drm/imagination/pvr_fw.c

// SPDX-License-Identifier: GPL-2.0-only OR MIT
/* Copyright (c) 2023 Imagination Technologies Ltd. */

#include "pvr_ccb.h"
#include "pvr_device.h"
#include "pvr_device_info.h"
#include "pvr_fw.h"
#include "pvr_fw_info.h"
#include "pvr_fw_startstop.h"
#include "pvr_fw_trace.h"
#include "pvr_gem.h"
#include "pvr_power.h"
#include "pvr_rogue_fwif_dev_info.h"
#include "pvr_rogue_heap_config.h"
#include "pvr_vm.h"

#include <drm/drm_drv.h>
#include <drm/drm_managed.h>
#include <drm/drm_mm.h>
#include <drm/drm_print.h>
#include <linux/clk.h>
#include <linux/firmware.h>
#include <linux/math.h>
#include <linux/minmax.h>
#include <linux/sizes.h>

#define FW_MAX_SUPPORTED_MAJOR_VERSION 1

#define FW_BOOT_TIMEOUT_USEC 5000000

/* Config heap occupies top 192k of the firmware heap. */
#define PVR_ROGUE_FW_CONFIG_HEAP_GRANULARITY SZ_64K
#define PVR_ROGUE_FW_CONFIG_HEAP_SIZE (3 * PVR_ROGUE_FW_CONFIG_HEAP_GRANULARITY)

/* Main firmware allocations should come from the remainder of the heap. */
#define PVR_ROGUE_FW_MAIN_HEAP_BASE ROGUE_FW_HEAP_BASE

/* Offsets from start of configuration area of FW heap. */
#define PVR_ROGUE_FWIF_CONNECTION_CTL_OFFSET 0
#define PVR_ROGUE_FWIF_OSINIT_OFFSET \
	(PVR_ROGUE_FWIF_CONNECTION_CTL_OFFSET + PVR_ROGUE_FW_CONFIG_HEAP_GRANULARITY)
#define PVR_ROGUE_FWIF_SYSINIT_OFFSET \
	(PVR_ROGUE_FWIF_OSINIT_OFFSET + PVR_ROGUE_FW_CONFIG_HEAP_GRANULARITY)

#define PVR_ROGUE_FAULT_PAGE_SIZE SZ_4K

#define PVR_SYNC_OBJ_SIZE sizeof(u32)

const struct pvr_fw_layout_entry *
pvr_fw_find_layout_entry(struct pvr_device *pvr_dev, enum pvr_fw_section_id id)
{
	const struct pvr_fw_layout_entry *layout_entries = pvr_dev->fw_dev.layout_entries;
	u32 num_layout_entries = pvr_dev->fw_dev.header->layout_entry_num;

	for (u32 entry = 0; entry < num_layout_entries; entry++) {
		if (layout_entries[entry].id == id)
			return &layout_entries[entry];
	}

	return NULL;
}

static const struct pvr_fw_layout_entry *
pvr_fw_find_private_data(struct pvr_device *pvr_dev)
{
	const struct pvr_fw_layout_entry *layout_entries = pvr_dev->fw_dev.layout_entries;
	u32 num_layout_entries = pvr_dev->fw_dev.header->layout_entry_num;

	for (u32 entry = 0; entry < num_layout_entries; entry++) {
		if (layout_entries[entry].id == META_PRIVATE_DATA ||
		    layout_entries[entry].id == MIPS_PRIVATE_DATA ||
		    layout_entries[entry].id == RISCV_PRIVATE_DATA)
			return &layout_entries[entry];
	}

	return NULL;
}

#define DEV_INFO_MASK_SIZE(x) DIV_ROUND_UP(x, 64)

/**
 * pvr_fw_validate() - Parse firmware header and check compatibility
 * @pvr_dev: Device pointer.
 *
 * Returns:
 *  * 0 on success, or
 *  * -EINVAL if firmware is incompatible.
 */
static int
pvr_fw_validate(struct pvr_device *pvr_dev)
{
	struct drm_device *drm_dev = from_pvr_device(pvr_dev);
	const struct firmware *firmware = pvr_dev->fw_dev.firmware;
	const struct pvr_fw_layout_entry *layout_entries;
	const struct pvr_fw_info_header *header;
	const u8 *fw = firmware->data;
	u32 fw_offset = firmware->size - SZ_4K;
	u32 layout_table_size;

	if (firmware->size < SZ_4K || (firmware->size % FW_BLOCK_SIZE))
		return -EINVAL;

