UniXNU

English

简体中文

English

简体中文

Appearance

Xiaomi Pad 6S Pro (gkxqh) ​

gkxqh/UniXNU-sheng

Xiaomi Pad 6S Pro 12.4 uses shared SM8550 support and board-owned storage, input, firmware and power integration. This record describes implementation coverage and the evidence required for each milestone.

Source record: porting.toml, 7cff07ea9933428e27769014e903f103ab31155d.

This page is generated from the device record.

AreaStatus
Configurationimplemented
Firmware and bootimplemented
CPU and interruptsimplemented
Memory and DMAimplemented
Storage and rootimplemented
Displayimplemented
Inputimplemented
GPUimplemented
Networkimplemented
Audioimplemented
Powerimplemented
Image assemblyimplemented
Diagnosticsimplemented
arm64e-osplanned

Configuration ​

implemented

Hardware and dependencies ​

  • SM8550 profile, iPadOS 26.5.2 build 23F84, arm64e sheng_ipados26_defconfig and pinned component sources.

Configuration ​

  • board.soc_source = sm8550; board.os_profile = ipados-26.5.2-23F84; schema_version = 2.
  • The device owns ShengUfs, ShengHidInput, ShengNovatekTouch and ShengPreflight submodules.

Procedure ​

Development findings ​

  • Tables merge in ARM64, SoC, OS, device order. Arrays replace inherited selections, so include every required component and fragment.
  • The selected defconfig applies after the explicit configuration fragments. Keep OS ABI and IPSW pins in the OS profile.
  • The active 23F84 configuration remains minimal. Source storage/input archives are built separately and are not yet selected for boot. OS-profile source pins select the public macOS 26.5 families without claiming binary ABI compatibility.
  • feeds.toml pins the SoC source at the commit that holds patches/xnu-12377/series, which board.toml lists as soc:patches/xnu-12377/series; a pin older than that commit leaves the series missing.
  • board.toml carries the 27 values at the top level and the differences of the 17 and 26 profiles under os_overrides, so one branch serves every profile., .github/workflows/package.yml runs scripts/package.sh on a macOS runner with the UniXNU and uefi-sheng checkouts beside the device repository; the platform seed comes from the UNIXNU_UNIQUE_CHIP_ID secret, and the run offers boot.img, payload.img, kernel.macho and the manifest as its artifacts. Run it in a fork and delete the run after downloading them., and the run passes its own GITHUB_TOKEN to the packaging step for api.github.com, whose anonymous quota a hosted runner exhausts., The kernel archives of the 27 and 26 profiles list build-sheng-source-storage.py after component:ShengUfs, so the source storage archive and root-policies.bin the defconfigs link no longer depend on a leftover of an earlier build., and name scripts/policies/<profile> in --policy-dir, the signed headers the repository ships., and the 27 kernel archives run fetch-adreno-inputs.py and the three prepare-sheng-* generators before build-adreno740-kits.py, so the generated GMU and SMMU headers no longer come from earlier local runs., with fetch-sheng-dts.py first: the firmware step runs after the kernel step, and the generators read the DTS sources it fetches.
  • [firmware] preflight lists scripts/fetch-sheng-dts.py before scripts/check-sheng.py, and [bootimg] dtb names the device tree it builds (build/sheng/sheng.dtb) for the pack step.
  • .gitignore keeps policies/**/*.bin tracked under the global *.bin ignore: the signed root-policy headers are repository inputs of the storage area.
  • .gitignore keeps firmware/**/*.bin tracked under the global *.bin ignore.
  • The 27 kernel archives end with build-fileset-release-reference.py --tree . --lto, the comparison kernel the prelink step reads.
  • .github/workflows/package.yml puts /opt/homebrew/opt/llvm/bin first on the package step PATH: the packaging step needs lld-link of the Homebrew LLVM the tools step installs.
  • The tools step also installs cmake: the packaging step builds EDK II BaseTools with it.
  • The package step PATH keeps /opt/homebrew/bin ahead of the LLVM tools: dropping it hid the tools step installs (cmake).
  • The tools step installs lld beside llvm (the keg-only llvm bottle has no lld-link; the packaging step finds /opt/homebrew/opt/lld/bin through the loader), and the PATH override is gone: the default runner PATH keeps Apple clang driving the kernel link.
  • The tools step installs the complete external set (dtc, llvm, lld, cmake, mtools, blacktop/tap/ipsw) and asserts every tool of the flow before the build: mtools builds the payload FAT volume, the ipsw tool fetches the AEA keys of the OS images.
  • The keg-only tool check accepts either the llvm or the lld keg for a tool: ls with two paths fails when only one of them carries it.
  • The uefi-sheng checkout carries its submodules recursively: the firmware volume builds from Binaries/sheng, itself a submodule.
  • The firmware preflight runs the download, extract and import scripts between the DTS fetch and the memory-map check.
  • .github/workflows/package.yml pins UniXNU revision be0e4fab0072bceaa8d744a4a6875ba5461cd7ff, which selects the GPU, Metal, display and source-storage latency integration. Existing installations retain their original Data seed through the packaging cache or an explicit seed import.

Completion criteria ​

  • All source pins resolve; every selected component has a record; status shows the intended overrides and patch order.

Current limits ​

  • Local overrides can select a different source from the published pin; record the effective source in each verification result.

Next action ​

  • Compare the effective status output whenever a profile, source or component selection changes.

Evidence ​

Firmware and boot ​

implemented

Components: ShengPreflight.

Hardware and dependencies ​

  • uefi-sheng firmware, stock firmware DTB, GOP handoff, PSCI SMC interface and vendor firmware inventory.

Configuration ​

  • firmware.dsc = Platforms/Xiaomi/shengPkg/sheng.dsc; firmware.config = sheng.
  • proprietary-files.txt records input paths and provenance.
  • The firmware DSC and FDF embed UniXNU, UniXNUDxe, DarwinBoot, UniXNURamDiskDxe, DiskIoDxe and FAT support.

