uzbek-plus/logs/b9/b9a/B9A-RESULT.md

B9A-RESULT — display chain audit (read-only)

Date: 2026-10-03. Board: Aurora JZ08AU-XPA-7J-R3, running B8F (cache 857c9c30, kernel 7.2.7-aurora-b8d #7). Nothing was changed: no kernel/DT build, no eMMC/cache write, no GPIO/regulator/PMIC/SPI writes, no reboot. The live snapshot only read sysfs/debugfs and PMIC registers (regmap debugfs reads). eMMC write counter = 0.

Main finding

This is not a DSI panel and MDP is not used. The built-in display is a 1.44" 128×128 ST7735S panel on SPI (MIPI-DBI type C, 4-wire: SCL/SDA/CS plus a D/C GPIO). It is driven over BLSP1 QUP4 (spi@78b8000, GPIO 12–15). The backlight is PM8916 MPP4 used as a 40 mA current sink.

Stock LK fully brings the panel up before Linux: reset, SPI, 19 init commands, a 128×128 "4G LTE" logo built into LK, then backlight. It happens about 210 ms after LK starts. LK then passes the panel to the kernel as continuous splash (mdss_mdp.panel=1:spi:0:qcom,mdss_spi_st7735s_wx144_128x128_cmd). Stock LK is therefore an exact reference, and it matches the stock DT byte for byte.

Table

Level	Stock	Current Linux	Status
MDP/MDSS	Present (qcom,mdss_mdp), used by Android only as a CPU-side fb (fb0 128×128, 32 bpp, memblock-reserve 0x83200000/0xfa0000). LK writes fb 0x83200000 and copies it over SPI, with no scanout.	display-subsystem@1a00000 status=disabled, DRM=n	Not needed: MDP/DSI are not part of the chain
DSI	Only mdss_dsi_sim_video (simulator) and an empty mdss_dsi@1a98000. LK also has a DSI st7796s_320p (id 0) that this board never uses.	Disabled	Not used
"Display controller" = SPI host	BLSP1 QUP4 0x78b8000; GPIO12 MOSI, 13 MISO, 14 CS0, 15 CLK (func 1, 12 mA); clock 16 MHz; mode 3 (CPOL=1, CPHA=1); TX only. Kernel: qcom,mdss_spi + mdss_spi_client @16 MHz.	spi@78b8000 status=disabled, SPI_QUP=y, no spi_master, GPIO 12–15 are reset defaults (in, pull-down)	MISSING (1st point in Linux)
Panel	st7735s wx144 128x128 command mode spi panel; in LK panel_id = 1 is hardcoded (no ID read). RGB565 (COLMOD 05), MADCTL c8 (MY|MX|BGR), window col 2..129 / row 3..130. The 19-command init sequence is identical in LK and DT (b9a-stock-lk.txt §4). Off: 28, 10+120 ms. An alternative nv3023a_jz05 is in the DT, but LK never selects it.	No panel node, no driver (DRM_PANEL_MIPI_DBI/DRM_ST7735R not built)	MISSING
Regulators	Stock kernel: vdd = 8916_l17 2.85 V, vddio = 8916_l6 1.8 V. Stock LK does not touch any regulator (target_ldo_ctrl is a stub; LK has no RPM regulator code).	HW: L6 ON (EN 0x80, by SBL/RPM default). L17 OFF (EN 0x00, STATUS 0x00). Linux holds neither.	Open: is L17 needed for the panel? LK runs without enabling it (see "Open questions")
GPIO/reset	RESET = GPIO118 (disp_rst_n), D/C = GPIO116 (disp_dc), both out, 8 mA. Reset: high 1 ms → low 1 ms → high → 120 ms. No TE, no enable GPIO (LK touches GPIO0 only with OE=0, a CAF leftover).	GPIO116/118: in, pull-down, UNCLAIMED → panel is held in reset	MISSING
Backlight	PM8916 MPP4 current sink: MODE_CTL 0xa340=0x61, SINK_CTL 0xa34c=0x07 (40 mA), EN 0xa346=0x80. Turned on after init and the first frame. Android: qcom,leds-qpnp MPP4 lcd-bl 40 mA (trigger bkl-trigger). No PWM/WLED/DCS.	MPP4 regs = 00/00/00 (off), /sys/class/backlight empty	MISSING
DRM/fb	Android: mdss_fb fb0 (mdssfb_d0000, 128×128, virtual 128×256, 32 bpp). LK: fbcon 16 bpp @0x83200000.	DRM=n, FB=n; no /dev/dri, /dev/fb*, /sys/class/drm|graphics	MISSING

Exact chain (stock → what B9 needs)

SoC display "controller": BLSP1 QUP4 SPI @0x78b8000 (gcc_blsp1_qup4_spi_apps_clk 16 MHz, mode 3, CS0, GPIO12-15 func1)
→ "DSI host": none. The SPI host itself + D/C GPIO116 = MIPI-DBI type C (4-wire) host
→ panel: ST7735S 128x128 (1.44" "wx144"), GRAM offset (2,3), RGB565, MADCTL 0xc8
→ reset/power: L6 1.8 V on (default) [L17 2.85 V: stock kernel only, LK does not enable it];
               GPIO118 1→0 (1 ms)→1, wait 120 ms
→ init: SLPOUT +120 ms, FRMCTR1/2/3, INVCTR 03, PWCTR1-5, VMCTR1 12, GMCTRP1/N1, MADCTL c8, COLMOD 05,
        CASET 2..129, RASET 3..130, DISPON, RAMWR (+ 128*128*2 B frame, D/C=1)
→ backlight: PM8916 MPP4 current sink 40 mA (0x61/0x07/0x80), after the first frame
→ framebuffer/DRM: in Linux → SPI device + panel-mipi-dbi (or st7735r) → /dev/dri/card0 (+ /dev/fb0 via fbdev emulation)

