diff --git a/arch/arm64/boot/dts/apple/t6040-j616s-extdisp-hdmi.dtsi b/arch/arm64/boot/dts/apple/t6040-j616s-extdisp-hdmi.dtsi
index b414a0bddee7d..f471f9332e939 100644
--- a/arch/arm64/boot/dts/apple/t6040-j616s-extdisp-hdmi.dtsi
+++ b/arch/arm64/boot/dts/apple/t6040-j616s-extdisp-hdmi.dtsi
@@ -4,7 +4,7 @@
  * -> atcphy3 -> DP-to-HDMI converter) with every node left DISABLED. The
  * nodes must not be enabled at boot in the device tree: powering the DISPEXT
  * chain without the PMP acknowledgement hangs the machine before root. The
- * enable gate (drivers/soc/apple/t6041-display-gate.c) switches them on in
+ * enable gate (drivers/soc/apple/display-gate.c) switches them on in
  * order once the PMP is bound.
  *
  * dispext0's DART is not in the display node's iommus: the gate appends it
diff --git a/arch/arm64/boot/dts/apple/t6040-j616s-extdisp-usbc.dtsi b/arch/arm64/boot/dts/apple/t6040-j616s-extdisp-usbc.dtsi
index 3d375fd93a98e..6fbf8d6a27f89 100644
--- a/arch/arm64/boot/dts/apple/t6040-j616s-extdisp-usbc.dtsi
+++ b/arch/arm64/boot/dts/apple/t6040-j616s-extdisp-usbc.dtsi
@@ -2,7 +2,7 @@
 /*
  * USB-C DisplayPort: dcpext1 over any of the three Type-C ports. As for
  * HDMI, the DISPEXT1 chain and dcpext1 stay DISABLED in the DTB and are
- * enabled by the enable gate (drivers/soc/apple/t6041-display-gate.c). The
+ * enabled by the enable gate (drivers/soc/apple/display-gate.c). The
  * routes go through the display fabric (typec-routes, end of this file):
  * tipd's mode switch reaches dcpext1, which claims the port. Boot-time
  * changes: mode-switch on atcphy0..2 (the PHY registers a Type-C mode
diff --git a/arch/arm64/boot/dts/apple/t6040-j616s-extdisp.dtsi b/arch/arm64/boot/dts/apple/t6040-j616s-extdisp.dtsi
index b6486f293da9d..ef7f9afb47028 100644
--- a/arch/arm64/boot/dts/apple/t6040-j616s-extdisp.dtsi
+++ b/arch/arm64/boot/dts/apple/t6040-j616s-extdisp.dtsi
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0+ OR MIT
 /*
  * External display resources of the J616s. Everything here is disabled in
- * the device tree: the enable gate (drivers/soc/apple/t6041-display-gate.c)
+ * the device tree: the enable gate (drivers/soc/apple/display-gate.c)
  * switches the chain on once the boot loader has provided the firmware
  * memory of the external display processors, so without that the booted
  * hardware state is the same as without this file.
diff --git a/arch/arm64/boot/dts/apple/t6040-j616s.dts b/arch/arm64/boot/dts/apple/t6040-j616s.dts
index 3995f5d4db16a..6c28c95f8155d 100644
--- a/arch/arm64/boot/dts/apple/t6040-j616s.dts
+++ b/arch/arm64/boot/dts/apple/t6040-j616s.dts
@@ -4368,7 +4368,7 @@
 
 #include "t6040-j616s-usb3.dtsi"
 
-/* External display chain, all disabled: the gate in drivers/soc/apple/t6041-display-gate.c enables it. */
+/* External display chain, all disabled: the gate in drivers/soc/apple/display-gate.c enables it. */
 #include "t6040-j616s-extdisp.dtsi"
 #include "t6040-j616s-extdisp-mem-loader.dtsi"
 #include "t6040-j616s-extdisp-hdmi.dtsi"
diff --git a/drivers/gpu/drm/asahi/m3/t8122_hwdata.rs b/drivers/gpu/drm/asahi/m3/t8122_hwdata.rs
index a86ec5e646037..841063767da9c 100644
--- a/drivers/gpu/drm/asahi/m3/t8122_hwdata.rs
+++ b/drivers/gpu/drm/asahi/m3/t8122_hwdata.rs
@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0-only OR MIT
 
 //! The 20-word block at HwDataA +0x418c..+0x41db that the runtime backend writes on a T8122
-//! with the G15 14.8.3 firmware, unless `asahi.t8122_hwdata_418c=0`. Plain data only, so that
-//! the host tests run it (tools/asahi).
+//! with the G15 14.8.3 firmware. The chip and firmware identity select it, as they select the
+//! rest of HwDataA; there is no switch to leave it out. Plain data only, so that the host tests
+//! run it (tools/asahi).
 //!
 //! The words are not in the device tree, and what they mean is not known. They have been
 //! tested on 10-core and 8-core J613s only; J615 on this firmware is untested.
@@ -31,28 +32,8 @@ pub(crate) const WORDS: [u32; 20] = [
 /// Size of the block in bytes.
 pub(crate) const SIZE: usize = WORDS.len() * 4;
 
-/// `asahi.t8122_hwdata_418c` values: 0 leaves the range as the builder made it (zero), 1 writes
-/// the block. The default is 1.
-pub(crate) const OFF: u64 = 0;
-pub(crate) const ON: u64 = 1;
-pub(crate) const DEFAULT: u64 = ON;
-
 const _: () = assert!(SIZE == 0x50 && OFFSET % 4 == 0);
 
-/// Parse `asahi.t8122_hwdata_418c`: `0` or `1`. Anything else is refused.
-pub(crate) fn parse(text: &str) -> Option<u64> {
-    match text.trim() {
-        "0" => Some(OFF),
-        "1" => Some(ON),
-        _ => None,
-    }
-}
-
-/// Whether a parameter value asks for the block.
-pub(crate) fn enabled(value: u64) -> bool {
-    value == ON
-}
-
 /// Write the block into `hwdata_a`, the bytes of HwDataA. Nothing outside
 /// `OFFSET..OFFSET + SIZE` changes. Err, with nothing written, when `hwdata_a` is too short.
 pub(crate) fn write(hwdata_a: &mut [u8]) -> Result<(), ()> {
@@ -112,16 +93,4 @@ mod tests {
         let mut exact = vec![0u8; OFFSET + SIZE];
         assert_eq!(write(&mut exact), Ok(()));
     }
-
-    #[test]
-    fn the_parameter_accepts_0_and_1_only_and_defaults_to_1() {
-        assert_eq!(parse("0"), Some(OFF));
-        assert_eq!(parse("1"), Some(ON));
-        assert_eq!(parse(" 1\n"), Some(ON));
-        for text in ["", "2", "-1", "+1", "0x1", "on", "yes", "01"] {
-            assert_eq!(parse(text), None, "{text:?}");
-        }
-        assert!(enabled(DEFAULT));
-        assert!(!enabled(OFF));
-    }
 }
diff --git a/drivers/pmdomain/apple/Kconfig b/drivers/pmdomain/apple/Kconfig
index 5f0a9d95c196c..e25dd30281fc4 100644
--- a/drivers/pmdomain/apple/Kconfig
+++ b/drivers/pmdomain/apple/Kconfig
@@ -39,7 +39,7 @@ config APPLE_PMP_REPORT
 
 	  On T8122 (M3), T6031 (M3 Max), and opted-in T6030 (M3 Pro) Macs
 	  whose boot loader hands the
-	  internal display over (see APPLE_T6030_DISPLAY_GATE), iBoot leaves
+	  internal display over (see APPLE_DISPLAY_GATE), iBoot leaves
 	  the PMP halted, and this driver starts it when the display driver
 	  first asks for it. Once its nodes are enabled the PMP may run until
 	  the next reboot. That holds when the start then fails, too (the PMP
diff --git a/drivers/soc/apple/Kconfig b/drivers/soc/apple/Kconfig
index cbd8a0f0d430a..4da82f85b2465 100644
--- a/drivers/soc/apple/Kconfig
+++ b/drivers/soc/apple/Kconfig
@@ -229,8 +229,8 @@ config APPLE_CLPC
 
 	  Say 'y' or 'm' here if you have an Apple SoC with a PMC.
 
-config APPLE_T6030_DISPLAY_GATE
-	bool "Apple T6030 internal display enable gate"
+config APPLE_DISPLAY_GATE
+	bool "Apple internal display enable gate"
 	depends on ARCH_APPLE && OF_DYNAMIC && OF_OVERLAY
 	default ARCH_APPLE
 	help
@@ -257,28 +257,19 @@ config APPLE_T6030_DISPLAY_GATE
 	  apple_t6031_display.enable=1 on the kernel command line, and only
 	  with the PMP values the boot loader passes.
 
-	  Say 'y' if you want the native display on M3 Pro MacBook Pros.
+	  On T6041 (M4 Pro) device trees it enables the internal display nodes
+	  only when the boot loader has handed the running display coprocessor
+	  over (apple,t6041-handoff, 26.6.2 display firmware), and powers up
+	  the J616s external display chain (HDMI, Type-C DisplayPort) once the
+	  boot loader has given the external display processors their
+	  firmware memory. Without these, or with nomodeset, it does nothing.
 
