diff --git a/docs/porting/device-repository.md b/docs/porting/device-repository.md index 236eae6..6ecc2ca 100644 --- a/docs/porting/device-repository.md +++ b/docs/porting/device-repository.md @@ -228,10 +228,13 @@ CONFIG_XNU_NATIVE_CS_HASH_CACHE=y # CONFIG_XNU_ARMVIRT_PLATFORM is not set CONFIG_XNU_CRYPTO_BOOTSTRAP="prelinked" CONFIG_XNU_OWNER_DATA_VOLUME_UUID="00000000-0000-0000-0000-000000000000" +CONFIG_XNU_OWNER_CACHE_VOLUME_UUID="00000000-0000-0000-0000-000000000000" ``` Values can be `y`, `n`, a number or a quoted string. Each `CONFIG_XNU_` becomes `XNU_` in the kernel build. `{tree}` in a string becomes the build tree path. +`CONFIG_XNU_OWNER_CACHE_VOLUME_UUID` names the SystemOS cryptex volume that the owner chain mounts as the cache carrier: the APFS volume UUID inside the image the signed SystemOS policy covers. Without it the kernel uses the sheng image's volume. + The file name is selected by `[kernel] defconfig`. ## feeds.toml diff --git a/docs/zh/porting/device-repository.md b/docs/zh/porting/device-repository.md index e4ccf63..d61384a 100644 --- a/docs/zh/porting/device-repository.md +++ b/docs/zh/porting/device-repository.md @@ -226,10 +226,13 @@ CONFIG_XNU_NATIVE_CS_HASH_CACHE=y # CONFIG_XNU_ARMVIRT_PLATFORM is not set CONFIG_XNU_CRYPTO_BOOTSTRAP="prelinked" CONFIG_XNU_OWNER_DATA_VOLUME_UUID="00000000-0000-0000-0000-000000000000" +CONFIG_XNU_OWNER_CACHE_VOLUME_UUID="00000000-0000-0000-0000-000000000000" ``` 取值可以是 `y`、`n`、数字或带引号字符串。每个 `CONFIG_XNU_` 变成内核构建的 `XNU_`，字符串中的 `{tree}` 替换为构建树路径。 +`CONFIG_XNU_OWNER_CACHE_VOLUME_UUID` 指定 owner 链作为缓存载体挂载的 SystemOS cryptex 卷，即签名 SystemOS 策略所覆盖镜像中的 APFS 卷 UUID。不设置时，内核使用 sheng 镜像的卷。 + ## feeds.toml 设备仓库可以追加源码： diff --git a/patches/xnu/offline-owner-systemos-mount.patch b/patches/xnu/offline-owner-systemos-mount.patch index f943fa8..ab33525 100644 --- a/patches/xnu/offline-owner-systemos-mount.patch +++ b/patches/xnu/offline-owner-systemos-mount.patch @@ -9,7 +9,7 @@ #include -@@ -7013,8 +7013,253 @@ +@@ -7013,8 +7013,256 @@ * word width of the kernel. Once the self-exec completes, the * initproc might be different. */ @@ -50,7 +50,10 @@ -load_init_program_at_path(proc_t p, user_addr_t scratch_addr, const char* path) +native_owner_cache_prepare(proc_t p, user_addr_t scratch, user_addr_t *envp) +{ -+ const char *volume = "8846FE78-2910-4297-AF97-D59BB6F8FC16"; ++#ifndef XNU_OWNER_CACHE_VOLUME_UUID ++#define XNU_OWNER_CACHE_VOLUME_UUID "8846FE78-2910-4297-AF97-D59BB6F8FC16" ++#endif ++ const char *volume = XNU_OWNER_CACHE_VOLUME_UUID; +#if defined(XNU_OWNER_UNION_SYSTEMOS) && XNU_OWNER_UNION_SYSTEMOS +#if !CONFIG_UNION_MOUNTS +#error The owner composition requires the original native union-mount implementation @@ -264,7 +267,7 @@ { int retval[2]; int error; -@@ -7086,7 +7326,7 @@ +@@ -7086,7 +7329,7 @@ */ init_exec_args.fname = argv0; init_exec_args.argp = scratch_addr; @@ -273,7 +276,7 @@ /* * So that init task is set with uid,gid 0 token -@@ -7148,6 +7388,15 @@ +@@ -7148,6 +7391,15 @@ mach_vm_size_t map_page_size = vm_map_page_size(map); (void) mach_vm_allocate_kernel(map, &scratch_addr, map_page_size, VM_FLAGS_ANYWHERE, VM_KERN_MEMORY_NONE); @@ -289,7 +292,7 @@ #if CONFIG_MEMORYSTATUS (void) memorystatus_init_at_boot_snapshot(); #endif /* CONFIG_MEMORYSTATUS */ -@@ -7162,7 +7411,7 @@ +@@ -7162,7 +7414,7 @@ if (is_release_suffix) { printf("load_init_program: attempting to load /sbin/launchd\n"); @@ -298,7 +301,7 @@ if (!error) { return; } -@@ -7173,7 +7422,7 @@ +@@ -7173,7 +7425,7 @@ strlcat(launchd_path, launchd_suffix, sizeof(launchd_path)); printf("load_init_program: attempting to load %s\n", launchd_path); @@ -307,7 +310,7 @@ if (!error) { return; } else if (error != ENOENT) { -@@ -7186,7 +7435,7 @@ +@@ -7186,7 +7438,7 @@ error = ENOENT; for (i = 0; i < sizeof(init_programs) / sizeof(init_programs[0]); i++) { printf("load_init_program: attempting to load %s\n", init_programs[i]); diff --git a/scripts/build-xnu-4k-baseline.sh b/scripts/build-xnu-4k-baseline.sh index 6b969c5..5815dd9 100755 --- a/scripts/build-xnu-4k-baseline.sh +++ b/scripts/build-xnu-4k-baseline.sh @@ -392,7 +392,7 @@ if [ "$OWNER_DATA_MOUNT" = 1 ] && [ "$OWNER_BOOT_MANIFEST" != 1 ]; then exit 1 fi OWNER_DATA_HEADER=$ROOT/build/xnu/owner-data-volume.h -python3 - "$OWNER_DATA_HEADER" "$OWNER_DATA_MOUNT" "$NATIVE_RAM_BLOCK" "${XNU_OWNER_DATA_VOLUME_UUID:-}" <<'PY_DATA_UUID' +python3 - "$OWNER_DATA_HEADER" "$OWNER_DATA_MOUNT" "$NATIVE_RAM_BLOCK" "${XNU_OWNER_DATA_VOLUME_UUID:-}" "${XNU_OWNER_CACHE_VOLUME_UUID:-}" <<'PY_DATA_UUID' from pathlib import Path import sys import uuid @@ -404,14 +404,22 @@ if sys.argv[2:4] == ['1', '1']: except ValueError: raise SystemExit('Set XNU_OWNER_DATA_VOLUME_UUID to the actual observed scratch APFS volume UUID') text = '#define XNU_OWNER_DATA_VOLUME_UUID "' + value + '"\n' +# The SystemOS cryptex volume of this image; the sheng value stays the default of the patch. +cache = '8846FE78-2910-4297-AF97-D59BB6F8FC16' +if len(sys.argv) > 5 and sys.argv[5]: + try: + cache = str(uuid.UUID(sys.argv[5])).upper() + except ValueError: + raise SystemExit('Set XNU_OWNER_CACHE_VOLUME_UUID to the SystemOS volume UUID of the signed policy') +text += '#define XNU_OWNER_CACHE_VOLUME_UUID "' + cache + '"\n' path.parent.mkdir(parents=True, exist_ok=True) if not path.exists() or path.read_text() != text: path.write_text(text) PY_DATA_UUID OWNER_DATA_STAMP=$ROOT/build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/.owner-data-mount-mode -if [ "$(cat "$OWNER_DATA_STAMP" 2>/dev/null || echo 0)" != "$OWNER_DATA_MOUNT:$NATIVE_RAM_BLOCK" ]; then +if [ "$(cat "$OWNER_DATA_STAMP" 2>/dev/null || echo 0)" != "$OWNER_DATA_MOUNT:$NATIVE_RAM_BLOCK:${XNU_OWNER_CACHE_VOLUME_UUID:-}" ]; then rm -f "$ROOT/build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/bsd/DEVELOPMENT/kern_exec.o" - printf '%s\n' "$OWNER_DATA_MOUNT:$NATIVE_RAM_BLOCK" > "$OWNER_DATA_STAMP" + printf '%s\n' "$OWNER_DATA_MOUNT:$NATIVE_RAM_BLOCK:${XNU_OWNER_CACHE_VOLUME_UUID:-}" > "$OWNER_DATA_STAMP" fi OWNER_CRYPTEX_FILES=${XNU_OWNER_CRYPTEX_FILES:-0} if [ "$OWNER_CRYPTEX_FILES" != 0 ] && [ "$OWNER_CRYPTEX_FILES" != 1 ]; then