From d3f6486fd3fddea01310e834b7e261e339de7da4 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:18:41 -0400
Subject: [PATCH 01/14] drm/apple: accept automatic PMGR activity in J613
 coldplug

Use the PMGR provider active-state predicate when checking inherited
display power. DISP_CPU can report ACTUAL=4 with AUTO_ENABLE and
TARGET=15 after automatic clock gating. Keep the checks read-only and
preserve all other handoff requirements.

Test all actual, target and automatic-state combinations and the
captured J613 state through the production helper.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/apple/j613_dcp_activate.c |  9 ++++-
 tools/asahi/run-host-tests.py             |  1 +
 tools/asahi/test-j613-dcp-power.py        | 45 +++++++++++++++++++++++
 3 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 tools/asahi/test-j613-dcp-power.py

diff --git a/drivers/gpu/drm/apple/j613_dcp_activate.c b/drivers/gpu/drm/apple/j613_dcp_activate.c
index 6e20a5afc914c..6d0a262069469 100644
--- a/drivers/gpu/drm/apple/j613_dcp_activate.c
+++ b/drivers/gpu/drm/apple/j613_dcp_activate.c
@@ -40,6 +40,13 @@ bool apple_t8122_25g83_board(void)
 	return ok;
 }
 
+/* Match the PMGR provider: automatic domains can be clock-gated while active. */
+static bool j613_power_state_active(u32 state)
+{
+	return FIELD_GET(GENMASK(7, 4), state) == 15 ||
+	       ((state & BIT(28)) && FIELD_GET(GENMASK(3, 0), state) == 15);
+}
+
 /* These are DT domain nodes, carrying the PMGR offsets, not copied registers. */
 static int j613_power_ready(void)
 {
@@ -82,7 +89,7 @@ static int j613_power_ready(void)
 			return -ENOMEM;
 		state = readl(pmgr + offset);
 		iounmap(pmgr);
-		if (FIELD_GET(GENMASK(7, 4), state) != 15)
+		if (!j613_power_state_active(state))
 			return -EBUSY;
 	}
 	return 0;
diff --git a/tools/asahi/run-host-tests.py b/tools/asahi/run-host-tests.py
index 5c5ca93c68594..00b9d65f68575 100755
--- a/tools/asahi/run-host-tests.py
+++ b/tools/asahi/run-host-tests.py
@@ -53,6 +53,7 @@ def mutations(flag, names, base, expect=KILL):
 
 # test file -> [(arguments, expectation)]. '{out}' is a fresh directory.
 ASAHI_TESTS = {
+    'test-j613-dcp-power.py': [([], PASS)],
     'aop-als-channel-tests.py': [([], PASS)],
     'mtp-pm-tests.py': [(out(), PASS),
                          (out() + ['--old-transport', '4db3a5a22c43'], PASS)],
diff --git a/tools/asahi/test-j613-dcp-power.py b/tools/asahi/test-j613-dcp-power.py
new file mode 100644
index 0000000000000..4e93bcc8b1bdb
--- /dev/null
+++ b/tools/asahi/test-j613-dcp-power.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Compile the production J613 PMGR predicate and test all actual/target/auto states."""
+from pathlib import Path
+import os
+import subprocess
+import tempfile
+
+root = Path(__file__).resolve().parents[2]
+source = (root / "drivers/gpu/drm/apple/j613_dcp_activate.c").read_text()
+start = source.index("static bool j613_power_state_active(")
+end = source.index("\n}\n", start) + 3
+stub = r"""
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+typedef uint32_t u32;
+#define BIT(n) (1U << (n))
+#define GENMASK(a,b) (((1U << ((a)-(b)+1))-1) << (b))
+#define FIELD_GET(mask,v) (((v) & (mask)) >> __builtin_ctz(mask))
+"""
+main = r"""
+int main(void) {
+ for (u32 actual = 0; actual < 16; actual++)
+ for (u32 target = 0; target < 16; target++)
+ for (u32 automatic = 0; automatic < 2; automatic++) {
+  u32 word = (actual << 4) | target | (automatic << 28);
+  bool expected = actual == 15 || (target == 15 && automatic);
+  if (j613_power_state_active(word) != expected) return 1;
+ }
+ if (!j613_power_state_active(0x1404024f)) return 2;
+ if (j613_power_state_active(0x0404024f)) return 3;
+ if (j613_power_state_active(0x14040240)) return 4;
+ puts("PASS: 512 PMGR combinations and captured-state regression controls");
+ return 0;
+}
+"""
+with tempfile.TemporaryDirectory() as temporary:
+    path = Path(temporary) / "power.c"
+    path.write_text(stub + source[start:end] + main)
+    for flags in ([], ["-O2"]):
+        exe = str(path.with_suffix(""))
+        subprocess.run([os.environ.get("CC", "cc"), "-Wall", "-Wextra", "-Werror",
+                        *flags, str(path), "-o", exe], check=True)
+        subprocess.run([exe], check=True)

From 31a2f5de22bbcf15668f864183b2c37fec43913b Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 22:17:26 -0400
Subject: [PATCH 02/14] test: vary unrelated bits in J613 PMGR state words

Cross all 512 ACTUAL/TARGET/AUTO combinations with zero, all-set,
alternating and individual unrelated-bit patterns. This verifies that
readiness ignores every bit outside the three PMGR fields.

A temporary ACTUAL mask widened from GENMASK(7, 4) to GENMASK(8, 4)
passes the old cases but fails the new ones at both -O0 and -O2.
Make the unoptimized compiler flag explicit and report failing words.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 tools/asahi/test-j613-dcp-power.py | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/tools/asahi/test-j613-dcp-power.py b/tools/asahi/test-j613-dcp-power.py
index 4e93bcc8b1bdb..3bc1a3379c253 100644
--- a/tools/asahi/test-j613-dcp-power.py
+++ b/tools/asahi/test-j613-dcp-power.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # SPDX-License-Identifier: GPL-2.0-only OR MIT
-"""Compile the production J613 PMGR predicate and test all actual/target/auto states."""
+"""Compile the production J613 PMGR predicate and test PMGR fields and unrelated bits."""
 from pathlib import Path
 import os
 import subprocess
@@ -21,24 +21,36 @@
 """
 main = r"""
 int main(void) {
+ /* Only ACTUAL[7:4], TARGET[3:0] and AUTO_ENABLE[28] affect readiness. */
+ const u32 unrelated_mask = ~(GENMASK(7, 0) | BIT(28));
+ u32 unrelated[32] = {0, unrelated_mask,
+                      0xaaaaaaaaU & unrelated_mask,
+                      0x55555555U & unrelated_mask};
+ unsigned int count = 4;
+ for (unsigned int bit = 8; bit < 32; bit++)
+  if (bit != 28) unrelated[count++] = BIT(bit);
+ for (unsigned int i = 0; i < count; i++)
  for (u32 actual = 0; actual < 16; actual++)
  for (u32 target = 0; target < 16; target++)
  for (u32 automatic = 0; automatic < 2; automatic++) {
-  u32 word = (actual << 4) | target | (automatic << 28);
+  u32 word = unrelated[i] | (actual << 4) | target | (automatic << 28);
   bool expected = actual == 15 || (target == 15 && automatic);
-  if (j613_power_state_active(word) != expected) return 1;
+  if (j613_power_state_active(word) != expected) {
+   fprintf(stderr, "PMGR state 0x%08x: expected active=%d\n", word, expected);
+   return 1;
+  }
  }
  if (!j613_power_state_active(0x1404024f)) return 2;
  if (j613_power_state_active(0x0404024f)) return 3;
  if (j613_power_state_active(0x14040240)) return 4;
- puts("PASS: 512 PMGR combinations and captured-state regression controls");
+ puts("PASS: 13824 PMGR combinations and captured-state regression controls");
  return 0;
 }
 """
 with tempfile.TemporaryDirectory() as temporary:
     path = Path(temporary) / "power.c"
     path.write_text(stub + source[start:end] + main)
-    for flags in ([], ["-O2"]):
+    for flags in (["-O0"], ["-O2"]):
         exe = str(path.with_suffix(""))
         subprocess.run([os.environ.get("CC", "cc"), "-Wall", "-Wextra", "-Werror",
                         *flags, str(path), "-o", exe], check=True)

From dfb9d8b576a0b6c0364990c4f3487737413524bc Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:38:58 -0400
Subject: [PATCH 03/14] drm/asahi: describe the T8122 extended firmware profile
 and owned IO records

Separate firmware identity, HAL metadata and VM bounds from physical
G15G stream selection. Add checked root and owned IO descriptor encoders.
Introduce slot 28 at SGX+0xd50000 with a production-writer regression;
the shifted T8132 bank is never introduced. Keep VM padding zero.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 MAINTAINERS                                 |   2 +
 drivers/gpu/drm/apple/j613_dcp_activate.c   |   9 +-
 drivers/gpu/drm/asahi/m3/m3_client.rs       |  17 +-
 drivers/gpu/drm/asahi/m3/m3_drm.rs          |  20 +-
 drivers/gpu/drm/asahi/m3/m3_firmware.rs     | 146 +++-
 drivers/gpu/drm/asahi/m3/m3_init_26.rs      | 275 +++++++
 drivers/gpu/drm/asahi/m3/m3_init_layout.rs  | 139 +++-
 drivers/gpu/drm/asahi/m3/m3_mmio_26.rs      | 265 +++++++
 drivers/gpu/drm/asahi/m3/m3_profile.rs      |  69 ++
 drivers/gpu/drm/asahi/m3/mod.rs             |   4 +
 drivers/gpu/drm/asahi/m3/t8122_admission.rs |  49 +-
 tools/asahi/m3-firmware-tests.rs            |  14 +
 tools/asahi/m3-runtime-tests.rs             |   9 +
 tools/asahi/m3-uapi-fixture.c               | 363 +++++++++
 tools/asahi/m3-uapi-tests.rs                | 832 ++++++++++++++++++++
 tools/asahi/run-host-tests.py               |   3 +
 tools/asahi/test-j613-dcp-power.py          |  57 ++
 tools/asahi/test-m3-mailbox.py              |  11 +
 tools/asahi/test-m3-uapi.py                 |  73 ++
 19 files changed, 2333 insertions(+), 24 deletions(-)
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_init_26.rs
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_profile.rs
 create mode 100644 tools/asahi/m3-firmware-tests.rs
 create mode 100644 tools/asahi/m3-uapi-fixture.c
 create mode 100644 tools/asahi/m3-uapi-tests.rs
 create mode 100644 tools/asahi/test-j613-dcp-power.py
 create mode 100755 tools/asahi/test-m3-uapi.py

diff --git a/MAINTAINERS b/MAINTAINERS
index e0a0070243ae6..dbe76f9d15eaf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2789,8 +2789,10 @@ F:	tools/asahi/apple-pwm-pm-tests.py
 F:	drivers/reset/reset-apple-cio.c
 F:	drivers/rtc/rtc-macsmc.c
 F:	drivers/soc/apple/*
+F:	tools/asahi/m3-uapi-*
 F:	tools/asahi/pmp-bootargs-tests.rs
 F:	drivers/spi/spi-apple-test.c
+F:	tools/asahi/test-m3-uapi.py
 F:	drivers/spi/spi-apple.c
 F:	drivers/spmi/spmi-apple-controller.c
 F:	drivers/thermal/apple-pmp*
diff --git a/drivers/gpu/drm/apple/j613_dcp_activate.c b/drivers/gpu/drm/apple/j613_dcp_activate.c
index 6e20a5afc914c..6d0a262069469 100644
--- a/drivers/gpu/drm/apple/j613_dcp_activate.c
+++ b/drivers/gpu/drm/apple/j613_dcp_activate.c
@@ -40,6 +40,13 @@ bool apple_t8122_25g83_board(void)
 	return ok;
 }
 
+/* Match the PMGR provider: automatic domains can be clock-gated while active. */
+static bool j613_power_state_active(u32 state)
+{
+	return FIELD_GET(GENMASK(7, 4), state) == 15 ||
+	       ((state & BIT(28)) && FIELD_GET(GENMASK(3, 0), state) == 15);
+}
+
 /* These are DT domain nodes, carrying the PMGR offsets, not copied registers. */
 static int j613_power_ready(void)
 {
@@ -82,7 +89,7 @@ static int j613_power_ready(void)
 			return -ENOMEM;
 		state = readl(pmgr + offset);
 		iounmap(pmgr);
-		if (FIELD_GET(GENMASK(7, 4), state) != 15)
+		if (!j613_power_state_active(state))
 			return -EBUSY;
 	}
 	return 0;
diff --git a/drivers/gpu/drm/asahi/m3/m3_client.rs b/drivers/gpu/drm/asahi/m3/m3_client.rs
index dff1af0783965..c1a07d61120d1 100644
--- a/drivers/gpu/drm/asahi/m3/m3_client.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_client.rs
@@ -35,7 +35,7 @@ use crate::{
 const AGX3_PARAMS_SIZE: u64 =
     (core::mem::offset_of!(uapi::drm_asahi_params_global, gpu_hal_generation)
         + core::mem::size_of::<u32>()) as u64;
-const _: () = assert!(AGX3_PARAMS_SIZE == 600);
+const _: () = assert!(AGX3_PARAMS_SIZE == super::m3_profile::PARAMS_REQUIRED);
 
 /// Refused clients that are logged per boot; later refusals only count.
 const REFUSALS_LOGGED: u32 = 16;
@@ -45,10 +45,19 @@ static REFUSALS: AtomicU32 = AtomicU32::new(0);
 /// [`AGX3_PARAMS_SIZE`] bytes (so it knows this GPU runs AGX3 command streams), and pass
 /// VM_CREATE flags 0 (legacy HAL). `size` is the largest GET_PARAMS size the file asked for.
 pub(crate) fn admit_vm(device: &kernel::device::Device, size: u64, flags: u32) -> Result {
+    admit_vm_for(device, super::m3_profile::Profile::Legacy, size, flags)
+}
+
+pub(crate) fn admit_vm_for(
+    device: &kernel::device::Device,
+    profile: super::m3_profile::Profile,
+    size: u64,
+    flags: u32,
+) -> Result {
     {
         // The positive acknowledgement of the command ABI (7.1.12 `g16_profile::client_admitted`):
         // GET_PARAMS coverage, and VM_CREATE flags 0 on the legacy-HAL M3 runtime.
-        if size >= AGX3_PARAMS_SIZE && flags == 0 {
+        if profile.vm_acknowledged(size, flags) {
             return Ok(());
         }
         let refusals = REFUSALS.fetch_add(1, Ordering::Relaxed).saturating_add(1);
@@ -64,11 +73,13 @@ pub(crate) fn admit_vm(device: &kernel::device::Device, size: u64, flags: u32) -
             };
             dev_info!(
                 device,
-                "M3: refusing a VM for {}[{}]: it asked GET_PARAMS for {} of the {} parameter bytes, so it cannot know this GPU runs AGX3 command streams; M3-aware userspace is needed{}\n",
+                "M3: refusing a VM for {}[{}]: GET_PARAMS bytes={}/{} HAL={} flags={:#x}{}\n",
                 name,
                 task.group_leader().pid(),
                 size,
                 AGX3_PARAMS_SIZE,
+                profile.hal(),
+                flags,
                 last
             );
         }
diff --git a/drivers/gpu/drm/asahi/m3/m3_drm.rs b/drivers/gpu/drm/asahi/m3/m3_drm.rs
index dc8f1a074e809..796abc7793f90 100644
--- a/drivers/gpu/drm/asahi/m3/m3_drm.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_drm.rs
@@ -86,6 +86,7 @@ pub(crate) struct Backend {
     core_mask: u64,
     max_frequency_khz: u32,
     soc: &'static crate::m3::m3_soc::Soc,
+    profile: super::m3_profile::Profile,
     _progress: Pin<KBox<kernel::debugfs::File<ProgressView>>>,
     _activity: Pin<KBox<kernel::debugfs::File<ActivityView>>>,
     _memory: Pin<KBox<kernel::debugfs::File<crate::m3::agx_memory_stats::View>>>,
@@ -125,6 +126,7 @@ impl Backend {
         let firmware = crate::m3::m3_firmware::identify_loaded(pdev, soc, resources, experiment)
             .inspect_err(refused("the firmware identity"))?;
         dev_info!(pdev.as_ref(), "M3: firmware identity accepted\n");
+        let profile = firmware.profile();
         // InitData source and contents, before any GPU register access.
         let contents = crate::m3::m3_adt_config::Contents::select(pdev, &firmware, soc, experiment)
             .inspect_err(refused("the InitData contents"))?;
@@ -160,7 +162,7 @@ impl Backend {
         let completion_work = crate::m3::m3_completion::Completion::new(shared.clone())?;
         // From here on every failure drops the backend, which stops the runtime.
         let backend = Arc::new(Self { shared, health, ids: gpu::SequenceIDs::default(),
-            scheduler, core_mask, max_frequency_khz, soc,
+            scheduler, core_mask, max_frequency_khz, soc, profile,
             _progress: progress, _activity: activity, _memory: memory, _timing: timing,
             _completion: completion, _overlap: overlap }, GFP_KERNEL)?;
         // The completion worker services this runtime from now on; the RTKit callbacks and
@@ -208,7 +210,9 @@ impl gpu::Gpu for Backend {
         }
         params.max_frequency_khz = self.max_frequency_khz;
         params.usc_generation = 3;
-        params.gpu_hal_generation = hw::GpuHalGeneration::Legacy as u32;
+        params.gpu_hal_generation = self.profile.hal();
+        params.max_commands_per_submission = super::agx_uapi::UAPI_MAX_HARDWARE_COMMANDS;
+        params.max_attachments = super::agx_uapi::UAPI_MAX_ATTACHMENTS as u32;
         Ok(())
     }
     fn supports_vm_status(&self) -> bool { true }
@@ -217,10 +221,12 @@ impl gpu::Gpu for Backend {
     fn feature_flags(&self) -> u64 {
         let mut flags = uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_VM_STATUS as u64
             | uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_SCHEDULED_QUEUES as u64;
-        if self.soc.features.fragment_dependency && crate::m3::m3_params::early_tiling() {
+        if self.profile == super::m3_profile::Profile::Legacy
+            && self.soc.features.fragment_dependency && crate::m3::m3_params::early_tiling() {
             flags |= uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_FRAGMENT_DEPENDENCY as u64;
         }
-        if self.soc.features.compute_wide_visibility {
+        if self.profile == super::m3_profile::Profile::Legacy
+            && self.soc.features.compute_wide_visibility {
             flags |= uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_COMPUTE_WIDE_VISIBILITY as u64;
         }
         flags
@@ -233,17 +239,17 @@ impl gpu::Gpu for Backend {
     }
     fn uat_geometry(&self) -> mmu::UatGeometry { mmu::UatGeometry { ias: 42, oas: 42 } }
     fn user_range(&self) -> Range<u64> {
-        mmu::UAT_PGSZ as u64..crate::m3::initdata::RUNTIME_UNKNOWN_PAGE
+        mmu::UAT_PGSZ as u64..self.profile.user_end()
     }
     /// The dummy page sits where InitData tells the firmware it is (unk_30), as on 7.1.12; the
     /// 42-bit geometry's own unk_page() is a different address.
     fn unknown_page(&self) -> u64 {
-        crate::m3::initdata::RUNTIME_UNKNOWN_PAGE
+        self.profile.user_end()
     }
     fn tracked_submission(&self) -> bool { true }
     /// Only M3-aware userspace may create a VM (7.1.12's per-file client gate).
     fn admit_vm(&self, dev: &kernel::device::Device, params_size: u64, flags: u32) -> Result {
-        crate::m3::m3_client::admit_vm(dev, params_size, flags)
+        crate::m3::m3_client::admit_vm_for(dev, self.profile, params_size, flags)
     }
     fn new_vm(&self, range: Range<u64>) -> Result<mmu::Vm> {
         Option::as_mut(&mut *self.shared.lock()).ok_or(ENODEV)?.new_vm(self.ids.vm.next(), range)
diff --git a/drivers/gpu/drm/asahi/m3/m3_firmware.rs b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
index 0d2835174c677..c9aa45cc02864 100644
--- a/drivers/gpu/drm/asahi/m3/m3_firmware.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
@@ -62,6 +62,19 @@ pub(crate) static KNOWN_IMAGES_T8122: [KnownImage; 1] = [KnownImage {
     initdata_magic: Some(G15_V14_8_3_INITDATA),
 }];
 
+/// Image record for the extended format. The SoC's runtime selection does not use it yet.
+pub(crate) static T8122_IMAGES_26: [KnownImage; 1] = [KnownImage {
+    name: "T8122 C0 firmware-compat 26.6.2",
+    uuid: None,
+    stkg_sha256: Some([
+        0x3a, 0x6b, 0x8b, 0x5e, 0x83, 0x38, 0x4d, 0x5c,
+        0xc1, 0x92, 0x9d, 0x91, 0xb6, 0x36, 0x40, 0xfe,
+        0xe8, 0xf5, 0x52, 0xb5, 0x10, 0x8c, 0x4e, 0xa6,
+        0x20, 0xbe, 0xdb, 0x7b, 0xbc, 0xa0, 0x31, 0x64,
+    ]),
+    initdata_magic: Some(0x0c89_c357_8392_04b8),
+}];
+
 /// The same T8122 image for the start experiment (`t8122_start`, only with
 /// `asahi.t8122_start=1`), where `asahi.t8122_initdata_version` may replace the version.
 pub(crate) static KNOWN_IMAGES_T8122_EXPERIMENT: [KnownImage; 1] = [KnownImage {
@@ -117,6 +130,10 @@ pub(crate) struct Layout {
     /// Offset of the 8-byte tag that precedes the 8 per-boot bytes zeroed before hashing.
     pub(crate) entropy_tag_offset: usize,
     pub(crate) entropy_tag: [u8; 8],
+    /// An additional independent boot value, when required by this image.
+    extra_boot_value: Option<(usize, [u8; 8])>,
+    /// Expected boot-table location and byte count in the image header.
+    boot_table: Option<(u32, u32)>,
     /// The firmware version, for logs.
     pub(crate) version: &'static str,
 }
@@ -127,6 +144,8 @@ pub(crate) static T6030_LAYOUT: Layout = Layout {
     vas: [0xffff_fc00_0000_0000, 0xffff_fc00_0005_c000],
     entropy_tag_offset: 0x58e88,
     entropy_tag: *b"GKTS\x08\x00\x00\x00",
+    extra_boot_value: None,
+    boot_table: None,
     version: "RTKit-2419.140.12.release",
 };
 
@@ -137,23 +156,73 @@ pub(crate) static T8122_LAYOUT: Layout = Layout {
     vas: [0xffff_fc00_0000_0000, 0xffff_fc00_0006_4000],
     entropy_tag_offset: 0x5d54a,
     entropy_tag: *b"GKTS\x08\x00\x00\x00",
+    extra_boot_value: None,
+    boot_table: None,
     version: "RTKit-2419.140.12.release",
 };
 
 pub(crate) const TEXT_SHA256: [u8; 32] = [
     0x11, 0xe4, 0x9f, 0x75, 0xb, 0x67, 0x1a, 0x2b, 0x13, 0xd0, 0x92, 0xdb, 0x1c, 0xbc, 0xa3, 0xa8, 0x77, 0x55, 0x86, 0xd6, 0xb1, 0xe3, 0xaa, 0xe8, 0xa6, 0xa4, 0x64, 0xa7, 0x80, 0x2, 0x93, 0xd5];
 
+/// T8122 C0, firmware-compat 26.6.2. Selection remains separate from runtime admission.
+pub(crate) static T8122_LAYOUT_26: Layout = Layout {
+    text_size: 393216,
+    data_size: 1228800,
+    vas: [0xffff_fc00_0000_0000, 0xffff_fc00_0006_0000],
+    entropy_tag_offset: 380492,
+    entropy_tag: *b"GKTS\x08\x00\x00\x00",
+    extra_boot_value: Some((380719, *b"ECAP\x08\x00\x00\x00")),
+    boot_table: Some((380492, 561)),
+    version: "RTKit-3255.160.4.release",
+};
+
 fn normalize_boot_entropy(layout: &Layout, text: &mut [u8]) -> bool {
-    let tag = layout.entropy_tag_offset;
     if text.len() != layout.text_size as usize {
         return false;
     }
-    let Some(end) = tag.checked_add(16) else { return false; };
-    let Some(entropy) = text.get_mut(tag..end) else { return false; };
-    if entropy[..8] != layout.entropy_tag {
-        return false;
+    if let Some((offset, count)) = layout.boot_table {
+        let Some(header) = text.get(0x22c..0x234) else {
+            return false;
+        };
+        if header[..4] != offset.to_le_bytes() || header[4..] != count.to_le_bytes() {
+            return false;
+        }
+        let Some(end) = (offset as usize).checked_add(count as usize) else {
+            return false;
+        };
+        if text.get(offset as usize..end).is_none() {
+            return false;
+        }
+    }
+    let fields = [
+        Some((layout.entropy_tag_offset, layout.entropy_tag)),
+        layout.extra_boot_value,
+    ];
+    // Validate every field before touching even the first boot value.
+    for (offset, tag) in fields.into_iter().flatten() {
+        let Some(end) = offset.checked_add(16) else {
+            return false;
+        };
+        let Some(field) = text.get(offset..end) else {
+            return false;
+        };
+        if field[..8] != tag {
+            return false;
+        }
+        if let Some((base, count)) = layout.boot_table {
+            if offset < base as usize || end > base as usize + count as usize {
+                return false;
+            }
+        }
+    }
+    if let Some((other, _)) = layout.extra_boot_value {
+        if other < layout.entropy_tag_offset + 16 && layout.entropy_tag_offset < other + 16 {
+            return false;
+        }
+    }
+    for (offset, _) in fields.into_iter().flatten() {
+        text[offset + 8..offset + 16].fill(0);
     }
-    entropy[8..].fill(0);
     true
 }
 
@@ -167,6 +236,14 @@ pub(crate) struct Firmware {
 }
 
 impl Firmware {
+    pub(crate) fn profile(&self) -> super::m3_profile::Profile {
+        if core::ptr::eq(self.layout, &T8122_LAYOUT_26) {
+            super::m3_profile::Profile::Extended
+        } else {
+            super::m3_profile::Profile::Legacy
+        }
+    }
+
     pub(crate) const fn version(&self) -> &'static str {
         self.layout.version
     }
@@ -393,4 +470,61 @@ mod tests {
         assert!(!normalize_boot_entropy(&layout, &mut text));
         assert_eq!(text, vec![0xa5; 15]);
     }
+
+    fn image_26() -> Vec<u8> {
+        let mut image = vec![0x5a; 393216];
+        image[0x22c..0x230].copy_from_slice(&380492u32.to_le_bytes());
+        image[0x230..0x234].copy_from_slice(&561u32.to_le_bytes());
+        image[380492..380500].copy_from_slice(b"GKTS\x08\x00\x00\x00");
+        image[380719..380727].copy_from_slice(b"ECAP\x08\x00\x00\x00");
+        image
+    }
+
+    #[test]
+    fn newer_image_masks_only_both_boot_values() {
+        let mut image = image_26();
+        let before = image.clone();
+        assert!(normalize_boot_entropy(&T8122_LAYOUT_26, &mut image));
+        for index in 0..image.len() {
+            let expected = if (380500..380508).contains(&index) || (380727..380735).contains(&index)
+            {
+                0
+            } else {
+                before[index]
+            };
+            assert_eq!(image[index], expected, "byte {index}");
+        }
+    }
+
+    #[test]
+    fn invalid_second_field_or_table_does_not_mask_first_value() {
+        for index in [0x22c, 0x230, 380492, 380496, 380719, 380723] {
+            let mut image = image_26();
+            image[index] ^= 1;
+            let before = image.clone();
+            assert!(!normalize_boot_entropy(&T8122_LAYOUT_26, &mut image));
+            assert_eq!(image, before);
+        }
+        let mut image = image_26();
+        image.pop();
+        let before = image.clone();
+        assert!(!normalize_boot_entropy(&T8122_LAYOUT_26, &mut image));
+        assert_eq!(image, before);
+    }
+
+    #[test]
+    fn extended_record_cannot_replace_legacy_identity() {
+        let newer = &T8122_IMAGES_26[0];
+        let digest = newer.stkg_sha256.unwrap();
+        assert!(newer.accepts_runtime(None, &digest));
+        assert_eq!(newer.initdata_magic, Some(0x0c89_c357_8392_04b8));
+        for index in 0..digest.len() {
+            let mut wrong = digest;
+            wrong[index] ^= 1;
+            assert!(!newer.accepts_runtime(None, &wrong));
+        }
+        assert!(!KNOWN_IMAGES_T8122[0].accepts_runtime(None, &digest));
+        assert!(!newer.accepts_runtime(KNOWN_IMAGES_T8122[0].uuid, &[0; 32]));
+    }
+
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_init_26.rs b/drivers/gpu/drm/asahi/m3/m3_init_26.rs
new file mode 100644
index 0000000000000..f08f16200b070
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_init_26.rs
@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! Allocation and pointer records for the extended M3 initialization format.
+//! Owners supply mapped regions; these builders never allocate or publish DMA.
+
+use super::m3_init_layout::{Error, Region, Root};
+use super::m3_init_storage::{self as storage, Allocation, Initial};
+
+pub(crate) const COUNT: usize = 56;
+pub(crate) const DYNAMIC_STATE: usize = 49;
+pub(crate) const PERFORMANCE_CONTROL: usize = 50;
+pub(crate) const RECOVERY_ACTIVITY: usize = 51;
+pub(crate) const SENSOR_VALUE: usize = 52;
+pub(crate) const RETENTION_STATE: usize = 53;
+pub(crate) const GLOBAL_POOL: usize = 54;
+pub(crate) const GLOBAL_PARAMETERS: usize = 55;
+pub(crate) const RUNTIME_SIZE: usize = 0x4b8;
+pub(crate) const LOG_THREADS: usize = 9;
+pub(crate) const RX_BYTES: usize = 0x48;
+pub(crate) const LOG_PAYLOAD_BYTES: usize = 0xd8;
+
+/// Extend the existing M3 owner indices instead of introducing another owner graph.
+pub(crate) fn allocation(index: usize) -> Result<Allocation, Error> {
+    let size = match index {
+        0..=23 if index % 2 == 0 => 0x30,
+        0..=23 => 0x1800,
+        24 | 26 | 30 | 32 => 0x30,
+        25 => 0x4000,
+        27 | 33 => 0x4800,
+        28 => LOG_THREADS * 0x30,
+        29 => LOG_THREADS * 256 * RX_BYTES,
+        31 => 512 * RX_BYTES,
+        34 => 0x40,
+        35 => 0x3fc0,
+        36 => 0xc8,
+        37 => 0x4000,
+        38 => RUNTIME_SIZE,
+        39 => 0x2658,
+        40 => 0x88,
+        41 => LOG_THREADS * 256 * LOG_PAYLOAD_BYTES,
+        42 => 0xc18,
+        43 => 0x1248,
+        44 => 0xe10,
+        45 => 0xe48,
+        46 => 0x670,
+        47 => 0xeaf0,
+        48 => 0x20,
+        DYNAMIC_STATE | RETENTION_STATE | GLOBAL_POOL | GLOBAL_PARAMETERS => 0x4000,
+        PERFORMANCE_CONTROL => 0x6578,
+        RECOVERY_ACTIVITY => 0x60,
+        SENSOR_VALUE => 4,
+        _ => return Err(Error::Bounds),
+    };
+    // Separate page-aligned owners, with room for the largest receive allocation.
+    // This namespace is disjoint from the existing fixed work and timestamp arenas.
+    Ok(Allocation {
+        address: 0xffff_fc21_0000_0000 + (index as u64) * 0x10_0000,
+        size,
+        gpu_shared: matches!(index, GLOBAL_POOL | GLOBAL_PARAMETERS),
+        initial: Initial::Zero,
+    })
+}
+
+pub(crate) fn cached(index: usize) -> bool {
+    matches!(index, 38 | 39 | 42 | 43 | 44 | PERFORMANCE_CONTROL)
+}
+
+pub(crate) struct PointerGraph<'a> {
+    pub(crate) owners: &'a [Region; COUNT],
+    pub(crate) scratch: Region,
+    pub(crate) pool_alias: u64,
+    pub(crate) parameter_alias: u64,
+}
+
+impl PointerGraph<'_> {
+    /// Check the complete graph, including padded mapping ownership, before encoding it.
+    fn addresses(&self) -> Result<[u64; COUNT], Error> {
+        let mut addresses = [0; COUNT];
+        for (index, owner) in self.owners.iter().enumerate() {
+            let size = allocation(index)?.size;
+            addresses[index] = owner.at(0, size)?;
+            if addresses[index] & 0x3fff != 0
+                || addresses[index] < 0xffff_fc20_0000_0000
+                || addresses[index] >= 0xffff_fc2f_fc00_0000
+            {
+                return Err(Error::Address);
+            }
+            let mapped = (size + 0x3fff) & !0x3fff;
+            let end = addresses[index]
+                .checked_add(mapped as u64)
+                .ok_or(Error::Address)?;
+            if end > 0xffff_fc2f_fc00_0000 {
+                return Err(Error::Address);
+            }
+            for prior in 0..index {
+                let prior_size = (allocation(prior)?.size + 0x3fff) & !0x3fff;
+                if addresses[index] < addresses[prior] + prior_size as u64
+                    && addresses[prior] < addresses[index] + mapped as u64
+                {
+                    return Err(Error::Address);
+                }
+            }
+        }
+        let scratch = self.scratch.at(0, 0x8000)?;
+        let scratch_end = scratch.checked_add(0x8000).ok_or(Error::Address)?;
+        if scratch & 0x3fff != 0 || scratch_end > 0xffff_fc2f_fc00_0000 {
+            return Err(Error::Address);
+        }
+        for (index, address) in addresses.iter().enumerate() {
+            let bytes = (allocation(index)?.size + 0x3fff) & !0x3fff;
+            if scratch < *address + bytes as u64 && *address < scratch_end {
+                return Err(Error::Address);
+            }
+        }
+        for alias in [self.pool_alias, self.parameter_alias] {
+            if alias & 0x3fff != 0 || !(0x70_0000_0000..0x70_0200_0000).contains(&alias) {
+                return Err(Error::Address);
+            }
+        }
+        if self.pool_alias == self.parameter_alias {
+            return Err(Error::Address);
+        }
+        Ok(addresses)
+    }
+
+    pub(crate) fn root(&self, output: &mut [u8]) -> Result<(), Error> {
+        self.addresses()?;
+        Root {
+            region_a: self.owners[storage::REGION_A],
+            runtime: self.owners[storage::RUNTIME_POINTERS],
+            globals: self.owners[storage::GLOBALS],
+            new_a: self.owners[storage::RUNTIME_FLAGS],
+            control: self.owners[storage::CONTROL_REGION],
+            power: self.owners[storage::GLOBALS_POWER],
+        }
+        .encode_26(output, self.owners[DYNAMIC_STATE])
+    }
+
+    pub(crate) fn runtime(&self, output: &mut [u8]) -> Result<(), Error> {
+        let addresses = self.addresses()?;
+        let scratch = self.scratch.at(0, 0x8000)?;
+        let bytes = output.get_mut(..RUNTIME_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        let pointer = |bytes: &mut [u8], offset: usize, value: u64| {
+            bytes[offset..offset + 8].copy_from_slice(&value.to_le_bytes());
+        };
+        pointer(bytes, 0x18, scratch);
+        pointer(bytes, 0x2d0, self.parameter_alias);
+        pointer(bytes, 0x2e0, self.pool_alias);
+        bytes[0x250..0x254].copy_from_slice(&1u32.to_le_bytes());
+        bytes[0x2f8..0x2fc].copy_from_slice(&4u32.to_le_bytes());
+        for (offset, owner) in [
+            (0, storage::HARDWARE_DATA),
+            (0x10, storage::UNKNOWN_PAIR),
+            (0x1c0, 26),
+            (0x1c8, 27),
+            (0x1d0, 28),
+            (0x1d8, 29),
+            (0x1e0, 30),
+            (0x1e8, 31),
+            (0x1f0, 32),
+            (0x1f8, 33),
+            (0x200, storage::FWLOG_PAYLOAD),
+            (0x254, storage::UNKNOWN_C0),
+            (0x25c, storage::UNKNOWN_C1),
+            (0x264, storage::UNKNOWN_C3),
+            (0x26c, RECOVERY_ACTIVITY),
+            (0x2d8, GLOBAL_PARAMETERS),
+            (0x2e8, GLOBAL_POOL),
+            (0x469, PERFORMANCE_CONTROL),
+        ] {
+            pointer(bytes, offset, addresses[owner]);
+        }
+        for channel in 0..13 {
+            let offset = 0x20 + channel * 0x20;
+            let state = addresses[channel * 2];
+            pointer(bytes, offset, state);
+            pointer(bytes, offset + 8, state + 0x10);
+            pointer(bytes, offset + 16, state + 0x20);
+            pointer(bytes, offset + 24, addresses[channel * 2 + 1]);
+        }
+        Ok(())
+    }
+
+    pub(crate) fn firmware_control(&self, output: &mut [u8]) -> Result<(), Error> {
+        let addresses = self.addresses()?;
+        let bytes = output
+            .get_mut(..allocation(storage::CONTROL_REGION)?.size)
+            .ok_or(Error::Size)?;
+        bytes.fill(0);
+        bytes[0x4f88..0x4f90].copy_from_slice(&addresses[storage::FW_CONTROL_STATE].to_le_bytes());
+        bytes[0x4f90..0x4f98].copy_from_slice(&addresses[storage::FW_CONTROL_RING].to_le_bytes());
+        bytes[0x4fd4..0x4fd8].copy_from_slice(&1u32.to_le_bytes());
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn owners(delta: u64) -> [Region; COUNT] {
+        core::array::from_fn(|index| {
+            let item = allocation(index).unwrap();
+            Region::new(item.address + delta, item.size).unwrap()
+        })
+    }
+
+    fn graph(owners: &[Region; COUNT]) -> PointerGraph<'_> {
+        PointerGraph {
+            owners,
+            scratch: Region::new(0xffff_fc22_0000_0000, 0x8000).unwrap(),
+            pool_alias: 0x70_0000_0000,
+            parameter_alias: 0x70_0000_8000,
+        }
+    }
+
+    #[test]
+    fn complete_plan_has_disjoint_page_owners_and_nine_log_threads() {
+        let owners = owners(0);
+        assert!(graph(&owners).addresses().is_ok());
+        assert_eq!(allocation(28).unwrap().size, 0x1b0);
+        assert_eq!(allocation(29).unwrap().size, 0x28800);
+        assert_eq!(allocation(41).unwrap().size, 0x79800);
+        assert!(allocation(COUNT).is_err());
+    }
+
+    #[test]
+    fn runtime_references_relocate_and_keep_the_packed_power_pointer() {
+        for delta in [0, 0x1000_0000] {
+            let owners = owners(delta);
+            let mut output = [0xa5; RUNTIME_SIZE + 8];
+            graph(&owners).runtime(&mut output).unwrap();
+            let read = |at| u64::from_le_bytes(output[at..at + 8].try_into().unwrap());
+            assert_eq!(
+                read(0x469),
+                allocation(PERFORMANCE_CONTROL).unwrap().address + delta
+            );
+            assert_eq!(read(0x1a0), allocation(24).unwrap().address + delta);
+            assert_eq!(read(0x1b8), allocation(25).unwrap().address + delta);
+            assert_eq!(read(0x2d0), 0x70_0000_8000);
+            assert_eq!(&output[RUNTIME_SIZE..], &[0xa5; 8]);
+        }
+    }
+
+    #[test]
+    fn every_short_runtime_rejects_before_mutation() {
+        let owners = owners(0);
+        for length in 0..RUNTIME_SIZE {
+            let mut output = [0xa5; RUNTIME_SIZE];
+            assert_eq!(
+                graph(&owners).runtime(&mut output[..length]),
+                Err(Error::Size)
+            );
+            assert_eq!(output, [0xa5; RUNTIME_SIZE]);
+        }
+    }
+
+    #[test]
+    fn every_owner_is_checked_before_any_record_is_written() {
+        for index in 0..COUNT {
+            let mut owners = owners(0);
+            let item = allocation(index).unwrap();
+            owners[index] = Region::new(item.address, item.size - 1).unwrap();
+            let mut output = [0xa5; RUNTIME_SIZE];
+            assert!(graph(&owners).runtime(&mut output).is_err());
+            assert_eq!(output, [0xa5; RUNTIME_SIZE]);
+        }
+        let mut owners = owners(0);
+        owners[1] = owners[0];
+        let mut output = [0xa5; RUNTIME_SIZE];
+        assert!(graph(&owners).runtime(&mut output).is_err());
+        assert_eq!(output, [0xa5; RUNTIME_SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_init_layout.rs b/drivers/gpu/drm/asahi/m3/m3_init_layout.rs
index 92cc818e030cc..75f06abe6f411 100644
--- a/drivers/gpu/drm/asahi/m3/m3_init_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_init_layout.rs
@@ -78,13 +78,38 @@ impl Root {
             (root::CONTROL, self.control.at(0, CONTROL_SIZE)?),
             (root::POWER, self.power.at(0, 2292)?),
         ];
-        let bytes = out.get_mut(..ROOT_SIZE).ok_or(Error::Size)?;
+        Self::write_root(out, ROOT_SIZE, 0x0c08_e21e_8380_0490, &references)
+    }
+
+    /// Encode the extended root without admitting a firmware image or publishing it.
+    pub(crate) fn encode_26(&self, out: &mut [u8], extra: Region) -> Result<(), Error> {
+        let references = [
+            (root::REGION_A, self.region_a.at(0, 0x4000)?),
+            (root::RUNTIME, self.runtime.at(0, 0x4b8)?),
+            (root::GLOBALS, self.globals.at(0, 0xe48)?),
+            (root::NEW_A, self.new_a.at(0, 0x20)?),
+            (root::CONTROL, self.control.at(0, 0xeaf0)?),
+            (root::POWER, self.power.at(0, 0x670)?),
+            (0xc0, extra.at(0, 0x4000)?),
+        ];
+        if references.iter().any(|(_, address)| address & 7 != 0) {
+            return Err(Error::Address);
+        }
+        Self::write_root(out, 0xc8, 0x0c89_c357_8392_04b8, &references)
+    }
+
+    fn write_root(
+        out: &mut [u8],
+        size: usize,
+        version: u64,
+        references: &[(usize, u64)],
+    ) -> Result<(), Error> {
+        let bytes = out.get_mut(..size).ok_or(Error::Size)?;
         bytes.fill(0);
-        // Opaque qualified G15/V14_8_3 version tuple, not a semantic version.
-        for (i, value) in [0x490u16, 0x8380, 0xe21e, 0xc08].iter().enumerate() {
-            bytes[root::VERSION + i * 2..root::VERSION + i * 2 + 2].copy_from_slice(&value.to_le_bytes());
+        pointer(bytes, root::VERSION, version);
+        for &(offset, value) in references {
+            pointer(bytes, offset, value);
         }
-        for (offset, value) in references { pointer(bytes, offset, value); }
         word(bytes, root::HOST_ALLOCATIONS, 1);
         bytes[root::PAGE_SIZE..root::PAGE_SIZE + 2].copy_from_slice(&0x4000u16.to_le_bytes());
         bytes[root::PAGE_BITS] = 14;
@@ -193,3 +218,107 @@ impl ControlRegion {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod root_format_tests {
+    use super::*;
+
+    fn allocations() -> (Root, Region) {
+        let region =
+            |index: u64| Region::new(0xffff_fc01_0000_0000 + index * 0x10000, 0x10000).unwrap();
+        (
+            Root {
+                region_a: region(1),
+                runtime: region(2),
+                globals: region(3),
+                new_a: region(4),
+                control: region(5),
+                power: region(6),
+            },
+            region(7),
+        )
+    }
+
+    #[test]
+    fn root_revision_changes_only_the_version_and_extension() {
+        let (root, extra) = allocations();
+        let mut older = [0x55; 0xd0];
+        let mut newer = older;
+        root.encode(&mut older).unwrap();
+        root.encode_26(&mut newer, extra).unwrap();
+        assert_eq!(&older[8..0xc0], &newer[8..0xc0]);
+        assert_eq!(
+            u64::from_le_bytes(newer[..8].try_into().unwrap()),
+            0x0c89_c357_8392_04b8
+        );
+        assert_eq!(
+            u64::from_le_bytes(newer[0xc0..0xc8].try_into().unwrap()),
+            0xffff_fc01_0007_0000
+        );
+        assert_eq!(&older[0xc0..], &[0x55; 16]);
+        assert_eq!(&newer[0xc8..], &[0x55; 8]);
+        for (offset, index) in [
+            (8, 1),
+            (0x18, 2),
+            (0x20, 3),
+            (0xa8, 4),
+            (0xb0, 5),
+            (0xb8, 6),
+        ] {
+            assert_eq!(
+                u64::from_le_bytes(newer[offset..offset + 8].try_into().unwrap()),
+                0xffff_fc01_0000_0000 + index * 0x10000
+            );
+        }
+    }
+
+    #[test]
+    fn every_short_destination_is_unchanged() {
+        let (root, extra) = allocations();
+        for length in 0..0xc8 {
+            let mut output = [0xa5; 0xc8];
+            assert_eq!(
+                root.encode_26(&mut output[..length], extra),
+                Err(Error::Size)
+            );
+            assert_eq!(output, [0xa5; 0xc8]);
+        }
+    }
+
+    #[test]
+    fn every_reference_requires_its_own_complete_allocation() {
+        for (index, required) in [0x4000, 0x4b8, 0xe48, 0x20, 0xeaf0, 0x670, 0x4000]
+            .into_iter()
+            .enumerate()
+        {
+            for (size, aligned, valid) in [
+                (required - 1, true, false),
+                (required, false, false),
+                (required, true, true),
+            ] {
+                let (mut root, mut extra) = allocations();
+                let reference = match index {
+                    0 => &mut root.region_a,
+                    1 => &mut root.runtime,
+                    2 => &mut root.globals,
+                    3 => &mut root.new_a,
+                    4 => &mut root.control,
+                    5 => &mut root.power,
+                    _ => &mut extra,
+                };
+                *reference =
+                    Region::new(0xffff_fc02_0000_0000 + u64::from(!aligned), size).unwrap();
+                let mut output = [0xa5; 0xc8];
+                let result = root.encode_26(&mut output, extra);
+                assert_eq!(
+                    result.is_ok(),
+                    valid,
+                    "reference {index}, size {size}, aligned {aligned}"
+                );
+                if !valid {
+                    assert_eq!(output, [0xa5; 0xc8]);
+                }
+            }
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs b/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
new file mode 100644
index 0000000000000..e4008f239c4a0
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
@@ -0,0 +1,265 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! T8122 firmware MMIO descriptors. Mapping ownership stays with the M3 runtime.
+
+use super::m3_init_layout::{Error, Region};
+
+pub(crate) const SLOTS: usize = 53;
+pub(crate) const RECORD_BYTES: usize = 40;
+pub(crate) const TABLE_OFFSET: usize = 0x640;
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Area {
+    pub(crate) physical: u64,
+    pub(crate) bytes: usize,
+    relative_register: u64,
+    writable: bool,
+    split: bool,
+}
+
+impl Area {
+    pub(crate) fn page_offset(self) -> usize {
+        (self.physical & 0x3fff) as usize
+    }
+
+    pub(crate) fn mapped_bytes(self) -> usize {
+        (self.page_offset() + self.bytes + 0x3fff) & !0x3fff
+    }
+
+    /// At most two physical banks; the second bank occupies the next virtual pages.
+    pub(crate) fn banks(self) -> [(u64, usize, usize); 2] {
+        if self.split {
+            [
+                (self.physical, self.bytes / 2, 0),
+                (self.physical + 0x200_0000, self.bytes / 2, self.bytes / 2),
+            ]
+        } else {
+            [(self.physical & !0x3fff, self.mapped_bytes(), 0), (0, 0, 0)]
+        }
+    }
+}
+
+/// Register resources obtained from the admitted T8122 hardware configuration.
+/// Their physical addresses are supplied by the owner, not duplicated in a wire table.
+#[derive(Clone, Copy)]
+pub(crate) struct RegisterBases {
+    pub(crate) gpu: u64,
+    pub(crate) interrupt: u64,
+    pub(crate) memory: u64,
+    pub(crate) telemetry_write: u64,
+    pub(crate) telemetry_read: u64,
+    pub(crate) neural: u64,
+    pub(crate) metrology: u64,
+}
+
+/// Select the wire slot and map its logical hardware block independently of its VA.
+pub(crate) fn area(slot: usize, bases: RegisterBases) -> Result<Option<Area>, Error> {
+    let (base, offset, bytes, tagged, writable, split) = match slot {
+        0 => (bases.interrupt, 0, 0x4000, false, true, false),
+        3 => (bases.memory, 0, 0x30000, false, true, true),
+        9 => (bases.telemetry_write, 0, 0x1000, false, true, false),
+        10 => (bases.telemetry_read, 0, 0x2000, false, false, false),
+        12 => (bases.neural, 0, 0x4000, false, true, false),
+        14 => (bases.metrology, 0, 0x8000, false, false, false),
+        17 => (bases.gpu, 0, 0x20000, false, true, false),
+        26 => (bases.gpu, 0xd04000, 0x8000, true, true, false),
+        27 => (bases.gpu, 0xd0d000, 0x1000, true, true, false),
+        28 => (bases.gpu, 0xd50000, 0x8000, true, true, false),
+        29 => (bases.gpu, 0xd10000, 0x4000, true, true, false),
+        31 => (bases.gpu, 0xd40000, 0x4000, true, true, false),
+        32 => (bases.gpu, 0xd60000, 0x8000, true, true, false),
+        35 => (bases.gpu, 0xe00000, 0x4000, true, true, false),
+        39 => (bases.gpu, 0xe08000, 0x8000, false, true, false),
+        40 => (bases.gpu, 0xe1c000, 0x4000, true, true, false),
+        0..SLOTS => return Ok(None),
+        _ => return Err(Error::Bounds),
+    };
+    let physical = base.checked_add(offset).ok_or(Error::Address)?;
+    if physical == 0 || physical.checked_add(bytes as u64).ok_or(Error::Address)? > 1 << 42 {
+        return Err(Error::Address);
+    }
+    Ok(Some(Area {
+        physical,
+        bytes,
+        relative_register: if tagged { offset } else { 0 },
+        writable,
+        split,
+    }))
+}
+
+fn empty_mode(slot: usize) -> u64 {
+    if matches!(slot, 2 | 5..=8 | 30 | 33 | 34 | 37 | 38 | 41..=43 | 46..=49 | 52) {
+        2
+    } else {
+        0
+    }
+}
+
+/// Encode a complete record after checking the owned mapping; errors preserve all output.
+pub(crate) fn encode(
+    slot: usize,
+    bases: RegisterBases,
+    mapping: Option<Region>,
+    output: &mut [u8],
+) -> Result<(), Error> {
+    let descriptor = area(slot, bases)?;
+    let (physical, va, bytes, requested, register, mode) = match (descriptor, mapping) {
+        (None, None) => (0, 0, 0, 0, 0, empty_mode(slot)),
+        (Some(item), Some(mapping)) => {
+            let page = mapping.at(0, item.mapped_bytes())?;
+            if page & 0x3fff != 0 {
+                return Err(Error::Address);
+            }
+            let va = page
+                .checked_add(item.page_offset() as u64)
+                .ok_or(Error::Address)?;
+            (
+                item.physical,
+                va,
+                item.bytes as u32,
+                if item.split {
+                    (item.bytes / 2) as u32
+                } else {
+                    item.bytes as u32
+                },
+                item.relative_register,
+                if item.writable { 2 } else { 0 },
+            )
+        }
+        _ => return Err(Error::Address),
+    };
+    let bytes_out = output.get_mut(..RECORD_BYTES).ok_or(Error::Size)?;
+    bytes_out.fill(0);
+    bytes_out[0..8].copy_from_slice(&physical.to_le_bytes());
+    bytes_out[8..16].copy_from_slice(&va.to_le_bytes());
+    bytes_out[16..20].copy_from_slice(&bytes.to_le_bytes());
+    bytes_out[20..24].copy_from_slice(&requested.to_le_bytes());
+    bytes_out[24..32].copy_from_slice(&register.to_le_bytes());
+    bytes_out[32..40].copy_from_slice(&mode.to_le_bytes());
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Register identities already present in the public T8122 configuration;
+    // memory-controller bank geometry is shared with the public 25G83 encoder.
+    const BASES: RegisterBases = RegisterBases {
+        gpu: 0x2_9000_0000,
+        interrupt: 0x2_d101_4000,
+        memory: 0x2_201c_4000,
+        telemetry_write: 0x2_d03d_0000,
+        telemetry_read: 0x2_d03c_0000,
+        neural: 0x3_1145_c000,
+        metrology: 0x2_d028_0000,
+    };
+
+    #[test]
+    fn j613_slot28_bank_and_wire_tag_agree() {
+        let bank = area(28, BASES).unwrap().unwrap();
+        assert_eq!(bank.physical, BASES.gpu + 0xd50000);
+        assert_eq!(bank.bytes, 0x8000);
+        let mapped = Region::new(0xffff_fc23_01c0_0000, 0x8000).unwrap();
+        let mut bytes = [0; RECORD_BYTES];
+        encode(28, BASES, Some(mapped), &mut bytes).unwrap();
+        assert_eq!(&bytes[0..8], &(BASES.gpu + 0xd50000).to_le_bytes());
+        assert_eq!(&bytes[24..32], &0xd50000u64.to_le_bytes());
+        assert_ne!(bank.physical, BASES.gpu + 0xd58000);
+    }
+
+    #[test]
+    fn descriptor_inventory_ends_before_the_retention_pointer() {
+        assert_eq!(TABLE_OFFSET + SLOTS * RECORD_BYTES, 0xe88);
+        assert_eq!(
+            (0..SLOTS)
+                .filter(|slot| area(*slot, BASES).unwrap().is_some())
+                .count(),
+            16
+        );
+        assert!(area(SLOTS, BASES).is_err());
+    }
+
+    #[test]
+    fn discontiguous_memory_controller_banks_have_distinct_physical_owners() {
+        let item = area(3, BASES).unwrap().unwrap();
+        assert_eq!(
+            item.banks(),
+            [
+                (0x2_201c_4000, 0x18000, 0),
+                (0x2_221c_4000, 0x18000, 0x18000)
+            ]
+        );
+        let mapping = Region::new(0xffff_fc23_0000_0000, 0x30000).unwrap();
+        let mut bytes = [0xa5; RECORD_BYTES];
+        encode(3, BASES, Some(mapping), &mut bytes).unwrap();
+        assert_eq!(
+            u32::from_le_bytes(bytes[16..20].try_into().unwrap()),
+            0x30000
+        );
+        assert_eq!(
+            u32::from_le_bytes(bytes[20..24].try_into().unwrap()),
+            0x18000
+        );
+    }
+
+    #[test]
+    fn subpage_mapping_keeps_the_register_offset() {
+        let item = area(27, BASES).unwrap().unwrap();
+        assert_eq!(item.page_offset(), 0x1000);
+        assert_eq!(item.banks()[0], (0x2_90d0_c000, 0x4000, 0));
+        let mut output = [0xa5; RECORD_BYTES + 8];
+        encode(
+            27,
+            BASES,
+            Some(Region::new(0xffff_fc23_0000_0000, 0x4000).unwrap()),
+            &mut output,
+        )
+        .unwrap();
+        assert_eq!(
+            u64::from_le_bytes(output[8..16].try_into().unwrap()),
+            0xffff_fc23_0000_1000
+        );
+        assert_eq!(&output[RECORD_BYTES..], &[0xa5; 8]);
+    }
+
+    #[test]
+    fn empty_slots_keep_modes_without_fabricating_mappings() {
+        for slot in 0..SLOTS {
+            if area(slot, BASES).unwrap().is_some() {
+                continue;
+            }
+            let mut output = [0xa5; RECORD_BYTES];
+            encode(slot, BASES, None, &mut output).unwrap();
+            assert_eq!(&output[..32], &[0; 32]);
+            assert_eq!(
+                u64::from_le_bytes(output[32..40].try_into().unwrap()),
+                empty_mode(slot)
+            );
+        }
+    }
+
+    #[test]
+    fn invalid_mapping_or_output_never_partially_changes_a_descriptor() {
+        let good = Region::new(0xffff_fc23_0000_0000, 0x4000).unwrap();
+        for (slot, mapping) in [
+            (SLOTS, None),
+            (0, None),
+            (1, Some(good)),
+            (0, Some(Region::new(0xffff_fc23_0000_0001, 0x4000).unwrap())),
+            (0, Some(Region::new(0xffff_fc23_0000_0000, 0x3fff).unwrap())),
+        ] {
+            let mut output = [0xa5; RECORD_BYTES];
+            assert!(encode(slot, BASES, mapping, &mut output).is_err());
+            assert_eq!(output, [0xa5; RECORD_BYTES]);
+        }
+        for length in 0..RECORD_BYTES {
+            let mut output = [0xa5; RECORD_BYTES];
+            assert_eq!(
+                encode(0, BASES, Some(good), &mut output[..length]),
+                Err(Error::Size)
+            );
+            assert_eq!(output, [0xa5; RECORD_BYTES]);
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_profile.rs b/drivers/gpu/drm/asahi/m3/m3_profile.rs
new file mode 100644
index 0000000000000..c70a88029072b
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_profile.rs
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! Firmware-interface properties, independent of the physical G15 GPU record format.
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Profile {
+    Legacy,
+    Extended,
+}
+
+pub(crate) const PARAMS_REQUIRED: u64 = 600;
+
+impl Profile {
+    pub(crate) const fn firmware_compat(self) -> [u32; 3] {
+        match self {
+            Self::Legacy => [14, 8, 3],
+            Self::Extended => [26, 6, 2],
+        }
+    }
+
+    pub(crate) const fn hal(self) -> u32 {
+        match self {
+            Self::Legacy => 0,
+            Self::Extended => 200,
+        }
+    }
+
+    pub(crate) const fn user_end(self) -> u64 {
+        match self {
+            Self::Legacy => 0x2ff_ffff_8000,
+            Self::Extended => (1 << 42) - 2 * 0x4000,
+        }
+    }
+
+    pub(crate) const fn vm_acknowledged(self, params_bytes: u64, flags: u32) -> bool {
+        // Both profiles consume G15 records; the existing VM padding stays zero.
+        params_bytes >= PARAMS_REQUIRED && flags == 0
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn profile_acknowledgement_is_exact_and_file_query_covers_hal() {
+        for profile in [Profile::Legacy, Profile::Extended] {
+            let expected = 0;
+            for size in [0, 599, 600, 616, u64::MAX] {
+                for flags in [0, 1, 2, 3, u32::MAX] {
+                    assert_eq!(
+                        profile.vm_acknowledged(size, flags),
+                        size >= 600 && flags == expected
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn firmware_interface_version_does_not_change_physical_identity() {
+        assert_eq!(Profile::Legacy.hal(), 0);
+        assert_eq!(Profile::Extended.hal(), 200);
+        assert_eq!(Profile::Legacy.firmware_compat(), [14, 8, 3]);
+        assert_eq!(Profile::Extended.firmware_compat(), [26, 6, 2]);
+        assert_eq!(Profile::Extended.user_end(), 0x3ff_ffff_8000);
+        assert_eq!(Profile::Legacy.user_end(), 0x2ff_ffff_8000);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/mod.rs b/drivers/gpu/drm/asahi/m3/mod.rs
index 1d10657c02f66..7073ecf294d63 100644
--- a/drivers/gpu/drm/asahi/m3/mod.rs
+++ b/drivers/gpu/drm/asahi/m3/mod.rs
@@ -198,3 +198,7 @@ mod t8122_admission;
 pub(crate) mod m3_soc;
 
