[erikwb]

A coprocessor that was powered off with apple_rtkit_poweroff() and then lost its power domains has no session to wake and has to boot again. Add apple_rtkit_cold_restart(): reset the session state (warm and port-only restart state included), let the caller start the CPU, then start the mailbox, enable receive and run the boot handshake.

The CPU is started before the mailbox is touched at all. On T8132 the ACIO mailbox registers are only clocked once the caller's start step has run, and touching them earlier takes an SError. On failure the caller has to stop the CPU it started.

Part 2/7 of J713 docked S2R, stacked on the native radio series (#1384), which is stacked on #1314.

Series order: #1414 → #1415 → #1416 → #1417 → #1418 → #1419 → #1420.

Depends on #1414.

Validation of the series on this base:

• Full arm64 Image, modules and DTBs at every PR tip of the series.
• Ten focused host suites with negative controls (DART owner and register sequence, PHY sleep transaction, USB3 host model, router state transfer, tunnel replay including a dock lost during the sleep, NHI and tunneled-PCIe ownership including its failure paths, dock PM callback ordering, DP repair, DART writer gate and its callers) plus the device-tree policy check. checkpatch is clean for the driver code; it notes the Based-on-work-by: trailers and style in the tools/asahi fixtures.
• J713 with a CalDigit TS5 (USB4 link, PCIe tunnel with the dock's Ethernet, USB hub with two keyboards, two 4K DisplayPort monitors), on the first version of the series: one suspend-abort test at the platform stage, then one real deep sleep with an RTC wake on the same boot. After the wake the dock link was at 20 Gb/s, dock Ethernet passed traffic at 2.5G, the USB devices were back, both monitors were lit at their previous mode about 10 s after the wake, Wi-Fi and Bluetooth answered, all ten CPUs were online, and there were no kernel warnings or taint. Repeated with one monitor unplugged; a monitor plugged in after the wake came up.

The changes since that version (the DT-selected DART owners and memory-only updates while closed, the unplug handling, the failure unwinds, the stock tb.c resume restored, the PMGR and RTKit hardening) are built and covered by the host suites, but have not run on the J713 yet.

Not covered: repeated sleeps on one boot, wake sources other than the RTC, the desktop's own sleep path (lid, logind), a dock unplugged during the sleep on hardware, and docks other than the TS5. Both native parameters (pcie_apple.cio_s2r, thunderbolt_apple.cio_s2r) default to off.

This series was developed and tested by Claude (Anthropic), working with me on the J713.

[DjDeveloperr]

[2/7] rtkit: review at dcaf73b

Gating: fine. This adds an export only; its one caller is #1419's T8132 ACIO, and no existing RTKit path changes, so other SoCs (T6050 included) are unaffected. Merging into the M5 branch (test/pr1012-m5-kit-0dd08338-t6050s2r-coproc) adds one trivial adjacency conflict in rtkit.c, where this lands next to helpers M5 added. t6050-sleep.c calls no RTKit API.

Findings

1. The comment says the mailbox may only be touched after the start() callback, but apple_rtkit_reinit() -> apple_mbox_start() -> apple_mbox_enable_hw() writes i2a_control (ap_initializes_mailboxes, T8140) and irq_enable (has_irq_controls, M3 ASC) before the start() callback runs. Both are no-ops on apple,asc-mailbox-v4 (T8132) and T6050 ascwrap-v6, so the one caller works. As a generic export it should either refuse those variants or start the mailbox after the start() callback.
2. reinit() doesn't clear warm_restart, port_only (sticky once apple_rtkit_port_restart() set it) or warm_last_mask. A cold boot after either would answer EPMAP with the echo/warm reply and start no system endpoints. This is a fresh session by definition, so reset them here.
3. If start() or boot() fails, the mailbox stays started with RX attached, and after a boot() failure the CPU is still running. #1419 panics there, so it works today, but the contract should say the caller has to stop the CPU.

Verdict: OK; (1) and (2) are small hardening changes.

---

Review only: read at the head commit, not built or run (no J713 here). Written with Claude Code.

[DjDeveloperr]

apple_rtkit_reinit() leaves rtk->warm_restart, rtk->port_only and rtk->warm_last_mask alone. A cold restart after an unfinished warm restart, or on a handle that ever went through apple_rtkit_port_restart() (port_only is never cleared), would take the echo/warm EPMAP branch and start no system endpoints. Suggest clearing them here, since this is always a fresh session.

[DjDeveloperr]

apple_rtkit_reinit() above already calls apple_mbox_start() -> apple_mbox_enable_hw(), which writes mailbox registers when the variant has ap_initializes_mailboxes (T8140 primary outbox) or has_irq_controls (M3 ASC). That's a no-op for apple,asc-mailbox-v4 (and T6050 ascwrap-v6), so the T8132 ACIO caller is fine, but the comment is stronger than what the helper guarantees. Either refuse those variants here, or split reinit() so the mailbox starts after start().

[DjDeveloperr]

On failure here, the CPU that start() released is still running and the mailbox is started without a session. #1419 panics on this path, so it's fine today; a sentence in the header saying the caller must stop the CPU on error would stop the next user from assuming otherwise.