[DjDeveloperr]

Adds coordinated suspend-to-RAM for T8140 (MacBook Neo, J700), with Linux running directly at EL2. A sleep that is refused finishes unwinding before any irreversible SEP, GPU, PMP or ANS stop. After the SEP SLEEP request goes out, the path always completes a physical sleep and wake.

Ready for review. The soaked tree b8f5b1e7 passed its confirmation soak (below). This head adds two integration merges and the two commits that move the T8140 ISP to macOS's model. It merges once CI is green on this exact head and the Neo fast retest of it passes.

What's in it

feat/s2r targets integration/aurora. Head 2573357fb92d, which contains integration 608f76fd5068.

Sleep stack and suspend speed:

• d9b438c4: the squashed T8140 sleep stack (EL2 sleep provider, CPU, power, interrupt and memory state, device firmware stop and restart, kept USB host and DRAM, RTC and radio wake, display, audio, storage and camera recovery).
• 2a57a36f, 38e9c6de, 3224a675: shorter debug-link and SMC waits before the commit (from soc: apple: reduce measured debug-link suspend entry waits #1437), and a debug-link reset gives up after 1.5 s.

What macOS does at the commit, and what the DRAM-kept wake needs (the fixes for the ~1 in 60 reset):

• fbe6f664 dmaengine: apple-sio: run the T8140 SIO firmware without DMA service, and stop it in the sleep's last step, as macOS does.
• 30c3dafd sleep: refuse a commit over an unbound coprocessor whose CPU still runs.
• adcdcbbc sleep: clear a power word left off with BUSY latched just before the commit; if one stays latched, take the deep path.
• d82906e2, 05799966, 0b5617bf pmdomain: apple: lower T8140 domains as macOS does (auto off first, then the target), count a domain off only once BUSY clears, and finish a loader-left power-off before a sleep.
• 042933d1, 60581160, 0a80c389, 7302a10b, ce8192d4, 942c0088, 589646b6, 74b070cc, 992923c9 accel/ane: h17: take the engine down in macOS's order, stop its firmware before its power goes (STOP, then POWER_DOWN answered in SCRATCH0), send SET_SNE_PMU_BASE2 on the IO ring, deactivate the ANE DARTs before every ANE_SYS power-off, and keep the engine off with no firmware until its first request. A stuck power word sends that sleep deep instead of refusing it.
• c2b4f4b4 iommu/apple-dart: the cold ANE DARTs runtime-suspend, so ANE_SYS stays off while the ANE has no client, as on macOS.
• 5801e1f1, 8ee99a76 nvme-apple: send a sleep's shutdown notification at suspend, as macOS does, and wait as long as macOS (35 s). The 1 s limit at the commit refused 1 to 2 sleeps in 50 without the debug cable.

Merges and review follow-ups:

• f65bce91, db580751, 970ec8e2: integration merges. 970ec8e2 resolves three conflicts: apple-dart resume skips cold ANE, live J613 MTP and consumer-saved DARTs; h16 session init keeps integration's dma-buf export state and this series' parked state; dcp-fabric applies integration's T8142 crossbar handling, and a route parked for a sleep skips the crossbar.
• 78edcab1: merge of integration f9f14be0, nine conflicts, plus T8142's new GPU config given sleep_restart: false, as every SoC but T8140. T8140's ISP keeps this series' soaked firmware model. media: apple: isp: Power the T8140 ISP down between streams #1580's T8132-style model isn't selected on T8140, and the rest of media: apple: isp: Power the T8140 ISP down between streams #1580 is guarded off there. The ISP's sensor domains stay after FE, listed once. admac: a resume with lost registers restarts from the last reclaimed period, otherwise integration's capture realign. aop: every configuration has both the sleep/wake endpoint orders and the setup-port EPMAP fields. asahi: both g17/sleep.o and g17/pmpdash.o.
• 2573357f: merge of integration 608f76fd, five conflicts and one duplicate resume callback:
  • ANE: this series' H17 sleep logic, on accel/ane: run the M5 Pro (T6050) Neural Engine on the H17 backend #1595's per-SoC PMGR words and SoC-aware checks. A new platform flag, macos_sleep, set on T8140 only, keeps the macOS-order power-down, the first-request firmware start, the park after a wake and the start-up host flags there. T6050 runs accel/ane: run the M5 Pro (T6050) Neural Engine on the H17 backend #1595's staged boot-time start and power-down unchanged.
  • apple-dart: this series' system and noirq sleep callbacks, with the J613 live MTP's s2idle retention first in them.
  • ISP: a latched IPC error (media: apple: isp: contain IPC failures #1560) refuses every command, on IO and DEBUG, and the stop sends nothing over a failed session before the T8140 cold stop.
  • rtkit-helper: a firmware-driven suspend idles the AP side, and the J613 s2idle retention follows unchanged. Both sides had added a resume callback; there's one now, the AP-on notice and then the J613 check.
• 269dec72, a2ec625b, b8f5b1e7: review follow-ups, no functional change.

