UniXNU-sheng/board.toml

"schema_version" = 2

["board"]
"name" = "sheng"
"soc" = "SM8550"
"description" = "Xiaomi Pad 6S Pro"
"kit" = "sheng"
"soc_source" = "sm8550"
"os_profile" = "ipados-27.0.1-24A446"


["userdata"]
"first_lba" = 3094592
"last_lba" = 64007162
"lba_bytes" = 4096


["kernel"]
"defconfig" = "sheng_ipados27_defconfig"
"archives" = ["build-corecrypto-14.py", "build-corecrypto-14.py --namespace", "component:ArmDTPlatform", "component:ArmCpu", "build-libpthread-kernel.py", "component:ShengUfs", "build-sheng-source-storage.py --policy-dir scripts/policies/ipados-27.0.1-24A446", "component:RamBlock", "component:Adreno740", "fetch-sheng-dts.py", "fetch-adreno-inputs.py", "prepare-sheng-gmu.py", "prepare-sheng-gpu-smmu.py", "prepare-sheng-gmu-votes.py", "build-adreno740-kits.py", "build-adreno740-accelerator.py", "component:AppleKeyStoreState", "build-gop-legacy-display-27.py", "build-fileset-release-reference.py --tree . --lto"]
"config_fragments" = ["arch:configs/common.config", "os:configs/ipados.config"]
"patch_series" = ["arch:patches/xnu/series", "soc:patches/xnu-12377/series", "os:patches/xnu/series", "device:patches/xnu-12377/series"]


["kernel"."prelink"]
# The profile's roots plus the USB device and host stacks. Host mode reaches AppleOnboardSerial and AppleSMC only through a metaclass in an
# OSDynamicCast, and they bring Skywalk, RTBuddy and more: left out, that cast finds nothing.
"roots" = ["com.apple.AppleFSCompression.AppleFSCompressionTypeZlib", "com.apple.driver.AppleARMPlatform", "com.apple.driver.AppleARMWatchdogTimer", "com.apple.driver.AppleAudioClockLibs", "com.apple.driver.AppleEffaceableStorage", "com.apple.driver.AppleIISController", "com.apple.driver.AppleM2ScalerCSCDriver", "com.apple.driver.AppleMobileFileIntegrity", "com.apple.driver.ApplePMGR", "com.apple.driver.IODARTFamily", "com.apple.filesystems.apfs", "com.apple.iokit.CoreAnalyticsFamily", "com.apple.iokit.IOAVFamily", "com.apple.iokit.IOAudio2Family", "com.apple.iokit.IOCECFamily", "com.apple.iokit.IOCryptoAcceleratorFamily", "com.apple.iokit.IOGPUFamily", "com.apple.iokit.IOHDCPFamily", "com.apple.iokit.IOMobileGraphicsFamily", "com.apple.iokit.IOReportFamily", "com.apple.iokit.IOSlowAdaptiveClockingFamily", "com.apple.iokit.IOStorageFamily", "com.apple.iokit.IOSurface", "com.apple.kec.Libm", "com.apple.kec.corecrypto", "com.apple.kext.AppleMatch", "com.apple.kext.CoreTrust", "com.apple.security.AppleImage4", "com.apple.security.sandbox", "com.apple.iokit.IOHIDFamily", "com.apple.iokit.IOHIDEventDriver", "com.apple.iokit.IOUSBDeviceFamily", "com.apple.driver.AppleUSBXDCI", "com.apple.driver.AppleUSBDeviceMux", "com.apple.iokit.IOUSBHostFamily", "com.apple.driver.usb.AppleUSBXHCI", "com.apple.driver.usb.AppleUSBHub", "com.apple.driver.usb.AppleUSBHostCompositeDevice", "com.apple.driver.usb.IOUSBHostHIDDevice", "com.apple.iokit.IOUSBMassStorageDriver", "com.apple.iokit.IOSCSIArchitectureModelFamily", "com.apple.iokit.IOSCSIBlockCommandsDevice", "!com.apple.driver.AppleOnboardSerial", "!com.apple.driver.AppleSMC"]


