Merge aurora-wip batch 1 (to fleet14b, 437edfa1) into integration/aurora

.github/workflows/sep-source.yml

@@ -8,9 +8,41 @@ on:
       - 'tools/aurora-bindgen/**'
       - 'drivers/soc/apple/**'
       - 'include/uapi/linux/apple-sep.h'
+      - 'tools/aurora-sep/**'
       - '.github/workflows/sep-source.yml'
 
 jobs:
+  source:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          filter: blob:none
+          sparse-checkout-cone-mode: false
+          sparse-checkout: |
+            drivers/soc/apple/**
+            include/uapi/linux/apple-sep.h
+            tools/aurora-sep/**
+      - name: Check biometric ioctl ABI sizes
+        run: |
+          cat > /tmp/sep-abi.c <<'EOF'
+          #include <linux/apple-sep.h>
+          _Static_assert(sizeof(struct sep_bio_enrol_start) == 144, "enrol ABI");
+          _Static_assert(sizeof(struct sep_bio_enclave_list) == 520, "list ABI");
+          _Static_assert(sizeof(struct sep_bio_delete) == 16, "delete ABI");
+          int main(void) { return 0; }
+          EOF
+          cc -Wall -Werror -Iinclude/uapi /tmp/sep-abi.c -o /tmp/sep-abi
+          /tmp/sep-abi
+      - name: Test recovery utility and package sources
+        run: |
+          python3 -m unittest tools/aurora-sep/tests/test_sep_bio_identities.py -v
+          python3 -m unittest tools/aurora-sep/tests/test_orphan_delete.py -v
+          python3 -m unittest tools/aurora-sep/tests/test_enrol_admission.py -v
+          python3 -m unittest tools/aurora-sep/tests/test_owner_preparation.py -v
+          python3 -m unittest discover -s tools/aurora-sep/tests -p test_packaging.py -v
+
   rust-build:
     runs-on: ubuntu-24.04
     timeout-minutes: 45

Documentation/ABI/testing/sysfs-driver-ane-performance

@@ -0,0 +1,35 @@
+What:           /sys/class/accel/accel*/device/performance_level
+Date:           October 2026
+Contact:        asahi@lists.linux.dev
+Description:
+                Requested ANE performance level, 0 through 5, or "unsupported"
+                when the device tree does not describe a supported controller.
+                This is a firmware request, not a measured clock frequency.
+                Work raises the level from the SoC match data. It drops to 0
+                after 32 ms without a submission. A stream amortizes the clock
+                transition cost; the first job after idle includes that cost.
+                The runtime PM reference covers the entire request lifetime.
+
+What:           /sys/class/accel/accel*/device/memory_vote
+Date:           October 2026
+Contact:        asahi@lists.linux.dev
+Description:
+                Requested average and peak memory bandwidth, in decimal kB/s,
+                separated by a space. Both are zero after idle release. The
+                requests are aggregated with other interconnect consumers.
+                The active values come from the high-level OPP's opp-avg-kBps
+                and opp-peak-kBps. "unsupported" means no interconnect path is
+                described. It does not mean a successful zero-bandwidth vote.
+                Current T600x trees have no host DCS interconnect provider;
+                describing a path requires a verified shared voting transport.
+
+What:           /sys/class/accel/accel*/device/performance_error
+Date:           October 2026
+Contact:        asahi@lists.linux.dev
+Description:
+                Last performance transition result: zero on success or a
+                negative errno. Failed busy requests abort before enqueueing.
+                Failed idle releases retain the runtime PM reference, retry
+                up to three times, and remain visible here if still failing.
+                A subsequent workload retries release before requesting high.
+                An unknown DMA state retains the votes until recovery.

Documentation/ABI/testing/sysfs-driver-aop-als

@@ -0,0 +1,13 @@
+What:           /sys/bus/iio/devices/iio:deviceX/in_cct_input
+Date:           October 2026
+Contact:        linux-iio@vger.kernel.org
+Description:
+                Firmware-computed correlated colour temperature in Kelvin on
+                aop-sensors-als devices with a Redbird (VD6286) sensor.
+                Fractional Kelvin are reported with micro resolution. There
+                is no raw photodiode-to-CCT conversion in the host driver.
+                Only the documented 122-byte fake-HID report is decoded.
+                Before a valid positive finite CCT arrives, reading returns
+                ENODATA. A report in another layout or without a valid CCT
+                leaves the last valid reading in place, independently of lux.
+                CT720 and CT817 devices do not expose this attribute.

