3.9. QUP/GENI serial-engine bus map (what is wired where)

This is the GENI/QUP register surface and the instance map together: every QUPv3 serial engine (SE), whether it runs I²C / SPI / UART, and the peripheral on each bus. The SE hardware and addresses come from the base DTB (artifacts/boot_a/board.dts); the protocol choice and attached devices come from the overlay (artifacts/dtbo_a/overlay_0.dts), resolved through its __fixups__ against the base __symbols__ (so each device is tied to a concrete SE, not guessed).

3.9.1. Controllers

Two QUPv3 wrappers, each with six GENI serial engines spaced 0x4000 apart:

• QUP0 — qcom,qupv3_0_geni_se@8c0000; SE0…SE5 at 0x880000 + n·0x4000.

• QUP1 — qcom,qupv3_1_geni_se@9c0000; SE6…SE11 at 0x980000 + (n−6)·0x4000.

Each SE is protocol-agnostic in silicon (the base DTB defines both i2c@ and spi@ shells at the same address); the overlay enables one protocol per SE and attaches devices.

3.9.2. The map

SE	Address	Mode	Device(s) on the bus (I²C 7-bit addr)
SE0	0x880000	I²C	Wacom EMR stylus digitizer — onyx,wacom_i2c @ 0x09 (the pen layer)
SE1	0x884000	UART (4-wire)	reserved 4-wire UART (CTS/RTS present); no overlay child
SE2	0x888000	SPI	e-ink TCON — onyx,lfcpnx @ CS0, with FPGA program/reset/standby GPIOs (the LFCPNX100 timing controller of Display pipeline — DSI transport to the color e-ink TCON)
SE3–SE5	0x88c000–0x894000	—	not populated
SE6	0x980000	—	I²C/SPI-capable; not populated
SE7	0x984000	I²C	LFE5U FPGA control — onyx,lfe5u_i2c @ 0x34 (Lattice ECP5-class FPGA; the I²C control side of the e-ink bridge whose SPI side is SE2)
SE8	0x988000	I²C	Parade touchscreen — parade,pt_i2c_adapter @ 0x24 (capacitive touch)
SE9	0x98c000	UART (2-wire)	the earlycon/debug console (earlycon=msm_geni_serial,0x98c000, Base kernel device tree (the SoC boot contract)); the overlay also attaches the Onyx keyboard-cover serial link (onyx,kb-serial → keyboard-ultra2) here
SE10	0x990000	I²C	a shared bus: SMB1396 charge-pump PMIC (qcom,i2c-pmic @ 0x34, PMIC reset timers, charging and reachability); Awinic AW87xxx audio PAs @ 0x78/0x79 (speaker amps); LM3630A front-light drivers @ 0x38/0x36 (warm/cold LED channels)
SE11	0x994000	—	not populated

The console SE (SE9, qcom,qup_uart@98c000, compatible = "qcom,msm-geni-console") register block is 0x98C000 size 0x4000, GIC-v3 SPI 0x164, 2-wire (TX/RX only), 115200 8N1 (ttyMSM0). Its pins are GPIO25 = TX, GPIO26 = RX (TLMM function qup13_f2, 2 mA, bias-disable when active; sleep state muxes them back to plain gpio with pull-down — Pin control — TLMM and the PMIC GPIOs), and its clocks are se-clk/m-ahb/s-ahb = GCC ids 0x5b / 0x63 / 0x64 (Clock tree — GCC, domain CCs, RPMh). The SE follows the standard Qualcomm GENI SE (qcom-geni-se) programming model — register offsets are the GENI interface, not device-specific. XBL carries a boot_logger_uart.c and a UARTLogBufferSize log buffer targeting this console; whether TX is physically driven before the OS starts is unverified statically (Open questions and limits of analysis).

3.9.3. Devices not on a GENI bus

Two peripherals are attached at /soc level with GPIO control rather than a GENI SE, so they are not in the table above:

• Fingerprint — a SPI sensor declared with GPIO chip-select and rst/irq lines, in three interchangeable vendor variants (fortsense,fortsense_fp / qcom,cs_finger (Chipsailing) / microarray,fingerprint); the running unit binds whichever matches.

• Hall sensor — onyx,onyx-hall (cover/fold detect), GPIO-IRQ driven.

3.9.4. What this reveals

The bus map is the wiring evidence behind several other pages:

• The color e-ink pipeline (Display pipeline — DSI transport to the color e-ink TCON) is confirmed to route through a TCON rather than a panel: the LFCPNX TCON (SE2, SPI) and its LFE5U FPGA control/bridge companion (SE7, I²C) sit on separate SEs.

• The charge-pump PMIC (SMB1396, SE10) is confirmed as a separate I²C part from the SPMI PMICs (PMIC reset timers, charging and reachability).

• Input is confirmed split across separate I²C engines, matching the two touch stacks in the kernel config (Boot image: kernel, DTB, ramdisk, config): Parade capacitive touch on SE8, Wacom EMR digitizer on SE0.

• The front-light (dual LM3630A) and speaker PAs (AW87xxx) are confirmed to share SE10 with the charger.

For a bring-up on replaced firmware, this is the peripheral inventory reachable over the two QUP blocks; the GENI engines themselves are already clocked by XBL (the debug UART on SE9 is configured as earlycon and expected to be live, though whether TX is physically driven before the OS starts is unverified statically — Open questions and limits of analysis), and the general execution state a post-XBL payload inherits is in Below UEFI — execution state and hardware register surface.

3.9.5. Provenance

Source:

artifacts/boot_a/board.dts (QUPv3 wrappers, SE addresses, __symbols__) and artifacts/dtbo_a/overlay_0.dts (device nodes + __fixups__ mapping each fragment to a qupv3_seN label).

Method:

SE address derivation (0x4000 stride within each QUP); overlay __fixups__``→base ``__symbols__ resolution to bind each device to its SE; I²C addresses read from each device node’s reg. No code executed.

Cross-refs:

Below UEFI — execution state and hardware register surface (execution state at hand-off), Base kernel device tree (the SoC boot contract) (earlycon, SoC), Pin control — TLMM and the PMIC GPIOs (console pins), Clock tree — GCC, domain CCs, RPMh (console clock ids), Display pipeline — DSI transport to the color e-ink TCON (TCON/FPGA buses), PMIC reset timers, charging and reachability (SMB1396 I²C charger), Boot image: kernel, DTB, ramdisk, config (Onyx touch/stylus/fingerprint drivers).