Procedure ​

  • Run ./unixnu build firmware -D ../UniXNU-sheng --uefi ../uefi-sheng.
  • Record the firmware commit, output FD and handoff memory map before a boot attempt.
  • Build the payload, then run ./unixnu bootimg with the firmware DTB. Inspect boot.json ramdisk_bytes and the required firmware modules.

Development findings ​

  • The firmware DTB is an input to boot-image assembly. XNU consumes the separately generated ADT.
  • The sheng preflight component belongs with board integration and its firmware requirements.
  • The shared UniXNURamDiskDxe reads the Mu-Silicium entry-argument HOB and FDT initrd range to publish the payload block device. ShengBootMemoryDxe owns memory expansion.
  • Configured menu entries require a payload FAT filesystem containing EFI/UniXNU/unixnu.toml. Check the UNIXNURAMDISK initrd block-device status when entries are absent.
  • fetch-sheng-dts.py writes the firmware device tree at build/sheng/sheng.dtb and the copy the GPU generators bind to at build/adreno-firmware/sheng.dtb.
  • firmware/novatek/novatek_nt36532_n81a_fw_csot.bin is the pinned touch firmware of proprietary-files.txt; the build reads the extracting machine cache first and this copy on a clean checkout.
  • board.toml [firmware.image] pins the official fastboot archive (url, SHA-256, MD5, bytes); the firmware preflight downloads it, streams out only the porting inputs, deletes the archive and generates Binaries/sheng in the firmware checkout from them. No extracted binaries live in any repository.
  • A completed extraction skips both scripts: porting-inputs.json records the archive as deleted with the pinned source url and SHA-256, so a rerun rebuilds Binaries/sheng without downloading again.
  • The extraction skip sits after the board.toml [firmware.image] load: it compares against the pinned table, which the first lines of the script have not read yet.
  • import-sheng-uefi.py regenerates Binaries/sheng only when its manifest differs from the cache: a matching tree is left in place.

Completion criteria ​

  • Firmware image builds, enters UniXNU, publishes the framebuffer and preserves the documented memory reservations.

Current limits ​

  • Boot-image assembly requires the selected firmware DTB and proprietary input files.

Next action ​

  • Capture firmware revision and memory reservations with the next image verification.

Evidence ​

CPU and interrupts ​

implemented

Components: ArmCpu, ArmDTPlatform.

Hardware and dependencies ​

  • SM8550 CPU affinities, GIC distributor at 0x17100000, redistributors at 0x17180000, 0x40000 stride and 19.2 MHz timer.
  • PSCI uses SMC. All eight CPUs are enabled; the DTS tags cpu0 to cpu2 (A510) as an E cluster and cpu3 to cpu7 as a P cluster with unixnu,cluster-type.

Configuration ​

  • dts/sheng.dts includes sm8550.dtsi; shared CPU and interrupt definitions come from the SoC source.
  • Kernel arguments select sheng-smp=1 and armcpu-spi-ipi=1.

Procedure ​

  • Compile the board DTS and inspect enabled CPUs, GIC ranges and timer properties in the ADT.
  • Record per-CPU entry, timer interrupts and inter-processor interrupt delivery.

Development findings ​

  • CPU affinity values are hardware identifiers. Enabled CPU count and MPIDR affinities must be checked together.
  • GIC register ranges must use translated physical addresses from the hardware tree.
  • XNU accepts work interval operations 6, 7 and 8 (interval start, update and finish) through patches/xnu/native-work-interval-instance.patch in UniXNU; without a performance controller they only succeed.
  • patches/xnu/zzyf-sheng-amp.patch runs the Edge scheduler with the E and P clusters from the ADT; UI work stays on the P cluster and coreduetd is stopped.

Completion criteria ​

  • Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU.

Current limits ​

  • CPU selection and frequency policy are board inputs; SoC topology describes all cores.

Next action ​

  • Attach per-CPU and interrupt observations for the selected firmware and image.

Evidence ​

Memory and DMA ​

implemented

Hardware and dependencies ​

  • Handoff DRAM at 0x80000000 with size 0x80000000; splash reservation at 0xb8000000 with size 0x2b00000.
  • Payload owned-memory request is 0x130000000. Device DMA requires controller stream IDs, address widths and ownership.

Configuration ​

  • device_tree.source = device:dts/sheng.dts; include_dirs = [soc:dts].
  • payload.adt.owned_memory_size and firmware reservations describe separate allocations.

Procedure ​

  • Compare firmware RAM ranges, reserved regions, DTS ranges and ADT memory-map entries.
  • Check DMA buffers against controller address width, cache policy and SMMU mapping before submitting work.

Development findings ​

  • The sheng WLAN node exports the wlan ADT name used by wifid matching. It adds service-discovery metadata to the shared DTS; DRAM reservations and DMA resource ownership continue to use the existing board and controller descriptions.
  • Physical register translation and CPU virtual mappings have different purposes. Preserve physical resource ranges in hardware descriptions.
  • GPU and UFS use different SMMU instances and stream assignments.
  • The DTS carries each CPU's cluster type for the ADT (see the cpu area).
  • The GPU memory host fixture uses the current trace and task-role interfaces. Image backing reuse and deferred physical release are bounded by the Metal runtime; foreground placement and room-worker allocations can still overlap.

Completion criteria ​

  • All handoff regions are accounted for and each enabled DMA engine accesses its allocated range with the documented cache policy.

Current limits ​

  • The DTS declares the current handoff window and splash region; memory sizing requires the selected firmware map.

Next action ​

  • Record the firmware memory map and each DMA consumer when changing reserved memory.

Evidence ​

Storage and root ​

implemented

Components: ShengUfs, VirtioMmioBlock, RamBlock, VerifiedRoot.

Hardware and dependencies ​

  • UFS host 0x01d84000/0x3000; PHY 0x01d80000/0x2000; GCC base 0x00100000.
  • GCC AXI, AHB, UniPro, symbol and PHY auxiliary branches; power domains and firmware link state.
  • Apps SMMU at 0x15000000, UFS stream 0x60, context-bank ownership, DMA width and cache maintenance.
  • LUN 0 uses 4096-byte blocks; userdata spans LBAs 3094592 through 64007162.

