From c89018ed79c338c40eb67080b3005235060fedd6 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:18:41 -0400
Subject: [PATCH 1/9] drm/apple: accept automatic PMGR activity in J613
 coldplug

Use the PMGR provider active-state predicate when checking inherited
display power. DISP_CPU can report ACTUAL=4 with AUTO_ENABLE and
TARGET=15 after automatic clock gating. Keep the checks read-only and
preserve all other handoff requirements.

Test all actual, target and automatic-state combinations and the
captured J613 state through the production helper.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/apple/j613_dcp_activate.c |  9 ++++-
 tools/asahi/test-j613-dcp-power.py        | 45 +++++++++++++++++++++++
 tools/aurora-ci/host-tests.json           |  8 ++++
 3 files changed, 61 insertions(+), 1 deletion(-)
 create mode 100644 tools/asahi/test-j613-dcp-power.py

diff --git a/drivers/gpu/drm/apple/j613_dcp_activate.c b/drivers/gpu/drm/apple/j613_dcp_activate.c
index 6e20a5afc914c5..6d0a2620694692 100644
--- a/drivers/gpu/drm/apple/j613_dcp_activate.c
+++ b/drivers/gpu/drm/apple/j613_dcp_activate.c
@@ -40,6 +40,13 @@ bool apple_t8122_25g83_board(void)
 	return ok;
 }
 
+/* Match the PMGR provider: automatic domains can be clock-gated while active. */
+static bool j613_power_state_active(u32 state)
+{
+	return FIELD_GET(GENMASK(7, 4), state) == 15 ||
+	       ((state & BIT(28)) && FIELD_GET(GENMASK(3, 0), state) == 15);
+}
+
 /* These are DT domain nodes, carrying the PMGR offsets, not copied registers. */
 static int j613_power_ready(void)
 {
@@ -82,7 +89,7 @@ static int j613_power_ready(void)
 			return -ENOMEM;
 		state = readl(pmgr + offset);
 		iounmap(pmgr);
-		if (FIELD_GET(GENMASK(7, 4), state) != 15)
+		if (!j613_power_state_active(state))
 			return -EBUSY;
 	}
 	return 0;
diff --git a/tools/asahi/test-j613-dcp-power.py b/tools/asahi/test-j613-dcp-power.py
new file mode 100644
index 00000000000000..4e93bcc8b1bdb1
--- /dev/null
+++ b/tools/asahi/test-j613-dcp-power.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Compile the production J613 PMGR predicate and test all actual/target/auto states."""
+from pathlib import Path
+import os
+import subprocess
+import tempfile
+
+root = Path(__file__).resolve().parents[2]
+source = (root / "drivers/gpu/drm/apple/j613_dcp_activate.c").read_text()
+start = source.index("static bool j613_power_state_active(")
+end = source.index("\n}\n", start) + 3
+stub = r"""
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+typedef uint32_t u32;
+#define BIT(n) (1U << (n))
+#define GENMASK(a,b) (((1U << ((a)-(b)+1))-1) << (b))
+#define FIELD_GET(mask,v) (((v) & (mask)) >> __builtin_ctz(mask))
+"""
+main = r"""
+int main(void) {
+ for (u32 actual = 0; actual < 16; actual++)
+ for (u32 target = 0; target < 16; target++)
+ for (u32 automatic = 0; automatic < 2; automatic++) {
+  u32 word = (actual << 4) | target | (automatic << 28);
+  bool expected = actual == 15 || (target == 15 && automatic);
+  if (j613_power_state_active(word) != expected) return 1;
+ }
+ if (!j613_power_state_active(0x1404024f)) return 2;
+ if (j613_power_state_active(0x0404024f)) return 3;
+ if (j613_power_state_active(0x14040240)) return 4;
+ puts("PASS: 512 PMGR combinations and captured-state regression controls");
+ return 0;
+}
+"""
+with tempfile.TemporaryDirectory() as temporary:
+    path = Path(temporary) / "power.c"
+    path.write_text(stub + source[start:end] + main)
+    for flags in ([], ["-O2"]):
+        exe = str(path.with_suffix(""))
+        subprocess.run([os.environ.get("CC", "cc"), "-Wall", "-Wextra", "-Werror",
+                        *flags, str(path), "-o", exe], check=True)
+        subprocess.run([exe], check=True)
diff --git a/tools/aurora-ci/host-tests.json b/tools/aurora-ci/host-tests.json
index a1b93d695dfd6e..6324bcaa99a94a 100644
--- a/tools/aurora-ci/host-tests.json
+++ b/tools/aurora-ci/host-tests.json
@@ -2282,6 +2282,14 @@
     "{output}"
    ],
    "note": "Build only the host Kconfig tool in an isolated output directory; check all built-in/module dependency combinations."
+  },
+  {
+   "name": "tools/asahi/test-j613-dcp-power.py",
+   "group": "tools",
+   "argv": [
+    "python3",
+    "tools/asahi/test-j613-dcp-power.py"
+   ]
   }
  ],
  "helpers": {

From d2c35b616d4a44f1e37843b494055657bdc62e54 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:18:41 -0400
Subject: [PATCH 2/9] drm/asahi: accept the T8122 25G83 mailbox compatible list

The 25G83 device tree advertises the AGX-specific compatible followed by
asc-mailbox-v4. Both bind the same mailbox operations. Admit this exact
pair while retaining all resource and identity checks.

Exercise the production rejection predicate with public-DTS fixtures and
resource mutations; allow optional local DT captures for reproduction.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_soc.rs |  1 +
 tools/asahi/test-m3-mailbox.py     | 90 ++++++++++++++++++++++++++++++
 tools/aurora-ci/host-tests.json    |  8 +++
 3 files changed, 99 insertions(+)
 create mode 100644 tools/asahi/test-m3-mailbox.py

diff --git a/drivers/gpu/drm/asahi/m3/m3_soc.rs b/drivers/gpu/drm/asahi/m3/m3_soc.rs
index 4b81475612b6fa..7500822c4124c5 100644
--- a/drivers/gpu/drm/asahi/m3/m3_soc.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_soc.rs
@@ -291,6 +291,7 @@ pub(crate) static T8122: Soc = Soc {
     cores_per_cluster: 10,
     mailbox_compatibles: &[
         b"apple,t8122-agx-asc-mailbox\0",
+        b"apple,t8122-agx-asc-mailbox\0apple,asc-mailbox-v4\0",
         b"apple,t8122-asc-mailbox\0apple,asc-mailbox-v4\0",
     ],
     mailbox_interrupts: &[0, 723, 4, 0, 724, 4, 0, 725, 4, 0, 726, 4],
diff --git a/tools/asahi/test-m3-mailbox.py b/tools/asahi/test-m3-mailbox.py
new file mode 100644
index 00000000000000..2320d17f10f6f4
--- /dev/null
+++ b/tools/asahi/test-m3-mailbox.py
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Exercise the production T8122 mailbox predicate with captured DTB properties.
+
+Usage: python3 tools/asahi/test-m3-mailbox.py [runtime.dtb daily.dtb]
+Requires dtc's fdtget. No target access or MMIO.
+"""
+import hashlib
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[2]
+board = (ROOT / 'drivers/gpu/drm/asahi/m3/m3_board.rs').read_text()
+soc = (ROOT / 'drivers/gpu/drm/asahi/m3/m3_soc.rs').read_text()
+t8122 = soc[soc.index('pub(crate) static T8122:'):]
+compatibles = re.search(r'mailbox_compatibles: &(\[.*?\]),', t8122, re.S)[1]
+irqs = re.search(r'mailbox_interrupts: &(\[.*?\]),', t8122, re.S)[1]
+base = re.search(r'mailbox: (0x[0-9a-fA-F_]+),', t8122)[1]
+regfn = re.search(r'fn expected_mailbox_reg\(.*?\n}', board, re.S)[0]
+predicate = board[board.index('    if !soc.mailbox_compatibles'):]
+predicate = predicate[:predicate.index('\n    {')].strip()[3:]
+
+
+def prop(dtb, node, name, kind):
+    result = subprocess.check_output(['fdtget', '-t', kind, str(dtb), node, name], text=True)
+    return [int(v, 16) for v in result.split()]
+
+
+def vec(values):
+    return 'vec![' + ','.join(map(str, values)) + ']'
+
+
+fixtures = []
+for argument in sys.argv[1:]:
+    dtb = Path(argument)
+    gpu = '/soc/gpu@292400000'
+    # Both retained captures use this mailbox path; verify the phandle link,
+    # not its capture-specific numeric value.
+    mbox = '/soc/mbox@292408000'
+    if prop(dtb, gpu, 'mboxes', 'x') != prop(dtb, mbox, 'phandle', 'x'):
+        raise RuntimeError('GPU mailbox phandle mismatch')
+    values = [prop(dtb, mbox, name, kind) for name, kind in
+              [('compatible', 'bx'), ('reg', 'x'), ('interrupt-names', 'bx'),
+               ('interrupts', 'x'), ('#mbox-cells', 'x')]]
+    if len(values[4]) != 1:
+        raise RuntimeError('bad #mbox-cells length')
+    fixtures.append('check(' + ','.join(vec(v) for v in values[:4]) + ',' + str(values[4][0]) + ');')
+    print(dtb.name, hashlib.sha256(dtb.read_bytes()).hexdigest())
+if not sys.argv[1:]:
+    # Public t8122-j613-dcp-25g83.dtsi and t8122-gpu.dtsi resource contract.
+    names = list(b'send-empty\0send-not-empty\0recv-empty\0recv-not-empty\0')
+    for compat in (b'apple,t8122-agx-asc-mailbox\0apple,asc-mailbox-v4\0',
+                   b'apple,t8122-asc-mailbox\0apple,asc-mailbox-v4\0'):
+        values = [list(compat), [2, 0x92408000, 0, 0x4000], names,
+                  [0,723,4,0,724,4,0,725,4,0,726,4]]
+        fixtures.append('check(' + ','.join(vec(v) for v in values) + ',0);')
+if len(fixtures) != 2:
+    raise SystemExit('supply runtime.dtb and daily.dtb')
+
+source = '''
+struct Windows { mailbox: u64 }
+struct Soc { mailbox_compatibles: &'static [&'static [u8]], mailbox_interrupts: &'static [u32], windows: Windows }
+''' + regfn + '''
+fn accepts(soc: &Soc, compat: &Vec<u8>, mbox_reg: &Vec<u32>, irq_names: &Vec<u8>, irqs: &Vec<u32>, cells: u32) -> bool {
+    !(''' + predicate + ''')
+}
+fn check(compat: Vec<u8>, reg: Vec<u32>, names: Vec<u8>, irqs: Vec<u32>, cells: u32) {
+    let soc = Soc { mailbox_compatibles: &''' + compatibles + ''', mailbox_interrupts: &''' + irqs + ''', windows: Windows { mailbox: ''' + base + ''' } };
+    let ok = |c: &Vec<u8>, r: &Vec<u32>, n: &Vec<u8>, i: &Vec<u32>, x| accepts(&soc,c,r,n,i,x);
+    assert!(ok(&compat,&reg,&names,&irqs,cells));
+    for i in 0..reg.len() { let mut v=reg.clone(); v[i]^=1; assert!(!ok(&compat,&v,&names,&irqs,cells)); }
+    for i in 0..irqs.len() { let mut v=irqs.clone(); v[i]^=1; assert!(!ok(&compat,&reg,&names,&v,cells)); }
+    assert!(!ok(&compat,&reg,&names,&irqs,1));
+    let mut v=names.clone(); v[0]^=1; assert!(!ok(&compat,&reg,&v,&irqs,cells));
+    for v in [b"apple,asc-mailbox-v4\\0".to_vec(), b"apple,t8122-agx-asc-mailbox\\0unknown\\0".to_vec(), b"apple,t6031-agx-asc-mailbox\\0".to_vec()] { assert!(!ok(&v,&reg,&names,&irqs,cells)); }
+    for v in soc.mailbox_compatibles { assert!(ok(&v.to_vec(),&reg,&names,&irqs,cells)); }
+}
+fn main() {
+''' + '\n'.join(fixtures) + '\nprintln!("mailbox: both captures, all exact supported lists and resource/identity mutation controls PASS");\n}\n'
+with tempfile.TemporaryDirectory() as tmp:
+    path = Path(tmp)
+    (path / 'test.rs').write_text(source)
+    subprocess.run([os.environ.get('RUSTC', 'rustc'), '--edition=2021', str(path / 'test.rs'), '-o', str(path / 'test')], check=True)
+    subprocess.run([str(path / 'test')], check=True)
+print('m3_board.rs', hashlib.sha256(board.encode()).hexdigest())
+print('m3_soc.rs', hashlib.sha256(soc.encode()).hexdigest())
diff --git a/tools/aurora-ci/host-tests.json b/tools/aurora-ci/host-tests.json
index a1b93d695dfd6e..017828e7865d44 100644
--- a/tools/aurora-ci/host-tests.json
+++ b/tools/aurora-ci/host-tests.json
@@ -2282,6 +2282,14 @@
     "{output}"
    ],
    "note": "Build only the host Kconfig tool in an isolated output directory; check all built-in/module dependency combinations."
+  },
+  {
+   "name": "tools/asahi/test-m3-mailbox.py",
+   "group": "tools",
+   "argv": [
+    "python3",
+    "tools/asahi/test-m3-mailbox.py"
+   ]
   }
  ],
  "helpers": {

From d17068fc1f78fcde813d4169c05c1db37aa61fcf Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 22:17:26 -0400
Subject: [PATCH 3/9] test: vary unrelated bits in J613 PMGR state words

Cross all 512 ACTUAL/TARGET/AUTO combinations with zero, all-set,
alternating and individual unrelated-bit patterns. This verifies that
readiness ignores every bit outside the three PMGR fields.

A temporary ACTUAL mask widened from GENMASK(7, 4) to GENMASK(8, 4)
passes the old cases but fails the new ones at both -O0 and -O2.
Make the unoptimized compiler flag explicit and report failing words.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 tools/asahi/test-j613-dcp-power.py | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/tools/asahi/test-j613-dcp-power.py b/tools/asahi/test-j613-dcp-power.py
index 4e93bcc8b1bdb1..3bc1a3379c253e 100644
--- a/tools/asahi/test-j613-dcp-power.py
+++ b/tools/asahi/test-j613-dcp-power.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # SPDX-License-Identifier: GPL-2.0-only OR MIT
-"""Compile the production J613 PMGR predicate and test all actual/target/auto states."""
+"""Compile the production J613 PMGR predicate and test PMGR fields and unrelated bits."""
 from pathlib import Path
 import os
 import subprocess
@@ -21,24 +21,36 @@
 """
 main = r"""
 int main(void) {
+ /* Only ACTUAL[7:4], TARGET[3:0] and AUTO_ENABLE[28] affect readiness. */
+ const u32 unrelated_mask = ~(GENMASK(7, 0) | BIT(28));
+ u32 unrelated[32] = {0, unrelated_mask,
+                      0xaaaaaaaaU & unrelated_mask,
+                      0x55555555U & unrelated_mask};
+ unsigned int count = 4;
+ for (unsigned int bit = 8; bit < 32; bit++)
+  if (bit != 28) unrelated[count++] = BIT(bit);
+ for (unsigned int i = 0; i < count; i++)
  for (u32 actual = 0; actual < 16; actual++)
  for (u32 target = 0; target < 16; target++)
  for (u32 automatic = 0; automatic < 2; automatic++) {
-  u32 word = (actual << 4) | target | (automatic << 28);
+  u32 word = unrelated[i] | (actual << 4) | target | (automatic << 28);
   bool expected = actual == 15 || (target == 15 && automatic);
-  if (j613_power_state_active(word) != expected) return 1;
+  if (j613_power_state_active(word) != expected) {
+   fprintf(stderr, "PMGR state 0x%08x: expected active=%d\n", word, expected);
+   return 1;
+  }
  }
  if (!j613_power_state_active(0x1404024f)) return 2;
  if (j613_power_state_active(0x0404024f)) return 3;
  if (j613_power_state_active(0x14040240)) return 4;
- puts("PASS: 512 PMGR combinations and captured-state regression controls");
+ puts("PASS: 13824 PMGR combinations and captured-state regression controls");
  return 0;
 }
 """
 with tempfile.TemporaryDirectory() as temporary:
     path = Path(temporary) / "power.c"
     path.write_text(stub + source[start:end] + main)
-    for flags in ([], ["-O2"]):
+    for flags in (["-O0"], ["-O2"]):
         exe = str(path.with_suffix(""))
         subprocess.run([os.environ.get("CC", "cc"), "-Wall", "-Wextra", "-Werror",
                         *flags, str(path), "-o", exe], check=True)

From 2bf9dbd571c8b357099f243bb730350e7c917b7a Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:38:58 -0400
Subject: [PATCH 4/9] drm/asahi: describe the T8122 extended firmware profile
 and owned IO records

Separate firmware identity, HAL metadata and VM bounds from physical
G15G stream selection. Add checked root and owned IO descriptor encoders.
Introduce slot 28 at SGX+0xd50000 with a production-writer regression;
the shifted T8132 bank is never introduced. Keep VM padding zero.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 MAINTAINERS                                 |   2 +
 drivers/gpu/drm/asahi/m3/m3_client.rs       |  17 +-
 drivers/gpu/drm/asahi/m3/m3_drm.rs          |  20 +-
 drivers/gpu/drm/asahi/m3/m3_firmware.rs     | 146 +++-
 drivers/gpu/drm/asahi/m3/m3_init_26.rs      | 275 +++++++
 drivers/gpu/drm/asahi/m3/m3_init_layout.rs  | 139 +++-
 drivers/gpu/drm/asahi/m3/m3_mmio_26.rs      | 265 +++++++
 drivers/gpu/drm/asahi/m3/m3_profile.rs      |  69 ++
 drivers/gpu/drm/asahi/m3/mod.rs             |   4 +
 drivers/gpu/drm/asahi/m3/t8122_admission.rs |  49 +-
 tools/asahi/m3-firmware-tests.rs            |  14 +
 tools/asahi/m3-runtime-tests.rs             |   9 +
 tools/asahi/m3-uapi-fixture.c               | 363 +++++++++
 tools/asahi/m3-uapi-tests.rs                | 832 ++++++++++++++++++++
 tools/asahi/test-m3-mailbox.py              |  11 +
 tools/asahi/test-m3-uapi.py                 |  73 ++
 tools/aurora-ci/host-tests.json             |  31 +-
 17 files changed, 2295 insertions(+), 24 deletions(-)
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_init_26.rs
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_profile.rs
 create mode 100644 tools/asahi/m3-firmware-tests.rs
 create mode 100644 tools/asahi/m3-uapi-fixture.c
 create mode 100644 tools/asahi/m3-uapi-tests.rs
 create mode 100755 tools/asahi/test-m3-uapi.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 491823243a5fc1..d152848f6be827 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2723,7 +2723,9 @@ F:	drivers/pwm/pwm-apple.c
 F:	drivers/reset/reset-apple-cio.c
 F:	drivers/rtc/rtc-macsmc.c
 F:	drivers/soc/apple/*
+F:	tools/asahi/m3-uapi-*
 F:	tools/asahi/pmp-bootargs-tests.rs
+F:	tools/asahi/test-m3-uapi.py
 F:	drivers/spi/spi-apple.c
 F:	drivers/spmi/spmi-apple-controller.c
 F:	drivers/thunderbolt/.kunitconfig.apple-dpin
diff --git a/drivers/gpu/drm/asahi/m3/m3_client.rs b/drivers/gpu/drm/asahi/m3/m3_client.rs
index dff1af0783965d..c1a07d61120d13 100644
--- a/drivers/gpu/drm/asahi/m3/m3_client.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_client.rs
@@ -35,7 +35,7 @@ use crate::{
 const AGX3_PARAMS_SIZE: u64 =
     (core::mem::offset_of!(uapi::drm_asahi_params_global, gpu_hal_generation)
         + core::mem::size_of::<u32>()) as u64;
-const _: () = assert!(AGX3_PARAMS_SIZE == 600);
+const _: () = assert!(AGX3_PARAMS_SIZE == super::m3_profile::PARAMS_REQUIRED);
 
 /// Refused clients that are logged per boot; later refusals only count.
 const REFUSALS_LOGGED: u32 = 16;
@@ -45,10 +45,19 @@ static REFUSALS: AtomicU32 = AtomicU32::new(0);
 /// [`AGX3_PARAMS_SIZE`] bytes (so it knows this GPU runs AGX3 command streams), and pass
 /// VM_CREATE flags 0 (legacy HAL). `size` is the largest GET_PARAMS size the file asked for.
 pub(crate) fn admit_vm(device: &kernel::device::Device, size: u64, flags: u32) -> Result {
+    admit_vm_for(device, super::m3_profile::Profile::Legacy, size, flags)
+}
+
+pub(crate) fn admit_vm_for(
+    device: &kernel::device::Device,
+    profile: super::m3_profile::Profile,
+    size: u64,
+    flags: u32,
+) -> Result {
     {
         // The positive acknowledgement of the command ABI (7.1.12 `g16_profile::client_admitted`):
         // GET_PARAMS coverage, and VM_CREATE flags 0 on the legacy-HAL M3 runtime.
-        if size >= AGX3_PARAMS_SIZE && flags == 0 {
+        if profile.vm_acknowledged(size, flags) {
             return Ok(());
         }
         let refusals = REFUSALS.fetch_add(1, Ordering::Relaxed).saturating_add(1);
@@ -64,11 +73,13 @@ pub(crate) fn admit_vm(device: &kernel::device::Device, size: u64, flags: u32) -
             };
             dev_info!(
                 device,
-                "M3: refusing a VM for {}[{}]: it asked GET_PARAMS for {} of the {} parameter bytes, so it cannot know this GPU runs AGX3 command streams; M3-aware userspace is needed{}\n",
+                "M3: refusing a VM for {}[{}]: GET_PARAMS bytes={}/{} HAL={} flags={:#x}{}\n",
                 name,
                 task.group_leader().pid(),
                 size,
                 AGX3_PARAMS_SIZE,
+                profile.hal(),
+                flags,
                 last
             );
         }
diff --git a/drivers/gpu/drm/asahi/m3/m3_drm.rs b/drivers/gpu/drm/asahi/m3/m3_drm.rs
index bcb9fd32c7d255..d81ce66ac53aa0 100644
--- a/drivers/gpu/drm/asahi/m3/m3_drm.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_drm.rs
@@ -86,6 +86,7 @@ pub(crate) struct Backend {
     core_mask: u64,
     max_frequency_khz: u32,
     soc: &'static crate::m3::m3_soc::Soc,
+    profile: super::m3_profile::Profile,
     _progress: Pin<KBox<kernel::debugfs::File<ProgressView>>>,
     _activity: Pin<KBox<kernel::debugfs::File<ActivityView>>>,
     _memory: Pin<KBox<kernel::debugfs::File<crate::m3::agx_memory_stats::View>>>,
@@ -125,6 +126,7 @@ impl Backend {
         let firmware = crate::m3::m3_firmware::identify_loaded(pdev, soc, resources, experiment)
             .inspect_err(refused("the firmware identity"))?;
         dev_info!(pdev.as_ref(), "M3: firmware identity accepted\n");
+        let profile = firmware.profile();
         // InitData source and contents, before any GPU register access.
         let contents = crate::m3::m3_adt_config::Contents::select(pdev, &firmware, soc, experiment)
             .inspect_err(refused("the InitData contents"))?;
@@ -160,7 +162,7 @@ impl Backend {
         let completion_work = crate::m3::m3_completion::Completion::new(shared.clone())?;
         // From here on every failure drops the backend, which stops the runtime.
         let backend = Arc::new(Self { shared, health, ids: gpu::SequenceIDs::default(),
-            scheduler, core_mask, max_frequency_khz, soc,
+            scheduler, core_mask, max_frequency_khz, soc, profile,
             _progress: progress, _activity: activity, _memory: memory, _timing: timing,
             _completion: completion, _overlap: overlap }, GFP_KERNEL)?;
         // The completion worker services this runtime from now on; the RTKit callbacks and
@@ -208,7 +210,9 @@ impl gpu::Gpu for Backend {
         }
         params.max_frequency_khz = self.max_frequency_khz;
         params.usc_generation = 3;
-        params.gpu_hal_generation = hw::GpuHalGeneration::Legacy as u32;
+        params.gpu_hal_generation = self.profile.hal();
+        params.max_commands_per_submission = super::agx_uapi::UAPI_MAX_HARDWARE_COMMANDS;
+        params.max_attachments = super::agx_uapi::UAPI_MAX_ATTACHMENTS as u32;
         Ok(())
     }
     fn supports_vm_status(&self) -> bool { true }
@@ -217,10 +221,12 @@ impl gpu::Gpu for Backend {
     fn feature_flags(&self) -> u64 {
         let mut flags = uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_VM_STATUS as u64
             | uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_SCHEDULED_QUEUES as u64;
-        if self.soc.features.fragment_dependency && crate::m3::m3_params::early_tiling() {
+        if self.profile == super::m3_profile::Profile::Legacy
+            && self.soc.features.fragment_dependency && crate::m3::m3_params::early_tiling() {
             flags |= uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_FRAGMENT_DEPENDENCY as u64;
         }
-        if self.soc.features.compute_wide_visibility {
+        if self.profile == super::m3_profile::Profile::Legacy
+            && self.soc.features.compute_wide_visibility {
             flags |= uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_COMPUTE_WIDE_VISIBILITY as u64;
         }
         flags
@@ -233,17 +239,17 @@ impl gpu::Gpu for Backend {
     }
     fn uat_geometry(&self) -> mmu::UatGeometry { mmu::UatGeometry { ias: 42, oas: 42 } }
     fn user_range(&self) -> Range<u64> {
-        mmu::UAT_PGSZ as u64..crate::m3::initdata::RUNTIME_UNKNOWN_PAGE
+        mmu::UAT_PGSZ as u64..self.profile.user_end()
     }
     /// The dummy page sits where InitData tells the firmware it is (unk_30), as on 7.1.12; the
     /// 42-bit geometry's own unk_page() is a different address.
     fn unknown_page(&self) -> u64 {
-        crate::m3::initdata::RUNTIME_UNKNOWN_PAGE
+        self.profile.user_end()
     }
     fn tracked_submission(&self) -> bool { true }
     /// Only M3-aware userspace may create a VM (7.1.12's per-file client gate).
     fn admit_vm(&self, dev: &kernel::device::Device, params_size: u64, flags: u32) -> Result {
-        crate::m3::m3_client::admit_vm(dev, params_size, flags)
+        crate::m3::m3_client::admit_vm_for(dev, self.profile, params_size, flags)
     }
     fn new_vm(&self, range: Range<u64>) -> Result<mmu::Vm> {
         Option::as_mut(&mut *self.shared.lock()).ok_or(ENODEV)?.new_vm(self.ids.vm.next(), range)
diff --git a/drivers/gpu/drm/asahi/m3/m3_firmware.rs b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
index 0d2835174c6775..c9aa45cc028648 100644
--- a/drivers/gpu/drm/asahi/m3/m3_firmware.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
@@ -62,6 +62,19 @@ pub(crate) static KNOWN_IMAGES_T8122: [KnownImage; 1] = [KnownImage {
     initdata_magic: Some(G15_V14_8_3_INITDATA),
 }];
 
+/// Image record for the extended format. The SoC's runtime selection does not use it yet.
+pub(crate) static T8122_IMAGES_26: [KnownImage; 1] = [KnownImage {
+    name: "T8122 C0 firmware-compat 26.6.2",
+    uuid: None,
+    stkg_sha256: Some([
+        0x3a, 0x6b, 0x8b, 0x5e, 0x83, 0x38, 0x4d, 0x5c,
+        0xc1, 0x92, 0x9d, 0x91, 0xb6, 0x36, 0x40, 0xfe,
+        0xe8, 0xf5, 0x52, 0xb5, 0x10, 0x8c, 0x4e, 0xa6,
+        0x20, 0xbe, 0xdb, 0x7b, 0xbc, 0xa0, 0x31, 0x64,
+    ]),
+    initdata_magic: Some(0x0c89_c357_8392_04b8),
+}];
+
 /// The same T8122 image for the start experiment (`t8122_start`, only with
 /// `asahi.t8122_start=1`), where `asahi.t8122_initdata_version` may replace the version.
 pub(crate) static KNOWN_IMAGES_T8122_EXPERIMENT: [KnownImage; 1] = [KnownImage {
@@ -117,6 +130,10 @@ pub(crate) struct Layout {
     /// Offset of the 8-byte tag that precedes the 8 per-boot bytes zeroed before hashing.
     pub(crate) entropy_tag_offset: usize,
     pub(crate) entropy_tag: [u8; 8],
+    /// An additional independent boot value, when required by this image.
+    extra_boot_value: Option<(usize, [u8; 8])>,
+    /// Expected boot-table location and byte count in the image header.
+    boot_table: Option<(u32, u32)>,
     /// The firmware version, for logs.
     pub(crate) version: &'static str,
 }
@@ -127,6 +144,8 @@ pub(crate) static T6030_LAYOUT: Layout = Layout {
     vas: [0xffff_fc00_0000_0000, 0xffff_fc00_0005_c000],
     entropy_tag_offset: 0x58e88,
     entropy_tag: *b"GKTS\x08\x00\x00\x00",
+    extra_boot_value: None,
+    boot_table: None,
     version: "RTKit-2419.140.12.release",
 };
 
@@ -137,23 +156,73 @@ pub(crate) static T8122_LAYOUT: Layout = Layout {
     vas: [0xffff_fc00_0000_0000, 0xffff_fc00_0006_4000],
     entropy_tag_offset: 0x5d54a,
     entropy_tag: *b"GKTS\x08\x00\x00\x00",
+    extra_boot_value: None,
+    boot_table: None,
     version: "RTKit-2419.140.12.release",
 };
 
 pub(crate) const TEXT_SHA256: [u8; 32] = [
     0x11, 0xe4, 0x9f, 0x75, 0xb, 0x67, 0x1a, 0x2b, 0x13, 0xd0, 0x92, 0xdb, 0x1c, 0xbc, 0xa3, 0xa8, 0x77, 0x55, 0x86, 0xd6, 0xb1, 0xe3, 0xaa, 0xe8, 0xa6, 0xa4, 0x64, 0xa7, 0x80, 0x2, 0x93, 0xd5];
 
+/// T8122 C0, firmware-compat 26.6.2. Selection remains separate from runtime admission.
+pub(crate) static T8122_LAYOUT_26: Layout = Layout {
+    text_size: 393216,
+    data_size: 1228800,
+    vas: [0xffff_fc00_0000_0000, 0xffff_fc00_0006_0000],
+    entropy_tag_offset: 380492,
+    entropy_tag: *b"GKTS\x08\x00\x00\x00",
+    extra_boot_value: Some((380719, *b"ECAP\x08\x00\x00\x00")),
+    boot_table: Some((380492, 561)),
+    version: "RTKit-3255.160.4.release",
+};
+
 fn normalize_boot_entropy(layout: &Layout, text: &mut [u8]) -> bool {
-    let tag = layout.entropy_tag_offset;
     if text.len() != layout.text_size as usize {
         return false;
     }
-    let Some(end) = tag.checked_add(16) else { return false; };
-    let Some(entropy) = text.get_mut(tag..end) else { return false; };
-    if entropy[..8] != layout.entropy_tag {
-        return false;
+    if let Some((offset, count)) = layout.boot_table {
+        let Some(header) = text.get(0x22c..0x234) else {
+            return false;
+        };
+        if header[..4] != offset.to_le_bytes() || header[4..] != count.to_le_bytes() {
+            return false;
+        }
+        let Some(end) = (offset as usize).checked_add(count as usize) else {
+            return false;
+        };
+        if text.get(offset as usize..end).is_none() {
+            return false;
+        }
+    }
+    let fields = [
+        Some((layout.entropy_tag_offset, layout.entropy_tag)),
+        layout.extra_boot_value,
+    ];
+    // Validate every field before touching even the first boot value.
+    for (offset, tag) in fields.into_iter().flatten() {
+        let Some(end) = offset.checked_add(16) else {
+            return false;
+        };
+        let Some(field) = text.get(offset..end) else {
+            return false;
+        };
+        if field[..8] != tag {
+            return false;
+        }
+        if let Some((base, count)) = layout.boot_table {
+            if offset < base as usize || end > base as usize + count as usize {
+                return false;
+            }
+        }
+    }
+    if let Some((other, _)) = layout.extra_boot_value {
+        if other < layout.entropy_tag_offset + 16 && layout.entropy_tag_offset < other + 16 {
+            return false;
+        }
+    }
+    for (offset, _) in fields.into_iter().flatten() {
+        text[offset + 8..offset + 16].fill(0);
     }
-    entropy[8..].fill(0);
     true
 }
 
