSCI is declared in the SoC DTSI and used for reset and secondary-core start.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Follow the power guide to add the PMIC and battery controls once the platform expert is stable.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Reset works through PSCI \(the stage-3 reset loop proved it\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Declared power controls and battery readings match observations and sleep/resume restores the dependent peripherals.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No battery reporting, no CPU frequency policy and no PMIC driver.
|
||||
|
||||
### Next action
|
||||
|
||||
- Defer until IOKit and storage are stable; keep sleep-disabled until a resume path exists.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [PSCI reset evidence and the reason sleep is disabled.](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/docs/HANDOFF.zh-CN.md)
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `XnuPrelink`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The payload FAT volume is the flashed artifact of this port; there is no boot.img.
|
||||
- The prelink inputs \(kernel path, roots, slide, early security initializer\) come from the OS profile; the board does not override them.
|
||||
|
||||
### Configuration
|
||||
|
||||
- \[payload\] sets volume SIRIUSESP, 256 MiB, loader = payload, dram\_size and the kernel command line.
|
||||
- \[payload.adt\] keeps only chip\_id: the platform seed is supplied per build with --unique-chip-id when the userland stages need it.
|
||||
|
||||
### Procedure
|
||||
|
||||
- ./unixnu build kernel, ./unixnu build package, then bash scripts/build-darwinboot.sh \(or the CI workflow\), ./unixnu build payload, and finally make-uboot-payload.py --output the volume to flash.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Format 2 generates kernel.macho.adt from the DTS, so the legacy ADT script is retired; make-uboot-payload.py still finishes the volume because U-Boot needs the EFI binaries inside it.
|
||||
- scripts/build-xnu-4k-baseline.sh is a copy of the UniXNU script with one board deviation: the boot-progress interlock only requires the source crypto provider.
|
||||
- The legacy build applied patches/xnu/\*.patch by glob \(56 files\); format 2 applies only what the series list names, and the ARM64 and OS series assume the two files they omit are present. native-smp-secondary.patch sets MAX\_CPUS 8 and Affinity1 core numbering; sheng-platform-power.patch supplies the bsd\_init.c block that zzz-boot-progress.patch quotes as context \(CONFIG\_XNU\_SHENG\_PMGR is off, so its code compiles to nothing\). Both now live in the sdm710 SoC series, which applies before the OS series.
|
||||
- The first format 2 kernel build on Linux failed at the last patch, zzz-boot-progress.patch, with a bsd\_init.c context mismatch: the missing piece was sheng-platform-power.patch, not the moved native-smp-secondary. With both in the SoC series the whole series applies and the kernel prelinks: kernel.macho 50 MB, \_\_TEXT 0xfffffff007004000, 30 kernelcache components, 69294 bindings.
|
||||
- The kernel step also runs on Linux through UniXNU's toolchain installer, which builds a patched LLVM, cctools-port ld64, MIG, iig and lzfse. That installer writes /opt/unixnu-linux, /usr/bin shims and distribution packages, so this port runs it inside a Podman image \(containers/xnu-linux/\) and leaves the host untouched. The alternative, Allenwdk/xnu-linux-toolchain, uses the system clang with portable-kalloc-type-builtins.patch and cctools-port, but needs a path-layout adapter for the driver's checks.
|
||||
- The first flashed build hung on hardware with the entry probe's blue bar and no magenta bar. The cause was a defconfig override, not the kernel sources: CONFIG\_XNU\_NATIVE\_ARCH\_TIMER=n. build-xnu-4k-baseline.sh sets NATIVE\_ARCH\_TIMER=$&\#123;XNU\_NATIVE\_ARCH\_TIMER:-$&\#123;XNU\_ARMCPU:-0&\#125;&\#125;, so the legacy build ran with 1; at 0, architectural-timer-entry.patch compiles the BCM2837 local interrupt router write \(0x40000040 + cpu\*4, Raspberry Pi local peripherals\) into start.s. SDM710 has nothing at that address, and the store aborts before the MMU is on. The defconfig now leaves the ARM64 profile value \(y\) alone and documents why.
|
||||
- Diagnosis method worth repeating: the legacy kernel from payload-full.img boots with this repository's new UniXNU.efi, DarwinBoot.efi and DTS-generated ADT \(it reaches \_sleh\_irq and panics on the known early timer PPI\), so the EFI side and the ADT are sound and the regression is in the kernel build. Comparing the two kernels' start\_first\_cpu bodies then showed the extra router write as the only semantic difference.
|
||||
- With the timer override removed the Linux-built kernel boots past the MMU on hardware: the boot-progress panel reports TOPO boot=0 max=7 nums=01234567, the console reaches IOKit \(PE\_init\_iokit, IONVRAM initImageFormat\) and then the CPU takes an IRQ it cannot dispatch. lr 0xfffffff00741754c is \_sleh\_irq+0x70, the same NULL per-CPU handler the legacy kernel hit.
|
||||
- That IRQ is DarwinBoot's early timer PPI. GIC\_SGI\_PPI\_ENABLE included bit 19, so the EL1 virtual timer fired before ArmCpu::start installed the handler. DarwinBoot now enables SGIs 0..15 only and leaves INTID 19 to ArmCpu \(armcpu-timer-intid=19\), which is what the handoff's next step asked for.
|
||||
- With the timer PPI left to ArmCpu the next stop was AppleARMPlatform's CPU class: it matches cpu0..cpu7 because IODTPlatformExpert compares IONameMatch by prefix \('cpu' matches 'cpu0'\), starts first, and panics with 'CPU configuration in device tree is invalid' \(its AppleARMCPU.cpp validates max\_cpus, cpu-id, interrupts and function-\* properties that an Apple device tree carries\). The native ArmCpu personality \(IOPlatformDevice, probe score 2000\) did not win that match even after probe\(\) added 40000, so make-uboot-payload.py rewrites the AppleARMCPU IONameMatch from cpu to xpu in the personality plist inside kernel.macho \(equal length, nothing moves\).
|
||||
- A frozen panel is not proof of a hang: the panel repaints from the timer interrupt, so before ArmCpu enables the timer PPI the last painted second stays on screen while the kernel may still be running. Checkpoints \(armcpu-panic=N, panics at entry/prepareGic/registration/controller/initCPU/registerService\) are what distinguish the two.
|
||||
- ArmCpu::start then failed inside initDistributor: it re-ran the quiesce sequence \(GICD\_CTLR &= \~3, wait, restore with ARE\) over the state DarwinBoot had already programmed, which clears the group enables and leaves the core with no interrupts at all; the boot then sits in IOKit matching with a frozen panel. The fix keeps the firmware state when GICD\_CTLR already reports affinity routing plus group 1 and only quiesces the SPIs. After it the panel advances \(time=31s, IRQ=1076\) and the kernel reaches bsd\_init with TOPO boot=0 max=7, PROBE calls=17 acc=8 num=7 reg=700 - eight CPUs online.
|
||||
- The next blocker is AMFI: 'AMFI: No PMGR?' @ConfigurationSettings.cpp:235. The unchanged target AMFI finds the PMGR through IOService::serviceMatching\("ApplePMGRNub"\) + waitForMatchingService, then reads the provider at nub+0x88 and calls its readAon/writeAon slots \(OR bit 2\). The original classes are ApplePMGR \(storage 0x4b8a8\) and ApplePMGRNub \(0x740\); UniXNU/scripts/audit-amfi-pmgr-contract.py pins the exact instructions. amfi\_get\_out\_of\_my\_way=1 does not skip the check. Two routes remain: instantiate the original classes the way UniXNU-sheng does \(OSKextLoadKextWithIdentifier + a generated OriginalPMGRABI.h + a published nub\), or patch the AMFI block in the prelinked kernel.
|
||||
- AMFI is cleared without touching the target kernel: the nub helpers behind AMFI's readAon/writeAon return 0 when the provider stored at nub+0x88 is NULL, so publishing a real but provider-less ApplePMGRNub satisfies the latch \(read 0, OR 4, write no-op\). package/SiriusPmgr.cpp allocates the class through OSMetaClass::getMetaClassWithName + alloc + init, attaches it to the platform and registers it from the sheng\_pmgr\_run hook in bsd\_init \(CONFIG\_XNU\_SHENG\_PMGR=1, sheng-pmgr=2\), and its build script writes the archive to build/sheng-platform-power/libShengPlatformPower.a because build-xnu-4k-baseline.sh force-loads exactly that path.
|
||||
- With AMFI satisfied the boot passes bsd\_init and stops at 'Failed to mount root device' @IOKitBSDInit.cpp:984 with 8 CPUs, IRQ=2145, 61 s of live uptime: the kernel now runs to the point where it needs a storage driver and a root filesystem, which this board does not have yet \(no UFS or VirtIO block component, no APFS container on the payload volume\).
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The kernel prelinks against the pinned 21H461 kernelcache, the payload contains the kernel, the ADT and the DarwinBoot driver, and the flashed volume boots from U-Boot.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The kernel step needs macOS and Xcode, or the container image with UniXNU's Linux toolchain; the board script must be re-based on the upstream script when UniXNU changes it.
|
||||
|
||||
### Next action
|
||||
|
||||
- Run the new payload once and diff the generated ADT against the legacy one before flashing.
|
||||
- Boot the prelinked kernel on the phone and record the stage rows; the build side is now reproducible on Linux \(container image, see downloads\).
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Build and deploy loop, the CI kernel artifact and the payload layout on the vendor partition.](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/docs/HANDOFF.zh-CN.md)
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The panel and the serial console are the two evidence channels; there is no storage for logs yet.
|
||||
|
||||
### Configuration
|
||||
|
||||
- panic\_screen = true patches the entry probe and the panic screen into the payload kernel.
|
||||
- boot-progress=2 draws the kernel console lines; debug=0x14e keeps the debug output on.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Record the last checkpoint printed on the panel and in the U-Boot/XNU log for every boot, with the kernel and payload hashes of that run.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Stage bands \(entry, pre-MMU, panic\) and the TOPO/PROBE/MEM rows replaced the LED and UART guessing of earlier bring-up.
|
||||
- A panic snapshot forces a panel re-render at panic time; before it, rows could show a stale frame.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each claimed milestone has a reproducible command, a matching source and image revision and an accessible result.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No persistent log capture: the evidence lives in photographs of the panel and in the run's hashes.
|
||||
|
||||
### Next action
|
||||
|
||||
- Add the boot row and hash triple to every hardware result recorded here.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [Entry probe, panic screen, panel rows and the evidence convention of the port.](https://github.com/57UU/UniXNU-sirius/blob/e51069a970f81a3c48588041a0caa3087a1ebbbc/docs/HANDOFF.zh-CN.md)
|
||||
|
||||
</div>
|
||||
+561
-20
@@ -1,30 +1,571 @@
|
||||
# Samsung Galaxy Tab S7 FE Wi-Fi (SM-T733)
|
||||
# Samsung Galaxy Tab S7 FE Wi-Fi \(SM-T733\)
|
||||
|
||||
A community-maintained port for SM7325. Current results are based on the maintainer records at the revisions linked below.