 mod t8122_hwdata;
+
+mod m3_init_26;
+mod m3_profile;
+mod m3_mmio_26;
diff --git a/drivers/gpu/drm/asahi/m3/t8122_admission.rs b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
index 12bea894c373e..fdc41024899f1 100644
--- a/drivers/gpu/drm/asahi/m3/t8122_admission.rs
+++ b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
@@ -2,6 +2,8 @@
 
 //! Read-only T8122 identity admission. Firmware startup remains disabled.
 
+use super::m3_profile::Profile;
+
 #[derive(Debug, Copy, Clone, PartialEq, Eq)]
 pub(crate) struct Identity {
     pub(crate) active_cores: u32,
@@ -16,12 +18,23 @@ pub(crate) fn validate_identity(
     result: u32,
     id_version: u32,
     masks: [u32; 3],
+) -> Option<Identity> {
+    validate_identity_for(Profile::Legacy, firmware_compat, schema, result, id_version, masks)
+}
+
+pub(crate) fn validate_identity_for(
+    profile: Profile,
+    firmware_compat: &[u32],
+    schema: u32,
+    result: u32,
+    id_version: u32,
+    masks: [u32; 3],
 ) -> Option<Identity> {
     let family = id_version >> 24;
     let variant = (id_version >> 16) & 0xff;
     let revision = (id_version >> 8) & 0xff;
     let active_cores = masks[0].count_ones();
-    if firmware_compat != [14, 8, 3]
+    if firmware_compat != profile.firmware_compat()
         || schema != 1
         || result != 1
         || family != 7
@@ -94,6 +107,14 @@ pub(crate) fn opp_table_shape(opps: impl IntoIterator<Item = (u64, u32)>) -> Opt
 #[cfg(not(test))]
 pub(crate) fn read_identity(
     pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
+) -> kernel::error::Result<Identity> {
+    read_identity_for(pdev, Profile::Legacy)
+}
+
+#[cfg(not(test))]
+pub(crate) fn read_identity_for(
+    pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
+    profile: Profile,
 ) -> kernel::error::Result<Identity> {
     use kernel::{bindings, c_str, prelude::*};
 
@@ -146,7 +167,8 @@ pub(crate) fn read_identity(
         observation.get_u32(c_str!("core-mask-1"))?,
         observation.get_u32(c_str!("core-mask-2"))?,
     ];
-    validate_identity(firmware_compat.as_slice(), schema, result, id_version, masks).ok_or(ENODEV)
+    validate_identity_for(profile, firmware_compat.as_slice(), schema, result, id_version, masks)
+        .ok_or(ENODEV)
 }
 
 #[cfg(test)]
@@ -164,6 +186,29 @@ mod tests {
         }
     }
 
+    #[test]
+    fn extended_identity_requires_its_actual_version_and_the_same_g15g_bounds() {
+        for mask in [0xff, 0x3ff] {
+            let good = || validate_identity_for(Profile::Extended, &[26, 6, 2], 1, 1, G15G_C0, [mask, 0, 0]);
+            assert_eq!(good().unwrap().active_cores, mask.count_ones());
+            assert!(validate_identity(&[26, 6, 2], 1, 1, G15G_C0, [mask, 0, 0]).is_none());
+            assert!(validate_identity_for(Profile::Extended, &[14, 8, 3], 1, 1, G15G_C0, [mask, 0, 0]).is_none());
+        }
+        for (schema, result, id, masks) in [
+            (0, 1, G15G_C0, [0xff, 0, 0]),
+            (1, 0, G15G_C0, [0xff, 0, 0]),
+            (1, 1, G15G_C0 ^ (1 << 24), [0xff, 0, 0]),
+            (1, 1, G15G_C0 ^ (1 << 16), [0xff, 0, 0]),
+            (1, 1, G15G_C0 ^ (1 << 8), [0xff, 0, 0]),
+            (1, 1, G15G_C0, [0x1ff, 0, 0]),
+            (1, 1, G15G_C0, [0x7ff, 0, 0]),
+            (1, 1, G15G_C0, [0xff, 1, 0]),
+            (1, 1, G15G_C0, [0xff, 0, 1]),
+        ] {
+            assert!(validate_identity_for(Profile::Extended, &[26, 6, 2], schema, result, id, masks).is_none());
+        }
+    }
+
     /// The booted J613 ladder (`perf-states`, frequency then millivolts), in ADT order: fourteen
     /// states, eight voltages above the idle one, 1338 MHz at the top.
     const J613_PERF_STATES: [(u64, u32); 14] = [
diff --git a/tools/asahi/m3-firmware-tests.rs b/tools/asahi/m3-firmware-tests.rs
new file mode 100644
index 0000000000000..90539441d623e
--- /dev/null
+++ b/tools/asahi/m3-firmware-tests.rs
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+//! Host tests of production firmware identity and normalization.
+#![allow(dead_code)]
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_profile.rs"]
+pub(crate) mod m3_profile;
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_resources.rs"]
+pub(crate) mod resources;
+mod m3 {
+    pub(crate) use crate::firmware as m3_firmware;
+    pub(crate) use crate::m3_profile;
+    pub(crate) use crate::resources as m3_resources;
+}
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_firmware.rs"]
+pub(crate) mod firmware;
diff --git a/tools/asahi/m3-runtime-tests.rs b/tools/asahi/m3-runtime-tests.rs
index fd4dc90489e81..f1768a242147b 100644
--- a/tools/asahi/m3-runtime-tests.rs
+++ b/tools/asahi/m3-runtime-tests.rs
@@ -15,3 +15,12 @@ mod m3_init_storage;
 mod m3_thermal_policy;
 #[path = "../../drivers/gpu/drm/asahi/m3/t8122_hwdata.rs"]
 mod t8122_hwdata;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_init_26.rs"]
+mod m3_init_26;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_profile.rs"]
+mod m3_profile;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_mmio_26.rs"]
+mod m3_mmio_26;
diff --git a/tools/asahi/m3-uapi-fixture.c b/tools/asahi/m3-uapi-fixture.c
new file mode 100644
index 0000000000000..9ee0994096009
--- /dev/null
+++ b/tools/asahi/m3-uapi-fixture.c
@@ -0,0 +1,363 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+#include <assert.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <string.h>
+
+#ifndef ASAHI_HEADER
+#define ASAHI_HEADER "drm/asahi_drm.h"
+#endif
+#include ASAHI_HEADER
+
+static_assert(sizeof(struct drm_asahi_cmd_header) == 8, "command header");
+static_assert(sizeof(struct drm_asahi_attachment) == 24, "attachment");
+static_assert(sizeof(struct drm_asahi_timestamps) == 16, "timestamps");
+static_assert(offsetof(struct drm_asahi_cmd_compute, ts_end_copies) == 64,
+	      "compute prefix");
+static_assert(offsetof(struct drm_asahi_cmd_render, ts_frag_end_copies) == 256,
+	      "render prefix");
+
+static int emit(unsigned int type, const void *payload, size_t size)
+{
+	struct drm_asahi_cmd_header header = {
+		.cmd_type = type,
+		.size = size,
+		.vdm_barrier = DRM_ASAHI_BARRIER_NONE,
+		.cdm_barrier = DRM_ASAHI_BARRIER_NONE,
+	};
+
+	return fwrite(&header, sizeof(header), 1, stdout) != 1 ||
+	       fwrite(payload, size, 1, stdout) != 1;
+}
+
+/* Named C offsets are exported independently of the Rust decoder. */
+static void layout(void)
+{
+	printf("profile.params_required %zu 0\n",
+	       offsetof(struct drm_asahi_params_global, gpu_hal_generation) + sizeof(__u32));
+	printf("profile.vm_create_size %zu 0\n", sizeof(struct drm_asahi_vm_create));
+	printf("profile.hal200 %u 0\n", (unsigned int)DRM_ASAHI_GPU_HAL_200);
+	printf("profile.features %u 0\n",
+	       DRM_ASAHI_FEATURE_VM_STATUS | DRM_ASAHI_FEATURE_SCHEDULED_QUEUES);
+	printf("header %zu 0\n", sizeof(struct drm_asahi_cmd_header));
+	printf("attachment %zu 0\n", sizeof(struct drm_asahi_attachment));
+	printf("timestamps %zu 0\n", sizeof(struct drm_asahi_timestamps));
+	printf("cmd_render.flags %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, flags),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->flags));
+	printf("cmd_render.isp_zls_pixels %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_zls_pixels),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_zls_pixels));
+	printf("cmd_render.vdm_ctrl_stream_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, vdm_ctrl_stream_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->vdm_ctrl_stream_base));
+	printf("cmd_render.vertex_helper.binary %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, vertex_helper.binary),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->vertex_helper.binary));
+	printf("cmd_render.vertex_helper.cfg %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, vertex_helper.cfg),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->vertex_helper.cfg));
+	printf("cmd_render.vertex_helper.data %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, vertex_helper.data),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->vertex_helper.data));
+	printf("cmd_render.fragment_helper.binary %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, fragment_helper.binary),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->fragment_helper.binary));
+	printf("cmd_render.fragment_helper.cfg %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, fragment_helper.cfg),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->fragment_helper.cfg));
+	printf("cmd_render.fragment_helper.data %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, fragment_helper.data),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->fragment_helper.data));
+	printf("cmd_render.isp_scissor_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_scissor_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_scissor_base));
+	printf("cmd_render.isp_dbias_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_dbias_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_dbias_base));
+	printf("cmd_render.isp_oclqry_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_oclqry_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_oclqry_base));
+	printf("cmd_render.depth.base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, depth.base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->depth.base));
+	printf("cmd_render.depth.comp_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, depth.comp_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->depth.comp_base));
+	printf("cmd_render.depth.stride %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, depth.stride),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->depth.stride));
+	printf("cmd_render.depth.comp_stride %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, depth.comp_stride),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->depth.comp_stride));
+	printf("cmd_render.stencil.base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, stencil.base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->stencil.base));
+	printf("cmd_render.stencil.comp_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, stencil.comp_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->stencil.comp_base));
+	printf("cmd_render.stencil.stride %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, stencil.stride),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->stencil.stride));
+	printf("cmd_render.stencil.comp_stride %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, stencil.comp_stride),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->stencil.comp_stride));
+	printf("cmd_render.zls_ctrl %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, zls_ctrl),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->zls_ctrl));
+	printf("cmd_render.ppp_multisamplectl %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ppp_multisamplectl),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ppp_multisamplectl));
+	printf("cmd_render.sampler_heap %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, sampler_heap),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->sampler_heap));
+	printf("cmd_render.ppp_ctrl %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ppp_ctrl),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ppp_ctrl));
+	printf("cmd_render.width_px %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, width_px),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->width_px));
+	printf("cmd_render.height_px %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, height_px),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->height_px));
+	printf("cmd_render.layers %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, layers),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->layers));
+	printf("cmd_render.sampler_count %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, sampler_count),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->sampler_count));
+	printf("cmd_render.utile_width_px %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, utile_width_px),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->utile_width_px));
+	printf("cmd_render.utile_height_px %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, utile_height_px),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->utile_height_px));
+	printf("cmd_render.samples %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, samples),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->samples));
+	printf("cmd_render.sample_size_B %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, sample_size_B),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->sample_size_B));
+	printf("cmd_render.isp_merge_upper_x %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_merge_upper_x),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_merge_upper_x));
+	printf("cmd_render.isp_merge_upper_y %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_merge_upper_y),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_merge_upper_y));
+	printf("cmd_render.bg.usc %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg.usc),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg.usc));
+	printf("cmd_render.bg.rsrc_spec %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg.rsrc_spec),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg.rsrc_spec));
+	printf("cmd_render.bg_rsrc_spec_hi %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg_rsrc_spec_hi),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg_rsrc_spec_hi));
+	printf("cmd_render.eot.usc %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, eot.usc),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->eot.usc));
+	printf("cmd_render.eot.rsrc_spec %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, eot.rsrc_spec),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->eot.rsrc_spec));
+	printf("cmd_render.bg_eot_rsrc_spec_hi %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg_eot_rsrc_spec_hi),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg_eot_rsrc_spec_hi));
+	printf("cmd_render.partial_bg.usc %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, partial_bg.usc),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->partial_bg.usc));
+	printf("cmd_render.partial_bg.rsrc_spec %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, partial_bg.rsrc_spec),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->partial_bg.rsrc_spec));
+	printf("cmd_render.bg_partial_rsrc_spec_hi %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg_partial_rsrc_spec_hi),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg_partial_rsrc_spec_hi));
+	printf("cmd_render.partial_eot.usc %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, partial_eot.usc),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->partial_eot.usc));
+	printf("cmd_render.partial_eot.rsrc_spec %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, partial_eot.rsrc_spec),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->partial_eot.rsrc_spec));
+	printf("cmd_render.bg_eot_partial_rsrc_spec_hi %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg_eot_partial_rsrc_spec_hi),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg_eot_partial_rsrc_spec_hi));
+	printf("cmd_render.isp_bgobjdepth %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_bgobjdepth),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_bgobjdepth));
+	printf("cmd_render.isp_bgobjvals %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_bgobjvals),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_bgobjvals));
+	printf("cmd_render.ts_vtx.start.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_vtx.start.handle),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_vtx.start.handle));
+	printf("cmd_render.ts_vtx.start.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_vtx.start.offset),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_vtx.start.offset));
+	printf("cmd_render.ts_vtx.end.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_vtx.end.handle),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_vtx.end.handle));
+	printf("cmd_render.ts_vtx.end.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_vtx.end.offset),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_vtx.end.offset));
+	printf("cmd_render.ts_frag.start.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag.start.handle),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag.start.handle));
+	printf("cmd_render.ts_frag.start.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag.start.offset),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag.start.offset));
+	printf("cmd_render.ts_frag.end.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag.end.handle),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag.end.handle));
+	printf("cmd_render.ts_frag.end.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag.end.offset),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag.end.offset));
+	printf("cmd_compute.flags %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, flags),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->flags));
+	printf("cmd_compute.sampler_count %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, sampler_count),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->sampler_count));
+	printf("cmd_compute.cdm_ctrl_stream_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, cdm_ctrl_stream_base),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->cdm_ctrl_stream_base));
+	printf("cmd_compute.cdm_ctrl_stream_end %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, cdm_ctrl_stream_end),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->cdm_ctrl_stream_end));
+	printf("cmd_compute.sampler_heap %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, sampler_heap),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->sampler_heap));
+	printf("cmd_compute.helper.binary %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, helper.binary),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->helper.binary));
+	printf("cmd_compute.helper.cfg %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, helper.cfg),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->helper.cfg));
+	printf("cmd_compute.helper.data %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, helper.data),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->helper.data));
+	printf("cmd_compute.ts.start.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts.start.handle),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts.start.handle));
+	printf("cmd_compute.ts.start.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts.start.offset),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts.start.offset));
+	printf("cmd_compute.ts.end.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts.end.handle),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts.end.handle));
+	printf("cmd_compute.ts.end.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts.end.offset),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts.end.offset));
+	printf("attachment.pointer %zu %zu\n",
+	       offsetof(struct drm_asahi_attachment, pointer),
+	       sizeof(((struct drm_asahi_attachment *)0)->pointer));
+	printf("attachment.size %zu %zu\n",
+	       offsetof(struct drm_asahi_attachment, size),
+	       sizeof(((struct drm_asahi_attachment *)0)->size));
+	printf("cmd_render.ts_frag_end_copies %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag_end_copies),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag_end_copies));
+	printf("cmd_compute.ts_end_copies %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts_end_copies),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts_end_copies));
+}
+
+int main(int argc, char **argv)
+{
+	struct drm_asahi_attachment attachment = {0};
+
+	attachment.pointer = 0xcdb09376593c1f02ULL;
+	attachment.size = 0xceb194775a3d2003ULL;
+
+	struct drm_asahi_cmd_render render = {0};
+
+	render.flags = 0x5b3e2104;
+	render.isp_zls_pixels = 0x5c3f2205;
+	render.vdm_ctrl_stream_base = 0xd1b4977a5d402306ULL;
+	render.vertex_helper.binary = 0x5e412407;
+	render.vertex_helper.cfg = 0x5f422508;
+	render.vertex_helper.data = 0xd4b79a7d60432609ULL;
+	render.fragment_helper.binary = 0x6144270a;
+	render.fragment_helper.cfg = 0x6245280b;
+	render.fragment_helper.data = 0xd7ba9d806346290cULL;
+	render.isp_scissor_base = 0xd8bb9e8164472a0dULL;
+	render.isp_dbias_base = 0xd9bc9f8265482b0eULL;
+	render.isp_oclqry_base = 0xdabda08366492c0fULL;
+	render.depth.base = 0xdbbea184674a2d10ULL;
+	render.depth.comp_base = 0xdcbfa285684b2e11ULL;
+	render.depth.stride = 0x694c2f12;
+	render.depth.comp_stride = 0x6a4d3013;
+	render.stencil.base = 0xdfc2a5886b4e3114ULL;
+	render.stencil.comp_base = 0xe0c3a6896c4f3215ULL;
+	render.stencil.stride = 0x6d503316;
+	render.stencil.comp_stride = 0x6e513417;
+	render.zls_ctrl = 0xe3c6a98c6f523518ULL;
+	render.ppp_multisamplectl = 0xe4c7aa8d70533619ULL;
+	render.sampler_heap = 0xe5c8ab8e7154371aULL;
+	render.ppp_ctrl = 0x7255381b;
+	render.width_px = 0x391c;
+	render.height_px = 0x3a1d;
+	render.layers = 0x3b1e;
+	render.sampler_count = 0x3c1f;
+	render.utile_width_px = 0x20;
+	render.utile_height_px = 0x21;
+	render.samples = 0x22;
+	render.sample_size_B = 0x23;
+	render.isp_merge_upper_x = 0x7b5e4124;
+	render.isp_merge_upper_y = 0x7c5f4225;
+	render.bg.usc = 0x7d604326;
+	render.bg.rsrc_spec = 0x7e614427;
+	render.bg_rsrc_spec_hi = 0x7f624528;
+	render.eot.usc = 0x80634629;
+	render.eot.rsrc_spec = 0x8164472a;
+	render.bg_eot_rsrc_spec_hi = 0x8265482b;
+	render.partial_bg.usc = 0x8366492c;
+	render.partial_bg.rsrc_spec = 0x84674a2d;
+	render.bg_partial_rsrc_spec_hi = 0x85684b2e;
+	render.partial_eot.usc = 0x86694c2f;
+	render.partial_eot.rsrc_spec = 0x876a4d30;
+	render.bg_eot_partial_rsrc_spec_hi = 0x886b4e31;
+	render.isp_bgobjdepth = 0x896c4f32;
+	render.isp_bgobjvals = 0x8a6d5033;
+	render.ts_vtx.start.handle = 0x8b6e5134;
+	render.ts_vtx.start.offset = 0x8c6f5235;
+	render.ts_vtx.end.handle = 0x8d705336;
+	render.ts_vtx.end.offset = 0x8e715437;
+	render.ts_frag.start.handle = 0x8f725538;
+	render.ts_frag.start.offset = 0x90735639;
+	render.ts_frag.end.handle = 0x9174573a;
+	render.ts_frag.end.offset = 0x9275583b;
+
+	struct drm_asahi_cmd_compute compute = {0};
+
+	compute.flags = 0x9376593c;
+	compute.sampler_count = 0x94775a3d;
+	compute.cdm_ctrl_stream_base = 0xbeccfb295785b3eULL;
+	compute.cdm_ctrl_stream_end = 0xcedd0b396795c3fULL;
+	compute.sampler_heap = 0xdeed1b4977a5d40ULL;
+	compute.helper.binary = 0x987b5e41;
+	compute.helper.cfg = 0x997c5f42;
+	compute.helper.data = 0x10f1d4b79a7d6043ULL;
+	compute.ts.start.handle = 0x9b7e6144;
+	compute.ts.start.offset = 0x9c7f6245;
+	compute.ts.end.handle = 0x9d806346;
+	compute.ts.end.offset = 0x9e816447;
+
+	size_t render_size =
+		offsetof(struct drm_asahi_cmd_render, ts_frag_end_copies);
+	size_t compute_size =
+		offsetof(struct drm_asahi_cmd_compute, ts_end_copies);
+
+	if (argc == 2 && !strcmp(argv[1], "--layout")) {
+		layout();
+		return 0;
+	} else if (argc == 2 && !strcmp(argv[1], "--full")) {
+		render_size = sizeof(render);
+		compute_size = sizeof(compute);
+	} else if (argc != 1) {
+		return 1;
+	}
+
+	return emit(DRM_ASAHI_SET_VERTEX_ATTACHMENTS, &attachment,
+		    sizeof(attachment)) ||
+	       emit(DRM_ASAHI_CMD_RENDER, &render, render_size) ||
+	       emit(DRM_ASAHI_CMD_COMPUTE, &compute, compute_size);
+}
diff --git a/tools/asahi/m3-uapi-tests.rs b/tools/asahi/m3-uapi-tests.rs
new file mode 100644
index 0000000000000..4dc6012f5213e
--- /dev/null
+++ b/tools/asahi/m3-uapi-tests.rs
@@ -0,0 +1,832 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+//! Offline tests of the production parser. All addresses are synthetic.
+#![allow(dead_code)]
+
+#[path = "../../drivers/gpu/drm/asahi/m3/t8122_admission.rs"]
+mod admission;
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_profile.rs"]
+mod m3_profile;
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_uapi.rs"]
+mod uapi;
+use uapi::*;
+
+fn frame(kind: u16, payload: &[u8]) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    for word in [
+        kind,
+        payload.len() as u16,
+        UAPI_BARRIER_NONE,
+        UAPI_BARRIER_NONE,
+    ] {
+        bytes.extend_from_slice(&word.to_le_bytes());
+    }
+    bytes.extend_from_slice(payload);
+    bytes
+}
+
+fn parse(bytes: &[u8]) -> Result<u32, UapiTranslateError> {
+    let mut parser = UapiCommandParser::new(bytes);
+    while parser.next_hardware()?.is_some() {}
+    parser.finish()
+}
+
+// Each offset below is checked against offsetof of the corresponding C member.
+fn layout() -> &'static std::collections::BTreeMap<String, (usize, usize)> {
+    static LAYOUT: std::sync::OnceLock<std::collections::BTreeMap<String, (usize, usize)>> =
+        std::sync::OnceLock::new();
+    LAYOUT.get_or_init(|| {
+        let path = std::env::var("ASAHI_UAPI_LAYOUT").expect("C layout path");
+        std::fs::read_to_string(path)
+            .unwrap()
+            .lines()
+            .map(|line| {
+                let words: Vec<_> = line.split_whitespace().collect();
+                (
+                    words[0].to_string(),
+                    (words[1].parse().unwrap(), words[2].parse().unwrap()),
+                )
+            })
+            .collect()
+    })
+}
+
+fn field(raw: &[u8], name: &str, offset: usize, width: usize, actual: u64) {
+    assert_eq!(layout()[name], (offset, width), "C offset/width for {name}");
+    let mut expected = [0u8; 8];
+    for (i, byte) in expected[..width].iter_mut().enumerate() {
+        *byte = raw.get(offset + i).copied().unwrap_or(0);
+    }
+    assert_eq!(actual, u64::from_le_bytes(expected), "decoded {name}");
+}
+
+fn check_render(p: UapiRenderCommand, raw: &[u8]) {
+    field(raw, "cmd_render.flags", 0, 4, p.flags as u64);
+    field(
+        raw,
+        "cmd_render.isp_zls_pixels",
+        4,
+        4,
+        p.depth_dimensions as u64,
+    );
+    field(
+        raw,
+        "cmd_render.vdm_ctrl_stream_base",
+        8,
+        8,
+        p.vdm_base as u64,
+    );
+    field(
+        raw,
+        "cmd_render.vertex_helper.binary",
+        16,
+        4,
+        p.vertex_helper.binary as u64,
+    );
+    field(
+        raw,
+        "cmd_render.vertex_helper.cfg",
+        20,
+        4,
+        p.vertex_helper.config as u64,
+    );
+    field(
+        raw,
+        "cmd_render.vertex_helper.data",
+        24,
+        8,
+        p.vertex_helper.data as u64,
+    );
+    field(
+        raw,
+        "cmd_render.fragment_helper.binary",
+        32,
+        4,
+        p.fragment_helper.binary as u64,
+    );
+    field(
+        raw,
+        "cmd_render.fragment_helper.cfg",
+        36,
+        4,
+        p.fragment_helper.config as u64,
+    );
+    field(
+        raw,
+        "cmd_render.fragment_helper.data",
+        40,
+        8,
+        p.fragment_helper.data as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_scissor_base",
+        48,
+        8,
+        p.scissor_base as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_dbias_base",
+        56,
+        8,
+        p.depth_bias_base as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_oclqry_base",
+        64,
+        8,
+        p.occlusion_query_base as u64,
+    );
+    field(raw, "cmd_render.depth.base", 72, 8, p.depth.base as u64);
+    field(
+        raw,
+        "cmd_render.depth.comp_base",
+        80,
+        8,
+        p.depth.compression_base as u64,
+    );
+    field(raw, "cmd_render.depth.stride", 88, 4, p.depth.stride as u64);
+    field(
+        raw,
+        "cmd_render.depth.comp_stride",
+        92,
+        4,
+        p.depth.compression_stride as u64,
+    );
+    field(raw, "cmd_render.stencil.base", 96, 8, p.stencil.base as u64);
+    field(
+        raw,
+        "cmd_render.stencil.comp_base",
+        104,
+        8,
+        p.stencil.compression_base as u64,
+    );
+    field(
+        raw,
+        "cmd_render.stencil.stride",
+        112,
+        4,
+        p.stencil.stride as u64,
+    );
+    field(
+        raw,
+        "cmd_render.stencil.comp_stride",
+        116,
+        4,
+        p.stencil.compression_stride as u64,
+    );
+    field(raw, "cmd_render.zls_ctrl", 120, 8, p.zls_control as u64);
+    field(
+        raw,
+        "cmd_render.ppp_multisamplectl",
+        128,
+        8,
+        p.multisample_control as u64,
+    );
+    field(
+        raw,
+        "cmd_render.sampler_heap",
+        136,
+        8,
+        p.sampler_heap as u64,
+    );
+    field(raw, "cmd_render.ppp_ctrl", 144, 4, p.ppp_control as u64);
+    field(raw, "cmd_render.width_px", 148, 2, p.width as u64);
+    field(raw, "cmd_render.height_px", 150, 2, p.height as u64);
+    field(raw, "cmd_render.layers", 152, 2, p.layers as u64);
+    field(
+        raw,
+        "cmd_render.sampler_count",
+        154,
+        2,
+        p.sampler_count as u64,
+    );
+    field(
+        raw,
+        "cmd_render.utile_width_px",
+        156,
+        1,
+        p.utile_width as u64,
+    );
+    field(
+        raw,
+        "cmd_render.utile_height_px",
+        157,
+        1,
+        p.utile_height as u64,
+    );
+    field(raw, "cmd_render.samples", 158, 1, p.samples as u64);
+    field(
+        raw,
+        "cmd_render.sample_size_B",
+        159,
+        1,
+        p.sample_size as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_merge_upper_x",
+        160,
+        4,
+        p.merge_upper_x as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_merge_upper_y",
+        164,
+        4,
+        p.merge_upper_y as u64,
+    );
+    field(raw, "cmd_render.bg.usc", 168, 4, p.background.usc as u64);
+    field(
+        raw,
+        "cmd_render.bg.rsrc_spec",
+        172,
+        4,
+        (p.background.resource_spec & 0xffffffff) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.bg_rsrc_spec_hi",
+        248,
+        4,
+        (p.background.resource_spec >> 32) as u64,
+    );
+    field(raw, "cmd_render.eot.usc", 176, 4, p.end_of_tile.usc as u64);
+    field(
+        raw,
+        "cmd_render.eot.rsrc_spec",
+        180,
+        4,
+        (p.end_of_tile.resource_spec & 0xffffffff) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.bg_eot_rsrc_spec_hi",
+        240,
+        4,
+        (p.end_of_tile.resource_spec >> 32) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.partial_bg.usc",
+        184,
+        4,
+        p.partial_background.usc as u64,
+    );
+    field(
+        raw,
+        "cmd_render.partial_bg.rsrc_spec",
+        188,
+        4,
+        (p.partial_background.resource_spec & 0xffffffff) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.bg_partial_rsrc_spec_hi",
+        252,
+        4,
+        (p.partial_background.resource_spec >> 32) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.partial_eot.usc",
+        192,
+        4,
+        p.partial_end_of_tile.usc as u64,
+    );
+    field(
+        raw,
+        "cmd_render.partial_eot.rsrc_spec",
+        196,
+        4,
+        (p.partial_end_of_tile.resource_spec & 0xffffffff) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.bg_eot_partial_rsrc_spec_hi",
+        244,
+        4,
+        (p.partial_end_of_tile.resource_spec >> 32) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_bgobjdepth",
+        200,
+        4,
+        p.depth_clear as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_bgobjvals",
+        204,
+        4,
+        p.stencil_clear as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_vtx.start.handle",
+        208,
+        4,
+        p.vertex_timestamps.start.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_vtx.start.offset",
+        212,
+        4,
+        p.vertex_timestamps.start.offset as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_vtx.end.handle",
+        216,
+        4,
+        p.vertex_timestamps.end.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_vtx.end.offset",
+        220,
+        4,
+        p.vertex_timestamps.end.offset as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_frag.start.handle",
+        224,
+        4,
+        p.fragment_timestamps.start.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_frag.start.offset",
+        228,
+        4,
+        p.fragment_timestamps.start.offset as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_frag.end.handle",
+        232,
+        4,
+        p.fragment_timestamps.end.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_frag.end.offset",
+        236,
+        4,
+        p.fragment_timestamps.end.offset as u64,
+    );
+}
+
+fn check_compute(p: UapiComputeCommand, raw: &[u8]) {
+    field(raw, "cmd_compute.flags", 0, 4, p.flags as u64);
+    field(
+        raw,
+        "cmd_compute.sampler_count",
+        4,
+        4,
+        p.sampler_count as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.cdm_ctrl_stream_base",
+        8,
+        8,
+        p.control_stream_base as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.cdm_ctrl_stream_end",
+        16,
+        8,
+        p.control_stream_end as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.sampler_heap",
+        24,
+        8,
+        p.sampler_heap as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.helper.binary",
+        32,
+        4,
+        p.helper.binary as u64,
+    );
+    field(raw, "cmd_compute.helper.cfg", 36, 4, p.helper.config as u64);
+    field(raw, "cmd_compute.helper.data", 40, 8, p.helper.data as u64);
+    field(
+        raw,
+        "cmd_compute.ts.start.handle",
+        48,
+        4,
+        p.timestamps.start.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.ts.start.offset",
+        52,
+        4,
+        p.timestamps.start.offset as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.ts.end.handle",
+        56,
+        4,
+        p.timestamps.end.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.ts.end.offset",
+        60,
+        4,
+        p.timestamps.end.offset as u64,
+    );
+}
+
+fn fixture() -> Vec<u8> {
+    std::fs::read(std::env::var("ASAHI_UAPI_FIXTURE").expect("C fixture path")).unwrap()
+}
+
+#[test]
+fn c_header_producer_matches_production_decoder() {
+    let offsets = layout();
+    assert_eq!(offsets["header"].0, UAPI_COMMAND_HEADER_SIZE);
+    assert_eq!(offsets["attachment"].0, UAPI_ATTACHMENT_SIZE);
+    assert_eq!(offsets["timestamps"].0, 16);
+    assert_eq!(offsets["cmd_render.ts_frag_end_copies"].0, UAPI_RENDER_SIZE);
+    assert_eq!(offsets["cmd_compute.ts_end_copies"].0, UAPI_COMPUTE_SIZE);
+    let bytes = fixture();
+    let render_offset = 2 * UAPI_COMMAND_HEADER_SIZE + UAPI_ATTACHMENT_SIZE;
+    let render_size = u16::from_le_bytes(
+        bytes[render_offset - 6..render_offset - 4]
+            .try_into()
+            .unwrap(),
+    ) as usize;
+    let compute_offset = render_offset + render_size + UAPI_COMMAND_HEADER_SIZE;
+    let mut parser = UapiCommandParser::new(&bytes);
+    let Some(ParsedHardwareCommand::Render {
+        index,
+        header,
+        payload,
+        vertex_attachments,
+        fragment_attachments,
+    }) = parser.next_hardware().unwrap()
+    else {
+        panic!("render missing")
+    };
+    assert_eq!(index, 2);
+    assert_eq!(
+        header,
+        UapiCommandHeader {
+            command_type: 0,
+            size: render_size as u16,
+            render_barrier: UAPI_BARRIER_NONE,
+            compute_barrier: UAPI_BARRIER_NONE,
+        }
+    );
+    check_render(payload, &bytes[render_offset..render_offset + render_size]);
+    assert_eq!(vertex_attachments.count, 1);
+    let attachment = vertex_attachments.as_slice()[0];
+    field(
+        &bytes[8..32],
+        "attachment.pointer",
+        0,
+        8,
+        attachment.address,
+    );
+    field(&bytes[8..32], "attachment.size", 8, 8, attachment.size);
+    assert!(fragment_attachments.as_slice().is_empty());
+    let Some(ParsedHardwareCommand::Compute {
+        index,
+        header,
+        payload,
+        attachments,
+    }) = parser.next_hardware().unwrap()
+    else {
+        panic!("compute missing")
+    };
+    assert_eq!(index, 3);
+    assert_eq!(
+        header,
+        UapiCommandHeader {
+            command_type: 1,
+            size: (bytes.len() - compute_offset) as u16,
+            render_barrier: UAPI_BARRIER_NONE,
+            compute_barrier: UAPI_BARRIER_NONE,
+        }
+    );
+    check_compute(payload, &bytes[compute_offset..]);
+    assert!(attachments.as_slice().is_empty());
+    assert!(parser.next_hardware().unwrap().is_none());
+    assert_eq!(parser.finish(), Ok(2));
+}
+
+#[test]
+fn short_payloads_zero_extend_but_missing_bytes_are_rejected() {
+    // Every length includes cuts within each multi-byte field, for both kinds.
+    for (kind, size) in [(0, 256), (1, 64)] {
+        let supplied: Vec<u8> = (0..size).map(|i| (i % 254 + 1) as u8).collect();
+        for length in 0..=size {
+            let raw = &supplied[..length];
+            let bytes = frame(kind, raw);
+            let mut parser = UapiCommandParser::new(&bytes);
+            match parser.next_hardware().unwrap().unwrap() {
+                ParsedHardwareCommand::Render { payload, .. } => check_render(payload, raw),
+                ParsedHardwareCommand::Compute { payload, .. } => check_compute(payload, raw),
+            }
+            assert!(parser.next_hardware().unwrap().is_none());
+            assert_eq!(parser.finish(), Ok(1));
+            for cut in 1..bytes.len() {
+                assert!(parse(&bytes[..cut]).is_err());
+            }
+        }
+    }
+    assert_eq!(parse(&[]), Err(UapiTranslateError::HardwareCommandCount));
+}
+
+#[test]
+fn named_optional_timestamp_copies_are_refused() {
+    for (kind, name) in [
+        (0, "cmd_render.ts_frag_end_copies"),
+        (1, "cmd_compute.ts_end_copies"),
+    ] {
+        let (offset, size) = layout()[name];
+        let mut raw = vec![0; offset + size];
+        assert_eq!(parse(&frame(kind, &raw)), Ok(1));
+        for i in offset..raw.len() {
+            raw[i] = 1;
+            assert_eq!(
+                parse(&frame(kind, &raw)),
+                Err(UapiTranslateError::PayloadTail),
+                "{name} byte {i}"
+            );
+            raw[i] = 0;
+        }
+    }
+}
+
+#[test]
+fn unsupported_nonzero_extensions_never_disappear() {
+    for (kind, size) in [(0, UAPI_RENDER_SIZE), (1, UAPI_COMPUTE_SIZE)] {
+        for extra in [1, 8, 64, 128] {
+            let mut payload = vec![0; size + extra];
+            assert_eq!(parse(&frame(kind, &payload)), Ok(1));
+            for offset in size..payload.len() {
+                payload[offset] = 1;
+                assert_eq!(
+                    parse(&frame(kind, &payload)),
+                    Err(UapiTranslateError::PayloadTail)
+                );
+                payload[offset] = 0;
+            }
+        }
+    }
+    assert_eq!(
+        parse(&frame(0xffff, &[])),
+        Err(UapiTranslateError::CommandType)
+    );
+}
+
+#[test]
+fn attachment_shapes_counts_and_reserved_fields_are_checked() {
+    for kind in 2..=4 {
+        for size in 1..UAPI_ATTACHMENT_SIZE {
+            assert_eq!(
+                parse(&frame(kind, &vec![0; size])),
+                Err(UapiTranslateError::AttachmentPayloadSize)
+            );
+        }
+        let mut bytes = frame(kind, &vec![0; UAPI_ATTACHMENT_SIZE * UAPI_MAX_ATTACHMENTS]);
+        bytes.extend(frame(1, &[]));
+        assert_eq!(parse(&bytes), Ok(1));
+        assert_eq!(
+            parse(&frame(
+                kind,
+                &vec![0; UAPI_ATTACHMENT_SIZE * (UAPI_MAX_ATTACHMENTS + 1)]
+            )),
+            Err(UapiTranslateError::AttachmentCount)
+        );
+        for offset in 16..24 {
+            let mut payload = [0; UAPI_ATTACHMENT_SIZE];
+            payload[offset] = 1;
+            assert_eq!(
+                parse(&frame(kind, &payload)),
+                Err(UapiTranslateError::AttachmentFields)
+            );
+        }
+        let mut bytes = frame(kind, &[]);
+        bytes[4..6].copy_from_slice(&0u16.to_le_bytes());
+        assert_eq!(parse(&bytes), Err(UapiTranslateError::AttachmentBarrier));
+    }
+}
+
+#[test]
+fn attachment_lists_reach_their_commands() {
+    let entry = |pointer: u64, size: u64| {
+        let mut raw = [0u8; UAPI_ATTACHMENT_SIZE];
+        raw[..8].copy_from_slice(&pointer.to_le_bytes());
+        raw[8..16].copy_from_slice(&size.to_le_bytes());
+        raw
+    };
+    let vertex = entry(0x1_2345_6000, 0x1_0000_0040).to_vec();
+    let fragment = [
+        entry(0x2_0000_8000, 0x80),
+        entry(0x3_0000_c000, 0x2_0000_0100),
+    ]
+    .concat();
+    let compute = entry(0x4_0000_1000, 0x5_0000_0010).to_vec();
+    let check = |list: UapiAttachmentList, raw: &[u8]| {
+        assert_eq!(list.as_slice().len(), raw.len() / UAPI_ATTACHMENT_SIZE);
+        for (attachment, raw) in list.as_slice().iter().zip(raw.chunks(UAPI_ATTACHMENT_SIZE)) {
+            field(raw, "attachment.pointer", 0, 8, attachment.address);
+            field(raw, "attachment.size", 8, 8, attachment.size);
+        }
+    };
+
+    // Lists persist until replaced; an empty list clears only its own kind.
+    let mut bytes = frame(2, &vertex);
+    bytes.extend(frame(3, &fragment));
+    bytes.extend(frame(4, &compute));
+    bytes.extend(frame(0, &[]));
+    bytes.extend(frame(1, &[]));
+    bytes.extend(frame(3, &[]));
+    bytes.extend(frame(0, &[]));
+    let mut parser = UapiCommandParser::new(&bytes);
+    for expected_fragment in [&fragment[..], &[]] {
+        let Some(ParsedHardwareCommand::Render {
+            vertex_attachments,
+            fragment_attachments,
+            ..
+        }) = parser.next_hardware().unwrap()
+        else {
+            panic!("render missing")
+        };
+        check(vertex_attachments, &vertex);
+        check(fragment_attachments, expected_fragment);
+        if !expected_fragment.is_empty() {
+            let Some(ParsedHardwareCommand::Compute { attachments, .. }) =
+                parser.next_hardware().unwrap()
+            else {
+                panic!("compute missing")
+            };
+            check(attachments, &compute);
+        }
+    }
+    assert!(parser.next_hardware().unwrap().is_none());
+    assert_eq!(parser.finish(), Ok(3));
+}
+
+#[test]
+fn dependencies_count_hardware_commands_and_bound_the_submit() {
+    for field in [4, 6] {
+        let mut bytes = frame(1, &[]);
+        bytes[field..field + 2].copy_from_slice(&1u16.to_le_bytes());
+        assert_eq!(parse(&bytes), Err(UapiTranslateError::BarrierFuture));
+    }
+    let mut bytes = frame(2, &[]);
+    bytes.extend(frame(0, &[]));
+    let mut compute = frame(1, &[]);
+    compute[4..6].copy_from_slice(&1u16.to_le_bytes());
+    bytes.extend(compute);
+    assert_eq!(parse(&bytes), Ok(2));
+    let command = frame(1, &[]);
+    assert_eq!(
+        parse(&command.repeat(UAPI_MAX_HARDWARE_COMMANDS as usize)),
+        Ok(UAPI_MAX_HARDWARE_COMMANDS)
+    );
+    assert_eq!(
+        parse(&command.repeat(UAPI_MAX_HARDWARE_COMMANDS as usize + 1)),
+        Err(UapiTranslateError::HardwareCommandCount)
+    );
+}
+
+struct Region {
+    start: u64,
+    end: u64,
+    writable: bool,
+}
+impl GpuAddressSpace for Region {
+    fn covers(&self, address: u64, size: u64, access: GpuAccess) -> bool {
+        let Some(end) = address.checked_add(size) else {
+            return false;
+        };
+        address >= self.start && end <= self.end && (access == GpuAccess::Read || self.writable)
+    }
+}
+
+#[test]
+fn attachment_validation_rejects_readonly_zero_and_wrapped_ranges() {
+    let mut list = UapiAttachmentList::EMPTY;
+    list.count = 1;
+    let mut region = Region {
+        start: 0x4000,
+        end: 0x8000,
+        writable: false,
+    };
+    list.entries[0] = UapiAttachment {
+        address: 0x4000,
+        size: 0x4000,
+    };
+    assert_eq!(
+        validate_attachments(&region, &list),
+        Err(UapiTranslateError::AddressRange)
+    );
+    region.writable = true;
+    assert_eq!(validate_attachments(&region, &list), Ok(()));
+    for (address, size) in [(0x4000, 0), (0x4000, 0x4001), (u64::MAX, 2)] {
+        list.entries[0] = UapiAttachment { address, size };
+        assert_eq!(
+            validate_attachments(&region, &list),
+            Err(UapiTranslateError::AddressRange)
+        );
+    }
+}
+
+#[test]
+fn usc_windows_reject_misalignment_overflow_and_unmapped_programs() {
+    let queue = QueueUscWindow {
+        base: USC_WINDOW_SIZE,
+        user_start: 0x4000,
+        user_end: 2 * USC_WINDOW_SIZE,
+    };
+    assert_eq!(queue.validate(), Ok(()));
+    assert_eq!(
+        QueueUscWindow {
+            base: queue.base + 1,
+            ..queue
+        }
+        .validate(),
+        Err(UapiTranslateError::QueueUscAlignment)
+    );
+    assert_eq!(
+        QueueUscWindow {
+            base: u64::MAX & !(USC_WINDOW_SIZE - 1),
+            ..queue
+        }
+        .validate(),
+        Err(UapiTranslateError::QueueUscRange)
+    );
+    assert_eq!(
+        QueueUscWindow {
+            user_end: queue.user_end - 1,
+            ..queue
+        }
+        .validate(),
+        Err(UapiTranslateError::QueueUscRange)
+    );
+    let region = Region {
+        start: queue.base + 8,
+        end: queue.base + 12,
+        writable: false,
+    };
+    assert_eq!(queue.full_program(&region, 9), Ok(queue.base + 8));
+    assert_eq!(
+        queue.full_program(&region, 0),
+        Err(UapiTranslateError::ProgramOffset)
+    );
+    assert_eq!(
+        queue.full_program(&region, 16),
+        Err(UapiTranslateError::AddressRange)
+    );
+}
+
+#[test]
+fn unsupported_firmware_cannot_reach_the_existing_profile() {
+    let identity = (1, 1, 0x07022000, [0xff, 0, 0]);
+    assert!(admission::validate_identity(
+        &[14, 8, 3],
+        identity.0,
+        identity.1,
+        identity.2,
+        identity.3
+    )
+    .is_some());
+    for version in [&[26, 6, 2][..], &[14, 8][..], &[14, 8, 3, 0][..], &[][..]] {
+        assert!(admission::validate_identity(
+            version, identity.0, identity.1, identity.2, identity.3
+        )
+        .is_none());
+    }
+}
+
+#[test]
+fn firmware_profile_agrees_with_the_actual_c_header() {
+    assert_eq!(
+        layout()["profile.params_required"].0 as u64,
+        m3_profile::PARAMS_REQUIRED
+    );
+    assert_eq!(layout()["profile.vm_create_size"].0, 24);
+    assert_eq!(
+        layout()["profile.hal200"].0 as u32,
+        m3_profile::Profile::Extended.hal()
+    );
+    assert_eq!(layout()["profile.features"].0, 0x0a);
+}
diff --git a/tools/asahi/run-host-tests.py b/tools/asahi/run-host-tests.py
index c4c6e21383fbf..04a2670f39b6c 100755
--- a/tools/asahi/run-host-tests.py
+++ b/tools/asahi/run-host-tests.py
@@ -53,7 +53,9 @@ def mutations(flag, names, base, expect=KILL):
 
