Add experimental P105 iPad mini 1 hardware and recovery support

.gitattributes

@@ -0,0 +1,3 @@
+# Unified-diff context prefixes are part of the patch data.
+kernel/p105/*.patch whitespace=-blank-at-eol,-space-before-tab
+runtime/p105/patches/*.patch whitespace=-blank-at-eol,-space-before-tab

BUILD.md

@@ -30,6 +30,12 @@ Choose new output paths. Producers use pinned upstream revisions, hardware patch
 
 The m1n1 backend is unbranded by default. A distro can pass `--extra-patch FILE`, `--include-header FILE`, and `--extra-cflags FLAGS` for its own presentation.
 
+## iPad mini 1 components
+
+The [P105 hardware profile](devices/p105/README.md) covers the first-generation Wi-Fi iPad mini. The [P105 producer](kernel/p105/README.md) builds ARMv7 public kernel components with an empty initramfs, or a private boot bundle from an explicit owner root and calibration. Run `kernel/build p105 --work NEW_WORK --output NEW_OUTPUT`; both directories must be outside this package. Its desktop configuration and device tree disable the reference NAND controller.
+
+The manual boot route uses an existing jailbreak and a root served over USB/NFS by the host. Follow [systemd runtime integration](runtime/p105/README.md) for the installed root. A private bundle embeds per-user recovery inputs and stays on the owner's host. The J71b release workflow continues to build J71b artifacts; P105 launcher publication and CLI integration are separate work.
+
 ## Runtime and image assembly
 
 - `image/runtime.py`: modules, hardware/touch scripts, device API and integrity lists.

MANIFEST.in

@@ -9,3 +9,11 @@ recursive-include .github/workflows *.yml
 prune boot/m1n1/.work
 prune boot/quiet/.work
 global-exclude __pycache__ *.py[cod] .DS_Store
+
+recursive-include devices/p105 *.md *.toml *.json
+recursive-include kernel/p105 *.md *.lock *.fragment *.patch *.sh Containerfile prepare-source build
+recursive-include runtime/p105 *.py *.md *.patch
+recursive-include runtime/p105/overlay *
+recursive-include runtime/p105/recovery *.py init
+prune runtime/p105/build
+prune kernel/p105/.work

NOTICE

@@ -14,3 +14,11 @@ selective reuse and adaptation, not a replacement of the pinned base kernel.
 
 m1n1: Asahi Linux Contributors, MIT (LICENSES/m1n1.txt).
 Wireless regulatory database: LICENSES/wireless-regdb.txt.
+
+P105/A5 manual bring-up uses Project Cascadia by rzxvx and its contributors:
+https://github.com/rzxvx/Project-Cascadia
+Pinned revision: c20b85ebb951c704d7e3a664c378dde8276e3928.
+Cascadia carries the GNU GPL version 2. The source-preparation recipe fetches
+that revision separately; its hardware timing remains in Cascadia. P105
+patches preserve the upstream source notices. Apple firmware and per-device
+touch calibration are supplied privately by the device owner.

README.md

@@ -6,6 +6,12 @@ Hardware support and image-building resources for Linux on Apple devices. This r
 
 Currently: iPad 6 Wi-Fi (`iPad7,5`, J71b), experimental. Boot is tethered and GPU acceleration is not available.
 
+The iPad mini 1 Wi-Fi (`iPad2,5`, P105AP) has an experimental P105 profile for
+jailbreak-assisted tethered boot and a host-served NFS root. See the
+[P105 prerequisites and measured results](devices/p105/README.md) for its
+A5/ARMv7 component recipe and companion Orchard CLI support. Public launcher
+assets await release integration.
+
 ## Use
 
 For installing and starting a published system, use the [Orchard CLI](https://github.com/OrchardLinux/cli). Its release requirements select compatible CLI and hardware wheels automatically.

