Historical record. The dates, candidate identity, "current" claims, next steps and permissions below belong to this recorded boundary. See current state for the latest physically observed result.
2026-09-10; canonical baseline e4a0a81. M1 complete; M2 active, exit incomplete. The blueprint, Linux 6.18, our recovery policy and physical results remain authoritative. This audit changes research/porting decisions, not the rootfs/application architecture or the current hardware configuration.
Read-only source: artificerchris/innioasis-y2-reverse-engineering, pinned at f96d4c7dddbcafeb31919fe1fbe2dab99c4bd641. Its kernel gitlink and archived migration manifest identify 53fb57bb99c916c24b65db5b7f9723be37f67826, exactly our existing donor. The new value is experiment history, failure explanations and some retained captures, not another kernel implementation.
Read the README, all ten requested porting pages, platform overview, known issues, relevant diagnostics, recovery/LK journals, archived patch mapping, radio isolation records and platform configuration/bootstrap/display sources. Reviewed both available commits: 41677bd and f96d4c7. Main is a squash; references to other historical commits are not a complete publicly retained commit history. The archive contains superseded claims even in its overview and known-issues page.
The named references/system-info and vendor-BSP directories are absent; their references page explicitly says those probes/large inputs were not committed. Many camera, waveform and build-log locators likewise name missing private files. A narrated hardware result is useful but is not an independently replayed capture. No external script, firmware, submodule build or installer was executed. The clean research checkout is retained privately, outside implementation. Selected-source hashes and link/source checks are retained under ignored evidence-private/20260910-reverse-engineering/validation.json. Device wall-clock dates in their logs are not trusted; use the recorded boot identities and monotonic intervals when comparing experiments.
Cross-checks use our donor audit, locked local v6.18 source, RAM evidence, display/input, power, audio, radio and USBACM-03 physical capture. Host USB inventory found no attached Y2; no new physical test is claimed. USBACM-04 and M2-INPUT-01 remain offline-validated candidates awaiting results. The owner's older board has no usable FM reception hardware. Their OCA72559 amplifier observation and possible alternate panel must not define our revision.
- The panel-height conflict has a dated correction. The September 9 recovery journal retracts 368 and reports camera-verified 480×360. This agrees with our hardware and the donor's emitted mode. Its older comments/porting page remain stale. Sync-event versus sync-pulse is a separate discrepancy: our LK analysis and donor mode flags support sync-pulse. D
- Cold display startup has concrete failure causes. In direct-DA startup, reading DSI INTEN stalled USB despite open display gates. Powering the PHY first restored register access; setting its rate after preparation failed with EBUSY. GPIO112 needed mode 1 to carry MMSYS LCM_RST_B. Reset/output-select/ MM-source guesses did not fix the hang; an extra VGP1 rail was unnecessary in the successful experiment. These explain donor patches 0033–0037. R
- Two historical fixes are already unnecessary in 6.18. OVL PITCH_MSB used to overwrite the old-layout scanout address; v6.18 confines those writes to supports_afbc variants, which excludes MT2701. Its PMIC key driver also uses static register descriptions for long-press setup, avoiding the missing-home- key pointer that donor patch 0011 guarded. Keep upstream implementations. DUKEY
- SMP release is a validation/port task, not discovery from zero. The journal reports four CPUs after using SRAMROM 0x10202000, offsets 0x34/38/3c/40 and the existing MediaTek release keys. The wrong 0x10002000 block truncated writes and CPUs timed out. Upstream's MT7623 boot data already implements the working layout. First release does not prove hotplug or SPM power cycling. K
- Audio silence has two experimentally distinguished causes. CON1 can give active DMA/IRQs without driving the external pads; CON3 drives the second I2S. Separately, a digitally responsive CS43131 reset when I2S began with VGP2 off. VGP2 at 1.8 V restored the analog path on their board. This corroborates our second-I2S work and makes PMIC supply ownership a concrete shared M2 prerequisite for M3. DAC probe success alone is insufficient. A
Evidence tags: H = CONFIRMED ON THEIR HARDWARE, as reported by the author (direct retained capture is identified explicitly); B = SOURCE/BSP-DERIVED; I = INFERRED; X = EXPERIMENTAL; W = WORKAROUND; K = KNOWN BUG; ? = UNKNOWN. Tags apply to the stated finding, never automatically to our Y2. Donor filenames below refer to the pinned snapshot indexed in donor-files.tsv. The comparison column includes our actual hardware limits, not just our plans.