 # test file -> [(arguments, expectation)]. '{out}' is a fresh directory.
 ASAHI_TESTS = {
+    'test-m3-uapi.py': [([], PASS)],
     'test-m3-mailbox.py': [([], PASS)],
+    'test-j613-dcp-power.py': [([], PASS)],
     'aop-als-channel-tests.py': [([], PASS)],
     'mtp-pm-tests.py': [(out(), PASS),
                          (out() + ['--old-transport', '4db3a5a22c43'], PASS)],
@@ -171,6 +173,7 @@ def mutations(flag, names, base, expect=KILL):
 
 # Production G17 decoder vectors also build directly with rustc --test.
 ASAHI_RUST.append('g17-telemetry-tests.rs')
+ASAHI_RUST.append('m3-firmware-tests.rs')
 
 # Python that runs on the host but imports its neighbours, so it keeps the
 # script directory on sys.path (-E -s instead of -I).
diff --git a/tools/asahi/test-j613-dcp-power.py b/tools/asahi/test-j613-dcp-power.py
new file mode 100644
index 0000000000000..3bc1a3379c253
--- /dev/null
+++ b/tools/asahi/test-j613-dcp-power.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Compile the production J613 PMGR predicate and test PMGR fields and unrelated bits."""
+from pathlib import Path
+import os
+import subprocess
+import tempfile
+
+root = Path(__file__).resolve().parents[2]
+source = (root / "drivers/gpu/drm/apple/j613_dcp_activate.c").read_text()
+start = source.index("static bool j613_power_state_active(")
+end = source.index("\n}\n", start) + 3
+stub = r"""
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+typedef uint32_t u32;
+#define BIT(n) (1U << (n))
+#define GENMASK(a,b) (((1U << ((a)-(b)+1))-1) << (b))
+#define FIELD_GET(mask,v) (((v) & (mask)) >> __builtin_ctz(mask))
+"""
+main = r"""
+int main(void) {
+ /* Only ACTUAL[7:4], TARGET[3:0] and AUTO_ENABLE[28] affect readiness. */
+ const u32 unrelated_mask = ~(GENMASK(7, 0) | BIT(28));
+ u32 unrelated[32] = {0, unrelated_mask,
+                      0xaaaaaaaaU & unrelated_mask,
+                      0x55555555U & unrelated_mask};
+ unsigned int count = 4;
+ for (unsigned int bit = 8; bit < 32; bit++)
+  if (bit != 28) unrelated[count++] = BIT(bit);
+ for (unsigned int i = 0; i < count; i++)
+ for (u32 actual = 0; actual < 16; actual++)
+ for (u32 target = 0; target < 16; target++)
+ for (u32 automatic = 0; automatic < 2; automatic++) {
+  u32 word = unrelated[i] | (actual << 4) | target | (automatic << 28);
+  bool expected = actual == 15 || (target == 15 && automatic);
+  if (j613_power_state_active(word) != expected) {
+   fprintf(stderr, "PMGR state 0x%08x: expected active=%d\n", word, expected);
+   return 1;
+  }
+ }
+ if (!j613_power_state_active(0x1404024f)) return 2;
+ if (j613_power_state_active(0x0404024f)) return 3;
+ if (j613_power_state_active(0x14040240)) return 4;
+ puts("PASS: 13824 PMGR combinations and captured-state regression controls");
+ return 0;
+}
+"""
+with tempfile.TemporaryDirectory() as temporary:
+    path = Path(temporary) / "power.c"
+    path.write_text(stub + source[start:end] + main)
+    for flags in (["-O0"], ["-O2"]):
+        exe = str(path.with_suffix(""))
+        subprocess.run([os.environ.get("CC", "cc"), "-Wall", "-Wextra", "-Werror",
+                        *flags, str(path), "-o", exe], check=True)
+        subprocess.run([exe], check=True)
diff --git a/tools/asahi/test-m3-mailbox.py b/tools/asahi/test-m3-mailbox.py
index 2320d17f10f6f..167b0566b2e5d 100644
--- a/tools/asahi/test-m3-mailbox.py
+++ b/tools/asahi/test-m3-mailbox.py
@@ -77,6 +77,17 @@ def vec(values):
     assert!(!ok(&compat,&reg,&names,&irqs,1));
     let mut v=names.clone(); v[0]^=1; assert!(!ok(&compat,&reg,&v,&irqs,cells));
     for v in [b"apple,asc-mailbox-v4\\0".to_vec(), b"apple,t8122-agx-asc-mailbox\\0unknown\\0".to_vec(), b"apple,t6031-agx-asc-mailbox\\0".to_vec()] { assert!(!ok(&v,&reg,&names,&irqs,cells)); }
+    // Compatible lists are ordered: reversing either supported pair must fail.
+    for pair in soc.mailbox_compatibles {
+        let parts: Vec<_> = pair.split(|byte| *byte == 0).filter(|part| !part.is_empty()).collect();
+        if parts.len() == 2 {
+            let mut reversed = parts[1].to_vec();
+            reversed.push(0);
+            reversed.extend_from_slice(parts[0]);
+            reversed.push(0);
+            assert!(!ok(&reversed,&reg,&names,&irqs,cells));
+        }
+    }
     for v in soc.mailbox_compatibles { assert!(ok(&v.to_vec(),&reg,&names,&irqs,cells)); }
 }
 fn main() {
diff --git a/tools/asahi/test-m3-uapi.py b/tools/asahi/test-m3-uapi.py
new file mode 100755
index 0000000000000..a63249e18869d
--- /dev/null
+++ b/tools/asahi/test-m3-uapi.py
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Compile public C producers and run the production Rust parser offline."""
+import argparse
+import hashlib
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+
+def run(command, **kwargs):
+    subprocess.run(command, check=True, **kwargs)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--mesa", type=Path, help="matched public Mesa source")
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parents[2]
+    if sys.byteorder != "little":
+        raise SystemExit("C fixtures currently require a little-endian host")
+    cc = os.environ.get("CC", "cc")
+    rustc = os.environ.get("RUSTC", "rustc")
+    fixture_source = root / "tools/asahi/m3-uapi-fixture.c"
+    with tempfile.TemporaryDirectory(prefix="asahi-uapi-") as temporary:
+        work = Path(temporary)
+        headers = work / "headers"
+        run(["make", "-s", "-C", str(root), "O=" + str(work / "headers-build"),
+             "ARCH=arm64", "headers_install", "INSTALL_HDR_PATH=" + str(headers)])
+        sources = [(headers / "include", "drm/asahi_drm.h")]
+        if args.mesa:
+            sources.append((args.mesa.resolve() / "include", "drm-uapi/asahi_drm.h"))
+        fixtures = []
+        layouts = []
+        prefixes = []
+        for index, (includes, header) in enumerate(sources):
+            producer = work / ("producer-" + str(index))
+            run([cc, "-std=c11", "-Wall", "-Wextra", "-Werror",
+                 "-I" + str(includes), '-DASAHI_HEADER="' + header + '"',
+                 str(fixture_source), "-o", str(producer)])
+            prefix = work / ("prefix-" + str(index))
+            with prefix.open("wb") as output:
+                run([str(producer)], stdout=output)
+            prefixes.append(prefix)
+            layout = work / ("layout-" + str(index))
+            with layout.open("wb") as output:
+                run([str(producer), "--layout"], stdout=output)
+            layouts.append(layout)
+            fixture = work / ("fixture-" + str(index))
+            with fixture.open("wb") as output:
+                run([str(producer), "--full"], stdout=output)
+            fixtures.append(fixture)
+        reference = prefixes[0].read_bytes()
+        if any(prefix.read_bytes() != reference for prefix in prefixes[1:]):
+            raise SystemExit("kernel/Mesa canonical fixture mismatch")
+        print("canonical fixture sha256=" + hashlib.sha256(reference).hexdigest(), flush=True)
+        for optimized in (False, True):
+            binary = work / ("tests-optimized" if optimized else "tests-debug")
+            command = [rustc, "--edition=2021", "--test",
+                       str(root / "tools/asahi/m3-uapi-tests.rs"), "-o", str(binary)]
+            if optimized:
+                command.append("-O")
+            run(command)
+            for index, fixture in enumerate(prefixes + fixtures):
+                env = dict(os.environ, ASAHI_UAPI_FIXTURE=str(fixture),
+                           ASAHI_UAPI_LAYOUT=str(layouts[index % len(layouts)]))
+                run([str(binary)], env=env)
+
+
+if __name__ == "__main__":
+    main()

From 32ad46810d2a07ffec5f7c1aa675bdb2b772024d Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:38:59 -0400
Subject: [PATCH 04/14] drm/asahi: construct and publish extended T8122
 initialization data

Build extended initialization owners, controller images and channel
records with checked allocation spans. Publish the bounded loader table
through existing M3 ownership. Keep extended runtime admission closed.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_channel_format.rs | 182 ++++++++
 drivers/gpu/drm/asahi/m3/m3_compute_layout.rs | 171 ++++++--
 drivers/gpu/drm/asahi/m3/m3_config.rs         | 179 +++++++-
 drivers/gpu/drm/asahi/m3/m3_firmware.rs       |  59 +++
 drivers/gpu/drm/asahi/m3/m3_init_26.rs        |  22 +-
 drivers/gpu/drm/asahi/m3/m3_mmio_26.rs        |  33 +-
 drivers/gpu/drm/asahi/m3/m3_power_26.rs       | 414 ++++++++++++++++++
 drivers/gpu/drm/asahi/m3/mod.rs               |   5 +
 tools/asahi/m3-runtime-tests.rs               |  12 +
 tools/asahi/run-host-tests.py                 |   1 +
 tools/asahi/test-m3-power.py                  | 173 ++++++++
 11 files changed, 1215 insertions(+), 36 deletions(-)
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_channel_format.rs
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_power_26.rs
 create mode 100644 tools/asahi/test-m3-power.py

diff --git a/drivers/gpu/drm/asahi/m3/m3_channel_format.rs b/drivers/gpu/drm/asahi/m3/m3_channel_format.rs
new file mode 100644
index 0000000000000..45eebda112b73
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_channel_format.rs
@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! Bounded firmware channel records. Publication and retirement belong to Config.
+
+use super::m3_init_layout::Error;
+
+pub(crate) const CONTROL_BYTES: usize = 64;
+pub(crate) const RECEIVE_BYTES: usize = 72;
+pub(crate) const SLOTS: u32 = 256;
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum Action {
+    Initialize,
+    Register {
+        pipe: u32,
+        engine: u32,
+    },
+    Idle {
+        enabled: bool,
+    },
+    Release {
+        group: u8,
+        index: u8,
+        weight: u8,
+        address: u64,
+    },
+}
+
+impl Action {
+    /// The first two actions precede the first generation-bearing publication.
+    pub(crate) fn generation(self, published: u32, consumed: u32) -> Result<u32, Error> {
+        match self {
+            Self::Initialize | Self::Register { .. } => {
+                if published != 0 || consumed != 0 {
+                    return Err(Error::Address);
+                }
+                Ok(0)
+            }
+            _ => published.max(consumed).checked_add(1).ok_or(Error::Address),
+        }
+    }
+
+    pub(crate) fn encode(self, output: &mut [u8]) -> Result<(), Error> {
+        let mut words = [0u32; 3];
+        let mut release = None;
+        match self {
+            Self::Initialize => words[0] = 0x16,
+            Self::Register { pipe, engine } => {
+                if pipe >= 3 || !(1..=2).contains(&engine) {
+                    return Err(Error::Address);
+                }
+                words = [0x1b, pipe, engine];
+            }
+            Self::Idle { enabled } => words = [0x0a, enabled.into(), 0],
+            Self::Release {
+                group,
+                index,
+                weight,
+                address,
+            } => {
+                if index == 255
+                    || weight == 255
+                    || address < 0xffff_fc00_0000_0000
+                    || address & 7 != 0
+                {
+                    return Err(Error::Address);
+                }
+                words[0] = 0x14;
+                words[2] = u32::from_le_bytes([group, index, weight, 4]);
+                release = Some(address);
+            }
+        }
+        let bytes = output.get_mut(..CONTROL_BYTES).ok_or(Error::Size)?;
+        bytes.fill(0);
+        for (index, word) in words.iter().enumerate() {
+            bytes[index * 4..index * 4 + 4].copy_from_slice(&word.to_le_bytes());
+        }
+        if let Some(address) = release {
+            bytes[12..20].copy_from_slice(&address.to_le_bytes());
+        }
+        Ok(())
+    }
+}
+
+/// An empty ring is required before publishing a synchronous control transaction.
+/// Both consumers must retire it before the next control action may be published.
+pub(crate) fn idle_cursor(cursors: [u32; 3]) -> Result<u32, Error> {
+    if cursors.iter().any(|value| *value >= SLOTS) {
+        return Err(Error::Bounds);
+    }
+    if cursors[0] != cursors[2] || cursors[1] != cursors[2] {
+        return Err(Error::Address);
+    }
+    Ok(cursors[2])
+}
+
+pub(crate) fn payload_offset(thread: usize, slot: u32) -> Result<usize, Error> {
+    if thread >= 9 {
+        return Err(Error::Bounds);
+    }
+    Ok((thread * 256 + (slot & 255) as usize) * 0xd8)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn initialization_records_have_only_their_defined_words() {
+        for action in [Action::Initialize, Action::Register { pipe: 2, engine: 1 }] {
+            let mut output = [0xa5; CONTROL_BYTES + 8];
+            action.encode(&mut output).unwrap();
+            assert_eq!(&output[12..CONTROL_BYTES], &[0; CONTROL_BYTES - 12]);
+            assert_eq!(&output[CONTROL_BYTES..], &[0xa5; 8]);
+            assert_eq!(action.generation(0, 0), Ok(0));
+            assert!(action.generation(1, 0).is_err());
+        }
+    }
+
+    #[test]
+    fn invalid_actions_preserve_the_entire_output() {
+        for action in [
+            Action::Register { pipe: 3, engine: 1 },
+            Action::Register { pipe: 0, engine: 0 },
+            Action::Release {
+                group: 0,
+                index: 255,
+                weight: 1,
+                address: 0xffff_fc21_0000_0000,
+            },
+            Action::Release {
+                group: 0,
+                index: 0,
+                weight: 1,
+                address: 8,
+            },
+        ] {
+            let mut output = [0xa5; CONTROL_BYTES];
+            assert!(action.encode(&mut output).is_err());
+            assert_eq!(output, [0xa5; CONTROL_BYTES]);
+        }
+    }
+
+    #[test]
+    fn generations_follow_consumption_and_never_wrap() {
+        let action = Action::Idle { enabled: true };
+        assert_eq!(action.generation(3, 5), Ok(6));
+        assert_eq!(action.generation(5, 3), Ok(6));
+        assert!(action.generation(u32::MAX, 0).is_err());
+        assert!(action.generation(0, u32::MAX).is_err());
+        let mut output = [0; CONTROL_BYTES];
+        action.encode(&mut output).unwrap();
+        assert_eq!(&output[..8], &[10, 0, 0, 0, 1, 0, 0, 0]);
+    }
+
+    #[test]
+    fn both_consumers_and_all_indices_are_checked() {
+        assert_eq!(idle_cursor([255, 255, 255]), Ok(255));
+        for cursors in [[0, 1, 1], [1, 0, 1], [256, 256, 256]] {
+            assert!(idle_cursor(cursors).is_err());
+        }
+        assert_eq!(payload_offset(8, 0x101), Ok((8 * 256 + 1) * 0xd8));
+        assert!(payload_offset(9, 0).is_err());
+    }
+
+    #[test]
+    fn release_uses_the_packed_owned_pointer() {
+        let action = Action::Release {
+            group: 1,
+            index: 2,
+            weight: 3,
+            address: 0xffff_fc21_0400_0000,
+        };
+        let mut output = [0; CONTROL_BYTES];
+        action.encode(&mut output).unwrap();
+        assert_eq!(&output[8..12], &[1, 2, 3, 4]);
+        assert_eq!(
+            u64::from_le_bytes(output[12..20].try_into().unwrap()),
+            0xffff_fc21_0400_0000
+        );
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs b/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
index 74bed858b71e2..64c8cb005c4a1 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only OR MIT
 use super::{m3_pool_layout::GpuRegion, m3_queue_layout::{Error, FirmwareVa}};
 pub(crate) const SIZE: usize = 0x893;
+pub(crate) const EXTENDED_SIZE: usize = 0x8b0;
 pub(crate) const REGISTERS: usize = 0x20;
 pub(crate) const REGISTER_COUNT: usize = 22;
 /// G15G takes the same list without its last two registers (0xa599, 0xd411).
@@ -64,12 +65,22 @@ impl Command {
     /// Validate before any output mutation. Encoding operates on ordinary host
     /// bytes; the caller copies them into the owned unpublished command buffer.
     pub(crate) fn encode(&self, out: &mut [u8]) -> Result<(), Error> {
-        if out.len() < SIZE { return Err(Error::Size); }
+        self.encode_for(super::m3_profile::Profile::Legacy, 0, 0, out)
+    }
+
+    /// Firmware envelopes vary independently of the GPU's CDM stream format.
+    pub(crate) fn encode_for(&self, profile: super::m3_profile::Profile,
+        asid_generation: u8, event_slot: u8, out: &mut [u8]) -> Result<(), Error> {
+        let extended = profile == super::m3_profile::Profile::Extended;
+        let size = if extended { EXTENDED_SIZE } else { SIZE };
+        if out.len() < size { return Err(Error::Size); }
+        if extended && (self.register_set != RegisterSet::G15G || event_slot >= 4
+            || (self.context != 0 && asid_generation == 0)) { return Err(Error::Address); }
         if self.context >= 64 || self.cdm_last.get() < self.cdm.get() { return Err(Error::Address); }
         if self.preemption.size() < 0x14a0 || self.microsequence_size == 0 || self.microsequence_size > 4096 {
             return Err(Error::Size);
         }
-        self.gpu_alias.add((SIZE - 3) as u64)?; // inclusive final aligned dword
+        self.gpu_alias.add(((size - 1) & !3) as u64)?; // inclusive final aligned dword
         let registers = self.gpu_alias.add(REGISTERS as u64)?;
         let preemption = self.preemption.base();
         let values = [
@@ -82,45 +93,143 @@ impl Command {
             (0x1a0b9, 0), (0x1a0c1, 0), (0x101d1, 0), (0xd479, 0),
             (0x1a0e9, 8), (0x107a1, 0xff0000), (0xa599, 0x13200400020), (0xd411, 0x200000001),
         ];
-        let bytes = &mut out[..SIZE];bytes.fill(0);
+        let bytes = &mut out[..size];bytes.fill(0);
         word(bytes, 0, 3); // compute opcode
-        pointer(bytes, COUNTER, u64::from(self.counter));
-        word(bytes, CONTEXT, self.context);
-        pointer(bytes, 0x14, self.notifier.get());
-        let count = match self.register_set {
+        if extended {
+            word(bytes, 0xc, self.context);
+            pointer(bytes, 0x10, self.notifier.get());
+        } else {
+            pointer(bytes, COUNTER, u64::from(self.counter));
+            word(bytes, CONTEXT, self.context);
+            pointer(bytes, 0x14, self.notifier.get());
+        }
+        let legacy_count = match self.register_set {
             RegisterSet::G15S => REGISTER_COUNT,
             RegisterSet::G15G => G15G_REGISTER_COUNT,
         };
-        for (n, (register, value)) in values.into_iter().take(count).enumerate() {
-            word(bytes, REGISTERS+n*REGISTER_STRIDE, register);
-            pointer(bytes, REGISTERS+n*REGISTER_STRIDE+4, value);
+        let mut count = 0;
+        let mut emit = |register, value| {
+            word(bytes, REGISTERS + count * REGISTER_STRIDE, register);
+            pointer(bytes, REGISTERS + count * REGISTER_STRIDE + 4, value);
+            count += 1;
+        };
+        let limit = if extended { REGISTER_COUNT } else { legacy_count };
+        for (register, value) in values.into_iter().take(limit) {
+            if extended && register == 0x12091 { continue; }
+            emit(register, value);
+        }
+        if extended {
+            emit(0x1a540, 1);
+            emit(0x014a9, 1);
+            emit(0x0a351, 1);
         }
         pointer(bytes, 0x720, registers.get());
         bytes[0x728..0x72a].copy_from_slice(&(count as u16).to_le_bytes());
         bytes[0x72a..0x72c].copy_from_slice(&((count*REGISTER_STRIDE) as u16).to_le_bytes());
         pointer(bytes, 0x760, self.microsequence.get());
         word(bytes, 0x768, self.microsequence_size);
-        // ComputeInfo2 mirrors the preemption buffer, inclusive CDM end and
-        // qualified control word from the register list.
-        pointer(bytes, 0x76c+0x28, preemption);
-        pointer(bytes, 0x76c+0x30, self.cdm_last.get());
-        pointer(bytes, 0x76c+0x58, QUALIFIED_COMPUTE_CONTROL);
-        word(bytes, 0x7cc+0x14, u32::MAX); // EncoderParams.unk_mask
-        pointer(bytes, META, self.stamp.get());
-        pointer(bytes, META+8, self.fw_stamp.get());
-        word(bytes, STAMP_VALUE, self.stamp_value);
-        word(bytes, META+0x14, 2); // qualified compute event slot
-        word(bytes, FLUSH_STAMPS, u32::from(self.flush_stamps));
-        word(bytes, META+0x20, 0xc10000); // producer UUID
-        word(bytes, QUEUE_COUNT, self.counter);
-        pointer(bytes, TAIL+8, self.timestamps[0].get());
-        pointer(bytes, TAIL+16, self.timestamps[1].get());
-        pointer(bytes, TAIL+0x2e, self.pool.get());
-        bytes[TAIL+0x36] = 1; // SharedCommandTail.unk_846
-        pointer(bytes, TAIL+0x37, 0xad0000);
-        pointer(bytes, TAIL+0x3f, 0x1600000);
-        pointer(bytes, TAIL+0x47, self.tail_scratch.get());
-        bytes[TAIL+0x4f] = 1; // SharedCommandTail.unk_85f
+        let info = if extended { 0x770 } else { 0x76c };
+        pointer(bytes, info + 0x28, preemption);
+        pointer(bytes, info + 0x30, self.cdm_last.get());
+        pointer(bytes, info + 0x58, QUALIFIED_COMPUTE_CONTROL);
+        word(bytes, if extended { 0x7e8 } else { 0x7e0 }, u32::MAX);
+        let meta = if extended { 0x800 } else { META };
+        pointer(bytes, meta, self.stamp.get());
+        pointer(bytes, meta + 8, self.fw_stamp.get());
+        word(bytes, meta + 0x10, self.stamp_value);
+        word(bytes, meta + 0x14, 2);
+        if extended { word(bytes, meta + 0x18, event_slot.into()); }
+        word(bytes, meta + 0x1c, u32::from(self.flush_stamps));
+        word(bytes, meta + 0x20, 0xc10000);
+        word(bytes, meta + 0x24, self.counter);
+        let tail = if extended { 0x82c } else { TAIL };
+        pointer(bytes, tail + 8, self.timestamps[0].get());
+        pointer(bytes, tail + 16, self.timestamps[1].get());
+        pointer(bytes, tail + if extended { 0x3e } else { 0x2e }, self.pool.get());
+        bytes[tail + if extended { 0x46 } else { 0x36 }] = 1;
+        pointer(bytes, tail + if extended { 0x47 } else { 0x37 },
+            if extended { 0x1588000 } else { 0xad0000 });
+        pointer(bytes, tail + if extended { 0x4f } else { 0x3f },
+            if extended { 0xef8000 } else { 0x1600000 });
+        pointer(bytes, tail + if extended { 0x57 } else { 0x47 }, self.tail_scratch.get());
+        if extended { bytes[0x88b] = asid_generation; }
+        else { bytes[TAIL + 0x4f] = 1; }
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use super::super::m3_profile::Profile;
+
+    fn fixture() -> Command {
+        let firmware = |n: u64| FirmwareVa::new(0xffff_fc21_8000_0000 + n * 0x4000).unwrap();
+        Command {
+            context: 3, counter: 7, notifier: firmware(0),
+            preemption: GpuRegion::new(0x5000_0000, 0x4000).unwrap(),
+            cdm: GpuVa::new(0x6000_0000).unwrap(),
+            cdm_last: GpuVa::new(0x6000_0ffc).unwrap(),
+            gpu_alias: GpuVa::new(0x7000_0000).unwrap(),
+            microsequence: firmware(1), microsequence_size: 0x300,
+            stamp: firmware(2), fw_stamp: firmware(3), stamp_value: 0x700,
+            timestamps: [firmware(4), firmware(5)], pool: firmware(6),
+            tail_scratch: firmware(7), flush_stamps: true,
+            register_set: RegisterSet::G15G,
+        }
+    }
+    fn read32(b: &[u8], o: usize) -> u32 {
+        u32::from_le_bytes(b[o..o + 4].try_into().unwrap())
+    }
+    fn read64(b: &[u8], o: usize) -> u64 {
+        u64::from_le_bytes(b[o..o + 8].try_into().unwrap())
+    }
+
+    #[test]
+    fn extended_envelope_preserves_stream_and_native_visibility_boundary() {
+        let c = fixture();
+        let mut b = [0xa5; EXTENDED_SIZE + 16];
+        c.encode_for(Profile::Extended, 9, 2, &mut b).unwrap();
+        assert_eq!(read32(&b, 0xc), c.context);
+        assert_eq!(read64(&b, 0x10), c.notifier.get());
+        assert_eq!(read32(&b, 0x728) & 0xffff, 24);
+        let count = (read32(&b, 0x728) & 0xffff) as usize;
+        let cdm = (0..count).find(|n| read32(&b, 0x20 + n * 12) == 0x1a420).unwrap();
+        assert_eq!(read64(&b, 0x24 + cdm * 12), c.cdm.get());
+        assert_eq!(read64(&b, 0x7a0), c.cdm_last.get());
+        assert_eq!(read64(&b, 0x800), c.stamp.get());
+        assert_eq!(read64(&b, 0x808), c.fw_stamp.get());
+        assert_eq!(read32(&b, 0x818), 2);
+        assert_eq!(read32(&b, 0x81c), 1);
+        assert_eq!(read64(&b, 0x834), c.timestamps[0].get());
+        assert_eq!(read64(&b, 0x86a), c.pool.get());
+        assert_eq!(read64(&b, 0x883), c.tail_scratch.get());
+        assert_eq!(b[0x88b], 9);
+        assert_eq!(&b[EXTENDED_SIZE..], &[0xa5; 16]);
+    }
+
+    #[test]
+    fn extended_validation_never_mutates_a_rejected_envelope() {
+        for (generation, slot) in [(0, 0), (1, 4), (1, 255)] {
+            let mut b = [0xa5; EXTENDED_SIZE];
+            assert!(fixture().encode_for(Profile::Extended, generation, slot, &mut b).is_err());
+            assert_eq!(b, [0xa5; EXTENDED_SIZE]);
+        }
+        let mut b = [0xa5; EXTENDED_SIZE - 1];
+        assert!(fixture().encode_for(Profile::Extended, 1, 0, &mut b).is_err());
+        assert_eq!(b, [0xa5; EXTENDED_SIZE - 1]);
+    }
+
+    #[test]
+    fn legacy_wrapper_keeps_legacy_geometry_and_register_order() {
+        let c = fixture();
+        let mut b = [0xa5; EXTENDED_SIZE];
+        c.encode(&mut b).unwrap();
+        assert_eq!(read32(&b, CONTEXT), c.context);
+        assert_eq!(read64(&b, 0x14), c.notifier.get());
+        assert_eq!(read32(&b, 0x728) & 0xffff, 20);
+        assert_eq!(read32(&b, REGISTERS + 8 * REGISTER_STRIDE), 0x12091);
+        assert_eq!(read64(&b, META), c.stamp.get());
+        assert_eq!(&b[SIZE..], &[0xa5; EXTENDED_SIZE - SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_config.rs b/drivers/gpu/drm/asahi/m3/m3_config.rs
index c4a44c4b4f3b0..67f4f963637f2 100644
--- a/drivers/gpu/drm/asahi/m3/m3_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_config.rs
@@ -49,6 +49,8 @@ impl Records {
 
 pub(crate) struct Config {
     objects: KVec<Buffer>,
+    profile: super::m3_profile::Profile,
+    control_generation: u32,
     _iomaps: KVec<mmu::KernelMapping>,
     pub(crate) completed_events: u64,
     pstates: crate::m3::m3_adt_config::PstateWatch,
@@ -140,7 +142,8 @@ impl Config {
         crate::m3::m3_adt_config::check_upload(dev.as_ref().as_ref(), firmware, contents.iomaps, &mut objects)?;
         agx_memory::publish();
         let thermal = crate::m3::m3_thermal::Governor::new(dev.as_ref().as_ref(), &contents.pstates)?;
-        Ok(Self { objects, _iomaps: iomaps, completed_events: 0,
+        Ok(Self { objects, profile: firmware.profile(), control_generation: 0,
+            _iomaps: iomaps, completed_events: 0,
             pstates: crate::m3::m3_adt_config::PstateWatch::new(contents.pstates), thermal,
             request_top:contents.table.0,request_value:0,request_checked:false,
             request_check_at:None,request_writes:0,request_observed:0 })
@@ -261,6 +264,9 @@ impl Config {
         Ok(true)
     }
     pub(crate) fn ready(&mut self) -> Result<bool> {
+        if self.profile == super::m3_profile::Profile::Extended {
+            return Ok(self.objects[RUNTIME_FLAGS].read_u32(0x14)? == 1);
+        }
         // NewRegionB+4 is an input initialized to 1, not an acknowledgement.
         // These are firmware-written transitions present in compute-15's
         // pre-submit snapshot; both start at zero in the exported schema.
@@ -343,10 +349,38 @@ impl Config {
         agx_memory::publish();
         Ok(next)
     }
+    /// Publish an extended-format synchronous control. The caller rings the
+    /// doorbell after this method and waits for both retirement cursors.
+    pub(crate) fn control_extended(&mut self, action: super::m3_channel_format::Action) -> Result<u32> {
+        use super::m3_channel_format as format;
+        if self.profile != super::m3_profile::Profile::Extended { return Err(EINVAL); }
+        let state = storage::DEVICE_CONTROL * 2;
+        let cursors = [self.objects[state].read_u32(0)?,
+            self.objects[state].read_u32(0x10)?, self.objects[state].read_u32(0x20)?];
+        let cursor = format::idle_cursor(cursors).map_err(|_| EBUSY)?;
+        let consumed = self.objects[CONTROL_REGION].read_u32(0xeae8)?;
+        let generation = action.generation(self.control_generation, consumed).map_err(|_| EOVERFLOW)?;
+        let mut record = [0; format::CONTROL_BYTES];
+        action.encode(&mut record).map_err(|_| EINVAL)?;
+        self.objects[state + 1].write(cursor as usize * format::CONTROL_BYTES, &record)?;
+        if generation != 0 {
+            self.objects[GLOBALS].write(0xe41, &generation.to_le_bytes())?;
+        }
+        agx_memory::publish();
+        let next = (cursor + 1) % format::SLOTS;
+        self.objects[state].u32(0x20, next)?;
+        agx_memory::publish();
+        self.control_generation = generation;
+        Ok(next)
+    }
+
     pub(crate) fn control_done(&mut self, next: u32) -> Result<bool> {
         Ok(self.objects[storage::DEVICE_CONTROL*2].read_u32(0)? == next && self.objects[storage::DEVICE_CONTROL*2].read_u32(0x10)? == next)
     }
     pub(crate) fn drain(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            return self.drain_extended(dev);
+        }
         // Event, trace, stats and six independent firmware log rings.
         for (state, ring, size, count, channels) in [(storage::EVENT*2,storage::EVENT*2+1,0x38,256,1),
             (storage::TRACE*2,storage::TRACE*2+1,0x38,512,1),
@@ -392,4 +426,147 @@ impl Config {
         }
         Ok(())
     }
+    fn drain_extended(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
+        use super::m3_channel_format as format;
+        // Snapshot each producer once. New arrivals remain for the next drain;
+        // a corrupt cursor is rejected before reading its ring allocation.
+        for (channel, capacity, threads) in [(storage::FIRMWARE_LOG, 256, 9),
+            (storage::EVENT, 256, 1), (storage::TRACE, 512, 1), (storage::STATS, 256, 1)] {
+            let state = channel * 2;
+            for thread in 0..threads {
+                let at = thread * 0x30;
+                let mut read = self.objects[state].read_u32(at)?;
+                let write = self.objects[state].read_u32(at + 0x20)?;
+                if read >= capacity || write >= capacity { return Err(EIO); }
+                let before = read;
+                while read != write {
+                    let offset = (thread * capacity as usize + read as usize) * format::RECEIVE_BYTES;
+                    let mut record = [0; format::RECEIVE_BYTES];
+                    self.objects[state + 1].read(offset, &mut record)?;
+                    let kind = u32::from_le_bytes(record[..4].try_into().map_err(|_| EIO)?);
+                    if channel == storage::FIRMWARE_LOG {
+                        let slot = u32::from_le_bytes(record[8..12].try_into().map_err(|_| EIO)?);
+                        let payload = format::payload_offset(thread, slot).map_err(|_| EIO)?;
+                        if crate::debug::debug_enabled(crate::debug::DebugFlags::KTraceCh) {
+                            let mut text = [0; 200];
+                            self.objects[FWLOG_PAYLOAD].read(payload + 0x10, &mut text)?;
+                            let len = text.iter().position(|value| *value == 0).unwrap_or(text.len());
+                            dev_info!(dev.as_ref(), "M3 firmware log[{}]: {}\n", thread,
+                                core::str::from_utf8(&text[..len]).unwrap_or("<non-UTF8>"));
+                        }
+                    } else if channel == storage::EVENT {
+                        if kind != 1 {
+                            dev_err!(dev.as_ref(), "M3 firmware event {}: {:02x?}\n", kind, record);
+                            return Err(EIO);
+                        }
+                        let flags = u32::from_le_bytes(record[4..8].try_into().map_err(|_| EIO)?);
+                        self.completed_events = self.completed_events.saturating_add((flags & 7).count_ones().into());
+                    } else if (channel == storage::TRACE && kind != 5)
+                        || (channel == storage::STATS && kind == 0x16) {
+                        dev_err!(dev.as_ref(), "M3 firmware channel {} record {}: {:02x?}\n", channel, kind, record);
+                        return Err(EIO);
+                    }
+                    read = (read + 1) % capacity;
+                }
+                if read != before { self.objects[state].u32(at, read)?; }
+            }
+        }
+        agx_memory::publish();
+        Ok(())
+    }
+
+}
+
+/// All extended initialization owners, retained as one construction transaction.
+/// Nothing is published to RTKit by this constructor. A failed allocation drops
+/// its mappings before backing storage and leaves no root visible to firmware.
+pub(crate) struct ExtendedStorage {
+    pub(crate) objects: KVec<Buffer>,
+    pub(crate) iomaps: KVec<mmu::KernelMapping>,
+    pub(crate) descriptors: KVec<u8>,
+    pub(crate) maximum_khz: u32,
+}
+
+impl ExtendedStorage {
+    pub(crate) fn new(
+        dev: &driver::AsahiDrmDevice,
+        uat: &mmu::Uat,
+        pwr: &super::hw::PwrConfig,
+        sram_uv: &[u32],
+        bases: super::m3_mmio_26::RegisterBases,
+    ) -> Result<Self> {
+        use super::{m3_init_26 as plan, m3_mmio_26 as io};
+        let mut objects = KVec::new();
+        for index in 0..plan::COUNT {
+            let entry = plan::allocation(index).map_err(|_| EINVAL)?;
+            let alias = match index {
+                plan::GLOBAL_POOL => Some((uat.kernel_lower_vm(), 0x70_0000_0000)),
+                plan::GLOBAL_PARAMETERS => Some((uat.kernel_lower_vm(), 0x70_0000_8000)),
+                _ => None,
+            };
+            let object = if plan::cached(index) {
+                Buffer::at_prot(dev, uat.kernel_vm(), alias, Some(entry.address), entry.size,
+                    prot::PROT_FW_PRIV_RW, prot::PROT_GPU_SHARED_RW)?
+            } else {
+                Buffer::at(dev, uat.kernel_vm(), alias, Some(entry.address), entry.size, entry.gpu_shared)?
+            };
+            objects.push(object, GFP_KERNEL)?;
+        }
+        let mut descriptors = KVec::new();
+        descriptors.resize(io::SLOTS * io::RECORD_BYTES, 0, GFP_KERNEL)?;
+        let mut iomaps = KVec::new();
+        for slot in 0..io::SLOTS {
+            let mut region = None;
+            if let Some(area) = io::area(slot, bases).map_err(|_| EINVAL)? {
+                let address = 0xffff_fc23_0000_0000 + slot as u64 * 0x10_0000;
+                let access = if area.writable() { prot::PROT_FW_MMIO_RW } else { prot::PROT_FW_MMIO_RO };
+                for (physical, bytes, offset) in area.banks() {
+                    if bytes == 0 { continue; }
+                    let mapping = uat.kernel_vm().map_io_m3(address + offset as u64,
+                        physical.try_into()?, bytes, access)?;
+                    iomaps.push(mapping, GFP_KERNEL)?;
+                }
+                region = Some(init::Region::new(address, area.mapped_bytes()).map_err(|_| EINVAL)?);
+            }
+            io::encode(slot, bases, region,
+                &mut descriptors[slot * io::RECORD_BYTES..(slot + 1) * io::RECORD_BYTES])
+                .map_err(|_| EINVAL)?;
+        }
+        // Runtime+0x18 references Fender SRAM, rather than anonymous DMA RAM.
+        // Retain its normal shared mapping independently of its MMIO view.
+        let scratch_physical = bases.gpu.checked_add(0xd6_0000).ok_or(EOVERFLOW)?;
+        let scratch = uat.kernel_vm().map_io_m3(0xffff_fc22_0000_0000,
+            scratch_physical.try_into()?, 0x8000, prot::PROT_FW_SHARED_RW)?;
+        let scratch_region = init::Region::new(scratch.iova(), 0x8000).map_err(|_| EINVAL)?;
+        iomaps.push(scratch, GFP_KERNEL)?;
+        let mut regions = [init::Region::new(0xffff_fc21_0000_0000, 1).map_err(|_| EINVAL)?; plan::COUNT];
+        for (index, object) in objects.iter().enumerate() {
+            regions[index] = init::Region::new(object.va(), object.size()).map_err(|_| EINVAL)?;
+        }
+        let graph = plan::PointerGraph { owners: &regions, scratch: scratch_region,
+            pool_alias: objects[plan::GLOBAL_POOL].gpu_va()?,
+            parameter_alias: objects[plan::GLOBAL_PARAMETERS].gpu_va()? };
+        let mut root = [0; 0xc8];
+        let mut runtime = [0; plan::RUNTIME_SIZE];
+        let mut control = KVec::new();
+        control.resize(plan::allocation(CONTROL_REGION).map_err(|_| EINVAL)?.size, 0, GFP_KERNEL)?;
+        graph.root(&mut root).map_err(|_| EINVAL)?;
+        graph.runtime(&mut runtime).map_err(|_| EINVAL)?;
+        graph.firmware_control(&mut control).map_err(|_| EINVAL)?;
+        let images = super::m3_power_26::PowerImages::new(pwr, sram_uv,
+            objects[plan::SENSOR_VALUE].va(), objects[plan::RETENTION_STATE].va(),
+            agx_memory::TIMESTAMP_RANGE.start, &descriptors)?;
+        objects[storage::ROOT].write(0, &root)?;
+        objects[RUNTIME_POINTERS].write(0, &runtime)?;
+        objects[CONTROL_REGION].write(0, &control)?;
+        objects[HARDWARE_DATA].write(0, &images.hardware)?;
+        objects[plan::PERFORMANCE_CONTROL].write(0, &images.performance)?;
+        objects[GLOBALS_POWER].write(0, &images.power)?;
+        objects[GLOBALS].write(0, &images.globals)?;
+        // Fragment scheduler entries start unassigned; these are input sentinels.
+        objects[UNKNOWN_C1].u32(0xc18, u32::MAX)?;
+        objects[UNKNOWN_C1].u32(0xc30, u32::MAX)?;
+        agx_memory::publish();
+        Ok(Self { objects, iomaps, descriptors, maximum_khz: images.maximum_khz })
+    }
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_firmware.rs b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
index c9aa45cc02864..6bc87a33aaa05 100644
--- a/drivers/gpu/drm/asahi/m3/m3_firmware.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
@@ -255,6 +255,51 @@ impl Firmware {
     }
 }
 
+/// Only the admitted extended image has this host-owned boot descriptor slot.
+fn loader_span(profile: super::m3_profile::Profile, data_bytes: u64, input_bytes: usize)
+    -> Option<core::ops::Range<usize>> {
+    if profile != super::m3_profile::Profile::Extended || input_bytes != 53 * 40
+        || data_bytes != T8122_LAYOUT_26.data_size { return None; }
+    let start: usize = 0x12_28e0;
+    let end = start.checked_add(input_bytes)?;
+    if end as u64 > data_bytes { return None; }
+    Some(start..end)
+}
+
+#[cfg(not(test))]
+impl Firmware {
+    /// Call after RTKit application startup and before exposing the InitData root.
+    /// The protocol grants the host this slot only during that boot interval.
+    pub(crate) fn publish_io_table(
+        &self,
+        pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
+        descriptors: &[u8],
+    ) -> kernel::error::Result {
+        use kernel::{c_str, io::mem::{Mem, MemFlag}, prelude::*};
+        let data = self.resources.regions[5];
+        let span = loader_span(self.profile(), data.size, descriptors.len()).ok_or(EINVAL)?;
+        let node = pdev.as_ref().of_node().ok_or(ENODEV)?;
+        let resource = agx_resources::reserved_resource(&node, c_str!("fw-data"))?;
+        if resource.start() != data.base || resource.size() != data.size { return Err(EINVAL); }
+        // SAFETY: This exact admitted no-map reservation remains firmware-owned.
+        // Only its bounded host boot slot is accessed, before root publication.
+        let mapping = unsafe { Mem::try_new(resource, MemFlag::WC.into()) }?;
+        if span.end > mapping.size() { return Err(EINVAL); }
+        // Validate the whole slot before changing any byte. Unexpected prior
+        // contents indicate a protocol/ownership mismatch, not a patchable image.
+        for offset in span.clone() {
+            // SAFETY: span is bounded by the retained mapping above.
+            if unsafe { mapping.ptr().add(offset).read_volatile() } != 0 { return Err(EBUSY); }
+        }
+        for (offset, byte) in span.zip(descriptors.iter().copied()) {
+            // SAFETY: same bounded host slot, exclusive under the boot protocol.
+            unsafe { mapping.ptr().add(offset).write_volatile(byte) };
+        }
+        crate::m3::agx_memory::publish();
+        Ok(())
+    }
+}
+
 #[cfg(not(test))]
 pub(crate) fn identify_loaded(
     pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
@@ -527,4 +572,18 @@ mod tests {
         assert!(!newer.accepts_runtime(KNOWN_IMAGES_T8122[0].uuid, &[0; 32]));
     }
 
+    #[test]
+    fn loader_slot_is_exact_bounded_and_profile_specific() {
+        use super::super::m3_profile::Profile;
+        let length = 53 * 40;
+        assert_eq!(loader_span(Profile::Extended, 0x12c000, length), Some(0x1228e0..0x123128));
+        for size in [0, 0x123127, 0x12bfff, 0x12c001, u64::MAX] {
+            assert!(loader_span(Profile::Extended, size, length).is_none());
+        }
+        for bytes in [0, length - 1, length + 1, usize::MAX] {
+            assert!(loader_span(Profile::Extended, 0x12c000, bytes).is_none());
+        }
+        assert!(loader_span(Profile::Legacy, 0x12c000, length).is_none());
+    }
+
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_init_26.rs b/drivers/gpu/drm/asahi/m3/m3_init_26.rs
index f08f16200b070..a86432b2bbe2b 100644
--- a/drivers/gpu/drm/asahi/m3/m3_init_26.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_init_26.rs
@@ -62,7 +62,7 @@ pub(crate) fn allocation(index: usize) -> Result<Allocation, Error> {
 }
 
 pub(crate) fn cached(index: usize) -> bool {
-    matches!(index, 38 | 39 | 42 | 43 | 44 | PERFORMANCE_CONTROL)
+    matches!(index, 39 | PERFORMANCE_CONTROL)
 }
 
 pub(crate) struct PointerGraph<'a> {
@@ -103,7 +103,10 @@ impl PointerGraph<'_> {
         }
         let scratch = self.scratch.at(0, 0x8000)?;
         let scratch_end = scratch.checked_add(0x8000).ok_or(Error::Address)?;
-        if scratch & 0x3fff != 0 || scratch_end > 0xffff_fc2f_fc00_0000 {
+        if scratch & 0x3fff != 0
+            || scratch < 0xffff_fc20_0000_0000
+            || scratch_end > 0xffff_fc2f_fc00_0000
+        {
             return Err(Error::Address);
         }
         for (index, address) in addresses.iter().enumerate() {
@@ -272,4 +275,19 @@ mod tests {
         assert!(graph(&owners).runtime(&mut output).is_err());
         assert_eq!(output, [0xa5; RUNTIME_SIZE]);
     }
+    #[test]
+    fn only_atomic_controller_owners_are_firmware_cacheable() {
+        let selected: Vec<_> = (0..COUNT).filter(|index| cached(*index)).collect();
+        assert_eq!(selected, vec![39, PERFORMANCE_CONTROL]);
+    }
+
+    #[test]
+    fn scratch_requires_its_firmware_host_window() {
+        let owners = owners(0);
+        let mut value = graph(&owners);
+        value.scratch = Region::new(0xffff_fc10_0000_0000, 0x8000).unwrap();
+        let mut output = [0xa5; RUNTIME_SIZE];
+        assert_eq!(value.runtime(&mut output), Err(Error::Address));
+        assert_eq!(output, [0xa5; RUNTIME_SIZE]);
+    }
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs b/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
index e4008f239c4a0..a17bc0ee399c3 100644
--- a/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
@@ -18,6 +18,10 @@ pub(crate) struct Area {
 }
 
 impl Area {
+    pub(crate) fn writable(self) -> bool {
+        self.writable
+    }
+
     pub(crate) fn page_offset(self) -> usize {
         (self.physical & 0x3fff) as usize
     }
@@ -78,6 +82,16 @@ pub(crate) fn area(slot: usize, bases: RegisterBases) -> Result<Option<Area>, Er
     if physical == 0 || physical.checked_add(bytes as u64).ok_or(Error::Address)? > 1 << 42 {
         return Err(Error::Address);
     }
+    if split
+        && (physical & 0x3fff != 0
+            || physical
+                .checked_add(0x200_0000)
+                .and_then(|v| v.checked_add((bytes / 2) as u64))
+                .filter(|v| *v <= 1 << 42)
+                .is_none())
+    {
+        return Err(Error::Address);
+    }
     Ok(Some(Area {
         physical,
         bytes,
@@ -143,8 +157,7 @@ pub(crate) fn encode(
 mod tests {
     use super::*;
 