-config APPLE_T6041_DISPLAY_GATE
-	bool "Apple T6041 internal display enable gate"
-	depends on ARCH_APPLE && OF_DYNAMIC
-	default ARCH_APPLE
-	help
-	  The J616s (M4 Pro) device tree keeps the internal display nodes
-	  disabled, so the display stays on the boot framebuffer until the
-	  boot loader has handed the running display coprocessor over. This
-	  option enables those nodes before devices are created, only when
-	  the boot loader has published a complete T6041 handoff for the
-	  26.6.2 display firmware. It also powers up the J616s external
-	  display chain (HDMI, Type-C DisplayPort) once the boot loader has
-	  given the external display processors their firmware memory.
-	  Without these, or with nomodeset, it does nothing.
-
-	  Say 'y' if you want the native display on M4 Pro MacBook Pros.
+	  Say 'y' if you want the native display on M3 Pro, M3 Max, M3 and
+	  M4 Pro Macs.
 
 config APPLE_T6030_GPU_PMP_LINK
 	bool
-	depends on APPLE_T6030_DISPLAY_GATE
+	depends on APPLE_DISPLAY_GATE
 	default n
 	help
 	  Link an opted-in T6030 GPU to the PMP admitted by the display gate.
@@ -287,7 +278,7 @@ config APPLE_T6030_GPU_PMP_LINK
 
 config APPLE_DISPLAY_GATE_KUNIT_TEST
 	bool "KUnit tests for the Apple display gate" if !KUNIT_ALL_TESTS
-	depends on KUNIT=y && APPLE_T6030_DISPLAY_GATE
+	depends on KUNIT=y && APPLE_DISPLAY_GATE
 	default KUNIT_ALL_TESTS
 	help
 	  Runs the display gate on test device trees with the T6030, T6031
diff --git a/drivers/soc/apple/Makefile b/drivers/soc/apple/Makefile
index 65d7c9d27c9c3..56d7c1e7b8abf 100644
--- a/drivers/soc/apple/Makefile
+++ b/drivers/soc/apple/Makefile
@@ -17,11 +17,11 @@ apple-rtkit-helper-y = rtkit-helper.o
 obj-$(CONFIG_APPLE_SART) += apple-sart.o
 apple-sart-y = sart.o
 
-obj-$(CONFIG_APPLE_T6030_DISPLAY_GATE) += apple-t6030-display.o
-apple-t6030-display-y := t6030-display-gate.o t6030-pmp.dtbo.o t6030-j516s-pmp.dtbo.o
-apple-t6030-display-$(CONFIG_APPLE_DISPLAY_GATE_KUNIT_TEST) += t6031-gate-test.dtbo.o \
-							 t6030-gate-test.dtbo.o \
-							 t8122-gate-test.dtbo.o
+obj-$(CONFIG_APPLE_DISPLAY_GATE) += apple-display-gate.o
+apple-display-gate-y := display-gate.o t6030-pmp.dtbo.o t6030-j516s-pmp.dtbo.o
+apple-display-gate-$(CONFIG_APPLE_DISPLAY_GATE_KUNIT_TEST) += t6031-gate-test.dtbo.o \
+							t6030-gate-test.dtbo.o \
+							t8122-gate-test.dtbo.o
 # The gate adds the interrupt parent from the base tree at boot.
 DTC_FLAGS_t6030-pmp := -Wno-interrupts_property
 DTC_FLAGS_t6030-j516s-pmp := -Wno-interrupts_property
@@ -32,8 +32,6 @@ DTC_FLAGS_t6030-gate-test := -Wno-interrupts_property -Wno-chosen_node_is_root \
 			     -Wno-avoid_unnecessary_addr_size
 DTC_FLAGS_t8122-gate-test := -Wno-interrupts_property -Wno-chosen_node_is_root
 
-obj-$(CONFIG_APPLE_T6041_DISPLAY_GATE) += t6041-display-gate.o
-
 obj-$(CONFIG_APPLE_TUNABLE) += apple-tunable.o
 apple-tunable-y = tunable.o
 
diff --git a/drivers/soc/apple/t6030-display-gate-test.c b/drivers/soc/apple/display-gate-test.c
similarity index 99%
rename from drivers/soc/apple/t6030-display-gate-test.c
rename to drivers/soc/apple/display-gate-test.c
index a970405c6205e..73b36e5a722b6 100644
--- a/drivers/soc/apple/t6030-display-gate-test.c
+++ b/drivers/soc/apple/display-gate-test.c
@@ -13,7 +13,7 @@
  *  - T8122 (t8122-gate-test.dtso): on by default, with the full handoff,
  *    and nothing changed when a check of the handoff or of the reused PMP
  *    topology fails.
- * Included at the end of t6030-display-gate.c.
+ * Included at the end of display-gate.c.
  *
  * The test trees are applied once and stay: the gate gives some properties
  * names it does not allocate, which the tree must never free. Each case
diff --git a/drivers/soc/apple/t6030-display-gate.c b/drivers/soc/apple/display-gate.c
similarity index 76%
rename from drivers/soc/apple/t6030-display-gate.c
rename to drivers/soc/apple/display-gate.c
index 2f73104b05c8c..b178583d09901 100644
--- a/drivers/soc/apple/t6030-display-gate.c
+++ b/drivers/soc/apple/display-gate.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only OR MIT
 /*
- * Apple T6030 internal display enable gate, and its T8122 counterpart
+ * Apple internal display enable gate (T6030, T6031, T8122 and T6041)
  *
  * The T6030 device tree describes the internal display (the DCP, its
  * mailbox, the two display DARTs and the display subsystem) with every node
@@ -62,10 +62,24 @@
  * DISP_SYS), and its PMP power states are in another PMGR block. On every
  * T6031 boot the gate also logs what the boot loader handed over, so that
  * a boot without the option already records what the next one needs.
+ *
+ * On T6041 (the display coprocessor of the M4 Pro, apple,t6040) m1n1 hands
+ * over the DCP that iBoot leaves running. It marks the DCP, the display
+ * subsystem and the DCP's piodma child with apple,t6041-handoff and names
+ * the display firmware in apple,firmware-compat. There is no PMP to add or
+ * complete: the device tree describes it and its own driver starts it. The
+ * gate checks the handoff and the running DCP, enables the internal display
+ * nodes, and powers up the external display chain in stages once the PMP is
+ * bound (see gate_t6041_run()). This part was a driver of its own,
+ * t6041-display-gate.c, by Ryan Murray and František Balázsy.
  */
 
 #define pr_fmt(fmt) fmt
 
+#include <linux/atomic.h>
+#include <linux/bits.h>
+#include <linux/delay.h>
+#include <linux/device.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/io.h>
@@ -73,12 +87,16 @@
 #include <linux/memblock.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/of_graph.h>
+#include <linux/platform_device.h>
 #include <linux/of_reserved_mem.h>
 #include <linux/printk.h>
 #include <linux/slab.h>
 #include <linux/sizes.h>
 #include <linux/string.h>
+#include <linux/stringify.h>
 #include <linux/types.h>
+#include <linux/workqueue.h>
 #include <video/nomodeset.h>
 
 enum {
@@ -181,6 +199,11 @@ struct gate_soc {
 	const char *fw_uuids;		/* /chosen strings naming each firmware image */
 	bool quiet_without_nodes;	/* no display nodes in the device tree is normal */
 	bool dcpext;			/* the external display processors and their DARTs */
+	/*
+	 * Set: this handoff has its own sequence instead of gate_run() (T6041:
+	 * the DCP is adopted running, and the PMP is the device tree's own).
+	 */
+	void (*run)(void);
 };
 
 static const struct gate_soc gate_t6030 __initconst = {
@@ -266,10 +289,27 @@ static const struct gate_soc gate_t6031 __initconst = {
 	.fw_uuids = "asahi,t6031-fw-uuids",
 };
 
+static void __init gate_t6041_run(void);
+
+/*
+ * T6041 (M4 Pro): the DCP is adopted running; no PMP is added or completed,
+ * and the command line options of the other SoCs do not apply.
+ */
+static const struct gate_soc gate_t6041 __initconst = {
+	.machine = "apple,t6040",
+	.prefix = "apple-t6041-display: ",
+	.name = "T6041",
+	.dcp_compat = "apple,t6041-dcp",
+	.display_compat = "apple,display-subsystem",
+	.marker = "apple,t6041-handoff",
+	.run = gate_t6041_run,
+};
+
 static const struct gate_soc *const gate_socs[] __initconst = {
 	&gate_t6030,
 	&gate_t8122,
 	&gate_t6031,
+	&gate_t6041,
 };
 
 /* The SoC this boot runs on, if the gate serves it. */
@@ -1335,35 +1375,36 @@ static int __init gate_ext_routes(struct of_changeset *cs, struct device_node *d
 	return ret;
 }
 
-/* The display subsystem's iommus with <@dart 0> appended. */
-static int __init gate_display_add_dart(struct of_changeset *cs, struct device_node *dart)
+/*
+ * @display's iommus with <@dart 0> appended, in @cs. Every entry must have one
+ * cell and none may name @dart already. Not __init: the T6041 external chain
+ * is powered up from a work item.
+ */
+static int gate_iommus_append(struct of_changeset *cs, struct device_node *display,
+			      struct device_node *dart)
 {
-	struct device_node *display = gate_find_one(gate_soc->display_compat);
 	struct of_phandle_args args;
 	struct property *old, *prop;
 	__be32 *value;
-	int i, n, ret = -EINVAL;
+	int i, n;
 
