Hardware
Every subsystem, and exactly where it stands. No boot to a shell yet — be honest about it.
Partition mapping (PIT)
MAPPEDFull 30-entry PIT read via Heimdall — BOOT 10 MiB, SYSTEM 2.25 GiB confirmed; EFS flagged for backup before any flash.
Kernel port (downstream 3.4.113)
BOOT-LOOP · r22LineageOS msm8226 fork pinned and built through 22 revisions. QCDT DTB packaging solved; Samsung cmdline reverse-engineered from TWRP. r20 got past the early-kernel cliff — screen now lights briefly before reset.
Debug console (USB-ACM)
RETRACTED · r22The r21 plan does not work on this tree. CONFIG_USB_CONFIGFS*/USB_F_ACM do not exist in 3.4, so oldconfig dropped them all — there is no /dev/ttyACM0 and there never was. This kernel uses android_usb, not configfs gadgets.
First boot to shell
NOT YETNo confirmed console output from real hardware, and no working plan to get one yet — the ACM route is closed. The crash sits somewhere in late kernel init or early userspace.
Display panel
ID TBD10.1in 1280×800 IPS via a TC358764 DSI-LVDS bridge; mdss_mdp.panel= set from TWRP but unverified against real silicon.
Backlight
QUEUEDNot reachable until the panel driver lands.
Touchscreen
PROBE PENDINGAtmel mXT540T or similar — exact part TBD by I2C probe once a shell exists.
WiFi
QUEUEDBroadcom BCM4334 SDIO — same brcmfmac + NVRAM path already proven on lg-hammerhead.
Bluetooth
QUEUEDBCM4334, UART-attached.
Audio out
QUEUEDWCD9304 codec over SLIMbus + Q6AFE — the first SLIMbus device in the fleet.
Audio in / mic
QUEUEDSame WCD9304/Q6AFE path as audio-out.
Battery + charger
DRIVER TBDSamsung-internal fuel gauge, likely max17048 — the wrong driver path risks shutdown loops before it can even be diagnosed.
Battery intelligence (batteryd)
BLOCKEDNeeds a working charger/fuel-gauge driver first — mid-SoC cap + SoH telemetry queued directly behind it.
Sensors
TYPE UNCONFIRMEDMPU-6500 accel/gyro, AK8963 mag, BH1721 ALS — typical for the matissewifi class, not yet probed on this unit.
GPU accel
QUEUEDAdreno 305 (a3xx) — freedreno-capable, and a3xx needs no proprietary GPU firmware blob.
Compositor / Wayland
QUEUEDsway on the wlroots GLES2 path — Track 4 keeps effects minimal by design.
USB networking / SSH
QUEUEDmicro-B 2.0; no OTG-host advertised but the SoC supports it. Same 172.16.42.1 pattern as the rest of the fleet.
Gesture nav + haptics + dt2w
BLOCKEDFleet-standard touch-UX bar — blocked on the touchscreen driver landing first.
Cameras
QUEUED1.3 MP front, 3 MP rear, no flash.
Cellular modem
N/AMODEM/APNHLOS partitions exist (shared board SW with the LTE sibling) but this WiFi-only SKU has no radio hardware behind them.
Beyond Android
Kernel-level capabilities the frozen 2014 TouchWiz firmware never allowed — the parity ceiling this bring-up is aimed at, not just the floor.
Battery intelligence
batteryd will cap charge at a mid-SoC band and track State-of-Health once the fuel-gauge driver lands — this pack is already 12 years old.
Firmware-free GPU
Adreno 305 (a3xx) accelerates through mainline freedreno with zero proprietary GPU firmware.
Gesture navigation
Swipe-based nav with haptic commit and paired audio cues, once the touch driver lands.
Double-tap-to-wake
Wake-from-black is on the roadmap the moment the Atmel touch driver probes.
A kernel that keeps moving
Phase 1 targets the downstream 3.4.113 fork just to get pixels; Phase 2 (unscoped) swaps it for a living mainline kernel.
Road to RO-OS
Eight rungs, one ladder — every device in the fleet climbs the same one.
| P0 | P1 | P2 | P3 | P4 | P5 | P6 | P7 |
|---|---|---|---|---|---|---|---|
| ~5% | ~15% | ~30% | ~45% | ~60% | ~75% | ~90% | 100% |
Live sprint
What's on the bench right now.
First boot — still no console, and the ACM plan was wrong
Full 30-entry partition table read with Heimdall (2026-05-09). BOOT confirmed 10 MiB — comfortable next to TN7's 8 MiB — SYSTEM 2.25 GiB, EFS flagged for backup before any flash.
aboot rejects an appended-DTB zImage — it wants a QCDT v1 blob, discovered by dissecting a working TWRP image. Kernel now emits /boot/dt.img via dtbtool; Samsung's exact cmdline (vmalloc, panel select, board_rev) was pulled from TWRP's live /proc/cmdline.
r20’s cmdline fix got the kernel measurably further — the screen now lights briefly before reset, versus instant black-screen before. r21 then wired ro-os.debug-shell over USB-CDC ACM to read the crash. That plan was invalid and is withdrawn. The CONFIG_USB_CONFIGFS* / USB_F_ACM symbols it enabled do not exist in this 3.4 tree, so oldconfig silently dropped every one — there is no /dev/ttyACM0 on this kernel and there never was. This downstream tree predates configfs gadgets; its USB is android_usb. r22 corrects the comments to that reality and carries no functional kernel delta.
Samsung speaks Odin/LOKE, not fastboot — heimdall flash --BOOT boot.img --no-reboot. An image (7cdffbd2) is built and waiting to go on. With no ACM shell possible, the read has to come from somewhere else: android_usb in this tree, or a UART, or the panel itself. P0 closes the moment any of them produces a line.