[joshuaswarren]

Phase 2 of M3 Ultra (Mac Studio 2025, Mac15,14, j575dap, T6032) support: the board description. Draft. Target firmware macOS 27.0.1 (26A434).

What changes

• USB-C: adds controller 3 at 0x1302280000 (ADT: inside die 0's window, power state ATC3_USB). Deletes the die-1 copy of die-0 port 2 at 0x2f02280000; the ADT has no such port. Ports 4 and 5 stay as die-1 mirrors of ports 0 and 1.
• Deletes the die-1 USB4 controller that has no ADT entry (0x2f01ac0000).
• Deletes laptop-only nodes with no ADT entry: MTP keyboard stack, the AOP audio ADMAC and its consumer, i2c3, spi1.
• Adds GPU, the eight external display pipes (dcpext0..7, mailboxes, DARTs) and both ANE engines (ane0, ane1, three DARTs each), all disabled. The GPU, display and ANE drivers for this chip are separate work.
• CI check .github/scripts/adt-dt-check-t6032.py (workflow t6032-adt-dt-check): builds the DTB, reads the device tree of the pinned 27.0.1 image from Apple's public IPSW by two HTTP range requests, verifies pinned SHA-256 hashes, and fails when a needed ADT node is not covered, a deleted window returns, a DT node maps nowhere in the ADT, a power state sits at another bank or offset, or the GPU, display or ANE nodes become enabled.

Checked: the fixed tree passes 104 checks; the tree before this change fails 43. The T6030, T6031 and T6034 DTBs still build.

Not shown: that this Mac boots Linux. No M3 Ultra is available to the developers; the ADT is the only reference. Open points are listed in the commit message.

[joshuaswarren]

GREEN at df16bdb

Scope: the two new commits, 0bbf34a (PCIe ports, Ethernet, power-enable lines) and df16bdb (console and network config fragment), plus how they sit on the T6031 base the T6032 tree includes. I did not re-review 40ae094 and 05cc2d4 (the CI checker covers those), and I did not run the ADT check, a dtc build or any boot. No boot claim in the texts, which is right.

PCIe commit, checked against the included T6031 nodes (t6031-die0.dtsi at this head):

• Defaults: port00 and pcie0_dart_0 are enabled by default; port01 to port03 and pcie0_dart_1 to _3 are disabled by default. The DTS enables exactly the other three ports and the three DARTs and leaves port00 and DART 0 alone, so all four ports and their IOMMUs end up on and no DART is referenced by an active port while disabled.
• Addressing: root bus-range is <0 4>; the ports take <1 1>, <2 2>, <3 3>, <4 4>. The Ethernet child ethernet@0,0 has reg 0x30000, which is bus 3 device 0 function 0, the bus of port02. ethernet0 alias exists. local-mac-address is the usual placeholder for the loader to fill.
• Power: pwren-gpios point at smc_gpio (a node that exists in the base, apple,smc-gpio under the SMC) with 19, 25 and 22 (hex 0x13, 0x19, 0x16, as the comment says the ADT keys read as hex). port02 has none, which matches "the ADT has no power function for port02". The WLAN, Bluetooth and SD reader children are left out for lack of PCI IDs, so nothing binds a driver to them.
• Could it hang a console boot? Not from this node set: ports probe through the PCIe driver; a missing SMC GPIO defers the port probe, it does not block the console; the fragment (below) builds the providers in. The ports power on WLAN, SD reader and xHCI through the SMC on the first boot of an untested machine; that is the one new thing a first boot does, and it is limited to the power-enable lines.

Config fragment: every symbol exists in asahi.config as a module (PINCTRL_APPLE_GPIO, MFD_MACSMC, GPIO_MACSMC, APPLE_SART, NVME_APPLE) and the fragment turns them to y, which is what "boot without an initramfs" needs; PCIE_APPLE, APPLE_DART, APPLE_AIC, APPLE_RTKIT and SERIAL_SAMSUNG are already y there. AQTION, USB_XHCI_PCI(_ASMEDIA) and the CDC USB net options are plain additions. GPU, display and ANE stay off. The commit says olddefconfig keeps every symbol; I did not reproduce that.