["firmware"]
"config" = "sheng"
"dsc" = "Platforms/Xiaomi/shengPkg/sheng.dsc"
"fd" = "Build/shengPkg/{target}_CLANGPDB/FV/SILICIUM_UEFI.fd"
"preflight" = ["scripts/fetch-sheng-dts.py", "scripts/download-sheng-firmware.py", "scripts/extract-sheng-firmware.py --delete-archive", "scripts/import-sheng-uefi.py", "scripts/check-sheng.py"]
"submodules" = ["Common/Mu", "Common/Mu_OEM_Sample", "Silicium-ACPI", "Silicon/Silicium/OpensslPkg/Library/OpensslLib/openssl"]
"patches" = ["Resources/MuPatches/Gic-Spurious.patch"]
"packages" = ["{uefi}", "{uefi}/Platforms/Xiaomi", "{tree}/package", "{tree}/drivers/DarwinBoot", "{edk2}", "{uefi}/Common/Mu", "{uefi}/Common/Mu_OEM_Sample", "{uefi}/Silicon/Qualcomm", "{uefi}/Silicon/Silicium", "{uefi}/Silicium-ACPI", "{uefi}/Silicium-ACPI/Platforms/Xiaomi", "{uefi}/Silicium-ACPI/Silicon/Qualcomm"]

["firmware"."image"]
# The official fastboot archive the firmware inputs are extracted from (download-sheng-firmware.py,
# extract-sheng-firmware.py); the archive itself is deleted after the extraction.
"url" = "https://bkt-sgp-miui-ota-update-alisgp.oss-ap-southeast-1.aliyuncs.com/OS3.0.305.0.WNXMIXM/sheng_global_images_OS3.0.305.0.WNXMIXM_20260914.0000.00_16.0_global_31450b6677.tgz"
"sha256" = "c6259e1c8dd89b5b16d086cbdda5d21083c2ca445dd4cde4c8917139f490c7ed"
"md5" = "31450b6677d9e46edc4937c3f797c51d"
"bytes" = 7609308281

["firmware"."defines"]
"ENABLE_SECUREBOOT" = "1"
"DEVICE_MODEL" = "sheng"
"MEMORY_PROTECTION" = "TRUE"
"SHIP_MODE" = "FALSE"
"BUILDID_STRING" = "sheng-research"



["payload"]
"volume" = "SHENGESP"
"size_mib" = 176
"root_policies" = "{tree}/build/sheng-source-storage/root-policies.bin"
"loader" = "firmware"
"title" = "Boot"
"dram_size" = "0x80000000"
"skip_setup_tool" = "scripts/seed-data-skip-setup.py"
"panic_screen" = true
"kernel_args" = ["-v", "serial=3", "debug=0x14e", "kt_fixed_zones=120", "-no_slto_panic", "use_contiguous_hint=0", "native-source-storage=1", "native-ufs-root=1", "offline-mobile-graphics-load=1", "offline-mobile-graphics-client=1", "offline-legacy-register=1", "offline-legacy-gop=1", "offline-legacy-unit-scale=2", "offline-legacy-pm=1", "offline-legacy-validate=1", "offline-legacy-transfer=1", "offline-legacy-cpu-present=1", "offline-legacy-phase=4", "offline-key-events=1", "sheng-aks=1", "sheng-aks-sls=3", "offline-hid-input=1", "offline-hid-home=1", "sheng-touch=4", "sheng-touch-hid=1", "sheng-buttons=1", "sheng-log=1", "sheng-smp=1", "armcpu-spi-ipi=1", "armcpu-self-ipi=1", "sheng-data-persist=2", "sheng-adsp=2", "sheng-audio=12", "sheng-wifi=5", "sheng-bluetooth=1", "sheng-backlight=1", "sheng-cpufreq=4", "sheng-gpu-power=9", "sheng-gpu-metal=1", "sheng-fb-gpu=1", "sheng-fb-bgra=1", "sheng-dpu-scanout=2", "sheng-no-lc=1", "sheng-vsync=120", "sheng-vsync-fixed=1", "sheng-gpu-dcvs=1", "sheng-disable-watchdogd=1", "sheng-lite=1", "sheng-gpu-addon=1", "sheng-usb=1", "appsync=1"]

[payload.runtime]
tool = "scripts/build-boot-runtime.py"
target = "ios27"
build = "24A446"
data_gib = 215
skip_setup = true
trust_components = ["StaticTrustCache", "Cryptex1,SystemTrustCache", "Cryptex1,AppTrustCache"]
wallpapers = ["ipados27", "ipados27-floating"]
audio_tool = "scripts/build-sheng-audio-hal.py"
audio_target = "arm64e-apple-ios27.0"
audio_system_plugins = ["BTAudioHALPlugin.driver"]
wifi_tool = "scripts/build-wifi-userspace.py"
wifi_target = "ios27"
wifi_launchd_cache = true
wifi_bin_prefix = "wifi-bin"
bluetooth_tool = "scripts/build-bluetooth-userspace.py"
bluetooth_target = "ios27"
appsync = true

