[HDP 2022] Put an RPi CM4 into an original iPad

Open up a 2010 iPad, remove its logic board, and fabricate a new board based around the Raspberry Pi CM4.

Similar projects worth following
(This project is a copy of because apparently pre-existing projects need to be copy-pasted to a new project to qualify as a Hackaday Prize entry. I suggest following the original project.)

The 2010 iPad is completely unsupported, and is almost useless. It will still run old apps, but almost all internet-connected apps are broken. Even browsing the web in Safari is difficult, since iOS 5 has out-of-date TLS CAs.

But still, it's a pretty good piece of hardware in many ways. If we were to replace the logic board, we could still use these parts:

* Case
* 25 watt-hour battery
* capacitive touchscreen digitizer
* 1024x768 LCD
* 2x wifi/bluetooth antennas
* mono speaker
* TRRS port
* microphone
* ambient light sensor
* four buttons (lock/unlock, volume up, volume down), one switch (rotation)
* The wifi/BT module
* 30-pin connector

In this project, I am building a replacement logic board around a Raspberry Pi CM4.

Apple sold millions of iPads the year they were introduced. These devices were capable of browsing the web, watching movies, and playing games, with up to 10 hours of battery life and an intuitive touchscreen display. Apple essentially defined what a tablet should look like, and competitors are still playing catch-up.

However, all the original iPads are many years out of date. While some apps still work, and some can be made to work by jailbreaking the device, due to a lack of software support by Apple, these tablets are unable to do many of the things they used to be capable of.

The hardware isn't terrible, though! The iPad has a nice touchscreen, an okay LCD, a beefy battery, and enough buttons and ports to make it still useful as a computing device.

With this project, I intend to make a logic board for the original iPad based around the Raspberry Pi CM4 or another similar SoM. This will allow people to upcycle their obsolete iPads into fully-functioning tablets, which should be able to run Linux and Android.

Hopefully by giving these venerable devices a new lease on life, we can keep some of them out of landfills.

  • Some progress on the LCD

    Evan07/22/2022 at 06:31 0 comments

    The iPad's LCD wants its video input data in the LVDS format, but the CM4 can't output LVDS. It can, however, output DSI video, and there are chips like the sn65dsi83-q1 from TI which can convert from DSI to LVDS.

    About a year ago, I had gotten the sn65dsi83 somewhat working on the previous revision of my board. However, I ran into an issue with that board design that was difficult to work around: That board was designed to work as a hat for a full-size Pi (for ease of controlling which parts of the board were connected), so it only supported the 2 lanes of DSI that are exposed on the 15-pin display FFC on the Pi 4. This made it impossible to get clock speeds in the right ranges to make everything happy:

    The LCD panel from the iPad wants an LVDS clock between 97MHz and 103MHz. The sn65dsi83 driver calculates a DSI clock speed for for a desired LVDS clock frequency based on the pixel rates required and how many lanes of DSI you're using. (In this case, it wanted a 600MHz clock, which the sn65 would then divide by 6 to get 100MHz.) The Pi's DSI driver, vc4_dsi, then rounds this requested DSI clock speed up to the nearest integer division of 1.5GHz. In the case of 2 DSI lanes, this meant the Pi was trying to send a 750MHz DSI clock, and divide by 6 to get a 125MHz LVDS clock. These clock speeds are out of spec for both the sn65 (which only supports up to 500MHz DSI clocks) and the panel (which wants 100MHz clocks).

    The fix would be to use 4 lanes of DSI -- with 4 lanes, the sn65dsi83 driver would request a 300MHz clock (which the vc4_dsi driver would happily provide, as that's one fifth of 1500 MHz), which the sn65 would then divide by 3 to get the 100MHz LVDS clock. I set aside any further work on the sn65 until I had my second board revision.

    Picking up where I left off

    Now that I've got my CM4-based board (which has all 4 lanes of DSI routed), it was time to try getting video working again.

    One of the first things I did was to skim through the updates on this massive thread on the Raspberry Pi forums, which is the de facto place to discuss using the sn65dsi83 with the Raspberry Pi. So, so many updates.