|
||||
[RigoLigoRLC/unixnu-sm-t733](https://github.com/RigoLigoRLC/unixnu-sm-t733)
|
||||
|
||||
| Repository | Maintainer |
|
||||
<div v-pre>
|
||||
|
||||
Samsung SM-T733 format 2 baseline48f records eight CPUs, UFS, CPU display and touch. A642L driver and Turnip tooling compiled and deployed as49h with verbose diagnostics; GPU hardware execution remains pending. The49g IODT interrupt-parent panic is addressed by emitting AAPL,phandle in the shared converter.
|
||||
|
||||
Source record: [porting.toml](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/porting.toml), `7ec704db1f60d99ea8606aabada919ed2dcbae1b`.
|
||||
|
||||
This page is generated from the device record.
|
||||
|
||||
| Area | Status |
|
||||
| --- | --- |
|
||||
| [unixnu-sm-t733](https://github.com/RigoLigoRLC/unixnu-sm-t733) | [RigoLigoRLC](https://github.com/RigoLigoRLC) |
|
||||
| [unixnu-nativeufs](https://github.com/RigoLigoRLC/unixnu-nativeufs) | [RigoLigoRLC](https://github.com/RigoLigoRLC) |
|
||||
| [unixnu-nativemobiledisplay](https://github.com/RigoLigoRLC/unixnu-nativemobiledisplay) | [RigoLigoRLC](https://github.com/RigoLigoRLC) |
|
||||
| [unixnu-nativeramblock](https://github.com/RigoLigoRLC/unixnu-nativeramblock) | [RigoLigoRLC](https://github.com/RigoLigoRLC) |
|
||||
| [unixnu-nativefocaltechtouch](https://github.com/RigoLigoRLC/unixnu-nativefocaltechtouch) | [RigoLigoRLC](https://github.com/RigoLigoRLC) |
|
||||
| [unixnu-sm7325-common](https://github.com/RigoLigoRLC/unixnu-sm7325-common) | [RigoLigoRLC](https://github.com/RigoLigoRLC) |
|
||||
| [unixnu-adreno6xx](https://github.com/RigoLigoRLC/unixnu-adreno6xx) | [RigoLigoRLC](https://github.com/RigoLigoRLC) |
|
||||
| [Configuration](#configuration) | `implemented` |
|
||||
| [Firmware and boot](#firmware) | `implemented` |
|
||||
| [CPU and interrupts](#cpu) | `implemented` |
|
||||
| [Memory and DMA](#memory) | `implemented` |
|
||||
| [Storage and root](#storage) | `implemented` |
|
||||
| [Display](#display) | `implemented` |
|
||||
| [Input](#input) | `implemented` |
|
||||
| [GPU](#gpu) | `implemented` |
|
||||
| [Network](#network) | `implemented` |
|
||||
| [Audio](#audio) | `planned` |
|
||||
| [Power](#power) | `implemented` |
|
||||
| [Image assembly](#packaging) | `implemented` |
|
||||
| [Diagnostics](#diagnostics) | `implemented` |
|
||||
|
||||
## State
|
||||
## Configuration {#configuration}
|
||||
|
||||
The format 2 system reaches the desktop on eight CPUs with UFS, a 96 GiB persistent Data volume and CPU framebuffer rendering. FT8203 touch, physical power/volume keys, brightness, display off/on and shutdown have device results. The SM5714 gauge reports battery state and charger changes.
|
||||
`implemented`
|
||||
|
||||
USB diagnostics include logs, stack capture, ECM and native debugserver capture/detach. MSC updates the FAT payload while preserving OS/SystemOS and Data. The A642L backend and Turnip tools are in source development; GPU UI acceleration, wireless, audio and system suspend remain pending.
|
||||
Components: `ArmDTPlatform`, `device`.
|
||||
|
||||
## Sources
|
||||
### Hardware and dependencies
|
||||
|
||||
- [README: RigoLigoRLC/unixnu-sm-t733](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/README.md)
|
||||
- SM-T733 uses the SM7325 profile and the iPad7,1 21H461 restore inputs.
|
||||
- The device's 14 driver and kit submodules retain their community repositories and adaptation revisions.
|
||||
|
||||
## Use this port
|
||||
### Configuration
|
||||
|
||||
1. Read the repository build instructions and pinned records. Prepare its firmware, system images and board inputs.
|
||||
2. Build with that repository's commands. Use [Build and boot](/building) for common configuration.
|
||||
3. Follow the [bring-up order](/porting/bring-up) and save results through [log capture](/porting/log-capture).
|
||||
4. Update the [porting record](/porting/records) with the source revisions and last confirmed stage.
|
||||
- Both boards select schema\_version 2, sm7325 and ipados-17.7.11-21H461.
|
||||
- The component list and archive list are complete arrays; device components.toml supplies community identities and board-specific recipes.
|
||||
- Public payload.adt.chip\_id is hexadecimal 733; private local.toml hardware.unique\_chip\_id enters the official UNIXNU\_UNIQUE\_CHIP\_ID environment variable.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Run bash scripts/build.sh TAG for the system configuration or add --platform for the platform configuration.
|
||||
- The official driver resolves output paths from the selected OS profile and defconfig.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Format 2 arrays replace inherited arrays, so every selected component, configuration fragment, patch series and archive remains explicit.
|
||||
- The SM7325 profile owns common CPU, interrupt, timer, PSCI and UFS facts; the device owns memory span, identity and board policies.
|
||||
- system-format2-48f completed configure, resolve, kernel, menu, wallpaper, debug-tools and payload with exit code 0.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The selected components and source revisions resolve and the unified build produces the requested payload.
|
||||
|
||||
### Current limits
|
||||
|
||||
- The format 2 observations cover the recorded eight-core, UFS, display and touch boot activity; other hardware observations retain their earlier build TAGs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record subsequent system operations under the current build TAG.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The system board selects all four configuration layers and the complete component and archive lists.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/board.toml)
|
||||
- `source`: [The delivery record names the seven successful stages, FAT deployment and specific USB boot observations for 48f.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/docs/archive/FORMAT2_2026-10-25.md)
|
||||
|
||||
## Firmware and boot {#firmware}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `DarwinBoot`, `EarlyEntry`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- Samsung bootloader is unlocked; BOOT/recovery use memory-input-display-46.
|
||||
- DarwinBoot receives the actual UEFI memory map, framebuffer and loaded sidecar addresses.
|
||||
|
||||
### Configuration
|
||||
|
||||
- gts7fewifi.dsc supplies the Samsung firmware package and userdata payload driver.
|
||||
- The normal system menu entry is Boot UniXNU.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Use the device build entry with --firmware when firmware source changes require a matching image.
|
||||
- Ordinary system updates write only the userdata FAT and restart the firmware.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The 47a runtime reaches the Apple logo, lock screen and USB with the existing 46 firmware.
|
||||
- 48f also booted with the existing 46 firmware and produced its own USB record.
|
||||
- The firmware's actual conventional-memory allocations define BootArgs memory ownership.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Firmware enters the menu, loads the payload and publishes the inherited framebuffer and UEFI reservations.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Samsung recovery and PARAM handling remain device-specific.
|
||||
|
||||
### Next action
|
||||
|
||||
- Retain the existing firmware and record any new firmware-dependent behavior with its build TAG.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [DarwinBoot implements the UEFI allocation and XNU handoff used by the current device build.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/drivers/DarwinBoot/DarwinBootPkg/Driver/DarwinBoot.c)
|
||||
|
||||
## CPU and interrupts {#cpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `ArmCpu`, `NativeQcomTsens`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- CPU affinities are 0 through 0x700 in 0x100 steps.
|
||||
- GIC distributor is 0x17a00000; redistributors begin at 0x17a60000 with 0x20000 stride; the architectural counter is 19.2 MHz.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The SM7325 DTSI records four efficiency cores, three performance cores and one highest-performance core across three scheduler clusters.
|
||||
- The current CPU power code reads the three hardware EPSS LUTs and the 27 TSENS channels.
|
||||
|
||||
### Procedure
|
||||
|
||||
- The kernel build applies the SM7325 startup and scheduler patches before generating compiler records.
|
||||
- build-cpu-power.py compiles the scheduler adapter, EPSS policy and TSENS reader from those records.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The 45f runtime started all eight CPUs, used three Edge scheduler clusters and registered perfcontrol.
|
||||
- The 48f USB record confirms all eight CPUs online=1 with fail=0.
|
||||
- Thermal policy uses the actual stock sensor groups and EPSS rows.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All enabled CPUs start, timer/IPI delivery works and policy chooses hardware LUT rows for each frequency domain.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Format 2 must preserve the cluster-type, die-cluster-id and cluster-core-id properties consumed by XNU.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record further scheduler and thermal observations under the current build TAG.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The board implementation reads EPSS frequency domains and applies scheduler demand to hardware rows.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/package/T733CpuPower.cpp)
|
||||
|
||||
## Memory and DMA {#memory}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The device DRAM address span is 0x80000000 through 0x200000000 and contains reserved holes.
|
||||
- UEFI conventional-memory ranges exclude firmware, TZ, framebuffer and DMA reservations.
|
||||
|
||||
### Configuration
|
||||
|
||||
- payload.adt.owned\_memory\_size remains auto.
|
||||
- The shared converter emits darwinboot-memory-range with a 1 GiB minimum and the existing 2 MiB-aligned maximum.
|
||||
|
||||
### Procedure
|
||||
|
||||
- DarwinBoot chooses a real contiguous UEFI allocation, then reports the successful base and size in BootArgs.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The 46b runtime reported 4548722688 bytes of XNU-managed memory, approximately 4.236 GiB; 48f has no separate LLDB memory probe.
|
||||
- The 6 GiB physical capacity is a DRAM span input; reservations and contiguous allocation still determine XNU ownership.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The owned window fits one successful UEFI allocation and preserves every reserved range.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Available contiguous memory depends on the live UEFI memory map.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the actual allocated range during the format 2 boot.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The board supplies the physical span while retaining automatic conventional-memory allocation.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/dts/board.dts)
|
||||
|
||||
## Storage and root {#storage}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `NativeUfs`, `NativeRamBlock`, `SoftwareAES`, `VirtioMmioBlock`, `VerifiedRoot`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM7325 UFS MMIO is 0x01d84000, SMMU MMIO is 0x15000000, stream ID is 0x80 and GIC INTID is 297.
|
||||
- USERDATA LBAs are 2320896 through 31099898 with 4096-byte sectors.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The NativeUfs community component retains its native-ufs-smmu-reg, native-ufs-stream-id and native-ufs-interrupt ABI.
|
||||
- The Data UUID remains 09A342FC-CB72-44DE-A10E-B89F14508869; its logical size remains 103079215104 bytes.
|
||||
- VirtioMmioBlock supplies storage ABI declarations to the existing archive builder.
|
||||
|
||||
### Procedure
|
||||
|
||||
- The ordered archive plan builds verified-root policies, original AES bindings, NativeUfs and NativeRamBlock before final kernel linking.
|
||||
- Ordinary deployment replaces the 512 MiB FAT at userdata offset 9382658048 and preserves the existing Data location and seed.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The 45f runtime completed 1213669 UFS requests with zero failures or timeouts and peak queue depth 16.