	header = (const struct pvr_fw_info_header *)&fw[fw_offset];

	if (header->info_version != PVR_FW_INFO_VERSION) {
		drm_err(drm_dev, "Unsupported fw info version %u\n",
			header->info_version);
		return -EINVAL;
	}

	if (header->header_len != sizeof(struct pvr_fw_info_header) ||
	    header->layout_entry_size != sizeof(struct pvr_fw_layout_entry) ||
	    header->layout_entry_num > PVR_FW_INFO_MAX_NUM_ENTRIES) {
		drm_err(drm_dev, "FW info format mismatch\n");
		return -EINVAL;
	}

	if (!(header->flags & PVR_FW_FLAGS_OPEN_SOURCE) ||
	    header->fw_version_major > FW_MAX_SUPPORTED_MAJOR_VERSION ||
	    header->fw_version_major == 0) {
		drm_err(drm_dev, "Unsupported FW version %u.%u (build: %u%s)\n",
			header->fw_version_major, header->fw_version_minor,
			header->fw_version_build,
			(header->flags & PVR_FW_FLAGS_OPEN_SOURCE) ? " OS" : "");
		return -EINVAL;
	}

	if (pvr_gpu_id_to_packed_bvnc(&pvr_dev->gpu_id) != header->bvnc) {
		struct pvr_gpu_id fw_gpu_id;

		packed_bvnc_to_pvr_gpu_id(header->bvnc, &fw_gpu_id);
		drm_err(drm_dev, "FW built for incorrect GPU ID %i.%i.%i.%i (expected %i.%i.%i.%i)\n",
			fw_gpu_id.b, fw_gpu_id.v, fw_gpu_id.n, fw_gpu_id.c,
			pvr_dev->gpu_id.b, pvr_dev->gpu_id.v, pvr_dev->gpu_id.n, pvr_dev->gpu_id.c);
		return -EINVAL;
	}

	fw_offset += header->header_len;
	layout_table_size =
		header->layout_entry_size * header->layout_entry_num;
	if ((fw_offset + layout_table_size) > firmware->size)
		return -EINVAL;

	layout_entries = (const struct pvr_fw_layout_entry *)&fw[fw_offset];
	for (u32 entry = 0; entry < header->layout_entry_num; entry++) {
		u32 start_addr = layout_entries[entry].base_addr;
		u32 end_addr = start_addr + layout_entries[entry].alloc_size;

		if (start_addr >= end_addr)
			return -EINVAL;
	}

	fw_offset = (firmware->size - SZ_4K) - header->device_info_size;

	drm_info(drm_dev, "FW version v%u.%u (build %u OS)\n", header->fw_version_major,
		 header->fw_version_minor, header->fw_version_build);

	pvr_dev->fw_version.major = header->fw_version_major;
	pvr_dev->fw_version.minor = header->fw_version_minor;

	pvr_dev->fw_dev.header = header;
	pvr_dev->fw_dev.layout_entries = layout_entries;

	return 0;
}

static int
pvr_fw_get_device_info(struct pvr_device *pvr_dev)
{
	const struct firmware *firmware = pvr_dev->fw_dev.firmware;
	struct pvr_fw_device_info_header *header;
	const u8 *fw = firmware->data;
	const u64 *dev_info;
	u32 fw_offset;

	fw_offset = (firmware->size - SZ_4K) - pvr_dev->fw_dev.header->device_info_size;

	header = (struct pvr_fw_device_info_header *)&fw[fw_offset];
	dev_info = (u64 *)(header + 1);

	pvr_device_info_set_quirks(pvr_dev, dev_info, header->brn_mask_size);
	dev_info += header->brn_mask_size;

	pvr_device_info_set_enhancements(pvr_dev, dev_info, header->ern_mask_size);
	dev_info += header->ern_mask_size;

	return pvr_device_info_set_features(pvr_dev, dev_info, header->feature_mask_size,
					    header->feature_param_size);
}

static void
layout_get_sizes(struct pvr_device *pvr_dev)
{
	const struct pvr_fw_layout_entry *layout_entries = pvr_dev->fw_dev.layout_entries;
	u32 num_layout_entries = pvr_dev->fw_dev.header->layout_entry_num;
	struct pvr_fw_mem *fw_mem = &pvr_dev->fw_dev.mem;

	fw_mem->code_alloc_size = 0;
	fw_mem->data_alloc_size = 0;
	fw_mem->core_code_alloc_size = 0;
	fw_mem->core_data_alloc_size = 0;