    An engineer from the Raspberry Pi foundation, who goes by 6by9 on the forums, maintains a branch of the Linux kernel with patches to the sn65dsi83 driver. I pulled the latest version of their branch and merged it with the changes from my branch from last year. I double-checked the settings in the device tree overlay file (updating e.g. which GPIO pins are connected to the enable pin on the sn65 and its voltage regulator).

    Before trying it out, I looked at the area of my board near the sn65 to check for short circuits and such. (This is my last copy of the chip, and they're only available from a few places, which are selling at quite a bit above MSRP.)

    Satisfied that I wasn't going to fry the chip, I enabled the dtoverlay. I was greeted with this error message on boot:

    [   18.154108] sn65dsi83 10-002d: failed to attach dsi to host: -517

    I used some tricks I've learned during this project to get more information out of the kernel at boot: specifically, adding a bunch of dyndbg flags to the kernel command line in /boot/cmdline.txt:

    ti_sn65dsi83.dyndbg="+pmf" vc4.dyndbg="+pmf" panel_simple.dyndbg="+pmf" drm_kms_helper.dyndbg="+pmf" component.dyndbg="+pmf" 

    (This enables debug messages in the ti_sn65dsi83, vc4, panel_simple, ... kernel modules.)

    After adding some more debug messages to those modules, I ended up with this in my boot log:

    [   17.888125] calling  sn65dsi83_driver_init+0x0/0x1000 [ti_sn65dsi83] @ 366
    [   17.900948] sn65dsi83 10-002d: supply vcc not found, using dummy regulator
    [   17.902829] systemd-journald[136]: Successfully sent stream file descriptor to service manager.
    [   17.907747] systemd-journald[136]: Successfully sent stream file descriptor to service manager.
    [   17.918315] systemd-journald[136]: Successfully sent stream file descriptor to service manager.
    [ 17.942603] systemd-journald[136]:...
    Read more »

  • Getting the GT9110 touchscreen controller working

    Evan07/22/2022 at 06:31 0 comments

    I've been testing out the GT9110 for the past few days, and finally got it working today.

    My board uses a Goodix GT9110 touchscreen controller, which is closely related to a few other parts (GT911, GT928, etc.), and is basically the only touchscreen controller that I could find which met my requirements:

    1. Has enough drive and sense pins to work with my touchscreen
    2. A reasonable footprint which doesn't require expensive, high-density PCBs (which excludes the mXT2952, an 0.5mm-pitch BGA)
    3. Available in small quantities for a reasonable price (which excludes the MXT2912TD-A)
    4. Actual datasheets are available (which excludes a bunch of Cypress chips)
    5. Linux drivers are available

    (I should note that I haven't found an English datasheet for the GT9110, only one in Chinese. However, I did find English datasheets for related chips, like the GT911 and GT9113. These, plus Google Translate, were enough to lay out my PCB.) 

    On my previous iteration of the board, the i2c communication to the GT9110 was unreliable -- it wouldn't respond on i2c until a little while after the INT pin went high, which made the Linux goodix driver unhappy. I had guessed that might've been because the bodge I had to do for the INT pin wasn't making a good connection.

    Initial progress

    I dug up the device tree overlay file I had written for testing, and updated the GPIO numbers to match my new board revision.

    Fortunately, the new board doesn't have the same communications issues from the old board -- the Linux driver was able to talk to the GT9110 successfully, and create a file under /dev/input/event*.

    Getting stuck

    However, beyond initializing the driver, nothing else would happen. The INT pin would go high during driver initialization, and wouldn't change when I touched the screen. No further i2c communication was happening. Looking at the drive pins with an oscilloscope, I could see nothing was happening.

