Hardware
Every subsystem, and exactly where it stands.
Boot → userland
LIVEMainline 7.0.1 (LLVM-built) reaches full userland cleanly — migrated off the frozen grate fork 2026-05-11; tree + toolchain jump validated on hardware 2026-08-04.
Access / shell
LIVEUSB-net gadget, NCM+ACM composite, zero host-side setup — the pure-peripheral chipidea fix (dr_mode) that also cascaded to the N9.
Display / sway on glass
LIVEDC-handover patch (grate 0011) preserves bootloader scanout; sway/pixman paints DSI-1 and Firefox-ESR loads pages over USB-NAT. Software-rendered — no GPU needed.
Compositor + browser
LIVEsway + foot + fuzzel auto-start on the panel at boot. Tegra K1 is a split-GPU system — tegra-drm (card0) owns the connectors, GK20A (renderD129) does the rendering — so GL clients now get real acceleration while the compositor stays on pixman.
WiFi
SILENTRETRACTED — this read LIVE and was wrong. The BCM43241 never answers CMD5. Every layer is now verified correct (pinmux, clk32kg LPO, rails, reset polarity, 1.8 V signaling ON, indefinite retries since broken-cd) and the chip still declines.
Bluetooth
SILENTSame combo chip, same silence: hci0 enumerates and hci_uart_bcm binds, but 0xfc18 times out and BCM reset fails -110. Both radio halves dead with all enables, clock and power present.
Sensors — IMU + compass
LIVEMPU6515 accel/gyro polled (IRQ optional) + AK8963 mag nested behind the MPU aux-i2c gate. Auto-rotate ready.
CPU frequency
LIVE4x Cortex-A15 online via PSCI; DFLL cpufreq sweeps 204 MHz–2.1 GHz. The CVB OPP table comes from the kernel, not DT.
Battery + charging
LIVELC709203F fuel gauge + BQ24190 charger. charge_type knob confirmed live — the control surface batteryd needs for a charge-band tier.
Audio out — speakers
LIVEConfirmed by ear 2026-08-06. The gate was never the codec: the RT5639's internal mixer path (Stereo DAC MIX → SPK MIX → SPKVOL → SPO MIX) defaults off at every stage, so a card that reported route-present, 100% volume and clean PCM streaming was open-circuit inside. Music now plays through mpv → PipeWire.
GPU acceleration
HW GLThe "FECS wall" was missing firmware — the GPU firmware directory never existed and nouveau was blacklisted. With the 8 gk20a blobs shipped, nouveau inits with zero FECS/PRIVRING errors and real hardware GL runs: GL_RENDERER=NVEA, glmark2 81 vs llvmpipe 42. Remaining: pushbuf timeouts under load.
Touchscreen
PORTINGRaydium RM31080 on SPI — no mainline driver exists. Needs a ~4000-line downstream rm31080a_ts.c port; the panel shows but is not finger-interactive without it.
Audio in / mic
ZEROTested 2026-08-06 now that playback is proven: a 6 s capture returns exact digital zero — RMS 0.0, peak 0, across 288 000 samples. Not a quiet room; a live ADC always has a noise floor. The capture-side mixer path is off the same way playback was.
ALS / proximity
QUEUEDCM3217 and LTR659 sit on the bus but have no mainline driver wired yet.
Suspend / resume
QUEUEDNot yet attempted on the mainline boot — s2idle/LP0 unexplored post-USB-SSH.
Double-tap-to-wake
QUEUEDFleet-standard rung — gated on the Raydium touch driver landing first.
Haptics + gesture nav
QUEUEDFleet-wide felt-parity layer (touch-boost, vibrator commit cues) is design-pending across every device; the RO shell (P6) is where it lands.
Cameras
QUEUEDFront/rear sensors unprobed.
Cellular modem
N/AWiFi-only hardware — the Shield Tablet ships no modem silicon.
Beyond Android
Kernel-level capabilities the stock 3.10.33 firmware never allowed — the parity ceiling raised, not just met.
Battery intelligence
batteryd targets a mid-SoC charge band + State-of-Health telemetry — the BQ24190 charge_type knob is confirmed live on hardware, the last piece before a real charge-capping tier.
