From ac6167e4e4485e9775d74a475c5328dfa4e21eee Mon Sep 17 00:00:00 2001
From: vhaudiquet <vhaudiquet@localhost>
Date: Sun, 30 Aug 2026 10:12:07 +0200
Subject: [PATCH] Round 14: 4K-align U-Boot entry inside the wrapped Image
 (start.S wfi hang)

---
 RESEARCH.md             |  17 +++++++++++++++++
 build-uboot-payload.sh  |  13 +++++++++----
 krane-uboot-payload.bin | Bin 589824 -> 593920 bytes
 krane-uboot.bin         | Bin 449516 -> 453432 bytes
 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/RESEARCH.md b/RESEARCH.md
index 2995847..25ef674 100644
--- a/RESEARCH.md
+++ b/RESEARCH.md
@@ -608,3 +608,20 @@ post-relocation one):
 
 Read: last paint reached = code survived through that checkpoint; the
 crash/hang is in the next window. Success = banner on black.
+
+## Round 14 — all green decoded: U-Boot's 4K-alignment requirement
+
+Reboot with `fc48d83b…`: **all green, no bands** — U-Boot hung before
+`board_early_init_f`. Root cause found in start.S: with
+CONFIG_POSITION_INDEPENDENT, U-Boot verifies `adr _start` & 0xfff == 0
+(it uses ADRP+ADD with lo12 relocations during the PIE fixup) and
+otherwise loops in `wfi` forever — a silent hang, no exception. Our
+wrapper pushed U-Boot's entry to load_base+0xB4: misaligned by
+construction.
+
+### Fix (payload `faee130f…`)
+
+`build-uboot-payload.sh` now pads the wrapper so U-Boot starts at the
+next 4 KiB boundary (0x1000) inside the 2 MiB-aligned image; wrapper
+tail branch patched accordingly (0x140003d4 → 0x1000, verified by
+disassembly). Keep this invariant for every future layout change.
diff --git a/build-uboot-payload.sh b/build-uboot-payload.sh
index 43bcbc0..e11493f 100755
--- a/build-uboot-payload.sh
+++ b/build-uboot-payload.sh
@@ -40,8 +40,12 @@ hdr = bytearray(64)
 hdr[0:4] = struct.pack('<I', (0x40 >> 2) | 0x14000000)  # code0: b +0x40
 struct.pack_into('<Q', hdr, 0x10, total)                # image_size
 struct.pack_into('<Q', hdr, 0x18, 1 << 3)               # flags: bit3
-hdr[0x38:0x3c] = b'ARM\x64'                             # magic
-
+# U-Boot requires its runtime _start to be 4K-aligned (start.S checks
+# `adr _start` & 0xfff and hangs in wfi otherwise; it uses ADRP+ADD with
+# lo12 relocations during the PIE fixup). depthcharge loads the image at
+# a 2 MiB-aligned slot, so place U-Boot at the next 4 KiB boundary.
+uboot_off = (wrap_off + wrap_len + 0xfff) & ~0xfff
+total = uboot_off + len(uboot)
 # patch the wrapper's trailing `b .` to jump to the U-Boot entry
 br_off = wrap_off + wrap_len - 4
 imm = (uboot_off - br_off) // 4
@@ -51,9 +55,10 @@ wrapper[-4:] = struct.pack('<I', (imm & 0x03ffffff) | 0x14000000)
 with open(out, 'wb') as f:
     f.write(hdr)
     f.write(wrapper)
+    f.write(bytes(uboot_off - wrap_off - wrap_len))
     f.write(uboot)
-print("layout: header 64, wrapper %d (0x40..0x%x), uboot %d, total %d" %
-      (wrap_len, uboot_off, len(uboot), total))
+print("layout: header 64, wrapper %d (0x40..0x%x), uboot %d @0x%x, total %d" %
+      (wrap_len, uboot_off, len(uboot), uboot_off, total))
 EOF
 
