[DjDeveloperr]

Follow-up to #1668 for the SoCs not covered there or in the parallel T8103/T600x/T603x/T8122/T8132 PR. #1668 fixed the J713 boot panic: a DART probes as its own device, and when it names no power domain (or the wrong one), its first register read can land on an unpowered block. That read takes an SError and panics in apple_dart_readl.

I checked every apple,*-dart node in the T8112, T602x, T6034, T604x, T6050, T8140, T8142 and T8152 device trees against its consumers (iommus and iommu-map) on all 137 Apple boards. I then compared each candidate with the macOS 27.2.1 device trees, using the DeviceTree images in the public IPSW. Evidence rule: if the ADT gives the DART a PMGR vote of its own (clock-gates naming an X-DART device), use that vote's parent. Otherwise use the domain of the engine that names the DART in iommu-parent, as #1668 did.

One commit per SoC family:

Commit	DARTs	Was	Now	Evidence
t8112	m2_dart_apr_0, m2_dart_apr_1, m2_dart_scdc	none	ps_scodec	ADT DARTs have no gates; the apr and scdc engines gate SCODEC; the T602x copies already use ps_scodec
t602x	m2_dart_scaler0 (T6020/1/2)	ps_avd_sys	ps_msr0	ADT dart-scaler0 votes AVD-SYS-DART (the AVD DART's vote), while MSR0-DART (parent MSR0) is used by no node; dart-scaler1/3 vote MSR1-DART; the engine votes MSR0; the M1 Pro/Max/Ultra DARTs at the same address use ps_msr0
t602x	m2_dart_scaler2 (T6022 die 1)	ps_spi3	ps_msr0_die1	ADT dart-scaler2 votes 0xb6 without the die-1 bit, which is die 0's SPI3
t602x	J475c and T6022 m2_dart_dispext{2,3,6,7}_0, m2_dart_dcpext{2,3,6,7}	none	the DCP's ps_dispextN_cpu0[_die1]	ADT DARTs have no gates; the DCPs vote DISPEXTn_CPU0; the J414c/J416c copies in t6021-display2.dtsi already use these domains
t602x	ane_dart0	ps_pmp	ps_ane_sys	ADT dart-ane0 votes ANE-SYS-DART (parent ANE_SYS); the T8103, T8112 and T600x ANE DARTs use ps_ane_sys
t6050	auss0_dart, rsm_dart	none	ps_auss, ps_debug_gated	ADT DARTs have no gates; engines vote AUSS_V (parent AUSS) and DEBUG_GATED
t8142	scaler0_dart	none	ps_msr	ADT DART has no gates; the scaler0 engine votes MSR-V (parent MSR)

Every node except ane_dart0 is disabled on every board, so only the ANE commit changes a current boot. ane_dart0 is enabled on J414s, J416s, J474s, J414c, J416c and J475c. Today it probes before anything has powered ANE_SYS, so it relies on the loader having left ANE_SYS on. ane_dart1 and ane_dart2 (on ps_ane_cpu, a child of ps_ane_sys) hold ANE_SYS on after they probe, so after probe nothing changes. It is a separate commit in case reviewers want to drop it.

Checked, no change:

• USB4 PCIe-C tunnel DARTs (T8112, T602x, T604x): only the ACIO driver populates them, after the PCIe-C port is clocked. They are not boot-time probes.
• T6040/T6041 PCIe DARTs: the APCIE power states are left to iBoot (status = "disabled"), except on J616s where they are always-on. Pointing a DART at a disabled domain would make it defer forever.
• T8140 display DARTs: ps_disp_cpu is always-on and firmware-owned. ps_dispext0_cpu stays disabled until the loader's J700 dcpext group turns it on, so a domain on the DART could make it defer.
• SEP DARTs: the SEP domain is always-on, or firmware-owned on T6050.
• T8142 JPEG/APR/SCDC/SIO and all T8152 DARTs: their engines' domains have no power-state node in the DT yet.
• All other engine DARTs (scaler, JPEG, AVE, AVD, ANE, ISP, SIO, USB) on these SoCs already match the ADT.
• T6034: built from the T6031 files, so it is covered by the other PR.

Validation, build-checked only:

• make dtbs W=1 for all 26 T8112, T602x, T6050 and T8142 boards: no new dtc warnings against the base.
• apple-adt-coverage.py --report on J413, J716s and J873s: no broken paths.
• dt-check-style on the changed files: clean.
• A semantic DTB diff shows only the listed DART power-domains changes.

