Repository navigation
spi: apple-qspi: runtime suspend T8140 between boot NOR accesses - #675
Merged
RyanTheTide merged 7 commits intoOct 31, 2026
Merged
Conversation
asahi-bless cannot select a one-time boot volume on the MacBook Neo (J700). The T8140 path admitted programs and erases inside the nvram partition with no runtime opt-in and no readback, while the J613 and J713 go through the read-only, opt-in, verified policy. Writes still never reached the flash, because the partition was read-only in MTD. Put the J700 on the same policy. The controller starts read-only and root opts in at runtime through the read_only parameter. A write needs the J700 board and the controller at 0x385110000. Programs are single-wire, three-byte, within one 256-byte page; erases are aligned 4 KiB sectors; both must lie inside the nvram partition. Every mutation checks the JEDEC ID and status first, is verified by readback, and a fault latches the driver read-only. The J613/J713 partition is pinned at 0x700000. The J700's comes from its device tree (0x24000, size 0x1d0000), so the range check now takes the partition bounds, and a DT window must fit in three-byte addressing. The J700 flash is a W25Q16JV (JEDEC ef6515). iBoot leaves BP0 set, which protects the top 64 KiB, so the J700 tolerates the block-protect bits as found: the driver never changes them, the flash ignores writes in that range, and readback then latches read-only. CMP, suspend, WPS, BUSY and WEL are still refused. T8140 data reads keep their multi-line pass-through. KUnit and the host harness now cover the shared policy at the J700 bounds, the J700 board gate and the block-protect tolerance. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
The J700 nvram partition starts at 0x24000 on its boot NOR. SPI-NOR picks the largest uniform erase size unless MTD_SPI_NOR_USE_4K_SECTORS is set, so the flash reports 64 KiB erase blocks and MTD forces the partition read-only because it does not start on an erase boundary. asahi-bless then cannot set a boot volume. There is no device tree or per-flash way to choose the erase size; this option is the only switch, and it is the upstream default. The Fedora base config turns it off. Set it again. The Apple NVRAM partitions are managed in 4 KiB units, and the QSPI NVRAM policy on the J613, J713 and J700 only admits 4 KiB erases anyway. Other SPI NOR users only see smaller erase blocks. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Each board that may write its NVRAM was qualified by its own compatible check in apple_qspi_nvram_write_board(), and probe then picked the partition bounds, JEDEC ID and block-protect allowance from whether the controller was T8140. The J613/J713 partition was a pair of constants, checked by a second device tree walk, while the J700 one came from the device tree unchecked. Put the qualified boards in one table: controller compatible, machine, controller aperture, the nvram partition the device tree must describe, the flash JEDEC ID and the block-protect bits its firmware leaves set. Every controller now reads its nvram partition from the device tree with the same walk, and a board is a write candidate only when that partition is exactly the one in its table entry. The T8140 multi-line read pass-through comes from the compatible match data. The J613 and J713 keep the 0x700000 partition and the W25Q64 ID, and the J700 keeps 0x24000, the W25Q16 ID and its BP tolerance, now with its partition pinned as well. The KUnit 0x700000 case covers the partition edges against its neighbours, and the host harness reads the table and gains controller, aperture and partition controls. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
The M4 Pro (T6041) boot NOR sits behind the same QSPIMC controller as the M3, M4 and A18 Pro parts, at 0x429118000. The J616s ADT places its nvram partition (anvram, "nvram,nor") at 0x700000 with a size of 1 MiB, the J613 and J713 layout, next to iboot at 0 and syscfg at 0x680000. Without a T6041 match the driver does not bind, so asahi-bless cannot select a boot volume from Linux. Match apple,t6041-qspi with single-line transfers, as on T8122 and T8132. Qualify the J616s for the verified NVRAM policy at its controller aperture and that partition, with the W25Q64 ID the other 0x700000 boards use and no block-protect bits tolerated. The flash ID is checked before every program or erase, so a different part is refused before any write enable reaches it. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Describe the J616s boot NOR on the QSPIMC controller with the nvram partition from its ADT (/arm-io/qspi/spinor/anvram, 0x700000, 1 MiB), so asahi-nvram and asahi-bless can find it. Use single-line transfers at 10 MHz, as on the J713. Add the nvram and spi0 aliases the J700 also carries. The SoC node stays disabled for boards that do not describe their flash. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
