[satchlj]

Stacked on #962 (port of omacom/linux-aurora#234); review that first.

Keep the T8122 transport and biometric v4 ABI. Require the forwarded identity and xART guard for writable J613 26.6.2 attachment, fail closed on store/index errors, and expose passive selected-policy diagnostics. Retain Aurora’s os_identity selector and existing defaults for other machines.

Port of omacom/linux-aurora#345. Depends on the port of omacom/linux-aurora#234; use the stack base above to review this layer. The original PR remains untouched.

Validation: arm64 defconfig + asahi.config, Image/modules/DTBs with BTF and KUnit enabled, LLVM 18/Rust 1.85.0, passed at stack top #345 (2565987465a2), which includes this branch. The validated integration base is b500668. QEMU loaded the test-bearing modules successfully with no additional failures. The combined run retains four pre-existing SEP store failures (plus their suite aggregate), reproduced on the unmodified Aurora base. The unmodified pinned base also crashes in apple-av-audio-lifetime/av_lifetime_devres_order; that unrelated audio suite is explicitly excluded. All tests added by these ports run through KUnit debugfs on Cortex-A76. This is not a fully green or complete-tree KUnit run. Identity, reader/caller, selected-policy, sensor, enrol and orphan-recovery fixtures passed normally and with optimized Python. No 7.3 hardware boot or deployment has been performed.

[satchlj]

@DjDeveloperr @RyanTheTide ready for your regression testing. It hasn't been boot-tested on J613 with 7.3 yet; I'll post the result here when I have it.

[satchlj]

J613 boot result on 7.3 (rubra, M3 MacBook Air 13", macOS 26.6.2 / 25G83 firmware), 2026-11-05.

• Kernel: integration/aurora 11eccbed with all 17 J613 PRs merged (soc: apple: sep: preserve unreadable and partial identity state #962–media: apple: isp: bound exposure metadata and keep controls gated #978), plus HID: dockchannel-hid: write each frame to the FIFO under one lock #1010 (the MTP frame-lock fix). Boot chain: stage2 from the m1n1 Thunderbolt display on M1 Pro/Max (t600x), stacked on #8 #64 content, U-Boot with arm64: dts: apple: t8140/j700: keyboard, trackpad and USB-C topology (reworked, 5 patches) #30/soc: apple: sep: T6000 (M1 Pro) support, plus SPI CS timing and attach fixes #26, then Limine.
• Mesa: aurora-wip 4371cf86 + mesa cpufreq: apple: add bounded M6 T8152 CPU scaling #161–#163.
• Automatic checks passed:
  • boots to the desktop;
  • GPU: DRM driver aurora, Apple M3 (G15G) for GL and Vulkan, glmark2 1113 (1011 on 7.2.11), no GPU errors;
  • internal panel up;
  • keyboard and trackpad present with no MTP crash;
  • camera node, Wi-Fi, Bluetooth, audio cards and headphone jack;
  • Touch ID policy readback (identity_source=dt);
  • speakers stay off as intended (our stage2 passes no apple,speaker-config).
• Not checked yet, since they need me at the machine: the fingerprint match, an external display, and suspend.