@@ -167,6 +236,14 @@ pub(crate) struct Firmware {
 }
 
 impl Firmware {
+    pub(crate) fn profile(&self) -> super::m3_profile::Profile {
+        if core::ptr::eq(self.layout, &T8122_LAYOUT_26) {
+            super::m3_profile::Profile::Extended
+        } else {
+            super::m3_profile::Profile::Legacy
+        }
+    }
+
     pub(crate) const fn version(&self) -> &'static str {
         self.layout.version
     }
@@ -393,4 +470,61 @@ mod tests {
         assert!(!normalize_boot_entropy(&layout, &mut text));
         assert_eq!(text, vec![0xa5; 15]);
     }
+
+    fn image_26() -> Vec<u8> {
+        let mut image = vec![0x5a; 393216];
+        image[0x22c..0x230].copy_from_slice(&380492u32.to_le_bytes());
+        image[0x230..0x234].copy_from_slice(&561u32.to_le_bytes());
+        image[380492..380500].copy_from_slice(b"GKTS\x08\x00\x00\x00");
+        image[380719..380727].copy_from_slice(b"ECAP\x08\x00\x00\x00");
+        image
+    }
+
+    #[test]
+    fn newer_image_masks_only_both_boot_values() {
+        let mut image = image_26();
+        let before = image.clone();
+        assert!(normalize_boot_entropy(&T8122_LAYOUT_26, &mut image));
+        for index in 0..image.len() {
+            let expected = if (380500..380508).contains(&index) || (380727..380735).contains(&index)
+            {
+                0
+            } else {
+                before[index]
+            };
+            assert_eq!(image[index], expected, "byte {index}");
+        }
+    }
+
+    #[test]
+    fn invalid_second_field_or_table_does_not_mask_first_value() {
+        for index in [0x22c, 0x230, 380492, 380496, 380719, 380723] {
+            let mut image = image_26();
+            image[index] ^= 1;
+            let before = image.clone();
+            assert!(!normalize_boot_entropy(&T8122_LAYOUT_26, &mut image));
+            assert_eq!(image, before);
+        }
+        let mut image = image_26();
+        image.pop();
+        let before = image.clone();
+        assert!(!normalize_boot_entropy(&T8122_LAYOUT_26, &mut image));
+        assert_eq!(image, before);
+    }
+
+    #[test]
+    fn extended_record_cannot_replace_legacy_identity() {
+        let newer = &T8122_IMAGES_26[0];
+        let digest = newer.stkg_sha256.unwrap();
+        assert!(newer.accepts_runtime(None, &digest));
+        assert_eq!(newer.initdata_magic, Some(0x0c89_c357_8392_04b8));
+        for index in 0..digest.len() {
+            let mut wrong = digest;
+            wrong[index] ^= 1;
+            assert!(!newer.accepts_runtime(None, &wrong));
+        }
+        assert!(!KNOWN_IMAGES_T8122[0].accepts_runtime(None, &digest));
+        assert!(!newer.accepts_runtime(KNOWN_IMAGES_T8122[0].uuid, &[0; 32]));
+    }
+
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_init_26.rs b/drivers/gpu/drm/asahi/m3/m3_init_26.rs
new file mode 100644
index 00000000000000..f08f16200b0700
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_init_26.rs
@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! Allocation and pointer records for the extended M3 initialization format.
+//! Owners supply mapped regions; these builders never allocate or publish DMA.
+
+use super::m3_init_layout::{Error, Region, Root};
+use super::m3_init_storage::{self as storage, Allocation, Initial};
+
+pub(crate) const COUNT: usize = 56;
+pub(crate) const DYNAMIC_STATE: usize = 49;
+pub(crate) const PERFORMANCE_CONTROL: usize = 50;
+pub(crate) const RECOVERY_ACTIVITY: usize = 51;
+pub(crate) const SENSOR_VALUE: usize = 52;
+pub(crate) const RETENTION_STATE: usize = 53;
+pub(crate) const GLOBAL_POOL: usize = 54;
+pub(crate) const GLOBAL_PARAMETERS: usize = 55;
+pub(crate) const RUNTIME_SIZE: usize = 0x4b8;
+pub(crate) const LOG_THREADS: usize = 9;
+pub(crate) const RX_BYTES: usize = 0x48;
+pub(crate) const LOG_PAYLOAD_BYTES: usize = 0xd8;
+
+/// Extend the existing M3 owner indices instead of introducing another owner graph.
+pub(crate) fn allocation(index: usize) -> Result<Allocation, Error> {
+    let size = match index {
+        0..=23 if index % 2 == 0 => 0x30,
+        0..=23 => 0x1800,
+        24 | 26 | 30 | 32 => 0x30,
+        25 => 0x4000,
+        27 | 33 => 0x4800,
+        28 => LOG_THREADS * 0x30,
+        29 => LOG_THREADS * 256 * RX_BYTES,
+        31 => 512 * RX_BYTES,
+        34 => 0x40,
+        35 => 0x3fc0,
+        36 => 0xc8,
+        37 => 0x4000,
+        38 => RUNTIME_SIZE,
+        39 => 0x2658,
+        40 => 0x88,
+        41 => LOG_THREADS * 256 * LOG_PAYLOAD_BYTES,
+        42 => 0xc18,
+        43 => 0x1248,
+        44 => 0xe10,
+        45 => 0xe48,
+        46 => 0x670,
+        47 => 0xeaf0,
+        48 => 0x20,
+        DYNAMIC_STATE | RETENTION_STATE | GLOBAL_POOL | GLOBAL_PARAMETERS => 0x4000,
+        PERFORMANCE_CONTROL => 0x6578,
+        RECOVERY_ACTIVITY => 0x60,
+        SENSOR_VALUE => 4,
+        _ => return Err(Error::Bounds),
+    };
+    // Separate page-aligned owners, with room for the largest receive allocation.
+    // This namespace is disjoint from the existing fixed work and timestamp arenas.
+    Ok(Allocation {
+        address: 0xffff_fc21_0000_0000 + (index as u64) * 0x10_0000,
+        size,
+        gpu_shared: matches!(index, GLOBAL_POOL | GLOBAL_PARAMETERS),
+        initial: Initial::Zero,
+    })
+}
+
+pub(crate) fn cached(index: usize) -> bool {
+    matches!(index, 38 | 39 | 42 | 43 | 44 | PERFORMANCE_CONTROL)
+}
+
+pub(crate) struct PointerGraph<'a> {
+    pub(crate) owners: &'a [Region; COUNT],
+    pub(crate) scratch: Region,
+    pub(crate) pool_alias: u64,
+    pub(crate) parameter_alias: u64,
+}
+
+impl PointerGraph<'_> {
+    /// Check the complete graph, including padded mapping ownership, before encoding it.
+    fn addresses(&self) -> Result<[u64; COUNT], Error> {
+        let mut addresses = [0; COUNT];
+        for (index, owner) in self.owners.iter().enumerate() {
+            let size = allocation(index)?.size;
+            addresses[index] = owner.at(0, size)?;
+            if addresses[index] & 0x3fff != 0
+                || addresses[index] < 0xffff_fc20_0000_0000
+                || addresses[index] >= 0xffff_fc2f_fc00_0000
+            {
+                return Err(Error::Address);
+            }
+            let mapped = (size + 0x3fff) & !0x3fff;
+            let end = addresses[index]
+                .checked_add(mapped as u64)
+                .ok_or(Error::Address)?;
+            if end > 0xffff_fc2f_fc00_0000 {
+                return Err(Error::Address);
+            }
+            for prior in 0..index {
+                let prior_size = (allocation(prior)?.size + 0x3fff) & !0x3fff;
+                if addresses[index] < addresses[prior] + prior_size as u64
+                    && addresses[prior] < addresses[index] + mapped as u64
+                {
+                    return Err(Error::Address);
+                }
+            }
+        }
+        let scratch = self.scratch.at(0, 0x8000)?;
+        let scratch_end = scratch.checked_add(0x8000).ok_or(Error::Address)?;
+        if scratch & 0x3fff != 0 || scratch_end > 0xffff_fc2f_fc00_0000 {
+            return Err(Error::Address);
+        }
+        for (index, address) in addresses.iter().enumerate() {
+            let bytes = (allocation(index)?.size + 0x3fff) & !0x3fff;
+            if scratch < *address + bytes as u64 && *address < scratch_end {
+                return Err(Error::Address);
+            }
+        }
+        for alias in [self.pool_alias, self.parameter_alias] {
+            if alias & 0x3fff != 0 || !(0x70_0000_0000..0x70_0200_0000).contains(&alias) {
+                return Err(Error::Address);
+            }
+        }
+        if self.pool_alias == self.parameter_alias {
+            return Err(Error::Address);
+        }
+        Ok(addresses)
+    }
+
+    pub(crate) fn root(&self, output: &mut [u8]) -> Result<(), Error> {
+        self.addresses()?;
+        Root {
+            region_a: self.owners[storage::REGION_A],
+            runtime: self.owners[storage::RUNTIME_POINTERS],
+            globals: self.owners[storage::GLOBALS],
+            new_a: self.owners[storage::RUNTIME_FLAGS],
+            control: self.owners[storage::CONTROL_REGION],
+            power: self.owners[storage::GLOBALS_POWER],
+        }
+        .encode_26(output, self.owners[DYNAMIC_STATE])
+    }
+
+    pub(crate) fn runtime(&self, output: &mut [u8]) -> Result<(), Error> {
+        let addresses = self.addresses()?;
+        let scratch = self.scratch.at(0, 0x8000)?;
+        let bytes = output.get_mut(..RUNTIME_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        let pointer = |bytes: &mut [u8], offset: usize, value: u64| {
+            bytes[offset..offset + 8].copy_from_slice(&value.to_le_bytes());
+        };
+        pointer(bytes, 0x18, scratch);
+        pointer(bytes, 0x2d0, self.parameter_alias);
+        pointer(bytes, 0x2e0, self.pool_alias);
+        bytes[0x250..0x254].copy_from_slice(&1u32.to_le_bytes());
+        bytes[0x2f8..0x2fc].copy_from_slice(&4u32.to_le_bytes());
+        for (offset, owner) in [
+            (0, storage::HARDWARE_DATA),
+            (0x10, storage::UNKNOWN_PAIR),
+            (0x1c0, 26),
+            (0x1c8, 27),
+            (0x1d0, 28),
+            (0x1d8, 29),
+            (0x1e0, 30),
+            (0x1e8, 31),
+            (0x1f0, 32),
+            (0x1f8, 33),
+            (0x200, storage::FWLOG_PAYLOAD),
+            (0x254, storage::UNKNOWN_C0),
+            (0x25c, storage::UNKNOWN_C1),
+            (0x264, storage::UNKNOWN_C3),
+            (0x26c, RECOVERY_ACTIVITY),
+            (0x2d8, GLOBAL_PARAMETERS),
+            (0x2e8, GLOBAL_POOL),
+            (0x469, PERFORMANCE_CONTROL),
+        ] {
+            pointer(bytes, offset, addresses[owner]);
+        }
+        for channel in 0..13 {
+            let offset = 0x20 + channel * 0x20;
+            let state = addresses[channel * 2];
+            pointer(bytes, offset, state);
+            pointer(bytes, offset + 8, state + 0x10);
+            pointer(bytes, offset + 16, state + 0x20);
+            pointer(bytes, offset + 24, addresses[channel * 2 + 1]);
+        }
+        Ok(())
+    }
+
+    pub(crate) fn firmware_control(&self, output: &mut [u8]) -> Result<(), Error> {
+        let addresses = self.addresses()?;
+        let bytes = output
+            .get_mut(..allocation(storage::CONTROL_REGION)?.size)
+            .ok_or(Error::Size)?;
+        bytes.fill(0);
+        bytes[0x4f88..0x4f90].copy_from_slice(&addresses[storage::FW_CONTROL_STATE].to_le_bytes());
+        bytes[0x4f90..0x4f98].copy_from_slice(&addresses[storage::FW_CONTROL_RING].to_le_bytes());
+        bytes[0x4fd4..0x4fd8].copy_from_slice(&1u32.to_le_bytes());
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn owners(delta: u64) -> [Region; COUNT] {
+        core::array::from_fn(|index| {
+            let item = allocation(index).unwrap();
+            Region::new(item.address + delta, item.size).unwrap()
+        })
+    }
+
+    fn graph(owners: &[Region; COUNT]) -> PointerGraph<'_> {
+        PointerGraph {
+            owners,
+            scratch: Region::new(0xffff_fc22_0000_0000, 0x8000).unwrap(),
+            pool_alias: 0x70_0000_0000,
+            parameter_alias: 0x70_0000_8000,
+        }
+    }
+
+    #[test]
+    fn complete_plan_has_disjoint_page_owners_and_nine_log_threads() {
+        let owners = owners(0);
+        assert!(graph(&owners).addresses().is_ok());
+        assert_eq!(allocation(28).unwrap().size, 0x1b0);
+        assert_eq!(allocation(29).unwrap().size, 0x28800);
+        assert_eq!(allocation(41).unwrap().size, 0x79800);
+        assert!(allocation(COUNT).is_err());
+    }
+
+    #[test]
+    fn runtime_references_relocate_and_keep_the_packed_power_pointer() {
+        for delta in [0, 0x1000_0000] {
+            let owners = owners(delta);
+            let mut output = [0xa5; RUNTIME_SIZE + 8];
+            graph(&owners).runtime(&mut output).unwrap();
+            let read = |at| u64::from_le_bytes(output[at..at + 8].try_into().unwrap());
+            assert_eq!(
+                read(0x469),
+                allocation(PERFORMANCE_CONTROL).unwrap().address + delta
+            );
+            assert_eq!(read(0x1a0), allocation(24).unwrap().address + delta);
+            assert_eq!(read(0x1b8), allocation(25).unwrap().address + delta);
+            assert_eq!(read(0x2d0), 0x70_0000_8000);
+            assert_eq!(&output[RUNTIME_SIZE..], &[0xa5; 8]);
+        }
+    }
+
+    #[test]
+    fn every_short_runtime_rejects_before_mutation() {
+        let owners = owners(0);
+        for length in 0..RUNTIME_SIZE {
+            let mut output = [0xa5; RUNTIME_SIZE];
+            assert_eq!(
+                graph(&owners).runtime(&mut output[..length]),
+                Err(Error::Size)
+            );
+            assert_eq!(output, [0xa5; RUNTIME_SIZE]);
+        }
+    }
+
+    #[test]
+    fn every_owner_is_checked_before_any_record_is_written() {
+        for index in 0..COUNT {
+            let mut owners = owners(0);
+            let item = allocation(index).unwrap();
+            owners[index] = Region::new(item.address, item.size - 1).unwrap();
+            let mut output = [0xa5; RUNTIME_SIZE];
+            assert!(graph(&owners).runtime(&mut output).is_err());
+            assert_eq!(output, [0xa5; RUNTIME_SIZE]);
+        }
+        let mut owners = owners(0);
+        owners[1] = owners[0];
+        let mut output = [0xa5; RUNTIME_SIZE];
+        assert!(graph(&owners).runtime(&mut output).is_err());
+        assert_eq!(output, [0xa5; RUNTIME_SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_init_layout.rs b/drivers/gpu/drm/asahi/m3/m3_init_layout.rs
index 92cc818e030ccb..75f06abe6f4110 100644
--- a/drivers/gpu/drm/asahi/m3/m3_init_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_init_layout.rs
@@ -78,13 +78,38 @@ impl Root {
             (root::CONTROL, self.control.at(0, CONTROL_SIZE)?),
             (root::POWER, self.power.at(0, 2292)?),
         ];
-        let bytes = out.get_mut(..ROOT_SIZE).ok_or(Error::Size)?;
+        Self::write_root(out, ROOT_SIZE, 0x0c08_e21e_8380_0490, &references)
+    }
+
+    /// Encode the extended root without admitting a firmware image or publishing it.
+    pub(crate) fn encode_26(&self, out: &mut [u8], extra: Region) -> Result<(), Error> {
+        let references = [
+            (root::REGION_A, self.region_a.at(0, 0x4000)?),
+            (root::RUNTIME, self.runtime.at(0, 0x4b8)?),
+            (root::GLOBALS, self.globals.at(0, 0xe48)?),
+            (root::NEW_A, self.new_a.at(0, 0x20)?),
+            (root::CONTROL, self.control.at(0, 0xeaf0)?),
+            (root::POWER, self.power.at(0, 0x670)?),
+            (0xc0, extra.at(0, 0x4000)?),
+        ];
+        if references.iter().any(|(_, address)| address & 7 != 0) {
+            return Err(Error::Address);
+        }
+        Self::write_root(out, 0xc8, 0x0c89_c357_8392_04b8, &references)
+    }
+
+    fn write_root(
+        out: &mut [u8],
+        size: usize,
+        version: u64,
+        references: &[(usize, u64)],
+    ) -> Result<(), Error> {
+        let bytes = out.get_mut(..size).ok_or(Error::Size)?;
         bytes.fill(0);
-        // Opaque qualified G15/V14_8_3 version tuple, not a semantic version.
-        for (i, value) in [0x490u16, 0x8380, 0xe21e, 0xc08].iter().enumerate() {
-            bytes[root::VERSION + i * 2..root::VERSION + i * 2 + 2].copy_from_slice(&value.to_le_bytes());
+        pointer(bytes, root::VERSION, version);
+        for &(offset, value) in references {
+            pointer(bytes, offset, value);
         }
-        for (offset, value) in references { pointer(bytes, offset, value); }
         word(bytes, root::HOST_ALLOCATIONS, 1);
         bytes[root::PAGE_SIZE..root::PAGE_SIZE + 2].copy_from_slice(&0x4000u16.to_le_bytes());
         bytes[root::PAGE_BITS] = 14;
@@ -193,3 +218,107 @@ impl ControlRegion {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod root_format_tests {
+    use super::*;
+
+    fn allocations() -> (Root, Region) {
+        let region =
+            |index: u64| Region::new(0xffff_fc01_0000_0000 + index * 0x10000, 0x10000).unwrap();
+        (
+            Root {
+                region_a: region(1),
+                runtime: region(2),
+                globals: region(3),
+                new_a: region(4),
+                control: region(5),
+                power: region(6),
+            },
+            region(7),
+        )
+    }
+
+    #[test]
+    fn root_revision_changes_only_the_version_and_extension() {
+        let (root, extra) = allocations();
+        let mut older = [0x55; 0xd0];
+        let mut newer = older;
+        root.encode(&mut older).unwrap();
+        root.encode_26(&mut newer, extra).unwrap();
+        assert_eq!(&older[8..0xc0], &newer[8..0xc0]);
+        assert_eq!(
+            u64::from_le_bytes(newer[..8].try_into().unwrap()),
+            0x0c89_c357_8392_04b8
+        );
+        assert_eq!(
+            u64::from_le_bytes(newer[0xc0..0xc8].try_into().unwrap()),
+            0xffff_fc01_0007_0000
+        );
+        assert_eq!(&older[0xc0..], &[0x55; 16]);
+        assert_eq!(&newer[0xc8..], &[0x55; 8]);
+        for (offset, index) in [
+            (8, 1),
+            (0x18, 2),
+            (0x20, 3),
+            (0xa8, 4),
+            (0xb0, 5),
+            (0xb8, 6),
+        ] {
+            assert_eq!(
+                u64::from_le_bytes(newer[offset..offset + 8].try_into().unwrap()),
+                0xffff_fc01_0000_0000 + index * 0x10000
+            );
+        }
+    }
+
+    #[test]
+    fn every_short_destination_is_unchanged() {
+        let (root, extra) = allocations();
+        for length in 0..0xc8 {
+            let mut output = [0xa5; 0xc8];
+            assert_eq!(
+                root.encode_26(&mut output[..length], extra),
+                Err(Error::Size)
+            );
+            assert_eq!(output, [0xa5; 0xc8]);
+        }
+    }
+
+    #[test]
+    fn every_reference_requires_its_own_complete_allocation() {
+        for (index, required) in [0x4000, 0x4b8, 0xe48, 0x20, 0xeaf0, 0x670, 0x4000]
+            .into_iter()
+            .enumerate()
+        {
+            for (size, aligned, valid) in [
+                (required - 1, true, false),
+                (required, false, false),
+                (required, true, true),
+            ] {
+                let (mut root, mut extra) = allocations();
+                let reference = match index {
+                    0 => &mut root.region_a,
+                    1 => &mut root.runtime,
+                    2 => &mut root.globals,
+                    3 => &mut root.new_a,
+                    4 => &mut root.control,
+                    5 => &mut root.power,
+                    _ => &mut extra,
+                };
+                *reference =
+                    Region::new(0xffff_fc02_0000_0000 + u64::from(!aligned), size).unwrap();
+                let mut output = [0xa5; 0xc8];
+                let result = root.encode_26(&mut output, extra);
+                assert_eq!(
+                    result.is_ok(),
+                    valid,
+                    "reference {index}, size {size}, aligned {aligned}"
+                );
+                if !valid {
+                    assert_eq!(output, [0xa5; 0xc8]);
+                }
+            }
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs b/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
new file mode 100644
index 00000000000000..e4008f239c4a0d
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
@@ -0,0 +1,265 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! T8122 firmware MMIO descriptors. Mapping ownership stays with the M3 runtime.
+
+use super::m3_init_layout::{Error, Region};
+
+pub(crate) const SLOTS: usize = 53;
+pub(crate) const RECORD_BYTES: usize = 40;
+pub(crate) const TABLE_OFFSET: usize = 0x640;
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Area {
+    pub(crate) physical: u64,
+    pub(crate) bytes: usize,
+    relative_register: u64,
+    writable: bool,
+    split: bool,
+}
+
+impl Area {
+    pub(crate) fn page_offset(self) -> usize {
+        (self.physical & 0x3fff) as usize
+    }
+
+    pub(crate) fn mapped_bytes(self) -> usize {
+        (self.page_offset() + self.bytes + 0x3fff) & !0x3fff
+    }
+
+    /// At most two physical banks; the second bank occupies the next virtual pages.
+    pub(crate) fn banks(self) -> [(u64, usize, usize); 2] {
+        if self.split {
+            [
+                (self.physical, self.bytes / 2, 0),
+                (self.physical + 0x200_0000, self.bytes / 2, self.bytes / 2),
+            ]
+        } else {
+            [(self.physical & !0x3fff, self.mapped_bytes(), 0), (0, 0, 0)]
+        }
+    }
+}
+
+/// Register resources obtained from the admitted T8122 hardware configuration.
+/// Their physical addresses are supplied by the owner, not duplicated in a wire table.
+#[derive(Clone, Copy)]
+pub(crate) struct RegisterBases {
+    pub(crate) gpu: u64,
+    pub(crate) interrupt: u64,
+    pub(crate) memory: u64,
+    pub(crate) telemetry_write: u64,
+    pub(crate) telemetry_read: u64,
+    pub(crate) neural: u64,
+    pub(crate) metrology: u64,
+}
+
+/// Select the wire slot and map its logical hardware block independently of its VA.
+pub(crate) fn area(slot: usize, bases: RegisterBases) -> Result<Option<Area>, Error> {
+    let (base, offset, bytes, tagged, writable, split) = match slot {
+        0 => (bases.interrupt, 0, 0x4000, false, true, false),
+        3 => (bases.memory, 0, 0x30000, false, true, true),
+        9 => (bases.telemetry_write, 0, 0x1000, false, true, false),
+        10 => (bases.telemetry_read, 0, 0x2000, false, false, false),
+        12 => (bases.neural, 0, 0x4000, false, true, false),
+        14 => (bases.metrology, 0, 0x8000, false, false, false),
+        17 => (bases.gpu, 0, 0x20000, false, true, false),
+        26 => (bases.gpu, 0xd04000, 0x8000, true, true, false),
+        27 => (bases.gpu, 0xd0d000, 0x1000, true, true, false),
+        28 => (bases.gpu, 0xd50000, 0x8000, true, true, false),
+        29 => (bases.gpu, 0xd10000, 0x4000, true, true, false),
+        31 => (bases.gpu, 0xd40000, 0x4000, true, true, false),
+        32 => (bases.gpu, 0xd60000, 0x8000, true, true, false),
+        35 => (bases.gpu, 0xe00000, 0x4000, true, true, false),
+        39 => (bases.gpu, 0xe08000, 0x8000, false, true, false),
+        40 => (bases.gpu, 0xe1c000, 0x4000, true, true, false),
+        0..SLOTS => return Ok(None),
+        _ => return Err(Error::Bounds),
+    };
+    let physical = base.checked_add(offset).ok_or(Error::Address)?;
+    if physical == 0 || physical.checked_add(bytes as u64).ok_or(Error::Address)? > 1 << 42 {
+        return Err(Error::Address);
+    }
+    Ok(Some(Area {
+        physical,
+        bytes,
+        relative_register: if tagged { offset } else { 0 },
+        writable,
+        split,
+    }))
+}
+
+fn empty_mode(slot: usize) -> u64 {
+    if matches!(slot, 2 | 5..=8 | 30 | 33 | 34 | 37 | 38 | 41..=43 | 46..=49 | 52) {
+        2
+    } else {
+        0
+    }
+}
+
+/// Encode a complete record after checking the owned mapping; errors preserve all output.
+pub(crate) fn encode(
+    slot: usize,
+    bases: RegisterBases,
+    mapping: Option<Region>,
+    output: &mut [u8],
+) -> Result<(), Error> {
+    let descriptor = area(slot, bases)?;
+    let (physical, va, bytes, requested, register, mode) = match (descriptor, mapping) {
+        (None, None) => (0, 0, 0, 0, 0, empty_mode(slot)),
+        (Some(item), Some(mapping)) => {
+            let page = mapping.at(0, item.mapped_bytes())?;
+            if page & 0x3fff != 0 {
+                return Err(Error::Address);
+            }
+            let va = page
+                .checked_add(item.page_offset() as u64)
+                .ok_or(Error::Address)?;
+            (
+                item.physical,
+                va,
+                item.bytes as u32,
+                if item.split {
+                    (item.bytes / 2) as u32
+                } else {
+                    item.bytes as u32
+                },
+                item.relative_register,
+                if item.writable { 2 } else { 0 },
+            )
+        }
+        _ => return Err(Error::Address),
+    };
+    let bytes_out = output.get_mut(..RECORD_BYTES).ok_or(Error::Size)?;
+    bytes_out.fill(0);
+    bytes_out[0..8].copy_from_slice(&physical.to_le_bytes());
+    bytes_out[8..16].copy_from_slice(&va.to_le_bytes());
+    bytes_out[16..20].copy_from_slice(&bytes.to_le_bytes());
+    bytes_out[20..24].copy_from_slice(&requested.to_le_bytes());
+    bytes_out[24..32].copy_from_slice(&register.to_le_bytes());
+    bytes_out[32..40].copy_from_slice(&mode.to_le_bytes());
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Register identities already present in the public T8122 configuration;
+    // memory-controller bank geometry is shared with the public 25G83 encoder.
+    const BASES: RegisterBases = RegisterBases {
+        gpu: 0x2_9000_0000,
+        interrupt: 0x2_d101_4000,
+        memory: 0x2_201c_4000,
+        telemetry_write: 0x2_d03d_0000,
+        telemetry_read: 0x2_d03c_0000,
+        neural: 0x3_1145_c000,
+        metrology: 0x2_d028_0000,
+    };
+
+    #[test]
+    fn j613_slot28_bank_and_wire_tag_agree() {
+        let bank = area(28, BASES).unwrap().unwrap();
+        assert_eq!(bank.physical, BASES.gpu + 0xd50000);
+        assert_eq!(bank.bytes, 0x8000);
+        let mapped = Region::new(0xffff_fc23_01c0_0000, 0x8000).unwrap();
+        let mut bytes = [0; RECORD_BYTES];
+        encode(28, BASES, Some(mapped), &mut bytes).unwrap();
+        assert_eq!(&bytes[0..8], &(BASES.gpu + 0xd50000).to_le_bytes());
+        assert_eq!(&bytes[24..32], &0xd50000u64.to_le_bytes());
+        assert_ne!(bank.physical, BASES.gpu + 0xd58000);
+    }
+
+    #[test]
+    fn descriptor_inventory_ends_before_the_retention_pointer() {
+        assert_eq!(TABLE_OFFSET + SLOTS * RECORD_BYTES, 0xe88);
+        assert_eq!(
+            (0..SLOTS)
+                .filter(|slot| area(*slot, BASES).unwrap().is_some())
+                .count(),
+            16
+        );
+        assert!(area(SLOTS, BASES).is_err());
+    }
+
+    #[test]
+    fn discontiguous_memory_controller_banks_have_distinct_physical_owners() {
+        let item = area(3, BASES).unwrap().unwrap();
+        assert_eq!(
+            item.banks(),
+            [
+                (0x2_201c_4000, 0x18000, 0),
+                (0x2_221c_4000, 0x18000, 0x18000)
+            ]
+        );
+        let mapping = Region::new(0xffff_fc23_0000_0000, 0x30000).unwrap();
+        let mut bytes = [0xa5; RECORD_BYTES];
+        encode(3, BASES, Some(mapping), &mut bytes).unwrap();
+        assert_eq!(
+            u32::from_le_bytes(bytes[16..20].try_into().unwrap()),
+            0x30000
+        );
+        assert_eq!(
+            u32::from_le_bytes(bytes[20..24].try_into().unwrap()),
+            0x18000
+        );
+    }
+
+    #[test]
+    fn subpage_mapping_keeps_the_register_offset() {
+        let item = area(27, BASES).unwrap().unwrap();
+        assert_eq!(item.page_offset(), 0x1000);
+        assert_eq!(item.banks()[0], (0x2_90d0_c000, 0x4000, 0));
+        let mut output = [0xa5; RECORD_BYTES + 8];
+        encode(
+            27,
+            BASES,
+            Some(Region::new(0xffff_fc23_0000_0000, 0x4000).unwrap()),
+            &mut output,
+        )
+        .unwrap();
+        assert_eq!(
+            u64::from_le_bytes(output[8..16].try_into().unwrap()),
+            0xffff_fc23_0000_1000
+        );
+        assert_eq!(&output[RECORD_BYTES..], &[0xa5; 8]);
+    }
+
+    #[test]
+    fn empty_slots_keep_modes_without_fabricating_mappings() {
+        for slot in 0..SLOTS {
+            if area(slot, BASES).unwrap().is_some() {
+                continue;
+            }
+            let mut output = [0xa5; RECORD_BYTES];
+            encode(slot, BASES, None, &mut output).unwrap();
+            assert_eq!(&output[..32], &[0; 32]);
+            assert_eq!(
+                u64::from_le_bytes(output[32..40].try_into().unwrap()),
+                empty_mode(slot)
+            );
+        }
+    }
+
+    #[test]
+    fn invalid_mapping_or_output_never_partially_changes_a_descriptor() {
+        let good = Region::new(0xffff_fc23_0000_0000, 0x4000).unwrap();
+        for (slot, mapping) in [
+            (SLOTS, None),
+            (0, None),
+            (1, Some(good)),
+            (0, Some(Region::new(0xffff_fc23_0000_0001, 0x4000).unwrap())),
+            (0, Some(Region::new(0xffff_fc23_0000_0000, 0x3fff).unwrap())),
+        ] {
+            let mut output = [0xa5; RECORD_BYTES];
+            assert!(encode(slot, BASES, mapping, &mut output).is_err());
+            assert_eq!(output, [0xa5; RECORD_BYTES]);
+        }
+        for length in 0..RECORD_BYTES {
+            let mut output = [0xa5; RECORD_BYTES];
+            assert_eq!(
+                encode(0, BASES, Some(good), &mut output[..length]),
+                Err(Error::Size)
+            );
+            assert_eq!(output, [0xa5; RECORD_BYTES]);
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_profile.rs b/drivers/gpu/drm/asahi/m3/m3_profile.rs
new file mode 100644
index 00000000000000..c70a88029072b6
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_profile.rs
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! Firmware-interface properties, independent of the physical G15 GPU record format.
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Profile {
+    Legacy,
+    Extended,
+}
+
+pub(crate) const PARAMS_REQUIRED: u64 = 600;
+
+impl Profile {
+    pub(crate) const fn firmware_compat(self) -> [u32; 3] {
+        match self {
+            Self::Legacy => [14, 8, 3],
+            Self::Extended => [26, 6, 2],
+        }
+    }
+
+    pub(crate) const fn hal(self) -> u32 {
+        match self {
+            Self::Legacy => 0,
+            Self::Extended => 200,
+        }
+    }
+
+    pub(crate) const fn user_end(self) -> u64 {
+        match self {
+            Self::Legacy => 0x2ff_ffff_8000,
+            Self::Extended => (1 << 42) - 2 * 0x4000,
+        }
+    }
+
+    pub(crate) const fn vm_acknowledged(self, params_bytes: u64, flags: u32) -> bool {
+        // Both profiles consume G15 records; the existing VM padding stays zero.
+        params_bytes >= PARAMS_REQUIRED && flags == 0
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn profile_acknowledgement_is_exact_and_file_query_covers_hal() {
+        for profile in [Profile::Legacy, Profile::Extended] {
+            let expected = 0;
+            for size in [0, 599, 600, 616, u64::MAX] {
+                for flags in [0, 1, 2, 3, u32::MAX] {
+                    assert_eq!(
+                        profile.vm_acknowledged(size, flags),
+                        size >= 600 && flags == expected
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn firmware_interface_version_does_not_change_physical_identity() {
+        assert_eq!(Profile::Legacy.hal(), 0);
+        assert_eq!(Profile::Extended.hal(), 200);
+        assert_eq!(Profile::Legacy.firmware_compat(), [14, 8, 3]);
+        assert_eq!(Profile::Extended.firmware_compat(), [26, 6, 2]);
+        assert_eq!(Profile::Extended.user_end(), 0x3ff_ffff_8000);
+        assert_eq!(Profile::Legacy.user_end(), 0x2ff_ffff_8000);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/mod.rs b/drivers/gpu/drm/asahi/m3/mod.rs
index 1d10657c02f662..7073ecf294d631 100644
--- a/drivers/gpu/drm/asahi/m3/mod.rs
+++ b/drivers/gpu/drm/asahi/m3/mod.rs
@@ -198,3 +198,7 @@ mod t8122_admission;
 pub(crate) mod m3_soc;
 
 mod t8122_hwdata;
+
+mod m3_init_26;
+mod m3_profile;
+mod m3_mmio_26;
diff --git a/drivers/gpu/drm/asahi/m3/t8122_admission.rs b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
index 7505065810acc3..c66ccb72cd18d7 100644
--- a/drivers/gpu/drm/asahi/m3/t8122_admission.rs
+++ b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
@@ -2,6 +2,8 @@
 
 //! Read-only T8122 identity admission. Firmware startup remains disabled.
 
+use super::m3_profile::Profile;
+
 #[derive(Debug, Copy, Clone, PartialEq, Eq)]
 pub(crate) struct Identity {
     pub(crate) active_cores: u32,
@@ -16,12 +18,23 @@ pub(crate) fn validate_identity(
     result: u32,
     id_version: u32,
     masks: [u32; 3],
+) -> Option<Identity> {
+    validate_identity_for(Profile::Legacy, firmware_compat, schema, result, id_version, masks)
+}
+
+pub(crate) fn validate_identity_for(
+    profile: Profile,
+    firmware_compat: &[u32],
+    schema: u32,
+    result: u32,
+    id_version: u32,
+    masks: [u32; 3],
 ) -> Option<Identity> {
     let family = id_version >> 24;
     let variant = (id_version >> 16) & 0xff;
     let revision = (id_version >> 8) & 0xff;
     let active_cores = masks[0].count_ones();
-    if firmware_compat != [14, 8, 3]
+    if firmware_compat != profile.firmware_compat()
         || schema != 1
         || result != 1
         || family != 7
@@ -94,6 +107,14 @@ pub(crate) fn opp_table_shape(opps: impl IntoIterator<Item = (u64, u32)>) -> Opt
 #[cfg(not(test))]
 pub(crate) fn read_identity(
     pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
+) -> kernel::error::Result<Identity> {
+    read_identity_for(pdev, Profile::Legacy)
+}
+
+#[cfg(not(test))]
+pub(crate) fn read_identity_for(
+    pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
+    profile: Profile,
 ) -> kernel::error::Result<Identity> {
     use kernel::{bindings, c_str, prelude::*};
 
@@ -146,7 +167,8 @@ pub(crate) fn read_identity(
         observation.get_u32(c_str!("core-mask-1"))?,
         observation.get_u32(c_str!("core-mask-2"))?,
     ];
-    validate_identity(firmware_compat.as_slice(), schema, result, id_version, masks).ok_or(ENODEV)
+    validate_identity_for(profile, firmware_compat.as_slice(), schema, result, id_version, masks)
+        .ok_or(ENODEV)
 }
 
 #[cfg(test)]
@@ -164,6 +186,29 @@ mod tests {
         }
     }
 
+    #[test]
+    fn extended_identity_requires_its_actual_version_and_the_same_g15g_bounds() {
+        for mask in [0xff, 0x3ff] {
+            let good = || validate_identity_for(Profile::Extended, &[26, 6, 2], 1, 1, G15G_C0, [mask, 0, 0]);
+            assert_eq!(good().unwrap().active_cores, mask.count_ones());
+            assert!(validate_identity(&[26, 6, 2], 1, 1, G15G_C0, [mask, 0, 0]).is_none());
+            assert!(validate_identity_for(Profile::Extended, &[14, 8, 3], 1, 1, G15G_C0, [mask, 0, 0]).is_none());
+        }
+        for (schema, result, id, masks) in [
+            (0, 1, G15G_C0, [0xff, 0, 0]),
+            (1, 0, G15G_C0, [0xff, 0, 0]),
+            (1, 1, G15G_C0 ^ (1 << 24), [0xff, 0, 0]),
+            (1, 1, G15G_C0 ^ (1 << 16), [0xff, 0, 0]),
+            (1, 1, G15G_C0 ^ (1 << 8), [0xff, 0, 0]),
+            (1, 1, G15G_C0, [0x1ff, 0, 0]),
+            (1, 1, G15G_C0, [0x7ff, 0, 0]),
+            (1, 1, G15G_C0, [0xff, 1, 0]),
+            (1, 1, G15G_C0, [0xff, 0, 1]),
+        ] {
+            assert!(validate_identity_for(Profile::Extended, &[26, 6, 2], schema, result, id, masks).is_none());
+        }
+    }
+
     /// The booted J613 ladder (`perf-states`, frequency then millivolts), in ADT order: fourteen
     /// states, eight voltages above the idle one, 1338 MHz at the top.
     const J613_PERF_STATES: [(u64, u32); 14] = [
diff --git a/tools/asahi/m3-firmware-tests.rs b/tools/asahi/m3-firmware-tests.rs
new file mode 100644
index 00000000000000..90539441d623ed
--- /dev/null
+++ b/tools/asahi/m3-firmware-tests.rs
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+//! Host tests of production firmware identity and normalization.
+#![allow(dead_code)]
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_profile.rs"]
+pub(crate) mod m3_profile;
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_resources.rs"]
+pub(crate) mod resources;
+mod m3 {
+    pub(crate) use crate::firmware as m3_firmware;
+    pub(crate) use crate::m3_profile;
+    pub(crate) use crate::resources as m3_resources;
+}
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_firmware.rs"]
+pub(crate) mod firmware;
diff --git a/tools/asahi/m3-runtime-tests.rs b/tools/asahi/m3-runtime-tests.rs
index fd4dc90489e817..f1768a242147b6 100644
--- a/tools/asahi/m3-runtime-tests.rs
+++ b/tools/asahi/m3-runtime-tests.rs
@@ -15,3 +15,12 @@ mod m3_init_storage;
 mod m3_thermal_policy;
 #[path = "../../drivers/gpu/drm/asahi/m3/t8122_hwdata.rs"]
 mod t8122_hwdata;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_init_26.rs"]
+mod m3_init_26;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_profile.rs"]
+mod m3_profile;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_mmio_26.rs"]
+mod m3_mmio_26;
diff --git a/tools/asahi/m3-uapi-fixture.c b/tools/asahi/m3-uapi-fixture.c
new file mode 100644
index 00000000000000..9ee09940960093
--- /dev/null
+++ b/tools/asahi/m3-uapi-fixture.c
@@ -0,0 +1,363 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+#include <assert.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <string.h>
+
+#ifndef ASAHI_HEADER
+#define ASAHI_HEADER "drm/asahi_drm.h"
+#endif
+#include ASAHI_HEADER
+
+static_assert(sizeof(struct drm_asahi_cmd_header) == 8, "command header");
+static_assert(sizeof(struct drm_asahi_attachment) == 24, "attachment");
+static_assert(sizeof(struct drm_asahi_timestamps) == 16, "timestamps");
+static_assert(offsetof(struct drm_asahi_cmd_compute, ts_end_copies) == 64,
+	      "compute prefix");
+static_assert(offsetof(struct drm_asahi_cmd_render, ts_frag_end_copies) == 256,
+	      "render prefix");
+
+static int emit(unsigned int type, const void *payload, size_t size)
+{
+	struct drm_asahi_cmd_header header = {
+		.cmd_type = type,
+		.size = size,
+		.vdm_barrier = DRM_ASAHI_BARRIER_NONE,
+		.cdm_barrier = DRM_ASAHI_BARRIER_NONE,
+	};
+
+	return fwrite(&header, sizeof(header), 1, stdout) != 1 ||
+	       fwrite(payload, size, 1, stdout) != 1;
+}
+
+/* Named C offsets are exported independently of the Rust decoder. */
+static void layout(void)
+{
+	printf("profile.params_required %zu 0\n",
+	       offsetof(struct drm_asahi_params_global, gpu_hal_generation) + sizeof(__u32));
+	printf("profile.vm_create_size %zu 0\n", sizeof(struct drm_asahi_vm_create));
+	printf("profile.hal200 %u 0\n", (unsigned int)DRM_ASAHI_GPU_HAL_200);
+	printf("profile.features %u 0\n",
+	       DRM_ASAHI_FEATURE_VM_STATUS | DRM_ASAHI_FEATURE_SCHEDULED_QUEUES);
+	printf("header %zu 0\n", sizeof(struct drm_asahi_cmd_header));
+	printf("attachment %zu 0\n", sizeof(struct drm_asahi_attachment));
+	printf("timestamps %zu 0\n", sizeof(struct drm_asahi_timestamps));
+	printf("cmd_render.flags %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, flags),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->flags));
+	printf("cmd_render.isp_zls_pixels %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_zls_pixels),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_zls_pixels));
+	printf("cmd_render.vdm_ctrl_stream_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, vdm_ctrl_stream_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->vdm_ctrl_stream_base));
+	printf("cmd_render.vertex_helper.binary %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, vertex_helper.binary),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->vertex_helper.binary));
+	printf("cmd_render.vertex_helper.cfg %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, vertex_helper.cfg),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->vertex_helper.cfg));
+	printf("cmd_render.vertex_helper.data %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, vertex_helper.data),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->vertex_helper.data));
+	printf("cmd_render.fragment_helper.binary %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, fragment_helper.binary),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->fragment_helper.binary));
+	printf("cmd_render.fragment_helper.cfg %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, fragment_helper.cfg),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->fragment_helper.cfg));
+	printf("cmd_render.fragment_helper.data %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, fragment_helper.data),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->fragment_helper.data));
+	printf("cmd_render.isp_scissor_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_scissor_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_scissor_base));
+	printf("cmd_render.isp_dbias_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_dbias_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_dbias_base));
+	printf("cmd_render.isp_oclqry_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_oclqry_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_oclqry_base));
+	printf("cmd_render.depth.base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, depth.base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->depth.base));
+	printf("cmd_render.depth.comp_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, depth.comp_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->depth.comp_base));
+	printf("cmd_render.depth.stride %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, depth.stride),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->depth.stride));
+	printf("cmd_render.depth.comp_stride %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, depth.comp_stride),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->depth.comp_stride));
+	printf("cmd_render.stencil.base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, stencil.base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->stencil.base));
+	printf("cmd_render.stencil.comp_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, stencil.comp_base),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->stencil.comp_base));
+	printf("cmd_render.stencil.stride %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, stencil.stride),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->stencil.stride));
+	printf("cmd_render.stencil.comp_stride %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, stencil.comp_stride),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->stencil.comp_stride));
+	printf("cmd_render.zls_ctrl %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, zls_ctrl),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->zls_ctrl));
+	printf("cmd_render.ppp_multisamplectl %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ppp_multisamplectl),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ppp_multisamplectl));
+	printf("cmd_render.sampler_heap %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, sampler_heap),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->sampler_heap));
+	printf("cmd_render.ppp_ctrl %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ppp_ctrl),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ppp_ctrl));
+	printf("cmd_render.width_px %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, width_px),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->width_px));
+	printf("cmd_render.height_px %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, height_px),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->height_px));
+	printf("cmd_render.layers %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, layers),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->layers));
+	printf("cmd_render.sampler_count %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, sampler_count),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->sampler_count));
+	printf("cmd_render.utile_width_px %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, utile_width_px),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->utile_width_px));
+	printf("cmd_render.utile_height_px %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, utile_height_px),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->utile_height_px));
+	printf("cmd_render.samples %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, samples),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->samples));
+	printf("cmd_render.sample_size_B %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, sample_size_B),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->sample_size_B));
+	printf("cmd_render.isp_merge_upper_x %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_merge_upper_x),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_merge_upper_x));
+	printf("cmd_render.isp_merge_upper_y %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_merge_upper_y),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_merge_upper_y));
+	printf("cmd_render.bg.usc %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg.usc),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg.usc));
+	printf("cmd_render.bg.rsrc_spec %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg.rsrc_spec),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg.rsrc_spec));
+	printf("cmd_render.bg_rsrc_spec_hi %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg_rsrc_spec_hi),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg_rsrc_spec_hi));
+	printf("cmd_render.eot.usc %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, eot.usc),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->eot.usc));
+	printf("cmd_render.eot.rsrc_spec %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, eot.rsrc_spec),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->eot.rsrc_spec));
+	printf("cmd_render.bg_eot_rsrc_spec_hi %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg_eot_rsrc_spec_hi),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg_eot_rsrc_spec_hi));
+	printf("cmd_render.partial_bg.usc %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, partial_bg.usc),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->partial_bg.usc));
+	printf("cmd_render.partial_bg.rsrc_spec %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, partial_bg.rsrc_spec),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->partial_bg.rsrc_spec));
+	printf("cmd_render.bg_partial_rsrc_spec_hi %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg_partial_rsrc_spec_hi),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg_partial_rsrc_spec_hi));
+	printf("cmd_render.partial_eot.usc %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, partial_eot.usc),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->partial_eot.usc));
+	printf("cmd_render.partial_eot.rsrc_spec %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, partial_eot.rsrc_spec),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->partial_eot.rsrc_spec));
+	printf("cmd_render.bg_eot_partial_rsrc_spec_hi %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, bg_eot_partial_rsrc_spec_hi),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->bg_eot_partial_rsrc_spec_hi));
+	printf("cmd_render.isp_bgobjdepth %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_bgobjdepth),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_bgobjdepth));
+	printf("cmd_render.isp_bgobjvals %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, isp_bgobjvals),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->isp_bgobjvals));
+	printf("cmd_render.ts_vtx.start.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_vtx.start.handle),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_vtx.start.handle));
+	printf("cmd_render.ts_vtx.start.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_vtx.start.offset),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_vtx.start.offset));
+	printf("cmd_render.ts_vtx.end.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_vtx.end.handle),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_vtx.end.handle));
+	printf("cmd_render.ts_vtx.end.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_vtx.end.offset),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_vtx.end.offset));
+	printf("cmd_render.ts_frag.start.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag.start.handle),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag.start.handle));
+	printf("cmd_render.ts_frag.start.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag.start.offset),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag.start.offset));
+	printf("cmd_render.ts_frag.end.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag.end.handle),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag.end.handle));
+	printf("cmd_render.ts_frag.end.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag.end.offset),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag.end.offset));
+	printf("cmd_compute.flags %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, flags),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->flags));
+	printf("cmd_compute.sampler_count %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, sampler_count),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->sampler_count));
+	printf("cmd_compute.cdm_ctrl_stream_base %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, cdm_ctrl_stream_base),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->cdm_ctrl_stream_base));
+	printf("cmd_compute.cdm_ctrl_stream_end %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, cdm_ctrl_stream_end),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->cdm_ctrl_stream_end));
+	printf("cmd_compute.sampler_heap %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, sampler_heap),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->sampler_heap));
+	printf("cmd_compute.helper.binary %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, helper.binary),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->helper.binary));
+	printf("cmd_compute.helper.cfg %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, helper.cfg),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->helper.cfg));
+	printf("cmd_compute.helper.data %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, helper.data),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->helper.data));
+	printf("cmd_compute.ts.start.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts.start.handle),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts.start.handle));
+	printf("cmd_compute.ts.start.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts.start.offset),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts.start.offset));
+	printf("cmd_compute.ts.end.handle %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts.end.handle),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts.end.handle));
+	printf("cmd_compute.ts.end.offset %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts.end.offset),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts.end.offset));
+	printf("attachment.pointer %zu %zu\n",
+	       offsetof(struct drm_asahi_attachment, pointer),
+	       sizeof(((struct drm_asahi_attachment *)0)->pointer));
+	printf("attachment.size %zu %zu\n",
+	       offsetof(struct drm_asahi_attachment, size),
+	       sizeof(((struct drm_asahi_attachment *)0)->size));
+	printf("cmd_render.ts_frag_end_copies %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_render, ts_frag_end_copies),
+	       sizeof(((struct drm_asahi_cmd_render *)0)->ts_frag_end_copies));
+	printf("cmd_compute.ts_end_copies %zu %zu\n",
+	       offsetof(struct drm_asahi_cmd_compute, ts_end_copies),
+	       sizeof(((struct drm_asahi_cmd_compute *)0)->ts_end_copies));
+}
+
+int main(int argc, char **argv)
+{
+	struct drm_asahi_attachment attachment = {0};
+
+	attachment.pointer = 0xcdb09376593c1f02ULL;
+	attachment.size = 0xceb194775a3d2003ULL;
+
+	struct drm_asahi_cmd_render render = {0};
+
+	render.flags = 0x5b3e2104;
+	render.isp_zls_pixels = 0x5c3f2205;
+	render.vdm_ctrl_stream_base = 0xd1b4977a5d402306ULL;
+	render.vertex_helper.binary = 0x5e412407;
+	render.vertex_helper.cfg = 0x5f422508;
+	render.vertex_helper.data = 0xd4b79a7d60432609ULL;
+	render.fragment_helper.binary = 0x6144270a;
+	render.fragment_helper.cfg = 0x6245280b;
+	render.fragment_helper.data = 0xd7ba9d806346290cULL;
+	render.isp_scissor_base = 0xd8bb9e8164472a0dULL;
+	render.isp_dbias_base = 0xd9bc9f8265482b0eULL;
+	render.isp_oclqry_base = 0xdabda08366492c0fULL;
+	render.depth.base = 0xdbbea184674a2d10ULL;
+	render.depth.comp_base = 0xdcbfa285684b2e11ULL;
+	render.depth.stride = 0x694c2f12;
+	render.depth.comp_stride = 0x6a4d3013;
+	render.stencil.base = 0xdfc2a5886b4e3114ULL;
+	render.stencil.comp_base = 0xe0c3a6896c4f3215ULL;
+	render.stencil.stride = 0x6d503316;
+	render.stencil.comp_stride = 0x6e513417;
+	render.zls_ctrl = 0xe3c6a98c6f523518ULL;
+	render.ppp_multisamplectl = 0xe4c7aa8d70533619ULL;
+	render.sampler_heap = 0xe5c8ab8e7154371aULL;
+	render.ppp_ctrl = 0x7255381b;
+	render.width_px = 0x391c;
+	render.height_px = 0x3a1d;
+	render.layers = 0x3b1e;
+	render.sampler_count = 0x3c1f;
+	render.utile_width_px = 0x20;
+	render.utile_height_px = 0x21;
+	render.samples = 0x22;
+	render.sample_size_B = 0x23;
+	render.isp_merge_upper_x = 0x7b5e4124;
+	render.isp_merge_upper_y = 0x7c5f4225;
+	render.bg.usc = 0x7d604326;
+	render.bg.rsrc_spec = 0x7e614427;
+	render.bg_rsrc_spec_hi = 0x7f624528;
+	render.eot.usc = 0x80634629;
+	render.eot.rsrc_spec = 0x8164472a;
+	render.bg_eot_rsrc_spec_hi = 0x8265482b;
+	render.partial_bg.usc = 0x8366492c;
+	render.partial_bg.rsrc_spec = 0x84674a2d;
+	render.bg_partial_rsrc_spec_hi = 0x85684b2e;
+	render.partial_eot.usc = 0x86694c2f;
+	render.partial_eot.rsrc_spec = 0x876a4d30;
+	render.bg_eot_partial_rsrc_spec_hi = 0x886b4e31;
+	render.isp_bgobjdepth = 0x896c4f32;
+	render.isp_bgobjvals = 0x8a6d5033;
+	render.ts_vtx.start.handle = 0x8b6e5134;
+	render.ts_vtx.start.offset = 0x8c6f5235;
+	render.ts_vtx.end.handle = 0x8d705336;
+	render.ts_vtx.end.offset = 0x8e715437;
+	render.ts_frag.start.handle = 0x8f725538;
+	render.ts_frag.start.offset = 0x90735639;
+	render.ts_frag.end.handle = 0x9174573a;
+	render.ts_frag.end.offset = 0x9275583b;
+
+	struct drm_asahi_cmd_compute compute = {0};
+
+	compute.flags = 0x9376593c;
+	compute.sampler_count = 0x94775a3d;
+	compute.cdm_ctrl_stream_base = 0xbeccfb295785b3eULL;
+	compute.cdm_ctrl_stream_end = 0xcedd0b396795c3fULL;
+	compute.sampler_heap = 0xdeed1b4977a5d40ULL;
+	compute.helper.binary = 0x987b5e41;
+	compute.helper.cfg = 0x997c5f42;
+	compute.helper.data = 0x10f1d4b79a7d6043ULL;
+	compute.ts.start.handle = 0x9b7e6144;
+	compute.ts.start.offset = 0x9c7f6245;
+	compute.ts.end.handle = 0x9d806346;
+	compute.ts.end.offset = 0x9e816447;
+
+	size_t render_size =
+		offsetof(struct drm_asahi_cmd_render, ts_frag_end_copies);
+	size_t compute_size =
+		offsetof(struct drm_asahi_cmd_compute, ts_end_copies);
+
+	if (argc == 2 && !strcmp(argv[1], "--layout")) {
+		layout();
+		return 0;
+	} else if (argc == 2 && !strcmp(argv[1], "--full")) {
+		render_size = sizeof(render);
+		compute_size = sizeof(compute);
+	} else if (argc != 1) {
+		return 1;
+	}
+
+	return emit(DRM_ASAHI_SET_VERTEX_ATTACHMENTS, &attachment,
+		    sizeof(attachment)) ||
+	       emit(DRM_ASAHI_CMD_RENDER, &render, render_size) ||
+	       emit(DRM_ASAHI_CMD_COMPUTE, &compute, compute_size);
+}
diff --git a/tools/asahi/m3-uapi-tests.rs b/tools/asahi/m3-uapi-tests.rs
new file mode 100644
index 00000000000000..4dc6012f5213e7
--- /dev/null
+++ b/tools/asahi/m3-uapi-tests.rs
@@ -0,0 +1,832 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+//! Offline tests of the production parser. All addresses are synthetic.
+#![allow(dead_code)]
+
+#[path = "../../drivers/gpu/drm/asahi/m3/t8122_admission.rs"]
+mod admission;
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_profile.rs"]
+mod m3_profile;
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_uapi.rs"]
+mod uapi;
+use uapi::*;
+
+fn frame(kind: u16, payload: &[u8]) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    for word in [
+        kind,
+        payload.len() as u16,
+        UAPI_BARRIER_NONE,
+        UAPI_BARRIER_NONE,
+    ] {
+        bytes.extend_from_slice(&word.to_le_bytes());
+    }
+    bytes.extend_from_slice(payload);
+    bytes
+}
+
+fn parse(bytes: &[u8]) -> Result<u32, UapiTranslateError> {
+    let mut parser = UapiCommandParser::new(bytes);
+    while parser.next_hardware()?.is_some() {}
+    parser.finish()
+}
+
+// Each offset below is checked against offsetof of the corresponding C member.
+fn layout() -> &'static std::collections::BTreeMap<String, (usize, usize)> {
+    static LAYOUT: std::sync::OnceLock<std::collections::BTreeMap<String, (usize, usize)>> =
+        std::sync::OnceLock::new();
+    LAYOUT.get_or_init(|| {
+        let path = std::env::var("ASAHI_UAPI_LAYOUT").expect("C layout path");
+        std::fs::read_to_string(path)
+            .unwrap()
+            .lines()
+            .map(|line| {
+                let words: Vec<_> = line.split_whitespace().collect();
+                (
+                    words[0].to_string(),
+                    (words[1].parse().unwrap(), words[2].parse().unwrap()),
+                )
+            })
+            .collect()
+    })
+}
+
+fn field(raw: &[u8], name: &str, offset: usize, width: usize, actual: u64) {
+    assert_eq!(layout()[name], (offset, width), "C offset/width for {name}");
+    let mut expected = [0u8; 8];
+    for (i, byte) in expected[..width].iter_mut().enumerate() {
+        *byte = raw.get(offset + i).copied().unwrap_or(0);
+    }
+    assert_eq!(actual, u64::from_le_bytes(expected), "decoded {name}");
+}
+
+fn check_render(p: UapiRenderCommand, raw: &[u8]) {
+    field(raw, "cmd_render.flags", 0, 4, p.flags as u64);
+    field(
+        raw,
+        "cmd_render.isp_zls_pixels",
+        4,
+        4,
+        p.depth_dimensions as u64,
+    );
+    field(
+        raw,
+        "cmd_render.vdm_ctrl_stream_base",
+        8,
+        8,
+        p.vdm_base as u64,
+    );
+    field(
+        raw,
+        "cmd_render.vertex_helper.binary",
+        16,
+        4,
+        p.vertex_helper.binary as u64,
+    );
+    field(
+        raw,
+        "cmd_render.vertex_helper.cfg",
+        20,
+        4,
+        p.vertex_helper.config as u64,
+    );
+    field(
+        raw,
+        "cmd_render.vertex_helper.data",
+        24,
+        8,
+        p.vertex_helper.data as u64,
+    );
+    field(
+        raw,
+        "cmd_render.fragment_helper.binary",
+        32,
+        4,
+        p.fragment_helper.binary as u64,
+    );
+    field(
+        raw,
+        "cmd_render.fragment_helper.cfg",
+        36,
+        4,
+        p.fragment_helper.config as u64,
+    );
+    field(
+        raw,
+        "cmd_render.fragment_helper.data",
+        40,
+        8,
+        p.fragment_helper.data as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_scissor_base",
+        48,
+        8,
+        p.scissor_base as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_dbias_base",
+        56,
+        8,
+        p.depth_bias_base as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_oclqry_base",
+        64,
+        8,
+        p.occlusion_query_base as u64,
+    );
+    field(raw, "cmd_render.depth.base", 72, 8, p.depth.base as u64);
+    field(
+        raw,
+        "cmd_render.depth.comp_base",
+        80,
+        8,
+        p.depth.compression_base as u64,
+    );
+    field(raw, "cmd_render.depth.stride", 88, 4, p.depth.stride as u64);
+    field(
+        raw,
+        "cmd_render.depth.comp_stride",
+        92,
+        4,
+        p.depth.compression_stride as u64,
+    );
+    field(raw, "cmd_render.stencil.base", 96, 8, p.stencil.base as u64);
+    field(
+        raw,
+        "cmd_render.stencil.comp_base",
+        104,
+        8,
+        p.stencil.compression_base as u64,
+    );
+    field(
+        raw,
+        "cmd_render.stencil.stride",
+        112,
+        4,
+        p.stencil.stride as u64,
+    );
+    field(
+        raw,
+        "cmd_render.stencil.comp_stride",
+        116,
+        4,
+        p.stencil.compression_stride as u64,
+    );
+    field(raw, "cmd_render.zls_ctrl", 120, 8, p.zls_control as u64);
+    field(
+        raw,
+        "cmd_render.ppp_multisamplectl",
+        128,
+        8,
+        p.multisample_control as u64,
+    );
+    field(
+        raw,
+        "cmd_render.sampler_heap",
+        136,
+        8,
+        p.sampler_heap as u64,
+    );
+    field(raw, "cmd_render.ppp_ctrl", 144, 4, p.ppp_control as u64);
+    field(raw, "cmd_render.width_px", 148, 2, p.width as u64);
+    field(raw, "cmd_render.height_px", 150, 2, p.height as u64);
+    field(raw, "cmd_render.layers", 152, 2, p.layers as u64);
+    field(
+        raw,
+        "cmd_render.sampler_count",
+        154,
+        2,
+        p.sampler_count as u64,
+    );
+    field(
+        raw,
+        "cmd_render.utile_width_px",
+        156,
+        1,
+        p.utile_width as u64,
+    );
+    field(
+        raw,
+        "cmd_render.utile_height_px",
+        157,
+        1,
+        p.utile_height as u64,
+    );
+    field(raw, "cmd_render.samples", 158, 1, p.samples as u64);
+    field(
+        raw,
+        "cmd_render.sample_size_B",
+        159,
+        1,
+        p.sample_size as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_merge_upper_x",
+        160,
+        4,
+        p.merge_upper_x as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_merge_upper_y",
+        164,
+        4,
+        p.merge_upper_y as u64,
+    );
+    field(raw, "cmd_render.bg.usc", 168, 4, p.background.usc as u64);
+    field(
+        raw,
+        "cmd_render.bg.rsrc_spec",
+        172,
+        4,
+        (p.background.resource_spec & 0xffffffff) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.bg_rsrc_spec_hi",
+        248,
+        4,
+        (p.background.resource_spec >> 32) as u64,
+    );
+    field(raw, "cmd_render.eot.usc", 176, 4, p.end_of_tile.usc as u64);
+    field(
+        raw,
+        "cmd_render.eot.rsrc_spec",
+        180,
+        4,
+        (p.end_of_tile.resource_spec & 0xffffffff) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.bg_eot_rsrc_spec_hi",
+        240,
+        4,
+        (p.end_of_tile.resource_spec >> 32) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.partial_bg.usc",
+        184,
+        4,
+        p.partial_background.usc as u64,
+    );
+    field(
+        raw,
+        "cmd_render.partial_bg.rsrc_spec",
+        188,
+        4,
+        (p.partial_background.resource_spec & 0xffffffff) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.bg_partial_rsrc_spec_hi",
+        252,
+        4,
+        (p.partial_background.resource_spec >> 32) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.partial_eot.usc",
+        192,
+        4,
+        p.partial_end_of_tile.usc as u64,
+    );
+    field(
+        raw,
+        "cmd_render.partial_eot.rsrc_spec",
+        196,
+        4,
+        (p.partial_end_of_tile.resource_spec & 0xffffffff) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.bg_eot_partial_rsrc_spec_hi",
+        244,
+        4,
+        (p.partial_end_of_tile.resource_spec >> 32) as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_bgobjdepth",
+        200,
+        4,
+        p.depth_clear as u64,
+    );
+    field(
+        raw,
+        "cmd_render.isp_bgobjvals",
+        204,
+        4,
+        p.stencil_clear as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_vtx.start.handle",
+        208,
+        4,
+        p.vertex_timestamps.start.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_vtx.start.offset",
+        212,
+        4,
+        p.vertex_timestamps.start.offset as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_vtx.end.handle",
+        216,
+        4,
+        p.vertex_timestamps.end.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_vtx.end.offset",
+        220,
+        4,
+        p.vertex_timestamps.end.offset as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_frag.start.handle",
+        224,
+        4,
+        p.fragment_timestamps.start.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_frag.start.offset",
+        228,
+        4,
+        p.fragment_timestamps.start.offset as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_frag.end.handle",
+        232,
+        4,
+        p.fragment_timestamps.end.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_render.ts_frag.end.offset",
+        236,
+        4,
+        p.fragment_timestamps.end.offset as u64,
+    );
+}
+
+fn check_compute(p: UapiComputeCommand, raw: &[u8]) {
+    field(raw, "cmd_compute.flags", 0, 4, p.flags as u64);
+    field(
+        raw,
+        "cmd_compute.sampler_count",
+        4,
+        4,
+        p.sampler_count as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.cdm_ctrl_stream_base",
+        8,
+        8,
+        p.control_stream_base as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.cdm_ctrl_stream_end",
+        16,
+        8,
+        p.control_stream_end as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.sampler_heap",
+        24,
+        8,
+        p.sampler_heap as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.helper.binary",
+        32,
+        4,
+        p.helper.binary as u64,
+    );
+    field(raw, "cmd_compute.helper.cfg", 36, 4, p.helper.config as u64);
+    field(raw, "cmd_compute.helper.data", 40, 8, p.helper.data as u64);
+    field(
+        raw,
+        "cmd_compute.ts.start.handle",
+        48,
+        4,
+        p.timestamps.start.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.ts.start.offset",
+        52,
+        4,
+        p.timestamps.start.offset as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.ts.end.handle",
+        56,
+        4,
+        p.timestamps.end.handle as u64,
+    );
+    field(
+        raw,
+        "cmd_compute.ts.end.offset",
+        60,
+        4,
+        p.timestamps.end.offset as u64,
+    );
+}
+
+fn fixture() -> Vec<u8> {
+    std::fs::read(std::env::var("ASAHI_UAPI_FIXTURE").expect("C fixture path")).unwrap()
+}
+
+#[test]
+fn c_header_producer_matches_production_decoder() {
+    let offsets = layout();
+    assert_eq!(offsets["header"].0, UAPI_COMMAND_HEADER_SIZE);
+    assert_eq!(offsets["attachment"].0, UAPI_ATTACHMENT_SIZE);
+    assert_eq!(offsets["timestamps"].0, 16);
+    assert_eq!(offsets["cmd_render.ts_frag_end_copies"].0, UAPI_RENDER_SIZE);
+    assert_eq!(offsets["cmd_compute.ts_end_copies"].0, UAPI_COMPUTE_SIZE);
+    let bytes = fixture();
+    let render_offset = 2 * UAPI_COMMAND_HEADER_SIZE + UAPI_ATTACHMENT_SIZE;
+    let render_size = u16::from_le_bytes(
+        bytes[render_offset - 6..render_offset - 4]
+            .try_into()
+            .unwrap(),
+    ) as usize;
+    let compute_offset = render_offset + render_size + UAPI_COMMAND_HEADER_SIZE;
+    let mut parser = UapiCommandParser::new(&bytes);
+    let Some(ParsedHardwareCommand::Render {
+        index,
+        header,
+        payload,
+        vertex_attachments,
+        fragment_attachments,
+    }) = parser.next_hardware().unwrap()
+    else {
+        panic!("render missing")
+    };
+    assert_eq!(index, 2);
+    assert_eq!(
+        header,
+        UapiCommandHeader {
+            command_type: 0,
+            size: render_size as u16,
+            render_barrier: UAPI_BARRIER_NONE,
+            compute_barrier: UAPI_BARRIER_NONE,
+        }
+    );
+    check_render(payload, &bytes[render_offset..render_offset + render_size]);
+    assert_eq!(vertex_attachments.count, 1);
+    let attachment = vertex_attachments.as_slice()[0];
+    field(
+        &bytes[8..32],
+        "attachment.pointer",
+        0,
+        8,
+        attachment.address,
+    );
+    field(&bytes[8..32], "attachment.size", 8, 8, attachment.size);
+    assert!(fragment_attachments.as_slice().is_empty());
+    let Some(ParsedHardwareCommand::Compute {
+        index,
+        header,
+        payload,
+        attachments,
+    }) = parser.next_hardware().unwrap()
+    else {
+        panic!("compute missing")
+    };
+    assert_eq!(index, 3);
+    assert_eq!(
+        header,
+        UapiCommandHeader {
+            command_type: 1,
+            size: (bytes.len() - compute_offset) as u16,
+            render_barrier: UAPI_BARRIER_NONE,
+            compute_barrier: UAPI_BARRIER_NONE,
+        }
+    );
+    check_compute(payload, &bytes[compute_offset..]);
+    assert!(attachments.as_slice().is_empty());
+    assert!(parser.next_hardware().unwrap().is_none());
+    assert_eq!(parser.finish(), Ok(2));
+}
+
+#[test]
+fn short_payloads_zero_extend_but_missing_bytes_are_rejected() {
+    // Every length includes cuts within each multi-byte field, for both kinds.
+    for (kind, size) in [(0, 256), (1, 64)] {
+        let supplied: Vec<u8> = (0..size).map(|i| (i % 254 + 1) as u8).collect();
+        for length in 0..=size {
+            let raw = &supplied[..length];
+            let bytes = frame(kind, raw);
+            let mut parser = UapiCommandParser::new(&bytes);
+            match parser.next_hardware().unwrap().unwrap() {
+                ParsedHardwareCommand::Render { payload, .. } => check_render(payload, raw),
+                ParsedHardwareCommand::Compute { payload, .. } => check_compute(payload, raw),
+            }
+            assert!(parser.next_hardware().unwrap().is_none());
+            assert_eq!(parser.finish(), Ok(1));
+            for cut in 1..bytes.len() {
+                assert!(parse(&bytes[..cut]).is_err());
+            }
+        }
+    }
+    assert_eq!(parse(&[]), Err(UapiTranslateError::HardwareCommandCount));
+}
+
+#[test]
+fn named_optional_timestamp_copies_are_refused() {
+    for (kind, name) in [
+        (0, "cmd_render.ts_frag_end_copies"),
+        (1, "cmd_compute.ts_end_copies"),
+    ] {
+        let (offset, size) = layout()[name];
+        let mut raw = vec![0; offset + size];
+        assert_eq!(parse(&frame(kind, &raw)), Ok(1));
+        for i in offset..raw.len() {
+            raw[i] = 1;
+            assert_eq!(
+                parse(&frame(kind, &raw)),
+                Err(UapiTranslateError::PayloadTail),
+                "{name} byte {i}"
+            );
+            raw[i] = 0;
+        }
+    }
+}
+
+#[test]
+fn unsupported_nonzero_extensions_never_disappear() {
+    for (kind, size) in [(0, UAPI_RENDER_SIZE), (1, UAPI_COMPUTE_SIZE)] {
+        for extra in [1, 8, 64, 128] {
+            let mut payload = vec![0; size + extra];
+            assert_eq!(parse(&frame(kind, &payload)), Ok(1));
+            for offset in size..payload.len() {
+                payload[offset] = 1;
+                assert_eq!(
+                    parse(&frame(kind, &payload)),
+                    Err(UapiTranslateError::PayloadTail)
+                );
+                payload[offset] = 0;
+            }
+        }
+    }
+    assert_eq!(
+        parse(&frame(0xffff, &[])),
+        Err(UapiTranslateError::CommandType)
+    );
+}
+
+#[test]
+fn attachment_shapes_counts_and_reserved_fields_are_checked() {
+    for kind in 2..=4 {
+        for size in 1..UAPI_ATTACHMENT_SIZE {
+            assert_eq!(
+                parse(&frame(kind, &vec![0; size])),
+                Err(UapiTranslateError::AttachmentPayloadSize)
+            );
+        }
+        let mut bytes = frame(kind, &vec![0; UAPI_ATTACHMENT_SIZE * UAPI_MAX_ATTACHMENTS]);
+        bytes.extend(frame(1, &[]));
+        assert_eq!(parse(&bytes), Ok(1));
+        assert_eq!(
+            parse(&frame(
+                kind,
+                &vec![0; UAPI_ATTACHMENT_SIZE * (UAPI_MAX_ATTACHMENTS + 1)]
+            )),
+            Err(UapiTranslateError::AttachmentCount)
+        );
+        for offset in 16..24 {
+            let mut payload = [0; UAPI_ATTACHMENT_SIZE];
+            payload[offset] = 1;
+            assert_eq!(
+                parse(&frame(kind, &payload)),
+                Err(UapiTranslateError::AttachmentFields)
+            );
+        }
+        let mut bytes = frame(kind, &[]);
+        bytes[4..6].copy_from_slice(&0u16.to_le_bytes());
+        assert_eq!(parse(&bytes), Err(UapiTranslateError::AttachmentBarrier));
+    }
+}
+
+#[test]
+fn attachment_lists_reach_their_commands() {
+    let entry = |pointer: u64, size: u64| {
+        let mut raw = [0u8; UAPI_ATTACHMENT_SIZE];
+        raw[..8].copy_from_slice(&pointer.to_le_bytes());
+        raw[8..16].copy_from_slice(&size.to_le_bytes());
+        raw
+    };
+    let vertex = entry(0x1_2345_6000, 0x1_0000_0040).to_vec();
+    let fragment = [
+        entry(0x2_0000_8000, 0x80),
+        entry(0x3_0000_c000, 0x2_0000_0100),
+    ]
+    .concat();
+    let compute = entry(0x4_0000_1000, 0x5_0000_0010).to_vec();
+    let check = |list: UapiAttachmentList, raw: &[u8]| {
+        assert_eq!(list.as_slice().len(), raw.len() / UAPI_ATTACHMENT_SIZE);
+        for (attachment, raw) in list.as_slice().iter().zip(raw.chunks(UAPI_ATTACHMENT_SIZE)) {
+            field(raw, "attachment.pointer", 0, 8, attachment.address);
+            field(raw, "attachment.size", 8, 8, attachment.size);
+        }
+    };
+
+    // Lists persist until replaced; an empty list clears only its own kind.
+    let mut bytes = frame(2, &vertex);
+    bytes.extend(frame(3, &fragment));
+    bytes.extend(frame(4, &compute));
+    bytes.extend(frame(0, &[]));
+    bytes.extend(frame(1, &[]));
+    bytes.extend(frame(3, &[]));
+    bytes.extend(frame(0, &[]));
+    let mut parser = UapiCommandParser::new(&bytes);
+    for expected_fragment in [&fragment[..], &[]] {
+        let Some(ParsedHardwareCommand::Render {
+            vertex_attachments,
+            fragment_attachments,
+            ..
+        }) = parser.next_hardware().unwrap()
+        else {
+            panic!("render missing")
+        };
+        check(vertex_attachments, &vertex);
+        check(fragment_attachments, expected_fragment);
+        if !expected_fragment.is_empty() {
+            let Some(ParsedHardwareCommand::Compute { attachments, .. }) =
+                parser.next_hardware().unwrap()
+            else {
+                panic!("compute missing")
+            };
+            check(attachments, &compute);
+        }
+    }
+    assert!(parser.next_hardware().unwrap().is_none());
+    assert_eq!(parser.finish(), Ok(3));
+}
+
+#[test]
+fn dependencies_count_hardware_commands_and_bound_the_submit() {
+    for field in [4, 6] {
+        let mut bytes = frame(1, &[]);
+        bytes[field..field + 2].copy_from_slice(&1u16.to_le_bytes());
+        assert_eq!(parse(&bytes), Err(UapiTranslateError::BarrierFuture));
+    }
+    let mut bytes = frame(2, &[]);
+    bytes.extend(frame(0, &[]));
+    let mut compute = frame(1, &[]);
+    compute[4..6].copy_from_slice(&1u16.to_le_bytes());
+    bytes.extend(compute);
+    assert_eq!(parse(&bytes), Ok(2));
+    let command = frame(1, &[]);
+    assert_eq!(
+        parse(&command.repeat(UAPI_MAX_HARDWARE_COMMANDS as usize)),
+        Ok(UAPI_MAX_HARDWARE_COMMANDS)
+    );
+    assert_eq!(
+        parse(&command.repeat(UAPI_MAX_HARDWARE_COMMANDS as usize + 1)),
+        Err(UapiTranslateError::HardwareCommandCount)
+    );
+}
+
+struct Region {
+    start: u64,
+    end: u64,
+    writable: bool,
+}
+impl GpuAddressSpace for Region {
+    fn covers(&self, address: u64, size: u64, access: GpuAccess) -> bool {
+        let Some(end) = address.checked_add(size) else {
+            return false;
+        };
+        address >= self.start && end <= self.end && (access == GpuAccess::Read || self.writable)
+    }
+}
+
+#[test]
+fn attachment_validation_rejects_readonly_zero_and_wrapped_ranges() {
+    let mut list = UapiAttachmentList::EMPTY;
+    list.count = 1;
+    let mut region = Region {
+        start: 0x4000,
+        end: 0x8000,
+        writable: false,
+    };
+    list.entries[0] = UapiAttachment {
+        address: 0x4000,
+        size: 0x4000,
+    };
+    assert_eq!(
+        validate_attachments(&region, &list),
+        Err(UapiTranslateError::AddressRange)
+    );
+    region.writable = true;
+    assert_eq!(validate_attachments(&region, &list), Ok(()));
+    for (address, size) in [(0x4000, 0), (0x4000, 0x4001), (u64::MAX, 2)] {
+        list.entries[0] = UapiAttachment { address, size };
+        assert_eq!(
+            validate_attachments(&region, &list),
+            Err(UapiTranslateError::AddressRange)
+        );
+    }
+}
+
+#[test]
+fn usc_windows_reject_misalignment_overflow_and_unmapped_programs() {
+    let queue = QueueUscWindow {
+        base: USC_WINDOW_SIZE,
+        user_start: 0x4000,
+        user_end: 2 * USC_WINDOW_SIZE,
+    };
+    assert_eq!(queue.validate(), Ok(()));
+    assert_eq!(
+        QueueUscWindow {
+            base: queue.base + 1,
+            ..queue
+        }
+        .validate(),
+        Err(UapiTranslateError::QueueUscAlignment)
+    );
+    assert_eq!(
+        QueueUscWindow {
+            base: u64::MAX & !(USC_WINDOW_SIZE - 1),
+            ..queue
+        }
+        .validate(),
+        Err(UapiTranslateError::QueueUscRange)
+    );
+    assert_eq!(
+        QueueUscWindow {
+            user_end: queue.user_end - 1,
+            ..queue
+        }
+        .validate(),
+        Err(UapiTranslateError::QueueUscRange)
+    );
+    let region = Region {
+        start: queue.base + 8,
+        end: queue.base + 12,
+        writable: false,
+    };
+    assert_eq!(queue.full_program(&region, 9), Ok(queue.base + 8));
+    assert_eq!(
+        queue.full_program(&region, 0),
+        Err(UapiTranslateError::ProgramOffset)
+    );
+    assert_eq!(
+        queue.full_program(&region, 16),
+        Err(UapiTranslateError::AddressRange)
+    );
+}
+
+#[test]
+fn unsupported_firmware_cannot_reach_the_existing_profile() {
+    let identity = (1, 1, 0x07022000, [0xff, 0, 0]);
+    assert!(admission::validate_identity(
+        &[14, 8, 3],
+        identity.0,
+        identity.1,
+        identity.2,
+        identity.3
+    )
+    .is_some());
+    for version in [&[26, 6, 2][..], &[14, 8][..], &[14, 8, 3, 0][..], &[][..]] {
+        assert!(admission::validate_identity(
+            version, identity.0, identity.1, identity.2, identity.3
+        )
+        .is_none());
+    }
+}
+
+#[test]
+fn firmware_profile_agrees_with_the_actual_c_header() {
+    assert_eq!(
+        layout()["profile.params_required"].0 as u64,
+        m3_profile::PARAMS_REQUIRED
+    );
+    assert_eq!(layout()["profile.vm_create_size"].0, 24);
+    assert_eq!(
+        layout()["profile.hal200"].0 as u32,
+        m3_profile::Profile::Extended.hal()
+    );
+    assert_eq!(layout()["profile.features"].0, 0x0a);
+}
diff --git a/tools/asahi/test-m3-mailbox.py b/tools/asahi/test-m3-mailbox.py
index 2320d17f10f6f4..167b0566b2e5dd 100644
--- a/tools/asahi/test-m3-mailbox.py
+++ b/tools/asahi/test-m3-mailbox.py
@@ -77,6 +77,17 @@ def vec(values):
     assert!(!ok(&compat,&reg,&names,&irqs,1));
     let mut v=names.clone(); v[0]^=1; assert!(!ok(&compat,&reg,&v,&irqs,cells));
     for v in [b"apple,asc-mailbox-v4\\0".to_vec(), b"apple,t8122-agx-asc-mailbox\\0unknown\\0".to_vec(), b"apple,t6031-agx-asc-mailbox\\0".to_vec()] { assert!(!ok(&v,&reg,&names,&irqs,cells)); }
+    // Compatible lists are ordered: reversing either supported pair must fail.
+    for pair in soc.mailbox_compatibles {
+        let parts: Vec<_> = pair.split(|byte| *byte == 0).filter(|part| !part.is_empty()).collect();
+        if parts.len() == 2 {
+            let mut reversed = parts[1].to_vec();
+            reversed.push(0);
+            reversed.extend_from_slice(parts[0]);
+            reversed.push(0);
+            assert!(!ok(&reversed,&reg,&names,&irqs,cells));
+        }
+    }
     for v in soc.mailbox_compatibles { assert!(ok(&v.to_vec(),&reg,&names,&irqs,cells)); }
 }
 fn main() {
diff --git a/tools/asahi/test-m3-uapi.py b/tools/asahi/test-m3-uapi.py
new file mode 100755
index 00000000000000..a63249e18869d4
--- /dev/null
+++ b/tools/asahi/test-m3-uapi.py
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Compile public C producers and run the production Rust parser offline."""
+import argparse
+import hashlib
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+
+def run(command, **kwargs):
+    subprocess.run(command, check=True, **kwargs)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--mesa", type=Path, help="matched public Mesa source")
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parents[2]
+    if sys.byteorder != "little":
+        raise SystemExit("C fixtures currently require a little-endian host")
+    cc = os.environ.get("CC", "cc")
+    rustc = os.environ.get("RUSTC", "rustc")
+    fixture_source = root / "tools/asahi/m3-uapi-fixture.c"
+    with tempfile.TemporaryDirectory(prefix="asahi-uapi-") as temporary:
+        work = Path(temporary)
+        headers = work / "headers"
+        run(["make", "-s", "-C", str(root), "O=" + str(work / "headers-build"),
+             "ARCH=arm64", "headers_install", "INSTALL_HDR_PATH=" + str(headers)])
+        sources = [(headers / "include", "drm/asahi_drm.h")]
+        if args.mesa:
+            sources.append((args.mesa.resolve() / "include", "drm-uapi/asahi_drm.h"))
+        fixtures = []
+        layouts = []
+        prefixes = []
+        for index, (includes, header) in enumerate(sources):
+            producer = work / ("producer-" + str(index))
+            run([cc, "-std=c11", "-Wall", "-Wextra", "-Werror",
+                 "-I" + str(includes), '-DASAHI_HEADER="' + header + '"',
+                 str(fixture_source), "-o", str(producer)])
+            prefix = work / ("prefix-" + str(index))
+            with prefix.open("wb") as output:
+                run([str(producer)], stdout=output)
+            prefixes.append(prefix)
+            layout = work / ("layout-" + str(index))
+            with layout.open("wb") as output:
+                run([str(producer), "--layout"], stdout=output)
+            layouts.append(layout)
+            fixture = work / ("fixture-" + str(index))
+            with fixture.open("wb") as output:
+                run([str(producer), "--full"], stdout=output)
+            fixtures.append(fixture)
+        reference = prefixes[0].read_bytes()
+        if any(prefix.read_bytes() != reference for prefix in prefixes[1:]):
+            raise SystemExit("kernel/Mesa canonical fixture mismatch")
+        print("canonical fixture sha256=" + hashlib.sha256(reference).hexdigest(), flush=True)
+        for optimized in (False, True):
+            binary = work / ("tests-optimized" if optimized else "tests-debug")
+            command = [rustc, "--edition=2021", "--test",
+                       str(root / "tools/asahi/m3-uapi-tests.rs"), "-o", str(binary)]
+            if optimized:
+                command.append("-O")
+            run(command)
+            for index, fixture in enumerate(prefixes + fixtures):
+                env = dict(os.environ, ASAHI_UAPI_FIXTURE=str(fixture),
+                           ASAHI_UAPI_LAYOUT=str(layouts[index % len(layouts)]))
+                run([str(binary)], env=env)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/aurora-ci/host-tests.json b/tools/aurora-ci/host-tests.json
index 071fd7ad35fd07..4d2fbc3c53dafb 100644
--- a/tools/aurora-ci/host-tests.json
+++ b/tools/aurora-ci/host-tests.json
@@ -2298,6 +2298,34 @@
         "python3",
         "tools/asahi/test-m3-mailbox.py"
       ]
+    },
+    {
+      "name": "tools/asahi/m3-firmware-tests.rs",
+      "group": "tools",
+      "argv": [
+        "{output}",
+        "--test-threads=1"
+      ],
+      "setup": [
+        [
+          "rustc",
+          "--edition=2021",
+          "--test",
+          "tools/asahi/m3-firmware-tests.rs",
+          "-o",
+          "{output}"
+        ]
+      ],
+      "rust": "1.85.0"
+    },
+    {
+      "name": "tools/asahi/test-m3-uapi.py",
+      "group": "tools",
+      "argv": [
+        "python3",
+        "tools/asahi/test-m3-uapi.py"
+      ],
+      "rust": "1.85.0"
     }
   ],
   "helpers": {
@@ -2305,7 +2333,8 @@
     "tools/testing/selftests/drivers/gpu/asahi-g15/uat-owner.c": "compiled and executed by the registered asahi-g15/run.py actual reservation-owner fixture",
     "tools/testing/selftests/drivers/gpu/asahi-g15/pmp-bridge.c": "compiled and executed by the registered asahi-g15/run.py maintained PMP fixture",
     "tools/asahi/t6030-pmp-graph-tests.c": "compiled and executed by the corresponding registered Python actual-body host suite",
-    "tools/asahi/t6030-display-admission-tests.c": "compiled and executed by the corresponding registered Python actual-body host suite"
+    "tools/asahi/t6030-display-admission-tests.c": "compiled and executed by the corresponding registered Python actual-body host suite",
+    "tools/asahi/m3-uapi-tests.rs": "compiled and executed by the registered tools/asahi/test-m3-uapi.py paired-header suite"
   },
   "excluded": {
     "tools/aurora-sep/tests/coordinator/runtime-check.sh": "Needs /dev/sep-bio, a running kernel booted with trusted.source=applesep, the hw_random sysfs interface and fprintd. Coordinator payload for an approved device.",

