[erikwb]

A deep sleep with a Thunderbolt dock attached powers off the ACIO and tunneled PCIe DARTs and the external display coprocessors' DARTs. Their hosts have to bring them back before the first requester runs again, at a point only the host knows.

Add an owner interface for these DARTs: bind once, then prepare, off, on and finish around a deep sleep. A DART takes part when its device-tree node names its clock protection slice (apple,clock-protection, now also on the eight J713 ACIO, tunneled PCIe and external display DARTs); there is no address table. off closes the DART to hardware commands, saves its registers, disables the streams, flushes and releases the clock-protection slice. on restores the slice and the saved state and reopens it. The generic suspend and resume callbacks leave an owned DART alone, and a DART with no owner bound takes no extra lock on its map paths.

While a DART is closed its page tables are still updated, in memory only, and map, unmap, attach, release and free never touch its registers. Those writers are counted; reopening waits for them and flushes the whole TLB before the DART opens if anything changed. finish always ends the transaction: a DART that was not restored stays closed, its registers unused, until reboot, and nothing panics on it.

Behaviour seen on the J713 that the restore accounts for:

• The tunneled PCIe DART has 256 stream slots where Linux allocates 64; the whole bank, as the hardware reports it, is saved.
• An external display DART's clock-protection slice word reads zero after the sleep; it is saved and written back.
• A locked DART can come back with other bits set in the root of a stream that is not enabled and whose root was and is invalid. That is accepted; everything else must match, and a locked DART is never rewritten.

Part 3/7 of J713 docked S2R, stacked on the native radio series (#1384), which is stacked on #1314.

Series order: #1414 → #1415 → #1416 → #1417 → #1418 → #1419 → #1420.

Depends on #1415.

Validation of the series on this base:

• Full arm64 Image, modules and DTBs at every PR tip of the series.
• Ten focused host suites with negative controls (DART owner and register sequence, PHY sleep transaction, USB3 host model, router state transfer, tunnel replay including a dock lost during the sleep, NHI and tunneled-PCIe ownership including its failure paths, dock PM callback ordering, DP repair, DART writer gate and its callers) plus the device-tree policy check. checkpatch is clean for the driver code; it notes the Based-on-work-by: trailers and style in the tools/asahi fixtures.
• J713 with a CalDigit TS5 (USB4 link, PCIe tunnel with the dock's Ethernet, USB hub with two keyboards, two 4K DisplayPort monitors), on the first version of the series: one suspend-abort test at the platform stage, then one real deep sleep with an RTC wake on the same boot. After the wake the dock link was at 20 Gb/s, dock Ethernet passed traffic at 2.5G, the USB devices were back, both monitors were lit at their previous mode about 10 s after the wake, Wi-Fi and Bluetooth answered, all ten CPUs were online, and there were no kernel warnings or taint. Repeated with one monitor unplugged; a monitor plugged in after the wake came up.

The changes since that version (the DT-selected DART owners and memory-only updates while closed, the unplug handling, the failure unwinds, the stock tb.c resume restored, the PMGR and RTKit hardening) are built and covered by the host suites, but have not run on the J713 yet.

Not covered: repeated sleeps on one boot, wake sources other than the RTC, the desktop's own sleep path (lid, logind), a dock unplugged during the sleep on hardware, and docks other than the TS5. Both native parameters (pcie_apple.cio_s2r, thunderbolt_apple.cio_s2r) default to off.

This series was developed and tested by Claude (Anthropic), working with me on the J713.

[DjDeveloperr]

[3/7] apple-dart: review at 071e41e

Gating: fine. apple_dart_cio_init() sets dart->cio only on apple,j713 T8110 DARTs at eight fixed bases. Every new branch (suspend, resume, resume_noirq, release_device, domain_free, the writer gate) depends on dart->cio or cio_active, so T6050 and every other SoC is unchanged.

M5: this adds no conflict hunk; apple-dart.c already conflicts with the M5 branch in 9 places through the series base. t6050-sleep.c runs the same SPTM-style display-DART sequence with raw writes (streams off one by one, flush, slice bit 4 cleared; on: slice 0x12, diag 0, streams). There is no runtime overlap, but the sequence now exists in two places.

