Files
vphone-cli/docs
zqxwce ee5e7d0fa2 kernel: Introduce EXP variant and hv_vmm_present OID rename (KernelEXPPatcher)
Introduces a new `exp` firmware variant on top of JB and ports the
`hv_vmm_present` sysctl rename to it.

Variant infrastructure
----------------------
- Adds `case exp` to `FirmwarePipeline.Variant`,
  `VPhoneCLI.PatchFirmwareCLI.VariantOption`, and
  `VPhoneVirtualMachine.Variant`. Every `switch variant` block in
  `FirmwarePipeline.buildComponentList` includes the new case.
- Adds `make fw_patch_exp` + `make cfw_install_exp` Makefile targets
  and an `EXP=1` flag for `make setup_machine`, mutually exclusive with
  `JB=1` / `DEV=1` / `LESS=1`. `SPOOF_BUILD` env var is threaded
  through for later use by the build-version step.
- Adds `--exp` to `scripts/setup_machine.sh` alongside `--jb` /
  `--dev` / `--less`. The post-install JB-Finalize block also fires
  for EXP (since EXP inherits the JB rootfs deployment).
- Adds `scripts/cfw_install_exp.sh` as the EXP install script
  starting point: identical phase set to `cfw_install_jb.sh` (JB-1..JB-5)
  with banner/header/footer updated for EXP. Subsequent commits in this
  branch add the EXP-only experimental phases on top.
- Updates the variants table in `AGENTS.md` / `README.md` and the
  three translated READMEs to include the new `Experimental (EXP)`
  row, plus a paragraph describing what EXP adds on top of JB.

Kernel patch
------------
- New `KernelEXPPatcher` orchestrator in
  `sources/FirmwarePatcher/Kernel/`, chained after `KernelPatcher` +
  `KernelJBPatcher` for the `.exp` variant only. Inherits
  `KernelJBPatcherBase` to reuse the JB symbol-table / ADRP-BL index /
  branch-encoder infrastructure.
- New `KernelEXPPatchHvVmmRename` patch in
  `sources/FirmwarePatcher/Kernel/EXPPatches/`. Part A flips byte 0 of
  the NUL-delimited `\\0hv_vmm_present\\0` cstring (the sysctl OID's
  `oid_name` value) — `'h'` -> `'X'` — so the kernel resolves
  `sysctlbyname("kern.hv_vmm_present")` as ENOENT and
  `sysctlbyname("kern.Xv_vmm_present")` to the OID's real int value.
  Part B mangles byte 5 of every kernel-internal occurrence of
  `kern.hv_vmm_present` so callers keep hitting the renamed OID; two
  byte-aligned forms are covered (NUL-delimited cstring + sandbox-profile
  name-token with trailing `\\x0f`).
- Patch IDs are `kernelcache_exp.hv_vmm_oid_rename` and
  `kernelcache_exp.hv_vmm_internal_caller_mangle`. Idempotent.
- `KernelJBPatcher` is unchanged at the call-site level (no
  `patchHvVmmRename` call); its docstring is updated to point at
  `KernelEXPPatcher` for the EXP-only patch.

JB and other variants are NOT affected: `cfw_install_jb.sh` and
`cfw_install_dev.sh` are untouched in this commit.
2026-05-18 16:14:55 +03:00
..