[brkosebay]

iPad 5 (J71t) port: three PRs, in release order

1. Add iPad 5 Wi-Fi (J71t) hardware support #6: kernel series, device data, firmware recipe, recovery and runtime
2. Add the iPad 5 Wi-Fi (J71t) adapter and multi-adapter discovery cli#2: J71t adapter and multi-adapter discovery
3. Build Omarchy A for iPad 5 Wi-Fi (J71t) beside J71b omarchy-a#4: J71t image and release

Kernel source: brkosebay/linux a9/orchard-j71t · Project: brkosebay/omarchy-ipad5

Summary

This PR adds a second device, iPad 5 Wi-Fi J71t (iPad6,11, A9 S8003, DFU
CPID 0x8003, BDID 0x10), beside J71b. J71b behaviour is unchanged.

• Device as a parameter. The runtime, recovery, launcher, component and
  quiet-boot producers take a device/profile argument that defaults to j71b.
  The device API in runtime/j71b/ is shared. It derives its profile from its
  install directory (/usr/libexec/orchard-<profile>) and keeps the
  per-device storage fence and J71b's touch-role firmware in small tables.

• J71t device data. devices/j71t/device.toml and a firmware.json recipe
  (20 entries) against the public iPadOS 16.7.10 IPSW (the last line for
  iPad 5):

  • BCM4355 C0 "feara" Wi-Fi (one image plus all nine NVRAM variants under
    brcmfmac's Apple board names).
  • Bluetooth patchram from BlueTool, SmartIO and the video-decoder firmware
    (vxd-deva.bin) from the kernelcache, and the N1 touch packet from
    J71t.mtprops.
  • Touch, ambient-light and charger calibration and the Bluetooth address
    come from the device's own ADT (j71t-adt generator, in the CLI PR).
  • The Wi-Fi MAC and calibration go through m1n1, as on J71b.

• J71t recovery and runtime.

  • boot/initramfs/j71t/recovery/ holds init, the "J71t Recovery" USB
    identity and boot arguments.
  • runtime/j71t/phase2-hardware releases the PCIe host and ANS that the
    kernel holds at boot, fences storage, then loads touch, Bluetooth and the
    charger.
  • j71t-check-platform is the read-only check in the installed system.

• m1n1. boot/m1n1/patches/j71t/ adds two generic A9/A10 kboot patches:
  the NVMe host-memory-buffer region and Wi-Fi calibration from the
  uart2/wlan node.

• Kernel. kernel/patches/j71t/ is 12 per-feature patches against the
  pinned 6831bc701a, in git format-patch form. Each patch is one commit of
  brkosebay/linux a9/orchard-j71t,
  so the source behind every patch is browsable. The series is the release 2
  kernel of the omarchy-ipad5
  port, which passed 13 of 13 device checks, minus the parts listed below.

  Patch	Contents
  0001	S8003 PCIe host, ANS NVMe with a boot-time write window, DART, PMGR states, watchdog
  0002	BCM4355 Wi-Fi (brcmfmac) and Bluetooth over the Samsung UART
  0003	SmartIO, SIO DMA, S8000 SPI
  0004	N1 touchscreen
  0005	CS42L81 codec and S8000 MCA audio
  0006	D2365 PMIC GPIO, charger with source detection, Lightning power role, bq27540 gauge, thermal, CPU frequency
  0007	DWC2 gadget, Lightning host role, USB PHY
  0008	CT819 light sensor, pinctrl, DWI backlight
  0009	Native display: ADBE KMS on the pipe iBoot leaves running (panel eDP-1)
  0010	VXD stateless H.264 decoder
  0011	S8003 and J71t device trees
  0012	MAINTAINERS

  kernel/configs/j71t/config was resolved with this repository's clang-19
  toolchain image. kernel/devicetree/j71t/build uses the kernel's
  s8003-j71t.dtb with a pinned SHA-256.

• CI. The kernel job builds a device matrix (j71b, j71t). The tools
  job builds a quiet loader per device, and assets packages
  <device>-components.tar.gz.

  • J71b's bundle name is unchanged.
  • The published kernel source archive is now kernel-source-<device>.tar.gz,
    so J71b's was renamed from kernel-source.tar.gz. This is the one
    J71b-visible change.
  • reuse_run_id cannot reuse hardware-tools artifacts from runs before
    the per-device layout.

