B9L: pre-Linux ST7735S splash from lk1st

2026-10-03 02:11:41 +03:00 · 2026-10-03 02:11:41 +03:00 · 41d7850b12
commit 41d7850b12
parent 4a7224c41f
18 changed files with 2236 additions and 8 deletions
--- a/NOTES.md
+++ b/NOTES.md
@ -1336,3 +1336,5 @@ fast MSS restart re-attach needs investigation; single unreproduced cases (pc1 n
  - Formal run directly from lk1st: PASS (e6849a2b). Nothing flashed.
 - Open: lk1st reflash with the panel code (separate GO); ~1 s dark gap at handoff (Linux gpio-backlight pinctrl/fbcon re-init);
  DT model string "RAM boot B9B"; screen UI. Next stage: battery / charging / power management.
+- B9L-PERSIST (2026-10-03, GO): aboot := lk1st-b9l **15208dbb** (B9L_ABOOT_WRITE_VERIFIED, backup 3b8cd266, rollback b9/b9l/persist/B9L-rollback.sh).
+  First normal boot: splash at LK +340 ms → b9c → Linux fbcon, LTE/Wi-Fi OK. logs/b9/b9l/B9L-PERSIST-RESULT.md.
--- a/README.md
+++ b/README.md
@ -33,7 +33,7 @@
 ## Рабочая цепочка загрузки (baseline B5)

 ```
-Power → stock SBL1 → DB410c TZ (TZ.BF.3.0) → qhypstub → lk1st (aboot, autoboot)
+Power → stock SBL1 → DB410c TZ (TZ.BF.3.0) → qhypstub → lk1st (aboot, autoboot, splash на ST7735S через ~0.4 с)
      → cache: ext2 + extlinux/extlinux.conf → B9C (ядро b9c + DTB b9b + initramfs: модем, время, Wi-Fi, дисплей) → ARM64 Linux → LTE + Wi-Fi AP + консоль на экране
 Fallback: extlinux не найден / не парсится / не грузится → Android boot image из раздела boot (emmc1 rescue)
 ```
@ -46,7 +46,7 @@ Fallback: extlinux не найден / не парсится / не грузит
 | GPT | stock + tz 512K→1M, tzbak перенесён в свободный промежуток @LBA 305184 | primary `6e850a5d`, backup `795952a1` |
 | tz | DB410c TZ.BF.3.0-00714, дополнен нулями до 1 MiB | `8481892f` |
 | hyp | qhypstub, до 512 KiB | `1a963047` |
-| aboot | lk1st (lk2nd 23.1) autoboot, подписан qtestsign, до 1 MiB | `3b8cd266` |
+| aboot | lk1st (lk2nd 23.1 + патч B9L: SPI-панель ST7735S + splash) autoboot, подписан qtestsign, до 1 MiB | `15208dbb` (откат: B5a lk1st `3b8cd266`) |
 | boot | emmc1 rescue image (+ нули до 16 MiB) | `e9579f33` |
 | cache | ext2 + extlinux + B9C (ядро 7.2.7-aurora-b9c, DTB b9b, initramfs B8F + дисплей) | `b9ce13c9` (откат: B8F `857c9c30` → B7C `14fe453a` → T4 `9d3bc890` → B6P `9fea693a`) |
 | recovery | lk2nd 23.1 (fastboot) | `0dfa60a0` |
@ -64,9 +64,11 @@ Golden mm1 (Android boot image, для `fastboot boot`): `aurora-mm1.img` sha256
  `getty` на tty1, UART-консоль сохранена (`console=tty0` стоит **до** `console=ttyMSM0`). Подсветка: pinctrl MPP `function "sink"`, `drive-strength 7`
  + `gpio-backlight` (регистры = стоковые 0x61/0x07/0x80), включается сервисом `aurora-display` через sysfs.
 - Cache B9C: 3 холодных загрузки с eMMC без ввода (2× class A + 1× class B, принято) — консоль ядра на экране, LTE + Wi-Fi AP, время, ошибок дисплея 0.
- B9L (только RAM): lk2nd второй стадии с портом SPI-панели под msm8916 (`b9/b9l/lk2nd-23.1-aurora-b9l.patch`) показывает картинку **до** Linux;
-  L17/L6 на этапе LK уже включены SBL. lk1st с этим кодом не прошит.
- Открыто: UI вместо консоли ядра, регулировка яркости, ~1 с темноты при передаче LK → Linux, прошивка lk1st с заставкой. Материалы: `b9/`, `logs/b9/`, NOTES.md сессия 37.
+- B9L: порт SPI-панели в lk2nd/lk1st под msm8916 (CAF `spi_qup`, клоки QUP4 16 МГц, модуль `lk2nd/aurora`; L17/L6 на этапе LK уже включены SBL).
+  Сначала проверен в RAM (второй lk2nd через `fastboot boot`), затем **прошит в aboot** (lk1st `15208dbb`, сборка воспроизводима, запись с readback
+  и сверкой всех разделов). Теперь при включении splash (`b9/b9l/splash/swag.png` → RGB565) появляется через ~0.4 с, до Linux; затем fbcon.
+  Патч: `b9/b9l/persist/lk2nd-23.1-aurora-b9l-lk1st.patch`, запись/откат: `b9/b9l/persist/B9L-write.sh` / `B9L-rollback.sh`.
+- Открыто: UI вместо консоли ядра, регулировка яркости, ~1 с темноты при передаче LK → Linux. Материалы: `b9/`, `logs/b9/`, NOTES.md сессия 37.

 ## B8 status — Wi-Fi PASS (2026-10-03)

@ -138,6 +140,6 @@ Safety:

 Полные дампы eMMC и разделов, NV/EFS (`modemst1/2`, `fsg`, `fsc`), `persist`, `userdata`, файлы прошивки модема,
 стоковые SBL1/RPM/TZ/aboot/boot/recovery/system, Firehose-программер, DB410c TZ, собранные бинарники,
-Wi-Fi NV (`WCNSS_qcom_wlan_nv.bin`), PSK тестовой AP и образы с ним (B8F/B9C initramfs/cache), логотип из stock LK и картинка-заставка B9L.
+Wi-Fi NV (`WCNSS_qcom_wlan_nv.bin`), PSK тестовой AP и образы с ним (B8F/B9C initramfs/cache), логотип из stock LK.
 Идентификаторы (IMEI, IMSI, ICCID, eMMC CID/serial, Sahara serial, MAC, номера сот, cookies) заменены на `<PLACEHOLDER>`.
 Как это сделано — `tools/publish-sanitize.py`; значения идентификаторов в репозиторий не попадают.
--- a/b9/b9l/BUILD-B9L.md
+++ b/b9/b9l/BUILD-B9L.md
@ -1,5 +1,5 @@
 # B9L lk2nd 2nd-stage build (RAM test only — never flash without a separate GO)
- Base: lk2nd 23.1 e9c8b217 (same tree as lk2nd-build/src, cloned to /home/q/aurora-lkbuild/b9l-src; the original tree is untouched).
+- Base: lk2nd 23.1 e9c8b217 (same tree as lk2nd-build/src, cloned to ~/aurora-lkbuild/b9l-src; the original tree is untouched).