| Subsystem | New information / evidence | Strength | Matches our evidence? | Donor / Linux 6.18 comparison | Phase / action |
|---|---|---|---|---|---|
| RAM, LK, carveouts | Stock MemTotal 994204 kB is reported, not allocator ownership. A traced stock modem load at be000000 overwrote their HYP trace ring; its 22 MiB span also covered the stub at be800000. Excluding RAM from Linux did not block explicit access. K | H/K for collision; ? for free RAM | Supports our modem exclusion and DMA warning. Does not resolve LK heap extent, bf700000 scratch lifetime, secure aliases or all bus masters. | Donor main bank ends be000000 and relocates CONSYS reservation to bdf00000. v6.18 ARM lowmem/HIGHMEM and DMA ownership still require our own policy. | M2 #22: pursue useful large-bank reconciliation; no new safe interval established, D08 unchanged. |
| SMP | Wrong SRAMROM base caused truncated keys/timeouts; corrected base reportedly brought up four cores around 0.4 s. K | H/B | Our CPU0 works; secondary startup remains untested. | Small MT6582 match to upstream MT7623 boot data in platsmp.c; no need to copy a CPU power sequencer for first release. USMP | M2 #28: validate boot state/coherency/IRQs, then adapt; hotplug remains separate. |
| Clocks / PLLs / gates | clk_ignore_unused prevents a reported wedge because consumers still inherit clocks. Claimed verified PLL probes are missing. K | H/W; B for tables, ? for exact rates | Our narrow USB mux/gate/PLL-enable snapshots work; they do not measure the complete clock tree. | clk-mt6582*.c still says best-effort parents, approximate postdiv and fixed 500 MHz VENCPLL; DT retains fake USB/I2C/GPU clocks. Current CCF helpers do not validate these numbers. | M2 #23/#28, M4 #30: derive parent/divider/gate contracts from retained BSP, preserve USB/scanout owners; no guessed retuning. |
| GPIO / pinmux / EINT | Five navigation GPIOs and APT32F wiring are described as stock-register verified. Missing GPIO112 mux caused a real cold panel failure. I | H(report)/B | GPIO6/7/9/10/54 feed our pending polled-input candidate; our board mapping remains untested. | gpio-mt6582.c inherits muxing. v6.18 mtk_eint needs base arrays and an explicit pin map; use proper pinctrl descriptions. UEINT | M2 #24/#28: capture current navigation candidate, then validated mux/EINT ownership. |
| IRQ polarity / GPU | Wrong Mali level-high IRQs stormed, were disabled, and led to ~200 ms polling; reported cube time improved 212→0.68 ms after level-low. G | H/K | Consistent with our sysirq-routed timer/USB success; no GPU test here. | Keep upstream lima + sysirq. Do not generalize “all IRQs low”: donor EINT parent SPI113 is high, PMIC EINT25 high, wheel EINT55 falling, keypad SPI116 falling. UIRQ | M2 IRQ foundations; GPU when needed under #28. Verify each domain, source and polarity. |
| PWRAP / MT6323 | Wrapper IRQ caused a reported storm; omission is explicitly an unresolved workaround. This is distinct from the PMIC's external interrupt. P | H/W/? cause | Our guarded WACS2 CID/VUSB/CHRDET reads and sync wait are stronger evidence for our transport. | Donor mtk-pmic-wrap.c omits wrapper IRQ; final DT does include mt6397-family MFD despite older prose. v6.18 MFD needs its PMIC IRQ; wrapper-error IRQ absence cannot justify omitting EINT25. UPWR | M2 #23: one serialized transport for USB/regmap; variant-scoped IRQ behavior, preserve probe-defer errors. |
| Regulators / battery / charger | VGP2 analog supply is a concrete consumer; charging reports and a four-second charger watchdog exist. Recovery's 450/1000 mA settings are programmed limits, not measured current. A | H/B/W | Does not fix our conflicting Android battery fields or establish safe current/temperature limits. | Use upstream MT6323 regulators. Correct donor charger unchecked writes, heuristic capacity and automatic re-enable; do not adopt recovery-charge policy. UREG | M2 #23 telemetry/rails; M4 #30 calibration, limits and policy. |
