Repository navigation
S9 everyday iOS 27 build (phone 1): Metal line + Wi-Fi + Sileo + modem branches merged; 64-wifi-nettest (integration, draft) - #302
Draft
claudiusthebot wants to merge 18 commits into
Draft
claudiusthebot wants to merge 18 commits into
claudiusthebot wants to merge 18 commits into
Conversation
…tor (turned textures) CoreAnimation's Metal renderer draws a display that is to show the interface turned by a quarter into a texture over the display's own surface whose descriptor has the turned size (1792 x 828 over 828 x 1792) and a rotation, a private property of Metal's descriptor. The plug-in ignored the rotation and refused the row pitch, so nothing was drawn until the interface was upright again. frontend-turned.diff: a texture asked for with a rotation is the asked shape in device memory, and every command buffer that drew into it ends with one pass that writes it, turned, into the surface's own texture (TurnShaders.metal, compiled by the bundle's script). Upright, nothing changes. docs/ios27/METAL-ROTATION.md: what is asked, what is done, what was seen on a phone.
… by default)
drivers/modem/hakios.shannon.c, new: the Samsung "Shannon" CP inside the Exynos 9810, as far as a
link in low power mode. Staged by cp=N:
1 a look: the CP's PMU words, its two secure control words (read through the secure monitor's
call), the mailbox, RADIO's table of contents
2 the phone's own modem image copied from the RADIO partition, read only and unchanged, into the
CP's memory at 0xF0000000, each part compared with the table's CRC, then checked by the secure
world's own call, as Android's boot path does. If that call refuses, the driver stops
3 the CP started: AP2CP_CFG, the boot loader's handshake (0x900D/0xA00D, 0x9F00/0xAF00) after the
AP's "boot confirm", INIT_START, the table of rings, PIF_INIT_DONE, PHONE_START
4 the link, only with the phone's own NV data (cp_nv=1: a file the image's builder supplies; this
driver never reads or writes EFS): "low power mode" is the first thing the CP is told, its
messages are logged (headers and lengths; the phone state, SIM status and registration state
decoded), the software version and band selection are asked. Its file requests are not answered
5 with a ready SIM: "normal" asked, the registration watched for two minutes, low power again.
Written, not run to the end: the test SIM read as locked, and the driver stopped there
The CP is put back in reset at the end of every run and before the phone is handed back.
Seen on a Galaxy S9 (SM-G960F) under the ios-27 tree: stages 1 to 4 (the secure world's check
answers 0; "CP is up" with zeros and with real NV; with real NV low power confirmed within a second
of the link, twice; SIM status read with and without a card; modem software G960FXXUFFUE1). With
zeros for NV the running CP went to its normal state by itself, so stage 4 is refused without real
NV. Not run on the 16.5 line, where it builds but refuses to work: that line's UEFI loads XNU into
the CP's memory, which the driver checks for.
Also: drivers/modem/conf (driver SHANNON, default n), drivers/map, the stub and the init call,
profiles/ios-27.copy, the boot-arguments' lists and the generated documents.
Facts (registers, layouts, message numbers) from Samsung's GPL kernel, the phone's device tree and
public descriptions of the protocol, read as data; no code of theirs, no firmware, no phone's data.
…ge has jb_seed copied /jb to /private/var/jb with each file's owner as the image had it. That is right for an image made as root. An image made or edited without root (a mount without owners on the builder's machine, which is how a root that is already on a phone gets one more step) carries the builder's user ID on its files, or 99, which the kernel shows to every process as that process's own. The copy would then be a prefix whose programs any app could rewrite, with a giveMeRoot whose set-user-ID bit names nobody. Everything in the Procursus bootstrap and in Sileo's package is root:wheel except var/mobile, which for_mobile() sets after the copy. So the copy is now made root:wheel outright; on an image built as root nothing changes. claim(), new: the few files an iOS 27 root carries for the prefix outside it (this program, var_sync, the five links in /bin, a test root's self-test script) and the image's /jb are made root's if they are not, before anything else. A fixed list; a name in /bin only if it is a link into the prefix. On a root built as root it touches nothing.
