Hardware
Every subsystem, and exactly where it stands.
Kernel / boot
LIVEUnmodified mainline 6.17 executes to a full userland — 8 penguins, all cores — after root-causing the dispcc-with-no-parents hard-hang and the ABL appended-DTB scan.
USB / SSH
LIVEFull RO-OS over USB-net. The gate was the SM5705 MUIC switch idling open — D+/D- route through it, not straight to the SoC. Closed in DT.
Storage (UFS)
LIVEReal rootfs on UFS sda30, ext4 rw, 108 G — Samsung KLUDG4UHDB. Host+PHY up on the mainline driver.
Bluetooth
LIVEWCN3990 (QCA) over UART; crbtfw firmware aliased and the BD address self-heals at boot — pulled from Samsung EFS to fix the unconfigured controller.
Display / panel
FIRST LIGHTANA38401 + AMSA05RB06 dual-DSI, 2560×1600 command-mode — lit 2026-07-23. fb0 is msmdrmfb on ae01000.display-controller, simplefb handed off at 5.4 s: DPU → dual-DSI → TCON → glass, with the weston desktop rendering on it. The long-assumed gamma gate was wrong — it lit on placeholder gamma; the per-panel MTP read is still open and only affects colour/brightness accuracy.
Wi-Fi
LIVEath10k_snoc associates and carries traffic — wlan0 holds a DHCP lease on real hardware. Needed BOTH a 3312 mV vdd-3.3-ch0 rail floor and shadowing the generic board-2.bin; the rail-floor trap is fleet-general.
Battery + charger
JUST LANDEDSM5705 charger + fuel-gauge driver (mainline has none) and batteryd wired for Tier-B mid-SoC charge capping. The two most recent commits in the repo.
GPU accel
HW RENDERINGBoth APIs on hardware, measured on glass 2026-07-23: turnip Vulkan 1.3.348 (Mesa 26.1.1) and freedreno FD640 GLES 3.2. glmark2 864 — it read 61 until we found weston was launched --renderer=pixman, a software compositor that also denied clients any hardware EGL path, silently dropping every GL app to llvmpipe.
Touchscreen
AFE SCANSThe on-cell STM FTS AFE scans in normal mode for the first time (2026-08-06). The old bus-wedge reading was retired — the IC probes fine; the real gate was the panel touch-sync enable, which is inert in the ON table and must be re-sent after display-on (~335 ms later). Confirmed on two cold boots; confirming finger events is the last step.
cpufreq
RE-ENABLEDSamsung OSM hyp-fence rationale was found wrong — cpufreq re-enabled; scaling range still to be verified live.
Audio
BT PLAYSFirst sound out of the device 2026-07-22 — A2DP to a UE BOOM 2, which needs no kernel card. Speakers are mapped from the stock HAL: Q6 → SEC_TDM_RX_0 → 4× CS35L41 (slots 0-3), VMON feedback on SEC_TDM_TX_0. The ADSP is now enabled — the Q6/APR bus, gate for the whole speaker path, is up and awaiting hardware confirm; SND_SOC_SM8250 is still unset and sm8250.c has no TDM support.
S Pen
LIVEWacom W9021 driver written from scratch — mainline wacom_i2c is the wrong model (big-endian 17-byte push frames vs. little-endian query/response). Complete on glass 2026-08-04: the pen tracks, with axis resolution reported.
Sensors
SLPI BOOTSThe SLPI remoteproc now boots — the TZ accepted the signed SLPI image and the glink dsps edge plus /dev/fastrpc-sdsp come up. The sensor PD then crash-loops every ~2.5 s, so it is opt-in and no image ships the storm. Next: attach hexagonrpcd before the DSP starts.
HW video (Venus)
SESSION RUNS2026-08-20 — the IRIS1 video core boots and answers HFI for the first time ever on mainline (SM8150 is the only IRIS1 in mainline; nobody had driven venus here before). Android’s own DT was the key: it holds all three GCC video-AXI clocks as proxy-clocks during firmware boot so the ARM9 fetches its firmware, the ready-poll clears (sciacmdarg0=0x40000001) and the HW H264/VP8/VP9/HEVC/MPEG-2 decoder node appears. 2026-08-23 — the session-init wall then fell: the firmware power-collapsed its codec island after boot and could not resume it, so every session hung. Keep the plane powered (fw_low_power=0) and the firmware runs an entire decode session for the first time — INIT → LOAD_RESOURCES → START, 16 input buffers fed, ARM9 idling correctly (WFI=1). It accepts coded input but emits no decoded frames yet.
USB-PD
QUEUEDSamsung s2mm005 CCIC — CC/PD/SBU only (no D+/D-); no mainline driver, not started.
NFC
QUEUEDnq-nci — downstream-only driver; bring-up not started.
Cameras
QUEUEDFront / rear sensors unprobed.
Beyond Android
This is a genuine Track-1 device — the fleet's flagship-tablet toe-hold. Modern capability the frozen One UI build never offered, now within reach.
Battery intelligence
batteryd caps the SM5705 charger at a mid-SoC band and tracks State-of-Health — the pack stops living at 100% 24/7. The driver just landed on the bench.
turnip Vulkan · Track 1
Adreno 640 (a6xx) is conformant turnip silicon — a real Vulkan compositor plus Zink for legacy GL. Both APIs now run on hardware against a lit panel: turnip 1.3.348 and freedreno FD640, glmark2 864.