 - Patch: lk2nd-23.1-aurora-b9l.patch (msm8916 QUP4 SPI clock + iomap, gpio_config_blsp_spi, clock_config_blsp_spi clamped to 16 MHz,
  module lk2nd/aurora (st7735s.c), project hook AURORA_SPI_PANEL=1).
 - Command (in b9l-src): make -j4 TOOLCHAIN_PREFIX=arm-none-eabi- LK2ND_DTBS="msm8916-512mb-mtp.dtb" AURORA_SPI_PANEL=1 lk2nd-msm8916
--- a/b9/b9l/SHA256SUMS
+++ b/b9/b9l/SHA256SUMS
@ -8,3 +8,4 @@ bb86eb620c96064b30f03b7165db793a795e23f188a3d1d684baf3680699307e  lk2nd-23.1-aur
 f126eb214ab89d3f3f71abd7ebe8960bb4ab4a13a3a7aba7115c12614d9c7adf  splash/swag.png
 476c9077eeb82386f0bb6c9b17b4583945d60cf262996acf971896bb94141ec6  splash/mk-splash.py
 eb3e0f33bb273a7939208f58f9249dab44e044211a1933cfaf645cf9081d9f5c  splash/aurora_splash.h
+94a94490e5eb9cce0d6c712f1ae228719d2f54903c7fbf104f3444459b8c8fd2  BUILD-B9L.md
--- a/b9/b9l/persist/B9L-PERSIST-PLAN.md
+++ b/b9/b9l/persist/B9L-PERSIST-PLAN.md
@ -0,0 +1,34 @@
+# B9L-PERSIST — lk1st with ST7735S splash: build done, write NOT done (waiting for a separate GO)
+
+## Images
+| | file | size | sha256 |
+|---|---|---|---|
+| unsigned | lk1st-b9l-unsigned.mbn | 446664 B | 16f9ec0ad8289fbf62acfa05733025fd254503229cf9cf5266ec190ecbd35ec7 |
+| signed (qtestsign 0eef3b5 `-v 3 aboot`) | aboot-lk1st-b9l.mbn | 367380 B | 0ddbc29a6bbdf0c8ba280dd7a4eaad793531600bce32528a92d59c9110f6bd0a |
+| final (zero-padded to the aboot partition, 1 MiB) | aboot-lk1st-b9l.pad1M | 1048576 B | 15208dbb4feafccd72d2b06db5714cd746c216701f0ef8822c58bb47105d37c4 |
+| current aboot (B5a) for comparison/rollback | b5a/aboot-lk1st-aurora-autoboot.pad1M | 1048576 B (signed 327196) | 3b8cd266… (unsigned 33c452e4, signed 7b3fb5b3) |
+
+Reproducibility: a clean lk2nd 23.1 e9c8b217 clone with the same command (`lk1st-msm8916 LK2ND_BUNDLE_DTB=msm8916-512mb-mtp.dtb`) + the same
+qtestsign gives 33c452e4 → 7b3fb5b3 → 3b8cd266, i.e. bit-identical to the flashed aboot. The B9L build differs only by the patch and the flags.
+
+## Difference from the current lk1st
+- config.h: `+AURORA_SPLASH 1`, `+WITH_LK2ND_AURORA 1` only (config-vs-current-lk1st.diff).
+- Objects: NEW lk2nd/aurora/st7735s.o, platform/msm_shared/spi_qup.o; changed platform/msm8916/{gpio,acpuclock,msm8916-clock}.o,
+  lk2nd/version/tag.o ("23.1-dirty"). Everything else is identical (normalised objdump compare).
+- st7735s.o, spi_qup.o, gpio.o, acpuclock.o, msm8916-clock.o are **identical** to the RAM-tested B9L lk2nd (e6849a2b, formal PASS).
+- ELF: the same 4-phdr layout. LOAD 0x8f600000 filesz 0x49b0c (was 0x3fe14), memsz 0x82dd8 (was 0x76dd0) → heap up to 0x8f700000 = 500 KiB (was 548);
+  the hash segment is at 0x8f683000, after the image.
+- Present in the final image: all [B9L …] log strings, "frame source: splash image", the 32768-byte splash blob (×1).
+  No "Fastboot mode was forced" (autoboot kept).
+- Behaviour change: every lk1st start (normal boot and RESET fastboot) runs the panel init (+~380 ms) before lk2nd boot/fastboot.
+
+## Plan (after GO only; on 480s; board in HW EDL 9008)
+1. `b9/b9l/persist/B9L-write.sh`:
+   - G0: loader sha, candidate 15208dbb/1 MiB, rollback image 3b8cd266/1 MiB, 9008 present.
+   - G1: printgpt + serial, aboot geometry 0x8100000/0x100000, GPT == A3, boot == e9579f33, cache == B9C b9ce13c9.
+     **Backup:** live aboot read to `logs/b9/b9l/W/pre-aboot.bin`, must be 3b8cd266.
+   - W: write aboot only → readback → cmp → ABOOT_MATCH.
+   - V: GPT p/b, tzbak, boot, cache, sbl1 rpm tz hyp recovery modemst1/2 fsg fsc persist == A3, modem/system/userdata == A4pre → `B9L_ABOOT_WRITE_VERIFIED`.
+2. Full power-off → normal power-on: expect the splash ~0.4 s after LK start → lk2nd extlinux `b9c` → Linux fbcon. Check UART + operator.
+3. Rollback if anything fails (lk1st does not start / no UART / boot regression): HW EDL → `b9/b9l/persist/B9L-rollback.sh` → aboot := 3b8cd266
+   (boot/cache untouched). If readback mismatches during the write: do not reboot, run the rollback at once.
--- a/b9/b9l/persist/B9L-rollback.sh
+++ b/b9/b9l/persist/B9L-rollback.sh
@ -0,0 +1,12 @@
+#!/bin/bash
+# B9L rollback — restore the B5a lk1st autoboot aboot (3b8cd266, operational since 2026-09-30). Needs 9008 via HW EDL (D+ -> GND).
+# Only aboot is written; boot/cache untouched. Pre-write backup of the live aboot: logs/b9/b9l/W/pre-aboot.bin (must also be 3b8cd266).
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin ; O=logs/b9/b9l/rollback ; mkdir -p $O
+B=b5a/aboot-lk1st-aurora-autoboot.pad1M
+[ "$(sha256sum $B | cut -d' ' -f1)" = 3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85 ] || { echo "STOP: rollback image hash"; exit 1; }
+lsusb | grep -q 05c6:9008 || { echo "STOP: no 9008"; exit 1; }
+edl --loader=$L printgpt > $O/00-printgpt.log 2>&1
+edl --loader=$L w aboot $B > $O/aboot-w.log 2>&1
+edl --loader=$L r aboot $O/aboot-rb.bin > /dev/null 2>&1 ; cmp $B $O/aboot-rb.bin && echo ABOOT_RESTORED_B5A
+sha256sum $B $O/aboot-rb.bin
--- a/b9/b9l/persist/B9L-write.sh
+++ b/b9/b9l/persist/B9L-write.sh
@ -0,0 +1,48 @@
+#!/bin/bash
+# B9L-PERSIST — the ONLY write: aboot := lk1st autoboot + B9L ST7735S panel/splash (lk2nd 23.1 + b9l patch, AURORA_SPI_PANEL=1 AURORA_SPLASH=1).