|
||||
- The 48f USB record shows 300788 completed UFS requests, failed=0, both timeout counts 0 and peak queue depth 14.
|
||||
- The existing Data implementation persists changes across ordinary FAT updates.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- UFS publishes the signed OS/SystemOS windows, root mounts, launchd starts and Data writes survive reboot at the fixed offset.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Install / erase Data intentionally initializes the fixed Data region and requires the explicit menu action.
|
||||
|
||||
### Next action
|
||||
|
||||
- Retain the layout and associate further storage activity with its build TAG.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The committed layout fixes the 512 MiB FAT and 96 GiB Data positions and UUID.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/package/data-layout.toml)
|
||||
|
||||
## Display {#display}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `NativeMobileDisplay`, `NativeGeniI2c`, `NativeQcomDsi`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- UEFI leaves the panel, DSI PHY and video scanout running.
|
||||
- The original 21H461 AppleARMBacklight and MobileFramebuffer classes supply the runtime ABI.
|
||||
|
||||
### Configuration
|
||||
|
||||
- Software rendering and CPU framebuffer copies remain enabled.
|
||||
- The current payload retains the CoreGraphics and CoreUI text fixups, framebuffer write-combine and display binding arguments.
|
||||
|
||||
### Procedure
|
||||
|
||||
- build-software-display.py emits original ABI bindings and the software display archive.
|
||||
- The board display coordinator sends DSI commands and controls panel power through the existing I2C resources.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The 46l runtime's backlight control and normal shutdown were confirmed by the user.
|
||||
- The 47a runtime reaches the graphical lock screen with CPU rendering.
|
||||
- The 48f USB record reports display ready=1 and awake=1 with continuing CPU display frames.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Frames have correct geometry and colors, userland presentation advances and brightness/shutdown controls work.
|
||||
|
||||
### Current limits
|
||||
|
||||
- GPU acceleration is a separate hardware implementation stage.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record subsequent brightness and presentation operations with the current build TAG.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The board coordinates current panel power, brightness and DSI command operations.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/package/T733Display/DisplayPower.cpp)
|
||||
|
||||
## Input {#input}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `NativeFocaltechTouch`, `NativeGeniSpi`, `NativeQcomSpmi`, `NativePmicKeys`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The touch controller is FT8203 on GENI SPI and uses GPIO81.
|
||||
- PM7325 supplies the power, volume-down and volume-up inputs through SPMI arbiter v5.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The board touch HID descriptor retains multitouch IDs and grouped digitizer dispatch.
|
||||
- The original button ADT names remain hold, voldown and volup.
|
||||
|
||||
### Procedure
|
||||
|
||||
- The touch archive compiles the FT8203 protocol, GENI SPI transport and original IOHIDDevice subclass.
|
||||
- The PMIC archive compiles the SPMI controller, key protocol and board Consumer Control subclass.
|
||||
|
||||
### Development findings
|
||||
|
||||
- Earlier runtime records contain complete power/volume DOWN and UP events.
|
||||
- The 48f USB record contains continuing touch DOWN/UP events.
|
||||
- The TLMM owner services registered GPIO sources and the PMIC transport preserves inherited hardware reset policy.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Touch coordinates and contact releases arrive, and all three physical buttons produce press/release HID reports.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Firmware and board electrical routing remain SM-T733 inputs.
|
||||
|
||||
### Next action
|
||||
|
||||
- Associate further touch and physical-button operations with the current build TAG.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The board binds the PMIC resources to the existing key and HID drivers.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/package/T733PmicKeys.cpp)
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `Adreno6xx`, `ArmSmmu4K`, `AdrenoPM4`, `AdrenoFirmware`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM7325 A642L chip ID 0x06030500, 512 KiB GMEM and A660 GMU/SQE/ZAP inputs.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The independent Adreno6xx archive is force-loaded with native-adreno-a6xx=1.
|
||||
- GPU classes register after IOBSD; screen and early diagnostics are enabled.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Initialize live command-db votes, clocks, GPU/GMU SMMU and HFI, then require CP fence and GPU memory readback before publication.
|
||||
- Run the raw ABI command followed by Turnip fill, compute and triangle readback.
|
||||
|
||||
### Development findings
|
||||
|
||||
- 49h completed eight build stages and its FAT was written and synced; GPU runtime results are pending.
|
||||
- 49g panicked in IODTGetICellCounts because interrupt-parent resolution requires AAPL,phandle;49h includes the shared converter correction.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Actual A642L submissions and rendering succeed before enabling system Metal composition and direct DPU scanout.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No successful A642L GPU hardware execution has been recorded.
|
||||
- Final display presentation uses GPU-rendered surfaces directly; framebuffer copies remain a diagnostic fallback.
|
||||
|
||||
### Next action
|
||||
|
||||
- Collect 49h screen and USB initialization results.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The component is compiled into a dedicated archive with deferred IOKit constructors; hardware execution remains pending.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/scripts/build-adreno6xx.py)
|
||||
|
||||
## Network {#network}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `NativeUsbNetwork`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The DWC3 device transport supplies the current USB ECM link.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The system archive plan includes NativeUsbNetwork and retains native-usb-debug=1.
|
||||
|
||||
### Procedure
|
||||
|
||||
- The existing USB implementation exposes ECM and the XNU ifnet adapter exchanges frames with the host.
|
||||
- Pairing and RSD setup use the native iOS diagnostics tool when required.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The current ECM connection supports native debugserver capture and detach.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The host connects through ECM and completes the requested native diagnostics session.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Wi-Fi transport is pending; this area records the implemented USB network.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the USB network connection after the format 2 boot.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The board's XNU ifnet adapter implements the existing USB network transport.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/drivers/NativeUsbNetwork/native_usb_network.c)
|
||||
|
||||
## Audio {#audio}
|
||||
|
||||
`planned`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- SM-T733 audio requires its ADSP, transport, codec and board routes.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The current component list selects the implemented CPU, storage, display, input, power and USB services.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Inventory the stock audio paths and firmware before adding an audio component.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The current working baseline reaches the graphical interface without an implemented audio route.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Each implemented playback or capture route carries its declared audio format and handles start/stop.
|
||||
|
||||
### Current limits
|
||||
|
||||
- No audio playback or capture support is claimed.
|
||||
|
||||
### Next action
|
||||
|
||||
- Implement audio after its hardware and firmware dependencies are collected.
|
||||
|
||||
### Evidence
|
||||
|
||||
Collect evidence using the next action.
|
||||
|
||||
## Power {#power}
|
||||
|
||||
`implemented`
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The board uses the SM5714 fuel gauge, TLMM GPIO54 notification and existing panel power resources.
|
||||
- CPU demand and temperature policy use EPSS and TSENS hardware.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The current battery, CPU DVFS, display power and managed-memory arguments remain enabled.
|
||||
- The system archive plan retains platform power, battery, thermal and display power ordering.
|
||||
|
||||
### Procedure
|
||||
|
||||
- The battery worker reads the fuel gauge and publishes the original IOPMPowerSource properties.
|
||||
- The platform shutdown implementation powers down the panel and invokes the existing firmware/PMIC path.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The 46l runtime's normal shutdown and brightness control were confirmed by the user.
|
||||
- The implemented battery service reports readings from the actual device resources.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- Battery readings and charging changes update, brightness control works and normal shutdown completes.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Suspend/resume requires separate implementation and runtime evidence.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record the power services after the format 2 boot.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The existing board battery service connects gauge readings and GPIO updates to IOPMPowerSource.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/package/T733Battery.cpp)
|
||||
|
||||
## Image assembly {#packaging}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `NativePrelink`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- The system payload contains the original Apple inputs, kernel, ADT, fixed Data seed and board addon files.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The payload remains a 512 MiB FAT with the existing menu, binary text replacements and root UUID.
|
||||
- The platform configuration retains its 64 MiB diagnostic payload.
|
||||
|
||||
### Procedure
|
||||
|
||||
- The official kernel builder owns prelinking; the unified device entry owns the dependent kernel, package and payload stages.
|
||||
- The coordinating agent deploys the complete resulting FAT with the existing MSC writer.
|
||||
|
||||
### Development findings
|
||||
|
||||
- 48f completed all seven build stages, a full 536870912-byte FAT write and sync, followed by a USB boot record identifying its TAG.
|
||||
- Format 2 output directories include the OS profile and selected defconfig; build.py reads status --json output before copying artifacts.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- All stages finish and the selected output contains a complete deployable payload for its TAG.
|
||||
|
||||
### Current limits
|
||||
|
||||
- Deployment only replaces the ordinary FAT window; Data is preserved.
|
||||
|
||||
### Next action
|
||||
|
||||
- Keep the delivered package and associate further runtime observations with system-format2-48f.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The device entry drives the official build stages and obtains the resolved output directory.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/scripts/build.py)
|
||||
- `source`: [The recorded stage table, complete MSC write and USB boot observation identify the 48f delivery.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/docs/archive/FORMAT2_2026-10-25.md)
|
||||
|
||||
## Diagnostics {#diagnostics}
|
||||
|
||||
`implemented`
|
||||
|
||||
Components: `NativeUsbDebug`.
|
||||
|
||||
### Hardware and dependencies
|
||||
|
||||
- USB logging remains enabled, including the original opaque USB resource property in /chosen.
|
||||
- Native debugserver provides one attach session per normal boot.
|
||||
|
||||
### Configuration
|
||||
|
||||
- The selected patch list includes process, page-table and SMP diagnostics.
|
||||
- Early framebuffer markers and regular screen startup logs remain disabled in the current normal configuration.
|
||||
|
||||
### Procedure
|
||||
|
||||
- Collect USB logs with the existing console tools.
|
||||
- Prepare symbols before a native attach, perform short reads, then continue and detach.
|
||||
|
||||
### Development findings
|
||||
|
||||
- The 47a debugger entry records reason and caller before parsing the optional panic argument.
|
||||
- Native debugserver capture and detach have completed on the device.
|
||||
- 48f USB raw logs identify the current build and capture CPU, UFS, display and touch observations.
|
||||
|
||||
### Completion criteria
|
||||
|
||||
- The build's selected patch list matches the delivered kernel and the requested logs or native capture are recorded with the build TAG.
|
||||
|
||||
### Current limits
|
||||
|
||||
- A new native debugserver session requires a normal reboot after the prior session is consumed.
|
||||
|
||||
### Next action
|
||||
|
||||
- Record further requested diagnostics with the current build TAG and its actual capture method.
|
||||
|
||||
### Evidence
|
||||
|
||||
- `source`: [The selected debugger patch preserves the 47a null-panic handling and entry-state records.](https://github.com/RigoLigoRLC/unixnu-sm-t733/blob/7ec704db1f60d99ea8606aabada919ed2dcbae1b/patches/t733-xnu/native-debugger-entry-state.patch)
|
||||
|
||||
</div>
|
||||
@@ -0,0 +1,5 @@
|
||||
# Xiaomi Redmi Note 10 Pro \(zeroninevibedslop\)
|
||||
|
||||
[zeroninevibedslop/UniXNU-sweet](https://github.com/zeroninevibedslop/UniXNU-sweet)
|
||||
|
||||
Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.