T8140 camera ISP, macOS's model (from the macOS recordings and kernelcache, isp-model-macos/README.md):

• 7fedcbe2 media: apple: isp: quiesce the T8140 coprocessor before its power-down, as macOS does before the core words go off. Without it, isp_cpu_core0/1 reach off with BUSY latched at every stream stop.
• e0549e4d media: apple: isp: keep the T8140 firmware up 5 s after a stream, as macOS does (5.07 s, measured twice). A stream in that window reuses it. A PM notifier stops idle firmware before any sleep, so a sleep still finds it off.

Supersedes

This PR carries the final diff of #1208, #1217, #1265, #1266, #1278, #1285, #1310, #1313, #1333, #1334, #1358, #1374, #1377, #1393, #1398, #1437 and #1443. Those PRs can close once this one merges. #1303 (H17 ANE resume retry) is obsolete under it: the latch it recovers from no longer forms, and a resume no longer boots the ANE.

Hardware validation (Neo J700, production Stage 2, distro boot path)

Confirmation soak on b8f5b1e7: kernel pr1445b = b8f5b1e7, no test patches. Production Stage 2, booted from the SSD with no upload, on the user path with no debug session.

• 100/100 DRAM-kept sleeps, 0 resets. Every safety net stayed at 0 (PMGR latch clears, commit clears, ANE retries, deep fallbacks), with 0 NVMe refusals and no NVMe shutdown over 1 s.
• Request to kernel entry: median 0.425 s. Request to commit: median 0.687 s.
• Wake: back from the sleep engine 0.014 s after the alarm, suspend exit at 0.534 s, panel backlight on at 0.877 s.
• Functional pass, all PASS: camera content, Wi-Fi both ways, WoWLAN, speaker, mics, cpufreq, stable USB, display.
• With the functional pass and the ANE checks, that's 109 sleeps on the exact head, and 587 across all the fix kernels, with 0 resets.

Fast retest of this head: running on the Neo now: ISP camera streams and the three ISP tests (runtime stops, sleeps right after camera use, the 5 s idle), ANE use and sleep, and a short DRAM-kept run. Merge waits for it and for CI on this exact head.

Earlier soaks on the same series, before the last commits:

• fast23 (through 8ee99a76, without c2b4f4b4 and without integration cdd7ccf5): 200/200 DRAM-kept sleeps, 150 without and 50 with the debug-link cut. 0 resets, 0 safety nets fired (PMGR latch clears, commit clears, ANE retries, deep fallbacks), 0 NVMe refusals. NVMe shutdown median 0.93 ms; one took 4.63 s, inside macOS's 35 s.
• fast20: 150/150 with the cut, 0 resets, 0 safety nets. ANE client: the first request brought the ANE up; the next sleep's stop was answered.
• Before the ANE and PMGR fixes, about 1 DRAM-kept sleep in 60 reset in the sleep engine's own wake, stalled on ane_sys off with BUSY latched (fast4e, PMU mark 0x51, SOCD on the ane_sys poll).

