The FP6 is 4x Cortex-A520 + 4x Cortex-A720 and this image boots nothing
else, so pass the compiler KCFLAGS="-march=armv8.6-a+fp16fml+aes+sha3+sm4
-mtune=cortex-a720". The stock arm64 build gives the compiler no arch flag
at all (so one image can boot any Armv8 board).
The string is what `gcc -march=native` derives on the phone, re-based on
armv8.6-a so clang can express the same set (clang has no flagm2/rcpc2/
frintts tokens; it reaches them through the architecture level). 8.6 is the
highest level whose mandatory set the phone exposes: 8.7 would assume WFxT
and 9.x SVE2, and neither is in its hwcaps or ID registers. clang emits
identical code for this and for -mcpu=cortex-a720+nosve+nomemtag; the
difference is only which system features (SPE, ETE, TRBE, FPAC) it knows
about, none of which generate code.
Verified on eef717f978f1 with the aport config: builds with zero warnings,
same module set as r100 (417), compat vDSO untouched, boots the dev phone
with a clean dmesg and a GREEN selftest. Record:
fp6 journal/base/captures/2026-09-05-mcpu-a720-verification.md.
CI run 52 failed at minute 57 with `fp6-vendor-blobs-extract: FAILED` from
abuild's checksum verification: 9575e55 changed the extractor and left its
sha512sums entry alone. Nothing was installed or published; latest is the
run-51 image.
Fix the sum, and stop paying an hour to learn it. check-aports.sh sources
every APKBUILD under aports/ and compares the committed sha512sums of its
local source files (scripts, units, configs, patches, including ones in a
subdirectory) against the files themselves. build.sh runs it before
pmbootstrap touches anything, so this class of mistake now fails in the first
seconds of a run and prints the line to paste. Aports whose sums build.sh
regenerates with pmbootstrap checksum are read from build.sh and skipped, so
the two lists cannot drift.
Verified: the checker reports exactly the run-52 mismatch on the tree as
pushed and nothing on the tree as fixed; a scratch copy with one corrupted
sum is caught; the fixed aport builds under abuild in an alpine:edge
container (the only complaint was the throwaway signing key at the index
step, which the CI's pmbootstrap flow does not have).
The fingerprint stack needs /dev/tee0, and the pmOS config has never built the
driver -- so every session so far has loaded an out-of-tree module. That has
been recorded since 2 September as the release blocker, on the reading that
drivers/tee/qcomtee/Kconfig's `select QCOM_TZMEM_MODE_SHMBRIDGE` would flip
tzmem out of Generic mode and drag a boot+selftest round with it.
It does not. QCOM_TZMEM_MODE_SHMBRIDGE is a member of a choice block, and
Kconfig cannot select a choice member -- the statement is inert, and silently
so. Setting CONFIG_QCOMTEE=m and running olddefconfig against the tree
produces exactly one line of difference and leaves CONFIG_QCOM_TZMEM_MODE_
GENERIC=y, which is the mode every fingerprint measurement was taken on.
The driver is already in the base tree; the only reason it was out-of-tree
here was that nothing enabled it. Verified on the dev phone: the module built
from this config carries ZERO module parameters against the research build's
95, matching vermagic, and the phone boots on it with modules-load.d bringing
it up, /dev/tee0 present, fingerprintd ready and the enrolled template
loading. So the shipped module is upstream code on the tested tzmem mode.
Not pushed. Whether to ship QCOMTEE with tzmem in Generic mode is a separate
question with a real answer -- journal/tee warns about that mode -- and it is
now sequenceable on its own instead of forced by a select that does nothing.
The fingerprint matcher is a proprietary OEM-signed trustlet, and it is not
shipped as one file: QTEE images live in the modem partition's image/ as an
ELF header+hashes file plus one payload per program header, and the loader
wants each payload written back at its segment's p_offset. So the existing
file directive cannot reach it.
An mbn directive does, with the same guarantees file has: the sha256 is of
the reassembled image, a mismatch tries the next partition, and an unverified
image is never installed. Reassembly is not a concatenation -- segments are
page aligned but not contiguous, gaps stay zero, and two pairs of focal64's
nine segments share an offset, so they are written in index order and the
later one wins, exactly as the bring-up repo's reassemble.py does.
Verified on the dev phone against the hash QTEE has actually accepted since
August: 3600472 bytes, sha256 1930c490..., reassembled from the phone's own
modem_a. The retry path was verified too, with a deliberately wrong first
partition -- which is how the variable clobber got caught: POSIX sh has no
locals, and reassemble() taking rdir= rewrote its caller's copy to the mount
path, so the second partition would have been searched at $MNT/$MNT/...
The fast path needed teaching as well: mbn's dest is the fifth field, and a
first boot would otherwise have exited early and extracted nothing.
Not pushed. The consumer fragment lives in the fingerprintd package.
The preset fix (6ecc1dc) makes the unit run, but multi-user is too late: the
sound card probes at ~21 s, hard-fails (-2, no retry) on the missing ACF, and
the extractor's amp rebind at ~60 s cannot re-form a card whose machine
driver already failed. Re-probing the machine driver does re-form it, but a
late-formed card has a dead capture path - the wcd9378 TX sequencer refuses
PS0 (act_ps 0x3) until the next boot. So rebinding after the fact can never
fully win; extraction has to happen before the drivers probe.
- fp6-vendor-blobs.service: DefaultDependencies=no, run after remount-fs and
before systemd-udev-trigger, so blobs exist before module coldplug.
multi-user stays a second Wants as a post-udev retry if the early run
failed (by-partlabel/make-dynpart-mappings fallbacks need udev).
- aw88261-acf.manifest: add 'rebind platform sound' so the fallback path at
least recovers playback the same boot (capture then heals on reboot).
- fp6-vendor-blobs.post-upgrade (pkgrel 1): systemctl preset + immediate
extract, so installs of the 2026-08-24 image (unit shipped disabled, no
version bump to deliver the preset) finally heal via plain apk upgrade.
- soc-fairphone-fp6-audio pkgrel 1: carries the manifest change.
Verified on the dev phone with the exact staged bytes (sha256-compared):
simulated fresh install (ACF removed, reboot) extracts at 13.3 s, coldplug
probes the amps at 15.1 s, card init at 20.9 s loads the ACF cleanly, and a
1 kHz speaker-to-mic loopback passes on that same first boot with zero TX
sequencer warnings; next boot takes the all-dests-present fast path in 25 ms.
Evidence: fp6 repo journal/blobs/, 2026-08-29.
Assisted-by: Claude:claude-fable-5
The package installs a multi-user.target.wants symlink, but that alone does
not survive image build: pmbootstrap runs systemctl preset-all, which removes
manually-installed .wants links for any unit whose preset does not enable it.
The 2026-08-24 image therefore shipped the service as
'disabled; preset: disabled' and it never ran, so aw88261_acf.bin was never
extracted from the stock vendor partition and a fresh install came up with no
sound card at all.
Reproduced and verified on the dev phone: with no preset file installed,
systemctl preset leaves the unit disabled; with it, the unit comes back enabled
and stays enabled across a full preset-all.
Investigation and evidence: fp6 repo journal/blobs/, 2026-08-28.
Assisted-by: Claude:claude-fable-5
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
pmOS's modem-gnss.service runs two qmicli calls, and the second --
--loc-set-nmea-types=all -- can never succeed on this modem: the LOC
engine answers QMI error 94 'NotSupported' to both get and set. That is
a permanent capability gap, not the boot race Restart=on-failure exists
for, so the unit failed and restarted every 30 s for the whole uptime
(restart counter 25 after 13 minutes; 165 over one evening). Its
StartLimit does not stop it either: 10 restarts at RestartSec=30 span
~303 s, just past StartLimitInterval=300.
Ship a drop-in that tolerates that one command's failure. The boot-race
retry stays armed -- a LOC service that is genuinely not up still fails
the first ExecStart. Nothing is lost: ModemManager issues its own
set-NMEA-types and takes the same 94 regardless, and location comes from
the Position Report path our modemmanager patches add.
Byte-identical to the drop-in verified on the dev phone (sha256
b0b5f71b0f25c3c5a8fc9e926f187412a6711da95f773234065f37ddcc1d3c6d):
across a reboot the unit runs once, Result=success, 0 restarts.
Assisted-by: Claude:claude-opus-5
Charger-insertion boots (androidboot.mode=charger, ABL-appended) divert to
a minimal charging.target instead of the full UI, ending the dead-battery
bootloop: ADSP charging/USB-PD runs, splash+panel killed ~6-10s in via an
initramfs hook, modem+cdsp stopped, radios/sensors suppressed, CPU capped.
Power key reboots to a normal boot, volume-up shows battery status,
volume-down enables USB ssh, unplug powers off. Measured >= breakeven on a
100mA-classified SDP port, strongly net-positive on real chargers.
Suspend duty-cycling (~13mA floor) exists behind an off-by-default flag:
resume from deep suspend intermittently kills the UFS link (hibern8 exit
failed ret=5) - do not enable until that kernel bug is fixed.