[payload.runtime.launchd_job_environment."com.apple.iconservices.iconservicesagent"]
FORCE_SOFTWARE_RENDERER = "0"
CI_ENABLE_METAL_GPU = "0"

["payload"."install"]
"title" = "Install and boot"
"confirm" = "ERASE all iPadOS user data and install again?"
"confirm_titles" = ["Erase Data, skip Hello, boot", "Erase Data, show Hello, boot"]
"confirm_args" = ["sheng-data-reset=1", "sheng-data-reset=2"]

["payload"."adt"]
"chip_id" = "8142"
"owned_memory_size" = "0x130000000"
"packed_data_ramdisk" = true
"persistent_data" = true
"unique_chip_id" = "required"



["bootimg"]
"dtb" = "build/sheng/sheng.dtb"
"dtb_node" = [{ "path" = "/reserved-memory/splash_region", "props" = [{ "name" = "label", "type" = "s", "value" = "cont_splash_region" }, { "name" = "reg", "type" = "x", "value" = ["0x0", "0xb8000000", "0x0", "0x2b00000"] }] }]


["device_tree"]
"source" = "device:dts/sheng.dts"
"include_dirs" = ["soc:dts"]


["components"]
"include" = ["ArmDTPlatform", "ArmCpu", "XnuPrelink", "DarwinBoot", "ShengPreflight", "ShengUfs", "RamBlock", "GopFramebuffer", "AppleKeyStoreState", "Adreno740", "AdrenoMetal"]


["adt"]

["adt"."product"]

["adt"."product"."string"]
"model" = "J120AP"
"artwork-display-gamut" = "sRGB"


["adt"."product"."u32"]
"thin-bezel" = 1



["adt"."defaults"]

["adt"."defaults"."u32"]
"sleep-disabled" = 1
# No Apple PMGR or SEP: report a virtual platform, so AMFI does not wait for an ApplePMGRNub.
"vmm-present" = 1
# The kernel is built with CONFIG_VNODES=1024 (xsmall), so desiredvnodes clips to 1024; the desktop keeps about 1950 vnodes live and
# vnode jetsam then kills daemons several times a second. XNU reads this value before it clips: memory/64K + 1024 for the owned 4864 MiB.
"kern.maxvnodes" = 78848



["adt"."chosen"."u32"]
# This SoC has no CTRR: kernel text stays writable by hardware, which XNU must be told (iBoot writes this on Apple SoCs).
"kernel-ctrr-to-be-enabled" = 0

["adt"."buttons"]

["adt"."buttons"."string"]
"compatible" = "buttons"
"device_type" = "buttons"


["adt"."buttons"."strings"]
"button-names" = ["hold", "voldown", "volup"]


["adt"."buttons"."u32"]
"home-button-type" = 2


["package"]
"unixnu" = "../UniXNU"

["package"."defconfig"]
"ipados-27.0.1-24A446" = "sheng_ipados27_defconfig"
"ipados-26.5.2-23F84" = "sheng_ipados26_defconfig"
"ipados-17.7.11-21H461" = "sheng_defconfig"

["os_overrides"."ipados-17.7.11-21H461"."components"]
"include" = ["ArmDTPlatform", "ArmCpu", "SoftwareAES", "ShengUfs", "VirtioMmioBlock", "RamBlock", "Adreno740", "AdrenoMetal", "GopFramebuffer", "ShengHidInput", "ShengNovatekTouch", "QcomGeniSpi", "AppleKeyStoreState", "XnuPrelink", "DarwinBoot", "VerifiedRoot", "ShengPreflight", "AirNir", "Ath12kWifi"]

["os_overrides"."ipados-17.7.11-21H461"."kernel"]
"archives" = ["build-corecrypto-14.py", "build-corecrypto-14.py --namespace", "component:ArmDTPlatform", "component:ArmCpu", "component:SoftwareAES", "build-software-aes-bindings.py", "component:ShengUfs", "component:VirtioMmioBlock", "component:RamBlock", "build-virtio-mmio-bindings.py --component RamBlock --directory build/ram-block", "build-virtio-mmio-bindings.py --component VirtioMmioBlock", "build-mockfs-fixture.py", "build-sheng-platform-power.py", "build-boot-progress.py", "build-libpthread-kernel.py", "component:Adreno740", "build-adreno740-kits.py", "build-adreno740-accelerator.py", "component:ShengHidInput", "component:AppleKeyStoreState", "build-gop-legacy-display.py"]
"config_fragments" = ["arch:configs/common.config", "soc:configs/sm8550.config", "os:configs/ipados.config"]
"defconfig" = "sheng_defconfig"
"patch_series" = ["arch:patches/xnu/series", "soc:patches/xnu/series", "os:patches/xnu/series", "device:patches/xnu/series"]

