UniXNU

简体中文

English

简体中文

English

外观

Lenovo Xiaoxin Pad Pro 2021 TB-J716F UniXNU bring-up (EmptyGhost) ​

EmptyGhost/UniXNU-j716f

Lenovo TB-J716F migration record for the UniXNU iPadOS 17.7.11 bring-up.

源记录: porting.toml, 93cd24d23f5aa3fd8457342471689693366fc9aa.

本页按设备记录自动生成。

部分状态
配置host-verified
固件与启动device-verified
CPU 与中断planned
内存与 DMAdevice-verified
存储与根卷planned
显示device-verified
输入device-verified
GPUplanned
网络planned
音频planned
电源planned
镜像组装host-verified
诊断device-verified

配置 ​

host-verified

组件: XnuPrelink, DarwinBoot.

硬件与依赖 ​

  • SM8250/Kona identity, iPadOS 17.7.11 profile candidate, source defconfig, and the local SoC evidence snapshot.

配置 ​

  • board.toml uses schema_version 2, soc_source sm8250, os_profile ipados-17.7.11-21H461, and device:dts/j716f.dts.
  • The source qualification defconfig remains the reproducible kernel configuration; it does not claim a bootable XNU.

操作步骤 ​

  • Run the latest UniXNU defconfig, status, tree, and porting-record checks from the UniXNU checkout.

开发经验 ​

  • CI review: native source build step succeeded at e104fe3b; encrypted transfer rejects six outputs against old four-output allowlist. Profile-specific seal/open validation and synthetic regression checks added; remote repair run pending, no device operation.
  • The local SM8250 source remains a transition snapshot; a public common scaffold is not yet qualified for this port.
  • The macOS source workflow is pinned to UniXNU 42bffe8 and keeps its J716F compatibility fixes in the device repository.
  • The source qualification defconfig disables the profile's MOCKFS fixture because that fixture requires ArmCpu, while this board intentionally keeps ArmCpu disabled.
  • The source-output sealing step discovers the migration-qualified report and tree instead of assuming the legacy out/j716f root.
  • A public SM8250 common scaffold exists at 6bb9b025704764a662728dce1a30557a35e082d8, but it is not yet qualified or selected for this port; the local transition snapshot remains.

完成条件 ​

  • The format 2 identity, source paths, defconfig, and patch order resolve without ambiguous board fields.

当前范围 ​

  • The SoC source is local and not yet a reusable fixed public commit; component ABI inputs remain incomplete.

下一步 ​

  • P17 original chosen/stall/topology and boot CPU number returns reached, SCTLR M1 and all nine CRCs survived one video-observed reboot. Preserve result; audit grouped boot CPU publication/max-CPU checks, current-thread/CPU bootstrap and rtclock_early_init, with logger mapping/stack lifetime. Native provider build and IRQ qualification remain separate.

证据 ​

固件与启动 ​

device-verified

硬件与依赖 ​

  • Mu-Silicium J716F platform, inherited GOP, fixed ZUI memory map, and the board UEFI DSC/FDF.

配置 ​

  • The device board points to the j716f DSC/FD and keeps vendor inputs outside the public repository.

操作步骤 ​

  • Build the diagnostic FD with the local UEFI checkout, audit its inputs, then boot only through boot_b for hardware checks.

开发经验 ​

  • V14 reached the UniXNU menu and exercised the documented button and DarwinBoot protocol paths.
  • V16 on boot_b displayed the green ExitBootServices bar, the blue MMU-off XNU entry probe and the magenta pre-MMU-enable probe; the screen also showed the normal CapsuleRuntimeDxe LockCapsuleInterface callback.
  • V17 on boot_b waited through the post-MMU probe, executed PSCI reset, and returned to the UniXNU menu with the same three entry bars.
  • V18 displayed the same three bars but later reset back to UniXNU despite replacing stage 3 with a WFE loop; the external reset/watchdog source is unresolved.
  • V19/V20 added read-only reset diagnostics. V20 photographs showed the DarwinBoot pre-ExitBootServices message and a later menu, but no readable PMIC value.
  • V21 continuous video confirms its own green/blue/magenta bands and restart through a Lenovo logo; V22A/1s and V22B/3s have passed host builds and final-image audits but have not been flashed.
  • V22A/B hardware times were 20.245/19.730s, without the intended 1s/3s response; B ended in A-slot ZUI. V23P/C/V/M host builds passed. P alone was flashed to boot_b and tested; only its first diagnostic line appeared before restart, so PSCI remains unverified.
  • V23P2 bootloader flash failed with unknown command; fastbootd flash of boot_b, B activation and reboot succeeded. Keep both operation outcomes separate.
  • P3A/B builds passed and every extracted non-payload firmware module matches P2. No P3 device operation was performed; the V23 DSC/FDF and platform modules are unchanged.
  • V23P3A was flashed only to boot_b via fastbootd, B activated and reboot command succeeded. Video, menu identity, prefix progress and PSCI results are pending; P3B remains unflashed.
  • V23P3B was flashed only to boot_b via fastbootd, B activated and reboot command succeeded. User report for P3A was brief screen then reboot; no checkpoint or PSCI result established. P3B video is pending.
  • V23P4 r1 actual non-payload firmware modules match P2; only embedded FAT changes. Original P4 was not flashed after preflight found its markers would be cleared.
  • V23P4 r1 was flashed only to boot_b through fastbootd; B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Menu identity, marker visibility, PSCI and reset observations await video. Retry-count variable is unsupported.
  • V23P4 r1 video confirms both early MMIO markers and title mode 5 with prefix squares 1/2; square 3 and EL/SCTLR are not observed. Original STR was passed, but external transaction completion is unproven. Diagnostic display disappears about 15.9s after entry, then Lenovo/Android splash and r1 menu return; PMIC 0x02000001 -> 0x02000041, reset cause unknown. Next-build source preference: UniXNU menu scale changed from 4 to 3 after r1 video; not compiled or flashed. Kernel diagnostic font unchanged. Original r1 library sources were privately snapshotted and match its remote-build hashes; the next build must explicitly audit the changed menu module.
  • V23P5A/B matched controls passed host image, source/HMAC, pair-delta and emulator checks. A kernel equals P4 r1; B differs only in relocated STR-to-NOP and HMAC. Both use compiled menu scale 3, identical non-payload modules, markers and title DSB. No P5 hardware trial or device write. Test A then B on boot_b. See docs/V23P5_MATCHED_MMIO_CONTROL.md.
  • V23P5A was flashed only to boot_b in fastbootd; B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. A menu identity, marker progression and reset observations await video. P5B remains unflashed. No PSCI or MMU-on result is claimed.
  • V23P5A video confirms the compact A menu, title mode 5, prefix squares 1/2 and both early MMIO markers, reproducing P4 r1 visible progress. No square 3, EL/SCTLR or PSCI evidence. Display disappears about 17.47s after entry, followed by Lenovo/Android splash and return to A menu; PMIC 0x02000001 -> 0x02000041. Reset cause and external MMIO completion remain unknown. P5B is the next boot_b control and remains unflashed.
  • V23P5B was flashed only to boot_b in fastbootd; B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Its menu identity and diagnostic progress await video. Reviewed P5A remains the visible control; no P5B functional, PSCI or MMU-on result is claimed.
  • V23P5B video confirms the compact B menu, both lower envelope markers and partial title in frame 56; the diagnostic is captured in only one camera frame. Top prefix 1 completion, prefix 2/3, EL/SCTLR and A0/pre-SMC are not established. Entry band to display loss is about 0.067s (camera observation), followed by Lenovo/Android splash and return to B menu; PMIC 0x02000001 -> 0x02000041. Rapid intentional PSCI reset is a hypothesis, not a verified result. Next proposed control retains P5B and replaces only its SMC with an in-place branch, preserving the preceding DSB; not yet built. This checkpoint supersedes earlier pending/unflashed notes; no new device operations or push occurred during video review.
  • Reviewed upstream logging/automatic-test guide at 16e592abee8a550dec8154ed1f38b5ebc4f16213 and same-SoC umi at 3eb72578597d2ca16471b172d45eddc096a34a04. Prioritize board-qualified retained RAM trace plus separate firmware QR logging. Existing J716F Recovery DT/dmesg show overlapping boot_log 0xb0000000+0x80000 and pstore 0xb0000000+0x100000; console file length 262132 does not establish its physical subrange. Do not copy umi 4MiB/2MiB layout or sheng disk/reset constants. Verify layout/format and minimal reset retention before attaching XNU records. Full unattended logging requires a validated reader and return-to-fastboot cycle. Read-only source/evidence review only; no new device test or logging implementation.
  • V23P6 RAMLOG r1 is host-verified and unflashed: read-only TWRP live parameters plus matching-build Recovery allocator emulation locate console at 0xb00be000+0x40000 (12-byte DBGC, ECC=0). iomem difference is reserved System RAM vmap versus non-RAM request_mem_region. Independent app validates live header before manual single-marker append; default read-only, no automatic start/reset, manual EFI warm request, no XNU. Actual SEC/four DXE nonpayload deltas are only the reservation-size byte; other modules/APRIORI unchanged. Retention and live header remain unverified. See docs/V23P6_RAMLOG_RETENTION.md.
  • V23P6 RAMLOG r1 (uncommitted additions on the recorded repository base; exact source/image hashes are in the P6 manifest) was flashed only to boot_b through fastbootd with the audited image; B activation, current-slot b and slot-unbootable:b=no were verified, and reboot command succeeded. First live header, marker append, warm-reset retention and Recovery readback await device observation. No other partition write or repository push occurred.
  • V23P6 first video/photo confirms the correct menu and read-only app: console DBGC 0x43474244, next=size=0x37bd9, capacity=0x3fff4, VALID, marker counts 0 and no append. The inferred console header is now device-readable and consistent, with 33819 bytes of unused capacity. No append, restart retention, Recovery readback or XNU progress is established. See research/v23p6-first-header.json.
  • V23P6 second video verifies manual RAM marker append and same-run readback: next=size 0x37bd9 -> 0x37c09 (+48 bytes), now=1, appended_this_run=1, APPEND READBACK OK. At about 15s the app reports Warm reset returned; no actual reboot is observed. At about 28s the app exits to parent EFI return diagnosis with Success/code 0, which is normal app return and not reset success. Cross-reset retention and Recovery readback remain unverified. Root cause of the returned firmware reset call is unknown. First-header transcription corrected to 0x37bd9 (33819 free bytes). See research/v23p6-append-reset-return.json.
  • V23P7 RESET r1 is host verified and unflashed. Only the P6 embedded FAT config/app changes; all non-payload inner-FV module sections and compact SEC executable match P6 exactly. Actual P6 reset driver uses SMC, queries RESET2 then falls back to SYSTEM_RESET; unused stack inputs are a host finding, not the proven failure cause. P7 defaults to read-only inventory; manual PSCI queries/firmware Warm/direct reset actions log PRE/RETURN to the validated console. Five wrapper cases, two linked record/gate cases and image/source audits passed with mocked SMC responses. First hardware trial must only photograph inventory and Query PSCI results on boot_b; no reset, retention or XNU result yet.
  • V23P7 RESET r1 (uncommitted source additions on the recorded repository base; exact source/image hashes in the P7 manifest) was flashed only to boot_b through fastbootd. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Inventory/PSCI-query observations await video. No reset trial, retention result or new XNU checkpoint is established.
  • V23P7 photos verify EL1, installed reset driver GUID/RVA/prefix match, PSCI_VERSION=0x00010001 (1.1) and FEATURES=0 for SYSTEM_RESET and RESET2 A64. Valid console next=size grows 0x2923f -> 0x2958a (+843 bytes); P7 entry=0/now=6 and Queries complete=1. Query returns and app-displayed same-run records are established. No actual P7 reset, retention, Recovery readback or new XNU checkpoint. Next manual trial uses Direct RESET2 only; preserve initial post-reboot inventory or returned x0..x3. Uninitialized old-driver inputs remain an unproven cause.
  • V23P7 RESET2 video/photo confirms two direct 0xc4000012 type=0/cookie=0 calls return x0=0xfffffffffffffffe (INVALID_PARAMS -2), x1..x3=0. FEATURES remains 0; valid console next=size 0x2958a -> 0x296a3 -> 0x297bc and P7 now 6 -> 8 -> 10. No reboot is observed in the 10.50s video; retention and Recovery readback remain untested. Old Warm falls back only on FEATURES failure, not on returned RESET2 error; historical P6 SMC returns remain uncaptured. Next manual test is existing Direct SYSTEM_RESET only. No new device commands, flash or source changes during this media review.
  • User reports the first P7 Direct SYSTEM_RESET rebooted, then selecting it after reentering the app did not reboot. No new SYSTEM_RESET photo/video or post-reset ring counts yet. Fresh app load clears mQueried; without rerunning Query, the action is blocked before SMC. Second-attempt gate status versus actual returned SMC is unresolved. Preserve full page/entry/now before new queries. One reboot is user-reported; repeatability and RAM retention remain unverified.
  • User clarified the second no-reboot selection displayed blocked; rerunning Query then Direct SYSTEM_RESET rebooted again. Two successful SYSTEM_RESET invocations are user-reported; no SYSTEM_RESET error return was reported. User then forced power off and entered ZUI13 before post-reset inventory capture. Earlier reset retention remains unknown; later marker state cannot isolate that path. Repeat a controlled P7 boot_b cycle from a photographed baseline, without forced shutdown or ZUI detour. No new flash/source/device commands performed.
  • Controlled P7 retention cycle relaunched: fastboot initially reported current-slot a and slot-unbootable:b=yes. set_active b succeeded; current-slot b and slot-unbootable:b=no verified; reboot command succeeded. No partition image was flashed. Prior P7 flash/image hash supplies expected identity, not a new partition readback. Await menu identity, baseline and post-SYSTEM_RESET read-only photo; retention remains unverified.
  • V23P9E was flashed only to boot_b after exact image-hash and fastbootd identity/unlock/size gates. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Await the initial read-only reader ENTRY photo before Query/ARM. No kernel entry/reset-retention observation or MMU progress yet. V23P9M remains unflashed and gated on observed E entry-record retention.
  • V23P12A/B built and host verified, unflashed. Six independent pre-staged CRC-bound records use one-byte commits; ENTRY high32 binds ARM CRC and low32 is SCTLR. A skips BCM and B preserves captured original address/value, with exactly one STR/NOP probe delta and identical reader/ADT/nonpayload firmware. 58 actual-assembly and22 linked-reader mocked cases passed; final image/HMAC/source audits passed. Byte-identical P11 power app reuses22 host cases. No P12 hardware/retention/MMU-on result; A first on boot_b only.
  • V23P12A BCM SKIP was flashed only to boot_b after image SHA256, matched-probe and fastbootd product/unlock/slot-count/partition-size gates. B activation, current-slot b and slot-unbootable:b=no verified; reboot command succeeded. Menu-only launch; recording readiness was not separately confirmed. Menu identity, initial reader, fresh Query/ARM and kernel/slot observations pending. B remains unflashed and gated by reviewed A evidence; no P12 retention, reset-source or MMU-on result. A image SHA256=49e924cd6fc784dff9c9df0df917d2d05156d34f95eea9f24569dea69234b5f8.
  • P12A initial photo confirms V23P12 reader at EL1, frozen ENTRY/NOW VALID next0x26e9 size0x3fff4 consoleCRC50977087, logical0/raw0 and all eight rows zero. THIS RUN ID1/query0/armed0. This is a saturated circular console, not an empty log. P12 linear-tail requirement fails before Query (832 bytes required); no Query block message or kernel launch observed. Parent A menu not pictured; variant follows recorded flash. Preserve baseline; qualify full-ring handling before a new attempt, B/P10C remain gated.
  • P12 r2 A/B built and host verified, unflashed. New reader requires explicit double confirmation before discarding a VALID saturated/exhausted console logical history; frozen entry remains, payload not bulk-cleared, INIT records old next/size, failure locks Query/ARM. 45 actual-linked reader cases passed including full-session-to-both-unchanged-kernels-to-frozen-reader flow, changed-console cancellation, failure and stale-ID gates. A/B kernel/ADT/probes equal r1 byte for byte; 58 prior assembled cases reused after identity check. Power app equals P11, 22 cases reused. Final FD/FAT/EFI/source/HMAC/nonpayload/boot-image checks passed. No r2 hardware, retention or MMU-on result; A first on boot_b only.
  • V23P12R2A BCM SKIP flashed only to boot_b after image SHA256/matched-probe/fastbootd identity gates. B active and bootable verified; reboot command succeeded. Menu-only launch; no independent recording-ready confirmation. Initial r2 reader, manual new-session action, Query/ARM and kernel observations pending. r2B remains unflashed and gated by reviewed r2A six-slot/header/reboot evidence. No new kernel progress, retention or MMU-on result.
  • P12 r2A initial photo confirms r2 reader at EL1; ENTRY/NOW VALID next=size0x38b69, consoleCRC98919B86, logical0/raw0, frozen checkpointID0 and all eight rows zero. THIS RUN ID1/query0/armed0/CRC0. Unused linear tail29835 bytes exceeds Query832-byte budget; no session rollover needed or performed. No kernel launch, r2 retention or hardware rollover qualification; parent A menu not visible, variant follows recorded flash. Earlier r1 saturated baseline stays independent.
  • P12 r2A Query/ARM photo shows NOW VALID next=size0x38ca9 logical5/raw5, THIS RUN ID1/query1/armed1 CRC063FE873 at EL1, PSCI1.1/FEATURES0 and ARM + six invalid templates OK. Frozen initial ENTRY remains0x38b69/CRC98919B86 with zero rows. Header growth320 bytes matches four Query records plus ARM; ARM phase9 CRC reconstructs exactly with cookie5031324b45524e4c and prior0x38c69. No session rollover or kernel launch observed. Fresh ARM binding saved for one A launch; expected terminal header0x38e69 is derived, not observed.
  • P12 r2A postreboot photo confirms ENTRY/NOW VALID next=size0x38e69 consoleCRCC067D0A6, logical12/raw12 latest ID1/phase21/04FFEC87. Fresh ARM063FE873 matches prelaunch; ENTRY1210179B value063FE87300C00808(M0). All six stages16..21 are L1/R1 with CRCsE66CD221,AA22646F,B1021655,9AB5746F,8742F221,04FFEC87 and ARM-bound value50313253063FE873; all eight CRCs reconstruct exactly. New reader ID2/query0/armed0, read-only. User explicitly reports automatic reboot/menu return; no continuous video reviewed. A skipped BCM and reached all six commits/publication, with matching records present after reported reboot. Kernel SMC/reset source, original BCM completion, MMU-on and manual session rollover remain unqualified. r2B original-STR control is next.