First point where things diverge

1. Across the whole boot path, the first divergence is the bootloader. Stock LK brings up the panel at ~210 ms. The current lk1st (msm8916 lk2nd tree) has no SPI-panel code: mdss_spi.o is only built for msm8909/msm8952. So the panel is never initialised, and its RESET stays low because of the SoC pull-down.
2. Within Linux, the first missing link is the SPI host: spi@78b8000 is status = "disabled". Everything after it is also missing: no panel node and no driver, D/C and RESET GPIOs are not described, there is no MPP4 backlight, and DRM/FB are off. MDP/DSI do not belong to this chain, so their being disabled is not the problem.

There is no simpledrm/simplefb path: no loader leaves the panel initialised, and an SPI panel has no scanout. So Linux has to bring the panel up itself, which is what B9 asks for anyway.

Open questions (do not block B9B)

• L17: it is off in hardware, while the stock kernel declares it as panel vdd and stock LK never turns it on. So either SBL1/RPM turn it on during a stock boot (unlikely: SBL1/RPM are still stock now and L17 is off), or the panel VDD is fed from another rail. B9B will settle it by testing with L17 untouched, exactly like LK.
• Exact glass model: LK hardcodes ST7735S and does not read an ID. The vendor DT also has nv3023a_jz05. The cable/glass markings are unknown. A visual check in B9B confirms that the ST7735S init works on this glass. An ID read (RDDID 04h) is possible later if MISO/SDA can actually be read back (LK runs TX-only).
• Operator question: on stock firmware, did the "4G LTE" logo appear on the screen at power-on? (LK's built-in image: b9a-stock-lk-embedded-logo-128x128.png, because the stock splash partition is all zeros.)

Proposed B9B (RAM-only, ONE test) — waiting for GO

B9B "first light": boot the B8F RAM image via RESET-held power-on + fastboot boot. Cache B8F and the eMMC are not touched.

• Kernel = out-b8d + DRM=y, DRM_PANEL_MIPI_DBI=y, DRM_FBDEV_EMULATION=y (+ the FB core it needs). No fbcon, no MSM DRM.
• DTB = B8B DTB plus:
  • &blsp_spi4 { status = "okay"; cs-gpios = <&tlmm 14 GPIO_ACTIVE_LOW>; } (upstream style; stock used native CS0).
  • panel@0: compatible = "aurora,st7735s-wx144", "panel-mipi-dbi-spi", spi-max-frequency = <16000000>, spi-cpol; spi-cpha, write-only (LK is TX-only; without it the driver's mipi_dbi_poweron_conditional_reset would read DCS 0Ah back over SPI and might skip init because of a garbage readback), dc-gpios = <&tlmm 116 GPIO_ACTIVE_HIGH>, reset-gpios = <&tlmm 118 GPIO_ACTIVE_LOW>, panel-timing 128×128 with hback-porch = 2, vback-porch = 3 (the GRAM offset), and backlight = <&lcd_bl>.
  • lcd_bl: gpio-backlight on &pm8916_mpps 4 with pinctrl function = "sink", drive-strength = <7> (40 mA, as in LK).
  • No regulator references (exactly like stock LK).
• initramfs = B8F + /lib/firmware/aurora,st7735s-wx144.bin: the stock 19-command sequence minus RAMWR, in the panel-mipi-dbi format (SLPOUT, then a 120 ms delay, …, MADCTL c8, COLMOD 05, DISPON). The driver loads <compatible[0]>.bin, and back-porch is used as the GRAM offset (panel-mipi-dbi.c:197, :366-367; checked against the 7.2.7 source). The driver turns on the backlight right after the init commands; LK does it after the first frame (a small difference, acceptable for B9B).
• Test (read-mostly): check the probe in dmesg, that /dev/dri/card0 and /dev/fb0 exist, and read back MPP4 = 0x61/0x07/0x80 plus GPIO 116/118/12–15. Then write one static test frame to /dev/fb0 (colour bars + a corner marker) and the operator confirms the image, colours and orientation. LTE and Wi-Fi must keep working, and eMMC writes must stay 0.
• PASS = a correct image with backlight on, and no LTE/Wi-Fi regressions. If the screen stays dark or white, the single next variable for B9C is the panel's power-supply = L17 2.85 V, as the stock kernel uses.

STOP. B9B only after a separate GO.

Files

• b9a-stock-lk.txt — stock LK: UART evidence, function map, structures, init table, backlight, splash
• b9a-stock-lk-embedded-logo-128x128.png — the logo built into stock LK (RGB565 @0x8f64b004)
• b9a-stock-dt.txt — stock dtb_01 nodes (mdss_mdp + panels, mdss_spi, spi@78b8000, pinctrl, MPP4 LED, L6/L17)
• b9a-current-dt.txt — current B8F DTB (dtc) display-related nodes
• b9a-kconfig.txt — kernel config audit
• b9a-linux-display.txt (+ .raw.txt) — live read-only snapshot of the board
• b9a-backlight.txt — backlight mechanism
• Scripts b9/b9a/: lk-xref.py, lkmem.py, disrange.sh, decode-panel.py, render-lk-logo.py, dt-extract.py, b9a-live.sh (board), b9a-run.sh (480s)