Repository navigation
install: allocate and populate checked LwVM Linux roots - #94
Open
shaynelegault wants to merge 34 commits into
Open
shaynelegault wants to merge 34 commits into
shaynelegault wants to merge 34 commits into
Conversation
Select ARM/v7 or ARM64 tool recipes explicitly and keep their outputs in separate caches. Pin Debian's ARMHF BusyBox package and verify each finished tool's ELF architecture and static linkage. Native builds require a host whose architecture matches the selected target. Assisted-by: LLM
Use board-owned handoff data to compile the ARM32 staging loader. Preserve Cascadia's cache/MMU handoff and require executable code at the upload address. A checked configuration places the supplied external initramfs in reserved RAM before entering Linux through its edited DTB. Bound the zImage decompressor workspace and preserve the kernel bytes. Add synthetic layout tests and a Linux fixture that exercises the actual loader C copy and rejection paths. Source provenance is recorded in NOTICE. The external-initramfs handoff still requires physical qualification. Assisted-by: LLM
Resolve one root architecture's per-platform loader and target tools through Orchard's producer contract. Preserve explicit board selection for Cascadia and stage ARM EABI5 hard-float Python dependency closures. Platform layers use the declared kernel image and validate the requested root ISA. Route RAM and recovery assembly through the declared payload format, bind Cascadia DTBs to their selected board, and keep Pongo inputs on their own boot path. Existing ARM64 default arguments remain supported. Document the producer contract and exercise cache separation and architecture refusal. Assisted-by: LLM
Carry a descriptor-selected host USB identity policy through the checked Cascadia bootargs, bind each upload to its selected hardware and a fresh attempt, and revalidate that provenance in RAM. ARM64 recovery keeps its existing ADT identity path. Stage declared USB dependencies and defer manual storage modules until the host has serial and authenticated SSH. Reject manual drivers built into the kernel or selected as USB dependencies before assembly. Validated with 666 unit tests (one Linux-only skip) and independent cross-layer review. Physical P105 qualification remains pending. Assisted-by: LLM
ARMv7 and ARM64 use different kernel bases while driver patches belong in shared subsystem directories. An adjacent patch scope lets those directories carry both platforms without applying a patch to the wrong base. Add schema-1 .patch.toml scopes and scoped-only series layers. Export writes scopes and missing layers with --platform, preserving existing patch numbers. Builds, conversion and regeneration use the same selector, and published source keys include selected scope metadata. Refuse malformed scopes and duplicate selection before build or export work starts. Existing patch bytes, ordered platform selections and published source keys are unchanged. Cover scope validation, export planning and deterministic kernel/m1n1 regeneration with host tests. Assisted-by: LLM
Record the measured geometry, native address views and the proposed kernel read path. Keep the chip evidence and device capability comments consistent with the pending exact-revision qualification. All 34 catalog tests pass; regenerating the matrix keeps capability rows. Assisted-by: LLM
Export the current ARMv7 H2FMI read source through kernel-tree/export.py. Keep the existing import intact and scope the new MTD layer to apple-armv7. The generated mail patch reproduces source fe8c2f696 exactly. The owner approved draft exports before physical qualification. The new source has focused ARMv7 and sanitizer results; exact-build device checks remain pending. Public logical storage capability stays gated. Assisted-by: LLM
Document the default-off H2FMI program primitive and its host checks. Keep logical storage_write missing while exact-build programming and translation-layer persistence remain unqualified. Record chip evidence and the shared reference-profile regression requirement. All 34 catalog tests pass. Matrix regeneration leaves capability rows unchanged; the P105 device and A5 chip schemas validate. Assisted-by: LLM
Export source cef7165b0 after the geometry/read dependency, preserving the scoped MTD series. Require complete pages, blank destinations and exact synchronous readback. The controller supplies no erase operation. The generated patch reproduces the source commit exactly. Programming stays disabled in the recovery candidate, and exact-revision physical qualification remains pending under the approved draft export order. Assisted-by: LLM
Document native VFL/SwissPPNFTL recovery, saved-capture crosschecks, KUnit results and the latest finite provider lifetime. Keep both logical storage capabilities missing until exact-revision device qualification. Record the host and ARM64 test limits separately from hardware evidence. All 34 catalog tests pass. Matrix regeneration leaves capability rows unchanged; the P105 device and A5 chip schemas validate. Assisted-by: LLM
Export the canonical PPN provider, native map reader and finite lifetime policy from current ARMv7 source. Preserve the preceding geometry and programming topics in series order, with every MTD patch scoped to ARMv7. The official export reproduces e7d118292 after its read prerequisite. Saved-capture crosschecks, real KUnit and ARMv7 object builds pass. The owner approved draft export before exact device qualification, which remains pending. Logical storage writes stay gated. Assisted-by: LLM