 # 3. pack + verify
diff --git a/krane-uboot-payload.bin b/krane-uboot-payload.bin
index 5ec041289d9777eecf5db66b9c1520633393f8fd..f4f26090a162103b28aaa3954f788c0d8391633a 100644
GIT binary patch
delta 694
zcmV;n0!jUVfFyvRB(U)WAOIKu0000001yBG00000EC2ui0000000961000000GB~g
z1si`nOwI4PYhL>3<wGBpQCQxh0bg8;7Gw?W5!pLO$C-%jbSJ&K1Tec6uR*ugtZ;h`
zs9k96Hiqepzrv{~i0IMjFE*8@SMdqji)k!l=ujOjQG`F+u0bmkN6qHbme$P*d-5!?
z4*V>%aocAUs4z6>G&Hy5eU#?ayq`v^PhfviqnHOWc9~=4;NE6UZD;@ULtS?r&TBP+
zv|OLC+SFY;-rQX{(Fu)S+B}L*-|C)xNND}lvt)4{Q>&>YV6~YO9_0n%NobT=QkMC2
zqrQAs`EfJ!Y>@im6g{c%5-yb$#l$Bp`kLMR<0h)yTN$_=!{{#Yjd_2(TMk*k-)w*I
z|CW+0zg2sves-4}!(mxz(#>2k?|+8473!oJ?6qu)obd5-9r(+^&3CxU+~Q5R_F!uk
z0J+l-nqAVi#v;C`F=><`<_^)>@bCS59_o3{w?`rPKp1CJf<HiiLI-d@CTo7!e||K(
zo$jPu<8$@U<N&~^ytocJF=~e<#c_W)S3=QY4hKg1(C#i7-134$#*$DP`qSVdtM;r-
zt!0&+BCt@BB{a~pbQ7AuRFW@U&yRzU;vC}bDR7?g@9juthJA4?4pGrz@$~R*tPDcQ
z!*BeVz$A~aA0VVf*T95A*kR3#U_(n3KP~G&FaV*pAd<ufZ-4~I2XlvMZ(am0l3lN}
zF$d51lRyUrlmP|`-!=dM05|{#-nf+z0Tu$@fR_PC1{)0n000040001PYLn%_wNL>%
z0Rrndmy7`cJd;2N2$#?S0dNG=0{|4WF$YW!heQGaheQGbheQGcheQGdheQGeheQGf
cw?qO5P}>BYtx0^hnB50x@{>RZw5HGqFzbId^#A|>

delta 676
zcmV;V0$crnpd^5RB(U)W8SobX0000001yBG00000EC2ui0000000EbfCk7akKnDtc
zv6jBl$Bq8jLNC*sJs}hz^#fEWl-#!!qct|}6Al3)Zma9&AWY6twv~>a=qRX5fINiZ
zSOES!eQ7lLwdQt9ojs&b^R1n>IFVA_=?)SNPfmRzUS8LOK;o-<;S*TKKlSI;P=}55
z%mu$f9|4j?H-Wgvu`TA2fFoIJz;7ylQ90{GIF8p4FJXy##!4zkjRD_=$5lag>8mTu
z)Xs-RK9B&4gR8cG`rKc<RaS4|NnsxzxI;TMUwdOJ-TzNP9T)Utg@Mj!OC8kAnwtVt
z3G&y+5t)_Jvcp3GG8T7KHr^eeLrATP<-^-NEcb#wlDylc-osv6(N2u%NPa<o@Wf4E
z=33)WF*^|Qp#c)edY#u7K&=>Y%Edf7n+C<wKruU42C^%7pwDhkZZUZY2>O&r(po8H
zK5cL#*|8xY1@@>2POOA9)Zy@91m=ec(q;Gi24>u!{b~b*JanZtq^3MeNv{=O({^ng
z2uddvK_{%!L_FDG+<p;WZjXe2l+f_gI!V9$A?t-UM>;UU*dVfxE~;036BFGX1J_z0
zEH4T}UB~{rJ;<wvKe`xG>E7Ko-|P>*IY~aPwg2hcTgxFWC_7gzsbhMx!w~QU0=UfB
zh6LfUjT<Ner`|Lw>7C0QQZ%eBOxQgi>n$|kWj!XC1(D}Pnh;F?FYdhr*L{i3voQzH
z_>({f1(X2>3eV~Q001}u2hVJk5CIkf&or0eHU$@zKLHN{<N>u%0XhK!+w7N&0RcP&
zK~ha*m&^eHbOZqa02GIi5dnvg5dw#h5d(*i5d?>j5e0{k5eB!A5eHD)1T94Hgtz4E
K2Wax9;0Q3K(jy%J

diff --git a/krane-uboot.bin b/krane-uboot.bin
index a5a061a097ff46f3a71221a9d1dae663a1b7c59e..008f2dd044f25d5a6318321ba2d2a451fb96aa3b 100644
GIT binary patch
delta 47
zcmV+~0MP&Jw;Q<D8<04WFbI)Aa0Ju?02H_J%LYsjfwYCR0fn>zg|q{Ov;>8;1+}yW
FINRV~6W{;<

delta 43
zcmdmSP5RAt=?NArjzPXD6KzUZ7#SEungrSe7~2Gx+60)}1X$VxShoqVS=<HyGd&DI