Google Pixel C board dragon · google-smaug NVIDIA Tegra X1 T210 · Cortex-A57 aarch64 RO-OS · mainline 6.12 LTS
Pixel C · 2015 · phase P6 · RO-OS shell

The first 64-bit Tegra,
climbing to mainline.

Google's 2015 aluminum flagship tablet — the fleet's first aarch64 target, booting through a ChromeOS-style coreboot + depthcharge loader instead of Android's usual fastboot chain. Shipped on Android 6.0 Marshmallow and frozen at 8.1 Oreo behind a 3.18 downstream kernel; now running an unmodified 6.12 LTS kernel, with capabilities the 2015 firmware never shipped.

Kernel
6.12.94 LTS
Signature HW
Multicolor LED light-bar lid
SoC
Tegra X1 · GM20B
Android life
6.0 Marshmallow → 8.1 Oreo
Vs. Android
3.18 → 6.12
90%RO-OS progress
Phase P6 · RO-OS shell — 12 of 17 subsystems live

Hardware

Every subsystem, mapped 1:1 to the fleet master matrix — and exactly where it stands.

WorkingIn progressBlocked / portingNot started

Boot

LIVE

Mainline 6.12.100 LTS boots to userspace through coreboot + depthcharge vboot — A/B kernel slots, the first ChromeOS-style bootloader in the fleet.

KERN-A/B · vboot

Access / SSH

LIVE

WiFi + a private VPN and a USB-C gadget-net channel (172.16.42.1) are both live shell paths — the daily dev route.

WiFi + USB · private VPN

Display / panel

LIVE

2560×1800 DSI panel renders via KMS; lp8557 backlight with cros-ec ambient-light auto-brightness + staged idle dim.

DSI · 2560×1800

Touchscreen

LIVE

Synaptics HID-over-I2C multitouch through the generic i2c-hid driver — no vendor blob.

06CB:3370 · i2c-hid

WiFi

LIVE · 5 GHz

BCM4354 over SDIO on mainline brcmfmac — associated at 5745 MHz (ch 149), −58 dBm, verified on hardware. The earlier claim that "5 GHz association is unsupported on this driver" was wrong and is retracted: the block was never the driver, it was that the only 5 GHz AP in range was not broadcasting, plus a regdom that had to be set (US) before the band was usable. Real remaining limits are narrower — brcmfmac SAE is offload-only, so no WPA3 or FT, and DFS channels are firmware-owned.

mmc@700b0200 · ch 149 · −58 dBm

Bluetooth

LIVE

BCM4354 controller enumerates; A2DP audio-out confirmed end-to-end (first sound out of the device was over BT). BCM4354.hcd firmware shipped.

BCM4354 · hci0 · A2DP

GPU / acceleration

LIVE

Nouveau drives the GM20B Maxwell GPU with HW GLES2 + a first-in-fleet mainline NVK Vulkan path (glmark2 ~560, GZDoom on Vulkan). gamescope@720p is the playable game path.

GM20B · nouveau + NVK

Wayland / compositor

LIVE

sway runs on the HW GLES2/tegra compositor (WLR_DRM_NO_ATOMIC) — the whole read-only shell renders here.

sway · wlroots

Audio out — speaker

LIVE

FIRST mainline Pixel C speaker audio. RT5677 (I2C) → internal DAC→ADC loopback → AIF2 codec-to-codec → MAX98357A. The key nobody had: the I2S1 link is DSP_A 4-slot TDM, so stereo must ride a 4-channel PCM. UCM + sway autostart baked.

rt5677.3-002d · MAX98357A

Audio in / mic array

LIVE

Four-DMIC far-field array captures on mainline — DMIC → rt5677 Stereo1 ADC2 leg → AIF1TX → I2S1 → ADMAIF, mic in TDM slots 0/1. Validated on-HW (record→playback loop). Far-field, not a call mic — noise-suppression tuning is next.

