Repository navigation
boot: add A5 Recovery and an on-device iOS launcher - #84
Open
shaynelegault wants to merge 16 commits into
Open
shaynelegault wants to merge 16 commits into
shaynelegault wants to merge 16 commits into
Conversation
shaynelegault
force-pushed
the
p105/05-ios-launcher
branch
from
November 6, 2026 19:26
869900e to
87b9ec1
Compare
Select ARM/v7 or ARM64 tool recipes explicitly and keep their outputs in separate caches. Pin Debian's ARMHF BusyBox package and verify each finished tool's ELF architecture and static linkage. Native builds require a host whose architecture matches the selected target. Assisted-by: LLM
Use board-owned handoff data to compile the ARM32 staging loader. Preserve Cascadia's cache/MMU handoff and require executable code at the upload address. A checked configuration places the supplied external initramfs in reserved RAM before entering Linux through its edited DTB. Bound the zImage decompressor workspace and preserve the kernel bytes. Add synthetic layout tests and a Linux fixture that exercises the actual loader C copy and rejection paths. Source provenance is recorded in NOTICE. The external-initramfs handoff still requires physical qualification. Assisted-by: LLM
Resolve one root architecture's per-platform loader and target tools through Orchard's producer contract. Preserve explicit board selection for Cascadia and stage ARM EABI5 hard-float Python dependency closures. Platform layers use the declared kernel image and validate the requested root ISA. Route RAM and recovery assembly through the declared payload format, bind Cascadia DTBs to their selected board, and keep Pongo inputs on their own boot path. Existing ARM64 default arguments remain supported. Document the producer contract and exercise cache separation and architecture refusal. Assisted-by: LLM
Carry a descriptor-selected host USB identity policy through the checked Cascadia bootargs, bind each upload to its selected hardware and a fresh attempt, and revalidate that provenance in RAM. ARM64 recovery keeps its existing ADT identity path. Stage declared USB dependencies and defer manual storage modules until the host has serial and authenticated SSH. Reject manual drivers built into the kernel or selected as USB dependencies before assembly. Validated with 666 unit tests (one Linux-only skip) and independent cross-layer review. Physical P105 qualification remains pending. Assisted-by: LLM
shaynelegault
force-pushed
the
p105/05-ios-launcher
branch
from
November 6, 2026 20:50
87b9ec1 to
6623327
Compare
Clear the profile watchdog before reading the checked handoff configuration. Rejected payloads now remain available for inspection instead of resetting while the loader waits. Cover the rejected-config path in the Linux runtime fixture. Assisted-by: LLM
shaynelegault
force-pushed
the
p105/05-ios-launcher
branch
from
November 6, 2026 23:11
f9887b2 to
2508c73
Compare
Validate the uploaded image before touching reserved high RAM. Capture its checked relocation fields, flush the inherited caches, and disable the MMU before copying the initrd through physical addresses. This removes the dependency on an inherited iBEC mapping for the destination. Clear the watchdog in assembly before stack setup. Exercise protected high RAM during validation and check word and tail copies through the complete P105 initrd size. Assisted-by: LLM
Record the exact prepared iBEC and the data needed by the Recovery autogo and iOS local-file methods. Keep current hardware feature evidence separate from the new startup candidates. Assisted-by: LLM
Prepare descriptor-pinned plaintext IMG3 inputs privately and route Recovery through the generic adapter. Upload one complete CB32 payload from an attempt-private snapshot, record uncertain outcomes before mutation, and bind readiness to the selected device and boot. Assisted-by: LLM
Prepare a private file inventory with exact model, iOS-build and asset checks. Keep the owned wake alive during one source-built handoff and cancel it on returning paths. Preserve the upstream kloader source and apply a separately pinned patch that bounds reads, searches and the sleep wait. [Orchard: from axi0mX/ios-kexec-utils a1bbca8a8f2847d9c53070e76e0b5d093bda5993; preserve winocm attribution and GPL source, add host build adaptation and bounded handoff.] Assisted-by: LLM
Carry a fresh nonce and the original public template hash through the payload, USB identity, serial bootstrap and authenticated SSH status. Require a private completed attempt receipt when resuming this host-bound recovery. Assisted-by: LLM
Keep the CB32 and identity codec in a standard-library core module so recovery-autogo works in the source-denied installer. The existing image command remains the producer entry point, and its cache inputs include the shared code. Exercise a real host identity bind from an unpacked core without site packages or image producers. Assisted-by: LLM
Mock the current upstream connection context so the serial/bootstrap test keeps exercising the handoff fields without starting a transport. Assisted-by: LLM
Send the identity-bound CB32 bundle before its exact loader prefix so the prepared iBEC enters the complete image already in RAM. Keep separate durable uncertainty phases and bind both upload hashes to the completed receipt. Require an observable irecovery completion marker and reject Recovery payload lengths whose trailing USB packet cannot be proved. Document the two-part contract and cover template, bound-bundle and trigger failure boundaries. Assisted-by: LLM
