SouveraineOS/devices/d10/README.md

d10 — iPhone 7 (A1660, iPhone9,1, T8010)

Second body. Bring-up, not daily use. The argument and the evidence live in ../../docs/tasks/63-d10-second-body.md; this page is the per-capability state and the commands.

Reboot it freely — Casey, 2026-08-09: "I'm happy to reboot it… idgaf, reboot it whenever." Nothing is flashed and every boot re-runs checkm8.

Boot

~/Projects/hoolock/boot.sh            # all stages, newest staged kernel
~/Projects/hoolock/boot.sh -l         # what is staged
~/Projects/hoolock/boot.sh -k touch   # a specific variant

DFU is buttons and only buttons: power off, Vol-Down + Power 8s, release Power, keep Vol-Down ~10s. The script waits for it. Stage 2 always ends in a SerialException — the proxy drops when the kernel takes the machine, and kboot refuses the jump if PCIe init failed, so reaching that disconnect is the success signal.

Cmdline carries initcall_blacklist=simpledrm_platform_driver_init. Without it simpledrm claims the panel first, udev names it the primary GPU, and viewtop composites through the fenceless framebuffer while ADP holds the same hardware — two writers, one panel. Disabling framebuffer0 in the DT does not work; m1n1's kboot fills and re-enables /chosen/framebuffer itself.

What runs

kernel	Pauli1Go/HoolockLinux + local commits; config hoolock/config-d10-full-16k
pages	16K. The 4K config builds and does not boot
display	simpledrm by default. ADP binds and scans out but the panel stays dark — see below
backlight	two: 20e200080.backlight (DWI) and 206600000.dsi.0 (panel, over DCS)
storage	nvme0n1p1 ext4; nvme0n3 is SysCfg, 131072 bytes, read-only
link	NCM usb0 172.16.43.1/24; no wifi, no modem, no battery node populated
session	greetd → souveraine-session-viewtop as casey, real seat0/tty1

Per-capability

works — storage, USB gadget, both backlights, session authority, SSH, display through simpledrm.

partial

• the display pipe. ADP binds, and everything measurable says it is working: [drm] Initialized adp 0.1.0 for 206200000.display-pipe on minor 1, connector card0-DSI-1 connected + enabled, CRTC active=1 with fb=43 and the plane at 750x1334+0+0, viewtop's EGL up on that card. The panel is dark anyway. Both backlights are raised, so it is content and not brightness. Two candidates, neither tested:

  • the mode timings are invented. m1n1 programmed Apple's real timings and ADP re-modesets with porches I made up (750 758 774 790 / 1334 1338 1346 1354, 64179 kHz). Nothing in the ADT gave a raster, so they were guessed — which is the one thing in this whole port that is not derived.
  • panel-summit sends no DCS display-on. It has no prepare/enable at all, by design: on a Touch Bar the loader leaves the panel running. It also never sets dsi->lanes / format / mode_flags, and D10's ADT says #lanes = 2. If adp-mipi reprograms the host from those defaults, the link comes up wrong.

  boot.sh -a is the ADP-only boot; without it simpledrm stays and the screen works. Do not make ADP the default until a pixel is seen.

• touch. apple_z2 binds on spi0.0, firmware loads, firmware ready IRQ received, surface geometry reads back off the part (5850×10405, 13 units/mm), "report initialization complete", and the gen2 report-enable answers. Then the IRQ never moves for a finger. It did work once — 2407 events, 270 SYN_REPORT, 13 balanced down/up, X 53..735, Y 107..1333 — on the first boot after the rails were fixed, and has not since. Ruled out by test: the driver changes (the original kernel is equally dead), and the rails (forced power cycle at probe, no change; a rebind cleanly re-inits). The untested difference is the display path — that first boot was the last one where simpledrm drove the panel. Apple's touch controllers sync to display scan; t8010-ipad7.dtsi gives its touchscreen display-sync-gpios, and D10's disp0 carries function-lcd_enable. Next test is one boot: the original touch variant without the simpledrm blacklist, which restores the exact conditions of the working run.

• lock surface. touchKeypad is answered from the environment now (SOUVERAINE_TOUCH_KEYPAD=1, set in /etc/environment and the shell unit drop-in), because PersistentProperties only carries the choice through a reload and the d10 always starts cold. Unverified on glass.

built, never run — bluetooth (node inherited), charging (SN2400 + BQ27540 in DT and kernel), ambient light (CT821 → TSL2583), audio (SND_SOC_APPLE_MCA), suspend, buttons (gpio-keys reports KEY_MUTE/VOLUMEDOWN/VOLUMEUP/ KEY_POWER, and viewtop already classifies the last three — nothing routes them on this body).

absent — GPU (no render node; llvmpipe, GALLIUM_DRIVER set in /etc/environment and it must never be set on blueline), wifi (BCM4350 needs a driver; the node is deliberately kept out of the DT because declaring it stalls PCI pwrctrl and takes the host bridge and NVMe down with it), modem, camera, sensor reporters.

Traps this body has already cost

1. /dev/mem on live display registers wedged it into recovery, twice. Do not probe MMIO to identify a register window. A wrong reg in a DT node is safe by comparison — the driver maps what it is told and fails to probe.
2. Warm re-exploit is not a cold boot. Rails, clocks and controller state survive it. The one boot where touch worked was the one following a true power-off.
3. config_16k is the bare upstream reference — no PCIE_APPLE_H9P, no APPLE_SIO, no TOUCHSCREEN_APPLE_Z2. Building d10 from it produces a kernel with no storage and no touch. Use config-d10-full-16k.
4. Firmware must be CONFIG_EXTRA_FIRMWARE. The disk-boot blob has no initramfs, so apple-sio's request_firmware loses the race to rootfs: 60 s -ETIMEDOUT, then the SPI bus never probes and touch cannot exist.
5. pgrep -f matches your own ssh command line. It has killed a session and produced two false "phone is down" readings in one night.

The panel cannot sleep on this body

Both ends of the blank are blueline-shaped, so there is no idle path that ends with a dark, powered-down panel:

• Blank/Unblank shell out to blueline-screen-toggle, which does not exist here and ships only in rootfs-overlay/. The trail records panel-off … No such file or directory — the actuator no-ops.
• Dim is the only thing that changes the panel, and on the shipped sessiond it is brightnessctl set 10 — an absolute, 0.5% of 2047, indistinguishable from off.

So the device offers lit-forever or black-forever and nothing between, until souveraine eb0292c lands by package. Meanwhile the timed policy is widened (dim_grace_secs 600, lock_blank_after_secs 1800) rather than left at 15 s. To park it by hand:

for d in /sys/class/backlight/*/; do echo 0 > $d/brightness; echo 4 > $d/bl_power; done

This is TASK-63's parity fix. viewtop owns the CRTC, has power.rs with the EBUSY deferral, and runs on both bodies — the blank belongs there as a verb, and then neither phone needs a script named after the other one.

Owed

• casey still has password 123456, which is also the lock PIN.
• Buttons are unrouted.
• sessiond eb0292c (dim by percent) needs a CI build and pacman -Syu to reach the device; until then the panel dims to black at set 10 and the idle policy is widened as a stopgap.
• The kernel work lives as a patch at ../../PAF/evidence/d10-adp-touch-2026-08-09.patch because hoolock/ is not a repository. It wants a real home.