DMIC1/2 · rt5677

Sensors

PARTIAL

Accel streams via IIO polling → an auto-rotate daemon drives screen rotation; the folio-lid hall sensor is read through the ChromeOS EC. Gyro/mag/ALS/prox remain EC-routed, not all wired.

cros-ec · iio

Battery + charger

LIVE · CAP UNRELIABLE

batteryd is live — first fleet deploy — and bq27742 State-of-Health telemetry is solid (the two units read 100.4 % at 41 cycles and 67.7 % at 970). Charge control is EC-locked, so the USB-PD port-override is the only knob, and it does not hold: the history shows a clean 51–65 % band working and then silently releasing, leaving the pack at 100 % for ~21 h with no full-charge flag set. Also measured: on a host port the EC negotiates SDP 500 mA (2.5 W in) against 4.2 W drawn at rest, so the tablet net-discharges while plugged in.

bq27742 · SoH 100.4 / 67.7 %

USB-C gadget / net

LIVE

Device-mode networking over USB-C works (172.16.42.1, SSH-over-USB) via an EC-managed VBUS role toggle; USB2-only gadget DT for stability.

tegra-xudc

Power at rest

MEASURED

The repose ladder stages the backlight down and snaps awake on touch, and the panel genuinely sleeps. What that hid: the SoC does ~659 timer wakeups/s while Asleep — 33x the 20/s budget — traced by ftrace to the embedded controller re-asserting EC_CMD_GET_NEXT_EVENT ~90x/s forever, because its sensor FIFO never arms and the events are drained and discarded. Not userspace: unbinding the sensorhub changes nothing. full SoC suspend/resume not yet exercised.

swayidle · DPMS

Cameras

BLOCKED · HW

Rear IMX219 DT is software-complete and matches the vendor config, but the sensor is silent on a live i2c bus — a ribbon/HW fault on this unit. Needs a physical reseat, not more code.

IMX219/208

Modem

N/A

Pixel C shipped WiFi-only — no cellular modem hardware exists to bring up.

—

RO shell

LIVE

The fleet read-only shell runs: double-tap / any-touch wake, staged DPMS rest, auto + locked rotation, lisgd swipe gestures, touch-boost snappiness, Widevine streaming.

sway · lisgd + dt2w

Beyond Android

Capabilities the frozen 2015 firmware never allowed — some already live, some queued right behind the next rung.

6.12

A living kernel

An unmodified upstream 6.12 LTS kernel where Android froze at 3.18 (Marshmallow, 2015) — a decade of security and driver work, still landing.

The tablet keeps getting newer instead of older.
🔊

First mainline speaker audio

The internal MAX98357A speaker plays on a mainline kernel for the first time — RT5677 DAC→ADC loopback out AIF2 to the amp, with the 4-slot-TDM channel trick that unblocked it. UCM-baked; games play music.

Mainline shipped the codec + amp nodes unwired — nobody had made this tablet make a sound before.
⚡

Battery intelligence

batteryd is live — the first fleet deploy — reading bq27742 State-of-Health telemetry through the cros-ec tunnel; charge control is EC-locked, so the USB-PD port-override is the lever.

This pack is a decade old and has likely sat at 100% SoC for most of it.
⇄

Gesture navigation

Swipe-based navigation is live via lisgd, with staged idle-rest + touch/keyboard wake alongside it — haptic commit and paired audio cues are the next layer.

A modern touch-UX bar the 2015 firmware never had.
◱

Screen wake

Staged graceful rest (backlight settles 50%→18%) that snaps awake on a keyboard key or the power button. The literal double-tap-to-tap is still grabbed out of dt2w — a daemon fix in flight.

Every panel device in the fleet climbs to this rung — no exceptions.
▶

Widevine DRM in Firefox

Netflix/HBO-Max-class Widevine L3 streams decrypt and play in Firefox — ChromeOS's arm64 CDM bridged onto Alpine/musl via gcompat plus a custom LFS64 shim. First proof in the fleet.

Stock Android never ran Firefox at all — this is a capability Android on this hardware never had either.

Road to RO-OS

The P0→P7 phase ladder every device in the fleet climbs. Pixel C sits at P6 — the RO-OS shell runs.

P0
Boots
~5%
P1
Access
~15%
P2
Display + Touch
~30%
P3
Connectivity
~45%
P4
Core I/O
~60%
P5
GPU + Wayland
~75%
P6
RO-OS shell
~90%
P7
Full parity
~100%

Target track

Accelerated GL / nouveau, arm64, 3–4 GB RAM — RO on GLES2 / zink, most spring physics, reduced blur. Native-first apps with light Waydroid. Pixel C shares this track with the Nexus 9 (pending its own GK20A fix).

Track 2 — RO Standard

What P6 means

The bespoke RO-OS read-only shell actually runs on the device: double-tap-wake, DPMS blank/wake, auto + locked rotation, swipe gestures. This is the rung where the device stops being "Linux booted" and starts being the fleet's UI.

The % model

P0≈5 · P1≈15 · P2≈30 · P3≈45 · P4≈60 · P5≈75 · P6≈90 · P7=100

The parity ring above reads the live subsystem tally — 12 of 17 working — while this ladder tracks the P0→P7 milestones the whole fleet shares.