Why these choices

• Storage. The J71t NVMe driver stays read-only except for a boot-time
  nvme.write_window=NSID:FIRST-LAST. Only Write commands in that range reach
  the controller (no trim, Write Zeroes, Format, Sanitize, firmware or
  namespace commands), and namespaces 2–7 stay read-only regardless.
  • Orchard picks the target after boot, so recovery opens all of namespace 1
    and uses the same block-layer fence as J71b: phase 2 sets every
    nvme0n1p* read-only, and the device API makes only the confirmed target
    writable.
  • The runtime accepts any namespace-1 window, so a recovery built with a
    narrower one keeps a kernel-level fence.
  • Reloading NVMe with the chosen target's window would be stricter. It needs
    an ANS re-probe that has not been validated yet; happy to discuss.
• Late private firmware. Orchard delivers private firmware after boot, and
  the J71t charger, for example, silently disables charging writes if its
  calibration is missing at probe. So the drivers that read private data at
  probe are modules, loaded by phase 2 or by the installed system's udev. Wi-Fi
  is built in but probes only after phase 2 releases the PCIe host. The video
  decoder is built in (it calls pr_flush, which modules cannot use) but
  probes without firmware; it loads its firmware only when booted through
  debugfs.
• Display. The ADBE driver is built in and takes the framebuffer over from
  simpledrm during boot. It only adopts the mode and pipe iBoot leaves running
  (no timings, clocks or link training). apple_adbe_drm.enable=0 keeps
  simpledrm.
• Kernel series scope. Only device-validated code is ported. The series
  leaves out:
  • GPU research code (it embeds captured Apple programs).
  • SEP and the Touch ID sensor transport (experimental).
  • The AOP accelerometer driver: it can only be built in, its cold start
    needs a release step from the port's own initramfs, and its firmware and
    calibration need extractors the CLI does not have yet. A follow-up.
  • Diagnostics-only and kexec-only code (boot watchdog, DVFS observer,
    CPU idle experiments, driver-core tracing, kdump pstore, the display probe
    module).
  • Opt-in overclocking, which is compiled out by the config.
• Charging. The power patch is the device-validated release 2 charger
  code. A fix for wall and USB-C chargers is in progress; it will follow as a
  separate commit on this PR, changing only patch 0006, after it passes on the
  device.
• Video decoder provenance. The decoder's CAVLC table is generated from the
  GPL-2.0 Imagination Technologies/Texas Instruments h264_vlc.h, which is
  included with its notices and the generator. Its firmware is not in the
  kernel; Orchard extracts it from the IPSW kernelcache and pins its SHA-256.
• Shared J71b directories keep the diff small. I can move the shared
  runtime and recovery tools to neutral names in a follow-up if you prefer.
• No J71t shared launcher yet. The launcher publishes device-agnostic asset
  names and needs a J71t Minimal Linux root, so device.toml has no
  launch_manifest, and orchard launch says none is published.

Testing done

• Unit tests. python -m unittest discover -s tests: 65 tests OK on Python
  3.12 and 3.9 (52 before). The new tests are test_j71t_data.py and
  test_device_profiles.py.
• J71b output. runtime.files() output for J71b compared with main:
  same file set, paths and modes. Only the three edited shared runtime sources
  and the derived hash list differ.
• m1n1. The J71t patches plus boot/quiet/m1n1.patch apply to d5a10ac52a
  and compile.
• Kernel series. Applied with git apply in order to 6831bc701a, the
  patches give exactly the tree of a9/orchard-j71t (tree hash checked).
• Kernel build. kernel/build j71t --resume, unmodified, in this
  repository's Containerfile image (Debian bookworm, clang 19.1.7), native
  mode on a Docker host (no Podman). The source was the pinned commit from a
  local mirror, not fetched from GitHub, and a parallel prebuild with the same
  flags ran first.
  • olddefconfig is byte-stable.
  • Image.gz 11.2 MB, kernel.release 7.3.0-rc1-orchard-j71t.
  • stage-modules.py staged 165 modules and ran depmod. Every
    module that phase 2 or udev loads is present; the display and video
    drivers are built in.
  • kernel/devicetree/j71t/build accepted the DTB (pinned SHA-256 matches).
  • runtime.files(..., 'j71t') over the staged modules, with the Omarchy A
    J71t image policy, produced the expected runtime.
• No captured GPU programs in the binaries. The 75 numeric arrays of the
  port's GPU research code were searched in the Image and all modules:
  0 matches.
• checkpatch.pl reports only style errors (DTS alignment indents in the
  ADT tunable tables, two trailing statements in the audio codec).
• Device. The same kernel (release 2 of the omarchy-ipad5 port) passed
  13 of 13 device checks on one iPad6,11 J71t (iPadOS 16.7.10), booted through
  that port's own path, among them: USB gadget, NVMe root with a kernel write
  fence, Wi-Fi, Bluetooth, touch, sound devices, battery and charging from a
  computer at up to 2.4 A, light sensor and brightness, and the native
  display's brightness slider (accelerometer and auto-rotate also passed but
  are not in this PR). The previous release, with the same audio and decoder
  drivers, verified stereo playback, microphone capture and bit-exact H.264
  decoding of a test stream.

