Carry aurora-silicon's G17 and M5 GPU driver work

Documentation/ABI/testing/sysfs-driver-asahi-agx-stats

@@ -64,5 +64,58 @@ Description:
 		`#[repr(C)]` on the Rust side and its offsets are asserted at
 		build time in `sysfs.c`; readers must parse `key value` lines and
 		must not assume binary layout of this file.
-		G17 firmware has no supported decoder for this snapshot format;
-		its file reports unsupported rather than fabricated zero counters.
+
+		G16S (T6040/V25G83) and G17P (T8140/V26A428) use a separate,
+		qualified snapshot. The G13/G14 output above is unchanged.
+		The following keys replace the legacy keys on these firmwares:
+
+		utilisation_status, pstate_status
+		           Each is valid, stale, or unavailable. Numeric metrics
+		           are printed only while their capability is valid;
+		           otherwise their value is the string unsupported.
+
+		util_tiler_percent, util_renderer_percent, util_device_percent
+		           Unsigned integer percent (0..100), from tag 0x13
+		           words 3, 4 and 6 respectively (zero-based). Device
+		           utilisation is independent of the overlapping engines;
+		           it is never their sum. Each complete valid packet from
+		           either role contributes one sample to a shared integer
+		           mean, rounded down. Reads do not consume samples.
+		           A packet with any value above 100 invalidates the whole
+		           utilisation capability. Zero is a valid sample.
+
+		pstate     Logical selector 0..10 from tag 0x10 word 6. Words 1
+		           and 2 form a little-endian u64 firmware timestamp.
+		           The first timestamp establishes a baseline. Invalid
+		           selectors and backwards timestamps remove pstate
+		           validity; timestamps are never extended across epochs.
+		           P0 is a logical state, not a core-power measurement.
+
+		requested_frequency_hz, achieved_frequency_hz, busy_ns,
+		power_mw, temperature_raw
+		           Always unsupported on these firmwares. The statistics
+		           packet does not identify performance table A or B;
+		           a selector is neither a host request nor a measured
+		           frequency. No qualified busy-time duration, power unit
+		           or temperature field is available.
+
+		The host uses a 16 ms age/averaging-window limit for V25G83 and
+		32 ms for V26A428 (two nominal periods). These are conservative
+		host policies, not firmware guarantees about packet duration.
+		The oldest contributing utilisation sample bounds its window.
+		A logical pstate has no qualified periodic-report cadence and
+		remains valid until a replacement or an epoch boundary; its
+		host receive time is retained in diagnostics, not used to invent
+		a periodic-report deadline.
+		Suspend/resume, restart, statistics-ring quarantine, observed
+		core gating and teardown end validity. After an epoch boundary,
+		each ring's already queued records are discarded before new
+		baselines are accepted. A quarantined statistics ring disables
+		both roles' exports until reprobe; a trace-ring error does not.
+
+		Reads take the device mutex and do not wake the GPU. The
+		firmware_reports debugfs view retains per-role raw packets,
+		counts and host monotonic receive times, plus capability status,
+		policy, timestamp and diagnostic tick deltas. Tick deltas are
+		never accumulated as GPU busy time. Firmware role streams are
+		merged in drain order without deduplication.

Documentation/devicetree/bindings/gpu/apple,agx.yaml

@@ -64,6 +64,23 @@ properties:
       - const: hw-cal-b
       - const: globals
 
+  apple,clpc:
+    $ref: /schemas/types.yaml#/definitions/phandle
+    description: |
+      Host performance controller receiving GPU submission and idle demand.
+      GFX supplier power cannot represent GPU work on firmware that keeps
+      its coprocessor domain powered while the cores are idle.
+
+  apple,idle-off-delay-ms:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    minimum: 2
+    maximum: 1000
+    default: 2
+    description:
+      Continuous idle time before GPU power-off, in milliseconds. The G17
+      backend extends the firmware's native delay with its host idle-hold
+      control; an absent property preserves the native policy.
+
   operating-points-v2: true
 
   apple,firmware-abi:

Documentation/gpu/asahi-g17-recovery-safety.rst

@@ -0,0 +1,72 @@
+G17 repeated-timeout containment
+===============================
+
+The 73f audit found workload-reachable host-liveness hazards. The journal
+alone cannot attribute the observed machine reset to one of them; no hardware
+reproduction is claimed here.
+
+* Compute replay called Packet::check_dependencies with the device mutex
+  held. That routine used MAX_SCHEDULE_TIMEOUT. If an input needed completion
+  service taking the same mutex, the event worker could deadlock. Replay now
+  checks statuses without sleeping and fails an unexpectedly unmet dependency.
+  Initial publication waits off-lock in 10 ms cancellation/status-check slices,
+  with one absolute 2 s budget (10 s for a selected long submission).
+* G17 mailbox receive drained an indefinitely replenished FIFO under rx_lock
+  with IRQs disabled. G17 now uses a oneshot threaded receive IRQ, consumes at
+  most 64 messages per pass, then sleeps 1-2 ms off-lock with the IRQ masked
+  when its budget is exhausted. The level condition retriggers without
+  discarding messages. Explicit receive polling has the same finite budget.
+* G17 mailbox transmit without a send-empty IRQ could busy-poll for 500 ms
+  under tx_lock with IRQs disabled. Non-atomic G17 callers now sleep off-lock
+  between checks; an atomic G17 send polls for at most 1 ms. All sleeping
+  retries share a single 500 ms deadline, including contention between senders.
+  Removal, cookie, provider lifecycle and PM ownership gates are retained.
+* Scheduler failure callbacks no longer synchronously join preparation leases
+  and RTKit receive work. They mark the runtime lost and queue the event worker.
+  Recovery joins preparation for at most 2 s. Runtime stop halts both firmware
+  producers first and joins preparation for at most 2 s before detachment.
+  If a builder remains stalled, its stopped firmware, graphs and reservations
+  remain owned in Shared::state. Timeout is never an ownership witness. That
+  path does not re-arm a polling loop; a later queued completion/owner return
+  may finish the stopped teardown. Explicit device shutdown still joins every
+  borrower before returning or releasing provider resources.
+* Borrowed render graphs and off-lock queued retirements previously renewed
+  the watchdog without incrementing a render deferral counter. Both engines
+  now charge deferrals, and render transaction grace ends after eight polls.
+  Existing three replay credits remain finite and are never reset here.
+* A per-device burst limit stops the runtime on the eighth actual scheduler
+  timeout in a 30 s window or the eighth restart handshake in a 30 s window.
+  VM changes, new publications, recovery generations and replay do not reset
+  those counters; terminal loss latches. The 30 s window contains eight
+  two-second expirations, including a stalled deferred timeout that cannot
+  complete its normal per-client settlement. This limits host recovery load even
+  when each individual handshake succeeds. Legitimate long jobs only consume
+  this budget after their independent bounded execution allowance expires.
+
+Lock order remains stop -> state and state -> preparation wait/reclaim. All
+preparation joins and deferred fence completion/destruction run outside state.
+Runtime stop uses try_lock for the stop owner, avoiding a recursive join from
+an off-lock fence callback. Receive callbacks only retain/copy ingress and
+queue work; no firmware ring is polled while an IRQ spinlock is held without
+a finite iteration/time bound on the G17 paths. RX acknowledgement is still
+level-sensitive, and TX publication/removal remains serialized by tx_lock.
+
+The existing control backpressure timer has 1,000 finite retries; its event
+probes do not consume or reset that budget. Event-ring ingress is bounded by
+EVENT_SLOTS; trace/statistics consume a snapshot producer. Render retirement
+loops remove one retained tracker per successful iteration (or mark one as
+accounted); compute replay consumes a retained replay per iteration. Shared
+capacity deadlines remain absolute and failed fences do not release mappings
+or return physical reservations. The new storm limits additionally bound
+repeated recoveries and timeouts across those paths.
+
+KUnit exercises 64 consecutive watchdog timeouts with recovery pending under
+real state/preparation mutexes, a retained lease that must time out rather
+than be freed, late lease return with failed admission still closed, restart
+storms and nonblocking replay status checks. The mailbox tests use normal RAM
+as never-empty RX and never-draining TX registers, invoking the production
+poll/send functions for 64 RX passes and eight atomic TX timeouts plus a
+sleeping TX timeout/removal control. The isolated Asahi scenario runs with
+lockdep, PROVE_LOCKING and panic_on_warn. Software tests cannot establish
+that physical fabric/firmware or the original reset is fixed; separately
+controller-gated Neo qualification remains necessary.