From 0667ef5f925fb7cb80a108e6ebbfaa5c0a4fe7fa Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:38:59 -0400
Subject: [PATCH 5/9] drm/asahi: construct and publish extended T8122
 initialization data

Build extended initialization owners, controller images and channel
records with checked allocation spans. Publish the bounded loader table
through existing M3 ownership. Keep extended runtime admission closed.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_channel_format.rs | 182 ++++++++
 drivers/gpu/drm/asahi/m3/m3_compute_layout.rs | 171 ++++++--
 drivers/gpu/drm/asahi/m3/m3_config.rs         | 179 +++++++-
 drivers/gpu/drm/asahi/m3/m3_firmware.rs       |  59 +++
 drivers/gpu/drm/asahi/m3/m3_init_26.rs        |  22 +-
 drivers/gpu/drm/asahi/m3/m3_mmio_26.rs        |  33 +-
 drivers/gpu/drm/asahi/m3/m3_power_26.rs       | 414 ++++++++++++++++++
 drivers/gpu/drm/asahi/m3/mod.rs               |   5 +
 tools/asahi/m3-runtime-tests.rs               |  12 +
 tools/asahi/test-m3-power.py                  | 173 ++++++++
 tools/aurora-ci/host-tests.json               |   9 +
 11 files changed, 1223 insertions(+), 36 deletions(-)
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_channel_format.rs
 create mode 100644 drivers/gpu/drm/asahi/m3/m3_power_26.rs
 create mode 100644 tools/asahi/test-m3-power.py

diff --git a/drivers/gpu/drm/asahi/m3/m3_channel_format.rs b/drivers/gpu/drm/asahi/m3/m3_channel_format.rs
new file mode 100644
index 00000000000000..45eebda112b738
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_channel_format.rs
@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! Bounded firmware channel records. Publication and retirement belong to Config.
+
+use super::m3_init_layout::Error;
+
+pub(crate) const CONTROL_BYTES: usize = 64;
+pub(crate) const RECEIVE_BYTES: usize = 72;
+pub(crate) const SLOTS: u32 = 256;
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum Action {
+    Initialize,
+    Register {
+        pipe: u32,
+        engine: u32,
+    },
+    Idle {
+        enabled: bool,
+    },
+    Release {
+        group: u8,
+        index: u8,
+        weight: u8,
+        address: u64,
+    },
+}
+
+impl Action {
+    /// The first two actions precede the first generation-bearing publication.
+    pub(crate) fn generation(self, published: u32, consumed: u32) -> Result<u32, Error> {
+        match self {
+            Self::Initialize | Self::Register { .. } => {
+                if published != 0 || consumed != 0 {
+                    return Err(Error::Address);
+                }
+                Ok(0)
+            }
+            _ => published.max(consumed).checked_add(1).ok_or(Error::Address),
+        }
+    }
+
+    pub(crate) fn encode(self, output: &mut [u8]) -> Result<(), Error> {
+        let mut words = [0u32; 3];
+        let mut release = None;
+        match self {
+            Self::Initialize => words[0] = 0x16,
+            Self::Register { pipe, engine } => {
+                if pipe >= 3 || !(1..=2).contains(&engine) {
+                    return Err(Error::Address);
+                }
+                words = [0x1b, pipe, engine];
+            }
+            Self::Idle { enabled } => words = [0x0a, enabled.into(), 0],
+            Self::Release {
+                group,
+                index,
+                weight,
+                address,
+            } => {
+                if index == 255
+                    || weight == 255
+                    || address < 0xffff_fc00_0000_0000
+                    || address & 7 != 0
+                {
+                    return Err(Error::Address);
+                }
+                words[0] = 0x14;
+                words[2] = u32::from_le_bytes([group, index, weight, 4]);
+                release = Some(address);
+            }
+        }
+        let bytes = output.get_mut(..CONTROL_BYTES).ok_or(Error::Size)?;
+        bytes.fill(0);
+        for (index, word) in words.iter().enumerate() {
+            bytes[index * 4..index * 4 + 4].copy_from_slice(&word.to_le_bytes());
+        }
+        if let Some(address) = release {
+            bytes[12..20].copy_from_slice(&address.to_le_bytes());
+        }
+        Ok(())
+    }
+}
+
+/// An empty ring is required before publishing a synchronous control transaction.
+/// Both consumers must retire it before the next control action may be published.
+pub(crate) fn idle_cursor(cursors: [u32; 3]) -> Result<u32, Error> {
+    if cursors.iter().any(|value| *value >= SLOTS) {
+        return Err(Error::Bounds);
+    }
+    if cursors[0] != cursors[2] || cursors[1] != cursors[2] {
+        return Err(Error::Address);
+    }
+    Ok(cursors[2])
+}
+
+pub(crate) fn payload_offset(thread: usize, slot: u32) -> Result<usize, Error> {
+    if thread >= 9 {
+        return Err(Error::Bounds);
+    }
+    Ok((thread * 256 + (slot & 255) as usize) * 0xd8)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn initialization_records_have_only_their_defined_words() {
+        for action in [Action::Initialize, Action::Register { pipe: 2, engine: 1 }] {
+            let mut output = [0xa5; CONTROL_BYTES + 8];
+            action.encode(&mut output).unwrap();
+            assert_eq!(&output[12..CONTROL_BYTES], &[0; CONTROL_BYTES - 12]);
+            assert_eq!(&output[CONTROL_BYTES..], &[0xa5; 8]);
+            assert_eq!(action.generation(0, 0), Ok(0));
+            assert!(action.generation(1, 0).is_err());
+        }
+    }
+
+    #[test]
+    fn invalid_actions_preserve_the_entire_output() {
+        for action in [
+            Action::Register { pipe: 3, engine: 1 },
+            Action::Register { pipe: 0, engine: 0 },
+            Action::Release {
+                group: 0,
+                index: 255,
+                weight: 1,
+                address: 0xffff_fc21_0000_0000,
+            },
+            Action::Release {
+                group: 0,
+                index: 0,
+                weight: 1,
+                address: 8,
+            },
+        ] {
+            let mut output = [0xa5; CONTROL_BYTES];
+            assert!(action.encode(&mut output).is_err());
+            assert_eq!(output, [0xa5; CONTROL_BYTES]);
+        }
+    }
+
+    #[test]
+    fn generations_follow_consumption_and_never_wrap() {
+        let action = Action::Idle { enabled: true };
+        assert_eq!(action.generation(3, 5), Ok(6));
+        assert_eq!(action.generation(5, 3), Ok(6));
+        assert!(action.generation(u32::MAX, 0).is_err());
+        assert!(action.generation(0, u32::MAX).is_err());
+        let mut output = [0; CONTROL_BYTES];
+        action.encode(&mut output).unwrap();
+        assert_eq!(&output[..8], &[10, 0, 0, 0, 1, 0, 0, 0]);
+    }
+
+    #[test]
+    fn both_consumers_and_all_indices_are_checked() {
+        assert_eq!(idle_cursor([255, 255, 255]), Ok(255));
+        for cursors in [[0, 1, 1], [1, 0, 1], [256, 256, 256]] {
+            assert!(idle_cursor(cursors).is_err());
+        }
+        assert_eq!(payload_offset(8, 0x101), Ok((8 * 256 + 1) * 0xd8));
+        assert!(payload_offset(9, 0).is_err());
+    }
+
+    #[test]
+    fn release_uses_the_packed_owned_pointer() {
+        let action = Action::Release {
+            group: 1,
+            index: 2,
+            weight: 3,
+            address: 0xffff_fc21_0400_0000,
+        };
+        let mut output = [0; CONTROL_BYTES];
+        action.encode(&mut output).unwrap();
+        assert_eq!(&output[8..12], &[1, 2, 3, 4]);
+        assert_eq!(
+            u64::from_le_bytes(output[12..20].try_into().unwrap()),
+            0xffff_fc21_0400_0000
+        );
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs b/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
index 74bed858b71e26..64c8cb005c4a1a 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only OR MIT
 use super::{m3_pool_layout::GpuRegion, m3_queue_layout::{Error, FirmwareVa}};
 pub(crate) const SIZE: usize = 0x893;
+pub(crate) const EXTENDED_SIZE: usize = 0x8b0;
 pub(crate) const REGISTERS: usize = 0x20;
 pub(crate) const REGISTER_COUNT: usize = 22;
 /// G15G takes the same list without its last two registers (0xa599, 0xd411).
@@ -64,12 +65,22 @@ impl Command {
     /// Validate before any output mutation. Encoding operates on ordinary host
     /// bytes; the caller copies them into the owned unpublished command buffer.
     pub(crate) fn encode(&self, out: &mut [u8]) -> Result<(), Error> {
-        if out.len() < SIZE { return Err(Error::Size); }
+        self.encode_for(super::m3_profile::Profile::Legacy, 0, 0, out)
+    }
+
+    /// Firmware envelopes vary independently of the GPU's CDM stream format.
+    pub(crate) fn encode_for(&self, profile: super::m3_profile::Profile,
+        asid_generation: u8, event_slot: u8, out: &mut [u8]) -> Result<(), Error> {
+        let extended = profile == super::m3_profile::Profile::Extended;
+        let size = if extended { EXTENDED_SIZE } else { SIZE };
+        if out.len() < size { return Err(Error::Size); }
+        if extended && (self.register_set != RegisterSet::G15G || event_slot >= 4
+            || (self.context != 0 && asid_generation == 0)) { return Err(Error::Address); }
         if self.context >= 64 || self.cdm_last.get() < self.cdm.get() { return Err(Error::Address); }
         if self.preemption.size() < 0x14a0 || self.microsequence_size == 0 || self.microsequence_size > 4096 {
             return Err(Error::Size);
         }
-        self.gpu_alias.add((SIZE - 3) as u64)?; // inclusive final aligned dword
+        self.gpu_alias.add(((size - 1) & !3) as u64)?; // inclusive final aligned dword
         let registers = self.gpu_alias.add(REGISTERS as u64)?;
         let preemption = self.preemption.base();
         let values = [
@@ -82,45 +93,143 @@ impl Command {
             (0x1a0b9, 0), (0x1a0c1, 0), (0x101d1, 0), (0xd479, 0),
             (0x1a0e9, 8), (0x107a1, 0xff0000), (0xa599, 0x13200400020), (0xd411, 0x200000001),
         ];
-        let bytes = &mut out[..SIZE];bytes.fill(0);
+        let bytes = &mut out[..size];bytes.fill(0);
         word(bytes, 0, 3); // compute opcode
-        pointer(bytes, COUNTER, u64::from(self.counter));
-        word(bytes, CONTEXT, self.context);
-        pointer(bytes, 0x14, self.notifier.get());
-        let count = match self.register_set {
+        if extended {
+            word(bytes, 0xc, self.context);
+            pointer(bytes, 0x10, self.notifier.get());
+        } else {
+            pointer(bytes, COUNTER, u64::from(self.counter));
+            word(bytes, CONTEXT, self.context);
+            pointer(bytes, 0x14, self.notifier.get());
+        }
+        let legacy_count = match self.register_set {
             RegisterSet::G15S => REGISTER_COUNT,
             RegisterSet::G15G => G15G_REGISTER_COUNT,
         };
-        for (n, (register, value)) in values.into_iter().take(count).enumerate() {
-            word(bytes, REGISTERS+n*REGISTER_STRIDE, register);
-            pointer(bytes, REGISTERS+n*REGISTER_STRIDE+4, value);
+        let mut count = 0;
+        let mut emit = |register, value| {
+            word(bytes, REGISTERS + count * REGISTER_STRIDE, register);
+            pointer(bytes, REGISTERS + count * REGISTER_STRIDE + 4, value);
+            count += 1;
+        };
+        let limit = if extended { REGISTER_COUNT } else { legacy_count };
+        for (register, value) in values.into_iter().take(limit) {
+            if extended && register == 0x12091 { continue; }
+            emit(register, value);
+        }
+        if extended {
+            emit(0x1a540, 1);
+            emit(0x014a9, 1);
+            emit(0x0a351, 1);
         }
         pointer(bytes, 0x720, registers.get());
         bytes[0x728..0x72a].copy_from_slice(&(count as u16).to_le_bytes());
         bytes[0x72a..0x72c].copy_from_slice(&((count*REGISTER_STRIDE) as u16).to_le_bytes());
         pointer(bytes, 0x760, self.microsequence.get());
         word(bytes, 0x768, self.microsequence_size);
-        // ComputeInfo2 mirrors the preemption buffer, inclusive CDM end and
-        // qualified control word from the register list.
-        pointer(bytes, 0x76c+0x28, preemption);
-        pointer(bytes, 0x76c+0x30, self.cdm_last.get());
-        pointer(bytes, 0x76c+0x58, QUALIFIED_COMPUTE_CONTROL);
-        word(bytes, 0x7cc+0x14, u32::MAX); // EncoderParams.unk_mask
-        pointer(bytes, META, self.stamp.get());
-        pointer(bytes, META+8, self.fw_stamp.get());
-        word(bytes, STAMP_VALUE, self.stamp_value);
-        word(bytes, META+0x14, 2); // qualified compute event slot
-        word(bytes, FLUSH_STAMPS, u32::from(self.flush_stamps));
-        word(bytes, META+0x20, 0xc10000); // producer UUID
-        word(bytes, QUEUE_COUNT, self.counter);
-        pointer(bytes, TAIL+8, self.timestamps[0].get());
-        pointer(bytes, TAIL+16, self.timestamps[1].get());
-        pointer(bytes, TAIL+0x2e, self.pool.get());
-        bytes[TAIL+0x36] = 1; // SharedCommandTail.unk_846
-        pointer(bytes, TAIL+0x37, 0xad0000);
-        pointer(bytes, TAIL+0x3f, 0x1600000);
-        pointer(bytes, TAIL+0x47, self.tail_scratch.get());
-        bytes[TAIL+0x4f] = 1; // SharedCommandTail.unk_85f
+        let info = if extended { 0x770 } else { 0x76c };
+        pointer(bytes, info + 0x28, preemption);
+        pointer(bytes, info + 0x30, self.cdm_last.get());
+        pointer(bytes, info + 0x58, QUALIFIED_COMPUTE_CONTROL);
+        word(bytes, if extended { 0x7e8 } else { 0x7e0 }, u32::MAX);
+        let meta = if extended { 0x800 } else { META };
+        pointer(bytes, meta, self.stamp.get());
+        pointer(bytes, meta + 8, self.fw_stamp.get());
+        word(bytes, meta + 0x10, self.stamp_value);
+        word(bytes, meta + 0x14, 2);
+        if extended { word(bytes, meta + 0x18, event_slot.into()); }
+        word(bytes, meta + 0x1c, u32::from(self.flush_stamps));
+        word(bytes, meta + 0x20, 0xc10000);
+        word(bytes, meta + 0x24, self.counter);
+        let tail = if extended { 0x82c } else { TAIL };
+        pointer(bytes, tail + 8, self.timestamps[0].get());
+        pointer(bytes, tail + 16, self.timestamps[1].get());
+        pointer(bytes, tail + if extended { 0x3e } else { 0x2e }, self.pool.get());
+        bytes[tail + if extended { 0x46 } else { 0x36 }] = 1;
+        pointer(bytes, tail + if extended { 0x47 } else { 0x37 },
+            if extended { 0x1588000 } else { 0xad0000 });
+        pointer(bytes, tail + if extended { 0x4f } else { 0x3f },
+            if extended { 0xef8000 } else { 0x1600000 });
+        pointer(bytes, tail + if extended { 0x57 } else { 0x47 }, self.tail_scratch.get());
+        if extended { bytes[0x88b] = asid_generation; }
+        else { bytes[TAIL + 0x4f] = 1; }
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use super::super::m3_profile::Profile;
+
+    fn fixture() -> Command {
+        let firmware = |n: u64| FirmwareVa::new(0xffff_fc21_8000_0000 + n * 0x4000).unwrap();
+        Command {
+            context: 3, counter: 7, notifier: firmware(0),
+            preemption: GpuRegion::new(0x5000_0000, 0x4000).unwrap(),
+            cdm: GpuVa::new(0x6000_0000).unwrap(),
+            cdm_last: GpuVa::new(0x6000_0ffc).unwrap(),
+            gpu_alias: GpuVa::new(0x7000_0000).unwrap(),
+            microsequence: firmware(1), microsequence_size: 0x300,
+            stamp: firmware(2), fw_stamp: firmware(3), stamp_value: 0x700,
+            timestamps: [firmware(4), firmware(5)], pool: firmware(6),
+            tail_scratch: firmware(7), flush_stamps: true,
+            register_set: RegisterSet::G15G,
+        }
+    }
+    fn read32(b: &[u8], o: usize) -> u32 {
+        u32::from_le_bytes(b[o..o + 4].try_into().unwrap())
+    }
+    fn read64(b: &[u8], o: usize) -> u64 {
+        u64::from_le_bytes(b[o..o + 8].try_into().unwrap())
+    }
+
+    #[test]
+    fn extended_envelope_preserves_stream_and_native_visibility_boundary() {
+        let c = fixture();
+        let mut b = [0xa5; EXTENDED_SIZE + 16];
+        c.encode_for(Profile::Extended, 9, 2, &mut b).unwrap();
+        assert_eq!(read32(&b, 0xc), c.context);
+        assert_eq!(read64(&b, 0x10), c.notifier.get());
+        assert_eq!(read32(&b, 0x728) & 0xffff, 24);
+        let count = (read32(&b, 0x728) & 0xffff) as usize;
+        let cdm = (0..count).find(|n| read32(&b, 0x20 + n * 12) == 0x1a420).unwrap();
+        assert_eq!(read64(&b, 0x24 + cdm * 12), c.cdm.get());
+        assert_eq!(read64(&b, 0x7a0), c.cdm_last.get());
+        assert_eq!(read64(&b, 0x800), c.stamp.get());
+        assert_eq!(read64(&b, 0x808), c.fw_stamp.get());
+        assert_eq!(read32(&b, 0x818), 2);
+        assert_eq!(read32(&b, 0x81c), 1);
+        assert_eq!(read64(&b, 0x834), c.timestamps[0].get());
+        assert_eq!(read64(&b, 0x86a), c.pool.get());
+        assert_eq!(read64(&b, 0x883), c.tail_scratch.get());
+        assert_eq!(b[0x88b], 9);
+        assert_eq!(&b[EXTENDED_SIZE..], &[0xa5; 16]);
+    }
+
+    #[test]
+    fn extended_validation_never_mutates_a_rejected_envelope() {
+        for (generation, slot) in [(0, 0), (1, 4), (1, 255)] {
+            let mut b = [0xa5; EXTENDED_SIZE];
+            assert!(fixture().encode_for(Profile::Extended, generation, slot, &mut b).is_err());
+            assert_eq!(b, [0xa5; EXTENDED_SIZE]);
+        }
+        let mut b = [0xa5; EXTENDED_SIZE - 1];
+        assert!(fixture().encode_for(Profile::Extended, 1, 0, &mut b).is_err());
+        assert_eq!(b, [0xa5; EXTENDED_SIZE - 1]);
+    }
+
+    #[test]
+    fn legacy_wrapper_keeps_legacy_geometry_and_register_order() {
+        let c = fixture();
+        let mut b = [0xa5; EXTENDED_SIZE];
+        c.encode(&mut b).unwrap();
+        assert_eq!(read32(&b, CONTEXT), c.context);
+        assert_eq!(read64(&b, 0x14), c.notifier.get());
+        assert_eq!(read32(&b, 0x728) & 0xffff, 20);
+        assert_eq!(read32(&b, REGISTERS + 8 * REGISTER_STRIDE), 0x12091);
+        assert_eq!(read64(&b, META), c.stamp.get());
+        assert_eq!(&b[SIZE..], &[0xa5; EXTENDED_SIZE - SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_config.rs b/drivers/gpu/drm/asahi/m3/m3_config.rs
index c4a44c4b4f3b0e..67f4f963637f23 100644
--- a/drivers/gpu/drm/asahi/m3/m3_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_config.rs
@@ -49,6 +49,8 @@ impl Records {
 
 pub(crate) struct Config {
     objects: KVec<Buffer>,
+    profile: super::m3_profile::Profile,
+    control_generation: u32,
     _iomaps: KVec<mmu::KernelMapping>,
     pub(crate) completed_events: u64,
     pstates: crate::m3::m3_adt_config::PstateWatch,
@@ -140,7 +142,8 @@ impl Config {
         crate::m3::m3_adt_config::check_upload(dev.as_ref().as_ref(), firmware, contents.iomaps, &mut objects)?;
         agx_memory::publish();
         let thermal = crate::m3::m3_thermal::Governor::new(dev.as_ref().as_ref(), &contents.pstates)?;
-        Ok(Self { objects, _iomaps: iomaps, completed_events: 0,
+        Ok(Self { objects, profile: firmware.profile(), control_generation: 0,
+            _iomaps: iomaps, completed_events: 0,
             pstates: crate::m3::m3_adt_config::PstateWatch::new(contents.pstates), thermal,
             request_top:contents.table.0,request_value:0,request_checked:false,
             request_check_at:None,request_writes:0,request_observed:0 })
@@ -261,6 +264,9 @@ impl Config {
         Ok(true)
     }
     pub(crate) fn ready(&mut self) -> Result<bool> {
+        if self.profile == super::m3_profile::Profile::Extended {
+            return Ok(self.objects[RUNTIME_FLAGS].read_u32(0x14)? == 1);
+        }
         // NewRegionB+4 is an input initialized to 1, not an acknowledgement.
         // These are firmware-written transitions present in compute-15's
         // pre-submit snapshot; both start at zero in the exported schema.
@@ -343,10 +349,38 @@ impl Config {
         agx_memory::publish();
         Ok(next)
     }
+    /// Publish an extended-format synchronous control. The caller rings the
+    /// doorbell after this method and waits for both retirement cursors.
+    pub(crate) fn control_extended(&mut self, action: super::m3_channel_format::Action) -> Result<u32> {
+        use super::m3_channel_format as format;
+        if self.profile != super::m3_profile::Profile::Extended { return Err(EINVAL); }
+        let state = storage::DEVICE_CONTROL * 2;
+        let cursors = [self.objects[state].read_u32(0)?,
+            self.objects[state].read_u32(0x10)?, self.objects[state].read_u32(0x20)?];
+        let cursor = format::idle_cursor(cursors).map_err(|_| EBUSY)?;
+        let consumed = self.objects[CONTROL_REGION].read_u32(0xeae8)?;
+        let generation = action.generation(self.control_generation, consumed).map_err(|_| EOVERFLOW)?;
+        let mut record = [0; format::CONTROL_BYTES];
+        action.encode(&mut record).map_err(|_| EINVAL)?;
+        self.objects[state + 1].write(cursor as usize * format::CONTROL_BYTES, &record)?;
+        if generation != 0 {
+            self.objects[GLOBALS].write(0xe41, &generation.to_le_bytes())?;
+        }
+        agx_memory::publish();
+        let next = (cursor + 1) % format::SLOTS;
+        self.objects[state].u32(0x20, next)?;
+        agx_memory::publish();
+        self.control_generation = generation;
+        Ok(next)
+    }
+
     pub(crate) fn control_done(&mut self, next: u32) -> Result<bool> {
         Ok(self.objects[storage::DEVICE_CONTROL*2].read_u32(0)? == next && self.objects[storage::DEVICE_CONTROL*2].read_u32(0x10)? == next)
     }
     pub(crate) fn drain(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            return self.drain_extended(dev);
+        }
         // Event, trace, stats and six independent firmware log rings.
         for (state, ring, size, count, channels) in [(storage::EVENT*2,storage::EVENT*2+1,0x38,256,1),
             (storage::TRACE*2,storage::TRACE*2+1,0x38,512,1),
@@ -392,4 +426,147 @@ impl Config {
         }
         Ok(())
     }
+    fn drain_extended(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
+        use super::m3_channel_format as format;
+        // Snapshot each producer once. New arrivals remain for the next drain;
+        // a corrupt cursor is rejected before reading its ring allocation.
+        for (channel, capacity, threads) in [(storage::FIRMWARE_LOG, 256, 9),
+            (storage::EVENT, 256, 1), (storage::TRACE, 512, 1), (storage::STATS, 256, 1)] {
+            let state = channel * 2;
+            for thread in 0..threads {
+                let at = thread * 0x30;
+                let mut read = self.objects[state].read_u32(at)?;
+                let write = self.objects[state].read_u32(at + 0x20)?;
+                if read >= capacity || write >= capacity { return Err(EIO); }
+                let before = read;
+                while read != write {
+                    let offset = (thread * capacity as usize + read as usize) * format::RECEIVE_BYTES;
+                    let mut record = [0; format::RECEIVE_BYTES];
+                    self.objects[state + 1].read(offset, &mut record)?;
+                    let kind = u32::from_le_bytes(record[..4].try_into().map_err(|_| EIO)?);
+                    if channel == storage::FIRMWARE_LOG {
+                        let slot = u32::from_le_bytes(record[8..12].try_into().map_err(|_| EIO)?);
+                        let payload = format::payload_offset(thread, slot).map_err(|_| EIO)?;
+                        if crate::debug::debug_enabled(crate::debug::DebugFlags::KTraceCh) {
+                            let mut text = [0; 200];
+                            self.objects[FWLOG_PAYLOAD].read(payload + 0x10, &mut text)?;
+                            let len = text.iter().position(|value| *value == 0).unwrap_or(text.len());
+                            dev_info!(dev.as_ref(), "M3 firmware log[{}]: {}\n", thread,
+                                core::str::from_utf8(&text[..len]).unwrap_or("<non-UTF8>"));
+                        }
+                    } else if channel == storage::EVENT {
+                        if kind != 1 {
+                            dev_err!(dev.as_ref(), "M3 firmware event {}: {:02x?}\n", kind, record);
+                            return Err(EIO);
+                        }
+                        let flags = u32::from_le_bytes(record[4..8].try_into().map_err(|_| EIO)?);
+                        self.completed_events = self.completed_events.saturating_add((flags & 7).count_ones().into());
+                    } else if (channel == storage::TRACE && kind != 5)
+                        || (channel == storage::STATS && kind == 0x16) {
+                        dev_err!(dev.as_ref(), "M3 firmware channel {} record {}: {:02x?}\n", channel, kind, record);
+                        return Err(EIO);
+                    }
+                    read = (read + 1) % capacity;
+                }
+                if read != before { self.objects[state].u32(at, read)?; }
+            }
+        }
+        agx_memory::publish();
+        Ok(())
+    }
+
+}
+
+/// All extended initialization owners, retained as one construction transaction.
+/// Nothing is published to RTKit by this constructor. A failed allocation drops
+/// its mappings before backing storage and leaves no root visible to firmware.
+pub(crate) struct ExtendedStorage {
+    pub(crate) objects: KVec<Buffer>,
+    pub(crate) iomaps: KVec<mmu::KernelMapping>,
+    pub(crate) descriptors: KVec<u8>,
+    pub(crate) maximum_khz: u32,
+}
+
+impl ExtendedStorage {
+    pub(crate) fn new(
+        dev: &driver::AsahiDrmDevice,
+        uat: &mmu::Uat,
+        pwr: &super::hw::PwrConfig,
+        sram_uv: &[u32],
+        bases: super::m3_mmio_26::RegisterBases,
+    ) -> Result<Self> {
+        use super::{m3_init_26 as plan, m3_mmio_26 as io};
+        let mut objects = KVec::new();
+        for index in 0..plan::COUNT {
+            let entry = plan::allocation(index).map_err(|_| EINVAL)?;
+            let alias = match index {
+                plan::GLOBAL_POOL => Some((uat.kernel_lower_vm(), 0x70_0000_0000)),
+                plan::GLOBAL_PARAMETERS => Some((uat.kernel_lower_vm(), 0x70_0000_8000)),
+                _ => None,
+            };
+            let object = if plan::cached(index) {
+                Buffer::at_prot(dev, uat.kernel_vm(), alias, Some(entry.address), entry.size,
+                    prot::PROT_FW_PRIV_RW, prot::PROT_GPU_SHARED_RW)?
+            } else {
+                Buffer::at(dev, uat.kernel_vm(), alias, Some(entry.address), entry.size, entry.gpu_shared)?
+            };
+            objects.push(object, GFP_KERNEL)?;
+        }
+        let mut descriptors = KVec::new();
+        descriptors.resize(io::SLOTS * io::RECORD_BYTES, 0, GFP_KERNEL)?;
+        let mut iomaps = KVec::new();
+        for slot in 0..io::SLOTS {
+            let mut region = None;
+            if let Some(area) = io::area(slot, bases).map_err(|_| EINVAL)? {
+                let address = 0xffff_fc23_0000_0000 + slot as u64 * 0x10_0000;
+                let access = if area.writable() { prot::PROT_FW_MMIO_RW } else { prot::PROT_FW_MMIO_RO };
+                for (physical, bytes, offset) in area.banks() {
+                    if bytes == 0 { continue; }
+                    let mapping = uat.kernel_vm().map_io_m3(address + offset as u64,
+                        physical.try_into()?, bytes, access)?;
+                    iomaps.push(mapping, GFP_KERNEL)?;
+                }
+                region = Some(init::Region::new(address, area.mapped_bytes()).map_err(|_| EINVAL)?);
+            }
+            io::encode(slot, bases, region,
+                &mut descriptors[slot * io::RECORD_BYTES..(slot + 1) * io::RECORD_BYTES])
+                .map_err(|_| EINVAL)?;
+        }
+        // Runtime+0x18 references Fender SRAM, rather than anonymous DMA RAM.
+        // Retain its normal shared mapping independently of its MMIO view.
+        let scratch_physical = bases.gpu.checked_add(0xd6_0000).ok_or(EOVERFLOW)?;
+        let scratch = uat.kernel_vm().map_io_m3(0xffff_fc22_0000_0000,
+            scratch_physical.try_into()?, 0x8000, prot::PROT_FW_SHARED_RW)?;
+        let scratch_region = init::Region::new(scratch.iova(), 0x8000).map_err(|_| EINVAL)?;
+        iomaps.push(scratch, GFP_KERNEL)?;
+        let mut regions = [init::Region::new(0xffff_fc21_0000_0000, 1).map_err(|_| EINVAL)?; plan::COUNT];
+        for (index, object) in objects.iter().enumerate() {
+            regions[index] = init::Region::new(object.va(), object.size()).map_err(|_| EINVAL)?;
+        }
+        let graph = plan::PointerGraph { owners: &regions, scratch: scratch_region,
+            pool_alias: objects[plan::GLOBAL_POOL].gpu_va()?,
+            parameter_alias: objects[plan::GLOBAL_PARAMETERS].gpu_va()? };
+        let mut root = [0; 0xc8];
+        let mut runtime = [0; plan::RUNTIME_SIZE];
+        let mut control = KVec::new();
+        control.resize(plan::allocation(CONTROL_REGION).map_err(|_| EINVAL)?.size, 0, GFP_KERNEL)?;
+        graph.root(&mut root).map_err(|_| EINVAL)?;
+        graph.runtime(&mut runtime).map_err(|_| EINVAL)?;
+        graph.firmware_control(&mut control).map_err(|_| EINVAL)?;
+        let images = super::m3_power_26::PowerImages::new(pwr, sram_uv,
+            objects[plan::SENSOR_VALUE].va(), objects[plan::RETENTION_STATE].va(),
+            agx_memory::TIMESTAMP_RANGE.start, &descriptors)?;
+        objects[storage::ROOT].write(0, &root)?;
+        objects[RUNTIME_POINTERS].write(0, &runtime)?;
+        objects[CONTROL_REGION].write(0, &control)?;
+        objects[HARDWARE_DATA].write(0, &images.hardware)?;
+        objects[plan::PERFORMANCE_CONTROL].write(0, &images.performance)?;
+        objects[GLOBALS_POWER].write(0, &images.power)?;
+        objects[GLOBALS].write(0, &images.globals)?;
+        // Fragment scheduler entries start unassigned; these are input sentinels.
+        objects[UNKNOWN_C1].u32(0xc18, u32::MAX)?;
+        objects[UNKNOWN_C1].u32(0xc30, u32::MAX)?;
+        agx_memory::publish();
+        Ok(Self { objects, iomaps, descriptors, maximum_khz: images.maximum_khz })
+    }
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_firmware.rs b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
index c9aa45cc028648..6bc87a33aaa052 100644
--- a/drivers/gpu/drm/asahi/m3/m3_firmware.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
@@ -255,6 +255,51 @@ impl Firmware {
     }
 }
 
