krane-fb-stub/main.c

/*
 * krane-fb-stub — freestanding, position-independent payload main.
 *
 * Checkpoint sequence (from the task spec):
 *   1. RED    — stub entered and running (depthcharge jumped here)
 *   2. YELLOW — DTB parsed, /firmware/coreboot node found
 *   3. GREEN  — "LBIO" signature verified, LB_TAG_FRAMEBUFFER record found
 *   4. BLUE   — previous fills visibly succeeded; hold blue forever
 *   On any failure: spin forever on the LAST SUCCESSFUL color.
 *
 * Deviation from the prompt (documented in README): the framebuffer
 * address is only knowable after parsing the DTB and the coreboot table,
 * so "red on entry" is physically impossible. Parsing happens first
 * (fast, <1ms); if any parse stage fails the screen keeps showing
 * depthcharge's own output (the dev-mode menu), which is an even
 * stronger "stuck at stage N" signal than a stuck color.
 */

typedef unsigned char  u8;
typedef unsigned short u16;
typedef unsigned int   u32;
typedef unsigned long long u64;

/* ---- platform helpers --------------------------------------------------- */

static void halt(void)
{
	for (;;)
		__asm__ volatile("wfe");
}

#ifdef __aarch64__
/* Generic timer read — not a timer driver, just two system registers. */
static void delay_ms(unsigned ms)
{
	u64 frq, t;
	__asm__ volatile("mrs %0, cntfrq_el0" : "=r"(frq));
	if (!frq) {				/* paranoia: fallback spin */
		volatile u64 n = (u64)ms * 200000;
		while (n--)
			;
		return;
	}
	__asm__ volatile("mrs %0, cntpct_el0" : "=r"(t));
	u64 end = t + (frq / 1000) * (u64)ms;
	do {
		__asm__ volatile("mrs %0, cntpct_el0" : "=r"(t));
	} while (t < end);
}
#else
/* host test build */
static void delay_ms(unsigned ms) { (void)ms; }
#endif

static u32 rd32le(const void *p) { return *(volatile const u32 *)p; }
static u32 rd32be(const void *p) { return __builtin_bswap32(*(volatile const u32 *)p); }

static int streq(const char *a, const char *b)
{
	while (*a && *a == *b) { a++; b++; }
	return *a == *b;
}

/* ---- FDT parsing -------------------------------------------------------- */

#define FDT_MAGIC	0xd00dfeedu
#define FDT_BEGIN_NODE	1
#define FDT_END_NODE	2
#define FDT_PROP	3
#define FDT_NOP		4
#define FDT_END		9

struct fbinfo {
	u64 pa;
	u32 xres, yres, bpl;
	u8 bpp, rpos, rsize, gpos, gsize, bpos, bsize;
};

/*
 * Walk the FDT at `dt`, find /firmware/coreboot, return reg pair #1
 * (coreboot table address + size). Cell counts tracked from
 * #address-cells/#size-cells properties; krane root is 2/2 and
 * depthcharge's fixup adds them on /firmware as well.
 */
static int find_coreboot_reg(const void *dt, u64 *addr, u32 *size)
{
	const u8 *base = (const u8 *)dt;
	const u8 *sbase = base + rd32be(base + 12);	/* off_dt_strings */
	const u32 *p = (const u32 *)(base + rd32be(base + 8)); /* off_dt_struct */

	if (rd32be(base) != FDT_MAGIC)
		return -1;

	int depth = 0;
	const char *path[8];
	u32 ac = 2, sc = 2;		/* krane root: #address/size-cells = 2/2 */

	for (;;) {
		u32 tok = rd32be(p); p++;

		if (tok == FDT_BEGIN_NODE) {
			const char *name = (const char *)p;
			while (*(volatile const u8 *)p)	/* skip name + NUL */
				p = (const u32 *)((const u8 *)p + 1);
			p = (const u32 *)(((u64)p + 4) & ~3ull); /* + pad */
			if (depth < 8)
				path[depth] = name;
			depth++;
		} else if (tok == FDT_END_NODE) {
			depth--;
		} else if (tok == FDT_PROP) {
			u32 len = rd32be(p); p++;
			u32 nameoff = rd32be(p); p++;
			const char *pname = (const char *)(sbase + nameoff);

			if (len == 4 && streq(pname, "#address-cells"))
				ac = rd32be(p);
			else if (len == 4 && streq(pname, "#size-cells"))
				sc = rd32be(p);
			else if (depth == 3 && streq(path[1], "firmware") &&
				 streq(path[2], "coreboot") && streq(pname, "reg") &&
				 len >= 16 && ac == 2 && sc == 2) {
				/* first (address, size) pair, big-endian cells */
				*addr = (u64)rd32be(p) << 32 | rd32be(p + 1);
				*size = (u64)rd32be(p + 2) << 32 | rd32be(p + 3);
				return 0;
			}
			p = (const u32 *)((const u8 *)p + ((len + 3) & ~3ull));
		} else if (tok == FDT_NOP) {
			continue;
		} else {			/* FDT_END or garbage */
			return -1;
		}
	}
}

/* ---- coreboot table walk ------------------------------------------------ */

#define LB_TAG_FRAMEBUFFER	0x12

/*
 * Layout verified against coreboot
 * src/commonlib/include/commonlib/coreboot_tables.h (see README):
 *   struct lb_header: sig[4] "LBIO", header_bytes, header_checksum,
 *                     table_bytes, table_checksum, table_entries (LE u32)
 *   struct lb_record: tag, size
 *   struct lb_framebuffer, offsets from record start (record = tag, size, ...):
 *     physical_address @8  (lb_uint64_t = 4-byte-aligned u64, little-endian)
 *     x_resolution @16, y_resolution @20, bytes_per_line @24,
 *     bits_per_pixel @28, red_pos/size @29/30, green @31/32,
 *     blue @33/34, reserved @35/36, orientation @37, flags @38, pad @39
 *   sizeof(struct lb_framebuffer) == 40 (host-verified with real header).
 *
 * **physical_address == 0 is LEGITIMATE on this device**: coreboot 4.14
 * kukui calls fb_new_framebuffer_info_from_edid(edid, 0) with no carveout,
 * so the LBIO record really says pa=0 and depthcharge's UI draws its menu
 * into DRAM address 0, which the (never-stopped) OVL scans out. Do NOT
 * reject it; paint at address 0 — the same 9.2 MB region depthcharge's own
 * display_cleanup black-fills at handoff.
 */
static int find_framebuffer(u64 table, struct fbinfo *fb)
{
	const u8 *h = (const u8 *)table;

	if (rd32le(h) != 0x4F49424Cu)	/* "LBIO", 'L' = lowest byte */
		return -1;

	u32 header_bytes = rd32le(h + 4);
	u32 entries = rd32le(h + 20);
	if (header_bytes < 24 || header_bytes > 4096 ||
	    entries == 0 || entries > 4096)
		return -1;

	const u8 *rec = h + header_bytes;
	for (u32 i = 0; i < entries; i++) {
		u32 tag = rd32le(rec);
		u32 rsize = rd32le(rec + 4);
		if (rsize < 8)
			return -1;
		if (tag == LB_TAG_FRAMEBUFFER) {
			if (rsize < 40)
				return -1;
			/* pa == 0 is legitimate here (see block comment). */
			fb->pa = (u64)rd32le(rec + 8) |
			         (u64)rd32le(rec + 12) << 32;
			fb->xres = rd32le(rec + 16);
			fb->yres = rd32le(rec + 20);
			fb->bpl  = rd32le(rec + 24);
			fb->bpp  = rec[28];
			fb->rpos = rec[29]; fb->rsize = rec[30];
			fb->gpos = rec[31]; fb->gsize = rec[32];
			fb->bpos = rec[33]; fb->bsize = rec[34];
			if (!fb->xres || !fb->yres || !fb->bpl)
				return -1;
			if (fb->bpp % 8 || fb->bpp < 8 || fb->bpp > 32)
				return -1;
			if (fb->bpl < (u32)fb->xres * (fb->bpp / 8))
				return -1;
			if (fb->xres > 16384 || fb->yres > 16384)
				return -1;
			return 0;
		}
		rec += rsize;
	}
	return -1;
}

/* ---- framebuffer fill --------------------------------------------------- */

static u64 mkcolor(const struct fbinfo *f, int r, int g, int b)
{
	u64 v = 0;
	if (r && f->rsize && f->rsize < 32)
		v |= (u64)((1u << f->rsize) - 1) << f->rpos;
	if (g && f->gsize && f->gsize < 32)
		v |= (u64)((1u << f->gsize) - 1) << f->gpos;
	if (b && f->bsize && f->bsize < 32)
		v |= (u64)((1u << f->bsize) - 1) << f->bpos;
	return v;
}

static void fill_screen(const struct fbinfo *f, u64 val)
{
	u32 bppb = f->bpp / 8;

	for (u32 y = 0; y < f->yres; y++) {
		volatile u8 *row = (volatile u8 *)f->pa + (u64)y * f->bpl;
		for (u32 x = 0; x < f->xres; x++) {
			volatile u8 *px = row + (u64)x * bppb;
			switch (bppb) {
			case 4: *(volatile u32 *)px = (u32)val; break;
			case 2: *(volatile u16 *)px = (u16)val; break;
			case 1: *px = (u8)val; break;
			case 3:
				px[0] = (u8)val;
				px[1] = (u8)(val >> 8);
				px[2] = (u8)(val >> 16);
				break;
			}
		}
	}
}

/* ---- display revival ----------------------------------------------------
 *
 * Verified against the DEVICE's depthcharge (v0.0.22-10476, 2021/2022):
 * display_cleanup() runs at CleanupOnHandoff before jumping here:
 *   1. clear_screen(black)               — LBIO framebuffer painted black
 *   2. backlight_update(false)           — GPIO 43 (DISP_PWM) and GPIO 176
 *                                          (EN_LCD_BL) driven low
 *   3. mtk_display_stop()                — OVL_EN=0 and OVL0_2L_EN=0
 * The DSI link, panel and display MTCMOS stay up (no panel poweroff in this
 * firmware generation). So the stub just needs to undo exactly those three
 * steps — no DSI/panel re-init required.
 */

