nvme: apple: Add resident ANS support over native APIF

Documentation/devicetree/bindings/nvme/apple,nvme-apif.yaml

@@ -0,0 +1,79 @@
+# SPDX-License-Identifier: GPL-2.0-only
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/nvme/apple,nvme-apif.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Resident Apple ANS controller using the Aurora platform interface
+
+maintainers:
+  - Dj <hey@djdev.me>
+
+description: |
+  A boot-time guest description for the native table-6 ABI with 64-entry
+  linear queues. The producer stops all NVMe DMA and quiesces both sides
+  of RTKit before handoff. Native queue registrations survive controller
+  disable, so the consumer must reuse the four registered queue pages.
+  This binding describes an ABI, not a promise of support for every SoC.
+  The controller uses identity DMA addresses and coherent shared memory.
+
+properties:
+  compatible:
+    const: apple,nvme-apif
+  reg:
+    items:
+      - description: NVMe controller registers
+      - description: ANS coprocessor control registers
+  reg-names:
+    items:
+      - const: nvme
+      - const: ans
+  interrupts:
+    maxItems: 1
+  mboxes:
+    maxItems: 1
+  apple,sart:
+    $ref: /schemas/types.yaml#/definitions/phandle
+    description: SART provider for the resident controller
+  aurora,apif:
+    $ref: /schemas/types.yaml#/definitions/phandle
+    description: Version-2 native APIF transport
+  dma-coherent: true
+  asahi,rtkit-quiesced:
+    type: boolean
+    description: Both RTKit peers were stopped before their buffers were released
+  memory-region:
+    minItems: 4
+    maxItems: 4
+  memory-region-names:
+    items:
+      - const: admin-sq
+      - const: admin-cq
+      - const: io-sq
+      - const: io-cq
+  power-domains:
+    minItems: 2
+    maxItems: 3
+  power-domain-names:
+    minItems: 2
+    items:
+      - const: ans
+      - const: apcie0
+      - enum: [apcie1, apcie_phy]
+  resets:
+    maxItems: 1
+
+required:
+  - compatible
+  - reg
+  - reg-names
+  - interrupts
+  - mboxes
+  - apple,sart
+  - aurora,apif
+  - dma-coherent
+  - asahi,rtkit-quiesced
+  - memory-region
+  - memory-region-names
+
+additionalProperties: false

Documentation/driver-api/firmware/aurora-apif-nvme.rst

@@ -0,0 +1,39 @@
+Resident ANS over APIF
+======================
+
+``apple,nvme-apif`` selects the native table-6 queue ABI. It keeps the
+existing Apple NVMe queue depth, batching, crypto fields, recovery ownership
+and synchronous post-M4 flush policy. Linux builds and translates the TCB
+and physical page list; Aura forwards selectors and arguments unchanged.
+No payload copying or monitor-side NVMe policy is required.
+
+The boot producer must quiesce RTKit and stop controller DMA before Linux
+starts. It supplies ``asahi,rtkit-quiesced`` and four distinct reserved-memory
+pages named ``admin-sq``, ``admin-cq``, ``io-sq`` and ``io-cq``. Each is coherent,
+16 KiB aligned, 16 KiB sized and ``no-map``. Their guest addresses must map to
+the native physical pages already registered with the firmware. Linux clears
+and reuses those pages; it does not substitute new queue addresses. They stay
+reserved after unbind because the native queue registrations survive it.
+
+This profile requires an identity DMA aperture. It checks each request's
+physical translation against the DMA address in its command and PRP chain.
+An offset aperture is rejected before native request registration. Native
+metadata addresses are independently translated, including the scratch TCB
+and page list. Queue-control and MAP endpoints return void; UNMAP must return
+one before a request's backing can be reused.
+
+A lost MAP response retains that request and prevents new registration until
+recovery has stopped the controller and explicitly invalidated every retained
+tag. Failed invalidation quarantines the controller and retains its DMA,
+requests and APIF client until platform reset. SART unmap failures also retain
+Linux-owned backing. These are ownership failures, not successful I/O.
+
+Live RTKit adoption is deliberately excluded from this new profile: controller
+CC.EN/RDY alone cannot prove a live mailbox session or authorize inherited
+buffers outside guest RAM. Existing raw-controller profiles keep their existing
+validated adoption path. The guest producer must provide the stopped handoff
+above; a version-1 live-session DT is not a drop-in replacement.
+
+Build and host fault tests do not qualify this path on hardware. Boot,
+read/write/flush durability, controller reset and teardown must be tested with
+the matching Aura version-2 monitor and generated handoff description.

Documentation/driver-api/firmware/index.rst

@@ -5,6 +5,7 @@ Linux Firmware API
 .. toctree::
 
    aurora-apif
+   aurora-apif-nvme
    introduction
    core
    efi/index

drivers/nvme/host/Kconfig

@@ -128,6 +128,7 @@ config NVME_APPLE
 	depends on APPLE_RTKIT && APPLE_SART
 	depends on ARCH_APPLE || COMPILE_TEST
 	select BLK_INLINE_ENCRYPTION
+	select AURORA_APIF_MMIO if ARM64_16K_PAGES
 	select NVME_CORE
 	help
 	  This provides support for the NVMe controller embedded in Apple SoCs