|
||||
@@ -0,0 +1 @@
|
||||
[Coryyi/UniXNU-thyme](https://github.com/Coryyi/UniXNU-thyme)
|
||||
@@ -0,0 +1 @@
|
||||
[wuhaoran956-cyber/UniXNU-uke](https://github.com/wuhaoran956-cyber/UniXNU-uke)
|
||||
@@ -0,0 +1 @@
|
||||
[mouya-q/UniXNU-umi](https://github.com/mouya-q/UniXNU-umi)
|
||||
@@ -0,0 +1 @@
|
||||
[xyyyds0106/UniXNU-vermeer](https://github.com/xyyyds0106/UniXNU-vermeer)
|
||||
@@ -0,0 +1 @@
|
||||
[yyx2025/UniXNU-vermeer](https://github.com/yyx2025/UniXNU-vermeer)
|
||||
@@ -113,12 +113,11 @@ Assign each area its supported [completion level](/porting/records#completion-le
|
||||
[github.com/topics/unixnu](https://github.com/topics/unixnu).
|
||||
4. Confirm the porting-record workflow passes on the published commit. Official
|
||||
device branches require its `Porting record` check.
|
||||
5. To publish the device on the central site, pin that commit in `devices.toml`,
|
||||
add the English and Chinese device pages, and link them from [Devices](/devices/).
|
||||
Follow [record publication](/porting/records#publishing-and-reuse) and
|
||||
[documentation contribution](/contributing/documentation), then run
|
||||
`npm --prefix docs run build` from UniXNU. Confirm the rendered record uses
|
||||
the published revision.
|
||||
5. Publish `board.toml` and a valid `porting.toml`. The twice-daily catalog
|
||||
workflow pins the source and generates the format 2 page and navigation.
|
||||
Follow [record publication](/porting/records#publishing-and-reuse) to request
|
||||
a scan or preview locally. Confirm the [device page](/devices/) links to the
|
||||
published revision.
|
||||
|
||||
**Result:** a published device repository with pinned sources, reproducible
|
||||
commands, a checked porting record, CI, common-guide links and the `unixnu` topic.
|
||||
|
||||
+41
-11
@@ -1,8 +1,8 @@
|
||||
# Device porting records
|
||||
|
||||
Every official device repository maintains `porting.toml`. Maintainers and
|
||||
agents use this record throughout development. The documentation site renders
|
||||
it at the device page from the revision pinned in `devices.toml`.
|
||||
Format 2 device repositories maintain `porting.toml`. Maintainers and agents
|
||||
update this record throughout development. The documentation site generates
|
||||
device pages from its pinned source snapshots.
|
||||
|
||||
## Procedure {#procedure}
|
||||
|
||||
@@ -10,7 +10,7 @@ it at the device page from the revision pinned in `devices.toml`.
|
||||
2. Fill each [required area](#required-areas) using the [record fields](#record-format). Include selected components, board-package code, inputs and ordered operations.
|
||||
3. Assign a [completion level](#completion-levels) supported by the source, host or device evidence. Record missing inputs and the next concrete action.
|
||||
4. Run the checker in [Change workflow](#change-workflow). Resolve the reported identity, coverage and evidence errors.
|
||||
5. Publish the device commit and follow [Publishing and reuse](#publishing-and-reuse) to update `devices.toml` and preview the site. Confirm the rendered record uses that revision.
|
||||
5. Publish the device commit and follow [Publishing and reuse](#publishing-and-reuse). Confirm the generated page links to the published revision.
|
||||
|
||||
## Required areas
|
||||
|
||||
@@ -86,7 +86,7 @@ the measurement needed to resolve them in `next_action`.
|
||||
4. Update configuration, procedure and completion criteria when the interface changes.
|
||||
5. Run the record checker and the existing checks for the changed implementation.
|
||||
6. Submit code and documentation in separate commits in the same pull request.
|
||||
7. After the device change is published, update its revision in UniXNU's `devices.toml`.
|
||||
7. Publish the device change. The catalog workflow refreshes its source revision and generated page.
|
||||
|
||||
```sh
|
||||
python3 scripts/porting-record.py check --device ../UniXNU-sheng
|
||||
@@ -102,15 +102,45 @@ The device template includes `.github/workflows/porting-record.yml`. Official
|
||||
device branches require its `Porting record` check. Reviewers verify hardware
|
||||
facts, evidence quality, component reuse and the stated completion level.
|
||||
|
||||
## Publishing and reuse
|
||||
## Publishing and reuse {#publishing-and-reuse}
|
||||
|
||||
Complete the [repository publication steps](/porting/device-repository#publish),
|
||||
including the `unixnu` GitHub topic, before registering the published revision.
|
||||
including the `unixnu` GitHub topic.
|
||||
|
||||
`npm run build` fetches each registered device's pinned `porting.toml` and
|
||||
`board.toml`, checks them and renders the device page. English and Chinese
|
||||
pages consume the same record. The record body uses concise English. Site
|
||||
sources and deployment remain in UniXNU.
|
||||
The [catalog workflow](https://github.com/UniXNU/UniXNU/actions/workflows/sync-devices.yml)
|
||||
runs at 00:00 and 12:00 UTC. It searches public repositories in the UniXNU
|
||||
organization, with the `unixnu` topic, or with UniXNU in their name or description.
|
||||
It reads root `board.toml` and `porting.toml` files at a fixed commit.
|
||||
|
||||
`board.toml` uses `schema_version = 2`; the record uses `schema_version = 1`.
|
||||
The workflow checks identity, required areas, component coverage and evidence.
|
||||
Valid records generate English and Chinese pages, the device index and navigation.
|
||||
Format 2 pages with missing or invalid records link to the repository and identify
|
||||
the required record work. Existing legacy pages keep their authored content.
|
||||
New legacy entries contain a repository link.
|
||||
|
||||
`devices.toml` stores repository identities, routes and source revisions.
|
||||
`docs/.vitepress/device-records/` stores the source records. Site builds render
|
||||
these committed snapshots. Both languages use the same record text. Write the
|
||||
record in concise English. Site sources and deployment remain in UniXNU.
|
||||
|
||||
To request a scan immediately:
|
||||
|
||||
```sh
|
||||
gh workflow run sync-devices.yml --repo UniXNU/UniXNU
|
||||
```
|
||||
|
||||
To scan locally, sign in with `gh auth login` or set `GITHUB_TOKEN`, then run
|
||||
from the UniXNU checkout:
|
||||
|
||||
```sh
|
||||
python3 scripts/sync-devices.py
|
||||
npm --prefix docs run build
|
||||
```
|
||||
|
||||
The workflow builds the site before committing generated changes and publishing
|
||||
that commit through the Docs workflow. Source errors appear in the workflow
|
||||
summary. Correct the device record and publish it before the next scan.
|
||||
|
||||
For a local preview:
|
||||
|
||||
|
||||
@@ -136,6 +136,7 @@ Save the paths from [requirements](/guide/requirements) in
|
||||
[local build configuration](/reference/configuration#local-build-inputs).
|
||||
Follow [Building](/building) in order: kernel, package, firmware, payload,
|
||||
userdata when required, then boot image. Check each output before proceeding.
|
||||
For a separate UniXNU partition, follow the [partition procedure](/porting/dual-system-partition) before installing the image.
|
||||
|
||||
Follow [bring-up](/porting/bring-up) for firmware, menu, loader, kernel and root
|
||||
checkpoints. Use [boot and recovery](/guide/boot) for device commands. After
|
||||
|
||||
@@ -51,6 +51,8 @@ docs/
|
||||
|
||||
## 新增页面
|
||||
|
||||
格式 2 设备页按[记录发布](/zh/porting/records#publishing-and-reuse)生成。手写指南使用以下步骤。
|
||||
|
||||
1. 在对应章节创建 Markdown 文件。
|
||||
2. 在 `docs/.vitepress/config.mts` 的 sidebar 中加入页面。
|
||||
3. 在 `docs/zh/` 下创建中文页面，并加入中文 sidebar。
|
||||
@@ -97,9 +99,11 @@ VitePress 在内部链接断开时构建失败。
|
||||
|
||||
## 设备记录
|
||||
|
||||
站点构建需要 Python 3.11 或更新版本。`npm run build` 从 `devices.toml` 的固定版本
|
||||
获取设备记录，检查后生成页面。更新记录时修改设备仓库的 `porting.toml`，发布后更新
|
||||
注册版本。中英文设备页引用同一份记录。详见[记录指南](/zh/porting/records)。
|
||||
站点构建需要 Python 3.11 或更新版本。`npm run build` 渲染已提交的目录和记录快照。
|
||||
每天两次的目录工作流发现源码、固定版本并更新格式 2 设备页、索引和导航。
|
||||
更新设备记录时修改并发布设备仓库的 `porting.toml`，中英文页面使用同一份记录。
|
||||
已有旧格式页面保留原文，新收录的旧格式条目只包含仓库链接。
|
||||
详见[记录指南](/zh/porting/records#publishing-and-reuse)。
|
||||
|
||||
## 驱动指南
|
||||
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
# Xiaomi Redmi K40 \(alioth, M2012K11AC\) \(yang232138\)
|
||||
|
||||
[yang232138/UniXNU-alioth](https://github.com/yang232138/UniXNU-alioth)
|
||||
|
||||
在设备仓库补齐并校验 [porting.toml](/zh/porting/records)，随后生成各部分的适配记录。
|
||||
|
||||