	/* Extract section sizes from FW layout table. */
	for (u32 entry = 0; entry < num_layout_entries; entry++) {
		switch (layout_entries[entry].type) {
		case FW_CODE:
			fw_mem->code_alloc_size += layout_entries[entry].alloc_size;
			break;
		case FW_DATA:
			fw_mem->data_alloc_size += layout_entries[entry].alloc_size;
			break;
		case FW_COREMEM_CODE:
			fw_mem->core_code_alloc_size +=
				layout_entries[entry].alloc_size;
			break;
		case FW_COREMEM_DATA:
			fw_mem->core_data_alloc_size +=
				layout_entries[entry].alloc_size;
			break;
		case NONE:
			break;
		}
	}
}

int
pvr_fw_find_mmu_segment(struct pvr_device *pvr_dev, u32 addr, u32 size, void *fw_code_ptr,
			void *fw_data_ptr, void *fw_core_code_ptr, void *fw_core_data_ptr,
			void **host_addr_out)
{
	const struct pvr_fw_layout_entry *layout_entries = pvr_dev->fw_dev.layout_entries;
	u32 num_layout_entries = pvr_dev->fw_dev.header->layout_entry_num;
	u32 end_addr = addr + size;

	/* Ensure requested range is not zero, and size is not causing addr to overflow. */
	if (end_addr <= addr)
		return -EINVAL;

	for (int entry = 0; entry < num_layout_entries; entry++) {
		u32 entry_start_addr = layout_entries[entry].base_addr;
		u32 entry_end_addr = entry_start_addr + layout_entries[entry].alloc_size;

		if (addr >= entry_start_addr && addr < entry_end_addr &&
		    end_addr > entry_start_addr && end_addr <= entry_end_addr) {
			switch (layout_entries[entry].type) {
			case FW_CODE:
				*host_addr_out = fw_code_ptr;
				break;

			case FW_DATA:
				*host_addr_out = fw_data_ptr;
				break;

			case FW_COREMEM_CODE:
				*host_addr_out = fw_core_code_ptr;
				break;

			case FW_COREMEM_DATA:
				*host_addr_out = fw_core_data_ptr;
				break;

			default:
				return -EINVAL;
			}
			/* Direct Mem write to mapped memory */
			addr -= layout_entries[entry].base_addr;
			addr += layout_entries[entry].alloc_offset;

			/*
			 * Add offset to pointer to FW allocation only if that
			 * allocation is available
			 */
			*(u8 **)host_addr_out += addr;
			return 0;
		}
	}

	return -EINVAL;
}

static int
pvr_fw_create_fwif_connection_ctl(struct pvr_device *pvr_dev)
{
	struct drm_device *drm_dev = from_pvr_device(pvr_dev);
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;

	fw_dev->fwif_connection_ctl =
		pvr_fw_object_create_and_map_offset(pvr_dev,
						    fw_dev->fw_heap_info.config_offset +
						    PVR_ROGUE_FWIF_CONNECTION_CTL_OFFSET,
						    sizeof(*fw_dev->fwif_connection_ctl),
						    PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
						    NULL, NULL,
						    &fw_dev->mem.fwif_connection_ctl_obj);
	if (IS_ERR(fw_dev->fwif_connection_ctl)) {
		drm_err(drm_dev,
			"Unable to allocate FWIF connection control memory\n");
		return PTR_ERR(fw_dev->fwif_connection_ctl);
	}

	return 0;
}

static void
pvr_fw_fini_fwif_connection_ctl(struct pvr_device *pvr_dev)
{
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;

	pvr_fw_object_unmap_and_destroy(fw_dev->mem.fwif_connection_ctl_obj);
}

static void
fw_osinit_init(void *cpu_ptr, void *priv)
{
	struct rogue_fwif_osinit *fwif_osinit = cpu_ptr;
	struct pvr_device *pvr_dev = priv;
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;
	struct pvr_fw_mem *fw_mem = &fw_dev->mem;

	fwif_osinit->kernel_ccbctl_fw_addr = pvr_dev->kccb.ccb.ctrl_fw_addr;
	fwif_osinit->kernel_ccb_fw_addr = pvr_dev->kccb.ccb.ccb_fw_addr;
	pvr_fw_object_get_fw_addr(pvr_dev->kccb.rtn_obj,
				  &fwif_osinit->kernel_ccb_rtn_slots_fw_addr);

	fwif_osinit->firmware_ccbctl_fw_addr = pvr_dev->fwccb.ctrl_fw_addr;
	fwif_osinit->firmware_ccb_fw_addr = pvr_dev->fwccb.ccb_fw_addr;