+/// Only the admitted extended image has this host-owned boot descriptor slot.
+fn loader_span(profile: super::m3_profile::Profile, data_bytes: u64, input_bytes: usize)
+    -> Option<core::ops::Range<usize>> {
+    if profile != super::m3_profile::Profile::Extended || input_bytes != 53 * 40
+        || data_bytes != T8122_LAYOUT_26.data_size { return None; }
+    let start: usize = 0x12_28e0;
+    let end = start.checked_add(input_bytes)?;
+    if end as u64 > data_bytes { return None; }
+    Some(start..end)
+}
+
+#[cfg(not(test))]
+impl Firmware {
+    /// Call after RTKit application startup and before exposing the InitData root.
+    /// The protocol grants the host this slot only during that boot interval.
+    pub(crate) fn publish_io_table(
+        &self,
+        pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
+        descriptors: &[u8],
+    ) -> kernel::error::Result {
+        use kernel::{c_str, io::mem::{Mem, MemFlag}, prelude::*};
+        let data = self.resources.regions[5];
+        let span = loader_span(self.profile(), data.size, descriptors.len()).ok_or(EINVAL)?;
+        let node = pdev.as_ref().of_node().ok_or(ENODEV)?;
+        let resource = agx_resources::reserved_resource(&node, c_str!("fw-data"))?;
+        if resource.start() != data.base || resource.size() != data.size { return Err(EINVAL); }
+        // SAFETY: This exact admitted no-map reservation remains firmware-owned.
+        // Only its bounded host boot slot is accessed, before root publication.
+        let mapping = unsafe { Mem::try_new(resource, MemFlag::WC.into()) }?;
+        if span.end > mapping.size() { return Err(EINVAL); }
+        // Validate the whole slot before changing any byte. Unexpected prior
+        // contents indicate a protocol/ownership mismatch, not a patchable image.
+        for offset in span.clone() {
+            // SAFETY: span is bounded by the retained mapping above.
+            if unsafe { mapping.ptr().add(offset).read_volatile() } != 0 { return Err(EBUSY); }
+        }
+        for (offset, byte) in span.zip(descriptors.iter().copied()) {
+            // SAFETY: same bounded host slot, exclusive under the boot protocol.
+            unsafe { mapping.ptr().add(offset).write_volatile(byte) };
+        }
+        crate::m3::agx_memory::publish();
+        Ok(())
+    }
+}
+
 #[cfg(not(test))]
 pub(crate) fn identify_loaded(
     pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
@@ -527,4 +572,18 @@ mod tests {
         assert!(!newer.accepts_runtime(KNOWN_IMAGES_T8122[0].uuid, &[0; 32]));
     }
 
+    #[test]
+    fn loader_slot_is_exact_bounded_and_profile_specific() {
+        use super::super::m3_profile::Profile;
+        let length = 53 * 40;
+        assert_eq!(loader_span(Profile::Extended, 0x12c000, length), Some(0x1228e0..0x123128));
+        for size in [0, 0x123127, 0x12bfff, 0x12c001, u64::MAX] {
+            assert!(loader_span(Profile::Extended, size, length).is_none());
+        }
+        for bytes in [0, length - 1, length + 1, usize::MAX] {
+            assert!(loader_span(Profile::Extended, 0x12c000, bytes).is_none());
+        }
+        assert!(loader_span(Profile::Legacy, 0x12c000, length).is_none());
+    }
+
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_init_26.rs b/drivers/gpu/drm/asahi/m3/m3_init_26.rs
index f08f16200b0700..a86432b2bbe2b5 100644
--- a/drivers/gpu/drm/asahi/m3/m3_init_26.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_init_26.rs
@@ -62,7 +62,7 @@ pub(crate) fn allocation(index: usize) -> Result<Allocation, Error> {
 }
 
 pub(crate) fn cached(index: usize) -> bool {
-    matches!(index, 38 | 39 | 42 | 43 | 44 | PERFORMANCE_CONTROL)
+    matches!(index, 39 | PERFORMANCE_CONTROL)
 }
 
 pub(crate) struct PointerGraph<'a> {
@@ -103,7 +103,10 @@ impl PointerGraph<'_> {
         }
         let scratch = self.scratch.at(0, 0x8000)?;
         let scratch_end = scratch.checked_add(0x8000).ok_or(Error::Address)?;
-        if scratch & 0x3fff != 0 || scratch_end > 0xffff_fc2f_fc00_0000 {
+        if scratch & 0x3fff != 0
+            || scratch < 0xffff_fc20_0000_0000
+            || scratch_end > 0xffff_fc2f_fc00_0000
+        {
             return Err(Error::Address);
         }
         for (index, address) in addresses.iter().enumerate() {
@@ -272,4 +275,19 @@ mod tests {
         assert!(graph(&owners).runtime(&mut output).is_err());
         assert_eq!(output, [0xa5; RUNTIME_SIZE]);
     }
+    #[test]
+    fn only_atomic_controller_owners_are_firmware_cacheable() {
+        let selected: Vec<_> = (0..COUNT).filter(|index| cached(*index)).collect();
+        assert_eq!(selected, vec![39, PERFORMANCE_CONTROL]);
+    }
+
+    #[test]
+    fn scratch_requires_its_firmware_host_window() {
+        let owners = owners(0);
+        let mut value = graph(&owners);
+        value.scratch = Region::new(0xffff_fc10_0000_0000, 0x8000).unwrap();
+        let mut output = [0xa5; RUNTIME_SIZE];
+        assert_eq!(value.runtime(&mut output), Err(Error::Address));
+        assert_eq!(output, [0xa5; RUNTIME_SIZE]);
+    }
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs b/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
index e4008f239c4a0d..a17bc0ee399c34 100644
--- a/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_mmio_26.rs
@@ -18,6 +18,10 @@ pub(crate) struct Area {
 }
 
 impl Area {
+    pub(crate) fn writable(self) -> bool {
+        self.writable
+    }
+
     pub(crate) fn page_offset(self) -> usize {
         (self.physical & 0x3fff) as usize
     }
@@ -78,6 +82,16 @@ pub(crate) fn area(slot: usize, bases: RegisterBases) -> Result<Option<Area>, Er
     if physical == 0 || physical.checked_add(bytes as u64).ok_or(Error::Address)? > 1 << 42 {
         return Err(Error::Address);
     }
+    if split
+        && (physical & 0x3fff != 0
+            || physical
+                .checked_add(0x200_0000)
+                .and_then(|v| v.checked_add((bytes / 2) as u64))
+                .filter(|v| *v <= 1 << 42)
+                .is_none())
+    {
+        return Err(Error::Address);
+    }
     Ok(Some(Area {
         physical,
         bytes,
@@ -143,8 +157,7 @@ pub(crate) fn encode(
 mod tests {
     use super::*;
 
-    // Register identities already present in the public T8122 configuration;
-    // memory-controller bank geometry is shared with the public 25G83 encoder.
+    // Resource owners exercise subpage mappings and split memory-controller banks.
     const BASES: RegisterBases = RegisterBases {
         gpu: 0x2_9000_0000,
         interrupt: 0x2_d101_4000,
@@ -262,4 +275,20 @@ mod tests {
             assert_eq!(output, [0xa5; RECORD_BYTES]);
         }
     }
+    #[test]
+    fn split_banks_require_page_alignment_and_both_fit_the_bus() {
+        for memory in [BASES.memory + 4, (1 << 42) - 0x100_0000] {
+            let mut bases = BASES;
+            bases.memory = memory;
+            let mut output = [0xa5; RECORD_BYTES];
+            assert!(encode(
+                3,
+                bases,
+                Some(Region::new(0xffff_fc21_0000_0000, 0x30000).unwrap()),
+                &mut output
+            )
+            .is_err());
+            assert_eq!(output, [0xa5; RECORD_BYTES]);
+        }
+    }
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_power_26.rs b/drivers/gpu/drm/asahi/m3/m3_power_26.rs
new file mode 100644
index 00000000000000..2619c24b4eb6a3
--- /dev/null
+++ b/drivers/gpu/drm/asahi/m3/m3_power_26.rs
@@ -0,0 +1,414 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+//! Build the extended M3 controller images from admitted device-tree inputs.
+//! These are constructor inputs. Firmware owns subsequent controller outputs.
+
+use super::{hw, initdata::PStateTables};
+use crate::{f32, float::F32};
+use kernel::prelude::*;
+
+struct Image(KVec<u8>);
+impl Image {
+    fn new(size: usize) -> Result<Self> {
+        let mut bytes = KVec::new();
+        bytes.resize(size, 0, GFP_KERNEL)?;
+        Ok(Self(bytes))
+    }
+    fn word(&mut self, offset: usize, value: u32) -> Result {
+        self.0
+            .get_mut(offset..offset.checked_add(4).ok_or(EOVERFLOW)?)
+            .ok_or(ERANGE)?
+            .copy_from_slice(&value.to_le_bytes());
+        Ok(())
+    }
+    fn pointer(&mut self, offset: usize, value: u64) -> Result {
+        self.0
+            .get_mut(offset..offset.checked_add(8).ok_or(EOVERFLOW)?)
+            .ok_or(ERANGE)?
+            .copy_from_slice(&value.to_le_bytes());
+        Ok(())
+    }
+    fn float(&mut self, offset: usize, value: F32) -> Result {
+        let bits = value.to_bits();
+        if bits & 0x7f80_0000 == 0x7f80_0000 {
+            return Err(EINVAL);
+        }
+        self.word(offset, bits)
+    }
+    fn reciprocal(&mut self, negative: usize, positive: usize, periods: u32) -> Result {
+        if periods == 0 {
+            return Err(EINVAL);
+        }
+        let alpha = f32!(1.0) / F32::from(periods);
+        self.float(negative, f32!(1.0) - alpha)?;
+        self.float(positive, alpha)
+    }
+}
+
+pub(crate) struct PowerImages {
+    pub(crate) hardware: KVec<u8>,
+    pub(crate) performance: KVec<u8>,
+    pub(crate) power: KVec<u8>,
+    pub(crate) globals: KVec<u8>,
+    pub(crate) maximum_khz: u32,
+}
+
+impl PowerImages {
+    /// `sram_uv` follows the same OPP iteration order as PwrConfig::perf_states.
+    /// No reference-bin voltage or experimental OPP-power estimate is substituted.
+    pub(crate) fn new(
+        pwr: &hw::PwrConfig,
+        sram_uv: &[u32],
+        sensor: u64,
+        retention: u64,
+        timestamp_base: u64,
+        io_records: &[u8],
+    ) -> Result<Self> {
+        let table = PStateTables::new(pwr, true, None, false)?;
+        let second = table.secondary.ok_or(EINVAL)?;
+        if table.len != 9
+            || table.max != 8
+            || sram_uv.len() != pwr.perf_states.len()
+            || pwr.perf_base_pstate == 0
+            || pwr.perf_base_pstate > 8
+            || !(1..=1000).contains(&pwr.power_sample_period)
+            || pwr.pwr_min_duty_cycle > 100
+            || pwr.avg_power_min_duty_cycle > 100
+            || io_records.len() != super::m3_mmio_26::SLOTS * super::m3_mmio_26::RECORD_BYTES
+            || [sensor, retention, timestamp_base]
+                .iter()
+                .any(|value| *value < 0xffff_fc00_0000_0000 || value & 7 != 0)
+        {
+            return Err(EINVAL);
+        }
+        let top = &pwr.perf_states[table.primary[8] as usize];
+        let base = &pwr.perf_states[table.primary[pwr.perf_base_pstate as usize] as usize];
+        if top.freq_hz != 1_338_000_000 || base.freq_hz >= top.freq_hz {
+            return Err(EINVAL);
+        }
+        let period = pwr.power_sample_period;
+        let ppm_periods = pwr.ppm_filter_time_constant_ms / period;
+        let average_periods = pwr.avg_power_filter_tc_ms / period;
+        if [
+            ppm_periods,
+            average_periods,
+            pwr.pwr_filter_time_constant,
+            pwr.perf_filter_time_constant,
+            pwr.perf_filter_time_constant2,
+            pwr.avg_power_target_filter_tc,
+            pwr.se_filter_time_constant,
+            pwr.se_filter_time_constant_1,
+        ]
+        .contains(&0)
+        {
+            return Err(EINVAL);
+        }
+        let clocks = |count: u32| {
+            count
+                .checked_mul(period)
+                .and_then(|v| v.checked_mul(24_000))
+                .ok_or(EOVERFLOW)
+        };
+        let dt = F32::from(period) / f32!(1000.0);
+        let ceiling = 800;
+        let base_units = pwr.perf_base_pstate * 100;
+        // The profile controller budget is independent of the loader's experimental
+        // OPP power model. It is not a demand floor or a replacement voltage table.
+        let budget = 22_044u32;
+        let mut main = Image::new(0x2658)?;
+        let mut performance = Image::new(0x6578)?;
+        let mut power = Image::new(0x670)?;
+        let mut globals = Image::new(0xe48)?;
+
+        main.pointer(0x28, timestamp_base)?;
+        main.0[0x640..0xe88].copy_from_slice(io_records);
+        main.pointer(0xe88, retention)?;
+        main.word(0xe90, 0x8122)?;
+        main.word(0xe94, 2)?;
+        main.word(0xe9c, 4)?;
+        main.word(0xea0, 1)?;
+        main.word(0xea4, 1)?;
+        main.word(0xeb8, 1)?;
+        main.word(0xec0, 1)?;
+        main.word(0xec8, 1)?;
+        main.word(0xed0, 24_000)?;
+        main.word(0xed4, 1)?;
+        main.word(0xed8, period)?;
+        main.word(0xee0, 1)?;
+        main.word(0xee4, 1)?;
+        main.word(0xee8, 1)?;
+        main.word(0xf04, 31)?;
+        main.pointer(0xf24, 4)?;
+        main.word(0xf34, 1)?;
+        // Firmware completion is polled through its normal bounded status path.
+        main.word(0xf38, 0)?;
+        main.word(0xf4c, 49)?;
+        main.word(0xf6c, 1)?;
+        main.word(0xf88, 10)?;
+        main.word(0xf8c, 3)?;
+        main.word(0xfac, 1)?;
+        main.word(0xfb8, 22)?;
+        main.word(0xfbc, 5)?;
+        main.word(0xfc0, 10)?;
+        main.word(0xfc4, 8)?;
+        main.word(0x1cd8, 8)?;
+        for state in 0..9 {
+            let primary = table.primary[state] as usize;
+            let secondary = second[state] as usize;
+            let item = &pwr.perf_states[primary];
+            let auxiliary = &pwr.perf_states[secondary];
+            if item.volt_mv.len() != 1
+                || auxiliary.volt_mv.len() != 1
+                || !(100..=1100).contains(&item.volt_mv[0])
+                || !(100..=1100).contains(&auxiliary.volt_mv[0])
+                || !(100_000..=1_100_000).contains(&sram_uv[primary])
+                || !(100_000..=1_100_000).contains(&sram_uv[secondary])
+                || sram_uv[primary].div_ceil(1000) < item.volt_mv[0]
+                || sram_uv[secondary].div_ceil(1000) < auxiliary.volt_mv[0]
+            {
+                return Err(EINVAL);
+            }
+            main.word(0xfc8 + state * 4, item.freq_hz / 1_000_000)?;
+            main.word(0x1808 + state * 4, auxiliary.freq_hz / 1_000_000)?;
+            main.float(0x1848 + state * 4, f32!(1.02))?;
+            for lane in 0..16 {
+                main.word(0x1008 + state * 64 + lane * 4, item.volt_mv[0])?;
+                main.word(
+                    0x1408 + state * 64 + lane * 4,
+                    sram_uv[primary].div_ceil(1000),
+                )?;
+            }
+            main.word(0x1cdc + state * 4, auxiliary.freq_hz / 1_000_000)?;
+            if state != 0 {
+                main.word(0x1d1c + state * 64, auxiliary.volt_mv[0])?;
+            }
+            main.word(0x211c + state * 64, sram_uv[secondary].div_ceil(1000))?;
+            if state != 0 {
+                // Profile indices for the admitted eight-state ladder.
+                let core_profile = if state <= 3 { state } else { 2 * state - 3 };
+                let auxiliary_profile = if state <= 4 { state } else { 2 * state - 4 };
+                main.word(0x19c8 + state * 4, core_profile as u32)?;
+                main.word(0x1a08 + state * 4, auxiliary_profile as u32)?;
+                let boost = item.freq_hz.saturating_sub(base.freq_hz) / 1_000_000;
+                main.word(
+                    0x1908 + state * 4,
+                    100 * boost / ((top.freq_hz - base.freq_hz) / 1_000_000),
+                )?;
+            }
+        }
+        // The native relative-power calibration of each running firmware state.
+        // Encode only these semantic percentages, not an object-image overlay.
+        for (state, percent) in [15, 25, 36, 46, 58, 75, 90, 100].into_iter().enumerate() {
+            main.word(0x18c8 + (state + 1) * 4, percent)?;
+        }
+        main.word(0x2544, 4)?;
+        main.word(0x2548, 6)?;
+        main.word(0x254c, 3)?;
+        main.word(0x2550, 7)?;
+        main.word(0x2554, 7)?;
+        main.word(0x2568, 10)?;
+        main.word(0x2570, 1)?;
+        main.word(0x258c, 0x160000)?;
+        main.word(0x2594, 1)?;
+        main.word(0x2598, 1)?;
+        main.word(0x259c, 1)?;
+        main.word(0x25a4, 1)?;
+        main.word(0x25a8, 1)?;
+        main.word(0x25ac, 1)?;
+        main.0[0x25b4..0x25e4].fill(0xff);
+        main.word(0x2604, 1)?;
+        main.word(0x2634, 1)?;
+
+        globals.word(0x24, 3000)?;
+        globals.word(0x78, 1)?;
+        globals.word(0x84, budget)?;
+        for offset in [0x88, 0x8c, 0x98] {
+            globals.word(offset, ceiling)?;
+        }
+        globals.word(0x998, 40)?;
+        globals.word(0x99c, 10)?;
+        globals.word(0x9a0, 250)?;
+        globals.word(0x9b8, 2)?;
+        globals.word(0x9bc, 40)?;
+        globals.word(0x9c0, 5)?;
+        globals.word(0x9c8, 40)?;
+        globals.word(0x9cc, 50)?;
+        globals.word(0xe28, 3)?;
+
+        power.word(0x10, average_periods)?;
+        power.float(0x14, pwr.avg_power_ki_only * dt)?;
+        power.float(0x18, pwr.avg_power_kp)?;
+        power.word(0x1c, pwr.avg_power_min_duty_cycle)?;
+        power.word(0x20, pwr.avg_power_target_filter_tc)?;
+        power.word(0xc8, 11_000)?;
+        power.word(0xcc, 8_000)?;
+        power.float(0xd8, pwr.fast_die0_proportional_gain)?;
+        power.float(0xdc, pwr.fast_die0_integral_gain * dt)?;
+        power.word(0x12c, budget)?;
+        power.float(0x130, pwr.ppm_kp)?;
+        power.float(0x134, pwr.ppm_ki * dt)?;
+        power.word(0x14c, 1)?;
+
+        performance.word(4, pwr.pwr_sample_period_aic_clks)?;
+        performance.word(8, pwr.pwr_sample_period_aic_clks)?;
+        performance.word(0x10, 4)?;
+        performance.float(0x14, f32!(1.0))?;
+        performance.word(0x2c, 1)?;
+        performance.word(0x30, 1)?;
+        // Leave the observed hardware state at zero until firmware writes it.
+        for offset in [0x40, 0x80, 0xb78, 0xb80, 0xbc0] {
+            performance.word(offset, base_units)?;
+        }
+        for offset in [0x44, 0x6c, 0x70, 0x84] {
+            performance.word(offset, 1)?;
+        }
+        for offset in [
+            0x48, 0x88, 0x9f4, 0x9f8, 0xa38, 0xaac, 0xaf0, 0xb7c, 0x221c, 0x22b4, 0x22b8, 0x22f8,
+            0x2870, 0x29f8, 0x29fc, 0x2a3c, 0x2b88, 0x2c44, 0x2c88,
+        ] {
+            performance.word(offset, ceiling)?;
+        }
+        performance.word(0x50, 100)?;
+        performance.word(0x60, 4)?;
+        performance.float(0x64, f32!(1.0))?;
+        performance.word(0x90, 100)?;
+        performance.word(0x9b8, 625)?;
+        performance.reciprocal(0x9c4, 0x9cc, pwr.pwr_filter_time_constant)?;
+        performance.float(0x9d4, pwr.pwr_integral_gain)?;
+        performance.float(0x9dc, F32::from(pwr.pwr_integral_min_clamp))?;
+        performance.float(0x9e0, F32::from(budget))?;
+        performance.float(0x9e4, pwr.pwr_proportional_gain)?;
+        performance.float(0x9ec, -F32::from(ceiling) / F32::from(budget))?;
+        for offset in [0x9f0, 0xaa8, 0x22b0] {
+            performance.word(offset, pwr.pwr_min_duty_cycle)?;
+        }
+        for offset in [0xa04, 0xabc, 0x28c8, 0x28cc, 0x28d0, 0x2a08] {
+            performance.word(offset, budget)?;
+        }
+        performance.word(0xa70, ppm_periods.checked_mul(4).ok_or(EOVERFLOW)?)?;
+        performance.reciprocal(0xa7c, 0xa84, ppm_periods)?;
+        performance.float(0xa8c, pwr.ppm_ki * dt)?;
+        performance.float(0xa98, f32!(65536.0))?;
+        performance.float(0xa9c, pwr.ppm_kp)?;
+        performance.word(0xac8, pwr.ppm_filter_time_constant_ms)?;
+        performance.word(0xad0, clocks(ppm_periods)?)?;
+        performance.word(0xb28, pwr.perf_tgt_utilization)?;
+        performance.word(0xb30, pwr.perf_boost_min_util)?;
+        performance.word(0xb34, pwr.perf_boost_ce_step)?;
+        performance.word(0xb38, pwr.perf_reset_iters)?;
+        performance.word(0xb40, 6)?;
+        performance.word(0xb44, 1)?;
+        performance.word(0xb48, pwr.perf_filter_drop_threshold)?;
+        performance.reciprocal(0xb4c, 0xb54, pwr.perf_filter_time_constant)?;
+        performance.reciprocal(0xb50, 0xb58, pwr.perf_filter_time_constant2)?;
+        performance.float(0xb5c, pwr.perf_integral_gain)?;
+        performance.float(0xb60, pwr.perf_integral_gain2)?;
+        performance.float(0xb64, F32::from(pwr.perf_integral_min_clamp))?;
+        performance.float(0xb68, f32!(95.0))?;
+        performance.float(0xb6c, pwr.perf_proportional_gain)?;
+        performance.float(0xb70, pwr.perf_proportional_gain2)?;
+        performance.float(0xb74, F32::from(8 - pwr.perf_base_pstate) / f32!(0.95))?;
+        performance.word(0xb8c, pwr.perf_tgt_utilization)?;
+        performance.float(0x21f0, f32!(65536.0))?;
+        performance.float(0x21f4, F32::from(pwr.pwr_min_duty_cycle))?;
+        performance.float(0x21f8, F32::from(ceiling))?;
+        performance.word(0x21fc, 1338)?;
+        performance.float(0x2218, f32!(100.0))?;
+        performance.float(0x2224, f32!(0.8))?;
+        performance.float(0x2228, f32!(0.2))?;
+        performance.word(0x2268, 0x4248)?;
+        performance.word(0x2270, 8_000)?;
+        performance.word(0x2278, 4)?;
+        performance.float(0x228c, f32!(1.0))?;
+        performance.float(0x2294, pwr.fast_die0_integral_gain * dt)?;
+        performance.float(0x22a0, f32!(65536.0))?;
+        performance.float(0x22a4, pwr.fast_die0_proportional_gain)?;
+        performance.word(0x22c4, 11_000)?;
+        performance.word(0x28c0, 1)?;
+        performance.reciprocal(0x28dc, 0x28e0, pwr.avg_power_target_filter_tc)?;
+        performance.word(
+            0x28e4,
+            pwr.avg_power_target_filter_tc
+                .checked_mul(4)
+                .ok_or(EOVERFLOW)?,
+        )?;
+        performance.word(
+            0x28e8,
+            pwr.avg_power_target_filter_tc
+                .checked_mul(period)
+                .ok_or(EOVERFLOW)?,
+        )?;
+        performance.word(0x28ec, clocks(pwr.avg_power_target_filter_tc)?)?;
+        performance.word(0x29bc, average_periods.checked_mul(4).ok_or(EOVERFLOW)?)?;
+        performance.reciprocal(0x29c8, 0x29d0, average_periods)?;
+        performance.float(0x29d8, pwr.avg_power_ki_only * dt)?;
+        performance.float(0x29e4, f32!(65536.0))?;
+        performance.float(0x29e8, pwr.avg_power_kp)?;
+        performance.word(0x29f4, pwr.avg_power_min_duty_cycle)?;
+        performance.float(0x2a04, F32::from(budget))?;
+        performance.word(0x2a14, pwr.avg_power_filter_tc_ms)?;
+        performance.word(0x2a1c, clocks(average_periods)?)?;
+        performance.word(0x2b4c, 50)?;
+        performance.word(0x2b50, 1)?;
+        performance.reciprocal(0x2b58, 0x2b60, pwr.se_filter_time_constant)?;
+        performance.reciprocal(0x2b5c, 0x2b64, pwr.se_filter_time_constant_1)?;
+        performance.float(0x2b68, pwr.se_ki * dt)?;
+        performance.float(0x2b6c, pwr.se_ki_1 * dt)?;
+        performance.float(0x2b74, f32!(65536.0))?;
+        performance.float(0x2b78, pwr.se_kp)?;
+        performance.float(0x2b7c, pwr.se_kp_1)?;
+        performance.word(0x2b84, 100)?;
+        performance.word(0x2b8c, 100)?;
+        performance.word(0x2b98, pwr.se_target)?;
+        performance.word(
+            0x2ba4,
+            pwr.se_filter_time_constant
+                .checked_mul(period)
+                .ok_or(EOVERFLOW)?,
+        )?;
+        performance.word(
+            0x2ba8,
+            pwr.se_filter_time_constant_1
+                .checked_mul(period)
+                .ok_or(EOVERFLOW)?,
+        )?;
+        performance.word(0x2bac, clocks(pwr.se_filter_time_constant)?)?;
+        performance.word(0x2bb4, clocks(pwr.se_filter_time_constant_1)?)?;
+        performance.float(0x2b94, f32!(8000.0))?;
+        for offset in [0x2bc0, 0x2bc4, 0x2c30] {
+            performance.float(offset, f32!(65536.0))?;
+        }
+        performance.word(0x2be8, 8000)?;
+        performance.word(0x2bec, 4)?;
+        performance.word(0x2bf0, pwr.se_inactive_threshold)?;
+        performance.word(0x2bf4, pwr.se_engagement_criteria as u32)?;
+        performance.word(0x2bf8, 2)?;
+        performance.word(0x2bfc, 4)?;
+        performance.word(0x2c00, pwr.se_reset_criteria)?;
+        performance.word(0x2c40, pwr.avg_power_min_duty_cycle)?;
+        performance.word(0x2e2c, 4)?;
+        performance.float(0x2e38, f32!(0.96875))?;
+        performance.float(0x2e40, f32!(0.03125))?;
+        performance.float(0x2e48, f32!(5.0))?;
+        performance.float(0x2e54, f32!(65536.0))?;
+        performance.float(0x2e58, f32!(15.0))?;
+        performance.word(0x2e64, 700)?;
+        for offset in [0x2e68, 0x2e6c, 0x2e78] {
+            performance.word(offset, ceiling)?;
+        }
+        performance.word(0x2f08, 0x4248)?;
+        performance.word(0x2f10, 125)?;
+        performance.word(0x2f14, 1)?;
+        performance.pointer(0x3b50, sensor)?;
+        performance.word(0x3b58, 0x4b48)?;
+        performance.word(0x3b60, 1)?;
+        performance.word(0x62a8, 1)?;
+        Ok(Self {
+            hardware: main.0,
+            performance: performance.0,
+            power: power.0,
+            globals: globals.0,
+            maximum_khz: top.freq_hz / 1000,
+        })
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/mod.rs b/drivers/gpu/drm/asahi/m3/mod.rs
index 7073ecf294d631..d885da1a8647ca 100644
--- a/drivers/gpu/drm/asahi/m3/mod.rs
+++ b/drivers/gpu/drm/asahi/m3/mod.rs
@@ -202,3 +202,8 @@ mod t8122_hwdata;
 mod m3_init_26;
 mod m3_profile;
 mod m3_mmio_26;
+
+#[cfg(CONFIG_DRM_ASAHI_M3_T8122)]
+mod m3_power_26;
+
+mod m3_channel_format;
diff --git a/tools/asahi/m3-runtime-tests.rs b/tools/asahi/m3-runtime-tests.rs
index f1768a242147b6..abac06668c0a1c 100644
--- a/tools/asahi/m3-runtime-tests.rs
+++ b/tools/asahi/m3-runtime-tests.rs
@@ -24,3 +24,15 @@ mod m3_profile;
 
 #[path = "../../drivers/gpu/drm/asahi/m3/m3_mmio_26.rs"]
 mod m3_mmio_26;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_queue_layout.rs"]
+mod m3_queue_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_pool_layout.rs"]
+mod m3_pool_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_compute_layout.rs"]
+mod m3_compute_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_channel_format.rs"]
+mod m3_channel_format;
diff --git a/tools/asahi/test-m3-power.py b/tools/asahi/test-m3-power.py
new file mode 100644
index 00000000000000..51bea088cd9db5
--- /dev/null
+++ b/tools/asahi/test-m3-power.py
@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+"""Run the production controller writer and soft-float code without a GPU.
+
+Kernel allocation/DT adapters are replaced by host adapters. Public production
+power types and PStateTables are extracted as complete balanced Rust items,
+never restated by hand. Their input hashes are printed with the test evidence.
+"""
+from pathlib import Path
+import hashlib
+import subprocess
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[2]
+M3 = ROOT / "drivers/gpu/drm/asahi/m3"
+
+
+def item(source, anchor):
+    start = source.index(anchor)
+    opening = source.index("{", start)
+    depth = 1
+    end = opening + 1
+    while depth:
+        if source[end] == "{":
+            depth += 1
+        elif source[end] == "}":
+            depth -= 1
+        end += 1
+    return source[start:end]
+
+
+shim = r'''
+#![allow(dead_code)]
+extern crate self as kernel;
+pub type Error = i32;
+pub type Result<T = ()> = core::result::Result<T, Error>;
+pub const EINVAL: Error = 22;
+pub const EOVERFLOW: Error = 75;
+pub const ERANGE: Error = 34;
+pub const GFP_KERNEL: () = ();
+pub unsafe trait Zeroable {}
+#[derive(Debug)]
+pub struct KVec<T>(Vec<T>);
+impl<T> Default for KVec<T> { fn default() -> Self { Self(Vec::new()) } }
+impl<T> KVec<T> {
+    pub fn new() -> Self { Self::default() }
+    pub fn resize(&mut self, n: usize, value: T, _: ()) -> Result where T: Clone {
+        self.0.resize(n, value); Ok(())
+    }
+}
+impl<T> core::ops::Deref for KVec<T> { type Target = Vec<T>; fn deref(&self) -> &Vec<T> { &self.0 } }
+impl<T> core::ops::DerefMut for KVec<T> { fn deref_mut(&mut self) -> &mut Vec<T> { &mut self.0 } }
+pub mod prelude { pub use crate::{Error,Result,EINVAL,EOVERFLOW,ERANGE,GFP_KERNEL,KVec,Zeroable}; }
+pub mod of {
+    pub struct Property<'a>(pub &'a [u8]);
+    pub trait PropertyUnit: Sized { const UNIT_SIZE: usize; fn from_bytes(data: &[u8]) -> crate::Result<Self>; }
+    impl PropertyUnit for u32 {
+        const UNIT_SIZE: usize = 4;
+        fn from_bytes(data: &[u8]) -> crate::Result<Self> {
+            Ok(u32::from_be_bytes(data.try_into().map_err(|_| crate::EINVAL)?))
+        }
+    }
+    impl TryFrom<Property<'_>> for u32 {
+        type Error = crate::Error;
+        fn try_from(value: Property<'_>) -> crate::Result<Self> { Self::from_bytes(value.0) }
+    }
+}
+'''
+fixture = r'''
+#[cfg(test)] mod controller_tests {
+    use super::*;
+    use float::F32;
+    fn input() -> hw::PwrConfig {
+        let mut p = hw::PwrConfig::default();
+        p.perf_states = KVec((0..9).map(|i| hw::PState {
+            freq_hz: if i == 8 { 1_338_000_000 } else { i * 100_000_000 },
+            volt_mv: KVec(vec![if i == 0 { 125 } else { 450 + i * 50 }]), pwr_mw: i * 1000,
+        }).collect());
+        p.perf_base_pstate = 1;
+        p.power_sample_period = 8;
+        p.ppm_filter_time_constant_ms = 16;
+        p.avg_power_filter_tc_ms = 16;
+        p.pwr_filter_time_constant = 2;
+        p.perf_filter_time_constant = 2;
+        p.perf_filter_time_constant2 = 2;
+        p.avg_power_target_filter_tc = 2;
+        p.se_filter_time_constant = 2;
+        p.se_filter_time_constant_1 = 2;
+        p.pwr_min_duty_cycle = 30;
+        p.avg_power_min_duty_cycle = 20;
+        p
+    }
+    fn build(p: &hw::PwrConfig, sram: &[u32]) -> Result<m3_power_26::PowerImages> {
+        m3_power_26::PowerImages::new(p, sram, 0xffff_fc21_0340_0000,
+            0xffff_fc21_0350_0000, 0xffff_fc2f_fc00_0000, &[0; 53 * 40])
+    }
+    fn word(b: &[u8], at: usize) -> u32 { u32::from_le_bytes(b[at..at + 4].try_into().unwrap()) }
+    #[test] fn native_controller_bounds_are_distinct_from_outputs_and_hardware_state() {
+        let image = build(&input(), &[950_001; 9]).unwrap();
+        assert_eq!(image.hardware.len(), 0x2658);
+        assert_eq!(image.performance.len(), 0x6578);
+        assert_eq!(image.power.len(), 0x670);
+        assert_eq!(image.globals.len(), 0xe48);
+        assert_eq!(image.maximum_khz, 1_338_000);
+        assert_eq!(word(&image.performance, 0x2c), 1);
+        assert_eq!(word(&image.performance, 0x30), 1);
+        assert_eq!(word(&image.performance, 0x38), 0);
+        assert_eq!(word(&image.performance, 0x9f0), 30);
+        assert_eq!(word(&image.performance, 0xa38), 800);
+        assert_eq!(word(&image.performance, 0xb78), 100);
+        assert_eq!(word(&image.performance, 0xb7c), 800);
+        assert_eq!(word(&image.hardware, 0x1408 + 64), 951);
+        assert_eq!(word(&image.performance, 0x2268), 0x4248);
+        assert_eq!(word(&image.performance, 0x3b58), 0x4b48);
+    }
+    #[test] fn malformed_tunables_and_nonfinite_gains_are_rejected() {
+        for period in [0, 1001, u32::MAX] {
+            let mut p = input(); p.power_sample_period = period;
+            assert!(build(&p, &[950_000; 9]).is_err());
+        }
+        for bits in [0x7f800000, 0xff800000, 0x7fc00001] {
+            let mut p = input(); p.pwr_integral_gain = F32::from_bits(bits);
+            assert!(build(&p, &[950_000; 9]).is_err());
+        }
+        assert!(build(&input(), &[950_000; 8]).is_err());
+        assert!(build(&input(), &[100_000; 9]).is_err());
+        let mut p = input(); p.avg_power_target_filter_tc = u32::MAX;
+        assert!(build(&p, &[950_000; 9]).is_err());
+    }
+    #[test] fn dt_order_is_not_the_firmware_voltage_order() {
+        let p = input();
+        let expected = build(&p, &[950_000; 9]).unwrap();
+        let mut shuffled = input();
+        shuffled.perf_states.swap(2, 6);
+        let actual = build(&shuffled, &[950_000; 9]).unwrap();
+        assert_eq!(actual.hardware.0, expected.hardware.0);
+        assert_eq!(actual.performance.0, expected.performance.0);
+    }
+}
+'''
+
+
+def main():
+    hw = (M3 / "hw.rs").read_text()
+    init = (M3 / "initdata.rs").read_text()
+    code = shim
+    # Keep the production soft-float prefix verbatim. Its unrelated existing
+    # print-only TODO test lacks an import and is not part of this harness.
+    soft_float = (ROOT / "drivers/gpu/drm/asahi/float.rs").read_text()
+    code += "mod float {\n" + soft_float.split("// TODO: Make this an actual test", 1)[0] + "\n}\n"
+    code += "mod hw { use crate::{KVec,float::F32};\n"
+    for name in ["PState", "PowerZone", "CsAfrPwrConfig", "PwrConfig"]:
+        code += "#[derive(Default)]\n" + item(hw, "pub(crate) struct " + name + " {") + "\n"
+    code += item(hw, "impl PState {") + "\n"
+    code += "}\nmod initdata { use crate::{prelude::*,hw}; const PSTATE_TABLE_ENTRIES: usize = 16;\n"
+    code += item(init, "pub(crate) struct PStateTables {") + "\n"
+    code += item(init, "impl PStateTables {") + "\n}\n"
+    code += "mod m3_mmio_26 { pub const SLOTS:usize=53; pub const RECORD_BYTES:usize=40; }\n"
+    code += f'#[path = "{M3}/m3_power_26.rs"] mod m3_power_26;\n'
+    code += fixture
+    for path in [M3 / "hw.rs", M3 / "initdata.rs", M3 / "m3_power_26.rs", ROOT / "drivers/gpu/drm/asahi/float.rs"]:
+        print(hashlib.sha256(path.read_bytes()).hexdigest(), path.relative_to(ROOT), flush=True)
+    with tempfile.TemporaryDirectory(prefix="m3-power-") as directory:
+        source = Path(directory) / "test.rs"
+        source.write_text(code)
+        for flags in [[], ["-O"]]:
+            binary = Path(directory) / "tests"
+            subprocess.run(["rustc", "--edition=2021", "--test", *flags, str(source), "-o", str(binary)], check=True)
+            subprocess.run([str(binary)], check=True)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/aurora-ci/host-tests.json b/tools/aurora-ci/host-tests.json
index 4d2fbc3c53dafb..1b51602b132cec 100644
--- a/tools/aurora-ci/host-tests.json
+++ b/tools/aurora-ci/host-tests.json
@@ -2326,6 +2326,15 @@
         "tools/asahi/test-m3-uapi.py"
       ],
       "rust": "1.85.0"
+    },
+    {
+      "name": "tools/asahi/test-m3-power.py",
+      "group": "tools",
+      "argv": [
+        "python3",
+        "tools/asahi/test-m3-power.py"
+      ],
+      "rust": "1.85.0"
     }
   ],
   "helpers": {

From ff9acb9b030c5dbf1690849e02a5595dd4b757f6 Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:40:41 -0400
Subject: [PATCH 6/9] drm/asahi: prepare extended firmware queues and
 controller handoff

Construct native queue, pool, context and notifier records. Read
controller inputs from the admitted OPP handoff, preserve nanosecond
durations and reject unsupported optional flags. Prepare native startup
without enabling extended admission.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_adt_config.rs     |  57 +++++++-
 drivers/gpu/drm/asahi/m3/m3_compute_layout.rs |  21 +++
 .../gpu/drm/asahi/m3/m3_compute_sequence.rs   | 110 +++++++++++++++
 .../gpu/drm/asahi/m3/m3_compute_storage.rs    |  66 +++++++++
 drivers/gpu/drm/asahi/m3/m3_config.rs         |  79 ++++++++++-
 drivers/gpu/drm/asahi/m3/m3_device.rs         |   6 +
 drivers/gpu/drm/asahi/m3/m3_drm.rs            |   3 +-
 drivers/gpu/drm/asahi/m3/m3_pool.rs           |  31 +++++
 drivers/gpu/drm/asahi/m3/m3_pool_layout.rs    | 128 ++++++++++++++++++
 drivers/gpu/drm/asahi/m3/m3_profile.rs        |  20 +++
 drivers/gpu/drm/asahi/m3/m3_queue_layout.rs   |  41 ++++++
 drivers/gpu/drm/asahi/m3/m3_runtime.rs        |  57 ++++++++
 drivers/gpu/drm/asahi/m3/m3_state_layout.rs   |  52 +++++++
 drivers/gpu/drm/asahi/m3/m3_submit.rs         |   8 +-
 drivers/gpu/drm/asahi/mmu.rs                  |   4 +-
 tools/asahi/m3-runtime-tests.rs               |  10 ++
 16 files changed, 678 insertions(+), 15 deletions(-)

diff --git a/drivers/gpu/drm/asahi/m3/m3_adt_config.rs b/drivers/gpu/drm/asahi/m3/m3_adt_config.rs
index 1893c113cf2a7d..355cd44b040254 100644
--- a/drivers/gpu/drm/asahi/m3/m3_adt_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_adt_config.rs
@@ -260,7 +260,14 @@ impl PstatePolicy {
 
 /// The runtime backend's InitData contents: the generated object images and the
 /// performance-state policy.
+pub(crate) struct ExtendedInputs {
+    pub(crate) power: hw::PwrConfig,
+    pub(crate) sram_uv: KVec<u32>,
+    pub(crate) bases: super::m3_mmio_26::RegisterBases,
+}
+
 pub(crate) struct Contents {
+    pub(crate) extended: Option<ExtendedInputs>,
     /// Generated images, per owner; None for owners that stay zero. Only the three image
     /// owners' images are uploaded; the records' are checked.
     images: KVec<Option<KVVec<u8>>>,
@@ -304,6 +311,10 @@ impl Contents {
         experiment: Option<&Experiment>,
     ) -> Result<Self> {
         let dev = pdev.as_ref();
+        if firmware.profile() == super::m3_profile::Profile::Extended {
+            if experiment.is_some() { return Err(EINVAL); }
+            return Self::extended(dev, soc);
+        }
         let param = m3_params::initdata_param();
         check_version(dev, firmware, experiment)?;
         let iomaps = match experiment {
@@ -370,12 +381,54 @@ impl Contents {
         );
         let read_only_slots = experiment.map(|e| e.read_only_slots()).unwrap_or(0);
         let hwdata_object = soc.hwdata_object;
-        Ok(Contents { images, pstates, iomaps, table, read_only_slots, hwdata_object })
+        Ok(Contents { extended: None, images, pstates, iomaps, table, read_only_slots, hwdata_object })
+    }
+
+    fn extended(dev: &device::Device, soc: &Soc) -> Result<Self> {
+        let cfg = soc.hwcfg.ok_or(ENODEV)?;
+        if soc.chip_id != 0x8122 || cfg.chip_id != 0x8122 { return Err(ENODEV); }
+        let power = hw::PwrConfig::load(dev, cfg)?;
+        let tables = initdata::PStateTables::new(&power, true, None, false)?;
+        if tables.len != 9 || tables.max != 8 || tables.max_frequency_khz(&power) != 1_338_000 {
+            return Err(EINVAL);
+        }
+        let node = dev.of_node().ok_or(ENODEV)?;
+        let opps = node.parse_phandle(c_str!("operating-points-v2"), 0).ok_or(EINVAL)?;
+        let mut sram_uv = KVec::new();
+        for opp in opps.children() {
+            let values: KVec<u32> = opp.get_property(c_str!("opp-microvolt-sram"))?;
+            if values.len() != 1 { return Err(EINVAL); }
+            sram_uv.push(values[0], GFP_KERNEL)?;
+        }
+        if sram_uv.len() != power.perf_states.len() { return Err(EINVAL); }
+        let block = |index: usize| -> Result<u64> {
+            Ok(cfg.io_mappings.get(index).and_then(|value| value.as_ref()).ok_or(EINVAL)?.base as u64)
+        };
+        let bases = super::m3_mmio_26::RegisterBases {
+            gpu: soc.windows.sgx, interrupt: block(2)?,
+            memory: block(11)?.checked_add(0x1c4000).ok_or(EOVERFLOW)?,
+            telemetry_write: block(18)?, telemetry_read: block(19)?,
+            neural: block(25)?, metrology: block(26)?,
+        };
+        let mut freqs = [0; 16];
+        for (index, value) in freqs.iter_mut().enumerate().take(tables.len) {
+            *value = tables.primary_state(&power, index).freq_hz / 1_000_000;
+        }
+        // This profile enables the native firmware's thermal/PID controllers.
+        // The legacy host-only thermal governor must not replace those inputs.
+        let pstates = PstatePolicy { table_max: 8, table_max_mhz: 1338,
+            max: 8, safe: 8, boot: 1, max_mhz: 1338, safe_mhz: 1338,
+            boot_mhz: freqs[1], freqs, thermal: ThermalMode::Off };
+        let mut images = KVec::new();
+        for _ in 0..super::m3_init_26::COUNT { images.push(None, GFP_KERNEL)?; }
+        Ok(Self { extended: Some(ExtendedInputs { power, sram_uv, bases }),
+            images, pstates, iomaps: &[], table: (8, 1338), read_only_slots: 0, hwdata_object: None })
     }
 
