Repository navigation
Hackios xnu integration - #13
Closed
zaidanfaiz wants to merge 101 commits into
Closed
zaidanfaiz wants to merge 101 commits into
zaidanfaiz wants to merge 101 commits into
Conversation
Patch 0082 adds three boot-arg-gated drivers for QEMU's virt machine: sweet_virtio_blk.c exposes the host's raw HFS+ image as vblk0/rvblk0 and hands it to IOKitBSDInit for rd=vblk0; sweet_virtio_input.c maps the virtio tablet and keyboard to SweetHID; sweet_ramfb.c configures QEMU's ramfb over fw_cfg so the existing 0x9c000000 panel appears in a window. qemu-sweet.py grows --disk, --input, --display, --extra-cmdline, --wait and --accel, and docs/QEMU_VM.md describes the external-image flow.
The 64 event buffers started at 0x1000. XNU uses a 16 KiB page for a guest with more than 1 GiB RAM, so that was still inside the page there, but it was outside a 4 KiB page. Put them at 0x0c00, after the used ring, so the same layout works with either page size.
One hackios-xnu-kernel checkout (github-clone/, oosexgang, main+metal); the kernel and userland repos are distinct. Documents what is relevant to 20H392 and why the redwood.patch is not a drop-in. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
setup.sh detects distro/toolchain and installs hfsprogs/apfs-fuse/build tools; build-kernel.sh validates the patch series and single-TU compile checks; patch-image.sh builds the new 20H392 image; verify-image.sh runs fsck/hash checks. QEMU is not run in WSL. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
boot-hackios.ps1 builds the QEMU payload and boots the image with disk-snapshot; collect-boot-logs.ps1 summarizes manifest/msgbuf/panic evidence. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Linux workflow: provenance/license check, shell and python syntax, validate-repo, shellcheck, reproducible patch/tool artifact. gitignore excludes images, logs, caches and secrets. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
workflow_dispatch is default-branch-only; push/pull_request events work on any branch that carries the workflow. Run the validation workflow on hackios-xnu-integration without merging to main.
Selective port of oosexgang/hackios-xnu-kernel's in-memory ramfs (xnu/patches/0090). Registered through vfs_fsadd but gated behind boot-arg sweet_ramfs=1, so the default HFS+ /private/var data volume is not shadowed by a fresh empty ramfs at init.
The options RAMFS / optional ramfs selection was not honoured by the CI config, so the 0090 kernel had no ramfs symbols. Compile the ramfs sources as standard files (like the other SWEET drivers) and gate registration only on the sweet_ramfs=1 boot-arg.
printf is not declared in the kernel scope used here; kprintf is the correct kernel printf.
--display now defaults to gtk so boot tests open a visible QEMU window with the ramfb framebuffer; add --headless for unattended -nographic runs. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Preserve prior uncommitted work as part of the ios-emulator migration: DISPLAY_INPUT_AUDIT.md, HACKIOS_20H392_PORT.md, QEMU_VM.md, NOTES.md handoff, and the QMP/display regression test scripts. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Gytis283123
added a commit
to Gytis283123/ios-merlin
that referenced
this pull request
Nov 1, 2026
…=0 across ~127k/527k reads => MSDC read path block-clean, scribbler confirmed (deterministic elem 0xfffffe29a02be000 off=2112 across boots); forensics tail hook WORKS; next = 0085 MSDC init hardening
earror00
added a commit
to earror00/ios-sweet
that referenced
this pull request
Nov 5, 2026
…SWEET.h Boot dipa-studio#13 died with 'Undefined kernel instruction instr=d500419f' (= msr PAN, dipa-studio#1, capstone-confirmed) at arm_init.c:521 between EARLY 6 and EARLY 7. The Kryo 260 Silver cluster exposes TGran16 but no PAN (v8.1) and no LSE. All PAN sites (arm_init x3, copyio, pmap, pcb, proc_reg PSR64_KERNEL_DEFAULT) are already guarded by __ARM_PAN_AVAILABLE__, so 0 compiles them out cleanly.
tarodib
added a commit
to tarodib/ios-mido
that referenced
this pull request
Nov 6, 2026
Build dipa-studio#13 (4 KB pages) gets past the commpage. The heartbeat keeps firing but reports the bootstrap thread stuck after PE_lockdown_iokit. Add marks after PE_lockdown_iokit and before bsd_init. From the third tick on, print the bootstrap thread's state, wait event and a frame-pointer backtrace from its saved kernel context. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.