Not checked, and the reason this is a GREEN for the diff and not a boot claim: the port assignment, the three SMC key values and the PERST pins (pinctrl_ap 4 to 7 come from the T6031 base, not from this commit) against the real ADT of a T6032; the checker and ADT fetch were not run by me.

[joshuaswarren]

Review at df16bdb: commits 1-2 (40ae094a, 05cc2d43). The dtsi content is GREEN. The checker has one real gap (section 6) and two small ones.

What I did. Built the real t6032-j575d.dtb at each commit (cpp + dtc from the sparse tree, dt-bindings from the tree) and ran the checker, as committed, against the pinned 27.0.1 (26A434) j575dap ADT (sha256 matches the pin in the script). Also exercised --fetch-ipsw: both pinned hashes verify and the run passes.

tree	result
parent of commit 1 (7b969982)	84 FAIL (fails as it should: the die-1 USB mirrors, MTP, AOP ADMAC, i2c3, SPI-NOR, drd3, interrupts)
commit 1 (40ae094a), head-version checker	30 FAIL (all interrupt checks that commit 2 fixes), commit 1's own checker passes
commit 2, commit 3, head	245 ok, 0 FAIL

dtsi against the ADT, beyond what the checker does.

• A live ioreg dump of a retail unit (same build) agrees with the pinned ADT for every required node: register words, interrupts and interrupts-valid (one unrelated node, pmgrtools, differs in its interrupt list).
• The 14 hard-coded PS offsets in REQUIRED_PS are right: I derived each from the ADT pmgr device table (ps-regs bank plus addr_offset << 3) and they match all 14 (DISPEXT0-3_CPU, ATC0-3_USB, ANE_SYS/MPM/CPU/TD/BASE, GFX).
• The power-domains of the eight display pipes (node, mailbox and both DARTs) and of the six USB-C controllers point at the right pmgr state and the right die (pipes 4-7 and controllers 4-5 are die 1, pipes 0-3 and controllers 0-3 die 0). 0 mismatches.
• All 41 labelled gated nodes (GPU, ANE and DARTs, eight DCPs, mailboxes and DARTs) are status = "disabled" in the built DTB; the GPU mailbox too.

Findings in adt-dt-check-t6032.py.

1. Section 6 ("disabled gates") tests 2 of 42 entries. MUST_BE_DISABLED holds DT labels (dcpext0, ane0, ane0_dart0, ...), but the check compares against the node name before the @ (dcp, ane, iommu, gpu, mbox@40a408000), and the kernel does not build these DTBs with -@. Only gpu and mbox@40a408000 ever match; the ANE, all eight DCPs and their DARTs are never looked at, although the docstring promises "the GPU, ANE and display nodes must stay disabled". Mutation test: with ane0 and dcpext0 set to okay the checker prints all checks passed. Suggested fix (tested): match by register window. A DT node is gated when its first window starts where the first window of a gated ADT node starts (for the DARTs, any window). Over the 30 gated ADT nodes this finds 33 DT nodes on the real tree (none enabled) and flags exactly dcp@306c00000 and ane@3c9400000 on the mutated one. Also make "found fewer DT nodes than gated ADT nodes" a FAIL so it cannot go quiet again.
2. CI will likely not get past the checker step. The workflow installs gcc-aarch64-linux-gnu flex bison but the checker runs dtc from PATH; the kernel build leaves its own copy in build/scripts/dtc/dtc, not on PATH. Add device-tree-compiler to the apt line (or call the built one). The workflow run for this head is waiting for approval, so this has not run on CI.
3. Small ones. REQUIRED_PS builds its _die1 label suffix with soc.endswith("2000000000"), which is never true for soc@2200000000, so die-1 entries are reported without the suffix (messages only). The docstring says the power states must "exist at the ADT address", but the check compares the DT offset with constants typed in the script; the constants are correct (see above), so a one-line comment would do. In t6032.dtsi the die-1 ANE node is ane@23c9400000 with reg = <0x3 0xc9400000 ...>; dtc warns simple_bus_reg: expected "3c9400000" (every other node uses the same unit address on both dies).

Not run on hardware and not on CI. I did not read the commit 3-4 content again (already GREEN at this head).