Live sprint

What's on the bench right now, and the next rung after it.

In flight

Inside P6 — polishing the RO-OS shell toward full parity

✓
Speaker audio — first on mainline

RT5677 (I2C) → internal DAC→ADC loopback → AIF2 codec-to-codec → MAX98357A. The unlock nobody had: the I2S1 link is DSP_A 4-slot TDM, so stereo must ride a 4-channel PCM. UCM + sway autostart + volume clamp all baked; SuperTuxKart plays music.

rt5677.3-002d · MAX98357A · P4
✓
GPU + Wayland live

Nouveau HW GLES2 + first-in-fleet mainline NVK Vulkan (glmark2 ~560, GZDoom on Vulkan); sway runs the whole shell on the tegra compositor.

GM20B · nouveau + NVK · P5
✓
Shell inputs

Folio BT keyboard pairs + wakes the screen; lisgd swipe gestures, auto/locked rotation, staged idle-rest, touch-boost snappiness, Widevine streaming — the RO-OS bar is up.

sway · lisgd · dt2w
◐
Mic + touch-wake

DMIC clock is live (rt5677 GPIO2 hog); the capture route is being mapped (same 4-channel-TDM rule as playback). Double-tap-wake works via keyboard/power but the tap itself is grabbed out of dt2w — a daemon fix.

DMIC1/2 · dt2w · in progress
✓
Daily-driver hardening — crossed the threshold

Detail-oriented pass, verifying subsystems against spec. Fixed the #1 blocker: elogind lid-close was suspending into Tegra SC7 (no resume path on coreboot) and wedging the tablet — now never system-suspends. Baked the whole RO-OS UX (tappable WiFi/BT/Power bar, gestures, rest daemons) so a fresh flash comes up complete. Measured ~3-day idle standby.

elogind · waybar · reflash-safe

The die, and what it drives

Every wire labelled with the bus it really runs on; every block coloured by what has been proven on hardware. The moving charge is not decoration — it flows only where work is actually being done, so the idle engines read as the holes they are.

TEGRA X1 · T210 20 nm · 4×A57 @ 204–1912.5 MHz · schedutil · cpuidle.off=1 CPU · 4×A57 17-step cpufreq cooling A53 ×4 absent from /sys GPU · GM20B nouveau + NVK · bandwidth-bound DC / DPU 54200000 · ~64 irq/s HOST1X 50000000 · engine bus NVDEC 54480000 · fw loaded, no path APE · audio tegra-ape · card 0 VIC 54340000 · scaler, unused XUSB xusb.bin · gadget + host NVENC · NVJPG · SE untouched PANEL · DSI 2560×1800 · card0-DSI-1 BACKLIGHT lp8557 · 0–255 TOUCH 06CB:3370 · PROP_DIRECT DSI · scanout i2c · lp8557 7000c000.i2c · touchscreen@20 VIC scale/compose — NOT WIRED GPU does the 1080p→2560×1800 upscale CROS-EC 1-001e · 7000c400.i2c GET_NEXT_EVENT ~90/s i2c FUEL GAUGE bq27742 · 5-0055 USB-PD CHARGER SDP 500 mA · 2.5 W in SENSORS accel 400 Hz · als · prox LIGHTBAR · LID cros-ec-lightbar · SW_LID tunnel i2c-5 FIFO −22 · on-demand LPDDR4 · 3 GB pinned 800 MHz · no DVFS eMMC · 64 GB life_time 0x05 · p7 rootfs EMC sdhci RT5677 CODEC DSP_A 4-slot TDM MAX98357A ×2 codec-to-codec AIF2 BCM4354 SDIO · wlan0 + hci0 USB-C gadget 172.16.42.1 I2S1 · 4ch SDIO XUSB VI / CSI dependency cycles IMX219 · i2c silent
energized — proven on hardware charging — in progress derezzed — blocked dormant — parked / no path

The three fastest streams run SoC → CROS-EC: the embedded controller re-asserting EC_CMD_GET_NEXT_EVENT ~90×/s, every second, because its sensor FIFO never arms (−22) and the events are drained and discarded — the largest single source of the ~659 timer wakeups/s measured at rest. The dark paths are the story: NVDEC has firmware loaded and its engine probing and decodes nothing, so every frame lands on the A57s; VIC is a fixed-function scaler that binds at boot and is never wired, so the GPU brute-forces the 1080p→2560×1800 upscale. Four engines idle while the CPU does their work — and on a fanless tablet that becomes heat, then throttle, then dropped frames.