Resolve the Apple ARMv7 config from kernel source commit 0921ec24248913d2a99ad1a262b2ab1e66f062e3 through kernel-tree/export.py. CONFIG_MTD_APPLE_SFTL=m lets recovery load the read-only frontend after its USB recovery link is ready. Keep CONFIG_MTD_APPLE_H2FMI_WRITE=n so this config exposes no raw page-program path. LLVM 19 olddefconfig and savedefconfig passed. The 23 focused kernel, platform and export tests passed. Physical qualification remains pending. Assisted-by: LLM
Read matching CRC-checked LwVM headers from the current logical storage provider and derive ordered Linux-only extents. Create or verify an exact DM-linear mapping without a userspace NAND worker or Python runtime. Exercise the real C parser with synthetic fragmented media and provide a disposable Linux loop-device integration check. Assisted-by: LLM
Stage the checked static mapper and owner recovery tools for LwVM platforms. Find root=PARTUUID in the current logical provider, retain USB serial and key-provisioned SSH before mounting, and hand the mounted root to its own init. Add optional tools.lwvm and root_format input records with --platform-lwvm overrides so distribution builds pass finished helpers to platform and recovery producers. The GPT path retains its existing component contract. Keep P105 installation gated on hardware qualification and an explicitly reviewed SFTL operating policy. Assisted-by: LLM
Keep the existing GPT product naming and USB setup timing while LwVM roots retain early rescue. Check every target mount directory before moving any RAM mounts, leaving recovery intact when a directory is unavailable. Assisted-by: LLM
Restrict the first logical-root backend to the declared P105 profile. J1 retains its existing root discovery path, and a platform-layer build covering different installed-root backends requires an explicit device before producing components. Assisted-by: LLM
Reject geometry whose first chunk cannot hold two separate 4096-byte headers. Cover the aliased 3MiB/4MiB cases and the first accepted 8KiB chunk geometry using the real C parser. Assisted-by: LLM
Include apple-sftl and its dependency closure only for the declared P105 installed-root profile. Keep J1 on its existing built-in storage path. Validate explicit read lifetime and write opt-in parameters before passing separate arguments to BusyBox modprobe. A writable root option leaves the default-off backend gate unchanged, and enabling it requires both finite limits. Exercise actual initrd module archives, the catalog boundary, and the ARMv7 BusyBox policy wrapper with a fixture module loader. The resolved kernel config dependency remains separately gated on export and physical qualification. Assisted-by: LLM
Accept the checked receipt identity and ordered extent table for unmap. Stat the original provider and verify the complete DM table, mode and UUID before removing an unused mapping, leaving mismatches and busy mappings intact. Cleanup avoids provider opens and header reads so recovery can refence storage after its read budget expires. Exercise invalid-header, busy-holder, table-mismatch and idempotent cleanup in the real Linux loop fixture. Assisted-by: LLM
Carry the resolved defconfig from Linux source commit 66d9d3ae49f15d12a58bdceca36d8974086fb671 through the official platform-scoped exporter. Select Apple SFTL as a module and device mapper built in for installed-root assembly. The exporter wrote zero patches and one config, verified against the source branch from base e7d118292d828b9796d85d19872653f7d4a8cb67. Hardware qualification remains pending. Assisted-by: LLM
Check for a value before consuming any option in the map, inspect and unmap parsers. Reject repeated mode arguments and exercise missing values without allowing a null argv access. Assisted-by: LLM
Source the normal install add-on after storage loading and let it own its RAM mounts and USB access. Keep early LwVM rescue and its RAM handoff on ordinary starts. Exercise both paths with bounded shell fixtures. Assisted-by: LLM
The install hook unmounts its RAM state and devpts before returning. Recreate them before root discovery and pass /run to installed init. Model the real cleanup and nested mount moves in the shell fixture, and fail the fixture when switch_root lacks either mount. Assisted-by: LLM
shaynelegault
force-pushed
the
p105/10-lwvm-installer
branch
from
November 6, 2026 21:46
d05a7eb to
387e9a9
Compare
Carry each input record's board selection, loader, native tools and LwVM mapper into the platform producer. Falling back to shared tools discarded explicit overrides and could build a layer with different inputs from those checked by the distribution. Validate the complete selection before creating output. Keep one coherent loader and install-tools archive across the selected ARM64 platforms and retain compatibility with older shared records. Cascadia continues to use the direct ARMv7 platform producer until its release contract is added. Ten index cases and six distribution-contract cases pass. The integration fixture checks actual layer/initrd/archive contents from selected inputs, and the companion Minimal Linux manifest passes schema and local-receipt validation. Device qualification remains separate. Assisted-by: LLM