-	if (!display)
-		return -ENODEV;
 	old = of_find_property(display, "iommus", NULL);
 	n = of_count_phandle_with_args(display, "iommus", "#iommu-cells");
-	if (!old || n < 1 || old->length != n * 2 * sizeof(__be32))
-		goto out;
+	if (!old || !dart->phandle || n < 1 || old->length != n * 2 * sizeof(__be32))
+		return -EINVAL;
 	for (i = 0; i < n; i++) {
 		if (of_parse_phandle_with_args(display, "iommus", "#iommu-cells", i, &args))
-			goto out;
+			return -EINVAL;
 		of_node_put(args.np);
 		if (args.np == dart || args.args_count != 1)
-			goto out;
+			return -EINVAL;
 	}
-	ret = -ENOMEM;
 	prop = kzalloc_obj(*prop);
 	value = kmalloc(old->length + 2 * sizeof(*value), GFP_KERNEL);
 	if (!prop || !value) {
 		kfree(prop);
 		kfree(value);
-		goto out;
+		return -ENOMEM;
 	}
 	memcpy(value, old->value, old->length);
 	value[old->length / sizeof(*value)] = cpu_to_be32(dart->phandle);
@@ -1371,8 +1412,18 @@ static int __init gate_display_add_dart(struct of_changeset *cs, struct device_n
 	prop->name = "iommus";
 	prop->length = old->length + 2 * sizeof(*value);
 	prop->value = value;
-	ret = of_changeset_update_property(cs, display, prop);
-out:
+	return of_changeset_update_property(cs, display, prop);
+}
+
+/* The display subsystem's iommus with <@dart 0> appended. */
+static int __init gate_display_add_dart(struct of_changeset *cs, struct device_node *dart)
+{
+	struct device_node *display = gate_find_one(gate_soc->display_compat);
+	int ret;
+
+	if (!display)
+		return -ENODEV;
+	ret = gate_iommus_append(cs, display, dart);
 	of_node_put(display);
 	return ret;
 }
@@ -1971,8 +2022,585 @@ static void __init gate_run(void)
 		of_node_put(np[i]);
 }
 
+/*
+ * T6041 internal display. The handoff describes the DCP that iBoot left
+ * running: the DCP, the display subsystem and the DCP's piodma child carry
+ * the marker, the DCP names the 26.6.2 firmware the desktop IOMFB instance is
+ * written for, and the DCP, display and piodma streams sit on the expected
+ * DARTs. The display nodes are enabled only when all of that checks out and
+ * the DCP is running.
+ */
+#define T6041_DCP_SID		23
+#define T6041_DISP_SID		0
+#define T6041_PIODMA_SID	16
+#define ASC_CPU_CONTROL		0x44
+#define ASC_CPU_CONTROL_RUN	BIT(4)
+
+enum {
+	T6041_DCP, T6041_DISPLAY, T6041_PIODMA, T6041_DCP_DART,
+	T6041_DISP_DART, T6041_DCP_MBOX, T6041_PANEL, T6041_NR_NODES
+};
+
+/* Nodes enabled, in this order: the DARTs and the mailbox before their users. */
+static const int t6041_enable[] __initconst = { T6041_DCP_DART, T6041_DISP_DART, T6041_DCP_MBOX,
+						T6041_DISPLAY, T6041_DCP, T6041_PANEL };
+
+/* Applied, it stays: the live tree refers to it. */
+static struct of_changeset t6041_gate;
+
+static void __init gate_t6041_internal(void)
+{
+	struct device_node *nodes[T6041_NR_NODES] = {};
+	struct device_node *piodma_dart = NULL;
+	void __iomem *cpu;
+	u32 version[3];
+	unsigned int i;
+	int ret = 0;
+
+	nodes[T6041_DCP] = of_find_node_by_path("dcp");
+	if (!nodes[T6041_DCP] || !of_device_is_compatible(nodes[T6041_DCP], gate_soc->dcp_compat) ||
+	    !of_property_present(nodes[T6041_DCP], gate_soc->marker))
+		goto out;	/* no handoff: the boot framebuffer stays */
+
+	ret = -EINVAL;
+	nodes[T6041_DISPLAY] = of_find_node_by_path("disp0");
+	nodes[T6041_PIODMA] = of_get_child_by_name(nodes[T6041_DCP], "piodma");
+	nodes[T6041_PANEL] = of_get_child_by_name(nodes[T6041_DCP], "panel");
+	if (!nodes[T6041_DISPLAY] || !nodes[T6041_PIODMA] || !nodes[T6041_PANEL] ||
+	    !of_device_is_compatible(nodes[T6041_DISPLAY], gate_soc->display_compat) ||
+	    !gate_marked(nodes[T6041_DCP]) || !gate_marked(nodes[T6041_DISPLAY]) ||
+	    !gate_marked(nodes[T6041_PIODMA]))
+		goto out;
+
+	/* The desktop IOMFB instance is written for the 26.6.2 firmware only. */
+	if (of_property_count_u32_elems(nodes[T6041_DCP], "apple,firmware-compat") != 3 ||
+	    of_property_read_u32_array(nodes[T6041_DCP], "apple,firmware-compat", version, 3) ||
+	    version[0] != 26 || version[1] != 6 || version[2] != 2)
+		goto out;
+
+	nodes[T6041_DCP_DART] = gate_target(nodes[T6041_DCP], "iommus", "#iommu-cells",
+					    1, T6041_DCP_SID, "apple,t8110-dart");
+	nodes[T6041_DISP_DART] = gate_target(nodes[T6041_DISPLAY], "iommus", "#iommu-cells",
+					     1, T6041_DISP_SID, "apple,t8110-dart");
+	piodma_dart = gate_target(nodes[T6041_PIODMA], "iommus", "#iommu-cells",
+				  1, T6041_PIODMA_SID, "apple,t8110-dart");
+	nodes[T6041_DCP_MBOX] = gate_target(nodes[T6041_DCP], "mboxes", "#mbox-cells",
+					    0, 0, "apple,asc-mailbox-v4");
+	if (!nodes[T6041_DCP_DART] || !nodes[T6041_DISP_DART] || !nodes[T6041_DCP_MBOX] ||
+	    piodma_dart != nodes[T6041_DISP_DART] ||
+	    nodes[T6041_DCP_DART] == nodes[T6041_DISP_DART])
+		goto out;
+
+	for (i = 0; i < ARRAY_SIZE(t6041_enable); i++) {
+		if (!gate_disabled(nodes[t6041_enable[i]])) {
+			ret = -EBUSY;
+			goto out;
+		}
+	}
+
+	/* The handoff describes a DCP that iBoot left running. */
+	cpu = of_iomap(nodes[T6041_DCP], 0);
+	if (!cpu) {
+		ret = -ENOMEM;
+		goto out;
+	}
+	ret = readl(cpu + ASC_CPU_CONTROL) & ASC_CPU_CONTROL_RUN ? 0 : -EBUSY;
+	iounmap(cpu);
+	if (ret)
+		goto out;
+
+	of_changeset_init(&t6041_gate);
+	for (i = 0; i < ARRAY_SIZE(t6041_enable) && !ret; i++)
+		ret = of_changeset_update_prop_string(&t6041_gate, nodes[t6041_enable[i]],
+						      "status", "okay");
+	if (!ret)
+		ret = of_changeset_apply(&t6041_gate);
+	if (ret)
+		of_changeset_destroy(&t6041_gate);
+	else
+		gate_info("display handoff accepted\n");
+out:
+	of_node_put(piodma_dart);
+	for (i = 0; i < ARRAY_SIZE(nodes); i++)
+		of_node_put(nodes[i]);
+	if (ret)
+		gate_info("display handoff refused: %d; keeping the boot framebuffer\n", ret);
+}
+
+/*
+ * The external chain is powered up from work items, after the init sections
+ * are gone, so its messages keep their own prefix.
+ */
+static const char *staged_prefix = "";
+#define staged_info(fmt, ...) pr_info("%s" fmt, staged_prefix, ##__VA_ARGS__)
+#define staged_warn(fmt, ...) pr_warn("%s" fmt, staged_prefix, ##__VA_ARGS__)
+#define staged_err(fmt, ...) pr_err("%s" fmt, staged_prefix, ##__VA_ARGS__)
+
+/*
+ * External displays (HDMI behind dcpext0, Type-C behind dcpext1). The
+ * device tree describes the whole chain disabled; it is enabled here once the
+ * boot loader has given each external display processor its firmware memory
+ * (the memory-region nodes of the dcpext are available, or they stay disabled
+ * placeholders). Before any device exists only the Type-C routes are enabled
+ * (the port controllers then wait for dcpext1's mode switches) and the
+ * display subsystem is held back. The power-up waits for the PMP firmware,
+ * whose acknowledgement the DISPEXT domains need: HDMI chain, Type-C chain,
+ * then both processors and the display subsystem together, so the display
+ * master is created once with every DART in its iommus.
+ */
+
+/*
+ * Two stages, each with its own display DART (a DART still disabled in the
+ * display subsystem's iommus would make of_iommu drop its whole fwspec): the
+ * HDMI chain, then the Type-C chain. Run at the same time the two processors
+ * crashed (dcpext0: axi_rd_err), as they never did one after the other.
+ * Parents first; the genpd links in the tree do the real ordering.
+ */
+struct gate_staged {
+	const char *dart;		/* display DART of this stage */
+	const char *const *nodes;
+	unsigned int nr;
+};
+
+static const char *const t6041_hdmi_nodes[] = {
+	/* ATC3 power, PMP DISPEXT0 request, DISPEXT0, AOP pins, PHY, crossbar, DARTs, mailbox, dcpext0 */
+	"/power-management@502800000/power-controller@408",
+	"/power-management@508300000/power-controller@e0",
+	"/power-management@508300000/power-controller@168",
+	"/power-management@508300000/power-controller@b8",
+	"/power-management@508300000/power-controller@148",
+	"/pmp-report@5003c0000/report@11",
+	"/power-management@502800000/power-controller@340",
+	"/power-management@502800000/power-controller@348",
+	"/pinctrl@510824000",
+	"/mailbox@39b148000",
+	"/phy@39aa90000",
+	"/mux@39b24c000",
+	"/iommu@3a2340000",
+	"/iommu@3a2300000",
+	"/mailbox@3a2e08000",
+	"/dcp@3a2e00000/typec-routes/route@0",
+	"/dcp@3a2e00000/typec-routes/route@1",
+	"/dcp@3a2e00000/typec-routes/route@2",
+	"/dcp@3a2e00000",
+};
+
+static const char *const t6041_usbc_nodes[] = {
+	/* PMP DISPEXT1 request, FAB7_SOC, DISPEXT1, crossbars, DARTs, mailbox, routes, dcpext1 */
+	"/pmp-report@5003c0000/report@12",
+	"/power-management@502800000/power-controller@488",
+	"/power-management@502800000/power-controller@490",
+	"/power-management@502800000/power-controller@498",
+	"/mux@38324c000",
+	"/mux@38b24c000",
+	"/mux@39324c000",
+	"/iommu@602340000",
+	"/iommu@602300000",
+	"/mailbox@602e08000",
+	"/dcp@602e00000/typec-routes/route@0",
+	"/dcp@602e00000/typec-routes/route@1",
+	"/dcp@602e00000/typec-routes/route@2",
+	"/dcp@602e00000",
+};
+
+static const struct gate_staged t6041_stages[] = {
+	{ "/iommu@3a2300000", t6041_hdmi_nodes, ARRAY_SIZE(t6041_hdmi_nodes) },
+	{ "/iommu@602300000", t6041_usbc_nodes, ARRAY_SIZE(t6041_usbc_nodes) },
+};
+
+/* A display processor (a direct child of the root) and a Type-C display route. */
+static bool staged_is_dcp(const char *path)
+{
+	return !strncmp(path, "/dcp@", 5) && !strchr(path + 5, '/');
+}
+
+static bool staged_is_route(const char *path)
+{
+	return strstr(path, "/typec-routes/");
+}
+
+/*
+ * The processor's firmware memory must be described: every memory-region of
+ * the dcpext node (the stage's last node) must be an available reserved-memory
+ * node. A loader that fills the regions from the ADT (m4-loader
+ * m4_dcpext_fixup) leaves disabled placeholders when it refuses, and an older
+ * loader leaves them all disabled; enabling the processor then would only
+ * make its driver fail. /chosen m4,dcpext is that loader's record (0 filled,
+ * 2 static memory), printed when the check fails.
+ */
+static bool staged_firmware_memory(const char *dcp)
+{
+	struct device_node *np, *region;
+	int i, n;
+	u32 record[2];
+
+	np = of_find_node_by_path(dcp);
+	if (!np)
+		return false;
+	n = of_count_phandle_with_args(np, "memory-region", NULL);
+	for (i = 0; i < n; i++) {
+		region = of_parse_phandle(np, "memory-region", i);
+		if (region && of_device_is_available(region) &&
+		    of_device_is_compatible(region, "apple,asc-mem")) {
+			of_node_put(region);
+			continue;
+		}
+		of_node_put(region);
+		n = -ENODEV;
+		break;
+	}
+	of_node_put(np);
+	if (n > 0)
+		return true;
+	np = of_find_node_by_path("/chosen");
+	if (np && !of_property_read_u32_array(np, "m4,dcpext", record, 2))
+		staged_err("%s: no firmware memory (loader record <%u %u>), nothing enabled\n", dcp,
+		       record[0], record[1]);
+	else
+		staged_err("%s: no firmware memory, nothing enabled\n", dcp);
+	of_node_put(np);
+	return false;
+}
+
+/* Every node of @st is there and still disabled, and its processor has firmware memory. */
+static bool staged_ready(const struct gate_staged *st)
+{
+	struct device_node *np;
+	unsigned int i;
+
+	if (!staged_firmware_memory(st->nodes[st->nr - 1]))
+		return false;
+	for (i = 0; i < st->nr; i++) {
+		np = of_find_node_by_path(st->nodes[i]);
+		if (!np) {
+			staged_err("%s: no such node, nothing enabled\n", st->nodes[i]);
+			return false;
+		}
+		if (of_device_is_available(np)) {
+			staged_err("%s: already enabled, nothing changed\n", st->nodes[i]);
+			of_node_put(np);
+			return false;
+		}
+		of_node_put(np);
+	}
+	return true;
+}
+
+/* Enable @st's nodes and put its display DART into the display subsystem's iommus. */
+static int staged_apply(const struct gate_staged *st, struct device_node *display)
+{
+	struct device_node *np;
+	struct of_changeset *cs;
