UniXNU

简体中文

English

简体中文

English

外观

Xiaomi MIX Fold 2 (zizhan, SM8475): UniXNU bring-up derived from Pong ​

qiumochen/UniXNU-zizhan

Xiaomi MIX Fold 2: iPadOS 18.7.10 inner display, touch, Adreno 730 rendering and battery readings, derived from UniXNU-pong. A 120 Hz panel and 95.3 moving fps in one synthetic workload; experimental Wi-Fi HTTPS works, Settings join and cross-band reconnect remain unresolved.

源记录: porting.toml, 3b3c52fb5ba11b0a185703d7832fd567c94e770e.

本页按设备记录自动生成。

部分状态
配置host-verified
固件与启动implemented
CPU 与中断implemented
内存与 DMAimplemented
存储与根卷implemented
显示implemented
输入implemented
GPUimplemented
网络device-verified
cellularplanned
音频planned
电源implemented
镜像组装host-verified
诊断implemented

配置 ​

host-verified

组件: PongPlatform24.

硬件与依赖 ​

  • zizhan (22061218C) live /sys/firmware/fdt; MIUI V14.0.15.0.TLRCNXM, Android 13, kernel 5.10.136.
  • SM8475 shared support and PongPlatform24 from UniXNU-pong (Nothing Phone (2)).
  • iPad7,11 iPadOS 18.7.10 / 22H374 restore.

配置 ​

  • board.toml: name=zizhan; device_tree.source=device:dts/zizhan.dts; kernel.defconfig=zizhan_ipados18_gpu_defconfig.
  • Default GPU config: CONFIG_XNU_PONG_ADRENO_PLATFORM=y, CONFIG_XNU_PONG_POWER=y, CONFIG_XNU_PONG_WIFI=y, CONFIG_XNU_PONG_BACKLIGHT=n.
  • Apply patches/xnu-ipados18/series in order: 0001-0006 and 0008-0014.

操作步骤 ​

  • Generate dts/zizhan.dts from the live DT with tools/gen_reserved.py, replacing model, compatible, DRAM and reserved-memory in the Pong layout.
  • Select uefi-zizhan Platforms/Xiaomi/zizhanPkg/zizhan.dsc; retain ARM64, SM8475, 22H374 and board layers.

开发经验 ​

  • The second DRAM bank is 0xf4600000+0xba00000, versus Pong 0xf1400000+0xec00000. ADSP uses 0x9fd00000+0x3100000, versus Pong 0x85700000+0x2800000. SMEM, IPCC, AOSS and cmd-db addresses agree.
  • The Pong build scripts do not depend on the board name.
  • The device default now enables GPU and Wi-Fi together. The old Wi-Fi defconfig is a relative symlink to the canonical GPU defconfig; local default build/packaging no longer needs separate profile or radio-enable options. The board-specific Wi-Fi hardware inputs remain in zizhan-wifi-sm8475.json.
  • One canonical device defconfig enables GPU and Wi-Fi; the previous Wi-Fi name is a compatibility symlink. Default and explicit reduced CI kernels built successfully.

完成条件 ​

  • Compile the board DTS, kernel and boot image, then reach the iPadOS Home Screen on the phone.

当前范围 ​

  • Outer display and audio remain disabled. Default GPU/Wi-Fi integration does not qualify untested long-duration or broader network cases; see the network limits.

下一步 ​

  • Keep build and device evidence separate and reproduce the published configuration before changing board inputs.

证据 ​

固件与启动 ​

implemented

组件: PongPlatform24.

硬件与依赖 ​

  • uefi-zizhan: uefi-pong plus Platforms/Xiaomi/zizhanPkg.
  • Stock uefi_b uefiplat.cfg memory map.

配置 ​

  • PIL Reserved size=0x1DC00000; remove Demura and QTEE.
  • SimpleFbDxe: framebuffer=0xb8000000, 2160x1916, inherited cont_splash_region.
  • Temporary fastboot boot only; do not flash partitions.

操作步骤 ​

  • build_fw.sh builds the zizhanPkg FD with EDK II; build_bootimg.py combines BootShim, FD and the device DTB into boot v4.
  • DarwinBoot24 reads the UniXNU menu and arms pong_autoreset before XNU handoff.
  • ci_boot_ufs.sh rejects command lines above its 1020-byte limit; DarwinBoot24 requires fewer than 1024 bytes.