yang232138/UniXNU-alioth: components without an area: \['AppleKeyStoreState', 'RamBlock', 'ShengUfs', 'VerifiedRoot', 'VirtioMmioBlock'\]
|
||||
@@ -1,32 +1,7 @@
|
||||
# Redmi K40（alioth）
|
||||
|
||||
SM8250-AC 社区设备移植，由 FFT-infra 维护。
|
||||
[FFT-infra/UniXNU-alioth](https://github.com/FFT-infra/UniXNU-alioth)
|
||||
|
||||
- [FFT-infra/UniXNU-alioth](https://github.com/FFT-infra/UniXNU-alioth)
|
||||
- [FFT-infra/UniXNU-sm8250-common](https://github.com/FFT-infra/UniXNU-sm8250-common)
|
||||
- [FFT-infra/uefi-alioth](https://github.com/FFT-infra/uefi-alioth)
|
||||
- [FFT-infra/UniXNU](https://github.com/FFT-infra/UniXNU)
|
||||
在设备仓库补齐并校验 [porting.toml](/zh/porting/records)，随后生成各部分的适配记录。
|
||||
|
||||
## 当前状态
|
||||
|
||||
格式 2 设备树选择共享 SM8250 支持及 iPad7,1 / iPadOS 17.7.11（21H461）。固件包含显示、按键、UFS 和 USB 集成。该布局的内核及启动镜像生成、实机验证待完成。
|
||||
|
||||
## 使用此移植
|
||||
|
||||
1. 阅读下方固定版本的源码说明和验证记录，准备该设备要求的固件和系统输入。
|
||||
2. 克隆设备仓库，在检出目录内按其构建指南准备依赖：
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/FFT-infra/UniXNU-alioth.git
|
||||
cd UniXNU-alioth
|
||||
git checkout 32988f00809d629721d69a34967a384710f929fd
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
|
||||
3. 在该版本完成对应构建后，按[启动验证顺序](/zh/porting/bring-up)验证，并按[日志抓取](/zh/porting/log-capture)保存最后确认的阶段。
|
||||
4. 将结果写入[移植记录](/zh/porting/records)。板级结构和组件选择见[移植设备](/zh/porting/steps)。
|
||||
|
||||
## 来源
|
||||
|
||||
- [板级配置: FFT-infra/UniXNU-alioth](https://github.com/FFT-infra/UniXNU-alioth/blob/edb4f63f42e75d1f855943d7a58cc7c55ee21327/board.toml)
|
||||
- [fjcx555/UniXNU-alioth](https://github.com/fjcx555/UniXNU-alioth)
|
||||
FFT-infra/UniXNU-alioth: components without an area: \['AppleKeyStoreState', 'RamBlock', 'ShengUfs', 'VerifiedRoot', 'VirtioMmioBlock'\]
|
||||
@@ -0,0 +1 @@
|
||||
[BluedMC-Amethyst/UniXNU-amethyst](https://github.com/BluedMC-Amethyst/UniXNU-amethyst)
|
||||
@@ -1,30 +1,5 @@
|
||||
# Redmi Note 10 5G（camellia）
|
||||
|
||||
MT6833 社区设备移植。
|
||||
[stanveyjiang/UniXNU-camellia](https://github.com/stanveyjiang/UniXNU-camellia)
|
||||
|
||||
- [stanveyjiang/UniXNU-camellia](https://github.com/stanveyjiang/UniXNU-camellia)
|
||||
|
||||
## 当前状态
|
||||
|
||||
板级仓库提供 MT6833 早期启动所需的 bootstrap defconfig、iPadOS 17.7.11 身份、预链接根和诊断包，内核配方复用共享预链接与诊断工具。
|
||||
|
||||
目标固件、原生存储、显示、输入、GPU 和电源集成仍需各自的构建及设备记录。bootstrap 内核输入按设备 README 准备。
|
||||
|
||||
## 使用此移植
|
||||
|
||||
1. 阅读下方固定版本的说明和记录，准备对应的固件、系统输入与构建工具。
|
||||
2. 克隆设备源码，并按其 README 准备匹配的主仓库和固件源码：
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/stanveyjiang/UniXNU-camellia.git
|
||||
cd UniXNU-camellia
|
||||
git checkout 7b83a3b41e4ae906130837cac37fdd718a258e4b
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
|
||||
3. 在该版本说明指定的工作目录执行构建，核对其记录的输出和未完成输入。
|
||||
4. 按[启动验证顺序](/zh/porting/bring-up)逐项确认，通过[日志抓取](/zh/porting/log-capture)保存结果，并填写[适配记录](/zh/porting/records)。板级结构和组件选择见[移植步骤](/zh/porting/steps)。
|
||||
|
||||
## 来源
|
||||
|
||||
- [README: stanveyjiang/UniXNU-camellia](https://github.com/stanveyjiang/UniXNU-camellia/blob/7b83a3b41e4ae906130837cac37fdd718a258e4b/README.md)
|
||||
在设备仓库补齐并校验 [porting.toml](/zh/porting/records)，随后生成各部分的适配记录。
|
||||
@@ -0,0 +1 @@
|
||||
[pxl777806/UniXNU-cas](https://github.com/pxl777806/UniXNU-cas)
|
||||
@@ -0,0 +1 @@
|
||||
[lss717/UniXNU-cheeseburger](https://github.com/lss717/UniXNU-cheeseburger)
|
||||
@@ -0,0 +1 @@
|
||||
[maozedongae/UniXNU-cheeseburger](https://github.com/maozedongae/UniXNU-cheeseburger)
|
||||
@@ -0,0 +1 @@
|
||||
[sbccc1888/ios-party](https://github.com/sbccc1888/ios-party)
|
||||
@@ -0,0 +1 @@
|
||||
[lateautumn233/UniXNU-droidvm](https://github.com/lateautumn233/UniXNU-droidvm)
|
||||
@@ -0,0 +1 @@
|
||||
[Neko17awa/UniXNU-droidvm](https://github.com/Neko17awa/UniXNU-droidvm)
|
||||
+2
-29
@@ -1,32 +1,5 @@
|
||||
# Rongyue E5（e5）
|
||||
|
||||
UMS9621 社区设备移植。
|
||||
[Enceka/UniXNU-e5](https://github.com/Enceka/UniXNU-e5)
|
||||
|
||||
- [Enceka/UniXNU-e5](https://github.com/Enceka/UniXNU-e5)
|
||||
- [Enceka/unixnu-ums9621](https://github.com/Enceka/unixnu-ums9621)
|
||||
- [Enceka/unixnu-e5-kernel-builder](https://github.com/Enceka/unixnu-e5-kernel-builder)
|
||||
|
||||
## 当前状态
|
||||
|
||||
格式 2 板级选择共享 UMS9621 支持、ArmDTPlatform、ArmCpu 和内存块设备。源码描述八个 Cortex-A53 核、GICv3、PSCI SMC 和 26 MHz 定时器，早期入口和 MMU 切换探针正在开发。
|
||||
|
||||
使用该板的 UEFI/DarwinBoot 路径及固定版本的 SoC feed。存储、显示、输入和持续 XNU 执行仍需设备验证。
|
||||
|
||||
## 使用此移植
|
||||
|
||||
1. 阅读下方固定版本的说明和记录，准备对应的固件、系统输入与构建工具。
|
||||
2. 克隆设备源码，并按其 README 准备匹配的主仓库和固件源码：
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/Enceka/UniXNU-e5.git
|
||||
cd UniXNU-e5
|
||||
git checkout b73c144ecb19c07e287f7a5c59ebcd7c72edfefa
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
|
||||
3. 在该版本说明指定的工作目录执行构建，核对其记录的输出和未完成输入。
|
||||
4. 按[启动验证顺序](/zh/porting/bring-up)逐项确认，通过[日志抓取](/zh/porting/log-capture)保存结果，并填写[适配记录](/zh/porting/records)。板级结构和组件选择见[移植步骤](/zh/porting/steps)。
|
||||
|
||||
## 来源
|
||||
|
||||
- [README: Enceka/UniXNU-e5](https://github.com/Enceka/UniXNU-e5/blob/b73c144ecb19c07e287f7a5c59ebcd7c72edfefa/README.md)
|
||||
在设备仓库补齐并校验 [porting.toml](/zh/porting/records)，随后生成各部分的适配记录。
|
||||
+676
-19
@@ -1,31 +1,688 @@
|
||||
# 联想拯救者 Y700 四代（elden）
|
||||
|
||||
SM8750P 社区设备移植，由 jerry-2009 维护。
|
||||
[jerry-2009/UNIXNU_elden](https://github.com/jerry-2009/UNIXNU_elden)
|
||||
|
||||
- [jerry-2009/UNIXNU_elden](https://github.com/jerry-2009/UNIXNU_elden)
|
||||
<div v-pre>
|
||||
|
||||
## 当前状态
|
||||
Lenovo Legion Y700 Gen 4 format 2 migration. Phase 1 UEFI is device-verified; XNU, storage, display and touch remain bring-up work.
|
||||
|
||||
TB322FC 已通过菜单、1904x3040 GOP 显示、音量键和 FAT 负载的重复内存启动验证。格式 2 配置、live FDT、内存保留区、ADT 和启动 CPU 输入通过宿主机审查。
|
||||
源记录: [porting.toml](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/porting.toml), `57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd`.
|
||||
|
||||
4 KiB XNU 内核、预链接的 `kernel.macho` 和宿主机 ADT 已生成并审计。下一项设备验证为 56 MiB 内存负载传输，随后验证 DarwinBoot 和 XNU 入口。
|
||||
本页按设备记录自动生成。
|
||||
|
||||
## 使用此移植
|
||||
| 部分 | 状态 |
|
||||
| --- | --- |
|
||||
| [配置](#configuration) | `host-verified` |
|
||||
| [固件与启动](#firmware) | `device-verified` |
|
||||
| [CPU 与中断](#cpu) | `implemented` |
|
||||
| [内存与 DMA](#memory) | `implemented` |
|
||||
| [存储与根卷](#storage) | `planned` |
|
||||
| [显示](#display) | `planned` |
|
||||
| [输入](#input) | `planned` |
|
||||
| [GPU](#gpu) | `planned` |
|
||||
| [网络](#network) | `not-applicable` |
|
||||
| [音频](#audio) | `not-applicable` |
|
||||
| [电源](#power) | `planned` |
|
||||
| [镜像组装](#packaging) | `host-verified` |
|
||||
| [诊断](#diagnostics) | `device-verified` |
|
||||
|
||||
1. 阅读下方固定版本的源码说明和验证记录，准备该设备要求的固件和系统输入。
|
||||
2. 克隆设备仓库，在检出目录内按其构建指南准备依赖：
|
||||
## 配置 {#configuration}
|
||||
|
||||
```sh
|
||||
git clone --branch main https://github.com/jerry-2009/UNIXNU_elden.git
|
||||
cd UNIXNU_elden
|
||||
git checkout c591b1a0a471f24978aba25c56c8f6ec9bd06668
|
||||
git submodule update --init --recursive
|
||||
```
|
||||
`host-verified`
|
||||
|
||||
3. 在该版本完成对应构建后，按[启动验证顺序](/zh/porting/bring-up)验证，并按[日志抓取](/zh/porting/log-capture)保存最后确认的阶段。
|
||||
4. 将结果写入[移植记录](/zh/porting/records)。板级结构和组件选择见[移植设备](/zh/porting/steps)。
|
||||
组件: `ArmDTPlatform`, `ArmCpu`, `SoftwareAES`, `XnuPrelink`, `DarwinBoot`.
|
||||
|
||||
## 来源
|
||||
### 硬件与依赖
|
||||
|
||||
- [README: jerry-2009/UNIXNU_elden](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/README.md)
|
||||
- [内核输入: jerry-2009/UNIXNU_elden](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
- Use the ARM64 and iPadOS 17.7.11 profiles supplied by UniXNU.
|
||||
- Select the shared platform, CPU and DarwinBoot components.
|
||||
- Provide an SM8750 profile until an official shared SoC repository exists.
|
||||
|
||||
### 配置
|
||||
|
||||
- board.toml declares schema\_version = 2, soc\_source = sm8750 and os\_profile = ipados-17.7.11-21H461.
|
||||
- The complete component list is explicit because profile arrays replace inherited arrays.
|
||||
- Configuration and patch roots are ordered as ARM64, SoC, OS and device.
|
||||
- soc/sm8750 supplies the transition profile and is referenced from feeds.toml.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Run defconfig from a current UniXNU checkout.
|
||||
- Inspect status JSON for profile order, component dependencies, patch order and output path.
|
||||
- Replace the local SoC source with a reviewed UniXNU-sm8750-common commit before release.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- The repository was format 1 and did not select shared SoC or OS profiles.