devices/p105/README.md

@@ -0,0 +1,139 @@
+# iPad mini 1 Wi-Fi (P105)
+
+Experimental hardware prerequisites and component builds for the original
+iPad mini Wi-Fi. The public resources describe the board and its firmware
+inputs; the boot components use Cascadia and vetted Legacy iOS Kit tools.
+The companion Orchard CLI contribution supplies a native P105 adapter for
+private tethered recovery and USB/NFS handoff. Public launch assets await
+release integration.
+
+| Identity | Value |
+| --- | --- |
+| Apple product | iPad2,5 |
+| Board / device tree | P105AP / apple,p105ap |
+| SoC / DFU chip | Apple A5 S5L8942X / 0x8942 |
+| DFU board | 0x0a |
+| Userspace ABI | 32-bit ARMv7, hard float |
+| Physical RAM | 512 MiB |
+| Panel | 768 x 1024 |
+
+The native recovery gadget uses `Orchard-P105`, with a boot-bound USB serial
+number. macOS reports its product as `Orchard_P105`. The device descriptor
+retains the generic CDC gadget metadata used by the earlier manual boot;
+native discovery validates the recovery identity through the CLI adapter.
+The capability flags describe observed hardware behavior.
+
+## Manual boot prerequisites
+
+- An iPad2,5 with a working jailbreak. The qualified device ran iOS 9.3.5
+  (13G36), with an untethered jailbreak and OpenSSH installed through Cydia.
+- A Lightning USB connection, a trusted computer and access to the owner's
+  iOS SSH credentials. The jailbreak supplies the kDFU entry path.
+- A macOS or Linux host with the dependencies reported by Cascadia's doctor,
+  a working Docker-compatible build environment, and Legacy iOS Kit's host
+  USB tools. The local qualification used a Mac.
+- The Apple iOS 8.4.1 / 12H321 IPSW pinned in firmware.json and the owner's
+  own multitouch calibration. The running iOS version and firmware-source
+  archive serve different steps of the boot path.
+- A 32-bit ARMv7 root filesystem and a compatible kernel/runtime. The
+  qualified desktop used an external NFS root through USB; installed-root
+  policy belongs to its image builder.
+
+The component producer and source preparation entry points are documented in
+[the P105 kernel recipe](../../kernel/p105/README.md):
+
+~~~sh
+python3 kernel/p105/prepare-source --output ../cascadia-p105
+cd ../cascadia-p105
+./cascadia doctor
+~~~
+
+These commands prepare source outside the hardware checkout and check the
+build host. Follow the kernel recipe for its pinned Linux commit checkout,
+private firmware inputs and RAM bundle build. The source preparer applies
+the P105 kernel fragment and runtime patches from this repository.
+Cascadia's `flash --kdfu` selects the paired plaintext iBEC generated from
+the pinned IPSW. See [the runtime handoff](../../runtime/p105/README.md) when
+preparing an installed system; its installer requires an explicit owner
+calibration file alongside the verified initramfs tree.
+
+The earlier physical qualification used upstream revisions
+[Cascadia c20b85e](https://github.com/rzxvx/Project-Cascadia/tree/c20b85ebb951c704d7e3a664c378dde8276e3928)
+and [Legacy iOS Kit 23622f8](https://github.com/LukeZGD/Legacy-iOS-Kit/tree/23622f8fe72c09952089d5145a7b008cfcc90d9b).
+Cascadia's [quick start](https://github.com/rzxvx/Project-Cascadia/blob/c20b85ebb951c704d7e3a664c378dde8276e3928/docs/QUICKSTART.md)
+describes the host setup and jailbreak-assisted USB boot sequence.
+
+## Firmware and private calibration
+
+firmware.json retains the shared device, IPSW, extracted-input and destination
+fields used by the existing J71b recipe. Its preparation mode is explicitly
+manual and source-only. The encrypted root filesystem needs Cascadia's pinned
+extractor, and generated entries name Cascadia source steps. The CLI verifies
