← The fleet Work with us →
Google Nexus 9 HTC flounder / flounder_lte NVIDIA Tegra K1 T132 · Denver2 aarch64 RO-OS · mainline 6.19
Bring-up status

The Lollipop tablet,
running mainline.

The launch device for Android 5.0 — now booting an unmodified 6.19 kernel on RO-OS, with hardware Android never exposed and battery-longevity intelligence Android never had.

Kernel
6.19.14 · r20
Panel
JDI ganged dual-DSI
SoC
Tegra K1 · GK20A
Android life
5.0 → 7.1
Validated on
Wi-Fi + LTE hardware
50%hw parity
14 of 22 tracked subsystems live

Hardware

Every subsystem, and exactly where it stands.

WorkingIn progressBlocked / portingNot started

Display / panel

LIVE

JDI ganged dual-DSI lit via bootloader handover; sway + Chromium render.

54300000/54400000 · 1536×2048

Panel first-boot

CLEAN

Both halves clean on every boot of this era (r213+ MIPI-cal + PHY fixes). Corruption now only follows a mid-video host-triggered DCS, and a full power-off clears it.

both halves · r213

USB / SSH

LIVE

Peripheral-mode gadget net; PHY VBUS software-override was the multi-week fix.

usb0 · 172.16.42.1

Wi-Fi

LIVE

brcmfmac BCM4354; board-NVRAM + firmware symlink wired.

wlan0 · BCM4354

Bluetooth

LIVE

hci0 up, not blocked, full BLE + BR/EDR.

BCM4354 · hci0

Battery + charger

LIVE

max17050 fuel gauge (=y) + bq24190 charger. Foundation for batteryd.

98% · max17050

Touchscreen

LIVE

Synaptics RMI4 via mainline driver — no vendor blob.

s7504 · RMI4

Haptics

LIVE

gpio-vibrator bound — the felt-parity motor.

gpio-vibrator

Double-tap wake

LIVE

Implemented for real in r4 — it was listed as working for six weeks with no implementing code. Now a daemon, verified.

DT2W · r4

H.264 decode

FALSIFIED

Tegra VDE runs but decodes WRONG PIXELS (mean|diff| 111/255, a BSEV flush timeout per frame), slower than software. Hard ceiling: MAIN profile, no CABAC — web H.264 can never use it.

/dev/video0 · ⛔ 2026-08-21

Compositor

LIVE

sway + Wayland; Chromium 150 plays YouTube (software-rendered).

sway · Wayland

Modem firmware

PACKAGED

All 7 Qualcomm MDM Sahara blobs harvested non-root + baked into the LTE image.

MDM9x25 · qdl-ready

Speakers

LIVE

Stereo by ear on two units. DAP pinmux CNF cleared on the tegra30 geometry + PLL locked from BCLK — the fix that earned the renumber to r1.

2× TFA9895 · PLL LOCKED

Backlight / dim

STUCK AT FULL

Stock dims via DCS 0x51 — master link, vblank-injected, shrink_pwm payload, all confirmed on a rooted unit. Mainline delivers that exact packet cleanly and the panel does not obey: we inherit a live panel from HBOOT and never own its init. Replaying the init late corrupts the display. Next: a real cold init in the vendor order.

0x51 · no obedience

GPU accel

PORTING

nouveau binds GK20A but GR-falcon (FECS/GPCCS) won't init — a kernel bug, not missing firmware. Jetson track.

GK20A · PRIVRING

Microphone

SAMPLES, NOT YET VOICE

Digital silence SOLVED: the IF1 ADC TDM slot swap (3/1/2/4) was the gate, negative-tested twice. Samples are non-zero but unproven as a mic — gain and physical input still open.

RT5677 · TDM 1/2/3/4

Headphone / AUX

LIVE

Audible by ear. LOUT rerouted through the RT5506 amp so its DAPM widgets actually power.

RT5506 · HP amp

LTE modem

PORTING

External Qualcomm MDM over HSIC; blobs + boot recipe captured. qdl → rmtfs → ModemManager.

wwan0 · multi-week

Sensors

LIVE

Our cwmcu IIO driver (patches 121/128/130): accel reads gravity, magnetometer a real field vector, ALS real lux — on two units. Gyro reads ~0 at rest and still needs a moving-tablet probe.

cwmcu · accel/mag/ALS

Suspend (LP0)

PORTING

s2idle hangs; true RAM-suspend needs AOTAG firmware not upstreamed.

LP0 · AOTAG

NFC

QUEUED

BCM20795 firmware harvested; driver bring-up not started.