+# Run on 480s ONLY after an explicit GO for the write. Derived from b5a/A4-write.sh + b9/b9c/cache/B9C-write.sh (gates/verify). Only aboot is written;
+# boot (emmc1 e9579f33), cache (B9C b9ce13c9) and everything else are checked before and after. The live aboot (must be 3b8cd266) is read back first = backup.
+# Entry: HW EDL (battery on, D+ -> GND, plug USB, release). Never `edl reset`. Stops at the first failed gate.
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin
+O=logs/b9/b9l/W ; A3=logs/b5a/A3 ; P=logs/b5a/A4pre ; mkdir -p $O
+NEW=b9/b9l/persist/aboot-lk1st-b9l.pad1M ; NEW_SHA=15208dbb4feafccd72d2b06db5714cd746c216701f0ef8822c58bb47105d37c4
+OLD=b5a/aboot-lk1st-aurora-autoboot.pad1M ; OLD_SHA=3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85   # current aboot (B5a)
+BOOT_SHA=e9579f33c7304cd47f487f2b61cd9226dc04fd3a63775d62b4b95fc15bd3ebff
+CACHE_SHA=b9ce13c9f48e36a5054c0ae3c39dc3f184b1fc2eea1d57d4b8bd8e9ae800a37b
+die(){ echo "STOP: $*"; exit 1; }
+sha(){ sha256sum "$1" | cut -d" " -f1; }
+E(){ edl --loader=$L "$@"; }
+echo "== G0 inputs"
+[ "$(sha $L)" = 53f193500c03248f0d671ab57bfe9ca8a42967e97f28403294b4b3f854075aca ] || die loader
+[ "$(sha $NEW)" = $NEW_SHA ] && [ $(stat -c %s $NEW) = 1048576 ] || die candidate
+[ "$(sha $OLD)" = $OLD_SHA ] && [ $(stat -c %s $OLD) = 1048576 ] || die rollback-image
+lsusb | grep -q 05c6:9008 || die "no 9008"
+echo "== G1 identity + geometry + baseline"
+E printgpt > $O/00-printgpt.log 2>&1 || die printgpt
+grep -aq "Serial: *0x<SAHARA_SERIAL>" $O/00-printgpt.log || grep -aq "Mode detected: firehose" $O/00-printgpt.log || die serial
+grep -a "^aboot:" $O/00-printgpt.log | grep -q "Offset 0x0000000008100000, Length 0x0000000000100000" || die aboot-geometry
+E rs 0 34 $O/pre-gptp.bin >/dev/null 2>&1; cmp $O/pre-gptp.bin $A3/gpt-primary-34.bin || die gpt-changed
+E r boot  $O/pre-boot.bin  >/dev/null 2>&1; [ "$(sha $O/pre-boot.bin)"  = $BOOT_SHA ]  || die boot-not-emmc1
+E r cache $O/pre-cache.bin >/dev/null 2>&1; [ "$(sha $O/pre-cache.bin)" = $CACHE_SHA ] || die cache-not-b9c
+E r aboot $O/pre-aboot.bin >/dev/null 2>&1; [ "$(sha $O/pre-aboot.bin)" = $OLD_SHA ]   || die aboot-not-3b8cd266
+echo "== W aboot := lk1st-b9l (LBA 264192, 2048 sectors)"
+E w aboot $NEW > $O/10-aboot-write.log 2>&1; echo "rc=$?"; grep -a "Wrote" $O/10-aboot-write.log
+E r aboot $O/11-aboot-readback.bin > $O/11-aboot-readback.log 2>&1 || die readback-rc
+sha256sum $NEW $O/11-aboot-readback.bin
+cmp $NEW $O/11-aboot-readback.bin || die "ABOOT READBACK MISMATCH — do NOT reboot; run b9/b9l/persist/B9L-rollback.sh"
+echo ABOOT_MATCH
+echo "== V everything else unchanged"
+E rs 0 34        $O/post-gptp.bin  >/dev/null 2>&1; cmp $O/post-gptp.bin  $A3/gpt-primary-34.bin || die gptp
+E rs 7634911 33  $O/post-gptb.bin  >/dev/null 2>&1; cmp $O/post-gptb.bin  $A3/gpt-backup-33.bin  || die gptb
+E rs 305184 1024 $O/post-tzbak.bin >/dev/null 2>&1; cmp $O/post-tzbak.bin $A3/tzbak-305184.bin   || die tzbak
+E r boot  $O/post-boot.bin  >/dev/null 2>&1; [ "$(sha $O/post-boot.bin)"  = $BOOT_SHA ]  || die boot
+E r cache $O/post-cache.bin >/dev/null 2>&1; [ "$(sha $O/post-cache.bin)" = $CACHE_SHA ] || die cache
+for p in sbl1 rpm tz hyp recovery modemst1 modemst2 fsg fsc persist; do
+  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $A3/$p.bin || die "$p changed"; echo "$p == A3"
+done
+for p in modem system userdata; do
+  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $P/$p.bin || die "$p changed"; echo "$p == A4pre"; rm -f $O/post-$p.bin
+done
+(cd $O && sha256sum *.bin > SHA256SUMS)
+echo "B9L_ABOOT_WRITE_VERIFIED — power off fully (USB, then battery) before the first boot"
--- a/b9/b9l/persist/SHA256SUMS
+++ b/b9/b9l/persist/SHA256SUMS
@ -0,0 +1,11 @@
+16f9ec0ad8289fbf62acfa05733025fd254503229cf9cf5266ec190ecbd35ec7  lk1st-b9l-unsigned.mbn
+0ddbc29a6bbdf0c8ba280dd7a4eaad793531600bce32528a92d59c9110f6bd0a  aboot-lk1st-b9l.mbn
+15208dbb4feafccd72d2b06db5714cd746c216701f0ef8822c58bb47105d37c4  aboot-lk1st-b9l.pad1M
+9f2b267244450f6674e80f01e30c9dd843659a131028278827aa666e3975c268  B9L-write.sh
+9358f0cb2b05a1a2525dd57496d41cc01a90ac1618db93863a24ce6936525eab  B9L-rollback.sh
+dcd182d495046ce30ebba70d1c04b5a119f3d426feb5bff29912a4b81feaf816  lk2nd-23.1-aurora-b9l-lk1st.patch
+f0a0a032533ad2c180f872d9e896b9ed1ef274d1ab610c157a62a17d8724fd39  config-vs-current-lk1st.diff
+1b8f6b19eb4b23e6a69ff10391c3b7c201c8fefe9eff10e0e2d083d8dd235f51  build-lk1st-b9l.log
+7085dd78a92e1e488220bf4e405a4f3b336ff0eae1ca053172a9cbbead1659ab  sign-b9l.log
+d7250389fe48c22266cfc10dcd698aa2c2950f35c9637c97018d1493a8fd44ed  structure-vs-current.txt
+5ffd39d58cd6c29e1dd3977c122da0361182671e965c852712df188744be4cc0  B9L-PERSIST-PLAN.md
--- a/b9/b9l/persist/b9l-boot.sh
+++ b/b9/b9l/persist/b9l-boot.sh
@ -0,0 +1,53 @@
+#!/bin/sh
+# 480s side, B9C boot K MODE (derived from b8f-boot.sh). MODE=ram: RESET-held power-on -> lk1st fastboot -> `fastboot boot` B9C RAM image.