+the owner's prepared firmware against this recipe. Extraction remains an
+explicit owner preparation step.
+
+P105.mtprops is generic Apple touchscreen firmware extracted from the IPSW.
+The separate mtcal.bin comes from the owner's panel calibration in syscfg
+MtCl. The pinned upstream source contains another device's reference
+calibration; source preparation excludes it and the runtime requires the
+owner's file. Keep calibration bytes and their hashes out of commits,
+public manifests and release artifacts.
+
+The generic output hashes cover the pinned archive and source generators.
+The Wi-Fi image hash uses Cascadia's public synthetic MAC default. A custom
+MAC produces a different image and needs a host-local receipt. The recipe
+also records the Broadcom Bluetooth patchram and SGX microkernel required
+by the qualified runtime. The BCM4334 build rejects the CLM-loading path,
+so the recorded recipe supplies its combined TRX/NVRAM image.
+
+IPSW downloads, decrypted firmware, patched Apple bootloaders and device
+calibration stay on the owner's host. This directory contains metadata and
+instructions.
+
+## Current component qualification
+
+The packaged producer's private bundle booted this device on 27 October 2026
+and reached the Arch / Omarchy A desktop through the preserved USB/NFS root.
+System and user managers reported zero failed units. The hardware payload
+checksums passed, while the flash controller stayed disabled with an empty
+MTD inventory. The owner calculated 2 + 2 = 4 in Omacalc and opened the app
+grid with Home.
+
+Touch responds slowly and sometimes needs repeated taps, matching the owner's
+experience with the earlier desktop. This remains an open issue. See the
+[component validation record](../../docs/p105-validation.md) for the tested
+scope and the package checks.
+
+The companion CLI subsequently passed repeated native recovery boots and NFS
+handoff, preserving its pinned diagnostics and the RAM rescue console. See
+[the Orchard validation record](../../docs/p105-orchard-validation.md).
+
+## Earlier physical qualification
+
+The results below describe the original manual build and its desktop root.
+
+On an original iPad2,5 with an A5 and 512 MiB RAM, a native Arch Linux ARM
+armv7h desktop ran on Cascadia Linux 6.12 with a USB/NFS root. A repeat boot
+reached graphical.target in 27.478 seconds. Both system and user managers
+reported zero failed units with the document portal running after FUSE was
+built in. Display qualification used the native panel with Pixman and Qt
+software rendering.
+
+The user confirmed touch input by calculating 2 + 2 = 4 in Omacalc. Foot and
+Firefox launched on the iPad. Physical Home opened the application grid with
+the runtime's opt-in --desktop-home forwarder. Wi-Fi association succeeded
+through the on-iPad password UI. USB networking carried NFS and SSH, and the USB serial rescue
+console remained available.
+
+The desktop runtime used systemd namespaces and cgroups, built-in FUSE,
+uinput and a 256 MiB LZ4 zram device. Those requirements are recorded in the
+kernel and runtime resources linked above. A user-supplied root must provide
+its own session, service and package policy.
+
+Bluetooth pairing and audio playback remain untested. Accelerated graphics
+still need qualification. Linux reboot currently powers the device off;
+starting Linux again requires the host boot flow. Tethered boot and the
+external root remain part of this qualified setup. P105 registration and
+manual component preparation cover this contribution; release integration
+remains part of later release work. The companion CLI adapter handles the
+private tethered recovery and NFS workflow.

devices/p105/device.toml

@@ -0,0 +1,25 @@
+# iPad mini 1 Wi-Fi (P105): identity and manual boot prerequisites.
+schema = 1
+kind = "hardware.device"
+
+[device]
+profile = "p105"
+name = "iPad mini 1 (Wi-Fi)"
+apple_products = ["iPad2,5"]
+dt_compatible = ["apple,p105ap"]
+
+[match.dfu]
+chip = 0x8942
+board = 0x0a
+
+[boot]
+methods = ["jailbreak-kdfu"]
+# The CLI consumes an owner-private boot manifest. Public launch assets await release integration.
+
+[firmware]
+recipe = "firmware.json"
+
+[support]
+wifi = true # Association was verified through the native desktop password UI.
+usb_serial = true
+usb_network = true

devices/p105/firmware.json

@@ -0,0 +1,88 @@
+{
+  "device": "iPad2,5",
+  "version": "8.4.1",
+  "build": "12H321",
+  "ipsw_url": "https://secure-appldnld.apple.com/ios8.4.1/031-31249-20150812-75235CC6-3C8F-11E5-848D-BE1A3A53DB92/iPad2,5_8.4.1_12H321_Restore.ipsw",
+  "ipsw_bytes": 1509764204,
+  "ipsw_sha256": "ce6cd59a4a3271eccb93b31c8d40e94ad966112999576663b3ab235196154756",
+  "preparation": {
+    "mode": "manual-source-only",
+    "source_url": "https://github.com/rzxvx/Project-Cascadia.git",
+    "source_commit": "c20b85ebb951c704d7e3a664c378dde8276e3928",
+    "entrypoint": "scripts/build-firmware.sh",
+    "rootfs_extractor": "scripts/rootfs-extract.py",
+    "rootfs_member": "058-24036-023.dmg",
+    "orchard_adapter": false,
+    "note": "The encrypted root filesystem and source generators require the pinned Cascadia workflow. Extraction patterns alone cannot prepare this recipe."
+  },
+  "extract_patterns": [
+    "^058-24036-023[.]dmg$",
+    "^kernelcache[.]release[.]p105$",
+    "^Firmware/dfu/iBSS[.]p105[.]RELEASE[.]dfu$",
+    "^Firmware/dfu/iBEC[.]p105[.]RELEASE[.]dfu$"
+  ],
+  "extracted_inputs": [
+    {
+      "name": "P105.mtprops",
+      "source_path": "usr/share/firmware/multitouch/P105.mtprops",
+      "sha256": "516b8db5f6144ad64698867b8f6e6209a49010fcff1cb103539fe5ea4ffb1390"
+    },
+    {
+      "name": "borg.trx",
+      "source_path": "usr/share/firmware/wifi/4334b1/borg.trx",
+      "sha256": "fcc6e5b6f085b7b1ae8558fe0af4a689ab9e7eb49689ef443e194865b0be7d12"
+    },
+    {
+      "name": "borg-t-st.txt",
+      "source_path": "usr/share/firmware/wifi/4334b1/borg-t-st.txt",
+      "sha256": "78d24471b6fecaf63ebda5d4e055d976905cda8230b2e166c3c2080f05aa6d81"
+    }
+  ],
+  "files": [
+    {
+      "name": "P105.mtprops",
+      "sha256": "516b8db5f6144ad64698867b8f6e6209a49010fcff1cb103539fe5ea4ffb1390",
+      "destination": "lib/firmware/P105.mtprops"
+    }
+  ],
+  "generated": [
+    {
+      "name": "brcmfmac4334.bin",
+      "destination": "lib/firmware/brcm/brcmfmac4334.bin",
+      "sha256": "c02d3308434b7e2251bb2e235362e31a6033a4bc909c030888e8f9085afec5f4",
+      "generator": "cascadia-trx-add-nvram",
+      "source_script": "scripts/trx-add-nvram.py",
+      "inputs": ["borg.trx", "borg-t-st.txt"],
+      "configuration": "Pinned upstream WIFI_MAC synthetic default. A MAC override requires a separate host-local output receipt."
+    },
+    {
+      "name": "BCM4334B0.hcd",
+      "destination": "lib/firmware/brcm/BCM4334B0.hcd",
+      "sha256": "b6791a67141f1a16447e916237180a049b89dfaab9c38451b33864dbb6a50dda",
+      "generator": "cascadia-bluetool-borg-tdk",
+      "source_script": "scripts/extract-bt-firmware.py",
+      "source_path": "usr/sbin/BlueTool",
+      "selection": "Borg TDK / BCM4334B1 37.4 MHz"
+    },
+    {
+      "name": "sgx543.fw",
+      "destination": "lib/firmware/apple/sgx543.fw",
+      "sha256": "5f929f351459b169ed91a68dce086dbc682b639c4a31846ef5b12837562e9a77",
+      "generator": "cascadia-sgx543-firmware",
+      "source_script": "scripts/extract-sgx-firmware.py",
+      "source_member": "kernelcache.release.p105"
+    }
+  ],
+  "private_inputs": [
+    {
+      "name": "mtcal.bin",
+      "destination": "lib/firmware/mtcal.bin",
+      "source": "The owner's iPad syscfg MtCl, captured from its jailbroken iOS",
+      "required": true,
+      "required_for": ["multitouch", "qualified desktop runtime"],
+      "allow_reference_fallback": false,
+      "publish": false,
+      "note": "Supply the owner's calibration explicitly. The upstream reference calibration is excluded; keep calibration bytes and hashes out of public recipes and releases."
+    }
+  ]
+}