    An error immediately stood out to me:

    [   67.112771] Goodix-TS 1-005d: Direct firmware load for goodix_9110_cfg.bin failed with error -2

    I searched the web for a goodix_9110_cfg.bin, but couldn't find any example files. I did, however, find a few relevant threads:

    Nobody seems to mention needing a goodix_9110_cfg.bin (or goodix_911_cfg.bin, goodix_928_cfg.bin, or whatever); everybody managed to get their touchscreens working after a while by fixing basic issues with their device tree overlay files.

    Thinking I might have the wrong settings for my interrupt pin, I tried various combinations of pull-up/down/hi-Z, interrupt configuration (IRQ_TYPE_EDGE_FALLING, IRQ_TYPE_EDGE_RISING, IRQ_TYPE_LEVEL_HIGH, IRQ_TYPE_LEVEL_LOW). None of these seemed to help - several of those combinations prevented i2c communications entirely.

    Eventually, I gave up on that and focused on the firmware load error again. Adding a bunch of debug printfs to the driver and watching i2c communication with my logic analyzer (I'm using the Logic 8 from Saleae), I could see that it was:

    • Identifying the GT9110 on i2c
    • Trying to load the firmware from disk, and complaining that it isn't there. (The internet tells me it's looking in /lib/firmware, among other places)
    • Reading a bunch of data from the GT9110 starting at register 0x8047, which is the beginning of the configuration registers.
    • Leaving the INT pin high, never signalling that it had data.
    My board with the logic analyzer hooked up. I neglected to put proper test points on the board, so instead I've just gotten into the habit of scraping some solder mask off with a scalpel and soldering a bit of enameled wire to a trace to give me something to hook a probe to. The bit of cereal box is there to prevent any accidental short-circuits between the back of my board and the metal on the screen.
    Zoomed-out view of driver...
    Read more »

  • Real-time clock: It's nice when something is easy.

    Evan07/22/2022 at 06:30 0 comments

    At the very last minute before ordering my PCBs, I realized I probably wanted a real-time clock on the board somewhere. I searched on Digi-Key, found the RV-8263-C7, which was:

    • in stock (not anymore, lol)
    • cheap
    • tiny
    • requires minimal external components (just a decoupling cap and a pull-up resistor on an output enable pin)
    • has a Linux kernel driver (this chip has the same protocol as the PCF85063)

    I found an empty spot on my board with I2C and VBAT lines nearby, and laid it out in a few minutes.

    Tonight, I decided to see if it was working:

    Throw together a quick dtoverlay file:

    / {
        compatible = "brcm,bcm2835";
        fragment@0 {
            target = <&i2c1>;
            __overlay__ {
                #address-cells = <1>;
                #size-cells = <0>;
                status = "okay";
                rv8263: rtc@51 {
                    compatible = "microcrystal,rv8263";
                    reg = <0x51>;
                    // quartz-load-femtofarads = <12500>;

    (This is basically just device tree overlay boilerplate plus the example from the documentation.)

    Compile with make -j4 ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- dtbs, copy the output dtbo file to the CM4's /boot/overlays directory, and run dtoverlay pipad-rtc.dtbo to load the overlay. Test with sudo hwclock --systohc then sudo hwclock --get. Add dtoverlay=pipad-rtc to /boot/config.txt, reboot, check sudo hwclock --get again, and it's still working.

    Remove the fake-hwclock package and disable the systemd unit with the instructions on, and double-check that it's actually reading the hardware clock on startup (and not just using NTP) by using rfkill block wifi to turn off wifi, reboot, and check that the time is accurate.

    No incorrect PCB footprints or unwired pins, no Linux kernel debugging. Just things working correctly on the first try. Feels good.

  • Figuring out why the CM4 wouldn't boot when attached to my board

    Evan07/22/2022 at 06:29 0 comments

    In my previous log entry, I had fried my CM4 by shorting 5V to 3.3V, so I had to order a replacement, which arrived last week.

    The next thing for me to test is whether I can boot the CM4 on my board, so I installed Raspberry Pi OS and set enable_uart=1 in /boot/config.txt. With the CM4 still in the CM4IO, I verified that I could see boot messages and log into the CM4 over serial.