["os_overrides"."ipados-17.7.11-21H461"."payload"]
"kernel_args" = ["-v", "serial=3", "debug=0x14e", "kt_fixed_zones=120", "offline-legacy-register=1", "offline-legacy-gop=1", "offline-legacy-unit-scale=2", "offline-legacy-pm=1", "offline-legacy-validate=1", "offline-legacy-transfer=1", "offline-legacy-cpu-present=1", "offline-hid-home=1", "offline-hid-input=1", "offline-legacy-phase=4", "offline-mobile-graphics-client=1", "offline-mobile-graphics-load=1", "offline-apfs-load=1", "boot-progress=2", "-apfs_shared_datavolume", "offline-key-events=1", "native-ufs-root=1", "sheng-pmgr=2", "sheng-disable-watchdogd=1", "sheng-lite=1", "boot-ui-focus4=SpringBoard", "sheng-smp=1", "sheng-cpufreq=4", "sheng-touch=4", "sheng-aks=1", "sheng-gpu-power=9", "sheng-gpu-metal=1", "sheng-fb-gpu=1", "sheng-banner=0", "sheng-gpu-dcvs=1", "sheng-gpu-addon=1", "armcpu-spi-ipi=1", "-no_slto_panic", "ml-timeout-lock-panic-scale=40", "sheng-touch-hid=1", "sheng-data-persist=2", "sheng-staged-apps=1", "sheng-buttons=1", "sheng-backlight=1", "sheng-wifi=5", "sheng-vsync=120"]
"size_mib" = 208

["os_overrides"."ipados-17.7.11-21H461"."payload"."adt"]
"root_match_volume_uuid" = "04769D26-2CA0-4825-B443-E2E5F88300F2"


["os_overrides"."ipados-17.7.11-21H461"]
"remove" = ["payload.root_policies", "payload.runtime", "kernel.prelink.roots"]

["os_overrides"."ipados-26.5.2-23F84"."components"]
"include" = ["ArmDTPlatform", "ArmCpu", "SoftwareAES", "ShengUfs", "VirtioMmioBlock", "RamBlock", "Adreno740", "AdrenoMetal", "GopFramebuffer", "ShengHidInput", "ShengNovatekTouch", "QcomGeniSpi", "AppleKeyStoreState", "XnuPrelink", "DarwinBoot", "VerifiedRoot", "ShengPreflight", "AirNir", "Ath12kWifi"]

["os_overrides"."ipados-26.5.2-23F84"."kernel"]
"archives" = ["build-corecrypto-14.py", "build-corecrypto-14.py --namespace", "component:ArmDTPlatform", "component:ArmCpu", "component:SoftwareAES", "build-software-aes-bindings.py", "component:ShengUfs", "build-sheng-source-storage.py --policy-dir scripts/policies/ipados-26.5.2-23F84", "component:VirtioMmioBlock", "component:RamBlock", "build-virtio-mmio-bindings.py --component RamBlock --directory build/ram-block", "build-virtio-mmio-bindings.py --component VirtioMmioBlock", "build-mockfs-fixture.py", "build-sheng-platform-power.py", "build-boot-progress.py", "build-libpthread-kernel.py", "component:Adreno740", "build-adreno740-kits.py", "build-adreno740-accelerator.py", "component:ShengHidInput", "component:AppleKeyStoreState", "build-gop-legacy-display.py"]
"config_fragments" = ["arch:configs/common.config", "soc:configs/sm8550.config", "os:configs/ipados.config"]
"defconfig" = "sheng_ipados26_defconfig"

["os_overrides"."ipados-26.5.2-23F84"."payload"]
"kernel_args" = ["-v", "serial=3", "debug=0x14e", "kt_fixed_zones=120", "-no_slto_panic"]
"size_mib" = 208

["os_overrides"."ipados-26.5.2-23F84"."payload"."adt"]
"root_match_volume_uuid" = "04769D26-2CA0-4825-B443-E2E5F88300F2"

["os_overrides"."ipados-26.5.2-23F84"]
"remove" = ["payload.install", "payload.root_policies", "payload.runtime", "kernel.prelink.roots"]