Chronological record of the research: source verification (coreboot
tables, arm64 Image header, depthcharge FIT loader), the first black-
screen attempt, the depth-charge-version forensics that identified the
handoff teardown (black fill + backlight GPIOs + OVL_EN off), the
register-level facts used for the revival fix, flash state, and a
post-fix diagnostic decision tree.
Root cause of the black screen, verified against the DEVICE's
depthcharge (v0.0.22-10476, ChromeOS R93-era): display_cleanup() runs
at CleanupOnHandoff before jumping to the payload and
1. clears the LBIO framebuffer to black,
2. drives DISP_PWM (GPIO 43) and EN_LCD_BL (GPIO 176) low,
3. disables the OVL engines (OVL_EN=0, OVL0_2L_EN=0).
DSI/panel/MTCMOS remain up (panel poweroff only exists in 2025+ code),
so the stub just undoes those three steps: re-enable both OVLs, set
both backlight GPIOs, then paint. The OVL_L0_ADDR register still points
at the menu framebuffer, which is the LBIO record address our parser
already extracts.
The live environment boots from the USB stick; the eMMC kernel
partition is not load-bearing, so it is the safer first target.
Document backup locations, flash/verify commands, and recovery.
Backup of /dev/mmcblk0p1 taken before any write.
Strengthen the qemu end-to-end test: sample the framebuffer first pixel
every 0.5s for ~9s of stub time and require the exact transition order
red -> yellow -> green -> blue with no further transitions, plus a
final full-screen uniform-blue snapshot. Update README with run
instructions. All checks pass.
Minimal freestanding arm64 binary that depthcharge boots as a kernel:
parses depthcharge's /firmware/coreboot DTB node, walks the coreboot
table, finds LB_TAG_FRAMEBUFFER, and paints red/yellow/green/blue
checkpoints (~2s each) into the live boot-splash framebuffer.
Verified against coreboot tables header, Linux arm64 booting.rst, and
depthcharge's fit.c/boot64.c. Host parser tests pass against the live
/sys/firmware/fdt; full red->yellow->green->blue sequence verified
end-to-end under qemu-system-aarch64; packed image verifies with the
ChromeOS devkeys.
vhaudiquet