| Power key / volume keypad | Single-key patch fixes a long-press null pointer, not an inability to enumerate one key. Volume is a separate keypad controller. I | B; H report of operation | Neither is qualified on our unit. | v6.18 long-press code no longer uses nullable per-key pointers. Keep its driver; donor keypad still needs clock/lifetime/error review. UKEY | M2 #24/#23: PMIC IRQ + upstream keys, keypad gate/MEM1 contract; preserve long-press recovery semantics. |
| I2C / APT32F | Plain reads can start at a wandering internal pointer; donor uses register-zero write + repeated-start nine-byte read. Notes misleadingly describe relative/positional events; final driver emits UP/PAGEUP/DOWN/PAGEDOWN taps. I | B; H report of wheel use | Supports separate GPIO navigation and I2C rotation; our rotation protocol/mapping is untested. | apt32f-wheel.c validates 55/class3 but omits AA validation. Use v6.18 mt6577-compatible I2C only after real clocks, pins and AP-DMA ownership; its DMA-safe message buffers handle ordinary stack-backed messages. UI2C | M2 #24: bounded parser/errors, register alignment, direction/acceleration capture; no UI-specific key grammar assumption. |
| Panel / framebuffer | Later 360-line correction supersedes 368; GC9503V table is attributed to LK disassembly. ST7701 is an unimplemented revision possibility. D | H/B; ? our exact part | Our 480×360 RGB565 at bfb00000 agrees. bfb54600 is one frame later arithmetically, not evidence for changing scanout. | panel-gc9503v.c emits 360 and sync-pulse despite its comments; supply/reset/backlight relationships remain incomplete. | M2 #25: keep geometry; verify panel selection, LK table and reset polarity on our unit. |
| DRM / DSI | Old OVL address alias, format encoding, CONST_BLEND, live OVL reset and SOF takeover caused black/garbled output; computed PHY timing gave a green edge. D | H/K; W for empirical timing | Native takeover is untested here; current guarded display must remain available until quiescence. | v6.18 already gates PITCH_MSB behind AFBC. Port only remaining MT6582 format/route/quiesce/PHY differences with variant data; remove raw framebuffer/debug writes. UOVL | M2 #25: rate-before-prepare, bounded frame-boundary takeover, owned reset/pins and failure cleanup; retain USB throughout. |
| Cold display handoff | DSI MMIO hung before PHY power; GPIO112 mode1 and MMSYS reset at 1400013c restored the camera-visible panel. VGP1 guess unnecessary. R | H; X/W implementation | Our normal LK path inherits a live pipeline; direct-DA results are a different initial state. | bringup_phy/bringup_rate and userspace devmem explain donor recovery success but are not a complete kernel lifecycle. 328344000 derives from 27362000×24/2, not an arbitrary universal PLL rate. | M2 #25: specify live-LK and cold states separately; later cold support requires its own authorized scope. |
| Backlight | Four MT6323 ISINKs are ganged; operation reported. P | H(report)/B | Our illumination persists; independent brightness/control remains untested. | mt6323-backlight.c error handling, current ceiling and nonmonotonic step mapping remain defective; upstream LED/MFD/regmap support supplies reusable mechanisms, not board qualification. | M2 #25/#23: bounded monotonic map, verified current limit, exclusive ISINK owner and error propagation. |
| eMMC / microSD | Both working storage and later recovery enumeration/read-only setup are reported; MMC devices appeared after init started. No specific reproducible MMC CRC/tuning fault was found. S | H; ? timing margins | Our slot metadata is known; native read/DMA evidence remains absent. | Donor uses MT8135-compatible MSDC, real CCF references but inherited pins/fixed supply. v6.18 still requires pinctrl; the global optional-pinctrl patch masks real failures. UMMC | M2 #26/#28: clocks/pins/rails/DMA → bounded read-only SD, then scoped eMMC; observe asynchronous discovery and every late block node. |