-    // Register identities already present in the public T8122 configuration;
-    // memory-controller bank geometry is shared with the public 25G83 encoder.
+    // Resource owners exercise subpage mappings and split memory-controller banks.
     const BASES: RegisterBases = RegisterBases {
         gpu: 0x2_9000_0000,
         interrupt: 0x2_d101_4000,
@@ -262,4 +275,20 @@ mod tests {
             assert_eq!(output, [0xa5; RECORD_BYTES]);
         }
     }
+    #[test]
+    fn split_banks_require_page_alignment_and_both_fit_the_bus() {
+        for memory in [BASES.memory + 4, (1 << 42) - 0x100_0000] {
+            let mut bases = BASES;
+            bases.memory = memory;
+            let mut output = [0xa5; RECORD_BYTES];
+            assert!(encode(
+                3,
+                bases,
+                Some(Region::new(0xffff_fc21_0000_0000, 0x30000).unwrap()),
+                &mut output
+            )
+            .is_err());
+            assert_eq!(output, [0xa5; RECORD_BYTES]);
+        }
+    }
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_power_26.rs b/drivers/gpu/drm/asahi/m3/m3_power_26.rs
new file mode 100644
index 0000000000000..2619c24b4eb6a
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_power_26.rs
@@ -0,0 +1,414 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! Build the extended M3 controller images from admitted device-tree inputs.
+//! These are constructor inputs. Firmware owns subsequent controller outputs.
+
+use super::{hw, initdata::PStateTables};
+use crate::{f32, float::F32};
+use kernel::prelude::*;
+
+struct Image(KVec<u8>);
+impl Image {
+    fn new(size: usize) -> Result<Self> {
+        let mut bytes = KVec::new();
+        bytes.resize(size, 0, GFP_KERNEL)?;
+        Ok(Self(bytes))
+    }
+    fn word(&mut self, offset: usize, value: u32) -> Result {
+        self.0
+            .get_mut(offset..offset.checked_add(4).ok_or(EOVERFLOW)?)
+            .ok_or(ERANGE)?
+            .copy_from_slice(&value.to_le_bytes());
+        Ok(())
+    }
+    fn pointer(&mut self, offset: usize, value: u64) -> Result {
+        self.0
+            .get_mut(offset..offset.checked_add(8).ok_or(EOVERFLOW)?)
+            .ok_or(ERANGE)?
+            .copy_from_slice(&value.to_le_bytes());
+        Ok(())
+    }
+    fn float(&mut self, offset: usize, value: F32) -> Result {
+        let bits = value.to_bits();
+        if bits & 0x7f80_0000 == 0x7f80_0000 {
+            return Err(EINVAL);
+        }
+        self.word(offset, bits)
+    }
+    fn reciprocal(&mut self, negative: usize, positive: usize, periods: u32) -> Result {
+        if periods == 0 {
+            return Err(EINVAL);
+        }
+        let alpha = f32!(1.0) / F32::from(periods);
+        self.float(negative, f32!(1.0) - alpha)?;
+        self.float(positive, alpha)
+    }
+}
+
+pub(crate) struct PowerImages {
+    pub(crate) hardware: KVec<u8>,
+    pub(crate) performance: KVec<u8>,
+    pub(crate) power: KVec<u8>,
+    pub(crate) globals: KVec<u8>,
+    pub(crate) maximum_khz: u32,
+}
+
+impl PowerImages {
+    /// `sram_uv` follows the same OPP iteration order as PwrConfig::perf_states.
+    /// No reference-bin voltage or experimental OPP-power estimate is substituted.
+    pub(crate) fn new(
+        pwr: &hw::PwrConfig,
+        sram_uv: &[u32],
+        sensor: u64,
+        retention: u64,
+        timestamp_base: u64,
+        io_records: &[u8],
+    ) -> Result<Self> {
+        let table = PStateTables::new(pwr, true, None, false)?;
+        let second = table.secondary.ok_or(EINVAL)?;
+        if table.len != 9
+            || table.max != 8
+            || sram_uv.len() != pwr.perf_states.len()
+            || pwr.perf_base_pstate == 0
+            || pwr.perf_base_pstate > 8
+            || !(1..=1000).contains(&pwr.power_sample_period)
+            || pwr.pwr_min_duty_cycle > 100
+            || pwr.avg_power_min_duty_cycle > 100
+            || io_records.len() != super::m3_mmio_26::SLOTS * super::m3_mmio_26::RECORD_BYTES
+            || [sensor, retention, timestamp_base]
+                .iter()
+                .any(|value| *value < 0xffff_fc00_0000_0000 || value & 7 != 0)
+        {
+            return Err(EINVAL);
+        }
+        let top = &pwr.perf_states[table.primary[8] as usize];
+        let base = &pwr.perf_states[table.primary[pwr.perf_base_pstate as usize] as usize];
+        if top.freq_hz != 1_338_000_000 || base.freq_hz >= top.freq_hz {
+            return Err(EINVAL);
+        }
+        let period = pwr.power_sample_period;
+        let ppm_periods = pwr.ppm_filter_time_constant_ms / period;
+        let average_periods = pwr.avg_power_filter_tc_ms / period;
+        if [
+            ppm_periods,
+            average_periods,
+            pwr.pwr_filter_time_constant,
+            pwr.perf_filter_time_constant,
+            pwr.perf_filter_time_constant2,
+            pwr.avg_power_target_filter_tc,
+            pwr.se_filter_time_constant,
+            pwr.se_filter_time_constant_1,
+        ]
+        .contains(&0)
+        {
+            return Err(EINVAL);
+        }
+        let clocks = |count: u32| {
+            count
+                .checked_mul(period)
+                .and_then(|v| v.checked_mul(24_000))
+                .ok_or(EOVERFLOW)
+        };
+        let dt = F32::from(period) / f32!(1000.0);
+        let ceiling = 800;
+        let base_units = pwr.perf_base_pstate * 100;
+        // The profile controller budget is independent of the loader's experimental
+        // OPP power model. It is not a demand floor or a replacement voltage table.
+        let budget = 22_044u32;
+        let mut main = Image::new(0x2658)?;
+        let mut performance = Image::new(0x6578)?;
+        let mut power = Image::new(0x670)?;
+        let mut globals = Image::new(0xe48)?;
+
+        main.pointer(0x28, timestamp_base)?;
+        main.0[0x640..0xe88].copy_from_slice(io_records);
+        main.pointer(0xe88, retention)?;
+        main.word(0xe90, 0x8122)?;
+        main.word(0xe94, 2)?;
+        main.word(0xe9c, 4)?;
+        main.word(0xea0, 1)?;
+        main.word(0xea4, 1)?;
+        main.word(0xeb8, 1)?;
+        main.word(0xec0, 1)?;
+        main.word(0xec8, 1)?;
+        main.word(0xed0, 24_000)?;
+        main.word(0xed4, 1)?;
+        main.word(0xed8, period)?;
+        main.word(0xee0, 1)?;
+        main.word(0xee4, 1)?;
+        main.word(0xee8, 1)?;
+        main.word(0xf04, 31)?;
+        main.pointer(0xf24, 4)?;
+        main.word(0xf34, 1)?;
+        // Firmware completion is polled through its normal bounded status path.
+        main.word(0xf38, 0)?;
+        main.word(0xf4c, 49)?;
+        main.word(0xf6c, 1)?;
+        main.word(0xf88, 10)?;
+        main.word(0xf8c, 3)?;
+        main.word(0xfac, 1)?;
+        main.word(0xfb8, 22)?;
+        main.word(0xfbc, 5)?;
+        main.word(0xfc0, 10)?;
+        main.word(0xfc4, 8)?;
+        main.word(0x1cd8, 8)?;
+        for state in 0..9 {
+            let primary = table.primary[state] as usize;
+            let secondary = second[state] as usize;
+            let item = &pwr.perf_states[primary];
+            let auxiliary = &pwr.perf_states[secondary];
+            if item.volt_mv.len() != 1
+                || auxiliary.volt_mv.len() != 1
+                || !(100..=1100).contains(&item.volt_mv[0])
+                || !(100..=1100).contains(&auxiliary.volt_mv[0])
+                || !(100_000..=1_100_000).contains(&sram_uv[primary])
+                || !(100_000..=1_100_000).contains(&sram_uv[secondary])
+                || sram_uv[primary].div_ceil(1000) < item.volt_mv[0]
+                || sram_uv[secondary].div_ceil(1000) < auxiliary.volt_mv[0]
+            {
+                return Err(EINVAL);
+            }
+            main.word(0xfc8 + state * 4, item.freq_hz / 1_000_000)?;
+            main.word(0x1808 + state * 4, auxiliary.freq_hz / 1_000_000)?;
+            main.float(0x1848 + state * 4, f32!(1.02))?;
+            for lane in 0..16 {
+                main.word(0x1008 + state * 64 + lane * 4, item.volt_mv[0])?;
+                main.word(
+                    0x1408 + state * 64 + lane * 4,
+                    sram_uv[primary].div_ceil(1000),
+                )?;
+            }
+            main.word(0x1cdc + state * 4, auxiliary.freq_hz / 1_000_000)?;
+            if state != 0 {
+                main.word(0x1d1c + state * 64, auxiliary.volt_mv[0])?;
+            }
+            main.word(0x211c + state * 64, sram_uv[secondary].div_ceil(1000))?;
+            if state != 0 {
+                // Profile indices for the admitted eight-state ladder.
+                let core_profile = if state <= 3 { state } else { 2 * state - 3 };
+                let auxiliary_profile = if state <= 4 { state } else { 2 * state - 4 };
+                main.word(0x19c8 + state * 4, core_profile as u32)?;
+                main.word(0x1a08 + state * 4, auxiliary_profile as u32)?;
+                let boost = item.freq_hz.saturating_sub(base.freq_hz) / 1_000_000;
+                main.word(
+                    0x1908 + state * 4,
+                    100 * boost / ((top.freq_hz - base.freq_hz) / 1_000_000),
+                )?;
+            }
+        }
+        // The native relative-power calibration of each running firmware state.
+        // Encode only these semantic percentages, not an object-image overlay.
+        for (state, percent) in [15, 25, 36, 46, 58, 75, 90, 100].into_iter().enumerate() {
+            main.word(0x18c8 + (state + 1) * 4, percent)?;
+        }
+        main.word(0x2544, 4)?;
+        main.word(0x2548, 6)?;
+        main.word(0x254c, 3)?;
+        main.word(0x2550, 7)?;
+        main.word(0x2554, 7)?;
+        main.word(0x2568, 10)?;
+        main.word(0x2570, 1)?;
+        main.word(0x258c, 0x160000)?;
+        main.word(0x2594, 1)?;
+        main.word(0x2598, 1)?;
+        main.word(0x259c, 1)?;
+        main.word(0x25a4, 1)?;
+        main.word(0x25a8, 1)?;
+        main.word(0x25ac, 1)?;
+        main.0[0x25b4..0x25e4].fill(0xff);
+        main.word(0x2604, 1)?;
+        main.word(0x2634, 1)?;
+
+        globals.word(0x24, 3000)?;
+        globals.word(0x78, 1)?;
+        globals.word(0x84, budget)?;
+        for offset in [0x88, 0x8c, 0x98] {
+            globals.word(offset, ceiling)?;
+        }
+        globals.word(0x998, 40)?;
+        globals.word(0x99c, 10)?;
+        globals.word(0x9a0, 250)?;
+        globals.word(0x9b8, 2)?;
+        globals.word(0x9bc, 40)?;
+        globals.word(0x9c0, 5)?;
+        globals.word(0x9c8, 40)?;
+        globals.word(0x9cc, 50)?;
+        globals.word(0xe28, 3)?;
+
+        power.word(0x10, average_periods)?;
+        power.float(0x14, pwr.avg_power_ki_only * dt)?;
+        power.float(0x18, pwr.avg_power_kp)?;
+        power.word(0x1c, pwr.avg_power_min_duty_cycle)?;
+        power.word(0x20, pwr.avg_power_target_filter_tc)?;
+        power.word(0xc8, 11_000)?;
+        power.word(0xcc, 8_000)?;
+        power.float(0xd8, pwr.fast_die0_proportional_gain)?;
+        power.float(0xdc, pwr.fast_die0_integral_gain * dt)?;
+        power.word(0x12c, budget)?;
+        power.float(0x130, pwr.ppm_kp)?;
+        power.float(0x134, pwr.ppm_ki * dt)?;
+        power.word(0x14c, 1)?;
+
+        performance.word(4, pwr.pwr_sample_period_aic_clks)?;
+        performance.word(8, pwr.pwr_sample_period_aic_clks)?;
+        performance.word(0x10, 4)?;
+        performance.float(0x14, f32!(1.0))?;
+        performance.word(0x2c, 1)?;
+        performance.word(0x30, 1)?;
+        // Leave the observed hardware state at zero until firmware writes it.
+        for offset in [0x40, 0x80, 0xb78, 0xb80, 0xbc0] {
+            performance.word(offset, base_units)?;
+        }
+        for offset in [0x44, 0x6c, 0x70, 0x84] {
+            performance.word(offset, 1)?;
+        }
+        for offset in [
+            0x48, 0x88, 0x9f4, 0x9f8, 0xa38, 0xaac, 0xaf0, 0xb7c, 0x221c, 0x22b4, 0x22b8, 0x22f8,
+            0x2870, 0x29f8, 0x29fc, 0x2a3c, 0x2b88, 0x2c44, 0x2c88,
+        ] {
+            performance.word(offset, ceiling)?;
+        }
+        performance.word(0x50, 100)?;
+        performance.word(0x60, 4)?;
+        performance.float(0x64, f32!(1.0))?;
+        performance.word(0x90, 100)?;
+        performance.word(0x9b8, 625)?;
+        performance.reciprocal(0x9c4, 0x9cc, pwr.pwr_filter_time_constant)?;
+        performance.float(0x9d4, pwr.pwr_integral_gain)?;
+        performance.float(0x9dc, F32::from(pwr.pwr_integral_min_clamp))?;
+        performance.float(0x9e0, F32::from(budget))?;
+        performance.float(0x9e4, pwr.pwr_proportional_gain)?;
+        performance.float(0x9ec, -F32::from(ceiling) / F32::from(budget))?;
+        for offset in [0x9f0, 0xaa8, 0x22b0] {
+            performance.word(offset, pwr.pwr_min_duty_cycle)?;
+        }
+        for offset in [0xa04, 0xabc, 0x28c8, 0x28cc, 0x28d0, 0x2a08] {
+            performance.word(offset, budget)?;
+        }
+        performance.word(0xa70, ppm_periods.checked_mul(4).ok_or(EOVERFLOW)?)?;
+        performance.reciprocal(0xa7c, 0xa84, ppm_periods)?;
+        performance.float(0xa8c, pwr.ppm_ki * dt)?;
+        performance.float(0xa98, f32!(65536.0))?;
+        performance.float(0xa9c, pwr.ppm_kp)?;
+        performance.word(0xac8, pwr.ppm_filter_time_constant_ms)?;
+        performance.word(0xad0, clocks(ppm_periods)?)?;
+        performance.word(0xb28, pwr.perf_tgt_utilization)?;
+        performance.word(0xb30, pwr.perf_boost_min_util)?;
+        performance.word(0xb34, pwr.perf_boost_ce_step)?;
+        performance.word(0xb38, pwr.perf_reset_iters)?;
+        performance.word(0xb40, 6)?;
+        performance.word(0xb44, 1)?;
+        performance.word(0xb48, pwr.perf_filter_drop_threshold)?;
+        performance.reciprocal(0xb4c, 0xb54, pwr.perf_filter_time_constant)?;
+        performance.reciprocal(0xb50, 0xb58, pwr.perf_filter_time_constant2)?;
+        performance.float(0xb5c, pwr.perf_integral_gain)?;
+        performance.float(0xb60, pwr.perf_integral_gain2)?;
+        performance.float(0xb64, F32::from(pwr.perf_integral_min_clamp))?;
+        performance.float(0xb68, f32!(95.0))?;
+        performance.float(0xb6c, pwr.perf_proportional_gain)?;
+        performance.float(0xb70, pwr.perf_proportional_gain2)?;
+        performance.float(0xb74, F32::from(8 - pwr.perf_base_pstate) / f32!(0.95))?;
+        performance.word(0xb8c, pwr.perf_tgt_utilization)?;
+        performance.float(0x21f0, f32!(65536.0))?;
+        performance.float(0x21f4, F32::from(pwr.pwr_min_duty_cycle))?;
+        performance.float(0x21f8, F32::from(ceiling))?;
+        performance.word(0x21fc, 1338)?;
+        performance.float(0x2218, f32!(100.0))?;
+        performance.float(0x2224, f32!(0.8))?;
+        performance.float(0x2228, f32!(0.2))?;
+        performance.word(0x2268, 0x4248)?;
+        performance.word(0x2270, 8_000)?;
+        performance.word(0x2278, 4)?;
+        performance.float(0x228c, f32!(1.0))?;
+        performance.float(0x2294, pwr.fast_die0_integral_gain * dt)?;
+        performance.float(0x22a0, f32!(65536.0))?;
+        performance.float(0x22a4, pwr.fast_die0_proportional_gain)?;
+        performance.word(0x22c4, 11_000)?;
+        performance.word(0x28c0, 1)?;
+        performance.reciprocal(0x28dc, 0x28e0, pwr.avg_power_target_filter_tc)?;
+        performance.word(
+            0x28e4,
+            pwr.avg_power_target_filter_tc
+                .checked_mul(4)
+                .ok_or(EOVERFLOW)?,
+        )?;
+        performance.word(
+            0x28e8,
+            pwr.avg_power_target_filter_tc
+                .checked_mul(period)
+                .ok_or(EOVERFLOW)?,
+        )?;
+        performance.word(0x28ec, clocks(pwr.avg_power_target_filter_tc)?)?;
+        performance.word(0x29bc, average_periods.checked_mul(4).ok_or(EOVERFLOW)?)?;
+        performance.reciprocal(0x29c8, 0x29d0, average_periods)?;
+        performance.float(0x29d8, pwr.avg_power_ki_only * dt)?;
+        performance.float(0x29e4, f32!(65536.0))?;
+        performance.float(0x29e8, pwr.avg_power_kp)?;
+        performance.word(0x29f4, pwr.avg_power_min_duty_cycle)?;
+        performance.float(0x2a04, F32::from(budget))?;
+        performance.word(0x2a14, pwr.avg_power_filter_tc_ms)?;
+        performance.word(0x2a1c, clocks(average_periods)?)?;
+        performance.word(0x2b4c, 50)?;
+        performance.word(0x2b50, 1)?;
+        performance.reciprocal(0x2b58, 0x2b60, pwr.se_filter_time_constant)?;
+        performance.reciprocal(0x2b5c, 0x2b64, pwr.se_filter_time_constant_1)?;
+        performance.float(0x2b68, pwr.se_ki * dt)?;
+        performance.float(0x2b6c, pwr.se_ki_1 * dt)?;
+        performance.float(0x2b74, f32!(65536.0))?;
+        performance.float(0x2b78, pwr.se_kp)?;
+        performance.float(0x2b7c, pwr.se_kp_1)?;
+        performance.word(0x2b84, 100)?;
+        performance.word(0x2b8c, 100)?;
+        performance.word(0x2b98, pwr.se_target)?;
+        performance.word(
+            0x2ba4,
+            pwr.se_filter_time_constant
+                .checked_mul(period)
+                .ok_or(EOVERFLOW)?,
+        )?;
+        performance.word(
+            0x2ba8,
+            pwr.se_filter_time_constant_1
+                .checked_mul(period)
+                .ok_or(EOVERFLOW)?,
+        )?;
+        performance.word(0x2bac, clocks(pwr.se_filter_time_constant)?)?;
+        performance.word(0x2bb4, clocks(pwr.se_filter_time_constant_1)?)?;
+        performance.float(0x2b94, f32!(8000.0))?;
+        for offset in [0x2bc0, 0x2bc4, 0x2c30] {
+            performance.float(offset, f32!(65536.0))?;
+        }
+        performance.word(0x2be8, 8000)?;
+        performance.word(0x2bec, 4)?;
+        performance.word(0x2bf0, pwr.se_inactive_threshold)?;
+        performance.word(0x2bf4, pwr.se_engagement_criteria as u32)?;
+        performance.word(0x2bf8, 2)?;
+        performance.word(0x2bfc, 4)?;
+        performance.word(0x2c00, pwr.se_reset_criteria)?;
+        performance.word(0x2c40, pwr.avg_power_min_duty_cycle)?;
+        performance.word(0x2e2c, 4)?;
+        performance.float(0x2e38, f32!(0.96875))?;
+        performance.float(0x2e40, f32!(0.03125))?;
+        performance.float(0x2e48, f32!(5.0))?;
+        performance.float(0x2e54, f32!(65536.0))?;
+        performance.float(0x2e58, f32!(15.0))?;
+        performance.word(0x2e64, 700)?;
+        for offset in [0x2e68, 0x2e6c, 0x2e78] {
+            performance.word(offset, ceiling)?;
+        }
+        performance.word(0x2f08, 0x4248)?;
+        performance.word(0x2f10, 125)?;
+        performance.word(0x2f14, 1)?;
+        performance.pointer(0x3b50, sensor)?;
+        performance.word(0x3b58, 0x4b48)?;
+        performance.word(0x3b60, 1)?;
+        performance.word(0x62a8, 1)?;
+        Ok(Self {
+            hardware: main.0,
+            performance: performance.0,
+            power: power.0,
+            globals: globals.0,
+            maximum_khz: top.freq_hz / 1000,
+        })
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/mod.rs b/drivers/gpu/drm/asahi/m3/mod.rs
index 7073ecf294d63..d885da1a8647c 100644
--- a/drivers/gpu/drm/asahi/m3/mod.rs
+++ b/drivers/gpu/drm/asahi/m3/mod.rs
@@ -202,3 +202,8 @@ mod t8122_hwdata;
 mod m3_init_26;
 mod m3_profile;
 mod m3_mmio_26;
+
+#[cfg(CONFIG_DRM_ASAHI_M3_T8122)]
+mod m3_power_26;
+
+mod m3_channel_format;
diff --git a/tools/asahi/m3-runtime-tests.rs b/tools/asahi/m3-runtime-tests.rs
index f1768a242147b..abac06668c0a1 100644
--- a/tools/asahi/m3-runtime-tests.rs
+++ b/tools/asahi/m3-runtime-tests.rs
@@ -24,3 +24,15 @@ mod m3_profile;
 
 #[path = "../../drivers/gpu/drm/asahi/m3/m3_mmio_26.rs"]
 mod m3_mmio_26;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_queue_layout.rs"]
+mod m3_queue_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_pool_layout.rs"]
+mod m3_pool_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_compute_layout.rs"]
+mod m3_compute_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_channel_format.rs"]
+mod m3_channel_format;
diff --git a/tools/asahi/run-host-tests.py b/tools/asahi/run-host-tests.py
index 04a2670f39b6c..5dfda83574ea6 100755
--- a/tools/asahi/run-host-tests.py
+++ b/tools/asahi/run-host-tests.py
@@ -53,6 +53,7 @@ def mutations(flag, names, base, expect=KILL):
 
 # test file -> [(arguments, expectation)]. '{out}' is a fresh directory.
 ASAHI_TESTS = {
+    'test-m3-power.py': [([], PASS)],
     'test-m3-uapi.py': [([], PASS)],
     'test-m3-mailbox.py': [([], PASS)],
     'test-j613-dcp-power.py': [([], PASS)],
diff --git a/tools/asahi/test-m3-power.py b/tools/asahi/test-m3-power.py
new file mode 100644
index 0000000000000..51bea088cd9db
--- /dev/null
+++ b/tools/asahi/test-m3-power.py
@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Run the production controller writer and soft-float code without a GPU.
+
+Kernel allocation/DT adapters are replaced by host adapters. Public production
+power types and PStateTables are extracted as complete balanced Rust items,
+never restated by hand. Their input hashes are printed with the test evidence.
+"""
+from pathlib import Path
+import hashlib
+import subprocess
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[2]
+M3 = ROOT / "drivers/gpu/drm/asahi/m3"
+
+
+def item(source, anchor):
+    start = source.index(anchor)
+    opening = source.index("{", start)
+    depth = 1
+    end = opening + 1
+    while depth:
+        if source[end] == "{":
+            depth += 1
+        elif source[end] == "}":
+            depth -= 1
+        end += 1
+    return source[start:end]
+
+
+shim = r'''
+#![allow(dead_code)]
+extern crate self as kernel;
+pub type Error = i32;
+pub type Result<T = ()> = core::result::Result<T, Error>;
+pub const EINVAL: Error = 22;
+pub const EOVERFLOW: Error = 75;
+pub const ERANGE: Error = 34;
+pub const GFP_KERNEL: () = ();
+pub unsafe trait Zeroable {}
+#[derive(Debug)]
+pub struct KVec<T>(Vec<T>);
+impl<T> Default for KVec<T> { fn default() -> Self { Self(Vec::new()) } }
+impl<T> KVec<T> {
+    pub fn new() -> Self { Self::default() }
+    pub fn resize(&mut self, n: usize, value: T, _: ()) -> Result where T: Clone {
+        self.0.resize(n, value); Ok(())
+    }
+}
+impl<T> core::ops::Deref for KVec<T> { type Target = Vec<T>; fn deref(&self) -> &Vec<T> { &self.0 } }
+impl<T> core::ops::DerefMut for KVec<T> { fn deref_mut(&mut self) -> &mut Vec<T> { &mut self.0 } }
+pub mod prelude { pub use crate::{Error,Result,EINVAL,EOVERFLOW,ERANGE,GFP_KERNEL,KVec,Zeroable}; }
+pub mod of {
+    pub struct Property<'a>(pub &'a [u8]);
+    pub trait PropertyUnit: Sized { const UNIT_SIZE: usize; fn from_bytes(data: &[u8]) -> crate::Result<Self>; }
+    impl PropertyUnit for u32 {
+        const UNIT_SIZE: usize = 4;
+        fn from_bytes(data: &[u8]) -> crate::Result<Self> {
+            Ok(u32::from_be_bytes(data.try_into().map_err(|_| crate::EINVAL)?))
+        }
+    }
+    impl TryFrom<Property<'_>> for u32 {
+        type Error = crate::Error;
+        fn try_from(value: Property<'_>) -> crate::Result<Self> { Self::from_bytes(value.0) }
+    }
+}
+'''
+fixture = r'''
+#[cfg(test)] mod controller_tests {
+    use super::*;
+    use float::F32;
+    fn input() -> hw::PwrConfig {
+        let mut p = hw::PwrConfig::default();
+        p.perf_states = KVec((0..9).map(|i| hw::PState {
+            freq_hz: if i == 8 { 1_338_000_000 } else { i * 100_000_000 },
+            volt_mv: KVec(vec![if i == 0 { 125 } else { 450 + i * 50 }]), pwr_mw: i * 1000,
+        }).collect());
+        p.perf_base_pstate = 1;
+        p.power_sample_period = 8;
+        p.ppm_filter_time_constant_ms = 16;
+        p.avg_power_filter_tc_ms = 16;
+        p.pwr_filter_time_constant = 2;
+        p.perf_filter_time_constant = 2;
+        p.perf_filter_time_constant2 = 2;
+        p.avg_power_target_filter_tc = 2;
+        p.se_filter_time_constant = 2;
+        p.se_filter_time_constant_1 = 2;
+        p.pwr_min_duty_cycle = 30;
+        p.avg_power_min_duty_cycle = 20;
+        p
+    }
+    fn build(p: &hw::PwrConfig, sram: &[u32]) -> Result<m3_power_26::PowerImages> {
+        m3_power_26::PowerImages::new(p, sram, 0xffff_fc21_0340_0000,
+            0xffff_fc21_0350_0000, 0xffff_fc2f_fc00_0000, &[0; 53 * 40])
+    }
+    fn word(b: &[u8], at: usize) -> u32 { u32::from_le_bytes(b[at..at + 4].try_into().unwrap()) }
+    #[test] fn native_controller_bounds_are_distinct_from_outputs_and_hardware_state() {
+        let image = build(&input(), &[950_001; 9]).unwrap();
+        assert_eq!(image.hardware.len(), 0x2658);
+        assert_eq!(image.performance.len(), 0x6578);
+        assert_eq!(image.power.len(), 0x670);
+        assert_eq!(image.globals.len(), 0xe48);
+        assert_eq!(image.maximum_khz, 1_338_000);
+        assert_eq!(word(&image.performance, 0x2c), 1);
+        assert_eq!(word(&image.performance, 0x30), 1);
+        assert_eq!(word(&image.performance, 0x38), 0);
+        assert_eq!(word(&image.performance, 0x9f0), 30);
+        assert_eq!(word(&image.performance, 0xa38), 800);
+        assert_eq!(word(&image.performance, 0xb78), 100);
+        assert_eq!(word(&image.performance, 0xb7c), 800);
+        assert_eq!(word(&image.hardware, 0x1408 + 64), 951);
+        assert_eq!(word(&image.performance, 0x2268), 0x4248);
+        assert_eq!(word(&image.performance, 0x3b58), 0x4b48);
+    }
+    #[test] fn malformed_tunables_and_nonfinite_gains_are_rejected() {
+        for period in [0, 1001, u32::MAX] {
+            let mut p = input(); p.power_sample_period = period;
+            assert!(build(&p, &[950_000; 9]).is_err());
+        }
+        for bits in [0x7f800000, 0xff800000, 0x7fc00001] {
+            let mut p = input(); p.pwr_integral_gain = F32::from_bits(bits);
+            assert!(build(&p, &[950_000; 9]).is_err());
+        }
+        assert!(build(&input(), &[950_000; 8]).is_err());
+        assert!(build(&input(), &[100_000; 9]).is_err());
+        let mut p = input(); p.avg_power_target_filter_tc = u32::MAX;
+        assert!(build(&p, &[950_000; 9]).is_err());
+    }
+    #[test] fn dt_order_is_not_the_firmware_voltage_order() {
+        let p = input();
+        let expected = build(&p, &[950_000; 9]).unwrap();
+        let mut shuffled = input();
+        shuffled.perf_states.swap(2, 6);
+        let actual = build(&shuffled, &[950_000; 9]).unwrap();
+        assert_eq!(actual.hardware.0, expected.hardware.0);
+        assert_eq!(actual.performance.0, expected.performance.0);
+    }
+}
+'''
+
+
+def main():
+    hw = (M3 / "hw.rs").read_text()
+    init = (M3 / "initdata.rs").read_text()
+    code = shim
+    # Keep the production soft-float prefix verbatim. Its unrelated existing
+    # print-only TODO test lacks an import and is not part of this harness.
+    soft_float = (ROOT / "drivers/gpu/drm/asahi/float.rs").read_text()
+    code += "mod float {\n" + soft_float.split("// TODO: Make this an actual test", 1)[0] + "\n}\n"
+    code += "mod hw { use crate::{KVec,float::F32};\n"
+    for name in ["PState", "PowerZone", "CsAfrPwrConfig", "PwrConfig"]:
+        code += "#[derive(Default)]\n" + item(hw, "pub(crate) struct " + name + " {") + "\n"
+    code += item(hw, "impl PState {") + "\n"
+    code += "}\nmod initdata { use crate::{prelude::*,hw}; const PSTATE_TABLE_ENTRIES: usize = 16;\n"
+    code += item(init, "pub(crate) struct PStateTables {") + "\n"
+    code += item(init, "impl PStateTables {") + "\n}\n"
+    code += "mod m3_mmio_26 { pub const SLOTS:usize=53; pub const RECORD_BYTES:usize=40; }\n"
+    code += f'#[path = "{M3}/m3_power_26.rs"] mod m3_power_26;\n'
+    code += fixture
+    for path in [M3 / "hw.rs", M3 / "initdata.rs", M3 / "m3_power_26.rs", ROOT / "drivers/gpu/drm/asahi/float.rs"]:
+        print(hashlib.sha256(path.read_bytes()).hexdigest(), path.relative_to(ROOT), flush=True)
+    with tempfile.TemporaryDirectory(prefix="m3-power-") as directory:
+        source = Path(directory) / "test.rs"
+        source.write_text(code)
+        for flags in [[], ["-O"]]:
+            binary = Path(directory) / "tests"
+            subprocess.run(["rustc", "--edition=2021", "--test", *flags, str(source), "-o", str(binary)], check=True)
+            subprocess.run([str(binary)], check=True)
+
+
+if __name__ == "__main__":
+    main()

From ee69dab429ed9f6498c03303dd34c9eb4af44ff2 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:40:41 -0400
Subject: [PATCH 05/14] drm/asahi: prepare extended firmware queues and
 controller handoff

Construct native queue, pool, context and notifier records. Read
controller inputs from the admitted OPP handoff, preserve nanosecond
durations and reject unsupported optional flags. Prepare native startup
without enabling extended admission.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_adt_config.rs     |  57 +++++++-
 drivers/gpu/drm/asahi/m3/m3_compute_layout.rs |  21 +++
 .../gpu/drm/asahi/m3/m3_compute_sequence.rs   | 110 +++++++++++++++
 .../gpu/drm/asahi/m3/m3_compute_storage.rs    |  66 +++++++++
 drivers/gpu/drm/asahi/m3/m3_config.rs         |  79 ++++++++++-
 drivers/gpu/drm/asahi/m3/m3_device.rs         |   6 +
 drivers/gpu/drm/asahi/m3/m3_drm.rs            |   3 +-
 drivers/gpu/drm/asahi/m3/m3_pool.rs           |  31 +++++
 drivers/gpu/drm/asahi/m3/m3_pool_layout.rs    | 128 ++++++++++++++++++
 drivers/gpu/drm/asahi/m3/m3_profile.rs        |  20 +++
 drivers/gpu/drm/asahi/m3/m3_queue_layout.rs   |  41 ++++++
 drivers/gpu/drm/asahi/m3/m3_runtime.rs        |  57 ++++++++
 drivers/gpu/drm/asahi/m3/m3_state_layout.rs   |  52 +++++++
 drivers/gpu/drm/asahi/m3/m3_submit.rs         |   8 +-
 drivers/gpu/drm/asahi/mmu.rs                  |   4 +-
 tools/asahi/m3-runtime-tests.rs               |  10 ++
 16 files changed, 678 insertions(+), 15 deletions(-)

diff --git a/drivers/gpu/drm/asahi/m3/m3_adt_config.rs b/drivers/gpu/drm/asahi/m3/m3_adt_config.rs
index 1893c113cf2a7..355cd44b04025 100644
--- a/drivers/gpu/drm/asahi/m3/m3_adt_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_adt_config.rs
@@ -260,7 +260,14 @@ impl PstatePolicy {
 
 /// The runtime backend's InitData contents: the generated object images and the
 /// performance-state policy.
+pub(crate) struct ExtendedInputs {
+    pub(crate) power: hw::PwrConfig,
+    pub(crate) sram_uv: KVec<u32>,
+    pub(crate) bases: super::m3_mmio_26::RegisterBases,
+}
+
 pub(crate) struct Contents {
+    pub(crate) extended: Option<ExtendedInputs>,
     /// Generated images, per owner; None for owners that stay zero. Only the three image
     /// owners' images are uploaded; the records' are checked.
     images: KVec<Option<KVVec<u8>>>,
@@ -304,6 +311,10 @@ impl Contents {
         experiment: Option<&Experiment>,
     ) -> Result<Self> {
         let dev = pdev.as_ref();
+        if firmware.profile() == super::m3_profile::Profile::Extended {
+            if experiment.is_some() { return Err(EINVAL); }
+            return Self::extended(dev, soc);
+        }
         let param = m3_params::initdata_param();
         check_version(dev, firmware, experiment)?;
         let iomaps = match experiment {
@@ -370,12 +381,54 @@ impl Contents {
         );
         let read_only_slots = experiment.map(|e| e.read_only_slots()).unwrap_or(0);
         let hwdata_object = soc.hwdata_object;
-        Ok(Contents { images, pstates, iomaps, table, read_only_slots, hwdata_object })
+        Ok(Contents { extended: None, images, pstates, iomaps, table, read_only_slots, hwdata_object })
+    }
+
+    fn extended(dev: &device::Device, soc: &Soc) -> Result<Self> {
+        let cfg = soc.hwcfg.ok_or(ENODEV)?;
+        if soc.chip_id != 0x8122 || cfg.chip_id != 0x8122 { return Err(ENODEV); }
+        let power = hw::PwrConfig::load(dev, cfg)?;
+        let tables = initdata::PStateTables::new(&power, true, None, false)?;
+        if tables.len != 9 || tables.max != 8 || tables.max_frequency_khz(&power) != 1_338_000 {
+            return Err(EINVAL);
+        }
+        let node = dev.of_node().ok_or(ENODEV)?;
+        let opps = node.parse_phandle(c_str!("operating-points-v2"), 0).ok_or(EINVAL)?;
+        let mut sram_uv = KVec::new();
+        for opp in opps.children() {
+            let values: KVec<u32> = opp.get_property(c_str!("opp-microvolt-sram"))?;
+            if values.len() != 1 { return Err(EINVAL); }
+            sram_uv.push(values[0], GFP_KERNEL)?;
+        }
+        if sram_uv.len() != power.perf_states.len() { return Err(EINVAL); }
+        let block = |index: usize| -> Result<u64> {
+            Ok(cfg.io_mappings.get(index).and_then(|value| value.as_ref()).ok_or(EINVAL)?.base as u64)
+        };
+        let bases = super::m3_mmio_26::RegisterBases {
+            gpu: soc.windows.sgx, interrupt: block(2)?,
+            memory: block(11)?.checked_add(0x1c4000).ok_or(EOVERFLOW)?,
+            telemetry_write: block(18)?, telemetry_read: block(19)?,
+            neural: block(25)?, metrology: block(26)?,
+        };
+        let mut freqs = [0; 16];
+        for (index, value) in freqs.iter_mut().enumerate().take(tables.len) {
+            *value = tables.primary_state(&power, index).freq_hz / 1_000_000;
+        }
+        // This profile enables the native firmware's thermal/PID controllers.
+        // The legacy host-only thermal governor must not replace those inputs.
+        let pstates = PstatePolicy { table_max: 8, table_max_mhz: 1338,
+            max: 8, safe: 8, boot: 1, max_mhz: 1338, safe_mhz: 1338,
+            boot_mhz: freqs[1], freqs, thermal: ThermalMode::Off };
+        let mut images = KVec::new();
+        for _ in 0..super::m3_init_26::COUNT { images.push(None, GFP_KERNEL)?; }
+        Ok(Self { extended: Some(ExtendedInputs { power, sram_uv, bases }),
+            images, pstates, iomaps: &[], table: (8, 1338), read_only_slots: 0, hwdata_object: None })
     }
 
     /// Check the contents before they are uploaded.
     pub(crate) fn check_for_upload(&self) -> Result {
-        if self.images.len() == storage::COUNT {
+        let count = if self.extended.is_some() { super::m3_init_26::COUNT } else { storage::COUNT };
+        if self.images.len() == count {
             Ok(())
         } else {
             Err(EINVAL)
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs b/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
index 64c8cb005c4a1..ace58e38f38a6 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
@@ -71,7 +71,14 @@ impl Command {
     /// Firmware envelopes vary independently of the GPU's CDM stream format.
     pub(crate) fn encode_for(&self, profile: super::m3_profile::Profile,
         asid_generation: u8, event_slot: u8, out: &mut [u8]) -> Result<(), Error> {
+        self.encode_with_usc(profile, asid_generation, event_slot, 0, out)
+    }
+
+    pub(crate) fn encode_with_usc(&self, profile: super::m3_profile::Profile,
+        asid_generation: u8, event_slot: u8, usc_base: u64, out: &mut [u8]) -> Result<(), Error> {
         let extended = profile == super::m3_profile::Profile::Extended;
+        if usc_base & 0xffff_ffff != 0 || usc_base >= 1 << 42
+            || (!extended && usc_base != 0) { return Err(Error::Address); }
         let size = if extended { EXTENDED_SIZE } else { SIZE };
         if out.len() < size { return Err(Error::Size); }
         if extended && (self.register_set != RegisterSet::G15G || event_slot >= 4
@@ -122,6 +129,7 @@ impl Command {
             emit(0x1a540, 1);
             emit(0x014a9, 1);
             emit(0x0a351, 1);
+            if usc_base != 0 { emit(0x10071, usc_base); }
         }
         pointer(bytes, 0x720, registers.get());
         bytes[0x728..0x72a].copy_from_slice(&(count as u16).to_le_bytes());
@@ -232,4 +240,17 @@ mod tests {
         assert_eq!(read64(&b, META), c.stamp.get());
         assert_eq!(&b[SIZE..], &[0xa5; EXTENDED_SIZE - SIZE]);
     }
+    #[test]
+    fn optional_usc_window_is_a_dispatch_register_without_stream_rewriting() {
+        let c = fixture();
+        let mut output = [0xa5; EXTENDED_SIZE];
+        c.encode_with_usc(Profile::Extended, 1, 0, 1 << 32, &mut output).unwrap();
+        assert_eq!(read32(&output, 0x728) & 0xffff, 25);
+        assert_eq!(read32(&output, REGISTERS + 24 * REGISTER_STRIDE), 0x10071);
+        assert_eq!(read64(&output, REGISTERS + 24 * REGISTER_STRIDE + 4), 1 << 32);
+        output.fill(0xa5);
+        assert!(c.encode_with_usc(Profile::Extended, 1, 0, 1, &mut output).is_err());
+        assert_eq!(output, [0xa5; EXTENDED_SIZE]);
+    }
+
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs b/drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs
index a10c3040d570f..bd78c03823aa0 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs
@@ -82,3 +82,113 @@ impl Sequence {
         Ok(())
     }
 }
+
+impl Sequence {
+    pub(crate) const EXTENDED_LENGTH: usize = 0x300;
+    pub(crate) const EXTENDED_ATTACHMENTS: usize = 0x58;
+    pub(crate) const EXTENDED_HAS_ATTACHMENTS: usize = 0x2c0;
+
+    /// The extended firmware operates on a native G15 CDM stream. Its firmware
+    /// microsequence has wider timestamp operations and different engine state.
+    pub(crate) fn encode_extended(&self, auxiliary: command::GpuVa,
+        context_store: super::m3_pool_layout::GpuRegion, queue_sequence: u64,
+        output: &mut [u8]) -> Result<(), Error> {
+        if self.context >= 64 || self.generation != 0 { return Err(Error::Address); }
+        if context_store.size() < 0x20000 { return Err(Error::Size); }
+        let registers = self.command.at(command::REGISTERS, 24 * command::REGISTER_STRIDE)?;
+        let engine = self.command.at(0x76c, 0x60)?;
+        let clock = self.command.at(0x82c, 8)?;
+        let pairs = self.command.at(0x834, 16)?;
+        let end_pair = self.command.at(0x83c, 8)?;
+        let pool_pointer = self.command.at(0x86a, 8)?;
+        let status = self.command.at(0x8ac, 4)?;
+        let time_aux = self.command.at(0x89c, 8)?;
+        let elapsed = self.command.at(0x7dc, 8)?;
+        let tail = self.command.at(0x88c, 8)?;
+        let activity = self.stats.at(0, 8)?;
+        let bytes = output.get_mut(..STORAGE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        word(bytes, 0, 0x0b);
+        pointer(bytes, 0x14, registers);
+        pointer(bytes, 0x1c, activity);
+        pointer(bytes, 0x24, self.queue.get());
+        word(bytes, 0x2c, self.context);
+        word(bytes, 0x30, 1);
+        pointer(bytes, 0x38, queue_sequence);
+        pointer(bytes, 0x44, engine);
+        word(bytes, 0x50, 1);
+        pointer(bytes, 0x160, self.pool.get());
+        pointer(bytes, 0x178, auxiliary.get());
+        for (offset, delta) in [0, 0xf400, 0x1e800, 0x1f000].into_iter().enumerate() {
+            pointer(bytes, 0x188 + offset * 8, context_store.base() + delta);
+        }
+        pointer(bytes, 0x1a8, status);
+        word(bytes, 0x1b8, 2);
+        // Timestamp records are 76 bytes; WFI sits between the two records.
+        for (offset, opcode, selected) in [(0x1bc, 0x8000_0003, pairs), (0x20c, 3, end_pair)] {
+            word(bytes, offset, opcode);
+            pointer(bytes, offset + 4, clock);
+            pointer(bytes, offset + 0xc, pairs);
+            pointer(bytes, offset + 0x14, selected);
+            pointer(bytes, offset + 0x1c, self.queue.get());
+            pointer(bytes, offset + 0x2c, time_aux);
+            pointer(bytes, offset + 0x34, elapsed);
+            pointer(bytes, offset + 0x44, 0xc10000);
+        }
+        word(bytes, 0x208, 1);
+        let finish = 0x258;
+        word(bytes, finish, 0x0c);
+        pointer(bytes, finish + 4, activity);
+        pointer(bytes, finish + 0xc, self.queue.get());
+        word(bytes, finish + 0x14, self.context);
+        pointer(bytes, finish + 0x18, engine);
+        pointer(bytes, finish + 0x24, 0xc10000);
+        pointer(bytes, finish + 0x2c, self.fw_stamp.get());
+        word(bytes, finish + 0x34, self.stamp_value);
+        pointer(bytes, finish + 0x5c, pool_pointer);
+        word(bytes, finish + 0x64, (-(finish as i32)) as u32);
+        pointer(bytes, finish + 0x69, status);
+        pointer(bytes, finish + 0x71, tail);
+        word(bytes, 0x2d4, 0x4000_0002);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    fn fixture() -> Sequence {
+        let fw = |i: u64| FirmwareVa::new(0xffff_fc21_a000_0000 + i * 0x4000).unwrap();
+        Sequence { command: Region::new(fw(0).get(), command::EXTENDED_SIZE).unwrap(),
+            stats: Region::new(fw(1).get(), 0xe10).unwrap(),
+            notifier: Region::new(fw(2).get(), 0x200).unwrap(), queue: fw(3),
+            context: 3, generation: 0, pool: fw(4), scratch: [fw(5); 5],
+            fw_stamp: fw(6), stamp_value: 0x700 }
+    }
+    fn ptr(bytes: &[u8], at: usize) -> u64 { u64::from_le_bytes(bytes[at..at + 8].try_into().unwrap()) }
+    #[test] fn extended_timestamps_and_retirement_refer_to_their_live_owners() {
+        let s = fixture();
+        let mut output = [0xa5; STORAGE + 8];
+        s.encode_extended(command::GpuVa::new(0x5000_0000).unwrap(),
+            super::super::m3_pool_layout::GpuRegion::new(0x6000_0000, 0x20000).unwrap(), 7, &mut output).unwrap();
+        assert_eq!(ptr(&output, 0x1c), s.stats.at(0, 8).unwrap());
+        assert_eq!(ptr(&output, 0x38), 7);
+        assert_eq!(ptr(&output, 0x188), 0x6000_0000);
+        assert_eq!(ptr(&output, 0x1bc + 0x14), s.command.at(0x834, 8).unwrap());
+        assert_eq!(ptr(&output, 0x20c + 0x14), s.command.at(0x83c, 8).unwrap());
+        assert_eq!(ptr(&output, 0x258 + 0x2c), s.fw_stamp.get());
+        assert_eq!(ptr(&output, 0x258 + 0x5c), s.command.at(0x86a, 8).unwrap());
+        assert_eq!(&output[STORAGE..], &[0xa5; 8]);
+    }
+    #[test] fn extended_sequence_rejects_legacy_command_extents_and_event_generations() {
+        for generation in [0, 1] {
+            let mut s = fixture();
+            s.generation = generation;
+            if generation == 0 { s.command = Region::new(s.command.at(0, 1).unwrap(), command::SIZE).unwrap(); }
+            let mut output = [0xa5; STORAGE];
+            assert!(s.encode_extended(command::GpuVa::new(0x5000_0000).unwrap(),
+                super::super::m3_pool_layout::GpuRegion::new(0x6000_0000, 0x20000).unwrap(), 0, &mut output).is_err());
+            assert_eq!(output, [0xa5; STORAGE]);
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute_storage.rs b/drivers/gpu/drm/asahi/m3/m3_compute_storage.rs
index 6bd3aecda387d..a897a45f0922d 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute_storage.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute_storage.rs
@@ -87,3 +87,69 @@ pub(crate) fn allocation(index:usize)->Result<Allocation,InvalidOwner> {
 pub(crate) fn coalesce_stamp_flush(wide:bool,timestamps:[u64;2],last:bool)->bool {
     wide && timestamps==[0,0] && !last
 }
+
+pub(crate) fn allocation_for(profile: super::m3_profile::Profile, index: usize)
+    -> Result<Allocation, InvalidOwner> {
+    let mut owner = allocation(index)?;
+    if profile == super::m3_profile::Profile::Legacy { return Ok(owner); }
+    match index {
+        // The initial allocator has eight 4-MiB payload owners. Retain the
+        // historical indices without allocating unused 4-MiB payloads.
+        9..=22 => { owner.size = 0x4000; owner.mapping = Mapping::FirmwareOnly; }
+        POOL_PAGES => owner.size = 0x20000,
+        POOL_TABLE => { owner.size = 0x4000; owner.mapping = Mapping::Client(POOL_TABLE_VA & !0x3fff); }
+        POOL => owner.size = 0xa0,
+        GPU_CONTEXT => owner.size = 0x38,
+        NOTIFIER => owner.size = 0x200,
+        EVENT => owner.size = 8,
+        QUEUE => owner.size = 0x24c0,
+        PREEMPTION => owner.size = 0x4000,
+        COMMAND => { owner.size = 0x8b0; owner.mapping = Mapping::CommandAlias(0x73_0000_0000); }
+        TAIL_SCRATCH => { owner.size = 0x4000; owner.mapping = Mapping::Client(0x72_0100_0000); }
+        46 => { owner.size = 0x40000; owner.mapping = Mapping::Client(0x72_0000_0000); }
+        45 | 47..=49 => { owner.size = 0x4000; owner.mapping = Mapping::FirmwareOnly; }
+        _ => {}
+    }
+    Ok(owner)
+}
+
+pub(crate) fn slot_offset_for(profile: super::m3_profile::Profile, index: usize, slot: usize)
+    -> Result<usize, InvalidOwner> {
+    if slot >= SLOTS { return Err(InvalidOwner); }
+    let size = allocation_for(profile, index)?.size;
+    Ok(if RESET.contains(&index) { ((size + 0x3fff) & !0x3fff) * slot } else { 0 })
+}
+
+pub(crate) fn batch_allocation_for(profile: super::m3_profile::Profile, index: usize)
+    -> Result<Allocation, InvalidOwner> {
+    let mut owner = allocation_for(profile, index)?;
+    owner.size += slot_offset_for(profile, index, SLOTS - 1)?;
+    Ok(owner)
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    use super::super::m3_profile::Profile;
+    #[test] fn extended_commands_do_not_straddle_another_slots_page() {
+        let command = allocation_for(Profile::Extended, COMMAND).unwrap();
+        let Mapping::CommandAlias(base) = command.mapping else { panic!("missing command alias") };
+        assert_eq!(base & 0x3fff, 0);
+        for slot in 0..SLOTS - 1 {
+            let start = slot_offset_for(Profile::Extended, COMMAND, slot).unwrap();
+            let next = slot_offset_for(Profile::Extended, COMMAND, slot + 1).unwrap();
+            assert!(start + command.size <= next);
+        }
+        assert_eq!(batch_allocation_for(Profile::Extended, QUEUE).unwrap().size, 0x24c0);
+        assert!(slot_offset_for(Profile::Extended, COMMAND, SLOTS).is_err());
+    }
+    #[test] fn legacy_plan_is_byte_for_byte_the_same_for_every_owner_and_slot() {
+        for index in 0..COUNT {
+            assert_eq!(allocation_for(Profile::Legacy, index), allocation(index));
+            for slot in 0..SLOTS {
+                assert_eq!(slot_offset_for(Profile::Legacy, index, slot), slot_offset(index, slot));
+            }
+            assert_eq!(batch_allocation_for(Profile::Legacy, index), batch_allocation(index));
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_config.rs b/drivers/gpu/drm/asahi/m3/m3_config.rs
index 67f4f963637f2..bfb408b07a530 100644
--- a/drivers/gpu/drm/asahi/m3/m3_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_config.rs
@@ -51,6 +51,7 @@ pub(crate) struct Config {
     objects: KVec<Buffer>,
     profile: super::m3_profile::Profile,
     control_generation: u32,
+    io_descriptors: Option<KVec<u8>>,
     _iomaps: KVec<mmu::KernelMapping>,
     pub(crate) completed_events: u64,
     pstates: crate::m3::m3_adt_config::PstateWatch,
@@ -67,6 +68,17 @@ impl Config {
     pub(crate) fn new(dev: &driver::AsahiDrmDevice, uat: &mmu::Uat, firmware: &crate::m3::m3_firmware::Firmware,
         contents: &crate::m3::m3_adt_config::Contents) -> Result<Self> {
         contents.check_for_upload()?;
+        if let Some(inputs) = &contents.extended {
+            if firmware.profile() != super::m3_profile::Profile::Extended { return Err(EINVAL); }
+            let owners = ExtendedStorage::new(dev, uat, &inputs.power, &inputs.sram_uv, inputs.bases)?;
+            let thermal = crate::m3::m3_thermal::Governor::new(dev.as_ref().as_ref(), &contents.pstates)?;
+            return Ok(Self { objects: owners.objects, _iomaps: owners.iomaps,
+                profile: firmware.profile(), control_generation: 0, completed_events: 0,
+                io_descriptors: Some(owners.descriptors),
+                pstates: crate::m3::m3_adt_config::PstateWatch::new(contents.pstates), thermal,
+                request_top: 8, request_value: 0, request_checked: false, request_check_at: None,
+                request_writes: 0, request_observed: 0 });
+        }
         let mut objects = KVec::new();
         let mut iomaps = KVec::new();
         for index in 0..storage::COUNT {
@@ -142,7 +154,7 @@ impl Config {
         crate::m3::m3_adt_config::check_upload(dev.as_ref().as_ref(), firmware, contents.iomaps, &mut objects)?;
         agx_memory::publish();
         let thermal = crate::m3::m3_thermal::Governor::new(dev.as_ref().as_ref(), &contents.pstates)?;
-        Ok(Self { objects, profile: firmware.profile(), control_generation: 0,
+        Ok(Self { objects, profile: firmware.profile(), control_generation: 0, io_descriptors: None,
             _iomaps: iomaps, completed_events: 0,
             pstates: crate::m3::m3_adt_config::PstateWatch::new(contents.pstates), thermal,
             request_top:contents.table.0,request_value:0,request_checked:false,
@@ -156,6 +168,15 @@ impl Config {
         objects[RUNTIME_POINTERS].write(0, &records.runtime)?;
         objects[CONTROL_REGION].write(0, &records.control)
     }
+    pub(crate) fn publish_io_table(&self,
+        pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
+        firmware: &crate::m3::m3_firmware::Firmware) -> Result {
+        if let Some(descriptors) = &self.io_descriptors {
+            firmware.publish_io_table(pdev, descriptors)?;
+        }
+        Ok(())
+    }
+
     pub(crate) fn root(&self) -> u64 { self.objects[storage::ROOT].va() }
     pub(crate) fn log_globals_debug(&mut self,dev:&driver::AsahiDrmDevice)->Result {
         let value=self.objects[GLOBALS].read_u32(crate::m3::m3_globals_debug::OFFSET)?;
@@ -164,6 +185,8 @@ impl Config {
         Ok(())
     }
     pub(crate) fn performance_request(&mut self,chip:u32,busy:bool)->Result {
+        // Native controller inputs supersede the legacy fixed-request interface.
+        if self.profile == super::m3_profile::Profile::Extended { return Ok(()); }
         let Some(value)=crate::m3::m3_consistent_perf::request(chip,
             crate::m3::m3_params::consistent_perf(),busy,self.request_top) else {return Ok(());};
         if value==0 && self.request_value==0 {return Ok(());}
@@ -195,6 +218,14 @@ impl Config {
     /// state the firmware reports against the ceiling and the runtime cap. Called after boot and
     /// after every job, by the job thread.
     pub(crate) fn check_pstate(&mut self, dev: &driver::AsahiDrmDevice, device: &crate::m3::m3_device::Device, what: &str) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            let state = device.pstate_register()? & 15;
+            if state > self.request_top {
+                dev_err!(dev.as_ref(), "M3: native performance state {} exceeds {} ({})\n", state, self.request_top, what);
+                return Err(ERANGE);
+            }
+            return Ok(());
+        }
         let now = kernel::time::Instant::<kernel::time::Monotonic>::now();
         if let Some(cap) = self.thermal.update(dev.as_ref().as_ref(), now) {
             crate::m3::m3_adt_config::publish_runtime_cap(&mut self.objects[GLOBALS], cap)?;
@@ -206,13 +237,25 @@ impl Config {
         Ok(())
     }
     pub(crate) fn stats_region(&self) -> Result<init::Region> {
-        let owner = &self.objects[HARDWARE_DATA];
+        let owner = &self.objects[if self.profile == super::m3_profile::Profile::Extended {
+            UNKNOWN_C3
+        } else { HARDWARE_DATA }];
         init::Region::new(owner.va(), owner.size()).map_err(|_| EINVAL)
     }
 