|
||||
- A public UniXNU-sm8750-common repository was not available during migration.
|
||||
- Keeping a separate local SoC profile preserves parser validation without mislabelling unqualified hardware support as shared.
|
||||
- Phase 2.0 resolved ARM64, local SM8750, iPadOS and device layers; the selected component order, 56 patches, 4 KiB page setting and separate format 2 output were checked with current UniXNU.
|
||||
- Phase 2.1 keeps the XNU handoff and firmware memory description separate from the phase 1 dummy firmware DTB.
|
||||
- Phase 2.2 resolved 57 patches after adding compile-time-disabled PMGR context required by the shared boot-progress patch. CONFIG\_XNU\_BOOT\_PROGRESS is disabled for the minimum kernel because that diagnostic layer currently requires UFS, owner-root and Virtio.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- board.toml resolves four ordered configuration layers.
|
||||
- All selected components come from the UniXNU catalog and include their dependencies.
|
||||
- No array field depends accidentally on inheritance.
|
||||
- The SoC source is a reviewed remote commit and unixnu.lock records it.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- soc/sm8750 is local and is not yet a release-quality shared source.
|
||||
- The first resolution pass selects only platform, CPU, AES, prelink and DarwinBoot components.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Phase 2.3: validate the near-final-size Android v3 ramdisk, FDT/initrd and HOB path in an isolated candidate. Replace the local SM8750 source with a reviewed shared commit before release.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [Schema 2 profile, component, kernel, device-tree and payload declarations.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/board.toml)
|
||||
- `source`: [SM8750 transition source with the release replacement documented.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/feeds.toml)
|
||||
- `source`: [Shared-profile-shaped SM8750 transition metadata.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/soc/sm8750/soc.toml)
|
||||
- `source`: [Migration result, preserved phase 1 inputs and remaining release work.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/FORMAT2-MIGRATION.md)
|
||||
- `host`: [2026-10-25: fresh defconfig, tree and status runs resolved four profiles, five pinned components, 56 patches and 4 KiB pages under a format 2 output directory separate from phase 1. The local SM8750 source remains unpinned for release.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>.venv/bin/python .cache/phase2-plan/UniXNU/unixnu status --json -D .</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
- `host`: [2026-10-25: defconfig and status resolved five canonical components and 57 applied patches. The Command Line Tools host-shim build produced and prelinked the target kernel; release rebuilding still requires a full Xcode iPhoneOS SDK.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>PATH=.cache/phase2-plan/toolchain/bin:.venv/bin:$PATH .venv/bin/python .cache/phase2-plan/UniXNU/unixnu build kernel -D .</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
|
||||
## 固件与启动 {#firmware}
|
||||
|
||||
`device-verified`
|
||||
|
||||
组件: `DarwinBoot`.
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- mu\_wide\_platforms lenovo-y700g4 UEFI source and patched PMIC binaries.
|
||||
- UniXNU, UniXNUDxe, DarwinBoot and EldenRamDiskDxe firmware modules.
|
||||
- A 4 MiB FAT16 payload containing package/unixnu.toml.
|
||||
|
||||
### 配置
|
||||
|
||||
- firmware.dsc points to PakalaPkg/PakalaNoSb.dsc.
|
||||
- firmware.fd points to the DEBUG CLANGPDB SM8750\_EFI.fd.
|
||||
- payload volume is ELDENRAM and loader is firmware.
|
||||
- panic\_screen remains false because the phase 2 panic renderer is not integrated.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Build the phase 1 image with scripts/build\_phase1.py.
|
||||
- Run scripts/verify\_artifact.py against the FD and Android v3 image.
|
||||
- Owner performs two RAM cold boots with fastboot boot.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- The vendor UFSDxe crashed before the menu, so it was removed from the phase 1 APRIORI, DSC and FDF.
|
||||
- The embedded FAT payload avoids persistent storage and makes the menu independent of UFS.
|
||||
- The same image reached the visible menu twice and returned to stock Android after reset.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- Firmware contains UniXNU, UniXNUDxe, DarwinBoot and the RAM payload driver.
|
||||
- The payload config is readable and the menu accepts volume-key input.
|
||||
- Two RAM boots produce the same visible checkpoint and do not modify persistent partitions.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- The verified firmware is phase 1 and does not contain a bootable XNU payload.
|
||||
- The new format 2 firmware command is not yet switched from the project build script.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Use the current phase 1 image as the accepted baseline. Phase 2.3: validate Android ramdisk/FDT/HOB handoff and the RAM disk driver only in a separately isolated candidate; measure inner/outer FV capacity before integrating kernel inputs.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [Accepted phase 1 artifact and firmware/module inventory.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-STATUS.md)
|
||||
- `source`: [Static FD, Android image and embedded FAT verification.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/scripts/verify_artifact.py)
|
||||
- `device`: [2026-10-25: owner reported that the current image completed two RAM cold boots, reached the visible and operable UniXNU menu, and returned to stock Android.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `dffc3020a85830d0d981a85871d9ab31aac5827d`.
|
||||
- `device`: [Two owner-run RAM cold boots reached the UniXNU menu and returned to Android.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-HANDOFF.md)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `c591b1a0a471f24978aba25c56c8f6ec9bd06668`.
|
||||
|
||||
## CPU 与中断 {#cpu}
|
||||
|
||||
`implemented`
|
||||
|
||||
组件: `ArmCpu`.
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- SM8750 MPIDRs 0x0, 0x100, 0x200, 0x300, 0x400, 0x500, 0x10000 and 0x10100.
|
||||
- GICv3 distributor 0x16000000, redistributor base 0x16080000 and stride 0x40000.
|
||||
- 19.2 MHz architectural timer and PSCI SMC conduit.
|
||||
|
||||
### 配置
|
||||
|
||||
- The SoC DTSI declares eight CPU nodes, timebase-frequency = 19200000 and psci method = smc.
|
||||
- The GIC node exports unixnu,adt-name = intc.
|
||||
- The device defconfig enables ARM DT platform, ArmCpu, native timer and PAN.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Compile dts/elden.dts with the SoC include path.
|
||||
- Generate an ADT from the DTB and inspect /cpus, /psci and /arm-io/intc.
|
||||
- Boot the smallest XNU payload and record the first CPU, GIC or timer failure.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- The board evidence documents the same eight MPIDR layout used by other SM8750 ports.
|
||||
- The shared ADT generator emitted cpu0 as running and all other cores as waiting; ArmCpu does not probe secondary nubs unless sheng-smp is enabled.
|
||||
- ArmCpu reads the GIC through /arm-io/intc and requires a complete two-range reg property.
|
||||
- The old kernel argument set enabled armcpu-spi-ipi before elden had evidence that SGIs fail or that per-core SPI routing works. Phase 2.1 removed it from the single-boot-CPU milestone.
|
||||
- Secondary CPU startup and both SGI and SPI IPI delivery are not device-verified for elden.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- The boot CPU reaches the ArmCpu checkpoint.
|
||||
- GIC distributor and its own redistributor frame map successfully.
|
||||
- Timer handling works before secondary cores or IPI transport are qualified.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- No elden XNU CPU, GIC or timer log exists yet.
|
||||
- The eight-core topology is described, but SMP bring-up is not claimed.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Phase 2.5: prove ArmDTPlatform and the boot CPU ArmCpu/GIC/timer checkpoints using the audited CPU order and argument set. Defer SPI IPI, SGI delivery, secondary startup and SMP qualification to separate device checks.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [SM8750 CPU, PSCI, GICv3 and timer resources.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/soc/sm8750/dts/sm8750.dtsi)
|
||||
- `source`: [Board CPU/GIC/timebase inventory and planned diagnostic sequence.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-HANDOFF.md)
|
||||
- `host`: [2026-10-25: independently decoded ADT contains the eight expected MPIDRs, cpu0 running and seven CPUs waiting, 19.2 MHz timebase, SMC PSCI, and GIC distributor/redistributor bases with 0x40000 stride. No device CPU checkpoint is claimed.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/phase2_1_audit.py --linux-dir .cache/elden-linux</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
- `host`: [2026-10-25: the prelinked kernel exports ArmCpu probe/start, GIC distributor and timer-related symbols and ArmDTPlatform configure/createDeviceNubs symbols. Symbol presence is source evidence, not a device checkpoint.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>xcrun nm -g .cache/phase2-plan/UniXNU/out/elden/ipados-17.7.11-21H461/elden/kernel/kernel.macho</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
|
||||
## 内存与 DMA {#memory}
|
||||
|
||||
`implemented`
|
||||
|
||||
组件: `ArmDTPlatform`.
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- The owner-captured live elden FDT, including the 12 GiB RAM map, initrd and reserved-memory nodes.
|
||||
- The pinned Linux 16 GiB variant and the elden UEFI static memory map.
|
||||
- A conservative 256 MiB XNU handoff window in UEFI DXE conventional memory.
|
||||
|
||||
### 配置
|
||||
|
||||
- dts/elden.dts declares one 256 MiB XNU handoff node at 0xC2400000.
|
||||
- payload.dram\_size and payload.adt.owned\_memory\_size both request 0x10000000.
|
||||
- dts/elden-firmware-memory.dts records the sanitised live 12 GiB RAM map, reserved-memory ranges and expected GOP framebuffer.
|
||||
- The format 2 generator creates a 64-byte seed, CHRP NVRAM proxy and optional-input memory-map placeholders.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Compile the hardware and firmware memory descriptions.
|
||||
- Generate an ADT with the shared generator and decode it independently.
|
||||
- Cross-check the XNU window against firmware RAM, reserved-memory and the pinned UEFI memory map.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- The previous \[0x80000000, 0x100000000\) candidate overlapped 44 recorded no-map reservations and was removed.
|
||||
- The live FDT is 885,861 bytes with SHA-256 8a653a3e790f29bf2b0f3545135f06fe771360f31da3d37c04f648c26b95e26e and describes the current 12 GiB RAM map.
|
||||
- The former A8000000+10000000 UEFI Kernel carveout overlaps the live initrd B74AC000-B7FFEE30 and is unsuitable for RAM-boot phase 2.
|
||||
- C2400000+10000000 is covered by live RAM, avoids all live reservations and the initrd, and lies in UEFI DXE conventional memory.
|
||||
- The flashed vendor FDT uses generic qcom,sun-qrd compatible strings but retains the elden 3K panel marker, 1904x3040 display and UFS path.
|
||||
- The ADT has no optional RAMDisk, TrustCache or GPU addon placeholders because phase 2.1 has no matching inputs.
|
||||
- The unique chip ID remains a local input and is not stored in the repository.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- The ADT contains exactly one continuous memory range.
|
||||
- The range is covered by live firmware RAM and avoids recorded reservations, initrd, GOP and UEFI FD.
|
||||
- DarwinBoot and the UEFI exit map confirm that same range is conventional memory before XNU entry.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- The raw live FDT remains local-only because it can contain device identifiers.
|
||||
- Actual DarwinBoot ADT, boot\_args and allocated-window addresses remain runtime evidence.