Suspend speed with the debug cable attached: systemctl suspend to the sleep commit went from 3.24 s to a median of 1.77 s. Without the debug cable, request to commit is a median of 0.68 s.

Evidence: migration/neo-continuation-20261108/final-validation/RESULT.md (top section) and final-validation/fast1/RESETS.md. Display wake-start latency is a follow-up (dcp-wake-macos/), not in this PR.

Changed since the soaked tree

• 78edcab1 merges integration cdd7ccf5..f9f14be0 into the soaked tree b8f5b1e7, and 7fedcbe2, e0549e4d move the T8140 ISP to macOS's model (quiesce, 5 s idle). 2573357f merges integration f9f14be0..608f76fd: on the Neo, the ANE on per-SoC offsets (same values on T8140), media: apple: isp: contain IPC failures #1560's ISP IPC containment, SEP (soc: apple: sep: rate-limit the two verify messages from the fresh bring-up #1590, soc: apple: sep: bring the Touch ID sensor up afresh for each prompt #1536, soc: apple: sep: MacBook Air 15-inch M5 (J815) profile #1531) and rtkit-helper. It touches code the Neo runs: media: apple: isp: Power the T8140 ISP down between streams #1580 (T8140 ISP, resolved to the soaked model), HID: dockchannel-hid: write each frame to the FIFO under one lock #1010 (MTP TX lock), arm64: dts: apple: t8140-j700: enable uart0 #1574 (J700 uart0), J813: AOP sound on integration/aurora (speakers, jack, microphones) #1423 (admac capture realign, audio codecs), soc: apple: sep: rate-limit request-path log messages #1578 (SEP log rate limit), soc: apple: clpc: name the vote reasons and share the sample work #1555 and soc: apple: clpc: T6050: sample on time with no vote held #1556 (CLPC), crypto: apple: SIO AES engine skcipher driver for T6000 and T8112 #1572 (SIO AES), soc: apple: display-gate: enable T6041 external chains independently (fixes j614s external displays) #1551, t6041-j575c: USB-C display on typec1, USB3 and the fourth back Type-C port #1546 and t6041-j614c-j616c: USB 3 on the USB-C ports #1476 (display gate), and drm/asahi, drm/apple: J813 (M5 MacBook Air) GPU and display on the macOS 27.0 firmware #1413 (common G17 GPU changes). The Neo fast retest covers them.

Known gaps

• mt7932_bt_pcie.c builds with five clang lock-analysis warnings. They come from integration's own code (881448c4, 6356a799, d561b4f9), not this PR.
• Encoder 0 on other J700 units: the J700 tree disables video encoder 0, its DARTs and its power domains on every unit, because this Neo has only encoder 1. On a J700 that has encoder 0, the encoder doesn't bind until the loader enables it. A separate aura PR fixes that: commit c0f59af9, "kboot: T8140: hand over whichever video encoder the ADT describes".
• ANE compute: an H17 EXECUTE of the in-tree test job times out. This is a separate driver gap. After a failed job the stop isn't answered, and that sleep takes the deep path.
• Deep-sleep energy can't be measured on the rig: the SMC charges from the debug cable through S2R. s2idle on battery is 1.19 W.
• An NVMe shutdown notification occasionally takes about 4.6 s (2 in 250 sleeps). The sleep still completes.
• AVE and AVD sleep the macOS way: a follow-up PR (parity-ave-avd/).
• SEP: there is no post-gate refusal by design. SEP SLEEP is sent only inside the irreversible commit, and apple_sep.sleep_refuse_before_send covers the supported refusal.

Owner-only tests (physical)

Lid close and open, the power button, and keyboard wake.

🤖 Generated with Claude Code

[DjDeveloperr]

Codex (GPT-6.1 Sol), reviewing on @DjDeveloperr’s behalf.