Documentation/gpu/asahi-usage-stats.rst

@@ -0,0 +1,80 @@
+.. SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+Asahi client engine time
+========================
+
+Asahi reports the following optional keys in each DRM file's fdinfo, following
+:doc:`drm-usage-stats`::
+
+    drm-engine-vertex:   123456 ns
+    drm-engine-fragment: 234567 ns
+    drm-engine-compute:  345678 ns
+
+``vertex`` is the tiling/vertex stage of render commands, ``fragment`` is their
+fragment stage, and ``compute`` is compute dispatch. These are separate timelines:
+vertex and fragment can overlap. There is no separately submitted blit engine in
+the driver's command ABI. Copies executed by compute or render are included in
+the engine that executes them.
+
+The counters belong to the open DRM file, rather than to a PID or a queue handle.
+All queues and VMs of that file contribute to the same ledger. Duplicated or
+inherited file descriptors share counters and must be deduplicated using
+``drm-client-id``. Closing a queue or VM does not reset its file's counters, and
+completions retain the ledger until their firmware work retires. A new DRM file
+starts at zero, even when another file in the same process has submitted work.
+
+Time source and limits
+----------------------
+
+Only completed stage intervals are reported. A long-running command contributes
+after retirement, so polling during execution can temporarily show no change.
+Counters accumulate monotonically, saturating at the largest unsigned 64-bit
+value. Conversion rounds down by less than one nanosecond per retired stage.
+
+G13 and G14 use the firmware's internal start/end timestamp cells. The existing
+timestamp microsequence operations run even when the application requests no
+timestamp output. Internal buffers were already allocated for each command;
+fdinfo never reads an application's timestamp buffer.
+
+The G15 and native G16 backends reuse the internal timestamp cells already read
+by their successful retirement statistics path. The shared G17 execution backend,
+including T6040/G16S and T8140/G17P, charges the timestamp pairs delivered by its
+once-only completion path. These backends use the firmware's 24 MHz command timer;
+the classic backend uses its hardware configuration's timer frequency.
+
+These are firmware stage envelopes, not hardware shader occupancy measurements.
+They can include firmware scheduling, preemption and stalls between the stage's
+start and end operations. Intervals are summed without attempting to merge
+overlapping commands on the same engine. Missing, zero-start or reversed intervals
+are ignored. Failed or cancelled commands do not contribute incomplete intervals;
+successful stages that retired before a later failure remain counted. An
+unexecuted G17 replay contributes only when it eventually retires successfully.
+There is no submit-to-completion wall-time fallback in the current backends.
+
+``drm-cycles-*`` and ``drm-maxfreq-*`` are intentionally absent. The timestamp
+clock is independent of the variable GPU execution clock. Treating command timer
+ticks as GPU busy cycles, or multiplying time by a sampled/maximum GPU frequency,
+would give incorrect frequency-weighted utilization. Per-client execution-cycle
+counters would require a separate hardware measurement source.
+
+Accounting cost
+---------------
+
+Each file allocates one three-counter ledger. Queues and pending completions
+retain references to it. Retirement adds one relaxed, saturating atomic update
+per valid stage, with no new locks or allocations. The native backends reuse
+existing timestamp reads. Classic completion callbacks read two internal cells
+per stage; commands without application timestamps also execute two existing
+timestamp microsequence operations per stage. Reading fdinfo loads three counters
+and does not traverse queues, wait for fences or access hardware.
+
+Host arithmetic tests
+---------------------
+
+The ledger uses only ``core`` and can be tested directly from a source checkout::
+
+    rustc --edition 2021 --test drivers/gpu/drm/asahi/usage.rs -o /tmp/asahi-usage-test
+    /tmp/asahi-usage-test
+
+Tests cover conversion, missing/reset timestamps, saturation, overlapping stages,
+client isolation, out-of-order completions and simultaneous queues sharing a file.

Documentation/gpu/drivers.rst

@@ -7,6 +7,7 @@ GPU Driver Documentation
 
    amdgpu/index
    apple-dcp-backlight
+   asahi-usage-stats
    i915
    imagination/index
    intel-display/index

drivers/gpu/drm/asahi/Kconfig

@@ -21,6 +21,7 @@ config DRM_ASAHI
 	select RUST_DRM_GEM_SHMEM_HELPER
 	select RUST_DRM_GPUVM
 	select RUST_APPLE_RTKIT
+	select CRYPTO_LIB_SHA256
 	help
 	  DRM driver for Apple AGX GPUs (G13x, found in the M1 SoC family)
 