+# MODE=cold: normal power-on (no RESET, no fastboot) -> lk2nd extlinux from eMMC cache. Script only observes + reads over telnet;
+# nothing is written to eMMC. Visual display checks need the operator. Adds display/fbcon/getty/console checks to the B8F snapshot.
+K=$1; MODE=$2; case "$MODE" in ram|cold) ;; *) echo "usage: $0 K ram|cold"; exit 2;; esac
+cd ~/doc/modem/jz08-aurora; O=logs/b9/b9l/boot$MODE$K; mkdir -p $O; IMG=b9/b9c/out/aurora-b9c.img
+A=$O/host-actions.txt; act() { echo "$(date -u +%H:%M:%S.%3N) $*" | tee -a $A; }
+tn() { { sleep 1; sed "s/\$/\r/" "$1"; sleep $2; } | ncat 172.16.42.1 23 | tr -d "\000\r"; }
+OLD=$(ps -eo pid,cmd | grep "[u]artlog.py /dev/ttyUSB0" | awk '{print $1}'); [ -n "$OLD" ] && kill $OLD; sleep 1
+U=logs/uart/b9l-boot$MODE$K-$(date +%Y%m%d-%H%M%S); setsid nohup python3 tools/uartlog.py /dev/ttyUSB0 $U > $U.stderr 2>&1 < /dev/null &
+if [ $MODE = ram ]; then
+	echo "fa855e1c84763861d8b2f6bd7ed669e8ab625aa42178317883fabff39dec4fce  $IMG" | sha256sum -c || exit 1
+	act "B9L-PERSIST $MODE$K: waiting for fastboot <EMMC_SERIAL> (power off >= 90 s, then RESET held + battery -> USB)"
+	if fastboot devices 2>/dev/null | grep -q <EMMC_SERIAL>; then act "already in fastboot - wait for power-off"; until ! fastboot devices 2>/dev/null | grep -q <EMMC_SERIAL>; do sleep 1; done; fi
+	i=0; until fastboot devices 2>/dev/null | grep -q <EMMC_SERIAL>; do i=$((i+1)); [ $i -ge 600 ] && { act "ABORT: no fastboot"; exit 1; }; sleep 2; done
+	act "fastboot present"; { fastboot boot $IMG 2>&1; echo "rc=$?"; } | tee -a $A
+else
+	act "B9L-PERSIST $MODE$K: waiting for the board to go away (power off >= 90 s), then normal power-on WITHOUT RESET"
+	until ! ping -c1 -W1 172.16.42.1 >/dev/null 2>&1; do sleep 1; done; act "board unreachable (powered off)"
+	until ping -c1 -W1 172.16.42.1 >/dev/null 2>&1; do fastboot devices 2>/dev/null | grep -q <EMMC_SERIAL> && { act "ABORT: board is in fastboot - RESET was held?"; exit 1; }; sleep 1; done
+fi
+i=0; until ping -c1 -W1 172.16.42.1 >/dev/null 2>&1; do i=$((i+1)); [ $i -ge 180 ] && { act "ABORT: NCM not up"; cp $U.log $O/uart.log; exit 1; }; sleep 1; done; act "NCM ping ok"
+R=$(grep -a "rtc-pm8xxx.*setting system clock" $U.log | tail -1 | sed -n 's/.*(\([0-9]*\)).*/\1/p'); C=B; [ -n "$R" ] && [ "$R" -lt 40 ] && C=A; act "RTC at boot ${R:-?} s -> class $C"
+printf 'cat /proc/device-tree/model; echo; uname -r; grep -E "START OK|FAIL in|rollback" /run/aurora-modem/lifecycle.log | tail -1\n' > $O/.w
+i=0; until tn $O/.w 3 | grep -qE "^\[[0-9.]+\] .*(=== START OK|FAIL in|rollback)"; do i=$((i+1)); [ $i -ge 80 ] && { act "no START OK/FAIL after ~12 min"; break; }; sleep 6; done
+tn $O/.w 3 | grep -aE "Aurora|aurora-b8|START OK|FAIL" | tee -a $A
+printf 'grep -E "AP ENABLED|FAIL" /run/aurora-wifi/wifi.log | tail -1\n' > $O/.a
+i=0; until tn $O/.a 3 | grep -qE "^\[[0-9.]+\] (=== AP ENABLED|FAIL)"; do i=$((i+1)); [ $i -ge 20 ] && { act "no AP ENABLED/FAIL after ~3 min"; break; }; sleep 6; done
+act "wifi: $(tn $O/.a 3 | grep -E '^\[[0-9.]+\] (=== AP ENABLED|FAIL)' | tail -1)"
+printf 'grep -E "SNTP (check|STEP|: )" /run/aurora-modem/lifecycle.log | tail -2\n' > $O/.s
+i=0; until tn $O/.s 3 | grep -qE "^\[[0-9.]+\] SNTP"; do i=$((i+1)); [ $i -ge 15 ] && break; sleep 4; done; act "sntp: $(tn $O/.s 3 | grep -E '^\[[0-9.]+\] SNTP' | tail -2 | tr '\n' ' ')"
+cat > $O/.c <<'C'
+echo SNAP-BEGIN; cat /proc/uptime; date -u; cat /proc/device-tree/model; echo; uname -a; cat /proc/cmdline
+echo ---time; cat /run/aurora-modem/time-set; grep -E "TIME|SNTP" /run/aurora-modem/lifecycle.log | tail -4
+echo ---modem; /etc/init.d/aurora-modem status
+echo ---wifi; /etc/init.d/aurora-wifi status; echo ---wifilog; cat /run/aurora-wifi/wifi.log; cat /run/aurora-wifi/service.log; echo ---hostapdlog; cat /run/aurora-wifi/hostapd.log
+for r in /sys/class/remoteproc/*; do echo "RP $(cat $r/name)=$(cat $r/state)"; done; iw dev
+echo ---dmesg-wifi; dmesg | grep -iE "wcn36xx|wcnss|a204000|cfg80211|aurora-wifi|crash|watchdog"
+echo ---ping; ping -c4 -W3 -I wwan0 77.88.8.8 | tail -2
+echo ---display; /etc/init.d/aurora-display status; cat /run/aurora-display/display.log; cat /run/aurora-display/service.log
+echo ---consoles; cat /sys/class/tty/console/active; for v in /sys/class/vtconsole/vtcon*; do echo "$v $(cat $v/bind) $(cat $v/name)"; done; ls -l /proc/[0-9]*/fd/0 2>/dev/null | grep -E "ttyMSM0|tty1|console" | sed "s/.* \/proc/\/proc/"
+echo ---getty; hostname; ps | grep -E "[g]etty|[c]ttyhack| sh$"
+echo ---fb; ls -l /dev/dri/card0 /dev/fb0; for f in name bits_per_pixel virtual_size stride; do echo "fb0 $f=$(cat /sys/class/graphics/fb0/$f)"; done; cat /sys/class/drm/card0-SPI-1/enabled /sys/class/drm/card0-SPI-1/dpms
