n31: EIC, GPIO, PMIC keys, I2C, USB gadget - #1
Draft
andrew867 wants to merge 15 commits into
Draft
Conversation
N31 GPIO interrupts go through an EIC at 0x39700000, then into the PL192 VIC EXT lines. Group is gpio >> 5. Chain only the parents listed in DT; wiring every EXT0..6 hung boot. GPIO 86 (PMIC nIRQ) is group 2 on VIC EXT3. Vol± stay on SoC GPIO and do not need this chip. Tested on iPod nano 7G.
RetailOS programs pads with a word at 0x3CF001E0: (bank << 16) | (pin << 8) | cmd DIN is bank+0x04, DIR is bank+0x14. The 2-line bcm6345 hack on 0x3CF000A4 is not enough for Vol± or for EIC to_irq. apple,skip-sec-pinmux leaves U-Boot/SEC leftovers alone and only GPIOCMDs the IIS0 pair plus GPIO 86. Replaying the full SEC table from Linux broke buttons and USB on glass. gpio-keys-polled on GPIO 40/41 issues mode 0xFFFE and the pads go quiet. This driver polls DIN itself. Tested on iPod nano 7G: Vol+ / Vol- report KEY_VOLUMEUP/DOWN.
N31 IIC1 never sets the +0x20 INT word. Byte done is IICCON bit 4 (S3C IRQPEND). The old ISR read +0x20, returned IRQ_NONE, and left SCL stretched. Clear IRQPEND to resume the bus. Do not treat STAT bit 0 as NAK; that aborted every PMIC@0x73 transfer with -EIO even when VIC 22 fired. On reads, the first IRQPEND is address-complete and DS still holds the address byte. Skip that one, then take one IRQPEND per RX byte. PIO mode stays available but is not required. IIC1 at 0x3C900000 is the PMIC bus. Tested on iPod nano 7G: D1830 @0x73 and LIS3 @0x18 complete.
Home / Sleep / Play are PMIC bits (regs 7 and 8), not SoC GPIO. OSOS unmasks them and uses GPIO 86 as an active-low nIRQ into the EIC. gpio-keys-polled on these lines hammers I2C and was already disabled in the N31 DTS. Register an input device and a threaded nIRQ. Keep a slow poll so a missed EIC edge still shows up. Do not write register 13 at probe. Bit 0 is the power-off latch and it cuts Vbat. The old default rail sequence did that. Rail bring-up stays behind dlg,apply-sec-rails, which N31 must not set. pm_power_off writes reg 13 bit 0. Sleep held ~2s still uses that path. Tested on iPod nano 7G: Home, Sleep, Play, and Sleep-hold poweroff.
The 8702 analog-stage ramp (CTRL1/CTRL2 walk) is for nano 3G. On nano 7G it drops the Lightning link while DWC2 still probes. Windows then sees VID_0000&PID_0002. N31 matches U-Boot s5l87xx-otg-phy: drop D+ (DCTL SFTDISCON), clear PCGCCTL, then PWR/RSTCON/MODE/CLK. Compatible strings apple,s5l87xx-otgphy and apple,s5l8740-otgphy select that path. apple,s5l8702-otgphy keeps the old ramp for N46. Tested on iPod nano 7G: gadget enumerates after DFU.
N46 and N20 keep apple,s5l87xx-usb → dwc2_set_s5l8702_params (slave PIO, session_valid_gintmsk_quirk). N31 uses apple,s5l8740-usb → dwc2_set_s5l87xx_params. That setter follows RetailOS sub_1B543A: NP=32, first dedicated IN capped at 512 words, buffer DMA, GAHBCFG INCR8. The 8702 quirk masks USBRST/EP0 until SessReqInt, which does not arrive after the 87xx PHY reset, so GET_DESCRIPTOR dies as 0000:0002. RNDIS already leaves cdc_filter=0 until SET. Apply the Windows inbox bits: IAD class/subclass/protocol on the control iface (usbccgp / rndiscmp.inf want EF/04/01 there), INIT reports media connected, LINK_SPEED stays non-zero. Tested on Windows 10/11 against 1d6b:0106 from our gadget: Remote NDIS Compatible Device, SSH and telnet to 192.168.7.2.
N31 boots with WTF/U-Boot leftovers. clk_disable_unused then writes SET_TO_DISABLE gates and peripherals drop. Clear the known PWRCON banks and the CG16 enable bits in the divider regs, and mark the published gates CLK_IS_CRITICAL | CLK_IGNORE_UNUSED. Never write CLKCON+0x00/+0x04 (SYS PLL / DRAM) or +0x50 (fatal latch). The ungate walk is limited to samsung,s5l8740 so N46 keeps the old probe. Tested on iPod nano 7G: I2C, GPIO, LCDIF, and DWC2 stay clocked after late init.
Backlight is a separate MMIO block at 0x3E000000. Level is 1..62 at +0x08. This driver does not touch LCDIF CON or PHTIME. TinyDRM was blitting fb->width * fb->height as a linear buffer. fbcon pitch is wider than 240, so the panel tore. Walk each row with pitches[0]/4. Log CON/PHTIME at probe and leave the values U-Boot wrote. Tested on iPod nano 7G: tty0 shell and backlight at 62.
Replace the 2-line bcm6345 GPIO hack with the banked s5l8740 GPIO and the EIC. Home/Sleep/Play come from D1830 nIRQ on GPIO 86; do not poll those bits over I2C. gpio-keys-polled stays disabled so it cannot GPIOCMD 0xFFFE the Vol pads. USB uses apple,s5l8740-usb / apple,s5l8740-otgphy so N31 does not inherit the nano3 PHY ramp or the 8702 DWC2 quirk. syscon-reboot is disabled: 0x100000 arms the watchdog. No I2S, PL080, CS42, or dlg,apply-sec-rails. Those are not ready. Tested on iPod nano 7G with apple_n31_defconfig.
WTF and U-Boot leave CON/CNT armed at 0x3C800000. A bigger zImage loses the race and resets in the middle of decompress or early device probe. Write CON=0 then CNT=0, twice. Never CLKCON+0x50. Tested on iPod nano 7G: kernel #90 reaches tty0.
Land the in-tree module set used on device (#90+): FMSS CS/META weave scan and FTL helper, Nimbus touch, PL080 DMA, CS42L81/I2S audio stubs, Tristar mux, plus DTS/defconfig wiring and RNDIS/gadget tweaks from the lab tree. Keep FMSS/FTL as loadable modules (CONFIG_FMSS_S5L8740=m).
Peripheral does not keep chaining state between operations. IV needs to be set explicitly before CMD_START.
Fail probe if apple,cpu or CS42 node is missing instead of falling back to string names. Codec DAI remains cs42l81-hifi (no COMP_DUMMY).
Match tools/linux-n31/Kconfig: SND_SOC_APPLE_NANO7 selects SND_SOC_APPLE_CS42L81_SPI; CS42 depends on SPI && SND_SOC.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
N31 peripherals that run on a real nano 7G with single commit per device, on top of
s5l87xx.Home, Sleep, Play, Vol±, the panel, backlight, I2C, and Windows RNDIS all work on glass. Kernel
6.14.0 #90.What we tested
zImage:ramdisk:dtb) → tty0#shell0xFFFEand the pads go quietpm_power_off(D1830 reg 13 bit 0)1d6b:0106. SSH and telnet to192.168.7.2I2C completion on this SoC is IICCON bit 4 (IRQPEND), not the
+0x20INT word. STAT bit 0 is not NAK here; treating it as NAK broke PMIC@0x73.What we left out
I2S / CS42 PCM is not in this series. We can program the analog path. The SoC serializer still does not drain the FIFO, so there is nothing useful to review yet.
Also out: PL080 tone, Nimbus, BCM2078, Tristar-as-working, LIS3 “fixes”, and
dlg,apply-sec-rails. That last one writes the power-off latch at probe.Other iPods
N46 and N20 still bind
apple,s5l87xx-usbtodwc2_set_s5l8702_params(slave PIO, session-valid GINTMSK quirk). N31 usesapple,s5l8740-usb/apple,s5l8740-otgphyso it does not inherit the nano3 PHY ramp or that quirk.Clock ungate is limited to
samsung,s5l8740. We do not write CLKCON+0x00/+0x04(SYS / DRAM) or+0x50(fatal latch).Commits
Happy to split any of these into their own PRs if that is easier to review.