Y2 CPU Final Fix02 physical qualification — 2026-09-29

Historical exact-image receipt. This report retains its named Fix image and dated result. It does not describe Baseline02 or negate the newer bounded UART01 C1/C2/C3 passes. See Baseline02 and latest CPU-idle hardware proof.

**Verdict: FAIL for acceptance as the normal Y2 CPU platform; the awake CPU platform is substantially qualified.** Timers, hotplug, QoS, thermal authority, MMC runtime clock gating, automatic core parking, PWRAP readiness and 1196/1300 MHz voltage DVFS pass on the device. The SRAM journal passes its awake self-test and warm-reboot retention, and every staged PM level passes on the same boot. Three defects remain: SLIDLE is refused by one bus-DCM register predicate, loaded USB upload still ends in a terminal IRQ storm, and full RTC deep suspend returns from SPM but resets 30 s later, after device resume and before pm_suspend exit. No implementation source was changed, nothing was built or flashed, no history was rewritten and nothing was pushed.

This supersedes the corresponding rows of the Fix01 physical report. The Fix02 receipt and source ledger remain software provenance. PASS applies to the bounded observed behavior; PARTIAL is incomplete evidence; NOT_TESTED never means a hardware pass.

Identity and evidence

Installed identity matched the candidate manifest before the first test and on every later boot:

Private evidence: out/cpu-final-fix02-physical-qualification/20260929T152328Z/ (restricted). It holds the unchanged harness run (harness/), every supplementary remote program with stdout/stderr/exit/duration/UTC (x-*/), the reused harness Run.suspend() receipts (suspend/), device-side staged-run directories, raw measurement snapshots, SRAM records, USB fault snapshots, qualification-summary.json and SHA256SUMS. No keys, bond secrets, NVRAM or calibration were exported.

The harness ran unchanged as qualify-cpu-fix02.py --run --host y2 --wifi-host y2-owner-wifi --allow-warm-reboot. The Wi-Fi alias came from a session-local SSH config, as in Fix01. It uses the pinned device host key and a temporary key-only dropbear on wlan0 started over USB. The listener was lost at each new boot and is gone at the end. The harness stops before suspend when any awake check fails. Its QoS and coordinator verdicts failed for harness reasons (below). Independent phases therefore continued through session-local scripts that reuse the harness helpers and its own Run.suspend() and usb_stress().

Timers, hotplug, QoS, thermal — PASS (regression gate)

GPT6 control 0x31 running; GPT4 gpt4_sole_owner broadcast (y2-gpt4-broadcast); admission prepared_13mhz, calibration 26000/26006/26000; CNTFRQ 13000000 on all CPUs, error 0; PPI29 arch_timer advances on all four CPUs; clocksource arch_sys_counter; all local events arch_sys_timer; hrtimer_interrupt and oneshot broadcast; hres 1 and nohz 1 per CPU with stopped ticks observed. 100 requested 1-ms sleeps: medians 1.09 ms on every CPU, p95 ≤ 1.133 ms. Nine individual CPU1–3 re-onlines plus 4→1→4 completed; taint 0. Identical on boots 3/4.

All eight workload classes were accepted with their floors (Idle/PlaybackNormal 0, PlaybackHeavy/Interactive/ArtworkDecode/LibraryScan 747.5 MHz, NetworkTransfer/Maintenance 598 MHz). Overlap, renewal, expiry and killed-child cleanup work. The cpufreq cooling device at max capped the policy at 598 MHz despite a live PlaybackHeavy lease (restored to 0). Real input: Back key → Interactive lease after 22 ms, lasting ≈274 ms; click-wheel likewise; screen-off drops Interactive immediately and wheel input while dark adds none. Real producers observed: PlaybackNormal, PlaybackHeavy, Interactive, LibraryScan, NetworkTransfer, Maintenance. C1 WFI usage/residency advances; rejected 0.

The harness QoS FAIL is a harness defect: it injects KEY_UP (103) into "Y2 navigation buttons", which Reborn maps only for 28/158/105/106/164.