     /// Check the contents before they are uploaded.
     pub(crate) fn check_for_upload(&self) -> Result {
-        if self.images.len() == storage::COUNT {
+        let count = if self.extended.is_some() { super::m3_init_26::COUNT } else { storage::COUNT };
+        if self.images.len() == count {
             Ok(())
         } else {
             Err(EINVAL)
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs b/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
index 64c8cb005c4a1a..ace58e38f38a6d 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute_layout.rs
@@ -71,7 +71,14 @@ impl Command {
     /// Firmware envelopes vary independently of the GPU's CDM stream format.
     pub(crate) fn encode_for(&self, profile: super::m3_profile::Profile,
         asid_generation: u8, event_slot: u8, out: &mut [u8]) -> Result<(), Error> {
+        self.encode_with_usc(profile, asid_generation, event_slot, 0, out)
+    }
+
+    pub(crate) fn encode_with_usc(&self, profile: super::m3_profile::Profile,
+        asid_generation: u8, event_slot: u8, usc_base: u64, out: &mut [u8]) -> Result<(), Error> {
         let extended = profile == super::m3_profile::Profile::Extended;
+        if usc_base & 0xffff_ffff != 0 || usc_base >= 1 << 42
+            || (!extended && usc_base != 0) { return Err(Error::Address); }
         let size = if extended { EXTENDED_SIZE } else { SIZE };
         if out.len() < size { return Err(Error::Size); }
         if extended && (self.register_set != RegisterSet::G15G || event_slot >= 4
@@ -122,6 +129,7 @@ impl Command {
             emit(0x1a540, 1);
             emit(0x014a9, 1);
             emit(0x0a351, 1);
+            if usc_base != 0 { emit(0x10071, usc_base); }
         }
         pointer(bytes, 0x720, registers.get());
         bytes[0x728..0x72a].copy_from_slice(&(count as u16).to_le_bytes());
@@ -232,4 +240,17 @@ mod tests {
         assert_eq!(read64(&b, META), c.stamp.get());
         assert_eq!(&b[SIZE..], &[0xa5; EXTENDED_SIZE - SIZE]);
     }
+    #[test]
+    fn optional_usc_window_is_a_dispatch_register_without_stream_rewriting() {
+        let c = fixture();
+        let mut output = [0xa5; EXTENDED_SIZE];
+        c.encode_with_usc(Profile::Extended, 1, 0, 1 << 32, &mut output).unwrap();
+        assert_eq!(read32(&output, 0x728) & 0xffff, 25);
+        assert_eq!(read32(&output, REGISTERS + 24 * REGISTER_STRIDE), 0x10071);
+        assert_eq!(read64(&output, REGISTERS + 24 * REGISTER_STRIDE + 4), 1 << 32);
+        output.fill(0xa5);
+        assert!(c.encode_with_usc(Profile::Extended, 1, 0, 1, &mut output).is_err());
+        assert_eq!(output, [0xa5; EXTENDED_SIZE]);
+    }
+
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs b/drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs
index a10c3040d570f0..bd78c03823aa07 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs
@@ -82,3 +82,113 @@ impl Sequence {
         Ok(())
     }
 }
+
+impl Sequence {
+    pub(crate) const EXTENDED_LENGTH: usize = 0x300;
+    pub(crate) const EXTENDED_ATTACHMENTS: usize = 0x58;
+    pub(crate) const EXTENDED_HAS_ATTACHMENTS: usize = 0x2c0;
+
+    /// The extended firmware operates on a native G15 CDM stream. Its firmware
+    /// microsequence has wider timestamp operations and different engine state.
+    pub(crate) fn encode_extended(&self, auxiliary: command::GpuVa,
+        context_store: super::m3_pool_layout::GpuRegion, queue_sequence: u64,
+        output: &mut [u8]) -> Result<(), Error> {
+        if self.context >= 64 || self.generation != 0 { return Err(Error::Address); }
+        if context_store.size() < 0x20000 { return Err(Error::Size); }
+        let registers = self.command.at(command::REGISTERS, 24 * command::REGISTER_STRIDE)?;
+        let engine = self.command.at(0x76c, 0x60)?;
+        let clock = self.command.at(0x82c, 8)?;
+        let pairs = self.command.at(0x834, 16)?;
+        let end_pair = self.command.at(0x83c, 8)?;
+        let pool_pointer = self.command.at(0x86a, 8)?;
+        let status = self.command.at(0x8ac, 4)?;
+        let time_aux = self.command.at(0x89c, 8)?;
+        let elapsed = self.command.at(0x7dc, 8)?;
+        let tail = self.command.at(0x88c, 8)?;
+        let activity = self.stats.at(0, 8)?;
+        let bytes = output.get_mut(..STORAGE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        word(bytes, 0, 0x0b);
+        pointer(bytes, 0x14, registers);
+        pointer(bytes, 0x1c, activity);
+        pointer(bytes, 0x24, self.queue.get());
+        word(bytes, 0x2c, self.context);
+        word(bytes, 0x30, 1);
+        pointer(bytes, 0x38, queue_sequence);
+        pointer(bytes, 0x44, engine);
+        word(bytes, 0x50, 1);
+        pointer(bytes, 0x160, self.pool.get());
+        pointer(bytes, 0x178, auxiliary.get());
+        for (offset, delta) in [0, 0xf400, 0x1e800, 0x1f000].into_iter().enumerate() {
+            pointer(bytes, 0x188 + offset * 8, context_store.base() + delta);
+        }
+        pointer(bytes, 0x1a8, status);
+        word(bytes, 0x1b8, 2);
+        // Timestamp records are 76 bytes; WFI sits between the two records.
+        for (offset, opcode, selected) in [(0x1bc, 0x8000_0003, pairs), (0x20c, 3, end_pair)] {
+            word(bytes, offset, opcode);
+            pointer(bytes, offset + 4, clock);
+            pointer(bytes, offset + 0xc, pairs);
+            pointer(bytes, offset + 0x14, selected);
+            pointer(bytes, offset + 0x1c, self.queue.get());
+            pointer(bytes, offset + 0x2c, time_aux);
+            pointer(bytes, offset + 0x34, elapsed);
+            pointer(bytes, offset + 0x44, 0xc10000);
+        }
+        word(bytes, 0x208, 1);
+        let finish = 0x258;
+        word(bytes, finish, 0x0c);
+        pointer(bytes, finish + 4, activity);
+        pointer(bytes, finish + 0xc, self.queue.get());
+        word(bytes, finish + 0x14, self.context);
+        pointer(bytes, finish + 0x18, engine);
+        pointer(bytes, finish + 0x24, 0xc10000);
+        pointer(bytes, finish + 0x2c, self.fw_stamp.get());
+        word(bytes, finish + 0x34, self.stamp_value);
+        pointer(bytes, finish + 0x5c, pool_pointer);
+        word(bytes, finish + 0x64, (-(finish as i32)) as u32);
+        pointer(bytes, finish + 0x69, status);
+        pointer(bytes, finish + 0x71, tail);
+        word(bytes, 0x2d4, 0x4000_0002);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    fn fixture() -> Sequence {
+        let fw = |i: u64| FirmwareVa::new(0xffff_fc21_a000_0000 + i * 0x4000).unwrap();
+        Sequence { command: Region::new(fw(0).get(), command::EXTENDED_SIZE).unwrap(),
+            stats: Region::new(fw(1).get(), 0xe10).unwrap(),
+            notifier: Region::new(fw(2).get(), 0x200).unwrap(), queue: fw(3),
+            context: 3, generation: 0, pool: fw(4), scratch: [fw(5); 5],
+            fw_stamp: fw(6), stamp_value: 0x700 }
+    }
+    fn ptr(bytes: &[u8], at: usize) -> u64 { u64::from_le_bytes(bytes[at..at + 8].try_into().unwrap()) }
+    #[test] fn extended_timestamps_and_retirement_refer_to_their_live_owners() {
+        let s = fixture();
+        let mut output = [0xa5; STORAGE + 8];
+        s.encode_extended(command::GpuVa::new(0x5000_0000).unwrap(),
+            super::super::m3_pool_layout::GpuRegion::new(0x6000_0000, 0x20000).unwrap(), 7, &mut output).unwrap();
+        assert_eq!(ptr(&output, 0x1c), s.stats.at(0, 8).unwrap());
+        assert_eq!(ptr(&output, 0x38), 7);
+        assert_eq!(ptr(&output, 0x188), 0x6000_0000);
+        assert_eq!(ptr(&output, 0x1bc + 0x14), s.command.at(0x834, 8).unwrap());
+        assert_eq!(ptr(&output, 0x20c + 0x14), s.command.at(0x83c, 8).unwrap());
+        assert_eq!(ptr(&output, 0x258 + 0x2c), s.fw_stamp.get());
+        assert_eq!(ptr(&output, 0x258 + 0x5c), s.command.at(0x86a, 8).unwrap());
+        assert_eq!(&output[STORAGE..], &[0xa5; 8]);
+    }
+    #[test] fn extended_sequence_rejects_legacy_command_extents_and_event_generations() {
+        for generation in [0, 1] {
+            let mut s = fixture();
+            s.generation = generation;
+            if generation == 0 { s.command = Region::new(s.command.at(0, 1).unwrap(), command::SIZE).unwrap(); }
+            let mut output = [0xa5; STORAGE];
+            assert!(s.encode_extended(command::GpuVa::new(0x5000_0000).unwrap(),
+                super::super::m3_pool_layout::GpuRegion::new(0x6000_0000, 0x20000).unwrap(), 0, &mut output).is_err());
+            assert_eq!(output, [0xa5; STORAGE]);
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute_storage.rs b/drivers/gpu/drm/asahi/m3/m3_compute_storage.rs
index 6bd3aecda387d3..a897a45f0922de 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute_storage.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute_storage.rs
@@ -87,3 +87,69 @@ pub(crate) fn allocation(index:usize)->Result<Allocation,InvalidOwner> {
 pub(crate) fn coalesce_stamp_flush(wide:bool,timestamps:[u64;2],last:bool)->bool {
     wide && timestamps==[0,0] && !last
 }
+
+pub(crate) fn allocation_for(profile: super::m3_profile::Profile, index: usize)
+    -> Result<Allocation, InvalidOwner> {
+    let mut owner = allocation(index)?;
+    if profile == super::m3_profile::Profile::Legacy { return Ok(owner); }
+    match index {
+        // The initial allocator has eight 4-MiB payload owners. Retain the
+        // historical indices without allocating unused 4-MiB payloads.
+        9..=22 => { owner.size = 0x4000; owner.mapping = Mapping::FirmwareOnly; }
+        POOL_PAGES => owner.size = 0x20000,
+        POOL_TABLE => { owner.size = 0x4000; owner.mapping = Mapping::Client(POOL_TABLE_VA & !0x3fff); }
+        POOL => owner.size = 0xa0,
+        GPU_CONTEXT => owner.size = 0x38,
+        NOTIFIER => owner.size = 0x200,
+        EVENT => owner.size = 8,
+        QUEUE => owner.size = 0x24c0,
+        PREEMPTION => owner.size = 0x4000,
+        COMMAND => { owner.size = 0x8b0; owner.mapping = Mapping::CommandAlias(0x73_0000_0000); }
+        TAIL_SCRATCH => { owner.size = 0x4000; owner.mapping = Mapping::Client(0x72_0100_0000); }
+        46 => { owner.size = 0x40000; owner.mapping = Mapping::Client(0x72_0000_0000); }
+        45 | 47..=49 => { owner.size = 0x4000; owner.mapping = Mapping::FirmwareOnly; }
+        _ => {}
+    }
+    Ok(owner)
+}
+
+pub(crate) fn slot_offset_for(profile: super::m3_profile::Profile, index: usize, slot: usize)
+    -> Result<usize, InvalidOwner> {
+    if slot >= SLOTS { return Err(InvalidOwner); }
+    let size = allocation_for(profile, index)?.size;
+    Ok(if RESET.contains(&index) { ((size + 0x3fff) & !0x3fff) * slot } else { 0 })
+}
+
+pub(crate) fn batch_allocation_for(profile: super::m3_profile::Profile, index: usize)
+    -> Result<Allocation, InvalidOwner> {
+    let mut owner = allocation_for(profile, index)?;
+    owner.size += slot_offset_for(profile, index, SLOTS - 1)?;
+    Ok(owner)
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    use super::super::m3_profile::Profile;
+    #[test] fn extended_commands_do_not_straddle_another_slots_page() {
+        let command = allocation_for(Profile::Extended, COMMAND).unwrap();
+        let Mapping::CommandAlias(base) = command.mapping else { panic!("missing command alias") };
+        assert_eq!(base & 0x3fff, 0);
+        for slot in 0..SLOTS - 1 {
+            let start = slot_offset_for(Profile::Extended, COMMAND, slot).unwrap();
+            let next = slot_offset_for(Profile::Extended, COMMAND, slot + 1).unwrap();
+            assert!(start + command.size <= next);
+        }
+        assert_eq!(batch_allocation_for(Profile::Extended, QUEUE).unwrap().size, 0x24c0);
+        assert!(slot_offset_for(Profile::Extended, COMMAND, SLOTS).is_err());
+    }
+    #[test] fn legacy_plan_is_byte_for_byte_the_same_for_every_owner_and_slot() {
+        for index in 0..COUNT {
+            assert_eq!(allocation_for(Profile::Legacy, index), allocation(index));
+            for slot in 0..SLOTS {
+                assert_eq!(slot_offset_for(Profile::Legacy, index, slot), slot_offset(index, slot));
+            }
+            assert_eq!(batch_allocation_for(Profile::Legacy, index), batch_allocation(index));
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_config.rs b/drivers/gpu/drm/asahi/m3/m3_config.rs
index 67f4f963637f23..bfb408b07a5307 100644
--- a/drivers/gpu/drm/asahi/m3/m3_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_config.rs
@@ -51,6 +51,7 @@ pub(crate) struct Config {
     objects: KVec<Buffer>,
     profile: super::m3_profile::Profile,
     control_generation: u32,
+    io_descriptors: Option<KVec<u8>>,
     _iomaps: KVec<mmu::KernelMapping>,
     pub(crate) completed_events: u64,
     pstates: crate::m3::m3_adt_config::PstateWatch,
@@ -67,6 +68,17 @@ impl Config {
     pub(crate) fn new(dev: &driver::AsahiDrmDevice, uat: &mmu::Uat, firmware: &crate::m3::m3_firmware::Firmware,
         contents: &crate::m3::m3_adt_config::Contents) -> Result<Self> {
         contents.check_for_upload()?;
+        if let Some(inputs) = &contents.extended {
+            if firmware.profile() != super::m3_profile::Profile::Extended { return Err(EINVAL); }
+            let owners = ExtendedStorage::new(dev, uat, &inputs.power, &inputs.sram_uv, inputs.bases)?;
+            let thermal = crate::m3::m3_thermal::Governor::new(dev.as_ref().as_ref(), &contents.pstates)?;
+            return Ok(Self { objects: owners.objects, _iomaps: owners.iomaps,
+                profile: firmware.profile(), control_generation: 0, completed_events: 0,
+                io_descriptors: Some(owners.descriptors),
+                pstates: crate::m3::m3_adt_config::PstateWatch::new(contents.pstates), thermal,
+                request_top: 8, request_value: 0, request_checked: false, request_check_at: None,
+                request_writes: 0, request_observed: 0 });
+        }
         let mut objects = KVec::new();
         let mut iomaps = KVec::new();
         for index in 0..storage::COUNT {
@@ -142,7 +154,7 @@ impl Config {
         crate::m3::m3_adt_config::check_upload(dev.as_ref().as_ref(), firmware, contents.iomaps, &mut objects)?;
         agx_memory::publish();
         let thermal = crate::m3::m3_thermal::Governor::new(dev.as_ref().as_ref(), &contents.pstates)?;
-        Ok(Self { objects, profile: firmware.profile(), control_generation: 0,
+        Ok(Self { objects, profile: firmware.profile(), control_generation: 0, io_descriptors: None,
             _iomaps: iomaps, completed_events: 0,
             pstates: crate::m3::m3_adt_config::PstateWatch::new(contents.pstates), thermal,
             request_top:contents.table.0,request_value:0,request_checked:false,
@@ -156,6 +168,15 @@ impl Config {
         objects[RUNTIME_POINTERS].write(0, &records.runtime)?;
         objects[CONTROL_REGION].write(0, &records.control)
     }
+    pub(crate) fn publish_io_table(&self,
+        pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
+        firmware: &crate::m3::m3_firmware::Firmware) -> Result {
+        if let Some(descriptors) = &self.io_descriptors {
+            firmware.publish_io_table(pdev, descriptors)?;
+        }
+        Ok(())
+    }
+
     pub(crate) fn root(&self) -> u64 { self.objects[storage::ROOT].va() }
     pub(crate) fn log_globals_debug(&mut self,dev:&driver::AsahiDrmDevice)->Result {
         let value=self.objects[GLOBALS].read_u32(crate::m3::m3_globals_debug::OFFSET)?;
@@ -164,6 +185,8 @@ impl Config {
         Ok(())
     }
     pub(crate) fn performance_request(&mut self,chip:u32,busy:bool)->Result {
+        // Native controller inputs supersede the legacy fixed-request interface.
+        if self.profile == super::m3_profile::Profile::Extended { return Ok(()); }
         let Some(value)=crate::m3::m3_consistent_perf::request(chip,
             crate::m3::m3_params::consistent_perf(),busy,self.request_top) else {return Ok(());};
         if value==0 && self.request_value==0 {return Ok(());}
@@ -195,6 +218,14 @@ impl Config {
     /// state the firmware reports against the ceiling and the runtime cap. Called after boot and
     /// after every job, by the job thread.
     pub(crate) fn check_pstate(&mut self, dev: &driver::AsahiDrmDevice, device: &crate::m3::m3_device::Device, what: &str) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            let state = device.pstate_register()? & 15;
+            if state > self.request_top {
+                dev_err!(dev.as_ref(), "M3: native performance state {} exceeds {} ({})\n", state, self.request_top, what);
+                return Err(ERANGE);
+            }
+            return Ok(());
+        }
         let now = kernel::time::Instant::<kernel::time::Monotonic>::now();
         if let Some(cap) = self.thermal.update(dev.as_ref().as_ref(), now) {
             crate::m3::m3_adt_config::publish_runtime_cap(&mut self.objects[GLOBALS], cap)?;
@@ -206,13 +237,25 @@ impl Config {
         Ok(())
     }
     pub(crate) fn stats_region(&self) -> Result<init::Region> {
-        let owner = &self.objects[HARDWARE_DATA];
+        let owner = &self.objects[if self.profile == super::m3_profile::Profile::Extended {
+            UNKNOWN_C3
+        } else { HARDWARE_DATA }];
         init::Region::new(owner.va(), owner.size()).map_err(|_| EINVAL)
     }
 
     pub(crate) fn log_active_power(&mut self, dev: &driver::AsahiDrmDevice,
                                   device: &crate::m3::m3_device::Device,
                                   sequence: u32) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            let state = device.pstate_register()? & 15;
+            let performance = &mut self.objects[super::m3_init_26::PERFORMANCE_CONTROL];
+            let actual = performance.read_u32(0x2c)?;
+            let target = performance.read_u32(0x30)?;
+            let hardware = performance.read_u32(0x38)?;
+            dev_info!(dev.as_ref(), "M3_NATIVE_POWER sample={} state={} actual={} target={} hardware={}\n",
+                sequence, state, actual, target, hardware);
+            return Ok(());
+        }
         let cap = self.thermal.allowed(kernel::time::Instant::<kernel::time::Monotonic>::now());
         self.pstates.log_active(dev.as_ref().as_ref(), &mut self.objects[HARDWARE_DATA],
                                device.pstate_register()?, cap, sequence)?;
@@ -232,6 +275,7 @@ impl Config {
     }
 
     pub(crate) fn render_pb(&mut self) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended { return Err(EOPNOTSUPP); }
         self.objects[UNKNOWN_C1].write(0,&storage::parameter_buffer(crate::m3::m3_render::PB_PAGES).map_err(|_|EINVAL)?)
     }
     pub(crate) fn submit_queue(&mut self, kind:usize, queue:u64, head:u16,event:u8,new:bool)->Result {
@@ -274,6 +318,13 @@ impl Config {
             && self.objects[RUNTIME_FLAGS].read_u32(4)? == 1)
     }
     pub(crate) fn log_ready(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            let ready = self.objects[RUNTIME_FLAGS].read_u32(0x14)?;
+            let consumed = self.objects[CONTROL_REGION].read_u32(0xeae8)?;
+            dev_info!(dev.as_ref(), "M3: extended firmware ready={} control-generation={}/{}\n",
+                ready, consumed, self.control_generation);
+            return Ok(());
+        }
         let magic=self.objects[RUNTIME_POINTERS].read_u32(0x314)?;
         let state=self.objects[RUNTIME_POINTERS].read_u32(0x2fc)?;
         let a=self.objects[RUNTIME_FLAGS].read_u32(4)?;
@@ -284,12 +335,14 @@ impl Config {
     }
     /// The firmware's halt counter and its halted and resume flags.
     pub(crate) fn halt_state(&mut self) -> Result<(u64,u32,u32)> {
+        if self.profile == super::m3_profile::Profile::Extended { return Err(EOPNOTSUPP); }
         let control=&mut self.objects[CONTROL_REGION];
         Ok((control.read_u64(0x4580)?,control.read_u32(0x4590)?,control.read_u32(0x45a0)?))
     }
     /// Let a halted firmware continue: clear halted, then set resume. These
     /// words keep the halt/resume layout of earlier Apple GPU firmware.
     pub(crate) fn resume_halted(&mut self) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended { return Err(EOPNOTSUPP); }
         let control=&mut self.objects[CONTROL_REGION];
         control.u32(0x4590,0)?;
         agx_memory::publish();
@@ -303,6 +356,18 @@ impl Config {
     /// at +0x40a0, and the details it leaves for a recovery event at +0x44a0.
     /// Nothing is acknowledged, cleared or resumed here.
     pub(crate) fn log_recovery_state(&mut self, dev: &driver::AsahiDrmDevice, events: u64) -> Result {
+        if self.profile == super::m3_profile::Profile::Extended {
+            for (owner, start, length) in [(super::m3_init_26::RECOVERY_ACTIVITY, 0, 0x60),
+                (CONTROL_REGION, 0x4ebc, 0x100)] {
+                for offset in (start..start + length).step_by(32) {
+                    let mut bytes = [0; 32];
+                    self.objects[owner].read(offset, &mut bytes)?;
+                    dev_err!(dev.as_ref(), "M3: firmware recovery owner={} offset={:#x} bytes={:02x?}\n",
+                        owner, offset, bytes);
+                }
+            }
+            return Ok(());
+        }
         let control=&mut self.objects[CONTROL_REGION];
         let halt_count=control.read_u64(0x4580)?;
         let halted=control.read_u32(0x4590)?;
@@ -318,7 +383,7 @@ impl Config {
     /// index (at most 16), as `drain` reads them. Nothing is consumed or acknowledged, and the
     /// completion count is not changed.
     pub(crate) fn log_event_ring(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
-        const SIZE: usize = 0x38;
+        let size = if self.profile == super::m3_profile::Profile::Extended { 0x48 } else { 0x38 };
         const COUNT: usize = 256;
         let r = self.objects[storage::EVENT*2].read_u32(0)? as usize;
         let w = self.objects[storage::EVENT*2].read_u32(0x20)? as usize;
@@ -327,8 +392,8 @@ impl Config {
         let mut index = r;
         for _ in 0..16 {
             if index == w { break; }
-            let mut raw = [0u8; SIZE];
-            self.objects[storage::EVENT*2+1].read(index * SIZE, &mut raw)?;
+            let mut raw = [0u8; 0x48];
+            self.objects[storage::EVENT*2+1].read(index * size, &mut raw[..size])?;
             dev_info!(dev.as_ref(), "M3 event ring entry {} kind={} bytes={:02x?}\n",
                 index, u32::from_le_bytes([raw[0], raw[1], raw[2], raw[3]]), raw);
             index = (index + 1) % COUNT;
@@ -357,7 +422,9 @@ impl Config {
         let state = storage::DEVICE_CONTROL * 2;
         let cursors = [self.objects[state].read_u32(0)?,
             self.objects[state].read_u32(0x10)?, self.objects[state].read_u32(0x20)?];
-        let cursor = format::idle_cursor(cursors).map_err(|_| EBUSY)?;
+        let cursor = format::idle_cursor(cursors).map_err(|error| {
+            if error == init::Error::Bounds { EIO } else { EBUSY }
+        })?;
         let consumed = self.objects[CONTROL_REGION].read_u32(0xeae8)?;
         let generation = action.generation(self.control_generation, consumed).map_err(|_| EOVERFLOW)?;
         let mut record = [0; format::CONTROL_BYTES];
diff --git a/drivers/gpu/drm/asahi/m3/m3_device.rs b/drivers/gpu/drm/asahi/m3/m3_device.rs
index c43017a8933c0f..05a3961369a6d2 100644
--- a/drivers/gpu/drm/asahi/m3/m3_device.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_device.rs
@@ -176,6 +176,12 @@ impl Device {
     /// Read-only snapshot. Do not select or acknowledge fault banks here;
     /// the firmware owns those registers until recovery is ported.
     pub(crate) fn log_engine_state(&self, vm: &crate::mmu::Vm) -> Result {
+        if self.firmware.profile() == super::m3_profile::Profile::Extended {
+            // Adaptive clock gating can leave individual engine banks inaccessible
+            // even while the GPU performance-state register says powered up.
+            dev_info!(self.dev.as_ref(), "M3: adaptive firmware fault evidence uses retained metadata; engine banks may be gated\n");
+            return Ok(());
+        }
         let sgx_guard = self.sgx.try_access().ok_or(ENODEV)?;
         let sgx = sgx_guard.as_view();
         let pstate = sgx.try_read32(0xe01000)? & 0xf;
diff --git a/drivers/gpu/drm/asahi/m3/m3_drm.rs b/drivers/gpu/drm/asahi/m3/m3_drm.rs
index d81ce66ac53aa0..4aa982ff95a5cf 100644
--- a/drivers/gpu/drm/asahi/m3/m3_drm.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_drm.rs
@@ -258,7 +258,8 @@ impl gpu::Gpu for Backend {
         _ualloc_priv: Arc<Mutex<alloc::DefaultAllocator>>, priority: u32,
         usc_exec_base: u64) -> Result<KBox<dyn queue::Queue>> {
         Ok(KBox::new(crate::m3::m3_submit::Queue::new(self.shared.clone(),self.scheduler.clone(),vm,priority,usc_exec_base,
-            self.soc.features.fragment_dependency)?,GFP_KERNEL)?)
+            self.feature_flags() & uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_FRAGMENT_DEPENDENCY as u64 != 0,
+            self.feature_flags() & uapi::drm_asahi_feature_DRM_ASAHI_FEATURE_COMPUTE_WIDE_VISIBILITY as u64 != 0)?,GFP_KERNEL)?)
     }
     fn map_timestamp_buffer(&self, bo: gem::ObjectRef, range: Range<usize>) -> Result<crate::timestamp::Buffer> {
         crate::timestamp::Buffer::firmware(
diff --git a/drivers/gpu/drm/asahi/m3/m3_pool.rs b/drivers/gpu/drm/asahi/m3/m3_pool.rs
index ab50ab7eca8a17..4eb284e1291bdb 100644
--- a/drivers/gpu/drm/asahi/m3/m3_pool.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_pool.rs
@@ -39,3 +39,34 @@ impl Owners {
         objects[self.manager].write(0, &manager)
     }
 }
+
+impl Owners {
+    pub(crate) fn initialize_extended(&self, objects: &mut [Buffer], slot: u8,
+        compute_only: bool) -> Result {
+        let mut backings = KVec::new();
+        for index in self.backing.clone().take(8) {
+            let buffer = objects.get(index).ok_or(EINVAL)?;
+            backings.push(wire::GpuRegion::new(buffer.gpu_va()?, buffer.size()).map_err(|_| EINVAL)?, GFP_KERNEL)?;
+        }
+        let backing = wire::ModernBacking(&backings);
+        let populated = backing.pages().map_err(|_| EINVAL)?;
+        let pages = objects.get(self.pages).ok_or(EINVAL)?;
+        let entries = wire::GpuRegion::new(pages.gpu_va()?, pages.size()).map_err(|_| EINVAL)?;
+        let table = objects.get(self.table).ok_or(EINVAL)?;
+        let groups = wire::GpuRegion::new(table.gpu_va()?, table.size()).map_err(|_| EINVAL)?;
+        if groups.size() < populated / 512 * 64 { return Err(EINVAL); }
+        let descriptor = wire::ModernPool { entries, groups,
+            submitted: FirmwareVa::new(objects.get(self.counter).ok_or(EINVAL)?.va()).map_err(|_| EINVAL)?,
+            identity: FirmwareVa::new(objects.get(self.manager).ok_or(EINVAL)?.va()).map_err(|_| EINVAL)?,
+            slot, capacity: (entries.size() / 8).try_into()?, populated: populated.try_into()?, compute_only };
+        let mut bytes = [0; wire::ModernPool::SIZE];
+        descriptor.encode(&mut bytes).map_err(|_| EINVAL)?;
+        for index in 0..populated {
+            objects[self.pages].u64(index * 8, backing.page(index).map_err(|_| EINVAL)?)?;
+        }
+        for index in 0..populated / 512 {
+            objects[self.table].write(index * 64, &backing.group(index).map_err(|_| EINVAL)?)?;
+        }
+        objects[self.manager].write(0, &bytes)
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_pool_layout.rs b/drivers/gpu/drm/asahi/m3/m3_pool_layout.rs
index a8474d262bc26d..ac7e6771f7880b 100644
--- a/drivers/gpu/drm/asahi/m3/m3_pool_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_pool_layout.rs
@@ -69,3 +69,131 @@ impl<'a> Pool<'a> {
         Ok(())
     }
 }
+
+/// Extended firmware's private-memory pool descriptor. The owners and initial
+/// population are supplied separately from the descriptor's firmware state.
+pub(crate) struct ModernPool {
+    pub(crate) identity: FirmwareVa,
+    pub(crate) slot: u8,
+    pub(crate) entries: GpuRegion,
+    pub(crate) groups: GpuRegion,
+    pub(crate) submitted: FirmwareVa,
+    pub(crate) capacity: u32,
+    pub(crate) populated: u32,
+    pub(crate) compute_only: bool,
+}
+
+impl ModernPool {
+    pub(crate) const SIZE: usize = 0xa0;
+
+    pub(crate) fn encode(&self, output: &mut [u8]) -> Result<(), Error> {
+        let entry_bytes = (self.capacity as usize).checked_mul(8).ok_or(Error::Size)?;
+        let group_bytes = (self.populated as usize / 512).checked_mul(8).ok_or(Error::Size)?;
+        if !(1..=64).contains(&self.slot) || self.capacity == 0 || self.populated >= self.capacity || self.populated % 512 != 0
+            || self.entries.base() & 0x3fff != 0 || self.groups.base() & 0x3fff != 0
+            || self.entries.size() < entry_bytes || self.groups.size() < group_bytes
+            || self.submitted.get() & 7 != 0 || self.identity.get() & 7 != 0 { return Err(Error::Address); }
+        let group_count: u32 = group_bytes.try_into().map_err(|_| Error::Size)?;
+        let bytes = output.get_mut(..Self::SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        let word = |bytes: &mut [u8], offset: usize, value: u32| {
+            bytes[offset..offset + 4].copy_from_slice(&value.to_le_bytes());
+        };
+        bytes[..8].copy_from_slice(&self.identity.get().to_le_bytes());
+        word(bytes, 8, self.slot.into());
+        word(bytes, 12, (self.populated == 0).into());
+        word(bytes, 16, 2);
+        bytes[0x14..0x1c].copy_from_slice(&self.entries.base().to_le_bytes());
+        word(bytes, 0x1c, self.capacity);
+        word(bytes, 0x24, self.populated);
+        word(bytes, 0x28, (self.populated == 0).into());
+        word(bytes, 0x2c, self.populated);
+        bytes[0x30..0x38].copy_from_slice(&self.groups.base().to_le_bytes());
+        word(bytes, 0x40, 4);
+        word(bytes, 0x48, group_count);
+        bytes[0x4c..0x54].copy_from_slice(&self.submitted.get().to_le_bytes());
+        word(bytes, 0x5c, (self.compute_only && self.populated != 0).into());
+        word(bytes, 0x84, (self.populated != 0).into());
+        word(bytes, 0x94, 2);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod modern_tests {
+    use super::*;
+    fn pool(compute_only: bool) -> ModernPool {
+        ModernPool { identity: FirmwareVa::new(0xffff_fc21_9100_0000).unwrap(), slot: 1,
+            entries: GpuRegion::new(0x5000_0000, 0x20000).unwrap(),
+            groups: GpuRegion::new(0x6000_0000, 0x4000).unwrap(),
+            submitted: FirmwareVa::new(0xffff_fc21_9000_0000).unwrap(),
+            capacity: 0x4000, populated: 512, compute_only }
+    }
+    fn word(bytes: &[u8], offset: usize) -> u32 {
+        u32::from_le_bytes(bytes[offset..offset + 4].try_into().unwrap())
+    }
+    #[test] fn shared_render_pool_never_gets_compute_exclusion() {
+        for compute in [false, true] {
+            let mut output = [0xa5; ModernPool::SIZE + 8];
+            pool(compute).encode(&mut output).unwrap();
+            assert_eq!(word(&output, 0x5c), compute.into());
+            assert_eq!(word(&output, 0x48), 8);
+            assert_eq!(word(&output, 0x84), 1);
+            assert_eq!(&output[ModernPool::SIZE..], &[0xa5; 8]);
+        }
+    }
+    #[test] fn bad_population_and_insufficient_owners_reject_before_mutation() {
+        for pages in [1, 511, 513, 0x4000] {
+            let mut value = pool(true); value.populated = pages;
+            let mut output = [0xa5; ModernPool::SIZE];
+            assert!(value.encode(&mut output).is_err());
+            assert_eq!(output, [0xa5; ModernPool::SIZE]);
+        }
+        let mut value = pool(true); value.capacity = 0x4001;
+        let mut output = [0xa5; ModernPool::SIZE];
+        assert!(value.encode(&mut output).is_err());
+        assert_eq!(output, [0xa5; ModernPool::SIZE]);
+    }
+}
+
+/// Populate the extended freelist from independently retained 4-MiB owners.
+/// Hardware group records describe 2-MiB subregions, not entire owners.
+pub(crate) struct ModernBacking<'a>(pub(crate) &'a [GpuRegion]);
+impl ModernBacking<'_> {
+    pub(crate) fn pages(&self) -> Result<usize, Error> {
+        if self.0.is_empty() || self.0.len() > 8
+            || self.0.iter().any(|owner| owner.size() != BACKING_SIZE || owner.base() & 0x3fff != 0) {
+            return Err(Error::Size);
+        }
+        Ok(self.0.len() * BACKING_SIZE / PAGE_SIZE)
+    }
+    pub(crate) fn page(&self, index: usize) -> Result<u64, Error> {
+        if index >= self.pages()? { return Err(Error::Index); }
+        let per_owner = BACKING_SIZE / PAGE_SIZE;
+        Ok(self.0[index / per_owner].base() + (index % per_owner * PAGE_SIZE) as u64)
+    }
+    pub(crate) fn group(&self, index: usize) -> Result<[u8; 64], Error> {
+        if index >= self.pages()? / 512 { return Err(Error::Index); }
+        let base = self.page(index * 512)?;
+        let mut record = [0; 64];
+        record[..8].copy_from_slice(&(base | (1 << 61)).to_le_bytes());
+        Ok(record)
+    }
+}
+
+#[cfg(test)]
+mod backing_tests {
+    use super::*;
+    #[test] fn group_records_never_cross_a_noncontiguous_backing_owner() {
+        let owners = [GpuRegion::new(0x5000_0000, BACKING_SIZE).unwrap(),
+            GpuRegion::new(0x6000_0000, BACKING_SIZE).unwrap()];
+        let backing = ModernBacking(&owners);
+        assert_eq!(backing.pages(), Ok(2048));
+        assert_eq!(backing.page(1024), Ok(0x6000_0000));
+        let second = backing.group(2).unwrap();
+        assert_eq!(u64::from_le_bytes(second[..8].try_into().unwrap()), (1 << 61) | 0x6000_0000);
+        assert_eq!(&second[8..], &[0; 56]);
+        assert!(backing.group(4).is_err());
+        assert!(backing.page(2048).is_err());
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_profile.rs b/drivers/gpu/drm/asahi/m3/m3_profile.rs
index c70a88029072b6..004ac2c7d1eef2 100644
--- a/drivers/gpu/drm/asahi/m3/m3_profile.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_profile.rs
@@ -32,6 +32,13 @@ impl Profile {
         }
     }
 
+    pub(crate) fn gpu_duration_ns(self, elapsed: u64) -> Option<u64> {
+        match self {
+            Self::Legacy => elapsed.checked_mul(1000).map(|value| value / 24),
+            Self::Extended => Some(elapsed),
+        }
+    }
+
     pub(crate) const fn vm_acknowledged(self, params_bytes: u64, flags: u32) -> bool {
         // Both profiles consume G15 records; the existing VM padding stays zero.
         params_bytes >= PARAMS_REQUIRED && flags == 0
@@ -66,4 +73,17 @@ mod tests {
         assert_eq!(Profile::Extended.user_end(), 0x3ff_ffff_8000);
         assert_eq!(Profile::Legacy.user_end(), 0x2ff_ffff_8000);
     }
+    #[test]
+    fn native_nanoseconds_are_never_rescaled_as_legacy_ticks() {
+        assert_eq!(
+            Profile::Extended.gpu_duration_ns(24_000_000),
+            Some(24_000_000)
+        );
+        assert_eq!(
+            Profile::Legacy.gpu_duration_ns(24_000_000),
+            Some(1_000_000_000)
+        );
+        assert_eq!(Profile::Extended.gpu_duration_ns(u64::MAX), Some(u64::MAX));
+        assert_eq!(Profile::Legacy.gpu_duration_ns(u64::MAX), None);
+    }
 }
diff --git a/drivers/gpu/drm/asahi/m3/m3_queue_layout.rs b/drivers/gpu/drm/asahi/m3/m3_queue_layout.rs
index 39cc1f5f2e4908..c3411bfdff8ed2 100644
--- a/drivers/gpu/drm/asahi/m3/m3_queue_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_queue_layout.rs
@@ -113,3 +113,44 @@ pub(crate) fn ring_entry(index: u32, capacity: u32, seeds: &[FirmwareVa]) -> Res
     if seeds.is_empty() || seeds.len() > capacity as usize || capacity > 65536 || index >= capacity { return Err(Error::Index); }
     Ok(if (index as usize) < seeds.len() { seeds[index as usize].0.to_le_bytes() } else { [0xcc; 8] })
 }
+
+impl QueueInfo {
+    pub(crate) const EXTENDED_SIZE: usize = 0x24c0;
+
+    /// Scheduler storage belongs to this same retained allocation; it is not
+    /// interchangeable with the legacy GPU scratch object.
+    pub(crate) fn encode_extended(&self, owner: FirmwareVa, output: &mut [u8]) -> Result<(), Error> {
+        let end = owner.get().checked_add(Self::EXTENDED_SIZE as u64).ok_or(Error::Address)?;
+        if end > 0xffff_fc30_0000_0000 { return Err(Error::Address); }
+        let bytes = output.get_mut(..Self::EXTENDED_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        for (offset, value) in [(0, self.state.get()), (8, self.ring.get()),
+            (16, self.job_list.get()), (24, owner.get() + 0xb0), (0xa4, self.context.get())] {
+            bytes[offset..offset + 8].copy_from_slice(&value.to_le_bytes());
+        }
+        for offset in [0x2c, 0x4c] { bytes[offset..offset + 4].fill(0xff); }
+        for offset in [0x30, 0x34, 0x48] {
+            bytes[offset..offset + 4].copy_from_slice(&2u32.to_le_bytes());
+        }
+        bytes[0x38..0x40].copy_from_slice(&0xffff_0000_0000_0000u64.to_le_bytes());
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test] fn scheduler_pointer_relocates_with_its_retained_queue_owner() {
+        let fw = |i: u64| FirmwareVa::new(0xffff_fc21_4000_0000 + i * 0x4000).unwrap();
+        let info = QueueInfo { state: fw(1), ring: fw(2), job_list: fw(3),
+            gpu_scratch: fw(4), context: fw(5), uuid: 9 };
+        let mut output = vec![0xa5; QueueInfo::EXTENDED_SIZE + 8];
+        info.encode_extended(fw(0), &mut output).unwrap();
+        assert_eq!(u64::from_le_bytes(output[24..32].try_into().unwrap()), fw(0).get() + 0xb0);
+        assert_eq!(&output[0xb0..QueueInfo::EXTENDED_SIZE], &vec![0; QueueInfo::EXTENDED_SIZE - 0xb0]);
+        assert_eq!(&output[QueueInfo::EXTENDED_SIZE..], &[0xa5; 8]);
+        let mut short = [0xa5; INFO_SIZE];
+        assert!(info.encode_extended(fw(0), &mut short).is_err());
+        assert_eq!(short, [0xa5; INFO_SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_runtime.rs b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
index 1a366d7f4b3407..40399a80a01f39 100644
--- a/drivers/gpu/drm/asahi/m3/m3_runtime.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
@@ -1214,6 +1214,9 @@ impl Runtime {
     }
     fn boot_inner(&mut self, pdev: &platform::Device<Core<'_>>) -> Result {
         use crate::m3::t8122_start::BootStep;
+        if self.inner.device.firmware().profile() == super::m3_profile::Profile::Extended {
+            return self.boot_extended(pdev);
+        }
         let root = self.inner.config.root();
         dev_info!(pdev.as_ref(), "M3: publishing owned initdata {:#x}\n", root);
         self.inner.boot_step = BootStep::Publish;
@@ -1245,6 +1248,60 @@ impl Runtime {
         dev_info!(pdev.as_ref(), "M3: firmware accepted owned initdata and device controls\n");
         Ok(())
     }
+    fn boot_extended(&mut self, pdev: &platform::Device<Core<'_>>) -> Result {
+        use super::m3_channel_format::Action;
+        use crate::m3::t8122_start::BootStep;
+        // The first control is pending when the root becomes visible. Its
+        // retirement comes from InitData consumption, without a work kick.
+        let first = self.inner.config.control_extended(Action::Initialize)?;
+        self.inner.config.publish_io_table(pdev, self.inner.device.firmware())?;
+        let root = self.inner.config.root();
+        Pin::new(&mut self.inner.transport).send_message(0x20,
+            0x0081_0000_0000_0000 | (root & ((1u64 << 44) - 1)))?;
+        self.inner.boot_step = BootStep::AwaitReady;
+        let deadline = Instant::<Monotonic>::now();
+        while !self.inner.config.ready()? {
+            let inner: &mut Inner = &mut *self.inner;
+            inner.config.drain(&inner.drm)?;
+            if !inner.state.healthy() { return Err(EIO); }
+            if deadline.elapsed() >= Delta::from_secs(2) { return Err(ETIMEDOUT); }
+            fsleep(Delta::from_millis(1));
+        }
+        self.retire_extended_control(first)?;
+        self.inner.boot_step = BootStep::DeviceControl;
+        // Each data master registers its two firmware engine classes.
+        for ordinal in 0..6 {
+            let action = Action::Register { pipe: ordinal / 2, engine: ordinal % 2 + 1 };
+            self.send_extended_control(action)?;
+        }
+        self.inner.boot_step = BootStep::PostReady;
+        self.send_extended_control(Action::Idle { enabled: true })?;
+        let inner: &mut Inner = &mut *self.inner;
+        inner.config.check_pstate(&inner.drm, &inner.device, "after native boot")?;
+        inner.config.log_ready(&inner.drm)?;
+        inner.state.health.set_gpu_pending(false);
+        dev_info!(pdev.as_ref(), "M3: extended firmware ready; native controllers and idle policy admitted\n");
+        Ok(())
+    }
+
+    fn send_extended_control(&mut self, action: super::m3_channel_format::Action) -> Result {
+        let cursor = self.inner.config.control_extended(action)?;
+        Pin::new(&mut self.inner.transport).send_message(0x21, 0x0084_0000_0000_0011)?;
+        self.retire_extended_control(cursor)
+    }
+
+    fn retire_extended_control(&mut self, expected: u32) -> Result {
+        let deadline = Instant::<Monotonic>::now();
+        loop {
+            let inner: &mut Inner = &mut *self.inner;
+            inner.config.drain(&inner.drm)?;
+            if !inner.state.healthy() { return Err(EIO); }
+            if inner.config.control_done(expected)? { return Ok(()); }
+            if deadline.elapsed() >= Delta::from_secs(2) { return Err(ETIMEDOUT); }
+            fsleep(Delta::from_millis(1));
+        }
+    }
+
     fn send_control(&mut self, opcode: u32) -> Result {
         let next = match self.inner.config.control(opcode) {
             Ok(next) => next,
diff --git a/drivers/gpu/drm/asahi/m3/m3_state_layout.rs b/drivers/gpu/drm/asahi/m3/m3_state_layout.rs
index 199b7082b26c29..6eeafea666e742 100644
--- a/drivers/gpu/drm/asahi/m3/m3_state_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_state_layout.rs
@@ -66,3 +66,55 @@ pub(crate) fn manager_misc(out: &mut [u8]) -> Result<(), Error> {
     word(bytes, 0x20, 1); // cpu_flag / reset
     Ok(())
 }
+
+pub(crate) const EXTENDED_CONTEXT_SIZE: usize = 0x38;
+pub(crate) const EXTENDED_NOTIFIER_SIZE: usize = 0x200;
+
+pub(crate) fn context_extended(output: &mut [u8]) -> Result<(), Error> {
+    let bytes = output.get_mut(..EXTENDED_CONTEXT_SIZE).ok_or(Error::Size)?;
+    bytes.fill(0);
+    bytes[..2].fill(0xff);
+    bytes[5] = 1;
+    bytes[0x26] = 2;
+    bytes[0x33] = 0xff;
+    Ok(())
+}
+
+impl Notifier {
+    pub(crate) fn encode_extended(&self, output: &mut [u8]) -> Result<(), Error> {
+        if self.context >= 64 { return Err(Error::Address); }
+        let bytes = output.get_mut(..EXTENDED_NOTIFIER_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        bytes[..8].copy_from_slice(&self.threshold.get().to_le_bytes());
+        word(bytes, 0x10, 0x50);
+        word(bytes, NOTIFIER_CONTEXT, self.context);
+        bytes[0xa8..0xb0].fill(0xff);
+        word(bytes, 0x114, 1);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test] fn registration_state_is_left_to_firmware() {
+        let mut bytes = [0xa5; EXTENDED_CONTEXT_SIZE + 8];
+        context_extended(&mut bytes).unwrap();
+        assert_eq!(&bytes[..6], &[255, 255, 0, 0, 0, 1]);
+        assert_eq!(bytes[0x26], 2);
+        assert_eq!(bytes[0x33], 255);
+        assert_eq!(&bytes[EXTENDED_CONTEXT_SIZE..], &[0xa5; 8]);
+    }
+    #[test] fn notifier_has_zero_generation_and_distinct_firmware_storage() {
+        let notifier = Notifier { threshold: FirmwareVa::new(0xffff_fc21_7000_0000).unwrap(), context: 3 };
+        let mut bytes = [0xa5; EXTENDED_NOTIFIER_SIZE + 8];
+        notifier.encode_extended(&mut bytes).unwrap();
+        assert_eq!(&bytes[8..12], &[0; 4]);
+        assert_eq!(&bytes[0xa8..0xb0], &[255; 8]);
+        assert_eq!(&bytes[0x114..0x118], &[1, 0, 0, 0]);
+        assert_eq!(&bytes[EXTENDED_NOTIFIER_SIZE..], &[0xa5; 8]);
+        let mut short = [0xa5; NOTIFIER_SIZE];
+        assert!(notifier.encode_extended(&mut short).is_err());
+        assert_eq!(short, [0xa5; NOTIFIER_SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_submit.rs b/drivers/gpu/drm/asahi/m3/m3_submit.rs
index 1212113af1618a..c3a25c9a2dc04d 100644
--- a/drivers/gpu/drm/asahi/m3/m3_submit.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_submit.rs
@@ -177,11 +177,12 @@ pub(crate) struct Queue {
     shared:Shared,vm:mmu::Vm,usc:u64,fences:FenceContexts,
     /// Whether the SoC advertises early tiling (`m3_soc::Features::fragment_dependency`).
     early_tiling:bool,
+    wide_visibility:bool,
     urgency:u8,
 }
 impl Queue {
     pub(crate) fn new(shared:Shared,scheduler:Arc<sched::Scheduler<Job>>,vm:mmu::Vm,priority:u32,usc:u64,
-        early_tiling:bool)->Result<Self> {
+        early_tiling:bool, wide_visibility:bool)->Result<Self> {
         agx_uapi::QueueUscWindow{base:usc,user_start:0x4000,user_end:(1u64<<42)-0x8000}.validate().map_err(|_|EINVAL)?;
         // file.rs passes REALTIME - UAPI priority: 3 is UAPI LOW, 0 is UAPI REALTIME.
         let urgency=3u8.saturating_sub(priority.min(3) as u8);
@@ -189,7 +190,7 @@ impl Queue {
             1=>sched::Priority::High,0=>sched::Priority::Kernel,_=>return Err(EINVAL)};
         Ok(Self {entity:sched::Entity::new(&scheduler,priority)?,_scheduler:scheduler,
             shared,vm,usc,fences:FenceContexts::new(1,c_str!("asahi_m3_queue"),kernel::static_lock_class!())?,
-            early_tiling,urgency})
+            early_tiling,wide_visibility,urgency})
     }
 }
 impl queue::Queue for Queue {
@@ -217,7 +218,8 @@ impl queue::Queue for Queue {
             let agx_uapi::ParsedHardwareCommand::Compute{mut payload,attachments,..}=command else {return Err(ENOTSUPP);};
             // Other engines and helpers need their own M3 firmware translation.
             let wide=kernel::uapi::drm_asahi_compute_flags_DRM_ASAHI_COMPUTE_WIDE_VISIBILITY as u32;
-            if payload.flags & !wide !=0 || payload.sampler_count!=0 || payload.sampler_heap!=0 {
+            if payload.flags & !wide !=0 || (!self.wide_visibility && payload.flags & wide != 0)
+                || payload.sampler_count!=0 || payload.sampler_heap!=0 {
                 pr_err!("M3 compute rejected: flags={:#x} samplers={} heap={:#x} attachments={} timestamps={}/{}\n",payload.flags,payload.sampler_count,payload.sampler_heap,attachments.as_slice().len(),payload.timestamps.start.handle,payload.timestamps.end.handle);
                 return Err(ENOTSUPP);
             }
diff --git a/drivers/gpu/drm/asahi/mmu.rs b/drivers/gpu/drm/asahi/mmu.rs
index ed032ab146dd06..faf1f086fd11c3 100644
--- a/drivers/gpu/drm/asahi/mmu.rs
+++ b/drivers/gpu/drm/asahi/mmu.rs
@@ -1156,8 +1156,7 @@ impl VmBind {
         self.1
     }
 