…root (60-sileo, on by default) The iOS 27 root had no package manager: tools/ios27/fullroot had no step for it, so a full root had no /var/jb, no Sileo and nothing in /bin but df and ps. The 16.5 line has had it by default (tools/mk-jb.sh, jb_seed). steps.d/60-sileo.sh ROOT [undo] puts the prefix on the root the way 16.5 does on a kept volume: the Procursus bootstrap with Sileo in it as /jb, copied to /private/var/jb by jb_seed at the first boot and left alone afterwards; var_sync flushing the volume every 5 s (the phone is reset, never shut down); the five names in /bin Sileo runs; two launchd jobs, as entries of /System/Library/xpc/launchd.plist, which is where iOS's launchd reads its jobs from (tools/ios27/sileo/jobs.py). Both programs are the 16.5 line's sources built for iOS (build-tools.sh). The prefix is the plain one (prepare.sh: PREINSTALL= ELLEKIT= tools/mk-jb.sh, both downloads pinned by SHA-256) and the step stops the build if it is anything else: no OpenSSH, no tweak injection, Procursus as the only repository (the project's own when SCION_REPO_URL says where it is hosted), no file writable by everybody, every Mach-O plain arm64, the set-ID programs exactly the bootstrap's seven and Sileo's helper. Two things of the bootstrap as shipped are changed on the way: mobile's password hash becomes "!" (no account has a password), and usr/sbin/shshd with its job, which mk-jb.sh takes out of dpkg's database but leaves on the disk, is deleted. mk-jb.sh itself is not touched: its checksum is the stamp of every 16.5 phone's prefix, and a change there would seed them all again. undo takes the step off again; launchd.plist comes back identical (checked on a clone of a full root image, with a second run, check-root.sh's new checks and fsck_hfs). prepare-root-inputs.sh calls prepare.sh; ENABLE_SILEO=0 builds a root without it. selftest.sh (SILEO_SELFTEST=1, a test root only): the port has no shell, so a third job says into a file at every boot what the prefix is: owners, modes, dpkg's database, Sileo registered, a kept file with a line per boot, and with a repository on the phone an install, run, remove and install again through apt-get. docs/ios27/SILEO.md: the step, keeping, apps, and what "secure user data" is and is not on this port today (no encryption at rest, no passcode, no sandbox: Unix owners and modes are what holds), with credits to Procursus, the Sileo Team and Anan Jaser's kept-volume work on 16.5. Not yet run on a phone.
…p=7; off by default) Two more stages for the Shannon CP's driver, each behind its own value of the cp= boot argument and only with the phone's own NV data, a ready SIM and a registered network (stages 4 and 5 unchanged): cp=6 with cp_apn=NAME (the operator's published default access point name; none is built in): the data context is defined and activated with Samsung IPC's packet group (0x0D numbers 1 and 4, "set"), in the layouts of the public numbering for older Samsung modems. Seen on an SM-G960F (modem software G960FXXUHFVB4): both accepted (general response 0x8000), then the CP's address configuration (0x0D/0x09) and call status (0x0D/0x10) notifications. The context is deactivated before low power mode and the reset. cp=7: one ICMP echo request and one DNS question, made and checked in the driver, through the context. The data rings as this phone uses them: no frame header, the channel in the upper half of the slot's size word; up through the "data" ring, down through the zero-copy slots whose buffers lie in the 11 MB region behind the IPC memory (the AP offers a 64-bit data offset per slot and moves the ring's read counter, the CP fills and moves the write counter) or the "high priority" ring. Seen: both answered, nothing malformed. No network interface is made and nothing of the system's is carried. What comes from the CP is checked before use: ring counters against the ring's length and against the slots offered, the slot's offset against the one given (never used as read), lengths against the buffer and the packet limit, IPv4 header and ICMP/UDP checksums, addresses and identifiers; packets are copied out before they are looked at. The context's addresses stay in memory for the run and are not logged beyond one octet. New arguments: cp_apn=, cp_ping=. docs/boot-args.md, configs/boot-args.lst, configs/symbols.tsv and docs/reference/drivers.md regenerated.
