q/uzbek-plus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
uzbek-plus/logs/b9/b9a/b9a-stock-lk.txt
q 4a7224c41f B9: built-in display (ST7735S SPI) in Linux and persistent B9C cache 
- B9A: read-only audit of stock LK/DT: the panel is an ST7735S 128x128 on SPI (BLSP1 QUP4,
  16 MHz, mode 3, D/C GPIO116, RESET GPIO118), backlight = PM8916 MPP4 current sink 40 mA.
- B9B: upstream panel-mipi-dbi with the stock init sequence as firmware; MPP4 sink via pinctrl
  + gpio-backlight; first light with correct colours/orientation/offsets.
- B9C: fbcon (6x8, 21x16) on tty1 + getty, UART console kept, aurora-display service;
  cache B9C b9ce13c9 written and verified, cold boots with LTE + Wi-Fi + display.
- B9L (RAM only): lk2nd second stage with an msm8916 SPI panel port shows a picture before Linux.
- Sanitizer: whitelist for b8/ and b9/.
2026-10-03 01:45:02 +03:00

134 lines
11 KiB
Text
Raw Blame History

# B9A — stock LK (aboot) display analysis. READ-ONLY.
# Source: partitions/aboot.bin (stock backup, ELF, entry 0x8f600000) -> bootchain/aboot-analysis/lk.bin (load seg 0x8f600000+0x530c8),
# lk-arm.dis (objdump). Tools: b9/b9a/lk-xref.py, lkmem.py, disrange.sh, decode-panel.py, render-lk-logo.py.
# NOTE: stock LK is no longer on the eMMC (aboot = lk1st-aurora-autoboot since B5a); this is the saved original.
## VERDICT: YES — stock LK fully brings up the panel before Linux (power/reset, SPI init, 19-cmd init, frame write, backlight),
## at ~210 ms after LK start, and hands it to the kernel as continuous splash (cmdline mdss_mdp.panel=1:spi:0:qcom,mdss_spi_st7735s_wx144_128x128_cmd).
== 1. UART evidence (stock boots, logs/uart/coldboot-20260929-200018.log, preflight-recovery-20260929-201150.log)
20:01:01.630 [0] welcome to lk
20:01:01.630 [10] target_init()
20:01:01.830 [210] Panel power on done
20:01:01.830 [210] Config SPI PANEL.
20:01:02.230 [500] cmdline: console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci andro
20:01:46.857 [0] welcome to lk
20:01:46.857 [10] target_init()
20:01:47.057 [210] Panel power on done
20:01:47.057 [210] Config SPI PANEL.
logs/uart/lk2nd-boottest-20260929-203353.log:20:34:56.320 [210] Panel power on done
logs/uart/lk2nd-boottest-20260929-203353.log:20:34:56.320 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:12:20.096 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:12:20.096 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:13:09.732 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:13:09.732 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:19:21.864 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:19:21.864 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:19:49.496 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:19:49.496 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:33:24.573 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:33:24.574 [210] Config SPI PANEL.
logs/uart/preflight-recovery-20260929-201150.log:20:33:39.596 [210] Panel power on done
logs/uart/preflight-recovery-20260929-201150.log:20:33:39.596 [210] Config SPI PANEL.
20:01:04.031 [ 0.000000] Node qcom,mdss_fb_primary memblock_reserve memory 83200000-841a0000
20:01:04.231 [ 0.000000] Kernel command line: console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci androidboot.emmc=true androidboot.serialno=3
20:01:04.632 [ 0.144515] KPI: Bootloader display count = 23838
20:01:05.834 [ 0.620091] mdss_spi_panel_probe: Ctrl name = mdss spi panel
20:01:05.835 [ 0.620348] mdss_spi_panel_init: Panel Name = st7735s wx144 128x128 command mode spi panel
20:01:05.835 [ 0.620665] mdss_spi_panel_init: Continuous splash enabled
20:01:07.439 [ 4.037439] mdss_fb_register: FrameBuffer[0] 128x128 registered successfully!
Current chain (lk1st-aurora-autoboot, e.g. logs/uart/b7cV1-20261002-195525.log): NO "Panel power on"/"Config SPI PANEL" lines.
lk2nd source: platform/msm_shared/rules.mk builds mdss_spi.o only for PLATFORM msm8909/msm8952; lk2nd/device/2nd/spi-display.c only
re-uses a panel "initialized by previous bootloader" (240x320 fixed). => current msm8916 lk1st has no SPI-panel code at all.