[joshuaswarren]

GREEN at b732ee8

Read the diff over df16bdb5 (3 files under .github, no dtsi change) and ran it:

• Section 6 now finds gated DT nodes by register window and fails when fewer DT nodes match than gated ADT nodes. On the real DTB built at this head against the pinned 26A434 ADT: 33 DT nodes match the 30 gated ADT nodes, 277 ok, 0 FAIL.
• The CI mutation script, run as the workflow runs it (fdtput from device-tree-compiler, --fetch-ipsw): ane@3c9400000 and dcp@306c00000 set to okay are both flagged, exit 1, mutation detected.
• The workflow installs device-tree-compiler and runs the mutation step; the die-1 label suffix and the docstring notes (offsets are typed in, ane@23c9400000 warning is expected) are as asked.

Not run on CI (the workflow still needs approval to run) or hardware.

[joshuaswarren]

Ready for review. The device tree and the checker fix (b732ee8) have one review, and the earlier PCIe and ethernet commits have two. Nothing here has booted a Mac.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] No blocking findings remain, but the three earlier checker gaps are still open.

Findings

1.  Wrong power references pass ▶
2.  Missing DART passes CI ▶
3.  Enabled engine escapes the check ▶

Summary

Updates the T6032 board description against the pinned macOS 27.0.1 ADT.

• The T6032 tree maps USB-C controller 3 to its ADT address and drops absent devices.
• The Mac Studio board description now names its built-in PCIe devices.
• The T6032 tree describes the M3 Ultra GPU while keeping it disabled.
• The T6032 tree describes eight external display pipes but keeps them disabled.
• The T6032 tree describes one disabled ANE engine on each die.
• CI checks the T6032 device tree against Apple's pinned ADT.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  DTS[Board device tree] --> Build[Build DTB]
  IPSW[Pinned Apple firmware] --> Verify[Fetch ADT and verify hashes]
  Build --> Compare[Compare DTB against ADT]
  Verify --> Compare
  Build --> Mutate[Enable two disabled devices in a copy]
  Mutate --> Reject[Check that comparison rejects the copy]

Loading

_{Reviews (2) · Last reviewed commit: "arm64: dts: apple: clarify the SD reader..." · Reviewed by Greptile}

[greptile-apps]

Wrong power references pass

REQUIRED_PS checks ps_atc3_usb on die 1, but the new USB controller and PHY use the die-0 state. The checker also never follows power-domains, so changing those devices to the wrong state still passes while the expected controller nodes remain. Check the die-0 entry and follow each device’s reference before checking its bank and offset.

[greptile-apps]

Missing DART passes CI

Required-node coverage accepts any single overlapping window. Removing ane0_dart2 and its iommus entry still leaves the other two DARTs covering dart-ane0 and carrying IRQ 984. Their extra matches also keep the disabled-device count above its minimum. CI therefore misses the loss of one of the three DARTs added here. Check each required DART window separately and add a deletion mutation test.

[greptile-apps]

Enabled engine escapes the check

The disabled check recognizes an engine only by its first reg window, then checks a shared total instead of each device. Reordering ane0’s first two windows and setting its status to okay skips its status check. The unchanged windows and interrupts still satisfy the other checks, and the extra ANE DART matches cover the lost count. Track each gated device separately and add a mutation that changes register order as well as status.

[joshuaswarren]

Review at 042b0f4: the SD reader node is fine; the commit message is wrong about the ADT.

Diff over b732ee81 is t6032-j575d.dts only. compatible = "pci17a0,9755" and reg = <0x20000 0 0 0 0> match the port01 bus-range = <2 2> and are the same child node the M2 Ultra Studio and the other boards use. The 27.0.1 j575dap ADT has a pcie-sdreader node on that port with gl9755-* properties, so the chip id is the right translation. It does not store the bytes of vendor 0x17a0 or device 0x9755.

Finding: the commit says the card-detect and write-protect polarity "is not in the ADT". Both properties are there, and both values are 1 (card-detect-polarity, write-protect-polarity). The live dump of a retail unit of the same build has the same two properties, also 1. cd-inverted and wp-inverted are copied from the M2 Ultra Studio board and are not checked against that 1. Say that, instead of saying the ADT has no polarity. I did not check whether 1 means inverted.

Not run: the checker again (this hunk adds no gated SoC node), and no SD card on hardware.

[joshuaswarren]

[Joshua's agent] The current head needs the required review; the squash commit will correct the SD reader polarity evidence.