BCM20795

Cameras

QUEUED

Front/rear sensors unprobed.

—

Beyond Android

Kernel-level capabilities the stock 3.10 firmware never allowed — the parity ceiling raised, not just met.

⚡

Battery intelligence

batteryd caps charge at a mid-SoC band and tracks State-of-Health — the pack stops living at 100% 24/7.

These lithium cells are 8–12 years old; Android just trickled them to full and let them age.
▶

Firmware-free HW video

H.264 decode on the reverse-engineered Tegra VDE — no proprietary blob, no GPU dependency.

Stock relied on the closed AVP codec stack; this is clean-room mainline.
⇄

Gesture navigation

Swipe-based nav with haptic commit and paired audio cues — no dependency on the vanished nav bar.

A modern touch-UX layer the 2014 firmware never shipped.
◱

Double-tap-to-wake

Wake-from-black straight through the mainline RMI4 touch driver — no vendor wake blob.

A fleet-standard rung, free from the upstream driver.
6.19

A living kernel

An unmodified upstream 6.19 kernel where Android froze at 3.10 — a decade of security and driver work.

The device keeps getting newer instead of older.

Live sprint

What's on the bench right now.

In flight

Built-in speakers — the last register

✓
AHUB fan-out proven

One DMA stream broadcast to both I2S buses in hardware — I2S2 RX CIF re-pointed at I2S1's TX FIFO. Samples reach the amp pins.

dmesg: SPKFAN — I2S2 core enabled, XFER_EN_TX set ✓
✓
Amp power rail asserted

The TFA9895 output-stage LDO that HTC's board code drove at boot — found in the downstream board file, now a DT gpio-hog.

gpio-189 (tfa9895-spkr-ldo-en) out hi ✓
✓
Wake the amp from power-down

The amp sits at SYS_CTRL 0x091d (PWDN=1) — the fan-out delivers audio below DAPM, so the codec never gets its power-up event. Fix: force-enable its POWER + AMPE widgets so the driver clears PWDN itself.

DONE · r266 → renumbered r1 · audible by ear on two units

The die, and what it drives

Every block is coloured by what has actually been proven on hardware; the hubs with the most connections pull inward, and every wire is labelled with the bus it really runs on. Nothing here is illustrative — every label is a measured fact read off the bench.

TEGRA K1 · T132 2× DENVER2 2.5 GHz · conservative GK20A GPU PRIVRING → Jetson DC · DSI A+B ganged scanout VDE stateless H.264 XUSB · UTMI peripheral mode VI · CSI absent from DT AHUB · I2S streams run SDMMC eMMC · SDIO SOCTHERM throttling ✓ SC7 broken upstream HOST PC CDC-NCM · ssh lifeline BCM4354 Wi-Fi assoc ✓ · BT A2DP ✓ one chip, two buses eMMC 32 G wear bin 1 · integrity ✓ D+/D− · VBUS sw-override SDIO UART-C SDMMC4 JDI PANEL 1536×2048 · 2-link ganged LED BOOST · 5 V stuck ON · full TOUCH · RMI4 s7504 · DT2W ✓ HAPTICS gpio-163 · eol ✓ DSI ×8 DCS 0x51 · inert display-sync · no off i2c · irq gpio-163 TPS65913 PMIC + max17050 · bq24193 BATTERY batteryd · SoH HTC MCU · 0x72 protocol PROVEN 08-06 wake-per-transaction · STM32 ACCEL·GYRO z = 0.94 g ✓ ALS lvl 3 · adc 46 ✓ MAG same path, unread PROX same path, unread i2c-0 / i2c-4 i2c-0 0x72 · wake Q1 MCU private i2c — 0x48 lives HERE RT5677 CODEC digital powered · route On TFA9895 ×2 PLL locked · stereo audible RT5506 → JACK 440 Hz + music · clean 0 dB DMIC CAPTURE streams zeros CAMERAS IMX219 · OV9760 · VCM MDM9x25 LTE HSIC — parked BCM20791 NFC i2c-0/0x77 · no driver I2S1 · i2c-1 I2S2 LOUT DMIC i2c-2 ✓ · CSI: no receiver HSIC i2c-0
energized — proven on hardware charging — in progress derezzed — blocked dormant — parked / no path

Hubs pull inward by connection count; leaf devices sit at the rim. The Tegra K1 die is the centre of gravity — the two Denver2 cores, the ganged dual-DSI display controller and the reverse-engineered VDE video engine are energized, while the GK20A GPU (GR-falcon PRIVRING init) and the external Qualcomm MDM modem read as the holes they still are.