MMC runtime clock gating — PASS (storage), with one media-lifecycle defect

y2_runtime_pm for eMMC (11230000.mmc) and SD (11240000.mmc) reports gated=1 at rest, suspends/resumes balanced, retained equal to resumes, restored=0, last_mismatch=0x0 and error=0. The only refusals are refused_request (a pending request, the intended retry). DMA, controller, FIFO and interrupt refusals are all 0. CCF shows y2-msdc0/y2-msdc1 gates with enable/prepare 0, hardware N. The harness 1-MiB eMMC and 64-KiB SD checks pass. A further 8 × 1 MiB eMMC and 8 × 512 KiB SD rounds each wrote, fsynced, dropped caches, observed the host re-gated, then read back. All 16 SHA-256 matches passed. ext4 error counters stayed 0, mounts stayed rw, and there were no MMC CRC/timeout/reset lines.

Defect (non-CPU, SD media lifecycle): media.inventory() identifies the SD by the kernfs inode number and ctime of /sys/class/block/mmcblk1*. Dropping caches evicts those kernfs inodes, and the recreated inodes compare as a changed inventory. The readiness loop then unmounted and remounted /media/sd twice during the test. One scratch file survived its unlink because the unlink ran against the momentarily empty mountpoint. Test-provoked here, but ordinary memory pressure reclaims kernfs inodes too. No data was damaged.

SLIDLE — FAIL (single identified predicate)

With radios on, the clock-blocker mask while parked is 0x100800 (APDMA + BTIF, the CONSYS transport). That is legitimate while Wi-Fi/BT run. MSDC0/MSDC1 are no longer persistent blockers; they appear only transiently.

With radios runtime-off, screen off and no forced topology/frequency, the coordinator parked naturally. The clock mask read 0 for 200 s, yet entries stayed 0: every attempt then failed slow_reject_bus (0 → 20809). In y2_ccf_slow_idle() that is readl(TOPCKGEN+4) != 0x0f. dormant_preflight reads the same register as bus=0x0 on this board. Stock bus_dcm_enable writes 0x8f and its disable clears bit 7, with no inherited-value check. The Y2 predicate assumes an inherited 0x0f that this boot chain never sets. This is the same class of mismatch as Fix01's PWRAP 0x1ff/0x7f. Nothing was overridden. Attempts/entries 61924/0, restore failures 0, broken N.

Automatic core parking — PASS; one attribution defect

Harness 240-s silent screen-off window: CPU3, CPU2, CPU1 powered off at 546.2/551.3/556.5 s (5-s pacing) after eligibility, parked_mask=0xe, online 0, last reset none, load 161 mc, high-frequency 214‰. Display wake restored 0-3 in 0.63 s. The radios-off run and the 330-s measurement parked the same way and stayed parked. Manual offline/online during hotplug tests was never claimed. The harness coordinator FAIL comes from requiring C2 entries in the same verdict.

Defect: after a user wake the state shows `last_reset=burst reset_burst=1 pressure_restores=1 hold_ms=120000`. The wake's render burst is counted as a pressure restore, which doubles the parking hold (up to 960 s, reset after ten stable parked minutes). Frequent real wakes would delay parking.

Screen-off CPU behavior — improved (CPU idle improvement, not battery)

Busy CPU time falls about 3.6×, IRQs 2.3×, context switches 1.4×. Measured in the same configuration (radios on, USB attached, charging). Harness attribution over 243 s: Reborn 8.19 s CPU, three long-lived platform Python daemons about 2.9 s each, y2-bt-reconnect 0.75 s. The harness percent_of_one_core field is 10× too large (harness defect). Dark bursts now reach 1300 MHz @ 1.25 V for 8.8 % of the time. No electrical power was measured.

PWRAP / high OPP — PASS

pwrap_readiness: `mux=0x0 wrap_en=0x1 hiprio_arb_en=0x7f implemented=0x7f wacs2_en=0x1 init_done2=0x1 live=ready last=ready`, DVFS slots 0x21e:0x58/0x50/0x48. Automatic admission qualification_max_khz=1300000, bin Y, voltage_fault=N. admission_error=1 is freq_qos_update_request()'s positive "changed" return, i.e. success (cosmetic).

