Repository navigation
spi: apple-qspi: runtime suspend T8140 between boot NOR accesses - #666
Closed
RyanTheTide wants to merge 8 commits into
Closed
RyanTheTide wants to merge 8 commits into
RyanTheTide wants to merge 8 commits into
Conversation
asahi-bless cannot select a one-time boot volume on the MacBook Neo (J700). The T8140 path admitted programs and erases inside the nvram partition with no runtime opt-in and no readback, while the J613 and J713 go through the read-only, opt-in, verified policy. Writes still never reached the flash, because the partition was read-only in MTD. Put the J700 on the same policy. The controller starts read-only and root opts in at runtime through the read_only parameter. A write needs the J700 board and the controller at 0x385110000. Programs are single-wire, three-byte, within one 256-byte page; erases are aligned 4 KiB sectors; both must lie inside the nvram partition. Every mutation checks the JEDEC ID and status first, is verified by readback, and a fault latches the driver read-only. The J613/J713 partition is pinned at 0x700000. The J700's comes from its device tree (0x24000, size 0x1d0000), so the range check now takes the partition bounds, and a DT window must fit in three-byte addressing. The J700 flash is a W25Q16JV (JEDEC ef6515). iBoot leaves BP0 set, which protects the top 64 KiB, so the J700 tolerates the block-protect bits as found: the driver never changes them, the flash ignores writes in that range, and readback then latches read-only. CMP, suspend, WPS, BUSY and WEL are still refused. T8140 data reads keep their multi-line pass-through. KUnit and the host harness now cover the shared policy at the J700 bounds, the J700 board gate and the block-protect tolerance. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The J700 nvram partition starts at 0x24000 on its boot NOR. SPI-NOR picks the largest uniform erase size unless MTD_SPI_NOR_USE_4K_SECTORS is set, so the flash reports 64 KiB erase blocks and MTD forces the partition read-only because it does not start on an erase boundary. asahi-bless then cannot set a boot volume. There is no device tree or per-flash way to choose the erase size; this option is the only switch, and it is the upstream default. The Fedora base config turns it off. Set it again. The Apple NVRAM partitions are managed in 4 KiB units, and the QSPI NVRAM policy on the J613, J713 and J700 only admits 4 KiB erases anyway. Other SPI NOR users only see smaller erase blocks. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each board that may write its NVRAM was qualified by its own compatible check in apple_qspi_nvram_write_board(), and probe then picked the partition bounds, JEDEC ID and block-protect allowance from whether the controller was T8140. The J613/J713 partition was a pair of constants, checked by a second device tree walk, while the J700 one came from the device tree unchecked. Put the qualified boards in one table: controller compatible, machine, controller aperture, the nvram partition the device tree must describe, the flash JEDEC ID and the block-protect bits its firmware leaves set. Every controller now reads its nvram partition from the device tree with the same walk, and a board is a write candidate only when that partition is exactly the one in its table entry. The T8140 multi-line read pass-through comes from the compatible match data. The J613 and J713 keep the 0x700000 partition and the W25Q64 ID, and the J700 keeps 0x24000, the W25Q16 ID and its BP tolerance, now with its partition pinned as well. The KUnit 0x700000 case covers the partition edges against its neighbours, and the host harness reads the table and gains controller, aperture and partition controls. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
The M4 Pro (T6041) boot NOR sits behind the same QSPIMC controller as the M3, M4 and A18 Pro parts, at 0x429118000. The J616s ADT places its nvram partition (anvram, "nvram,nor") at 0x700000 with a size of 1 MiB, the J613 and J713 layout, next to iboot at 0 and syscfg at 0x680000. Without a T6041 match the driver does not bind, so asahi-bless cannot select a boot volume from Linux. Match apple,t6041-qspi with single-line transfers, as on T8122 and T8132. Qualify the J616s for the verified NVRAM policy at its controller aperture and that partition, with the W25Q64 ID the other 0x700000 boards use and no block-protect bits tolerated. The flash ID is checked before every program or erase, so a different part is refused before any write enable reaches it. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Describe the J616s boot NOR on the QSPIMC controller with the nvram partition from its ADT (/arm-io/qspi/spinor/anvram, 0x700000, 1 MiB), so asahi-nvram and asahi-bless can find it. Use single-line transfers at 10 MHz, as on the J713. Add the nvram and spi0 aliases the J700 also carries. The SoC node stays disabled for boards that do not describe their flash. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
