fix(bb64): validate and repair the PocketBeagle2 EEPROM before flashing eMMC

Some industrial boards leave the factory with the identity EEPROM only partly
programmed.  u-boot's SPL applies the 1GB DDRSS timings only when the EEPROM
identifies the board as the industrial variant, so those boards come up as the
512MB base board -- and flashing one produced a finished-looking unit that was
wrong in a way nothing downstream would notice.

The eMMC is the tell: only the industrial has it populated, and mmcblk0 is the
only target this profile ever flashes.  So flash_storage.sh's bb64 preflight,
previously a no-op, now checks the EEPROM and repairs it where it can, before
anything is written.  A preflight die already runs under the same EXIT trap as
every other phase, so an abort ends with all user LEDs blinking rather than
with a board that looks done.

The detect/repair/verify logic moves out of BB64-AutoFlash.sh into a shared
check_pb2_eeprom.sh so the boot-time flasher and the interactive one cannot
drift.  BB64-AutoFlash.sh's fail() moves above its first use: the EEPROM check
is now the first thing that can fail, and sh only resolves a function once it
has read the definition.

An EEPROM that cannot be repaired now stops the flash instead of warning and
continuing.  There is no EEPROM part on this board -- an MSPM0L1105 emulates a
24c32 at 0x50 -- so when its firmware was never flashed, 0x50 does not ACK,
at24's probe read fails, and the driver never binds.  Nothing can be written to
a silent device, so the only honest answer is to refuse.  The same MSPM0 also
emulates the ADC at 0x20, which separates three faults that need different
people to look at them: neither bound (MSPM0 not running), ADC bound but 0x50
silent (MSPM0 running, firmware fault), and no i2c client at all (device tree,
not the board).  Its own address at 0x48 is useless for this -- it does not ACK
there even on a healthy board.

Also fixed, all of which reported success on boards that were not repaired:

- The repair is now re-read and re-verified.  A sysfs write to a write
  protected or wedged part looks exactly like a successful dd.
- A read that fails with EIO yielded an empty header, which read as "blank" and
  sent the board down the repair path to abort later complaining about the
  write.  Short reads are now rejected up front.
- A base-board ID programmed on hardware with eMMC now aborts.  The fix scripts
  merge only over 0xFF bytes, so they cannot correct an EEPROM that is fully
  but wrongly programmed; running one would have changed nothing and said it
  worked.
- [ $OLDNUMHEX != ... ] was unquoted, so an empty read was a syntax error
  rather than a branch.

The two sysfs paths in the fix scripts and the four in the checker are
overridable so the failure modes can be exercised against fixtures; nothing in
FPP sets them.  Verified on a PocketBeagle2 Industrial: fixtures byte-identical
to real PB2I and PB20 dumps, and the driver-unbind controls reproduce the real
sysfs shape for each MSPM0 fault.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dkulp

SD/BB64-AutoFlash.sh

@@ -20,100 +20,14 @@ DEVICE=/dev/mmcblk0
 mount -t vfat /dev/mmcblk1p1 /boot/firmware
 mount  -t tmpfs /tmp
 
-echo "---------------------------------------"
-
-# Some PB2i boards ship with blank or improperly-programmed EEPROMs.
-# The factory write is two-step: (1) board template, (2) serial number.
-# Either or both steps can fail, so check both:
-#   - Magic header (bytes 0-1) should be AA55
-#   - Serial number (bytes 52-55) should not be all FF
-# The fix scripts use a merge strategy that only overwrites 0xFF bytes
-# in the existing EEPROM, so they're safe to run in either failure mode.
-EEPROM=/sys/bus/i2c/devices/0-0050/eeprom
-NEEDS_FIX=false
-if [ -f "$EEPROM" ]; then
-    MAGIC=$(dd if="$EEPROM" bs=1 count=2 2>/dev/null | xxd -p)
-    SERIAL=$(dd if="$EEPROM" bs=1 skip=52 count=4 2>/dev/null | xxd -p)
-    if [ "$MAGIC" != "aa55" ]; then
-        echo "EEPROM header invalid (expected aa55, got ${MAGIC:-empty})"
-        NEEDS_FIX=true
-    elif [ "$SERIAL" = "ffffffff" ]; then
-        echo "EEPROM header valid but serial number is blank"
-        NEEDS_FIX=true
-    else
-        echo "EEPROM valid (magic=${MAGIC}, serial=${SERIAL})"
-    fi
-
-    if $NEEDS_FIX; then
-        # Determine the board variant.  The device-tree model string is NOT
-        # usable for this: it reads "BeagleBoard.org PocketBeagle2" on the
-        # industrial board as well as on the base one.
-        #
-        # The board ID at EEPROM offset 46 is "PB2I" on the industrial and
-        # "PB20" on the base board, and it is still readable in the "valid
-        # header, blank serial" failure mode.  When the header itself is blank
-        # there is nothing left to read, so probe the hardware instead: the
-        # industrial always has eMMC populated, the base board ships with the
-        # footprint empty (and is not a target for this script anyway, since
-        # everything below flashes ${DEVICE}).
-        #
-        # This matters beyond cosmetics.  u-boot's SPL only applies the 1GB
-        # DDRSS timings when the EEPROM identifies the board as the industrial
-        # variant, so writing a base-board EEPROM onto an industrial leaves it
-        # running on half its RAM until the EEPROM is rewritten.
-        BOARDID=""
-        if [ "$MAGIC" = "aa55" ]; then
-            BOARDID=$(dd if="$EEPROM" bs=1 skip=46 count=4 2>/dev/null)
-        fi
-        case "$BOARDID" in
-            PB2I)
-                INDUSTRIAL=true
-                ;;
-            PB20)
-                INDUSTRIAL=false
-                ;;
-            *)
-                # Blank header - wait briefly for the eMMC to enumerate, then
-                # decide on its presence.
-                INDUSTRIAL=false
-                i=0
-                while [ $i -lt 10 ]; do
-                    if [ "$(cat /sys/block/mmcblk0/device/type 2>/dev/null)" = "MMC" ]; then
-                        INDUSTRIAL=true
-                        break
-                    fi
-                    i=$((i + 1))
-                    sleep 1
-                done
-                echo "EEPROM header blank, detected industrial=${INDUSTRIAL} from eMMC presence"
-                ;;
-        esac
-
-        if $INDUSTRIAL; then
-            echo "Running fix_pb2i_eeprom.sh"
-            /bin/bash /opt/fpp/capes/drivers/bb64/fix_pb2i_eeprom.sh
-        else
-            echo "Running fix_pb2_eeprom.sh"
-            /bin/bash /opt/fpp/capes/drivers/bb64/fix_pb2_eeprom.sh
-        fi
-    fi
-else
-    echo "WARNING: EEPROM device not found at $EEPROM"
-fi
-
-echo "---------------------------------------"
-echo "Installing bootloader "
-echo ""
-
-#install bootloader
-/opt/u-boot/bb-u-boot-pocketbeagle2/install-emmc.sh
-
-
 # Mark a failure the only two ways an unattended flash can be read: leave the board
 # powered on, and blink every user LED together.  A finished board goes dark, so
 # neither can be mistaken for success.  flash_storage.sh does this for its own
-# failures; this covers the steps after it.  Note the PocketBeagle2 exposes
+# failures; this covers the steps either side of it.  Note the PocketBeagle2 exposes
 # usr1-usr4 where the BeagleBone Black exposes usr0-usr3, hence the glob.
+#
+# Defined before the first thing that can fail: the EEPROM check below aborts boards
+# with no EEPROM at all, and sh resolves a function only once it has been read.
 fail() {
     echo ""
     echo "############################################################"
@@ -129,6 +43,27 @@ fail() {
     exit 1
 }
 
+echo "---------------------------------------"
+
+# Some PB2i boards ship with a blank or half-programmed EEPROM, which makes u-boot
+# configure the industrial board as the 512MB base one.  check_pb2_eeprom.sh works
+# out which variant this is, repairs what can be repaired, and verifies the result.
+#
+# It exits non-zero when the EEPROM is missing entirely or is programmed with the
+# wrong identity.  Neither can be written around, and a board flashed in that state
+# boots misidentified -- so stop here and blink, rather than producing something
+# that looks finished.
+/bin/bash /opt/fpp/capes/drivers/bb64/check_pb2_eeprom.sh \
+    || fail "The on-board EEPROM is not usable; see the message above."
+
+echo "---------------------------------------"
+echo "Installing bootloader "
+echo ""
+
+#install bootloader
+/opt/u-boot/bb-u-boot-pocketbeagle2/install-emmc.sh
+
+
 # flash_storage.sh partitions, copies, configures and then VERIFIES the eMMC.
 /opt/fpp/SD/flash_storage.sh -y --clone --no-reboot ${DEVICE} \
     || fail "See the errors above."

SD/flash_storage.sh

@@ -610,7 +610,31 @@ profile_bb64_fixup() {
 	EOF
 }
 
-profile_bb64_preflight() { :; }
+# The PocketBeagle2 Industrial is the only board this profile ever flashes: mmcblk0
+# is the eMMC, and only the industrial has it populated.  Some of those boards leave
+# the factory with a blank or half-written identity EEPROM, which makes u-boot bring
+# them up as the 512MB base board -- so the EEPROM gets checked, and repaired if it
+# can be, before anything is written to the eMMC.
+#
+# A board with no EEPROM at all cannot be repaired, and check_pb2_eeprom.sh exits
+# non-zero for it.  Dying here is what the factory flow needs: preflight runs under
+# the same EXIT trap as every other phase, so the abort ends with all the user LEDs
+# blinking rather than with a board that looks finished.
+profile_bb64_preflight() {
+    local check="${BINDIR}/../capes/drivers/bb64/check_pb2_eeprom.sh"
+
+    if [ ! -f "${check}" ]; then
+        info "  ${check} not found; skipping the EEPROM check"
+        return 0
+    fi
+
+    /bin/bash "${check}" || die \
+"the on-board EEPROM is not usable.  See the message above.
+
+ Flashing would produce a board that misreports its variant, and on the
+ industrial that means booting with half its RAM."
+    info "  on-board EEPROM  OK"
+}
 
 profile_bb64_finish() { :; }