Five cycles of 1040→1196→1300→1196→1040→598→1040 (30 steps) reached exact clock/voltage every step, last_error=0 first_error=0. There is no tracefs, so ordering was checked by a concurrent sampler on CPU3 (7796 frequency-then-voltage pairs). No UP-direction violation occurred. The four (high clock, lower voltage) pairs all fell 2 ms into DOWN steps, which is the read-order artifact expected from clock-before-voltage. The intermediate (1196 MHz, 1.25 V) was observed. Sampled evidence, not a hardware trace.

Four-worker SHA/zlib integrity: 1040 MHz 16647 iterations, 1196 MHz 18604, both with 0 errors (peak 71.5 °C at 1196). At 1300 MHz, four workers reached the 75 °C test guard in 16.8 s and were stopped. Two workers ran 5247 iterations with 0 errors (peak 64.5 °C). No voltage fault or fallback. The DT cpu-thermal trips are the BSP 110 °C passive / 120 °C critical, so the natural trip is NOT_TESTED under the new 1300-MHz ceiling. The cooling-device override passes.

USB loaded transfer — FAIL, attributed

Wi-Fi observed before and after. Both runs (boots 1 and 3) lost USB in the first 1-MiB upload round: 0 of 10 successful. Classification is IRQ storm, fault_reason=irq_overflow, rc=-75, irq_max_burst=513 > 512. It is not a power-read transient, not reconnect timing and not a DMA bus error: monitor_failures=0, reconnect_retries=0, dma_bus_errors=0×8, irq_unexplained=0.

Fault snapshots: boot 1 L1 0x182/0xf (RX pending), rx=2/1e, EP1 RXCSR 0x0003 (RxPktRdy|FIFOFull, 512 B) with DMA channel 5 (cntl=0x618, EP1 RX) complete. Boot 3 L1 0x108/0xf (DMA pending), DMA_INTR=0x20 (channel 5), EP1 RXCSR 0x2003 (DMAReqEnab + RxPktRdy + FIFOFull). Both are the host→device EP1 OUT bulk path under Inventra DMA. An RX completion/next-packet condition keeps re-asserting instead of being acknowledged and re-armed. The UI stayed alive and the transfer mode fell back to PIO. The fault is terminal by design and has no runtime recovery hook, so recovery was an ordinary reboot over Wi-Fi.

SRAM diagnostics — PASS

Awake self-test: result=pass, sequences A=1/B=2, slot alternation, previous record preserved, reset stamp written and restored, ring verified, phys 0x10dc00 size 0x500. One ordinary warm reboot: new boot ID, `previous_valid=1 previous_sequence=2 previous_stage=SELFTEST_B selftest_scratch=retained previous_ring=valid`. Retained records and the device callback ring were also valid after the RTC backstop reset (below).

Charger and staged suspend — PASS

With USB attached the charger was charging_active (CONSTANT_CURRENT). A staged devices request produced y2_charger_prepare_pm returns -16, "not prepared for power transition", clean suspend exit, same boot, taint unchanged, no WARN, retained failed_stage=DPM_PREPARED error=-16, radios restored. The harness marked it FAIL only because the charger's prepare entry had scrolled out of the 24-entry ring. After the owner unplugged USB: no_usb, NO_SOURCE, no refusal.

Full RTC suspend — FAIL; exact boundary

Pre-flight: RTC wakeup enabled, PMIC EINT25 → RTC IRQ20 / keys IRQ5, SPM SPM_CPU_SHUTDOWN_INFRA_RETAINED not broken, backstop provider present. Alarm +30 s armed 16:18:37 UTC; kernel_suspend 16:18:44; RTC due ≈16:19:07. The device came back as a new boot; its kernel started ≈16:19:40, a reset ≈30 s after wake. This is the backstop period (panic=0 would hang, not reboot). The reset cause register is not decoded (not_observed).