Configuration ​

  • iOS 17 uses CONFIG_XNU_NATIVE_UFS=y. The 23F84 source adapter uses the deferred source archive with native-source-storage=1 native-ufs-root=1; do not also install the old personality.
  • userdata defines OS and SystemOS windows. 23F84 payload.adt.root_match_volume_uuid = 546DFF4A-4172-4026-9F1B-7FDAD45F3D2E.

Procedure ​

  • Read https://unixnu.com/porting/ufs with this storage record.
  • Inspect clock enables, power state, HCE/HCS, link state, request-list base and SMMU mappings before changing controller ownership.
  • Validate SCSI capacity and GPT reads, then publish root windows and mount the configured root UUID.
  • Verify persistent Data writes on the documented Data allocation with a recovery image available.

Development findings ​

  • ShengUfs also owns the apps SMMU stage 1 windows for the display bank (sheng-dpu-scanout) and the WiFi endpoint (sheng-wifi=2 or more); both are off by default.
  • An idle AHB branch may report CLK_OFF with hardware gating enabled. Check enable and gating bits together.
  • SMMU bypass still has address-width constraints. Validate every DMA range and context-bank assignment.
  • ShengUfs contains controller access, GPT/window parsing and sheng Data/log policy. Reuse each layer according to its inputs.
  • iPadOS 26 source-interface build: ShengUfs and all 15 public IOStorageFamily 337.100.1 compilation units produce arm64e iOS 26 objects. Verified-root policy flags remain enabled; four root-path host suites pass ASan/UBSan.
  • The display bank's TCR2 SEP field (bits 17:15) is set so IOVAs with bit 31 translate. The userdata reserve past the log and its export region is readable through native_ufs_import_read and is never written by the driver.
  • scripts/policies/ipados-* carry the signed root-policy headers (manifest.header.bin, trusted-key.bin, verification.json) of each OS profile; the kernel archives pass scripts/policies/<profile> to build-sheng-source-storage.py with --policy-dir, and the full block tables stay local inputs of the userdata image., and .gitignore keeps scripts/policies/**/*.bin tracked under the global *.bin ignore.

Completion criteria ​

  • Host: register, clock, link and SMMU facts match the board inventory.
  • Reads: SCSI capacity, GPT and known blocks are correct; OS/SystemOS windows stay within userdata.
  • Root: the configured volume mounts and launchd starts. Persistence: writes survive reboot within the allocated Data region.

Current limits ​

  • The SoC DTSI exports host and PHY ranges. GCC and UFS SMMU handling currently use constants and operations in ShengUfs.
  • The root transport uses a polled request slot. Its firmware adoption path requires a usable existing request list.
  • 23F84 now has deferred source storage registration, original IOStorageFamily/APFS loading, signed policy sidecar handoff and build selection. These latest changes have not been built or run: the user explicitly stopped testing. Runtime class/interface compatibility, root mount and persistence remain unqualified. See reports/ipados26-source-storage-runtime.json.

Next action ​

  • Record clock/PHY/reset initialization ownership and the SMMU stream before adapting this driver to another board.

Evidence ​

Display ​

implemented

Components: GopFramebuffer.

Hardware and dependencies ​

  • UEFI GOP framebuffer, stride, pixel format, splash reservation and board panel/backlight controls.

Configuration ​

  • Select GopFramebuffer; CONFIG_XNU_NATIVE_LEGACY_DISPLAY=y; artwork-display-gamut = sRGB.
  • sheng-vsync=120 requests board display timing.
  • sheng-dpu-scanout=2 lets the display pipes fetch the compositor surface through a stage 1 window of the display bank (TCR2 SEP 7); off by default. The flip waits for the GPU fence of the frame (always on).

Procedure ​

  • Verify GOP address, dimensions, stride and pixel layout before enabling presentation.
  • Build the late display archive with the selected OS ABI records, then check display publication and frame presentation.

Development findings ​

  • The 24A446 display adapter declares fixed original targets. XnuPrelink relocates BTI/B stubs after native segment placement; a cached native-slide value is no longer used. The 2026-11-02 device log showed the unrelocated constructor branch jumping to 0xfffffff00dbb4c74 instead of 0xfffffff00a288c74, an excess of 0x392c000.
  • The display source and ABI binding are selected independently from the physical panel configuration.
  • The board configuration declares sRGB for the current 8-bit framebuffer path.
  • scripts/build-gop-legacy-display.py also builds the board driver objects in the display archive, including the ADSP, IPC router, FAT reader and battery manager.
  • With sheng-dpu=2 DisplayTimingProbe reads the VIG 0 and 1 pipes, CTL 0 and the tear checks; sheng-dpu=3 also rewrites the pipe addresses and times the flush latch (5.4 ms, no start needed: the panel refreshes by itself).
  • Direct scanout: the compositor submits a swap when the command buffer is scheduled, so the flip waits until the GPU wrote the frame; the wait removes the flicker (content changes of the shown surface fell from 808 to 2 per run). Direct scanout needs the 8-bit BGRA framebuffer.
  • The GENI I2C core also moves 1 to 8 byte writes and 1 to 4 byte reads (the audio amplifiers use 32-bit registers); the backlight keeps its 8-bit transfers.
  • The legacy display builder now refuses arm64e/iOS 26 before reading original ABI addresses. Its existing use of kernel_target.TRIPLE does not qualify the iOS 17 class layout for 23F84. Source input transport compilation is independent of this builder.
  • The 24A446 adapter creates a BGRA IOSurface through the original IOSurfaceRoot factory, checks allocation and geometry, and transfers its reference to the family default-surface field. The void create_default_fb_surface slot is invoked by the original start method.
  • build-gop-legacy-display-27.py reads the device checkout from UNIXNU_DEVICE (set by the release) before the sibling directory name, so a checkout under any name works., and the HID source is the tree pin (refer/IOHIDFamily of the feed) instead of a hand-placed driver-sources copy.

Completion criteria ​

  • A known frame appears with correct geometry and colors, then userland presentation and backlight controls work.