|
||||
- The live vendor tree and pinned 16 GiB source differ in RAM size and generic compatible strings; both are tracked separately.
|
||||
- SMMU and cache policy are not complete.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Phase 2.3: preserve .cache/device/elden-live.fdt locally and rerun the live audit if firmware or boot mode changes; never commit the raw tree. Keep the phase 2 hardware ADT separate from the firmware FDT.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [One 256 MiB XNU range in UEFI DXE conventional memory and board compatible values.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/dts/elden.dts)
|
||||
- `source`: [Sanitised live 12 GiB RAM, reserved-memory and expected GOP framebuffer description.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/dts/elden-firmware-memory.dts)
|
||||
- `source`: [Documented DRAM base, fragmentation risk and memory handoff constraints.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
- `device`: [2026-10-25: owner-connected device produced an 885,861-byte live FDT with SHA-256 8a653a3e790f29bf2b0f3545135f06fe771360f31da3d37c04f648c26b95e26e. The flashed vendor tree reports generic qcom,sun-qrd compatible values but contains elden panel markers, 1904x3040 display, 1d84000 UFS and a 12 GiB RAM map. Raw bytes remain local-only.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>/Users/jerry/Library/Android/sdk/platform-tools/adb shell su -c 'cp /sys/firmware/fdt /data/local/tmp/elden-live.fdt'</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
- `host`: [2026-10-25: the live FDT audit passed with C2400000+10000000. It is in live RAM and UEFI DXE conventional memory, avoids all live reserved-memory and the B74AC000-B7FFEE30 initrd, and reproduces the eight-CPU ADT. No XNU entry is claimed.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/phase2_1_audit.py --firmware-dtb .cache/device/elden-live.fdt --output-dir .cache/phase2.1-live</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
|
||||
## 存储与根卷 {#storage}
|
||||
|
||||
`planned`
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- SM8750 UFS host at 0x1d84000 and PHY at 0x1d80000.
|
||||
- 4 KiB logical-sector partition geometry and a root-volume UUID.
|
||||
- Clock, regulator, power-domain and SMMU stream ownership.
|
||||
|
||||
### 配置
|
||||
|
||||
- The phase 1 defconfig disables Native UFS.
|
||||
- The format 2 component list does not select a storage transport.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Inventory GPT and logical block size without modifying the device.
|
||||
- Bring up UFS in read-only mode and validate known blocks.
|
||||
- Add an SM8750 storage component and root-window input before mounting.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- UFSDxe crashed in phase 1 and was removed from the menu path.
|
||||
- There is no elden XNU UFS probe result yet.
|
||||
- The phase 1 FAT payload intentionally bypasses persistent storage.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- Controller and PHY initialize.
|
||||
- Read-only capacity, GPT and known-block checks match the device.
|
||||
- The configured OS volume mounts and launchd starts.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- Storage is not selected or implemented.
|
||||
- No owner-authored userdata image or root UUID exists.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Capture a read-only GPT and memory-resource audit, then implement an SM8750 UFS component.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [Storage addresses, missing root inputs and phase 1 bypass decision; implementation remains a later phase.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
|
||||
## 显示 {#display}
|
||||
|
||||
`planned`
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- 1904x3040 bonded dual-DSI panel with DSC.
|
||||
- UEFI GOP framebuffer and splash reservation.
|
||||
- SM8750 DPU/DSI/PHY and backlight sequencing.
|
||||
|
||||
### 配置
|
||||
|
||||
- The phase 1 menu renders through UEFI GOP.
|
||||
- XNU display and IOMobileFramebuffer components remain disabled.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Keep display handoff on GOP for the first kernel milestone.
|
||||
- Record a visible checkpoint after DarwinBoot.
|
||||
- Add DPU/DSI only after kernel entry is stable.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- GOP display is device-verified in the UniXNU menu.
|
||||
- No XNU display provider has been validated.
|
||||
- The panel path remains a known high-risk cold-boot area.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- XNU paints a known pattern through a declared framebuffer handoff.
|
||||
- Userland presentation and backlight transitions work.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- No DPU, DSI, DSC or panel node is present in the hardware DTS.
|
||||
- GOP success is not counted as XNU display support.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Carry GOP framebuffer properties into DarwinBoot and record the first kernel-visible screen checkpoint.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [GOP menu display was observed on hardware.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-STATUS.md)
|
||||
- `source`: [Display topology, panel risk and GOP-first strategy.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
|
||||
## 输入 {#input}
|
||||
|
||||
`planned`
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- Novatek SPI touch on SPI4 and GPIO 162 interrupt.
|
||||
- Volume and power keys used by the UEFI menu.
|
||||
|
||||
### 配置
|
||||
|
||||
- The phase 1 menu accepts volume-key input through UEFI.
|
||||
- No XNU HID or Novatek transport is selected.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Preserve UEFI key navigation as the bring-up input path.
|
||||
- Inventory the touch firmware and protocol from read-only sources.
|
||||
- Add QCOM GENI SPI, touch protocol and HID input after XNU boots.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- Volume-key menu input is device-verified.
|
||||
- Touch has not been initialized by XNU.
|
||||
- The panel and touch controller share board state that must be validated together.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- Touch coordinates map to the display.
|
||||
- Contact IDs, releases and multi-touch remain stable.
|
||||
- Buttons produce expected HID events in XNU.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- No touch component is selected.
|
||||
- The NT36536 firmware and ABI inputs are not yet integrated.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Read the touch controller model and firmware version without modifying flash, then define the board transport.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [Volume-key navigation reached the accepted menu.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-STATUS.md)
|
||||
- `source`: [Novatek SPI wiring and input bring-up requirements.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
|
||||
## GPU {#gpu}
|
||||
|
||||
`planned`
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- Adreno 830 / gen80000.
|
||||
- GPU firmware, power votes, SMMU and display integration.
|
||||
|
||||
### 配置
|
||||
|
||||
- GPU and Metal components are not selected.
|
||||
- The first XNU milestone targets CPU/console progress only.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Reach the XNU platform expert without GPU dependencies.
|
||||
- Collect the GPU identity and firmware hashes.
|
||||
- Select and implement a GPU component only after a display provider exists.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- The board has no validated XNU GPU path.
|
||||
- Selecting SM8550 Adreno740 would misrepresent the Adreno 830 implementation scope.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- GPU submissions, fences and mapping work.
|
||||
- A known image renders and Metal presentation is visible.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- GPU and Metal are explicitly out of the first milestone.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Keep GPU unselected until an SM8750-compatible component and firmware inputs exist.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [Adreno 830 scope and exclusion from the first milestone.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/porting-analysis.md)
|
||||
|
||||
## 网络 {#network}
|
||||
|
||||
`not-applicable`
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- Wi-Fi is outside the current bring-up milestone.
|
||||
|
||||
### 配置
|
||||
|
||||
- No Wi-Fi or MHI component is selected.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Revisit after the USB or PCIe transport and firmware ownership are established.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- There is no verified Wi-Fi source or firmware path for elden.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- Not required for this milestone.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- Wi-Fi, Bluetooth and cellular are not implemented or claimed.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Open a separate network bring-up task when the base kernel and root volume are stable.
|
||||
|
||||
### 证据
|
||||
|
||||
按下一步操作收集证据。
|
||||
|
||||
## 音频 {#audio}
|
||||
|
||||
`not-applicable`
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- Audio is outside the current bring-up milestone.
|
||||
|
||||
### 配置
|
||||
|
||||
- No ADSP, GLink, codec or audio component is selected.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Revisit after platform, storage and display are stable.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- There is no elden audio log or firmware inventory.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- Not required for this milestone.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- Speakers, microphone and DSP routing are not implemented or claimed.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Open a separate audio bring-up task with DSP and codec inputs.
|
||||
|
||||
### 证据
|
||||
|
||||
按下一步操作收集证据。
|
||||
|
||||
## 电源 {#power}
|
||||
|
||||
`planned`
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- PM8550-class PMIC, RPMh resources and device power domains.
|
||||
- Volume and power key behavior.
|
||||
|
||||
### 配置
|
||||
|
||||
- The first DTS selects only CPU and GIC resources.
|
||||
- No platform power component is selected.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Keep suspend and CPU power management disabled during first XNU entry.
|
||||
- Record regulator and clock ownership.
|
||||
- Add platform power only after the boot CPU reaches a stable checkpoint.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- UEFI power and key handling are verified only at the firmware layer.
|
||||
- The selected OS profile does not supply sleep-disabled, so board.toml now adds it under \[adt.defaults.u32\].
|
||||
- The final Phase 2.1 ADT was decoded with sleep-disabled=1.
|
||||
- The XNU power topology is not complete.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- Declared power controls match readings.
|
||||
- Sleep/resume or shutdown transitions restore dependent peripherals.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- Battery, charging, thermal and sleep are not implemented.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Phase 2.5: use armcpu-diagnostics=1 to observe boot-CPU quiesce/halt behavior. Audit RPMh ownership and keep suspend/secondary CPU power management out of initial qualification.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [Board hardware and payload policy values.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/board.toml)
|
||||
- `host`: [2026-10-25: independent ADT decode found /defaults sleep-disabled=1. This is source/host evidence, not a device suspend test.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/phase2_1_audit.py --linux-dir .cache/elden-linux</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
|
||||
## 镜像组装 {#packaging}
|
||||
|
||||
`host-verified`
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- iPad7,1 iPadOS 17.7.11 build 21H461 restore inputs.
|
||||
- Target kernelcache, XNU 10063.141.1, DriverKit and TrustCache ABI inputs.
|
||||
- Android v3 RAM-boot image, a 4 MiB phase 1 embedded FAT payload and a measured 56 MiB phase 2 candidate.
|
||||
|
||||
### 配置
|
||||
|
||||
- The phase 1 image is produced by the project build script and verified against recorded hashes.
|
||||
- Format 2 output is out/elden/ipados-17.7.11-21H461/elden/.
|
||||
- The 2.2 prelink output is kernel/kernel.macho and its ADT sidecar; no phase 2 boot image is generated.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Run scripts/build\_phase1.py for the accepted firmware path.
|
||||
- Fetch the target IPSW components and build the patched 4 KiB XNU.
|
||||
- Prelink against the pinned kernelcache and audit Mach-O, ABI, symbols and ADT.
|
||||
- Package an isolated near-final-size payload only in Phase 2.3.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- The documented Phase 1 build was device-verified and the current procedure rebuilds and passes structural checks.
|
||||
- The same current recipe produced 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a instead of the historical accepted image hash; byte-for-byte rebuild identity is not claimed, but the new image completed two owner RAM cold boots.
|
||||
- The verified UniXNU third-party pin is intentionally retained for the accepted build.
|
||||
- Phase 2.2 produced a 21,206,040-byte native kernel and a 54,050,816-byte prelinked kernel. The 57-patch sequence selects 30 executable Apple components, 7 kernel interfaces and 30 module entrypoints.
|
||||
- A 56 MiB FAT16 host volume held the 54,063,968-byte kernel/config/ADT set with 3,734,016 bytes free and a byte-identical kernel readback.
|
||||
- The prelink report remains runtime\_qualified=false, abi\_qualified=false and loadable=false until device execution evidence exists.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- All format 2 build steps run from the resolved output directory.
