From dca94d627c2638ea728a002a8930e892da82035e Mon Sep 17 00:00:00 2001 From: vhaudiquet Date: Sat, 29 Aug 2026 22:01:59 +0200 Subject: [PATCH] =?UTF-8?q?stub:=20stage-0=20diagnostic=20=E2=80=94=20prov?= =?UTF-8?q?e=20handoff=20before=20parsing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round 3: still black with the corrected OVL_EN offset. All device-era display_cleanup steps are now provably undone, and init_screen() sequencing proves the menu was drawn into the LBIO physical_address (OVL_L0_ADDR == pa), so revival + fills are correct on paper. The unexcluded branch: the payload may never execute — internal boot of a custom p1 image was never baseline-proven on this device. Diagnostic payload (9d7859dc...): - first instructions: OVL_EN=1, OVL0_2L_EN=1, backlight on (no parse) - parse failure: 5 slow backlight blinks, spin - parse success: red -> yellow -> green -> blue, blue held Decision tree: colors = pipeline validated; blinks on black = parse failed at runtime; nothing = payload never handed off. An earlier design read OVL_L0_ADDR pre-parse; abandoned: unassigned MMIO reads data-abort on qemu -M virt (killed the test) and would do the same on hardware with a gated display clock. The stub now has no MMIO reads. host_test and qemu_test pass; flashed and verified on device. --- RESEARCH.md | 51 ++++++++++++++++++++++++++--- krane-fb-stub-payload.bin | Bin 159744 -> 159744 bytes krane-fb-stub.bin | Bin 18240 -> 18464 bytes main.c | 66 +++++++++++++++++++++++++++----------- 4 files changed, 94 insertions(+), 23 deletions(-) diff --git a/RESEARCH.md b/RESEARCH.md index b7766fd..17b544d 100644 --- a/RESEARCH.md +++ b/RESEARCH.md @@ -194,20 +194,63 @@ disassembly before reboot), flashed to `mmcblk0p1`, `cmp` + ## Flash state -- `mmcblk0p1` reflashed with the revival payload: - sha256 `9e7cf29d3cddb83cda957a469ff5fb0dea70a2d67c9a6cc0a1f1497b19bc8756`, +- `mmcblk0p1` reflashed with the Round-3 diagnostic payload: + sha256 `9d7859dc04dd9c445143f6b45600bb972cf5fc1497c06a4f9db549e3d2971e73`, verified on-device (`cmp` first 159,744 bytes + `vbutil_kernel --verify` - → body verification succeeded). (Round-1 payload was `edb65b29…`.) + → body verification succeeded). Earlier: Round-1 `edb65b29…`, Round-2 + `9e7cf29d…` (both functionally identical wrong-offset code; `41270e53…` + was a stale-tree rebuild caught by disassembly). - USB stick `sda1` untouched throughout (sha256 watched: `c4ee2044…`). - eMMC backup: `~/mmcblk0p1-pmos-backup.img` (sha256 `20951a54…`). **Copy it onto the USB stick before rebooting** so recovery never depends on eMMC. + +## Round 3 — still black with corrected offset; diagnostic stub + +Reboot with payload `9e7cf29d…` (correct `OVL_EN=0x000C`): still pitch +black. Fact check: all four