Skip to content

PCI/NVMe: Keep the ANS handoff across kexec, cold-reset when it fails - #105

Draft
brkosebay wants to merge 15 commits into
OrchardLinux:mainfrom
brkosebay:j71t/warm-storage
Draft

brkosebay wants to merge 15 commits into
OrchardLinux:mainfrom
brkosebay:j71t/warm-storage

Conversation

@brkosebay

@brkosebay brkosebay commented Nov 8, 2026 •

Copy link
Copy Markdown
Contributor

Part 3 of 11 of the iPad 5 (J71t) series in this repository; merge after #103.

Problem

On J71t the NVMe controller (ANS) sits behind the H9P PCIe port, and resetting that port loses the controller until a cold boot. A kexec therefore has to hand over a stopped but powered ANS, with its DART translations retained, or the next kernel loses its root filesystem. The first version of this handoff panicked when a step failed, which with panic=0 is an indefinite hang.

Change

Keep the certified ANS kexec handoff: DT and bindings describe it, the DART, H9P and NVMe drivers stop queues and translations in order and the next kernel picks them up, and core/printk export what the modules need. Every failure on the outgoing side now ends in a native cold reset through apple_cold_reset() instead of a panic, with explicit returns after it. The port is handed over powered, with PERST# asserted and the link stopped, and the incoming kernel brings it up with the cold-boot sequence (port power cycle, NVMe mode, port enable, then link training). Retraining the powered port by PERST# alone, as iOS never does, left the root port in Detect.Quiet and cost a timeout on every warm boot.

Testing

  • Hardware: iPad 5 Wi-Fi (J71t). Hands-on testing on 2026-11-11 with an integrated build of this series, made before the final failure-path fixes, covered NVMe root after cold boot and after warm restart (write/fsync/drop caches/read-back hash check).
  • Not covered on hardware: the cold-reset failure paths, exercised by the host tests in tools/testing.
  • 2026-11-12: 20+ warm restarts (kexec), several right after a glmark2 run, came back on the NVMe root without a freeze. Every warm boot now takes the full port cycle directly; the powered reset failed -110 retrain timeout is gone.
  • Host: the Linux test suite passes at this branch's head, and the kernel and m1n1 patch series apply on apple-16k and apple-4k. At the top of the series the applied kernel tree differs from the built release image only where main took earlier PRs of this series in reworked form, by the closed perf: apple: A9 memory port byte counters #123, and by the new G5P sleep refusal (drivers/drm 0045, not yet run on the device).
  • Other boards that share these drivers or compatibles have not been tested.

Dependencies

Depends on #103.

This branch is stacked on the PRs it depends on and carries their commits; the change of this PR is the commit "PCI/NVMe: Keep the ANS handoff across kexec, cold-reset when it fails", and the merge commits after it bring the branch onto current main.

This update keeps the branch's history: it merges current main and the updated branch below it into this branch. Nothing is forced.

🤖 Generated with Claude Code

kernel/configs/apple-16k/config:
CONFIG_APPLE_AOP_GYRO=m
CONFIG_APPLE_AOP_PRESSURE=m
These options provide aop and its Kconfig dependencies on both page sizes.

Assisted-by: LLM
kernel/configs/apple-16k/config:
# CONFIG_NVME_APPLE_ANS_EARLY_USB is not set
These options provide warm-storage and its Kconfig dependencies on both page sizes.

kernel/configs/apple-4k/config:
# CONFIG_NVME_APPLE_ANS_EARLY_USB is not set
These options provide warm-storage and its Kconfig dependencies on both page sizes.

Assisted-by: LLM
Bring this branch onto current main and the series it depends on. The
merge keeps the other side's tree; the next commit carries the reworked
version of this branch's change.
The A9 AOP hosts the accelerometer, gyroscope, pressure and
ambient-light sensors. Its firmware needs boot arguments and per-device
calibration that m1n1 did not pass on S8003, and a reloaded AOP (after
kexec or sleep) lost its sensor firmware state, so the sensors did not
come back.

m1n1 passes the A9 AOP boot arguments and sensor calibration. The kernel
selects a certified AOP reload path through device-tree match data
(bindings, DT, mailbox, pmdomain, IIO and AOP driver patches), keeps the
AOP power domain and firmware state for that reload, and refuses a
suspend that would interrupt the firmware's boot. The J71t firmware
recipe gains the AOP pieces, the gyroscope and pressure drivers are
enabled, and J71t's accelerometer and gyroscope move from missing to
working, and its light sensor from untested to working.

