bde961c6f2
PAF becomes saf/device (history kept), STATE.md dissolves into saf/state.md with the dated era archived, the substrate SAF moves up from souveraine, and every agreement points at saf/INDEX.md and nowhere else. one map, nothing to remember
150 lines
7.7 KiB
Markdown
150 lines
7.7 KiB
Markdown
# d10 — iPhone 7 (A1660, iPhone9,1, T8010)
|
||
|
||
Second body. Bring-up, not daily use. The argument and the evidence live in
|
||
[`../../docs/tasks/63-d10-second-body.md`](../../docs/tasks/63-d10-second-body.md);
|
||
this page is the per-capability state and the commands.
|
||
|
||
**Reboot it freely** — Casey, 2026-08-09: *"I'm happy to reboot it… idgaf,
|
||
reboot it whenever."* Nothing is flashed and every boot re-runs checkm8.
|
||
|
||
## Boot
|
||
|
||
```sh
|
||
~/Projects/hoolock/boot.sh # all stages, newest staged kernel
|
||
~/Projects/hoolock/boot.sh -l # what is staged
|
||
~/Projects/hoolock/boot.sh -k touch # a specific variant
|
||
```
|
||
|
||
DFU is buttons and only buttons: power off, Vol-Down + Power 8s, release Power,
|
||
keep Vol-Down ~10s. The script waits for it. Stage 2 **always** ends in a
|
||
`SerialException` — the proxy drops when the kernel takes the machine, and
|
||
`kboot` refuses the jump if PCIe init failed, so reaching that disconnect is the
|
||
success signal.
|
||
|
||
Cmdline carries `initcall_blacklist=simpledrm_platform_driver_init`. Without it
|
||
simpledrm claims the panel first, udev names it the primary GPU, and viewtop
|
||
composites through the fenceless framebuffer while ADP holds the same hardware —
|
||
two writers, one panel. Disabling `framebuffer0` in the DT does **not** work;
|
||
m1n1's `kboot` fills and re-enables `/chosen/framebuffer` itself.
|
||
|
||
## What runs
|
||
|
||
| | |
|
||
|---|---|
|
||
| kernel | `Pauli1Go/HoolockLinux` + local commits; config `hoolock/config-d10-full-16k` |
|
||
| pages | **16K**. The 4K config builds and does not boot |
|
||
| display | simpledrm by default. ADP binds and scans out but the panel stays dark — see below |
|
||
| backlight | two: `20e200080.backlight` (DWI) and `206600000.dsi.0` (panel, over DCS) |
|
||
| storage | `nvme0n1p1` ext4; `nvme0n3` is SysCfg, 131072 bytes, read-only |
|
||
| link | NCM `usb0` `172.16.43.1/24`; no wifi, no modem, no battery node populated |
|
||
| session | greetd → `souveraine-session-viewtop` as `casey`, real `seat0`/tty1 |
|
||
|
||
## Per-capability
|
||
|
||
**works** — storage, USB gadget, both backlights, session authority, SSH,
|
||
display *through simpledrm*.
|
||
|
||
**partial**
|
||
|
||
- **the display pipe.** ADP binds, and everything measurable says it is
|
||
working: `[drm] Initialized adp 0.1.0 for 206200000.display-pipe on minor 1`,
|
||
connector `card0-DSI-1` **connected + enabled**, CRTC `active=1` with `fb=43`
|
||
and the plane at `750x1334+0+0`, viewtop's EGL up on that card. **The panel
|
||
is dark anyway.** Both backlights are raised, so it is content and not
|
||
brightness. Two candidates, neither tested:
|
||
- **the mode timings are invented.** m1n1 programmed Apple's real timings and
|
||
ADP re-modesets with porches I made up (`750 758 774 790 / 1334 1338 1346
|
||
1354`, 64179 kHz). Nothing in the ADT gave a raster, so they were guessed —
|
||
which is the one thing in this whole port that is not derived.
|
||
- **`panel-summit` sends no DCS display-on.** It has no `prepare`/`enable` at
|
||
all, by design: on a Touch Bar the loader leaves the panel running. It also
|
||
never sets `dsi->lanes` / `format` / `mode_flags`, and D10's ADT says
|
||
`#lanes = 2`. If `adp-mipi` reprograms the host from those defaults, the
|
||
link comes up wrong.
|
||
|
||
`boot.sh -a` is the ADP-only boot; without it simpledrm stays and the screen
|
||
works. **Do not make ADP the default until a pixel is seen.**
|
||
|
||
- **touch.** `apple_z2` binds on `spi0.0`, firmware loads, `firmware ready IRQ
|
||
received`, surface geometry reads back off the part (5850×10405, 13 units/mm),
|
||
*"report initialization complete"*, and the gen2 report-enable answers. Then
|
||
the IRQ never moves for a finger. It **did** work once — 2407 events, 270
|
||
`SYN_REPORT`, 13 balanced down/up, X 53..735, Y 107..1333 — on the first boot
|
||
after the rails were fixed, and has not since. Ruled out by test: the driver
|
||
changes (the original kernel is equally dead), and the rails (forced power
|
||
cycle at probe, no change; a rebind cleanly re-inits). The untested difference
|
||
is the display path — that first boot was the last one where simpledrm drove
|
||
the panel. Apple's touch controllers sync to display scan;
|
||
`t8010-ipad7.dtsi` gives its touchscreen `display-sync-gpios`, and D10's
|
||
`disp0` carries `function-lcd_enable`. **Next test is one boot:** the original
|
||
`touch` variant *without* the simpledrm blacklist, which restores the exact
|
||
conditions of the working run.