开发经验 ​

  • The inner panel shows the Silicium logo and UniXNU menu with correct color and orientation; DarwinBoot24 hands off to XNU.
  • On refusal, DarwinBoot24 appends the reason to logfs:\BOOTFAIL.TXT, retries, then returns to fastboot.
  • A Wi-Fi kernel with larger embedded firmware occupied the temporary low-memory ReadFile buffer while the loader requested scanout pages. Free copied kernel/ADT inputs before reserving the optional 96 MiB pool. g299/g300 used the same kernel with radio disabled; the changed loader restored the real pool and complete screenshots.

完成条件 ​

  • Temporary boot reaches the menu and XNU; failures retain an automatic return path.

当前范围 ​

  • Qualcomm DXE binaries still come from uefi-pong Binaries/pong. There is no zizhan DisplayDxe and the outer panel stays off.

下一步 ​

  • Audit the stock FV Panel_L18_38_0c_0a_sec_dsc_cmd.xml before attempting outer-panel support.

证据 ​

CPU 与中断 ​

implemented

组件: PongPlatform24.

硬件与依赖 ​

  • SM8475: four Cortex-A510, three Cortex-A710, one Cortex-X2; GICv3, 19.2 MHz timer and PSCI.

配置 ​

  • ADT cluster-type is required with PONG_ADT_CLUSTERS=1; build two clusters with __ARM_AMP__.
  • pong_fast_pri=47 and pong_fast_cpu=7 by default.
  • ml-timeout-lock-panic-scale=40; interrupt-masked-debug-mode=1.

操作步骤 ​

  • 0008 exposes E/P clusters to AMP, 0014 prefers an idle X2 for UI-priority threads, and 0003 bounds qsort recursion to avoid early stack overflow.

开发经验 ​

  • All eight CPUs start. An AMP kernel without ADT cluster-type stalls early (g97).
  • Under Gunyah, ordinary pauses can exceed the DEVELOPMENT 500 us interrupt-masking threshold. Following sheng, scale timeouts by 40 and log masking violations; preserve genuine fatal panic handling.
  • In g170, a stalled app-opening workload used 0.73 CPU on A710 and 0.09 on X2 for the SpringBoard main thread; 0014 gives UI work X2 preference.

完成条件 ​

  • Start eight cores and place UI threads on X2 when available.

当前范围 ​

  • No thermal control. Repeated trials heat the phone and can corrupt DRAM ramoops logs.

下一步 ​

  • Integrate SM8475 thermal sensors and CPU frequency limits.

证据 ​

内存与 DMA ​

implemented

组件: PongPlatform24.

硬件与依赖 ​

  • Live device-tree memory and reserved-memory nodes.

配置 ​

  • dts/zizhan.dts memory@80000000 and reserved-memory.

操作步骤 ​

  • DarwinBoot24 passes only owned RAM ranges to XNU.

开发经验 ​

  • XNU reports Pong RAM: 4 owned banks, 9728 MiB. The phone has 12 GiB; holes are excluded from VM.

完成条件 ​

  • XNU boots and reports managed memory.

当前范围 ​

  • Managed RAM is 9728 MiB; not all physical memory is used.

下一步 ​

  • Check whether ranges above 0x9_0000_0000 can safely be given to XNU.

证据 ​

存储与根卷 ​

implemented

组件: PongPlatform24.

硬件与依赖 ​

  • UFS 3.1 and Android userdata (f2fs).
  • OS, SystemOS and Data images prepared locally from 22H374 on macOS.

配置 ​

  • pong_shngroot_4k=<4K block> identifies the root image extent.
  • pong_ufs_async=0; pong_ufs_defer enabled by default.

操作步骤 ​

  • install_pinned.py uses pinalloc to allocate a contiguous 19.4 GiB /data/hackios/root.img, writes OS/SystemOS/Data windows and reports its first block.
  • RootLayout publishes each window as separate IOMedia.
  • 0006 immediately sends matched notifications when publishResource finds IOResources still configuring.

开发经验 ​

  • Before 0006, roughly three of four boots failed to mount root. APFS probing held its lock while waiting for IOBSD, forming a cycle with IOResources configuration; waiting-thread dumps identified it in g28. g36-g39 mounted root in 4/4 trials after the fix.
  • OS, SystemOS and writable Data mount; stock 22H374 launchd starts.
  • Existing SmmuTakeover WIP selects SMR/S2CR validity and SID mask from IDR0.EXIDS. APPSSMMU on this phone has EXIDS disabled; g272-retry through g275 mounted root, wrote fresh UFS klog and returned to Android. EXIDS-enabled behavior has host build coverage only.

完成条件 ​

  • Mount root reliably and preserve Data writes across boots.

当前范围 ​

  • The root image is a pinned f2fs file. Never move or defragment it in Android; a 40 GiB placeholder was used to preserve a contiguous extent.

下一步 ​

  • Provide a software IOAESAccelerator for AppleImage4 to resolve its wait on /defaults.

证据 ​

显示 ​

implemented

组件: PongPlatform24.

硬件与依赖 ​

  • Inner DSI-1 panel: 2160x1916, command mode, DSC, 60/120 Hz.
  • Bootloader cont_splash_region: 0xb8000000+0x2b00000.

配置 ​

  • ADT display-scale=2 and artwork-scale-factor=2 (1080x958 points).
  • pong_panel_hz=120 by default.
  • Kernel defaults: pong_dpu_flip=1, pong_dpu_bufs=2, pong_zc=2, fb_swapwait=1.

操作步骤 ​

  • Send timing@1 timing-switch commands through the DSI command FIFO to select 120 Hz.
  • Flip DPU directly to CoreAnimation surfaces using triple buffering and no scanout GPU copy.

开发经验 ​

  • At scale 3, 1916/3 is fractional and SpringBoard status-bar Auto Layout recurses until crash; scale 2 reaches Home Screen (u3).
  • INTF_1 counters changed from 60.5/s to 120.2/s and latch ceiling from 16.6 to 8.3 ms. The early synthetic workload improved from 44.6 to 54-55 fps; later display-link measurements are in gpu.
  • Removing the 2.5 ms per-frame scanout copy presented every submitted frame without counted tears.

完成条件 ​

  • Display iPadOS Home Screen on the inner panel with stable presentation at 120 Hz.

当前范围 ​

  • Outer display is unsupported. Backlight retains bootloader state; system brightness control is absent.
  • Old screenshot log lines were truncated to about 39/135 sampled columns. The segmented format was device-verified in g248/g249; sampled screenshots do not replace pixel-level panel inspection.

下一步 ​

  • Integrate panel DCS brightness commands.

证据 ​

输入 ​

implemented

组件: PongPlatform24.

硬件与依赖 ​

  • Inner ST FTS touch (spi0.0 fts-pri), st_fts_l18.ubin firmware.
  • PMIC power key.

配置 ​

  • pong_touch=1; touch_flip=2 (mirror Y) by default.
  • Hold the power key for pong_button_reset milliseconds (default 3000) to reset to fastboot.

操作步骤 ​

  • 0002 adds bsd/dev/pong_fts.c. SE4 is GSI-only, so SPI is bit-banged through GPIO.
  • Deliver events to backboardd through the inherited Pong HID path.

开发经验 ​

  • Touch opened Settings from Home Screen (t4).
  • A three-second power-key hold resets running iOS to fastboot.
  • ui_compat18.c also owns presentation hooks. The 22H374 UIKit.InProcessAnimationManager class match was corrected and exercised in g298; synthetic-animation evidence does not establish additional physical-touch coverage.

完成条件 ​

  • Use touch to open apps and scroll pages.

当前范围 ​

  • Outer touch (spi2.0 fts-sec) is unsupported; volume keys remain unaudited. g298 measures synthetic input, not real-finger latency.

下一步 ​

  • Audit volume-key PMIC addresses and measure physical-touch latency separately from synthetic cadence.

证据 ​

GPU ​

implemented

组件: PongPlatform24.

硬件与依赖 ​

  • Adreno730v3; local device a730_sqe.fw, gmu_gen70000.bin and a730_zap.* firmware, excluded from Git.
  • Turnip and metal2vulkan.

配置 ​

  • PONG_ADRENO_FIRMWARE selects the local firmware directory.
  • pong_gpu_level=9 (710 MHz initial GMU level) by default.
  • MercuryPosterEx is denied GPU access by default; pong_gpu_deny=- restores it.

操作步骤 ​

  • Start Adreno after rootvnode exists and publish the Metal provider after root mount.
  • Cache surface mappings and scanout imports.

开发经验 ​

  • User photos confirm GPU-rendered Home Screen and animations.
  • MercuryPosterEx competes with backboardd: 5/13 baseline trials lost the GPU. Denying it yielded 6/6 without loss and an early mean scrolling rate of 54.5 fps.
  • Fixed 900 MHz did not outperform DCVS; GPU clock was not the limiting factor.
  • A ledger-killed GPU client (SBRendererService on Battery) freed BO pages with user mappings alive, causing pmap_assert_free. PongAdrenoClient::dropViews now unmaps/releases mappings; NativeAdrenoMemory::release calls pmap_disconnect per page before returning pages to VM.
  • After ASTC layout fixes, g248/g249 opened Weather with DeviceSupportsASTC=1; six segmented images per run had 135/135 columns across the screen. g251 Clock and g252 Settings also had complete app images.
  • g253/g254 completed 592/592 and 403/403 GPU submissions. A one-submit deadline difference was backboardd work issued 26 ms before reset, not persistent fence blockage.
  • Tungsten called PXCreateContext with 0x0, triggering Photos assertions. A Photos-only hook clamps zero axes to 1; g262/g263 and final-kernel g264 reached Photos with ASTC both off and on.
  • g296 observed UIKit.InProcessAnimationManager; the old UIViewInProcessAnimationManager-only hook missed it. g298 matched the actual class, filtered 121 requests and reached 95.3 moving fps versus 56.7-58.4 baseline. Trace presentation gaps p50/p90 improved from about 16.6/33.3 to 8.3/16.6 ms.

完成条件 ​

  • Render Home Screen and apps through the GPU without GPU loss during sustained scrolling.

当前范围 ​

  • Wallpaper extensions cannot use the GPU; metal2vulkan still spends about 10-20 ms CPU time per submission.
  • Sampled screenshots verified Home Screen, Weather, Clock, Settings and Photos after ASTC fixes. Multitasking, touch animations and Photos album/search/edit paths need manual checks; ASTC remains off by default. Stuck-copy and poison detection remain enabled for previously observed GPU losses.
  • Photos launch and album landing page are verified; grid, search, edit and image viewing after first-use prompts need manual interaction. IOSurfaceSharedEvent listeners are still missing.
  • g298 improves the synthetic animation tail; first frame after idle remains about 75-80 ms. Real fingers, Settings scrolling, power and other apps have no independent qualification; this is not a global 120 fps claim.

下一步 ​

  • Implement IOSurfaceSharedEvent listeners before restoring dependent services and wallpaper GPU access.
  • Locate the roughly 80 ms first frame and measure Settings scrolling separately. Use segmented traces to prioritize BO/IOSurface work; qualify fairplayd and wallpaper independently.

证据 ​

网络 ​

device-verified

组件: PongPlatform24.

硬件与依赖 ​

  • QCA6490 (PCI 17cb:1103); read-only device firmware export and Linux v7.0.14 ath11k sources kept outside this repository.

配置 ​

  • Default zizhan_ipados18_gpu_defconfig enables GPU and Wi-Fi together; the legacy Wi-Fi name is only a compatibility symlink. Build/package defaults select that profile and startup follows actual compiled settings. WIFI=0 remains an explicit diagnostic override. Private association inputs remain disabled.

操作步骤 ​

  • Check PCIe0, WLAN GPIOs and SIDs against the Android live DT; build and pack the isolated Wi-Fi configuration.
  • Temporarily fastboot boot over rear USB-A with automatic return. Diagnose power, PCIe, DMA, MHI, firmware, MSI and scan in order; preserve the first failure.