teardown steps of device-era `display_cleanup` +are now provably undone — `clear_screen(black)` (repainted), the backlight +GPIOs (matches `kukui_backlight_update`), `OVL_EN`/`OVL0_2L_EN` (correct +offsets), and `disable_graphics_buffer()` (a libpayload double-buffer +helper, no hardware effect). Device-era `init_screen()` sequencing +(`ui/display.c`) proves the dev menu was drawn into the LBIO +`physical_address` and scanned out via `OVL_L0_ADDR` = same address, so the +stub's fills go to the right buffer. Revival logic is correct on paper — +yet black. + +**The unexcluded branch: the stub may never execute.** "Menu vanished" only +proves depthcharge reached handoff — cleanup runs unconditionally. And the +internal-boot path was never baseline-proven: pmOS always ran from USB; no +custom image has ever been observed booting from p1 on this device. Every +black screen so far is equally consistent with "payload never ran". + +### Diagnostic design (payload `9d7859dc…`) + +Payload now paints/blinks BEFORE trusting any parsing: + +1. First instructions: `OVL_EN=1`, `OVL0_2L_EN=1`, backlight GPIOs on. +2. Parse (<1 ms). Failure → 5 slow backlight blinks, spin. +3. Success → red → yellow → green → blue, blue held. + +Decision tree: colors = pipeline validated; 5 blinks on black = parse +failed at runtime; nothing at all = payload never handed off (boot path). + +### Abandoned: OVL_L0_ADDR stage-0 read + +An earlier design read `OVL_L0_ADDR` (0x14008F40) pre-parse to paint the +menu buffer without knowing `pa`. Rejected: on qemu `-M virt`, READS of +unassigned MMIO data-abort (writes are silently dropped) — it killed the +test instantly; the same risk exists on real hardware if a display clock +gate is off, and a fault there is indistinguishable from "never ran". The +stub now contains no MMIO reads at all. + ## Diagnostic decision tree (after this fix) | observation | meaning | |---|---| -| menu exits → black immediately, no color | stub ran but died in DTB/LBIO parse (or OVL revive didn't take) | +| black, no colors, no blink | payload never handed off — boot-path problem (vboot/mkdepthcharge), investigate p1 boot | +| black + 5 slow backlight blinks | stub ran, parse failed at runtime | | colors appear but sequence stops early | fill/mask problem — stuck color identifies stage | | red → yellow → green → blue, blue held | pipeline fully validated | diff --git a/krane-fb-stub-payload.bin b/krane-fb-stub-payload.bin index 3e529734656d2a3e67c57236ac4e5dfba63e2b2c..ce0eafdea6494e5c76701f6e5b5ad9c615cd056b 100644 GIT binary patch delta 1780 zcmah|dr(wm6hGhIUG~9>1SFUUyK7J(rGPuKqVDH{h879S9bY{_ltNcYP}4zlFKB6C z6PwvmA#7_>l1-NQSVJD>gR*>pXeG*SLJ$Zjj>rOXJGZRqzwXSL-~GC5wX7||Qoyluw%(*c2 ztxab;*F4r5;{Vmao6WTa3)1SUG#9gzd+qd{{Eq6&3m2|em>G}JlKBVx66{{h`gz4` zDz*1jnfmKpA?0!9Y0}v%WMdXZ1ywB%S#W=M-AGF)yQjY8aD2fJ4`SRc;i8#GiY;Fb z{Nd`*ZaA?2%9!sqRG+=pe0}N`UNL{CxV~A`+shO7DDH_9u}Srv=6kjsUe)cMxtpV|ug_amb7isV>#@Z%Z`YSBJK?q1F{!vTEnFS3 z`ACm%=DO<0ZaQ!Lg!ksWGI!b7sJq>3dM9Vxo0xIDbVqwuT-Ce`{&$Q~OHip$O@Pfn8K8d7pSFrjG%DXdp4gyS>R6QB3Nt z2&u32^|?eT7h@!I<*sR_!