…table to choose from A data connection needs the operator's access point name, and the modem does not know it. Android's list of every network's (device/sample etc/apns-full-conf.xml, Apache-2.0) is fetched at a pinned commit with its SHA-256 checked and its "default" entries made into a compact table with every length checkable by a reader; "select" applies Android's rules to it (the SIM's own mcc and mnc; a brand's entry by service provider name, group identifier, subscriber-number pattern or card-number prefix before the network's own) and, one step stricter, chooses nothing when the candidates differ. Neither the list nor the table is committed; NOTICE and THIRD_PARTY_LICENSES.md get its row. The modem driver still takes the name from cp_apn=: reading the SIM's values and choosing at run time is the next step (the tool's text says what a chooser may and may not log).
…rom /Applications What phone 1 showed on its first boots with REV 1 (13 Nov 2026): - Procursus' apt runs its download methods as _apt (uid 1001), a uid iOS's own /etc/passwd does not have. The system cfprefsd crashes (CFEqual on NULL) on the first preferences request of a client it cannot name; the method retries, launchd restarts cfprefsd every ten seconds, and every root process that reads a preference waits for ever: apt-get update hung at its first file, uicache with it, then SpringBoard's pasteboard call and the interface. The prefix now gets etc/apt/apt.conf.d/00scion-sandbox (APT::Sandbox::User "root"). No crash since. - uicache -p answers "Unable to register" for every path (also /Applications/*.app) and uicache -l lists nothing, while lsd's own rebuild at boot registers /Applications. The step puts a real copy of Sileo.app there (marked .scion-prefix-app), drops the LaunchServices databases so lsd rebuilds them, and prep.sh makes such copies root's (giveMeRoot 4755) at every boot. Undo takes the copy off again. REV 1 -> 2: phones seeded with REV 1 seed again (the old copy is moved aside). selftest.sh: no awk in the plain bootstrap (grep/cut), Sileo checked by its /Applications copy and giveMeRoot's owner. docs/ios27/SILEO.md and the README's status table say what ran on the phone and what did not. Checked on a clone of phone 1's root on the Mac: apply, a second run without change, undo (jobs and copy gone).
…e (off by default) A probe of whether this modem takes the SIM file read in the public numbering's layout for older Samsung modems (group 0x05 number 5 "get": 0xB0, file 0x6FAD, offset 0, 4 bytes; EF_AD holds no identity). Asked once, 2 s after the SIM says all its files are ready (0x83). Seen twice on an SM-G960F (modem software G960FXXUHFVB4): refused with a general response 0x8001, so the layout is not this firmware's. Nothing else changes; cp_sim unset = as before.
# Conflicts: # docs/boot-args.md # profiles/ios-27.copy
…y boot (address, routes, apt-get update over https) A job in launchd's cache (com.scion.nettest) for TEST roots only: once a boot, after the package manager's prefix is there, it waits for an IPv4 address (any interface, or the one named in /private/var/scion-test/nettest-if), logs the interfaces and routes, tries an HTTP GET with bash's /dev/tcp and runs apt-get update (the prefix's sources, https) into /private/var/log/scion-nettest.log. Nothing listens. 'undo' removes the job and the script. Seen on a Galaxy S9 (phone 1, 13 Nov 2026, everyday Metal kernel + Wi-Fi stage 2, brcmfmac=8): en0 192.168.0.x by DHCP, default route on en0, apt-get update fetched apt.procurs.us InRelease + Packages (342 kB). The bash /dev/tcp GET was killed (SIGKILL) at once under launchd: not understood yet; apt-get is the userland proof.
…P's NV file requests answered from it, and the data context as pdp_ip0 (cp_if=1); all off by default
- drivers/modem/hakios.ext4ro.h (new, MIT-0): a read-only reader of one file on ext2/3/4, written from the
on-disk format (superblock, 32/64-byte group descriptors, extent trees of any depth, the block map,
linear directory lookup). No write path, no journal replay. tools/modem/ext4ro-test.c runs the same code
on the host against an image and prints only the size and a hash prefix.
- cp_nv=2: /nv_data.bin read at boot from the EFS partition through hakios_ufs_read_partition("EFS"), which
only reads (the fork's commit for it). EFS is never mounted and never written; the copy stays in kernel
memory; only its size and four hex digits of its CRC-32 are logged. This replaces boot images that carried
the NV data.
- With cp_nv=2 the CP's RFS NV requests are answered from the RAM copy (Samsung IPC RFS: header length,
command, id; answer confirm, offset, length, data for reads). NV writes are put together from their
continuation frames and kept in RAM for the run only, never written back. File opens (command 0x11,
e.g. CP_OMC_AUDIO_SLSI.bin) are still not answered.