Assisted-by: LLM
Bring this branch onto current main. The merge keeps the other side's
tree; the next commit carries the reworked version of this branch's
change.
Bring this branch onto current main and the series it depends on. The
merge keeps the other side's tree; the next commit carries the reworked
version of this branch's change.
Bring this branch onto current main and the series it depends on. The
merge keeps the other side's tree; the next commit carries the reworked
version of this branch's change.
A7-A9 have no EL2 and boot without any PSCI firmware, so Linux on an
iPad 5 could not bring secondary CPUs down and up again, and a kexec had
nowhere to park them. CPU hotplug, kexec and a clean poweroff all need a
PSCI implementation that stays resident after m1n1 hands over.

Carry m1n1 patches that keep a small EL3 PSCI implementation resident:
CPU_ON/CPU_OFF with a firmware rendezvous (EL1 WFI/WFE trap to EL3),
SYSTEM_OFF, and a guarded SYSTEM_RESET that boots the default entry
again. The loader marks retained hardware in the device tree after a
PSCI re-entry. The resident PSCI is on by default on these SoCs; the
shipped boot framing keeps psci_reset=0, so SYSTEM_RESET stays off
unless a loader enables it. Adds boot/m1n1/psci-loader and its tests.

Assisted-by: LLM
The TriStar charger subscribed to the PMU's RTC event 16 for source
identification. An acknowledgement there could take the RTC's wake
event, and the polled cover inputs had no driver enabled.

Give RTC event 16 to the RTC alone and keep the PMU and RTC event split
(DT, RTC and USB patches), so one consumer's acknowledgement cannot take
the other's wake event. Enable KEYBOARD_GPIO_POLLED for the polled cover
inputs.

Assisted-by: LLM
On J71t the NVMe controller (ANS) sits behind the H9P PCIe port, and
resetting that port loses the controller until a cold boot. A kexec
therefore has to hand over a stopped but powered ANS, with its DART
translations retained, or the next kernel loses its root filesystem. The
first version of this handoff panicked when a step failed, which with
panic=0 is an indefinite hang.

Keep the certified ANS kexec handoff: DT and bindings describe it, the
DART, H9P and NVMe drivers stop queues and translations in order and the
next kernel picks them up, and core/printk export what the modules need.
Every failure on the outgoing side now ends in a native cold reset
through apple_cold_reset() instead of a panic, with explicit returns
after it. The port is handed over powered, with PERST# asserted and the
link stopped, and the incoming kernel brings it up with the cold-boot
sequence (port power cycle, NVMe mode, port enable, then link training).
Retraining the powered port by PERST# alone, as iOS never does, left the
root port in Detect.Quiet and cost a timeout on every warm boot.

Assisted-by: LLM
@brkosebay brkosebay changed the title PCI/NVMe: retain the stopped ANS handoff across kexec PCI/NVMe: Keep the ANS handoff across kexec, cold-reset when it fails Nov 12, 2026
Bring this branch onto current main. Main has since merged OrchardLinux#124, OrchardLinux#122,
OrchardLinux#118, OrchardLinux#121, OrchardLinux#110, OrchardLinux#127, OrchardLinux#101, OrchardLinux#126, OrchardLinux#108 and OrchardLinux#111, several in part or
reworked, and OrchardLinux#123 and OrchardLinux#128 were closed. Where main carries a topic,
main's version is kept; the left-out parts that warm restart and
suspend need come back in OrchardLinux#107 and OrchardLinux#117.
Bring this branch onto current main. Main has since merged OrchardLinux#124, OrchardLinux#122,
OrchardLinux#118, OrchardLinux#121, OrchardLinux#110, OrchardLinux#127, OrchardLinux#101, OrchardLinux#126, OrchardLinux#108 and OrchardLinux#111, several in part or
reworked, and OrchardLinux#123 and OrchardLinux#128 were closed. Where main carries a topic,
main's version is kept; the left-out parts that warm restart and
suspend need come back in OrchardLinux#107 and OrchardLinux#117.

This branch's own patches in drivers/usb are renumbered to follow
main's.
Bring this branch onto current main. Main has since merged OrchardLinux#124, OrchardLinux#122,
OrchardLinux#118, OrchardLinux#121, OrchardLinux#110, OrchardLinux#127, OrchardLinux#101, OrchardLinux#126, OrchardLinux#108 and OrchardLinux#111, several in part or
reworked, and OrchardLinux#123 and OrchardLinux#128 were closed. Where main carries a topic,
main's version is kept; the left-out parts that warm restart and
suspend need come back in OrchardLinux#107 and OrchardLinux#117.

This branch's own patches in devices/s8000, drivers/base and drivers/usb
are renumbered to follow main's.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant