Round 15: black anomaly; blink-train magenta wrapper + misc_init_r checkpoint

RESEARCH.md

@@ -625,3 +625,42 @@ construction.
 next 4 KiB boundary (0x1000) inside the 2 MiB-aligned image; wrapper
 tail branch patched accordingly (0x140003d4 → 0x1000, verified by
 disassembly). Keep this invariant for every future layout change.
+
+## Round 15 — all black again (Round 14 anomaly); blink-train wrapper
+
+Reboot with `faee130f…` (4K-aligned U-Boot): **all black, no backlight**.
+Unexpected: the wrapper is byte-identical to Rounds 12/13 except its
+tail-branch immediate, and it demonstrably painted green in both. Black
+without any wrapper trace was only ever explained by "payload never
+ran". Candidates for a genuine regression: none found in the wrapper
+path; no U-Boot driver can touch the backlight GPIOs (no MTK GPIO
+driver in-tree, PINCTRL off); nothing before the video probe touches
+display HW. Working hypothesis: the Round-14 boot transiently did not
+hand off (or the report reflects a state we cannot yet distinguish).
+Note: a build slip was caught before flashing — the diagnostic hooks
+were gc-section'ed out because `.config` was stale; defconfig was
+re-run and the hook symbols verified with `nm` (board_early_init_f,
+board_early_init_r, dram_init_banksize, misc_init_r all present).
+
+### Round-15 payload (`b1c5c380…`, flashed, cmp + vbutil OK)
+
+Maximally distinguishable phases:
+
+- wrapper: **magenta** full screen + backlight, then **3 slow backlight
+  blinks** (~250 ms each via the arch timer), then branch to U-Boot.
+  Repeating blink trains = WDT reset loop; a single train then colors =
+  wrapper ran; nothing at all = never ran.
+- U-Boot checkpoints unchanged: orange top (`board_early_init_f`), blue
+  bottom (`dram_init_banksize`), red top (`board_early_init_r`).
+- new: **yellow band** + backlight re-assert in `misc_init_r`
+  (CONFIG_MISC_INIT_R) — proves full init past the banner stage.
+
+### Decision tree
+
+| observation | meaning |
+|---|---|
+| nothing, no blink | payload not handed off (depthcharge-side) |
+| blink train once, then magenta persists | U-Boot crashed before `board_early_init_f` (PIE fixup / early board_init_f / initf_dm) |
+| blink train repeating periodically | reset loop (WDT) — identify the phase by the colors that flicker |
+| magenta + orange/blue/red/yellow bands | crash in the next window after the last band |
+| banner on black | success |

uboot-wrapper.S

@@ -6,16 +6,20 @@
  * Purpose: prove that the payload actually executes and revive the
  * display before U-Boot gets a chance to crash, so a dark screen can be
  * attributed unambiguously:
- *   - green screen + backlight on = wrapper ran, U-Boot crashed later
- *   - dark screen, no backlight   = wrapper never executed
+ *   - magenta screen + backlight on, then 3 slow blinks = wrapper ran,
+ *     U-Boot crashed later (bands from the U-Boot checkpoints narrow
+ *     the window further)
+ *   - dark screen, no blink train   = wrapper never executed
+ *   - blink train repeating forever = watchdog reset loop
  *
  * Register sources (all verified on device, see RESEARCH.md rounds 4/10):
  *   OVL0 base 0x14008000: OVL_EN @ +0x000c, OVL0_2L_EN @ +0x100c,
  *   OVL_L0_ADDR @ +0x0f40 (depthcharge device-era mtk_ddp.c).
  *   GPIO controller 0x10005000, dout block +0x100, 16 B per 32-pin
- *   group, set @ +4 (mt8183.h GpioRegs): DISP_PWM = pin 43 (bit 11,
- *   0x10005114), EN_LCD_BL = pin 176 (bit 16, 0x10005154).
- *   Scanout geometry: 1200*1920*4 bpl-based = 0x8ca000 bytes, xRGB.
+ *   group, set @ +4 / rst @ +8 (mt8183.h GpioRegs):
+ *   DISP_PWM = pin 43 (bit 11, set 0x10005114 / rst 0x10005118),
+ *   EN_LCD_BL = pin 176 (bit 16, set 0x10005154 / rst 0x10005158).
+ *   Scanout geometry: 1200*1920, 32bpp xRGB, 0x8ca000 bytes.
  */
 
 	.text
@@ -49,11 +53,45 @@ _start:
 	movk	w5, #0x4000, lsl #16
 	cmp	w4, w5
 	b.lo	1f
-	/* fill the scanout with green (0x0000ff00): 0x8ca000/4 words */
-	mov	w2, #0xff00
+	/* fill the scanout with magenta (0x00ff00ff): 0x8ca000/4 words */
+	mov	w2, #0xff
+	movk	w2, #0xff00, lsl #16
 	mov	x6, #0x2800
 	movk	x6, #0x23, lsl #16
 2:	str	w2, [x4], #4
 	subs	x6, x6, #1
 	b.ne	2b
+	/* blink the backlight 3x: repeating trains reveal a reset loop */
+	mov	w11, #3
+6:	mov	w2, #0x800
+	mov	w3, #0x5118
+	movk	w3, #0x1000, lsl #16
+	str	w2, [x3]
+	mov	w2, #0x10000
+	mov	w3, #0x5158
+	movk	w3, #0x1000, lsl #16
+	str	w2, [x3]
+	bl	delay
+	mov	w2, #0x800
+	mov	w3, #0x5114
+	movk	w3, #0x1000, lsl #16
+	str	w2, [x3]
+	mov	w2, #0x10000
+	mov	w3, #0x5154
+	movk	w3, #0x1000, lsl #16
+	str	w2, [x3]
+	bl	delay
+	subs	w11, w11, #1
+	b.ne	6b
 1:	b	.			/* PATCHED: branch to U-Boot entry */
+
+	/* ~250 ms delay using the arch timer */
+delay:
+	mrs	x7, cntfrq_el0
+	lsr	x7, x7, #2
+	mrs	x8, cntvct_el0
+	add	x8, x8, x7
+9:	mrs	x9, cntvct_el0
+	cmp	x9, x8
+	b.lo	9b
+	ret