- cp_if=1 (with cp=6/7 and cp_apn): the active context becomes pdp_ip0, an IPv4 point-to-point interface
with the context's address; the context, normal mode and the CP stay up until kern.hakios.cp.go=2.
cp_route=1 adds an IPv4 default route through it when there is none. cp_if_kb=N (2048 by default) caps
the bytes through it in a boot. Packets go up through the data ring from the modem's own thread.
Seen on a Galaxy S9 (SM-G960F, GoMo SIM on eir 272-03), 13 Nov 2026, everyday iOS 27 Metal kernel:
- ext4ro-test on the phone's EFS backup image: the file byte-identical (sha256) to a ro,noload mount's copy.
- cp=7 cp_nv=2: NV read from EFS in 33 ms, image accepted, SIM ready, registered HOME, 4 NV writes of the CP
answered and kept in RAM, one echo (55 ms) and one DNS query (24 ms, rcode 0) through the context.
- cp=7 cp_nv=2 cp_if=1 cp_route=1, no Wi-Fi: pdp_ip0 up with its address and a default route; user space
fetched http://1.1.1.1/ over it (HTTP/1.1 301 from Cloudflare). No DNS for it yet (configd has no
service for pdp_ip0): docs/ios27/MODEM-IOS.md has the plan.
…llular DNS on top of the S9's modem; 64-wifi-nettest: hosts list, no timeout(1) MODEM-IOS.md: the kernel side as it stands (cp_nv=2, RFS answers, pdp_ip0), why CommCenter sees no baseband (it expects Apple's own over IOKit; Samsung IPC is not that), and three ways up by size: a root daemon publishing pdp_ip0 as a configd service (DNS, routes), an injected SpringBoard library for bars and the carrier name, and a CommCenter-compatible baseband shim (large; owner's decision). 64-wifi-nettest.sh: hosts from /private/var/scion-test/nettest-hosts (an address works without DNS), the GET by bash's read -t instead of timeout(1), which was killed at once under launchd.
…-sync from prep.sh and a diverted uicache)
On this port LaunchServices refuses uicache's registration of every bundle ("Unable to register"), while
lsd's own rebuild registers what is in /Applications (13 Nov 2026, phone 1: that is how Sileo got its icon).
tools/ios27/sileo/scion-apps-sync.sh, installed as /var/jb/usr/libexec/scion-apps-sync, gives every
/var/jb/Applications/X.app a real copy in /Applications (marked .scion-prefix-app, root's, nothing writable
by others, giveMeRoot set-user-ID), makes it again when it differs from the prefix's, removes marked copies
whose package is gone, and when anything changed drops the LaunchServices databases and restarts lsd. iOS's
own applications (no mark) are never touched. prep.sh (every boot, root) runs it and, once, diverts uicache
(dpkg-divert, so a uikittools upgrade keeps it) to a wrapper that runs it first, so an app installed from
Sileo or apt is synced by its package's own uicache trigger. tools/ios27/sileo/prep-apps.py adds both to a
prefix; 60-sileo.sh calls it on the image's /jb.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integration branch for phone 1's everyday iOS 27 build. Draft. Do not merge as is.
What it contains:
test-sensors: the s9-metal-perf agent's local line. That iss9/metal-perfwith the Metal rotation workb6d6a59, pluss9/sensors-ios27andwip/ios27-liquid-glass.main,s9/sileo-ios27(iOS 27: Sileo and the rootless prefix as a full-root step (60-sileo), REV 2 after phone runs #300) ands9/modem-data(Galaxy S9 modem (Shannon CP) from XNU: stages 1-7, SIM, registration, data probe (cp=N, off by default) #301). The conflicts were inprofiles/ios-27.copy, where both sides were kept, and indocs/boot-args.md, which was regenerated withtools/boot-args.py --check, green.tools/ios27/wifi/64-wifi-nettest.sh, a network check for test roots only. It is a launchd job that waits for an address, logs routes and runsapt-get updateover https.Paired with the fork's
s9/p1-everyday-ios27(Scion-Project/xnu draft PR).Seen on phone 1 (13 Nov 2026):
apt-get updatefetched apt.procurs.us InRelease and Packages (342 kB).🤖 Generated with Claude Code