Current limits ​

  • The late display builder needs qualified prelink candidates and ABI records. A timing request requires a measured presentation result. The 24A446 default-surface adapter still requires a hardware boot result.

Next action ​

  • Record frame timing, pixel format and presentation evidence for each image used to qualify display.

Evidence ​

Input ​

implemented

Components: ShengHidInput, ShengNovatekTouch, QcomGeniSpi.

Hardware and dependencies ​

  • Novatek NT36532 sensor, GENI SPI controller, pin configuration, reset/interrupt lines, firmware and touch coordinate geometry.

Configuration ​

  • Select ShengHidInput, ShengNovatekTouch and QcomGeniSpi; sheng-touch=4 and sheng-touch-hid=1 select board integration.

Procedure ​

  • Read TouchBoard.h and verify the SPI clock and mode against the controller setup.
  • Validate protocol reports, contact tracking and coordinate orientation before publishing HID events.

Development findings ​

  • The arm64e HID adapter uses the same fixed-target stub contract as the display adapter. Host verification checks all 51 IOHIDFamily stub destinations after fileset placement.
  • Controller transfer logic, sensor protocol and board sensor geometry are separate inputs.
  • Track contact IDs across movement and lift events; a register read alone covers only transport access.
  • sheng_buttons_press() holds a button mask for a given time through the HID sink, for unattended tests (the audio lock sound test uses it).
  • iPadOS 26 source-interface build: IOHIDDevice reports and independent touch/button, GENI SPI, Novatek and firmware archives compile. Four host model suites pass ASan/UBSan. The source path does not patch a foreign vtable.
  • On arm64e the event driver's vtable is copied and every slot is re-signed with the 220 discriminators read from the 24A446 kernelcache; each slot is checked against the original table first, and AppleUserHIDEventService, this device's event driver, takes the copy as well. A search over 16-bit values can accept a second discriminator with the same 24-bit signature and stops touch events.
  • With latency capture enabled, the HID input path records the time of each touch report handed to the event driver; these times bound the analysed touch windows. Contact IDs and coordinates are not recorded.

Completion criteria ​

  • Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports.

Current limits ​

  • Sensor firmware and board dimensions remain sheng inputs.
  • 23F84 HID linking/startup and edge gestures remain unqualified. Apple IOHIDFamily 2238.120.5 omits event-type/struct headers and the complete device build needs private reporting/analytics dependencies.

Next action ​

  • Attach contact and orientation observations when firmware or geometry changes.

Evidence ​

GPU ​

implemented

Components: Adreno740, AdrenoMetal, AirNir, Sm8550Platform, AdrenoPM4, AdrenoFirmware, ArmSmmu4K.

Hardware and dependencies ​

  • A740 GPU/GMU registers, GPU SMMU streams 0/1 and GMU stream 5, signed ZAP firmware and board power votes.
  • Turnip, metal2vulkan, AIR translation and the selected OS GPU/Metal ABI.

Configuration ​

  • Select Adreno740, AdrenoMetal and AirNir; shared SM8550 operations arrive through component dependencies.
  • Board scripts combine shared GMU code with package/ShengGmuVotes.c.
  • sheng-gpu-preempt defaults to 2: requested high priorities use ring 0, normal/low work uses ring 1. Mode 1 sends only low/background to ring 1; mode 0 selects one ring.

Procedure ​

  • Qualify power, firmware, SMMU and GMU startup before command submission.
  • Check memory mapping, command completion and a known rendered image before staging the Metal plugin.

Development findings ​

  • Each ring restores its executed page-table snapshot, saves GMEM and runs the SRAM postamble. GMU keepalive covers restore-register writes through the incoming WPTR update; board writes retry AHB-fence drops.
  • The shared process queue keeps FIFO across priority changes. Current live Metal requests determine priority, with task GPU role selecting foreground or background.
  • All AdrenoMetal clients use one sample by default; NATIVE_METAL_SINGLE_SAMPLE=0 preserves a process's requested sample counts. The frontend implements heap aliasing, swizzles, mip/slice copies, function constants and callbacks, specialized link names, backing-allocation statistics, queue capacity and full viewport/scissor arrays.
  • Writable same-user caches cover frontend, runtime and Turnip IR3 artifacts; restricted clients use private caches. Normal builds enable Mesa disk caching and apply the recorded vendor patches.
  • The optional sheng-wallpaper-freeze=1 mode retains a Poster renderer's first completed large IOSurface draw and parks later runtime commits. PosterBoard and compositor clients keep running. Event 60 identifies the completion boundary and parked commands.
  • The current sheng iPadOS 27 image boots and accepts touch interaction, and shader priming covers 280 of 280 selected libraries. Foreground and room-worker 64 MiB allocations still overlap. Focused latency capture retains full-width runtime memory phases, command and pass timings, paired callbacks and allocation roles. GPU pixel collection and per-frame content scans are disabled.
  • The kernel GPU ring keeps submission, retirement, display arrival, fence, latch, build identity and the render server's render, encode and completion thread identities; client processes forward nothing else. The decoders read only these records and write touch-window subsets.

Completion criteria ​

  • GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it.

Current limits ​

  • A740 coverage depends on the selected firmware and OS ABI; board qualification requires its own memory and power evidence.

Next action ​

  • Qualify concurrent Metal clients, repeated preemption, rendered pixels and frame pacing on sheng with iPadOS 27.

Evidence ​

Network ​

implemented

Components: Ath12kWifi.

Hardware and dependencies ​

  • Ath12k device on PCIe, BAR windows, MSI routing, DMA callbacks, firmware, MHI and QRTR services.

Configuration ​

  • Select Ath12kWifi. build-gop-legacy-display.py compiles its objects through build-ath12k-wifi.py.
  • The 17 and 27 payload defaults set sheng-wifi=5; WifiProbe and the UFS driver read it.
  • dts/sheng.dts exports the WCN7850 node as /arm-io/wlan through unixnu,adt-name, before launchd checks the stock wifid job.

Procedure ​

  • Verify PCIe enumeration and MSI delivery before MHI startup.
  • Record firmware startup, scan, association, address configuration and bidirectional packet delivery separately.