Retained previous record (valid, sequence 138): reset_resume_entry=0x59325253 (the Y2 resume stamp, never observed in Fix01), SPM wake 0x20, cirq=0x3, boot_vector=0x8047ca20, PCM 0x8495e000/596, wake_mask=0xfedfbfdb, rtc_enable=0x5, last stage DEVICES_RESUMING, failed stage none, error 0. The callback ring (cycle 101 = this attempt) ends with balanced phase=8 complete enter/leave pairs through the last device. **SPM entry, RTC wake, Boot-ROM resume vector, CPU context restore, syscore, secondaries and all device resume/complete callbacks happened.** The kernel then did not reach Y2_PM_EXIT within the 30-s backstop. Userspace never logged after resume and y2-suspend never wrote RADIOS_RESTORING.

The unmarked window is resume_console → platform_resume_end → suspend_finish (thaw, PM_POST_SUSPEND notifiers, console restore). No mark pings the backstop between DEVICES_RESUMING and EXIT. The exact stalled call inside that window is not established. The harness start step also misparsed rtc-alarm's own JSON output and retried after the suspend had already launched (harness defect; no effect on the device path).

C3 DORMANT — NOT_TESTED (not eligible)

dormant_preflight: unmet=topology,frequency,domains,clocks,bus. It needs one CPU, ≤747.5 MHz, domains 0xe0a (CPUs, CONN, DISP) off, PERI blockers 0x21e8ffd / INFRA 0xa0a0 clear, and bus=0x0f. The last shares SLIDLE's predicate. C3 stayed disabled (disable=1, CPUIDLE_FLAG_OFF); nothing was forced.

Intelligent CPU workload matrix

Direct /proc and cpufreq/cpuidle deltas; CPU and C1 normalized to four-core capacity; OPP order 598/747.5/1040/1196/1300 MHz; voltage follows the OPP table per readback. Observer overhead is included. Per-core values are in x-matrix/analysis.json.

Playback ran with fixture silence; zero-XRUN/fidelity was not re-certified. Crossfade was set through the real UI and restored to 0. Playback leases keep all cores online by design.

Cleanup and owner actions

Final boot 6bb70fad…: identity unchanged, four CPUs, schedutil 598–1300 MHz, cooling 0, C3 disabled, crossfade 0, playback stopped, fixtures and scratch files removed, original three library tracks present. Wi-Fi associated, CONSYS calibrated with 0 errors, BT controller up, DSI connected, ALSA/GPU present, Reborn health ok, root/data/SD rw, ext4 errors 0, taint 0. The temporary Wi-Fi listener is gone. Device-side staged-run receipts remain in /data/system/platform/fix02-* and are copied to private evidence. Reborn's queue still lists the removed fixture entries.

Owner physical actions, exactly two:

1. Unplug USB (charging was active; required for devices+ stages).
2. Reconnect USB after the RTC backstop reset (Wi-Fi listener lost with the boot).

No Power press, shell command, log inspection or frequency selection was needed.

Acceptance answers

One coherent Fix03 correction batch

Scope: resume completion, bus-DCM baseline and EP1 RX DMA servicing. No CPU architecture change.

1. Resume completion. Mark and ping the backstop at every step from

   dpm_resume_end to Y2_PM_EXIT (after resume, complete, resume_console, platform_resume_end, thaw and PM_POST_SUSPEND). Stamp ring entries with a monotonic ms value. Decode the RGU reset status into boot.json. Then take one RTC attempt to name the stalled call and fix that call only.

2. Bus DCM. Establish the source-backed baseline of TOPCKGEN+4 (Y2 reads

   0x0, stock clears only bit 7 on exit). Reconcile the SLIDLE and deep-idle predicates with it, as PWRAP was reconciled, keeping the verified write and exact restore.

3. USB EP1 OUT. Align RX DMA completion, DMA_INTR acknowledgement and

   RxPktRdy/DMAReqEnab re-arm for channel 5 with the MT6582/Inventra reference, using the two captured snapshots. Keep the storm guard terminal.

4. Coordinator and media. Exclude display/workload restores from

   pressure-hold escalation. Key SD inventory on stable identity (device number/CID), not kernfs inode/ctime.

Harness corrections, which do not affect the device: navigation key code, separate parking and C2 verdicts, a warm reboot over the Wi-Fi fallback, the attribution scale, charger refusal checked from failed_stage/dmesg, rtc-alarm output captured, and no retry after a launch.