# B9A — stock LK (aboot) display analysis. READ-ONLY.
# Source: partitions/aboot.bin (stock backup, ELF, entry 0x8f600000) -> bootchain/aboot-analysis/lk.bin (load seg 0x8f600000+0x530c8),
#         lk-arm.dis (objdump). Tools: b9/b9a/lk-xref.py, lkmem.py, disrange.sh, decode-panel.py, render-lk-logo.py.
# NOTE: stock LK is no longer on the eMMC (aboot = lk1st-aurora-autoboot since B5a); this is the saved original.

## VERDICT: YES — stock LK fully brings up the panel before Linux (power/reset, SPI init, 19-cmd init, frame write, backlight),
## at ~210 ms after LK start, and hands it to the kernel as continuous splash (cmdline mdss_mdp.panel=1:spi:0:qcom,mdss_spi_st7735s_wx144_128x128_cmd).

== 1. UART evidence (stock boots, logs/uart/coldboot-20260929-200018.log, preflight-recovery-20260929-201150.log)
20:01:01.630 [0] welcome to lk
20:01:01.630 [10] target_init()
20:01:01.830 [210] Panel power on done
20:01:01.830 [210] Config SPI PANEL.
20:01:02.230 [500] cmdline: console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci andro
20:01:46.857 [0] welcome to lk
20:01:46.857 [10] target_init()
20:01:47.057 [210] Panel power on done
20:01:47.057 [210] Config SPI PANEL.
logs/uart/lk2nd-boottest-20260929-203353.log:20:34:56.320 [210] Panel power on done
logs/uart/lk2nd-boottest-20260929-203353.log:20:34:56.320 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:12:20.096 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:12:20.096 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:13:09.732 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:13:09.732 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:19:21.864 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:19:21.864 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:19:49.496 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:19:49.496 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:33:24.573 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:33:24.574 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:33:39.596 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:33:39.596 [210] Config SPI PANEL.
20:01:04.031 [    0.000000] Node qcom,mdss_fb_primary memblock_reserve memory 83200000-841a0000
20:01:04.231 [    0.000000] Kernel command line: console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci androidboot.emmc=true androidboot.serialno=3
20:01:04.632 [    0.144515] KPI: Bootloader display count = 23838
20:01:05.834 [    0.620091] mdss_spi_panel_probe: Ctrl name = mdss spi panel
20:01:05.835 [    0.620348] mdss_spi_panel_init: Panel Name = st7735s wx144 128x128 command mode spi panel
20:01:05.835 [    0.620665] mdss_spi_panel_init: Continuous splash enabled
20:01:07.439 [    4.037439] mdss_fb_register: FrameBuffer[0] 128x128 registered successfully!
Current chain (lk1st-aurora-autoboot, e.g. logs/uart/b7cV1-20261002-195525.log): NO "Panel power on"/"Config SPI PANEL" lines.
lk2nd source: platform/msm_shared/rules.mk builds mdss_spi.o only for PLATFORM msm8909/msm8952; lk2nd/device/2nd/spi-display.c only
re-uses a panel "initialized by previous bootloader" (240x320 fixed). => current msm8916 lk1st has no SPI-panel code at all.