Development findings ​

  • Settings can toggle Wi-Fi and list SSIDs on 24A446. Manual WPA2 association and DHCP have device confirmation. WifiNet supports 592-byte and 656-byte association requests, publishes explicit disconnect events, suppresses stale connection state, completes repeated joins and drains teardown before switching networks. Authentication queries report WPA2 personal as 0x10. Host regression and the kernel/payload/boot-image build pass. See reports/ipados27-wifi-association-2026-11-02.md.
  • The board DTS exports WCN7850 as wlan to satisfy the stock wifid device-tree condition.
  • The reusable Wi-Fi stack consumes board callbacks; PCIe and the OS network interface are owned by the device integration.
  • MHI startup and network traffic are separate completion points.
  • WifiNet uses sys/kpi_mbuf.h for the SDK mbuf interface. WifiProbe allocates its RPMh command database and arena block table at startup.
  • build-ath12k-wifi.py fetches the pinned Linux v7.0.14 sparse tree before preparing Ath12kWifi.

Completion criteria ​

  • Scanning, association, address configuration and sustained receive/transmit traffic pass with the selected firmware.

Current limits ​

  • The current state changes await device validation of joining, network switching, the Wi-Fi icon and password-sheet dismissal. Credential persistence, group-key disconnects and authentication timeouts remain open.
  • Throughput is low for an 80 MHz link.

Next action ​

  • Validate joining, network switching, power-off icon state and password-sheet dismissal on the device.
  • Measure local throughput, firmware rates, retries and aggregation; see reports/ipados27-wifi-association-2026-11-02.md.

Evidence ​

Audio ​

implemented

Hardware and dependencies ​

  • ADSP firmware from modem_a, SMEM, SMP2P, GLINK, the GPR channel adsp_apps.
  • Speakers: six CS35L43 amplifiers on QUP1 SE5 and QUP2 SE0 (I2C 0x40 to 0x42), shared reset gpio90, secondary MI2S (gpio121 to 124).
  • Microphones: WCD938x codec on the TX SoundWire master (0x6d30000), reset gpio108, supply ldob15; TX and VA macros.

Configuration ​

  • sheng-audio takes bits (sheng-adsp=2 is required): any nonzero value serves the audio service, 2 plays a 1.5 s 750 Hz test tone at boot, 4 brings up the microphone path and reads two seconds of capture, 8 runs the lock sound test.
  • sheng-audio-pa moves the DSP period buffer (default 0xd0000000); sheng-audio-tone-ms and sheng-audio-atten set the tone.
  • The payload addon carries hal/ShengAudio.driver under audio/; patches/xnu/zzyd-sheng-audio-addon-mount.patch mounts it over /System/Library/Audio/Plug-Ins/HAL. Its CDHash joins the owner trust cache.

Procedure ​

  • Read the [audio], [amps], [audio-glink], [audio-buffer], [mic], [mic regs] and [mic capture] log lines with scripts/read-sheng-log.py.
  • Read [audio-props], [audio-service], [audio-io], [audio-thread], [audio-clock], [audio-requests] and [audio-sync] for the iOS path: the plug-in's volume and peak, late and silent periods, write-ahead and read-behind, IO cycle intervals, clock skew, the audio server's IO thread scheduling and host clock, and the plug-in's last start and stop requests.
  • Run scripts/check-audioreach-host.py, scripts/check-cs35l43-host.py and scripts/check-geni-i2c-host.py after changing the codecs.

Development findings ​

  • The ADSP image loads in place from the split adsp and adsp_dtb files in /image of the modem_a FAT volume.
  • The DSP offers 24 intents of 128 bytes on adsp_apps and grants a 4 KiB one on request; the GLINK remote intent table keeps it.
  • The amplifiers play ASP RX1 directly (DSP bypassed, no amplifier firmware): top three slot 0, bottom three slot 1, gain 18 dB, 16-bit I2S at 48 kHz from the SoC as clock master.
  • The DSP takes buffers as a 32-bit address with the stream index (0x1001 & 0xf) in the upper word. The period buffer is low DRAM outside the kernel's window, mapped write-combined; the audio streams stay in SMMU pass-through.
  • Programming a translating SMMU context for the audio streams resets the board; the hypervisor keeps those context banks.
  • PRM commands go from the PRM port (2) and use PRM clock ids: the TX core clock is 0x30c. The macro and digital codec votes make the LPASS registers accessible.
  • The VA macro gates the TX SoundWire master's clock on SM8550; with its gate and the TX macro's on, the link comes up and the codec enumerates as device 1.
  • The primary microphone is AMIC3 on micbias 3 into ADC2, codec data port 1 channel 2, master port 2, TX decimator 0 from SWR_MIC1 and codec DMA TX3, mono 48 kHz.
  • iOS sees the plug-in device only with the Thunderbolt transport type: VirtualAudio makes it a driver device with one output and one input port. Built-in devices need Apple port descriptions, and a USB device needs a location the audio server does not take from a plug-in.
  • The plug-in and the service share one timeline anchored at boot on the 19.2 MHz host timer (400 ticks per frame, computed in 128-bit). Playback and capture rings hold 65536 frames; the service takes 480-frame periods and keeps four in flight.
  • The DSP answers a playback buffer once it has copied it, so the steady lead is measured per run (about 1600 to 2000 frames) and the published lead is at least 300 ms.
  • Capture answers carry a byte count and an offset; only those bytes are taken, and a short period is normal.
  • CoreAudio takes the host clock to be 24 MHz (one constant behind AudioGetHostClockFrequency). The plug-in finds that constant and the service sets it to 19.2 MHz on its shared page; without it the audio server's IO cycles ran 25 percent long and playback and recording stuttered.
  • The zero time stamps start at the frame IO starts on, every 65536 frames, with the raw clock algorithm. A period under the safety offset stops the audio server's IO.
  • The audio server's IO thread runs with a time constraint (priority 97, period 409600 ticks, computation 204800).
  • The audio server is arm64e on iPadOS 27: dlsym signs the pointer it returns, so the plug-in strips the signature to read the two instructions behind AudioGetHostClockFrequency and calls through the signed pointer. The VirtualAudio image-added rebind is built for arm64 only, because the slot pointers there are authenticated with their slot address and a plain rebind faults.

