[erikwb]

Touch ID on the J713 (M4 MacBook Air) through the SEP driver: enrol, match, and restore across reboots.

What the J713 needs

Its SoC side is J613's: a warm-attach enclave shared with macOS, the variant-5 key store, and the BIT(40) DART alias. Its Mesa sensor is J700's generation, though: 0x3356 ("V3" in the ADT), not J613's 0x3352. A J613-style profile attaches and provisions the keybag, but the enclave then refuses the R3 session (SESSION_SHARE status 0x16) on every attempt. The sensor's factory calibration is also an FSC2 image, as on J700. So the J713 profile takes J613's SoC fields and J700's sensor protocol: SPI mode 2, the nonce session, and a signed root key.

Patches

1. dt-bindings: add apple,t8132-spi. It's the T8103 design, as on T8140.
2. t8132.dtsi: add the SEP, its mailbox and DART, and SPI2 with the Mesa node, all disabled, taken from the ADT. The SEP driver enables the SEP and its DART itself, with a changeset at module init; a board enables the mailbox and SPI2. Two details differ from T8122:
   • The SEP DART's window is 0x20000. Its stale-exception drain reads per-stream registers past 0x4000; with a 0x4000 window the DART probe oopses.
   • SPI2 runs from the 24 MHz reference clock, as on T8140. With T8122's 200 MHz rate, the divider for 8 MHz produced about 1 MHz, so register reads worked but frame reads timed out (SPI transfer failed: -110).
3. sep: the J713 profile. Only apple,j713 is matched; the other T8132 Macs haven't been read. Profile selection becomes a pure select(), so the KUnit tests can check that a bare T8132, J613 on a T8132, or J713 claimed on a T8122 is refused while J613, J700 and J616s keep their profiles.
4. t8132-j713: enable the SEP mailbox and the sensor. Power is on NUB GPIO 28, data-ready on AP GPIO 199, both from the ADT. Its firmware-name names the calibration and the signed root key, which the driver now reads from the device tree (cd2cdc5).

Boot chain and userspace

• Boot chain: the driver refuses to attach without local-policy-manifest and iboot-manifest on the SEP node, as intended. m1n1 publishes them once its DTB has the sep alias this adds, and U-Boot's J713 importer carries them into the per-kernel tree (arm: apple: carry the J713 SEP boot manifests into the OS tree u-boot#14, which needs nvme: apple: add J700 T8140 ANS ownership and reset #15). The whole route has run on J713: a boot.bin of m1n1 + this series' DTBs + U-Boot ASoC: apple: T8140 (J700) AOP audio and macaudio routing (reworked, 12 patches) #13/j416s: DisplayPort over Thunderbolt (T602X USB4 DP tunnel) #14/nvme: apple: add J700 T8140 ANS ownership and reset #15, booting a per-kernel DTB with no manifests, delivered both, byte-identical to ADT-hash-verified copies, and Touch ID worked.

• Root key and calibration: these are this Mac's own factory records, resealed the way aurora-installer builds them for the J700:

  • apple/msrk-j713.bin;
  • apple/mesacal-j713.bin, the FSC2 resealed, since the enclave refuses the bare image here too.

  The installer collects these only for the J700 today; Collect the Touch ID root key and sealed calibration on J713 (M4 MacBook Air) aurora-installer#38 describes what the J713 needs.

• Two-entry firmware-name: the sensor node names both files, so the Touch ID helper must read firmware-name as a string list. The distro helpers do from alarm-aurora 6889700, fedora-aurora 87f9001 and nixos-aurora 37c604a (aurora-touchid-setup). An older prepare-sep-calibration rejects the name and skips fprintd, so this should land together with or after packages that carry those commits.

Testing

• Hardware: J713 on macOS 26.6.2 (25G83), with this series on top of arm64: keep J713 GPU/DCP non-coherent when CLIDR_EL1.LoC == 0 (fixes J713 graphics on 7.3) #429/cpuidle: apple: add T8132 and enable it on J713 (s2idle groundwork) #432/soc: apple: aop: T8132 (M4 MacBook Air) AOP and microphones #434/ASoC: apple: J713 (M4 MacBook Air) headphone jack on the AOP (depends on #434) #437/ASoC: apple: J713 (M4 MacBook Air) speakers on the AOP (depends on #437) #439/J713 (M4 MacBook Air): suspend-to-idle #449/J713: G16 performance governor, and the PMP idle floor it needs #455:

  • attach;
  • keybag provisioning, with xart_guard 1 and no record refused;
  • enrolment through fprintd-enroll (10 stages);
  • fprintd-verify match;
  • restore and match after a reboot, through aurora-sep.service;
  • lock-screen unlock through pam_fprintd.

  The root key loaded under its J713 name with no J700 file present.

• Checks: checkpatch --strict is clean on all five patches. dt_binding_check passes for apple,spi, apple,sep and apple,mesa-fingerprint. The J713 dtbs_check adds nothing new. The tree builds with APPLE_SEP=m plus APPLE_SEP_KUNIT_TEST and no new warnings. rustfmt is clean for profile.rs, and the series adds no rustfmt findings to sbio.rs.