    I bodged some wires onto the UART traces on my board and connected them to my USB-serial adapter. I moved the CM4 off the CM4IO and onto my own board, and booted it, and.... nothing. Zero output from the UART.

    I figured it must be crashing somewhere during the bootloader or early kernel boot settings, so I moved the CM4 back to the CM4IO and:

    1. added console=ttyS0,115200n8 loglevel=7 earlycon=uart8250,mmio32,0xfe215040 to my /boot/cmdline.txt, to get early kernel messages.
    2. set BOOT_UART=1 in boot.conf to get output from the bootloader.

    Still nothing...

    After a while, I figured out that the TX pin on my 100-pin connector wasn't properly soldered to my board. Of all the pins to have issues, it had to be that pin!

    At this point, it still isn't booting, but I can at least see kernel messages. I would get a warning at some point during boot:

    [    3.178888] ------------[ cut here ]------------
    [    3.183639] Firmware transaction timeout
    [    3.183693] WARNING: CPU: 2 PID: 1 at drivers/firmware/raspberrypi.c:67 rpi_firmware_property_list+0x1dc/0x250
    [    3.197794] Modules linked in:
    [    3.200888] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.15.32-v8+ #1538
    [    3.207583] Hardware name: Raspberry Pi Compute Module 4 Rev 1.1 (DT)
    [    3.214098] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [    3.221144] pc : rpi_firmware_property_list+0x1dc/0x250
    [    3.226432] lr : rpi_firmware_property_list+0x1dc/0x250
    [    3.231719] sp : ffffffc00960b9b0
    [    3.235068] x29: ffffffc00960b9b0 x28: 0000000000000000 x27: 0000000000000004
    [    3.242300] x26: ffffffc009a5d008 x25: ffffff8002aa8b80 x24: 0000000000001000
    [    3.249530] x23: 0000000000000014 x22: ffffffc008e8a9c8 x21: ffffff80020b7200
    [    3.256758] x20: ffffffc009a5d000 x19: ffffffc009491158 x18: 0000000000000010
    [    3.263986] x17: 0000000000000001 x16: 0000000000000019 x15: 0720072007200720
    [    3.271214] x14: 0720072d072d072d x13: 74756f656d697420 x12: ffffffc0093a6670
    [    3.278442] x11: 0000000000000003 x10: ffffffc00938e630 x9 : ffffffc0080ec768
    [    3.285670] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000000001
    [    3.292899] x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : 0000000000000001
    [    3.300126] x2 : 0000000000000000 x1 : 529515f3f0203b00 x0 : 0000000000000000
    [    3.307354] Call trace:
    [    3.309824]  rpi_firmware_property_list+0x1dc/0x250
    [    3.314760]  rpi_firmware_property+0x78/0x110
    [    3.319169]  rpi_domain_on+0x6c/0x90
    [    3.322789]  genpd_power_on.part.23+0x188/0x220
    [    3.327375]  __genpd_dev_pm_attach+0x104/0x238
    [    3.331870]  genpd_dev_pm_attach+0x6c/0x88
    [    3.336014]  dev_pm_domain_attach+0x28/0x40
    [    3.340249]  platform_probe+0x58/0xe0
    [    3.343957]  really_probe+0xc0/0x318
    [    3.347573]  __driver_probe_device+0x80/0xe8
    [    3.351892]  driver_probe_device+0x88/0x118
    [    3.356123]  __driver_attach+0x78/0x110
    [    3.360004]  bus_for_each_dev+0x7c/0xd0
    [    3.363890]  driver_attach+0x2c/0x38
    [    3.367505]  bus_add_driver+0x194/0x1f8
    [    3.371385]  driver_register+0x6c/0x128
    [    3.375265]  __platform_driver_register+0x30/0x40
    [    3.380026]  xhci_plat_init+0x38/0x44
    [    3.383737]  do_one_initcall+0x54/0x2a0
    [    3.387619]  kernel_init_freeable+0x250/0x2d8
    [    3.392031]  kernel_init+0x2c/0x130
    [    3.395564]  ret_from_fork+0x10/0x20
    [    3.399186] ---[ end trace b159b7c67bd50e8b ]---

    Then after a few more messages, it would hang.