Completion criteria ​

  • Each declared route carries the selected audio format through playback or capture and handles start/stop correctly.

Current limits ​

  • Playback sounds harsh in places; no speaker equalization or protection runs.

Next action ​

  • Qualify iOS playback and capture across apps and routes, then add speaker equalization and protection.

Evidence ​

Power ​

implemented

Components: AppleKeyStoreState.

Hardware and dependencies ​

  • Board PMGR integration, clocks/regulators and per-peripheral power requirements.
  • ADSP battery manager: PMIC GLINK owner 32778 on PMIC_RTR_ADSP_APPS; board properties use opcode 0x50; fuel gauges 0x8a/0x8b and 0xa6/0xa7.

Configuration ​

  • CONFIG_XNU_SHENG_PMGR=y; sheng-pmgr=2 selects the board integration.
  • AppleKeyStoreState is selected with the OS event integration.
  • sheng-adsp=2 publishes the battery as an IOPMPowerSource; sheng-battery=0 leaves it off.
  • sheng-usb-sdp-ma sets the input limit on a standard computer port (default 900; 0 keeps the firmware limit).
  • sheng-cpufreq=4 scales the CPU domains with load (sheng-cpufreq-min sets a floor in MHz); sheng-cpufreq=3 fixes the highest non-turbo level.
  • sheng-gpu-dcvs=1 scales the GPU clock with its busy time (sheng-gpu-dcvs-min sets the floor level, default 3); sheng-gpu-perf fixes a level instead.

Procedure ​

  • Document each clock, regulator and firmware-owned state before enabling power transitions.
  • Check battery units and update behavior separately from suspend/resume and peripheral power.
  • Read the [battery], [battery-raw] and [charger] log lines with scripts/read-sheng-log.py.

Development findings ​

  • The ADSP firmware runs charging and PD/PPS negotiation without host requests.
  • Battery properties after 11 are shifted by one: charge current 12, temperature 13, charge counter 15, cycles 16, design 17, full 18, time to full 20, time to empty 21.
  • Charge is the sum of both fuel gauges' remaining over full capacity. Battery current is reported discharge-positive.
  • USB property 6 reads SDP on every port. Property 7 carries the adapter type (6 PD, 8 PD PPS).
  • A PPS adapter gets a 3 A input limit at about 8.7 V; the battery charges at the 2000 mA charge current with the charge pump off.
  • Both cells and the PD adapter read unauthenticated.
  • A Mac USB-C port negotiates PD 5 V with a 1.2 A input limit: about 1.1 A in, and the battery gains 0.25 to 0.4 A on the desktop.
  • Power policy belongs to the board even when controller operations are shared.
  • The GPU power probe hands the ring its register window without a GMU fence callback: only the GPU service checks fenced WPTR writes.
  • The CPU governor reads each CPU idle time through patches/xnu/zzye-sheng-cpu-idle.patch. Domain 0, the E cluster, scales with load like the other domains.
  • The GPU governor reads the GMU XO busy counter and votes over HFI with the level bandwidth.
  • A touch holds the P CPU domains and the GPU at their top level for sheng-cpufreq-boost-ms and sheng-gpu-dcvs-boost-ms (1000) after the last report. GPU submits in 2 of 4 windows keep every CPU domain at 60 percent of its top for 300 ms. A fence waiter sleeps up to sheng-gpu-pause-us (1000) and the fence interrupt wakes it.
  • The existing xnu-12377 migration uses kernel_target.TRIPLE and DEPLOYMENT for platform-power binding assembly and the deployment audit instead of a fixed iOS 17 target. This compilation-target change does not provide new 23F84 power or charging device evidence.
  • GpuPowerProbe retries AHB-fenced context-switch writes for up to 2 ms while keepalive is held. The governor records accepted frequency votes and, with sheng-gpu-perf=1 and diagnostic export enabled, samples 19 A7XX BR counters approximately every 32 ms with selector, reset and preemption validity.

Completion criteria ​

  • Declared power controls and battery readings match observations; each claimed sleep/resume transition restores its dependent peripherals.

Current limits ​

  • Adapter details shown to iOS come from USB property 6, so every adapter reads as a computer port.
  • Charge current stays at 2 A without fuel gauge and adapter authentication.
  • A low-battery shutdown panics in vnode_rele_ext during unmount.
  • Per-peripheral controls and battery publication have separate coverage from system suspend.
  • The GPU governor changes level several times a second and spends most busy time at 680 MHz; its effect on frame times is not measured.

Next action ​

  • Take adapter details from property 7.
  • Authenticate both fuel gauges, then qualify PPS charge pump charging; Xiaomi adapter authentication follows.

Evidence ​

Image assembly ​

implemented

Components: DarwinBoot, XnuPrelink, SoftwareAES.

Hardware and dependencies ​

  • Prelinked kernel, hardware DTB, generated ADT, trust cache, Data seed, platform identity and firmware DTB.

Configuration ​

  • The 27 archive recipe builds the fileset comparison kernel with --lto; the reference builder validates its inputs and output digest before reuse.
  • Payload volume is 208 MiB. kernel.patch_series selects ARM64, SoC, OS and device series in order.

Procedure ​

  • Build kernel and package, then payload with --unique-chip-id and the selected trust-cache/Data inputs.
  • Run ./unixnu bootimg -D ../UniXNU-sheng --uefi ../uefi-sheng --dtb <firmware.dtb> and inspect the assembly report.