== 2. Function map (stock LK, addresses in 0x8f6xxxxx)
0x8f600eac  display init loop -> gcdb_display_init(0x8f616918)(rev, MDP_REV=12, fb_base=0x83200000)
0x8f600f20  oem_panel_select(): panel_id := 1 (HARDCODED, mov r5,#1; str -> 0x8f654408), prints "lcd_id == st7735s spi lcd"
            unconditionally (NO ID read over SPI, no ID GPIO). id 0 -> qcom,mdss_dsi_st7796s_320p_video (DSI), id 1 -> st7735s (19 cmds),
            id 2 -> qcom,mdss_spi_nv3023a_jz05_128x128_cmd (58 cmds). Aurora stock LK always uses id 1.
0x8f616918  gcdb_display_init(): "SPI panel select and init start", pinfo.type = 13 (SPI_PANEL), power_func=0x8f6165e0, bl_func=0x8f616698
0x8f6165e0  mdss_spi panel power: target_ldo_ctrl(0x8f600e98) then target_panel_reset(0x8f600bb8); prints "Panel power on done"
0x8f600e98  target_ldo_ctrl(): STUB `mov r0,#0; bx lr` -> stock LK switches NO regulator. No RPM 'ldoa'/'smpa' request code in LK at all.
0x8f600bb8  target_panel_reset(enable): (board hw_id 8 MTP) gpio_tlmm_config(0,...,enable=0)+gpio_set(0,HIGH) [CAF enable_gpio leftover,
            OE bit 9 = 0 -> GPIO0 not driven], then reset GPIO 118: tlmm_config(118, func0, dir out, nopull, drv=3 (8 mA), OE=1),
            set HIGH, then seq pin_state {1,0,1} / sleep {1,1,120} ms => RST high 1 ms, LOW 1 ms, HIGH, wait 120 ms.
            (QRD hw_id 11/subtype 4 branch drives TPS65132 on I2C 0x3e — not this board.)
0x8f600b54  target_backlight_ctrl(bl, en): if bl_interface_type != 2 (DCS): PM8916 MPP4 (base 0xa300, SID0):
            MODE_CTL(0xa340) = 0x60|1 = 0x61 (current-sink mode, enable), SINK_CTL(0xa34c) = 7 (=40 mA), EN_CTL(0xa346) = en<<7 (0x80);
            mdelay(20). No PWM/LPG, no WLED (PM8916 has no WLED; "bl_ctrl_wled" in panel data is a CAF label).
0x8f6107e4  spi_qup_init(blsp=1, qup=3): base = (3+0x78b5)<<12 = 0x078b8000 (BLSP1 QUP4)
0x8f601bc8  BLSP1 QUP4 pinmux: TLMM cfg regs 0x0100c000..0x0100f000 = GPIO12 (MOSI), 13 (MISO), 14 (CS_N), 15 (CLK), func 1
0x8f6019d4  clock_config_blsp_spi: gcc_blsp1_qup4_spi_apps_clk = 16 000 000 Hz (0x00f42400)
0x8f610924  QUP regs: QUP_CONFIG=0x180 (SPI mode, NO_INPUT), SPI_CONFIG(0x300)=0 (INPUT_FIRST=0 -> CPHA=1), SPI_IO_CONTROL(0x304)=0x401
            (NO_TRI_STATE|CLK_IDLE_HIGH -> CPOL=1) => SPI mode 3 (spi-qup.c semantics), write-only (TX), native CS0.
0x8f610b6c  mdss_spi panel on: D/C GPIO 116 tlmm_config(func0, out, nopull, drv 3, OE); per cmd: D/C LOW + 1 cmd byte (0x8f6109f4),
            D/C HIGH + params (0x8f610a80), mdelay(wait). Frame: D/C HIGH, 16-bit words, len = w*h*bpp/8 (0x8f610b00/0x8f610c64).
0x8f61659c  display_image_on_screen(): fbcon_clear; fetch splash partition; if no "SPLASH!!" header -> built-in 128x128 RGB565 image
            @0x8f64b004 (memcpy 128*128*2 to fb 0x83200000, then SPI flush). Stock splash partition = 10 MiB of zeros (sha in
            partitions/SHA256SUMS) => stock shows the built-in "4G LTE" logo (rendered: b9a-stock-lk-embedded-logo-128x128.png).
0x8f60d78c  "Continuous splash enabled, keeping panel alive." -> panel left ON for the kernel.
0x8f6166e8  cmdline builder: " mdss_mdp.panel=" + "1:spi:0:" + panel node id.

== 3. Panel data structures (stock LK, panel_id 1)
paneldata @0x8f648288: node 'qcom,mdss_spi_st7735s_wx144_128x128_cmd', controller 'spi:0:', compatible 'qcom,mdss-spi-panel',
  interface 10, destination DISPLAY_1, framerate 27 (DT node says 20; irrelevant for a GRAM panel)
resolution @0x8f647e8c: 128 x 128, h fp/bp/pw 79/59/60, v 10/7/2 (porches meaningless for SPI command-mode)
color @0x8f648410: 16 bpp (RGB565), order 0
reset @0x8f6483ec: pin_state {1,0,1,0,0} sleep {1,1,120,0,0} ms, direction 2  (== DT qcom,mdss-spi-reset-sequence <1 1 0 1 1 0x78>)
backlight @0x8f648728: interface 1 (BL_WLED label -> MPP4 path above), min 1, max 0xfff, step 100, pmic ctrl 1, model 'PMIC_8941'
on-commands @0x8f64849c: 19 x {u32 size, u32 ptr, u32 wait, u8 post_tg}, count 19 (pinfo+0xf0/0xf4)