|
||
- **lock surface.** `touchKeypad` is answered from the environment now
|
||
(`SOUVERAINE_TOUCH_KEYPAD=1`, set in `/etc/environment` and the shell unit
|
||
drop-in), because `PersistentProperties` only carries the choice through a
|
||
reload and the d10 always starts cold. Unverified on glass.
|
||
|
||
**built, never run** — bluetooth (node inherited), charging (SN2400 + BQ27540 in
|
||
DT and kernel), ambient light (CT821 → `TSL2583`), audio (`SND_SOC_APPLE_MCA`),
|
||
suspend, buttons (`gpio-keys` reports `KEY_MUTE`/`VOLUMEDOWN`/`VOLUMEUP`/
|
||
`KEY_POWER`, and viewtop already classifies the last three — nothing routes them
|
||
on this body).
|
||
|
||
**absent** — GPU (no render node; llvmpipe, `GALLIUM_DRIVER` set in
|
||
`/etc/environment` and it must **never** be set on blueline), wifi (BCM4350
|
||
needs a driver; the node is deliberately kept out of the DT because declaring it
|
||
stalls PCI pwrctrl and takes the host bridge and NVMe down with it), modem,
|
||
camera, sensor reporters.
|
||
|
||
## Traps this body has already cost
|
||
|
||
1. **`/dev/mem` on live display registers wedged it into recovery, twice.** Do
|
||
not probe MMIO to identify a register window. A wrong `reg` in a DT node is
|
||
safe by comparison — the driver maps what it is told and fails to probe.
|
||
2. **Warm re-exploit is not a cold boot.** Rails, clocks and controller state
|
||
survive it. The one boot where touch worked was the one following a true
|
||
power-off.
|
||
3. **`config_16k` is the bare upstream reference** — no `PCIE_APPLE_H9P`, no
|
||
`APPLE_SIO`, no `TOUCHSCREEN_APPLE_Z2`. Building d10 from it produces a
|
||
kernel with no storage and no touch. Use `config-d10-full-16k`.
|
||
4. **Firmware must be `CONFIG_EXTRA_FIRMWARE`.** The disk-boot blob has no
|
||
initramfs, so `apple-sio`'s `request_firmware` loses the race to rootfs: 60 s
|
||
`-ETIMEDOUT`, then the SPI bus never probes and touch cannot exist.
|
||
5. **`pgrep -f` matches your own ssh command line.** It has killed a session and
|
||
produced two false "phone is down" readings in one night.
|
||
|
||
## The panel cannot sleep on this body
|
||
|
||
Both ends of the blank are blueline-shaped, so there is no idle path that ends
|
||
with a dark, powered-down panel:
|
||
|
||
- `Blank`/`Unblank` shell out to **`blueline-screen-toggle`**, which does not
|
||
exist here and ships only in `rootfs-overlay/`. The trail records
|
||
`panel-off … No such file or directory` — the actuator no-ops.
|
||
- `Dim` is the only thing that changes the panel, and on the shipped sessiond it
|
||
is `brightnessctl set 10` — an absolute, 0.5% of 2047, indistinguishable from
|
||
off.
|
||
|
||
So the device offers lit-forever or black-forever and nothing between, until
|
||
`souveraine eb0292c` lands by package. Meanwhile the timed policy is widened
|
||
(`dim_grace_secs` 600, `lock_blank_after_secs` 1800) rather than left at 15 s.
|
||
To park it by hand:
|
||
|
||
```sh
|
||
for d in /sys/class/backlight/*/; do echo 0 > $d/brightness; echo 4 > $d/bl_power; done
|
||
```
|
||
|
||
**This is TASK-63's parity fix.** viewtop owns the CRTC, has `power.rs` with the
|
||
EBUSY deferral, and runs on both bodies — the blank belongs there as a verb, and
|
||
then neither phone needs a script named after the other one.
|
||
|
||
## Owed
|
||
|
||
- `casey` still has password `123456`, which is also the lock PIN.
|
||
- Buttons are unrouted.
|
||
- `sessiond eb0292c` (dim by percent) needs a CI build and `pacman -Syu` to
|
||
reach the device; until then the panel dims to black at `set 10` and the idle
|
||
policy is widened as a stopgap.
|
||
- The kernel work lives as a patch at
|
||
`../../saf/device/evidence/d10-adp-touch-2026-08-09.patch` because `hoolock/` is not
|
||
a repository. It wants a real home.
|