-    /// Stable wire incarnation for this active root lease. M4 reserves zero as unbound.
-    #[cfg(CONFIG_DRM_ASAHI_G16)]
+    /// Stable firmware wire incarnation for this active root lease; zero is unbound.
     pub(crate) fn generation(&self) -> u8 {
         self.0.binding.lock().generation
     }
@@ -2670,7 +2669,6 @@ impl Vm {
     }
 
     /// Spend the binding generation only for an incarnation exposed to firmware.
-    #[cfg(CONFIG_DRM_ASAHI_G16)]
     pub(crate) fn mark_binding_published(&self) -> Result {
         let uat = self.gpuvm.lock_inner().uat_inner.clone();
         let binding = self.binding.lock();
diff --git a/tools/asahi/m3-runtime-tests.rs b/tools/asahi/m3-runtime-tests.rs
index abac06668c0a1c..458603366c954b 100644
--- a/tools/asahi/m3-runtime-tests.rs
+++ b/tools/asahi/m3-runtime-tests.rs
@@ -36,3 +36,13 @@ mod m3_compute_layout;
 
 #[path = "../../drivers/gpu/drm/asahi/m3/m3_channel_format.rs"]
 mod m3_channel_format;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_compute_sequence.rs"]
+mod m3_compute_sequence;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_state_layout.rs"]
+mod m3_state_layout;
+
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_compute_storage.rs"]
+mod m3_compute_storage;

From c0184b54c40c263cd96e9dd06075e1ec4c20745b Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:40:41 -0400
Subject: [PATCH 7/9] drm/asahi: dispatch G15 compute through extended T8122
 firmware

Dispatch extended firmware compute records through the existing M3
runtime while preserving G15 CDM streams. Retain owned pool backing and
leave firmware-managed register setup to the extended interface.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_compute.rs | 162 +++++++++++++++++--------
 drivers/gpu/drm/asahi/m3/m3_config.rs  |  10 ++
 drivers/gpu/drm/asahi/m3/m3_device.rs  |   2 +-
 drivers/gpu/drm/asahi/m3/m3_runtime.rs |  18 ++-
 4 files changed, 132 insertions(+), 60 deletions(-)

diff --git a/drivers/gpu/drm/asahi/m3/m3_compute.rs b/drivers/gpu/drm/asahi/m3/m3_compute.rs
index 34aa0c0d2cd3fb..577510b7e9ecf6 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute.rs
@@ -40,25 +40,28 @@ pub(crate) struct Compute {
     barriers: Option<Buffer>,
     /// The register lists of the SoC's GPU (`m3_soc::Soc::registers`).
     registers: command::RegisterSet,
+    profile: super::m3_profile::Profile,
     /// Last: drops after the command aliases.
     _lower_tlbi: crate::m3::m3_memory::LowerTlbi,
 }
 impl Compute {
     pub(crate) fn new(dev: &driver::AsahiDrmDevice, uat: &mmu::Uat, vm: &mmu::Vm,
         stats: Region, control: crate::m3::agx_compute::Control,
-        registers: command::RegisterSet) -> Result<Self> {
+        registers: command::RegisterSet, profile: super::m3_profile::Profile) -> Result<Self> {
         let lower_tlbi=crate::m3::m3_memory::LowerTlbi;
         let binding=uat.bind(vm)?;
         let mut objects=KVec::new();
         let mut client_command=None;
         let mut command_bytes = KVec::new();
-        command_bytes.resize(command::SIZE, 0u8, GFP_KERNEL)?;
+        command_bytes.resize(if profile == super::m3_profile::Profile::Extended {
+            command::EXTENDED_SIZE
+        } else { command::SIZE }, 0u8, GFP_KERNEL)?;
         let mut sequence_bytes = KVec::new();
         sequence_bytes.resize(microsequence::STORAGE, 0u8, GFP_KERNEL)?;
         // A private compute aperture, disjoint from the retained render graph.
         // Address-bearing graph fields are constructed from their live owners.
         for index in 0..storage::COUNT {
-            let a=storage::batch_allocation(index).map_err(|_|EINVAL)?;
+            let a=storage::batch_allocation_for(profile,index).map_err(|_|EINVAL)?;
             let mut b=match a.mapping {
                 Mapping::CommandAlias(va)=>Buffer::at(dev,uat.kernel_vm(),Some((uat.kernel_lower_vm(),va)),None,a.size,true)?,
                 Mapping::Client(va)=>Buffer::at(dev,uat.kernel_vm(),Some((vm,va)),None,a.size,true)?,
@@ -68,10 +71,13 @@ impl Compute {
             if matches!(a.mapping,Mapping::CommandAlias(_)) {client_command=Some(b.map_gpu_view(vm)?);}
             objects.push(b,GFP_KERNEL)?;
         }
-        Self::encode_command(&mut objects, &mut command_bytes, binding.slot(), control, 1, 0, registers)?;
-        Self::encode_sequence(&mut objects, &mut sequence_bytes, stats, binding.slot(), timeline::stamp(0xc1000000,1), 0)?;
-        UMA_POOL.initialize(&mut objects)?;
-        Self::initialize_state(&mut objects, binding.slot())?;
+        Self::encode_command(&mut objects, &mut command_bytes, binding.slot(), control, 1, 0,
+            registers, profile, binding.generation())?;
+        Self::encode_sequence(&mut objects, &mut sequence_bytes, stats, binding.slot(), timeline::stamp(0xc1000000,1), 0, profile, 0)?;
+        if profile == super::m3_profile::Profile::Extended {
+            UMA_POOL.initialize_extended(&mut objects, 1, true)?;
+        } else { UMA_POOL.initialize(&mut objects)?; }
+        Self::initialize_state(&mut objects, binding.slot(), profile)?;
         // Queue references are firmware VAs from live allocations. In contrast
         // to render's unpublished seed entries, compute dispatches entry zero
         // immediately, so its initial producer cursor remains one.
@@ -80,8 +86,13 @@ impl Compute {
             job_list: address(JOB_LIST)?, gpu_scratch: address(QUEUE_SCRATCH)?,
             context: address(GPU_CONTEXT)?, uuid: 0xc10000 };
         let command = address(storage::COMMAND)?;
-        let mut bytes = [0; queue::INFO_SIZE];
-        info.encode(&mut bytes).map_err(|_| EINVAL)?;
+        let mut bytes = KVec::new();
+        bytes.resize(if profile == super::m3_profile::Profile::Extended {
+            queue::QueueInfo::EXTENDED_SIZE
+        } else { queue::INFO_SIZE }, 0u8, GFP_KERNEL)?;
+        if profile == super::m3_profile::Profile::Extended {
+            info.encode_extended(address(storage::QUEUE)?, &mut bytes).map_err(|_| EINVAL)?;
+        } else { info.encode(&mut bytes).map_err(|_| EINVAL)?; }
         objects[storage::QUEUE].write(0, &bytes)?;
         let mut state = [0; queue::STATE_SIZE];
         queue::RingState { capacity: queue::QUALIFIED_CAPACITY, done: 0, read: 0, write: 1 }
@@ -107,54 +118,74 @@ impl Compute {
         // the invalidation.
         crate::mem::sync();crate::mem::tlbi_all();crate::mem::sync();
         unsafe {core::arch::asm!("isb",options(nostack,preserves_flags))};
-        Ok(Self {_client_command:client_command.ok_or(EINVAL)?,objects,command_bytes,sequence_bytes,_binding:binding,stats,last_progress_ns:0,sequence:1,head:1,cached_views:KVec::new(),slot:0,batch_count:1,checkpoint:(0,0,0),barriers:None,registers,_lower_tlbi:lower_tlbi})
+        Ok(Self {_client_command:client_command.ok_or(EINVAL)?,objects,command_bytes,sequence_bytes,_binding:binding,stats,last_progress_ns:0,sequence:1,head:1,cached_views:KVec::new(),slot:0,batch_count:1,checkpoint:(0,0,0),barriers:None,registers,profile,_lower_tlbi:lower_tlbi})
     }
     fn encode_command(objects: &mut [Buffer], bytes: &mut [u8], context: u32,
         control: crate::m3::agx_compute::Control, sequence: u64, slot: usize,
-        register_set: command::RegisterSet) -> Result {
-        let offset = |owner:usize| storage::slot_offset(owner,slot).map_err(|_|EINVAL);
+        register_set: command::RegisterSet, profile: super::m3_profile::Profile, generation: u8) -> Result {
+        let offset = |owner:usize| storage::slot_offset_for(profile,owner,slot).map_err(|_|EINVAL);
         let fw = |owner: usize| queue::FirmwareVa::new(objects[owner].va()+offset(owner)? as u64).map_err(|_| EINVAL);
         let preemption = &objects[PREEMPTION];
         let value = command::Command {
             context, counter: timeline::previous(sequence), notifier: fw(NOTIFIER)?,
-            preemption: GpuRegion::new(preemption.gpu_va()?+offset(PREEMPTION)? as u64, storage::allocation(PREEMPTION).map_err(|_|EINVAL)?.size).map_err(|_| EINVAL)?,
+            preemption: GpuRegion::new(preemption.gpu_va()?+offset(PREEMPTION)? as u64, storage::allocation_for(profile,PREEMPTION).map_err(|_|EINVAL)?.size).map_err(|_| EINVAL)?,
             cdm: command::GpuVa::new(control.base).map_err(|_| EINVAL)?,
             cdm_last: command::GpuVa::new(control.end.checked_sub(4).ok_or(EINVAL)?).map_err(|_| EINVAL)?,
             gpu_alias: command::GpuVa::new(objects[storage::COMMAND].gpu_va()?+offset(storage::COMMAND)? as u64).map_err(|_| EINVAL)?,
-            microsequence: fw(storage::MICROSEQUENCE)?, microsequence_size: microsequence::LENGTH as u32,
+            microsequence: fw(storage::MICROSEQUENCE)?, microsequence_size:
+                if profile == super::m3_profile::Profile::Extended { microsequence::Sequence::EXTENDED_LENGTH as u32 }
+                else { microsequence::LENGTH as u32 },
             stamp: fw(storage::STAMP)?, fw_stamp: fw(storage::FW_STAMP)?,
             stamp_value: timeline::stamp(0xc1000000,sequence),
             timestamps: [fw(TIMESTAMPS[0])?, fw(TIMESTAMPS[1])?],
             pool: fw(storage::POOL)?, tail_scratch: fw(TAIL_SCRATCH)?, flush_stamps: false,
             register_set,
         };
-        value.encode(bytes).map_err(|_| EINVAL)?;
+        value.encode_with_usc(profile, generation, 0,
+            if profile == super::m3_profile::Profile::Extended { control.usc_base } else { 0 }, bytes).map_err(|_| EINVAL)?;
         objects[storage::COMMAND].write(offset(storage::COMMAND)?, bytes)
     }
     fn encode_sequence(objects: &mut [Buffer], bytes: &mut [u8], stats: Region,
-        context: u32, stamp_value: u32, slot: usize) -> Result {
-        let offset = |owner:usize| storage::slot_offset(owner,slot).map_err(|_|EINVAL);
+        context: u32, stamp_value: u32, slot: usize, profile: super::m3_profile::Profile,
+        queue_sequence: u64) -> Result {
+        let offset = |owner:usize| storage::slot_offset_for(profile,owner,slot).map_err(|_|EINVAL);
         let fw = |owner: usize| queue::FirmwareVa::new(objects[owner].va()+offset(owner)? as u64).map_err(|_| EINVAL);
-        let region = |owner: usize| Region::new(objects[owner].va()+offset(owner)? as u64, storage::allocation(owner).map_err(|_|EINVAL)?.size).map_err(|_| EINVAL);
+        let region = |owner: usize| Region::new(objects[owner].va()+offset(owner)? as u64, storage::allocation_for(profile,owner).map_err(|_|EINVAL)?.size).map_err(|_| EINVAL);
         let value = microsequence::Sequence {
             command: region(storage::COMMAND)?, stats, notifier: region(NOTIFIER)?,
-            queue: fw(storage::QUEUE)?, context, generation: 1, pool: fw(storage::POOL)?,
+            queue: fw(storage::QUEUE)?, context,
+            generation: if profile == super::m3_profile::Profile::Extended { 0 } else { 1 }, pool: fw(storage::POOL)?,
             scratch: [fw(MICROSEQUENCE_SCRATCH[0])?, fw(MICROSEQUENCE_SCRATCH[1])?,
                 fw(MICROSEQUENCE_SCRATCH[2])?, fw(MICROSEQUENCE_SCRATCH[3])?, fw(MICROSEQUENCE_SCRATCH[4])?],
             fw_stamp: fw(storage::FW_STAMP)?, stamp_value,
         };
-        value.encode(bytes).map_err(|_| EINVAL)?;
+        if profile == super::m3_profile::Profile::Extended {
+            let auxiliary = command::GpuVa::new(objects[TAIL_SCRATCH].gpu_va()? + offset(TAIL_SCRATCH)? as u64).map_err(|_| EINVAL)?;
+            let context_store = GpuRegion::new(objects[MICROSEQUENCE_SCRATCH[1]].gpu_va()?
+                + offset(MICROSEQUENCE_SCRATCH[1])? as u64, 0x40000).map_err(|_| EINVAL)?;
+            value.encode_extended(auxiliary, context_store, queue_sequence, bytes).map_err(|_| EINVAL)?;
+        } else { value.encode(bytes).map_err(|_| EINVAL)?; }
         objects[storage::MICROSEQUENCE].write(offset(storage::MICROSEQUENCE)?, bytes)
     }
-    fn initialize_state(objects: &mut [Buffer], context_slot: u32) -> Result {
+    fn initialize_state(objects: &mut [Buffer], context_slot: u32, profile: super::m3_profile::Profile) -> Result {
         let address = |owner: usize| queue::FirmwareVa::new(objects[owner].va()).map_err(|_| EINVAL);
         let notification = state::Notifier { threshold: address(storage::EVENT)?, context: context_slot };
         let list_owner = address(JOB_LIST)?;
         let mut context = [0; state::CONTEXT_SIZE];
-        state::context(&mut context).map_err(|_| EINVAL)?;
-        objects[GPU_CONTEXT].write(0, &context)?;
-        let mut notifier = [0; state::NOTIFIER_SIZE];
-        notification.encode(&mut notifier).map_err(|_| EINVAL)?;
+        if profile == super::m3_profile::Profile::Extended {
+            state::context_extended(&mut context).map_err(|_| EINVAL)?;
+        } else { state::context(&mut context).map_err(|_| EINVAL)?; }
+        let context_size = if profile == super::m3_profile::Profile::Extended {
+            state::EXTENDED_CONTEXT_SIZE
+        } else { state::CONTEXT_SIZE };
+        objects[GPU_CONTEXT].write(0, &context[..context_size])?;
+        let mut notifier = KVec::new();
+        notifier.resize(if profile == super::m3_profile::Profile::Extended {
+            state::EXTENDED_NOTIFIER_SIZE
+        } else { state::NOTIFIER_SIZE }, 0u8, GFP_KERNEL)?;
+        if profile == super::m3_profile::Profile::Extended {
+            notification.encode_extended(&mut notifier).map_err(|_| EINVAL)?;
+        } else { notification.encode(&mut notifier).map_err(|_| EINVAL)?; }
         objects[NOTIFIER].write(0, &notifier)?;
         let mut list = [0; state::JOB_LIST_SIZE];
         state::job_list(&mut list, list_owner).map_err(|_| EINVAL)?;
@@ -182,7 +213,7 @@ impl Compute {
                 let binding = uat.bind(vm)?;
                 let mut views = KVec::new();
                 for i in 0..storage::COUNT {
-                    if matches!(storage::allocation(i).map_err(|_|EINVAL)?.mapping,Mapping::Client(_)) {
+                    if matches!(storage::allocation_for(self.profile,i).map_err(|_|EINVAL)?.mapping,Mapping::Client(_)) {
                         views.push((i,self.objects[i].map_gpu_view(vm)?),GFP_KERNEL)?;
                     }
                 }
@@ -221,18 +252,17 @@ impl Compute {
         if self.batch_count>=storage::SLOTS {return Err(E2BIG);}
         self.slot=self.batch_count;
         for i in storage::RESET {
-            let offset=storage::slot_offset(i,self.slot).map_err(|_|EINVAL)?;
-            let size=storage::allocation(i).map_err(|_|EINVAL)?.size;
+            let offset=storage::slot_offset_for(self.profile,i,self.slot).map_err(|_|EINVAL)?;
+            let size=storage::allocation_for(self.profile,i).map_err(|_|EINVAL)?.size;
             self.objects[i].fill_range(offset,size,if i==PREEMPTION {0xcc} else {0})?;
         }
         self.objects[NOTIFIER].u32(state::NOTIFIER_CONTEXT,self._binding.slot())?;
         self.sequence=self.sequence.checked_add(1).ok_or(EOVERFLOW)?;
-        Self::encode_command(&mut self.objects,&mut self.command_bytes,self._binding.slot(),control,self.sequence,self.slot,self.registers)?;
+        Self::encode_command(&mut self.objects,&mut self.command_bytes,self._binding.slot(),control,self.sequence,self.slot,self.registers,self.profile,self._binding.generation())?;
         let stamp=self.stamp();
-        Self::encode_sequence(&mut self.objects,&mut self.sequence_bytes,self.stats,self._binding.slot(),stamp,self.slot)?;
-        self.objects[storage::EVENT].u32(0,self.sequence as u32)?;
-        self.objects[storage::COUNTER].u32(0,self.sequence as u32)?;
-        let address=self.objects[storage::COMMAND].va()+storage::slot_offset(storage::COMMAND,self.slot).map_err(|_|EINVAL)? as u64;
+        Self::encode_sequence(&mut self.objects,&mut self.sequence_bytes,self.stats,self._binding.slot(),stamp,self.slot,self.profile,self.sequence - 1)?;
+        self.write_counters()?;
+        let address=self.objects[storage::COMMAND].va()+storage::slot_offset_for(self.profile,storage::COMMAND,self.slot).map_err(|_|EINVAL)? as u64;
         self.objects[storage::RING].u64(usize::from(self.head)*8,address)?;
         self.head=(self.head+1)%queue::QUALIFIED_CAPACITY as u16;
         self.batch_count+=1;
@@ -245,39 +275,55 @@ impl Compute {
     pub(crate) fn abort_batch(&mut self)->Result {
         (self.sequence,self.head,self.batch_count)=self.checkpoint;
         self.slot=self.batch_count.saturating_sub(1);
-        self.objects[storage::EVENT].u32(0,self.sequence as u32)?;
-        self.objects[storage::COUNTER].u32(0,self.sequence as u32)?;
+        self.write_counters()?;
         self.objects[storage::QUEUE_STATE].u32(queue::WRITE,u32::from(self.head))?;
         agx_memory::publish();Ok(())
     }
+    fn write_counters(&mut self) -> Result {
+        for index in [storage::EVENT, storage::COUNTER] {
+            if self.profile == super::m3_profile::Profile::Extended {
+                self.objects[index].u64(0, self.sequence)?;
+            } else { self.objects[index].u32(0, self.sequence as u32)?; }
+        }
+        Ok(())
+    }
+
     fn offset(&self,owner:usize)->Result<usize> {
-        storage::slot_offset(owner,self.slot).map_err(|_|EINVAL)
+        storage::slot_offset_for(self.profile,owner,self.slot).map_err(|_|EINVAL)
     }
     /// Same cache-generation contract as M4: StartCompute and the persistent
     /// notifier must use the same tag before the firmware flushes user stamps.
     /// RTKit 2419: StartCompute.counter1 +0x34; JobMeta.flush_stamps +0x804.
     pub(crate) fn prepare_completion(&mut self,coalesce:bool)->Result {
+        if coalesce && self.profile == super::m3_profile::Profile::Extended { return Err(EINVAL); }
         let sequence=self.offset(storage::MICROSEQUENCE)?;
         let command=self.offset(storage::COMMAND)?;
         self.objects[storage::MICROSEQUENCE].u32(sequence+microsequence::GENERATION,0)?;
-        self.objects[storage::COMMAND].u32(command+command::FLUSH_STAMPS,u32::from(!coalesce))?;
+        self.objects[storage::COMMAND].u32(command+if self.profile == super::m3_profile::Profile::Extended { 0x81c } else { command::FLUSH_STAMPS },u32::from(!coalesce))?;
         agx_memory::publish();Ok(())
     }
     pub(crate) fn set_user_timestamps(&mut self,addresses:[u64;2])->Result {
-        let offset=self.offset(storage::COMMAND)?+command::USER_TIMESTAMPS;
+        let offset=self.offset(storage::COMMAND)?+if self.profile == super::m3_profile::Profile::Extended {
+            0x844
+        } else { command::USER_TIMESTAMPS };
         self.objects[storage::COMMAND].u64(offset,addresses[0])?;
         self.objects[storage::COMMAND].u64(offset+8,addresses[1])?;
         let pointer=if addresses==[0,0] {0} else {self.objects[storage::COMMAND].va()+offset as u64};
         let sequence=self.offset(storage::MICROSEQUENCE)?;
-        for start in [microsequence::TIMESTAMP_START,microsequence::TIMESTAMP_END] {
+        for start in if self.profile == super::m3_profile::Profile::Extended { [0x1bc, 0x20c] }
+            else { [microsequence::TIMESTAMP_START,microsequence::TIMESTAMP_END] } {
             self.objects[storage::MICROSEQUENCE].u64(sequence+start+microsequence::USER_TIMESTAMP_POINTER,pointer)?;
         }
         agx_memory::publish();Ok(())
     }
     pub(crate) fn set_attachments(&mut self,attachments:&crate::m3::agx_attachments::Attachments)->Result {
         let sequence=self.offset(storage::MICROSEQUENCE)?;
-        self.objects[storage::MICROSEQUENCE].write(sequence+microsequence::ATTACHMENTS,&attachments.0)?;
-        self.objects[storage::MICROSEQUENCE].write(sequence+microsequence::HAS_ATTACHMENTS,&[u8::from(attachments.count()!=0)])?;
+        self.objects[storage::MICROSEQUENCE].write(sequence+if self.profile == super::m3_profile::Profile::Extended {
+            microsequence::Sequence::EXTENDED_ATTACHMENTS
+        } else { microsequence::ATTACHMENTS },&attachments.0)?;
+        self.objects[storage::MICROSEQUENCE].write(sequence+if self.profile == super::m3_profile::Profile::Extended {
+            microsequence::Sequence::EXTENDED_HAS_ATTACHMENTS
+        } else { microsequence::HAS_ATTACHMENTS },&[u8::from(attachments.count()!=0)])?;
         agx_memory::publish();Ok(())
     }
     fn stamp(&self) -> u32 { timeline::stamp(0xc1000000,self.sequence) }
@@ -319,26 +365,31 @@ impl Compute {
         agx_memory::publish();crate::mem::sync();Ok(())
     }
     pub(crate) fn gpu_ns(&mut self)->Result<u64> {
-        let mut total=0;
-        for slot in 0..self.batch_count {total+=self.slot_gpu_ns(slot)?;}
+        let mut total: u64 = 0;
+        for slot in 0..self.batch_count {
+            total = total.checked_add(self.slot_gpu_ns(slot)?).ok_or(EOVERFLOW)?;
+        }
         Ok(total)
     }
     pub(crate) fn slot_gpu_ns(&mut self,slot:usize)->Result<u64> {
         if slot>=self.batch_count {return Err(EINVAL);}
-        let start=self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset(TIMESTAMPS[0],slot).map_err(|_|EINVAL)?)?;
-        let end=self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset(TIMESTAMPS[1],slot).map_err(|_|EINVAL)?)?;
-        Ok(if start!=0 && end>=start {(end-start)*1000/24} else {0})
+        let start=self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[0],slot).map_err(|_|EINVAL)?)?;
+        let end=self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[1],slot).map_err(|_|EINVAL)?)?;
+        if start == 0 || end < start { return Ok(0); }
+        self.profile.gpu_duration_ns(end - start).ok_or(EOVERFLOW)
     }
     /// A batch span includes gaps between its compute commands, unlike gpu_ns.
     /// Read only after stamps, queues, events and idle state prove retirement.
     pub(crate) fn batch_gpu_span(&mut self)->Result<[u64;2]> {
         if self.batch_count == 0 {return Err(EINVAL);}
-        Ok([self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset(TIMESTAMPS[0],0).map_err(|_|EINVAL)?)?,
-            self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset(TIMESTAMPS[1],self.batch_count-1).map_err(|_|EINVAL)?)?])
+        Ok([self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[0],0).map_err(|_|EINVAL)?)?,
+            self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[1],self.batch_count-1).map_err(|_|EINVAL)?)?])
     }
     pub(crate) fn head(&self) -> u16 { self.head }
     pub(crate) fn ordinal(&self)->u64 {self.sequence}
-    pub(crate) fn first(&self) -> bool { self.sequence == self.batch_count as u64 }
+    pub(crate) fn first(&self) -> bool {
+        self.profile == super::m3_profile::Profile::Legacy && self.sequence == self.batch_count as u64
+    }
     pub(crate) fn progress(&mut self, dev: &driver::AsahiDrmDevice) -> Result {
         // Report real completions by elapsed time as well as sequence count;
         // batches need not land on a multiple of 128.
@@ -361,10 +412,15 @@ impl Compute {
 
     pub(crate) fn queue(&self)->u64 {self.objects[storage::QUEUE].va()}
     pub(crate) fn complete(&mut self)->Result<bool> {
-        Ok(self.objects[storage::STAMP].read_u32(0)?==self.stamp()
-            && self.objects[storage::FW_STAMP].read_u32(0)?==self.stamp()
-            && self.objects[storage::QUEUE_STATE].read_u32(queue::DONE)?==u32::from(self.head)
-            && self.objects[storage::QUEUE_STATE].read_u32(queue::READ)?==u32::from(self.head))
+        let stamped = self.objects[storage::STAMP].read_u32(0)? == self.stamp()
+            && self.objects[storage::FW_STAMP].read_u32(0)? == self.stamp()
+            && self.objects[storage::QUEUE_STATE].read_u32(queue::DONE)? == u32::from(self.head)
+            && self.objects[storage::QUEUE_STATE].read_u32(queue::READ)? == u32::from(self.head);
+        if !stamped { return Ok(false); }
+        if self.profile == super::m3_profile::Profile::Extended {
+            return Ok(self.objects[storage::POOL].read_u64(0x54)? == self.sequence);
+        }
+        Ok(true)
     }
     pub(crate) fn log(&mut self,dev:&driver::AsahiDrmDevice)->Result {
         for off in (0..512).step_by(128) {
diff --git a/drivers/gpu/drm/asahi/m3/m3_config.rs b/drivers/gpu/drm/asahi/m3/m3_config.rs
index bfb408b07a5307..ffd1bb963b9055 100644
--- a/drivers/gpu/drm/asahi/m3/m3_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_config.rs
@@ -177,6 +177,16 @@ impl Config {
         Ok(())
     }
 
+    pub(crate) fn global_table_views(&mut self, vm: &mmu::Vm) -> Result<KVec<mmu::KernelMapping>> {
+        let mut mappings = KVec::new();
+        if self.profile == super::m3_profile::Profile::Extended {
+            for index in [super::m3_init_26::GLOBAL_POOL, super::m3_init_26::GLOBAL_PARAMETERS] {
+                mappings.push(self.objects[index].map_gpu_view(vm)?, GFP_KERNEL)?;
+            }
+        }
+        Ok(mappings)
+    }
+
     pub(crate) fn root(&self) -> u64 { self.objects[storage::ROOT].va() }
     pub(crate) fn log_globals_debug(&mut self,dev:&driver::AsahiDrmDevice)->Result {
         let value=self.objects[GLOBALS].read_u32(crate::m3::m3_globals_debug::OFFSET)?;
diff --git a/drivers/gpu/drm/asahi/m3/m3_device.rs b/drivers/gpu/drm/asahi/m3/m3_device.rs
index 05a3961369a6d2..474a8b3f561ec7 100644
--- a/drivers/gpu/drm/asahi/m3/m3_device.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_device.rs
@@ -129,6 +129,7 @@ impl Device {
                 }
                 e.sgx_setup()
             }
+            None if device.firmware.profile() == super::m3_profile::Profile::Extended => None,
             None => Some(soc.sgx_setup.ok_or(ENODEV)?),
         };
         if let Some((setup_offset, setup_value)) = setup {
@@ -179,7 +180,6 @@ impl Device {
         if self.firmware.profile() == super::m3_profile::Profile::Extended {
             // Adaptive clock gating can leave individual engine banks inaccessible
             // even while the GPU performance-state register says powered up.
-            dev_info!(self.dev.as_ref(), "M3: adaptive firmware fault evidence uses retained metadata; engine banks may be gated\n");
             return Ok(());
         }
         let sgx_guard = self.sgx.try_access().ok_or(ENODEV)?;
diff --git a/drivers/gpu/drm/asahi/m3/m3_runtime.rs b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
index 40399a80a01f39..058c6610399ae3 100644
--- a/drivers/gpu/drm/asahi/m3/m3_runtime.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
@@ -389,7 +389,7 @@ impl Inner {
         let index=found.unwrap_or(self.jobs.len());
         if found.is_none() {
             let job=match control {
-                crate::m3::m3_submit::Command::Compute(c)=>NativeJob::Compute(crate::m3::m3_compute::Compute::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,c,self.device.soc().registers).map_err(early)?),
+                crate::m3::m3_submit::Command::Compute(c)=>NativeJob::Compute(crate::m3::m3_compute::Compute::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,c,self.device.soc().registers,self.device.firmware().profile()).map_err(early)?),
                 crate::m3::m3_submit::Command::Render{..}=>NativeJob::Render(crate::m3::m3_render::Render::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,self.device.soc().clusters,self.device.soc().registers).map_err(early)?),
             };
             self.jobs.push(job,GFP_KERNEL).map_err(|_|early(ENOMEM))?;
@@ -469,6 +469,9 @@ impl Inner {
         crate::mem::sync();
         self.t8122_verdict=false;
         let previous_events=self.config.completed_events;
+        if self.device.firmware().profile() == super::m3_profile::Profile::Extended {
+            packet.vm.mark_binding_published().map_err(early)?;
+        }
         let publication_tick=if crate::debug::debug_enabled(crate::debug::DebugFlags::M3PassTiming) {physical_counter()} else {0};
         self.state.health.set_gpu_pending(true);
         self.gpu_pending = true;
@@ -535,7 +538,7 @@ impl Inner {
             let control=first_compute.ok_or(EINVAL)?;
             if existing.is_none() {
                 let job=crate::m3::m3_compute::Compute::new(&self.drm,&self.uat,&packet.vm,
-                    self.config.stats_region()?,control,self.device.soc().registers)?;
+                    self.config.stats_region()?,control,self.device.soc().registers,self.device.firmware().profile())?;
                 self.jobs.push(NativeJob::Compute(job),GFP_KERNEL)?;
             } else {
                 let NativeJob::Compute(j)=&mut self.jobs[compute_index] else {return Err(EINVAL);};
@@ -1059,7 +1062,7 @@ impl Runtime {
             // TTBAT of the admitted reservations, the firmware kernel root (`pagetables`) as
             // every context's upper half, and the host window (root entry 2) through the
             // shared L2. The RTKit is awake and no initdata or GPU job has been published.
-            let (uat,window)=adopted.insert(adopt_uat(&drm,device.soc(),&device.firmware().resources)?);
+            let (uat,window)=adopted.insert(adopt_uat(&drm,device.soc(),&device.firmware().resources,device.firmware().profile())?);
             let config=Config::new(&drm,uat,device.firmware(),&contents)?;
             // Link every kernel table the configuration created before the firmware sees an
             // address in it, then drop any translation cached before they existed.
@@ -1103,7 +1106,8 @@ impl Runtime {
         // (7.1.12's M3 VM job lifetime, the shared `mmu::lifetime` on 7.2).
         let vm=self.inner.uat.new_vm(id, range)?.with_tracked_status()?;
         let mut reserved=KVec::new();reserved.push(reserved_range,GFP_KERNEL)?;reserved.push(0x100_8000_0000..0x101_0000_0000,GFP_KERNEL)?;reserved.push(0x10_0000_0000..0x10_0800_0000,GFP_KERNEL)?;reserved.push(0x10_7400_0000..0x10_7402_8000,GFP_KERNEL)?;
-        vm.install_driver_mappings(KVec::new(),reserved)?;
+        let mappings = self.inner.config.global_table_views(&vm)?;
+        vm.install_driver_mappings(mappings,reserved)?;
         Ok(vm)
     }
     pub(crate) fn map_timestamp(&mut self,mut bo:crate::gem::ObjectRef,range:core::ops::Range<usize>)->Result<mmu::KernelMapping> {
@@ -1369,13 +1373,15 @@ pub(crate) fn physical_counter() -> u64 {
 /// (ttbs, pagetables, handoff, shared-l2) and the PPL exchange with its startup epoch, as the
 /// G15 backend does it on 7.2 (`g15::uat`).
 fn adopt_uat(drm: &driver::AsahiDrmDevice, soc: &'static crate::m3::m3_soc::Soc,
-    resources: &crate::m3::agx_resources::Resources) -> Result<(mmu::Uat, crate::g15::uat::Window)> {
+    resources: &crate::m3::agx_resources::Resources, profile: super::m3_profile::Profile)
+    -> Result<(mmu::Uat, crate::g15::uat::Window)> {
     let cfg = soc.hwcfg.ok_or(ENODEV)?;
     let [ttbs, tables, handoff, shared_l2, ..] = resources.regions;
     let range = |r: crate::m3::agx_resources::Region| r.base..r.base + r.size;
     let geometry = mmu::UatGeometry { ias: cfg.uat_ias.into(), oas: cfg.uat_oas };
     let regions = mmu::AdoptedRegions { handoff: range(handoff), ttbs: range(ttbs), kernel_root: tables.base };
-    let uat = mmu::Uat::new_adopted(drm, geometry, &regions)?;
+    let uat = mmu::Uat::new_adopted_with_user_upper(drm, geometry, &regions,
+        profile == super::m3_profile::Profile::Legacy)?;
     let mut window = crate::g15::uat::Window::from_regions(handoff.base, ttbs.base, tables.base, shared_l2.base)?;
     window.bootstrap(drm.as_ref().as_ref(), &uat)?;
     // 7.1.12 cleaned every reserved-table write to the point of coherency; these regions may be

From 99b74c9a52496fe6fcf5a47442093483bbd8fcbf Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Fri, 30 Oct 2026 21:40:42 -0400
Subject: [PATCH 8/9] drm/asahi: enable J613 extended firmware render and
 retirement

Encode extended tiler and fragment work, scene records, independent
notifications and attachment visibility through the existing runtime.
Retire native pools and enable only the exact J613 26.6.2 profile.
Keep the public UAPI and physical G15 stream formats unchanged.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/m3_board.rs          |   2 +-
 drivers/gpu/drm/asahi/m3/m3_compute.rs        |  10 +-
 drivers/gpu/drm/asahi/m3/m3_config.rs         |  12 +
 drivers/gpu/drm/asahi/m3/m3_drm.rs            |  10 +-
 drivers/gpu/drm/asahi/m3/m3_firmware.rs       |  10 +-
 .../gpu/drm/asahi/m3/m3_fragment_command.rs   | 138 ++++++++++--
 .../gpu/drm/asahi/m3/m3_parameter_layout.rs   |  74 +++++++
 drivers/gpu/drm/asahi/m3/m3_pass.rs           |   4 +-
 drivers/gpu/drm/asahi/m3/m3_pass_layout.rs    |  36 +++
 drivers/gpu/drm/asahi/m3/m3_profile.rs        |  21 ++
 drivers/gpu/drm/asahi/m3/m3_render.rs         | 206 +++++++++++++-----
 .../gpu/drm/asahi/m3/m3_render_sequence.rs    | 168 ++++++++++++++
 drivers/gpu/drm/asahi/m3/m3_runtime.rs        |   4 +-
 drivers/gpu/drm/asahi/m3/m3_scene_layout.rs   |  40 ++++
 drivers/gpu/drm/asahi/m3/m3_shared_layout.rs  |  23 ++
 drivers/gpu/drm/asahi/m3/m3_submit.rs         |   7 +-
 drivers/gpu/drm/asahi/m3/m3_sync_layout.rs    |  55 +++++
 drivers/gpu/drm/asahi/m3/m3_tiler_command.rs  | 131 +++++++++--
 drivers/gpu/drm/asahi/m3/t8122_admission.rs   |  40 +++-
 tools/asahi/m3-runtime-tests.rs               |  36 +++
 20 files changed, 926 insertions(+), 101 deletions(-)

diff --git a/drivers/gpu/drm/asahi/m3/m3_board.rs b/drivers/gpu/drm/asahi/m3/m3_board.rs
index c44b2a42d99d55..5d4ea4277b6181 100644
--- a/drivers/gpu/drm/asahi/m3/m3_board.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_board.rs
@@ -13,7 +13,7 @@ use crate::m3::m3_resources::{
 use crate::m3::m3_soc::Soc;
 
 /// Whether the root node's compatible list contains `compatible`.
-fn board_is(compatible: &[u8]) -> bool {
+pub(crate) fn board_is(compatible: &[u8]) -> bool {
     let Some(root) = kernel::of::root() else {
         return false;
     };
diff --git a/drivers/gpu/drm/asahi/m3/m3_compute.rs b/drivers/gpu/drm/asahi/m3/m3_compute.rs
index 577510b7e9ecf6..b6e9444ed54499 100644
--- a/drivers/gpu/drm/asahi/m3/m3_compute.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_compute.rs
@@ -350,10 +350,12 @@ impl Compute {
         let barriers=self.barriers.as_mut().ok_or(EINVAL)?;
         let offset=self.slot*64;
         let mut bytes=[0;crate::m3::m3_sync_layout::BARRIER_SIZE];
-        crate::m3::m3_sync_layout::Barrier {
+        let barrier=crate::m3::m3_sync_layout::Barrier {
             stamp:dependency.stamp,wait_value:dependency.value,event:dependency.event,
             self_value:value,uuid:0xc10000,dependency:crate::m3::m3_sync_layout::Dependency::PreviousPass,
-        }.encode(&mut bytes).map_err(|_|EINVAL)?;
+        };
+        if self.profile==super::m3_profile::Profile::Extended {barrier.encode_extended(&mut bytes)}
+        else {barrier.encode(&mut bytes)}.map_err(|_|EINVAL)?;
         barriers.write(offset,&bytes)?;
         let address=barriers.va()+offset as u64;
         let (slots,next)=queue::insert_before_last(self.head,queue::QUALIFIED_CAPACITY).map_err(|_|EINVAL)?;
@@ -382,8 +384,8 @@ impl Compute {
     /// Read only after stamps, queues, events and idle state prove retirement.
     pub(crate) fn batch_gpu_span(&mut self)->Result<[u64;2]> {
         if self.batch_count == 0 {return Err(EINVAL);}
-        Ok([self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[0],0).map_err(|_|EINVAL)?)?,
-            self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[1],self.batch_count-1).map_err(|_|EINVAL)?)?])
+        Ok([self.profile.profiler_ticks(self.objects[TIMESTAMPS[0]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[0],0).map_err(|_|EINVAL)?)?),
+            self.profile.profiler_ticks(self.objects[TIMESTAMPS[1]].read_u64(storage::slot_offset_for(self.profile,TIMESTAMPS[1],self.batch_count-1).map_err(|_|EINVAL)?)?)])
     }
     pub(crate) fn head(&self) -> u16 { self.head }
     pub(crate) fn ordinal(&self)->u64 {self.sequence}
diff --git a/drivers/gpu/drm/asahi/m3/m3_config.rs b/drivers/gpu/drm/asahi/m3/m3_config.rs
index ffd1bb963b9055..02b847e210dc9b 100644
--- a/drivers/gpu/drm/asahi/m3/m3_config.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_config.rs
@@ -246,6 +246,18 @@ impl Config {
         self.thermal.busy(now);
         Ok(())
     }
+    pub(crate) fn render_stats(&self) -> Result<[init::Region;2]> {
+        if self.profile==super::m3_profile::Profile::Legacy {
+            let value=self.stats_region()?;return Ok([value;2]);
+        }
+        let region=|index:usize,offset:usize| {
+            let object=&self.objects[index];
+            init::Region::new(object.va().checked_add(offset as u64).ok_or(EOVERFLOW)?,
+                object.size().checked_sub(offset).ok_or(EINVAL)?).map_err(|_|EINVAL)
+        };
+        Ok([region(UNKNOWN_C0,4)?,region(UNKNOWN_C1,8)?])
+    }
+
     pub(crate) fn stats_region(&self) -> Result<init::Region> {
         let owner = &self.objects[if self.profile == super::m3_profile::Profile::Extended {
             UNKNOWN_C3
diff --git a/drivers/gpu/drm/asahi/m3/m3_drm.rs b/drivers/gpu/drm/asahi/m3/m3_drm.rs
index 4aa982ff95a5cf..922d76ba2055bc 100644
--- a/drivers/gpu/drm/asahi/m3/m3_drm.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_drm.rs
@@ -113,10 +113,12 @@ impl Backend {
             crate::m3::t8122_start::not_admitted(pdev.as_ref(), soc);
         })?;
         dev_info!(pdev.as_ref(), "M3: resource admission complete\n");
-        // An armed T8122 start supplies the values its table leaves out. An unarmed T8122
-        // needs a complete table, which it does not have: it is refused here.
-        let experiment = crate::m3::t8122_start::arm(pdev.as_ref(), soc)?;
-        if experiment.is_none() {
+        // Extended T8122 uses its dedicated initialization graph. Keep the
+        // legacy guarded-start and completeness checks for older interfaces.
+        let extended=crate::m3::t8122_start::is_t8122(soc)
+            && crate::m3::t8122_admission::loaded_profile(pdev)?==super::m3_profile::Profile::Extended;
+        let experiment = if extended {None} else {crate::m3::t8122_start::arm(pdev.as_ref(), soc)?};
+        if experiment.is_none() && !extended {
             soc.require_complete(pdev.as_ref())?;
         }
         let experiment = experiment.as_ref();
diff --git a/drivers/gpu/drm/asahi/m3/m3_firmware.rs b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
index 6bc87a33aaa052..94a2d3384d08aa 100644
--- a/drivers/gpu/drm/asahi/m3/m3_firmware.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_firmware.rs
@@ -62,7 +62,7 @@ pub(crate) static KNOWN_IMAGES_T8122: [KnownImage; 1] = [KnownImage {
     initdata_magic: Some(G15_V14_8_3_INITDATA),
 }];
 
-/// Image record for the extended format. The SoC's runtime selection does not use it yet.
+/// Exact normalized image identity for the extended firmware interface.
 pub(crate) static T8122_IMAGES_26: [KnownImage; 1] = [KnownImage {
     name: "T8122 C0 firmware-compat 26.6.2",
     uuid: None,
@@ -164,7 +164,7 @@ pub(crate) static T8122_LAYOUT: Layout = Layout {
 pub(crate) const TEXT_SHA256: [u8; 32] = [
     0x11, 0xe4, 0x9f, 0x75, 0xb, 0x67, 0x1a, 0x2b, 0x13, 0xd0, 0x92, 0xdb, 0x1c, 0xbc, 0xa3, 0xa8, 0x77, 0x55, 0x86, 0xd6, 0xb1, 0xe3, 0xaa, 0xe8, 0xa6, 0xa4, 0x64, 0xa7, 0x80, 0x2, 0x93, 0xd5];
 
-/// T8122 C0, firmware-compat 26.6.2. Selection remains separate from runtime admission.
+/// T8122 C0, firmware-compat 26.6.2 segment and loader-mutable bounds.
 pub(crate) static T8122_LAYOUT_26: Layout = Layout {
     text_size: 393216,
     data_size: 1228800,
@@ -313,7 +313,10 @@ pub(crate) fn identify_loaded(
         prelude::*,
     };
 