Findings (most severe first)

1. Panics the dock path can reach. With dart->cio set, an unmap or TLB flush on a closed DART calls apple_dart_sleep_release_failed(), and release_device() panics for the whole prepare..finish window. For the radio, its owner was the only mapper. Here the mappers are every driver behind the dock and the DRM buffers on the display DARTs. finish() returning -EUCLEAN also leaves cio_active set for the rest of the boot, so a failed wake followed by unplugging the dock (PCI removal, then release_device) panics.
   Suggestion: while a DART is closed, let map/unmap publish to memory only, as the display_dark path already does. Skip the hardware TLB command and mark the TLB stale. dart_cio_restore() flushes before it re-enables streams, so nothing walks a stale entry. Release and free then don't need to panic, and a failed transaction can end with the streams left off but the bookkeeping released.
2. A rejected map poisons the restore. One map attempted during the window (cio_violation) makes on() refuse to restore, so the DART stays closed until reboot. A late dma_map from a dock NIC refill or a DRM worker then takes out the dock or the display. With (1), a rejected map is harmless.
3. Selection by base address. The table sits under of_machine_is_compatible("apple,j713"). J715 shares t8132-j713-j715.dtsi and the existing j713_* DART detection (firmware path plus address), but this excludes it. Two of these bases (0x48a300000/0x48a340000) are T6050's internal display DART pair in t6050-sleep.c, so the machine check is load-bearing. A DT property on the DART node carrying the slice number would be sturdier than a code table.
4. Hot-path cost with the feature off. The writer gate now takes managed_lock (irqsave) on every map, unmap and flush on these eight DARTs even with both cio_s2r params at 0, because dart->cio is set at probe. Gate on a bound owner or on cio_active instead.
5. commands_gated is set under dart->lock (apple_dart_quiesce_commands()) but cleared under managed_lock here. That's harmless while requesters are stopped, but it's the only writer that skips dart->lock.

Verdict: needs changes, mainly (1) and (2).

---

Review only: read at the head commit, not built or run (no J713 here). Written with Claude Code.

[DjDeveloperr]

This extends the radio's panic-on-release to the eight CIO and display DARTs. Unlike the radio, these front hot-pluggable trees (the tunneled PCIe hierarchy behind a dock) and DRM buffers. Two concrete ways in: (a) apple_dart_cio_finish() returns -EUCLEAN and leaves cio_active set permanently, so unplugging the dock after a failed wake panics here; (b) any PCI removal between the NHI's .prepare and .complete, for example a surprise unplug while sleep is starting. See the summary for a memory-only publish while closed, which makes this check unnecessary.

[DjDeveloperr]

dart->cio is set at probe on J713 whatever pcie_apple.cio_s2r/thunderbolt_apple.cio_s2r say, so every map, unmap and flush on the tunneled PCIe, NHI and display DARTs now takes managed_lock with IRQs off, even with the feature off. Suggest keying this on a bound owner (dart->cio && dart->cio->owner) or on cio_active. Also note that with cio set, writer_get() failing on the unmap/flush paths now panics (apple_dart_sleep_release_failed()): see summary point 1.

[DjDeveloperr]

J715 uses the same t8132-j713-j715.dtsi and gets the j713_dispext/j713_dcpext treatment in apple_dart_probe(), which is based on firmware path and address, but is left out here. Also, 0x48a300000/0x48a340000 are T6050's internal display DART pair (T6050_DISP0_DART and the DCP DART in t6050-sleep.c), so this machine check is the only thing separating the two. A DT property on the DART nodes (for example apple,cio-power-slice = <N>) would drop the address table and make the opt-in explicit.

[DjDeveloperr]

Nit: every other writer of commands_gated (apple_dart_quiesce_commands(), apple_dart_resume_commands(), apple_dart_host_resume()) holds dart->lock; this one holds managed_lock. It's safe while requesters are stopped, but taking dart->lock here too would keep one rule.

[DjDeveloperr]

A single map attempted while closed (writer_get() sets cio_violation and returns -EBUSY to the caller, so nothing was written) makes this refuse to restore, and the DART stays closed for the rest of the boot. A late dma_map from a dock NIC refill or a DRM worker during the window is enough to lose the dock or the display. Since a rejected map changed nothing, it shouldn't block the restore. With the memory-only publish from the summary, it wouldn't even need rejecting.

[DjDeveloperr]

On this path cio_active stays true and the runtime-PM reference stays held forever. From then on apple_dart_suspend()/resume() skip this DART, prepare() returns -EBUSY, domain_free() leaks, and release_device() panics. The header calls this fail-closed, but for a removable tree it means a later unplug crashes the machine. Consider ending the transaction here with the streams left disabled, and releasing the bookkeeping.

[erikwb]

Closing: this commit set landed in integration/aurora through #1314, which carried the whole docked deep-sleep series (#1414 to #1420). The follow-up that turns the docked deep sleep on by default is #1855.