+	unsigned int i;
+	int ret;
+
+	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
+	if (!cs)
+		return -ENOMEM;
+	of_changeset_init(cs);
+
+	np = of_find_node_by_path(st->dart);
+	ret = np ? gate_iommus_append(cs, display, np) : -ENODEV;
+	of_node_put(np);
+	for (i = 0; !ret && i < st->nr; i++) {
+		if (staged_is_dcp(st->nodes[i]) || staged_is_route(st->nodes[i]))
+			continue;
+		np = of_find_node_by_path(st->nodes[i]);
+		ret = np ? of_changeset_update_prop_string(cs, np, "status", "okay") : -ENODEV;
+		of_node_put(np);
+	}
+	if (!ret)
+		ret = of_changeset_apply(cs);
+	if (ret) {
+		of_changeset_destroy(cs);
+		kfree(cs);
+	}
+	/* Applied, it stays: the live tree refers to it. */
+	return ret;
+}
+
+#define STAGED_PMP_WAIT_MS 20000
+
+/* A tether boot reserves ATC0 for the debug link. Its DP PHY is disabled,
+ * so exposing a route@0 would make its DCP (dcpext1, or the dcpext0 hybrid)
+ * defer on that missing supplier and take the usable ATC1/2 display routes
+ * (and dcpext0's HDMI) down with it.
+ */
+static bool staged_route_phy_available(struct device_node *route)
+{
+	struct device_node *routes, *dcp;
+	struct of_phandle_args phy;
+	char name[16];
+	u32 index;
+	int match;
+	bool available = false;
+
+	if (of_property_read_u32(route, "reg", &index))
+		return false;
+	routes = of_get_parent(route);
+	dcp = routes ? of_get_parent(routes) : NULL;
+	of_node_put(routes);
+	if (!dcp)
+		return false;
+	/* The fabric takes a route's PHY by name ("typecN"), not by position. */
+	snprintf(name, sizeof(name), "typec%u", index);
+	match = of_property_match_string(dcp, "phy-names", name);
+	if (match >= 0)
+		index = match;
+	if (!of_parse_phandle_with_args(dcp, "phys", "#phy-cells", index, &phy)) {
+		available = of_device_is_available(phy.np);
+		of_node_put(phy.np);
+	}
+	of_node_put(dcp);
+	return available;
+}
+
+/* Set the status of the processors (externals) or the routes, and the display subsystem, in one changeset. */
+static int staged_set(struct device_node *display, bool dcps, const char *dcp_status, bool routes,
+		    const char *route_status, const char *display_status)
+{
+	struct device_node *np;
+	struct of_changeset *cs;
+	unsigned int i, j;
+	int ret = 0;
+
+	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
+	if (!cs)
+		return -ENOMEM;
+	of_changeset_init(cs);
+	for (i = 0; !ret && i < ARRAY_SIZE(t6041_stages); i++)
+		for (j = 0; !ret && j < t6041_stages[i].nr; j++) {
+			const char *path = t6041_stages[i].nodes[j];
+
+			if (!(dcps && staged_is_dcp(path)) && !(routes && staged_is_route(path)))
+				continue;
+			np = of_find_node_by_path(path);
+			if (np && staged_is_route(path) && route_status &&
+			    !strcmp(route_status, "okay") && !staged_route_phy_available(np)) {
+				staged_info("%s remains disabled: DP PHY unavailable\n", path);
+				of_node_put(np);
+				continue;
+			}
+			ret = np ? of_changeset_update_prop_string(cs, np, "status",
+								   staged_is_dcp(path) ? dcp_status :
+								   route_status) : -ENODEV;
+			of_node_put(np);
+		}
+	if (!ret && display_status)
+		ret = of_changeset_update_prop_string(cs, display, "status", display_status);
+	if (!ret)
+		ret = of_changeset_apply(cs);
+	if (ret) {
+		of_changeset_destroy(cs);
+		kfree(cs);
+	}
+	return ret;
+}
+
+static struct device_node *staged_display;
+static struct device_node *staged_pmp;
+static atomic_t staged_started = ATOMIC_INIT(0);
+
+/* Internal panel only: the routes go again, so the port controllers probe without mode switches. */
+static void staged_fallback(const char *why)
+{
+	int ret = staged_set(staged_display, false, NULL, true, "disabled", "okay");
+
+	staged_err("%s: external displays stay off, internal panel only (%d)\n", why, ret);
+}
+
+/*
+ * The Type-C core treats a mode switch below a disabled node as absent, so the
+ * port controllers, which probe before dcpext1 is enabled, only took the USB
+ * muxes. Once dcpext1 is bound (its route mode switches are registered), let
+ * each controller wired to a route probe again, so that it takes them too.
+ */
+static void staged_reprobe_port_controllers(void)
+{
+	struct device *done[ARRAY_SIZE(t6041_usbc_nodes)] = {};
+	struct device_node *dcp, *np, *ep, *connector, *ctrl;
+	struct device *dev = NULL;
+	unsigned int i, n = 0, tries;
+
+	dcp = of_find_node_by_path("/dcp@602e00000");
+	for (tries = 0; dcp && tries < 150; tries++) {
+		dev = dcp->fwnode.dev;
+		if (dev && READ_ONCE(dev->driver))
+			break;
+		msleep(200);
+	}
+	of_node_put(dcp);
+	if (!dev || !READ_ONCE(dev->driver)) {
+		staged_err("dcpext1 not bound, port controllers left as they are\n");
+		return;
+	}
+	for (i = 0; i < ARRAY_SIZE(t6041_usbc_nodes); i++) {
+		unsigned int k;
+
+		if (!staged_is_route(t6041_usbc_nodes[i]))
+			continue;
+		np = of_find_node_by_path(t6041_usbc_nodes[i]);
+		ep = np ? of_graph_get_next_endpoint(np, NULL) : NULL;
+		connector = ep ? of_graph_get_remote_port_parent(ep) : NULL;
+		ctrl = connector ? of_get_parent(connector) : NULL;
+		dev = ctrl ? get_device(ctrl->fwnode.dev) : NULL;
+		of_node_put(ctrl);
+		of_node_put(connector);
+		of_node_put(ep);
+		of_node_put(np);
+		if (!dev)
+			continue;
+		for (k = 0; k < n && done[k] != dev; k++)
+			;
+		if (k < n || !READ_ONCE(dev->driver)) {
+			put_device(dev);
+			continue;
+		}
+		done[n++] = dev;
+		if (device_reprobe(dev))
+			dev_err(dev, "probe again failed\n");
+		else
+			dev_info(dev, "probed again for the display routes\n");
+	}
+	while (n)
+		put_device(done[--n]);
+}
+
+/*
+ * A processor that finds its crossbar or DP PHY without a driver is given up
+ * for good (the deferred probe timeout is 0 here), and those drivers are
+ * modules that load only once the stage has created their devices. Wait until
+ * every such device of the enabled infrastructure has its driver. Returns the
+ * first path still without one, or NULL.
+ */
+static const char *staged_unbound_infra(void)
+{
+	unsigned int i, j;
+
+	for (i = 0; i < ARRAY_SIZE(t6041_stages); i++)
+		for (j = 0; j < t6041_stages[i].nr; j++) {
+			const char *path = t6041_stages[i].nodes[j];
+			struct device_node *np;
+			struct device *dev;
+
+			/* Power domains are the genpd core's to wait for; the modules are the point here. */
+			if (staged_is_dcp(path) || staged_is_route(path) ||
+			    !strncmp(path, "/power-management@", 18))
+				continue;
+			np = of_find_node_by_path(path);
+			dev = np ? READ_ONCE(np->fwnode.dev) : NULL;
+			of_node_put(np);
+			if (dev && !READ_ONCE(dev->driver))
+				return path;
+		}
+	return NULL;
+}
+
+#define STAGED_DRIVER_WAIT_MS 10000
+
+static void staged_wait_for_drivers(void)
+{
+	const char *path = NULL;
+	unsigned int tries;
+
+	for (tries = 0; tries < STAGED_DRIVER_WAIT_MS / 100; tries++) {
+		path = staged_unbound_infra();
+		if (!path)
+			return;
+		msleep(100);
+	}
+	staged_warn("%s has no driver after " __stringify(STAGED_DRIVER_WAIT_MS) " ms, enabling the processors anyway\n",
+		path);
+}
+
+static void staged_power_up(struct work_struct *work)
+{
+	unsigned int i;
+	int ret = 0;
+
+	for (i = 0; !ret && i < ARRAY_SIZE(t6041_stages); i++) {
+		ret = staged_apply(&t6041_stages[i], staged_display);
+		if (!ret)
+			staged_info("stage %u enabled\n", i);
+	}
+	if (!ret)
+		staged_wait_for_drivers();
+	/* Both processors and the display subsystem together: the master binds once, with all DCPs. */
+	if (!ret)
+		ret = staged_set(staged_display, true, "okay", false, NULL, "okay");
+	if (ret) {
+		staged_fallback("could not enable the external displays");
+		return;
+	}
+	staged_info("processors and display subsystem enabled\n");
+	staged_reprobe_port_controllers();
+}
+static DECLARE_WORK(staged_power_up_work, staged_power_up);
+
+static void staged_timeout(struct work_struct *work)
+{
+	if (!atomic_xchg(&staged_started, 1))
+		staged_fallback("no PMP within " __stringify(STAGED_PMP_WAIT_MS) " ms");
+}
+static DECLARE_DELAYED_WORK(staged_timeout_work, staged_timeout);
+
+/* The PMP's driver is bound: DISPEXT can be acknowledged now. */
+static int staged_pmp_bound(struct notifier_block *nb, unsigned long action, void *data)
+{
+	struct device *dev = data;
+
+	if (action != BUS_NOTIFY_BOUND_DRIVER || dev->of_node != staged_pmp || atomic_xchg(&staged_started, 1))
+		return NOTIFY_DONE;
+	cancel_delayed_work(&staged_timeout_work);
+	queue_work(system_long_wq, &staged_power_up_work);
+	return NOTIFY_OK;
+}
+static struct notifier_block staged_pmp_nb = { .notifier_call = staged_pmp_bound };
+
+static void __init gate_t6041_staged(void)
+{
+	unsigned int i;
+	int ret;
+
+	staged_prefix = gate_soc->prefix;
+
+	/* Everything must be there and disabled, with firmware memory, before anything is changed. */
+	for (i = 0; i < ARRAY_SIZE(t6041_stages); i++)
+		if (!staged_ready(&t6041_stages[i]))
+			return;
+	staged_display = of_find_node_by_path("/display-subsystem");
+	staged_pmp = of_find_node_by_path("/pmp@500700000");
+	if (!staged_display || !staged_pmp || !of_device_is_available(staged_display) ||
+	    !of_device_is_available(staged_pmp)) {
+		staged_err("no display subsystem or PMP, nothing enabled\n");
+		return;
+	}
+
+	/* No device exists yet: routes on, display subsystem held back until the power-up. */
+	ret = staged_set(staged_display, false, NULL, true, "okay", "disabled");
+	if (ret) {
+		staged_err("could not prepare the tree: %d, nothing enabled\n", ret);
+		return;
+	}
+	ret = bus_register_notifier(&platform_bus_type, &staged_pmp_nb);
+	if (ret) {
+		staged_fallback("no bus notifier");
+		return;
+	}
+	schedule_delayed_work(&staged_timeout_work, msecs_to_jiffies(STAGED_PMP_WAIT_MS));
+	staged_info("routes enabled, waiting for the PMP\n");
+}
+
+static void __init gate_t6041_run(void)
+{
+	if (IS_ENABLED(CONFIG_VIDEO) && video_firmware_drivers_only())
+		return;
+	gate_t6041_internal();
+	gate_t6041_staged();
+}
+
 /* Runs before of_platform_default_populate_init() at arch_initcall_sync. */
-static int __init apple_t6030_display_gate(void)
+static int __init apple_display_gate(void)
 {
 	int i;
 