macOS reports the J616s boot NOR JEDEC ID as c22b27, a Macronix part, not the Winbond W25Q64 the J613 and J713 carry. Pin that ID in the J616s table entry. The write policy and the flash_status attribute read status registers with Winbond opcodes: 05h, 35h and 15h. On Macronix parts 35h is EQIO, which switches the flash to QPI mode, and the status register keeps four block-protect bits, BP[3:0] at bits 5:2, where Winbond has three and TB. For a Macronix part, read only the status (05h) and configuration (15h) registers, refuse 35h from SPI-NOR as well, and check WIP, WEL and all four BP bits before a write. flash_status reads the JEDEC ID first and sends 35h only to Winbond parts. The J616s still admits only 3-byte page programs and 4 KiB sector erases (20h) inside its nvram partition, with readback verification. SPI-NOR has no table entry for c22b27; it binds through the generic Macronix entry and takes geometry and erase types from SFDP. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
The T8140 boot NOR controller keeps its genpd domain active between accesses. Enable runtime PM only for this SoC, independently of the board qualification and NVRAM write policy. Let spi-mem acquire the runtime reference around exec_op. This covers all private JEDEC/status reads, WREN, completion polling, WRDI and readback in a verified mutation. Mark the controller busy after the whole operation, since spi-mem releases its reference with a plain pm_runtime_put(). Use a 100 ms autosuspend delay to group successive 4 KiB read chunks and userspace NVRAM access bursts without retaining the domain for long idle periods. Hold an initial reference through registration, NOR discovery and the last probe MMIO, and balance it on failure. Drain and disable the IRQ before genpd can gate the block. On resume, reuse the reset helper to restore timing, FIFO thresholds and interrupt state before enabling the IRQ; mode, divider and transfer descriptors are set per operation. A failed reset leaves the IRQ disabled and prevents the memory access. Use the force helpers for system sleep so an already suspended block is not accessed. Keep the SPI queue rollback and reopen behavior, and leave other SoCs on their existing system-sleep path. Extend the host harness to check that read, refusal, verified program and error paths update the idle stamp under the outer SPI PM reference. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Contributor
Author
|
Superseded by #675, which carries the same change with the house trailers and is merged into aurora-wip after the fleet12 hardware run. 🤖 Generated with Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The T8140 QSPI controller has no runtime PM, so it holds its power domain between boot-NOR accesses. This enables runtime suspend on T8140 while keeping the verified NVRAM write sequence and multi-line reads intact.
Dependency order: #626 → #662 → this PR. The branch merges the original #662 ancestry (including #626) onto aurora-wip
8348f8244b20; neither prerequisite branch is changed. The new functional change is the final commit,e96eb52c5dbe. A merge-tree check of that order is conflict-free and produces exactly the tested tree. The dependency commits remain visible until their PRs merge.pm_runtime_put(). Long mutation polls remain protected by the reference, regardless of the delay.History review: the initial PIO driver (
f795597317be) had no PM callbacks; no deliberate runtime-PM prohibition was found.1e76f292c061added configuration restoration after power loss in system sleep, and0d8b9f1db4acfixed the queue remaining suspended after reset failure. The new callbacks reuse those mechanisms. In the current T8140 DT, QSPI at0x385110000usesps_qspi(0x350) belowps_spi_p(0x2f0); both are enabled without always-on or firmware-owned flags. No DT flag change is needed, and another consumer may keep the parent on.Validation:
CONFIG_RUST=n: the initial Rust-enabled preparation failed in unrelated generated EFI binding alignment assertions.checkpatch --strict: 0 errors, 0 warnings, 0 checks.git diff --checkclean.apple-qspi-nvram-policy: 9/9 pass. W=1 usedCONFIG_WERROR=nfor warnings outside QSPI (including proc_sysctl and Synaptics); this is a test-build setting only.Not hardware qualified. No full kernel Image build or measured power saving is claimed. Lead checks before merging:
f0f4ded041f8with this commit using a one-shot kernel and a known-good boot fallback. Confirm JEDEC ID, partition bounds and default read-only policy; retain raw NVRAM snapshots privately.asahi-nvramreads back-to-back and after >250 ms idle. Briefly opt in through the existingread_onlyparameter to write/read/delete a fresh benign test variable, restoring read-only after each mutation. Check latency, readback, fault latch and dmesg. Do not retry a latched mutation.asahi-bless -d <snapshot-copy> --next --set-boot <confirmed-target> -yonly on a copy. Verify the byte diff, bit transitions and unchanged persistent selection.qspidomain off. Explain remainingspi_pconsumers. Repeat access checks after s2idle from idle and active states; require no MMIO fault, reset timeout, IRQ imbalance or stuck queue.