No hardware boot yet.

Before merge: the ane_dart0 commit (856b8d4) needs one boot on a T602x machine (any of J414s, J416s, J474s, J414c, J416c or J475c). Check that 285800000.iommu probes cleanly, that the ANE still binds, and that there is no SError. If no T602x tester is available, drop that commit from this merge and resubmit it as its own PR. The other commits only touch DARTs that are disabled on every board (the J475c/Ultra dispext/dcpext DARTs included), so build-checked is enough for them.

🤖 Generated with Claude Code

[RyanTheTide]

I went through 49931e7 one commit at a time. For each DART I checked the domain of every engine that uses it in the DT, and checked the ADT evidence quoted in each commit message against the macOS device trees for J413, J414s, J475c, J180d, J873s and J813.

Commit	DART(s) → domain	Consumer engine domain	ADT evidence in the commit	Result
t8112	m2_dart_apr_0/1, m2_dart_scdc → ps_scodec	m2_apr, m2_scdc on ps_scodec	agrees	OK
t602x	m2_dart_scaler0 → ps_msr0	scaler0 on ps_msr0	agrees (the ADT DART vote names the AVD DART)	OK
t602x	m2_dart_scaler2 (T6022 die 1) → ps_msr0_die1	scaler2 on ps_msr0_die1	agrees (the ADT vote is missing the die-1 bit)	OK
t602x	J475c/T6022 dispext{2,3,6,7}/dcpext{2,3,6,7} DARTs → ps_dispextN_cpu0[_die1]	DCPs on the same domains	agrees	OK
t602x	ane_dart0 ps_pmp → ps_ane_sys	ANE under ps_ane_sys	agrees	OK, needs a boot (see below)
t6050	rsm_dart → ps_debug_gated, auss0_dart → ps_auss	rsm, usb_auss0 on the same	agrees	OK
t8142	scaler0_dart → ps_msr	scaler0 on ps_msr	agrees	OK

DTBs: I built all 137 Apple DTBs with dtc, before (f173f7c) and after. 26 change: 8 T602x, 11 T6050, 4 T8112 and 3 T8142. The preprocessed sources differ only in power-domains lines. t6000-j316s, t6040-j616s and t8140-j700 come out byte-identical. In t8112-j413 only the three apr/scdc DARTs change, and all three stay disabled.

Hardware (J413, M2). One boot of the live Stage 2 with only the j413 DTB changed, run as an aura-try trial on the production kernel 7.3.0-aurora-fleet67:

• The trial DTB is the live j413 DTB plus power-domains = <&ps_scodec> on iommu@27d024000, iommu@27d028000 and iommu@27d02c000. For this boot only, I also set the three DARTs to okay so the new domain gets exercised. The PR itself leaves them disabled.
• All three bound to apple-dart, each with a device link to the scodec power controller. They runtime-suspend, and pm_genpd_summary shows scodec off. Writing on to their power/control powered scodec up, and auto powered it down again. No SError.
• 0 DART faults, SELinux enforcing, 0 failed units, 0 AVCs. s2idle 3/3 (rtcwake on rtc1), Wi-Fi back after each resume.
• Kernel errors: one new entry, a UBSAN shift-out-of-bounds in apple_dart_probe at dart->dma_max = DMA_BIT_MASK(dart->ias). DMA_BIT_MASK(n) is GENMASK_ULL((n) - 1, 0), so ias was 0: at least one of these DARTs read a zero VA width from PARAMS3 with only scodec on. This comes from my extra okay override, not from this PR. Before ProRes or SCDC gets enabled on T8112, someone should check whether these DARTs need another domain or clock to report valid params. The probe could also reject ias == 0 with an error rather than computing a mask from it.
• The production boot afterwards was clean (0 kernel errors), and the Stage 2 hash was unchanged.
• No trial was needed on J316s, J616s or J700, since their DTBs do not change.

Approving the series. ane_dart0 (856b8d4) is the only change to a node that is enabled, and it still needs the T602x boot listed in the description before merge.

[DjDeveloperr]

The t602x ane_dart0 commit (ps_pmp -> ps_ane_sys, formerly 856b8d4) has moved to draft #1694 until someone boots it on T602x hardware. This branch is now the other four commits rebased onto the current integration/aurora. Their content is unchanged from what @RyanTheTide approved (git range-diff shows all four as =).