[TripleU613]

On macOS 27.3 beta 1 (26C5035r, iBoot 20457.60.65) the T6050 ANE driver leaves the engine alone (no loader hand-off (preload layout)). The firmware iBoot preloads has a different TEXT/DATA split:

	TEXT	DATA
27.0	0xc0000 @ 0x10000000000	0x2ac000 @ 0x100000c0000
27.3 beta 1	0xec000 @ 0x10000000000	0x280000 @ 0x100000ec000

Apple moved 0x2c000 bytes from DATA into TEXT. Both layouts end at the same DVA, so the firmware span (heap tail, pool, IPC) does not move. Aura's hand-off (#169, #171) reads the segments from the ADT and is not version-gated, so it already hands the 27.3 preload over intact. With the layout admitted, the firmware then asks for a larger IPC area: its request is 0x10440 (IPC size minus one), where 27.0 asks for 0xc440. ane_fw_boot() accepted only 0xc440 and mapped 64 KiB.

Change (drivers/accel/ane):

• A platform can list the preload builds it admits (struct ane_fw_preload_build: TEXT/DATA DVA and size, and the TEXT sha256 pin). The handed-off layout selects the build, and the build supplies the pin. T6050 admits 27.0 (its existing pin, unchanged) and 27.3 beta 1. Platforms without a table keep their single layout and pin through the same helpers.
• The IPC window is mapped up to the heap (0x14000 bytes). Any IPC size the firmware requests is accepted if it holds the channel table and fits that window, and that size goes back in the init block in place of the fixed 0xc441. The H16 boot path (ane_h16_boot.h) already checks the request this way.
• The hand-off log names the selected build and the measured TEXT digest. When no admitted build matches, it prints the layout it saw.
• KUnit: the layout selects the build and its pin, and a mix of the two layouts matches neither.

Shared code. ane_fw_boot() also runs for T8140 (ane_h17_platform). Its firmware's 0xc440 request still passes. Its IPC mapping grows from 64 KiB to the 80 KiB below the heap DVA, which nothing else maps.

Tested on a J714s (M5 Pro) on 27.3 beta 1, booted through Aura with the ANE preload handed over. The kernels were integration/aurora f1b79c4, f8581cb, 2b4523c, 8679514 and 3766943, each with this change. They also carried the out-of-tree 27.3 GPU (#1173) and DCP changes, the Aura side of which is not on main either (cf. #172).

H17 ANE: loader hand-off verified (27.3 build, TEXT sha256 115575864d4c8d02d48d83077170e7e16079aaf70dadd608c71910ac66dc6066); starting the engine
H17 ANE: READY; IPC 0x10441 bytes requested

	Result
Bring-up at bind	firmware READY, up at boot, accel node ready
/dev/accel/accel0	present on each test boot where it was checked, across these kernels (one of them eight boots in a row)
Kernel log	no SError, Oops or WARNING

Not tested:

• No inference workload was run. This shows the firmware booting and the accel node coming up, not a job completing.
• The 27.0 firmware and T8140 were not re-run with this change.
• This branch (rebased on 793358e, with a debug-only module parameter dropped) was build-tested only: clang, LLVM=1, arm64, W=1 for drivers/accel/ane/ including the KUnit object, with no warnings. The KUnit case compiles but was not run.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T01:33:19.822691Z	9dd865f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[RyanTheTide]

The build table and pins look right and the layout check still refuses a mix of the two layouts. One request: the IPC window is now mapped to the heap, and the channel table is parsed against that whole window rather than the size the firmware asked for. Could the parse use the requested size (the value you now write at init + 0x50)? That keeps the T8140 bounds where they are today. We will run the T8140 side on our A18 Pro before merging: hand-off, READY with 0xc441, an inference job, and one suspend cycle.