+echo ---regs; for r in /sys/class/regulator/regulator.*; do n=$(cat $r/name); case $n in l6|l17) echo "$n $(cat $r/state) $(cat $r/microvolts) users=$(cat $r/num_users)";; esac; done
+echo ---bl; for f in bl_power brightness actual_brightness; do echo "bl $f=$(cat /sys/class/backlight/backlight/$f)"; done
+echo ---dmesg-display; dmesg | grep -iE "drm|panel|mipi|spi_qup|78b8000|fbcon|Console: |frame buffer|backlight|aurora-display|l17"
+echo ---display-errors; dmesg | grep -iE "drm|panel|mipi|spi0|fbcon|backlight|aurora-display" | grep -ciE "err|fail|timeout|warn"
+echo ---emmc; awk "{print \"w=\"\$5\" s=\"\$7}" /sys/block/mmcblk0/stat
+echo SNAP-END
+C
+tn $O/.c 25 > $O/snapshot.txt; act "snapshot: $(grep -c SNAP-END $O/snapshot.txt) end markers; $(grep -E '^RP a204' $O/snapshot.txt)"
+printf 'dmesg > /tmp/dm.txt; nc -l -p 9881 < /tmp/dm.txt &\n' > $O/.d; tn $O/.d 3 >/dev/null; sleep 1; ncat --recv-only 172.16.42.1 9881 > $O/dmesg.full
+cp $U.log $O/uart.log; act "B9L-PERSIST $MODE$K END - operator visual check next"
--- a/b9/b9l/persist/config-vs-current-lk1st.diff
+++ b/b9/b9l/persist/config-vs-current-lk1st.diff
@ -0,0 +1,4 @@
+54a55
+> #define AURORA_SPLASH 1
+79a81
+> #define WITH_LK2ND_AURORA 1
--- a/b9/b9l/persist/lk2nd-23.1-aurora-b9l-lk1st.patch
+++ b/b9/b9l/persist/lk2nd-23.1-aurora-b9l-lk1st.patch
--- a/b9/b9l/persist/structure-vs-current.txt
+++ b/b9/b9l/persist/structure-vs-current.txt
@ -0,0 +1,10 @@
+current aboot 3b8cd266: file 1048576 B, non-zero end 327193 B, entry 0x8f600000, 4 phdrs
+   type 0x00000000 off 0x000000 vaddr 0x00000000 filesz 0x0000b4 memsz 0x000000 flags 0x07000000
+   type 0x00000000 off 0x001000 vaddr 0x8f677000 filesz 0x0008d8 memsz 0x001000 flags 0x02200000
+   type 0x70000001 off 0x04fe14 vaddr 0x8f63dca0 filesz 0x000008 memsz 0x000008 flags 0x00000004
+   type 0x00000001 off 0x010000 vaddr 0x8f600000 filesz 0x03fe14 memsz 0x076dd0 flags 0x00000007
+B9L aboot 15208dbb: file 1048576 B, non-zero end 367377 B, entry 0x8f600000, 4 phdrs
+   type 0x00000000 off 0x000000 vaddr 0x00000000 filesz 0x0000b4 memsz 0x000000 flags 0x07000000
+   type 0x00000000 off 0x001000 vaddr 0x8f683000 filesz 0x0008d8 memsz 0x001000 flags 0x02200000
+   type 0x70000001 off 0x059b0c vaddr 0x8f647854 filesz 0x000008 memsz 0x000008 flags 0x00000004
+   type 0x00000001 off 0x010000 vaddr 0x8f600000 filesz 0x049b0c memsz 0x082dd8 flags 0x00000007
--- a/b9/b9l/splash/swag.png
+++ b/b9/b9l/splash/swag.png
--- a/logs/b9/b9l/B9L-PERSIST-RESULT.md
+++ b/logs/b9/b9l/B9L-PERSIST-RESULT.md
@ -0,0 +1,19 @@
+# B9L-PERSIST — lk1st with ST7735S splash flashed to aboot — PASS (2026-10-03)
+
+**aboot = lk1st-b9l 15208dbb** (lk2nd 23.1 + b9l patch, AURORA_SPI_PANEL=1 AURORA_SPLASH=1; unsigned 16f9ec0a, signed 0ddbc29a).
+Previous aboot 3b8cd266 backed up (logs/b9/b9l/W/pre-aboot.bin); rollback = `b9/b9l/persist/B9L-rollback.sh` (HW EDL, aboot only).
+
+## Write (HW EDL, b9/b9l/persist/B9L-write.sh) — B9L_ABOOT_WRITE_VERIFIED
+pre-aboot 3b8cd266 → "Wrote … to sector 264192" → readback 15208dbb == candidate. GPT p/b, tzbak, boot e9579f33, cache b9ce13c9,
+sbl1/rpm/tz/hyp/recovery/modemst1/2/fsg/fsc/persist == A3, modem/system/userdata == A4pre → W/SHA256SUMS.
+Incident: the first tool call was shown as rejected but had already started on 480s and completed normally. An operator retry while it was still
+verifying userdata failed harmlessly at G1 (USB busy) and overwrote W/00-printgpt.log + W-console.txt. Details: W-NOTE.txt.
+
+## First normal power-on (no RESET), bootcold1/
+- UART: one `welcome to lk` (new lk1st) → `[B9L +0 ms]` at LK 60 ms → 19 commands 0 failures (`SPI_IO_CONTROL=401`) → `frame source: splash image`, sent ret=0
+  → MPP4 61/80/07 (L6/L17 on) → end at +380 ms → `Trying to boot 'b9c'` → Linux.
+- Linux: panel-mipi-dbi 1.42 s, fbcon 21x16 1.77 s, DISPLAY READY 7.86 s (no unblank), display errors 0.
+- START OK 72.4 s, AP ENABLED 76.9 s, ping 4/4, MPSS+WCNSS running, crash 0, eMMC w=0. Class B (RTC 514 s, short off-time) — not a criterion for this check.
+- Operator: everything seen (own splash before Linux, then the Linux console).
+
+Power-on → splash (~0.4 s after LK start) → b9c → Linux fbcon is now the persistent boot path.
--- a/logs/b9/b9l/W-NOTE.txt
+++ b/logs/b9/b9l/W-NOTE.txt
@ -0,0 +1,7 @@
+B9L aboot write — reconstruction (2026-10-03):
+- Run 1 (pid 30167, started ~01:54 local on 480s): the tool call was displayed as rejected but the ssh command had already started; it ran to completion:
+  pre-aboot.bin = 3b8cd266 (backup), "Wrote b9/b9l/persist/aboot-lk1st-b9l.pad1M to sector 264192", 11-aboot-readback.bin = 15208dbb == candidate (cmp OK),
+  post-* checks: GPT p/b, tzbak, boot, cache, sbl1 rpm tz hyp recovery modemst1/2 fsg fsc persist == A3, modem/system/userdata == A4pre (files removed after match),
+  W/SHA256SUMS written (only reached after every gate) => B9L_ABOOT_WRITE_VERIFIED.