== 4. Init sequence: stock LK vs stock DT (b9/b9a/decode-panel.py)
== stock LK st7735s (0x8f64849c): 19 commands
   0 11 SLPOUT                                                    wait=120 ms
   1 b1 FRMCTR1  05 3a 3a                                         wait=0 ms
   2 b2 FRMCTR2  05 3a 3a                                         wait=0 ms
   3 b3 FRMCTR3  05 3a 3a 05 3a 3a                                wait=0 ms
   4 b4 INVCTR   03                                               wait=0 ms
   5 c0 PWCTR1   62 02 04                                         wait=0 ms
   6 c1 PWCTR2   c0                                               wait=0 ms
   7 c2 PWCTR3   0d 00                                            wait=0 ms
   8 c3 PWCTR4   8d 6a                                            wait=0 ms
   9 c4 PWCTR5   8d ee                                            wait=0 ms
  10 c5 VMCTR1   12                                               wait=0 ms
  11 e0 GMCTRP1  03 1b 12 11 3f 3a 32 34 2f 2b 30 3a 00 01 02 05  wait=0 ms
  12 e1 GMCTRN1  03 1b 12 11 32 2f 2a 2f 2e 2c 35 3f 00 00 01 05  wait=0 ms
  13 36 MADCTL   c8                                               wait=0 ms
  14 3a COLMOD   05                                               wait=0 ms
  15 2a CASET    00 02 00 81                                      wait=0 ms
  16 2b RASET    00 03 00 82                                      wait=0 ms
  17 29 DISPON                                                    wait=0 ms
  18 2c RAMWR                                                     wait=0 ms
== stock dtb_01 st7735s on-command: 19 commands
   0 11 SLPOUT                                                    wait=120 ms
   1 b1 FRMCTR1  05 3a 3a                                         wait=0 ms
   2 b2 FRMCTR2  05 3a 3a                                         wait=0 ms
   3 b3 FRMCTR3  05 3a 3a 05 3a 3a                                wait=0 ms
   4 b4 INVCTR   03                                               wait=0 ms
   5 c0 PWCTR1   62 02 04                                         wait=0 ms
   6 c1 PWCTR2   c0                                               wait=0 ms
   7 c2 PWCTR3   0d 00                                            wait=0 ms
   8 c3 PWCTR4   8d 6a                                            wait=0 ms
   9 c4 PWCTR5   8d ee                                            wait=0 ms
  10 c5 VMCTR1   12                                               wait=0 ms
  11 e0 GMCTRP1  03 1b 12 11 3f 3a 32 34 2f 2b 30 3a 00 01 02 05  wait=0 ms
  12 e1 GMCTRN1  03 1b 12 11 32 2f 2a 2f 2e 2c 35 3f 00 00 01 05  wait=0 ms
  13 36 MADCTL   c8                                               wait=0 ms
  14 3a COLMOD   05                                               wait=0 ms
  15 2a CASET    00 02 00 81                                      wait=0 ms
  16 2b RASET    00 03 00 82                                      wait=0 ms
  17 29 DISPON                                                    wait=0 ms
  18 2c RAMWR                                                     wait=0 ms
LK == DT (payload+wait): True
== stock dtb_01 st7735s off-command: 2 commands
   0 28 DISPOFF                                                   wait=0 ms
   1 10 SLPIN                                                     wait=120 ms

Interpretation: ST7735S (ST7735-family command set; MADCTL 0xc8 = MY|MX|BGR, COLMOD 0x05 = 16 bpp RGB565,
visible window column 2..129, row 3..130 => 128x128 glass on a 132x162 GRAM with offset (2,3)).

== 5. Things stock LK does NOT do
- no regulator control (L17/L6 untouched; whatever SBL1/RPM left on is used)
- no panel ID read (hardcoded id 1)
- no TE GPIO, no DSI, no MDP scanout (SPI panel has own GRAM; fb 0x83200000 is only a CPU-side buffer)
- no PWM brightness (MPP4 sink fixed 40 mA, on/off)