== 2. Function map (stock LK, addresses in 0x8f6xxxxx)
0x8f600eac display init loop -> gcdb_display_init(0x8f616918)(rev, MDP_REV=12, fb_base=0x83200000)
0x8f600f20 oem_panel_select(): panel_id := 1 (HARDCODED, mov r5,#1; str -> 0x8f654408), prints "lcd_id == st7735s spi lcd"
unconditionally (NO ID read over SPI, no ID GPIO). id 0 -> qcom,mdss_dsi_st7796s_320p_video (DSI), id 1 -> st7735s (19 cmds),
id 2 -> qcom,mdss_spi_nv3023a_jz05_128x128_cmd (58 cmds). Aurora stock LK always uses id 1.
0x8f616918 gcdb_display_init(): "SPI panel select and init start", pinfo.type = 13 (SPI_PANEL), power_func=0x8f6165e0, bl_func=0x8f616698
0x8f6165e0 mdss_spi panel power: target_ldo_ctrl(0x8f600e98) then target_panel_reset(0x8f600bb8); prints "Panel power on done"
0x8f600e98 target_ldo_ctrl(): STUB `mov r0,#0; bx lr` -> stock LK switches NO regulator. No RPM 'ldoa'/'smpa' request code in LK at all.
0x8f600bb8 target_panel_reset(enable): (board hw_id 8 MTP) gpio_tlmm_config(0,...,enable=0)+gpio_set(0,HIGH) [CAF enable_gpio leftover,
OE bit 9 = 0 -> GPIO0 not driven], then reset GPIO 118: tlmm_config(118, func0, dir out, nopull, drv=3 (8 mA), OE=1),
set HIGH, then seq pin_state {1,0,1} / sleep {1,1,120} ms => RST high 1 ms, LOW 1 ms, HIGH, wait 120 ms.
(QRD hw_id 11/subtype 4 branch drives TPS65132 on I2C 0x3e — not this board.)
0x8f600b54 target_backlight_ctrl(bl, en): if bl_interface_type != 2 (DCS): PM8916 MPP4 (base 0xa300, SID0):
MODE_CTL(0xa340) = 0x60|1 = 0x61 (current-sink mode, enable), SINK_CTL(0xa34c) = 7 (=40 mA), EN_CTL(0xa346) = en<<7 (0x80);
mdelay(20). No PWM/LPG, no WLED (PM8916 has no WLED; "bl_ctrl_wled" in panel data is a CAF label).
0x8f6107e4 spi_qup_init(blsp=1, qup=3): base = (3+0x78b5)<<12 = 0x078b8000 (BLSP1 QUP4)
0x8f601bc8 BLSP1 QUP4 pinmux: TLMM cfg regs 0x0100c000..0x0100f000 = GPIO12 (MOSI), 13 (MISO), 14 (CS_N), 15 (CLK), func 1
0x8f6019d4 clock_config_blsp_spi: gcc_blsp1_qup4_spi_apps_clk = 16 000 000 Hz (0x00f42400)
0x8f610924 QUP regs: QUP_CONFIG=0x180 (SPI mode, NO_INPUT), SPI_CONFIG(0x300)=0 (INPUT_FIRST=0 -> CPHA=1), SPI_IO_CONTROL(0x304)=0x401
(NO_TRI_STATE|CLK_IDLE_HIGH -> CPOL=1) => SPI mode 3 (spi-qup.c semantics), write-only (TX), native CS0.
0x8f610b6c mdss_spi panel on: D/C GPIO 116 tlmm_config(func0, out, nopull, drv 3, OE); per cmd: D/C LOW + 1 cmd byte (0x8f6109f4),
D/C HIGH + params (0x8f610a80), mdelay(wait). Frame: D/C HIGH, 16-bit words, len = w*h*bpp/8 (0x8f610b00/0x8f610c64).
0x8f61659c display_image_on_screen(): fbcon_clear; fetch splash partition; if no "SPLASH!!" header -> built-in 128x128 RGB565 image
@0x8f64b004 (memcpy 128*128*2 to fb 0x83200000, then SPI flush). Stock splash partition = 10 MiB of zeros (sha in
partitions/SHA256SUMS) => stock shows the built-in "4G LTE" logo (rendered: b9a-stock-lk-embedded-logo-128x128.png).
0x8f60d78c "Continuous splash enabled, keeping panel alive." -> panel left ON for the kernel.
0x8f6166e8 cmdline builder: " mdss_mdp.panel=" + "1:spi:0:" + panel node id.
== 3. Panel data structures (stock LK, panel_id 1)
paneldata @0x8f648288: node 'qcom,mdss_spi_st7735s_wx144_128x128_cmd', controller 'spi:0:', compatible 'qcom,mdss-spi-panel',
interface 10, destination DISPLAY_1, framerate 27 (DT node says 20; irrelevant for a GRAM panel)
resolution @0x8f647e8c: 128 x 128, h fp/bp/pw 79/59/60, v 10/7/2 (porches meaningless for SPI command-mode)
color @0x8f648410: 16 bpp (RGB565), order 0
reset @0x8f6483ec: pin_state {1,0,1,0,0} sleep {1,1,120,0,0} ms, direction 2 (== DT qcom,mdss-spi-reset-sequence <1 1 0 1 1 0x78>)
backlight @0x8f648728: interface 1 (BL_WLED label -> MPP4 path above), min 1, max 0xfff, step 100, pmic ctrl 1, model 'PMIC_8941'
on-commands @0x8f64849c: 19 x {u32 size, u32 ptr, u32 wait, u8 post_tg}, count 19 (pinfo+0xf0/0xf4)
== 4. Init sequence: stock LK vs stock DT (b9/b9a/decode-panel.py)
== stock LK st7735s (0x8f64849c): 19 commands
0 11 SLPOUT wait=120 ms
1 b1 FRMCTR1 05 3a 3a wait=0 ms
2 b2 FRMCTR2 05 3a 3a wait=0 ms
3 b3 FRMCTR3 05 3a 3a 05 3a 3a wait=0 ms
4 b4 INVCTR 03 wait=0 ms
5 c0 PWCTR1 62 02 04 wait=0 ms
6 c1 PWCTR2 c0 wait=0 ms
7 c2 PWCTR3 0d 00 wait=0 ms
8 c3 PWCTR4 8d 6a wait=0 ms
9 c4 PWCTR5 8d ee wait=0 ms
10 c5 VMCTR1 12 wait=0 ms
11 e0 GMCTRP1 03 1b 12 11 3f 3a 32 34 2f 2b 30 3a 00 01 02 05 wait=0 ms
12 e1 GMCTRN1 03 1b 12 11 32 2f 2a 2f 2e 2c 35 3f 00 00 01 05 wait=0 ms
13 36 MADCTL c8 wait=0 ms
14 3a COLMOD 05 wait=0 ms
15 2a CASET 00 02 00 81 wait=0 ms
16 2b RASET 00 03 00 82 wait=0 ms
17 29 DISPON wait=0 ms
18 2c RAMWR wait=0 ms
== stock dtb_01 st7735s on-command: 19 commands
0 11 SLPOUT wait=120 ms
1 b1 FRMCTR1 05 3a 3a wait=0 ms
2 b2 FRMCTR2 05 3a 3a wait=0 ms
3 b3 FRMCTR3 05 3a 3a 05 3a 3a wait=0 ms
4 b4 INVCTR 03 wait=0 ms
5 c0 PWCTR1 62 02 04 wait=0 ms
6 c1 PWCTR2 c0 wait=0 ms
7 c2 PWCTR3 0d 00 wait=0 ms
8 c3 PWCTR4 8d 6a wait=0 ms
9 c4 PWCTR5 8d ee wait=0 ms
10 c5 VMCTR1 12 wait=0 ms
11 e0 GMCTRP1 03 1b 12 11 3f 3a 32 34 2f 2b 30 3a 00 01 02 05 wait=0 ms
12 e1 GMCTRN1 03 1b 12 11 32 2f 2a 2f 2e 2c 35 3f 00 00 01 05 wait=0 ms
13 36 MADCTL c8 wait=0 ms
14 3a COLMOD 05 wait=0 ms
15 2a CASET 00 02 00 81 wait=0 ms
16 2b RASET 00 03 00 82 wait=0 ms
17 29 DISPON wait=0 ms
18 2c RAMWR wait=0 ms
LK == DT (payload+wait): True
== stock dtb_01 st7735s off-command: 2 commands
0 28 DISPOFF wait=0 ms
1 10 SLPIN wait=120 ms
Interpretation: ST7735S (ST7735-family command set; MADCTL 0xc8 = MY|MX|BGR, COLMOD 0x05 = 16 bpp RGB565,
visible window column 2..129, row 3..130 => 128x128 glass on a 132x162 GRAM with offset (2,3)).
== 5. Things stock LK does NOT do
- no regulator control (L17/L6 untouched; whatever SBL1/RPM left on is used)
- no panel ID read (hardcoded id 1)
- no TE GPIO, no DSI, no MDP scanout (SPI panel has own GRAM; fb 0x83200000 is only a CPU-side buffer)
- no PWM brightness (MPP4 sink fixed 40 mA, on/off)
Reference in a new issue View git blame Copy permalink