+- Run 2 (operator retry while run 1 was still reading userdata): edl got USBError 16 Resource busy, stopped at G1 printgpt; it overwrote
+  W/00-printgpt.log and W-console.txt (run-1 console lost). It wrote nothing.
--- a/logs/b9/b9l/bootcold1/host-actions.txt
+++ b/logs/b9/b9l/bootcold1/host-actions.txt
@ -0,0 +1,11 @@
+23:01:46.740 B9L-PERSIST cold1: waiting for the board to go away (power off >= 90 s), then normal power-on WITHOUT RESET
+23:01:47.743 board unreachable (powered off)
+23:02:32.254 NCM ping ok
+23:02:32.256 RTC at boot 514 s -> class B
+~ # [6ncat /proc/device-tree/model; echo; uname -r; grep -E "START OK|FAIL in|rollb
+JZ08AU Aurora (RAM boot B9B)
+[82.20] === START OK in 72.4s (wwan0 10.86.108.125/30, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )
+23:04:08.375 wifi: [86.68] === AP ENABLED ssid=aurora-b8f ch=6 pid=2721 in 76.93s
+23:04:16.407 sntp: [97.62] SNTP check ( 89.109.251.21 89.109.251.22 89.109.251.23): 14 replies; best offset delay server: +0.526425 0.059569 89.109.251.22: (offset > 0 = clock behind) 
+23:04:42.424 snapshot: 2 end markers; RP a204000.remoteproc=running
+23:04:47.461 B9L-PERSIST cold1 END - operator visual check next
--- a/logs/b9/b9l/bootcold1/snapshot.txt
+++ b/logs/b9/b9l/bootcold1/snapshot.txt
@ -0,0 +1,200 @@
+<EFBFBD><EFBFBD><01><><1F><><01><>
+
+
+BusyBox v1.37.0 (Debian 1:1.37.0-6+b9) built-in shell (ash)
+Enter 'help' for a list of built-in commands.
+
+~ # [6necho SNAP-BEGIN; cat /proc/uptime; date -u; cat /proc/device-tree/model; ech
+o; uname -a; cat /proc/cmdline
+SNAP-BEGIN
+114.61 416.56
+Fri Oct  2 23:04:16 UTC 2026
+JZ08AU Aurora (RAM boot B9B)
+Linux aurora 7.2.7-aurora-b9c #9 SMP PREEMPT Sat Oct  3 03:06:50 +06 2026 aarch64 GNU/Linux
+earlycon console=tty0 console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init fbcon=font:6x8 consoleblank=0
+~ # echo ---time; cat /run/aurora-modem/time-set; grep -E "TIME|SNTP" /run/auror
+a-modem/lifecycle.log | tail -4
+---time
+1790982164 21.69 REG:registered/attached qmi-dms
+[21.83] TIME probe 6 [REGISTERED]: dms_ms=1475017364075 dms_utc=1790982164.075 nitz=2026-10-02 23:02:44 dms-nitz=+0.11 clock=1790982164 -> VALID (ok)
+[82.32] TIME probe 7 [BEARER_CONNECTED]: dms_ms=1475017424557 dms_utc=1790982224.557 nitz=2026-10-02 23:03:44 dms-nitz=+0.60 clock=1790982224 -> VALID (ok)
+[97.62] SNTP check ( 89.109.251.21 89.109.251.22 89.109.251.23): 14 replies; best offset delay server: +0.526425 0.059569 89.109.251.22: (offset > 0 = clock behind)
+[97.63] SNTP: |offset| < 1s - clock kept (no slew: STA_UNSYNC stays, RTC_SYSTOHC never engages)
+~ # echo ---modem; /etc/init.d/aurora-modem status
+---modem
+service: idle
+controller: BEARER_CONNECTED
+remoteproc: 4080000.remoteproc running (/sys/class/remoteproc/remoteproc0) fw=mba.mbn
+rmtfs:      pid='1159' writes_logged=1
+qmi dev:    /dev/wwan0qmi0  qmi-proxy='1979'
+daemons:    udevd='1859' dbus='1887' polkitd='1891' ModemManager='1902'
+  mm plugin: qcom-soc
+  mm primary port: wwan0qmi0
+  mm state: connected
+  mm power state: on
+  mm access tech: lte
+  mm signal quality: 65% (recent)
+  mm operator name: Beeline
+  mm registration: home
+  bearer 1:  Status connected: yes; interface: wwan0; address: 10.86.108.125;
+wwan:       wwan0 UP 10.86.108.125/30
+wwan up:    1 of 8
+routes:     1.1.1.1 dev wwan0 scope link  src 10.86.108.125 ;10.10.22.3 dev wwan0 scope link  src 10.86.108.125 ;10.86.108.124/30 dev wwan0 scope link  src 10.86.108.125 ;77.88.8.8 dev wwan0 scope link  src 10.86.108.125 ;89.109.251.21 dev wwan0 scope link  src 10.86.108.125 ;89.109.251.22 dev wwan0 scope link  src 10.86.108.125 ;89.109.251.23 dev wwan0 scope link  src 10.86.108.125 ;194.186.191.1 dev wwan0 scope link  src 10.86.108.125 ;
+bam-dmux:   suspended active_ms=11253 suspended_ms=103001 control=auto
+usb0:       172.16.42.1/24 route-to-host: 172.16.42.2 dev usb0  src 172.16.42.1 
+emmc:       writes_completed=0 sectors_written=0
+time:       2026-10-02 23:04:17 UTC; set: 1790982164 21.69 REG:registered/attached qmi-dms; probes: 7
+dmesg-errs: 0
+~ # echo ---wifi; /etc/init.d/aurora-wifi status; echo ---wifilog; cat /run/auro
+ra-wifi/wifi.log; cat /run/aurora-wifi/service.log; echo ---hostapdlog; cat /run
+/aurora-wifi/hostapd.log
+---wifi
+service: idle
+remoteproc: a204000.remoteproc running (/sys/class/remoteproc/remoteproc1)
+crash=0 watchdog=0 fatal=0
+wlan0: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP>  ssid aurora-b8f type AP channel 6 (2437 MHz), width: 20 MHz, center1: 2437 MHz 
+hostapd: pid=2721 0 connects, 0 disconnects
+[82.90] WCNSS /sys/class/remoteproc/remoteproc1 state=running
+[85.63] wlan0 up addr=<MAC> (wcn36xx: firmware WLAN version 'WCN v2.0 RadioPhy vUnknown with 19.2MHz XO')
+[86.68] === AP ENABLED ssid=aurora-b8f ch=6 pid=2721 in 76.93s
+---wifilog
+[9.76] === WIFI START (wait for modem START OK/FAIL up to 300s)
+[82.40] modem gate after 72s: [82.20] === START OK in 72.4s (wwan0 10.86.108.125/30, routes: 10.10.22.3 194.18