-    let layout = soc.firmware.ok_or(ENODEV)?;
+    let extended=crate::m3::t8122_start::is_t8122(soc)
+        && crate::m3::t8122_admission::loaded_profile(pdev)?==super::m3_profile::Profile::Extended;
+    if extended && experiment.is_some() {return Err(EINVAL);}
+    let layout = if extended {&T8122_LAYOUT_26} else {soc.firmware.ok_or(ENODEV)?};
     if !Firmware::matching_layout(layout, &resources) {
         dev_err!(pdev.as_ref(), "M3 {}: unsupported firmware segment layout\n", soc.gpu_name);
         return Err(ENODEV);
@@ -337,6 +340,7 @@ pub(crate) fn identify_loaded(
     // The T8122 start experiment identifies the same image, with its own InitData version.
     let images = match experiment {
         Some(_) => &KNOWN_IMAGES_T8122_EXPERIMENT[..],
+        None if extended => &T8122_IMAGES_26[..],
         None => soc.images,
     };
     let image = crate::m3::m3_board::identify(pdev.as_ref(), bytes, &digest, images).ok_or(ENODEV)?;
diff --git a/drivers/gpu/drm/asahi/m3/m3_fragment_command.rs b/drivers/gpu/drm/asahi/m3/m3_fragment_command.rs
index 2367e6c7ad557f..0abccad3cb9d64 100644
--- a/drivers/gpu/drm/asahi/m3/m3_fragment_command.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_fragment_command.rs
@@ -3,6 +3,8 @@ use super::{agx_render::Geometry, agx_render_state::{Program,DepthStencil},
     m3_compute_layout::{GpuVa,RegisterSet}, m3_init_layout::{Error,Region},
     m3_queue_layout::FirmwareVa, m3_render_sequence::fragment};
 pub(crate) const SIZE:usize=0xc73;
+pub(crate) const EXTENDED_SIZE:usize=0xca0;
+pub(crate) const EXTENDED_FLUSH:usize=0xbdc;
 pub(crate) const REGISTERS:usize=fragment::REGISTERS;
 /// The registers G15G does not take; the others keep the G15S order.
 pub(crate) const G15G_OMIT:[u32;4]=[0x160a8,0x160b8,0xa5a9,0xd429];
@@ -74,16 +76,30 @@ impl Command {
     /// Check references before touching output. The caller owns validation of
     /// client resource mappings; this layer serializes their semantic state.
     pub(crate) fn encode(&self,out:&mut[u8])->Result<(),Error> {
-        if out.len()<SIZE {return Err(Error::Size);}
+        self.encode_format(out,None)
+    }
+    pub(crate) fn encode_extended(&self, dispatch:super::m3_tiler_command::Dispatch26,
+        out:&mut[u8])->Result<(),Error> {
+        self.encode_format(out,Some(dispatch))
+    }
+    fn encode_format(&self,out:&mut[u8],dispatch:Option<super::m3_tiler_command::Dispatch26>)->Result<(),Error> {
+        let extended=dispatch.is_some();
+        let size=if extended {EXTENDED_SIZE} else {SIZE};
+        if out.len()<size {return Err(Error::Size);}
+        if let Some(native)=&dispatch {
+            if native.incarnation==0 || native.serial==0 || native.usc_window&0xffff_ffff!=0
+                || native.usc_window>=1<<42 || self.register_set!=RegisterSet::G15G {return Err(Error::Address);}
+        }
         if self.context>=64 {return Err(Error::Address);}
-        let seq=self.sequence.at(0,fragment::LENGTH)?;
+        let sequence_size=if extended {0x370} else {fragment::LENGTH};
+        let seq=self.sequence.at(0,sequence_size)?;
         let alias=self.gpu_alias.get();
-        GpuVa::new(alias.checked_add((SIZE-3) as u64).ok_or(Error::Address)?).map_err(|_|Error::Address)?;
+        GpuVa::new(alias.checked_add(((size-1)&!3) as u64).ok_or(Error::Address)?).map_err(|_|Error::Address)?;
         let registers=alias+REGISTERS as u64;
         let s=&self.state;let g=&s.geometry;
         let layer_metadata=self.heap.get().checked_add(if g.layers>1 {0x200}else{0}).ok_or(Error::Address)?;
         GpuVa::new(layer_metadata).map_err(|_|Error::Address)?;
-        let user=super::agx_render_state::compact(self.scene_user.get().checked_add(0x40).ok_or(Error::Address)?)
+        let user=super::agx_render_state::compact(self.scene_user.get().checked_add(if extended {0} else {0x40}).ok_or(Error::Address)?)
             .map_err(|_|Error::Address)? & !15;
         let width=(g.pixels&0xffff)+1;let height=(g.pixels>>16)+1;
         let tx=(width+31)/32;let ty=(height+31)/32;
@@ -116,43 +132,85 @@ impl Command {
             (0x101c1,0),(0xd469,0),(0x1a0f9,8),(0x1c838,0),(0x1ca28,user),
             (0xa5a9,0x6000400020),(0xd429,0x200000001),
         ];
-        let bytes=&mut out[..SIZE];bytes.fill(0);
+        let bytes=&mut out[..size];bytes.fill(0);
         word(bytes,0,1); // fragment opcode; work counter remains zero
         word(bytes,0xc,self.context);
         for (offset,value) in [(0x14,seq),(0x20,self.notifier.get()),(0x28,self.manager.get()),
             (0x30,self.scene.get()),(0x38,self.empty.get()),(0x40,self.tilemap.get()),(0x780,registers)] {pointer(bytes,offset,value);}
-        word(bytes,SEQUENCE_LENGTH,fragment::LENGTH as u32);
-        // The qualified patch path updates register MSAA but retains these
-        // producer header values. Representation cleanup must not change that.
-        pointer(bytes,0x48,0x88);word(bytes,0x50,1);
-        bytes[0x54..0x56].copy_from_slice(&((g.y_blocks>>18) as u16).to_le_bytes());
-        bytes[0x56..0x58].copy_from_slice(&((g.x_blocks>>18) as u16).to_le_bytes());
-        word(bytes,0x68,s.merge_upper[0]);word(bytes,0x6c,s.merge_upper[1]);
-        pointer(bytes,0x78,u64::from(g.tiles));
+        word(bytes,SEQUENCE_LENGTH,sequence_size as u32);
+        if extended {
+            pointer(bytes,4,dispatch.as_ref().map_or(0,|native|native.serial));
+            word(bytes,0x50,1);
+            word(bytes,0x54,g.isp_blocks);
+            word(bytes,0x60,g.x_blocks);
+            word(bytes,0x64,g.y_blocks);
+            word(bytes,0x68,g.blocks);
+            word(bytes,0x78,g.tiles);
+        } else {
+            pointer(bytes,0x48,0x88);word(bytes,0x50,1);
+            bytes[0x54..0x56].copy_from_slice(&((g.y_blocks>>18) as u16).to_le_bytes());
+            bytes[0x56..0x58].copy_from_slice(&((g.x_blocks>>18) as u16).to_le_bytes());
+            word(bytes,0x68,s.merge_upper[0]);word(bytes,0x6c,s.merge_upper[1]);
+            pointer(bytes,0x78,u64::from(g.tiles));
+        }
         let g15g=self.register_set==RegisterSet::G15G;
         let mut count=0;
-        for (register,value) in values.into_iter().filter(|(r,_)| !g15g || !G15G_OMIT.contains(r)) {
-            let n=count;count+=1;
-            word(bytes,REGISTERS+n*REGISTER_STRIDE,register);pointer(bytes,REGISTERS+n*REGISTER_STRIDE+4,value);
+        let mut emit=|register,value| {
+            word(bytes,REGISTERS+count*REGISTER_STRIDE,register);
+            pointer(bytes,REGISTERS+count*REGISTER_STRIDE+4,value);
+            count+=1;
+        };
+        for (register,mut value) in values {
+            if extended {
+                if matches!(register,0x160b8|0x120a1|0x1c838|0x1ca28) {continue;}
+                if register==0x10791 {emit(0xa301,0);}
+                if register==0x16068 {value=(value&!0x3ffff)|0x3717f;}
+                if matches!(register,0x15109|0x15101) {value&=!3;}
+            } else if g15g && G15G_OMIT.contains(&register) {continue;}
+            emit(register,value);
+        }
+        if let Some(native)=&dispatch {
+            for register in [0x160e0,0x1499,0xa341] {emit(register,fragment::UUID.into());}
+            emit(0x1c838,0);
+            emit(0x1ca28,user);
+            emit(0x10069,native.usc_window);
         }
         bytes[0x788..0x78a].copy_from_slice(&(count as u16).to_le_bytes());
         bytes[0x78a..0x78c].copy_from_slice(&((count*REGISTER_STRIDE) as u16).to_le_bytes());
         // Start3DJobParameters3: mirror records use their actual packed widths.
         for (offset,value) in [(0,s.depth_bias),(0x10,s.scissor),(0x20,s.query),
-            (0x168,s.partial_background.resources),(0x170,s.partial_background.address),
+            (0x168,if extended {s.background.resources}else{s.partial_background.resources}),
+            (0x170,if extended {s.background.address}else{s.partial_background.address}),
             (0x198,s.partial_background.resources),(0x1a0,s.partial_background.address),
             (0x1a8,s.zls_control),(0x1b8,s.depth.base),(0x1c0,s.depth.stride),
             (0x1c8,s.depth_compression.stride),(0x1e0,s.depth_compression.base),
             (0x1d0,s.depth.base),(0x1d8,s.depth.base),
             (0x1e8,s.stencil.base),(0x1f0,s.stencil.stride),(0x200,s.stencil.base),(0x208,s.stencil.base),
             (0x1f8,s.stencil_compression.stride),(0x210,s.stencil_compression.base),
-            (0x26c,s.partial_eot.address),(0x28c,s.partial_eot.address),(0x2c0,u64::from(s.depth_dimensions))] {
-            pointer(bytes,PARAMETERS+offset,value);
+            (0x26c,if extended {s.eot.address}else{s.partial_eot.address}),(0x28c,s.partial_eot.address),(0x2c0,u64::from(s.depth_dimensions))] {
+            pointer(bytes,PARAMETERS+offset+if extended && offset<=0x20 {0x10}else{0},value);
         }
         for (offset,value) in [(0x1b0,0x04040404),(0x228,s.mirror_tilebuffer_control),
             (0x230,s.isp_control),(0x238,width),(0x23c,height),(0x240,0x100000),
-            (0x248,s.mirror_tile_mode),(0x264,s.partial_eot.resources as u32),(0x284,s.partial_eot.resources as u32),
+            (0x248,s.mirror_tile_mode),(0x264,if extended {s.eot.resources as u32}else{s.partial_eot.resources as u32}),(0x284,s.partial_eot.resources as u32),
             (0x298,s.depth_clear),(0x29c,s.stencil_clear),(0x2a0,s.sample_size)] {word(bytes,PARAMETERS+offset,value);}
+        if let Some(native)=dispatch {
+            pointer(bytes,0xbc0,self.stamp.get());
+            pointer(bytes,0xbc8,self.fw_stamp.get());
+            word(bytes,0xbd0,self.stamp_value);
+            word(bytes,0xbd4,1);
+            word(bytes,EXTENDED_FLUSH,1);
+            word(bytes,0xbe0,fragment::UUID);
+            pointer(bytes,0xc10,self.timestamps[0].get());
+            pointer(bytes,0xc18,self.timestamps[1].get());
+            pointer(bytes,0xc20,self.user_timestamps[0].get());
+            pointer(bytes,0xc28,self.user_timestamps[1].get());
+            pointer(bytes,0xc46,self.pool.get());
+            bytes[0xc4e]=1;
+            pointer(bytes,0xc57,native.firmware_aux.get());
+            bytes[0xc5f]=native.incarnation;
+            bytes[0xc84]=1;
+        } else {
         word(bytes,0xb88,0x67); // EncoderParams.encoder_id
         word(bytes,0xb90,u32::MAX); // EncoderParams.unk_mask
         word(bytes,0xb94,u32::from(s.process_empty_tiles));
@@ -167,6 +225,46 @@ impl Command {
             pointer(bytes,fragment::COMMAND_TAIL+offset,value);
         }
         bytes[fragment::COMMAND_TAIL+0x36]=1;bytes[fragment::COMMAND_TAIL+0x4f]=1;
+        }
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test]
+    fn native_fragment_uses_distinct_program_mirrors_and_completion_tail() {
+        let fw=|n:u64|FirmwareVa::new(0xffff_fc25_3000_0000+n*0x4000).unwrap();
+        let gpu=|n:u64|GpuVa::new(0x10_0300_0000+n*0x4000).unwrap();
+        let program=|n:u64|Program{address:0x1_0000_0000+n*0x1000,resources:n};
+        let surface=DepthStencil{base:0,stride:0};
+        let command=Command {context:3,register_set:RegisterSet::G15G,
+            sequence:Region::new(fw(0).get(),0x1000).unwrap(),notifier:fw(1),manager:fw(2),scene:fw(3),empty:fw(4),
+            gpu_alias:GpuVa::new(0x72_1000_4000).unwrap(),tilemap:gpu(0),heap:gpu(1),auxiliary:gpu(2),scene_user:gpu(3),
+            scratch:gpu(4),pool:fw(5),stamp:fw(6),fw_stamp:fw(7),stamp_value:0x3d000100,
+            timestamps:[fw(8),fw(9)],user_timestamps:[fw(10),fw(11)],
+            state:State {geometry:Geometry::new(64,64,super::super::agx_render::Utile::Pixels32,
+                super::super::agx_render::Utile::Pixels32,1).unwrap(),multisample:0,merge_upper:[0;2],
+                eot:program(1),background:program(2),partial_eot:program(3),partial_background:program(4),
+                scissor:0,depth_bias:0,query:0,isp_control:0xc000,tilebuffer_control:1,mirror_tilebuffer_control:1,
+                tile_mode:0x280,mirror_tile_mode:0x280,depth:surface,stencil:surface,depth_compression:surface,
+                stencil_compression:surface,zls_control:0,depth_dimensions:0,depth_clear:0,stencil_clear:0,
+                sample_size:4,process_empty_tiles:false}};
+        let dispatch=||super::super::m3_tiler_command::Dispatch26 {incarnation:9,serial:1,peer_stamp:0,
+            usc_window:1<<32,firmware_aux:fw(12),scene_scratch:gpu(4)};
+        let mut bytes=[0xa5;EXTENDED_SIZE+8];
+        command.encode_extended(dispatch(),&mut bytes).unwrap();
+        let word=|at|u32::from_le_bytes(bytes[at..at+4].try_into().unwrap());
+        let pointer=|at|u64::from_le_bytes(bytes[at..at+8].try_into().unwrap());
+        assert_eq!(word(0xbd0),command.stamp_value);
+        assert_eq!(word(EXTENDED_FLUSH),1);
+        assert_eq!(pointer(0x900),command.state.background.address);
+        assert_eq!(pointer(0x930),command.state.partial_background.address);
+        assert_eq!(bytes[0xc5f],9);
+        assert_eq!(&bytes[EXTENDED_SIZE..],&[0xa5;8]);
+        let mut short=[0xa5;EXTENDED_SIZE-1];
+        assert!(command.encode_extended(dispatch(),&mut short).is_err());
+        assert!(short.iter().all(|b|*b==0xa5));
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs b/drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs
index 684505615adf3b..97c1367b29455d 100644
--- a/drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs
@@ -61,3 +61,77 @@ impl Manager {
         Ok(())
     }
 }
+
+impl Manager {
+    pub(crate) const EXTENDED_SIZE: usize = 0xc0;
+
+    /// J613's extended manager has both firmware and GPU page-list aliases.
+    /// The block ring is read through its canonical firmware mapping.
+    pub(crate) fn encode_extended(&self, pages_fw: FirmwareVa, blocks_fw: FirmwareVa,
+        hardware_id: u32, output: &mut [u8]) -> Result<(), Error> {
+        let capacity = self.block_count.checked_add(1).and_then(u32::checked_next_power_of_two)
+            .ok_or(Error::Size)?;
+        if hardware_id >= 32 || capacity as usize > self.blocks.size() / 8 {
+            return Err(Error::Size);
+        }
+        let bytes = output.get_mut(..Self::EXTENDED_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        let word = |bytes: &mut [u8], offset: usize, value: u32| {
+            bytes[offset..offset + 4].copy_from_slice(&value.to_le_bytes());
+        };
+        let address = |bytes: &mut [u8], offset: usize, value: u64| {
+            bytes[offset..offset + 8].copy_from_slice(&value.to_le_bytes());
+        };
+        word(bytes, 8, hardware_id);
+        word(bytes, 12, hardware_id);
+        address(bytes, 0x1c, pages_fw.get());
+        address(bytes, 0x24, self.pages.base());
+        word(bytes, 0x2c, self.pages.size() as u32);
+        word(bytes, 0x30, self.page_count);
+        word(bytes, 0x34, capacity);
+        word(bytes, 0x38, self.block_count);
+        address(bytes, 0x40, blocks_fw.get());
+        address(bytes, 0x48, self.control.get());
+        word(bytes, 0x50, self.page_count - 1);
+        word(bytes, 0x54, BLOCK_SIZE as u32);
+        address(bytes, 0x60, self.counter.get());
+        word(bytes, 0x78, self.page_count);
+        word(bytes, 0x7c, self.page_count);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    fn fixture() -> Manager {
+        Manager::new(GpuRegion::new(0x5000_0000, 0x4000).unwrap(),
+            GpuRegion::new(0x6000_0000, 0x4000).unwrap(),
+            FirmwareVa::new(0xffff_fc24_0010_0000).unwrap(),
+            FirmwareVa::new(0xffff_fc24_0020_0000).unwrap(), 32).unwrap()
+    }
+    #[test] fn native_manager_keeps_distinct_aliases_and_hardware_identity() {
+        let mut bytes = [0xa5; Manager::EXTENDED_SIZE + 8];
+        let pages = FirmwareVa::new(0xffff_fc24_0030_0000).unwrap();
+        let blocks = FirmwareVa::new(0xffff_fc24_0040_0000).unwrap();
+        fixture().encode_extended(pages, blocks, 7, &mut bytes).unwrap();
+        let word = |at| u32::from_le_bytes(bytes[at..at + 4].try_into().unwrap());
+        let pointer = |at| u64::from_le_bytes(bytes[at..at + 8].try_into().unwrap());
+        assert_eq!(word(8), 7); assert_eq!(word(12), 7);
+        assert_eq!(pointer(0x1c), pages.get());
+        assert_eq!(pointer(0x24), 0x5000_0000);
+        assert_eq!(pointer(0x40), blocks.get());
+        assert_eq!(word(0x34), 64); assert_eq!(word(0x38), 32);
+        assert_eq!(word(0x50), 127);
+        assert_eq!(pointer(0x80), 0);
+        assert_eq!(&bytes[Manager::EXTENDED_SIZE..], &[0xa5; 8]);
+    }
+    #[test] fn native_manager_rejects_short_storage_and_invalid_identity_before_mutation() {
+        let fw = FirmwareVa::new(0xffff_fc24_0010_0000).unwrap();
+        let mut bytes = [0xa5; Manager::EXTENDED_SIZE];
+        assert!(fixture().encode_extended(fw, fw, 32, &mut bytes).is_err());
+        assert_eq!(bytes, [0xa5; Manager::EXTENDED_SIZE]);
+        assert!(fixture().encode_extended(fw, fw, 0, &mut bytes[..MANAGER_SIZE]).is_err());
+        assert_eq!(bytes, [0xa5; Manager::EXTENDED_SIZE]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_pass.rs b/drivers/gpu/drm/asahi/m3/m3_pass.rs
index 94c2172e33279b..9c0eb070039cdd 100644
--- a/drivers/gpu/drm/asahi/m3/m3_pass.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_pass.rs
@@ -8,10 +8,10 @@ use layout::{Field,Space};
 pub(crate) struct Pass {buffers:KVec<Buffer>}
 impl Pass {
     pub(crate) fn new(dev:&driver::AsahiDrmDevice,uat:&mmu::Uat,vm:&mmu::Vm,
-        slot:usize,clusters:u32,aliases:&mut KVec<mmu::KernelMapping>)->Result<Self> {
+        slot:usize,clusters:u32,profile:super::m3_profile::Profile,aliases:&mut KVec<mmu::KernelMapping>)->Result<Self> {
         let mut buffers=KVec::with_capacity(layout::COUNT,GFP_KERNEL)?;
         for field in layout::FIELDS {
-            let a=layout::board_allocation(slot,field,clusters).map_err(|_|EINVAL)?;
+            let a=layout::allocation_for(profile,slot,field,clusters).map_err(|_|EINVAL)?;
             let mut b=match a.space {
                 Space::ClientGpu=>Buffer::at_prot(dev,uat.kernel_vm(),Some((vm,a.address)),None,
                     a.size,prot::PROT_GPU_FW_SHARED_RW,prot::Prot::from_pte(a.access.pte()))?,
diff --git a/drivers/gpu/drm/asahi/m3/m3_pass_layout.rs b/drivers/gpu/drm/asahi/m3/m3_pass_layout.rs
index a8a2e23c0fbd14..2ec8f8eb212e57 100644
--- a/drivers/gpu/drm/asahi/m3/m3_pass_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_pass_layout.rs
@@ -215,3 +215,39 @@ mod tests {
         }
     }
 }
+
+pub(crate) fn allocation_for(profile: super::m3_profile::Profile, slot:usize, field:Field, clusters:u32)
+    -> Result<Allocation,Error> {
+    let mut owner = board_allocation(slot,field,clusters)?;
+    if profile == super::m3_profile::Profile::Legacy { return Ok(owner); }
+    if owner.space == Space::Firmware {
+        owner.address = 0xffff_fc25_0000_0000 + (slot * COUNT + field as usize) as u64 * 0x10_0000;
+    }
+    match field {
+        Field::Scene => owner.size = 0x400,
+        Field::TilerCommand | Field::FragmentCommand => {
+            let fragment = field == Field::FragmentCommand;
+            owner.size = if fragment {0xca0} else {0x940};
+            owner.gpu_alias = Some(0x72_1000_0000 + slot as u64 * 0x4_0000
+                + u64::from(fragment) * 0x4000);
+        }
+        Field::TilerToFragment | Field::TilerDependency | Field::FragmentDependency => owner.size = 0x40,
+        _ => {}
+    }
+    Ok(owner)
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test] fn extended_command_aliases_keep_whole_disjoint_pages() {
+        for slot in 0..SLOTS {
+            for field in [Field::TilerCommand,Field::FragmentCommand] {
+                let owner = allocation_for(super::super::m3_profile::Profile::Extended,slot,field,1).unwrap();
+                assert_eq!(owner.address & 0x3fff,0);
+                assert_eq!(owner.gpu_alias.unwrap() & 0x3fff,0);
+                assert!(owner.size <= 0x4000);
+            }
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_profile.rs b/drivers/gpu/drm/asahi/m3/m3_profile.rs
index 004ac2c7d1eef2..04b872ed9ea809 100644
--- a/drivers/gpu/drm/asahi/m3/m3_profile.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_profile.rs
@@ -32,6 +32,15 @@ impl Profile {
         }
     }
 
+    /// Keep the diagnostic AP/GPU timeline in its established 24 MHz units.
+    /// User timestamps and duration calculations retain native firmware units.
+    pub(crate) const fn profiler_ticks(self, timestamp: u64) -> u64 {
+        match self {
+            Self::Legacy => timestamp,
+            Self::Extended => (timestamp / 1000) * 24 + (timestamp % 1000) * 24 / 1000,
+        }
+    }
+
     pub(crate) fn gpu_duration_ns(self, elapsed: u64) -> Option<u64> {
         match self {
             Self::Legacy => elapsed.checked_mul(1000).map(|value| value / 24),
@@ -49,6 +58,18 @@ impl Profile {
 mod tests {
     use super::*;
 