This remains an experimental draft. The body still records rare DRAM-kept wake resets before Linux returns (~1/60, two observations), safe ANS suspend refusal, and exact-tree qualification only for f65bce9 rather than the later integration additions on current db58075. CI success does not establish reliable suspend-to-RAM or close the latest-head hardware gap. I will not merge or relabel this as Working while those reset/boot-path gates remain. No new speaker tests, default-loader change, Stage1 write or physical sleep test is requested here; any future work must retain the owner's existing dead-man/rollback constraints.

[DjDeveloperr]

Codex (GPT-6.1 Sol), reviewing on @DjDeveloperr’s behalf.

Host job 130886997274 completed the runner: 269/284 passed. The 15 failures are fixture integration problems introduced by combining the current production interfaces; they are separate from the SEP log-policy failure in review5867347666.

• j613-mtp-s2idle-tests.py fails extraction with ValueError before compiling. It still requests apple_dart_system_suspend/resume, while this head wires apple_dart_sys_suspend/resume and delegates to apple_dart_live_mtp_suspend/resume. Its extractor also normalizes only the other __maybe_unused placement. Adapt the fixture to the actual callbacks/delegation and qualifier order, retaining live-MTP normal/abort/refusal/runtime checks; do not revert the production PM composition to satisfy an old name.
• Four normal ISP cases and ten negative-control cases fail to compile. The session fixture lacks hardware.fw_restart, apple_isp.fw.started and the isp_check_restarted boundary; the extractor omits the new isp_cmd_send_chan helper. Buffer/return fixtures lack ISP_FW_RUNNING, and the queue fixture lacks clear_bit. Extend the fixtures/extraction for the real restart/command interfaces and preserve source guards, ownership and shutdown ordering. The overwrite control must still exercise the effective guard after the shared send-helper refactor; a success stub must not bypass it.

The runner correctly rejected compilation failures as 'without a control failure'. Keep that behavior: normal cases must compile/run successfully and controls must compile then fail their intended runtime assertions. Do not count these ten compiler errors as killed mutants, skip registrations or weaken assertions. Relevant production is not shown failing by these diagnostics; the separate kernel build remains its own evidence. No unchanged CI retry will fix the fixtures.

The keeper owns the next patch/push and validation. I have not changed that branch, started another build, adjusted its queue or requested another physical test. Exact-head green CI and the existing owner-approved fast Neo retest remain the merge gates.

[DjDeveloperr]

Codex (GPT-6.1 Sol), reviewing on @DjDeveloperr’s behalf.

Host job 130899624898 passed 262/284 cases. The previous MTP/ISP fixture failures are gone. All 22 remaining failures belong to sep-suspend-errors-tests.py: its normal case and 21 mutations stop at Rust fixture compilation, so none provides a runtime result yet.

The fixture’s Rust prelude still defines only dev_err!, dev_warn!, dev_dbg! and dev_info!. The extracted production sleep/wake code now correctly uses the rate-limited forms after the source-policy fix. Add corresponding fixture-only logging boundaries alongside the existing ones, for example:

macro_rules! dev_err_ratelimited { ($($a:tt)*) => {{}}; }
macro_rules! dev_warn_ratelimited { ($($a:tt)*) => {{}}; }
macro_rules! dev_info_ratelimited { ($($a:tt)*) => {{}}; }

Keep the real production rate limiting and the policy test intact. Then require the normal SEP case to compile/pass and each mutation to compile and fail its intended runtime check; the current compiler errors are not killed controls. Do not remove registrations, weaken assertions or retry unchanged CI. This is a host-fixture boundary update, not evidence that the kernel sleep implementation failed to compile.

The keeper retains patch/push/build ownership. No competing source change, build, queue adjustment or physical test was started here. The existing green-CI and owner-approved fast-retest merge gates remain, with the keeper’s stated logging/callback-rename equivalence for the retest retaining its exact scope.