| Rootfs / storage placement | Earlier “SPFT cannot write large data” claim is narrowed by a deterministic b80000 address shift that overwrote the filesystem body but preserved an old superblock. DA read and write address spaces differ. SDA | H/B/K | Our partition/recovery evidence remains authoritative; their installed layout differs. | This is deployment/address translation, not an mtk-sd CRC fix. Use v6.18 block/filesystem semantics and our own layout; do not import their blkdevparts, p1/p8 or self-installer. | M2 #26/#28; #32 retain offset/integrity and read-only-filesystem checks before any later storage deployment. |
| USB MUSB / PHY / ACM / ECM | Composite ACM+ECM worked; missing IRQ name mc prevented probe; HUPCL/DTR affected their getty. No comparable bounded reconnect acceptance was found. USB | H/B; ? reconnect | Our real LOG1 capture is authoritative. Host reader already clears HUPCL during capture and restores prior settings; it is not their getty. | Keep canonical PIO MUSB/guarded PHY. v6.18 supports standard gadget functions; donor fixed clocks/unguarded PHY writes are not an upgrade. | M2 #27: preserve USBACM-03, qualify pending -04/INPUT-01; ECM can follow a justified later need. |
| Watchdog / shutdown / reboot | AP watchdog and PMIC charger watchdog are distinct. Their DA reset diagnosis names the charger watchdog only as suspect; an HYP “armed” log was false because generic pets defeated the deadline. KI | H/K for harness; I for DA cause | Our early AP stop and owner recovery work; standard watchdog/poweroff are not qualified. | Use upstream MT6582 watchdog and MT6323 power controller through one PMIC owner; never import diagnostic watchdog policies. | M2 #28/#23 basics, M4 #30 lifecycle; actual reset/reboot evidence required. |
| AFE / I2S / DMA | CON1 yielded DMA/IRQs but dead pads; CON3/CONN0 drove GPIO43/44/46. FPGA_CFG1 bit4 did not read back and was retained only for fidelity. A | H/B; W for fidelity write | Corroborates our HAL/DL1/second-I2S inference. Native samples/rates remain untested. | mt6582-afe-pcm.c/common AFE API is the port base; v6.18 shared memif/DMA/ASoC helpers stay authoritative. No evidence here proves every suspected DMA race or a hardware rate maximum. | M3 #29 after M2: validate IRQ/ring lifetime and audible 44.1/48 kHz PCM; justify or omit nonfunctional fidelity writes. |
| CS43131 / amp / jack | VGP2-off brownout produced I2C -6/PLL_READY timeout when clocks began. OCA72559 ID09, EINT16 jack and wired/speaker audio reported on September 2. Speaker audibility depended on jack removal. A | H/B | CS43131/amp bus addresses match ours; amp silicon, rails and jack behavior require local validation. | Upstream cs43130 supports CS43131; donor machine and aw87559 need mute/error/unwind and exclusive route design. Older “three GPIO supplies” prose is superseded by final VGP2 VA/VP/VCP connections. | M3 #29; M2 #23 owns shared supply groundwork. Retain 22.5792 MHz/64-BCLK clues, measure actual rate drift and safe levels. |
| Audio underruns / scheduling | Direct playback was smooth while periodic process creation caused app dropouts; combined video load also starved a 128-frame graph. A 512-frame minimum improved that workload. MEDIA | H/report; W workload tuning | No native Y2Linux underrun/rate result. These are not evidence of a broken AFE DMA engine. | Use ALSA period/xrun/monotonic measurements with v6.18. Do not copy PipeWire, Flutter or their global buffer choice into our wired plan. | M3 #29: distinguish transport, clock drift, DMA and userspace starvation. |
| Wi-Fi / Bluetooth / WMT-STP | Cold Classic inquiry required complete modem firmware/filesystem startup, not just MD power or boot-ready; retained logs show 592 records and MD1 off at 14.708 s, with a 106.507 s A2DP result. BT | H (retained logs/results); W board-specific bootstrap | Consistent with our firmware clues; native cold behavior/calibration on our older board remains unknown. | Donor CONSYS/BTIF/fullmac plus platform bootstrap explains missing kernel-only prerequisites. v6.18 HCI/cfg80211 does not supply this MT6582 calibration sequence. | M5 #31: validate own firmware/calibration and cold/warm controls; never use another player's FS fixture or import userspace raw-MMIO ownership. |