+    #[test]
+    fn profiling_uses_one_clock_domain_without_changing_native_durations() {
+        for value in [0, 1, 999, 1000, 24_000_000, u64::MAX] {
+            assert_eq!(Profile::Legacy.profiler_ticks(value), value);
+            assert_eq!(
+                Profile::Extended.profiler_ticks(value),
+                ((value as u128) * 24 / 1000) as u64
+            );
+        }
+        assert_eq!(Profile::Extended.profiler_ticks(1_000_000_000), 24_000_000);
+    }
+
     #[test]
     fn profile_acknowledgement_is_exact_and_file_query_covers_hal() {
         for profile in [Profile::Legacy, Profile::Extended] {
diff --git a/drivers/gpu/drm/asahi/m3/m3_render.rs b/drivers/gpu/drm/asahi/m3/m3_render.rs
index e7a02982e96f12..9a9f63d15b784f 100644
--- a/drivers/gpu/drm/asahi/m3/m3_render.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_render.rs
@@ -26,7 +26,7 @@ pub(crate) struct Render {
     passes:KVec<Pass>, init_bm:Buffer,
     // All active mappings above must drop before their ASID binding.
     _binding:mmu::VmBind,
-    stats: Region, sequence_bytes: KVec<u8>, tiler_bytes: KVec<u8>, fragment_bytes: KVec<u8>,
+    stats: [Region;2], profile:super::m3_profile::Profile, sequence_bytes: KVec<u8>, tiler_bytes: KVec<u8>, fragment_bytes: KVec<u8>,
     last_progress_ns:i64,
     draw:u64, heads:[u16;2], cached_views:KVec<CachedViews>,
     slot:usize, batch_count:usize, early_count:u32,
@@ -67,37 +67,45 @@ const RENDER_QUEUES: [QueueObjects; 2] = [
         scratch: s::FRAGMENT_SCRATCH, tiler: false, uuid: 0x3d0000 },
 ];
 impl Render {
-    pub(crate) fn new(dev:&driver::AsahiDrmDevice,uat:&mmu::Uat,vm:&mmu::Vm,stats:Region,clusters:u32,
-        registers:crate::m3::m3_compute_layout::RegisterSet)->Result<Self> {
+    pub(crate) fn new(dev:&driver::AsahiDrmDevice,uat:&mmu::Uat,vm:&mmu::Vm,stats:[Region;2],clusters:u32,
+        registers:crate::m3::m3_compute_layout::RegisterSet,profile:super::m3_profile::Profile)->Result<Self> {
         let lower_tlbi=crate::m3::m3_memory::LowerTlbi;
         let binding=uat.bind(vm)?;
         let mut objects=KVec::new();let mut aliases=KVec::new();
         for index in 0..s::COUNT {
-            let a=s::allocation(index).map_err(|_|EINVAL)?;
+            let a=s::allocation_for(profile,index).map_err(|_|EINVAL)?;
             let protection=prot::Prot::from_pte(a.access.pte());
             let b=match a.space {
                 Space::ClientGpu=>Buffer::at_prot(dev,uat.kernel_vm(),Some((vm,a.address)),None,
                     a.size,prot::PROT_GPU_FW_SHARED_RW,protection)?,
-                Space::Firmware=>Buffer::at_prot(dev,uat.kernel_vm(),None,Some(a.address),
+                Space::Firmware=>Buffer::at_prot(dev,uat.kernel_vm(),
+                    a.gpu_alias.map(|address|(uat.kernel_lower_vm(),address)),Some(a.address),
                     a.size,protection,prot::PROT_GPU_SHARED_RW)?,
             };
+            let mut b=b;
+            if a.gpu_alias.is_some() { aliases.push(b.map_gpu_view(vm)?,GFP_KERNEL)?; }
             objects.push(b,GFP_KERNEL)?;
         }
         // InitBM is shared, not part of a pass. Preserve its qualified mapping.
-        let init_bm=Buffer::at_prot(dev,uat.kernel_vm(),None,Some(0xfffffc200062bfe0),
+        let init_bm=Buffer::at_prot(dev,uat.kernel_vm(),None,Some(if profile==super::m3_profile::Profile::Extended {0xffff_fc24_4000_0000}
+                else {0xfffffc200062bfe0}),
             sync::INIT_BM_SIZE,prot::PROT_FW_SHARED_RW,prot::PROT_GPU_SHARED_RW)?;
         let mut passes=KVec::with_capacity(pass_layout::SLOTS,GFP_KERNEL)?;
-        for slot in 0..pass_layout::SLOTS {passes.push(Pass::new(dev,uat,vm,slot,clusters,&mut aliases)?,GFP_KERNEL)?;}
+        for slot in 0..pass_layout::SLOTS {passes.push(Pass::new(dev,uat,vm,slot,clusters,profile,&mut aliases)?,GFP_KERNEL)?;}
         let mut sequence_bytes=KVec::new();
         sequence_bytes.resize(sequence::STORAGE,0u8,GFP_KERNEL)?;
         let mut tiler_bytes=KVec::new();
-        tiler_bytes.resize(tiler::SIZE,0u8,GFP_KERNEL)?;
+        tiler_bytes.resize(if profile==super::m3_profile::Profile::Extended {tiler::EXTENDED_SIZE} else {tiler::SIZE},0u8,GFP_KERNEL)?;
         let mut fragment_bytes=KVec::new();
-        fragment_bytes.resize(fragment::SIZE,0u8,GFP_KERNEL)?;
-        let mut job=Self{passes,init_bm,stats,sequence_bytes,tiler_bytes,fragment_bytes,objects,_aliases:aliases,_binding:binding,last_progress_ns:0,draw:0,heads:[0;2],cached_views:KVec::new(),slot:0,batch_count:0,early_count:0,stage_timestamps:[true;2],base:0,checkpoint:(0,[0;2],0,0,0,0),clusters,registers,_lower_tlbi:lower_tlbi};
+        fragment_bytes.resize(if profile==super::m3_profile::Profile::Extended {fragment::EXTENDED_SIZE} else {fragment::SIZE},0u8,GFP_KERNEL)?;
+        let mut job=Self{passes,init_bm,stats,profile,sequence_bytes,tiler_bytes,fragment_bytes,objects,_aliases:aliases,_binding:binding,last_progress_ns:0,draw:0,heads:[0;2],cached_views:KVec::new(),slot:0,batch_count:0,early_count:0,stage_timestamps:[true;2],base:0,checkpoint:(0,[0;2],0,0,0,0),clusters,registers,_lower_tlbi:lower_tlbi};
         // Lists and the matching manager are built before InitBM publication.
         job.initialize_parameter_buffer()?;
-        for pool in &UMA_POOLS { pool.initialize(&mut job.objects)?; }
+        for (index,pool) in UMA_POOLS.iter().enumerate() {
+            if profile==super::m3_profile::Profile::Extended {
+                pool.initialize_extended(&mut job.objects,33+index as u8,false)?;
+            } else {pool.initialize(&mut job.objects)?;}
+        }
         job.initialize_state()?;
         job.initialize_queues()?;
         dev_info!(dev.as_ref(),"M3 native render storage initialized, PB={} MiB\n",PB_BLOCKS as usize*PB_BLOCK_SIZE/(1024*1024));
@@ -113,8 +121,14 @@ impl Render {
         let control = queue::FirmwareVa::new(self.objects[BLOCK_CONTROL].va()).map_err(|_| EINVAL)?;
         let counter = queue::FirmwareVa::new(self.objects[s::BM_COUNTER].va()).map_err(|_| EINVAL)?;
         let manager = parameter::Manager::new(pages, blocks, control, counter, PB_BLOCKS).map_err(|_| EINVAL)?;
-        let mut bytes = [0; parameter::MANAGER_SIZE];
-        manager.encode(&mut bytes).map_err(|_| EINVAL)?;
+        let extended=self.profile==super::m3_profile::Profile::Extended;
+        let mut bytes = [0; parameter::Manager::EXTENDED_SIZE];
+        let length=if extended {
+            manager.encode_extended(queue::FirmwareVa::new(self.objects[PARAMETER_PAGE_LIST].va()).map_err(|_|EINVAL)?,
+                queue::FirmwareVa::new(self.objects[PARAMETER_BLOCK_LIST].va()).map_err(|_|EINVAL)?,0,&mut bytes)
+                .map_err(|_|EINVAL)?;
+            parameter::Manager::EXTENDED_SIZE
+        } else {manager.encode(&mut bytes).map_err(|_|EINVAL)?;parameter::MANAGER_SIZE};
         for group in 0..PB_GROUPS {
             let buffer = &self.objects[PB_FIRST + group];
             let backing = parameter::Backing::new(GpuRegion::new(buffer.gpu_va()?, buffer.size()).map_err(|_| EINVAL)?)
@@ -128,18 +142,30 @@ impl Render {
                     backing.page(page).map_err(|_| EINVAL)?)?;
             }
         }
-        self.objects[BUFFER_MANAGER].write(0, &bytes)
+        self.objects[BUFFER_MANAGER].write(0, &bytes[..length])
     }
     fn initialize_state(&mut self) -> Result {
         let address = |owner: usize| queue::FirmwareVa::new(self.objects[owner].va()).map_err(|_| EINVAL);
         let notification = state::Notifier { threshold: address(s::EVENT_COUNT)?, context: self._binding.slot() };
         let list_owner = address(JOB_LIST)?;
         let mut context = [0; state::CONTEXT_SIZE];
-        state::context(&mut context).map_err(|_| EINVAL)?;
-        self.objects[GPU_CONTEXT].write(0, &context)?;
-        let mut notifier = [0; state::NOTIFIER_SIZE];
-        notification.encode(&mut notifier).map_err(|_| EINVAL)?;
-        self.objects[NOTIFIER].write(0, &notifier)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            state::context_extended(&mut context).map_err(|_|EINVAL)?;
+            self.objects[GPU_CONTEXT].write(0,&context[..state::EXTENDED_CONTEXT_SIZE])?;
+            for engine in 0..2 {
+                let value=state::Notifier {threshold:queue::FirmwareVa::new(self.objects[s::EVENT_COUNT].va()+engine as u64*8).map_err(|_|EINVAL)?,
+                    context:self._binding.slot()};
+                let mut notifier=[0;state::EXTENDED_NOTIFIER_SIZE];
+                value.encode_extended(&mut notifier).map_err(|_|EINVAL)?;
+                self.objects[NOTIFIER].write(engine*state::EXTENDED_NOTIFIER_SIZE,&notifier)?;
+            }
+        } else {
+            state::context(&mut context).map_err(|_| EINVAL)?;
+            self.objects[GPU_CONTEXT].write(0, &context)?;
+            let mut notifier = [0; state::NOTIFIER_SIZE];
+            notification.encode(&mut notifier).map_err(|_| EINVAL)?;
+            self.objects[NOTIFIER].write(0, &notifier)?;
+        }
         let mut list = [0; state::JOB_LIST_SIZE];
         state::job_list(&mut list, list_owner).map_err(|_| EINVAL)?;
         self.objects[JOB_LIST].write(0, &list)?;
@@ -157,6 +183,10 @@ impl Render {
             state::counter(bytes, value).map_err(|_| EINVAL)?;
             self.objects[owner].write(0, bytes)?;
         }
+        if self.profile==super::m3_profile::Profile::Extended {
+            self.objects[s::EVENT_COUNT].fill(0)?;
+            self.objects[s::BM_COUNTER].fill(0)?;
+        }
         Ok(())
     }
     fn initialize_queues(&mut self) -> Result {
@@ -172,8 +202,13 @@ impl Render {
             }else{[self.passes[0].get(P::TilerToFragment).va(),self.passes[0].get(P::FragmentCommand).va()]};
             let seeds=[queue::FirmwareVa::new(seed_addresses[0]).map_err(|_|EINVAL)?,
                 queue::FirmwareVa::new(seed_addresses[1]).map_err(|_|EINVAL)?];
-            let mut bytes = [0; queue::INFO_SIZE];
-            info.encode(&mut bytes).map_err(|_| EINVAL)?;
+            let mut bytes=KVec::new();
+            bytes.resize(if self.profile==super::m3_profile::Profile::Extended {
+                queue::QueueInfo::EXTENDED_SIZE
+            } else {queue::INFO_SIZE},0u8,GFP_KERNEL)?;
+            if self.profile==super::m3_profile::Profile::Extended {
+                info.encode_extended(address(owner.info)?,&mut bytes).map_err(|_|EINVAL)?;
+            } else {info.encode(&mut bytes).map_err(|_|EINVAL)?;}
             self.objects[owner.info].write(0, &bytes)?;
             let mut state = [0; queue::STATE_SIZE];
             queue::RingState { capacity: queue::QUALIFIED_CAPACITY, done: 0, read: 0, write: 0 }
@@ -187,9 +222,12 @@ impl Render {
         Ok(())
     }
     fn write_barrier(&mut self, owner: P, command: sync::Barrier) -> Result {
-        let mut bytes = [0; sync::BARRIER_SIZE];
-        command.encode(&mut bytes).map_err(|_| EINVAL)?;
-        self.passes[self.slot].get_mut(owner).write(0, &bytes)
+        let mut bytes=[0;sync::Barrier::EXTENDED_SIZE];
+        let length=if self.profile==super::m3_profile::Profile::Extended {
+            command.encode_extended(&mut bytes).map_err(|_|EINVAL)?;
+            sync::Barrier::EXTENDED_SIZE
+        } else {command.encode(&mut bytes).map_err(|_|EINVAL)?;sync::BARRIER_SIZE};
+        self.passes[self.slot].get_mut(owner).write(0,&bytes[..length])
     }
     // Construct synchronization from the actual owners after resetting a pass,
     // before publishing its ring entries. InitBM is shared and dispatched only
@@ -201,9 +239,11 @@ impl Render {
         let ta_stamp = address(s::TA_FW_STAMP)?;
         let fs_stamp = address(s::FRAGMENT_FW_STAMP)?;
         let mut init = [0; sync::INIT_BM_SIZE];
-        sync::InitBufferManager { context: self._binding.slot(), slot: 0,
-            block_count: PB_BLOCKS, manager, stamp: timeline::stamp(s::STAMP_TA - 256, 1) }
-            .encode(&mut init).map_err(|_| EINVAL)?;
+        let value=sync::InitBufferManager { context: self._binding.slot(), slot: 0,
+            block_count: PB_BLOCKS, manager, stamp: timeline::stamp(s::STAMP_TA - 256, 1) };
+        if self.profile==super::m3_profile::Profile::Extended {
+            value.encode_extended(&mut init).map_err(|_|EINVAL)?;
+        } else {value.encode(&mut init).map_err(|_|EINVAL)?;}
         self.init_bm.write(0, &init)?;
         let ta_value = timeline::stamp(s::STAMP_TA - 256, draw);
         let fs_value = timeline::stamp(s::STAMP_FRAGMENT - 256, draw);
@@ -225,7 +265,7 @@ impl Render {
     }
     // Prepare each private command after its retired slot is reset. The
     // reusable host staging allocation is copied before the next slot is built.
-    fn prepare_tiler(&mut self,r:agx_uapi::UapiRenderCommand,draw:u64)->Result {
+    fn prepare_tiler(&mut self,r:agx_uapi::UapiRenderCommand,usc:u64,draw:u64)->Result {
         use crate::m3::m3_compute_layout::GpuVa;
         let pass=&self.passes[self.slot];
         let shared=|index:usize| queue::FirmwareVa::new(self.objects[index].va()).map_err(|_|EINVAL);
@@ -243,7 +283,7 @@ impl Render {
         let value=tiler::Command {
             context:self._binding.slot(),register_set:self.registers,
             notifier:shared(NOTIFIER)?,manager:shared(BUFFER_MANAGER)?,
-            scene:fw(P::Scene)?,empty:shared(547)?,gpu_alias:GpuVa::new(command.gpu_va()?).map_err(|_|EINVAL)?,
+            scene:fw(P::Scene)?,empty:if self.profile==super::m3_profile::Profile::Extended {queue::FirmwareVa::new(pass.get(P::Scene).va()+0x100).map_err(|_|EINVAL)?} else {shared(547)?},gpu_alias:GpuVa::new(command.gpu_va()?).map_err(|_|EINVAL)?,
             sequence:Region::new(seq.va(),seq.size()).map_err(|_|EINVAL)?,pool:shared(UMA_POOLS[0].manager)?,
             scratch:fw(P::TilerScratch)?,stamp:shared(s::TA_STAMP)?,fw_stamp:shared(s::TA_FW_STAMP)?,
             stamp_value:timeline::stamp(s::STAMP_TA - 256, draw),timestamps:[fw(P::TilerStart)?,fw(P::TilerEnd)?],
@@ -253,7 +293,12 @@ impl Render {
             vdm:crate::m3::agx_render_state::compact(r.vdm_base).map_err(|_|EINVAL)?,
             multisample:r.multisample_control,ppp:r.ppp_control,process_empty_tiles:r.flags&2!=0,
         };
-        value.encode(&mut self.tiler_bytes).map_err(|_|EINVAL)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            value.encode_extended(tiler::Dispatch26 {incarnation:self._binding.generation(),serial:draw.checked_mul(2).ok_or(EOVERFLOW)?,
+                peer_stamp:timeline::stamp(s::STAMP_FRAGMENT-256,draw),usc_window:usc,
+                firmware_aux:queue::FirmwareVa::new(self.objects[UMA_POOLS[0].manager].va()+0x100).map_err(|_|EINVAL)?,
+                scene_scratch:gpu(P::FragmentScratch)?},&mut self.tiler_bytes).map_err(|_|EINVAL)?;
+        } else {value.encode(&mut self.tiler_bytes).map_err(|_|EINVAL)?;}
         self.passes[self.slot].get_mut(P::TilerCommand).write(0,&self.tiler_bytes)
     }
     fn prepare_sequences(&mut self,draw:u64)->Result {
@@ -266,14 +311,21 @@ impl Render {
             let notifier=&self.objects[NOTIFIER];
             let owners=sequence::Owners {
                 command:region(if fs{P::FragmentCommand}else{P::TilerCommand})?,sequence:region(target)?,
-                stats:self.stats,notifier:Region::new(notifier.va(),notifier.size()).map_err(|_|EINVAL)?,
+                stats:self.stats[usize::from(fs)],notifier:Region::new(notifier.va()+
+                    if fs && self.profile==super::m3_profile::Profile::Extended {0x200} else {0},
+                    if self.profile==super::m3_profile::Profile::Extended {0x200} else {notifier.size()}).map_err(|_|EINVAL)?,
                 queue:shared(if fs{s::FRAGMENT_QUEUE}else{s::TA_QUEUE})?,scene:fw(P::Scene)?,
                 manager:shared(BUFFER_MANAGER)?,pool:shared(UMA_POOLS[usize::from(fs)].manager)?,
                 fw_stamp:shared(if fs{s::FRAGMENT_FW_STAMP}else{s::TA_FW_STAMP})?,
                 context:self._binding.slot(),stamp:timeline::stamp((if fs{s::STAMP_FRAGMENT}else{s::STAMP_TA}) - 256, draw),
             };
             let timed=self.stage_timestamps[usize::from(fs)];
-            let length=if fs {
+            let length=if self.profile==super::m3_profile::Profile::Extended {
+                let pool=&self.objects[UMA_POOLS[usize::from(fs)].manager];
+                let auxiliary=super::m3_compute_layout::GpuVa::new(pool.gpu_va()?+if fs{0x200}else{0x100}).map_err(|_|EINVAL)?;
+                let serial=draw.checked_mul(2).and_then(|v|v.checked_sub(u64::from(fs))).ok_or(EOVERFLOW)?;
+                owners.encode_extended(fs,auxiliary,serial,&mut self.sequence_bytes).map_err(|_|EINVAL)?
+            } else if fs {
                 let b=pass.get(P::FragmentScratch);
                 let scratch=GpuRegion::new(b.gpu_va()?,b.size()).map_err(|_|EINVAL)?;
                 sequence::Fragment{owners,scratch,queue_command_count:timeline::previous(draw)}.encode_timestamps(&mut self.sequence_bytes,timed).map_err(|_|EINVAL)?
@@ -290,6 +342,9 @@ impl Render {
     fn patch_context(&mut self)->Result {
         let context=self._binding.slot();
         self.objects[NOTIFIER].u32(state::NOTIFIER_CONTEXT, context)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            self.objects[NOTIFIER].u32(0x200+state::NOTIFIER_CONTEXT,context)?;
+        }
         Ok(())
     }
     /// Pass geometry; TPC storage is per tiler accelerator, one per GPU cluster.
@@ -320,7 +375,8 @@ impl Render {
         let value=fragment::Command {
             context:self._binding.slot(),register_set:self.registers,
             sequence:Region::new(seq.va(),seq.size()).map_err(|_|EINVAL)?,
-            notifier:shared(NOTIFIER)?,manager:shared(BUFFER_MANAGER)?,scene:fw(P::Scene)?,empty:shared(547)?,
+            notifier:queue::FirmwareVa::new(self.objects[NOTIFIER].va()+
+                if self.profile==super::m3_profile::Profile::Extended {0x200} else {0}).map_err(|_|EINVAL)?,manager:shared(BUFFER_MANAGER)?,scene:fw(P::Scene)?,empty:if self.profile==super::m3_profile::Profile::Extended {queue::FirmwareVa::new(pass.get(P::Scene).va()+0x100).map_err(|_|EINVAL)?} else {shared(547)?},
             gpu_alias:GpuVa::new(command.gpu_va()?).map_err(|_|EINVAL)?,tilemap:gpu(P::Tilemap)?,
             heap:gpu(P::HeapMetadata)?,auxiliary:gpu(P::Auxiliary)?,scene_user:gpu(P::SceneUser)?,
             scratch:gpu(P::FragmentScratch)?,pool:shared(UMA_POOLS[1].manager)?,stamp:shared(s::FRAGMENT_STAMP)?,
@@ -341,15 +397,34 @@ impl Render {
                 stencil_clear:r.stencil_clear,sample_size:u32::from(r.sample_size),process_empty_tiles:r.flags&2!=0,
             },
         };
-        value.encode(&mut self.fragment_bytes).map_err(|_|EINVAL)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            value.encode_extended(tiler::Dispatch26 {incarnation:self._binding.generation(),serial:draw.checked_mul(2).and_then(|v|v.checked_sub(1)).ok_or(EOVERFLOW)?,
+                peer_stamp:0,usc_window:usc,
+                firmware_aux:queue::FirmwareVa::new(self.objects[UMA_POOLS[1].manager].va()+0x200).map_err(|_|EINVAL)?,
+                scene_scratch:gpu(P::FragmentScratch)?},&mut self.fragment_bytes).map_err(|_|EINVAL)?;
+        } else {value.encode(&mut self.fragment_bytes).map_err(|_|EINVAL)?;}
         self.passes[self.slot].get_mut(P::FragmentCommand).write(0,&self.fragment_bytes)
     }
+    pub(crate) fn set_attachments(&mut self,attachments:&[crate::m3::agx_attachments::Attachments;2])->Result {
+        // Preserve the legacy renderer's existing packet format. The native
+        // interface consumes separate attachment apertures for both stages.
+        if self.profile!=super::m3_profile::Profile::Extended {return Ok(());}
+        for (fragment,list) in attachments.iter().enumerate() {
+            let field=if fragment==0 {P::TilerSequence}else{P::FragmentSequence};
+            let buffer=self.passes[self.slot].get_mut(field);
+            sequence::patch_extended_attachments(fragment!=0,list,|offset,data|buffer.write(offset,data))?;
+        }
+        crate::m3::agx_memory::publish();Ok(())
+    }
     pub(crate) fn set_user_timestamps(&mut self,addresses:[[u64;2];2])->Result {
         if addresses.iter().enumerate().any(|(stage,pair)|*pair!=[0;2] && !self.stage_timestamps[stage]) {return Err(EINVAL);}
         for (stage,(command,sequence,offset,start,end)) in [
             (P::TilerCommand,P::TilerSequence,sequence::ta::USER_PAIR,sequence::ta::TIMESTAMP_START,sequence::ta::TIMESTAMP_END),
             (P::FragmentCommand,P::FragmentSequence,sequence::fragment::USER_PAIR,sequence::fragment::TIMESTAMP_START,sequence::fragment::TIMESTAMP_END)
         ].into_iter().enumerate() {
+            let (offset,start,end)=if self.profile==super::m3_profile::Profile::Extended {
+                if stage==0 {(0x8d8,0x1cc,0x21c)} else {(0xc20,0x1e4,0x234)}
+            } else {(offset,start,end)};
             let pair=addresses[stage];
             if !self.stage_timestamps[stage] {continue;}
             self.passes[self.slot].get_mut(command).u64(offset,pair[0])?;
@@ -365,19 +440,19 @@ impl Render {
     pub(crate) fn gpu_ns(&mut self,base:usize,count:usize)->Result<u64> {
         let start=self.passes[base].get_mut(P::TilerStart).read_u64(0)?;
         let end=self.passes[Self::at(base,count-1)].get_mut(P::FragmentEnd).read_u64(0)?;
-        Ok(if start!=0 && end>=start {(end-start)*1000/24} else {0})
+        self.profile.gpu_duration_ns(if start!=0 && end>=start {end-start} else {0}).ok_or(EOVERFLOW)
     }
     /// The batch's first tiler start and last fragment end, in 24 MHz GPU timestamp ticks.
     pub(crate) fn gpu_ticks(&mut self,base:usize,count:usize)->Result<(u64,u64)> {
-        Ok((self.passes[base].get_mut(P::TilerStart).read_u64(0)?,
-            self.passes[Self::at(base,count-1)].get_mut(P::FragmentEnd).read_u64(0)?))
+        Ok((self.profile.profiler_ticks(self.passes[base].get_mut(P::TilerStart).read_u64(0)?),
+            self.profile.profiler_ticks(self.passes[Self::at(base,count-1)].get_mut(P::FragmentEnd).read_u64(0)?)))
     }
     /// Read retained timestamps only after exact batch retirement. The first
     /// TA and final fragment delimit the batch in the shared 24 MHz counter.
     pub(crate) fn batch_gpu_span(&mut self)->Result<[u64;2]> {
         if self.batch_count == 0 {return Err(EINVAL);}
-        Ok([self.passes[self.base].get_mut(P::TilerStart).read_u64(0)?,
-            self.passes[Self::at(self.base,self.batch_count-1)].get_mut(P::FragmentEnd).read_u64(0)?])
+        let (start,end)=self.gpu_ticks(self.base,self.batch_count)?;
+        Ok([start,end])
     }
     pub(crate) fn stage_ns(&mut self,base:usize,count:usize)->Result<[u64;3]> {
         let mut total=[0;3];
@@ -390,7 +465,7 @@ impl Render {
     pub(crate) fn slot_stage_ns(&mut self,base:usize,count:usize,index:usize)->Result<[u64;3]> {
         if index>=count {return Err(EINVAL);}
         let slot=Self::at(base,index);
-        let duration=|a:u64,b:u64| if a!=0 && b>=a {(b-a)*1000/24} else {0};
+        let duration=|a:u64,b:u64| self.profile.gpu_duration_ns(if a!=0 && b>=a {b-a} else {0}).unwrap_or(0);
         let fs_start=self.passes[slot].get_mut(P::FragmentStart).read_u64(0)?;
         let fs_end=self.passes[slot].get_mut(P::FragmentEnd).read_u64(0)?;
         let ta_start=self.passes[slot].get_mut(P::TilerStart).read_u64(0)?;
@@ -415,7 +490,9 @@ impl Render {
     }
     /// Whether any draw has been published (the first one initializes the buffer manager).
     pub(crate) fn started(&self)->bool {self.draw>0}
-    pub(crate) fn first(&self)->bool {self.draw==self.batch_count as u64}
+    pub(crate) fn first(&self)->bool {
+        self.profile==super::m3_profile::Profile::Legacy && self.draw==self.batch_count as u64
+    }
     /// Start a batch in pass slots `base..`. With `overlap`, earlier batches may still run: then
     /// the VM must already be bound, no storage may grow and the slots must not be in flight
     /// (the caller keeps the in-flight passes plus this batch within SLOTS).
@@ -447,13 +524,15 @@ impl Render {
                 let binding=uat.bind(vm)?;
                 let mut views=KVec::new();let mut aliases=KVec::new();
                 for i in 0..s::COUNT {
-                    if s::allocation(i).map_err(|_|EINVAL)?.space==Space::ClientGpu {
+                    let a=s::allocation_for(self.profile,i).map_err(|_|EINVAL)?;
+                    if a.gpu_alias.is_some() {aliases.push(self.objects[i].map_gpu_view(vm)?,GFP_KERNEL)?;}
+                    if a.space==Space::ClientGpu {
                         views.push((ViewOwner::Shared(i),self.objects[i].map_gpu_view(vm)?),GFP_KERNEL)?;
                     }
                 }
                 for (slot,pass) in self.passes.iter_mut().enumerate() {
                     for field in pass_layout::FIELDS {
-                        let a=pass_layout::board_allocation(slot,field,self.clusters).map_err(|_|EINVAL)?;
+                        let a=pass_layout::allocation_for(self.profile,slot,field,self.clusters).map_err(|_|EINVAL)?;
                         if a.space==Space::ClientGpu {views.push((ViewOwner::Pass{slot,field},pass.get_mut(field).map_gpu_view(vm)?),GFP_KERNEL)?;}
                         if a.gpu_alias.is_some() {aliases.push(pass.get_mut(field).map_gpu_view(vm)?,GFP_KERNEL)?;}
                     }
@@ -498,12 +577,22 @@ impl Render {
         self.base=base;
         Ok(())
     }
+    fn publish_counts(&mut self, draw:u64) -> Result {
+        if self.profile==super::m3_profile::Profile::Extended {
+            for offset in [0,8] {self.objects[s::EVENT_COUNT].u64(offset,draw)?;}
+            for counter in [TA_POOL_COUNTER,FRAGMENT_POOL_COUNTER] {self.objects[counter].u64(0,draw)?;}
+        } else {
+            self.objects[s::BM_COUNTER].u32(0,draw as u32)?;
+            self.objects[s::EVENT_COUNT].u32(0,timeline::events(draw,2))?;
+        }
+        Ok(())
+    }
+
     /// Restore producer state only when no batch is in flight. Running firmware can
     /// consume append's WRITE updates without a new doorbell, so overlap cannot abort.
     pub(crate) fn abort_batch(&mut self)->Result {
         (self.draw,self.heads,self.batch_count,self.slot,self.early_count,self.base)=self.checkpoint;
-        self.objects[s::BM_COUNTER].u32(0,self.draw as u32)?;
-        self.objects[s::EVENT_COUNT].u32(0,timeline::events(self.draw,2))?;
+        self.publish_counts(self.draw)?;
         for (stage,pointers) in [s::TA_POINTERS,s::FRAGMENT_POINTERS].into_iter().enumerate() {
             self.objects[pointers].u32(queue::WRITE,u32::from(self.heads[stage]))?;
         }
@@ -547,8 +636,20 @@ impl Render {
         self.draw=self.draw.checked_add(1).ok_or(EOVERFLOW)?;
         self.batch_count+=1;
         let draw=self.draw;
-        self.objects[s::BM_COUNTER].u32(0,draw as u32)?;
-        self.objects[s::EVENT_COUNT].u32(0,timeline::events(draw,2))?;
+        self.publish_counts(draw)?;
+        if self.profile==super::m3_profile::Profile::Extended {
+            let pass=&self.passes[self.slot];
+            let scratch=pass.get(P::FragmentScratch);
+            let scratch_gpu=GpuRegion::new(scratch.gpu_va()?,scratch.size()).map_err(|_|EINVAL)?;
+            let scratch_fw=queue::FirmwareVa::new(scratch.va()).map_err(|_|EINVAL)?;
+            let list=pass.get(P::SceneUser);
+            let list=GpuRegion::new(list.gpu_va()?,list.size()).map_err(|_|EINVAL)?;
+            let metadata=pass.get(P::Scene);
+            let owner=Region::new(metadata.va(),metadata.size()).map_err(|_|EINVAL)?;
+            let mut bytes=[0;scene::EXTENDED_SIZE];
+            scene::encode_extended(&mut bytes,owner,scratch_gpu,scratch_fw,list).map_err(|_|EINVAL)?;
+            self.passes[self.slot].get_mut(P::Scene).write(0,&bytes)?;
+        } else {
         let entry_offset = (self.draw % u64::from(MANAGER_SCENE_COUNT)) as usize * 4;
         let scene_list = &mut self.objects[s::BM_SCENES];
         if entry_offset + 4 > scene_list.size() { return Err(ERANGE); }
@@ -560,7 +661,8 @@ impl Render {
         let mut bytes = [0; scene::SIZE];
         scene::Scene { manager_entry, manager_misc, user_buffer }.encode(&mut bytes).map_err(|_| EINVAL)?;
         self.passes[self.slot].get_mut(P::Scene).write(0, &bytes)?;
-        self.prepare_tiler(r,draw)?;
+        }
+        self.prepare_tiler(r,usc,draw)?;
         self.patch_context()?;
         self.prepare_fragment(r,usc,draw)?;
         self.prepare_sequences(draw)?;
@@ -655,7 +757,13 @@ impl Render {
             if self.objects[stamp].read_u32(0)?!=value || self.objects[fw].read_u32(0)?!=value
                 || self.objects[pointers].read_u32(queue::DONE)?!=u32::from(head)
                 || self.objects[pointers].read_u32(queue::READ)?!=u32::from(head) {return Ok(false);}
-        } Ok(true)
+        }
+        if self.profile==super::m3_profile::Profile::Extended && self.draw!=0 {
+            for pool in UMA_POOLS {
+                if self.objects[pool.manager].read_u64(0x54)?!=self.draw {return Ok(false);}
+            }
+        }
+        Ok(true)
     }
     pub(crate) fn log(&mut self,dev:&driver::AsahiDrmDevice)->Result {
         // Retain allocator state as well as payloads: an exhausted parameter
diff --git a/drivers/gpu/drm/asahi/m3/m3_render_sequence.rs b/drivers/gpu/drm/asahi/m3/m3_render_sequence.rs
index f9a0483e77b21b..3d421e99066929 100644
--- a/drivers/gpu/drm/asahi/m3/m3_render_sequence.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_render_sequence.rs
@@ -184,3 +184,171 @@ impl Fragment {
         Ok(if timed {LENGTH} else {without_timestamps(bytes,TIMESTAMP_START,FINALIZE,LENGTH,0xa4)})
     }
 }
+
+impl Owners {
+    pub(crate) fn encode_extended(&self, fragment:bool,
+        auxiliary:super::m3_compute_layout::GpuVa, serial:u64, output:&mut[u8]) -> Result<usize,Error> {
+        if self.context>=64 || serial==0 || self.stamp==0 {return Err(Error::Address);}
+        let command=self.command.at(0,if fragment {0xca0}else{0x940})?;
+        let sequence=self.sequence.at(0,STORAGE)?;
+        let activity=self.stats.at(0,8)?;
+        let scene_tail=self.scene.get().checked_add(0x54).ok_or(Error::Address)?;
+        let (clock,pair,aux_time,elapsed)=if fragment {(0xc08,0xc10,0xc70,0xb84)}else{(0x8c0,0x8c8,0x928,0x83c)};
+        let first=if fragment {0x1e4}else{0x1cc};
+        let finalize=if fragment {0x280}else{0x268};
+        let pool=if fragment {0x1b0}else{0x190};
+        let length=if fragment {0x370}else{0x300};
+        let uuid=if fragment {fragment::UUID}else{ta::UUID};
+        let bytes=output.get_mut(..STORAGE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        word(bytes,0,if fragment {7}else{5});
+        pointer(bytes,0x14,command+if fragment {0x80}else{0x40});
+        pointer(bytes,pool,self.pool.get());
+        pointer(bytes,pool+0x18,auxiliary.get());
+        pointer(bytes,pool+0x28,serial);
+        word(bytes,pool+0x30,u32::from(fragment));
+        if fragment {
+            pointer(bytes,0x1c,self.scene.get());
+            pointer(bytes,0x24,activity);
+            pointer(bytes,0x2c,command+0xb70);
+            pointer(bytes,0x34,scene_tail);
+            pointer(bytes,0x3c,command+0xbb0);
+            pointer(bytes,0x44,command+0xbb4);
+            pointer(bytes,0x4c,self.queue.get());
+            pointer(bytes,0x54,command);
+            word(bytes,0x5c,self.context);
+            word(bytes,0x60,1);
+            pointer(bytes,0x7c,command+0xa58);
+            pointer(bytes,0x84,command+0xbf0);
+            word(bytes,0xa0,uuid);
+        } else {
+            pointer(bytes,0x1c,self.manager.get());
+            pointer(bytes,0x24,self.scene.get());
+            pointer(bytes,0x2c,activity);
+            pointer(bytes,0x34,self.queue.get());
+            pointer(bytes,0x3c,command+0x85c);
+            word(bytes,0x44,self.context);
+            word(bytes,0x48,1);
+            pointer(bytes,0x64,command+0x784);
+            pointer(bytes,0x6c,command+0x8a8);
+            word(bytes,0x7c,uuid);
+        }
+        for (at,opcode,selected) in [(first,0x8000_0003,pair),(first+0x50,3,pair+8)] {
+            word(bytes,at,opcode);
+            pointer(bytes,at+4,command+clock);
+            pointer(bytes,at+0xc,command+pair);
+            pointer(bytes,at+0x14,command+selected);
+            pointer(bytes,at+0x1c,self.queue.get());
+            pointer(bytes,at+0x2c,command+aux_time);
+            pointer(bytes,at+0x34,command+elapsed);
+            pointer(bytes,at+0x44,uuid.into());
+        }
+        word(bytes,first+0x4c,1);
+        word(bytes,finalize,if fragment {8}else{6});
+        if fragment {
+            word(bytes,finalize+4,uuid);
+            pointer(bytes,finalize+0xc,self.fw_stamp.get());
+            word(bytes,finalize+0x14,self.stamp);
+            pointer(bytes,finalize+0x1c,self.scene.get());
+            pointer(bytes,finalize+0x24,self.manager.get());
+            word(bytes,finalize+0x2c,1);
+            pointer(bytes,finalize+0x30,activity);
+            pointer(bytes,finalize+0x38,command+0xbb0);
+            pointer(bytes,finalize+0x40,command+0xbb4);
+            pointer(bytes,finalize+0x48,command+0xb70);
+            pointer(bytes,finalize+0x50,self.queue.get());
+            pointer(bytes,finalize+0x58,command);
+            word(bytes,finalize+0x60,self.context);
+            pointer(bytes,finalize+0x64,command+0xa58);
+            pointer(bytes,finalize+0x98,sequence+pool as u64);
+            word(bytes,finalize+0xa0,(-(finalize as i32))as u32);
+            pointer(bytes,finalize+0xa5,command+0xc60);
+            word(bytes,finalize+0xad,1);
+            bytes[finalize+0xb1]=1;
+            // J613 terminates this record after the 16-bit event field.
+            bytes[finalize+0xb2..finalize+0xb4].copy_from_slice(&1u16.to_le_bytes());
+            word(bytes,finalize+0xb4,0x4000_0002);
+        } else {
+            pointer(bytes,finalize+4,self.scene.get());
+            pointer(bytes,finalize+0xc,self.manager.get());
+            pointer(bytes,finalize+0x14,activity);
+            pointer(bytes,finalize+0x1c,self.queue.get());
+            pointer(bytes,finalize+0x24,command+0x85c);
+            word(bytes,finalize+0x2c,self.context);
+            pointer(bytes,finalize+0x34,command+0x784);
+            word(bytes,finalize+0x40,uuid);
+            pointer(bytes,finalize+0x48,self.fw_stamp.get());
+            word(bytes,finalize+0x50,self.stamp);
+            pointer(bytes,finalize+0x78,sequence+pool as u64);
+            word(bytes,finalize+0x80,(-(finalize as i32))as u32);
+            pointer(bytes,finalize+0x85,command+0x918);
+            bytes[finalize+0x8d]=1;
+            word(bytes,finalize+0x94,0x4000_0002);
+        }
+        Ok(length)
+    }
+}
+
+#[cfg(test)]
+mod native_tests {
+    use super::*;
+    #[test] fn j613_fragment_ends_before_the_m4_tail_and_keeps_relative_restart() {
+        let fw=|index:u64|FirmwareVa::new(0xffff_fc25_2000_0000+index*0x4000).unwrap();
+        let o=Owners {command:Region::new(fw(0).get(),0xca0).unwrap(),sequence:Region::new(fw(1).get(),STORAGE).unwrap(),
+            stats:Region::new(fw(2).get(),0x1000).unwrap(),notifier:Region::new(fw(3).get(),0x200).unwrap(),
+            queue:fw(4),scene:fw(5),manager:fw(6),pool:fw(7),fw_stamp:fw(8),context:3,stamp:0x3d000100};
+        let mut output=[0xa5;STORAGE+8];
+        let length=o.encode_extended(true,super::super::m3_compute_layout::GpuVa::new(0x72_3000_0200).unwrap(),1,&mut output).unwrap();
+        assert_eq!(length,0x370);
+        let word=|at|u32::from_le_bytes(output[at..at+4].try_into().unwrap());
+        assert_eq!(word(0x1e4),0x8000_0003);
+        assert_eq!(word(0x230),1);
+        assert_eq!(word(0x234),3);
+        assert_eq!(word(0x280),8);
+        assert_eq!(word(0x320),(-0x280i32)as u32);
+        assert_eq!(word(0x334),0x4000_0002);
+        assert_eq!(&output[STORAGE..],&[0xa5;8]);
+    }
+}
+
+/// Native start records reserve one packed attachment list per engine. The
+/// matching finalizer flag enables completion visibility for that same list.
+pub(crate) const fn extended_attachment_offsets(fragment:bool)->(usize,usize) {
+    if fragment {(0xa8,0x324)} else {(0x88,0x2ec)}
+}
+
+/// Send both pieces through the same bounded writer used for firmware storage.
+#[cfg(any(test, CONFIG_DRM_ASAHI_M3_T8122))]
+pub(crate) fn patch_extended_attachments<E>(fragment:bool,
+    attachments:&super::agx_attachments::Attachments,
+    mut write:impl FnMut(usize,&[u8])->Result<(),E>)->Result<(),E> {
+    let (start,flag)=extended_attachment_offsets(fragment);
+    write(start,&attachments.0)?;
+    write(flag,&[u8::from(attachments.count()!=0)])
+}
+
+#[cfg(test)]
+mod attachment_tests {
+    use super::*;
+    use super::super::agx_attachments::{Attachments,SIZE};
+    #[test] fn each_engine_keeps_its_list_and_can_clear_a_previous_list() {
+        for (fragment,start,flag,pool) in [(false,0x88,0x2ec,0x190),(true,0xa8,0x324,0x1b0)] {
+            let mut bytes=[0xa5;STORAGE];
+            let list=Attachments::new(&[(0x100_0040,0x180),(0x200_0000,0x4000)]).unwrap();
+            let mut apply=|list:&Attachments|patch_extended_attachments(fragment,list,|at,data|{
+                bytes.get_mut(at..at+data.len()).ok_or(Error::Size)?.copy_from_slice(data);Ok::<(),Error>(())
+            });
+            apply(&list).unwrap();
+            assert_eq!(&bytes[start..start+SIZE],&list.0);
+            assert_eq!(bytes[flag],1);
+            assert_eq!(&bytes[pool..pool+8],&[0xa5;8]);
+            patch_extended_attachments(fragment,&Attachments::EMPTY,|at,data|{
+                bytes[at..at+data.len()].copy_from_slice(data);Ok::<(),Error>(())
+            }).unwrap();
+            assert!(bytes[start..start+SIZE].iter().all(|b|*b==0));
+            assert_eq!(bytes[flag],0);
+            assert_eq!(bytes[start-1],0xa5);
+            assert_eq!(bytes[start+SIZE],0xa5);
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_runtime.rs b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
index 058c6610399ae3..3b1f3d6d085356 100644
--- a/drivers/gpu/drm/asahi/m3/m3_runtime.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_runtime.rs
@@ -390,7 +390,7 @@ impl Inner {
         if found.is_none() {
             let job=match control {
                 crate::m3::m3_submit::Command::Compute(c)=>NativeJob::Compute(crate::m3::m3_compute::Compute::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,c,self.device.soc().registers,self.device.firmware().profile()).map_err(early)?),
-                crate::m3::m3_submit::Command::Render{..}=>NativeJob::Render(crate::m3::m3_render::Render::new(&self.drm,&self.uat,&packet.vm,self.config.stats_region().map_err(early)?,self.device.soc().clusters,self.device.soc().registers).map_err(early)?),
+                crate::m3::m3_submit::Command::Render{..}=>NativeJob::Render(crate::m3::m3_render::Render::new(&self.drm,&self.uat,&packet.vm,self.config.render_stats().map_err(early)?,self.device.soc().clusters,self.device.soc().registers,self.device.firmware().profile()).map_err(early)?),
             };
             self.jobs.push(job,GFP_KERNEL).map_err(|_|early(ENOMEM))?;
         } else {
@@ -439,6 +439,7 @@ impl Inner {
                     let timed=timestamps.map(|pair|policy::stage_timestamps(internal_timestamps,chip,pair));
                     j.append(command,usc,coalesce,timed)?;
                     j.set_user_timestamps(timestamps)?;
+                    j.set_attachments(&p.render_attachments[*next])?;
                     coalesced_stamps+=u64::from(coalesce);
                 }
                 Ok(())
@@ -563,6 +564,7 @@ impl Inner {
                         let timed=timestamps.map(|pair|policy::stage_timestamps(internal_timestamps,self.device.soc().chip_id,pair));
                         j.append_after(command,usc,false,predecessor,timed)?;
                         j.set_user_timestamps(timestamps)?;
+                        j.set_attachments(&p.render_attachments[*i])?;
                         dependencies+=usize::from(predecessor.is_some());
                         previous=Some((true,j.completion_dependency()?));
                     },
diff --git a/drivers/gpu/drm/asahi/m3/m3_scene_layout.rs b/drivers/gpu/drm/asahi/m3/m3_scene_layout.rs
index 880cf4c2b9a75d..ea3c2064ef39e6 100644
--- a/drivers/gpu/drm/asahi/m3/m3_scene_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_scene_layout.rs
@@ -39,3 +39,43 @@ impl Scene {
         Ok(())
     }
 }
+
+pub(crate) const EXTENDED_SIZE: usize = 0x400;
+
+/// Encode a native scene header from its retained aliases. The local
+/// statistics and parameter scratch remain part of this same owned record.
+pub(crate) fn encode_extended(output: &mut [u8], owner: super::m3_init_layout::Region,
+    scratch_gpu: super::m3_pool_layout::GpuRegion, scratch_fw: FirmwareVa,
+    scene_list: super::m3_pool_layout::GpuRegion) -> Result<(), Error> {
+    let statistics = owner.at(0x200, 0x40).map_err(|_| Error::Size)?;
+    owner.at(0, EXTENDED_SIZE).map_err(|_| Error::Size)?;
+    if scratch_gpu.size() < 0x4000 || scene_list.size() < 0x4000 { return Err(Error::Size); }
+    let compact = super::agx_render_state::compact(scene_list.base()).map_err(|_| Error::Address)?;
+    let bytes = output.get_mut(..EXTENDED_SIZE).ok_or(Error::Size)?;
+    bytes.fill(0);
+    bytes[..8].copy_from_slice(&scratch_gpu.base().to_le_bytes());
+    bytes[8..16].copy_from_slice(&scratch_fw.get().to_le_bytes());
+    bytes[0x28..0x30].copy_from_slice(&compact.to_le_bytes());
+    bytes[0x40..0x48].copy_from_slice(&statistics.to_le_bytes());
+    Ok(())
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    use super::super::{m3_init_layout::Region, m3_pool_layout::GpuRegion};
+    #[test] fn native_scene_keeps_scratch_aliases_and_local_statistics_distinct() {
+        let owner = Region::new(0xffff_fc25_0010_0000, EXTENDED_SIZE).unwrap();
+        let scratch = GpuRegion::new(0x10_0200_0000, 0x4000).unwrap();
+        let scratch_fw = FirmwareVa::new(0xffff_fc25_0020_0000).unwrap();
+        let list = GpuRegion::new(0x10_0300_0000, 0x4000).unwrap();
+        let mut bytes = [0xa5; EXTENDED_SIZE + 8];
+        encode_extended(&mut bytes, owner, scratch, scratch_fw, list).unwrap();
+        let read = |at| u64::from_le_bytes(bytes[at..at + 8].try_into().unwrap());
+        assert_eq!(read(0), scratch.base());
+        assert_eq!(read(8), scratch_fw.get());
+        assert_eq!(read(0x28), 0x300_0000);
+        assert_eq!(read(0x40), owner.at(0x200, 0x40).unwrap());
+        assert_eq!(&bytes[EXTENDED_SIZE..], &[0xa5; 8]);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_shared_layout.rs b/drivers/gpu/drm/asahi/m3/m3_shared_layout.rs
index 9b8d503836d0a7..a18197890a1ff1 100644
--- a/drivers/gpu/drm/asahi/m3/m3_shared_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_shared_layout.rs
@@ -100,3 +100,26 @@ pub(crate) fn fault_buffers()->impl Iterator<Item=(usize,usize)> {
         .chain((PB_FIRST..PB_FIRST+PB_GROUPS).map(|i|(i,256)))
         .chain([(TILEMAP_LABEL,1280),(HEAP_METADATA_LABEL,256)])
 }
+
+pub(crate) fn allocation_for(profile: super::m3_profile::Profile, index: usize) -> Result<Allocation,Error> {
+    let mut owner = allocation(index)?;
+    if profile == super::m3_profile::Profile::Legacy { return Ok(owner); }
+    if owner.space == Space::Firmware {
+        owner.address = 0xffff_fc24_0000_0000 + index as u64 * 0x10_0000;
+    }
+    match index {
+        8 | 20 => owner.size = 0x20000,
+        9 | 21 => { owner.address &= !0x3fff; owner.size = 0x4000; }
+        10 | 22 => {
+            owner.size = 0x4000;
+            owner.gpu_alias = Some(0x72_3000_0000 + u64::from(index == 22) * 0x4000);
+        }
+        GPU_CONTEXT => owner.size = 0x38,
+        NOTIFIER => owner.size = 0x400,
+        EVENT_COUNT => owner.size = 16,
+        BUFFER_MANAGER => owner.size = 0xc0,
+        FRAGMENT_QUEUE | TA_QUEUE => owner.size = 0x24c0,
+        _ => {}
+    }
+    Ok(owner)
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_submit.rs b/drivers/gpu/drm/asahi/m3/m3_submit.rs
index c3a25c9a2dc04d..155bda714e9d9f 100644
--- a/drivers/gpu/drm/asahi/m3/m3_submit.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_submit.rs
@@ -42,6 +42,7 @@ pub(crate) struct Packet {
     timestamps:KVec<[Option<Destination>;4]>,
     pub(crate) attachments:KVec<crate::m3::agx_attachments::Attachments>,
     pub(crate) wide_visibility:KVec<bool>,
+    pub(crate) render_attachments:KVec<[crate::m3::agx_attachments::Attachments;2]>,
     completion:UserFence<Completion>,
     finish_claimed: AtomicBool,
     /// Set before a batch with any of this packet's commands can change firmware-visible state,
@@ -197,7 +198,7 @@ impl queue::Queue for Queue {
     fn submit(&mut self,_reg_data:&crate::driver::AsahiRegData<'_>,_id:u64,mut syncs:KVec<file::SyncItem>,in_sync_count:usize,
         raw:&[u8],objects:Pin<&xarray::XArray<KBox<file::Object>>>)->Result {
         let vm_job=self.vm.retain_job()?;
-        let mut parser=agx_uapi::UapiCommandParser::new(raw);let mut commands=KVec::new();let mut timestamps=KVec::new();let mut flushes=KVec::new();let mut visibility=KVec::new();
+        let mut parser=agx_uapi::UapiCommandParser::new(raw);let mut commands=KVec::new();let mut timestamps=KVec::new();let mut flushes=KVec::new();let mut visibility=KVec::new();let mut render_attachments=KVec::new();
         while let Some(command)=parser.next_hardware().map_err(|_|EINVAL)? {
             if let agx_uapi::ParsedHardwareCommand::Render{payload,vertex_attachments,fragment_attachments,..}=command {
                 if let Err(e)=validate_render(payload,self.usc,&AddressSpace(&self.vm),self.early_tiling) {
@@ -212,6 +213,7 @@ impl queue::Queue for Queue {
                     Destination::resolve(objects,payload.fragment_timestamps.start)?,
                     Destination::resolve(objects,payload.fragment_timestamps.end)?],GFP_KERNEL)?;
                 flushes.push(crate::m3::agx_attachments::Attachments::EMPTY,GFP_KERNEL)?;
+                render_attachments.push([encode_attachments(&self.vm,&vertex_attachments)?,encode_attachments(&self.vm,&fragment_attachments)?],GFP_KERNEL)?;
                 visibility.push(false,GFP_KERNEL)?;
                 continue;
             }
@@ -227,6 +229,7 @@ impl queue::Queue for Queue {
             // The common translator validates the original command/attachment
             // addresses; this M3 scheduling hint changes none of them.
             payload.flags &= !wide;
+            render_attachments.push([crate::m3::agx_attachments::Attachments::EMPTY;2],GFP_KERNEL)?;
             flushes.push(encode_attachments(&self.vm,&attachments)?,GFP_KERNEL)?;
             let c=agx_uapi::translate_compute_command(payload,attachments,
                 agx_uapi::QueueUscWindow{base:self.usc,user_start:0x4000,user_end:(1u64<<42)-0x8000},
@@ -240,7 +243,7 @@ impl queue::Queue for Queue {
             commands.push(Command::Compute(crate::m3::agx_compute::Control{base:c.control_stream_base,end:c.control_stream_end,usc_base:self.usc}),GFP_KERNEL)?;
         }
         parser.finish().map_err(|_|EINVAL)?;
-        let packet=Arc::new(Packet{vm:self.vm.clone(),commands,timestamps,attachments:flushes,wide_visibility:visibility,
+        let packet=Arc::new(Packet{vm:self.vm.clone(),commands,timestamps,attachments:flushes,wide_visibility:visibility,render_attachments,
             completion:self.fences.new_fence(0,Completion)?.into(),
             finish_claimed:AtomicBool::new(false),published:AtomicBool::new(false),urgency:self.urgency,owner:Owner::current(),
             vm_job:KBox::pin_init(new_mutex!(Some(vm_job)),GFP_KERNEL)?},GFP_KERNEL)?;
diff --git a/drivers/gpu/drm/asahi/m3/m3_sync_layout.rs b/drivers/gpu/drm/asahi/m3/m3_sync_layout.rs
index 92d533efa82345..2cf5e189140430 100644
--- a/drivers/gpu/drm/asahi/m3/m3_sync_layout.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_sync_layout.rs
@@ -91,3 +91,58 @@ impl Barrier {
         Ok(())
     }
 }
+
+impl InitBufferManager {
+    /// The extended rebuild path requires a zero staged-block count. Appending
+    /// already-staged blocks would leave a previous hardware descriptor live.
+    pub(crate) fn encode_extended(&self, output: &mut [u8]) -> Result<(), Error> {
+        if self.context >= 64 || self.slot >= 32 { return Err(Error::Address); }
+        Self { context: self.context, slot: self.slot, block_count: 0,
+            manager: self.manager, stamp: self.stamp }.encode(output)
+    }
+}
+
+impl Barrier {
+    pub(crate) const EXTENDED_SIZE: usize = 0x40;
+
+    pub(crate) fn encode_extended(&self, output: &mut [u8]) -> Result<(), Error> {
+        if self.event >= 128 || self.wait_value == 0 || self.self_value == 0 {
+            return Err(Error::Address);
+        }
+        let bytes = output.get_mut(..Self::EXTENDED_SIZE).ok_or(Error::Size)?;
+        bytes.fill(0);
+        u32_at(bytes, 0, 4);
+        address_at(bytes, 4, self.stamp);
+        address_at(bytes, 12, self.stamp);
+        u32_at(bytes, 0x14, self.wait_value);
+        u32_at(bytes, 0x20, self.event);
+        u32_at(bytes, 0x24, self.self_value);
+        if matches!(self.dependency, Dependency::PreviousPass) { u32_at(bytes, 0x3c, 1); }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    #[test] fn full_rebuild_never_uses_the_legacy_staged_count() {
+        let mut bytes = [0xa5; INIT_BM_SIZE];
+        InitBufferManager { context: 3, slot: 7, block_count: 2048,
+            manager: FirmwareVa::new(0xffff_fc24_0010_0000).unwrap(), stamp: 0x100 }
+            .encode_extended(&mut bytes).unwrap();
+        assert_eq!(&bytes[12..20], &[0; 8]);
+    }
+    #[test] fn extended_dependencies_use_their_native_tail_and_preserve_trailing_storage() {
+        for previous in [false, true] {
+            let mut bytes = [0xa5; Barrier::EXTENDED_SIZE + 8];
+            Barrier { stamp: FirmwareVa::new(0xffff_fc24_0010_0000).unwrap(), wait_value: 0x100,
+                event: 2, self_value: 0x200, uuid: 9,
+                dependency: if previous { Dependency::PreviousPass } else { Dependency::TilerToFragment } }
+                .encode_extended(&mut bytes).unwrap();
+            assert_eq!(&bytes[0x18..0x20], &[0; 8]);
+            assert_eq!(&bytes[0x20..0x24], &[2, 0, 0, 0]);
+            assert_eq!(u32::from_le_bytes(bytes[0x3c..0x40].try_into().unwrap()), previous.into());
+            assert_eq!(&bytes[Barrier::EXTENDED_SIZE..], &[0xa5; 8]);
+        }
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/m3_tiler_command.rs b/drivers/gpu/drm/asahi/m3/m3_tiler_command.rs
index eeda857a3ed88a..caa61621e0b049 100644
--- a/drivers/gpu/drm/asahi/m3/m3_tiler_command.rs
+++ b/drivers/gpu/drm/asahi/m3/m3_tiler_command.rs
@@ -3,6 +3,17 @@ use super::{agx_render::Geometry, m3_compute_layout::{GpuVa,RegisterSet},
     m3_init_layout::{Error,Region}, m3_queue_layout::FirmwareVa,
     m3_render_sequence::ta};
 pub(crate) const SIZE:usize=0x92b;
+pub(crate) const EXTENDED_SIZE:usize=0x940;
+pub(crate) const EXTENDED_FLUSH:usize=0x894;
+pub(crate) struct Dispatch26 {
+    pub(crate) incarnation:u8,
+    pub(crate) serial:u64,
+    pub(crate) peer_stamp:u32,
+    pub(crate) usc_window:u64,
+    pub(crate) firmware_aux:FirmwareVa,
+    pub(crate) scene_scratch:GpuVa,
+}
+
 pub(crate) const REGISTERS:usize=ta::REGISTERS;
 /// The registers G15G does not take; the others keep the G15S order.
 pub(crate) const G15G_OMIT:[u32;14]=[0x1c041,0x1c9d0,0x1c948,0x1c888,0x1c890,0x1c918,0x1c089,0x1c9e0,0x16c41,0x1ca40,0x1c9a8,0x1c920,0xa5a1,0xd419];
@@ -57,17 +68,32 @@ impl Command {
     /// All address checks precede mutation. Zero all reserved fields, then
     /// emit semantic registers and explicit packed command/tail fields.
     pub(crate) fn encode(&self,out:&mut[u8])->Result<(),Error> {
-        if out.len()<SIZE {return Err(Error::Size);}
+        self.encode_format(out, None)
+    }
+    pub(crate) fn encode_extended(&self, dispatch: Dispatch26, out: &mut [u8]) -> Result<(),Error> {
+        self.encode_format(out, Some(dispatch))
+    }
+    fn encode_format(&self, out: &mut [u8], dispatch: Option<Dispatch26>) -> Result<(),Error> {
+        let extended = dispatch.is_some();
+        let size = if extended { EXTENDED_SIZE } else { SIZE };
+        if out.len()<size {return Err(Error::Size);}
+        if let Some(native) = &dispatch {
+            if native.incarnation == 0 || native.serial == 0 || native.peer_stamp == 0 || native.usc_window & 0xffff_ffff != 0
+                || native.usc_window >= 1 << 42 || self.register_set != RegisterSet::G15G {
+                return Err(Error::Address);
+            }
+        }
         if self.context>=64 || self.page_count==0 || self.tpc_bytes==0 {return Err(Error::Address);}
         let registers=self.gpu_alias.get().checked_add(REGISTERS as u64).ok_or(Error::Address)?;
-        GpuVa::new(self.gpu_alias.get().checked_add((SIZE-3) as u64).ok_or(Error::Address)?)
+        GpuVa::new(self.gpu_alias.get().checked_add(((size-1)&!3) as u64).ok_or(Error::Address)?)
             .map_err(|_|Error::Address)?;
-        let seq=self.sequence.at(0,ta::LENGTH)?;
+        let sequence_size = if extended { 0x300 } else { ta::LENGTH };
+        let seq=self.sequence.at(0,sequence_size)?;
         let tilemap=compact(self.tilemap.get())?;
         let tpc=compact(self.tpc.get())?;
         let heap=compact(self.heap.get())?;
         let preemption=[compact(self.preemption[0].get())?,compact(self.preemption[1].get())?,compact(self.preemption[2].get())?];
-        let user=compact(self.scene_user.get().checked_add(0x40).ok_or(Error::Address)?)?;
+        let user=compact(self.scene_user.get().checked_add(if extended {0} else {0x40}).ok_or(Error::Address)?)?;
         let g=&self.geometry;
         let layers=g.layers;
         let layer_metadata=compact(self.heap.get().checked_add(if layers>1 {0x200}else{0}).ok_or(Error::Address)?)?;
@@ -99,23 +125,67 @@ impl Command {
             (0x1c830,0),(0x1ca30,user),(0x16c39,user),
             (0x1c910,0xa0_00000000|(self.initial_scene_entry.get()&0xf_ffffffff)|1),
         ];
-        let bytes=&mut out[..SIZE];bytes.fill(0); // TA opcode is zero
-        pointer(bytes,4,1); // qualified work-command counter remains one
+        let bytes=&mut out[..size];bytes.fill(0); // TA opcode is zero
+        pointer(bytes,4,dispatch.as_ref().map_or(1, |native| native.serial));
         word(bytes,CONTEXT,self.context);
-        for (offset,value) in [(0x14,self.notifier.get()),(0x24,self.manager.get()),
-            (0x2c,self.scene.get()),(0x34,self.empty.get()),(0x740,registers),
+        for (offset,value) in [(if extended {0x10} else {0x14},self.notifier.get()),
+            (if extended {0x20} else {0x24},self.manager.get()),
+            (if extended {0x28} else {0x2c},self.scene.get()),
+            (if extended {0x30} else {0x34},self.empty.get()),(0x740,registers),
             (0x760,self.tpc.get()),(0x768,self.tpc_bytes),(0x770,seq)] {pointer(bytes,offset,value);}
         let g15g=self.register_set==RegisterSet::G15G;
         let mut count=0;
-        for (register,value) in values.into_iter().filter(|(r,_)| !g15g || !G15G_OMIT.contains(r)) {
-            let n=count;count+=1;
-            word(bytes,REGISTERS+n*REGISTER_STRIDE,register);
-            pointer(bytes,REGISTERS+n*REGISTER_STRIDE+4,value);
+        let mut emit = |register, value| {
+            word(bytes, REGISTERS + count * REGISTER_STRIDE, register);
+            pointer(bytes, REGISTERS + count * REGISTER_STRIDE + 4, value);
+            count += 1;
+        };
+        for (register, mut value) in values {
+            if g15g && G15G_OMIT.contains(&register) { continue; }
+            if extended && matches!(register, 0x12099 | 0x1c898) { continue; }
+            if let Some(native) = &dispatch {
+                if register == 0x101e1 {
+                    emit(0xa309, 0);
+                    emit(0x1c8e0, u64::MAX);
+                    emit(0x1c8e8, u64::MAX);
+                    emit(0x1c898, 0);
+                }
+                if register == 0x1c910 {
+                    let address = native.scene_scratch.get();
+                    let escaped = (address & (1 << 42)) >> 3;
+                    let bias = if escaped == 0 { 0x70_0000_0000 } else { 0 };
+                    value = ((address + bias) & 0x7f_ffff_fffe) | escaped | 1;
+                }
+            }
+            emit(register, value);
+        }
+        if let Some(native) = &dispatch {
+            emit(0xa5a1, 0x60_0040_0020);
+            emit(0xd419, 0x2_0000_0001);
+            for register in [0x1ca10, 0x14a1, 0xa349] { emit(register, ta::UUID.into()); }
+            emit(0x10061, native.usc_window);
         }
         bytes[0x748..0x74a].copy_from_slice(&(count as u16).to_le_bytes());
         bytes[0x74a..0x74c].copy_from_slice(&((count*REGISTER_STRIDE) as u16).to_le_bytes());
-        word(bytes,SEQUENCE_LENGTH,ta::LENGTH as u32);
+        word(bytes,SEQUENCE_LENGTH,sequence_size as u32);
         word(bytes,0x77c,1); // fragment event slot
+        if let Some(native) = dispatch {
+            word(bytes, STAMP_VALUE, native.peer_stamp);
+            pointer(bytes, 0x7a8, preemption[0]);
+            pointer(bytes, 0x878, self.stamp.get());
+            pointer(bytes, 0x880, self.fw_stamp.get());
+            word(bytes, 0x888, self.stamp_value);
+            word(bytes, EXTENDED_FLUSH, 1);
+            word(bytes, 0x898, ta::UUID);
+            pointer(bytes, 0x8c8, self.timestamps[0].get());
+            pointer(bytes, 0x8d0, self.timestamps[1].get());
+            pointer(bytes, 0x8d8, self.user_timestamps[0].get());
+            pointer(bytes, 0x8e0, self.user_timestamps[1].get());
+            pointer(bytes, 0x8fe, self.pool.get());
+            bytes[0x906] = 1;
+            pointer(bytes, 0x90f, native.firmware_aux.get());
+            bytes[0x917] = native.incarnation;
+        } else {
         word(bytes,STAMP_VALUE,self.stamp_value);
         pointer(bytes,ta::STRUCT3+0x24,preemption[0]);
         word(bytes,ta::STRUCT3+0xbc,0x67); // retained producer encoder_id
@@ -132,6 +202,41 @@ impl Command {
             (0x47,self.scratch.get())] {pointer(bytes,ta::COMMAND_TAIL+offset,value);}
         bytes[ta::COMMAND_TAIL+0x36]=1; // unk_846
         bytes[ta::COMMAND_TAIL+0x4f]=1; // unk_85f
+        }
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod extended_tests {
+    use super::*;
+    fn command() -> Command {
+        let fw=|index:u64|FirmwareVa::new(0xffff_fc25_1000_0000+index*0x4000).unwrap();
+        let gpu=|index:u64|GpuVa::new(0x10_0100_0000+index*0x4000).unwrap();
+        Command {context:3,register_set:RegisterSet::G15G,notifier:fw(0),manager:fw(1),scene:fw(2),empty:fw(3),
+            gpu_alias:GpuVa::new(0x72_1000_0000).unwrap(),sequence:Region::new(fw(4).get(),0x1000).unwrap(),
+            pool:fw(5),scratch:fw(6),stamp:fw(7),fw_stamp:fw(8),stamp_value:0x7a000100,
+            timestamps:[fw(9),fw(10)],user_timestamps:[fw(11),fw(12)],preemption:[gpu(0),gpu(1),gpu(2)],
+            tilemap:gpu(3),tpc:gpu(4),tpc_bytes:0x4000,heap:gpu(5),scene_user:gpu(6),
+            initial_scene_entry:fw(13),geometry:Geometry::new(64,64,super::super::agx_render::Utile::Pixels32,
+                super::super::agx_render::Utile::Pixels32,1).unwrap(),page_count:128,
+            vdm:0x100000,multisample:0,ppp:0,process_empty_tiles:false}
+    }
+    #[test] fn native_tiler_keeps_peer_completion_and_usc_window_explicit() {
+        let value=command();let mut bytes=[0xa5;EXTENDED_SIZE+8];
+        value.encode_extended(Dispatch26 {incarnation:9,serial:2,peer_stamp:0x3d000100,
+            usc_window:1<<32,firmware_aux:value.scratch,
+            scene_scratch:GpuVa::new(0x10_0200_0000).unwrap()},&mut bytes).unwrap();
+        let word=|at|u32::from_le_bytes(bytes[at..at+4].try_into().unwrap());
+        assert_eq!(word(0x780),0x3d000100);
+        assert_eq!(word(0x888),value.stamp_value);
+        assert_eq!(word(0x894),1);
+        assert_eq!(word(0x748)&0xffff,66);
+        assert_eq!(bytes[0x917],9);
+        assert_eq!(&bytes[EXTENDED_SIZE..],&[0xa5;8]);
+        let registers=&bytes[REGISTERS..REGISTERS+66*REGISTER_STRIDE];
+        assert!(!registers.chunks_exact(12).any(|r|u32::from_le_bytes(r[..4].try_into().unwrap())==0x12099));
+        let usc=registers.chunks_exact(12).find(|r|u32::from_le_bytes(r[..4].try_into().unwrap())==0x10061).unwrap();
+        assert_eq!(u64::from_le_bytes(usc[4..].try_into().unwrap()),1<<32);
+    }
+}
diff --git a/drivers/gpu/drm/asahi/m3/t8122_admission.rs b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
index c66ccb72cd18d7..65a1df4bc0a6b6 100644
--- a/drivers/gpu/drm/asahi/m3/t8122_admission.rs
+++ b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only OR MIT
 
-//! Read-only T8122 identity admission. Firmware startup remains disabled.
+//! Read-only T8122 identity and firmware-interface admission.
 
 use super::m3_profile::Profile;
 
@@ -53,6 +53,28 @@ pub(crate) fn validate_identity_for(
     })
 }
 
+/// Firmware-interface selection is exact and does not change physical GPU encodings.
+pub(crate) fn profile_for(compat:&[u32],j613:bool)->Option<Profile> {
+    match compat {
+        [14,8,3]=>Some(Profile::Legacy),
+        [26,6,2] if j613=>Some(Profile::Extended),
+        _=>None,
+    }
+}
+
+#[cfg(not(test))]
+pub(crate) fn loaded_profile(pdev:&kernel::platform::Device<kernel::device::Core<'_>>)
+    ->kernel::error::Result<Profile> {
+    use kernel::{c_str,prelude::*};
+    let node=pdev.as_ref().of_node().ok_or(ENODEV)?;
+    let compat:KVec<u32>=node.get_property(c_str!("apple,firmware-compat"))?;
+    #[cfg(CONFIG_DRM_ASAHI_M3_T8122)]
+    let j613 = super::m3_board::board_is(b"apple,j613");
+    #[cfg(not(CONFIG_DRM_ASAHI_M3_T8122))]
+    let j613 = false;
+    profile_for(&compat, j613).ok_or(ENODEV)
+}
+
 /// Shape of the voltage-sorted running-state tables: one entry per distinct millivolt,
 /// and the highest primary frequency in MHz. Voltages round up, matching `PwrConfig`.
 /// The first point is the off state. Both primary and secondary frequencies must increase
@@ -108,7 +130,7 @@ pub(crate) fn opp_table_shape(opps: impl IntoIterator<Item = (u64, u32)>) -> Opt
 pub(crate) fn read_identity(
     pdev: &kernel::platform::Device<kernel::device::Core<'_>>,
 ) -> kernel::error::Result<Identity> {
-    read_identity_for(pdev, Profile::Legacy)
+    read_identity_for(pdev, loaded_profile(pdev)?)
 }
 
 #[cfg(not(test))]
@@ -300,3 +322,17 @@ mod tests {
         assert!(validate_identity(&[14, 8, 3], 1, 1, G15G_C0, [0x7f, 0, 0]).is_none());
     }
 }
+
+#[cfg(test)]
+mod selection_tests {
+    use super::*;
+    #[test] fn extended_admission_requires_exact_firmware_and_j613() {
+        for board in [false,true] {
+            assert_eq!(profile_for(&[14,8,3],board),Some(Profile::Legacy));
+            assert_eq!(profile_for(&[26,6,2],board),if board{Some(Profile::Extended)}else{None});
+            for wrong in [&[][..],&[26,6][..],&[26,6,1][..],&[26,6,2,0][..],&[14,8,4][..]] {
+                assert_eq!(profile_for(wrong,board),None);
+            }
+        }
+    }
+}
diff --git a/tools/asahi/m3-runtime-tests.rs b/tools/asahi/m3-runtime-tests.rs
index 458603366c954b..713c82f42250fa 100644
--- a/tools/asahi/m3-runtime-tests.rs
+++ b/tools/asahi/m3-runtime-tests.rs
@@ -46,3 +46,39 @@ mod m3_state_layout;
 
 #[path = "../../drivers/gpu/drm/asahi/m3/m3_compute_storage.rs"]
 mod m3_compute_storage;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_parameter_layout.rs"]
+mod m3_parameter_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_sync_layout.rs"]
+mod m3_sync_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_render.rs"]
+mod agx_render;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_render_state.rs"]
+mod agx_render_state;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_scene_layout.rs"]
+mod m3_scene_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_command_layout.rs"]
+mod m3_command_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_render_sequence.rs"]
+mod m3_render_sequence;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_tiler_command.rs"]
+mod m3_tiler_command;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_pass_layout.rs"]
+mod m3_pass_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_shared_layout.rs"]
+mod m3_shared_layout;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/m3_fragment_command.rs"]
+mod m3_fragment_command;
+
+#[path = "../../drivers/gpu/drm/asahi/m3/agx_attachments.rs"]
+mod agx_attachments;

From 47a34336f4bd1e1e53a6858950cbcbd7bec4713c Mon Sep 17 00:00:00 2001
From: Satya Benson <satya@benson.earth>
Date: Sat, 31 Oct 2026 02:29:47 -0400
Subject: [PATCH 9/9] drm/asahi: admit opted-in J615 on the shared 26.6.2
 profile

The 26.6.2 (25G83) IPSW ships the same GPU, DCP and PMP firmware for
the 13-inch (J613) and 15-inch (J615) M3 Air, and the J615 ADT matches
J613's in every node this path uses. Allow J615 onto the extended
profile, but only with the same exact opt-in m1n1 and the DCP code
already require (chosen asahi,j615-25g83-experimental = "1"), and only
when the board identity is unambiguous. J613 behaviour is unchanged.

This has not been qualified on J615 hardware.

Signed-off-by: Satya Benson <satya@benson.earth>
---
 drivers/gpu/drm/asahi/m3/t8122_admission.rs | 35 +++++++++++++++++----
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/asahi/m3/t8122_admission.rs b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
index 65a1df4bc0a6b6..ffa04859c6b936 100644
--- a/drivers/gpu/drm/asahi/m3/t8122_admission.rs
+++ b/drivers/gpu/drm/asahi/m3/t8122_admission.rs
@@ -53,11 +53,17 @@ pub(crate) fn validate_identity_for(
     })
 }
 
+/// Same mutually exclusive board identities and exact string opt-in as m1n1/DCP.
+/// J615 shares the 25G83 GPU/ADT profile, but has no hardware qualification here.
+pub(crate) fn extended_board(j613: bool, j615: bool, optin: Option<&[u8]>) -> bool {
+    (j613 && !j615) || (!j613 && j615 && optin == Some(b"1\0"))
+}
+
 /// Firmware-interface selection is exact and does not change physical GPU encodings.
-pub(crate) fn profile_for(compat:&[u32],j613:bool)->Option<Profile> {
+pub(crate) fn profile_for(compat:&[u32],air:bool)->Option<Profile> {
     match compat {
         [14,8,3]=>Some(Profile::Legacy),
-        [26,6,2] if j613=>Some(Profile::Extended),
+        [26,6,2] if air=>Some(Profile::Extended),
         _=>None,
     }
 }
@@ -69,10 +75,17 @@ pub(crate) fn loaded_profile(pdev:&kernel::platform::Device<kernel::device::Core
     let node=pdev.as_ref().of_node().ok_or(ENODEV)?;
     let compat:KVec<u32>=node.get_property(c_str!("apple,firmware-compat"))?;
     #[cfg(CONFIG_DRM_ASAHI_M3_T8122)]
-    let j613 = super::m3_board::board_is(b"apple,j613");
+    let air = {
+        let j613 = super::m3_board::board_is(b"apple,j613");
+        let j615 = super::m3_board::board_is(b"apple,j615");
+        let optin = kernel::of::chosen().and_then(|chosen| {
+            chosen.get_property::<KVec<u8>>(c_str!("asahi,j615-25g83-experimental")).ok()
+        });
+        extended_board(j613, j615, optin.as_deref())
+    };
     #[cfg(not(CONFIG_DRM_ASAHI_M3_T8122))]
-    let j613 = false;
-    profile_for(&compat, j613).ok_or(ENODEV)
+    let air = false;
+    profile_for(&compat, air).ok_or(ENODEV)
 }
 
 /// Shape of the voltage-sorted running-state tables: one entry per distinct millivolt,
@@ -326,7 +339,17 @@ mod tests {
 #[cfg(test)]
 mod selection_tests {
     use super::*;
-    #[test] fn extended_admission_requires_exact_firmware_and_j613() {
+    #[test]
+    fn j615_requires_exact_optin_and_unambiguous_board() {
+        for optin in [None, Some(&b""[..]), Some(&b"1"[..]), Some(&b"0\0"[..]),
+                      Some(&b"1\0extra"[..]), Some(&[0, 0, 0, 1][..]), Some(&b"1\0"[..])] {
+            assert!(extended_board(true, false, optin));
+            assert!(!extended_board(false, false, optin));
+            assert!(!extended_board(true, true, optin));
+            assert_eq!(extended_board(false, true, optin), optin == Some(&b"1\0"[..]));
+        }
+    }
+    #[test] fn extended_admission_requires_exact_firmware_and_air() {
         for board in [false,true] {
             assert_eq!(profile_for(&[14,8,3],board),Some(Profile::Legacy));
             assert_eq!(profile_for(&[26,6,2],board),if board{Some(Profile::Extended)}else{None});