====================================================== QUP/GENI serial-engine bus map (what is wired where) ====================================================== This is the GENI/QUP register surface **and** the instance map together: every QUPv3 serial engine (SE), whether it runs I²C / SPI / UART, and the peripheral on each bus. The SE hardware and addresses come from the base DTB (``artifacts/boot_a/board.dts``); the protocol choice and attached devices come from the overlay (``artifacts/dtbo_a/overlay_0.dts``), resolved through its ``__fixups__`` against the base ``__symbols__`` (so each device is tied to a concrete SE, not guessed). Controllers =========== Two QUPv3 wrappers, each with six GENI serial engines spaced ``0x4000`` apart: - **QUP0** — ``qcom,qupv3_0_geni_se@8c0000``; SE0…SE5 at ``0x880000`` + n·``0x4000``. - **QUP1** — ``qcom,qupv3_1_geni_se@9c0000``; SE6…SE11 at ``0x980000`` + (n−6)·``0x4000``. Each SE is protocol-agnostic in silicon (the base DTB defines both ``i2c@`` and ``spi@`` shells at the same address); the overlay enables one protocol per SE and attaches devices. The map ======= .. list-table:: :header-rows: 1 :widths: 10 14 10 66 * - SE - Address - Mode - Device(s) on the bus (I²C 7-bit addr) * - **SE0** - ``0x880000`` - I²C - **Wacom EMR stylus** digitizer — ``onyx,wacom_i2c`` @ ``0x09`` (the pen layer) * - SE1 - ``0x884000`` - UART (4-wire) - reserved 4-wire UART (CTS/RTS present); no overlay child * - **SE2** - ``0x888000`` - SPI - **e-ink TCON** — ``onyx,lfcpnx`` @ CS0, with FPGA program/reset/standby GPIOs (the LFCPNX100 timing controller of :doc:`/display/panel`) * - SE3–SE5 - ``0x88c000``–``0x894000`` - — - not populated * - SE6 - ``0x980000`` - — - I²C/SPI-capable; not populated * - **SE7** - ``0x984000`` - I²C - **LFE5U FPGA** control — ``onyx,lfe5u_i2c`` @ ``0x34`` (Lattice ECP5-class FPGA; the I²C control side of the e-ink bridge whose SPI side is SE2) * - **SE8** - ``0x988000`` - I²C - **Parade touchscreen** — ``parade,pt_i2c_adapter`` @ ``0x24`` (capacitive touch) * - **SE9** - ``0x98c000`` - UART (2-wire) - the **earlycon/debug console** (``earlycon=msm_geni_serial,0x98c000``, :doc:`/boot/base-dtb`); the overlay also attaches the **Onyx keyboard-cover** serial link (``onyx,kb-serial`` → ``keyboard-ultra2``) here * - **SE10** - ``0x990000`` - I²C - a shared bus: **SMB1396 charge-pump PMIC** (``qcom,i2c-pmic`` @ ``0x34``, :doc:`/soc/pmic`); **Awinic AW87xxx audio PAs** @ ``0x78``/``0x79`` (speaker amps); **LM3630A front-light drivers** @ ``0x38``/``0x36`` (warm/cold LED channels) * - SE11 - ``0x994000`` - — - not populated The console SE (SE9, ``qcom,qup_uart@98c000``, ``compatible = "qcom,msm-geni-console"``) register block is ``0x98C000`` size ``0x4000``, GIC-v3 SPI ``0x164``, 2-wire (TX/RX only), 115200 8N1 (``ttyMSM0``). Its pins are **GPIO25 = TX, GPIO26 = RX** (TLMM function ``qup13_f2``, 2 mA, ``bias-disable`` when active; sleep state muxes them back to plain ``gpio`` with pull-down — :doc:`/soc/pinctrl`), and its clocks are ``se-clk``/``m-ahb``/``s-ahb`` = GCC ids ``0x5b`` / ``0x63`` / ``0x64`` (:doc:`/soc/clocks`). The SE follows the standard Qualcomm GENI SE (``qcom-geni-se``) programming model — register offsets are the GENI interface, not device-specific. XBL carries a ``boot_logger_uart.c`` and a ``UARTLogBufferSize`` log buffer targeting this console; whether TX is physically driven before the OS starts is unverified statically (:doc:`/open-questions`). Devices not on a GENI bus ========================= Two peripherals are attached at ``/soc`` level with GPIO control rather than a GENI SE, so they are not in the table above: - **Fingerprint** — a SPI sensor declared with GPIO chip-select and rst/irq lines, in three interchangeable vendor variants (``fortsense,fortsense_fp`` / ``qcom,cs_finger`` (Chipsailing) / ``microarray,fingerprint``); the running unit binds whichever matches. - **Hall sensor** — ``onyx,onyx-hall`` (cover/fold detect), GPIO-IRQ driven. What this reveals ================= The bus map is the wiring evidence behind several other pages: - The **color e-ink pipeline** (:doc:`/display/panel`) is confirmed to route through a TCON rather than a panel: the LFCPNX TCON (SE2, SPI) and its LFE5U FPGA control/bridge companion (SE7, I²C) sit on separate SEs. - The **charge-pump PMIC** (SMB1396, SE10) is confirmed as a separate I²C part from the SPMI PMICs (:doc:`/soc/pmic`). - Input is confirmed split across separate I²C engines, matching the two touch stacks in the kernel config (:doc:`/boot/boot-image`): Parade capacitive touch on SE8, Wacom EMR digitizer on SE0. - The **front-light** (dual ``LM3630A``) and **speaker PAs** (``AW87xxx``) are confirmed to share SE10 with the charger. For a bring-up on replaced firmware, this is the peripheral inventory reachable over the two QUP blocks; the GENI engines themselves are already clocked by XBL (the debug UART on SE9 is configured as earlycon and expected to be live, though whether TX is physically driven before the OS starts is unverified statically — :doc:`/open-questions`), and the general execution state a post-XBL payload inherits is in :doc:`/boot/below-uefi`. Provenance ========== :Source: ``artifacts/boot_a/board.dts`` (QUPv3 wrappers, SE addresses, ``__symbols__``) and ``artifacts/dtbo_a/overlay_0.dts`` (device nodes + ``__fixups__`` mapping each fragment to a ``qupv3_seN`` label). :Method: SE address derivation (``0x4000`` stride within each QUP); overlay ``__fixups__``→base ``__symbols__`` resolution to bind each device to its SE; I²C addresses read from each device node's ``reg``. No code executed. :Cross-refs: :doc:`/boot/below-uefi` (execution state at hand-off), :doc:`/boot/base-dtb` (earlycon, SoC), :doc:`/soc/pinctrl` (console pins), :doc:`/soc/clocks` (console clock ids), :doc:`/display/panel` (TCON/FPGA buses), :doc:`/soc/pmic` (SMB1396 I²C charger), :doc:`/boot/boot-image` (Onyx touch/stylus/fingerprint drivers).