drivers/gpu/drm/asahi/Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 
 obj-$(CONFIG_DRM_ASAHI) += asahi.o
-asahi-y := asahi_core.o sysfs.o g17/sync_input.o g17/sync_output.o g17/sync_scope.o g17/trace.o
+asahi-y := asahi_core.o fwid.o sysfs.o g17/sync_input.o g17/sync_output.o g17/sync_scope.o g17/trace.o g17/clpc.o g17/fans.o
 CFLAGS_g17/trace.o := -I$(src)/g17
 
 asahi-$(CONFIG_DRM_ASAHI_G15) += g15/glue.o

drivers/gpu/drm/asahi/alloc.rs

@@ -162,14 +162,14 @@ impl<T, U: RawAllocation> Drop for GenericAlloc<T, U> {
                 // the invariant, and greater than debug_len as checked above.
                 unsafe {
                     let p = p.as_ptr().add(self.debug_offset - debug_len);
-                    (p as *mut u32).write(STATE_DEAD);
+                    p.cast::<u32>().write(STATE_DEAD);
                 }
             }
         }
         if debug_enabled(DebugFlags::FillAllocations) {
             if let Some(p) = self.ptr() {
                 // SAFETY: Writing to our inner base pointer with our known inner size is safe.
-                unsafe { (p.as_ptr() as *mut u8).write_bytes(0xde, self.size()) };
+                unsafe { p.as_ptr().cast::<u8>().write_bytes(0xde, self.size()) };
             }
         }
         if self.padding != 0 {
@@ -178,7 +178,7 @@ impl<T, U: RawAllocation> Drop for GenericAlloc<T, U> {
                 // the inner base pointer, after `size()` bytes.
                 let guard = unsafe {
                     core::slice::from_raw_parts(
-                        (p.as_ptr() as *mut u8 as *const u8).add(self.size()),
+                        p.as_ptr().cast::<u8>().cast_const().add(self.size()),
                         self.padding,
                     )
                 };
@@ -313,8 +313,8 @@ pub(crate) trait Allocator {
                     unsafe {
                         let p = p.as_ptr();
                         p.write_bytes(0x42, debug_offset - 2 * debug_len);
-                        let cur = p.add(debug_offset - debug_len) as *mut AllocDebugData;
-                        let prev = p.add(debug_offset - 2 * debug_len) as *mut AllocDebugData;
+                        let cur = p.add(debug_offset - debug_len).cast::<AllocDebugData>();
+                        let prev = p.add(debug_offset - 2 * debug_len).cast::<AllocDebugData>();
                         prev.copy_from(cur, 1);
                         cur.copy_from(&debug, 1);
                     };
@@ -344,7 +344,7 @@ pub(crate) trait Allocator {
         if debug_enabled(DebugFlags::FillAllocations) {
             if let Some(p) = ret.ptr() {
                 // SAFETY: Writing to our inner base pointer with our known inner size is safe.
-                unsafe { (p.as_ptr() as *mut u8).write_bytes(0xaa, ret.size()) };
+                unsafe { p.as_ptr().cast::<u8>().write_bytes(0xaa, ret.size()) };
             }
         }
 
@@ -354,7 +354,7 @@ pub(crate) trait Allocator {
                 // the inner base pointer, after `size()` bytes.
                 let guard = unsafe {
                     core::slice::from_raw_parts_mut(
-                        (p.as_ptr() as *mut u8).add(ret.size()),
+                        p.as_ptr().cast::<u8>().add(ret.size()),
                         padding,
                     )
                 };
@@ -536,7 +536,7 @@ impl Allocator for SimpleAllocator {
         );
 
         let mut obj = crate::gem::new_kernel_object(&self.dev, size_aligned)?;
-        let p = obj.vmap()?.addr as *mut u8;
+        let p = obj.vmap()?.addr.cast::<u8>();
         if debug_enabled(DebugFlags::FillAllocations) {
             let obj_size = obj.size();
             if let Ok(vmap) = obj.vmap() {
@@ -990,7 +990,7 @@ impl HeapAllocator {
             let (obj_start, obj_size, p) = self.mm.with_inner(|inner| -> Result<_> {
                 let idx = idx.unwrap_or(inner.backing_objects.len() - 1);
                 let obj = &mut inner.backing_objects[idx];
-                let p = obj.0.vmap()?.addr as *mut u8;
+                let p = obj.0.vmap()?.addr.cast::<u8>();
                 Ok((obj.2, obj.0.size(), p))
             })?;
             assert!(obj_start <= start);