开发经验 ​

  • Live DT confirms PCIe0, GPIO 80/94/95/96/204 and SID 0x1c00/0x1c01; Android runs Gen2 x1.
  • The old Pong profile differed in six PHY entries and one extra power request. g265/g266 never booted. The corrected zizhan profile was checked against the full live DT; g267 was prepared but its waiter was removed before any device boot.
  • Extended QMI board IDs preserve the chip-dependent bdwlan/bdwlang prefix. g268 PWF2 matched all 213 exported files; the kernel and boot image contained the complete package. USB tool failures meant no g268 device evidence.
  • Remove the unverified Pong PCI subsystem gate; validate the primary ID and log actual subsystem values. The summary reports only the last cold start and does not infer association from scan milestones.
  • g272-retry verified power, PCIe link/BAR and subsystem 0x010817cb. SMMU context returned StateMismatch (7), left the SID detached and let iOS continue; no scan.
  • g273 passed TCR2 checks but failed SCTLR ASIDPNE readback. Explicit TBI and a coordinated shared ASID enabled SID1c01 DMA in g274; firmware/QMI reported chip_id=0x12, board_id=0xff and selected bdwlang.elf. WMI_INIT returned -11; receiver setup alone did not prove MSI delivery.
  • The host replay selects shim headers with -iquote: its first Linux run exposed -I shadowing glibc linux/errno.h and hiding EAGAIN. This is a host-harness fix; driver behavior is unchanged. A reproduced WMI wait bug resent after success. The fix in g275 reached station-ready, 102 channels, a completed 42-channel scan and 15 networks; Apple80211 queries followed. g276 never booted due to USB enumeration; g277 prepared private optional join inputs.
  • g278 completed real WPA2 and key installation. g279 native IPConfiguration acquired DHCP; g280/g281 repeated it, but published service state lacked Router despite router/DNS in the ACK.
  • g290 default Wi-Fi path used a separate lease compensation session and verified initial HTTPS, requested renewal, disconnect cleanup and reconnect, with three HTTPS 200 responses. A credential-free boot reached station-ready and scanned 11 networks without association or public probes.
  • g291 authenticated to a different BSSID but received no DHCP Offer/ACK. A same-image retry crashed firmware into RDDM; repeated recovery messages overwrote early diagnostics.
  • g292 verified first connection and requested renewal on 2.4 GHz, then hit RDDM on cross-band reconnect. g294 vdev recreation failed and was removed. g293/g295 bound the native IO80211 user client; after wifid job/cache repair manager-port lookup errors disappeared, but no native scan/join SET and no successful Settings launch were observed.
  • g304 and g306 verified 5220-to-2452 MHz and 2452-to-5220 MHz reconnects to distinct BSSIDs: first connection, requested renewal and reconnect each returned HTTPS 200, with route/DNS cleanup and no RDDM. Publish target-band basic rates before assigning the channel context; ath11k reuses its cached management rate at vdev start.
  • g301-g303 traced the native UI stall from SpringBoard wifi_manager_open to wifid waiting for InterfaceNamer completion. The stock 300/240-second stack/quiet fallback exceeded short device trials. Stock InterfaceNamer metadata now selects 30/10 seconds and configd publishes its actual TIMEOUT/COMPLETE state.
  • g309 used only the native Settings UI: exact private network row, secure text input and navigation Join action. Stock wifid submitted the 900-byte association ABI, WPA2 key installation and DHCP completed, native HTTPS returned 200; ACK compensation released after native route/DNS took over. Kernel auto-association remained disabled.
  • g312 reused native saved credentials from an SSID-only/no-password fixture and returned HTTPS 200; kernel credentials and kernel association test remained disabled.
  • g311 failed a 128 MiB wired DMA allocation before station readiness. Retry a real 64 MiB arena with SMMU/allocator bounds from the actual size; g312/g314 verified that budget.
  • 22H374 reads a 2264-byte scan record with a monotonic observation timestamp at 0x8d0. Preserve the legacy prefix and derive real observation time conservatively from frame age.
  • RSSI_BOUNDS type 106 was unsupported, leaving a zero legacy threshold that rejected negative-dBm candidates. Report signed decoder format limits after checking SIGNAL_DBM, with no extra station admission floor; native quality policy and actual RSSI readings are preserved. g331 automatic association and HTTPS 200 passed. g332 repeated it with original wifid, no Settings launch and actual default 128 MiB DMA; its periodic disconnects were subsequently diagnosed as PrimaryTimeout.
  • g334 native logs identified Not Primary Interface (1005). Bind the ACK compensation service to the existing real en0 Setup Interface in the same session; cleanup removes that binding with IPv4/DNS. g337 used original wifid, no fixture or Settings launch, a real default 64 MiB arena and asynchronous FIFO notifications: one native association, HTTPS 200, no link loss through approximately 309 seconds.
  • g338-g340 failed the second DHCP after real radio off/on despite successful key installation. The shared timer traversal cached a successor across recursive callbacks; inner removal made that node self-linked. Adapt the generated timer pass to restart selection after each callback with a 256-callback budget. Host replay reproduces the old hang. g341 with the same local test OS passed two distinct DHCP REQUEST/ACK transactions, two HTTPS 200 responses and session/route/DNS cleanup, with continued worker progress.
  • Default device packaging now starts the compiled radio without WIFI=1; explicit WIFI=0 disables only the radio, and reduced CI packaging does not claim a compiled radio.

完成条件 ​

  • Scan and associate with a real network.
  • On en0, verify DHCP, requested renewal, disconnect route/DNS cleanup, reconnect and three public HTTPS responses (g290 default network path).

当前范围 ​

  • The default GPU configuration now includes Wi-Fi. Current radio processing still depends on polling; actual GIC MSI delivery is unverified.
  • Bidirectional cross-band tests and one Settings join passed against the current WPA2 APs. Natural T1 expiry, different SSIDs/subnets, long-duration roaming, enterprise/SAE and broader device coverage remain unqualified.
  • DHCP ACK compensation remains available for missing route/DNS state; g309 observed native takeover. UI fixture files and firmware stay local, and the optional UI test is disabled unless explicitly requested.
  • Automatic join, short connection hold and one native radio off/on lifecycle passed. This is not long-duration qualification. One logging boot failed before userland with shared-cache ENOMEM; preserve that genuine panic as a failed prerequisite.

下一步 ​

  • Keep the verified clean prepared OS, UI/helper and manifest aligned; old prepared artifacts are retained and canonical/trial descriptors match. Investigate the separate no-Settings canvas-mapping failure without treating it as a successful UI trial.
  • Qualify natural T1, different subnets, long-duration reconnect and actual MSI separately before changing the shipping default.

证据 ​

cellular ​

planned

硬件与依赖 ​

  • SM8475 phone with a cellular modem; unlike a Wi-Fi-only board this area is applicable.
  • Board-specific modem firmware, EFS/NV, QRTR/QMI, SIM, IPA/QMAP and OS ABI inputs require an audit. Keep identities and device dumps private.

配置 ​

  • No cellular component is selected or enabled in board.toml; no modem initialization is added by this record.

操作步骤 ​

  • Read the upstream baseband guide and sibling implementation before selecting a shared component.
  • Audit the live board resources and firmware dependencies; isolate read-only transport/identity checks before registration or data-session work.

开发经验 ​

  • No cellular implementation or device verification has been performed in this repository; a Wi-Fi HTTPS result does not validate modem transport or data.

完成条件 ​

  • Establish firmware/transport ownership, valid SIM state and network registration.
  • Verify IPA/QMAP data sessions, routing and teardown/reset with separate host/device evidence.

当前范围 ​

  • Modem firmware loading, EFS/NV, SIM, registration, IPA/QMAP and data sessions are not implemented or verified. No IMEI/ICCID or raw modem dump is published.

下一步 ​

  • Inventory the actual zizhan modem transport, firmware and OS dependencies against the upstream QcomBaseband guide, then choose the first bounded read-only probe.

证据 ​

音频 ​

planned

组件: PongPlatform24.

硬件与依赖 ​

  • Two CS35L41 amplifiers at 0x40/0x42. Public zizhan Android DT gives SE15 I2C 0x880000, GPIO56/57 SDA/SCL, GPIO88/118 IRQ and shared GPIO1 reset. Recheck the live phone DT before enabling; Pong uses TFA9873 with different bus/pins/addresses.

配置 ​

  • pong_audio=0; without tfa98xx.cnt build an empty amplifier table.

操作步骤 ​

  • Keep audio off; audit live DT and I2C prerequisites, run an isolated read-only identity probe, then implement CS35L41 initialization and ADSP playback routing.

开发经验 ​

  • Pong TFA9873 initialization cannot be reused by changing addresses.
  • PongAudio.cpp uses SE13 0xa94000, GPIO48/49 and addresses 0x34/0x35, unlike the public zizhan SE15 description.
  • GeniI2c supports multi-byte transfers but amplifier wrappers and writes remain TFA9873-specific.

完成条件 ​

  • Play audible sound through the speakers.

当前范围 ​

  • No CS35L41 driver. Public extracted DT still needs live-device revalidation; no audio device-boot or playback evidence.

下一步 ​

  • Verify live SE15 clocks, pins, reset and IRQ, then read CS35L41 identity in an isolated config. Audit tuning/firmware and ADSP routing before staged device tests.

证据 ​

电源 ​

implemented

组件: PongPlatform24.

硬件与依赖 ​

  • Local ADSP /vendor/firmware_mnt/image/adsp.mdt and b00..b25, merged by mdt2mbn.py into adsp.mbn; not committed.
  • UniXNU-sheng ShengBattmgr protocol.

配置 ​

  • CONFIG_XNU_PONG_POWER=y.
  • pong_adsp=2 starts DSP and battery; 1 maps/investigates only; 0 disables.

操作步骤 ​

  • PongAdsp loads/authenticates ADSP in the zizhan carveout and reads battery through PMIC GLINK.
  • Shift ShengBattmgr Xiaomi property IDs by one after 12; temperature is already in 0.01 C.
  • PongRpmh.cpp supplies shared RPMh votes when Wi-Fi is not built.

开发经验 ​

  • g206 agreed with Android sysfs: 100%, 4444 mV, charging 426 mA, 34.40 C, full capacity 3507 mAh, design 4500 mAh and 907 cycles.
  • Rename the battery service AppleSmartBattery because PerfPowerServices PLBatteryAgent and powerd health calculation select that class. Publish Serial, BatteryData and MaximumCapacityPercent. Settings Battery Health reported 78% (3483/4500 mAh).
  • The health spinner follows batteryDataUnavailable: thermalmonitord never publishes com.apple.thermalmonitor.ageAwareMitigationState and powerd lacks Battery Service State.
  • USB plug/unplug changes charge state and current direction (+300/-520 mA, v7).
  • Settings checks MobileGestalt D6/BMDrlb8V3WSiqL8gL+w then AppleAuthCPRelay isTrustedForUI for battery authentication. This battery has no Apple authentication chip; ui_compat18.c reports the capability false, without inventing genuine-part status.

完成条件 ​

  • Status bar and Settings Battery show accurate charge and plug/unplug changes; Battery opens without blocking.

当前范围 ​

  • Battery Health still spins due to missing management/service state. Usage graphs need long-term collection. Sleep/wake is unsupported.

下一步 ​

  • Implement thermalmonitord ageAwareMitigationState and powerd Battery Service State from actual services; do not fabricate a normal status in Settings.

证据 ​

镜像组装 ​

host-verified

组件: PongPlatform24.

硬件与依赖 ​

  • xnu-11417.140.69 (Darwin 24.6.0) and stock 22H374 restore components.

配置 ​

  • patches/xnu-ipados18/series.
  • PROFILE=zizhan_ipados18_gpu; local prelink/userdata inputs documented under migration/ipados18.

操作步骤 ​

  • ci_prep.sh prepares dependencies; ci_kernel.sh builds; ci_boot_ufs.sh prelinks and creates the boot image.
  • build-xnu-ipados18.sh uses patch --forward in series order to avoid reversing already-applied hunks.

开发经验 ​

  • After the series is applied, clean xnu-11417.140.69 matches the actual build tree file by file.
  • Disable three newer-clang warnings under -Werror; support both Intel and arm64 macOS hosts.
  • ADT /chosen requires unique-chip-id and chip-id. Without IOPlatformUUID, gethostuuid blocks and timed/locationd/contextstored/PowerUIAgent lead to a frozen Battery page. build-ipados18-bootimg-local.py supplies a software seed, not an Apple hardware identity.
  • fairplayd.A2 exits immediately in this port; launchd KeepAlive retains its port and queued requests have no response. EXCLUDED18 removes it on a full rebuild.
  • The packer enforces 1020 command-line bytes. Omit default pong_ui_software=0, pong_software_ui=0 and pong_ram_banks=1 to save about 54 bytes.
  • ADT /product udid-version=1 requires SerialNumber, ECID, WifiAddress and BluetoothAddress; disabled Wi-Fi stalls MobileGestalt and Settings ISDefaults. With a /chosen seed, use the stock iPhone17,1 version 2 (ChipID-ECID); first Settings screen fell from 6.4 to 1.2 seconds.
  • On November 2, fairplayd was restored from pre-g213 OS for Weather diagnosis. g245 recorded 2560 frames, 2453 moving at 72.0 fps and no failed lookups, but respawn persisted. EXCLUDED18 still removes it on full rebuild.
  • Read-only inspection found fairplayd cache/plist in current OS and g213, absent in f245. Kernel builds do not change that installed service state; use the same kernel and B1-A-B2 ordering for a device control.
  • g279 installed a signed native DHCP helper/job into the 22H374 OS after old-window/block prechecks, then read back blocks against the manifest. The phone launched the service.
  • The November 4 compliance audit found that the existing local and macOS build pipelines have not adopted the latest upstream templates/package.sh and package action. Record validity and successful builds do not establish compliance with that new packaging interface.
  • Full 22H374 preparation copies stock InterfaceNamer bundle metadata into the overlay with its documented native 30/10-second fallback. The signed UI helper is opt-in; tests use local-only credential files, verified OS delta preflights and readbacks. No fake dynamic-store Quiet state is injected.
  • Local build and package defaults select the combined device profile. Runtime GPU/Wi-Fi enablement follows the kernel report; explicit overrides produce a single value per key. Reduced cloud CI remains explicitly selected.

完成条件 ​

  • Build a bootable image reproducibly from a published device revision and record host and device results separately.

当前范围 ​

  • Apple images, firmware and ABI binaries are prepared locally.
  • The generic job-restore.sh had static checking only. Installed fairplayd policy differs from full rebuild; no B1-A-B2 device comparison has completed.
  • The latest unified scripts/package.sh and .github/workflows/package.yml are absent. Current CI builds the reduced kernel by default, not a clean end-to-end release or a full Wi-Fi/GPU image.