     pub(crate) fn log_active_power(&mut self, dev: &driver::AsahiDrmDevice,
                                   device: &crate::m3::m3_device::Device,
                                   sequence: u32) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            let state = device.pstate_register()? & 15;
+            let performance = &mut self.objects[super::m3_init_26::PERFORMANCE_CONTROL];
+            let actual = performance.read_u32(0x2c)?;
+            let target = performance.read_u32(0x30)?;
+            let hardware = performance.read_u32(0x38)?;
+            dev_info!(dev.as_ref(), "M3_NATIVE_POWER sample={} state={} actual={} target={} hardware={}\n",
+                sequence, state, actual, target, hardware);
+            return Ok(());
+        }
         let cap = self.thermal.allowed(kernel::time::Instant::<kernel::time::Monotonic>::now());
         self.pstates.log_active(dev.as_ref().as_ref(), &mut self.objects[HARDWARE_DATA],
                                device.pstate_register()?, cap, sequence)?;
@@ -232,6 +275,7 @@ impl Config {
     }
 
     pub(crate) fn render_pb(&mut self) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended { return Err(EOPNOTSUPP); }
         self.objects[UNKNOWN_C1].write(0,&storage::parameter_buffer(crate::m3::m3_render::PB_PAGES).map_err(|_|EINVAL)?)
     }
     pub(crate) fn submit_queue(&mut self, kind:usize, queue:u64, head:u16,event:u8,new:bool)->Result {
@@ -274,6 +318,13 @@ impl Config {
             && self.objects[RUNTIME_FLAGS].read_u32(4)? == 1)
     }
     pub(crate) fn log_ready(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            let ready = self.objects[RUNTIME_FLAGS].read_u32(0x14)?;
+            let consumed = self.objects[CONTROL_REGION].read_u32(0xeae8)?;
+            dev_info!(dev.as_ref(), "M3: extended firmware ready={} control-generation={}/{}\n",
+                ready, consumed, self.control_generation);
+            return Ok(());
+        }
         let magic=self.objects[RUNTIME_POINTERS].read_u32(0x314)?;
         let state=self.objects[RUNTIME_POINTERS].read_u32(0x2fc)?;
         let a=self.objects[RUNTIME_FLAGS].read_u32(4)?;
@@ -284,12 +335,14 @@ impl Config {
     }
     /// The firmware's halt counter and its halted and resume flags.
     pub(crate) fn halt_state(&mut self) -> Result<(u64,u32,u32)> {
+        if self.profile == super::m3_profile::Profile::Extended { return Err(EOPNOTSUPP); }
         let control=&mut self.objects[CONTROL_REGION];
         Ok((control.read_u64(0x4580)?,control.read_u32(0x4590)?,control.read_u32(0x45a0)?))
     }
     /// Let a halted firmware continue: clear halted, then set resume. These
     /// words keep the halt/resume layout of earlier Apple GPU firmware.
     pub(crate) fn resume_halted(&mut self) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended { return Err(EOPNOTSUPP); }
         let control=&mut self.objects[CONTROL_REGION];
         control.u32(0x4590,0)?;
         agx_memory::publish();
@@ -303,6 +356,18 @@ impl Config {
     /// at +0x40a0, and the details it leaves for a recovery event at +0x44a0.
     /// Nothing is acknowledged, cleared or resumed here.
     pub(crate) fn log_recovery_state(&mut self, dev: &driver::AsahiDrmDevice, events: u64) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            for (owner, start, length) in [(super::m3_init_26::RECOVERY_ACTIVITY, 0, 0x60),
+                (CONTROL_REGION, 0x4ebc, 0x100)] {
+                for offset in (start..start + length).step_by(32) {
+                    let mut bytes = [0; 32];
+                    self.objects[owner].read(offset, &mut bytes)?;
+                    dev_err!(dev.as_ref(), "M3: firmware recovery owner={} offset={:#x} bytes={:02x?}\n",
+                        owner, offset, bytes);
+                }
+            }
+            return Ok(());
+        }
         let control=&mut self.objects[CONTROL_REGION];
         let halt_count=control.read_u64(0x4580)?;
         let halted=control.read_u32(0x4590)?;
@@ -318,7 +383,7 @@ impl Config {
     /// index (at most 16), as `drain` reads them. Nothing is consumed or acknowledged, and the
     /// completion count is not changed.
     pub(crate) fn log_event_ring(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
-        const SIZE: usize = 0x38;
+        let size = if self.profile == super::m3_profile::Profile::Extended { 0x48 } else { 0x38 };
         const COUNT: usize = 256;
         let r = self.objects[storage::EVENT*2].read_u32(0)? as usize;
         let w = self.objects[storage::EVENT*2].read_u32(0x20)? as usize;
@@ -327,8 +392,8 @@ impl Config {
         let mut index = r;
         for _ in 0..16 {
             if index == w { break; }
-            let mut raw = [0u8; SIZE];
-            self.objects[storage::EVENT*2+1].read(index * SIZE, &mut raw)?;
+            let mut raw = [0u8; 0x48];
+            self.objects[storage::EVENT*2+1].read(index * size, &mut raw[..size])?;
             dev_info!(dev.as_ref(), "M3 event ring entry {} kind={} bytes={:02x?}\n",
                 index, u32::from_le_bytes([raw[0], raw[1], raw[2], raw[3]]), raw);
             index = (index + 1) % COUNT;
@@ -357,7 +422,9 @@ impl Config {
         let state = storage::DEVICE_CONTROL * 2;
         let cursors = [self.objects[state].read_u32(0)?,
             self.objects[state].read_u32(0x10)?, self.objects[state].read_u32(0x20)?];
-        let cursor = format::idle_cursor(cursors).map_err(|_| EBUSY)?;
+        let cursor = format::idle_cursor(cursors).map_err(|error| {
+            if error == init::Error::Bounds { EIO } else { EBUSY }
+        })?;
         let consumed = self.objects[CONTROL_REGION].read_u32(0xeae8)?;
         let generation = action.generation(self.control_generation, consumed).map_err(|_| EOVERFLOW)?;
         let mut record = [0; format::CONTROL_BYTES];
diff --git a/drivers/gpu/drm/asahi/m3/m3_device.rs b/drivers/gpu/drm/asahi/m3/m3_device.rs
index c43017a8933c0..05a3961369a6d 100644
--- a/drivers/gpu/drm/asahi/m3/m3_device.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_device.rs
@@ -176,6 +176,12 @@ impl Device {
     /// Read-only snapshot. Do not select or acknowledge fault banks here;
     /// the firmware owns those registers until recovery is ported.
     pub(crate) fn log_engine_state(&self, vm: &crate::mmu::Vm) -> Result {
+        if self.firmware.profile() == super::m3_profile::Profile::Extended {
+            // Adaptive clock gating can leave individual engine banks inaccessible
+            // even while the GPU performance-state register says powered up.
+            dev_info!(self.dev.as_ref(), "M3: adaptive firmware fault evidence uses retained metadata; engine banks may be gated\n");
+            return Ok(());
+        }
         let sgx_guard = self.sgx.try_access().ok_or(ENODEV)?;
         let sgx = sgx_guard.as_view();
         let pstate = sgx.try_read32(0xe01000)? & 0xf;
diff --git a/drivers/gpu/drm/asahi/m3/m3_drm.rs b/drivers/gpu/drm/asahi/m3/m3_drm.rs
index 796abc7793f90..e1db1adf9e6a9 100644
--- a/drivers/gpu/drm/asahi/m3/m3_drm.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_drm.rs
@@ -258,7 +258,8 @@ impl gpu::Gpu for Backend {
         _ualloc_priv: Arc<Mutex<alloc::DefaultAllocator>>, priority: u32,
         usc_exec_base: u64) -> Result<KBox<dyn queue::Queue>> {
         Ok(KBox::new(crate::m3::m3_submit::Queue::new(self.shared.clone(),self.scheduler.clone(),vm,priority,usc_exec_base,
-            self.soc.features.fragment_dependency)?,GFP_KERNEL)?)
+            self.feature_flags() & uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_FRAGMENT_DEPENDENCY as u64 != 0,
+            self.feature_flags() & uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_COMPUTE_WIDE_VISIBILITY as u64 != 0)?,GFP_KERNEL)?)
     }
     fn map_timestamp_buffer(&self, bo: gem::ObjectRef, range: Range<usize>) -> Result<mmu::KernelMapping> {
         Option::as_mut(&mut *self.shared.lock()).ok_or(ENODEV)?.map_timestamp(bo,range)
diff --git a/drivers/gpu/drm/asahi/m3/m3_pool.rs b/drivers/gpu/drm/asahi/m3/m3_pool.rs
index ab50ab7eca8a1..4eb284e1291bd 100644
--- a/drivers/gpu/drm/asahi/m3/m3_pool.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_pool.rs
@@ -39,3 +39,34 @@ impl Owners {
         objects[self.manager].write(0, &manager)
     }
 }
+
+impl Owners {
+    pub(crate) fn initialize_extended(&self, objects: &mut [Buffer], slot: u8,
+        compute_only: bool) -> Result {
+        let mut backings = KVec::new();
+        for index in self.backing.clone().take(8) {
+            let buffer = objects.get(index).ok_or(EINVAL)?;
+            backings.push(wire::GpuRegion::new(buffer.gpu_va()?, buffer.size()).map_err(|_| EINVAL)?, GFP_KERNEL)?;
+        }
+        let backing = wire::ModernBacking(&backings);
+        let populated = backing.pages().map_err(|_| EINVAL)?;
+        let pages = objects.get(self.pages).ok_or(EINVAL)?;
+        let entries = wire::GpuRegion::new(pages.gpu_va()?, pages.size()).map_err(|_| EINVAL)?;
+        let table = objects.get(self.table).ok_or(EINVAL)?;
+        let groups = wire::GpuRegion::new(table.gpu_va()?, table.size()).map_err(|_| EINVAL)?;
+        if groups.size() < populated / 512 * 64 { return Err(EINVAL); }
+        let descriptor = wire::ModernPool { entries, groups,
+            submitted: FirmwareVa::new(objects.get(self.counter).ok_or(EINVAL)?.va()).map_err(|_| EINVAL)?,
+            identity: FirmwareVa::new(objects.get(self.manager).ok_or(EINVAL)?.va()).map_err(|_| EINVAL)?,
+            slot, capacity: (entries.size() / 8).try_into()?, populated: populated.try_into()?, compute_only };
+        let mut bytes = [0; wire::ModernPool::SIZE];
+        descriptor.encode(&mut bytes).map_err(|_| EINVAL)?;
+        for index in 0..populated {
+            objects[self.pages].u64(index * 8, backing.page(index).map_err(|_| EINVAL)?)?;
+        }
+        for index in 0..populated / 512 {
+            objects[self.table].write(index * 64, &backing.group(index).map_err(|_| EINVAL)?)?;
+        }
+        objects[self.manager].write(0, &bytes)
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_pool_layout.rs b/drivers/gpu/drm/asahi/m3/m3_pool_layout.rs
index a8474d262bc26..ac7e6771f7880 100644
--- a/drivers/gpu/drm/asahi/m3/m3_pool_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_pool_layout.rs
@@ -69,3 +69,131 @@ impl<'a> Pool<'a> {
         Ok(())
     }
 }
+
+/// Extended firmware's private-memory pool descriptor. The owners and initial
+/// population are supplied separately from the descriptor's firmware state.
+pub(crate) struct ModernPool {
+    pub(crate) identity: FirmwareVa,
+    pub(crate) slot: u8,
+    pub(crate) entries: GpuRegion,
+    pub(crate) groups: GpuRegion,
+    pub(crate) submitted: FirmwareVa,
+    pub(crate) capacity: u32,
+    pub(crate) populated: u32,
+    pub(crate) compute_only: bool,
+}
+
+impl ModernPool {
+    pub(crate) const SIZE: usize = 0xa0;
+
+    pub(crate) fn encode(&self, output: &mut [u8]) -> Result<(), Error> {
+        let entry_bytes = (self.capacity as usize).checked_mul(8).ok_or(Error::Size)?;
+        let group_bytes = (self.populated as usize / 512).checked_mul(8).ok_or(Error::Size)?;
+        if !(1..=64).contains(&self.slot) || self.capacity == 0 || self.populated >= self.capacity || self.populated % 512 != 0
+            || self.entries.base() & 0x3fff != 0 || self.groups.base() & 0x3fff != 0
+            || self.entries.size() < entry_bytes || self.groups.size() < group_bytes
+            || self.submitted.get() & 7 != 0 || self.identity.get() & 7 != 0 { return Err(Error::Address); }
+        let group_count: u32 = group_bytes.try_into().map_err(|_| Error::Size)?;
+        let bytes = output.get_mut(..Self::SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        let word = |bytes: &mut [u8], offset: usize, value: u32| {
+            bytes[offset..offset + 4].copy_from_slice(&value.to_le_bytes());
+        };
+        bytes[..8].copy_from_slice(&self.identity.get().to_le_bytes());
+        word(bytes, 8, self.slot.into());
+        word(bytes, 12, (self.populated == 0).into());
+        word(bytes, 16, 2);
+        bytes[0x14..0x1c].copy_from_slice(&self.entries.base().to_le_bytes());
+        word(bytes, 0x1c, self.capacity);
+        word(bytes, 0x24, self.populated);
+        word(bytes, 0x28, (self.populated == 0).into());
+        word(bytes, 0x2c, self.populated);
+        bytes[0x30..0x38].copy_from_slice(&self.groups.base().to_le_bytes());
+        word(bytes, 0x40, 4);
+        word(bytes, 0x48, group_count);
+        bytes[0x4c..0x54].copy_from_slice(&self.submitted.get().to_le_bytes());
+        word(bytes, 0x5c, (self.compute_only && self.populated != 0).into());
+        word(bytes, 0x84, (self.populated != 0).into());
+        word(bytes, 0x94, 2);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod modern_tests {
+    use super::*;
+    fn pool(compute_only: bool) -> ModernPool {
+        ModernPool { identity: FirmwareVa::new(0xffff_fc21_9100_0000).unwrap(), slot: 1,
+            entries: GpuRegion::new(0x5000_0000, 0x20000).unwrap(),
+            groups: GpuRegion::new(0x6000_0000, 0x4000).unwrap(),
+            submitted: FirmwareVa::new(0xffff_fc21_9000_0000).unwrap(),
+            capacity: 0x4000, populated: 512, compute_only }
+    }
+    fn word(bytes: &[u8], offset: usize) -> u32 {
+        u32::from_le_bytes(bytes[offset..offset + 4].try_into().unwrap())
+    }
+    #[test] fn shared_render_pool_never_gets_compute_exclusion() {
+        for compute in [false, true] {
+            let mut output = [0xa5; ModernPool::SIZE + 8];
+            pool(compute).encode(&mut output).unwrap();
+            assert_eq!(word(&output, 0x5c), compute.into());
+            assert_eq!(word(&output, 0x48), 8);
+            assert_eq!(word(&output, 0x84), 1);
+            assert_eq!(&output[ModernPool::SIZE..], &[0xa5; 8]);
+        }
+    }
+    #[test] fn bad_population_and_insufficient_owners_reject_before_mutation() {
+        for pages in [1, 511, 513, 0x4000] {
+            let mut value = pool(true); value.populated = pages;
+            let mut output = [0xa5; ModernPool::SIZE];
+            assert!(value.encode(&mut output).is_err());
+            assert_eq!(output, [0xa5; ModernPool::SIZE]);
+        }
+        let mut value = pool(true); value.capacity = 0x4001;
+        let mut output = [0xa5; ModernPool::SIZE];
+        assert!(value.encode(&mut output).is_err());
+        assert_eq!(output, [0xa5; ModernPool::SIZE]);
+    }
+}
+
+/// Populate the extended freelist from independently retained 4-MiB owners.
+/// Hardware group records describe 2-MiB subregions, not entire owners.
+pub(crate) struct ModernBacking<'a>(pub(crate) &'a [GpuRegion]);
+impl ModernBacking<'_> {
+    pub(crate) fn pages(&self) -> Result<usize, Error> {
+        if self.0.is_empty() || self.0.len() > 8
+            || self.0.iter().any(|owner| owner.size() != BACKING_SIZE || owner.base() & 0x3fff != 0) {
+            return Err(Error::Size);
+        }
+        Ok(self.0.len() * BACKING_SIZE / PAGE_SIZE)
+    }
+    pub(crate) fn page(&self, index: usize) -> Result<u64, Error> {
+        if index >= self.pages()? { return Err(Error::Index); }
+        let per_owner = BACKING_SIZE / PAGE_SIZE;
+        Ok(self.0[index / per_owner].base() + (index % per_owner * PAGE_SIZE) as u64)
+    }
+    pub(crate) fn group(&self, index: usize) -> Result<[u8; 64], Error> {
+        if index >= self.pages()? / 512 { return Err(Error::Index); }
+        let base = self.page(index * 512)?;
+        let mut record = [0; 64];
+        record[..8].copy_from_slice(&(base | (1 << 61)).to_le_bytes());
+        Ok(record)
+    }
+}
+
+#[cfg(test)]
+mod backing_tests {
+    use super::*;
+    #[test] fn group_records_never_cross_a_noncontiguous_backing_owner() {
+        let owners = [GpuRegion::new(0x5000_0000, BACKING_SIZE).unwrap(),
+            GpuRegion::new(0x6000_0000, BACKING_SIZE).unwrap()];
+        let backing = ModernBacking(&owners);
+        assert_eq!(backing.pages(), Ok(2048));
+        assert_eq!(backing.page(1024), Ok(0x6000_0000));
+        let second = backing.group(2).unwrap();
+        assert_eq!(u64::from_le_bytes(second[..8].try_into().unwrap()), (1 << 61) | 0x6000_0000);
+        assert_eq!(&second[8..], &[0; 56]);
+        assert!(backing.group(4).is_err());
+        assert!(backing.page(2048).is_err());
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_profile.rs b/drivers/gpu/drm/asahi/m3/m3_profile.rs
index c70a88029072b..004ac2c7d1eef 100644
--- a/drivers/gpu/drm/asahi/m3/m3_profile.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_profile.rs
@@ -32,6 +32,13 @@ impl Profile {
         }
     }
 
+    pub(crate) fn gpu_duration_ns(self, elapsed: u64) -> Option<u64> {
+        match self {
+            Self::Legacy => elapsed.checked_mul(1000).map(|value| value / 24),
+            Self::Extended => Some(elapsed),
+        }
+    }
+
     pub(crate) const fn vm_acknowledged(self, params_bytes: u64, flags: u32) -> bool {
         // Both profiles consume G15 records; the existing VM padding stays zero.
         params_bytes >= PARAMS_REQUIRED && flags == 0
@@ -66,4 +73,17 @@ mod tests {
         assert_eq!(Profile::Extended.user_end(), 0x3ff_ffff_8000);
         assert_eq!(Profile::Legacy.user_end(), 0x2ff_ffff_8000);
     }
+    #[test]
+    fn native_nanoseconds_are_never_rescaled_as_legacy_ticks() {
+        assert_eq!(
+            Profile::Extended.gpu_duration_ns(24_000_000),
+            Some(24_000_000)
+        );
+        assert_eq!(
+            Profile::Legacy.gpu_duration_ns(24_000_000),
+            Some(1_000_000_000)
+        );
+        assert_eq!(Profile::Extended.gpu_duration_ns(u64::MAX), Some(u64::MAX));
+        assert_eq!(Profile::Legacy.gpu_duration_ns(u64::MAX), None);
+    }
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_queue_layout.rs b/drivers/gpu/drm/asahi/m3/m3_queue_layout.rs
index 3daba7acba2d0..8fd5ffdf1d30d 100644
--- a/drivers/gpu/drm/asahi/m3/m3_queue_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_queue_layout.rs
@@ -113,3 +113,44 @@ pub(crate) fn ring_entry(index: u32, capacity: u32, seeds: &[FirmwareVa]) -> Res
     if seeds.is_empty() || seeds.len() > capacity as usize || capacity > 65536 || index >= capacity { return Err(Error::Index); }
     Ok(if (index as usize) < seeds.len() { seeds[index as usize].0.to_le_bytes() } else { [0xcc; 8] })
 }
+
+impl QueueInfo {
+    pub(crate) const EXTENDED_SIZE: usize = 0x24c0;
+
+    /// Scheduler storage belongs to this same retained allocation; it is not
+    /// interchangeable with the legacy GPU scratch object.
+    pub(crate) fn encode_extended(&self, owner: FirmwareVa, output: &mut [u8]) -> Result<(), Error> {
+        let end = owner.get().checked_add(Self::EXTENDED_SIZE as u64).ok_or(Error::Address)?;
+        if end > 0xffff_fc30_0000_0000 { return Err(Error::Address); }
+        let bytes = output.get_mut(..Self::EXTENDED_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        for (offset, value) in [(0, self.state.get()), (8, self.ring.get()),
+            (16, self.job_list.get()), (24, owner.get() + 0xb0), (0xa4, self.context.get())] {
+            bytes[offset..offset + 8].copy_from_slice(&value.to_le_bytes());
+        }
+        for offset in [0x2c, 0x4c] { bytes[offset..offset + 4].fill(0xff); }
+        for offset in [0x30, 0x34, 0x48] {
+            bytes[offset..offset + 4].copy_from_slice(&2u32.to_le_bytes());
+        }
+        bytes[0x38..0x40].copy_from_slice(&0xffff_0000_0000_0000u64.to_le_bytes());
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test] fn scheduler_pointer_relocates_with_its_retained_queue_owner() {
+        let fw = |i: u64| FirmwareVa::new(0xffff_fc21_4000_0000 + i * 0x4000).unwrap();
+        let info = QueueInfo { state: fw(1), ring: fw(2), job_list: fw(3),
+            gpu_scratch: fw(4), context: fw(5), uuid: 9 };
+        let mut output = vec![0xa5; QueueInfo::EXTENDED_SIZE + 8];
+        info.encode_extended(fw(0), &mut output).unwrap();
+        assert_eq!(u64::from_le_bytes(output[24..32].try_into().unwrap()), fw(0).get() + 0xb0);
+        assert_eq!(&output[0xb0..QueueInfo::EXTENDED_SIZE], &vec![0; QueueInfo::EXTENDED_SIZE - 0xb0]);
+        assert_eq!(&output[QueueInfo::EXTENDED_SIZE..], &[0xa5; 8]);
+        let mut short = [0xa5; INFO_SIZE];
+        assert!(info.encode_extended(fw(0), &mut short).is_err());
+        assert_eq!(short, [0xa5; INFO_SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_runtime.rs b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
index 1a366d7f4b340..40399a80a01f3 100644
--- a/drivers/gpu/drm/asahi/m3/m3_runtime.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
@@ -1214,6 +1214,9 @@ impl Runtime {
     }
     fn boot_inner(&mut self, pdev: &platform::Device<Core<'_>>) -> Result {
         use crate::m3::t8122_start::BootStep;
+        if self.inner.device.firmware().profile() == super::m3_profile::Profile::Extended {
+            return self.boot_extended(pdev);
+        }
         let root = self.inner.config.root();
         dev_info!(pdev.as_ref(), "M3: publishing owned initdata {:#x}\n", root);
         self.inner.boot_step = BootStep::Publish;
@@ -1245,6 +1248,60 @@ impl Runtime {
         dev_info!(pdev.as_ref(), "M3: firmware accepted owned initdata and device controls\n");
         Ok(())
     }
+    fn boot_extended(&mut self, pdev: &platform::Device<Core<'_>>) -> Result {
+        use super::m3_channel_format::Action;
+        use crate::m3::t8122_start::BootStep;
+        // The first control is pending when the root becomes visible. Its
+        // retirement comes from InitData consumption, without a work kick.
+        let first = self.inner.config.control_extended(Action::Initialize)?;
+        self.inner.config.publish_io_table(pdev, self.inner.device.firmware())?;
+        let root = self.inner.config.root();
+        Pin::new(&mut self.inner.transport).send_message(0x20,
+            0x0081_0000_0000_0000 | (root & ((1u64 << 44) - 1)))?;
+        self.inner.boot_step = BootStep::AwaitReady;
+        let deadline = Instant::<Monotonic>::now();
+        while !self.inner.config.ready()? {
+            let inner: &mut Inner = &mut *self.inner;
+            inner.config.drain(&inner.drm)?;
+            if !inner.state.healthy() { return Err(EIO); }
+            if deadline.elapsed() >= Delta::from_secs(2) { return Err(ETIMEDOUT); }
+            fsleep(Delta::from_millis(1));
+        }
+        self.retire_extended_control(first)?;
+        self.inner.boot_step = BootStep::DeviceControl;
+        // Each data master registers its two firmware engine classes.
+        for ordinal in 0..6 {
+            let action = Action::Register { pipe: ordinal / 2, engine: ordinal % 2 + 1 };
+            self.send_extended_control(action)?;
+        }
+        self.inner.boot_step = BootStep::PostReady;
+        self.send_extended_control(Action::Idle { enabled: true })?;
+        let inner: &mut Inner = &mut *self.inner;
+        inner.config.check_pstate(&inner.drm, &inner.device, "after native boot")?;
+        inner.config.log_ready(&inner.drm)?;
+        inner.state.health.set_gpu_pending(false);
+        dev_info!(pdev.as_ref(), "M3: extended firmware ready; native controllers and idle policy admitted\n");
+        Ok(())
+    }
+
+    fn send_extended_control(&mut self, action: super::m3_channel_format::Action) -> Result {
+        let cursor = self.inner.config.control_extended(action)?;
+        Pin::new(&mut self.inner.transport).send_message(0x21, 0x0084_0000_0000_0011)?;
+        self.retire_extended_control(cursor)
+    }
+
+    fn retire_extended_control(&mut self, expected: u32) -> Result {
+        let deadline = Instant::<Monotonic>::now();
+        loop {
+            let inner: &mut Inner = &mut *self.inner;
+            inner.config.drain(&inner.drm)?;
+            if !inner.state.healthy() { return Err(EIO); }
+            if inner.config.control_done(expected)? { return Ok(()); }
+            if deadline.elapsed() >= Delta::from_secs(2) { return Err(ETIMEDOUT); }
+            fsleep(Delta::from_millis(1));
+        }
+    }
+
     fn send_control(&mut self, opcode: u32) -> Result {
         let next = match self.inner.config.control(opcode) {
             Ok(next) => next,
diff --git a/drivers/gpu/drm/asahi/m3/m3_state_layout.rs b/drivers/gpu/drm/asahi/m3/m3_state_layout.rs
index 199b7082b26c2..6eeafea666e74 100644
--- a/drivers/gpu/drm/asahi/m3/m3_state_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_state_layout.rs
@@ -66,3 +66,55 @@ pub(crate) fn manager_misc(out: &mut [u8]) -> Result<(), Error> {
     word(bytes, 0x20, 1); // cpu_flag / reset
     Ok(())
 }
+
+pub(crate) const EXTENDED_CONTEXT_SIZE: usize = 0x38;
+pub(crate) const EXTENDED_NOTIFIER_SIZE: usize = 0x200;
+
+pub(crate) fn context_extended(output: &mut [u8]) -> Result<(), Error> {
+    let bytes = output.get_mut(..EXTENDED_CONTEXT_SIZE).ok_or(Error::Size)?;
+    bytes.fill(0);
+    bytes[..2].fill(0xff);
+    bytes[5] = 1;
+    bytes[0x26] = 2;
+    bytes[0x33] = 0xff;
+    Ok(())
+}
+
+impl Notifier {
+    pub(crate) fn encode_extended(&self, output: &mut [u8]) -> Result<(), Error> {
+        if self.context >= 64 { return Err(Error::Address); }
+        let bytes = output.get_mut(..EXTENDED_NOTIFIER_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        bytes[..8].copy_from_slice(&self.threshold.get().to_le_bytes());
+        word(bytes, 0x10, 0x50);
+        word(bytes, NOTIFIER_CONTEXT, self.context);
+        bytes[0xa8..0xb0].fill(0xff);
+        word(bytes, 0x114, 1);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test] fn registration_state_is_left_to_firmware() {
+        let mut bytes = [0xa5; EXTENDED_CONTEXT_SIZE + 8];
+        context_extended(&mut bytes).unwrap();
+        assert_eq!(&bytes[..6], &[255, 255, 0, 0, 0, 1]);
+        assert_eq!(bytes[0x26], 2);
+        assert_eq!(bytes[0x33], 255);
+        assert_eq!(&bytes[EXTENDED_CONTEXT_SIZE..], &[0xa5; 8]);
+    }
+    #[test] fn notifier_has_zero_generation_and_distinct_firmware_storage() {
+        let notifier = Notifier { threshold: FirmwareVa::new(0xffff_fc21_7000_0000).unwrap(), context: 3 };
+        let mut bytes = [0xa5; EXTENDED_NOTIFIER_SIZE + 8];
+        notifier.encode_extended(&mut bytes).unwrap();
+        assert_eq!(&bytes[8..12], &[0; 4]);
+        assert_eq!(&bytes[0xa8..0xb0], &[255; 8]);
+        assert_eq!(&bytes[0x114..0x118], &[1, 0, 0, 0]);
+        assert_eq!(&bytes[EXTENDED_NOTIFIER_SIZE..], &[0xa5; 8]);
+        let mut short = [0xa5; NOTIFIER_SIZE];
+        assert!(notifier.encode_extended(&mut short).is_err());
+        assert_eq!(short, [0xa5; NOTIFIER_SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_submit.rs b/drivers/gpu/drm/asahi/m3/m3_submit.rs
index ffc57c77afcb2..2aac0dfad36ff 100644
--- a/drivers/gpu/drm/asahi/m3/m3_submit.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_submit.rs
@@ -176,11 +176,12 @@ pub(crate) struct Queue {
     shared:Shared,vm:mmu::Vm,usc:u64,fences:FenceContexts,
     /// Whether the SoC advertises early tiling (`m3_soc::Features::fragment_dependency`).
     early_tiling:bool,
+    wide_visibility:bool,
     urgency:u8,
 }
 impl Queue {
     pub(crate) fn new(shared:Shared,scheduler:Arc<sched::Scheduler<Job>>,vm:mmu::Vm,priority:u32,usc:u64,
-        early_tiling:bool)->Result<Self> {
+        early_tiling:bool, wide_visibility:bool)->Result<Self> {
         agx_uapi::QueueUscWindow{base:usc,user_start:0x4000,user_end:(1u64<<42)-0x8000}.validate().map_err(|_|EINVAL)?;
         // file.rs passes REALTIME - UAPI priority: 3 is UAPI LOW, 0 is UAPI REALTIME.
         let urgency=3u8.saturating_sub(priority.min(3) as u8);
@@ -188,7 +189,7 @@ impl Queue {
             1=>sched::Priority::High,0=>sched::Priority::Kernel,_=>return Err(EINVAL)};
         Ok(Self {entity:sched::Entity::new(&scheduler,priority)?,_scheduler:scheduler,
             shared,vm,usc,fences:FenceContexts::new(1,c_str!("asahi_m3_queue"),kernel::static_lock_class!())?,
-            early_tiling,urgency})
+            early_tiling,wide_visibility,urgency})
     }
 }
 impl queue::Queue for Queue {
@@ -216,7 +217,8 @@ impl queue::Queue for Queue {
             let agx_uapi::ParsedHardwareCommand::Compute{mut payload,attachments,..}=command else {return Err(ENOTSUPP);};
             // Other engines and helpers need their own M3 firmware translation.
             let wide=kernel::uapi::drm_asahi_compute_flags_DRM_ASAHI_COMPUTE_WIDE_VISIBILITY as u32;
-            if payload.flags & !wide !=0 || payload.sampler_count!=0 || payload.sampler_heap!=0 {
+            if payload.flags & !wide !=0 || (!self.wide_visibility && payload.flags & wide != 0)
+                || payload.sampler_count!=0 || payload.sampler_heap!=0 {
                 pr_err!("M3 compute rejected: flags={:#x} samplers={} heap={:#x} attachments={} timestamps={}/{}\n",payload.flags,payload.sampler_count,payload.sampler_heap,attachments.as_slice().len(),payload.timestamps.start.handle,payload.timestamps.end.handle);
                 return Err(ENOTSUPP);
             }
diff --git a/drivers/gpu/drm/asahi/mmu.rs b/drivers/gpu/drm/asahi/mmu.rs
index 437685bfad1de..2651d0aca3198 100644
--- a/drivers/gpu/drm/asahi/mmu.rs
+++ b/drivers/gpu/drm/asahi/mmu.rs
@@ -1155,8 +1155,7 @@ impl VmBind {
         self.1
     }
 
-    /// Stable wire incarnation for this active root lease. M4 reserves zero as unbound.
-    #[cfg(CONFIG_DRM_ASAHI_G16)]
+    /// Stable firmware wire incarnation for this active root lease; zero is unbound.
     pub(crate) fn generation(&self) -> u8 {
         self.0.binding.lock().generation
     }
@@ -2703,7 +2702,6 @@ impl Vm {
     }
 
     /// Spend the binding generation only for an incarnation exposed to firmware.
-    #[cfg(CONFIG_DRM_ASAHI_G16)]
     pub(crate) fn mark_binding_published(&self) -> Result {
         let uat = self.gpuvm.lock_inner().uat_inner.clone();
         let binding = self.binding.lock();
diff --git a/tools/asahi/m3-runtime-tests.rs b/tools/asahi/m3-runtime-tests.rs
index abac06668c0a1..458603366c954 100644
--- a/tools/asahi/m3-runtime-tests.rs
+++ b/tools/asahi/m3-runtime-tests.rs
@@ -36,3 +36,13 @@ mod m3_compute_layout;
 
 #[path = "../../drivers/gpu/drm/asahi/m3/m3_channel_format.rs"]
 mod m3_channel_format;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs"]
+mod m3_compute_sequence;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_state_layout.rs"]
+mod m3_state_layout;
+
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_compute_storage.rs"]
+mod m3_compute_storage;

From c5e1b35de06e10f3587132f93ea51bac621c6510 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:40:41 -0400
Subject: [PATCH 06/14] drm/asahi: dispatch G15 compute through extended T8122
 firmware

Dispatch extended firmware compute records through the existing M3
runtime while preserving G15 CDM streams. Retain owned pool backing and
leave firmware-managed register setup to the extended interface.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_compute.rs | 162 +++++++++++++++++--------
 drivers/gpu/drm/asahi/m3/m3_config.rs  |  10 ++
 drivers/gpu/drm/asahi/m3/m3_device.rs  |   2 +-
 drivers/gpu/drm/asahi/m3/m3_runtime.rs |  18 ++-
 4 files changed, 132 insertions(+), 60 deletions(-)

diff --git a/drivers/gpu/drm/asahi/m3/m3_compute.rs b/drivers/gpu/drm/asahi/m3/m3_compute.rs
index 34aa0c0d2cd3f..577510b7e9ecf 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute.rs
@@ -40,25 +40,28 @@ pub(crate) struct Compute {
     barriers: Option<Buffer>,
     /// The register lists of the SoC's GPU (`m3_soc::Soc::registers`).
     registers: command::RegisterSet,
+    profile: super::m3_profile::Profile,
     /// Last: drops after the command aliases.
     _lower_tlbi: crate::m3::m3_memory::LowerTlbi,
 }
 impl Compute {
     pub(crate) fn new(dev: &driver::AsahiDrmDevice, uat: &mmu::Uat, vm: &mmu::Vm,
         stats: Region, control: crate::m3::agx_compute::Control,
-        registers: command::RegisterSet) -> Result<Self> {
+        registers: command::RegisterSet, profile: super::m3_profile::Profile) -> Result<Self> {
         let lower_tlbi=crate::m3::m3_memory::LowerTlbi;
         let binding=uat.bind(vm)?;
         let mut objects=KVec::new();
         let mut client_command=None;
         let mut command_bytes = KVec::new();
-        command_bytes.resize(command::SIZE, 0u8, GFP_KERNEL)?;
+        command_bytes.resize(if profile == super::m3_profile::Profile::Extended {
+            command::EXTENDED_SIZE
+        } else { command::SIZE }, 0u8, GFP_KERNEL)?;
         let mut sequence_bytes = KVec::new();
         sequence_bytes.resize(microsequence::STORAGE, 0u8, GFP_KERNEL)?;
         // A private compute aperture, disjoint from the retained render graph.
         // Address-bearing graph fields are constructed from their live owners.
         for index in 0..storage::COUNT {
-            let a=storage::batch_allocation(index).map_err(|_|EINVAL)?;
+            let a=storage::batch_allocation_for(profile,index).map_err(|_|EINVAL)?;
             let mut b=match a.mapping {
                 Mapping::CommandAlias(va)=>Buffer::at(dev,uat.kernel_vm(),Some((uat.kernel_lower_vm(),va)),None,a.size,true)?,
                 Mapping::Client(va)=>Buffer::at(dev,uat.kernel_vm(),Some((vm,va)),None,a.size,true)?,
@@ -68,10 +71,13 @@ impl Compute {
             if matches!(a.mapping,Mapping::CommandAlias(_)) {client_command=Some(b.map_gpu_view(vm)?);}
             objects.push(b,GFP_KERNEL)?;
         }
-        Self::encode_command(&mut objects, &mut command_bytes, binding.slot(), control, 1, 0, registers)?;
-        Self::encode_sequence(&mut objects, &mut sequence_bytes, stats, binding.slot(), timeline::stamp(0xc1000000,1), 0)?;
-        UMA_POOL.initialize(&mut objects)?;
-        Self::initialize_state(&mut objects, binding.slot())?;
+        Self::encode_command(&mut objects, &mut command_bytes, binding.slot(), control, 1, 0,
+            registers, profile, binding.generation())?;
+        Self::encode_sequence(&mut objects, &mut sequence_bytes, stats, binding.slot(), timeline::stamp(0xc1000000,1), 0, profile, 0)?;
+        if profile == super::m3_profile::Profile::Extended {
+            UMA_POOL.initialize_extended(&mut objects, 1, true)?;
+        } else { UMA_POOL.initialize(&mut objects)?; }
+        Self::initialize_state(&mut objects, binding.slot(), profile)?;
         // Queue references are firmware VAs from live allocations. In contrast
         // to render's unpublished seed entries, compute dispatches entry zero
         // immediately, so its initial producer cursor remains one.
@@ -80,8 +86,13 @@ impl Compute {
             job_list: address(JOB_LIST)?, gpu_scratch: address(QUEUE_SCRATCH)?,
             context: address(GPU_CONTEXT)?, uuid: 0xc10000 };
         let command = address(storage::COMMAND)?;
-        let mut bytes = [0; queue::INFO_SIZE];
-        info.encode(&mut bytes).map_err(|_| EINVAL)?;
+        let mut bytes = KVec::new();
+        bytes.resize(if profile == super::m3_profile::Profile::Extended {
+            queue::QueueInfo::EXTENDED_SIZE
+        } else { queue::INFO_SIZE }, 0u8, GFP_KERNEL)?;
+        if profile == super::m3_profile::Profile::Extended {
+            info.encode_extended(address(storage::QUEUE)?, &mut bytes).map_err(|_| EINVAL)?;
+        } else { info.encode(&mut bytes).map_err(|_| EINVAL)?; }
         objects[storage::QUEUE].write(0, &bytes)?;
         let mut state = [0; queue::STATE_SIZE];
         queue::RingState { capacity: queue::QUALIFIED_CAPACITY, done: 0, read: 0, write: 1 }
@@ -107,54 +118,74 @@ impl Compute {
         // the invalidation.
         crate::mem::sync();crate::mem::tlbi_all();crate::mem::sync();
         unsafe {core::arch::asm!("isb",options(nostack,preserves_flags))};
-        Ok(Self {_client_command:client_command.ok_or(EINVAL)?,objects,command_bytes,sequence_bytes,_binding:binding,stats,last_progress_ns:0,sequence:1,head:1,cached_views:KVec::new(),slot:0,batch_count:1,checkpoint:(0,0,0),barriers:None,registers,_lower_tlbi:lower_tlbi})
+        Ok(Self {_client_command:client_command.ok_or(EINVAL)?,objects,command_bytes,sequence_bytes,_binding:binding,stats,last_progress_ns:0,sequence:1,head:1,cached_views:KVec::new(),slot:0,batch_count:1,checkpoint:(0,0,0),barriers:None,registers,profile,_lower_tlbi:lower_tlbi})
     }
     fn encode_command(objects: &mut [Buffer], bytes: &mut [u8], context: u32,
         control: crate::m3::agx_compute::Control, sequence: u64, slot: usize,
-        register_set: command::RegisterSet) -> Result {
-        let offset = |owner:usize| storage::slot_offset(owner,slot).map_err(|_|EINVAL);
+        register_set: command::RegisterSet, profile: super::m3_profile::Profile, generation: u8) -> Result {
+        let offset = |owner:usize| storage::slot_offset_for(profile,owner,slot).map_err(|_|EINVAL);
         let fw = |owner: usize| queue::FirmwareVa::new(objects[owner].va()+offset(owner)? as u64).map_err(|_| EINVAL);
         let preemption = &objects[PREEMPTION];
         let value = command::Command {
             context, counter: timeline::previous(sequence), notifier: fw(NOTIFIER)?,
-            preemption: GpuRegion::new(preemption.gpu_va()?+offset(PREEMPTION)? as u64, storage::allocation(PREEMPTION).map_err(|_|EINVAL)?.size).map_err(|_| EINVAL)?,
+            preemption: GpuRegion::new(preemption.gpu_va()?+offset(PREEMPTION)? as u64, storage::allocation_for(profile,PREEMPTION).map_err(|_|EINVAL)?.size).map_err(|_| EINVAL)?,
             cdm: command::GpuVa::new(control.base).map_err(|_| EINVAL)?,
             cdm_last: command::GpuVa::new(control.end.checked_sub(4).ok_or(EINVAL)?).map_err(|_| EINVAL)?,
             gpu_alias: command::GpuVa::new(objects[storage::COMMAND].gpu_va()?+offset(storage::COMMAND)? as u64).map_err(|_| EINVAL)?,
-            microsequence: fw(storage::MICROSEQUENCE)?, microsequence_size: microsequence::LENGTH as u32,
+            microsequence: fw(storage::MICROSEQUENCE)?, microsequence_size:
+                if profile == super::m3_profile::Profile::Extended { microsequence::Sequence::EXTENDED_LENGTH as u32 }
+                else { microsequence::LENGTH as u32 },
             stamp: fw(storage::STAMP)?, fw_stamp: fw(storage::FW_STAMP)?,
             stamp_value: timeline::stamp(0xc1000000,sequence),
             timestamps: [fw(TIMESTAMPS[0])?, fw(TIMESTAMPS[1])?],
             pool: fw(storage::POOL)?, tail_scratch: fw(TAIL_SCRATCH)?, flush_stamps: false,
             register_set,
         };
-        value.encode(bytes).map_err(|_| EINVAL)?;
+        value.encode_with_usc(profile, generation, 0,
+            if profile == super::m3_profile::Profile::Extended { control.usc_base } else { 0 }, bytes).map_err(|_| EINVAL)?;
         objects[storage::COMMAND].write(offset(storage::COMMAND)?, bytes)
     }
     fn encode_sequence(objects: &mut [Buffer], bytes: &mut [u8], stats: Region,
-        context: u32, stamp_value: u32, slot: usize) -> Result {
-        let offset = |owner:usize| storage::slot_offset(owner,slot).map_err(|_|EINVAL);
+        context: u32, stamp_value: u32, slot: usize, profile: super::m3_profile::Profile,
+        queue_sequence: u64) -> Result {
+        let offset = |owner:usize| storage::slot_offset_for(profile,owner,slot).map_err(|_|EINVAL);
         let fw = |owner: usize| queue::FirmwareVa::new(objects[owner].va()+offset(owner)? as u64).map_err(|_| EINVAL);
-        let region = |owner: usize| Region::new(objects[owner].va()+offset(owner)? as u64, storage::allocation(owner).map_err(|_|EINVAL)?.size).map_err(|_| EINVAL);
+        let region = |owner: usize| Region::new(objects[owner].va()+offset(owner)? as u64, storage::allocation_for(profile,owner).map_err(|_|EINVAL)?.size).map_err(|_| EINVAL);
         let value = microsequence::Sequence {
             command: region(storage::COMMAND)?, stats, notifier: region(NOTIFIER)?,
-            queue: fw(storage::QUEUE)?, context, generation: 1, pool: fw(storage::POOL)?,
+            queue: fw(storage::QUEUE)?, context,
+            generation: if profile == super::m3_profile::Profile::Extended { 0 } else { 1 }, pool: fw(storage::POOL)?,
             scratch: [fw(MICROSEQUENCE_SCRATCH[0])?, fw(MICROSEQUENCE_SCRATCH[1])?,
                 fw(MICROSEQUENCE_SCRATCH[2])?, fw(MICROSEQUENCE_SCRATCH[3])?, fw(MICROSEQUENCE_SCRATCH[4])?],
             fw_stamp: fw(storage::FW_STAMP)?, stamp_value,
         };
-        value.encode(bytes).map_err(|_| EINVAL)?;
+        if profile == super::m3_profile::Profile::Extended {
+            let auxiliary = command::GpuVa::new(objects[TAIL_SCRATCH].gpu_va()? + offset(TAIL_SCRATCH)? as u64).map_err(|_| EINVAL)?;
+            let context_store = GpuRegion::new(objects[MICROSEQUENCE_SCRATCH[1]].gpu_va()?
+                + offset(MICROSEQUENCE_SCRATCH[1])? as u64, 0x40000).map_err(|_| EINVAL)?;
+            value.encode_extended(auxiliary, context_store, queue_sequence, bytes).map_err(|_| EINVAL)?;
+        } else { value.encode(bytes).map_err(|_| EINVAL)?; }
         objects[storage::MICROSEQUENCE].write(offset(storage::MICROSEQUENCE)?, bytes)
     }
-    fn initialize_state(objects: &mut [Buffer], context_slot: u32) -> Result {
+    fn initialize_state(objects: &mut [Buffer], context_slot: u32, profile: super::m3_profile::Profile) -> Result {
         let address = |owner: usize| queue::FirmwareVa::new(objects[owner].va()).map_err(|_| EINVAL);
         let notification = state::Notifier { threshold: address(storage::EVENT)?, context: context_slot };
         let list_owner = address(JOB_LIST)?;
         let mut context = [0; state::CONTEXT_SIZE];
-        state::context(&mut context).map_err(|_| EINVAL)?;
-        objects[GPU_CONTEXT].write(0, &context)?;
-        let mut notifier = [0; state::NOTIFIER_SIZE];
-        notification.encode(&mut notifier).map_err(|_| EINVAL)?;
+        if profile == super::m3_profile::Profile::Extended {
+            state::context_extended(&mut context).map_err(|_| EINVAL)?;
+        } else { state::context(&mut context).map_err(|_| EINVAL)?; }
+        let context_size = if profile == super::m3_profile::Profile::Extended {
+            state::EXTENDED_CONTEXT_SIZE
+        } else { state::CONTEXT_SIZE };
+        objects[GPU_CONTEXT].write(0, &context[..context_size])?;
+        let mut notifier = KVec::new();
+        notifier.resize(if profile == super::m3_profile::Profile::Extended {
+            state::EXTENDED_NOTIFIER_SIZE
+        } else { state::NOTIFIER_SIZE }, 0u8, GFP_KERNEL)?;
+        if profile == super::m3_profile::Profile::Extended {
+            notification.encode_extended(&mut notifier).map_err(|_| EINVAL)?;
+        } else { notification.encode(&mut notifier).map_err(|_| EINVAL)?; }
         objects[NOTIFIER].write(0, &notifier)?;
         let mut list = [0; state::JOB_LIST_SIZE];
         state::job_list(&mut list, list_owner).map_err(|_| EINVAL)?;
@@ -182,7 +213,7 @@ impl Compute {
                 let binding = uat.bind(vm)?;
                 let mut views = KVec::new();
                 for i in 0..storage::COUNT {
-                    if matches!(storage::allocation(i).map_err(|_|EINVAL)?.mapping,Mapping::Client(_)) {
+                    if matches!(storage::allocation_for(self.profile,i).map_err(|_|EINVAL)?.mapping,Mapping::Client(_)) {
                         views.push((i,self.objects[i].map_gpu_view(vm)?),GFP_KERNEL)?;
                     }
                 }
@@ -221,18 +252,17 @@ impl Compute {
         if self.batch_count>=storage::SLOTS {return Err(E2BIG);}
         self.slot=self.batch_count;
         for i in storage::RESET {
-            let offset=storage::slot_offset(i,self.slot).map_err(|_|EINVAL)?;
-            let size=storage::allocation(i).map_err(|_|EINVAL)?.size;
+            let offset=storage::slot_offset_for(self.profile,i,self.slot).map_err(|_|EINVAL)?;
+            let size=storage::allocation_for(self.profile,i).map_err(|_|EINVAL)?.size;
             self.objects[i].fill_range(offset,size,if i==PREEMPTION {0xcc} else {0})?;
         }
         self.objects[NOTIFIER].u32(state::NOTIFIER_CONTEXT,self._binding.slot())?;
         self.sequence=self.sequence.checked_add(1).ok_or(EOVERFLOW)?;
-        Self::encode_command(&mut self.objects,&mut self.command_bytes,self._binding.slot(),control,self.sequence,self.slot,self.registers)?;
+        Self::encode_command(&mut self.objects,&mut self.command_bytes,self._binding.slot(),control,self.sequence,self.slot,self.registers,self.profile,self._binding.generation())?;
         let stamp=self.stamp();
-        Self::encode_sequence(&mut self.objects,&mut self.sequence_bytes,self.stats,self._binding.slot(),stamp,self.slot)?;
-        self.objects[storage::EVENT].u32(0,self.sequence as u32)?;
-        self.objects[storage::COUNTER].u32(0,self.sequence as u32)?;
-        let address=self.objects[storage::COMMAND].va()+storage::slot_offset(storage::COMMAND,self.slot).map_err(|_|EINVAL)? as u64;
+        Self::encode_sequence(&mut self.objects,&mut self.sequence_bytes,self.stats,self._binding.slot(),stamp,self.slot,self.profile,self.sequence - 1)?;
+        self.write_counters()?;
+        let address=self.objects[storage::COMMAND].va()+storage::slot_offset_for(self.profile,storage::COMMAND,self.slot).map_err(|_|EINVAL)? as u64;
         self.objects[storage::RING].u64(usize::from(self.head)*8,address)?;
         self.head=(self.head+1)%queue::QUALIFIED_CAPACITY as u16;
         self.batch_count+=1;
@@ -245,39 +275,55 @@ impl Compute {
     pub(crate) fn abort_batch(&mut self)->Result {
         (self.sequence,self.head,self.batch_count)=self.checkpoint;
         self.slot=self.batch_count.saturating_sub(1);
-        self.objects[storage::EVENT].u32(0,self.sequence as u32)?;
-        self.objects[storage::COUNTER].u32(0,self.sequence as u32)?;
+        self.write_counters()?;
         self.objects[storage::QUEUE_STATE].u32(queue::WRITE,u32::from(self.head))?;
         agx_memory::publish();Ok(())
     }
+    fn write_counters(&mut self) -> Result {
+        for index in [storage::EVENT, storage::COUNTER] {
+            if self.profile == super::m3_profile::Profile::Extended {
+                self.objects[index].u64(0, self.sequence)?;
+            } else { self.objects[index].u32(0, self.sequence as u32)?; }
+        }
+        Ok(())
+    }
+
     fn offset(&self,owner:usize)->Result<usize> {
-        storage::slot_offset(owner,self.slot).map_err(|_|EINVAL)
+        storage::slot_offset_for(self.profile,owner,self.slot).map_err(|_|EINVAL)
     }
     /// Same cache-generation contract as M4: StartCompute and the persistent
     /// notifier must use the same tag before the firmware flushes user stamps.
     /// RTKit 2419: StartCompute.counter1 +0x34; JobMeta.flush_stamps +0x804.
     pub(crate) fn prepare_completion(&mut self,coalesce:bool)->Result {
+        if coalesce && self.profile == super::m3_profile::Profile::Extended { return Err(EINVAL); }
         let sequence=self.offset(storage::MICROSEQUENCE)?;
         let command=self.offset(storage::COMMAND)?;
         self.objects[storage::MICROSEQUENCE].u32(sequence+microsequence::GENERATION,0)?;
-        self.objects[storage::COMMAND].u32(command+command::FLUSH_STAMPS,u32::from(!coalesce))?;
+        self.objects[storage::COMMAND].u32(command+if self.profile == super::m3_profile::Profile::Extended { 0x81c } else { command::FLUSH_STAMPS },u32::from(!coalesce))?;
         agx_memory::publish();Ok(())
     }
     pub(crate) fn set_user_timestamps(&mut self,addresses:[u64;2])->Result {
-        let offset=self.offset(storage::COMMAND)?+command::USER_TIMESTAMPS;
+        let offset=self.offset(storage::COMMAND)?+if self.profile == super::m3_profile::Profile::Extended {
+            0x844
+        } else { command::USER_TIMESTAMPS };
         self.objects[storage::COMMAND].u64(offset,addresses[0])?;
         self.objects[storage::COMMAND].u64(offset+8,addresses[1])?;
         let pointer=if addresses==[0,0] {0} else {self.objects[storage::COMMAND].va()+offset as u64};
         let sequence=self.offset(storage::MICROSEQUENCE)?;
-        for start in [microsequence::TIMESTAMP_START,microsequence::TIMESTAMP_END] {
+        for start in if self.profile == super::m3_profile::Profile::Extended { [0x1bc, 0x20c] }
+            else { [microsequence::TIMESTAMP_START,microsequence::TIMESTAMP_END] } {
             self.objects[storage::MICROSEQUENCE].u64(sequence+start+microsequence::USER_TIMESTAMP_POINTER,pointer)?;
         }
         agx_memory::publish();Ok(())
     }
     pub(crate) fn set_attachments(&mut self,attachments:&crate::m3::agx_attachments::Attachments)->Result {
         let sequence=self.offset(storage::MICROSEQUENCE)?;
-        self.objects[storage::MICROSEQUENCE].write(sequence+microsequence::ATTACHMENTS,&attachments.0)?;
-        self.objects[storage::MICROSEQUENCE].write(sequence+microsequence::HAS_ATTACHMENTS,&[u8::from(attachments.count()!=0)])?;
+        self.objects[storage::MICROSEQUENCE].write(sequence+if self.profile == super::m3_profile::Profile::Extended {
+            microsequence::Sequence::EXTENDED_ATTACHMENTS
+        } else { microsequence::ATTACHMENTS },&attachments.0)?;
+        self.objects[storage::MICROSEQUENCE].write(sequence+if self.profile == super::m3_profile::Profile::Extended {
+            microsequence::Sequence::EXTENDED_HAS_ATTACHMENTS
+        } else { microsequence::HAS_ATTACHMENTS },&[u8::from(attachments.count()!=0)])?;
         agx_memory::publish();Ok(())
     }
     fn stamp(&self) -> u32 { timeline::stamp(0xc1000000,self.sequence) }
@@ -319,26 +365,31 @@ impl Compute {
         agx_memory::publish();crate::mem::sync();Ok(())
     }
     pub(crate) fn gpu_ns(&mut self)->Result<u64> {
-        let mut total=0;
-        for slot in 0..self.batch_count {total+=self.slot_gpu_ns(slot)?;}
+        let mut total: u64 = 0;
+        for slot in 0..self.batch_count {
+            total = total.checked_add(self.slot_gpu_ns(slot)?).ok_or(EOVERFLOW)?;
+        }
         Ok(total)
     }
     pub(crate) fn slot_gpu_ns(&mut self,slot:usize)->Result<u64> {
         if slot>=self.batch_count {return Err(EINVAL);}
-        let start=self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset(TIMESTAMPS[0],slot).map_err(|_|EINVAL)?)?;
-        let end=self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset(TIMESTAMPS[1],slot).map_err(|_|EINVAL)?)?;
-        Ok(if start!=0 && end>=start {(end-start)*1000/24} else {0})
+        let start=self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[0],slot).map_err(|_|EINVAL)?)?;
+        let end=self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[1],slot).map_err(|_|EINVAL)?)?;
+        if start == 0 || end < start { return Ok(0); }
+        self.profile.gpu_duration_ns(end - start).ok_or(EOVERFLOW)
     }
     /// A batch span includes gaps between its compute commands, unlike gpu_ns.
     /// Read only after stamps, queues, events and idle state prove retirement.
     pub(crate) fn batch_gpu_span(&mut self)->Result<[u64;2]> {
         if self.batch_count == 0 {return Err(EINVAL);}
-        Ok([self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset(TIMESTAMPS[0],0).map_err(|_|EINVAL)?)?,
-            self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset(TIMESTAMPS[1],self.batch_count-1).map_err(|_|EINVAL)?)?])
+        Ok([self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[0],0).map_err(|_|EINVAL)?)?,
+            self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[1],self.batch_count-1).map_err(|_|EINVAL)?)?])
     }
     pub(crate) fn head(&self) -> u16 { self.head }
     pub(crate) fn ordinal(&self)->u64 {self.sequence}
-    pub(crate) fn first(&self) -> bool { self.sequence == self.batch_count as u64 }
+    pub(crate) fn first(&self) -> bool {
+        self.profile == super::m3_profile::Profile::Legacy && self.sequence == self.batch_count as u64
+    }
     pub(crate) fn progress(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
         // Report real completions by elapsed time as well as sequence count;
         // batches need not land on a multiple of 128.
@@ -361,10 +412,15 @@ impl Compute {
 