#define DISP_OVL0_BASE		0x14008000u
#define DISP_REG_OVL_EN		0x000Cu		/* mtk_ddp.c, both mt8173/mt8183 */
#define DISP_REG_OVL_L0_ADDR	0x0F40u		/* scanout address, survives stop */
#define DISP_REG_OVL0_2L_EN	0x100Cu		/* 2021 mtk_ddp.c */

#define GPIO_BASE		0x10005000u
/* GpioRegs (mt8183.h): dir[6]@0x000, rsv00[160], dout[6]@0x100,
 * rsv01[160], din[6]@0x200; GpioValRegs = 16 B: val@0, set@4, rst@8.
 * **[REVERSED]** Round-1 note claimed dout@0x140 — wrong, backlight never
 * fired in any round; read back from the device-era header. */
#define GPIO_DOUT_SET(pin)	(GPIO_BASE + 0x100 + ((pin) / 32) * 16 + 4)
#define GPIO_DOUT_RST(pin)	(GPIO_BASE + 0x100 + ((pin) / 32) * 16 + 8)
#define GPIO_DOUT_BIT(pin)	(1u << ((pin) % 32))

#define PAD_DISP_PWM		43		/* DISP_PWM */
#define PAD_EN_LCD_BL		176		/* PERIPHERAL_EN13 */

static void wr32(u64 addr, u32 val)
{
	*(volatile u32 *)addr = val;
}

/* ---- main checkpoint sequence ------------------------------------------- */
/*
 * The krane panel (BOE TV101WUM_NL6) is 1200x1920 xRGB8888 — the menu
 * buffer depthcharge scanned out (OVL_L0_ADDR, programmed from the LBIO
 * record's physical_address) has exactly that geometry. So painting the
 * parsed LBIO pa IS repainting the still-registered scanout buffer.
 * Note: we deliberately never READ OVL registers — MMIO reads to a gated
 * display module can data-abort (qemu -M virt aborts on such reads too,
 * which killed an earlier stage-0 design); writes are always safe.
 */

static void blink_backlight(int times)
{
	for (int i = 0; i < times; i++) {
		wr32(GPIO_DOUT_RST(PAD_DISP_PWM), GPIO_DOUT_BIT(PAD_DISP_PWM));
		wr32(GPIO_DOUT_RST(PAD_EN_LCD_BL), GPIO_DOUT_BIT(PAD_EN_LCD_BL));
		delay_ms(300);
		wr32(GPIO_DOUT_SET(PAD_DISP_PWM), GPIO_DOUT_BIT(PAD_DISP_PWM));
		wr32(GPIO_DOUT_SET(PAD_EN_LCD_BL), GPIO_DOUT_BIT(PAD_EN_LCD_BL));
		delay_ms(300);
	}
}

static void stage0(void)
{
	/*
	 * Stage 0 — first instructions after entry, BEFORE any parsing.
	 * Backlight on + OVL engine re-enabled (undoing depthcharge's
	 * cleanup). No reads, no parse: if even this never becomes visible,
	 * the payload was never handed off (boot-path problem), not a
	 * display-revival problem.
	 */
	wr32(DISP_OVL0_BASE + DISP_REG_OVL_EN, 1);
	wr32(DISP_OVL0_BASE + DISP_REG_OVL0_2L_EN, 1);
	wr32(GPIO_DOUT_SET(PAD_DISP_PWM), GPIO_DOUT_BIT(PAD_DISP_PWM));
	wr32(GPIO_DOUT_SET(PAD_EN_LCD_BL), GPIO_DOUT_BIT(PAD_EN_LCD_BL));
}

/* ---- main checkpoint sequence ------------------------------------------- */

static void checkpoint(const struct fbinfo *f, int r, int g, int b)
{
	fill_screen(f, mkcolor(f, r, g, b));
	delay_ms(2000);
}

/* Parse failure: black screen + 5 slow backlight blinks, then spin. */
static void parse_fail(void)
{
	blink_backlight(5);
	halt();
}

void cmain(u64 dtb)
{
	struct fbinfo fb;
	u64 lbio_addr;
	u32 lbio_size;

	stage0();

	if (find_coreboot_reg((const void *)dtb, &lbio_addr, &lbio_size))
		parse_fail();		/* 5 blinks: DTB parse failed */

	if (find_framebuffer(lbio_addr, &fb))
		parse_fail();		/* 5 blinks: LBIO/fb record bad */

	/* Checkpoint 1: red — parsed; LBIO framebuffer record is sane. */
	checkpoint(&fb, 1, 0, 0);	/* red */
	/* Checkpoint 2: yellow. */
	checkpoint(&fb, 1, 1, 0);	/* yellow */
	/* Checkpoint 3: green. */
	checkpoint(&fb, 0, 1, 0);	/* green */
	/* Checkpoint 4: blue — hold. */
	checkpoint(&fb, 0, 0, 1);	/* blue */

	halt();				/* hold blue forever */
}