+[82.90] WCNSS /sys/class/remoteproc/remoteproc1 state=running
+[85.63] wlan0 up addr=<MAC> (wcn36xx: firmware WLAN version 'WCN v2.0 RadioPhy vUnknown with 19.2MHz XO')
+[86.68] === AP ENABLED ssid=aurora-b8f ch=6 pid=2721 in 76.93s
+[9.76] === WIFI START (wait for modem START OK/FAIL up to 300s)
+[82.40] modem gate after 72s: [82.20] === START OK in 72.4s (wwan0 10.86.108.125/30, routes: 10.10.22.3 194.18
+[82.90] WCNSS /sys/class/remoteproc/remoteproc1 state=running
+[85.63] wlan0 up addr=<MAC> (wcn36xx: firmware WLAN version 'WCN v2.0 RadioPhy vUnknown with 19.2MHz XO')
+[86.68] === AP ENABLED ssid=aurora-b8f ch=6 pid=2721 in 76.93s
+=== service start rc=0 86.69
+---hostapdlog
+1790982228.343416: VLAN: vlan_set_name_type: SET_VLAN_NAME_TYPE_CMD name_type=2 failed: No error information
+1790982228.471078: wlan0: interface state UNINITIALIZED->ENABLED
+1790982228.471123: wlan0: AP-ENABLED 
+~ # for r in /sys/class/remoteproc/*; do echo "RP $(cat $r/name)=$(cat $r/state)
+"; done; iw dev
+RP 4080000.remoteproc=running
+RP a204000.remoteproc=running
+phy#0
+        Interface wlan0
+                ifindex 12
+                wdev 0x1
+                addr <MAC>
+                ssid aurora-b8f
+                type AP
+                channel 6 (2437 MHz), width: 20 MHz, center1: 2437 MHz
+                txpower 20.00 dBm
+                multicast TXQ:
+                        qsz-byt qsz-pkt flows   drops   marks   overlmt hashcol tx-bytes        tx-packets
+                        0       0       0       0       0       0       0       0               0
+~ # echo ---dmesg-wifi; dmesg | grep -iE "wcn36xx|wcnss|a204000|cfg80211|aurora-
+wifi|crash|watchdog"
+---dmesg-wifi
+[    0.000000] OF: reserved mem: 0x000000008b600000..0x000000008bbfffff (6144 KiB) nomap non-reusable wcnss@8b600000
+[    0.968838] remoteproc remoteproc0: releasing a204000.remoteproc
+[    0.996520] qcom-wcnss-pil a204000.remoteproc: supply vddcx not found, using dummy regulator
+[    1.004997]  a204000.remoteproc.iris: failed to get regulators
+[    1.017964] remoteproc remoteproc0: releasing a204000.remoteproc
+[    1.052715] qcom-wcnss-pil a204000.remoteproc: supply vddcx not found, using dummy regulator
+[    1.069877] remoteproc remoteproc1: a204000.remoteproc is available
+[    1.412563] remoteproc remoteproc1: Direct firmware load for wcnss.mdt failed with error -2
+[    1.415283] remoteproc remoteproc1: powering up a204000.remoteproc
+[    1.423459] remoteproc remoteproc1: Direct firmware load for wcnss.mdt failed with error -2
+[    1.818893] cfg80211: Loading compiled-in X.509 certificates for regulatory database
+[    1.861144] cfg80211: failed to load regulatory.db
+[    9.910467] [aurora-wifi] === WIFI START (wait for modem START OK/FAIL up to 300s)
+[   82.551324] [aurora-wifi] modem gate after 72s: [82.20] === START OK in 72.4s (wwan0 10.86.108.125/30, routes: 10.10.22.3 194.18
+[   82.574793] remoteproc remoteproc1: powering up a204000.remoteproc
+[   82.576346] remoteproc remoteproc1: Booting fw image wcnss.mdt, size 7260
+[   83.036648] remoteproc remoteproc1: remote processor a204000.remoteproc is now up
+[   83.054841] [aurora-wifi] WCNSS /sys/class/remoteproc/remoteproc1 state=running
+[   83.158869] qcom_wcnss_ctrl remoteproc1:smd-edge.WCNSS_CTRL.-1.-1: WCNSS Version 1.5 1.2
+[   83.182898] wcn36xx: mac address: <MAC>
+[   85.715937] wcn36xx: firmware WLAN version 'WCN v2.0 RadioPhy vUnknown with 19.2MHz XO' and CRM version 'CNSS-PR-1-4-2-c4-00084'
+[   85.730098] wcn36xx: firmware API 1.5.1.2, 41 stations, 2 bssids
+[   85.780989] [aurora-wifi] wlan0 up addr=<MAC> (wcn36xx: firmware WLAN version 'WCN v2.0 RadioPhy vUnknown with 19.2MHz XO')
+[   86.837567] [aurora-wifi] === AP ENABLED ssid=aurora-b8f ch=6 pid=2721 in 76.93s
+~ # echo ---ping; ping -c4 -W3 -I wwan0 77.88.8.8 | tail -2
+---ping
+4 packets transmitted, 4 packets received, 0% packet loss
+round-trip min/avg/max = 50.071/94.370/217.949 ms
+~ # echo ---display; /etc/init.d/aurora-display status; cat /run/aurora-display/
+display.log; cat /run/aurora-display/service.log
+---display
+fb0=panel-mipi-dbid fbcon=bound conn=enabled/On l17_users=1 bl_power=0 bl=1
+[7.78] display pipe already enabled (by fbcon takeover) - no unblank needed
+[7.79] backlight on -> bl_power=0 actual_brightness=1
+[7.86] === DISPLAY READY fb0=panel-mipi-dbid fbcon=bound conn=enabled/On l17_users=1 bl_power=0 bl=1
+[7.70] start: fb0=panel-mipi-dbid fbcon=bound conn=enabled/On l17_users=1 bl_power=4 bl=1
+[7.73] fbcon bound to fb0
+[7.78] display pipe already enabled (by fbcon takeover) - no unblank needed
+[7.79] backlight on -> bl_power=0 actual_brightness=1
+[7.86] === DISPLAY READY fb0=panel-mipi-dbid fbcon=bound conn=enabled/On l17_users=1 bl_power=0 bl=1
+=== service start rc=0 7.86
+~ # echo ---consoles; cat /sys/class/tty/console/active; for v in /sys/class/vtc
+onsole/vtcon*; do echo "$v $(cat $v/bind) $(cat $v/name)"; done; ls -l /proc/[0-
