[techmore]

On the Mac mini M4 (J773g, T8132), Aurora never booted with a GravityLinux-shaped device tree: no output, then a watchdog reset about a minute in.

Cause: T8110-family DARTs at version 2.2 or later keep the exception bitmap at 0x4000 and the per-stream records at 0x8000 + 0x40 * sid. The reset path drains them on every probe (apple_dart_hw_finish_reset() → apple_dart_drain_stale_exceptions()). Nothing checks that the node's reg covers them. GravityLinux's J773g DT gives 12 DARTs (ADMAC, 8 USB, 3 PCIe) a 0x4000 window, so the first exception read faults in the device initcalls, the kernel dies before apple_wdt takes over, and U-Boot's 60 s watchdog resets the SoC.

Change: at probe, refuse a v2.2 T8110 DART whose reg is shorter than DART_T8110_ERR_SID(num_streams), with a message naming the region and the size it needs. The check runs after version and num_streams are read and before any access at 0x4000 or above. Tunneled DARTs: apple-dart.c sets version 0x0202 for the tunneled T8132 PCIe-C DARTs, so the check does apply to them; they pass because t8132-usb4.dtsi gives them a 0x20000 window. (Corrected 2026-11-05 after RyanTheTide's merge-train note.)

Effect on other machines: none on a correct DT. Aurora's T8132, T8140, T8142 and T6040 DARTs are all 0xc000 or 0x20000, including every J713 node. Any DART this refuses already faults today, so it turns a silent crash into a logged refusal. The 0x4000 DARTs on M1/M2/M3 boot today, which means they report a version below 2.2 and are not affected.

Trade-off: the consumers of a refused DART probe without an IOMMU once deferred probe times out, so they run untranslated. The alternative is a fallback that keeps translation on a short window using only the low registers (legacy ERROR at 0x100, DIAG_LOCK, BLOCK_ERROR, the TLB command). We built and booted two versions of that, but whether the legacy ERROR register latches faults on a v2.2 DART is not established, so this PR takes the smaller, safer change. The real fix is the DT (0xc000; the ADT gives 0x20000 for the PCIe DARTs); a matching fix for omacom/linux-aurora#332 is being pushed there.

Tested on J773g, integration/aurora @ 19f71a1 + this change (the hunk applies unchanged at 7d581f6), booted through m1n1-gravity → U-Boot → Limine:

• GravityLinux-shaped DT (0x4000 windows): boots to init at 1.7 s and logs 11 refusals (… too small for v2.2 exception records (need 0x8400); fix the DT reg) for the enabled short DARTs: ADMAC 390f00000, USB 402f00000/402f80000/40af00000/40af80000/412f00000/412f80000/41af00000/41af80000, PCIe 490000000/492000000. Ethernet (atlantic), NVMe and ADMAC come up after the deferral.
• Same DT with those 12 windows set to 0xc000: no refusals, Ethernet at 7.9 s; matches the unpatched kernel on that DT.
• Without the change, the 0x4000 DT never boots; with the windows enlarged, the unpatched kernel boots.
• checkpatch --strict clean, W=1 clean. Not tested on J713 (its DT windows are all large enough, so the check never fires there).

Unrelated and unchanged by this PR: on J773g four locked DARTs (30a300000, 30a340000, 286340000, 48a340000) fail probe with -EBUSY through a WARN in iommu_setup_default_domain().

🤖 Generated with Claude Code

[RyanTheTide]

Merge train (MTL, 06/11). Gates passed on test tree 0412501 (integration/aurora 2661d71 + this batch):

• Signed-off-by from the author on every commit. Adversarial review done.
• W=1 on the touched objects: 0 new warnings. KUnit: drm/apple 112/113 (1 skip), hid 19/19, SEP 158/163 (the 4 known apple_sep_host_store failures, profile tests all pass). dt_binding_check clean. apple-dcp host selftests 86/86, run-host-tests at base parity (with Merge train: G17 hang confinement (#928) plus its host-test fixture #989's fixture).
• Regression boots of 7.3.0-aurora-mtl1106a, compared with the fleet16/fleet17 rows: M2, M1 Pro, J700 and J616s all clean (0 err-level lines, 0 AVCs, displays, Wi-Fi, BT, Touch ID, camera, speakers at minimal volume with speakerguardd, s2idle, perf at parity).
• iommu/apple-dart: refuse v2.2 DARTs whose reg misses the exception records #924: no DART was refused on any of our Macs (including the M2's 0x4000-window T8110 DARTs). Small note: the description says tunneled DARTs never set a version, but apple-dart.c sets 0x0202 for the tunneled T8132 PCIe-C DARTs; that's safe because t8132-usb4.dtsi gives them 0x20000.