docs/p105-orchard-validation.md

@@ -0,0 +1,77 @@
+# P105 Orchard recovery validation
+
+On 27 October 2026, Orchard CLI 0.1.11 booted the original iPad mini Wi-Fi
+through its qualified iOS 9.3.5 jailbreak into RAM recovery. The authenticated
+NFS handoff reached the preserved Arch Linux ARM / Omarchy A desktop. A second
+cold boot qualified the final console cleanup in the recovery init.
+
+The local contributions pair hardware 0.1.11 with CLI 0.1.11 and the ARMv7
+recovery composer in Minimal Linux. Each repository has a separate branch.
+The desktop filesystem still comes from the preserved development root; its
+migration into the current Omarchy A builder belongs to phase 4.
+
+## Physical checks
+
+| Check | Result |
+| --- | --- |
+| Boot transport | UDID-bound iOS SSH, verified kloader and iBEC, then one bundle upload and one loader upload |
+| Cable wait continuation | The repeat test resumed its saved iBEC wait with the same target and verified assets |
+| Recovery identity | Provisioned owner ECID and live kernel boot UUID checked through USB, serial bootstrap and pinned SSH |
+| NFS handoff | One authenticated request; the same device, boot UUID and SSH host key remained valid after the pivot |
+| Installed system | NFS root ready, graphical target active, Labwc and desktop shell running |
+| Service health after touch recovery | Zero failed system units; platform, touch and Home services active |
+| Hardware payload | All eight installed checksums passed |
+| Rescue console | Exactly one reader of `ttyGS0`, rooted in the installed system; physical serial commands ran the rescue shell from RAM |
+| Flash fence | Controller disabled and MTD inventory empty |
+| Owner interaction | Desktop visible; physical Home opened the app grid on the first native boot |
+
+The repeat boot's touchscreen daemon exhausted its calibration attempts and
+exited. A single service restart restored it in the same Linux session. The
+driver reported missing attention signals during that failed startup. This
+intermittent calibration failure remains open alongside the slow touch and
+repeated taps observed in the earlier desktop. The owner accepted slow touch
+for the tethered milestone. Logs retain the failed startup and recovery.
+
+The final repeat used installed wheels while Python audit hooks denied reads
+from all five Orchard checkouts and the original source workspace. The host's
+NFS service continued serving the existing desktop dataset. These hooks
+exercise package independence within the Python processes; the kernel and
+NFS service have their own access to the exported root.
+
+## Host and package checks
+
+The CLI suite passes 161 tests on Python 3.9.6 and 3.14.6. Its adapter type
+checks pass for both profiles. Hardware passes 107 tests on both versions;
+Minimal Linux passes 47 tests. Fixtures cover ambiguous USB discovery and
+unrelated Apple devices, alongside identity checks during re-enumeration.
+
+The hardware wheel and source archive carry all 41 P105 resources with bytes
+matching the checkout. CLI archives include every P105 module. Package audits
+check for owner calibration, private access material and generated boot files.
+The Minimal Linux base uses signed Alpine ARMv7 packages. Public userspace
+checks ran under QEMU's Cortex-A9 model before physical qualification.
+
+The recovery kernel retains P105's namespace, FUSE and zram settings. Its USB
+fragment selects configfs ACM/ECM and disables `CONFIG_USB_CDC_COMPOSITE`.
+Source tests cover the managed configuration block and refuse output paths
+inside the owner's input tree.
+
+macOS supplied `Orchard_P105` as the product name and masked the link MAC in
+`ifconfig`. The adapter accepts the measured product spelling and obtains the
+network interface and MAC from children of the selected USB device. Existing
+host addresses remain owned by their original setup.
+
+## Remaining work
+
+The host supplies boot components and serves the root throughout the session.
+The owner manages the existing NFS export. Orchard records any address it adds
+to the selected USB link and provides a cleanup command after shutdown.
+
+Internal installation requires the later A5 storage work. Bluetooth pairing,
+audio playback and accelerated graphics still need physical tests. Public
+release assembly follows the migrated ARMv7 desktop builder. Private firmware,
+calibration and patched Apple boot components stay on the owner's host.
+
+Private receipts and device logs are retained under the owner's local P105
+qualification directory. The earlier manual component test remains recorded
+in [p105-validation.md](p105-validation.md).