@@ -1992,11 +2620,14 @@ static int __init apple_t6030_display_gate(void)
 			return 0;
 	}
 
-	gate_run();
+	if (gate_soc->run)
+		gate_soc->run();
+	else
+		gate_run();
 	return 0;
 }
-arch_initcall(apple_t6030_display_gate);
+arch_initcall(apple_display_gate);
 
 #if IS_ENABLED(CONFIG_APPLE_DISPLAY_GATE_KUNIT_TEST)
-#include "t6030-display-gate-test.c"
+#include "display-gate-test.c"
 #endif
diff --git a/drivers/soc/apple/t6041-display-gate.c b/drivers/soc/apple/t6041-display-gate.c
deleted file mode 100644
index 3f27fe2cff832..0000000000000
--- a/drivers/soc/apple/t6041-display-gate.c
+++ /dev/null
@@ -1,655 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only OR MIT
-/*
- * Enable gate for the T6041 internal display of the M4 Pro J616s. m1n1
- * describes the DCP that iBoot leaves running (apple,t6041-handoff on dcp,
- * display and piodma, their firmware regions, apple,firmware-compat) and
- * leaves the display nodes disabled. They are enabled here, before devices
- * are created, only when that handoff is complete, so a boot loader without
- * it, or nomodeset, keeps the boot framebuffer.
- */
-#define pr_fmt(fmt) "apple-t6041-display: " fmt
-
-#include <linux/bits.h>
-#include <linux/io.h>
-#include <linux/of.h>
-#include <linux/of_address.h>
-#include <linux/init.h>
-#include <linux/printk.h>
-#include <linux/string.h>
-
-#include <video/nomodeset.h>
-
-#define T6041_HANDOFF "apple,t6041-handoff"
-#define T6041_DCP_SID 23
-#define T6041_DISP_SID 0
-#define T6041_PIODMA_SID 16
-#define ASC_CPU_CONTROL 0x44
-#define ASC_CPU_CONTROL_RUN BIT(4)
-
-enum {
-	T6041_DCP, T6041_DISPLAY, T6041_PIODMA, T6041_DCP_DART,
-	T6041_DISP_DART, T6041_DCP_MBOX, T6041_PANEL, T6041_NR_NODES
-};
-
-/* Nodes enabled, in this order: the DARTs and the mailbox before their users. */
-static const int t6041_enable[] __initconst = { T6041_DCP_DART, T6041_DISP_DART, T6041_DCP_MBOX,
-				    T6041_DISPLAY, T6041_DCP, T6041_PANEL };
-
-static struct of_changeset t6041_gate;
-
-/* The single @list target of @np, if it is @compat and (stream >= 0) that stream. */
-static struct device_node *__init t6041_target(const struct device_node *np, const char *list,
-					const char *cells, int stream, const char *compat)
-{
-	struct of_phandle_args args;
-
-	if (of_count_phandle_with_args(np, list, cells) != 1 ||
-	    of_parse_phandle_with_args(np, list, cells, 0, &args))
-		return NULL;
-	if (args.args_count != (stream < 0 ? 0 : 1) ||
-	    (stream >= 0 && args.args[0] != (u32)stream) ||
-	    !of_device_is_compatible(args.np, compat)) {
-		of_node_put(args.np);
-		return NULL;
-	}
-	return args.np;
-}
-
-static bool __init t6041_marked(const struct device_node *np)
-{
-	u32 marker;
-
-	return np && of_property_count_u32_elems(np, T6041_HANDOFF) == 1 &&
-	       !of_property_read_u32(np, T6041_HANDOFF, &marker) && marker == 1;
-}
-
-static bool __init t6041_disabled(const struct device_node *np)
-{
-	const char *status;
-
-	return !of_property_read_string(np, "status", &status) && !strcmp(status, "disabled");
-}
-
-static int __init apple_t6041_display_gate(void)
-{
-	struct device_node *nodes[T6041_NR_NODES] = {};
-	struct device_node *piodma_dart = NULL;
-	void __iomem *cpu;
-	u32 version[3];
-	unsigned int i;
-	int ret = 0;
-
-	if (!of_machine_is_compatible("apple,j616s"))
-		return 0;
-	if (IS_ENABLED(CONFIG_VIDEO) && video_firmware_drivers_only())
-		return 0;
-	nodes[T6041_DCP] = of_find_node_by_path("dcp");
-	if (!nodes[T6041_DCP] || !of_device_is_compatible(nodes[T6041_DCP], "apple,t6041-dcp") ||
-	    !of_property_present(nodes[T6041_DCP], T6041_HANDOFF))
-		goto out;	/* no handoff: the boot framebuffer stays */
-
-	ret = -EINVAL;
-	nodes[T6041_DISPLAY] = of_find_node_by_path("disp0");
-	nodes[T6041_PIODMA] = of_get_child_by_name(nodes[T6041_DCP], "piodma");
-	nodes[T6041_PANEL] = of_get_child_by_name(nodes[T6041_DCP], "panel");
-	if (!nodes[T6041_DISPLAY] || !nodes[T6041_PIODMA] || !nodes[T6041_PANEL] ||
-	    !of_device_is_compatible(nodes[T6041_DISPLAY], "apple,display-subsystem") ||
-	    !t6041_marked(nodes[T6041_DCP]) || !t6041_marked(nodes[T6041_DISPLAY]) ||
-	    !t6041_marked(nodes[T6041_PIODMA]))
-		goto out;
-
-	/* The desktop IOMFB instance is written for the 26.6.2 firmware only. */
-	if (of_property_count_u32_elems(nodes[T6041_DCP], "apple,firmware-compat") != 3 ||
-	    of_property_read_u32_array(nodes[T6041_DCP], "apple,firmware-compat", version, 3) ||
-	    version[0] != 26 || version[1] != 6 || version[2] != 2)
-		goto out;
-
-	nodes[T6041_DCP_DART] = t6041_target(nodes[T6041_DCP], "iommus", "#iommu-cells",
-					     T6041_DCP_SID, "apple,t8110-dart");
-	nodes[T6041_DISP_DART] = t6041_target(nodes[T6041_DISPLAY], "iommus", "#iommu-cells",
-					      T6041_DISP_SID, "apple,t8110-dart");
-	piodma_dart = t6041_target(nodes[T6041_PIODMA], "iommus", "#iommu-cells",
-				   T6041_PIODMA_SID, "apple,t8110-dart");
-	nodes[T6041_DCP_MBOX] = t6041_target(nodes[T6041_DCP], "mboxes", "#mbox-cells", -1,
-					     "apple,asc-mailbox-v4");
-	if (!nodes[T6041_DCP_DART] || !nodes[T6041_DISP_DART] || !nodes[T6041_DCP_MBOX] ||
-	    piodma_dart != nodes[T6041_DISP_DART] ||
-	    nodes[T6041_DCP_DART] == nodes[T6041_DISP_DART])
-		goto out;
-
-	for (i = 0; i < ARRAY_SIZE(t6041_enable); i++) {
-		if (!t6041_disabled(nodes[t6041_enable[i]])) {
-			ret = -EBUSY;
-			goto out;
-		}
-	}
-
-	/* The handoff describes a DCP that iBoot left running. */
-	cpu = of_iomap(nodes[T6041_DCP], 0);
-	if (!cpu) {
-		ret = -ENOMEM;
-		goto out;
-	}
-	ret = readl(cpu + ASC_CPU_CONTROL) & ASC_CPU_CONTROL_RUN ? 0 : -EBUSY;
-	iounmap(cpu);
-	if (ret)
-		goto out;
-
-	of_changeset_init(&t6041_gate);
-	for (i = 0; i < ARRAY_SIZE(t6041_enable) && !ret; i++)
-		ret = of_changeset_update_prop_string(&t6041_gate, nodes[t6041_enable[i]],
-						      "status", "okay");
-	if (!ret)
-		ret = of_changeset_apply(&t6041_gate);
-	if (ret)
-		of_changeset_destroy(&t6041_gate);
-	else
-		pr_info("display handoff accepted\n");
-out:
-	of_node_put(piodma_dart);
-	for (i = 0; i < ARRAY_SIZE(nodes); i++)
-		of_node_put(nodes[i]);
-	if (ret)
-		pr_info("display handoff refused: %d; keeping the boot framebuffer\n", ret);
-	return 0;
-}
-
-/* Runs before of_platform_default_populate_init() at arch_initcall_sync. */
-arch_initcall(apple_t6041_display_gate);
-
-/*
- * External displays (HDMI behind dcpext0, Type-C behind dcpext1). The
- * device tree describes the whole chain disabled; it is enabled here once the
- * boot loader has given each external display processor its firmware memory
- * (the memory-region nodes of the dcpext are available, or they stay disabled
- * placeholders). Before any device exists only the Type-C routes are enabled
- * (the port controllers then wait for dcpext1's mode switches) and the
- * display subsystem is held back. The power-up waits for the PMP firmware,
- * whose acknowledgement the DISPEXT domains need: HDMI chain, Type-C chain,
- * then both processors and the display subsystem together, so the display
- * master is created once with every DART in its iommus.
- */
-#include <linux/delay.h>
-#include <linux/device.h>
-#include <linux/of_graph.h>
-#include <linux/platform_device.h>
-#include <linux/slab.h>
-#include <linux/workqueue.h>
-#include <linux/stringify.h>
-
-/*
- * Two stages, each with its own display DART (a DART still disabled in the
- * display subsystem's iommus would make of_iommu drop its whole fwspec): the
- * HDMI chain, then the Type-C chain. Run at the same time the two processors
- * crashed (dcpext0: axi_rd_err), as they never did one after the other.
- * Parents first; the genpd links in the tree do the real ordering.
- */
-struct gate_stage {
-	const char *dart;		/* display DART of this stage */
-	const char *const *nodes;
-	unsigned int nr;
-};
-
-static const char *const gate_hdmi_nodes[] = {
-	/* ATC3 power, PMP DISPEXT0 request, DISPEXT0, AOP pins, PHY, crossbar, DARTs, mailbox, dcpext0 */
