watchdog: apple: Prefer a cold reset and guard the warm reset path

boot/initramfs/root/init

@@ -10,6 +10,7 @@ mount -t devtmpfs -o mode=0755,nosuid dev /dev
 exec </dev/console >/dev/console 2>&1
 
 stop() {
+    echo "<3>orchard initrd: $1; rescue shell" > /dev/kmsg
     echo "orchard initrd: $1"
     echo 'Starting a shell on the console; the system did not start.'
     exec sh
@@ -31,8 +32,11 @@ done
 [ ! -e /etc/orchard/usb-modules ] || for module in $(cat /etc/orchard/usb-modules); do
     modprobe "$module" || echo "orchard initrd: could not load $module; no USB"
 done
+echo '<6>orchard initrd: storage load begin' > /dev/kmsg
 for module in $(cat /etc/orchard/modules); do
+    echo "<6>orchard initrd: modprobe $module begin" > /dev/kmsg
     modprobe "$module" || stop "could not load $module"
+    echo "<6>orchard initrd: modprobe $module complete" > /dev/kmsg
 done
 
 # An install boot: orchard's add-on, appended to this initrd by the CLI, writes the
@@ -87,8 +91,35 @@ done
 
 mkdir -p /newroot
 mount ${fstype:+-t "$fstype"} -o "$mode${flags:+,$flags}" "$device" /newroot || stop "could not mount $device"
+echo '<6>orchard initrd: root mounted' > /dev/kmsg
 [ -x "/newroot$init" ] || [ -L "/newroot$init" ] || stop "the root has no $init"
 
+# Preserve the running boot's *pristine* tree before any package update can
+# replace /boot or same-release module assets. The matching initrd embeds cold
+# DTBs; warm boots name their retained stage instead. Never infer it by uname.
+mkdir -p /run /newroot/run
+mount -t tmpfs -o mode=0755,nosuid,nodev tmpfs /run
+mkdir -p /run/orchard-kexec
+warm_pristine=
+for argument in $(cat /proc/cmdline); do
+    case "$argument" in orchard_warm.dtb=*) warm_pristine=${argument#orchard_warm.dtb=} ;; esac
+done
+if [ -n "$warm_pristine" ]; then
+    case "$warm_pristine" in
+        /var/tmp/orchard-warm.*/pristine.dtb)
+            case "$warm_pristine" in *..*) stop 'invalid warm DT provenance' ;; esac
+            cp "/newroot$warm_pristine" /run/orchard-kexec/pristine.dtb || stop 'missing warm pristine DT' ;;
+        *) stop 'invalid warm DT provenance' ;;
+    esac
+elif [ -f /etc/orchard/pristine-map ]; then
+    board=$(tr '\000' '\n' < /proc/device-tree/compatible | head -1)
+    while read compatible file; do
+        [ "$compatible" != "$board" ] || cp "/etc/orchard/dtbs/$file" /run/orchard-kexec/pristine.dtb
+done < /etc/orchard/pristine-map
+fi
+cat /proc/sys/kernel/random/boot_id > /run/orchard-kexec/boot-id
+mount --move /run /newroot/run || stop 'cannot retain boot provenance'
+
 # USB for the host: network (usb0) and a serial console (ttyGS0), named after
 # the system, so `orchard devices` sees it. What runs on them is the system's.
 usb_gadget() {
@@ -97,13 +128,29 @@ usb_gadget() {
     [ ! -e "$g" ] || return 0
     name=$(sed -n 's/^NAME=//p' /newroot/etc/os-release /newroot/usr/lib/os-release 2>/dev/null | head -1 | tr -d "\"'")
     board=$(tr '\000' '\n' < /proc/device-tree/compatible | head -1)
+    # Opt-in compatibility identity in macOS's 2400 mA capability table.
+    # This requests a host grant; it does not set a charger limit. Keep the
+    # generic composite personality (no iOS/usbmux or preferred-config API).
+    pid=0x4145
+    device_class=0x00 device_subclass=0x00 device_protocol=0x00
+    if [ "$board" = apple,j71t ] &&
+       [ "$(cat /newroot/etc/orchard/mac-usb-current 2>/dev/null)" = 1 ]; then
+        pid=0x1014
+        # Standard IAD device: macOS defers its CDC composite match here,
+        # allowing the generic composite driver to deliver the grant.
+        device_class=0xef device_subclass=0x02 device_protocol=0x01
+    fi
+    serial=$(sh /etc/orchard/usb-identity) || return 1
     mkdir "$g" &&
     echo 0x05ac > "$g/idVendor" &&
-    echo 0x4145 > "$g/idProduct" &&
+    echo "$pid" > "$g/idProduct" &&
+    echo "$device_class" > "$g/bDeviceClass" &&
+    echo "$device_subclass" > "$g/bDeviceSubClass" &&
+    echo "$device_protocol" > "$g/bDeviceProtocol" &&
     mkdir -p "$g/strings/0x409" "$g/configs/c.1/strings/0x409" &&
     echo 'Orchard Linux' > "$g/strings/0x409/manufacturer" &&
     echo "${name:-Linux}" > "$g/strings/0x409/product" &&
-    echo "BOOT:$(cat /proc/sys/kernel/random/boot_id) BOARD:${board#apple,}" > "$g/strings/0x409/serialnumber" &&
+    echo "$serial" > "$g/strings/0x409/serialnumber" &&
     echo 'USB network and serial' > "$g/configs/c.1/strings/0x409/configuration" &&
     echo 500 > "$g/configs/c.1/MaxPower" &&
     mkdir "$g/functions/ncm.usb0" "$g/functions/acm.usb0" &&
@@ -112,6 +159,7 @@ usb_gadget() {
     basename "$(ls -d /sys/class/udc/* | head -1)" > "$g/UDC"
 }
 usb_gadget || echo 'orchard initrd: no USB gadget; continuing without USB'
+echo '<6>orchard initrd: USB setup complete; switching root' > /dev/kmsg
 
 for name in dev proc sys; do
     mount --move "/$name" "/newroot/$name"

boot/m1n1/README.md

@@ -28,3 +28,16 @@ gives the same tree as Hoolock's tip before updating `sources.toml`.
 
 Scratch stays in ignored `boot/m1n1/.work/<device>/`. `--resume` reuses it only
 if the recorded patch set is unchanged.
+
+## Resident PSCI on A7-A9
+
+Orchard patch 0015 adds the resident EL3 PSCI monitor (CPU_ON, CPU_OFF,
+AFFINITY_INFO); 0016-0019 make it the default whenever m1n1 is entered at EL3
+and add SYSTEM_RESET (warm reboot back into m1n1, which boots the default BLS
+entry with the last launch's DTB) and SYSTEM_OFF (halt). Any PSCI-aware
+kernel reboots, powers off and kexecs through its ordinary paths; m1n1 takes
+IPI-stopped CPUs back by trapping EL1 WFI/WFE to EL3. EL1/EL2 entries keep
+the spin table. Payload variables (append to `m1n1.bin`, e.g. with
+`psci-loader`): `psci=0` turns PSCI off, `psci_reset=0` keeps only the CPU
+lifecycle (no WFI/WFE traps), `psci_reset=proxy` stops in the proxy after a
+reset. 0020 marks retained hardware in the device tree after a re-entry.