完成条件 ​

  • The FD enters UniXNU, preserves the documented memory reservations, and exposes the framebuffer for the menu.

当前范围 ​

  • Bounded MMU-on and original early-init returns are verified by P13-P16. Sustained operation, ArmCpu/ArmDTPlatform driver matching, timer IRQ, UFS/root and userspace remain unverified; TzDxe is out of scope.

下一步 ​

  • P17 original chosen/stall/topology and boot CPU number returns reached, SCTLR M1 and all nine CRCs survived one video-observed reboot. Preserve result; audit grouped boot CPU publication/max-CPU checks, current-thread/CPU bootstrap and rtclock_early_init, with logger mapping/stack lifetime. Native provider build and IRQ qualification remain separate.

证据 ​

CPU 与中断 ​

planned

硬件与依赖 ​

  • CPU0 MPIDR affinity 0, PSCI SMC, and a 19.2 MHz timer from the firmware device-tree evidence.

配置 ​

  • The DTS describes one enabled CPU and the measured timer frequency; the source qualification defconfig keeps ArmCpu disabled.

操作步骤 ​

  • Compile the DTS, enable the reviewed ArmCpu implementation, and verify CPU entry, timer and IPI checkpoints.

开发经验 ​

  • Only the single boot CPU and shared resource addresses are currently audited; no multi-core XNU entry has been established.
  • The source qualification keeps ArmCpu disabled, so the profile's MOCKFS executable-root fixture is disabled rather than claiming CPU component support.
  • V23 isolates pre-MMU PSCI, CNTPCT and CNTVCT with fixed-iteration sampling. P hardware reached only the first diagnostic line; common-prefix completion, counter access and PSCI execution remain unverified. No ArmCpu qualification is claimed.
  • V23P2 video shows only inline checkpoints 1/2 before the title DSB boundary; no CurrentEL/SCTLR, counter or SMC progress is established.
  • P3A changes only the legacy BCM store to NOP. P3B retains it and changes only the title barrier to DMB, preserving other rows DSB. Both retain counter-free PSCI diagnostics; no CPU/PSCI hardware qualification is added.
  • V23P4 r1 video confirms both early MMIO markers and title mode 5 with prefix squares 1/2; square 3 and EL/SCTLR are not observed. Original STR was passed, but external transaction completion is unproven. Diagnostic display disappears about 15.9s after entry, then Lenovo/Android splash and r1 menu return; PMIC 0x02000001 -> 0x02000041, reset cause unknown.
  • V23P5A/B matched controls passed host image, source/HMAC, pair-delta and emulator checks. A kernel equals P4 r1; B differs only in relocated STR-to-NOP and HMAC. Both use compiled menu scale 3, identical non-payload modules, markers and title DSB. No P5 hardware trial or device write. Test A then B on boot_b. See docs/V23P5_MATCHED_MMIO_CONTROL.md.
  • V23P5A video confirms the compact A menu, title mode 5, prefix squares 1/2 and both early MMIO markers, reproducing P4 r1 visible progress. No square 3, EL/SCTLR or PSCI evidence. Display disappears about 17.47s after entry, followed by Lenovo/Android splash and return to A menu; PMIC 0x02000001 -> 0x02000041. Reset cause and external MMIO completion remain unknown. P5B is the next boot_b control and remains unflashed.
  • V23P5B video confirms the compact B menu, both lower envelope markers and partial title in frame 56; the diagnostic is captured in only one camera frame. Top prefix 1 completion, prefix 2/3, EL/SCTLR and A0/pre-SMC are not established. Entry band to display loss is about 0.067s (camera observation), followed by Lenovo/Android splash and return to B menu; PMIC 0x02000001 -> 0x02000041. Rapid intentional PSCI reset is a hypothesis, not a verified result. Next proposed control retains P5B and replaces only its SMC with an in-place branch, preserving the preceding DSB; not yet built. This checkpoint supersedes earlier pending/unflashed notes; no new device operations or push occurred during video review.

完成条件 ​

  • Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on the selected cores.

当前范围 ​

  • CPU0 early XNU entry, bounded MMU-on and early-init returns are observed. ArmCpu/GIC driver integration, actual timer IRQs, scheduler and secondary CPUs remain unverified.

下一步 ​

  • P17 original chosen/stall/topology and boot CPU number returns reached, SCTLR M1 and all nine CRCs survived one video-observed reboot. Preserve result; audit grouped boot CPU publication/max-CPU checks, current-thread/CPU bootstrap and rtclock_early_init, with logger mapping/stack lifetime. Native provider build and IRQ qualification remain separate.

证据 ​

内存与 DMA ​

device-verified

硬件与依赖 ​

  • Two firmware RAM banks, a 5 GiB primary contiguous bank, reserved ranges, and the qualified 256 MiB DarwinBoot window.

配置 ​

  • The board DTS records the primary 0xc0000000/0x140000000 bank; the diagnostic payload separately requests 0x10000000 owned bytes.

操作步骤 ​

  • Audit the memory map on the host, then allocate, cache-maintain, read back and release the V14 window on boot_b.

开发经验 ​

  • The V14 256 MiB physical window passed seven checks, including two complete write/read rounds with cache maintenance and release; this does not validate full DRAM ownership.
  • V21 host audit confirms the same embedded FAT payload and module GUID set as V20; this does not add a new RAM qualification result.
  • V22 retains the actual V21 ADT, memory map and 256 MiB request. Its host image audits add no new device RAM qualification.
  • V23M checks exact TCR/MAIR/TTBR layout and a zero unreferenced spare page inside the kernel-owned 64KiB bootstrap reserve before mapping the existing display reservation. It changes no firmware ownership; real MMU translation is untested.
  • V23P2 adds only bounded stores within the existing validated framebuffer reservation; no table, RAM ownership or MMU mapping change is introduced.
  • P3B uses 20 previously zero bytes inside the existing guarded kernel code cave. It introduces no new firmware allocation, ownership or framebuffer mapping change; real MMIO/barrier behavior is untested.
  • V23P4 r1 uses the existing guarded cave (2108 of 2800 bytes) and fixed framebuffer reservation; no mapping or MMU configuration changes. Exact P2 rollback includes restoring the original clear STP.
  • V23P4 r1 video confirms both early MMIO markers and title mode 5 with prefix squares 1/2; square 3 and EL/SCTLR are not observed. Original STR was passed, but external transaction completion is unproven. Diagnostic display disappears about 15.9s after entry, then Lenovo/Android splash and r1 menu return; PMIC 0x02000001 -> 0x02000041, reset cause unknown.
  • V23P5A/B matched controls passed host image, source/HMAC, pair-delta and emulator checks. A kernel equals P4 r1; B differs only in relocated STR-to-NOP and HMAC. Both use compiled menu scale 3, identical non-payload modules, markers and title DSB. No P5 hardware trial or device write. Test A then B on boot_b. See docs/V23P5_MATCHED_MMIO_CONTROL.md.
  • Reviewed upstream logging/automatic-test guide at 16e592abee8a550dec8154ed1f38b5ebc4f16213 and same-SoC umi at 3eb72578597d2ca16471b172d45eddc096a34a04. Prioritize board-qualified retained RAM trace plus separate firmware QR logging. Existing J716F Recovery DT/dmesg show overlapping boot_log 0xb0000000+0x80000 and pstore 0xb0000000+0x100000; console file length 262132 does not establish its physical subrange. Do not copy umi 4MiB/2MiB layout or sheng disk/reset constants. Verify layout/format and minimal reset retention before attaching XNU records. Full unattended logging requires a validated reader and return-to-fastboot cycle. Read-only source/evidence review only; no new device test or logging implementation.
  • V23P6 RAMLOG r1 is host-verified and unflashed: read-only TWRP live parameters plus matching-build Recovery allocator emulation locate console at 0xb00be000+0x40000 (12-byte DBGC, ECC=0). iomem difference is reserved System RAM vmap versus non-RAM request_mem_region. Independent app validates live header before manual single-marker append; default read-only, no automatic start/reset, manual EFI warm request, no XNU. Actual SEC/four DXE nonpayload deltas are only the reservation-size byte; other modules/APRIORI unchanged. Retention and live header remain unverified. See docs/V23P6_RAMLOG_RETENTION.md.
  • V23P6 RAMLOG r1 (uncommitted additions on the recorded repository base; exact source/image hashes are in the P6 manifest) was flashed only to boot_b through fastbootd with the audited image; B activation, current-slot b and slot-unbootable:b=no were verified, and reboot command succeeded. First live header, marker append, warm-reset retention and Recovery readback await device observation. No other partition write or repository push occurred.
  • V23P6 first video/photo confirms the correct menu and read-only app: console DBGC 0x43474244, next=size=0x37bd9, capacity=0x3fff4, VALID, marker counts 0 and no append. The inferred console header is now device-readable and consistent, with 33819 bytes of unused capacity. No append, restart retention, Recovery readback or XNU progress is established. See research/v23p6-first-header.json.
  • V23P6 second video verifies manual RAM marker append and same-run readback: next=size 0x37bd9 -> 0x37c09 (+48 bytes), now=1, appended_this_run=1, APPEND READBACK OK. At about 15s the app reports Warm reset returned; no actual reboot is observed. At about 28s the app exits to parent EFI return diagnosis with Success/code 0, which is normal app return and not reset success. Cross-reset retention and Recovery readback remain unverified. Root cause of the returned firmware reset call is unknown. First-header transcription corrected to 0x37bd9 (33819 free bytes). See research/v23p6-append-reset-return.json.
  • V23P7 RESET r1 is host verified and unflashed. Only the P6 embedded FAT config/app changes; all non-payload inner-FV module sections and compact SEC executable match P6 exactly. Actual P6 reset driver uses SMC, queries RESET2 then falls back to SYSTEM_RESET; unused stack inputs are a host finding, not the proven failure cause. P7 defaults to read-only inventory; manual PSCI queries/firmware Warm/direct reset actions log PRE/RETURN to the validated console. Five wrapper cases, two linked record/gate cases and image/source audits passed with mocked SMC responses. First hardware trial must only photograph inventory and Query PSCI results on boot_b; no reset, retention or XNU result yet.
  • V23P7 RESET r1 (uncommitted source additions on the recorded repository base; exact source/image hashes in the P7 manifest) was flashed only to boot_b through fastbootd. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Inventory/PSCI-query observations await video. No reset trial, retention result or new XNU checkpoint is established.
  • V23P7 photos verify EL1, installed reset driver GUID/RVA/prefix match, PSCI_VERSION=0x00010001 (1.1) and FEATURES=0 for SYSTEM_RESET and RESET2 A64. Valid console next=size grows 0x2923f -> 0x2958a (+843 bytes); P7 entry=0/now=6 and Queries complete=1. Query returns and app-displayed same-run records are established. No actual P7 reset, retention, Recovery readback or new XNU checkpoint. Next manual trial uses Direct RESET2 only; preserve initial post-reboot inventory or returned x0..x3. Uninitialized old-driver inputs remain an unproven cause.
  • V23P7 RESET2 video/photo confirms two direct 0xc4000012 type=0/cookie=0 calls return x0=0xfffffffffffffffe (INVALID_PARAMS -2), x1..x3=0. FEATURES remains 0; valid console next=size 0x2958a -> 0x296a3 -> 0x297bc and P7 now 6 -> 8 -> 10. No reboot is observed in the 10.50s video; retention and Recovery readback remain untested. Old Warm falls back only on FEATURES failure, not on returned RESET2 error; historical P6 SMC returns remain uncaptured. Next manual test is existing Direct SYSTEM_RESET only. No new device commands, flash or source changes during this media review.
  • User clarified the second no-reboot selection displayed blocked; rerunning Query then Direct SYSTEM_RESET rebooted again. Two successful SYSTEM_RESET invocations are user-reported; no SYSTEM_RESET error return was reported. User then forced power off and entered ZUI13 before post-reset inventory capture. Earlier reset retention remains unknown; later marker state cannot isolate that path. Repeat a controlled P7 boot_b cycle from a photographed baseline, without forced shutdown or ZUI detour. No new flash/source/device commands performed.
  • Controlled P7 retention cycle relaunched: fastboot initially reported current-slot a and slot-unbootable:b=yes. set_active b succeeded; current-slot b and slot-unbootable:b=no verified; reboot command succeeded. No partition image was flashed. Prior P7 flash/image hash supplies expected identity, not a new partition readback. Await menu identity, baseline and post-SYSTEM_RESET read-only photo; retention remains unverified.
  • V23P12A/B built and host verified, unflashed. Six independent pre-staged CRC-bound records use one-byte commits; ENTRY high32 binds ARM CRC and low32 is SCTLR. A skips BCM and B preserves captured original address/value, with exactly one STR/NOP probe delta and identical reader/ADT/nonpayload firmware. 58 actual-assembly and22 linked-reader mocked cases passed; final image/HMAC/source audits passed. Byte-identical P11 power app reuses22 host cases. No P12 hardware/retention/MMU-on result; A first on boot_b only.
  • P12 r2 A/B built and host verified, unflashed. New reader requires explicit double confirmation before discarding a VALID saturated/exhausted console logical history; frozen entry remains, payload not bulk-cleared, INIT records old next/size, failure locks Query/ARM. 45 actual-linked reader cases passed including full-session-to-both-unchanged-kernels-to-frozen-reader flow, changed-console cancellation, failure and stale-ID gates. A/B kernel/ADT/probes equal r1 byte for byte; 58 prior assembled cases reused after identity check. Power app equals P11, 22 cases reused. Final FD/FAT/EFI/source/HMAC/nonpayload/boot-image checks passed. No r2 hardware, retention or MMU-on result; A first on boot_b only.
  • P12 r2A postreboot photo confirms ENTRY/NOW VALID next=size0x38e69 consoleCRCC067D0A6, logical12/raw12 latest ID1/phase21/04FFEC87. Fresh ARM063FE873 matches prelaunch; ENTRY1210179B value063FE87300C00808(M0). All six stages16..21 are L1/R1 with CRCsE66CD221,AA22646F,B1021655,9AB5746F,8742F221,04FFEC87 and ARM-bound value50313253063FE873; all eight CRCs reconstruct exactly. New reader ID2/query0/armed0, read-only. User explicitly reports automatic reboot/menu return; no continuous video reviewed. A skipped BCM and reached all six commits/publication, with matching records present after reported reboot. Kernel SMC/reset source, original BCM completion, MMU-on and manual session rollover remain unqualified. r2B original-STR control is next.

完成条件 ​

  • Handoff regions do not overlap and the requested DarwinBoot window is allocated, coherently accessed and released.

当前范围 ​

  • The tested 256 MiB window and bounded MMU-on trace do not qualify all RAM, sustained mappings or normal OS allocations.

下一步 ​

  • P17 original chosen/stall/topology and boot CPU number returns reached, SCTLR M1 and all nine CRCs survived one video-observed reboot. Preserve result; audit grouped boot CPU publication/max-CPU checks, current-thread/CPU bootstrap and rtclock_early_init, with logger mapping/stack lifetime. Native provider build and IRQ qualification remain separate.

证据 ​

存储与根卷 ​

planned

硬件与依赖 ​

  • UFS controller, PHY, LUN and userdata geometry are not yet represented by a reviewed J716F component source.

配置 ​

  • No UFS node, root volume UUID, GPT window or Data seed is declared in the public board configuration.

操作步骤 ​

  • Capture the UFS controller and GPT facts from recovery/TWRP, then select a compatible storage component and root policy.

开发经验 ​

  • The current V15 payload is a diagnostic FAT volume and does not prove physical UFS access or root mounting.

完成条件 ​

  • Controller reads, GPT windows, OS/SystemOS ranges and root persistence pass on the device.

当前范围 ​

  • No storage ABI, trust cache or userdata seed is public or verified.

下一步 ​

  • Record UFS register, LUN and userdata geometry before adding a storage component.

证据 ​

按下一步操作收集证据。

显示 ​

device-verified

硬件与依赖 ​

  • Inherited GOP at 2560x1600 with 10240 bytes per row and 32-bit pixels.

配置 ​

  • The UEFI platform keeps the inherited framebuffer and the board DTS does not invent a panel controller.

操作步骤 ​

  • Enter the menu through boot_b, observe the framebuffer geometry, and preserve the last screen on a returned diagnostic path.

开发经验 ​

  • The menu and diagnostic screens rendered on the device; panel, backlight and native display driver adaptation are not complete.
  • V21 video shows the entry bands over retained menu pixels. V22 preserves enlarged menus and uses distinct V22A/1s and V22B/3s payload titles; both are still awaiting device observation.
  • V23 host logic checked 118272 renderer pixel values. P video confirms the first large V23/mode-1 line, but not later register/stage lines. M uses an explicitly guarded mapping of 0x9c000000..0x9e400000 and has no hardware result.
  • V23P2 title and two inline 96x96 squares are visible on hardware. The post-title-DSB square is absent; five modeled scenarios checked 552960 square pixel values, not real barrier completion.
  • P3 retains P2 mode 5, font and checkpoint geometry. Ten controlled cases executed real renderer, squares and the B dispatcher; 1105920 square pixels were checked. No P3 hardware display result is claimed.
  • V23P4 r1 initializes both early marker regions and retains only two 96x96 rectangles through the subsequent clear. Unicorn checked all 16384000 framebuffer bytes after the actual pre/setup_fb/clear path; hardware visibility is pending.
  • V23P4 r1 video confirms both early MMIO markers and title mode 5 with prefix squares 1/2; square 3 and EL/SCTLR are not observed. Original STR was passed, but external transaction completion is unproven. Diagnostic display disappears about 15.9s after entry, then Lenovo/Android splash and r1 menu return; PMIC 0x02000001 -> 0x02000041, reset cause unknown. Next-build source preference: UniXNU menu scale changed from 4 to 3 after r1 video; not compiled or flashed. Kernel diagnostic font unchanged. Original r1 library sources were privately snapshotted and match its remote-build hashes; the next build must explicitly audit the changed menu module.
  • V23P5A/B matched controls passed host image, source/HMAC, pair-delta and emulator checks. A kernel equals P4 r1; B differs only in relocated STR-to-NOP and HMAC. Both use compiled menu scale 3, identical non-payload modules, markers and title DSB. No P5 hardware trial or device write. Test A then B on boot_b. See docs/V23P5_MATCHED_MMIO_CONTROL.md.
  • V23P5A video confirms the compact A menu, title mode 5, prefix squares 1/2 and both early MMIO markers, reproducing P4 r1 visible progress. No square 3, EL/SCTLR or PSCI evidence. Display disappears about 17.47s after entry, followed by Lenovo/Android splash and return to A menu; PMIC 0x02000001 -> 0x02000041. Reset cause and external MMIO completion remain unknown. P5B is the next boot_b control and remains unflashed.
  • V23P5B video confirms the compact B menu, both lower envelope markers and partial title in frame 56; the diagnostic is captured in only one camera frame. Top prefix 1 completion, prefix 2/3, EL/SCTLR and A0/pre-SMC are not established. Entry band to display loss is about 0.067s (camera observation), followed by Lenovo/Android splash and return to B menu; PMIC 0x02000001 -> 0x02000041. Rapid intentional PSCI reset is a hypothesis, not a verified result. Next proposed control retains P5B and replaces only its SMC with an in-place branch, preserving the preceding DSB; not yet built. This checkpoint supersedes earlier pending/unflashed notes; no new device operations or push occurred during video review.

完成条件 ​

  • A known frame has the measured geometry and format, followed by a native display provider and backlight result.

当前范围 ​

  • Only GOP/menu output is verified; native display and backlight remain pending.

下一步 ​

  • Prepare a P5B-derived single-instruction control replacing SMC at 0xfffffff0073fc798 with B . (bytes 00000014), retaining the preceding DSB, markers, menu and all other instructions; reseal HMAC and audit before any boot_b test. Do not branch to the existing halt routine, which adds a DSB. This control is not yet built.

证据 ​

输入 ​

device-verified

硬件与依赖 ​

  • Volume and power key paths provided by the Mu-Silicium platform and J716F key DXE.

配置 ​

  • The menu remains interactive only where the platform reports an input device; no touch component is selected yet.

操作步骤 ​

  • Use volume keys to select and the power key to confirm, then record whether the selected entry returns or advances.

开发经验 ​

  • Volume and power keys were observed in the diagnostic menu; touch coordinates and HID reports are not yet adapted.

完成条件 ​

  • Touches map to the display and buttons produce stable reports through the selected input component.

当前范围 ​

  • Only the hardware keys are verified; touch controller and HID ABI are pending.

下一步 ​

  • Collect touch controller bus, interrupt and coordinate mapping from the vendor DT and recovery logs.

证据 ​

GPU ​

planned

硬件与依赖 ​

  • Adreno/GMU registers, firmware, SMMU streams and Metal ABI inputs are not public for this board.

配置 ​

  • No GPU component is selected; the source defconfig keeps native Adreno disabled.

操作步骤 ​

  • Audit the SM8250 GPU resources, obtain matching firmware and ABI records, then add a component and package service.

开发经验 ​

  • The current screen result comes from inherited GOP and does not establish GPU submission or Metal presentation.

完成条件 ​

  • GPU submissions, mapping, fences, known rendering and the selected Metal client all pass.

当前范围 ​

  • No GPU firmware or device-side submission evidence is available.

下一步 ​

  • Inventory Adreno 650/SM8250 resources and firmware ownership before selecting a component.

证据 ​

按下一步操作收集证据。

网络 ​

planned

硬件与依赖 ​

  • Wireless chipset, bus, firmware and DMA ownership are not identified in the public port.

配置 ​

  • No Wi-Fi component or network package is selected.

操作步骤 ​

  • Identify the wireless controller and firmware, then follow the network adaptation guide and record association/traffic tests.

开发经验 ​

  • No network path has been exercised by the diagnostic images.

完成条件 ​

  • Scanning, association, address configuration and sustained traffic pass with the selected firmware.

当前范围 ​

  • Wireless hardware and OS ABI inputs are missing.

下一步 ​

  • Extract the wireless controller identity and firmware source from the stock system.

证据 ​

按下一步操作收集证据。

音频 ​

planned

硬件与依赖 ​

  • DSP, codec, clocks and firmware service ownership are not yet described.

配置 ​

  • No audio component or board package service is selected.

操作步骤 ​

  • Inventory the audio graph and DSP firmware, then validate playback and capture routes.

开发经验 ​

  • The current bring-up stops before userspace audio and has no audio evidence.

完成条件 ​

  • Declared routes carry the selected format through playback and capture with correct start/stop behavior.

当前范围 ​

  • Audio inputs and firmware are unavailable.

下一步 ​

  • Capture the codec/DSP graph and firmware interfaces from the stock device.

证据 ​

按下一步操作收集证据。

电源 ​

planned

硬件与依赖 ​

  • Regulators, clocks, battery units and firmware ownership are not yet modeled.

配置 ​

  • The port keeps vendor power initialization in UEFI and declares no XNU power component.

操作步骤 ​

  • Document regulators and power domains, then validate battery readings and a controlled sleep/resume cycle.

开发经验 ​

  • No sleep/resume or battery result has been obtained from the diagnostic image.
  • The V20/V21 UEFI diagnostic provider reads PMIC history without clearing it. V21 displays 0x02000001; bit semantics and reset cause remain unclassified, and this does not validate an XNU power driver.
  • V21 video establishes PMIC 0x02000001 before an attempt and 0x02000041 after the Lenovo-logo restart. Only PON bit 0x40 changed; its meaning and the reset source remain unclassified. V22 requests bounded PSCI reset through the shared entry probe, with device behavior still pending.
  • V22A/B failed to show their intended timing response. V23P uses counter-free SYSTEM_RESET, but its first video lacks A0/A1 and RETURN; a later restart with PMIC unchanged at 0x02000041 cannot establish SMC execution or reset cause.
  • V23P2 later restarts to its menu and PMIC changes 0x02000001 to 0x02000041. No SMC progress is established and no reset cause or bit semantics are assigned.
  • P3 retains the original PSCI arguments and pre-SMC barrier. Host SMC results are mocked and no P3 reset or PMIC observation exists.
  • V23P4 r1 video confirms both early MMIO markers and title mode 5 with prefix squares 1/2; square 3 and EL/SCTLR are not observed. Original STR was passed, but external transaction completion is unproven. Diagnostic display disappears about 15.9s after entry, then Lenovo/Android splash and r1 menu return; PMIC 0x02000001 -> 0x02000041, reset cause unknown.
  • V23P5A/B matched controls passed host image, source/HMAC, pair-delta and emulator checks. A kernel equals P4 r1; B differs only in relocated STR-to-NOP and HMAC. Both use compiled menu scale 3, identical non-payload modules, markers and title DSB. No P5 hardware trial or device write. Test A then B on boot_b. See docs/V23P5_MATCHED_MMIO_CONTROL.md.
  • V23P5A video confirms the compact A menu, title mode 5, prefix squares 1/2 and both early MMIO markers, reproducing P4 r1 visible progress. No square 3, EL/SCTLR or PSCI evidence. Display disappears about 17.47s after entry, followed by Lenovo/Android splash and return to A menu; PMIC 0x02000001 -> 0x02000041. Reset cause and external MMIO completion remain unknown. P5B is the next boot_b control and remains unflashed.
  • V23P5B video confirms the compact B menu, both lower envelope markers and partial title in frame 56; the diagnostic is captured in only one camera frame. Top prefix 1 completion, prefix 2/3, EL/SCTLR and A0/pre-SMC are not established. Entry band to display loss is about 0.067s (camera observation), followed by Lenovo/Android splash and return to B menu; PMIC 0x02000001 -> 0x02000041. Rapid intentional PSCI reset is a hypothesis, not a verified result. Next proposed control retains P5B and replaces only its SMC with an in-place branch, preserving the preceding DSB; not yet built. This checkpoint supersedes earlier pending/unflashed notes; no new device operations or push occurred during video review.
  • V23P7 RESET r1 is host verified and unflashed. Only the P6 embedded FAT config/app changes; all non-payload inner-FV module sections and compact SEC executable match P6 exactly. Actual P6 reset driver uses SMC, queries RESET2 then falls back to SYSTEM_RESET; unused stack inputs are a host finding, not the proven failure cause. P7 defaults to read-only inventory; manual PSCI queries/firmware Warm/direct reset actions log PRE/RETURN to the validated console. Five wrapper cases, two linked record/gate cases and image/source audits passed with mocked SMC responses. First hardware trial must only photograph inventory and Query PSCI results on boot_b; no reset, retention or XNU result yet.
  • V23P7 RESET r1 (uncommitted source additions on the recorded repository base; exact source/image hashes in the P7 manifest) was flashed only to boot_b through fastbootd. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Inventory/PSCI-query observations await video. No reset trial, retention result or new XNU checkpoint is established.
  • V23P7 photos verify EL1, installed reset driver GUID/RVA/prefix match, PSCI_VERSION=0x00010001 (1.1) and FEATURES=0 for SYSTEM_RESET and RESET2 A64. Valid console next=size grows 0x2923f -> 0x2958a (+843 bytes); P7 entry=0/now=6 and Queries complete=1. Query returns and app-displayed same-run records are established. No actual P7 reset, retention, Recovery readback or new XNU checkpoint. Next manual trial uses Direct RESET2 only; preserve initial post-reboot inventory or returned x0..x3. Uninitialized old-driver inputs remain an unproven cause.
  • V23P7 RESET2 video/photo confirms two direct 0xc4000012 type=0/cookie=0 calls return x0=0xfffffffffffffffe (INVALID_PARAMS -2), x1..x3=0. FEATURES remains 0; valid console next=size 0x2958a -> 0x296a3 -> 0x297bc and P7 now 6 -> 8 -> 10. No reboot is observed in the 10.50s video; retention and Recovery readback remain untested. Old Warm falls back only on FEATURES failure, not on returned RESET2 error; historical P6 SMC returns remain uncaptured. Next manual test is existing Direct SYSTEM_RESET only. No new device commands, flash or source changes during this media review.
  • User reports the first P7 Direct SYSTEM_RESET rebooted, then selecting it after reentering the app did not reboot. No new SYSTEM_RESET photo/video or post-reset ring counts yet. Fresh app load clears mQueried; without rerunning Query, the action is blocked before SMC. Second-attempt gate status versus actual returned SMC is unresolved. Preserve full page/entry/now before new queries. One reboot is user-reported; repeatability and RAM retention remain unverified.
  • User clarified the second no-reboot selection displayed blocked; rerunning Query then Direct SYSTEM_RESET rebooted again. Two successful SYSTEM_RESET invocations are user-reported; no SYSTEM_RESET error return was reported. User then forced power off and entered ZUI13 before post-reset inventory capture. Earlier reset retention remains unknown; later marker state cannot isolate that path. Repeat a controlled P7 boot_b cycle from a photographed baseline, without forced shutdown or ZUI detour. No new flash/source/device commands performed.
  • V23P11A/B/D built and host verified, unflashed. Terminal phase11 value is P11S stage1..5, not SCTLR or MMU-on. Entry CRC writer and linked reader match P9. 40 kernel, 18 reader and 22 power-app mocked cases passed; actual images/HMAC/sources audited, nonpayload FV and compact SEC match P9/P8. Reboot and Power off are included through direct PSCI queries/actions, without RESET2; device power actions remain untested.

完成条件 ​

  • Power readings and supported sleep/resume transitions restore dependent peripherals.

当前范围 ​

  • Power resources and low-power ownership remain unknown.

下一步 ​

  • Run a fresh controlled retention cycle with installed P7 on boot_b once fastboot/recording ready: photo baseline, Query, SYSTEM_RESET once, photo first read-only reentry. Avoid intervening forced poweroff/ZUI; report any ZUI outcome before changing state.

证据 ​

镜像组装 ​

host-verified

组件: XnuPrelink, DarwinBoot.

硬件与依赖 ​

  • V15 FAT payload layout, Android boot image v2 parameters, UEFI FD and the real kernel/ADT private inputs.

配置 ​

  • The board declares a 64 MiB diagnostic volume, firmware DarwinBoot loader, measured DRAM and boot image v2 offsets.
  • The UEFI repository now declares the shared RAM-disk DXE alongside DiskIoDxe and FAT while retaining the existing V15 embedded-FAT diagnostic path.

操作步骤 ​

  • Run host image audits, verify kernel/ADT hashes and inspect the boot image before any boot_b test.

开发经验 ​

  • CI review: native source build step succeeded at e104fe3b; encrypted transfer rejects six outputs against old four-output allowlist. Profile-specific seal/open validation and synthetic regression checks added; remote repair run pending, no device operation.
  • V15 host packaging and static audits passed.
  • V16 host packaging produced the source-prelinked kernel, J716F ADT and boot image used for the boot_b test.
  • The source build applies a device-local patch-series compatibility fix before the pinned UniXNU resolver, so optional Sheng PMGR context is not required for J716F.
  • V21 host checks passed FD/FV/FFS checksums, AARCH64 PE and linked-module identity, V21 markers, unchanged V20 embedded FAT, BootShim/gzip, both DTB copies and Android v2 header/SHA1/padding.
  • The byte-identical local V21 DSC is preserved in the firmware repository; it retains the V15 FDF/output path and omits the public V15 DSC additional standard-initrd declarations. Device board.toml retains historical V17 payload settings and is not the complete V21 artifact recipe.
  • V22 has an explicit paired payload builder and independent V22 firmware DSC/FDF/module lists. Both kernels use the same unpatched V21 prelink baseline and differ only in their timer literal. Final FD/FAT/file, PE, probe and Android image audits passed; no device write was performed.
  • V23 rebuilds from the pinned prelink baseline, guards patch/vector/cave ranges and reseals corecrypto after all code changes. Actual extracted kernels and all four Android-v2 images passed host audits. P was flashed to boot_b; hardware functional results remain incomplete.
  • V23P2 separately packages an 1824-byte guarded probe, reseals crypto and passes actual FD/FAT/PE/Android-v2 audits. Old V23 artifacts and manifest remain preserved.
  • P3A/B actual FD/FAT/PE/Android-v2 audits and final crypto HMAC checks passed. Undoing the approved factor and seal reconstructs the exact pinned P2 kernel. P2 and other prior manifests remain preserved.
  • V23P3A was flashed only to boot_b via fastbootd, B activated and reboot command succeeded. Video, menu identity, prefix progress and PSCI results are pending; P3B remains unflashed.
  • V23P3B was flashed only to boot_b via fastbootd, B activated and reboot command succeeded. User report for P3A was brief screen then reboot; no checkpoint or PSCI result established. P3B video is pending.
  • V23P4 r1 passed actual FD/FAT/PE/Android-v2, source hashes and crypto HMAC audits. Undoing its envelope, clear filter and HMAC seal reconstructs pinned P2. Original P4 was not flashed and is privately archived.
  • V23P4 r1 was flashed only to boot_b through fastbootd; B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Menu identity, marker visibility, PSCI and reset observations await video. Retry-count variable is unsupported.
  • V23P4 r1 video confirms both early MMIO markers and title mode 5 with prefix squares 1/2; square 3 and EL/SCTLR are not observed. Original STR was passed, but external transaction completion is unproven. Diagnostic display disappears about 15.9s after entry, then Lenovo/Android splash and r1 menu return; PMIC 0x02000001 -> 0x02000041, reset cause unknown. Next-build source preference: UniXNU menu scale changed from 4 to 3 after r1 video; not compiled or flashed. Kernel diagnostic font unchanged. Original r1 library sources were privately snapshotted and match its remote-build hashes; the next build must explicitly audit the changed menu module.
  • V23P5A/B matched controls passed host image, source/HMAC, pair-delta and emulator checks. A kernel equals P4 r1; B differs only in relocated STR-to-NOP and HMAC. Both use compiled menu scale 3, identical non-payload modules, markers and title DSB. No P5 hardware trial or device write. Test A then B on boot_b. See docs/V23P5_MATCHED_MMIO_CONTROL.md.
  • V23P5A was flashed only to boot_b in fastbootd; B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. A menu identity, marker progression and reset observations await video. P5B remains unflashed. No PSCI or MMU-on result is claimed.
  • V23P5A video confirms the compact A menu, title mode 5, prefix squares 1/2 and both early MMIO markers, reproducing P4 r1 visible progress. No square 3, EL/SCTLR or PSCI evidence. Display disappears about 17.47s after entry, followed by Lenovo/Android splash and return to A menu; PMIC 0x02000001 -> 0x02000041. Reset cause and external MMIO completion remain unknown. P5B is the next boot_b control and remains unflashed.
  • V23P5B was flashed only to boot_b in fastbootd; B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Its menu identity and diagnostic progress await video. Reviewed P5A remains the visible control; no P5B functional, PSCI or MMU-on result is claimed.
  • V23P5B video confirms the compact B menu, both lower envelope markers and partial title in frame 56; the diagnostic is captured in only one camera frame. Top prefix 1 completion, prefix 2/3, EL/SCTLR and A0/pre-SMC are not established. Entry band to display loss is about 0.067s (camera observation), followed by Lenovo/Android splash and return to B menu; PMIC 0x02000001 -> 0x02000041. Rapid intentional PSCI reset is a hypothesis, not a verified result. Next proposed control retains P5B and replaces only its SMC with an in-place branch, preserving the preceding DSB; not yet built. This checkpoint supersedes earlier pending/unflashed notes; no new device operations or push occurred during video review.
  • V23P7 RESET r1 is host verified and unflashed. Only the P6 embedded FAT config/app changes; all non-payload inner-FV module sections and compact SEC executable match P6 exactly. Actual P6 reset driver uses SMC, queries RESET2 then falls back to SYSTEM_RESET; unused stack inputs are a host finding, not the proven failure cause. P7 defaults to read-only inventory; manual PSCI queries/firmware Warm/direct reset actions log PRE/RETURN to the validated console. Five wrapper cases, two linked record/gate cases and image/source audits passed with mocked SMC responses. First hardware trial must only photograph inventory and Query PSCI results on boot_b; no reset, retention or XNU result yet.
  • V23P7 RESET r1 (uncommitted source additions on the recorded repository base; exact source/image hashes in the P7 manifest) was flashed only to boot_b through fastbootd. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Inventory/PSCI-query observations await video. No reset trial, retention result or new XNU checkpoint is established.
  • V23P8 RETENTION r1 is built and host-verified, unflashed. Only the embedded FAT config/app differs from P7; non-payload inner-FV sections and compact SEC executable match exactly. Sanitizer ring/record, three wrapper and nine linked-EFI UI cases passed. Exact image identity is in research/v23p8-retention.json.
  • The pinned 42bffe8 source builder now includes standalone backport 0004 of upstream 018c8f3 to restore omitted XNU headers after a fresh clone. Exact upstream-file equivalence and fresh/repeated/reclone/failure-path checks passed; full macOS XNU compilation has not been rerun.
  • V23P8 RETENTION r1 was flashed only to boot_b after exact image-hash and fastbootd identity/unlock/size gates. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Initial ENTRY and actual retention observations remain pending.
  • V23P9E/M host-verified kernel trace candidates are prepared. E logs the first kernel entry then direct SYSTEM_RESET; M logs entry, pre-MMU and post-MSR/ISB before terminal reset. A manual UEFI Query/ARM cookie and expected prior CRC/phase bind each kernel append to its session. Exactly the audited console is mapped as 64 NC pages after strict TCR/MAIR/TTBR/spare-page guards. Pre/post preserve integer registers, SP and NZCV; pre handles the already-virtual SP with M=0. Original BCM store and vectors remain unchanged. 23 actual-assembly logic cases and 12 linked-reader cases pass with mocked system registers/SMC/UEFI; E/M nonpayload FV sections and compact SEC match P8; crypto HMACs match. No P9 device write or MMU progress yet. Test E before M.
  • V23P9E was flashed only to boot_b after exact image-hash and fastbootd identity/unlock/size gates. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Await the initial read-only reader ENTRY photo before Query/ARM. No kernel entry/reset-retention observation or MMU progress yet. V23P9M remains unflashed and gated on observed E entry-record retention.
  • V23P12A/B built and host verified, unflashed. Six independent pre-staged CRC-bound records use one-byte commits; ENTRY high32 binds ARM CRC and low32 is SCTLR. A skips BCM and B preserves captured original address/value, with exactly one STR/NOP probe delta and identical reader/ADT/nonpayload firmware. 58 actual-assembly and22 linked-reader mocked cases passed; final image/HMAC/source audits passed. Byte-identical P11 power app reuses22 host cases. No P12 hardware/retention/MMU-on result; A first on boot_b only.
  • P12 r2 A/B built and host verified, unflashed. New reader requires explicit double confirmation before discarding a VALID saturated/exhausted console logical history; frozen entry remains, payload not bulk-cleared, INIT records old next/size, failure locks Query/ARM. 45 actual-linked reader cases passed including full-session-to-both-unchanged-kernels-to-frozen-reader flow, changed-console cancellation, failure and stale-ID gates. A/B kernel/ADT/probes equal r1 byte for byte; 58 prior assembled cases reused after identity check. Power app equals P11, 22 cases reused. Final FD/FAT/EFI/source/HMAC/nonpayload/boot-image checks passed. No r2 hardware, retention or MMU-on result; A first on boot_b only.

完成条件 ​

  • Kernel and ADT inputs are reproducible, the payload contains declared files, and the boot image matches the platform header and size constraints.

当前范围 ​

  • Private payload binaries and vendor inputs are excluded. Bounded MMU-on continuation is observed; integrated timer/platform drivers, storage/root and userspace remain unverified.

下一步 ​

  • P17 original chosen/stall/topology and boot CPU number returns reached, SCTLR M1 and all nine CRCs survived one video-observed reboot. Preserve result; audit grouped boot CPU publication/max-CPU checks, current-thread/CPU bootstrap and rtclock_early_init, with logger mapping/stack lifetime. Native provider build and IRQ qualification remain separate.

证据 ​

诊断 ​

device-verified

硬件与依赖 ​

  • Host audit scripts, V14 memory evidence, V15 entry preparation, V16 boot_b observation, and source-build reports.

配置 ​

  • Diagnostic outputs are separated from private binaries and the record distinguishes host, device and planned evidence.

操作步骤 ​

  • Run the preflight and record checks, preserve only text metadata in CI, and use the boot_b-only recovery procedure on hardware.

开发经验 ​

  • CI review: native source build step succeeded at e104fe3b; encrypted transfer rejects six outputs against old four-output allowlist. Profile-specific seal/open validation and synthetic regression checks added; remote repair run pending, no device operation.
  • V16 device evidence confirms ExitBootServices and XNU early-entry probes on boot_b; the result is preserved in docs/V16_SOURCE_ENTRY_RESULT.md.
  • Source-build diagnostics record both device-local compatibility patches and keep patch preparation idempotent across repeated macOS runner attempts.
  • V21 video and extracted kernel establish the pre-MMU checkpoint and a later restart; its default post-MMU timer hook is absent. V22A/1s and V22B/3s install independently audited post-MMU reset probes. They omit the panic renderer because the verified padding cannot fit both. Hardware timing remains unverified.
  • V23 provides terminal single-core PSCI/counter/direct-MMU screen records and an early exception handler. Sixteen mocked logic cases and renderer checks passed. P video confirms only the common prefix and title, followed by restart; first-line DSB/return, register reads and A0 execution require finer records. Screen records require video and are not retained RAM logs.
  • V23P2 narrows the last visible progress to title stores and RAW checkpoint 2, followed by DSB SY at 0xfffffff0073fca54; checkpoint 3 is not observed. The earlier BCM MMIO store is a candidate access, not a confirmed cause. Isolate barrier behavior and that store separately.
  • P3 isolates legacy MMIO and title barrier behavior independently. A retains all DSBs; B uses a title-only DMB dispatcher without changing registers, NZCV or LR. Only menus identify A/B; hardware trials are pending.
  • V23P3A was flashed only to boot_b via fastbootd, B activated and reboot command succeeded. Video, menu identity, prefix progress and PSCI results are pending; P3B remains unflashed.
  • V23P3B was flashed only to boot_b via fastbootd, B activated and reboot command succeeded. User report for P3A was brief screen then reboot; no checkpoint or PSCI result established. P3B video is pending.
  • V23P4 r1 host simulation executes the actual kernel legacy branch, original store and return, then explicitly reenters pre for a complete clear/filter. It verifies stale after-marker removal and preserved registers. Intervening privileged instructions and real MMIO ordering are excluded; device result pending.
  • V23P4 r1 was flashed only to boot_b through fastbootd; B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Menu identity, marker visibility, PSCI and reset observations await video. Retry-count variable is unsupported.
  • V23P4 r1 video confirms both early MMIO markers and title mode 5 with prefix squares 1/2; square 3 and EL/SCTLR are not observed. Original STR was passed, but external transaction completion is unproven. Diagnostic display disappears about 15.9s after entry, then Lenovo/Android splash and r1 menu return; PMIC 0x02000001 -> 0x02000041, reset cause unknown. Next-build source preference: UniXNU menu scale changed from 4 to 3 after r1 video; not compiled or flashed. Kernel diagnostic font unchanged. Original r1 library sources were privately snapshotted and match its remote-build hashes; the next build must explicitly audit the changed menu module.
  • V23P5A/B matched controls passed host image, source/HMAC, pair-delta and emulator checks. A kernel equals P4 r1; B differs only in relocated STR-to-NOP and HMAC. Both use compiled menu scale 3, identical non-payload modules, markers and title DSB. No P5 hardware trial or device write. Test A then B on boot_b. See docs/V23P5_MATCHED_MMIO_CONTROL.md.
  • V23P5A was flashed only to boot_b in fastbootd; B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. A menu identity, marker progression and reset observations await video. P5B remains unflashed. No PSCI or MMU-on result is claimed.
  • V23P5A video confirms the compact A menu, title mode 5, prefix squares 1/2 and both early MMIO markers, reproducing P4 r1 visible progress. No square 3, EL/SCTLR or PSCI evidence. Display disappears about 17.47s after entry, followed by Lenovo/Android splash and return to A menu; PMIC 0x02000001 -> 0x02000041. Reset cause and external MMIO completion remain unknown. P5B is the next boot_b control and remains unflashed.
  • V23P5B was flashed only to boot_b in fastbootd; B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Its menu identity and diagnostic progress await video. Reviewed P5A remains the visible control; no P5B functional, PSCI or MMU-on result is claimed.
  • V23P5B video confirms the compact B menu, both lower envelope markers and partial title in frame 56; the diagnostic is captured in only one camera frame. Top prefix 1 completion, prefix 2/3, EL/SCTLR and A0/pre-SMC are not established. Entry band to display loss is about 0.067s (camera observation), followed by Lenovo/Android splash and return to B menu; PMIC 0x02000001 -> 0x02000041. Rapid intentional PSCI reset is a hypothesis, not a verified result. Next proposed control retains P5B and replaces only its SMC with an in-place branch, preserving the preceding DSB; not yet built. This checkpoint supersedes earlier pending/unflashed notes; no new device operations or push occurred during video review.
  • Reviewed upstream logging/automatic-test guide at 16e592abee8a550dec8154ed1f38b5ebc4f16213 and same-SoC umi at 3eb72578597d2ca16471b172d45eddc096a34a04. Prioritize board-qualified retained RAM trace plus separate firmware QR logging. Existing J716F Recovery DT/dmesg show overlapping boot_log 0xb0000000+0x80000 and pstore 0xb0000000+0x100000; console file length 262132 does not establish its physical subrange. Do not copy umi 4MiB/2MiB layout or sheng disk/reset constants. Verify layout/format and minimal reset retention before attaching XNU records. Full unattended logging requires a validated reader and return-to-fastboot cycle. Read-only source/evidence review only; no new device test or logging implementation.
  • V23P6 RAMLOG r1 is host-verified and unflashed: read-only TWRP live parameters plus matching-build Recovery allocator emulation locate console at 0xb00be000+0x40000 (12-byte DBGC, ECC=0). iomem difference is reserved System RAM vmap versus non-RAM request_mem_region. Independent app validates live header before manual single-marker append; default read-only, no automatic start/reset, manual EFI warm request, no XNU. Actual SEC/four DXE nonpayload deltas are only the reservation-size byte; other modules/APRIORI unchanged. Retention and live header remain unverified. See docs/V23P6_RAMLOG_RETENTION.md.
  • V23P6 RAMLOG r1 (uncommitted additions on the recorded repository base; exact source/image hashes are in the P6 manifest) was flashed only to boot_b through fastbootd with the audited image; B activation, current-slot b and slot-unbootable:b=no were verified, and reboot command succeeded. First live header, marker append, warm-reset retention and Recovery readback await device observation. No other partition write or repository push occurred.
  • V23P6 first video/photo confirms the correct menu and read-only app: console DBGC 0x43474244, next=size=0x37bd9, capacity=0x3fff4, VALID, marker counts 0 and no append. The inferred console header is now device-readable and consistent, with 33819 bytes of unused capacity. No append, restart retention, Recovery readback or XNU progress is established. See research/v23p6-first-header.json.
  • V23P6 second video verifies manual RAM marker append and same-run readback: next=size 0x37bd9 -> 0x37c09 (+48 bytes), now=1, appended_this_run=1, APPEND READBACK OK. At about 15s the app reports Warm reset returned; no actual reboot is observed. At about 28s the app exits to parent EFI return diagnosis with Success/code 0, which is normal app return and not reset success. Cross-reset retention and Recovery readback remain unverified. Root cause of the returned firmware reset call is unknown. First-header transcription corrected to 0x37bd9 (33819 free bytes). See research/v23p6-append-reset-return.json.
  • V23P7 RESET r1 is host verified and unflashed. Only the P6 embedded FAT config/app changes; all non-payload inner-FV module sections and compact SEC executable match P6 exactly. Actual P6 reset driver uses SMC, queries RESET2 then falls back to SYSTEM_RESET; unused stack inputs are a host finding, not the proven failure cause. P7 defaults to read-only inventory; manual PSCI queries/firmware Warm/direct reset actions log PRE/RETURN to the validated console. Five wrapper cases, two linked record/gate cases and image/source audits passed with mocked SMC responses. First hardware trial must only photograph inventory and Query PSCI results on boot_b; no reset, retention or XNU result yet.
  • V23P7 RESET r1 (uncommitted source additions on the recorded repository base; exact source/image hashes in the P7 manifest) was flashed only to boot_b through fastbootd. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Inventory/PSCI-query observations await video. No reset trial, retention result or new XNU checkpoint is established.
  • V23P7 photos verify EL1, installed reset driver GUID/RVA/prefix match, PSCI_VERSION=0x00010001 (1.1) and FEATURES=0 for SYSTEM_RESET and RESET2 A64. Valid console next=size grows 0x2923f -> 0x2958a (+843 bytes); P7 entry=0/now=6 and Queries complete=1. Query returns and app-displayed same-run records are established. No actual P7 reset, retention, Recovery readback or new XNU checkpoint. Next manual trial uses Direct RESET2 only; preserve initial post-reboot inventory or returned x0..x3. Uninitialized old-driver inputs remain an unproven cause.
  • V23P7 RESET2 video/photo confirms two direct 0xc4000012 type=0/cookie=0 calls return x0=0xfffffffffffffffe (INVALID_PARAMS -2), x1..x3=0. FEATURES remains 0; valid console next=size 0x2958a -> 0x296a3 -> 0x297bc and P7 now 6 -> 8 -> 10. No reboot is observed in the 10.50s video; retention and Recovery readback remain untested. Old Warm falls back only on FEATURES failure, not on returned RESET2 error; historical P6 SMC returns remain uncaptured. Next manual test is existing Direct SYSTEM_RESET only. No new device commands, flash or source changes during this media review.
  • User reports the first P7 Direct SYSTEM_RESET rebooted, then selecting it after reentering the app did not reboot. No new SYSTEM_RESET photo/video or post-reset ring counts yet. Fresh app load clears mQueried; without rerunning Query, the action is blocked before SMC. Second-attempt gate status versus actual returned SMC is unresolved. Preserve full page/entry/now before new queries. One reboot is user-reported; repeatability and RAM retention remain unverified.
  • User clarified the second no-reboot selection displayed blocked; rerunning Query then Direct SYSTEM_RESET rebooted again. Two successful SYSTEM_RESET invocations are user-reported; no SYSTEM_RESET error return was reported. User then forced power off and entered ZUI13 before post-reset inventory capture. Earlier reset retention remains unknown; later marker state cannot isolate that path. Repeat a controlled P7 boot_b cycle from a photographed baseline, without forced shutdown or ZUI detour. No new flash/source/device commands performed.
  • Controlled P7 retention cycle relaunched: fastboot initially reported current-slot a and slot-unbootable:b=yes. set_active b succeeded; current-slot b and slot-unbootable:b=no verified; reboot command succeeded. No partition image was flashed. Prior P7 flash/image hash supplies expected identity, not a new partition readback. Await menu identity, baseline and post-SYSTEM_RESET read-only photo; retention remains unverified.
  • The later P7 INVALID photo has unknown timing and intervening actions. Read-only Recovery capture confirmed unchanged DTB/config/ramoops layout and mounted but empty pstore; the prior 65-byte console-ramoops-0 capture is missing-file error text. The P7 image-length boot_b prefix matches, with partition tail untested. Retention remains unknown.
  • V23P8 is host-verified and unflashed. Frozen ENTRY includes raw header, full-console CRC and separate logical/raw CRC-checked record summaries. Manual invalid-only header initialization preserves payload except appended records; two-step SYSTEM_RESET is gated on same-run BASELINE, PSCI query and unchanged PRE_RESET. No automatic RAM write, SMC or reset; no XNU. Collector rejects failed or unframed remote status; the new decoder requires accepted hash-matching pstore capture evidence.
  • V23P8 RETENTION r1 was flashed only to boot_b after exact image-hash and fastbootd identity/unlock/size gates. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Initial ENTRY and actual retention observations remain pending.
  • The first P8 photo confirms RETENTION r1, ENTRY/NOW DBGC 0x43474244, next=size=0x3fb3f, ENTRY whole-console CRC32=0x9e93c89c, NOW VALID, zero logical/raw P8 records, run ID=1, baseline=0 and query=0 at EL1. This establishes the initial readable header, not append or reboot retention. Skip initialization; append BASELINE once, run Query PSCI + record (NO RESET), and photograph the full page before reset.
  • P8 BASELINE photo confirms readback OK: NOW VALID, next=size=0x3fb7f (+64 bytes), logical/raw count=1, ID=1, phase=2, CRC=0x668a6fef, baseline=1/query=0. Query photo confirms NOW VALID, next=size=0x3fc7f (+256 bytes), logical/raw count=5, ID=1, phase=8, CRC=0xb4d25630, baseline=1/query=1, EL1, PSCI_VERSION=0x10001 (1.1), FEATURES(SYSTEM_RESET)=0 and last-x0=0. Frozen ENTRY remains unchanged. Same-invocation append/readback and query are observed; PRE_RESET and cross-reset retention remain untested.
  • P8 PRE_RESET photograph confirms NOW VALID, next=size=0x3fcbf, logical/raw count=6, ID=1, phase=3, record CRC=0xe13f0c63, baseline=1/query=1 and PRE_RESET ready. Frozen ENTRY remains unchanged. First reset press committed the pre-reset record; no reset or retention result is yet observed. Matching post-reboot ENTRY must be captured before any initialization, append or Query.
  • P8 controlled SYSTEM_RESET video shows the armed PRE_RESET page, screen loss, Lenovo/Android splash, return to the P8 menu and manual app reentry. At 10.898s (frame 327), frozen ENTRY and NOW retain DBGC 0x43474244, next=size=0x3fcbf, six logical and six raw CRC-valid records, latest ID=1/phase=3/CRC=0xe13f0c63, exactly matching the pre-reset photo. NOW remains VALID. New invocation ID=2 with baseline=0/query=0 and read-only status confirms capture before new app writes/query. One observed immediate UEFI-to-UEFI reset cycle preserves the header and matching PRE_RESET record. This does not establish all payload bytes, power-off/ZUI/Recovery retention, repeated reliability, or XNU/MMU checkpoint progress.
  • V23P9E/M host-verified kernel trace candidates are prepared. E logs the first kernel entry then direct SYSTEM_RESET; M logs entry, pre-MMU and post-MSR/ISB before terminal reset. A manual UEFI Query/ARM cookie and expected prior CRC/phase bind each kernel append to its session. Exactly the audited console is mapped as 64 NC pages after strict TCR/MAIR/TTBR/spare-page guards. Pre/post preserve integer registers, SP and NZCV; pre handles the already-virtual SP with M=0. Original BCM store and vectors remain unchanged. 23 actual-assembly logic cases and 12 linked-reader cases pass with mocked system registers/SMC/UEFI; E/M nonpayload FV sections and compact SEC match P8; crypto HMACs match. No P9 device write or MMU progress yet. Test E before M.
  • V23P9E was flashed only to boot_b after exact image-hash and fastbootd identity/unlock/size gates. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Await the initial read-only reader ENTRY photo before Query/ARM. No kernel entry/reset-retention observation or MMU progress yet. V23P9M remains unflashed and gated on observed E entry-record retention.
  • First P9 reader photo confirms KERNEL TRACE r1, ENTRY/NOW DBGC 0x43474244, next=size=0x2b0e4, ENTRY whole-console CRC32=0x51d98b35 and NOW VALID. Logical count=0; raw count=6 with old P8 ID=1/phase=3/CRC=0xe13f0c63. All six P9 checkpoint rows have logical/raw hits=0; invocation ID=2, query=0/armed=0 at EL1 and read-only status. Old P8 payload bytes remain outside current logical extent after the intervening fastboot path; this is not a controlled P9 kernel-retention result or evidence locating a header change. Next Query then ARM once, photograph this-run ID/CRC before kernel launch.
  • P9E Query/ARM photos confirm NOW VALID throughout. Query: next=size=0x2b1e4, logical/raw counts=4/10, ID=2, query=1/armed=0, last CRC=0x3ef428f0, EL1, PSCI_VERSION=0x00010001 and SYSTEM_RESET FEATURES=0. ARM: next=size=0x2b224, logical/raw counts=5/11, ID=2, query=1/armed=1, last CRC=0x47ccacb5 and ARM readback OK. Frozen ENTRY and checkpoint rows remain unchanged from reader entry; no kernel launch or reset is observed in these photos.
  • P9E controlled entry trial is device-observed. Video starts with armed ID=2/CRC=47CCACB5, shows the E entry-only kernel selected, then screen loss, Lenovo/Android splash and return to the P9E menu. The separate photo, identified by the user as first reader reentry after that reboot, shows frozen ENTRY and NOW VALID: DBGC=0x43474244, next=size=0x2b264, whole-console CRC=0x8b79118f, logical/raw counts=6/12, latest ID=2/phase=10/CRC=0xf17e59fc. ARM has one logical and one raw hit with matching prior CRC=0x47ccacb5; KERNEL_ENTRY has one of each with CRC=0xf17e59fc and SCTLR_EL1=0xc00808 (M=0). Reconstructing phase-10 record bytes from ID/value/prior header reproduces the photographed CRC. New reader invocation ID=3/query=0/armed=0 and read-only status confirm capture before new Query/ARM. PRE_MMU, POST_MMU, MAP_FAILURE and RESET_RETURN have zero hits, expected for E. The valid header and same-session entry record survived one observed reboot; actual reset-source attribution, M execution and sustained MMU-on remain unverified.
  • V23P9M was flashed only to boot_b after exact image SHA256 and fastbootd product/unlock/slot-count/partition-size gates. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Launch targets the untimed menu only; recording readiness for the manual kernel trial was not newly confirmed. Initial M menu identity, reader ENTRY, Query/ARM and kernel/MMU checkpoints await device observations. The observed P9E entry-record retention prerequisite remains preserved.
  • Initial reader photo after the P9M fastboot launch confirms common J716F V23P9 KERNEL TRACE r1 reader, frozen ENTRY/NOW DBGC=0x43474244, next=size=0x2bf58, ENTRY whole-console CRC=0xbdb07c93 and NOW VALID. Logical count=0; raw count=6 with old P8 ID=1/phase=3/CRC=0xe13f0c63; all six frozen P9 checkpoint rows have zero logical/raw hits. THIS RUN ID=2/query=0/armed=0 at EL1, read-only status. The earlier E ARM/ENTRY chain is not present in this snapshot after the intervening fastboot path; the cause or timing of those changes is not isolated, and this does not alter the separately observed E controlled-reboot result. No M kernel launch or MMU progress is observed.
  • P9M Query/ARM video and photo show a successful same-invocation preparation, with frozen ENTRY unchanged. At video frame 90, Query OK: NOW VALID next=size=0x2c058, logical/raw counts=4/10, ID=2, query=1/armed=0, CRC=0xbbfaa9d1, EL1, PSCI_VERSION=0x00010001 and SYSTEM_RESET FEATURES=0. ARM photo: NOW VALID next=size=0x2c098, logical/raw counts=5/11, ID=2, query=1/armed=1, CRC=0xc2c22d94 and ARM readback OK. The phase-8/phase-9 CRCs reconstructed from the displayed session/value/prior headers match. All frozen P9 rows remain zero because they describe the earlier reader-entry snapshot. The approximately 11.065-second video ends on the armed reader; it does not show M kernel launch or reset. Match this M attempt by both ID=2 and ARM CRC=C2C22D94, distinct from E ID=2/CRC=47CCACB5.
  • P9M launch photo confirms menu identity J716F V23P9M KERNEL TRACE r1 and the M entry/pre-MMU/post-MMU kernel item, with stage DARWIN BOOT, a green top band, and visible DARWINBOOT text: inputs validated; exiting boot services. It is a launch/handoff display, not a reader checkpoint. User subsequently reports an automatic reboot. No video of this launch/reboot or post-reboot reader snapshot has been supplied yet; entry/PRE/POST/MAP_FAILURE record state and actual reset source remain unknown. Do not infer MMU progress or a specific stopping PC from the still image or reboot alone.
  • User clarifies that after the first user-reported automatic M reboot, the M kernel was launched a second time directly, without a fresh Query/ARM or a supplied first post-reboot reader capture. User reports this second launch remains stopped; the supplied photo shows DARWINBOOT inputs validated; exiting boot services. Source stage1 requires an immediately preceding valid phase-9 ARM cookie, and branches to the WFE halt if append validation fails. If the first launch consumed ARM by appending ENTRY or later records, the unarmed second launch would be rejected; this is a source-supported explanation, not a confirmed device stopping PC. Neither first-run MMU progress nor second-run rejection is established without retained reader records. The second launch must not be treated as a freshly armed M trial.
  • M recovery reader photo shows frozen ENTRY and NOW VALID: DBGC=0x43474244, next=size=0x2c0d8, whole-console CRC=0xc0749332, logical/raw counts=6/12, latest ID=2/phase=10/CRC=0xdc7aa441. Frozen ARM has one logical and one raw hit, CRC=0xc2c22d94 and cookie=0x50394b45524e454c, exactly matching the M prelaunch baseline. KERNEL_ENTRY has one logical and one raw hit, CRC=0xdc7aa441, SCTLR_EL1=0xc00808 (M=0); reconstructing the record with prior header 0x2c098 reproduces that CRC. PRE_MMU, POST_MMU, MAP_FAILURE and RESET_RETURN all have zero hits. New reader invocation ID=3/query=0/armed=0 with read-only status confirms no new Query/ARM in the snapshot. This recovery capture follows the user-reported first automatic reboot, an unarmed second launch that stalled, and the requested hardware recovery; it is not the missing immediate first-reboot capture, and recovery method/timing is not independently captured. It establishes a surviving M-session entry record and consumed ARM, with no retained later checkpoints. Source requires ARM immediately before entry: the now-visible consumed chain supports second-launch gate rejection, but does not prove the exact PC of that launch. The missing PRE record spans original firstcpu code, pre-hook stack handling, mapping checks/setup/barriers and PRE append; it does not isolate an SCTLR/MMU failure or a reset source.
  • Fresh M session ID=3 photo sequence supplies ARM preparation, M handoff display and a new read-only reader invocation. ARM photo: NOW VALID next=size=0x2c218, logical/raw counts=11/17, ID=3/query=1/armed=1, CRC=0x671d1670, PSCI_VERSION=0x00010001, FEATURES=0. Frozen rows still describe prior ID=2, as designed. M launch photo identifies entry/pre-MMU/post-MMU terminal SYSTEM_RESET and shows the DarwinBoot handoff prompt. Subsequent reader photo: ENTRY/NOW VALID next=size=0x2c258, whole-console CRC=0x8b348f61, logical/raw counts=12/18, latest ID=3/phase=10/CRC=0xd1afe339. Frozen ID=3 ARM and KERNEL_ENTRY each have one logical/raw hit; ARM CRC=0x671d1670 matches prelaunch, ENTRY CRC=0xd1afe339 and SCTLR_EL1=0xc00808 (M=0). Both displayed CRCs reconstruct from the record format and prior headers. PRE_MMU, POST_MMU, MAP_FAILURE and RESET_RETURN again have no hits. New invocation ID=4/query=0/armed=0 confirms a fresh read-only snapshot. Photos were supplied in response to the requested single-launch/immediate-reader sequence; they independently establish the fresh chain and ENTRY-only repeat, while continuous reboot timing, reset source and absence of all intervening operations are not video-verified. Further identical M retries are not required before adding finer probes. Missing PRE spans original firstcpu, pre stack conversion, map_console and PRE append, not a demonstrated MMU-enable failure.
  • V23P10A/B/C are built and host verified, without device writes. Terminal sites are before BCM STR, after STR before ISB, and before original SCTLR. Entry and terminal phase11 use the unchanged P9 CRC writer; phase11 means prefix stop, not P9M mapping success. Eighteen actual full-prefix kernel cases and thirteen linked-reader cases passed with explicit system-register/barrier/MMIO/SMC/UEFI mocks and synthetic boot args. Exact images, sources, probe and reader hashes are in research/v23p10-prefix-controls.json. Actual packed FAT/menu/kernel/HMAC audited; nonpayload FV modules and compact SEC match P9/P8, and reader EFI is byte-identical to P9. No new hardware MMU or retained terminal record is established.
  • V23P10A was flashed only to boot_b after exact image SHA256, fastbootd product/unlock/slot-count/partition-size gates. Image SHA256=6637e8055846c79d64f09a8115d311cc92c4ac8ba91977ec9dd81f4ef9c98e0b. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. User confirmed fastboot and recording readiness. Only the untimed menu was launched; no manual Query/ARM, kernel execution, terminal record or reset retention is observed yet. B/C remain unflashed.
  • P10A initial reader photo shows common J716F V23P9 KERNEL TRACE r1 reader; parent-menu variant is not visible and expected A identity is tied to the recorded flash. Frozen ENTRY/NOW VALID: DBGC=0x43474244, next=size=0x2e137, whole-console CRC=0x5104221a. Logical/raw record counts are both zero; latest ID/phase/CRC and all six frozen checkpoint rows are zero. THIS RUN ID=1/query=0/armed=0/CRC=0 at EL1, read-only status; PSCI/features zeros are unqueried defaults. This is a valid starting baseline after the fastboot path, not a controlled retention result or proof of P10 kernel execution. Fresh Query/ARM and kernel launch remain pending.
  • P10A ARM photo confirms NOW VALID next=size=0x2e277 (+0x140 from baseline), logical/raw counts=5/5, THIS RUN ID=1/query=1/armed=1, CRC=0xde027ae6, EL1, PSCI_VERSION=0x00010001 and SYSTEM_RESET FEATURES=0. ARM readback OK is visible. Frozen ENTRY remains next=size=0x2e137/CRC=0x5104221a and all frozen checkpoint rows are zero, as expected before these writes. Reconstructing phase9 with ID1/cookie=0x50394b45524e454c/prior next=size=0x2e237 reproduces CRC DE027AE6. No kernel launch or reset is observed in this photo; use ID and CRC together to identify this A attempt.
  • P10A continuous video confirms A menu/kernel identity, green handoff band, screen loss, Lenovo/Android splash, return to A menu and read-only reader reentry. At frame240 (~7.999s), frozen ENTRY/NOW VALID next=size=0x2e2f7, whole-console CRC=0x4e5c6046, logical/raw counts=7/7, latest ID1/phase11/CRC=D8F17B33. ARM/ENTRY/PRE_MMU each have logical/raw hits 1/1: ARM DE027AE6 matches prelaunch photo, ENTRY F3461909 and terminal phase11 D8F17B33 both have SCTLR=0xc00808 (M=0). Reconstructed record CRCs match all three. POST/MAP_FAILURE/RESET_RETURN have no hits; new reader ID2/query0/armed0 and read-only status preserve the first snapshot. PMIC changes 0x02000001 to 0x02000041 without independent reset-source attribution. In A phase11 is the terminal prefix stop BEFORE BCM STR; it proves this prefix/physical-stack/logger path and one observed reset retention cycle. A does not execute BCM STR, map_console or MMU enable. Advance to already-built B with a fresh Query/ARM; B/C remain unflashed.
  • V23P10B was flashed only to boot_b after exact image SHA256, fastbootd product/unlock/slot-count/partition-size gates and the observed A terminal-record prerequisite. B image SHA256=e77d5b67e8b6a044ef1ca1df10e143f07bc78e060ad371214c5634bd9f690cb4. B activation, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. User confirmed fastboot and recording readiness. Only the untimed menu was launched; B menu identity, initial reader, fresh Query/ARM and kernel/BCM terminal result await observation. A retained phase11 result remains preserved; C remains unflashed.
  • P10B initial reader photo shows common P9 reader, expected B identity tied to recorded flash (parent menu not visible). ENTRY/NOW VALID next=size=0x27fe9, whole-console CRC=0x2394a7e1, logical count0/raw count7. Frozen checkpoint ID1 ARM/ENTRY/PRE_MMU have L0/R1 with raw CRCs DE027AE6/F3461909/D8F17B33 matching historical A; later rows are zero. THIS RUN ID2/query0/armed0/CRC0 at EL1 and read-only status; PSCI/features zeros are unqueried defaults. A bytes are raw-only outside current logical extent, not B progress. Header changes across intervening fastboot/boot are not isolated to a cause; A immediate observed retention remains independently established. Next fresh B Query/ARM; no B kernel launch or retained terminal result yet.
  • P10B Query and ARM photos confirm fresh reader session ID2. Query: NOW VALID next=size=0x280e9, logical/raw=4/11, query1/armed0, CRC=DCAE06F5, PSCI1.1/FEATURES0 and Query OK. ARM: NOW VALID next=size=0x28129, logical/raw=5/12, query1/armed1, CRC=A59682B0 and ARM readback OK. Both phase8/phase9 CRCs reconstruct exactly from ID2/value/prior headers. Frozen ENTRY remains 0x27fe9/CRC2394A7E1 and frozen rows still describe old raw A ID1, as designed. No B kernel launch or reset is shown. Match the coming B attempt using both ID2 and ARM A59682B0, distinct from historical A.
  • P10B 22.648s video starts on NOW VALID armed ID2/CRC A59682B0, then reader returns through EFI diagnosis START IMAGE/Success/code0 before B kernel selection. B menu and STOP after BCM STR before ISB identity are confirmed. Green handoff band and DarwinBoot inputs validated; exiting boot services remain visible through final frame678 (~22.615s). User reports a later automatic reboot into UniXNU, but supplied clip ends before that later cycle and has no post-reboot reader. Earlier EFI Success is reader return, not B terminal reset evidence. B intentionally resets after successful phase11 append, so reboot alone neither proves nor disproves terminal/BCM progress. Need first read-only post-reboot reader matching B ID2/ARM A59682B0; C stays gated.
  • B post-reported-reboot reader photo matches fresh ID2 ARM A59682B0 logically/raw. ENTRY/NOW VALID next=size=0x28169, whole-console CRC=F03B33AB; logical6 latest phase10 CRC DCD7DF11, raw14 latest phase11 CRC C49C5711. Frozen ENTRY L1/R1 and PRE_MMU L0/R1 both value SCTLR=0xc00808 (M0); reconstructed ID2 phase10/prior28129 and phase11/prior28169 CRCs exactly match. New reader ID3/query0/armed0 is read-only. This is new B raw terminal data, distinct from old A CRC D8F17B33. The audited path crosses original BCM STR into terminal writer, but phase11 is not published in current logical extent: expected next=size after commit would be 0x281a9. Source order is record byte stores -> DSB SY at 0xfffffff0073fc7d0 -> byte readback -> size/next stores at fc828/fc82c -> DSB SY fc830 -> return -> reset DSB/SMC. Raw bytes plus old header do not isolate exact PC; first DSB, readback, publication/visibility and reset-retention differences remain candidates. Direct SYSTEM_RESET and external BCM transaction completion are unverified. Supplied video does not include later reboot; user reports it. Keep B terminal_record_survived_observed_reset false and C gated; isolate writer publication with an independent terminal-only control.
  • V23P11A/B/D built and host verified, unflashed. Terminal phase11 value is P11S stage1..5, not SCTLR or MMU-on. Entry CRC writer and linked reader match P9. 40 kernel, 18 reader and 22 power-app mocked cases passed; actual images/HMAC/sources audited, nonpayload FV and compact SEC match P9/P8. Reboot and Power off are included through direct PSCI queries/actions, without RESET2; device power actions remain untested.
  • V23P11A was flashed only to boot_b after exact SHA256, fastbootd product/unlock/slot-count/partition-size gates. B active, current-slot b and slot-unbootable:b=no were verified; reboot command succeeded. Only the untimed menu was requested; menu identity, initial reader, Query/ARM, kernel launch and retained P11 stages remain unobserved. P11B/D remain unflashed; P10C gated. Image SHA256=e19591e47ae931348d1c1e5a8f01ab9a2e397a2108c21cb0a9b75af187bdbea5.
  • P11A initial reader photo shows common P9 reader, ENTRY/NOW VALID next=size=0x2baf2, whole-console CRC32=413A1021, logical0/raw7. Raw ID1 ARM DE027AE6, ENTRY F3461909 and phase11 D8F17B33 (value SCTLR 0xc00808) match historical P10A; no P11S stage code. THIS RUN ID2/query0/armed0/CRC0 at EL1, read-only. Parent P11A menu identity not visible; expected variant comes from recorded flash. No current kernel or retention result.
  • P11A Query/ARM photo confirms NOW VALID next=size=0x2bc32 (+0x140), logical5/raw12, THIS RUN ID2/query1/armed1/CRC58E2DBCF at EL1, PSCI1.1 and SYSTEM_RESET FEATURES0. ARM readback OK. Reconstructed phase9 ID2/cookie/prior0x2bbf2 CRC matches exactly. Frozen ENTRY remains 0x2baf2/CRC413A1021 with historical P10A raw ID1 rows; no kernel launch or P11S stage yet.
  • P11A 10.565s video confirms A before-BCM menu selection, screen loss, Lenovo/Android splash, return to A menu and manual read-only reader. Frame316 (~10.532s): ENTRY/NOW VALID next=size=0x2bcb2, console CRC94CC810C, logical7/raw14, ID2 phase11 CRC43AA3200. Frozen ARM/ENTRY/PRE_MMU each L1/R1: ARM58E2DBCF matches prelaunch, ENTRY AAC67917 value SCTLR0xc00808 (M0), terminal value5031315300000005 stage5. All three CRCs reconstruct exactly; new invocation ID3/query0/armed0 read-only. One observed reboot preserves the new writer stage5 and logical header before BCM STR. PMIC02000001->02000041; independent reset attribution unknown. No original BCM store, MMU enable, sustained XNU or power-app result. P11B is next; D/P10C remain gated.
  • V23P11B was flashed only to boot_b after observed P11A stage5/ARM/CRC/reset-retention prerequisite and exact image SHA256, fastbootd product/unlock/slot-count/partition-size gates. B activation, current-slot b and slot-unbootable:b=no verified; reboot command succeeded. User confirmed fastboot/recording readiness. Untimed menu only; B menu identity, initial reader, fresh Query/ARM and kernel/stage observations pending. Original BCM STR is present in B, but its execution has not yet been observed in this trial. A result preserved, D/P10C gated. B image SHA256=94c97bacfef84deab3bceaacfee5f1f95b20f4e74a57c01f9beb5bbabc64a40c.
  • P11B initial reader photo confirms ENTRY/NOW VALID next=size=0x2c55a, console CRCAC4189D6, logical0/raw7. Raw ID1 ARM DE027AE6, ENTRY F3461909 and phase11 D8F17B33/value0xc00808 match historical P10A, not B progress. THIS RUN ID2/query0/armed0/CRC0 at EL1 read-only. Parent B menu identity not visible; expected B follows recorded boot_b flash. Fresh B ARM CRC required because ID2 is reused after the intervening fastboot/boot path; earlier A immediate stage5 retention stays independently established. No B kernel launch or P11S stage observed.
  • P11B Query/ARM photos confirm Query NOW VALID next=size0x2c65a logical4/raw11 ID2/query1/armed0 CRC9E81CF4A, then ARM NOW VALID next=size0x2c69a logical5/raw12 ID2/query1/armed1 CRCE7B94B0F. PSCI1.1/FEATURES0 and ARM readback OK. Both phase8 and phase9 CRCs reconstruct exactly using prior0x2c61a/0x2c65a. Frozen ENTRY remains0x2c55a/CRCAC4189D6 with historical P10A raw ID1 rows. This B CRC differs from prior A ID2/58E2DBCF; no B launch or terminal stage observed yet.
  • P11B 31.562s video confirms B after-STR/before-ISB menu identity, green handoff/DarwinBoot inputs, screen loss, Lenovo/Android splash, B menu return and read-only reader. Frame946 (~31.528s): ENTRY/NOW VALID next=size0x2c6da, CRC D603FA7F, logical6 latest phase10 F901C2DA/raw14 latest phase11 796B1792. Frozen ID2 ARM E7B94B0F and ENTRY F901C2DA(SCTLR0xc00808/M0) are L1/R1; phase11 is L0/R1 value5031315300000001 stage1. All CRCs reconstruct exactly; new reader ID3/query0/armed0 read-only. Header grew only64 from ARM, not expected terminal publication to0x2c71a. Original BCM STR was crossed and terminal body stored; external completion, first DSB completion, stage2+ execution/visibility/retention and reset source unresolved. A stage5 versus B raw-only stage1 motivates P11D single first-DSB-to-DMB control. No terminal SYSTEM_RESET, MMU-on or power-app result.
  • V23P11D was flashed only to boot_b after reviewed B fresh raw-stage1/ARM/CRC/observed-reboot prerequisite and image SHA256, fastbootd product/unlock/slot-count/partition-size gates. B/D assembled probe difference rechecked: only terminal first DSB SY changed to DMB SY; subsequent barriers retained. B activation, current-slot b and slot-unbootable:b=no verified; reboot command succeeded. User confirmed fastboot/testing readiness following recording request. Untimed menu only; D menu identity, reader, fresh ARM and kernel results pending. A/B observations preserved; P10C gated. D image SHA256=0a0b647be892107591787f05b4709286b20ab49c25125822e81a306bc65c73af.
  • P11D initial reader photo shows ENTRY/NOW VALID next=size0x2f1fb, whole-console CRC65E3F901, logical0/raw0, frozen checkpoint ID0 and all six rows zero. THIS RUN ID1/query0/armed0/CRC0 at EL1 read-only. Valid new baseline after intervening fastboot/firmware boot; no trace records recognized and no D execution or controlled retention conclusion. Earlier A stage5/B raw-stage1 immediate reboot observations remain independently preserved. Expected D variant tied to recorded flash; parent menu not visible.
  • P11D Query/ARM photos confirm Query NOW VALID next=size0x2f2fb logical4/raw4 ID1/query1/armed0 CRC16B5614F, then ARM NOW VALID next=size0x2f33b logical5/raw5 ID1/query1/armed1 CRC6F8DE50A. PSCI1.1/FEATURES0 and ARM readback OK. Phase8/phase9 CRCs reconstruct exactly with prior0x2f2bb/0x2f2fb. Frozen ENTRY remains0x2f1fb with all rows zero. Full-resolution photo review corrects earlier console-CRC transcription55C3F901 to65E3F901; no image/hash or device log altered. No D kernel/stage result yet.
  • P11D 30.83s continuous video confirms D first-DMB menu, handoff, screen loss, Lenovo/Android splash and D menu return. Frame924: frozen ENTRY/NOW VALID next=size0x2f37b, console CRC995CCD03, logical6 latest phase10/16CCB8AB, raw7 latest phase11/96A66DE3. ID1 ARM6F8DE50A and ENTRY16CCB8AB(SCTLR0xc00808/M0) L1/R1; phase11 L0/R1 value5031315300000001 stage1. All three CRCs reconstruct exactly; reader ID2/query0/armed0. Header grew64 from ARM, not terminal publication to0x2f3bb. B and D retain the same stage1-only result; first DSB-to-DMB substitution did not improve observed progress. Same-slot non-atomic updates prevent exact PC/barrier attribution. Original BCM STR crossed, external completion and reset source unknown. No terminal SYSTEM_RESET or MMU-on evidence.
  • Reviewed upstream ae687009348296e97e49ce6e925795044f363ce6 and fixed umi/pipa/kebab/enuma/SM-T733 snapshots. Header restore is already backported; cluster-type/catalog changes do not solve the P11 stop. Kebab documents a probe-induced fault after TTBR0 removal, and its architectural-timer patch skips the legacy BCM route. Pipa provides a warm-reset/early-pstore/USB export reference, not J716F-qualified PMIC or retention inputs. P12 should use independent witnesses and a separate matched BCM-STR-versus-skip factor; qualify mapping lifetime before MMU markers. No device operation, new build, pin change or push.
  • V23P12A/B built and host verified, unflashed. Six independent pre-staged CRC-bound records use one-byte commits; ENTRY high32 binds ARM CRC and low32 is SCTLR. A skips BCM and B preserves captured original address/value, with exactly one STR/NOP probe delta and identical reader/ADT/nonpayload firmware. 58 actual-assembly and22 linked-reader mocked cases passed; final image/HMAC/source audits passed. Byte-identical P11 power app reuses22 host cases. No P12 hardware/retention/MMU-on result; A first on boot_b only.
  • V23P12A BCM SKIP was flashed only to boot_b after image SHA256, matched-probe and fastbootd product/unlock/slot-count/partition-size gates. B activation, current-slot b and slot-unbootable:b=no verified; reboot command succeeded. Menu-only launch; recording readiness was not separately confirmed. Menu identity, initial reader, fresh Query/ARM and kernel/slot observations pending. B remains unflashed and gated by reviewed A evidence; no P12 retention, reset-source or MMU-on result. A image SHA256=49e924cd6fc784dff9c9df0df917d2d05156d34f95eea9f24569dea69234b5f8.
  • P12A initial photo confirms V23P12 reader at EL1, frozen ENTRY/NOW VALID next0x26e9 size0x3fff4 consoleCRC50977087, logical0/raw0 and all eight rows zero. THIS RUN ID1/query0/armed0. This is a saturated circular console, not an empty log. P12 linear-tail requirement fails before Query (832 bytes required); no Query block message or kernel launch observed. Parent A menu not pictured; variant follows recorded flash. Preserve baseline; qualify full-ring handling before a new attempt, B/P10C remain gated.
  • P12 r2 A/B built and host verified, unflashed. New reader requires explicit double confirmation before discarding a VALID saturated/exhausted console logical history; frozen entry remains, payload not bulk-cleared, INIT records old next/size, failure locks Query/ARM. 45 actual-linked reader cases passed including full-session-to-both-unchanged-kernels-to-frozen-reader flow, changed-console cancellation, failure and stale-ID gates. A/B kernel/ADT/probes equal r1 byte for byte; 58 prior assembled cases reused after identity check. Power app equals P11, 22 cases reused. Final FD/FAT/EFI/source/HMAC/nonpayload/boot-image checks passed. No r2 hardware, retention or MMU-on result; A first on boot_b only.
  • V23P12R2A BCM SKIP flashed only to boot_b after image SHA256/matched-probe/fastbootd identity gates. B active and bootable verified; reboot command succeeded. Menu-only launch; no independent recording-ready confirmation. Initial r2 reader, manual new-session action, Query/ARM and kernel observations pending. r2B remains unflashed and gated by reviewed r2A six-slot/header/reboot evidence. No new kernel progress, retention or MMU-on result.
  • P12 r2A initial photo confirms r2 reader at EL1; ENTRY/NOW VALID next=size0x38b69, consoleCRC98919B86, logical0/raw0, frozen checkpointID0 and all eight rows zero. THIS RUN ID1/query0/armed0/CRC0. Unused linear tail29835 bytes exceeds Query832-byte budget; no session rollover needed or performed. No kernel launch, r2 retention or hardware rollover qualification; parent A menu not visible, variant follows recorded flash. Earlier r1 saturated baseline stays independent.
  • P12 r2A Query/ARM photo shows NOW VALID next=size0x38ca9 logical5/raw5, THIS RUN ID1/query1/armed1 CRC063FE873 at EL1, PSCI1.1/FEATURES0 and ARM + six invalid templates OK. Frozen initial ENTRY remains0x38b69/CRC98919B86 with zero rows. Header growth320 bytes matches four Query records plus ARM; ARM phase9 CRC reconstructs exactly with cookie5031324b45524e4c and prior0x38c69. No session rollover or kernel launch observed. Fresh ARM binding saved for one A launch; expected terminal header0x38e69 is derived, not observed.
  • P12 r2A postreboot photo confirms ENTRY/NOW VALID next=size0x38e69 consoleCRCC067D0A6, logical12/raw12 latest ID1/phase21/04FFEC87. Fresh ARM063FE873 matches prelaunch; ENTRY1210179B value063FE87300C00808(M0). All six stages16..21 are L1/R1 with CRCsE66CD221,AA22646F,B1021655,9AB5746F,8742F221,04FFEC87 and ARM-bound value50313253063FE873; all eight CRCs reconstruct exactly. New reader ID2/query0/armed0, read-only. User explicitly reports automatic reboot/menu return; no continuous video reviewed. A skipped BCM and reached all six commits/publication, with matching records present after reported reboot. Kernel SMC/reset source, original BCM completion, MMU-on and manual session rollover remain unqualified. r2B original-STR control is next.

完成条件 ​

  • Each claimed milestone has a reproducible command, matching source/image revision and an accessible result.

当前范围 ​

  • No UART capture is available. Bounded MMU-on and P16 early-init records survive an observed reboot; sustained execution, platform drivers, UFS/root and userspace remain unverified.

下一步 ​

  • P17 original chosen/stall/topology and boot CPU number returns reached, SCTLR M1 and all nine CRCs survived one video-observed reboot. Preserve result; audit grouped boot CPU publication/max-CPU checks, current-thread/CPU bootstrap and rtclock_early_init, with logger mapping/stack lifetime. Native provider build and IRQ qualification remain separate.

证据 ​

Released under the BSD-2-Clause-Patent License.

Copyright 2026 UniXNU contributors