    From what I can tell from this issue where people saw the same "Firmware transaction timeout" warning, this happens when the code running on the VC4 locks up.

    Getting more output

    The internet told me to add initcall_debug to my kernel command line to get more output on startup. This prints a message per kernel subsystem on boot....

    Read more »

  • CM4 carrier board: chip shortage pain, bodges, silly mistakes, and tragedy.

    Evan07/22/2022 at 06:29 0 comments

    Chip shortage problems

    Shortly after my last project log, I tried to place an order for all the new components that I'd need for the next revision of my board, as well as re-stocking anything that I had already used most of. I discovered that my backlight controller of choice had gone out of stock with indefinite lead times, so I had to swap to a different backlight driver. (I switched from the TPS61176 to the TPS61177, which was the next cheapest suitable controller on DigiKey.)

    I ordered my parts then modified my PCB design to accommodate the new chip.

    Fit Testing

    Once I had parts in hand, I made a mockup of my board by printing the front and back solder mask layers on separate sheets of paper, and then gluing them to either side of a piece of cardboard taken from a soda can box. (This stackup comes remarkably close to the 0.8mm thickness of my PCB.) With some double-sided tape, I affixed the connectors for the largest components -- the CM4 and the NVMe SSD -- snapped the CM4 and SSD in place, and did a fit test in my iPad case. The screen did not want to drop into place.

    I found a few things that I could change to improve the fit:

    1. I rotated the CM4 180 degrees, so that the BCM2711 processor (the thickest part of the CM4) is closer to the center of the case (where the iPad is thicker, so there's more room)
    2. I moved almost all of the other components from the front to the back of the board, in between the SSD and the CM4, leaving only the connectors (dock, ambient light sensor, touchscreen, buttons) and the touchscreen controller and audio codec. (The touchscreen and audio bits are on the other end of the board, and I didn't seem to have any trouble fitting that end.) This meant the battery charger, 3.3v buck-boost (for the SSD), 5V boost (for the CM4), the DSI-LVDS converter, and the backlight driver all moved to the back.

    I also needed to adjust the edge of the board to leave a spot where the LVDS cable can come up from the back of the case to the front of the board.

    All these changes required re-routing a significant chunk of the board, which took me a few weeks.

    Touchscreen controller testing

    Meanwhile, I decided to test the GT9113/GT9110 touchscreen controller on the previous iteration of my board. I had messed up the orientation of the FFC connectors for the touchscreen on that revision, but I figured I should at least test whether I can get the Linux kernel to talk to it. I'm glad I did -- I discovered a few things that were wrong with my PCB.

    The GT9110 touchscreen controller, with the hack I had to implement to get access to the INT pin.

    First of all, the Linux kernel driver wants the INT pin from the controller to be wired to a GPIO pin. I hadn't connected that pin anywhere, and  didn't leave myself any extra space on the pad to solder a wire to. I tried several things to bodge a connection to this wire before finding something that worked:

    • poking an enameled wire at the edge of the chip and trying to get it to solder in place: the pins on the chip are visible on the side, but even my finest soldering iron tip is enormous compared to the 0.4mm between adjacent pins.
    • removing the IC, soldering a 40AWG wire to the pad, and soldering the IC back down. It turns out, even  40ga wire is thick enough to keep the rest of the pads from reliably making contact when soldering. I still feel like I could've gotten this to work by adding more solder, but it was just too finicky, so I got frustrated and tried another approach:
    • (what ultimately ended up working, mostly?) I took a standard 0.1" header pin, and used a file on 3 sides to sharpen it to a point that's flush with the 4th side. I then glued this in place with some UV-cure solder mask, which is my new favorite thing for bodges. Assuming you use a thin layer, it cures in like 10 seconds under the provided UV flashlight. This is what's shown in the photo above.

    Another thing that I discovered was that...

    Read more »

View all 5 project logs

Enjoy this project?



Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates