Hardware
Every subsystem, and exactly where it stands. Nothing here is padded.
Kernel boot
BOOTS pmOSlibre-tegra next 7.0.0 (commit 7ab58370) with the real 2431-line board file. Reaches userspace, OpenRC completes, all 4 Cortex-A15 cores online. The rootfs grows itself on a fresh install — 1.06 GiB → 12.4 G — after resize2fs was restored to the initramfs.
Access (USB net + serial)
SSH AND CONSOLEThe gadget is network and console and says so: TN7 USB Net+Con. SSH on 172.16.42.1 since r11, gated on nvidia,has-legacy-mode. The serial console on /dev/ttyGS0 needs no IP stack and is the way in when the host orphans the network interface.
WiFi (TI WiLink 8)
ASSOCIATESWPA3-Personal + FT, DHCP lease, internet reachable. Three stacked gates: SDIO needs 18.8 s of cold retries on a non-removable card, a baked static [IPv4] block iwd cannot parse, and wl18xx implements no 802.11w — PMF must be off or the AP deauths with reason=9.
Thermal (SOCTHERM)
ALL 4 ZONES LIVEFixed in r42 and confirmed on glass: cpu 42.0 / gpu 40.0 / pllx 43.5 / mem 40.5 °C, where three of four read exactly 0 before. Cause was a one-line dead store in mainline — shifted_cp extracted then overwritten with the raw fuse word. Inert on every SoC upstream ships; T114 is the only one with a non-zero field shift.
CPU DVFS
SCALINGLive since r15 — cpufreq scales and idles at 816 MHz. The earlier BogoMIPS 24 LP-idle-clock signature is gone. With thermal fixed in r42 the 90 °C passive trip can finally engage its cooling device.
eMMC / storage
INTACTHynix HAG2e, 14.7 GiB. Stock Android 5.1 mounts clean. The “rotted flash” theory is dead. Boot partition is 8 MiB — the tightest budget in the fleet — with the dtb in its own 2 MiB partition.
Display (Tegra DC + DSI)
PANEL IS A CONSOLEcard0, card0-DSI-1, tegradrmfb and a backlight device. Two stride guesses against simple-framebuffer both failed; what worked was enabling the real path — DRM_TEGRA + DRM_PANEL_LG_LD070WX3, a driver for this exact panel that was in-tree and switched off.
Touchscreen
CHIP SILENT ON SPIThe one genuinely dead subsystem, and now cleanly isolated. Driver binds spi0.0, the touch_fusion daemon runs, generic netlink handshakes, and the firmware reads back 49152 B CRC16 0xEADE — then the controller answers unexpected status 0000 under both SPI framings, including the chip_access_method=2 the NVIDIA board file specifies. A second, separate fault (the daemon exec racing the rootfs mount) is fixed by a rebind service.
Battery / charging
ENUMERATESGauge and charger both bind — /sys/class/power_supply/ carries battery and bq24190-charger, where r11 had an empty directory. The pack reads healthy. That is presence, not a validated SoC/SoH reading; batteryd has not yet run here, and max17048 is voltage-only so current_now comes from the INA230.
Audio
CARD REGISTERSCard 0 “Nvidia Tegra Note 7 RT5639” registers and a Headphones Jack input device exists. Codec is rt5639 @ i2c-0 0x1c on tegra30-i2s.1 — the stock cmdline says rt5640 and is wrong. A registered card is not audible audio: nothing has been heard from this device under pmOS yet.
Bluetooth (WiLink 8)
CHIP ANSWERS -110hci0 exists since r14 and TIInit_12.8.32.bts loads, but reading TI version information times out at -110. Same die and same antenna path as the WiFi that works, so the radio is not dead. The retry is bounded in hci_ll.c — it is not the source of any console flood.
Sensors
ENUMERATEDmpu6050 accel+gyro @ 0x69, ak8963 compass @ 0x0d, cm3217 ALS @ 0x10, ina230 power monitor @ 0x44. Match these on the channel, never the driver name: mpu6050 publishes no “accel” in its IIO name and the magnetometer publishes no name at all, appearing as the bare address 4-000d.
GPU (GRATE GR3D)
DRM ON, GR3D OFFDRM_TEGRA + TEGRA_HOST1X are on and renderD128 exists. GRATE_HOST1X stays off deliberately. Untested beyond node presence — no GL client has run on this device.
Crash forensics
RAMOOPS LANDINGThis board shipped with no self-recovery and no post-mortem: PANIC_ON_OOPS unset, PANIC_TIMEOUT=0, no hardlockup detector, no PSTORE_RAM. r43 adds a 2 MiB ramoops region and arms the hardware watchdog. PANIC_ON_OOPS stays off deliberately until pstore is proven — the panel is still this device’s best evidence channel.
Suspend/resume
UNKNOWNTegra 4 LP0 untested. Stock passes lp0_vec=2656@0xb98ff000 on the cmdline.
Camera
ENUMERATEDov5693 rear @ 0x10 with ad5823 focuser, ov7695 + mt9m114 front, all on i2c-2. No mainline Tegra114 VI/CSI path exists.
Haptics
QUEUEDVibrator driver identity still TBD — the felt-parity floor requirement.
Double-tap wake
BLOCKED BY TOUCHNeeds a working touch driver first, and touch is the hardest known problem on this device rather than an assumed-easy one.
Beyond Android
What's designed in for this device once it boots — the parity ceiling raised, not just met.
Battery intelligence
batteryd's mid-SoC charge band + State-of-Health telemetry is designed for exactly this pack the moment it can hold a charge again — Tegra Note 7 is named among the oldest, highest-priority packs in the fleet.
A living kernel, parked
GRATE-driver 6.6.22 LTS today, with a 6.18.29 mainline-catch-up migration already scoped and sitting on a branch — vs. Android 4.2.2, frozen since 2013 and never patched again.
Gesture navigation
Swipe-based nav with haptic commit and paired audio cues, targeted at Track 4 — essential animation only, no blur, snappy purely from touch-boost cpufreq.
Double-tap-to-wake
Fleet-standard wake-from-black, planned on the same mainline touch path as every other device — implementation waits on the touch controller ID that first boot will give us.
WiLink diversity
The only TI WiLink 8 (WL18xx) radio in the fleet — proving the touch-feel and battery stack works on non-Broadcom, non-Qualcomm silicon.
Road to RO-OS
Every device climbs the same ladder. Phase = the highest rung fully reached.
kernel + initramfs + rootfs mount; reaches a login/console internally
a shell — serial UART, USB-net, or WiFi+SSH
panel lights via KMS, backlight, touchscreen events
WiFi associates; Bluetooth enumerates
audio, core sensors, battery/charge + batteryd
GL acceleration + a Wayland compositor runs
the bespoke RO shell runs — double-tap-wake, rotation, gestures
cameras, suspend/resume, vibration
Live sprint
What's on the bench right now.
Touch — the one chip still silent
The bench unit was parked in June on a pack that took no charge, and the page said so for weeks after it stopped being true. On 2026-08-10 the tablet reached stock recovery userspace — the Android “No command” screen drew on the panel, which only happens after a kernel boots, starts userspace and reinitialises the display. The “rotted flash” theory is dead: the Hynix eMMC is intact and stock Android 5.1 mounts clean.
libre-tegra next 7.0.0 boots RO-OS on the real 2431-line board file. The USB gadget is network and console in one (TN7 USB Net+Con). WiFi associates on WPA3-Personal with a DHCP lease and reachable internet, through three stacked gates including an 18.8 s SDIO settle. Since r42 all four SOCTHERM zones read live, so the chip throttles itself in software instead of cooking.
This board shipped with no self-recovery and no post-mortem — a hang was simply a hang, with nothing to read afterwards. Since r43 ramoops lands, so the device survives a hang well enough to tell you why it happened.
The one genuinely dead subsystem, and now cleanly isolated rather than tangled up with the battery story. The driver binds spi0.0 and the chip stays silent. Double-tap wake is queued behind it — it needs a working touch driver first, and touch is the hardest known problem on this device rather than the next easy win.