arm64 T8010 (iPad 6)

Darwin on Apple’s own A10X-generation hardware, reached through the checkm8 BootROM exploit. Boots to a shell on the device’s own display.

Building

nix build .#kernel-arm64-t8010     # or -debug
nix build .#kc-arm64-t8010
nix build .#ramdisk-arm64-t8010

There is no disk image. The root filesystem is a 160 MB ext4 RAM disk mounted as md0, loaded together with the kernel collection.

Getting code onto the device

checkm8 puts the device in a state where an unsigned image can be loaded, and a modified PongoOS chainloads PureDarwin from there. The tooling lives in the project’s checkm8-tools (gaster plus PongoOS, both packaged with Nix), and the chainload itself is a pdload/pdboot PongoOS module with a prejump hook.

PongoOS is a Mach-O ld64 preload rather than an ELF, so it links with the same native-ld the rest of the project uses. Its default 128 MB and 64 MB size caps had to be raised to fit the collection and ramdisk.

Console

There is no serial console on this device, and PureDarwin does not need one. The console is the iPad’s own display: iBoot hands a live framebuffer to PongoOS, PongoOS passes it along, and the kernel inherits something already lit and already configured. Nothing in PureDarwin has to bring up the display hardware, work out its geometry, or know anything about it at all, which is why a target with five kexts and no graphics driver still puts a visible shell in front of you.

It is worth being clear that this is borrowed, not earned. The day PureDarwin wants to change a mode, drive the panel itself, or survive a boot path that does not come through iBoot, that display work is still ahead of us.

Kexts

Five: corecrypto, pthread, PDArmPlatformExpert, ext4, Ext4FileSystemDriver. Nothing else is needed to reach a shell, and everything else is future work.

Interrupts

PDAppleAIC implements the Apple Interrupt Controller as an IOInterruptController. The bootloader also has to quiesce interrupts before jumping, or sleh_irq panics on a NULL handler.

Build notes

Five things in the kernel needed working around because Apple builds this with an internal clang: -mcpu=hurricane, several unnamed HID, PMC and error registers, and memmap_types.h.

The collection uses the MH_FILESET path, which sidesteps a non-fileset __LASTDATA_CONST assert that would otherwise stop the build.

Ramdisk pruning

A RAM disk has to fit in memory twice on the way in, so the T8010 image drops System/Library/Kernels, every include tree, the pkgconfig directories and the guest header staging before packing.