-	"/power-management@502800000/power-controller@408",
-	"/power-management@508300000/power-controller@e0",
-	"/power-management@508300000/power-controller@168",
-	"/power-management@508300000/power-controller@b8",
-	"/power-management@508300000/power-controller@148",
-	"/pmp-report@5003c0000/report@11",
-	"/power-management@502800000/power-controller@340",
-	"/power-management@502800000/power-controller@348",
-	"/pinctrl@510824000",
-	"/mailbox@39b148000",
-	"/phy@39aa90000",
-	"/mux@39b24c000",
-	"/iommu@3a2340000",
-	"/iommu@3a2300000",
-	"/mailbox@3a2e08000",
-	"/dcp@3a2e00000/typec-routes/route@0",
-	"/dcp@3a2e00000/typec-routes/route@1",
-	"/dcp@3a2e00000/typec-routes/route@2",
-	"/dcp@3a2e00000",
-};
-
-static const char *const gate_usbc_nodes[] = {
-	/* PMP DISPEXT1 request, FAB7_SOC, DISPEXT1, crossbars, DARTs, mailbox, routes, dcpext1 */
-	"/pmp-report@5003c0000/report@12",
-	"/power-management@502800000/power-controller@488",
-	"/power-management@502800000/power-controller@490",
-	"/power-management@502800000/power-controller@498",
-	"/mux@38324c000",
-	"/mux@38b24c000",
-	"/mux@39324c000",
-	"/iommu@602340000",
-	"/iommu@602300000",
-	"/mailbox@602e08000",
-	"/dcp@602e00000/typec-routes/route@0",
-	"/dcp@602e00000/typec-routes/route@1",
-	"/dcp@602e00000/typec-routes/route@2",
-	"/dcp@602e00000",
-};
-
-static const struct gate_stage gate_stages[] = {
-	{ "/iommu@3a2300000", gate_hdmi_nodes, ARRAY_SIZE(gate_hdmi_nodes) },
-	{ "/iommu@602300000", gate_usbc_nodes, ARRAY_SIZE(gate_usbc_nodes) },
-};
-
-/* A display processor (a direct child of the root) and a Type-C display route. */
-static bool gate_is_dcp(const char *path)
-{
-	return !strncmp(path, "/dcp@", 5) && !strchr(path + 5, '/');
-}
-
-static bool gate_is_route(const char *path)
-{
-	return strstr(path, "/typec-routes/");
-}
-
-static int gate_display_add_dart(struct of_changeset *cs, struct device_node *display,
-					struct device_node *dart)
-{
-	struct property *old, *prop;
-	__be32 *value;
-
-	old = of_find_property(display, "iommus", NULL);
-	if (!old || !dart->phandle || old->length % (2 * sizeof(*value)))
-		return -EINVAL;
-	prop = kzalloc(sizeof(*prop), GFP_KERNEL);
-	value = kmalloc(old->length + 2 * sizeof(*value), GFP_KERNEL);
-	if (!prop || !value) {
-		kfree(prop);
-		kfree(value);
-		return -ENOMEM;
-	}
-	memcpy(value, old->value, old->length);
-	value[old->length / sizeof(*value)] = cpu_to_be32(dart->phandle);
-	value[old->length / sizeof(*value) + 1] = cpu_to_be32(0);
-	prop->name = kstrdup("iommus", GFP_KERNEL);
-	prop->length = old->length + 2 * sizeof(*value);
-	prop->value = value;
-	if (!prop->name) {
-		kfree(value);
-		kfree(prop);
-		return -ENOMEM;
-	}
-	return of_changeset_update_property(cs, display, prop);
-}
-
-/*
- * The processor's firmware memory must be described: every memory-region of
- * the dcpext node (the stage's last node) must be an available reserved-memory
- * node. A loader that fills the regions from the ADT (m4-loader
- * m4_dcpext_fixup) leaves disabled placeholders when it refuses, and an older
- * loader leaves them all disabled; enabling the processor then would only
- * make its driver fail. /chosen m4,dcpext is that loader's record (0 filled,
- * 2 static memory), printed when the check fails.
- */
-static bool gate_firmware_memory(const char *dcp)
-{
-	struct device_node *np, *region;
-	int i, n;
-	u32 record[2];
-
-	np = of_find_node_by_path(dcp);
-	if (!np)
-		return false;
-	n = of_count_phandle_with_args(np, "memory-region", NULL);
-	for (i = 0; i < n; i++) {
-		region = of_parse_phandle(np, "memory-region", i);
-		if (region && of_device_is_available(region) &&
-		    of_device_is_compatible(region, "apple,asc-mem")) {
-			of_node_put(region);
-			continue;
-		}
-		of_node_put(region);
-		n = -ENODEV;
-		break;
-	}
-	of_node_put(np);
-	if (n > 0)
-		return true;
-	np = of_find_node_by_path("/chosen");
-	if (np && !of_property_read_u32_array(np, "m4,dcpext", record, 2))
-		pr_err("%s: no firmware memory (loader record <%u %u>), nothing enabled\n", dcp,
-		       record[0], record[1]);
-	else
-		pr_err("%s: no firmware memory, nothing enabled\n", dcp);
-	of_node_put(np);
-	return false;
-}
-
-/* Every node of @st is there and still disabled, and its processor has firmware memory. */
-static bool gate_stage_ready(const struct gate_stage *st)
-{
-	struct device_node *np;
-	unsigned int i;
-
-	if (!gate_firmware_memory(st->nodes[st->nr - 1]))
-		return false;
-	for (i = 0; i < st->nr; i++) {
-		np = of_find_node_by_path(st->nodes[i]);
-		if (!np) {
-			pr_err("%s: no such node, nothing enabled\n", st->nodes[i]);
-			return false;
-		}
-		if (of_device_is_available(np)) {
-			pr_err("%s: already enabled, nothing changed\n", st->nodes[i]);
-			of_node_put(np);
-			return false;
-		}
-		of_node_put(np);
-	}
-	return true;
-}
-
-/* Enable @st's nodes and put its display DART into the display subsystem's iommus. */
-static int gate_stage_apply(const struct gate_stage *st, struct device_node *display)
-{
-	struct device_node *np;
-	struct of_changeset *cs;
-	unsigned int i;
-	int ret;
-
-	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
-	if (!cs)
-		return -ENOMEM;
-	of_changeset_init(cs);
-
-	np = of_find_node_by_path(st->dart);
-	ret = np ? gate_display_add_dart(cs, display, np) : -ENODEV;
-	of_node_put(np);
-	for (i = 0; !ret && i < st->nr; i++) {
-		if (gate_is_dcp(st->nodes[i]) || gate_is_route(st->nodes[i]))
-			continue;
-		np = of_find_node_by_path(st->nodes[i]);
-		ret = np ? of_changeset_update_prop_string(cs, np, "status", "okay") : -ENODEV;
-		of_node_put(np);
-	}
-	if (!ret)
-		ret = of_changeset_apply(cs);
-	if (ret) {
-		of_changeset_destroy(cs);
-		kfree(cs);
-	}
-	/* Applied, it stays: the live tree refers to it. */
-	return ret;
-}
-
-#define GATE_PMP_WAIT_MS 20000
-
-/* A tether boot reserves ATC0 for the debug link. Its DP PHY is disabled,
- * so exposing a route@0 would make its DCP (dcpext1, or the dcpext0 hybrid)
- * defer on that missing supplier and take the usable ATC1/2 display routes
- * (and dcpext0's HDMI) down with it.
- */
-static bool gate_route_phy_available(struct device_node *route)
-{
-	struct device_node *routes, *dcp;
-	struct of_phandle_args phy;
-	char name[16];
-	u32 index;
-	int match;
-	bool available = false;
-
-	if (of_property_read_u32(route, "reg", &index))
-		return false;
-	routes = of_get_parent(route);
-	dcp = routes ? of_get_parent(routes) : NULL;
-	of_node_put(routes);
-	if (!dcp)
-		return false;
-	/* The fabric takes a route's PHY by name ("typecN"), not by position. */
-	snprintf(name, sizeof(name), "typec%u", index);
-	match = of_property_match_string(dcp, "phy-names", name);
-	if (match >= 0)
-		index = match;
-	if (!of_parse_phandle_with_args(dcp, "phys", "#phy-cells", index, &phy)) {
-		available = of_device_is_available(phy.np);
-		of_node_put(phy.np);
-	}
-	of_node_put(dcp);
-	return available;
-}
-
-/* Set the status of the processors (externals) or the routes, and the display subsystem, in one changeset. */
-static int gate_set(struct device_node *display, bool dcps, const char *dcp_status, bool routes,
-		    const char *route_status, const char *display_status)
-{
-	struct device_node *np;
-	struct of_changeset *cs;
-	unsigned int i, j;
-	int ret = 0;
-
-	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
-	if (!cs)
-		return -ENOMEM;
-	of_changeset_init(cs);
-	for (i = 0; !ret && i < ARRAY_SIZE(gate_stages); i++)
-		for (j = 0; !ret && j < gate_stages[i].nr; j++) {
-			const char *path = gate_stages[i].nodes[j];
-
-			if (!(dcps && gate_is_dcp(path)) && !(routes && gate_is_route(path)))
-				continue;
-			np = of_find_node_by_path(path);
-			if (np && gate_is_route(path) && route_status &&
-			    !strcmp(route_status, "okay") && !gate_route_phy_available(np)) {
-				pr_info("%s remains disabled: DP PHY unavailable\n", path);
-				of_node_put(np);
-				continue;
-			}