macOS reports the J616s boot NOR JEDEC ID as c22b27, a Macronix part, not the Winbond W25Q64 the J613 and J713 carry. Pin that ID in the J616s table entry. The write policy and the flash_status attribute read status registers with Winbond opcodes: 05h, 35h and 15h. On Macronix parts 35h is EQIO, which switches the flash to QPI mode, and the status register keeps four block-protect bits, BP[3:0] at bits 5:2, where Winbond has three and TB. For a Macronix part, read only the status (05h) and configuration (15h) registers, refuse 35h from SPI-NOR as well, and check WIP, WEL and all four BP bits before a write. flash_status reads the JEDEC ID first and sends 35h only to Winbond parts. The J616s still admits only 3-byte page programs and 4 KiB sector erases (20h) inside its nvram partition, with readback verification. SPI-NOR has no table entry for c22b27; it binds through the generic Macronix entry and takes geometry and erase types from SFDP. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
The T8140 boot NOR controller keeps its genpd domain active between accesses. Enable runtime PM only for this SoC, independently of the board qualification and NVRAM write policy. Let spi-mem acquire the runtime reference around exec_op. This covers all private JEDEC/status reads, WREN, completion polling, WRDI and readback in a verified mutation. Mark the controller busy after the whole operation, since spi-mem releases its reference with a plain pm_runtime_put(). Use a 100 ms autosuspend delay to group successive 4 KiB read chunks and userspace NVRAM access bursts without retaining the domain for long idle periods. Hold an initial reference through registration, NOR discovery and the last probe MMIO, and balance it on failure. Drain and disable the IRQ before genpd can gate the block. On resume, reuse the reset helper to restore timing, FIFO thresholds and interrupt state before enabling the IRQ; mode, divider and transfer descriptors are set per operation. A failed reset leaves the IRQ disabled and prevents the memory access. Use the force helpers for system sleep so an already suspended block is not accessed. Keep the SPI queue rollback and reopen behavior, and leave other SoCs on their existing system-sleep path. Extend the host harness to check that read, refusal, verified program and error paths update the idle stamp under the outer SPI PM reference. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
RyanTheTide
marked this pull request as ready for review
October 31, 2026 05:29
Contributor
Author
|
Hardware-tested in the fleet12 kernel (7.3.0-aurora-fleet12): the same eight files are byte-identical to the tested tree. Booted one-shot and default on the Neo, M2, M1 Pro and J616s with no new err-level lines. On the Neo the nvram partition shows 4 KiB erase blocks, the T8140 controller runtime-suspends between accesses, and nvram reads work while read_only stays Y. The J616s DT half needs its Stage 2 DTB refresh before it takes effect there. 🤖 Generated with Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #666 (#666). Recreates its functional changes on current
aurora-wip(58d41ca2f87d) with corrected house trailers. Every new commit ends with contiguousAssisted-by: LLMandSigned-off-by: Ryan Murray <ryan@aurorasilicon.org>, with noCo-Authored-Byline.Dependency order: #673 → #674 → this PR. The first six commits are the replacement prerequisite stack. The final commit enables T8140 runtime PM with a 100 ms autosuspend delay, an operation-wide spi-mem reference for verified mutations, IRQ draining before power-off, reset/configuration restoration before IRQ enable, and runtime force helpers for system sleep with queue rollback/reopen.
The obsolete prerequisite merge from #666 is replaced by this linear ancestry; the runtime-PM functional patch is unchanged.
Validation on all three replacement heads:
W=1:spi-apple-qspi.oandspi-apple-qspi-policy-test.obuild (defconfig + asahi.config, C-onlyCONFIG_RUST=n).tools/asahi/qspi-nvram-tests.py: ASan/UBSan harness and changed-guard controls pass on Linux.git log --format=%Bchecked for every introduced commit;git diff --checkclean.git merge-tree --write-tree <current-base> <old-head>result. Context-free stable patch IDs match the original functional commits.Whole old-head/new-head diffs contain the newer base changes (including #665/#668/#669); making those diffs empty would revert landed work. No implementation changes beyond the original patches are introduced.
No new hardware qualification or power-saving measurement is claimed. Existing qualification and remaining lead checks are documented in the superseded PRs. No existing branch was rewritten, no force push was used, and no old PR was closed or merged.
Assisted-by: LLM
🤖 Generated with Claude Code