| Bluetooth EDR / radio failures | EDR exhausted four ACL credits; Basic Rate restored playback. Reset/calibration order, stock address init, PA settle and leaving MD1 on failed to fix EDR. Interrupted calibration/restarts coincided with an unexplained reboot. EDR | H/K/W; ? root causes | Unreproduced on our board; no general radio-readiness promotion. | Patch0031 includes a controller-scoped quirk in generic HCI code, not a blanket all-controller ban. It is still an EDR workaround. Do not infer EDR success from an aptX/SBC codec name. | M5 #31: retain failed controls, localize any needed workaround, gate consumers on completed calibration, test interruption separately. |
| Haptics / thermal / DVFS / idle / suspend | Regulator-haptic/VIBR configuration exists; normal SPM handshakes are not thermal sensing. Product config explicitly disables suspend; no qualifying thermal/OPP/deep-idle result found. CFG | B for haptics; ? remaining qualification | These remain our open gaps; no battery-life or suspend proof to borrow. | Reuse upstream haptic/regulator mechanisms after board limits; donor SPM PCM/MFG mappings need proper shared regmap/DMA ownership. | M2 basic safety; M4 #30 optimization/suspend. FM stays excluded for this older unit. |
Keep M2-INPUT-01 as the next navigation hardware candidate and USBACM-04 for USB robustness. No rebuild is justified by this evidence-only change. First obtain identified evdev/USB/heartbeat results from the owner-run candidate; logging regressions stop further consumer integration.
The next provider work under #23/#24/#28 has a narrower, reviewable contract:
- Resolve CCF parent/divider/gate descriptions from retained BSP before enabling automatic gating. Track inherited USB and display dependencies explicitly.
- Transfer the existing persistent WACS2 claim into one serialized transport; USB CHRDET reads and regmap consumers must share its lock and preserve the observed sync-idle wait/refusal rules. Adding an independent upstream wrapper owner beside the diagnostic mapping is not acceptable.
- Separate wrapper-error IRQ from PMIC EINT25, then supply upstream MFD/regulators/ single power key. Add only identified ADC/status telemetry before charging policy. EINT55 + clocked/DMA-owned I2C unlocks wheel rotation; keypad is separate.
- Complete #22's loader/DMA/lowmem analysis before expanding RAM. Display takeover and MSDC then use the resulting provider/memory contracts; neither inherits Tempo's fixed supplies, unknown pin state or deployment layout.
For display, record register-layout capabilities rather than reapplying the 6.12 pitch workaround. Compute link rate from the selected mode, acquire clocks/ PHY before dependent MMIO, own panel reset through kernel pinctrl/reset/panel interfaces, and quiesce inherited scanout at a bounded frame boundary. Eliminate permanent probe PHY references, module-parameter fixes and raw framebuffer markers. Mode/pin/rail values remain subject to our exact LK/BSP provenance and hardware validation.
This audit implements the research/strategy part of M2, not a new hardware slice. No kernel/config/DT/PID1/logging implementation, build, flash or partition access occurred. Roadmap reassessment retains every exit criterion and existing issue owner. M3 and M5 information is retained now; their implementation remains gated.
The LK recovery-entry analysis additionally identifies software RTC/MISC requests but no physical recovery-key check in its analyzed FM LK. This is B, not a new observation of our installed loader. Retain it under #32 for later recovery design; it neither changes our working runbook nor authorizes MISC/RTC/loader writes.