[MuBai-He]

Stacked on #200. The first five commits are #200's; review the last three.

Summary

Adds the 13-inch M4 MacBook Air (J713) next to #200's J715:

1. apple_sep: T8132_J713, the J715 profile with J713's own FDR MSRk file, apple/msrk-j713.bin. It uses J715's rules: a 10,848-byte body, loaded only after SESSION_SHARE status 0x16, and one retry. It is selected only on apple,j713. The sensor description says what J713 reads back: ID 0x3356, mode 2. Adds three KUnit cases.
2. dt-bindings: apple,t8132-spi.
3. t8132.dtsi / t8132-j713.dts: spi2 and its Mesa sensor. Both are disabled in the SoC file, as in t8122.dtsi. J713 enables them with NUB GPIO 28, spi-cpol, 20 ns chip-select timing and apple/mesacal-j713.bin.
4. Documentation: Documentation/input/devices/j713-touchid.rst.

No sbio.rs change was needed. On J713, a capture taken straight after calibration gets IMAGE_ASSESSMENT 0x16. The sensor must be registered again first: power cycle, identity, CLEAR_STATE, serial and nonce, session, patch and params, without the root key or calibration. The existing flow already does that before every enrolment and match.

How J713 differs from J715

• Root-key file name. This is the only difference. The rules and input sizes are the same: the MSRk body is 10,848 bytes and the source-6 calibration is 130,427 bytes on both. The signed IMG4 payload alone (1,726 bytes) is refused with 0x1c.
• Sensor description. 0x3356 and mode 2 are descriptive; the driver does not branch on them. J715 keeps the values it inherits from T8122, because nothing here was measured on J715.

Evidence

MacBook Air 13-inch M4 (J713). The gigalocker held 9 session records that Linux did not create. Test setup:

• Omarchy M4 kit kernel 7.1.9.
• A port of this branch's drivers/soc/apple:
  • profile.rs is the same file plus one local helper.
  • kernel::firmware maps to a local shim.
  • It adds a local check of the boot handoff.
• Kit m1n1 with the two SEP fixes from fix: let a SEP driver attach on T8132 (mailbox IRQ roles, m1n1 handoff) Kb2uka/Omarchy-M4-Native#168.
• The kit device tree, with SEP nodes equivalent to T8132 (MacBook Air M4): add the SEP and a J715 platform profile #200's and the sep alias.
• The spi2/sensor properties from this PR, applied as an overlay.

Results:

• Activation: profile T8132/J713, 12 endpoints. The first SESSION_SHARE returned 0x16. The driver loaded msrk-j713.bin and the retry was accepted.
• Use: the owner enrolled one finger. It matched twice and another finger was rejected twice.
• Persistence: three cold boots, on two builds of the module. Each restored the enrolment from the Catacomb files. After a cold boot the enrolled finger matched and another finger was rejected; the owner confirmed both.
• xART guard: default level 1, no refusals of enclave writes in builds without KUnit (see "Found while testing" for the KUnit build). The only gigalocker change was the enclave rewriting a shared root record (kind 1).
• KUnit: ran at insmod on the J713. All 11 apple_sep suites passed: 124 cases, including the three new J713 cases, with 0 failures and 0 skips. The kit kernel has CONFIG_KUNIT=m, so the module was built with its suites enabled and kunit was loaded with enable=1.
• DT: dtc 1.7.2 builds t8132-j713.dtb and t8132-j715.dtb with no warnings. The decompiled spi2 and sensor nodes match the live overlay property for property. The one difference is the controller compatible: the kit's spi-apple lacks hardware chip-select timing, so the run bound a copy of this tree's driver under a private compatible.

apple_sep 3aa600000.sep: SEP platform profile: T8132/J713
apple_sep: xART guard level 1: 9 session records exist, 0 created by Linux; the other 9 are protected
apple_sep 3aa600000.sep: sensor: SESSION_SHARE status 0x16; loading FDR MSRk
apple_sep 3aa600000.sep: Touch ID: restored 1 enrolled identity/identities; enrolment survived reboot

Found while testing (existing code, not changed here)

When APPLE_SEP_KUNIT_TEST is enabled, apple_sep_xart_guard calls Guard::check() on its test guards. Each refusal in a test also calls crate::diag::xart_guard_refused(), which counts it in the driver's global refusal counter. After the suites run at insmod, diag/xart_guard_refusals reads 13 and diag/matching reads blocked. Meanwhile diag/touchid is ready, matching works, and no enclave write was refused. All 13 refusal messages fall between the suite's KTAP version 1 line and ok 1 apple_sep_xart_guard.

A readiness check that trusts diag/matching would turn Touch ID off on a kernel built with the tests. One possible fix is to skip the diag call under kernel::kunit::in_kunit_test(). That belongs in its own change, so it is not included here.

Not tested

• Keybag creation with the guard on. This Mac's identity keybag was created earlier by a development build with xart_guard=0. Under guard 2, the enclave's rewrite of the kind-2 shared root was refused. Under guard 1 it then rewrote a session record that predates Linux, which was also refused. integration/aurora has since added a first-setup window (1f45121, 5447fa2), which this branch does not include. A fresh J713 setup with the guard on has not been run.
• In-tree build. The driver was built only as the 7.1.9 port, not in this tree.
• Booting the in-tree t8132-j713.dtb. The hardware run used the kit DTB plus an overlay.
• rustfmt and dt_binding_check, which were not available.
• The data-ready interrupt; the driver polls.
• Login through fprintd/PAM, and suspend with the SEP active.
• Re-running J715. This branch adds only a new variant and a new detect() branch.

Merge Danger

Door: two-way

Blast Radius: J713 only. The profile is selected only on apple,j713, and J715 and the other profiles are unchanged. In t8132.dtsi, spi2 and the sensor are disabled; only t8132-j713.dts enables them. On a J713 without apple_sep, spi-apple binds spi2 and the sensor node has no driver, as on J613. As on J715, the SEP nodes stay disabled and the sep alias is not set.

Private data: none in the patches. msrk-j713.bin and mesacal-j713.bin are per-machine files supplied at provisioning.

Assisted-by: Claude:claude-opus-5-5