-			ret = np ? of_changeset_update_prop_string(cs, np, "status",
-								   gate_is_dcp(path) ? dcp_status :
-								   route_status) : -ENODEV;
-			of_node_put(np);
-		}
-	if (!ret && display_status)
-		ret = of_changeset_update_prop_string(cs, display, "status", display_status);
-	if (!ret)
-		ret = of_changeset_apply(cs);
-	if (ret) {
-		of_changeset_destroy(cs);
-		kfree(cs);
-	}
-	return ret;
-}
-
-static struct device_node *gate_display;
-static struct device_node *gate_pmp;
-static atomic_t gate_started = ATOMIC_INIT(0);
-
-/* Internal panel only: the routes go again, so the port controllers probe without mode switches. */
-static void gate_fallback(const char *why)
-{
-	int ret = gate_set(gate_display, false, NULL, true, "disabled", "okay");
-
-	pr_err("%s: external displays stay off, internal panel only (%d)\n", why, ret);
-}
-
-/*
- * The Type-C core treats a mode switch below a disabled node as absent, so the
- * port controllers, which probe before dcpext1 is enabled, only took the USB
- * muxes. Once dcpext1 is bound (its route mode switches are registered), let
- * each controller wired to a route probe again, so that it takes them too.
- */
-static void gate_reprobe_port_controllers(void)
-{
-	struct device *done[ARRAY_SIZE(gate_usbc_nodes)] = {};
-	struct device_node *dcp, *np, *ep, *connector, *ctrl;
-	struct device *dev = NULL;
-	unsigned int i, n = 0, tries;
-
-	dcp = of_find_node_by_path("/dcp@602e00000");
-	for (tries = 0; dcp && tries < 150; tries++) {
-		dev = dcp->fwnode.dev;
-		if (dev && READ_ONCE(dev->driver))
-			break;
-		msleep(200);
-	}
-	of_node_put(dcp);
-	if (!dev || !READ_ONCE(dev->driver)) {
-		pr_err("dcpext1 not bound, port controllers left as they are\n");
-		return;
-	}
-	for (i = 0; i < ARRAY_SIZE(gate_usbc_nodes); i++) {
-		unsigned int k;
-
-		if (!gate_is_route(gate_usbc_nodes[i]))
-			continue;
-		np = of_find_node_by_path(gate_usbc_nodes[i]);
-		ep = np ? of_graph_get_next_endpoint(np, NULL) : NULL;
-		connector = ep ? of_graph_get_remote_port_parent(ep) : NULL;
-		ctrl = connector ? of_get_parent(connector) : NULL;
-		dev = ctrl ? get_device(ctrl->fwnode.dev) : NULL;
-		of_node_put(ctrl);
-		of_node_put(connector);
-		of_node_put(ep);
-		of_node_put(np);
-		if (!dev)
-			continue;
-		for (k = 0; k < n && done[k] != dev; k++)
-			;
-		if (k < n || !READ_ONCE(dev->driver)) {
-			put_device(dev);
-			continue;
-		}
-		done[n++] = dev;
-		if (device_reprobe(dev))
-			dev_err(dev, "probe again failed\n");
-		else
-			dev_info(dev, "probed again for the display routes\n");
-	}
-	while (n)
-		put_device(done[--n]);
-}
-
-/*
- * A processor that finds its crossbar or DP PHY without a driver is given up
- * for good (the deferred probe timeout is 0 here), and those drivers are
- * modules that load only once the stage has created their devices. Wait until
- * every such device of the enabled infrastructure has its driver. Returns the
- * first path still without one, or NULL.
- */
-static const char *gate_unbound_infra(void)
-{
-	unsigned int i, j;
-
-	for (i = 0; i < ARRAY_SIZE(gate_stages); i++)
-		for (j = 0; j < gate_stages[i].nr; j++) {
-			const char *path = gate_stages[i].nodes[j];
-			struct device_node *np;
-			struct device *dev;
-
-			/* Power domains are the genpd core's to wait for; the modules are the point here. */
-			if (gate_is_dcp(path) || gate_is_route(path) ||
-			    !strncmp(path, "/power-management@", 18))
-				continue;
-			np = of_find_node_by_path(path);
-			dev = np ? READ_ONCE(np->fwnode.dev) : NULL;
-			of_node_put(np);
-			if (dev && !READ_ONCE(dev->driver))
-				return path;
-		}
-	return NULL;
-}
-
-#define GATE_DRIVER_WAIT_MS 10000
-
-static void gate_wait_for_drivers(void)
-{
-	const char *path = NULL;
-	unsigned int tries;
-
-	for (tries = 0; tries < GATE_DRIVER_WAIT_MS / 100; tries++) {
-		path = gate_unbound_infra();
-		if (!path)
-			return;
-		msleep(100);
-	}
-	pr_warn("%s has no driver after " __stringify(GATE_DRIVER_WAIT_MS) " ms, enabling the processors anyway\n",
-		path);
-}
-
-static void gate_power_up(struct work_struct *work)
-{
-	unsigned int i;
-	int ret = 0;
-
-	for (i = 0; !ret && i < ARRAY_SIZE(gate_stages); i++) {
-		ret = gate_stage_apply(&gate_stages[i], gate_display);
-		if (!ret)
-			pr_info("stage %u enabled\n", i);
-	}
-	if (!ret)
-		gate_wait_for_drivers();
-	/* Both processors and the display subsystem together: the master binds once, with all DCPs. */
-	if (!ret)
-		ret = gate_set(gate_display, true, "okay", false, NULL, "okay");
-	if (ret) {
-		gate_fallback("could not enable the external displays");
-		return;
-	}
-	pr_info("processors and display subsystem enabled\n");
-	gate_reprobe_port_controllers();
-}
-static DECLARE_WORK(gate_power_up_work, gate_power_up);
-
-static void gate_timeout(struct work_struct *work)
-{
-	if (!atomic_xchg(&gate_started, 1))
-		gate_fallback("no PMP within " __stringify(GATE_PMP_WAIT_MS) " ms");
-}
-static DECLARE_DELAYED_WORK(gate_timeout_work, gate_timeout);
-
-/* The PMP's driver is bound: DISPEXT can be acknowledged now. */
-static int gate_pmp_bound(struct notifier_block *nb, unsigned long action, void *data)
-{
-	struct device *dev = data;
-
-	if (action != BUS_NOTIFY_BOUND_DRIVER || dev->of_node != gate_pmp || atomic_xchg(&gate_started, 1))
-		return NOTIFY_DONE;
-	cancel_delayed_work(&gate_timeout_work);
-	queue_work(system_long_wq, &gate_power_up_work);
-	return NOTIFY_OK;
-}
-static struct notifier_block gate_pmp_nb = { .notifier_call = gate_pmp_bound };
-
-static int __init apple_t6041_extdisp_gate(void)
-{
-	unsigned int i;
-	int ret;
-
-	if (!of_machine_is_compatible("apple,j616s"))
-		return 0;
-	if (IS_ENABLED(CONFIG_VIDEO) && video_firmware_drivers_only())
-		return 0;
-
-	/* Everything must be there and disabled, with firmware memory, before anything is changed. */
-	for (i = 0; i < ARRAY_SIZE(gate_stages); i++)
-		if (!gate_stage_ready(&gate_stages[i]))
-			return 0;
-	gate_display = of_find_node_by_path("/display-subsystem");
-	gate_pmp = of_find_node_by_path("/pmp@500700000");
-	if (!gate_display || !gate_pmp || !of_device_is_available(gate_display) ||
-	    !of_device_is_available(gate_pmp)) {
-		pr_err("no display subsystem or PMP, nothing enabled\n");
-		return 0;
-	}
-
-	/* No device exists yet: routes on, display subsystem held back until the power-up. */
-	ret = gate_set(gate_display, false, NULL, true, "okay", "disabled");
-	if (ret) {
-		pr_err("could not prepare the tree: %d, nothing enabled\n", ret);
-		return 0;
-	}
-	ret = bus_register_notifier(&platform_bus_type, &gate_pmp_nb);
-	if (ret) {
-		gate_fallback("no bus notifier");
-		return 0;
-	}
-	schedule_delayed_work(&gate_timeout_work, msecs_to_jiffies(GATE_PMP_WAIT_MS));
-	pr_info("routes enabled, waiting for the PMP\n");
-	return 0;
-}
-arch_initcall(apple_t6041_extdisp_gate);
diff --git a/tools/asahi/t6030-pmp-supplier-tests.py b/tools/asahi/t6030-pmp-supplier-tests.py
index 3379b2911f480..d323dffbef728 100755
--- a/tools/asahi/t6030-pmp-supplier-tests.py
+++ b/tools/asahi/t6030-pmp-supplier-tests.py
@@ -21,7 +21,7 @@
 import sys
 
 ROOT = Path(__file__).resolve().parents[2]
-GATE = "drivers/soc/apple/t6030-display-gate.c"
+GATE = "drivers/soc/apple/display-gate.c"
 REPORT = "drivers/pmdomain/apple/pmp-report.c"
 EXPORT = "drivers/soc/apple/pmp-export.c"
 
@@ -84,7 +84,7 @@ def main():
     kconfig = (ROOT / "drivers/soc/apple/Kconfig").read_text()
     section = kconfig.split("config APPLE_T6030_GPU_PMP_LINK\n", 1)[1].split("\nconfig ", 1)[0]
     assert '\n\tbool\n' in "\n" + section and "\n\tdefault n\n" in section
-    assert "depends on APPLE_T6030_DISPLAY_GATE" in section
+    assert "depends on APPLE_DISPLAY_GATE" in section
     parts = [function(gate, "static struct device_node *__init gate_find_one("),
              function(gate, "static int __init gate_gpu_pmp_link("),
              function(report, "static struct device_node *apple_pmp_report_t6030_entry("),