+9]*/fd/0 2>/dev/null | grep -E "ttyMSM0|tty1|console" | sed "s/.* \/proc/\/proc/
+"
+---consoles
+tty0 ttyMSM0
+/sys/class/vtconsole/vtcon0 0 (S) dummy device
+/sys/class/vtconsole/vtcon1 1 (M) frame buffer device
+/proc/1/fd/0 -> /dev/console
+/proc/1121/fd/0 -> /dev/ttyMSM0
+/proc/626/fd/0 -> /dev/tty1
+~ # echo ---getty; hostname; ps | grep -E "[g]etty|[c]ttyhack| sh$"
+---getty
+aurora
+  626 root     getty 0 tty1 linux
+ 1121 root     sh
+~ # echo ---fb; ls -l /dev/dri/card0 /dev/fb0; for f in name bits_per_pixel virt
+ual_size stride; do echo "fb0 $f=$(cat /sys/class/graphics/fb0/$f)"; done; cat /
+sys/class/drm/card0-SPI-1/enabled /sys/class/drm/card0-SPI-1/dpms
+---fb
+crw-------    1 root     root      226,   0 Oct  2 23:02 /dev/dri/card0
+crw-------    1 root     root       29,   0 Oct  2 23:02 /dev/fb0
+fb0 name=panel-mipi-dbid
+fb0 bits_per_pixel=16
+fb0 virtual_size=128,128
+fb0 stride=256
+enabled
+On
+~ # echo ---regs; for r in /sys/class/regulator/regulator.*; do n=$(cat $r/name)
+; case $n in l6|l17) echo "$n $(cat $r/state) $(cat $r/microvolts) users=$(cat $
+r/num_users)";; esac; done
+---regs
+l17 enabled 2850000 users=1
+l6 enabled 1800000 users=1
+~ # echo ---bl; for f in bl_power brightness actual_brightness; do echo "bl $f=$
+(cat /sys/class/backlight/backlight/$f)"; done
+---bl
+bl bl_power=0
+bl brightness=1
+bl actual_brightness=1
+~ # echo ---dmesg-display; dmesg | grep -iE "drm|panel|mipi|spi_qup|78b8000|fbco
+n|Console: |frame buffer|backlight|aurora-display|l17"
+---dmesg-display
+[    0.000000] Kernel command line: earlycon console=tty0 console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init fbcon=font:6x8 consoleblank=0
+[    0.010996] Console: colour dummy device 80x25
+[    0.717971] spi_qup 78b8000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
+[    1.069935] l17: Bringing 0uV into 2850000-2850000uV
+[    1.423536] [drm] Initialized panel-mipi-dbi 1.0.0 for spi0.0 on minor 0
+[    1.771604] Console: switching to colour frame buffer device 21x16
+[    1.813675] panel-mipi-dbi-spi spi0.0: [drm] fb0: panel-mipi-dbid frame buffer device
+[    7.856445] [aurora-display] start: fb0=panel-mipi-dbid fbcon=bound conn=enabled/On l17_users=1 bl_power=4 bl=1
+[    7.878898] [aurora-display] fbcon bound to fb0
+[    7.931007] [aurora-display] display pipe already enabled (by fbcon takeover) - no unblank needed
+[    7.944013] [aurora-display] backlight on -> bl_power=0 actual_brightness=1
+[    8.010294] [aurora-display] === DISPLAY READY fb0=panel-mipi-dbid fbcon=bound conn=enabled/On l17_users=1 bl_power=0 bl=1
+~ # echo ---display-errors; dmesg | grep -iE "drm|panel|mipi|spi0|fbcon|backligh
+t|aurora-display" | grep -ciE "err|fail|timeout|warn"
+---display-errors
+0
+~ # echo ---emmc; awk "{print \"w=\"\$5\" s=\"\$7}" /sys/block/mmcblk0/stat
+---emmc
+w=0 s=0
+~ # echo SNAP-END
+SNAP-END
+~ # [6n
--- a/tools/publish-sanitize.py
+++ b/tools/publish-sanitize.py
@ -51,6 +51,7 @@ INCLUDE = [r'^(README\.md|NOTES\.md|MANIFEST\.md|manifest\.tsv|firmware-fat-comp
    r'^b9/b9c/cache/([^/]+\.(md|sh|conf|txt)|SHA256SUMS)$',
    r'^b9/b9c/cache/emu/[^/]+\.(out|txt|sh)$',
    r'^b9/b9l/([^/]+\.(sh|md)|SHA256SUMS|lk2nd-23\.1-aurora-b9l\.patch|splash/mk-splash\.py)$',
+    r'^b9/b9l/persist/(B9L-write\.sh|B9L-rollback\.sh|b9l-boot\.sh|B9L-PERSIST-PLAN\.md|config-vs-current-lk1st\.diff|structure-vs-current\.txt|lk2nd-23\.1-aurora-b9l-lk1st\.patch|SHA256SUMS)$',
    r'^bootchain/(elfinfo\.txt|(boot|recovery)/(info\.txt|ramdisk\.list|ramdisk\.type))$',
    r'^(firehose|gpt)/SHA256SUMS$', r'^partitions/(SHA256SUMS|rawprogram0\.xml)$',
    r'^lk2nd-build/(BUILD\.md|WRITE-PLAN\.md|build\.log|build-lk1st\.log)$',
@ -66,7 +67,7 @@ INCLUDE = [r'^(README\.md|NOTES\.md|MANIFEST\.md|manifest\.tsv|firmware-fat-comp
    r'^logs/uart/[^/]+\.(log|txt)$',
    r'^logs/b6/all/(?!.*\.tar$)(?!b6/mm-|b6-try\d/(amd/)?mm-).*$',
 ]
-NEVER = r'^logs/b6[jp]/.*(^|/)mm-[^/]*\.log$|^logs/b7/b7c/.*/uart[^/]*\.log$|^logs/b8/.*/uart[^/]*\.log$|^logs/b9/.*/uart[^/]*\.log$|^logs/b9/.*\.png$|^b9/b9[bc]/out/(?!SHA256SUMS$|overlay-b9[bc]\.list$|init\.diff$|panel-fw\.txt$|cmdline\.txt$)|(^|/)private/|^b8/b8f/out/(?!SHA256SUMS$|overlay-b8f\.list$)|(^|/)(dumps|partitions/.*\.bin|firmware-fat/)|\.(bin|img|mbn|pad\d*[KM]?|tar|tgz|gz|pcap|raw|apk|so|dtb|elf|mdt|b\d\d|dis)$|modemst|(^|/)(fsg|fsc|persist|userdata)\b'
+NEVER = r'^logs/b6[jp]/.*(^|/)mm-[^/]*\.log$|^logs/b7/b7c/.*/uart[^/]*\.log$|^logs/b8/.*/uart[^/]*\.log$|^logs/b9/.*/uart[^/]*\.log$|^logs/b9/b9l/W/|^logs/b9/b9l/W-console\.txt$|^logs/b9/.*\.png$|^b9/b9[bc]/out/(?!SHA256SUMS$|overlay-b9[bc]\.list$|init\.diff$|panel-fw\.txt$|cmdline\.txt$)|(^|/)private/|^b8/b8f/out/(?!SHA256SUMS$|overlay-b8f\.list$)|(^|/)(dumps|partitions/.*\.bin|firmware-fat/)|\.(bin|img|mbn|pad\d*[KM]?|tar|tgz|gz|pcap|raw|apk|so|dtb|elf|mdt|b\d\d|dis)$|modemst|(^|/)(fsg|fsc|persist|userdata)\b(?!/)'
 inc = [re.compile(p) for p in INCLUDE]; nev = re.compile(NEVER)

 ids = []