Not tested

• Orchard flow on a J71t. The Orchard recovery boot, mixin, phase 2,
  install and handoff have not yet run on a J71t.
• Phase 2 ordering (PCIe/ANS release, module loading) and the
  whole-namespace window with block-layer fencing are new for this device.
• Wi-Fi file layout. brcmfmac's apple,feara image fallback and per-module
  NVRAM names are checked against the driver source. Our unit loaded the more
  specific -XX names.
• Charging from wall and USB-C chargers. They do not charge correctly with
  this kernel: the input stays at the 500 mA floor and the battery drains with
  the screen on. Computers charge at up to 2.4 A.
• IPSW. No full IPSW download/extraction run. Pinned SmartIO, DEVA, HCD
  and N1 hashes were reproduced from the same build's files.

How to test

1. python -m build, install the wheel, then run
   python -m unittest discover -s tests.
2. kernel/build j71t --output out/kernel/j71t (Podman, or native as in CI).
   boot/m1n1/build j71t --output out/m1n1.bin.
3. Device test, in DFU: orchard devices (expect CPID 0x8003, BDID
   0x10). Then boot a J71t recovery and run orchard prepare. Phase 2 must
   report wifi, storage-fence, touch, bluetooth, charging-policy and
   hardware-ready, with every nvme0n1p* ro=1. The panel should be eDP-1
   under /sys/class/drm.

Credits

• Pauli1Go. The A9 work builds on Paul Praschl's (Pauli1Go) HoolockLinux
  T8010 PCIe/ANS, SmartIO, SIO DMA, D2365 charger, Wi-Fi and Bluetooth work,
  which includes code by Corellium LLC.
• Imagination Technologies and Texas Instruments for the GPL-2.0 decoder
  table source.
• HoolockLinux. The kernel and m1n1 bases are HoolockLinux's.
• Orchard's J71b port is the reference design this follows: the device
  runtime, recovery, mixin and fencing model.

🤖 Generated with Claude Code

[brkosebay]

Update: J71t charging is validated; added as one new commit (nothing rewritten)

• New patch kernel/patches/j71t/0013-j71t-charging-sources.patch. It is the new commit 0dd7ae0 on a9/orchard-j71t, which fast-forwards from 4dfc90d. Patches 0001–0012 are unchanged.

• What it changes (8 files: Apple power drivers, bq27xxx, the USB gadget core's current notifier, ABI docs):

  • The Tristar power role reads the USB-C CC advertisement through Apple's USB-C to Lightning cable, capping 3 A sources at the 2.4 A board maximum. It keeps BC1.2 results across the cable's ID exchange and prefers an enumerated USB host over an early BC1.2 reading.
  • The D2365 charger restores its policy limit after the PMIC's attach default instead of treating it as a weak source.
  • bq27xxx reports Discharging on negative current, also at 100 %.

• Validated on an iPad 5 Wi-Fi (J71t) on 2026-10-27, using the same charger code through the omarchy-ipad5 port's boot path:

  • computers over USB-A, and a Mac USB-C port through Apple's USB-C to Lightning cable;
  • a USB-C wall charger;
  • a Mac USB-C power adapter.

  All of them charge at 2.4 A, and the battery no longer drains on wall chargers. Charging is 5 V only: the iPad 5 has no USB Power Delivery.

• Config and DTB pin are unchanged. Rebuilt with the unmodified kernel/build j71t: olddefconfig is byte-stable, 165 modules are staged, and the DTB pin matches. Unit tests: 65 OK.

• Still not run: the Orchard recovery/install flow on a J71t.

[henrikklee]

Thank you, Berkay. This PR is now integrated on the layered kernel stack, on feature/j71t-integration. Your branch hasn't been touched.

Every kernel patch there keeps you as author, and its [Orchard: …] note names your original commits (a9/orchard-j71t, the granular a9/* branches, omarchy-ipad5 rounds) and an item in docs/integration/j71t.md. That document's ledger goes through this PR topic by topic: what was taken as is, what was reworked to fit the shared drivers, and what stays in your research tree (kexec paths, diagnostics). It explains why for each. Several of your findings apply beyond the iPad 5: the DART table format, NVMMU ordering, the shared-MSI completions, the SIO tags, the SPI CS delay fix and BC1.2.

Charging (0013): BC1.2, the CC reading through the USB-C cable, the Apple host grant and the bq27xxx status fix are all in. The policy differs in one point: sources that identify nothing get 500 mA instead of 2.4 A (ledger 6.5–6.7).

Next is your device test on the new stack; the doc has the setup and a staged plan. Once it passes, update this PR with the integration branch and your fixes, or open a new one, whichever you prefer.

[henrikklee]

Thanks, Berkay! Closing this one, since its work moved on: the shared part is on main, and the iPad 5 part continues from feature/j71t-integration and your device test in #28. We'll bring your patches onto main from there, with you as author.