Send the checked loader code prefix after iBEC has had one monotonic second to rearm its Recovery endpoint. Revalidate the exact device before the trigger and retain each transition in the private attempt receipt. Keep the trigger below the iBEC auto-go cutoff while preserving the bound configuration in RAM. Assisted-by: LLM
shaynelegault
force-pushed
the
p105/05-ios-launcher
branch
from
November 7, 2026 00:15
2508c73 to
acb6864
Compare
Read the P105 identity through iOS before preparing each startup. Bind a fresh nonce and ios-device provenance into private payload and iBEC copies, then verify both renamed files before scheduling wake and entering kloader. Resume from the selected provision receipt and compare the complete handoff across recovery transports. Preserve schema-1 host-usb and policy-free ARM64 behavior. Reject malformed lease residue and persist attempt-file renames through their directories before wake. Native fixtures cover failed preparation and the iOS 9 ARMv7 link. Assisted-by: LLM
The loader validates its CB32 record at offset 0x7f00 before entering Linux. The short upload ended at 0x6001, leaving the record dependent on retention across the two transfers. Send the checked prefix through the record's final CRC byte at 0x7f44. This remains below the iBEC autogo threshold and ends with a short USB packet. Exercise identity binding that changes the DTB size, verify the uploaded configuration and its CRC, and reject stale or truncated prefixes. Keep receipt validation strict and document refusal of old compact-trigger receipts. The hardware startup failure remains under investigation. Assisted-by: LLM
shaynelegault
marked this pull request as ready for review
November 7, 2026 05:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The iOS helper binds on-device startup to the live P105 identity and a fresh nonce before handing control to kloader. Recovery accepts
ios-deviceprovenance through a schema-2 policy, and later host attachment verifies the selected private provision receipt against the full runtime handoff.Each permitted Start tap checks the installed inputs, creates private payload and iBEC copies, and verifies both files before scheduling its owned wake event. Renames receive directory durability barriers. The per-boot lease rejects malformed or partial state, including residue from failed writes. Returning paths cancel the owned wake. An interruption before rename can leave a pending file that the owner must inspect and clear before another tap.
The host sends the bound bundle, waits at least one second, and revalidates the exact Recovery device before its second upload. That upload now includes the complete bound CB32 configuration through offset
0x7f44. This removes the loader configuration's dependency on retention across transfers. Earlier0x6001receipts remain as evidence and are refused for resume. Schema-1host-usband policy-free ARM64 behavior remain covered. Entry into iBSS/iBEC and private firmware preparation stay external. The kloader source and provenance records are preserved.Depends on ARMv7 producers #82. The topic-only range isolates this host and launcher work. The native installed-root path also needs #92 and #94.
Validation at
51ce3cbe:P105 hardware qualification remains pending. Host
51ce3cbetransferred both the full public image2dd9027b382c0b7e2c5e1065a73d14832611e860dbcd801d7fedc551285cabb6and its 32,580-byte loader/configuration prefix, with endpoint identity checked between transfers. That image produced no visible text or Linux USB. The preserved legacy loader/kernel/recovery pair reached Linux USB and boot text through the same raw iBEC and kloader.A private diagnostic image (
f34eeab02c1d8cb98379bc5acad21cdfcfac727a7c120da5a62b4744724ff9f0) added guarded framebuffer markers to the public loader. Its kernel, DTB, initramfs and configuration matched the public image before host identity binding. The owner observed all seven checkpoints, including the final green marker after initramfs relocation, immediately before the kernel branch. Linux USB still timed out. Runtime-bound image and trigger hashes were recomputed successfully. This locates the observed progress through the loader; kernel execution and the remaining startup failure are unresolved. The diagnostic remains private, and qualification of the submitted image remains pending.The diagnostic issued zero Linux runtime or storage-helper commands, with NAND programming compiled out. After the owner returned to iOS, five bounded native reads verified the LwVM pair and CRC, the unchanged Linux header, and 40 GiB Data geometry. Temporary entry files were already absent and the connection closed.
The newly built on-device helper still needs its unplugged start. Earlier desktop evidence belongs to the preserved development build. P105 is the owner's test board, with other-board coverage left to Henrik or those board owners. Public installation remains gated.
Proposed changelog text awaits owner approval: P105: prepare an on-device iOS launcher that binds startup to the live device identity and a fresh handoff.