     pub(crate) fn queue(&self)->u64 {self.objects[storage::QUEUE].va()}
     pub(crate) fn complete(&mut self)->Result<bool> {
-        Ok(self.objects[storage::STAMP].read_u32(0)?==self.stamp()
-            && self.objects[storage::FW_STAMP].read_u32(0)?==self.stamp()
-            && self.objects[storage::QUEUE_STATE].read_u32(queue::DONE)?==u32::from(self.head)
-            && self.objects[storage::QUEUE_STATE].read_u32(queue::READ)?==u32::from(self.head))
+        let stamped = self.objects[storage::STAMP].read_u32(0)? == self.stamp()
+            && self.objects[storage::FW_STAMP].read_u32(0)? == self.stamp()
+            && self.objects[storage::QUEUE_STATE].read_u32(queue::DONE)? == u32::from(self.head)
+            && self.objects[storage::QUEUE_STATE].read_u32(queue::READ)? == u32::from(self.head);
+        if !stamped { return Ok(false); }
+        if self.profile == super::m3_profile::Profile::Extended {
+            return Ok(self.objects[storage::POOL].read_u64(0x54)? == self.sequence);
+        }
+        Ok(true)
     }
     pub(crate) fn log(&mut self,dev:&driver::AsahiDrmDevice)->Result {
         for off in (0..512).step_by(128) {
diff --git a/drivers/gpu/drm/asahi/m3/m3_config.rs b/drivers/gpu/drm/asahi/m3/m3_config.rs
index bfb408b07a530..ffd1bb963b905 100644
--- a/drivers/gpu/drm/asahi/m3/m3_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_config.rs
@@ -177,6 +177,16 @@ impl Config {
         Ok(())
     }
 
+    pub(crate) fn global_table_views(&mut self, vm: &mmu::Vm) -> Result<KVec<mmu::KernelMapping>> {
+        let mut mappings = KVec::new();
+        if self.profile == super::m3_profile::Profile::Extended {
+            for index in [super::m3_init_26::GLOBAL_POOL, super::m3_init_26::GLOBAL_PARAMETERS] {
+                mappings.push(self.objects[index].map_gpu_view(vm)?, GFP_KERNEL)?;
+            }
+        }
+        Ok(mappings)
+    }
+
     pub(crate) fn root(&self) -> u64 { self.objects[storage::ROOT].va() }
     pub(crate) fn log_globals_debug(&mut self,dev:&driver::AsahiDrmDevice)->Result {
         let value=self.objects[GLOBALS].read_u32(crate::m3::m3_globals_debug::OFFSET)?;
diff --git a/drivers/gpu/drm/asahi/m3/m3_device.rs b/drivers/gpu/drm/asahi/m3/m3_device.rs
index 05a3961369a6d..474a8b3f561ec 100644
--- a/drivers/gpu/drm/asahi/m3/m3_device.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_device.rs
@@ -129,6 +129,7 @@ impl Device {
                 }
                 e.sgx_setup()
             }
+            None if device.firmware.profile() == super::m3_profile::Profile::Extended => None,
             None => Some(soc.sgx_setup.ok_or(ENODEV)?),
         };
         if let Some((setup_offset, setup_value)) = setup {
@@ -179,7 +180,6 @@ impl Device {
         if self.firmware.profile() == super::m3_profile::Profile::Extended {
             // Adaptive clock gating can leave individual engine banks inaccessible
             // even while the GPU performance-state register says powered up.
-            dev_info!(self.dev.as_ref(), "M3: adaptive firmware fault evidence uses retained metadata; engine banks may be gated\n");
             return Ok(());
         }
         let sgx_guard = self.sgx.try_access().ok_or(ENODEV)?;
diff --git a/drivers/gpu/drm/asahi/m3/m3_runtime.rs b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
index 40399a80a01f3..058c6610399ae 100644
--- a/drivers/gpu/drm/asahi/m3/m3_runtime.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
@@ -389,7 +389,7 @@ impl Inner {
         let index=found.unwrap_or(self.jobs.len());
         if found.is_none() {
             let job=match control {
-                crate::m3::m3_submit::Command::Compute(c)=>NativeJob::Compute(crate::m3::m3_compute::Compute::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,c,self.device.soc().registers).map_err(early)?),
+                crate::m3::m3_submit::Command::Compute(c)=>NativeJob::Compute(crate::m3::m3_compute::Compute::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,c,self.device.soc().registers,self.device.firmware().profile()).map_err(early)?),
                 crate::m3::m3_submit::Command::Render{..}=>NativeJob::Render(crate::m3::m3_render::Render::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,self.device.soc().clusters,self.device.soc().registers).map_err(early)?),
             };
             self.jobs.push(job,GFP_KERNEL).map_err(|_|early(ENOMEM))?;
@@ -469,6 +469,9 @@ impl Inner {
         crate::mem::sync();
         self.t8122_verdict=false;
         let previous_events=self.config.completed_events;
+        if self.device.firmware().profile() == super::m3_profile::Profile::Extended {
+            packet.vm.mark_binding_published().map_err(early)?;
+        }
         let publication_tick=if crate::debug::debug_enabled(crate::debug::DebugFlags::M3PassTiming) {physical_counter()} else {0};
         self.state.health.set_gpu_pending(true);
         self.gpu_pending = true;
@@ -535,7 +538,7 @@ impl Inner {
             let control=first_compute.ok_or(EINVAL)?;
             if existing.is_none() {
                 let job=crate::m3::m3_compute::Compute::new(&self.drm,&self.uat,&packet.vm,
-                    self.config.stats_region()?,control,self.device.soc().registers)?;
+                    self.config.stats_region()?,control,self.device.soc().registers,self.device.firmware().profile())?;
                 self.jobs.push(NativeJob::Compute(job),GFP_KERNEL)?;
             } else {
                 let NativeJob::Compute(j)=&mut self.jobs[compute_index] else {return Err(EINVAL);};
@@ -1059,7 +1062,7 @@ impl Runtime {
             // TTBAT of the admitted reservations, the firmware kernel root (`pagetables`) as
             // every context's upper half, and the host window (root entry 2) through the
             // shared L2. The RTKit is awake and no initdata or GPU job has been published.
-            let (uat,window)=adopted.insert(adopt_uat(&drm,device.soc(),&device.firmware().resources)?);
+            let (uat,window)=adopted.insert(adopt_uat(&drm,device.soc(),&device.firmware().resources,device.firmware().profile())?);
             let config=Config::new(&drm,uat,device.firmware(),&contents)?;
             // Link every kernel table the configuration created before the firmware sees an
             // address in it, then drop any translation cached before they existed.
@@ -1103,7 +1106,8 @@ impl Runtime {
         // (7.1.12's M3 VM job lifetime, the shared `mmu::lifetime` on 7.2).
         let vm=self.inner.uat.new_vm(id, range)?.with_tracked_status()?;
         let mut reserved=KVec::new();reserved.push(reserved_range,GFP_KERNEL)?;reserved.push(0x100_8000_0000..0x101_0000_0000,GFP_KERNEL)?;reserved.push(0x10_0000_0000..0x10_0800_0000,GFP_KERNEL)?;reserved.push(0x10_7400_0000..0x10_7402_8000,GFP_KERNEL)?;
-        vm.install_driver_mappings(KVec::new(),reserved)?;
+        let mappings = self.inner.config.global_table_views(&vm)?;
+        vm.install_driver_mappings(mappings,reserved)?;
         Ok(vm)
     }
     pub(crate) fn map_timestamp(&mut self,mut bo:crate::gem::ObjectRef,range:core::ops::Range<usize>)->Result<mmu::KernelMapping> {
@@ -1369,13 +1373,15 @@ pub(crate) fn physical_counter() -> u64 {
 /// (ttbs, pagetables, handoff, shared-l2) and the PPL exchange with its startup epoch, as the
 /// G15 backend does it on 7.2 (`g15::uat`).
 fn adopt_uat(drm: &driver::AsahiDrmDevice, soc: &'static crate::m3::m3_soc::Soc,
-    resources: &crate::m3::agx_resources::Resources) -> Result<(mmu::Uat, crate::g15::uat::Window)> {
+    resources: &crate::m3::agx_resources::Resources, profile: super::m3_profile::Profile)
+    -> Result<(mmu::Uat, crate::g15::uat::Window)> {
     let cfg = soc.hwcfg.ok_or(ENODEV)?;
     let [ttbs, tables, handoff, shared_l2, ..] = resources.regions;
     let range = |r: crate::m3::agx_resources::Region| r.base..r.base + r.size;
     let geometry = mmu::UatGeometry { ias: cfg.uat_ias.into(), oas: cfg.uat_oas };
     let regions = mmu::AdoptedRegions { handoff: range(handoff), ttbs: range(ttbs), kernel_root: tables.base };
-    let uat = mmu::Uat::new_adopted(drm, geometry, &regions)?;
+    let uat = mmu::Uat::new_adopted_with_user_upper(drm, geometry, &regions,
+        profile == super::m3_profile::Profile::Legacy)?;
     let mut window = crate::g15::uat::Window::from_regions(handoff.base, ttbs.base, tables.base, shared_l2.base)?;
     window.bootstrap(drm.as_ref().as_ref(), &uat)?;
     // 7.1.12 cleaned every reserved-table write to the point of coherency; these regions may be

From ec30b227fefa70ee9bb6b962bceb2bf03495d791 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:40:42 -0400
Subject: [PATCH 07/14] drm/asahi: enable J613 extended firmware render and
 retirement

Encode extended tiler and fragment work, scene records, independent
notifications and attachment visibility through the existing runtime.
Retire native pools and enable only the exact J613 26.6.2 profile.
Keep the public UAPI and physical G15 stream formats unchanged.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_board.rs          |   2 +-
 drivers/gpu/drm/asahi/m3/m3_compute.rs        |  10 +-
 drivers/gpu/drm/asahi/m3/m3_config.rs         |  12 +
 drivers/gpu/drm/asahi/m3/m3_drm.rs            |  10 +-
 drivers/gpu/drm/asahi/m3/m3_firmware.rs       |  10 +-
 .../gpu/drm/asahi/m3/m3_fragment_command.rs   | 138 ++++++++++--
 .../gpu/drm/asahi/m3/m3_parameter_layout.rs   |  74 +++++++
 drivers/gpu/drm/asahi/m3/m3_pass.rs           |   4 +-
 drivers/gpu/drm/asahi/m3/m3_pass_layout.rs    |  36 +++
 drivers/gpu/drm/asahi/m3/m3_profile.rs        |  21 ++
 drivers/gpu/drm/asahi/m3/m3_render.rs         | 206 +++++++++++++-----
 .../gpu/drm/asahi/m3/m3_render_sequence.rs    | 168 ++++++++++++++
 drivers/gpu/drm/asahi/m3/m3_runtime.rs        |   4 +-
 drivers/gpu/drm/asahi/m3/m3_scene_layout.rs   |  40 ++++
 drivers/gpu/drm/asahi/m3/m3_shared_layout.rs  |  26 +++
 drivers/gpu/drm/asahi/m3/m3_submit.rs         |   7 +-
 drivers/gpu/drm/asahi/m3/m3_sync_layout.rs    |  55 +++++
 drivers/gpu/drm/asahi/m3/m3_tiler_command.rs  | 131 +++++++++--
 drivers/gpu/drm/asahi/m3/t8122_admission.rs   |  40 +++-
 tools/asahi/m3-runtime-tests.rs               |  60 +++++
 20 files changed, 953 insertions(+), 101 deletions(-)

diff --git a/drivers/gpu/drm/asahi/m3/m3_board.rs b/drivers/gpu/drm/asahi/m3/m3_board.rs
index c44b2a42d99d5..5d4ea4277b618 100644
--- a/drivers/gpu/drm/asahi/m3/m3_board.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_board.rs
@@ -13,7 +13,7 @@ use crate::m3::m3_resources::{
 use crate::m3::m3_soc::Soc;
 
 /// Whether the root node's compatible list contains `compatible`.
-fn board_is(compatible: &[u8]) -> bool {
+pub(crate) fn board_is(compatible: &[u8]) -> bool {
     let Some(root) = kernel::of::root() else {
         return false;
     };
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute.rs b/drivers/gpu/drm/asahi/m3/m3_compute.rs
index 577510b7e9ecf..b6e9444ed5449 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute.rs
@@ -350,10 +350,12 @@ impl Compute {
         let barriers=self.barriers.as_mut().ok_or(EINVAL)?;
         let offset=self.slot*64;
         let mut bytes=[0;crate::m3::m3_sync_layout::BARRIER_SIZE];
-        crate::m3::m3_sync_layout::Barrier {
+        let barrier=crate::m3::m3_sync_layout::Barrier {
             stamp:dependency.stamp,wait_value:dependency.value,event:dependency.event,
             self_value:value,uuid:0xc10000,dependency:crate::m3::m3_sync_layout::Dependency::PreviousPass,
-        }.encode(&mut bytes).map_err(|_|EINVAL)?;
+        };
+        if self.profile==super::m3_profile::Profile::Extended {barrier.encode_extended(&mut bytes)}
+        else {barrier.encode(&mut bytes)}.map_err(|_|EINVAL)?;
         barriers.write(offset,&bytes)?;
         let address=barriers.va()+offset as u64;
         let (slots,next)=queue::insert_before_last(self.head,queue::QUALIFIED_CAPACITY).map_err(|_|EINVAL)?;
@@ -382,8 +384,8 @@ impl Compute {
     /// Read only after stamps, queues, events and idle state prove retirement.
     pub(crate) fn batch_gpu_span(&mut self)->Result<[u64;2]> {
         if self.batch_count == 0 {return Err(EINVAL);}
-        Ok([self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[0],0).map_err(|_|EINVAL)?)?,
-            self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[1],self.batch_count-1).map_err(|_|EINVAL)?)?])
+        Ok([self.profile.profiler_ticks(self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[0],0).map_err(|_|EINVAL)?)?),
+            self.profile.profiler_ticks(self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[1],self.batch_count-1).map_err(|_|EINVAL)?)?)])
     }
     pub(crate) fn head(&self) -> u16 { self.head }
     pub(crate) fn ordinal(&self)->u64 {self.sequence}
diff --git a/drivers/gpu/drm/asahi/m3/m3_config.rs b/drivers/gpu/drm/asahi/m3/m3_config.rs
index ffd1bb963b905..02b847e210dc9 100644
--- a/drivers/gpu/drm/asahi/m3/m3_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_config.rs
@@ -246,6 +246,18 @@ impl Config {
         self.thermal.busy(now);
         Ok(())
     }
+    pub(crate) fn render_stats(&self) -> Result<[init::Region;2]> {
+        if self.profile==super::m3_profile::Profile::Legacy {
+            let value=self.stats_region()?;return Ok([value;2]);
+        }
+        let region=|index:usize,offset:usize| {
+            let object=&self.objects[index];
+            init::Region::new(object.va().checked_add(offset as u64).ok_or(EOVERFLOW)?,
+                object.size().checked_sub(offset).ok_or(EINVAL)?).map_err(|_|EINVAL)
+        };
+        Ok([region(UNKNOWN_C0,4)?,region(UNKNOWN_C1,8)?])
+    }
+
     pub(crate) fn stats_region(&self) -> Result<init::Region> {
         let owner = &self.objects[if self.profile == super::m3_profile::Profile::Extended {
             UNKNOWN_C3
diff --git a/drivers/gpu/drm/asahi/m3/m3_drm.rs b/drivers/gpu/drm/asahi/m3/m3_drm.rs
index e1db1adf9e6a9..8aedd920f31dc 100644
--- a/drivers/gpu/drm/asahi/m3/m3_drm.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_drm.rs
@@ -113,10 +113,12 @@ impl Backend {
             crate::m3::t8122_start::not_admitted(pdev.as_ref(), soc);
         })?;
         dev_info!(pdev.as_ref(), "M3: resource admission complete\n");
-        // An armed T8122 start supplies the values its table leaves out. An unarmed T8122
-        // needs a complete table, which it does not have: it is refused here.
-        let experiment = crate::m3::t8122_start::arm(pdev.as_ref(), soc)?;
-        if experiment.is_none() {
+        // Extended T8122 uses its dedicated initialization graph. Keep the
+        // legacy guarded-start and completeness checks for older interfaces.
+        let extended=crate::m3::t8122_start::is_t8122(soc)
+            && crate::m3::t8122_admission::loaded_profile(pdev)?==super::m3_profile::Profile::Extended;
+        let experiment = if extended {None} else {crate::m3::t8122_start::arm(pdev.as_ref(), soc)?};
+        if experiment.is_none() && !extended {
             soc.require_complete(pdev.as_ref())?;
         }
         let experiment = experiment.as_ref();
diff --git a/drivers/gpu/drm/asahi/m3/m3_firmware.rs b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
index 6bc87a33aaa05..94a2d3384d08a 100644
--- a/drivers/gpu/drm/asahi/m3/m3_firmware.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
@@ -62,7 +62,7 @@ pub(crate) static KNOWN_IMAGES_T8122: [KnownImage; 1] = [KnownImage {
     initdata_magic: Some(G15_V14_8_3_INITDATA),
 }];
 
-/// Image record for the extended format. The SoC's runtime selection does not use it yet.
+/// Exact normalized image identity for the extended firmware interface.
 pub(crate) static T8122_IMAGES_26: [KnownImage; 1] = [KnownImage {
     name: "T8122 C0 firmware-compat 26.6.2",
     uuid: None,
@@ -164,7 +164,7 @@ pub(crate) static T8122_LAYOUT: Layout = Layout {
 pub(crate) const TEXT_SHA256: [u8; 32] = [
     0x11, 0xe4, 0x9f, 0x75, 0xb, 0x67, 0x1a, 0x2b, 0x13, 0xd0, 0x92, 0xdb, 0x1c, 0xbc, 0xa3, 0xa8, 0x77, 0x55, 0x86, 0xd6, 0xb1, 0xe3, 0xaa, 0xe8, 0xa6, 0xa4, 0x64, 0xa7, 0x80, 0x2, 0x93, 0xd5];
 
-/// T8122 C0, firmware-compat 26.6.2. Selection remains separate from runtime admission.
+/// T8122 C0, firmware-compat 26.6.2 segment and loader-mutable bounds.
 pub(crate) static T8122_LAYOUT_26: Layout = Layout {
     text_size: 393216,
     data_size: 1228800,
@@ -313,7 +313,10 @@ pub(crate) fn identify_loaded(
         prelude::*,
     };
 
-    let layout = soc.firmware.ok_or(ENODEV)?;
+    let extended=crate::m3::t8122_start::is_t8122(soc)
+        && crate::m3::t8122_admission::loaded_profile(pdev)?==super::m3_profile::Profile::Extended;
+    if extended && experiment.is_some() {return Err(EINVAL);}
+    let layout = if extended {&T8122_LAYOUT_26} else {soc.firmware.ok_or(ENODEV)?};
     if !Firmware::matching_layout(layout, &resources) {
         dev_err!(pdev.as_ref(), "M3 {}: unsupported firmware segment layout\n", soc.gpu_name);
         return Err(ENODEV);
@@ -337,6 +340,7 @@ pub(crate) fn identify_loaded(
     // The T8122 start experiment identifies the same image, with its own InitData version.
     let images = match experiment {
         Some(_) => &KNOWN_IMAGES_T8122_EXPERIMENT[..],
+        None if extended => &T8122_IMAGES_26[..],
         None => soc.images,
     };
     let image = crate::m3::m3_board::identify(pdev.as_ref(), bytes, &digest, images).ok_or(ENODEV)?;
diff --git a/drivers/gpu/drm/asahi/m3/m3_fragment_command.rs b/drivers/gpu/drm/asahi/m3/m3_fragment_command.rs
index 44671ee3cd0ab..e0aaf2584284a 100644
--- a/drivers/gpu/drm/asahi/m3/m3_fragment_command.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_fragment_command.rs
@@ -3,6 +3,8 @@ use super::{agx_render::Geometry, agx_render_state::{Program,DepthStencil},
     m3_compute_layout::{GpuVa,RegisterSet}, m3_init_layout::{Error,Region},
     m3_queue_layout::FirmwareVa, m3_render_sequence::fragment};
 pub(crate) const SIZE:usize=0xc73;
+pub(crate) const EXTENDED_SIZE:usize=0xca0;
+pub(crate) const EXTENDED_FLUSH:usize=0xbdc;
 pub(crate) const REGISTERS:usize=fragment::REGISTERS;
 /// The registers G15G does not take; the others keep the G15S order.
 pub(crate) const G15G_OMIT:[u32;4]=[0x160a8,0x160b8,0xa5a9,0xd429];
@@ -74,16 +76,30 @@ impl Command {
     /// Check references before touching output. The caller owns validation of
     /// client resource mappings; this layer serializes their semantic state.
     pub(crate) fn encode(&self,out:&mut[u8])->Result<(),Error> {
-        if out.len()<SIZE {return Err(Error::Size);}
+        self.encode_format(out,None)
+    }
+    pub(crate) fn encode_extended(&self, dispatch:super::m3_tiler_command::Dispatch26,
+        out:&mut[u8])->Result<(),Error> {
+        self.encode_format(out,Some(dispatch))
+    }
+    fn encode_format(&self,out:&mut[u8],dispatch:Option<super::m3_tiler_command::Dispatch26>)->Result<(),Error> {
+        let extended=dispatch.is_some();
+        let size=if extended {EXTENDED_SIZE} else {SIZE};
+        if out.len()<size {return Err(Error::Size);}
+        if let Some(native)=&dispatch {
+            if native.incarnation==0 || native.serial==0 || native.usc_window&0xffff_ffff!=0
+                || native.usc_window>=1<<42 || self.register_set!=RegisterSet::G15G {return Err(Error::Address);}
+        }
         if self.context>=64 {return Err(Error::Address);}
-        let seq=self.sequence.at(0,fragment::LENGTH)?;
+        let sequence_size=if extended {0x370} else {fragment::LENGTH};
+        let seq=self.sequence.at(0,sequence_size)?;
         let alias=self.gpu_alias.get();
-        GpuVa::new(alias.checked_add((SIZE-3) as u64).ok_or(Error::Address)?).map_err(|_|Error::Address)?;
+        GpuVa::new(alias.checked_add(((size-1)&!3) as u64).ok_or(Error::Address)?).map_err(|_|Error::Address)?;
         let registers=alias+REGISTERS as u64;
         let s=&self.state;let g=&s.geometry;
         let layer_metadata=self.heap.get().checked_add(if g.layers>1 {0x200}else{0}).ok_or(Error::Address)?;
         GpuVa::new(layer_metadata).map_err(|_|Error::Address)?;
-        let user=super::agx_render_state::compact(self.scene_user.get().checked_add(0x40).ok_or(Error::Address)?)
+        let user=super::agx_render_state::compact(self.scene_user.get().checked_add(if extended {0} else {0x40}).ok_or(Error::Address)?)
             .map_err(|_|Error::Address)? & !15;
         let width=(g.pixels&0xffff)+1;let height=(g.pixels>>16)+1;
         let tx=width.div_ceil(32);let ty=height.div_ceil(32);
@@ -116,43 +132,85 @@ impl Command {
             (0x101c1,0),(0xd469,0),(0x1a0f9,8),(0x1c838,0),(0x1ca28,user),
             (0xa5a9,0x6000400020),(0xd429,0x200000001),
         ];
-        let bytes=&mut out[..SIZE];bytes.fill(0);
+        let bytes=&mut out[..size];bytes.fill(0);
         word(bytes,0,1); // fragment opcode; work counter remains zero
         word(bytes,0xc,self.context);
         for (offset,value) in [(0x14,seq),(0x20,self.notifier.get()),(0x28,self.manager.get()),
             (0x30,self.scene.get()),(0x38,self.empty.get()),(0x40,self.tilemap.get()),(0x780,registers)] {pointer(bytes,offset,value);}
-        word(bytes,SEQUENCE_LENGTH,fragment::LENGTH as u32);
-        // The qualified patch path updates register MSAA but retains these
-        // producer header values. Representation cleanup must not change that.
-        pointer(bytes,0x48,0x88);word(bytes,0x50,1);
-        bytes[0x54..0x56].copy_from_slice(&((g.y_blocks>>18) as u16).to_le_bytes());
-        bytes[0x56..0x58].copy_from_slice(&((g.x_blocks>>18) as u16).to_le_bytes());
-        word(bytes,0x68,s.merge_upper[0]);word(bytes,0x6c,s.merge_upper[1]);
-        pointer(bytes,0x78,u64::from(g.tiles));
+        word(bytes,SEQUENCE_LENGTH,sequence_size as u32);
+        if extended {
+            pointer(bytes,4,dispatch.as_ref().map_or(0,|native|native.serial));
+            word(bytes,0x50,1);
+            word(bytes,0x54,g.isp_blocks);
+            word(bytes,0x60,g.x_blocks);
+            word(bytes,0x64,g.y_blocks);
+            word(bytes,0x68,g.blocks);
+            word(bytes,0x78,g.tiles);
+        } else {
+            pointer(bytes,0x48,0x88);word(bytes,0x50,1);
+            bytes[0x54..0x56].copy_from_slice(&((g.y_blocks>>18) as u16).to_le_bytes());
+            bytes[0x56..0x58].copy_from_slice(&((g.x_blocks>>18) as u16).to_le_bytes());
+            word(bytes,0x68,s.merge_upper[0]);word(bytes,0x6c,s.merge_upper[1]);
+            pointer(bytes,0x78,u64::from(g.tiles));
+        }
         let g15g=self.register_set==RegisterSet::G15G;
         let mut count=0;
-        for (register,value) in values.into_iter().filter(|(r,_)| !g15g || !G15G_OMIT.contains(r)) {
-            let n=count;count+=1;
-            word(bytes,REGISTERS+n*REGISTER_STRIDE,register);pointer(bytes,REGISTERS+n*REGISTER_STRIDE+4,value);
+        let mut emit=|register,value| {
+            word(bytes,REGISTERS+count*REGISTER_STRIDE,register);
+            pointer(bytes,REGISTERS+count*REGISTER_STRIDE+4,value);
+            count+=1;
+        };
+        for (register,mut value) in values {
+            if extended {
+                if matches!(register,0x160b8|0x120a1|0x1c838|0x1ca28) {continue;}
+                if register==0x10791 {emit(0xa301,0);}
+                if register==0x16068 {value=(value&!0x3ffff)|0x3717f;}
+                if matches!(register,0x15109|0x15101) {value&=!3;}
+            } else if g15g && G15G_OMIT.contains(&register) {continue;}
+            emit(register,value);
+        }
+        if let Some(native)=&dispatch {
+            for register in [0x160e0,0x1499,0xa341] {emit(register,fragment::UUID.into());}
+            emit(0x1c838,0);
+            emit(0x1ca28,user);
+            emit(0x10069,native.usc_window);
         }
         bytes[0x788..0x78a].copy_from_slice(&(count as u16).to_le_bytes());
         bytes[0x78a..0x78c].copy_from_slice(&((count*REGISTER_STRIDE) as u16).to_le_bytes());
         // Start3DJobParameters3: mirror records use their actual packed widths.
         for (offset,value) in [(0,s.depth_bias),(0x10,s.scissor),(0x20,s.query),
-            (0x168,s.partial_background.resources),(0x170,s.partial_background.address),
+            (0x168,if extended {s.background.resources}else{s.partial_background.resources}),
+            (0x170,if extended {s.background.address}else{s.partial_background.address}),
             (0x198,s.partial_background.resources),(0x1a0,s.partial_background.address),
             (0x1a8,s.zls_control),(0x1b8,s.depth.base),(0x1c0,s.depth.stride),
             (0x1c8,s.depth_compression.stride),(0x1e0,s.depth_compression.base),
             (0x1d0,s.depth.base),(0x1d8,s.depth.base),
             (0x1e8,s.stencil.base),(0x1f0,s.stencil.stride),(0x200,s.stencil.base),(0x208,s.stencil.base),
             (0x1f8,s.stencil_compression.stride),(0x210,s.stencil_compression.base),
-            (0x26c,s.partial_eot.address),(0x28c,s.partial_eot.address),(0x2c0,u64::from(s.depth_dimensions))] {
-            pointer(bytes,PARAMETERS+offset,value);
+            (0x26c,if extended {s.eot.address}else{s.partial_eot.address}),(0x28c,s.partial_eot.address),(0x2c0,u64::from(s.depth_dimensions))] {
+            pointer(bytes,PARAMETERS+offset+if extended && offset<=0x20 {0x10}else{0},value);
         }
         for (offset,value) in [(0x1b0,0x04040404),(0x228,s.mirror_tilebuffer_control),
             (0x230,s.isp_control),(0x238,width),(0x23c,height),(0x240,0x100000),
-            (0x248,s.mirror_tile_mode),(0x264,s.partial_eot.resources as u32),(0x284,s.partial_eot.resources as u32),
+            (0x248,s.mirror_tile_mode),(0x264,if extended {s.eot.resources as u32}else{s.partial_eot.resources as u32}),(0x284,s.partial_eot.resources as u32),
             (0x298,s.depth_clear),(0x29c,s.stencil_clear),(0x2a0,s.sample_size)] {word(bytes,PARAMETERS+offset,value);}
+        if let Some(native)=dispatch {
+            pointer(bytes,0xbc0,self.stamp.get());
+            pointer(bytes,0xbc8,self.fw_stamp.get());
+            word(bytes,0xbd0,self.stamp_value);
+            word(bytes,0xbd4,1);
+            word(bytes,EXTENDED_FLUSH,1);
+            word(bytes,0xbe0,fragment::UUID);
+            pointer(bytes,0xc10,self.timestamps[0].get());
+            pointer(bytes,0xc18,self.timestamps[1].get());
+            pointer(bytes,0xc20,self.user_timestamps[0].get());
+            pointer(bytes,0xc28,self.user_timestamps[1].get());
+            pointer(bytes,0xc46,self.pool.get());
+            bytes[0xc4e]=1;
+            pointer(bytes,0xc57,native.firmware_aux.get());
+            bytes[0xc5f]=native.incarnation;
+            bytes[0xc84]=1;
+        } else {
         word(bytes,0xb88,0x67); // EncoderParams.encoder_id
         word(bytes,0xb90,u32::MAX); // EncoderParams.unk_mask
         word(bytes,0xb94,u32::from(s.process_empty_tiles));
@@ -167,6 +225,46 @@ impl Command {
             pointer(bytes,fragment::COMMAND_TAIL+offset,value);
         }
         bytes[fragment::COMMAND_TAIL+0x36]=1;bytes[fragment::COMMAND_TAIL+0x4f]=1;
+        }
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test]
+    fn native_fragment_uses_distinct_program_mirrors_and_completion_tail() {
+        let fw=|n:u64|FirmwareVa::new(0xffff_fc25_3000_0000+n*0x4000).unwrap();
+        let gpu=|n:u64|GpuVa::new(0x10_0300_0000+n*0x4000).unwrap();
+        let program=|n:u64|Program{address:0x1_0000_0000+n*0x1000,resources:n};
+        let surface=DepthStencil{base:0,stride:0};
+        let command=Command {context:3,register_set:RegisterSet::G15G,
+            sequence:Region::new(fw(0).get(),0x1000).unwrap(),notifier:fw(1),manager:fw(2),scene:fw(3),empty:fw(4),
+            gpu_alias:GpuVa::new(0x72_1000_4000).unwrap(),tilemap:gpu(0),heap:gpu(1),auxiliary:gpu(2),scene_user:gpu(3),
+            scratch:gpu(4),pool:fw(5),stamp:fw(6),fw_stamp:fw(7),stamp_value:0x3d000100,
+            timestamps:[fw(8),fw(9)],user_timestamps:[fw(10),fw(11)],
+            state:State {geometry:Geometry::new(64,64,super::super::agx_render::Utile::Pixels32,
+                super::super::agx_render::Utile::Pixels32,1).unwrap(),multisample:0,merge_upper:[0;2],
+                eot:program(1),background:program(2),partial_eot:program(3),partial_background:program(4),
+                scissor:0,depth_bias:0,query:0,isp_control:0xc000,tilebuffer_control:1,mirror_tilebuffer_control:1,
+                tile_mode:0x280,mirror_tile_mode:0x280,depth:surface,stencil:surface,depth_compression:surface,
+                stencil_compression:surface,zls_control:0,depth_dimensions:0,depth_clear:0,stencil_clear:0,
+                sample_size:4,process_empty_tiles:false}};
+        let dispatch=||super::super::m3_tiler_command::Dispatch26 {incarnation:9,serial:1,peer_stamp:0,
+            usc_window:1<<32,firmware_aux:fw(12),scene_scratch:gpu(4)};
+        let mut bytes=[0xa5;EXTENDED_SIZE+8];
+        command.encode_extended(dispatch(),&mut bytes).unwrap();
+        let word=|at|u32::from_le_bytes(bytes[at..at+4].try_into().unwrap());
+        let pointer=|at|u64::from_le_bytes(bytes[at..at+8].try_into().unwrap());
+        assert_eq!(word(0xbd0),command.stamp_value);
+        assert_eq!(word(EXTENDED_FLUSH),1);
+        assert_eq!(pointer(0x900),command.state.background.address);
+        assert_eq!(pointer(0x930),command.state.partial_background.address);
+        assert_eq!(bytes[0xc5f],9);
+        assert_eq!(&bytes[EXTENDED_SIZE..],&[0xa5;8]);
+        let mut short=[0xa5;EXTENDED_SIZE-1];
+        assert!(command.encode_extended(dispatch(),&mut short).is_err());
+        assert!(short.iter().all(|b|*b==0xa5));
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs b/drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs
index 684505615adf3..97c1367b29455 100644
--- a/drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs
@@ -61,3 +61,77 @@ impl Manager {
         Ok(())
     }
 }
+
+impl Manager {
+    pub(crate) const EXTENDED_SIZE: usize = 0xc0;
+
+    /// J613's extended manager has both firmware and GPU page-list aliases.
+    /// The block ring is read through its canonical firmware mapping.
+    pub(crate) fn encode_extended(&self, pages_fw: FirmwareVa, blocks_fw: FirmwareVa,
+        hardware_id: u32, output: &mut [u8]) -> Result<(), Error> {
+        let capacity = self.block_count.checked_add(1).and_then(u32::checked_next_power_of_two)
+            .ok_or(Error::Size)?;
+        if hardware_id >= 32 || capacity as usize > self.blocks.size() / 8 {
+            return Err(Error::Size);
+        }
+        let bytes = output.get_mut(..Self::EXTENDED_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        let word = |bytes: &mut [u8], offset: usize, value: u32| {
+            bytes[offset..offset + 4].copy_from_slice(&value.to_le_bytes());
+        };
+        let address = |bytes: &mut [u8], offset: usize, value: u64| {
+            bytes[offset..offset + 8].copy_from_slice(&value.to_le_bytes());
+        };
+        word(bytes, 8, hardware_id);
+        word(bytes, 12, hardware_id);
+        address(bytes, 0x1c, pages_fw.get());
+        address(bytes, 0x24, self.pages.base());
+        word(bytes, 0x2c, self.pages.size() as u32);
+        word(bytes, 0x30, self.page_count);
+        word(bytes, 0x34, capacity);
+        word(bytes, 0x38, self.block_count);
+        address(bytes, 0x40, blocks_fw.get());
+        address(bytes, 0x48, self.control.get());
+        word(bytes, 0x50, self.page_count - 1);
+        word(bytes, 0x54, BLOCK_SIZE as u32);
+        address(bytes, 0x60, self.counter.get());
+        word(bytes, 0x78, self.page_count);
+        word(bytes, 0x7c, self.page_count);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    fn fixture() -> Manager {
+        Manager::new(GpuRegion::new(0x5000_0000, 0x4000).unwrap(),
+            GpuRegion::new(0x6000_0000, 0x4000).unwrap(),
+            FirmwareVa::new(0xffff_fc24_0010_0000).unwrap(),
+            FirmwareVa::new(0xffff_fc24_0020_0000).unwrap(), 32).unwrap()
+    }
+    #[test] fn native_manager_keeps_distinct_aliases_and_hardware_identity() {
+        let mut bytes = [0xa5; Manager::EXTENDED_SIZE + 8];
+        let pages = FirmwareVa::new(0xffff_fc24_0030_0000).unwrap();
+        let blocks = FirmwareVa::new(0xffff_fc24_0040_0000).unwrap();
+        fixture().encode_extended(pages, blocks, 7, &mut bytes).unwrap();
+        let word = |at| u32::from_le_bytes(bytes[at..at + 4].try_into().unwrap());
+        let pointer = |at| u64::from_le_bytes(bytes[at..at + 8].try_into().unwrap());
+        assert_eq!(word(8), 7); assert_eq!(word(12), 7);
+        assert_eq!(pointer(0x1c), pages.get());
+        assert_eq!(pointer(0x24), 0x5000_0000);
+        assert_eq!(pointer(0x40), blocks.get());
+        assert_eq!(word(0x34), 64); assert_eq!(word(0x38), 32);
+        assert_eq!(word(0x50), 127);
+        assert_eq!(pointer(0x80), 0);
+        assert_eq!(&bytes[Manager::EXTENDED_SIZE..], &[0xa5; 8]);
+    }
+    #[test] fn native_manager_rejects_short_storage_and_invalid_identity_before_mutation() {
+        let fw = FirmwareVa::new(0xffff_fc24_0010_0000).unwrap();
+        let mut bytes = [0xa5; Manager::EXTENDED_SIZE];
+        assert!(fixture().encode_extended(fw, fw, 32, &mut bytes).is_err());
+        assert_eq!(bytes, [0xa5; Manager::EXTENDED_SIZE]);
+        assert!(fixture().encode_extended(fw, fw, 0, &mut bytes[..MANAGER_SIZE]).is_err());
+        assert_eq!(bytes, [0xa5; Manager::EXTENDED_SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_pass.rs b/drivers/gpu/drm/asahi/m3/m3_pass.rs
index 94c2172e33279..9c0eb070039cd 100644
--- a/drivers/gpu/drm/asahi/m3/m3_pass.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_pass.rs
@@ -8,10 +8,10 @@ use layout::{Field,Space};
 pub(crate) struct Pass {buffers:KVec<Buffer>}
 impl Pass {
     pub(crate) fn new(dev:&driver::AsahiDrmDevice,uat:&mmu::Uat,vm:&mmu::Vm,
-        slot:usize,clusters:u32,aliases:&mut KVec<mmu::KernelMapping>)->Result<Self> {
+        slot:usize,clusters:u32,profile:super::m3_profile::Profile,aliases:&mut KVec<mmu::KernelMapping>)->Result<Self> {
         let mut buffers=KVec::with_capacity(layout::COUNT,GFP_KERNEL)?;
         for field in layout::FIELDS {
-            let a=layout::board_allocation(slot,field,clusters).map_err(|_|EINVAL)?;
+            let a=layout::allocation_for(profile,slot,field,clusters).map_err(|_|EINVAL)?;
             let mut b=match a.space {
                 Space::ClientGpu=>Buffer::at_prot(dev,uat.kernel_vm(),Some((vm,a.address)),None,
                     a.size,prot::PROT_GPU_FW_SHARED_RW,prot::Prot::from_pte(a.access.pte()))?,
diff --git a/drivers/gpu/drm/asahi/m3/m3_pass_layout.rs b/drivers/gpu/drm/asahi/m3/m3_pass_layout.rs
index 5ace477a44fff..f88a2a2c9b4a5 100644
--- a/drivers/gpu/drm/asahi/m3/m3_pass_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_pass_layout.rs
@@ -219,3 +219,39 @@ mod tests {
         }
     }
 }
+
+pub(crate) fn allocation_for(profile: super::m3_profile::Profile, slot:usize, field:Field, clusters:u32)
+    -> Result<Allocation,Error> {
+    let mut owner = board_allocation(slot,field,clusters)?;
+    if profile == super::m3_profile::Profile::Legacy { return Ok(owner); }
+    if owner.space == Space::Firmware {
+        owner.address = 0xffff_fc25_0000_0000 + (slot * COUNT + field as usize) as u64 * 0x10_0000;
+    }
+    match field {
+        Field::Scene => owner.size = 0x400,
+        Field::TilerCommand | Field::FragmentCommand => {
+            let fragment = field == Field::FragmentCommand;
+            owner.size = if fragment {0xca0} else {0x940};
+            owner.gpu_alias = Some(0x72_1000_0000 + slot as u64 * 0x4_0000
+                + u64::from(fragment) * 0x4000);
+        }
+        Field::TilerToFragment | Field::TilerDependency | Field::FragmentDependency => owner.size = 0x40,
+        _ => {}
+    }
+    Ok(owner)
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test] fn extended_command_aliases_keep_whole_disjoint_pages() {
+        for slot in 0..SLOTS {
+            for field in [Field::TilerCommand,Field::FragmentCommand] {
+                let owner = allocation_for(super::super::m3_profile::Profile::Extended,slot,field,1).unwrap();
+                assert_eq!(owner.address & 0x3fff,0);
+                assert_eq!(owner.gpu_alias.unwrap() & 0x3fff,0);
+                assert!(owner.size <= 0x4000);
+            }
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_profile.rs b/drivers/gpu/drm/asahi/m3/m3_profile.rs
index 004ac2c7d1eef..04b872ed9ea80 100644
--- a/drivers/gpu/drm/asahi/m3/m3_profile.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_profile.rs
@@ -32,6 +32,15 @@ impl Profile {
         }
     }
 
+    /// Keep the diagnostic AP/GPU timeline in its established 24 MHz units.
+    /// User timestamps and duration calculations retain native firmware units.
+    pub(crate) const fn profiler_ticks(self, timestamp: u64) -> u64 {
+        match self {
+            Self::Legacy => timestamp,
+            Self::Extended => (timestamp / 1000) * 24 + (timestamp % 1000) * 24 / 1000,
+        }
+    }
+
     pub(crate) fn gpu_duration_ns(self, elapsed: u64) -> Option<u64> {
         match self {
             Self::Legacy => elapsed.checked_mul(1000).map(|value| value / 24),
@@ -49,6 +58,18 @@ impl Profile {
 mod tests {
     use super::*;
 