|
||||
- The payload contains the kernel, ADT and declared optional inputs.
|
||||
- The boot image matches the ABL header and size limits.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- The format 2 payload and bootimg pipeline is not yet connected to a phase 2 firmware candidate.
|
||||
- The current 4 MiB board payload belongs to phase 1; the phase 2 candidate is 56 MiB and its ABL/initrd/FDT/HOB channel is unverified.
|
||||
- The 2.2 host build used Command Line Tools with an iPhone platform shim because full Xcode is absent; release rebuilding still requires the official Xcode/iPhoneOS SDK.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Phase 2.3: build a near-final-size FAT16 payload in an isolated output and verify Android v3 ramdisk, FDT/initrd and HOB delivery before executing the kernel. Keep all phase 2 outputs separate from the accepted phase 1 baseline.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [Reproducible phase 1 build commands, hashes and verification checklist.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-HANDOFF.md)
|
||||
- `source`: [Preserved build inputs and remaining format 2 handoff work.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/FORMAT2-MIGRATION.md)
|
||||
- `source`: [Phase 2 gates mapped to the official porting steps, capacity and memory constraints, and separate loader/kernel acceptance criteria; planning only, with no new device qualification.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-HANDOFF.md)
|
||||
- `source`: [Source-derived FDT, firmware RAM and reservation audit, decoded ADT checks, boot CPU parameter policy and remaining runtime evidence.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
- `source`: [Pinned kernelcache, 57-patch XNU build, prelink inventory, symbol/4 KiB audits and measured 56 MiB payload fit.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
- `host`: [Phase 2.0 established a rebuilt phase 1 baseline, preserved prior candidates, verified format 2 output isolation, and did not generate a phase 2 boot image.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>test -e .cache/phase2-plan/UniXNU/out/elden/ipados-17.7.11-21H461/elden/tree</code>. Revision: `dffc3020a85830d0d981a85871d9ab31aac5827d`.
|
||||
- `host`: [2026-10-25: kernelcache f18b4df865405f2a287b84977d7aca745e056d656d9fc9df1662970ce2969de7 produced native kernel 02f216348851ba9ce70616430ff7607be9d3305cbc8b2ae1186f0e7d6b20fce7 and prelinked kernel.macho 65a3e799e1eb7f631a3b146dfc890ef5a8147c8fc613ee383a1665b398fb1ef9; runtime qualification remains false.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>PATH=.cache/phase2-plan/toolchain/bin:.venv/bin:$PATH .venv/bin/python .cache/phase2-plan/UniXNU/unixnu build kernel -D .</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
- `host`: [2026-10-25: a 58,720,256-byte FAT16 volume held all 54,063,968 payload bytes, left 3,734,016 bytes free, and round-tripped kernel.macho with SHA-256 65a3e799e1eb7f631a3b146dfc890ef5a8147c8fc613ee383a1665b398fb1ef9.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>mformat -C -F -T 114688 -v ELDENPH2 -i .cache/phase2.2/payload-fit-56m-20261025-223638.img :: && mcopy -i .cache/phase2.2/payload-fit-56m-20261025-223638.img -s .cache/phase2-plan/UniXNU/out/elden/ipados-17.7.11-21H461/elden/payload/stage/EFI ::/</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
|
||||
## 诊断 {#diagnostics}
|
||||
|
||||
`device-verified`
|
||||
|
||||
### 硬件与依赖
|
||||
|
||||
- RAM-only owner-operated boot procedure.
|
||||
- Build and artifact SHA-256 values.
|
||||
- UEFI screen output and recovery path.
|
||||
|
||||
### 配置
|
||||
|
||||
- verify\_artifact.py checks the FD, Android image and embedded FAT.
|
||||
- build.json records artifact sizes and hashes.
|
||||
- The phase 1 acceptance requires two consecutive cold boots.
|
||||
|
||||
### 操作步骤
|
||||
|
||||
- Build and verify the image.
|
||||
- Owner runs fastboot boot twice and records the visible result.
|
||||
- Power off and confirm stock Android before further work.
|
||||
|
||||
### 开发经验
|
||||
|
||||
- The original accepted image is b56ef4b7e5a71382b8c279c4ee1560764fabd126ba37ac0fd6e495c80b9ec6e1.
|
||||
- Earlier UFSDxe failure images are identified and must not be reused.
|
||||
- Phase 2 requires separate kernel and DarwinBoot evidence.
|
||||
- On 2026-10-25 a fresh phase 1 rebuild produced image SHA-256 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a and FD SHA-256 e5420517d55f4b638c07617a252d3a65c95cfb731584dcb10dd1d98bae412580. The build and prior local candidate were read-only preserved under .cache/phase2.0, and the owner then completed two RAM cold boots of the new image.
|
||||
- Phase 2.1 host auditing now checks the ADT independently and records FDT, ADT, UEFI memory and boot argument sources under .cache/phase2.1 without replacing phase 1 artifacts.
|
||||
- Phase 2.2 audits passed for 1,010 target objects, 7,730 prelink XML tags, iOS 17.0 deployment, 4 KiB TCR and the expected ArmDTPlatform/ArmCpu symbols. These are host-only checks.
|
||||
|
||||
### 完成条件
|
||||
|
||||
- Every claimed checkpoint has a reproducible command, image hash and visible result.
|
||||
- Failures reach a diagnosable screen or log instead of a silent hang.
|
||||
|
||||
### 当前范围
|
||||
|
||||
- There is no phase 2 XNU log or ADT handoff evidence yet.
|
||||
- The generated hardware ADT input is a minimal host candidate. The separate firmware memory description contains the source-derived reservation map, but neither is a live device FDT.
|
||||
- The historical accepted image bytes are absent from the workspace, so they cannot be booted or byte-compared locally.
|
||||
|
||||
### 下一步
|
||||
|
||||
- Proceed with phase 2.3 using isolated outputs. Before any phase 2 device boot, rerun the Phase 2.1 audit against the owner-captured live firmware FDT. Record source, host and device evidence separately for every gate; loader validation, kernel entry, platform expert and boot CPU require distinct checkpoints and two final-image cold boots.
|
||||
|
||||
### 证据
|
||||
|
||||
- `source`: [Recorded phase 1 artifact sizes and SHA-256 values.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/out/build.json)
|
||||
- `source`: [The elden Linux reference now matches soc/sm8750/soc.toml at h0cheung/tb322fc-linux-kernel 6f97250ead155fc3b980856323e99a4623dae73d.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/unixnu.lock)
|
||||
- `host`: [2026-10-25: a fresh phase 1 rebuild completed in 6:46 and passed static Android v3, shim, FD, embedded FAT and module checks. Image SHA-256 was 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a and FD SHA-256 was e5420517d55f4b638c07617a252d3a65c95cfb731584dcb10dd1d98bae412580; no device boot was performed.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/build_phase1.py --skip-submodules --crypto-path $PWD/.cache/phase1/basecrypto</code>. Revision: `dffc3020a85830d0d981a85871d9ab31aac5827d`.
|
||||
- `device`: [2026-10-25: owner confirmed two RAM cold boots of image 94b6a6315b04fc9d276bc15e9519107be292244380fc3bf139f5af6c96a3bb0a; both reached the usable UniXNU menu and stock Android resumed after exit. This evidence covers phase 1 only.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `dffc3020a85830d0d981a85871d9ab31aac5827d`.
|
||||
- `host`: [2026-10-25: DTC 1.8.1-gf99e3af0 generated a 1,557-byte DTB with SHA-256 60316b6d4e753610610126d691f6d39ba54edd21e9b02875ec034e81e27a4371; round-trip inspection found the expected compatible strings, CPU MPIDRs, PSCI, GICv3, timer and DRAM data.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2-STATUS.md)
|
||||
Command: <code>.cache/dtc-src/dtc -I dts -O dtb -i soc/sm8750/dts -o /tmp/elden-phase2.0.dtb dts/elden.dts</code>. Revision: `f99e3af0ecb67a9085478a9b8ddbcc25aa64931d`.
|
||||
- `host`: [2026-10-25: live-FDT audit produced a 13,152-byte ADT. Independent checks passed for C2400000+10000000 RAM/reservation/initrd coverage, UEFI DXE conventional memory, framebuffer, eight MPIDRs, one running boot CPU, GIC, timer, CHRP NVRAM, optional placeholders and sleep-disabled=1. Report: .cache/phase2.1-live/audit.json.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.1-STATUS.md)
|
||||
Command: <code>.venv/bin/python scripts/phase2_1_audit.py --firmware-dtb .cache/device/elden-live.fdt --output-dir .cache/phase2.1-live</code>. Revision: `16e592abee8a550dec8154ed1f38b5ebc4f16213`.
|
||||
- `host`: [2026-10-25: native kernel audited as arm64/iOS 17 with 4 KiB TG0 and TG1; 1,010 target objects passed; the pinned prelink XML lexer accepted 7,730 tags. No device checkpoint is claimed.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE2.2-STATUS.md)
|
||||
Command: <code>python3 scripts/audit-xnu-kernel.py build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf && python3 scripts/audit-xnu-objects.py && python3 scripts/check-prelink-xml.py ../kernel/kernel.macho</code>. Revision: `c91a2191fdf591a401a03027ed8b7fbfdbcad3a7`.
|
||||
- `device`: [Two cold boots reached DISPLAY OK, INPUT OK, config loaded and menu shown.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/docs/PHASE1-STATUS.md)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `c591b1a0a471f24978aba25c56c8f6ec9bd06668`.
|
||||
- `device`: [Screen capture shows the rendered UniXNU menu on the tablet.](https://github.com/jerry-2009/UNIXNU_elden/blob/57e68be133c407ef9fa7dc6b4f10f1bd4cd3aedd/assets/phase1-menu-20261025.jpg)
|
||||
Command: <code>fastboot boot out/elden-phase1.img</code>. Revision: `c591b1a0a471f24978aba25c56c8f6ec9bd06668`.
|
||||
|
||||
</div>
|
||||
@@ -0,0 +1 @@
|
||||
[alghiffaryfa19/UniXNU-enuma-5g](https://github.com/alghiffaryfa19/UniXNU-enuma-5g)
|
||||
@@ -0,0 +1 @@
|
||||
[Tlrenhb/UniXNU-enuma](https://github.com/Tlrenhb/UniXNU-enuma)
|
||||
@@ -0,0 +1 @@
|
||||
[0721GPT/UniXNU-fuxi](https://github.com/0721GPT/UniXNU-fuxi)
|
||||
@@ -0,0 +1 @@
|
||||
[hanzi123-bilp/unixnu-fuxi](https://github.com/hanzi123-bilp/unixnu-fuxi)
|
||||
@@ -0,0 +1 @@
|
||||
[ljhhkx529/unixnu-fuxi](https://github.com/ljhhkx529/unixnu-fuxi)
|
||||
@@ -0,0 +1 @@
|
||||
[MinecraftVM/UniXNU-fuxi](https://github.com/MinecraftVM/UniXNU-fuxi)
|
||||
Loaded 100 of 149 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user