Development findings ​

  • The next 24A446 device run passed the display branch but aborted in vfs_fsadd+0x364: APFS still referenced an old vnop_mknod descriptor address, which now held zone_array data (index 0xaaaaab). XnuPrelink now pins 13 missing vnode descriptors, four metaclass pointer slots, gIODTPHandleKey and audio_active by data identity and source consumers. A subsequent run mounted the OS root and SystemCryptex, then stopped because the payload omitted its Data seed. The payload now rejects CONFIG_XNU_OWNER_DATA_MOUNT without a seed; a persistent overlay also requires the original seed.
  • Fileset adapters contain N_ABS function branches without split-segment records. XnuPrelink now retargets them after placement and rejects destinations outside retained executable code. The final packed 24A446 kernel passes checks for 266 branches and five absolute data symbols; the scan covers 317146 branch-shaped words, with two source-confirmed inline constants.
  • The 2026-11-02 packaged 24A446 image panicked at corecrypto_kext_start: its kprintf import was rebound to unixnu_fileset_unmapped. The recipe omitted --lto and the reference builder accepted any existing output. Restore LTO and rebuild the reference and mapping; packaging success with --allow-missing does not establish boot compatibility.
  • The OS boot-progress integration follows the SoC hooks in patch order.
  • The payload carries kernel.macho.adt; the boot image carries the firmware FDT. Keep the two inputs named explicitly.
  • The device patch series adds zzyd-sheng-audio-addon-mount.patch: the payload addon's audio directory is union-mounted over /System/Library/Audio/Plug-Ins/HAL (mount4 in the A log line).
  • zzyf-sheng-amp.patch follows it: the AMP Edge scheduler for the E and P clusters (see the cpu area).
  • The selected xnu-12377 board series contains CPU-idle, AMP and audio-addon patches. The new source-driver archives are compile-audit outputs only and are not added to the minimal 23F84 boot payload.
  • scripts/package.sh is the shared packaging script of the device repositories (templates/package.sh in UniXNU) and holds no board value: board.toml [package] names the UniXNU checkout and the defconfig of each OS profile, and [os_overrides] holds the kernel, payload and component values of the 17 and 26 profiles. unixnu release --check lists 64 patches for 17, 75 for 26 and 78 for 27. scripts/package.sh --os 27 produces boot.img (185733120 bytes), payload.img (184549376 bytes) and kernel.macho (96354304 bytes) when --uefi and UNIXNU_UNIQUE_CHIP_ID are given. The firmware preflight runs scripts/fetch-sheng-dts.py, which builds the firmware device tree that board.toml [bootimg] dtb names, and scripts/check-sheng.py reads the firmware checkout from UNIXNU_UEFI. build-ath12k-wifi.py runs tools/fetch-sources.sh of Ath12kWifi first, which fetches the pinned Linux sources.
  • The bringup patch includes sys/proc.h at its exception record: the RELEASE-config fileset reference build compiles the same tree without the DEVELOPMENT block that carried the declaration.
  • The xnu-12377 board series includes optional latency hooks for IPC, user exceptions, fault registers and signal exit reasons. build-sheng-source-storage.py links BootLatencyTrace.c and includes its header hashes in the source identity.
  • The xnu-12377 board series drops the IPC, user-client, contiguous-allocation and latency-detail trace patches and ends with zzzzzzzzz-sheng-unnest-trace.patch, a board hook in log_unnest_badness before its rate limit; the latency trace patch keeps only the user-fault hook.

Completion criteria ​

  • Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit.

Current limits ​

  • Device logging confirms the reference/import repair passed corecrypto initialization and reached the native legacy-display constructor. The next failure exposed unrelocated absolute adapter branches. Hardware verifies the branch repair and vnode descriptor repair through OS/SystemCryptex mounting. The final collection still reports two unresolved data references and 24 trap references; later boot validation must be recorded separately.
  • Image output depends on the selected ABI audits, firmware and volume policy inputs.

Next action ​

  • Attach artifact paths and exact source revisions to the next image build record.

Evidence ​

Diagnostics ​

implemented

Hardware and dependencies ​

  • Serial or framebuffer diagnostics, panic region, boot checkpoints and a recovery path.

Configuration ​

  • boot-progress=2 enables checkpoints; source and image revisions accompany every log.
  • On the iPadOS 27 native source path, sheng-log=1 plus boot-ui-trace=1 starts a separate process-capture worker. boot-ui-focus3=chronod adds the display-query client to backboardd and SpringBoard. Arm64e return-address PAC is stripped for diagnostic stacks.

Procedure ​

  • Run the existing check for the changed area and keep its command, output and input revision.
  • Record the last completed checkpoint and the first failing operation; link the captured output.