+    #[test]
+    fn profiling_uses_one_clock_domain_without_changing_native_durations() {
+        for value in [0, 1, 999, 1000, 24_000_000, u64::MAX] {
+            assert_eq!(Profile::Legacy.profiler_ticks(value), value);
+            assert_eq!(
+                Profile::Extended.profiler_ticks(value),
+                ((value as u128) * 24 / 1000) as u64
+            );
+        }
+        assert_eq!(Profile::Extended.profiler_ticks(1_000_000_000), 24_000_000);
+    }
+
     #[test]
     fn profile_acknowledgement_is_exact_and_file_query_covers_hal() {
         for profile in [Profile::Legacy, Profile::Extended] {
diff --git a/drivers/gpu/drm/asahi/m3/m3_render.rs b/drivers/gpu/drm/asahi/m3/m3_render.rs
index e7a02982e96f1..9a9f63d15b784 100644
--- a/drivers/gpu/drm/asahi/m3/m3_render.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_render.rs
@@ -26,7 +26,7 @@ pub(crate) struct Render {
     passes:KVec<Pass>, init_bm:Buffer,
     // All active mappings above must drop before their ASID binding.
     _binding:mmu::VmBind,
-    stats: Region, sequence_bytes: KVec<u8>, tiler_bytes: KVec<u8>, fragment_bytes: KVec<u8>,
+    stats: [Region;2], profile:super::m3_profile::Profile, sequence_bytes: KVec<u8>, tiler_bytes: KVec<u8>, fragment_bytes: KVec<u8>,
     last_progress_ns:i64,
     draw:u64, heads:[u16;2], cached_views:KVec<CachedViews>,
     slot:usize, batch_count:usize, early_count:u32,
@@ -67,37 +67,45 @@ const RENDER_QUEUES: [QueueObjects; 2] = [
         scratch: s::FRAGMENT_SCRATCH, tiler: false, uuid: 0x3d0000 },
 ];
 impl Render {
-    pub(crate) fn new(dev:&driver::AsahiDrmDevice,uat:&mmu::Uat,vm:&mmu::Vm,stats:Region,clusters:u32,
-        registers:crate::m3::m3_compute_layout::RegisterSet)->Result<Self> {
+    pub(crate) fn new(dev:&driver::AsahiDrmDevice,uat:&mmu::Uat,vm:&mmu::Vm,stats:[Region;2],clusters:u32,
+        registers:crate::m3::m3_compute_layout::RegisterSet,profile:super::m3_profile::Profile)->Result<Self> {
         let lower_tlbi=crate::m3::m3_memory::LowerTlbi;
         let binding=uat.bind(vm)?;
         let mut objects=KVec::new();let mut aliases=KVec::new();
         for index in 0..s::COUNT {
-            let a=s::allocation(index).map_err(|_|EINVAL)?;
+            let a=s::allocation_for(profile,index).map_err(|_|EINVAL)?;
             let protection=prot::Prot::from_pte(a.access.pte());
             let b=match a.space {
                 Space::ClientGpu=>Buffer::at_prot(dev,uat.kernel_vm(),Some((vm,a.address)),None,
                     a.size,prot::PROT_GPU_FW_SHARED_RW,protection)?,
-                Space::Firmware=>Buffer::at_prot(dev,uat.kernel_vm(),None,Some(a.address),
+                Space::Firmware=>Buffer::at_prot(dev,uat.kernel_vm(),
+                    a.gpu_alias.map(|address|(uat.kernel_lower_vm(),address)),Some(a.address),
                     a.size,protection,prot::PROT_GPU_SHARED_RW)?,
             };
+            let mut b=b;
+            if a.gpu_alias.is_some() { aliases.push(b.map_gpu_view(vm)?,GFP_KERNEL)?; }
             objects.push(b,GFP_KERNEL)?;
         }
         // InitBM is shared, not part of a pass. Preserve its qualified mapping.
-        let init_bm=Buffer::at_prot(dev,uat.kernel_vm(),None,Some(0xfffffc200062bfe0),
+        let init_bm=Buffer::at_prot(dev,uat.kernel_vm(),None,Some(if profile==super::m3_profile::Profile::Extended {0xffff_fc24_4000_0000}
+                else {0xfffffc200062bfe0}),
             sync::INIT_BM_SIZE,prot::PROT_FW_SHARED_RW,prot::PROT_GPU_SHARED_RW)?;
         let mut passes=KVec::with_capacity(pass_layout::SLOTS,GFP_KERNEL)?;
-        for slot in 0..pass_layout::SLOTS {passes.push(Pass::new(dev,uat,vm,slot,clusters,&mut aliases)?,GFP_KERNEL)?;}
+        for slot in 0..pass_layout::SLOTS {passes.push(Pass::new(dev,uat,vm,slot,clusters,profile,&mut aliases)?,GFP_KERNEL)?;}
         let mut sequence_bytes=KVec::new();
         sequence_bytes.resize(sequence::STORAGE,0u8,GFP_KERNEL)?;
         let mut tiler_bytes=KVec::new();
-        tiler_bytes.resize(tiler::SIZE,0u8,GFP_KERNEL)?;
+        tiler_bytes.resize(if profile==super::m3_profile::Profile::Extended {tiler::EXTENDED_SIZE} else {tiler::SIZE},0u8,GFP_KERNEL)?;
         let mut fragment_bytes=KVec::new();
-        fragment_bytes.resize(fragment::SIZE,0u8,GFP_KERNEL)?;
-        let mut job=Self{passes,init_bm,stats,sequence_bytes,tiler_bytes,fragment_bytes,objects,_aliases:aliases,_binding:binding,last_progress_ns:0,draw:0,heads:[0;2],cached_views:KVec::new(),slot:0,batch_count:0,early_count:0,stage_timestamps:[true;2],base:0,checkpoint:(0,[0;2],0,0,0,0),clusters,registers,_lower_tlbi:lower_tlbi};
+        fragment_bytes.resize(if profile==super::m3_profile::Profile::Extended {fragment::EXTENDED_SIZE} else {fragment::SIZE},0u8,GFP_KERNEL)?;
+        let mut job=Self{passes,init_bm,stats,profile,sequence_bytes,tiler_bytes,fragment_bytes,objects,_aliases:aliases,_binding:binding,last_progress_ns:0,draw:0,heads:[0;2],cached_views:KVec::new(),slot:0,batch_count:0,early_count:0,stage_timestamps:[true;2],base:0,checkpoint:(0,[0;2],0,0,0,0),clusters,registers,_lower_tlbi:lower_tlbi};
         // Lists and the matching manager are built before InitBM publication.
         job.initialize_parameter_buffer()?;
-        for pool in &UMA_POOLS { pool.initialize(&mut job.objects)?; }
+        for (index,pool) in UMA_POOLS.iter().enumerate() {
+            if profile==super::m3_profile::Profile::Extended {
+                pool.initialize_extended(&mut job.objects,33+index as u8,false)?;
+            } else {pool.initialize(&mut job.objects)?;}
+        }
         job.initialize_state()?;
         job.initialize_queues()?;
         dev_info!(dev.as_ref(),"M3 native render storage initialized, PB={} MiB\n",PB_BLOCKS as usize*PB_BLOCK_SIZE/(1024*1024));
@@ -113,8 +121,14 @@ impl Render {
         let control = queue::FirmwareVa::new(self.objects[BLOCK_CONTROL].va()).map_err(|_| EINVAL)?;
         let counter = queue::FirmwareVa::new(self.objects[s::BM_COUNTER].va()).map_err(|_| EINVAL)?;
         let manager = parameter::Manager::new(pages, blocks, control, counter, PB_BLOCKS).map_err(|_| EINVAL)?;
-        let mut bytes = [0; parameter::MANAGER_SIZE];
-        manager.encode(&mut bytes).map_err(|_| EINVAL)?;
+        let extended=self.profile==super::m3_profile::Profile::Extended;
+        let mut bytes = [0; parameter::Manager::EXTENDED_SIZE];
+        let length=if extended {
+            manager.encode_extended(queue::FirmwareVa::new(self.objects[PARAMETER_PAGE_LIST].va()).map_err(|_|EINVAL)?,
+                queue::FirmwareVa::new(self.objects[PARAMETER_BLOCK_LIST].va()).map_err(|_|EINVAL)?,0,&mut bytes)
+                .map_err(|_|EINVAL)?;
+            parameter::Manager::EXTENDED_SIZE
+        } else {manager.encode(&mut bytes).map_err(|_|EINVAL)?;parameter::MANAGER_SIZE};
         for group in 0..PB_GROUPS {
             let buffer = &self.objects[PB_FIRST + group];
             let backing = parameter::Backing::new(GpuRegion::new(buffer.gpu_va()?, buffer.size()).map_err(|_| EINVAL)?)
@@ -128,18 +142,30 @@ impl Render {
                     backing.page(page).map_err(|_| EINVAL)?)?;
             }
         }
-        self.objects[BUFFER_MANAGER].write(0, &bytes)
+        self.objects[BUFFER_MANAGER].write(0, &bytes[..length])
     }
     fn initialize_state(&mut self) -> Result {
         let address = |owner: usize| queue::FirmwareVa::new(self.objects[owner].va()).map_err(|_| EINVAL);
         let notification = state::Notifier { threshold: address(s::EVENT_COUNT)?, context: self._binding.slot() };
         let list_owner = address(JOB_LIST)?;
         let mut context = [0; state::CONTEXT_SIZE];
-        state::context(&mut context).map_err(|_| EINVAL)?;
-        self.objects[GPU_CONTEXT].write(0, &context)?;
-        let mut notifier = [0; state::NOTIFIER_SIZE];
-        notification.encode(&mut notifier).map_err(|_| EINVAL)?;
-        self.objects[NOTIFIER].write(0, &notifier)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            state::context_extended(&mut context).map_err(|_|EINVAL)?;
+            self.objects[GPU_CONTEXT].write(0,&context[..state::EXTENDED_CONTEXT_SIZE])?;
+            for engine in 0..2 {
+                let value=state::Notifier {threshold:queue::FirmwareVa::new(self.objects[s::EVENT_COUNT].va()+engine as u64*8).map_err(|_|EINVAL)?,
+                    context:self._binding.slot()};
+                let mut notifier=[0;state::EXTENDED_NOTIFIER_SIZE];
+                value.encode_extended(&mut notifier).map_err(|_|EINVAL)?;
+                self.objects[NOTIFIER].write(engine*state::EXTENDED_NOTIFIER_SIZE,&notifier)?;
+            }
+        } else {
+            state::context(&mut context).map_err(|_| EINVAL)?;
+            self.objects[GPU_CONTEXT].write(0, &context)?;
+            let mut notifier = [0; state::NOTIFIER_SIZE];
+            notification.encode(&mut notifier).map_err(|_| EINVAL)?;
+            self.objects[NOTIFIER].write(0, &notifier)?;
+        }
         let mut list = [0; state::JOB_LIST_SIZE];
         state::job_list(&mut list, list_owner).map_err(|_| EINVAL)?;
         self.objects[JOB_LIST].write(0, &list)?;
@@ -157,6 +183,10 @@ impl Render {
             state::counter(bytes, value).map_err(|_| EINVAL)?;
             self.objects[owner].write(0, bytes)?;
         }
+        if self.profile==super::m3_profile::Profile::Extended {
+            self.objects[s::EVENT_COUNT].fill(0)?;
+            self.objects[s::BM_COUNTER].fill(0)?;
+        }
         Ok(())
     }
     fn initialize_queues(&mut self) -> Result {
@@ -172,8 +202,13 @@ impl Render {
             }else{[self.passes[0].get(P::TilerToFragment).va(),self.passes[0].get(P::FragmentCommand).va()]};
             let seeds=[queue::FirmwareVa::new(seed_addresses[0]).map_err(|_|EINVAL)?,
                 queue::FirmwareVa::new(seed_addresses[1]).map_err(|_|EINVAL)?];
-            let mut bytes = [0; queue::INFO_SIZE];
-            info.encode(&mut bytes).map_err(|_| EINVAL)?;
+            let mut bytes=KVec::new();
+            bytes.resize(if self.profile==super::m3_profile::Profile::Extended {
+                queue::QueueInfo::EXTENDED_SIZE
+            } else {queue::INFO_SIZE},0u8,GFP_KERNEL)?;
+            if self.profile==super::m3_profile::Profile::Extended {
+                info.encode_extended(address(owner.info)?,&mut bytes).map_err(|_|EINVAL)?;
+            } else {info.encode(&mut bytes).map_err(|_|EINVAL)?;}
             self.objects[owner.info].write(0, &bytes)?;
             let mut state = [0; queue::STATE_SIZE];
             queue::RingState { capacity: queue::QUALIFIED_CAPACITY, done: 0, read: 0, write: 0 }
@@ -187,9 +222,12 @@ impl Render {
         Ok(())
     }
     fn write_barrier(&mut self, owner: P, command: sync::Barrier) -> Result {
-        let mut bytes = [0; sync::BARRIER_SIZE];
-        command.encode(&mut bytes).map_err(|_| EINVAL)?;
-        self.passes[self.slot].get_mut(owner).write(0, &bytes)
+        let mut bytes=[0;sync::Barrier::EXTENDED_SIZE];
+        let length=if self.profile==super::m3_profile::Profile::Extended {
+            command.encode_extended(&mut bytes).map_err(|_|EINVAL)?;
+            sync::Barrier::EXTENDED_SIZE
+        } else {command.encode(&mut bytes).map_err(|_|EINVAL)?;sync::BARRIER_SIZE};
+        self.passes[self.slot].get_mut(owner).write(0,&bytes[..length])
     }
     // Construct synchronization from the actual owners after resetting a pass,
     // before publishing its ring entries. InitBM is shared and dispatched only
@@ -201,9 +239,11 @@ impl Render {
         let ta_stamp = address(s::TA_FW_STAMP)?;
         let fs_stamp = address(s::FRAGMENT_FW_STAMP)?;
         let mut init = [0; sync::INIT_BM_SIZE];
-        sync::InitBufferManager { context: self._binding.slot(), slot: 0,
-            block_count: PB_BLOCKS, manager, stamp: timeline::stamp(s::STAMP_TA - 256, 1) }
-            .encode(&mut init).map_err(|_| EINVAL)?;
+        let value=sync::InitBufferManager { context: self._binding.slot(), slot: 0,
+            block_count: PB_BLOCKS, manager, stamp: timeline::stamp(s::STAMP_TA - 256, 1) };
+        if self.profile==super::m3_profile::Profile::Extended {
+            value.encode_extended(&mut init).map_err(|_|EINVAL)?;
+        } else {value.encode(&mut init).map_err(|_|EINVAL)?;}
         self.init_bm.write(0, &init)?;
         let ta_value = timeline::stamp(s::STAMP_TA - 256, draw);
         let fs_value = timeline::stamp(s::STAMP_FRAGMENT - 256, draw);
@@ -225,7 +265,7 @@ impl Render {
     }
     // Prepare each private command after its retired slot is reset. The
     // reusable host staging allocation is copied before the next slot is built.
-    fn prepare_tiler(&mut self,r:agx_uapi::UapiRenderCommand,draw:u64)->Result {
+    fn prepare_tiler(&mut self,r:agx_uapi::UapiRenderCommand,usc:u64,draw:u64)->Result {
         use crate::m3::m3_compute_layout::GpuVa;
         let pass=&self.passes[self.slot];
         let shared=|index:usize| queue::FirmwareVa::new(self.objects[index].va()).map_err(|_|EINVAL);
@@ -243,7 +283,7 @@ impl Render {
         let value=tiler::Command {
             context:self._binding.slot(),register_set:self.registers,
             notifier:shared(NOTIFIER)?,manager:shared(BUFFER_MANAGER)?,
-            scene:fw(P::Scene)?,empty:shared(547)?,gpu_alias:GpuVa::new(command.gpu_va()?).map_err(|_|EINVAL)?,
+            scene:fw(P::Scene)?,empty:if self.profile==super::m3_profile::Profile::Extended {queue::FirmwareVa::new(pass.get(P::Scene).va()+0x100).map_err(|_|EINVAL)?} else {shared(547)?},gpu_alias:GpuVa::new(command.gpu_va()?).map_err(|_|EINVAL)?,
             sequence:Region::new(seq.va(),seq.size()).map_err(|_|EINVAL)?,pool:shared(UMA_POOLS[0].manager)?,
             scratch:fw(P::TilerScratch)?,stamp:shared(s::TA_STAMP)?,fw_stamp:shared(s::TA_FW_STAMP)?,
             stamp_value:timeline::stamp(s::STAMP_TA - 256, draw),timestamps:[fw(P::TilerStart)?,fw(P::TilerEnd)?],
@@ -253,7 +293,12 @@ impl Render {
             vdm:crate::m3::agx_render_state::compact(r.vdm_base).map_err(|_|EINVAL)?,
             multisample:r.multisample_control,ppp:r.ppp_control,process_empty_tiles:r.flags&2!=0,
         };
-        value.encode(&mut self.tiler_bytes).map_err(|_|EINVAL)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            value.encode_extended(tiler::Dispatch26 {incarnation:self._binding.generation(),serial:draw.checked_mul(2).ok_or(EOVERFLOW)?,
+                peer_stamp:timeline::stamp(s::STAMP_FRAGMENT-256,draw),usc_window:usc,
+                firmware_aux:queue::FirmwareVa::new(self.objects[UMA_POOLS[0].manager].va()+0x100).map_err(|_|EINVAL)?,
+                scene_scratch:gpu(P::FragmentScratch)?},&mut self.tiler_bytes).map_err(|_|EINVAL)?;
+        } else {value.encode(&mut self.tiler_bytes).map_err(|_|EINVAL)?;}
         self.passes[self.slot].get_mut(P::TilerCommand).write(0,&self.tiler_bytes)
     }
     fn prepare_sequences(&mut self,draw:u64)->Result {
@@ -266,14 +311,21 @@ impl Render {
             let notifier=&self.objects[NOTIFIER];
             let owners=sequence::Owners {
                 command:region(if fs{P::FragmentCommand}else{P::TilerCommand})?,sequence:region(target)?,
-                stats:self.stats,notifier:Region::new(notifier.va(),notifier.size()).map_err(|_|EINVAL)?,
+                stats:self.stats[usize::from(fs)],notifier:Region::new(notifier.va()+
+                    if fs && self.profile==super::m3_profile::Profile::Extended {0x200} else {0},
+                    if self.profile==super::m3_profile::Profile::Extended {0x200} else {notifier.size()}).map_err(|_|EINVAL)?,
                 queue:shared(if fs{s::FRAGMENT_QUEUE}else{s::TA_QUEUE})?,scene:fw(P::Scene)?,
                 manager:shared(BUFFER_MANAGER)?,pool:shared(UMA_POOLS[usize::from(fs)].manager)?,
                 fw_stamp:shared(if fs{s::FRAGMENT_FW_STAMP}else{s::TA_FW_STAMP})?,
                 context:self._binding.slot(),stamp:timeline::stamp((if fs{s::STAMP_FRAGMENT}else{s::STAMP_TA}) - 256, draw),
             };
             let timed=self.stage_timestamps[usize::from(fs)];
-            let length=if fs {
+            let length=if self.profile==super::m3_profile::Profile::Extended {
+                let pool=&self.objects[UMA_POOLS[usize::from(fs)].manager];
+                let auxiliary=super::m3_compute_layout::GpuVa::new(pool.gpu_va()?+if fs{0x200}else{0x100}).map_err(|_|EINVAL)?;
+                let serial=draw.checked_mul(2).and_then(|v|v.checked_sub(u64::from(fs))).ok_or(EOVERFLOW)?;
+                owners.encode_extended(fs,auxiliary,serial,&mut self.sequence_bytes).map_err(|_|EINVAL)?
+            } else if fs {
                 let b=pass.get(P::FragmentScratch);
                 let scratch=GpuRegion::new(b.gpu_va()?,b.size()).map_err(|_|EINVAL)?;
                 sequence::Fragment{owners,scratch,queue_command_count:timeline::previous(draw)}.encode_timestamps(&mut self.sequence_bytes,timed).map_err(|_|EINVAL)?
@@ -290,6 +342,9 @@ impl Render {
     fn patch_context(&mut self)->Result {
         let context=self._binding.slot();
         self.objects[NOTIFIER].u32(state::NOTIFIER_CONTEXT, context)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            self.objects[NOTIFIER].u32(0x200+state::NOTIFIER_CONTEXT,context)?;
+        }
         Ok(())
     }
     /// Pass geometry; TPC storage is per tiler accelerator, one per GPU cluster.
@@ -320,7 +375,8 @@ impl Render {
         let value=fragment::Command {
             context:self._binding.slot(),register_set:self.registers,
             sequence:Region::new(seq.va(),seq.size()).map_err(|_|EINVAL)?,
-            notifier:shared(NOTIFIER)?,manager:shared(BUFFER_MANAGER)?,scene:fw(P::Scene)?,empty:shared(547)?,
+            notifier:queue::FirmwareVa::new(self.objects[NOTIFIER].va()+
+                if self.profile==super::m3_profile::Profile::Extended {0x200} else {0}).map_err(|_|EINVAL)?,manager:shared(BUFFER_MANAGER)?,scene:fw(P::Scene)?,empty:if self.profile==super::m3_profile::Profile::Extended {queue::FirmwareVa::new(pass.get(P::Scene).va()+0x100).map_err(|_|EINVAL)?} else {shared(547)?},
             gpu_alias:GpuVa::new(command.gpu_va()?).map_err(|_|EINVAL)?,tilemap:gpu(P::Tilemap)?,
             heap:gpu(P::HeapMetadata)?,auxiliary:gpu(P::Auxiliary)?,scene_user:gpu(P::SceneUser)?,
             scratch:gpu(P::FragmentScratch)?,pool:shared(UMA_POOLS[1].manager)?,stamp:shared(s::FRAGMENT_STAMP)?,
@@ -341,15 +397,34 @@ impl Render {
                 stencil_clear:r.stencil_clear,sample_size:u32::from(r.sample_size),process_empty_tiles:r.flags&2!=0,
             },
         };
-        value.encode(&mut self.fragment_bytes).map_err(|_|EINVAL)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            value.encode_extended(tiler::Dispatch26 {incarnation:self._binding.generation(),serial:draw.checked_mul(2).and_then(|v|v.checked_sub(1)).ok_or(EOVERFLOW)?,
+                peer_stamp:0,usc_window:usc,
+                firmware_aux:queue::FirmwareVa::new(self.objects[UMA_POOLS[1].manager].va()+0x200).map_err(|_|EINVAL)?,
+                scene_scratch:gpu(P::FragmentScratch)?},&mut self.fragment_bytes).map_err(|_|EINVAL)?;
+        } else {value.encode(&mut self.fragment_bytes).map_err(|_|EINVAL)?;}
         self.passes[self.slot].get_mut(P::FragmentCommand).write(0,&self.fragment_bytes)
     }
+    pub(crate) fn set_attachments(&mut self,attachments:&[crate::m3::agx_attachments::Attachments;2])->Result {
+        // Preserve the legacy renderer's existing packet format. The native
+        // interface consumes separate attachment apertures for both stages.
+        if self.profile!=super::m3_profile::Profile::Extended {return Ok(());}
+        for (fragment,list) in attachments.iter().enumerate() {
+            let field=if fragment==0 {P::TilerSequence}else{P::FragmentSequence};
+            let buffer=self.passes[self.slot].get_mut(field);
+            sequence::patch_extended_attachments(fragment!=0,list,|offset,data|buffer.write(offset,data))?;
+        }
+        crate::m3::agx_memory::publish();Ok(())
+    }
     pub(crate) fn set_user_timestamps(&mut self,addresses:[[u64;2];2])->Result {
         if addresses.iter().enumerate().any(|(stage,pair)|*pair!=[0;2] && !self.stage_timestamps[stage]) {return Err(EINVAL);}
         for (stage,(command,sequence,offset,start,end)) in [
             (P::TilerCommand,P::TilerSequence,sequence::ta::USER_PAIR,sequence::ta::TIMESTAMP_START,sequence::ta::TIMESTAMP_END),
             (P::FragmentCommand,P::FragmentSequence,sequence::fragment::USER_PAIR,sequence::fragment::TIMESTAMP_START,sequence::fragment::TIMESTAMP_END)
         ].into_iter().enumerate() {
+            let (offset,start,end)=if self.profile==super::m3_profile::Profile::Extended {
+                if stage==0 {(0x8d8,0x1cc,0x21c)} else {(0xc20,0x1e4,0x234)}
+            } else {(offset,start,end)};
             let pair=addresses[stage];
             if !self.stage_timestamps[stage] {continue;}
             self.passes[self.slot].get_mut(command).u64(offset,pair[0])?;
@@ -365,19 +440,19 @@ impl Render {
     pub(crate) fn gpu_ns(&mut self,base:usize,count:usize)->Result<u64> {
         let start=self.passes[base].get_mut(P::TilerStart).read_u64(0)?;
         let end=self.passes[Self::at(base,count-1)].get_mut(P::FragmentEnd).read_u64(0)?;
-        Ok(if start!=0 && end>=start {(end-start)*1000/24} else {0})
+        self.profile.gpu_duration_ns(if start!=0 && end>=start {end-start} else {0}).ok_or(EOVERFLOW)
     }
     /// The batch's first tiler start and last fragment end, in 24 MHz GPU timestamp ticks.
     pub(crate) fn gpu_ticks(&mut self,base:usize,count:usize)->Result<(u64,u64)> {
-        Ok((self.passes[base].get_mut(P::TilerStart).read_u64(0)?,
-            self.passes[Self::at(base,count-1)].get_mut(P::FragmentEnd).read_u64(0)?))
+        Ok((self.profile.profiler_ticks(self.passes[base].get_mut(P::TilerStart).read_u64(0)?),
+            self.profile.profiler_ticks(self.passes[Self::at(base,count-1)].get_mut(P::FragmentEnd).read_u64(0)?)))
     }
     /// Read retained timestamps only after exact batch retirement. The first
     /// TA and final fragment delimit the batch in the shared 24 MHz counter.
     pub(crate) fn batch_gpu_span(&mut self)->Result<[u64;2]> {
         if self.batch_count == 0 {return Err(EINVAL);}
-        Ok([self.passes[self.base].get_mut(P::TilerStart).read_u64(0)?,
-            self.passes[Self::at(self.base,self.batch_count-1)].get_mut(P::FragmentEnd).read_u64(0)?])
+        let (start,end)=self.gpu_ticks(self.base,self.batch_count)?;
+        Ok([start,end])
     }
     pub(crate) fn stage_ns(&mut self,base:usize,count:usize)->Result<[u64;3]> {
         let mut total=[0;3];
@@ -390,7 +465,7 @@ impl Render {
     pub(crate) fn slot_stage_ns(&mut self,base:usize,count:usize,index:usize)->Result<[u64;3]> {
         if index>=count {return Err(EINVAL);}
         let slot=Self::at(base,index);
-        let duration=|a:u64,b:u64| if a!=0 && b>=a {(b-a)*1000/24} else {0};
+        let duration=|a:u64,b:u64| self.profile.gpu_duration_ns(if a!=0 && b>=a {b-a} else {0}).unwrap_or(0);
         let fs_start=self.passes[slot].get_mut(P::FragmentStart).read_u64(0)?;
         let fs_end=self.passes[slot].get_mut(P::FragmentEnd).read_u64(0)?;
         let ta_start=self.passes[slot].get_mut(P::TilerStart).read_u64(0)?;
@@ -415,7 +490,9 @@ impl Render {
     }
     /// Whether any draw has been published (the first one initializes the buffer manager).
     pub(crate) fn started(&self)->bool {self.draw>0}
-    pub(crate) fn first(&self)->bool {self.draw==self.batch_count as u64}
+    pub(crate) fn first(&self)->bool {
+        self.profile==super::m3_profile::Profile::Legacy && self.draw==self.batch_count as u64
+    }
     /// Start a batch in pass slots `base..`. With `overlap`, earlier batches may still run: then
     /// the VM must already be bound, no storage may grow and the slots must not be in flight
     /// (the caller keeps the in-flight passes plus this batch within SLOTS).
@@ -447,13 +524,15 @@ impl Render {
                 let binding=uat.bind(vm)?;
                 let mut views=KVec::new();let mut aliases=KVec::new();
                 for i in 0..s::COUNT {
-                    if s::allocation(i).map_err(|_|EINVAL)?.space==Space::ClientGpu {
+                    let a=s::allocation_for(self.profile,i).map_err(|_|EINVAL)?;
+                    if a.gpu_alias.is_some() {aliases.push(self.objects[i].map_gpu_view(vm)?,GFP_KERNEL)?;}
+                    if a.space==Space::ClientGpu {
                         views.push((ViewOwner::Shared(i),self.objects[i].map_gpu_view(vm)?),GFP_KERNEL)?;
                     }
                 }
                 for (slot,pass) in self.passes.iter_mut().enumerate() {
                     for field in pass_layout::FIELDS {
-                        let a=pass_layout::board_allocation(slot,field,self.clusters).map_err(|_|EINVAL)?;
+                        let a=pass_layout::allocation_for(self.profile,slot,field,self.clusters).map_err(|_|EINVAL)?;
                         if a.space==Space::ClientGpu {views.push((ViewOwner::Pass{slot,field},pass.get_mut(field).map_gpu_view(vm)?),GFP_KERNEL)?;}
                         if a.gpu_alias.is_some() {aliases.push(pass.get_mut(field).map_gpu_view(vm)?,GFP_KERNEL)?;}
                     }
@@ -498,12 +577,22 @@ impl Render {
         self.base=base;
         Ok(())
     }
+    fn publish_counts(&mut self, draw:u64) -> Result {
+        if self.profile==super::m3_profile::Profile::Extended {
+            for offset in [0,8] {self.objects[s::EVENT_COUNT].u64(offset,draw)?;}
+            for counter in [TA_POOL_COUNTER,FRAGMENT_POOL_COUNTER] {self.objects[counter].u64(0,draw)?;}
+        } else {
+            self.objects[s::BM_COUNTER].u32(0,draw as u32)?;
+            self.objects[s::EVENT_COUNT].u32(0,timeline::events(draw,2))?;
+        }
+        Ok(())
+    }
+
     /// Restore producer state only when no batch is in flight. Running firmware can
     /// consume append's WRITE updates without a new doorbell, so overlap cannot abort.
     pub(crate) fn abort_batch(&mut self)->Result {
         (self.draw,self.heads,self.batch_count,self.slot,self.early_count,self.base)=self.checkpoint;
-        self.objects[s::BM_COUNTER].u32(0,self.draw as u32)?;
-        self.objects[s::EVENT_COUNT].u32(0,timeline::events(self.draw,2))?;
+        self.publish_counts(self.draw)?;
         for (stage,pointers) in [s::TA_POINTERS,s::FRAGMENT_POINTERS].into_iter().enumerate() {
             self.objects[pointers].u32(queue::WRITE,u32::from(self.heads[stage]))?;
         }
@@ -547,8 +636,20 @@ impl Render {
         self.draw=self.draw.checked_add(1).ok_or(EOVERFLOW)?;
         self.batch_count+=1;
         let draw=self.draw;
-        self.objects[s::BM_COUNTER].u32(0,draw as u32)?;
-        self.objects[s::EVENT_COUNT].u32(0,timeline::events(draw,2))?;
+        self.publish_counts(draw)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            let pass=&self.passes[self.slot];
+            let scratch=pass.get(P::FragmentScratch);
+            let scratch_gpu=GpuRegion::new(scratch.gpu_va()?,scratch.size()).map_err(|_|EINVAL)?;
+            let scratch_fw=queue::FirmwareVa::new(scratch.va()).map_err(|_|EINVAL)?;
+            let list=pass.get(P::SceneUser);
+            let list=GpuRegion::new(list.gpu_va()?,list.size()).map_err(|_|EINVAL)?;
+            let metadata=pass.get(P::Scene);
+            let owner=Region::new(metadata.va(),metadata.size()).map_err(|_|EINVAL)?;
+            let mut bytes=[0;scene::EXTENDED_SIZE];
+            scene::encode_extended(&mut bytes,owner,scratch_gpu,scratch_fw,list).map_err(|_|EINVAL)?;
+            self.passes[self.slot].get_mut(P::Scene).write(0,&bytes)?;
+        } else {
         let entry_offset = (self.draw % u64::from(MANAGER_SCENE_COUNT)) as usize * 4;
         let scene_list = &mut self.objects[s::BM_SCENES];
         if entry_offset + 4 > scene_list.size() { return Err(ERANGE); }
@@ -560,7 +661,8 @@ impl Render {
         let mut bytes = [0; scene::SIZE];
         scene::Scene { manager_entry, manager_misc, user_buffer }.encode(&mut bytes).map_err(|_| EINVAL)?;
         self.passes[self.slot].get_mut(P::Scene).write(0, &bytes)?;
-        self.prepare_tiler(r,draw)?;
+        }
+        self.prepare_tiler(r,usc,draw)?;
         self.patch_context()?;
         self.prepare_fragment(r,usc,draw)?;
         self.prepare_sequences(draw)?;
@@ -655,7 +757,13 @@ impl Render {
             if self.objects[stamp].read_u32(0)?!=value || self.objects[fw].read_u32(0)?!=value
                 || self.objects[pointers].read_u32(queue::DONE)?!=u32::from(head)
                 || self.objects[pointers].read_u32(queue::READ)?!=u32::from(head) {return Ok(false);}
-        } Ok(true)
+        }
+        if self.profile==super::m3_profile::Profile::Extended && self.draw!=0 {
+            for pool in UMA_POOLS {
+                if self.objects[pool.manager].read_u64(0x54)?!=self.draw {return Ok(false);}
+            }
+        }
+        Ok(true)
     }
     pub(crate) fn log(&mut self,dev:&driver::AsahiDrmDevice)->Result {
         // Retain allocator state as well as payloads: an exhausted parameter
diff --git a/drivers/gpu/drm/asahi/m3/m3_render_sequence.rs b/drivers/gpu/drm/asahi/m3/m3_render_sequence.rs
index f9a0483e77b21..3d421e9906692 100644
--- a/drivers/gpu/drm/asahi/m3/m3_render_sequence.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_render_sequence.rs
@@ -184,3 +184,171 @@ impl Fragment {
         Ok(if timed {LENGTH} else {without_timestamps(bytes,TIMESTAMP_START,FINALIZE,LENGTH,0xa4)})
     }
 }
+
+impl Owners {
+    pub(crate) fn encode_extended(&self, fragment:bool,
+        auxiliary:super::m3_compute_layout::GpuVa, serial:u64, output:&mut[u8]) -> Result<usize,Error> {
+        if self.context>=64 || serial==0 || self.stamp==0 {return Err(Error::Address);}
+        let command=self.command.at(0,if fragment {0xca0}else{0x940})?;
+        let sequence=self.sequence.at(0,STORAGE)?;
+        let activity=self.stats.at(0,8)?;
+        let scene_tail=self.scene.get().checked_add(0x54).ok_or(Error::Address)?;
+        let (clock,pair,aux_time,elapsed)=if fragment {(0xc08,0xc10,0xc70,0xb84)}else{(0x8c0,0x8c8,0x928,0x83c)};
+        let first=if fragment {0x1e4}else{0x1cc};
+        let finalize=if fragment {0x280}else{0x268};
+        let pool=if fragment {0x1b0}else{0x190};
+        let length=if fragment {0x370}else{0x300};
+        let uuid=if fragment {fragment::UUID}else{ta::UUID};
+        let bytes=output.get_mut(..STORAGE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        word(bytes,0,if fragment {7}else{5});
+        pointer(bytes,0x14,command+if fragment {0x80}else{0x40});
+        pointer(bytes,pool,self.pool.get());
+        pointer(bytes,pool+0x18,auxiliary.get());
+        pointer(bytes,pool+0x28,serial);
+        word(bytes,pool+0x30,u32::from(fragment));
+        if fragment {
+            pointer(bytes,0x1c,self.scene.get());
+            pointer(bytes,0x24,activity);
+            pointer(bytes,0x2c,command+0xb70);
+            pointer(bytes,0x34,scene_tail);
+            pointer(bytes,0x3c,command+0xbb0);
+            pointer(bytes,0x44,command+0xbb4);
+            pointer(bytes,0x4c,self.queue.get());
+            pointer(bytes,0x54,command);
+            word(bytes,0x5c,self.context);
+            word(bytes,0x60,1);
+            pointer(bytes,0x7c,command+0xa58);
+            pointer(bytes,0x84,command+0xbf0);
+            word(bytes,0xa0,uuid);
+        } else {
+            pointer(bytes,0x1c,self.manager.get());
+            pointer(bytes,0x24,self.scene.get());
+            pointer(bytes,0x2c,activity);
+            pointer(bytes,0x34,self.queue.get());
+            pointer(bytes,0x3c,command+0x85c);
+            word(bytes,0x44,self.context);
+            word(bytes,0x48,1);
+            pointer(bytes,0x64,command+0x784);
+            pointer(bytes,0x6c,command+0x8a8);
+            word(bytes,0x7c,uuid);
+        }
+        for (at,opcode,selected) in [(first,0x8000_0003,pair),(first+0x50,3,pair+8)] {
+            word(bytes,at,opcode);
+            pointer(bytes,at+4,command+clock);
+            pointer(bytes,at+0xc,command+pair);
+            pointer(bytes,at+0x14,command+selected);
+            pointer(bytes,at+0x1c,self.queue.get());
+            pointer(bytes,at+0x2c,command+aux_time);
+            pointer(bytes,at+0x34,command+elapsed);
+            pointer(bytes,at+0x44,uuid.into());
+        }
+        word(bytes,first+0x4c,1);
+        word(bytes,finalize,if fragment {8}else{6});
+        if fragment {
+            word(bytes,finalize+4,uuid);
+            pointer(bytes,finalize+0xc,self.fw_stamp.get());
+            word(bytes,finalize+0x14,self.stamp);
+            pointer(bytes,finalize+0x1c,self.scene.get());
+            pointer(bytes,finalize+0x24,self.manager.get());
+            word(bytes,finalize+0x2c,1);
+            pointer(bytes,finalize+0x30,activity);
+            pointer(bytes,finalize+0x38,command+0xbb0);
+            pointer(bytes,finalize+0x40,command+0xbb4);
+            pointer(bytes,finalize+0x48,command+0xb70);
+            pointer(bytes,finalize+0x50,self.queue.get());
+            pointer(bytes,finalize+0x58,command);
+            word(bytes,finalize+0x60,self.context);
+            pointer(bytes,finalize+0x64,command+0xa58);
+            pointer(bytes,finalize+0x98,sequence+pool as u64);
+            word(bytes,finalize+0xa0,(-(finalize as i32))as u32);
+            pointer(bytes,finalize+0xa5,command+0xc60);
+            word(bytes,finalize+0xad,1);
+            bytes[finalize+0xb1]=1;
+            // J613 terminates this record after the 16-bit event field.
+            bytes[finalize+0xb2..finalize+0xb4].copy_from_slice(&1u16.to_le_bytes());
+            word(bytes,finalize+0xb4,0x4000_0002);
+        } else {
+            pointer(bytes,finalize+4,self.scene.get());
+            pointer(bytes,finalize+0xc,self.manager.get());
+            pointer(bytes,finalize+0x14,activity);
+            pointer(bytes,finalize+0x1c,self.queue.get());
+            pointer(bytes,finalize+0x24,command+0x85c);
+            word(bytes,finalize+0x2c,self.context);
+            pointer(bytes,finalize+0x34,command+0x784);
+            word(bytes,finalize+0x40,uuid);
+            pointer(bytes,finalize+0x48,self.fw_stamp.get());
+            word(bytes,finalize+0x50,self.stamp);
+            pointer(bytes,finalize+0x78,sequence+pool as u64);
+            word(bytes,finalize+0x80,(-(finalize as i32))as u32);
+            pointer(bytes,finalize+0x85,command+0x918);
+            bytes[finalize+0x8d]=1;
+            word(bytes,finalize+0x94,0x4000_0002);
+        }
+        Ok(length)
+    }
+}
+
+#[cfg(test)]
+mod native_tests {
+    use super::*;
+    #[test] fn j613_fragment_ends_before_the_m4_tail_and_keeps_relative_restart() {
+        let fw=|index:u64|FirmwareVa::new(0xffff_fc25_2000_0000+index*0x4000).unwrap();
+        let o=Owners {command:Region::new(fw(0).get(),0xca0).unwrap(),sequence:Region::new(fw(1).get(),STORAGE).unwrap(),
+            stats:Region::new(fw(2).get(),0x1000).unwrap(),notifier:Region::new(fw(3).get(),0x200).unwrap(),
+            queue:fw(4),scene:fw(5),manager:fw(6),pool:fw(7),fw_stamp:fw(8),context:3,stamp:0x3d000100};
+        let mut output=[0xa5;STORAGE+8];
+        let length=o.encode_extended(true,super::super::m3_compute_layout::GpuVa::new(0x72_3000_0200).unwrap(),1,&mut output).unwrap();
+        assert_eq!(length,0x370);
+        let word=|at|u32::from_le_bytes(output[at..at+4].try_into().unwrap());
+        assert_eq!(word(0x1e4),0x8000_0003);
+        assert_eq!(word(0x230),1);
+        assert_eq!(word(0x234),3);
+        assert_eq!(word(0x280),8);
+        assert_eq!(word(0x320),(-0x280i32)as u32);
+        assert_eq!(word(0x334),0x4000_0002);
+        assert_eq!(&output[STORAGE..],&[0xa5;8]);
+    }
+}
+
+/// Native start records reserve one packed attachment list per engine. The
+/// matching finalizer flag enables completion visibility for that same list.
+pub(crate) const fn extended_attachment_offsets(fragment:bool)->(usize,usize) {
+    if fragment {(0xa8,0x324)} else {(0x88,0x2ec)}
+}
+
+/// Send both pieces through the same bounded writer used for firmware storage.
+#[cfg(any(test, CONFIG_DRM_ASAHI_M3_T8122))]
+pub(crate) fn patch_extended_attachments<E>(fragment:bool,
+    attachments:&super::agx_attachments::Attachments,
+    mut write:impl FnMut(usize,&[u8])->Result<(),E>)->Result<(),E> {
+    let (start,flag)=extended_attachment_offsets(fragment);
+    write(start,&attachments.0)?;
+    write(flag,&[u8::from(attachments.count()!=0)])
+}
+
+#[cfg(test)]
+mod attachment_tests {
+    use super::*;
+    use super::super::agx_attachments::{Attachments,SIZE};
+    #[test] fn each_engine_keeps_its_list_and_can_clear_a_previous_list() {
+        for (fragment,start,flag,pool) in [(false,0x88,0x2ec,0x190),(true,0xa8,0x324,0x1b0)] {
+            let mut bytes=[0xa5;STORAGE];
+            let list=Attachments::new(&[(0x100_0040,0x180),(0x200_0000,0x4000)]).unwrap();
+            let mut apply=|list:&Attachments|patch_extended_attachments(fragment,list,|at,data|{
+                bytes.get_mut(at..at+data.len()).ok_or(Error::Size)?.copy_from_slice(data);Ok::<(),Error>(())
+            });
+            apply(&list).unwrap();
+            assert_eq!(&bytes[start..start+SIZE],&list.0);
+            assert_eq!(bytes[flag],1);
+            assert_eq!(&bytes[pool..pool+8],&[0xa5;8]);
+            patch_extended_attachments(fragment,&Attachments::EMPTY,|at,data|{
+                bytes[at..at+data.len()].copy_from_slice(data);Ok::<(),Error>(())
+            }).unwrap();
+            assert!(bytes[start..start+SIZE].iter().all(|b|*b==0));
+            assert_eq!(bytes[flag],0);
+            assert_eq!(bytes[start-1],0xa5);
+            assert_eq!(bytes[start+SIZE],0xa5);
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_runtime.rs b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
index 058c6610399ae..3b1f3d6d08535 100644
--- a/drivers/gpu/drm/asahi/m3/m3_runtime.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
@@ -390,7 +390,7 @@ impl Inner {
         if found.is_none() {
             let job=match control {
                 crate::m3::m3_submit::Command::Compute(c)=>NativeJob::Compute(crate::m3::m3_compute::Compute::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,c,self.device.soc().registers,self.device.firmware().profile()).map_err(early)?),
-                crate::m3::m3_submit::Command::Render{..}=>NativeJob::Render(crate::m3::m3_render::Render::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,self.device.soc().clusters,self.device.soc().registers).map_err(early)?),
+                crate::m3::m3_submit::Command::Render{..}=>NativeJob::Render(crate::m3::m3_render::Render::new(&self.drm,&self.uat,&packet.vm,self.config.render_stats().map_err(early)?,self.device.soc().clusters,self.device.soc().registers,self.device.firmware().profile()).map_err(early)?),
             };
             self.jobs.push(job,GFP_KERNEL).map_err(|_|early(ENOMEM))?;
         } else {
@@ -439,6 +439,7 @@ impl Inner {
                     let timed=timestamps.map(|pair|policy::stage_timestamps(internal_timestamps,chip,pair));
                     j.append(command,usc,coalesce,timed)?;
                     j.set_user_timestamps(timestamps)?;
+                    j.set_attachments(&p.render_attachments[*next])?;
                     coalesced_stamps+=u64::from(coalesce);
                 }
                 Ok(())
@@ -563,6 +564,7 @@ impl Inner {
                         let timed=timestamps.map(|pair|policy::stage_timestamps(internal_timestamps,self.device.soc().chip_id,pair));
                         j.append_after(command,usc,false,predecessor,timed)?;
                         j.set_user_timestamps(timestamps)?;
+                        j.set_attachments(&p.render_attachments[*i])?;
                         dependencies+=usize::from(predecessor.is_some());
                         previous=Some((true,j.completion_dependency()?));
                     },
diff --git a/drivers/gpu/drm/asahi/m3/m3_scene_layout.rs b/drivers/gpu/drm/asahi/m3/m3_scene_layout.rs
index 880cf4c2b9a75..ea3c2064ef39e 100644
--- a/drivers/gpu/drm/asahi/m3/m3_scene_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_scene_layout.rs
@@ -39,3 +39,43 @@ impl Scene {
         Ok(())
     }
 }
+
+pub(crate) const EXTENDED_SIZE: usize = 0x400;
+
+/// Encode a native scene header from its retained aliases. The local
+/// statistics and parameter scratch remain part of this same owned record.
+pub(crate) fn encode_extended(output: &mut [u8], owner: super::m3_init_layout::Region,
+    scratch_gpu: super::m3_pool_layout::GpuRegion, scratch_fw: FirmwareVa,
+    scene_list: super::m3_pool_layout::GpuRegion) -> Result<(), Error> {
+    let statistics = owner.at(0x200, 0x40).map_err(|_| Error::Size)?;
+    owner.at(0, EXTENDED_SIZE).map_err(|_| Error::Size)?;
+    if scratch_gpu.size() < 0x4000 || scene_list.size() < 0x4000 { return Err(Error::Size); }
+    let compact = super::agx_render_state::compact(scene_list.base()).map_err(|_| Error::Address)?;
+    let bytes = output.get_mut(..EXTENDED_SIZE).ok_or(Error::Size)?;
+    bytes.fill(0);
+    bytes[..8].copy_from_slice(&scratch_gpu.base().to_le_bytes());
+    bytes[8..16].copy_from_slice(&scratch_fw.get().to_le_bytes());
+    bytes[0x28..0x30].copy_from_slice(&compact.to_le_bytes());
+    bytes[0x40..0x48].copy_from_slice(&statistics.to_le_bytes());
+    Ok(())
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    use super::super::{m3_init_layout::Region, m3_pool_layout::GpuRegion};
+    #[test] fn native_scene_keeps_scratch_aliases_and_local_statistics_distinct() {
+        let owner = Region::new(0xffff_fc25_0010_0000, EXTENDED_SIZE).unwrap();
+        let scratch = GpuRegion::new(0x10_0200_0000, 0x4000).unwrap();
+        let scratch_fw = FirmwareVa::new(0xffff_fc25_0020_0000).unwrap();
+        let list = GpuRegion::new(0x10_0300_0000, 0x4000).unwrap();
+        let mut bytes = [0xa5; EXTENDED_SIZE + 8];
+        encode_extended(&mut bytes, owner, scratch, scratch_fw, list).unwrap();
+        let read = |at| u64::from_le_bytes(bytes[at..at + 8].try_into().unwrap());
+        assert_eq!(read(0), scratch.base());
+        assert_eq!(read(8), scratch_fw.get());
+        assert_eq!(read(0x28), 0x300_0000);
+        assert_eq!(read(0x40), owner.at(0x200, 0x40).unwrap());
+        assert_eq!(&bytes[EXTENDED_SIZE..], &[0xa5; 8]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_shared_layout.rs b/drivers/gpu/drm/asahi/m3/m3_shared_layout.rs
index 9b8d503836d0a..0a2262858556d 100644
--- a/drivers/gpu/drm/asahi/m3/m3_shared_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_shared_layout.rs
@@ -100,3 +100,29 @@ pub(crate) fn fault_buffers()->impl Iterator<Item=(usize,usize)> {
         .chain((PB_FIRST..PB_FIRST+PB_GROUPS).map(|i|(i,256)))
         .chain([(TILEMAP_LABEL,1280),(HEAP_METADATA_LABEL,256)])
 }
+
+pub(crate) fn allocation_for(profile: super::m3_profile::Profile, index: usize) -> Result<Allocation,Error> {
+    let mut owner = allocation(index)?;
+    if profile == super::m3_profile::Profile::Legacy { return Ok(owner); }
+    if owner.space == Space::Firmware {
+        owner.address = 0xffff_fc24_0000_0000 + index as u64 * 0x10_0000;
+    }
+    match index {
+        // Extended firmware reads the uncached kernel aliases supplied to
+        // encode_extended; these lower client mappings are GPU-only.
+        PARAMETER_PAGE_LIST | PARAMETER_BLOCK_LIST => owner.access = Access::GpuCachedRw,
+        8 | 20 => owner.size = 0x20000,
+        9 | 21 => { owner.address &= !0x3fff; owner.size = 0x4000; }
+        10 | 22 => {
+            owner.size = 0x4000;
+            owner.gpu_alias = Some(0x72_3000_0000 + u64::from(index == 22) * 0x4000);
+        }
+        GPU_CONTEXT => owner.size = 0x38,
+        NOTIFIER => owner.size = 0x400,
+        EVENT_COUNT => owner.size = 16,
+        BUFFER_MANAGER => owner.size = 0xc0,
+        FRAGMENT_QUEUE | TA_QUEUE => owner.size = 0x24c0,
+        _ => {}
+    }
+    Ok(owner)
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_submit.rs b/drivers/gpu/drm/asahi/m3/m3_submit.rs
index 2aac0dfad36ff..29d2bc7de5f68 100644
--- a/drivers/gpu/drm/asahi/m3/m3_submit.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_submit.rs
@@ -41,6 +41,7 @@ pub(crate) struct Packet {
     timestamps:KVec<[Option<Destination>;4]>,
     pub(crate) attachments:KVec<crate::m3::agx_attachments::Attachments>,
     pub(crate) wide_visibility:KVec<bool>,
+    pub(crate) render_attachments:KVec<[crate::m3::agx_attachments::Attachments;2]>,
     completion:UserFence<Completion>,
     finish_claimed: AtomicBool,
     /// Set before a batch with any of this packet's commands can change firmware-visible state,
@@ -196,7 +197,7 @@ impl queue::Queue for Queue {
     fn submit(&mut self,_reg_data:&crate::driver::AsahiRegData<'_>,_id:u64,mut syncs:KVec<file::SyncItem>,in_sync_count:usize,
         raw:&[u8],objects:Pin<&xarray::XArray<KBox<file::Object>>>)->Result {
         let vm_job=self.vm.retain_job()?;
-        let mut parser=agx_uapi::UapiCommandParser::new(raw);let mut commands=KVec::new();let mut timestamps=KVec::new();let mut flushes=KVec::new();let mut visibility=KVec::new();
+        let mut parser=agx_uapi::UapiCommandParser::new(raw);let mut commands=KVec::new();let mut timestamps=KVec::new();let mut flushes=KVec::new();let mut visibility=KVec::new();let mut render_attachments=KVec::new();
         while let Some(command)=parser.next_hardware().map_err(|_|EINVAL)? {
             if let agx_uapi::ParsedHardwareCommand::Render{payload,vertex_attachments,fragment_attachments,..}=command {
                 if let Err(e)=validate_render(payload,self.usc,&AddressSpace(&self.vm),self.early_tiling) {
@@ -211,6 +212,7 @@ impl queue::Queue for Queue {
                     Destination::resolve(objects,payload.fragment_timestamps.start)?,
                     Destination::resolve(objects,payload.fragment_timestamps.end)?],GFP_KERNEL)?;
                 flushes.push(crate::m3::agx_attachments::Attachments::EMPTY,GFP_KERNEL)?;
+                render_attachments.push([encode_attachments(&self.vm,&vertex_attachments)?,encode_attachments(&self.vm,&fragment_attachments)?],GFP_KERNEL)?;
                 visibility.push(false,GFP_KERNEL)?;
                 continue;
             }
@@ -226,6 +228,7 @@ impl queue::Queue for Queue {
             // The common translator validates the original command/attachment
             // addresses; this M3 scheduling hint changes none of them.
             payload.flags &= !wide;
+            render_attachments.push([crate::m3::agx_attachments::Attachments::EMPTY;2],GFP_KERNEL)?;
             flushes.push(encode_attachments(&self.vm,&attachments)?,GFP_KERNEL)?;
             let c=agx_uapi::translate_compute_command(payload,attachments,
                 agx_uapi::QueueUscWindow{base:self.usc,user_start:0x4000,user_end:(1u64<<42)-0x8000},
@@ -239,7 +242,7 @@ impl queue::Queue for Queue {
             commands.push(Command::Compute(crate::m3::agx_compute::Control{base:c.control_stream_base,end:c.control_stream_end,usc_base:self.usc}),GFP_KERNEL)?;
         }
         parser.finish().map_err(|_|EINVAL)?;
-        let packet=Arc::new(Packet{vm:self.vm.clone(),commands,timestamps,attachments:flushes,wide_visibility:visibility,
+        let packet=Arc::new(Packet{vm:self.vm.clone(),commands,timestamps,attachments:flushes,wide_visibility:visibility,render_attachments,
             completion:self.fences.new_fence(0,Completion)?.into(),
             finish_claimed:AtomicBool::new(false),published:AtomicBool::new(false),urgency:self.urgency,owner:Owner::current(),
             vm_job:KBox::pin_init(new_mutex!(Some(vm_job)),GFP_KERNEL)?},GFP_KERNEL)?;
diff --git a/drivers/gpu/drm/asahi/m3/m3_sync_layout.rs b/drivers/gpu/drm/asahi/m3/m3_sync_layout.rs
index 92d533efa8234..2cf5e18914043 100644
--- a/drivers/gpu/drm/asahi/m3/m3_sync_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_sync_layout.rs
@@ -91,3 +91,58 @@ impl Barrier {
         Ok(())
     }
 }
+
+impl InitBufferManager {
+    /// The extended rebuild path requires a zero staged-block count. Appending
+    /// already-staged blocks would leave a previous hardware descriptor live.
+    pub(crate) fn encode_extended(&self, output: &mut [u8]) -> Result<(), Error> {
+        if self.context >= 64 || self.slot >= 32 { return Err(Error::Address); }
+        Self { context: self.context, slot: self.slot, block_count: 0,
+            manager: self.manager, stamp: self.stamp }.encode(output)
+    }
+}
+
+impl Barrier {
+    pub(crate) const EXTENDED_SIZE: usize = 0x40;
+
+    pub(crate) fn encode_extended(&self, output: &mut [u8]) -> Result<(), Error> {
+        if self.event >= 128 || self.wait_value == 0 || self.self_value == 0 {
+            return Err(Error::Address);
+        }
+        let bytes = output.get_mut(..Self::EXTENDED_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        u32_at(bytes, 0, 4);
+        address_at(bytes, 4, self.stamp);
+        address_at(bytes, 12, self.stamp);
+        u32_at(bytes, 0x14, self.wait_value);
+        u32_at(bytes, 0x20, self.event);
+        u32_at(bytes, 0x24, self.self_value);
+        if matches!(self.dependency, Dependency::PreviousPass) { u32_at(bytes, 0x3c, 1); }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test] fn full_rebuild_never_uses_the_legacy_staged_count() {
+        let mut bytes = [0xa5; INIT_BM_SIZE];
+        InitBufferManager { context: 3, slot: 7, block_count: 2048,
+            manager: FirmwareVa::new(0xffff_fc24_0010_0000).unwrap(), stamp: 0x100 }
+            .encode_extended(&mut bytes).unwrap();
+        assert_eq!(&bytes[12..20], &[0; 8]);
+    }
+    #[test] fn extended_dependencies_use_their_native_tail_and_preserve_trailing_storage() {
+        for previous in [false, true] {
+            let mut bytes = [0xa5; Barrier::EXTENDED_SIZE + 8];
+            Barrier { stamp: FirmwareVa::new(0xffff_fc24_0010_0000).unwrap(), wait_value: 0x100,
+                event: 2, self_value: 0x200, uuid: 9,
+                dependency: if previous { Dependency::PreviousPass } else { Dependency::TilerToFragment } }
+                .encode_extended(&mut bytes).unwrap();
+            assert_eq!(&bytes[0x18..0x20], &[0; 8]);
+            assert_eq!(&bytes[0x20..0x24], &[2, 0, 0, 0]);
+            assert_eq!(u32::from_le_bytes(bytes[0x3c..0x40].try_into().unwrap()), previous.into());
+            assert_eq!(&bytes[Barrier::EXTENDED_SIZE..], &[0xa5; 8]);
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_tiler_command.rs b/drivers/gpu/drm/asahi/m3/m3_tiler_command.rs
index eeda857a3ed88..caa61621e0b04 100644
--- a/drivers/gpu/drm/asahi/m3/m3_tiler_command.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_tiler_command.rs
@@ -3,6 +3,17 @@ use super::{agx_render::Geometry, m3_compute_layout::{GpuVa,RegisterSet},
     m3_init_layout::{Error,Region}, m3_queue_layout::FirmwareVa,
     m3_render_sequence::ta};
 pub(crate) const SIZE:usize=0x92b;
+pub(crate) const EXTENDED_SIZE:usize=0x940;
+pub(crate) const EXTENDED_FLUSH:usize=0x894;
+pub(crate) struct Dispatch26 {
+    pub(crate) incarnation:u8,
+    pub(crate) serial:u64,
+    pub(crate) peer_stamp:u32,
+    pub(crate) usc_window:u64,
+    pub(crate) firmware_aux:FirmwareVa,
+    pub(crate) scene_scratch:GpuVa,
+}
+
 pub(crate) const REGISTERS:usize=ta::REGISTERS;
 /// The registers G15G does not take; the others keep the G15S order.
 pub(crate) const G15G_OMIT:[u32;14]=[0x1c041,0x1c9d0,0x1c948,0x1c888,0x1c890,0x1c918,0x1c089,0x1c9e0,0x16c41,0x1ca40,0x1c9a8,0x1c920,0xa5a1,0xd419];
@@ -57,17 +68,32 @@ impl Command {
     /// All address checks precede mutation. Zero all reserved fields, then
     /// emit semantic registers and explicit packed command/tail fields.
     pub(crate) fn encode(&self,out:&mut[u8])->Result<(),Error> {
-        if out.len()<SIZE {return Err(Error::Size);}
+        self.encode_format(out, None)
+    }
+    pub(crate) fn encode_extended(&self, dispatch: Dispatch26, out: &mut [u8]) -> Result<(),Error> {
+        self.encode_format(out, Some(dispatch))
+    }
+    fn encode_format(&self, out: &mut [u8], dispatch: Option<Dispatch26>) -> Result<(),Error> {
+        let extended = dispatch.is_some();
+        let size = if extended { EXTENDED_SIZE } else { SIZE };
+        if out.len()<size {return Err(Error::Size);}
+        if let Some(native) = &dispatch {
+            if native.incarnation == 0 || native.serial == 0 || native.peer_stamp == 0 || native.usc_window & 0xffff_ffff != 0
+                || native.usc_window >= 1 << 42 || self.register_set != RegisterSet::G15G {
+                return Err(Error::Address);
+            }
+        }
         if self.context>=64 || self.page_count==0 || self.tpc_bytes==0 {return Err(Error::Address);}
         let registers=self.gpu_alias.get().checked_add(REGISTERS as u64).ok_or(Error::Address)?;
-        GpuVa::new(self.gpu_alias.get().checked_add((SIZE-3) as u64).ok_or(Error::Address)?)
+        GpuVa::new(self.gpu_alias.get().checked_add(((size-1)&!3) as u64).ok_or(Error::Address)?)
             .map_err(|_|Error::Address)?;
-        let seq=self.sequence.at(0,ta::LENGTH)?;
+        let sequence_size = if extended { 0x300 } else { ta::LENGTH };
+        let seq=self.sequence.at(0,sequence_size)?;
         let tilemap=compact(self.tilemap.get())?;
         let tpc=compact(self.tpc.get())?;
         let heap=compact(self.heap.get())?;
         let preemption=[compact(self.preemption[0].get())?,compact(self.preemption[1].get())?,compact(self.preemption[2].get())?];
-        let user=compact(self.scene_user.get().checked_add(0x40).ok_or(Error::Address)?)?;
+        let user=compact(self.scene_user.get().checked_add(if extended {0} else {0x40}).ok_or(Error::Address)?)?;
         let g=&self.geometry;
         let layers=g.layers;
         let layer_metadata=compact(self.heap.get().checked_add(if layers>1 {0x200}else{0}).ok_or(Error::Address)?)?;
@@ -99,23 +125,67 @@ impl Command {
             (0x1c830,0),(0x1ca30,user),(0x16c39,user),
             (0x1c910,0xa0_00000000|(self.initial_scene_entry.get()&0xf_ffffffff)|1),
         ];
-        let bytes=&mut out[..SIZE];bytes.fill(0); // TA opcode is zero
-        pointer(bytes,4,1); // qualified work-command counter remains one
+        let bytes=&mut out[..size];bytes.fill(0); // TA opcode is zero
+        pointer(bytes,4,dispatch.as_ref().map_or(1, |native| native.serial));
         word(bytes,CONTEXT,self.context);
-        for (offset,value) in [(0x14,self.notifier.get()),(0x24,self.manager.get()),
-            (0x2c,self.scene.get()),(0x34,self.empty.get()),(0x740,registers),
+        for (offset,value) in [(if extended {0x10} else {0x14},self.notifier.get()),
+            (if extended {0x20} else {0x24},self.manager.get()),
+            (if extended {0x28} else {0x2c},self.scene.get()),
+            (if extended {0x30} else {0x34},self.empty.get()),(0x740,registers),
             (0x760,self.tpc.get()),(0x768,self.tpc_bytes),(0x770,seq)] {pointer(bytes,offset,value);}
         let g15g=self.register_set==RegisterSet::G15G;
         let mut count=0;
-        for (register,value) in values.into_iter().filter(|(r,_)| !g15g || !G15G_OMIT.contains(r)) {
-            let n=count;count+=1;
-            word(bytes,REGISTERS+n*REGISTER_STRIDE,register);
-            pointer(bytes,REGISTERS+n*REGISTER_STRIDE+4,value);
+        let mut emit = |register, value| {
+            word(bytes, REGISTERS + count * REGISTER_STRIDE, register);
+            pointer(bytes, REGISTERS + count * REGISTER_STRIDE + 4, value);
+            count += 1;
+        };
+        for (register, mut value) in values {
+            if g15g && G15G_OMIT.contains(&register) { continue; }
+            if extended && matches!(register, 0x12099 | 0x1c898) { continue; }
+            if let Some(native) = &dispatch {
+                if register == 0x101e1 {
+                    emit(0xa309, 0);
+                    emit(0x1c8e0, u64::MAX);
+                    emit(0x1c8e8, u64::MAX);
+                    emit(0x1c898, 0);
+                }
+                if register == 0x1c910 {
+                    let address = native.scene_scratch.get();
+                    let escaped = (address & (1 << 42)) >> 3;
+                    let bias = if escaped == 0 { 0x70_0000_0000 } else { 0 };
+                    value = ((address + bias) & 0x7f_ffff_fffe) | escaped | 1;
+                }
+            }
+            emit(register, value);
+        }
+        if let Some(native) = &dispatch {
+            emit(0xa5a1, 0x60_0040_0020);
+            emit(0xd419, 0x2_0000_0001);
+            for register in [0x1ca10, 0x14a1, 0xa349] { emit(register, ta::UUID.into()); }
+            emit(0x10061, native.usc_window);
         }
         bytes[0x748..0x74a].copy_from_slice(&(count as u16).to_le_bytes());
         bytes[0x74a..0x74c].copy_from_slice(&((count*REGISTER_STRIDE) as u16).to_le_bytes());
-        word(bytes,SEQUENCE_LENGTH,ta::LENGTH as u32);
+        word(bytes,SEQUENCE_LENGTH,sequence_size as u32);
         word(bytes,0x77c,1); // fragment event slot
+        if let Some(native) = dispatch {
+            word(bytes, STAMP_VALUE, native.peer_stamp);
+            pointer(bytes, 0x7a8, preemption[0]);
+            pointer(bytes, 0x878, self.stamp.get());
+            pointer(bytes, 0x880, self.fw_stamp.get());
+            word(bytes, 0x888, self.stamp_value);
+            word(bytes, EXTENDED_FLUSH, 1);
+            word(bytes, 0x898, ta::UUID);
+            pointer(bytes, 0x8c8, self.timestamps[0].get());
+            pointer(bytes, 0x8d0, self.timestamps[1].get());
+            pointer(bytes, 0x8d8, self.user_timestamps[0].get());
+            pointer(bytes, 0x8e0, self.user_timestamps[1].get());
+            pointer(bytes, 0x8fe, self.pool.get());
+            bytes[0x906] = 1;
+            pointer(bytes, 0x90f, native.firmware_aux.get());
+            bytes[0x917] = native.incarnation;
+        } else {
         word(bytes,STAMP_VALUE,self.stamp_value);
         pointer(bytes,ta::STRUCT3+0x24,preemption[0]);
         word(bytes,ta::STRUCT3+0xbc,0x67); // retained producer encoder_id
@@ -132,6 +202,41 @@ impl Command {
             (0x47,self.scratch.get())] {pointer(bytes,ta::COMMAND_TAIL+offset,value);}
         bytes[ta::COMMAND_TAIL+0x36]=1; // unk_846
         bytes[ta::COMMAND_TAIL+0x4f]=1; // unk_85f
+        }
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    fn command() -> Command {
+        let fw=|index:u64|FirmwareVa::new(0xffff_fc25_1000_0000+index*0x4000).unwrap();
+        let gpu=|index:u64|GpuVa::new(0x10_0100_0000+index*0x4000).unwrap();
+        Command {context:3,register_set:RegisterSet::G15G,notifier:fw(0),manager:fw(1),scene:fw(2),empty:fw(3),
+            gpu_alias:GpuVa::new(0x72_1000_0000).unwrap(),sequence:Region::new(fw(4).get(),0x1000).unwrap(),
+            pool:fw(5),scratch:fw(6),stamp:fw(7),fw_stamp:fw(8),stamp_value:0x7a000100,
+            timestamps:[fw(9),fw(10)],user_timestamps:[fw(11),fw(12)],preemption:[gpu(0),gpu(1),gpu(2)],
+            tilemap:gpu(3),tpc:gpu(4),tpc_bytes:0x4000,heap:gpu(5),scene_user:gpu(6),
+            initial_scene_entry:fw(13),geometry:Geometry::new(64,64,super::super::agx_render::Utile::Pixels32,
+                super::super::agx_render::Utile::Pixels32,1).unwrap(),page_count:128,
+            vdm:0x100000,multisample:0,ppp:0,process_empty_tiles:false}
+    }
+    #[test] fn native_tiler_keeps_peer_completion_and_usc_window_explicit() {
+        let value=command();let mut bytes=[0xa5;EXTENDED_SIZE+8];
+        value.encode_extended(Dispatch26 {incarnation:9,serial:2,peer_stamp:0x3d000100,
+            usc_window:1<<32,firmware_aux:value.scratch,
+            scene_scratch:GpuVa::new(0x10_0200_0000).unwrap()},&mut bytes).unwrap();
+        let word=|at|u32::from_le_bytes(bytes[at..at+4].try_into().unwrap());
+        assert_eq!(word(0x780),0x3d000100);
+        assert_eq!(word(0x888),value.stamp_value);
+        assert_eq!(word(0x894),1);
+        assert_eq!(word(0x748)&0xffff,66);
+        assert_eq!(bytes[0x917],9);
+        assert_eq!(&bytes[EXTENDED_SIZE..],&[0xa5;8]);
+        let registers=&bytes[REGISTERS..REGISTERS+66*REGISTER_STRIDE];
+        assert!(!registers.chunks_exact(12).any(|r|u32::from_le_bytes(r[..4].try_into().unwrap())==0x12099));
+        let usc=registers.chunks_exact(12).find(|r|u32::from_le_bytes(r[..4].try_into().unwrap())==0x10061).unwrap();
+        assert_eq!(u64::from_le_bytes(usc[4..].try_into().unwrap()),1<<32);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/t8122_admission.rs b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
index fdc41024899f1..fb280ebcde520 100644
--- a/drivers/gpu/drm/asahi/m3/t8122_admission.rs
+++ b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only OR MIT
 