A living kernel
An unmodified mainline 6.17 where the tablet froze on One UI / Android 11 (a 4.14 vendor kernel). A half-decade of security and driver work Samsung stopped shipping.
Gesture navigation + feel
Swipe nav with haptic commit and paired audio cues, plus touch-boost cpufreq for launch-day snap — the Android-feel layer, held to the same floor across the fleet.
Double-tap-to-wake
Shipped and machine-validated via the vendor low-power gesture mode — no wake blob. The production loop was caught firing unprompted: idle blank → LPM → a real double-tap with coordinates → KEY_WAKEUP → resume → full re-arm. It landed on hardware whose normal touch mode did not yet scan.
Road to RO-OS
Every device climbs the same eight rungs. Phase = the highest rung fully reached.
Kernel + initramfs + rootfs on UFS; reaches userland internally.
USB-net SSH shell — full RO-OS reachable at 172.16.42.1.
Panel LIT 2026-07-23 — a Wayland desktop renders on it. STM FTS touch is the one gate left: the AFE now scans in normal mode, and confirming finger events on glass is the last step.
Wi-Fi associates and holds a DHCP lease; Bluetooth enumerates and plays A2DP — both live out of sequence, ahead of the P2 touch gate.
Speakers (Q6 → 4× CS35L41, drafted; A2DP already plays), sensors (SLPI), battery intelligence — batteryd foundation already landed.
Adreno 640 on hardware — turnip Vulkan 1.3.348 + freedreno GL, glmark2 864, weston rendering on the lit panel. Live ahead of the touch gate.
The bespoke RO shell — double-tap-wake, rotation, gestures.
Cameras, S Pen, suspend/resume, vibration — everything the stock firmware did.
On-paper this is a Track 1 target — Adreno 640 turnip Vulkan, ≥6 GB, arm64 — so the ceiling is full RO with spring physics, blur and live thumbnails. As of 2026-07-23 the panel is lit and weston renders on hardware GL (glmark2 864); Wi-Fi, Bluetooth, the GPU and the S Pen came live out of sequence, but the phase stays gated at P2 until STM FTS touch confirms finger events — the AFE now scans in normal mode, and that last confirmation is the one gate left. Progress is tracked by phase, not a fake-precise percentage: the rough model is P0≈5% · P1≈15% · P2≈30% · P3≈45% · P4≈60% · P5≈75% · P6≈90% · P7=100%. The unit on the bench is the fleet's second Tab S6 (R52MC0J6FVJ) — the first was returned; this one is committed to the port.
On the bench
What's live in the workspace right now.
From first light toward a touchable, speaking tablet
Two walls fell in one session: the SM5705 MUIC switch idled open (D+/D- never reached the SoC) and dispcc was enabled with every parent disabled (hard-hang at ~20 s). Closed the switch, disabled dispcc — the device came up on UFS.
ANA38401 + AMSA05RB06 dual-DSI, 2560×1600 command-mode. Electricals derived from live stock clocks, cross-checked against vendor source, then validated on the real panel: enable err=0, 29h read back, TCON handshake, clocks exact.
The two most-recent commits in the repo: a mainline-absent SM5705 charger/fuel-gauge driver, then the battery-manager workspace wired for Tier-B mid-SoC charge capping. The longevity foundation is in place.
The panel lit 2026-07-23 on placeholder gamma (the long-assumed gamma gate was wrong) and a weston desktop renders on it: DPU → dual-DSI → TCON → glass. glmark2 jumped 61 → 864 once weston stopped launching --renderer=pixman — turnip Vulkan 1.3.348 and freedreno FD640 GL both on hardware. Wi-Fi and Bluetooth also came live.
A2DP already plays; now wire the on-board speakers — Q6 → SEC_TDM_RX_0 → 4× CS35L41, drafted from the stock HAL (ADSP now enabled, sm8250.c still has no TDM). In parallel, the STM FTS AFE now scans in normal mode after display-on — confirming real finger events on glass is the last step to close P2.
The session-init wall fell (2026-08-23): the IRIS1 firmware power-collapsed its codec island after boot and could not resume it, so every session hung. Keep the plane powered (fw_low_power=0) and the firmware runs the whole decode session for the first time — INIT → LOAD_RESOURCES → START → 16 input buffers fed, with the ARM9 idling correctly (WFI=1). It accepts coded input but emits no decoded frames yet; registering the LLCC video cache-slices the firmware expects (llcc_subcache) is the next shot at output.
The SLPI remoteproc boots but the sensor PD crash-loops — attach hexagonrpcd before the DSP starts to hold accel/gyro/mag/ALS/prox up. S Pen is already live and double-tap-to-wake shipped; from here it is the RO-OS shell — rotation, gestures, and the rest of full parity.
The die, and what it drives
Every wire labelled with the bus it really runs on; every block coloured by what has been proven on this tablet, not by what the silicon can do. Green is live, amber is in flight, red is porting-in-progress, grey is untouched — so the dark blocks are measured holes, not unexplored ground.