Byte-identical to the deployment verified on the dev phone 2026-08-24
(journal/power: r5 armed tests, crash autopsies, measurements).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The package declared BSD-3-Clause while shipping aw88261_acf.bin, a
verbatim proprietary Awinic blob extracted from the stock vendor
partition - an affirmative false claim about the file. Mark the license
compound (BSD-3-Clause AND proprietary) and document per-file provenance;
the durable fix (FairBlobs adoption or install-time on-device extraction)
is tracked in the audio journal.
Assisted-by: Claude:claude-fable-5
pkgver 7.1.2 -> 7.2.0; config regenerated from the pmOS 7.2.0-r0 config
plus the FP6 bring-up fragment (same enables as before), olddefconfig'd
against the rebased combined-stable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
milos-linux combined-stable now carries the camera-main merge
(af49850e65bd): camss C-PHY support, the IMX896 main sensor, the DW9784
AF controller and the board DTS for all three (the VL53L3 ToF node is
DTS-only for now, its driver is future work). Kernel config gains
CONFIG_VIDEO_IMX896=m + CONFIG_VIDEO_DW9784=m - the camss core, CAMCC
and CCI are on since the ultra-wide commit, and the libcamera side
(IMX896 tuning, contrast AF, AWB stabilization) already ships since
aport r8.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Kernel config: CONFIG_VIDEO_OV13B10=m + CONFIG_VIDEO_DW9714=m — the camss
core, CAMCC and CCI were already enabled; the sensor and VCM drivers were
the only missing pieces. The camera carries themselves land via
milos-linux combined-stable (merge of the 'camera' topic branch,
nondescriptpointer's 5 patches, authorship preserved).
libcamera: new temp/ aport overriding pmOS 99990.7.2-r1 with -r2, adding
nondescriptpointer's OV13B10 sensor helper (gain = code/128, enables the
software-ISP AGC/AWB) and sensor properties patches on top of the pmOS
0.7.2 APKBUILD. Patch sha512s re-recorded from the actual files (his
APKBUILD diff carried stale hashes); all four patches verified to apply
against the v0.7.2 tarball.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Full-system audit findings: without an explicit provider selection the
image installed real PulseAudio (Plasma Mobile hard-path), which claims
the card and ships a wireplumber fragment disabling hardware.audio -
zero sinks forever. Mirror the dev phone's world: pipewire backend meta
+ pipewire-pulse + echo-cancel in extra_packages, pulse meta banned via
apk conflict in fp6-device-tweaks. The two hand-made /etc audio
fragments (wireplumber no-ACP rule, AEC pair for VoLTE speakerphone)
move into soc-fairphone-fp6-audio.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Full-system audit on the flashed phone found the IMU dead: the journal's
documented reinstall-loss trio (inv-icm42600-spi modules-load - fallback-only
SPI node never coldplugs; the accel poll udev rule for auto-rotate; the
iio-sensor-proxy libssc-crash restart drop-in). All device-critical, none
personal - now packaged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two device-critical pieces previously applied only by the dev restore
script: masked sleep targets (idle-suspend resets the WCN combo firmware
and kills wifi ~40min - a device defect, not personalization) and imsd
enabled at boot, gated on /etc/imsd.env existing so unconfigured systems
don't boot a failing unit. A stranger now needs exactly: flash, wifi via
UI, write imsd.env, restart imsd.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
CI publishes every locally built apk to the instance's Alpine registry
(catbot credentials via the PACKAGE_TOKEN secret; step skips until it
exists). catcrafts-fp6-repo ships the registry signing key and appends
the repo URL - NOT yet in extra_packages: the registry must have its
first content before image builds may reference it (an empty repo's
missing APKINDEX would break apk in the build chroots).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
First flash boot reached systemd and died into emergency mode on
'FAT-fs (loop0p1): IO charset ascii not found': the tested phone config
never needed FAT NLS tables because the old install used an ext2 /boot;
the current device package uses a vfat ESP. Single flip, olddefconfig
roundtripped.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
imsd turns out to be fully public already (0.2.7 snapshot + emergency
stage 1 + the make build path) - no tag needed, same git-archive dance as
the kernel. callaudioshim was a load-bearing unpackaged home-dir script on
the phone (callaudiod replacement, working in-call mic mute); now an aport
autostarted at phase 1. kde-telephony's modem daemon autostart is hidden
via /etc/skel from the imsd package, mirroring the phone's user override.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Files copied byte-identical from the tested dev phone; installed to the
exact deployed paths (the spaced tplg/UCM filenames come from the machine
driver's card name). Wired into the image via extra_packages.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Kernel aport forked from pmaports 7.1.2-r0, repointed at milos-linux
combined-stable with the tested FP6 config (+EFI_ZBOOT for packaging);
imsd + nftables aports from the pending pmaports submission. build.sh
carries TODO(validate) markers - not yet run end-to-end.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