-//! Read-only T8122 identity admission. Firmware startup remains disabled.
+//! Read-only T8122 identity and firmware-interface admission.
 
 use super::m3_profile::Profile;
 
@@ -53,6 +53,28 @@ pub(crate) fn validate_identity_for(
     })
 }
 
+/// Firmware-interface selection is exact and does not change physical GPU encodings.
+pub(crate) fn profile_for(compat:&[u32],j613:bool)->Option<Profile> {
+    match compat {
+        [14,8,3]=>Some(Profile::Legacy),
+        [26,6,2] if j613=>Some(Profile::Extended),
+        _=>None,
+    }
+}
+
+#[cfg(not(test))]
+pub(crate) fn loaded_profile(pdev:&kernel::platform::Device<kernel::device::Core<'_>>)
+    ->kernel::error::Result<Profile> {
+    use kernel::{c_str,prelude::*};
+    let node=pdev.as_ref().of_node().ok_or(ENODEV)?;
+    let compat:KVec<u32>=node.get_property(c_str!("apple,firmware-compat"))?;
+    #[cfg(CONFIG_DRM_ASAHI_M3_T8122)]
+    let j613 = super::m3_board::board_is(b"apple,j613");
+    #[cfg(not(CONFIG_DRM_ASAHI_M3_T8122))]
+    let j613 = false;
+    profile_for(&compat, j613).ok_or(ENODEV)
+}
+
 /// Shape of the voltage-sorted running-state tables: one entry per distinct millivolt,
 /// and the highest primary frequency in MHz. Voltages round up, matching `PwrConfig`.
 /// The first point is the off state. Both primary and secondary frequencies must increase
@@ -108,7 +130,7 @@ pub(crate) fn opp_table_shape(opps: impl IntoIterator<Item = (u64, u32)>) -> Opt
 pub(crate) fn read_identity(
     pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
 ) -> kernel::error::Result<Identity> {
-    read_identity_for(pdev, Profile::Legacy)
+    read_identity_for(pdev, loaded_profile(pdev)?)
 }
 
 #[cfg(not(test))]
@@ -300,3 +322,17 @@ mod tests {
         assert!(validate_identity(&[14, 8, 3], 1, 1, G15G_C0, [0x7f, 0, 0]).is_none());
     }
 }
+
+#[cfg(test)]
+mod selection_tests {
+    use super::*;
+    #[test] fn extended_admission_requires_exact_firmware_and_j613() {
+        for board in [false,true] {
+            assert_eq!(profile_for(&[14,8,3],board),Some(Profile::Legacy));
+            assert_eq!(profile_for(&[26,6,2],board),if board{Some(Profile::Extended)}else{None});
+            for wrong in [&[][..],&[26,6][..],&[26,6,1][..],&[26,6,2,0][..],&[14,8,4][..]] {
+                assert_eq!(profile_for(wrong,board),None);
+            }
+        }
+    }
+}
diff --git a/tools/asahi/m3-runtime-tests.rs b/tools/asahi/m3-runtime-tests.rs
index 458603366c954..91cbefd298fe2 100644
--- a/tools/asahi/m3-runtime-tests.rs
+++ b/tools/asahi/m3-runtime-tests.rs
@@ -46,3 +46,63 @@ mod m3_state_layout;
 
 #[path = "../../drivers/gpu/drm/asahi/m3/m3_compute_storage.rs"]
 mod m3_compute_storage;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs"]
+mod m3_parameter_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_sync_layout.rs"]
+mod m3_sync_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_render.rs"]
+mod agx_render;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_render_state.rs"]
+mod agx_render_state;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_scene_layout.rs"]
+mod m3_scene_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_command_layout.rs"]
+mod m3_command_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_render_sequence.rs"]
+mod m3_render_sequence;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_tiler_command.rs"]
+mod m3_tiler_command;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_pass_layout.rs"]
+mod m3_pass_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_shared_layout.rs"]
+mod m3_shared_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_fragment_command.rs"]
+mod m3_fragment_command;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_attachments.rs"]
+mod agx_attachments;
+
+#[test]
+fn extended_parameter_aliases_are_gpu_only_and_legacy_is_unchanged() {
+    use m3_pass_layout::{Access, Space};
+    use m3_profile::Profile;
+    use m3_shared_layout as shared;
+    for index in 0..shared::COUNT {
+        let original = shared::allocation(index).unwrap();
+        let legacy = shared::allocation_for(Profile::Legacy, index).unwrap();
+        assert_eq!(legacy, original);
+        let extended = shared::allocation_for(Profile::Extended, index).unwrap();
+        if [shared::PARAMETER_PAGE_LIST, shared::PARAMETER_BLOCK_LIST].contains(&index) {
+            assert_eq!(extended.space, Space::ClientGpu);
+            assert_eq!(extended.address, original.address);
+            assert_eq!(extended.size, original.size);
+            assert_eq!(extended.access, Access::GpuCachedRw);
+            assert_eq!(extended.access.pte(), 0xc0000000000080);
+            assert_eq!(original.access, Access::GpuFirmwareCachedRw);
+        }
+        if extended.space == Space::ClientGpu {
+            assert_ne!(extended.access, Access::GpuFirmwareCachedRw);
+        }
+    }
+}

From efcd402f4ccd5ecfb91745a944c328486af3745e Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Tue, 3 Nov 2026 16:28:32 -0500
Subject: [PATCH 08/14] drm/asahi: admit authorized HIGH queues on Extended
 T8122

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/file.rs       | 10 ++++-
 drivers/gpu/drm/asahi/m3/m3_drm.rs  |  5 +++
 tools/asahi/queue-priority-tests.py | 69 +++++++++++++++++++++++++++++
 3 files changed, 82 insertions(+), 2 deletions(-)
 create mode 100644 tools/asahi/queue-priority-tests.py

diff --git a/drivers/gpu/drm/asahi/file.rs b/drivers/gpu/drm/asahi/file.rs
index 24e8db30e580e..a09fa33ed02a4 100644
--- a/drivers/gpu/drm/asahi/file.rs
+++ b/drivers/gpu/drm/asahi/file.rs
@@ -1350,9 +1350,15 @@ impl File {
             cls_pr_debug!(Errors, "queue_create: Invalid priority\n");
             return Err(EINVAL);
         }
-        // HIGH has only been run on G17; G13 and G14 keep refusing it.
+        // Keep support tied to a backend and admitted profile. G13/G14 and
+        // unqualified M3 profiles retain their previous rejection.
+        let high_supported = reg_data.gpu.as_any().is::<crate::g17::Gpu>();
+        #[cfg(CONFIG_DRM_ASAHI_M3_T8122)]
+        let high_supported = high_supported || reg_data.gpu.as_any()
+            .downcast_ref::<crate::m3::m3_drm::Backend>()
+            .is_some_and(|gpu| gpu.supports_high_priority());
         if data.priority == uapi::drm_asahi_priority_DRM_ASAHI_PRIORITY_HIGH
-            && !reg_data.gpu.as_any().is::<crate::g17::Gpu>()
+            && !high_supported
         {
             cls_pr_debug!(
                 Errors,
diff --git a/drivers/gpu/drm/asahi/m3/m3_drm.rs b/drivers/gpu/drm/asahi/m3/m3_drm.rs
index 8aedd920f31dc..555edf7074a6b 100644
--- a/drivers/gpu/drm/asahi/m3/m3_drm.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_drm.rs
@@ -96,6 +96,11 @@ pub(crate) struct Backend {
 }
 
 impl Backend {
+    /// HIGH promises host publication ordering, not firmware preemption.
+    pub(crate) fn supports_high_priority(&self) -> bool {
+        self.soc.chip_id == 0x8122 && self.profile == super::m3_profile::Profile::Extended
+    }
+
     /// Admits and starts the M3 runtime on `soc` (the T8122), with the DRM device `drm` that the
     /// caller registers afterwards.
     pub(crate) fn start(
diff --git a/tools/asahi/queue-priority-tests.py b/tools/asahi/queue-priority-tests.py
new file mode 100644
index 0000000000000..5ecce0620588d
--- /dev/null
+++ b/tools/asahi/queue-priority-tests.py
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Compile the production queue admission gate with controlled credentials/backends."""
+from pathlib import Path
+import subprocess
+import tempfile
+root = Path(__file__).resolve().parents[2]
+s = (root / 'drivers/gpu/drm/asahi/file.rs').read_text()
+a = s.index('        if data.flags != 0', s.index('pub(crate) fn queue_create('))
+b = s.index('        let queues_xa', a)
+gate = s[a:b]
+predicate = (root / 'drivers/gpu/drm/asahi/m3/m3_drm.rs').read_text().split('pub(crate) fn supports_high_priority(&self) -> bool {', 1)[1].split('\n    }', 1)[0]
+unit = r'''
+#![allow(dead_code, non_upper_case_globals)]
+use std::any::Any;
+const EINVAL:i32=22; const EACCES:i32=13;
+macro_rules! cls_pr_debug { ($($arg:tt)*) => {} }
+mod uapi {
+ pub const drm_asahi_priority_DRM_ASAHI_PRIORITY_REALTIME:u32=3;
+ pub const drm_asahi_priority_DRM_ASAHI_PRIORITY_HIGH:u32=2;
+}
+mod bindings { pub const CAP_SYS_NICE:u32=23;
+ pub unsafe fn capable(_:u32)->bool { CAP.with(|c|c.get()) }
+ thread_local! {pub static CAP:std::cell::Cell<bool>=const {std::cell::Cell::new(false)};}
+}
+mod g17 {pub struct Gpu;}
+mod m3 {pub mod m3_drm {
+ #[derive(PartialEq)] pub enum Profile {Legacy, Extended}
+ pub struct Soc {pub chip_id:u32}
+ pub struct Backend {pub soc:Soc,pub profile:Profile}
+ impl Backend {pub fn supports_high_priority(&self)->bool { PREDICATE }}
+}}
+struct Gpu(Box<dyn Any>); impl Gpu {fn as_any(&self)->&dyn Any {&*self.0}}
+struct Reg {gpu:Gpu}
+struct Data {flags:u32,priority:u32}
+struct File(bool); impl File {fn is_current_master(&self)->bool {self.0}}
+fn admit(reg_data:&Reg,data:&Data,file:&File)->Result<(),i32> { GATE Ok(()) }
+fn main() {
+ use m3::m3_drm::*;
+ let mut n=0;
+ for backend in 0..5 { for cap in [false,true] { for master in [false,true] {
+  let gpu:Box<dyn Any>=match backend {
+   0=>Box::new(g17::Gpu),
+   1=>Box::new(Backend{soc:Soc{chip_id:0x8122},profile:Profile::Extended}),
+   2=>Box::new(Backend{soc:Soc{chip_id:0x8122},profile:Profile::Legacy}),
+   3=>Box::new(Backend{soc:Soc{chip_id:0x6030},profile:Profile::Extended}),
+   _=>Box::new(())};
+  let reg=Reg{gpu:Gpu(gpu)};
+  bindings::CAP.with(|c|c.set(cap));
+  for flags in [0,1,u32::MAX] { for priority in [0,1,2,3,4,u32::MAX] {
+   let expected=if flags!=0 || priority>=3 {Err(EINVAL)}
+    else if priority!=2 {Ok(())}
+    else if backend!=0 && !(backend==1 && cfg!(CONFIG_DRM_ASAHI_M3_T8122)) {Err(EINVAL)}
+    else if cap||master {Ok(())} else {Err(EACCES)};
+   assert_eq!(admit(&reg,&Data{flags,priority},&File(master)),expected,
+    "backend={backend} cap={cap} master={master} flags={flags} priority={priority}"); n+=1;
+  }}
+ }}}
+ println!("{n} actual admission cases passed");
+}
+'''.replace('PREDICATE', predicate.replace('super::m3_profile::Profile', 'Profile')).replace('GATE', gate)
+with tempfile.TemporaryDirectory(prefix='queue-priority-') as d:
+    p = Path(d) / 'gate.rs'
+    p.write_text(unit)
+    for enabled in [False, True]:
+        subprocess.run(['rustc', '--edition=2021', *(['--cfg', 'CONFIG_DRM_ASAHI_M3_T8122'] if enabled else []), str(p), '-o', str(p.with_suffix(''))], check=True)
+        # Without M3 compiled only the G17 backend is admitted.
+        subprocess.run([str(p.with_suffix(''))], check=True)
+print('M3 enabled/disabled gate compilation passed')

From c1c0e23c6e4f50e03038a22a6cab7f8d72e39a54 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Tue, 3 Nov 2026 17:25:00 -0500
Subject: [PATCH 09/14] drm/asahi: test the M3 host priority mapping alongside
 admission

Signed-off-by: Satya Benson <satya@benson.earth>
---
 tools/asahi/queue-priority-tests.py | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/tools/asahi/queue-priority-tests.py b/tools/asahi/queue-priority-tests.py
index 5ecce0620588d..cfbbe8f36d4e6 100644
--- a/tools/asahi/queue-priority-tests.py
+++ b/tools/asahi/queue-priority-tests.py
@@ -10,6 +10,10 @@
 b = s.index('        let queues_xa', a)
 gate = s[a:b]
 predicate = (root / 'drivers/gpu/drm/asahi/m3/m3_drm.rs').read_text().split('pub(crate) fn supports_high_priority(&self) -> bool {', 1)[1].split('\n    }', 1)[0]
+submit = (root / 'drivers/gpu/drm/asahi/m3/m3_submit.rs').read_text()
+ordering = submit.split('        let urgency=', 1)[1].split('        Ok(Self', 1)[0]
+ordering = 'let urgency=' + ordering
+assert 'uapi::drm_asahi_priority_DRM_ASAHI_PRIORITY_REALTIME - data.priority' in s
 unit = r'''
 #![allow(dead_code, non_upper_case_globals)]
 use std::any::Any;
@@ -35,6 +39,13 @@
 struct Data {flags:u32,priority:u32}
 struct File(bool); impl File {fn is_current_master(&self)->bool {self.0}}
 fn admit(reg_data:&Reg,data:&Data,file:&File)->Result<(),i32> { GATE Ok(()) }
+mod sched {
+ #[derive(Debug,PartialEq)] pub enum Priority {Low,Normal,High,Kernel}
+}
+fn ordering(priority:u32)->Result<(u8,sched::Priority),i32> {
+ ORDERING
+ Ok((urgency,priority))
+}
 fn main() {
  use m3::m3_drm::*;
  let mut n=0;
@@ -56,9 +67,13 @@
     "backend={backend} cap={cap} master={master} flags={flags} priority={priority}"); n+=1;
   }}
  }}}
- println!("{n} actual admission cases passed");
+ for (uapi,expected) in [(0,sched::Priority::Low),(1,sched::Priority::Normal),(2,sched::Priority::High)] {
+  assert_eq!(ordering(3-uapi),Ok((uapi as u8,expected)));
+ }
+ assert_eq!(ordering(4),Err(EINVAL));
+ println!("{n} actual admission cases and LOW/MEDIUM/HIGH host mappings passed");
 }
-'''.replace('PREDICATE', predicate.replace('super::m3_profile::Profile', 'Profile')).replace('GATE', gate)
+'''.replace('PREDICATE', predicate.replace('super::m3_profile::Profile', 'Profile')).replace('GATE', gate).replace('ORDERING', ordering)
 with tempfile.TemporaryDirectory(prefix='queue-priority-') as d:
     p = Path(d) / 'gate.rs'
     p.write_text(unit)

From ba872b99a0039f15a82fa0f91ed7b8ab4e5905c1 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Tue, 3 Nov 2026 20:36:32 -0500
Subject: [PATCH 10/14] ci: register the M3 queue priority admission tests

Signed-off-by: Satya Benson <satya@benson.earth>
---
 tools/asahi/run-host-tests.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/asahi/run-host-tests.py b/tools/asahi/run-host-tests.py
index 5dfda83574ea6..4ebce94ccb47d 100755
--- a/tools/asahi/run-host-tests.py
+++ b/tools/asahi/run-host-tests.py
@@ -53,6 +53,7 @@ def mutations(flag, names, base, expect=KILL):
 
 # test file -> [(arguments, expectation)]. '{out}' is a fresh directory.
 ASAHI_TESTS = {
+    'queue-priority-tests.py': [([], PASS)],
     'test-m3-power.py': [([], PASS)],
     'test-m3-uapi.py': [([], PASS)],
     'test-m3-mailbox.py': [([], PASS)],

From bd92c01562acb283b2138ba90843606a4b924164 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Tue, 3 Nov 2026 17:39:31 -0500
Subject: [PATCH 11/14] drm/asahi: back off interrupt-assisted M3 completion
 waits

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_completion.rs     | 26 +++----
 .../gpu/drm/asahi/m3/m3_completion_policy.rs  | 77 +++++++++++++++++++
 drivers/gpu/drm/asahi/m3/m3_drm.rs            |  2 +-
 drivers/gpu/drm/asahi/m3/m3_rtkit.rs          | 14 ++--
 drivers/gpu/drm/asahi/m3/mod.rs               |  2 +
 tools/asahi/m3-fence-latency.py               | 63 +++++++++++++++
 tools/asahi/m3-runtime-tests.rs               |  3 +
 7 files changed, 166 insertions(+), 21 deletions(-)
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_completion_policy.rs
 create mode 100644 tools/asahi/m3-fence-latency.py

diff --git a/drivers/gpu/drm/asahi/m3/m3_completion.rs b/drivers/gpu/drm/asahi/m3/m3_completion.rs
index e06fcded9047e..387aaeca1b6c6 100644
--- a/drivers/gpu/drm/asahi/m3/m3_completion.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_completion.rs
@@ -24,10 +24,9 @@ impl WorkItem for Completion {
     type Pointer = Arc<Self>;
     fn run(owner: Arc<Self>) {
         use crate::m3::m3_runtime::Service;
-        // Snapshots after a notification before sleeping for the next one: the completion
-        // stamps can trail the firmware's event message.
-        const TRAILING_POLLS: u32 = 4;
-        let (mut trailing, mut waited_at) = (0, u64::MAX);
+        // No deliberate spin: fsleep(5) selects udelay, not a scheduler sleep.
+        // Check immediately on IRQ, with backoff for trailing coherent witnesses.
+        let mut policy = super::m3_completion_policy::WaitPolicy::new();
         loop {
             let (outcome, events) = {
                 let mut guard = owner.shared.lock();
@@ -37,23 +36,20 @@ impl WorkItem for Completion {
                 // Preserve the root-only CPU-overlap diagnostic: disabled waits retain
                 // the runtime lock so VM/timestamp preparation cannot overlap the GPU.
                 if let Service::Waiting(messages)=outcome {
-                    if !events.cpu_overlap() {events.wait_past(messages);continue;}
+                    if !events.cpu_overlap() {
+                        events.wait_past(messages, policy.next_wait_us(events.wait_ceiling_us()));
+                        continue;
+                    }
                 }
                 (outcome,events)
             };
             match outcome {
                 Service::Idle => break,
-                Service::Progress => { trailing = 0; waited_at = u64::MAX; }
+                Service::Progress => policy.progress(),
                 Service::Waiting(messages) => {
-                    if messages != waited_at { waited_at = messages; trailing = 0; }
-                    if trailing < TRAILING_POLLS {
-                        trailing += 1;
-                        kernel::time::delay::fsleep(kernel::time::Delta::from_micros(5));
-                    } else {
-                        // Until the next firmware event, or a bounded 100 us resnapshot.
-                        events.wait_past(messages);
-                        trailing = 0;
-                    }
+                    // IRQs and timer expiry alone are not retirement progress.
+                    // Keep backing off until service publishes or retires work.
+                    events.wait_past(messages, policy.next_wait_us(events.wait_ceiling_us()));
                 }
             }
         }
diff --git a/drivers/gpu/drm/asahi/m3/m3_completion_policy.rs b/drivers/gpu/drm/asahi/m3/m3_completion_policy.rs
new file mode 100644
index 0000000000000..9c0da8c3246e3
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_completion_policy.rs
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! Bounded fallback for witnesses which can become visible after the last IRQ.
+//!
+//! Notifications request a fresh snapshot, but do not prove witness progress.
+//! Only publication or retirement resets this policy. In particular, neither a
+//! timer wake nor a stream of early firmware notifications renews a spin budget.
+
+pub(crate) struct WaitPolicy {
+    next_us: u64,
+}
+
+impl WaitPolicy {
+    pub(crate) const fn new() -> Self {
+        Self { next_us: 25 }
+    }
+
+    pub(crate) fn progress(&mut self) {
+        self.next_us = 25;
+    }
+
+    /// No deliberate busy delay: IRQs still wake each sleep immediately.
+    /// The caller supplies the root-selected ceiling (25..=1000 us).
+    pub(crate) fn next_wait_us(&mut self, ceiling_us: u64) -> u64 {
+        let wait = self.next_us.min(ceiling_us.clamp(25, 1000));
+        self.next_us = (wait * 2).min(1000);
+        wait
+    }
+}
+
+#[cfg_attr(not(test), kernel::macros::kunit_tests(asahi_m3_completion_policy))]
+mod tests {
+    use super::WaitPolicy;
+
+    #[test]
+    fn no_progress_backs_off_and_stays_bounded() {
+        let mut policy = WaitPolicy::new();
+        for expected in [25, 50, 100, 200, 400, 800, 1000, 1000] {
+            assert_eq!(policy.next_wait_us(1000), expected);
+        }
+        for _ in 0..100_000 {
+            assert_eq!(policy.next_wait_us(1000), 1000);
+        }
+    }
+
+    #[test]
+    fn publication_or_retirement_restarts_fast_detection() {
+        let mut policy = WaitPolicy::new();
+        for _ in 0..8 { policy.next_wait_us(1000); }
+        policy.progress();
+        assert_eq!(policy.next_wait_us(1000), 25);
+        assert_eq!(policy.next_wait_us(1000), 50);
+    }
+
+    #[test]
+    fn live_ceiling_changes_apply_to_the_next_wait() {
+        let mut policy = WaitPolicy::new();
+        for _ in 0..8 { policy.next_wait_us(1000); }
+        assert_eq!(policy.next_wait_us(25), 25);
+        assert_eq!(policy.next_wait_us(1000), 50);
+        assert_eq!(policy.next_wait_us(100), 100);
+        assert_eq!(policy.next_wait_us(100), 100);
+    }
+
+    #[test]
+    fn fallback_keeps_timeout_checks_frequent_without_any_irq() {
+        let mut policy = WaitPolicy::new();
+        let mut elapsed_us = 0;
+        while elapsed_us < 2_000_000 {
+            let wait = policy.next_wait_us(1000);
+            assert!(wait <= 1000);
+            elapsed_us += wait;
+        }
+        // This bounds the requested delay, not scheduler dispatch latency.
+        assert!(elapsed_us < 2_001_000);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_drm.rs b/drivers/gpu/drm/asahi/m3/m3_drm.rs
index 555edf7074a6b..04759396c7757 100644
--- a/drivers/gpu/drm/asahi/m3/m3_drm.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_drm.rs
@@ -38,7 +38,7 @@ struct CompletionView(Arc<crate::m3::m3_rtkit::EventWait>);
 impl kernel::debugfs::Writer for CompletionView {
     fn write(&self, f: &mut kernel::fmt::Formatter<'_>) -> kernel::fmt::Result {
         let (us, irqs, sleeps, timers, preparations) = self.0.snapshot();
-        writeln!(f, "version=1 wait_us={} notifications={} sleeps={} timer_wakes={} cpu_preparations={}",
+        writeln!(f, "version=2 policy=adaptive wait_us={} notifications={} sleeps={} timer_wakes={} cpu_preparations={}",
                  us, irqs, sleeps, timers, preparations)
     }
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_rtkit.rs b/drivers/gpu/drm/asahi/m3/m3_rtkit.rs
index be81c4a4e9d92..ba8ad365ce20a 100644
--- a/drivers/gpu/drm/asahi/m3/m3_rtkit.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_rtkit.rs
@@ -38,7 +38,7 @@ impl EventWait {
         Arc::pin_init(
             pin_init!(EventWait {
                 count: AtomicU64::new(0),
-                wait_us: AtomicU64::new(100),
+                wait_us: AtomicU64::new(1000),
                 overlap_cpu: AtomicBool::new(crate::m3::m3_params::unlocked_wait()),
                 cpu_preparations: AtomicU64::new(0),
                 sleeps: AtomicU64::new(0),
@@ -55,7 +55,7 @@ impl EventWait {
         self.arrived.complete();
     }
 
-    /// Diagnostic tuning changes only the bounded resnapshot cadence, never
+    /// Diagnostic tuning sets the adaptive fallback ceiling in microseconds, never
     /// stamps, pipe retirement, event counts, fences or the two-second timeout.
     /// Atomic publication permits root to compare policies in the same boot.
     pub(crate) fn set_wait_us(&self, us: u64) -> Result {
@@ -64,6 +64,10 @@ impl EventWait {
         Ok(())
     }
 
+    pub(crate) fn wait_ceiling_us(&self) -> u64 {
+        self.wait_us.load(Ordering::Relaxed)
+    }
+
     pub(crate) fn cpu_overlap(&self) -> bool {
         self.overlap_cpu.load(Ordering::Relaxed)
     }
@@ -82,11 +86,11 @@ impl EventWait {
     }
 
     /// Sleep until a notification later than `seen` has been recorded or
-    /// the selected 25..1000 us elapse (default 100 us). A one-jiffy fallback alone takes up to 4 ms at HZ=250,
+    /// the selected 25..1000 us fallback elapses. A one-jiffy fallback alone takes up to 4 ms at HZ=250,
     /// even when the GPU stamp arrives just after its notification. The timer
     /// adds a bounded resnapshot without replacing IRQ wakeups or busy-waiting.
     /// Only the single completion worker may call this method.
-    pub(crate) fn wait_past(self: &Arc<Self>, seen: u64) -> bool {
+    pub(crate) fn wait_past(self: &Arc<Self>, seen: u64, wait_us: u64) -> bool {
         // Events can arrive while the worker is polling. Discard stale wakeup
         // tokens before checking the sequence. A concurrent event either moves
         // the sequence or leaves a token, including between the check and wait.
@@ -98,7 +102,7 @@ impl EventWait {
                 // on every return, before a subsequent wait can arm the timer.
                 self.sleeps.fetch_add(1, Ordering::Relaxed);
                 let timer = self.clone().start(Delta::from_micros(
-                    self.wait_us.load(Ordering::Relaxed) as i64));
+                    wait_us.clamp(25, 1000) as i64));
                 // Retain one tick as a backup bound; normally either the real
                 // interrupt or our high-resolution timer supplies the token.
                 self.arrived.wait_for_completion_timeout(1);
diff --git a/drivers/gpu/drm/asahi/m3/mod.rs b/drivers/gpu/drm/asahi/m3/mod.rs
index d885da1a8647c..eafd5732bceac 100644
--- a/drivers/gpu/drm/asahi/m3/mod.rs
+++ b/drivers/gpu/drm/asahi/m3/mod.rs
@@ -133,6 +133,8 @@ mod t8122_knobs;
 #[cfg(CONFIG_DRM_ASAHI_M3_T8122)]
 mod t8122_start;
 
+mod m3_completion_policy;
+
 mod m3_compute_layout;
 
 mod m3_compute_sequence;
diff --git a/tools/asahi/m3-fence-latency.py b/tools/asahi/m3-fence-latency.py
new file mode 100644
index 0000000000000..c8428d65dbf0d
--- /dev/null
+++ b/tools/asahi/m3-fence-latency.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Join existing M3 timing logs. Input must be one boot, captured without gaps."""
+import collections
+import json
+import math
+import re
+import sys
+
+milestones = {}
+packets = collections.defaultdict(list)
+fences = []
+invalid = collections.Counter()
+for line in open(sys.argv[1]):
+    fields = {k: int(v, 0) for k, v in re.findall(r'(\w+)=(-?0x[0-9a-fA-F]+|-?\d+)', line)}
+    if 'M3_BATCH_MILESTONE ' in line:
+        key = (fields['vm'], fields['publication_tick'])
+        if key in milestones:
+            invalid['duplicate_milestone'] += 1
+        milestones[key] = fields
+    elif 'M3_BATCH_PACKET ' in line:
+        packets[(fields['vm'], fields['packet'])].append((fields['publication_tick'], fields['command']))
+    elif 'M3_PACKET_FENCE ' in line:
+        fences.append(fields)
+values = []
+previous_signal = {}
+for f in sorted(fences, key=lambda f: f['signal_before_tick']):
+    identity = (f['vm'], f['packet'])
+    previous = previous_signal.get(identity, 0)
+    previous_signal[identity] = f['signal_after_tick']
+    if f['status'] != 0:
+        invalid['error_fence'] += 1
+        continue
+    linked = packets.get((f['vm'], f['packet']), [])
+    # Pointer reuse is disambiguated by the completed fence's physical counter.
+    candidates = [(tick, command) for tick, command in linked if previous < tick <= f['signal_before_tick'] and command == f['commands'] - 1]
+    if not candidates:
+        invalid['missing_final_command'] += 1
+        continue
+    final_tick, _ = max(candidates)
+    batch = milestones.get((f['vm'], final_tick))
+    if not batch or batch['mixed'] or batch['render_end_tick'] <= 0:
+        invalid['missing_or_non_render_end'] += 1
+        continue
+    end = batch['render_end_tick']
+    before, after = f['signal_before_tick'], f['signal_after_tick']
+    if not (final_tick <= end <= before <= after):
+        invalid['invalid_counter_order'] += 1
+        continue
+    # GPU execution end is earlier than full coherent retirement; this includes
+    # trailing witnesses and dispatch/retirement, rather than claiming an IRQ is done.
+    values.append(((before - end) / 24, (after - end) / 24))
+
+def percentiles(data):
+    ordered = sorted(data)
+    return {str(p): ordered[max(0, math.ceil(len(ordered) * p / 100) - 1)] for p in (50, 95, 99, 100)} if ordered else {}
+
+print(json.dumps({'render_fences': len(values), 'invalid': invalid,
+                  'gpu_end_to_signal_before_us': percentiles([a for a, b in values]),
+                  'gpu_end_to_signal_after_us': percentiles([b for a, b in values]),
+                  'note': '24 MHz physical counter; interval brackets signal(); includes trailing witnesses. Not presentation latency.'}, indent=2))
+if not values:
+    sys.exit('No valid render fences: do not report latency from this capture')
diff --git a/tools/asahi/m3-runtime-tests.rs b/tools/asahi/m3-runtime-tests.rs
index 91cbefd298fe2..0d6d4e5841194 100644
--- a/tools/asahi/m3-runtime-tests.rs
+++ b/tools/asahi/m3-runtime-tests.rs
@@ -106,3 +106,6 @@ fn extended_parameter_aliases_are_gpu_only_and_legacy_is_unchanged() {
         }
     }
 }
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_completion_policy.rs"]
+mod m3_completion_policy;

From 9f3b31006dd1ac17b751b73d9feceba550675f48 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Tue, 3 Nov 2026 17:59:21 -0500
Subject: [PATCH 12/14] drm/asahi: omit no-op M3 module pins without unload
 support

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_runtime.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/asahi/m3/m3_runtime.rs b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
index 3b1f3d6d08535..8e25e2c3c602f 100644
--- a/drivers/gpu/drm/asahi/m3/m3_runtime.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
@@ -1079,6 +1079,8 @@ impl Runtime {
                 crate::m3::t8122_start::prepare_verdict(pdev.as_ref(),device.soc(),started,e);
                 state.health.mark_failed();
                 if device.stop_asc().is_err() {
+                    // Without module unloading, the C helper is an unbound no-op.
+                    #[cfg(CONFIG_MODULE_UNLOAD)]
                     unsafe {kernel::bindings::__module_get(crate::THIS_MODULE.as_ptr())};
                     core::mem::forget(transport);core::mem::forget(state);
                     core::mem::forget(adopted);
@@ -1348,6 +1350,7 @@ impl Drop for Runtime {
         for batch in self.inner.active.iter() {Inner::finish_all(&batch.entries,Err(ENODEV));}
         if policy::retain_runtime(self.inner.device.stop_asc().is_err(),self.inner.gpu_pending) {
             // SAFETY: a live module reference pins callbacks with retained DMA.
+            #[cfg(CONFIG_MODULE_UNLOAD)]
             unsafe { kernel::bindings::__module_get(crate::THIS_MODULE.as_ptr()) };
             return;
         }

From 40c0f578fa188d83dbe58f0cdd0780aff05696fa Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Wed, 4 Nov 2026 21:13:17 -0500
Subject: [PATCH 13/14] selftests: asahi: match the 7.3 capability argument
 type

Signed-off-by: Satya Benson <satya@benson.earth>
---
 tools/asahi/queue-priority-tests.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/asahi/queue-priority-tests.py b/tools/asahi/queue-priority-tests.py
index cfbbe8f36d4e6..1c5b4695c85f7 100644
--- a/tools/asahi/queue-priority-tests.py
+++ b/tools/asahi/queue-priority-tests.py
@@ -24,7 +24,7 @@
  pub const drm_asahi_priority_DRM_ASAHI_PRIORITY_HIGH:u32=2;
 }
 mod bindings { pub const CAP_SYS_NICE:u32=23;
- pub unsafe fn capable(_:u32)->bool { CAP.with(|c|c.get()) }
+ pub unsafe fn capable(_:i32)->bool { CAP.with(|c|c.get()) }
  thread_local! {pub static CAP:std::cell::Cell<bool>=const {std::cell::Cell::new(false)};}
 }
 mod g17 {pub struct Gpu;}

From 4b07a28daa8348cb232b860874fac0c8bf2513b6 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Wed, 4 Nov 2026 21:33:34 -0500
Subject: [PATCH 14/14] selftests: apple: accept the explicitly registered PMGR
 fixture

Signed-off-by: Satya Benson <satya@benson.earth>
---
 tools/asahi/run-host-tests.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/asahi/run-host-tests.py b/tools/asahi/run-host-tests.py
index 00b9d65f68575..540858e834a6f 100755
--- a/tools/asahi/run-host-tests.py
+++ b/tools/asahi/run-host-tests.py
@@ -189,7 +189,7 @@ def jobs(work, conf, dtc):
              if re.search(r'-tests\.(py|rs|sh)$', p.name) and p.name != Path(__file__).name}
     known = set(ASAHI_TESTS) | set(ASAHI_RUST) | set(ASAHI_SHELL)
     missing = sorted(found - known)
-    gone = sorted(known - found)
+    gone = sorted(name for name in known if not (ASAHI / name).is_file())
     if missing or gone:
         for name in missing:
             print(f'not registered in {Path(__file__).name}: tools/asahi/{name}', file=sys.stderr)