下一步 ​

  • Migrate the fixed upstream package template, TOML-selected Darwin24 prelink/payload inputs and package action together; validate --check and a full local build before claiming adoption.
  • Run the same-kernel fairplayd B1-A-B2 control and inspect exits, Weather and Battery independently of UI/plugin build success.

证据 ​

诊断 ​

implemented

组件: PongPlatform24.

硬件与依赖 ​

  • ramoops at 0x85200000, logfs and USB adb/fastboot.

配置 ​

  • pong_autoreset=<seconds> (default 300), pong_autoreset_sb.
  • pong_klog_4k copies kernel logs into a fixed UFS file.
  • pong_gtrace, pong_gtrace_delay, pong_gtrace_ib and touch_lat provide timed per-frame traces.

操作步骤 ​

  • cycle.sh temporarily boots, waits for watchdog fastboot return, uses RamoopsDump to write logfs, returns to Android and pulls logs.
  • Panic, a three-second power-key hold and deadline reset all return to fastboot while retaining DRAM logs.

开发经验 ​

  • The loop needs no key presses. Missing pong_autoreset in g152 was mistaken for a bus freeze.
  • Repeated hot trials cause bit flips in DRAM ramoops; the pong_klog_4k UFS copy avoids that corruption.
  • pong_url and pong_pane open Settings; settings_compat18.c prints views/specifiers/spinners/accessibility at 6/12/20/30 seconds. settings-ui.py decodes escaped non-ASCII output.
  • gs_all=2 in 0005 also samples waiting threads; gsym.py resolves complete stacks. This traced synchronous XPC to timed waiting in gethostuuid.
  • pong_gtrace_delay moves capture after SpringBoard startup. Fence age separates persistent stalls from in-flight work at reset.
  • USB enumeration probes have six-second limits; fastboot boot has a 180-second transfer limit and preserves failure instead of claiming boot.
  • The old g268 waiter ran under user-domain launchd with heartbeats but no device enumeration; this is historical evidence.
  • Failed logfs export/pull removes stale and partial local copies. Screenshot decode removes old PNGs when the new trial has none.
  • Only matching current arm/successful-boot markers permit UFS klog readback; otherwise recover ramoops, preventing old pinned klog reuse.
  • boot.sh checks device/image before reboot; adb reboot is bounded to 30 seconds. fastboot visibility requires a successful command.
  • logfs export/pull are limited to 60/120 seconds and remove stale/partial outputs on failure.
  • g272-retry through g275 completed temporary boots, deadline return and fresh UFS logs. g276 never booted after USB vanished in the fastboot transition.
  • Rear USB-A passed 10/10 Android-fastboot-Android transitions without replug. After the matching companion-port action and three-second settle, a 100168 KB image transferred and booted once.
  • The host replay uses -iquote so Darwin shim headers do not shadow glibc linux/errno.h. Record CI now uses the reviewed e67a79eb64012e8f30ba04c56ea37753bdb720a2 checker and compares committed paths against the push-before or PR-base SHA, in addition to structural validation. All matched owner areas must update findings/evidence. A separate Ubuntu/clang job replays the existing SMMU, WMI, DHCP and USB regressions against pinned Ath12kWifi headers without private inputs.
  • g301-g303 stack sampling separated SpringBoard wifi_manager_open, wifid SystemConfiguration quiet waiting and normal configd run loops. The optional bounded Settings probe selects only the exact private SSID, uses native secure-text and Join handlers, logs no credentials and requires independent association/HTTPS evidence. UISwitch dumps report actual on/enabled state.
  • Optional read-only Wi-Fi progress diagnostics and kernel thread sampling distinguished an executing dispatcher stall from a sleeping waiter. The actual timer-pass regression now reproduces the original nested-removal hang and validates the generated fix; g341 native UI actions are accepted only alongside independent DHCP transactions, HTTPS and cleanup evidence.
  • Default and radio-off package paths were run with the system bash, including unset PROFILE/WIFI; no empty-array nounset failure remains. Device evidence is collected from an actual default package with automatic return.

完成条件 ​

  • Every trial automatically returns to Android and yields fresh complete logs.

当前范围 ​

  • Direct USB-C can still fail enumeration and lacks supported host-port probing. Rear USB-A is the verified path. Port-state bits do not prove VBUS power-off; prefer current-trial UFS klog over corrupt ramoops.

下一步 ​

  • Use rear USB-A for unattended trials; retry only once for an explicit USB write failure during transfer. Follow both record and kernel CI at the published SHA.

证据 ​

Released under the BSD-2-Clause-Patent License.

Copyright 2026 UniXNU contributors