diff --git a/RESEARCH.md b/RESEARCH.md index 66308c8..04d8247 100644 --- a/RESEARCH.md +++ b/RESEARCH.md @@ -429,6 +429,27 @@ confirmed by the kernel's own coreboot driver, sysfs tags, and Payload `adbea06f…` flashed (cmp + vbutil OK). host_test and qemu_test pass. +## Round 10 — SUCCESS: full pipeline validated + +Payload `adbea06f…`: **red → yellow → green → blue, blue held.** The +depthcharge → custom-payload → display pipeline works end to end: + +1. depthcharge boots the dev-signed FIT from `mmcblk0p1` and hands off + (x0 = FDT buffer, x1-x3 = 0, MMU off); +2. stage0 re-enables OVL (+0x000C / +0x100C) and backlight (GPIO dout + 0x10005114 / 0x10005154); +3. the LBIO table at the fixed 0xffed9000 parses (record: pa handled via + OVL_L0_ADDR substitution = 0xFD536000); +4. fills at the live scanout are visible. + +Effective gotchas that cost nine rounds, all [REVERSED] or resolved: +OVL_EN offset (0x0F00→0x000C), GPIO dout offset (0x140→0x100), LBIO pa=0 +legitimacy (cbgfx rejects it; scanout comes from OVL_L0_ADDR), and the +empty x0 FDT buffer (bypassed with the fixed table address; root cause +still open and RELEVANT FOR U-BOOT). + +Next phase: U-Boot as the FIT kernel payload (see Round 11 planning). + Recovery: power-cycle, boot USB (unchanged), `dd if=mmcblk0p1-pmos-backup.img of=/dev/mmcblk0p1 bs=4M conv=fsync`.