-*u41jMWGtnmi$L;Uwq#alljBud7qEM)+erlU=S#EQ(V z?$U;>VFeA#S61~&okb0wu50Y$W8sn=I3ol0zHI@meXnKP`aB@d7y>pU7g^9?25GDm?ptgn5PHms^@tYxy%i( zJ|vSoBvXn0pX|RR1~FtU9pc#(Bo}Oi=l$EI;C4!>n~33(3*T)#e^|&<5Atlk5N9yX z2yrte;6X^ZjsZd8gH6Zx=aHfY!rA*CFklJAN!;}Ww+JT?iXub7+mVM8BRByKo;5fX z4Fv}|o@cD9IgzbYQU@cW4iQjC3J{Y^4(u{n?Goaw@nL`|JOjkj#V{2~$h&i{ymm@DoGzx0G!**@ z3N#1?%0gcd71n^lnk*q|vjdZYGSZ?)M))ahOi)-C<6F@;E7+1D=8U*^e(B?Bv_uM1 z;)7^(Fp-!zyw@6#p&(#0aT4dT!A|7p@TYE{lfjmAO3o-DRF@8*ZAJfcSXTp{CiO7S zN|5VKp4ZOypt^lSytZo`HM?cleKr=!h{}@wu)Lot>IC2L45^w5oF(j;QA~+^+OvO!K+%rGwz(4HHZ1H?2COC018C*;eni_5D z2yfLO3Vs(O3KL?H==h!M1>ANnTXyHG3mo;1gXev-9ol+i%|<|D!E@+QL8M zXQNw@FYrqUhT+ ziM8%m7HZ1FCdCW#T&m9<_+Z08uU>wQs1T~c|@NbhKIphdX+M&{fj*_j@vv*&*) z>?p|g{w3NwXYQ0HIa2@IuaQrJKU`taeqS}xn_t#FI&-7q!sqfl)3C0qb;@}6Oj!6~ z;m5kMW%?wKJ?;FLH(SylI8ZYdRDL_M*!~YEj>q=wzzSVkigx`rMcPMOY$pd|w!f89 z-yz(jY(FhdTH@v6eYQr~+|C57rY97>PtHZGKRWVPWXJM*^D?6gqW+xX{TTYgn)Bng z@+#^}H)%R2a_zgs&M^VaFezgzsWH}{wUz^Y6QNq zhl3=#E)ueSCF!64Ppaf#nay)1L_vxTZxI=y9cbk?a>)%6Unjz$ zap0;(lZ>i`aMQ^p6>Ka^pI}1dOF;vN6k5pyDVz@)nguFM)^M5dN;q;Xvv$)&h}O;p zERi9Bbj~83XIhJ3*{CJY7*#USkCUXCq=?F=OvtCC^IEds8e;$lCF+1|OTh+bz>=&| zV5xhj8P%IBke>j}VKO*GekY1hZJe;VmqOC}OTg?yQ>K0)OtJ*ntOFSBlY^P$iek^k z=7BIUqa-Zrbwx7HUMzdyMlgk-kYFl7FM>4I$sYI+C4)HTAXyb5!yzoQ%tJB@b5Pmh zgtdxXtj#FE+V~fYN-TybIS-G42wYgajoP2dkj1G~G^E-H$s16I5t~N2o%6|%fUX!r zpjT2vXA!XnFx!KZnU)^u1hAfgSpuudln4Xq$X;rp>`aN%jIodCuWc)N=PRG}+-f5t m3B=d`iepV~^~E=; z%dM-Zi%4RBOi{XW-?z_x*V8 zbDs02{5mV<*)8ov+v$d1XyEz_o9gog3%%R?PN*#^lcB##7_PhL04wW?f=PcBuRKE zb>ynFk|0;HDdmm}K5Eu{qRBjTzK-Xjlpm?S@ZZw8}50R^S-+6!mT zOt5@~IWvuGoC-Z~;&LlBH8{`%kv-JzPQWn+2O@Znz?Fy~mz|w3=S!cBx3vkE`-Q8K zaFfLBdJ9>P`^!VDR_f%$b6*f^t#dv%2;SEoY$*?2tq<5ch<5jiM6_KBj|GF&tR zPSM0==5IzM$!ixGSxR7%eD<)9tR%JA&c7J2=e<++@z80=&hnx_tAlYZqXZLy6xb8OXP zU*n*^g5#GRqS<*aSXgLtOq~g1lqj~0{6m;4QL7!^kd_Xvm!ymx@(N@2s*J7f64|C7 zE{tQy&q9UKt-)_F*oo#6b=pU8w@QQ>)OBI3G-XVKVC+?X;3mhM6`{fiKBf-)-fq#G zRN~g9HG&Vnh?yCWFcRxB7JqzJQlZ~%(bshlQMf>^mQ z>s)t1gA0l{$hz(ME7Cd!F{eO03*tjpWGn?2?hcfP&VVQWHl_AmmKKBK9C^K6xOL8= zD|e8)$Ki8JUD&tn!o@%B(oc7ho5O%m!{;IB4h~?!oV}(MB+L=Ls8SpkPrza=O>85P6`&2EV{dJ(pI~4R$Lh`bdrq&wBnCeJ3tv3r}8S3?UylQG_T)*jQ4ww8#O<=9`%S&v_MJf8|P(Vq?*Y6=VMO2nX`!Th{%jq)b|{9giJtQeNR8Va~;Ct%3C%uU?`DeQWekYHq4r?-Dgx#A!wZT@u1rFO8n=Sd zg7X8cxq>y;+-x&ffYe~;2CI#zEIS=fsH$$T@yfIxS$E-4O)XtGS#G!XeuuiTzUkR3#h!;Y(lW8 z-k)5#js9aS+KWw$taJYjRQ?h-|6*WFY>NS|F@$>o=ItK>LCxm4vVS+hXV88h=SFZ3 z6q%MnW@IVxEu99VQlqJba@Z6~nGpl{J|6@FYt@T~nXy<42D!EfL-ReD1u*Zx@WO?p tOc