Shared Tegra-K1 DC handover
The same bootloader-active-scanout-preserve patch (0011) that cracked the Nexus 9 panel, now proven on Shield hardware 2026-06-29 — three T124/T132 devices sharing one fix.
A living kernel
Migrated off the frozen grate-driver fork (v6.6.22-lts, Apr 2024) onto real upstream — now 7.0.1, LLVM-built — picking up 18 months of the GRATE maintainer's own patches that never reached Android's 3.10.33.
Double-tap-to-wake
Slated to fire through a native mainline touch driver once Raydium lands — no vendor wake blob, unlike the stock firmware. Arrives with the P6 RO shell.
Gesture nav + haptics + cues
Swipe-based navigation with haptic commit and paired audio cues — the felt-parity layer 2014's TegraZone UI never had, budgeted for Track 3 richness once GK20A lands.
Road to RO-OS
The P0→P7 ladder, and where this device sits on it today.
Where Shield sits: a Wayland daily driver with hardware GL for its clients — P5. Boot, USB-SSH access, the DC-handover panel with sway on glass, sensors, 4-core cpufreq, battery and (since 2026-08-06) speaker audio are live, and the GK20A now renders in hardware. The wall moved: the BCM43241 radio never answers CMD5, so WiFi and Bluetooth are both silent — a P3-connectivity hole sitting underneath an otherwise P5 device, and the single blocker in front of the device now. Next rung is P6, the RO read-only shell, gated on the Raydium touch port for a finger-interactive panel — bringing the felt-parity floor (double-tap-wake, DPMS, rotation, swipe gestures) shared by every track.
Live sprint
What's on the bench right now.
The radio wall — BCM43241 answers nothing
The Tegra-K1 DC-handover patch (grate 0011) preserves bootloader scanout; sway/pixman lights DSI-1 and Firefox-ESR loads pages over USB-NAT. A running Wayland session on the panel — no GPU required.
The card had looked correct for weeks: route present, volume 100%, PCM streaming, no XRUN, MCLK+BCLK live. Every one of those checks sat above the actual break — the RT5639's own internal mixer chain was off at every stage, so the DAC never reached the Class-D amp. Music now plays through mpv → PipeWire.
Recorded across the fleet for months as a FECS/PRIVRING kernel bug. It was two missing files: the GPU firmware directory never existed, and nouveau was blacklisted. With the 8 gk20a blobs shipped it inits with zero faults — glmark2 81 vs llvmpipe's 42.
USB-SSH (NCM+ACM, zero host config), 4×A15 via PSCI, DFLL cpufreq 204 MHz–2.1 GHz, sensors, and the BQ24190 charge knob — the full P4 layer live on hardware.
The hardest remaining wall, and the one entry on this page that used to claim success. Pinmux, clk32kg LPO, rails, reset polarity and 1.8 V signaling are all verified correct on hardware, and since broken-cd the host retries forever — CMD and DAT sit idle-HIGH and never toggle. Bluetooth is silent on the same die.
A far later wall than "FECS won't init": the engine initialises and executes real command streams, but a submission path times out (nv50cal_space: -110, 310× in one run) with zero FECS/gr/PRIVRING errors. It is what caps a 128-core Kepler at ~1.9× software.
With the compositor daily-driver-capable, the next rung is the bespoke RO shell: double-tap-wake, DPMS, rotation and swipe gestures — the felt-parity floor, on Track 3 (RO Lite). Raydium touch (no mainline driver, a ~4000-line port) lands here to make the panel finger-interactive.
The die, and what it drives
Every wire labelled with the bus it really runs on; every block coloured by what has been
proven on this tablet, not by what the silicon is capable of. Re-triaged subsystem
by subsystem on 2026-08-16 against build bf3d89f7 — so the dark blocks are
measured holes, not unexplored ground.
Read the dark blocks as the roadmap: touch is the gate (no SPI master, no driver, and the vendor stack turns out to live in userspace), WiFi and Bluetooth are one silent chip whose last host-side excuse was eliminated on 2026-08-16, and VDE/VI/CSI are deliberate non-goals — mainline has no T124 backend and software decode already holds 1080p60 at 58 °C.