Development findings ​

  • A source implementation, a host check and a device observation establish different completion levels.
  • Keep an unresolved cause explicit and record the next measurement that can distinguish it.
  • The UFS log carries [adsp], [qrtr], [battery], [battery-raw] and [charger] lines for the DSP, the IPC router and the charger.
  • BatteryProbe starts the battery with sheng-adsp=2, so the [battery] and [charger] lines appear on every DSP image; a missing [battery] line on such an image means sheng-battery=0 or a failed start.
  • Host checks for the ADSP path: check-adsp-host.py, check-modem-fw-host.py, check-qrtr-host.py and check-battery-host.py.
  • The log carries [audio], [amps], [audio-glink], [audio-buffer], [mic] and [mic regs] for the audio path, and [gpu wptr] for fenced GPU write pointer writes.
  • GPU memory rows: [vm map], [vm unmap], [vm kinds] (time per owned map, fast and full import, unmap by page and by ASID) and [bo memory]. Governor rows: [cpu gov] with boost and frame-floor counts, [cpu throttle] and [gpu dcvs] with touch and wake boosts. Display rows (sheng-dpu=2 or 3, sheng-dpu-scanout): [dpu vig0], [dpu vig1], [dpu ctl0], [swap surfaces], [direct scanout] and [dpu smmu].
  • The 23F84 branch lock and source-driver report describe different stages: unixnu.lock covers the selected minimal build, while reports/ipados26-source-drivers.json records separate public-family compile inputs, object hashes, warning counts and unresolved imports. Neither report qualifies source-driver device execution.
  • unixnu.lock records the sm8550 source at the same commit as feeds.toml; fetch rewrites it, so a hand edit and a fetch must agree.
  • scripts/check-sheng.py reads the firmware checkout from UNIXNU_UEFI, which the firmware step of unixnu sets for its preflight scripts.
  • The direct scanout log labels native_legacy_direct[12] as waits>=250ms. This counter records a slow GPU wait; direct display retries busy queries and keeps the current frame until completion or swap cancellation.
  • kernel.latency.bin pairs IPC send attempts and receive completions by message cookie, records user exception registers, accepted GPU frequency votes and touch coordinates, and exports a bounded LAT1 ring before filesystem logs. Events 61-63 expose encoding batch waits, frontend phases and render-thread identities; client samples mark the selected render thread with state 0x1000, and CPU process names follow xpcproxy exec. The exporter prioritizes the complete backboardd frames.trace before optional CPU reports; framework files, unified logs, shader inventories and images are excluded.
  • Detailed capture records slow encoding operations, callback and destructor identities, outgoing IPC/reply ports, blocked-thread user/kernel stacks and Mach service peers. Faults retain registers, bounded worker-read stacks and image UUIDs; signal exits include reason descriptions. sheng-gpu-perf=1 enables the 19-counter A7XX BR plan with selector, reset and preemption validity. The source-storage archive includes the latency capture object.
  • LAT1 separates 32768 fault/identity records from 491519 ordinary events and one coverage summary. IPC keeps traced requests, matching receives and tracked replies, with unmatched or ambiguous traffic counted. Tracking tables are allocated when capture starts and do not occupy linked kernel data. Pending display queries retain state changes, a 100 ms heartbeat and omitted counts. Idle runtime stages and duplicate generic IOKit/GPU/IPC streams are excluded before recording. Fast unannounced resource spans below 250 microseconds are omitted; paired callback spans remain. Dispatch task tracing uses the optional introspection SPI.
  • The latency capture keeps only seven-issue evidence: the backboardd frame trace, kernel GPU submission and display records, large GPU allocations, CPU occupancy and process CPU time, 4 ms samples of the render server's render, encode and completion threads and SpringBoard's main thread, blocked-thread waits, faults with exit reasons, shared-region unnests with kernel and user callers, and touch report times that bound the analysed windows. Mach message flow, user-client calls, contiguous allocations, per-contact touch records and dispatch points are not collected, and their xnu hooks are removed from the series. The export reads the sampler rings at their allocated sizes.
  • scripts/sheng-latency-report.py prints the acceptance figures of a capture inside touch windows: frame intervals, large allocations, full-screen pass times, slow completions, encode thread priority and run-queue share, client crashes and Metal refusal texts.

Completion criteria ​

  • Each claimed milestone has a reproducible command, a matching source/image revision and an accessible result.

Current limits ​

  • Source references in this record describe implemented behavior. Host and device status require their respective evidence entries.

Next action ​

  • Add captured host or device evidence when repeating a checkpoint on a known image.

Evidence ​

arm64e-os ​

planned

Hardware and dependencies ​

  • iPadOS 26.5.2 build 23F84 IPSW for iPad17,1 to iPad17,4; target identity iPad17,3 J820AP.
  • Public XNU source xnu-12377.121.6; arm64e profile requirements in https://unixnu.com/porting/arm64e.

Configuration ​

  • board.os_profile = ipados-26.5.2-23F84 with [os] arch = "arm64e"; kernel defconfig sheng_ipados26_defconfig selects the full sheng component set; the xnu-12377 patch series is split into arch, SoC, OS and device layers.
  • Payload kernel arguments: -v serial=3 debug=0x14e kt_fixed_zones=120 -no_slto_panic; no install menu.
  • The arm64e build uses the BCM2837 machine config restored for xnu-12377, the non-SPTM pmap and no Apple CPU counters.

Procedure ​

  • Check FEAT_PAuth, EL1 key register writes and PAC instruction behavior on all eight CPUs.
  • Build the arm64e kernel from xnu-12377.121.6 with the ported 4 KiB patches, then prelink the 23F84 kexts.
  • Follow the bring-up order: arm_init, bsd_init, root mount, launchd, SpringBoard.

Development findings ​

  • The 23F84 kernelcache is xnu-12377.122.8; xnu-12377.121.6 is the closest public source.
  • SM8550 CPUs implement FEAT_PAuth; signatures are created on the device, so the PAC algorithm need not match Apple's.
  • Public XNU programs PAC keys only for VMAPPLE through HVC; the arm64e profile provides native key programming.
  • The 23F84 dyld cache is arm64e and contains SME code; SM8550 has no SME.
  • The arm64e xnu-12377.121.6 kernel compiles and links as MH_EXECUTE with chained fixups.
  • The 23F84 kernelcache is an MH_FILESET with stripped symbol tables; kext code branches directly into the kernel, so the prelink step for iPadOS 17 does not apply.
  • The bringup patch includes sys/proc.h at its exception record: the RELEASE-config fileset reference build compiles the same tree without the DEVELOPMENT block that carried proc_pid's declaration.
  • The shared xnu-12377 device series carries latency, fault-detail and signal-exit hooks backed by BootLatencyTrace.c. The capture is enabled by diagnostic export; qualification of another OS profile requires its own build and device evidence.
  • The iPadOS 27 kernel keeps the board user-fault and exit hooks and adds the shared-region unnest hook; the IPC send/receive, user-client call and contiguous-allocation hooks are no longer patched in.

Completion criteria ​

  • The arm64e kernel reaches launchd on sheng from the 23F84 root volume, then SpringBoard.

Current limits ​

  • Facts: only the boot core has a recorded PAC check; the other seven cores are unmeasured.
  • Facts: no fileset prelink output exists yet, so the kernel has not booted.
  • Facts: the storage, AES, HID, platform power, Adreno and GOP binding archives use original kext addresses recorded from the iPadOS 17 kernelcache; the iPadOS 26 kernelcache has no symbols for them.
  • Guess: the SME functions are selected at run time from hw.optional and commpage features; this is unconfirmed.

Next action ​

  • Produce a fileset kernel collection from the native kernel and the selected 23F84 kexts.
  • Read ID_AA64ISAR1_EL1 and ID_AA64ISAR2_EL1 on all eight CPUs and run a PACIA and AUTIA round trip on each.

Evidence ​

Released under the BSD-2-Clause-Patent License.

Copyright 2026 UniXNU contributors