Preserve System and Data identities while assigning a checked native HFS tail to a Linux descriptor. Bind saved plans to the live header pair and recovery identity, stop on uncertain metadata outcomes, and confine root formatting and streamed files to a verified mapper receipt. Keep public installation gated pending writable backend and hardware qualification. Assisted-by: LLM
Check the fresh provider read-only flag before clearing a fence so an unsupported replay state cannot reach the first metadata write. Verify host handoff and the isolated recovery script bundle, and execute planned fragmented headers through the source-built mapper. Assisted-by: LLM
Require enough room in the metadata chunk for both 4 KiB headers. Derive and validate the backup offset before reading either copy so malformed small media cannot alias a metadata commit at byte zero. Assisted-by: LLM
Linux encodes sizeof(size_t) in BLKGETSIZE64 while always returning an eight-byte size. Derive the request from the native pointer width so ARMv7 uses its 32-bit ioctl number, and verify both supported request encodings through the actual provider constructor. Assisted-by: LLM
Use the static mapper cleanup API with the validated provider, root UUID, access mode and complete extent receipt instead of assuming dmsetup exists in recovery. Record cleanup failures while continuing to attempt the raw read-only fence, and leave held mappings and write policy for inspection when cleanup stops. Assisted-by: LLM
Put the final raw read-only fence in an outer finally block and preserve the earlier cancellation or unexpected cleanup error for re-raising afterward. Exercise cancellation during both unmount and verified mapper removal without dropping the fence attempt. Assisted-by: LLM
Keep the optional partition field narrowed before reading its identity or type. A malformed replacement target now stops before the typed erase prompt, and the installer passes the project type checks. Assisted-by: LLM
Keep checked LwVM installation on supported recovery releases and reject unsupported block-image selections before boot. Detect live LwVM media before the direct GPT path reads or writes its table. Stage the matching support bundle before the supported direct installer finishes inside the new root. Assisted-by: LLM
Consume the recovery manual-storage marker once before inspect or install waits. Bound activation, retain failures for inspection and give a failed marker precedence over stale readiness. Exercise both command paths and failed activation without retry. Assisted-by: LLM
Record the module transition after unload, before load or sysfs verification can fail. Let the quiet cleanup path attempt unload and default reload after a raw-fence failure. Cover missing or unreadable policy state, a disabled value, cancellation and load timeout before any root or header write. Assisted-by: LLM
shaynelegault
force-pushed
the
p105/10-lwvm-installer
branch
from
November 7, 2026 00:26
387e9a9 to
1e4ed7e
Compare
This was referenced Nov 7, 2026
shaynelegault
marked this pull request as ready for review
November 7, 2026 05:08
This was referenced Nov 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LwVM installation can now assign a Linux descriptor to the tail of a Data filesystem that the owner has already shrunk and checked through native iOS. The saved proof binds native HFS geometry and volume identity to the device and LwVM snapshot. It trusts the owner's native filesystem-check result and later size confirmation; recovery checks the live header pair and its pinned identity before any storage change. Data remains encrypted in the kernel's whole-provider view.
The planner preserves System and Data identities and their flags, rounds retained Data up to a complete chunk, and follows fragmented mappings. An existing Linux partition requires an explicit replacement choice and typed erase confirmation. Metadata writes proceed backup first, with a durable private intent, flush and full readback at each step. An uncertain result stops for inspection and prevents an automatic retry.
Root formatting and the streamed tar extractor receive only the verified Linux DM mapping. The recovered kernel provider must advertise write capability before the installer clears its fence. A modular provider receives an explicit read budget and lifetime for this installation, then returns to its default read-only policy during cleanup. The installed root produces an iOS launcher handoff receipt; native iOS still prepares System boot assets.
This depends on installed-root mapping #92, bounded logical reads #89 and the separately reviewed append writer #91. The native iOS boot path #84 supplies the launcher entry. P105's public install capability stays gated while public live identity, the writable backend and device qualification remain open. This candidate has no hardware boot or write result. The distribution companions forward
tools.lwvmas the additive recovery producer argument--lwvm FILE.Validation:
1e4ed7e4rebases the ten installer commits onto exact mapping dependencyb2b860f4. All ten commits replayed unchanged. The branch now retains the selected-platform index fix and its regression cases.1e4ed7e4. Hardware qualification remains pending.The topic-only comparison isolates the installer commits from the dependency stack. Proposed changelog text awaits owner approval.