Documentation/ABI/testing/sysfs-driver-apple-pmp-dram

@@ -0,0 +1,49 @@
+What:           /sys/bus/platform/devices/.../dram/type
+Date:           October 2026
+Contact:        Ryan Murray <ryan@aurorasilicon.org>
+Description:
+                Read-only DRAM family from DT, currently "lpddr5". This family
+                includes LPDDR5X; the attribute does not assert the X suffix.
+                The dram group is present on an apple-pmp-report device only
+                when DT supplies a complete, consistent memory description.
+                Static attributes remain valid when firmware is stopped.
+
+What:           /sys/bus/platform/devices/.../dram/max_data_rate
+Date:           October 2026
+Contact:        Ryan Murray <ryan@aurorasilicon.org>
+Description:
+                Read-only maximum interface transfers per second per data pin
+                (divide by 1000000 for MT/s), from the highest DT OPP. This is
+                an inferred interface class, not a measured current rate or
+                a literal LPDDR5 command clock/WCK. The maximum state ID is
+                state_count minus one, independent of DT child order.
+
+What:           /sys/bus/platform/devices/.../dram/peak_bandwidth
+Date:           October 2026
+Contact:        Ryan Murray <ryan@aurorasilicon.org>
+Description:
+                Read-only inferred physical maximum in decimal bytes/second,
+                max_data_rate * data_bus_width / 8. This excludes ECC/check bits
+                and does not measure sustainable application bandwidth.
+
+What:           /sys/bus/platform/devices/.../dram/bandwidth_class
+Date:           October 2026
+Contact:        Ryan Murray <ryan@aurorasilicon.org>
+Description:
+                Read-only published maximum bandwidth class in decimal
+                bytes/second. It may be rounded relative to peak_bandwidth.
+
+What:           /sys/bus/platform/devices/.../dram/data_bus_width
+Date:           October 2026
+Contact:        Ryan Murray <ryan@aurorasilicon.org>
+Description:
+                Read-only inferred usable data width in bits, excluding ECC.
+
+What:           /sys/bus/platform/devices/.../dram/state_count
+Date:           October 2026
+Contact:        Ryan Murray <ryan@aurorasilicon.org>
+Description:
+                Read-only number of firmware DCS states, from DT. State IDs
+                are not frequencies. No current-state, current-rate, residency,
+                or transition-statistics attribute is provided without an
+                independently specified achieved-state transport.

Documentation/ABI/testing/sysfs-driver-asahi-agx-stats

@@ -64,5 +64,58 @@ Description:
 		`#[repr(C)]` on the Rust side and its offsets are asserted at
 		build time in `sysfs.c`; readers must parse `key value` lines and
 		must not assume binary layout of this file.
-		G17 firmware has no supported decoder for this snapshot format;
-		its file reports unsupported rather than fabricated zero counters.
+
+		G16S (T6040/V25G83) and G17P (T8140/V26A428) use a separate,
+		qualified snapshot. The G13/G14 output above is unchanged.
+		The following keys replace the legacy keys on these firmwares:
+
+		utilisation_status, pstate_status
+		           Each is valid, stale, or unavailable. Numeric metrics
+		           are printed only while their capability is valid;
+		           otherwise their value is the string unsupported.
+
+		util_tiler_percent, util_renderer_percent, util_device_percent
+		           Unsigned integer percent (0..100), from tag 0x13
+		           words 3, 4 and 6 respectively (zero-based). Device
+		           utilisation is independent of the overlapping engines;
+		           it is never their sum. Each complete valid packet from
+		           either role contributes one sample to a shared integer
+		           mean, rounded down. Reads do not consume samples.
+		           A packet with any value above 100 invalidates the whole
+		           utilisation capability. Zero is a valid sample.
+
+		pstate     Logical selector 0..10 from tag 0x10 word 6. Words 1
+		           and 2 form a little-endian u64 firmware timestamp.
+		           The first timestamp establishes a baseline. Invalid
+		           selectors and backwards timestamps remove pstate
+		           validity; timestamps are never extended across epochs.
+		           P0 is a logical state, not a core-power measurement.
+
+		requested_frequency_hz, achieved_frequency_hz, busy_ns,
+		power_mw, temperature_raw
+		           Always unsupported on these firmwares. The statistics
+		           packet does not identify performance table A or B;
+		           a selector is neither a host request nor a measured
+		           frequency. No qualified busy-time duration, power unit
+		           or temperature field is available.
+
+		The host uses a 16 ms age/averaging-window limit for V25G83 and
+		32 ms for V26A428 (two nominal periods). These are conservative
+		host policies, not firmware guarantees about packet duration.
+		The oldest contributing utilisation sample bounds its window.
+		A logical pstate has no qualified periodic-report cadence and
+		remains valid until a replacement or an epoch boundary; its
+		host receive time is retained in diagnostics, not used to invent
+		a periodic-report deadline.
+		Suspend/resume, restart, statistics-ring quarantine, observed
+		core gating and teardown end validity. After an epoch boundary,
+		each ring's already queued records are discarded before new
+		baselines are accepted. A quarantined statistics ring disables
+		both roles' exports until reprobe; a trace-ring error does not.
+
+		Reads take the device mutex and do not wake the GPU. The
+		firmware_reports debugfs view retains per-role raw packets,
+		counts and host monotonic receive times, plus capability status,
+		policy, timestamp and diagnostic tick deltas. Tick deltas are
+		never accumulated as GPU busy time. Firmware role streams are
+		merged in drain order without deduplication.