• KUnit: arm64 16K under qemu virt, all SEP suites: 133/133 pass, including apple_sep_profile 7/7 and apple_sep_dart_window 2/2.

Rebased onto 23827fe (2026-10-30). The base now takes the root-key name from the sensor node's second firmware-name entry (cd2cdc5). That replaces the old patch 3, a per-profile root-key name, which is dropped, so the series is four patches. The J713 device tree names apple/msrk-j713.bin instead. The J713 profile is merged with the base's J616s profile, and the J616s selection now runs through select() with a test case. On the new base:

• KUnit: 137/138 SEP tests pass, with 1 policy skip;
• checkpatch --strict and rustfmt are clean;
• dtbs_check gives the same 11 diagnostics as the base on all six T8132 DTBs.

On J713, a SEP module with the base's device-tree lookup, without the old profile name, plus the new device tree restored the enrolment after a reboot. fprintd-verify then matched.

[RyanTheTide]

The profile selection is restricted to both apple,t8132 and apple,j713. The existing J700/T8140 and J613/T8122 branches keep their selection order. J713 inherits J613's warm attach, variant-5 key store, wide DMA mask, BIT(40) alias and guarded persistent state; its overrides select the V3 sensor, SPI mode 2, nonce session and J713 root-key filename.

There is one shared execution-path change: sensor_nonce_session() now requests profile.root_key instead of the fixed J700 name. J700 retains that exact filename, while J613, M1 Pro and M2 retain non-nonce profiles with no root-key request. The key-store encoding, DART alias calculation and calibration parser are unchanged. This still needs a Neo Touch ID boot using an existing enrolment, match only, and an M1 Pro check. No re-enrolment, reset or OS-identity change is part of that gate.

Please complete the per-kernel DT activation. The new SEP and SEP DART nodes are disabled in t8132.dtsi, and this board patch enables only SPI2/Mesa. U-Boot #14 copies the two manifests but preserves static status, and its ordinary device-enable list does not include SEP. That combination leaves the per-kernel SEP unavailable. Put the qualified J713 activation policy in its board tree and test the actual control-DTB to per-kernel handoff. Also, sep_mbox currently has no disabled status, so it becomes enabled on every T8132 board despite the description saying all these additions are disabled; keep the unread boards inactive.

Add T8132 and root-key/nonce consistency to the profile contract tests, including refusal of an unqualified T8132 board. The contributor's enrol, match and reboot results are useful J713 evidence. Deployment also needs this Mac's own installer-prepared root key and sealed calibration; the installer currently collects those only for J700.

The software gates are queued through an ordinary buildslot. I will update this same comment with the exact build and test results. No hardware test was performed in this review.

Merge after the reviewed common train, with an enabled SEP control DTB and U-Boot #15 before #14 for the per-kernel route; the source tree with manifests exceeds the old importer limit. Preserve the existing enrolments for the required Neo and M1 Pro regression checks. Keep the affected calibration-preparation package from overwriting the sealed calibration before those boots.

[erikwb]

Updated (b6674505, rebased on 421e314):

• sep_mbox: now disabled in t8132.dtsi; the J713 board enables it. SPI2 and Mesa were already disabled in the dtsi and enabled by the board.
• Profile tests: selection is now a pure select(), and detect() calls it on the live tree. New KUnit cases check that a bare T8132, J613 on a T8132, and J713 claimed on a T8122 are refused, while J613/T8122 and J700/T8140 keep their profiles. Every profile's root_key must match its nonce_session, with J700 keeping apple/msrk-j700.bin. T8132 must have J700's sensor ID, mode 2, and J613's shmem, guard and DART window, and it's added to the BIT(40) window test. All SEP suites pass on arm64 16K under qemu: 133/133, apple_sep_profile 7/7.

Activation: the SEP and SEP DART don't need board enabling. dt::enable_sep_and_dart() brings both out of disabled with a changeset at module init, as on the other profiles. Only the mailbox and SPI2 come from the board. The control-DTB to per-kernel route has now run on J713. The boot.bin was m1n1 + this series' DTBs + U-Boot #13/#14/#15, booting a per-kernel DTB carrying no manifests:

• both manifests arrived on the SEP node, byte-identical to copies checked against the ADT's secure-boot-hashes;
• m1n1 reserved sep-firmware;
• the driver attached, restored the existing enrolment and matched;
• Wi-Fi, display, GPU and audio were unchanged.

U-Boot #14 now also removes a stale manifest the control tree doesn't publish. #15 raises the importer's 128 KiB source bound, which the SEP-carrying control tree (136,997 bytes) exceeded on the first attempt.

Records: the J713's records are filed as aurora-installer#38. alarm-aurora#26 keeps the sealed calibration from being overwritten; I'm tightening its validation as you asked there.

The Neo and M1 Pro regression boots need hardware I don't have.