	fwif_osinit->work_est_firmware_ccbctl_fw_addr = 0;
	fwif_osinit->work_est_firmware_ccb_fw_addr = 0;

	pvr_fw_object_get_fw_addr(fw_mem->hwrinfobuf_obj,
				  &fwif_osinit->rogue_fwif_hwr_info_buf_ctl_fw_addr);
	pvr_fw_object_get_fw_addr(fw_mem->osdata_obj, &fwif_osinit->fw_os_data_fw_addr);

	fwif_osinit->hwr_debug_dump_limit = 0;

	rogue_fwif_compchecks_bvnc_init(&fwif_osinit->rogue_comp_checks.hw_bvnc);
	rogue_fwif_compchecks_bvnc_init(&fwif_osinit->rogue_comp_checks.fw_bvnc);
}

static void
fw_osdata_init(void *cpu_ptr, void *priv)
{
	struct rogue_fwif_osdata *fwif_osdata = cpu_ptr;
	struct pvr_device *pvr_dev = priv;
	struct pvr_fw_mem *fw_mem = &pvr_dev->fw_dev.mem;

	pvr_fw_object_get_fw_addr(fw_mem->power_sync_obj, &fwif_osdata->power_sync_fw_addr);
}

static void
fw_fault_page_init(void *cpu_ptr, void *priv)
{
	u32 *fault_page = cpu_ptr;

	for (int i = 0; i < PVR_ROGUE_FAULT_PAGE_SIZE / sizeof(*fault_page); i++)
		fault_page[i] = 0xdeadbee0;
}

static void
fw_sysinit_init(void *cpu_ptr, void *priv)
{
	struct rogue_fwif_sysinit *fwif_sysinit = cpu_ptr;
	struct pvr_device *pvr_dev = priv;
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;
	struct pvr_fw_mem *fw_mem = &fw_dev->mem;
	dma_addr_t fault_dma_addr = 0;
	u32 clock_speed_hz = clk_get_rate(pvr_dev->core_clk);

	WARN_ON(!clock_speed_hz);

	WARN_ON(pvr_fw_object_get_dma_addr(fw_mem->fault_page_obj, 0, &fault_dma_addr));
	fwif_sysinit->fault_phys_addr = (u64)fault_dma_addr;

	fwif_sysinit->pds_exec_base = ROGUE_PDSCODEDATA_HEAP_BASE;
	fwif_sysinit->usc_exec_base = ROGUE_USCCODE_HEAP_BASE;

	pvr_fw_object_get_fw_addr(fw_mem->runtime_cfg_obj, &fwif_sysinit->runtime_cfg_fw_addr);
	pvr_fw_object_get_fw_addr(fw_dev->fw_trace.tracebuf_ctrl_obj,
				  &fwif_sysinit->trace_buf_ctl_fw_addr);
	pvr_fw_object_get_fw_addr(fw_mem->sysdata_obj, &fwif_sysinit->fw_sys_data_fw_addr);
	pvr_fw_object_get_fw_addr(fw_mem->gpu_util_fwcb_obj,
				  &fwif_sysinit->gpu_util_fw_cb_ctl_fw_addr);
	if (fw_mem->core_data_obj) {
		pvr_fw_object_get_fw_addr(fw_mem->core_data_obj,
					  &fwif_sysinit->coremem_data_store.fw_addr);
	}

	/* Currently unsupported. */
	fwif_sysinit->counter_dump_ctl.buffer_fw_addr = 0;
	fwif_sysinit->counter_dump_ctl.size_in_dwords = 0;

	/* Skip alignment checks. */
	fwif_sysinit->align_checks = 0;

	fwif_sysinit->filter_flags = 0;
	fwif_sysinit->hw_perf_filter = 0;
	fwif_sysinit->firmware_perf = FW_PERF_CONF_NONE;
	fwif_sysinit->initial_core_clock_speed = clock_speed_hz;
	fwif_sysinit->active_pm_latency_ms = 0;
	fwif_sysinit->gpio_validation_mode = ROGUE_FWIF_GPIO_VAL_OFF;
	fwif_sysinit->firmware_started = false;
	fwif_sysinit->marker_val = 1;

	memset(&fwif_sysinit->bvnc_km_feature_flags, 0,
	       sizeof(fwif_sysinit->bvnc_km_feature_flags));
}

#define ROGUE_FWIF_SLC_MIN_SIZE_FOR_DM_OVERLAP_KB 4

static void
fw_sysdata_init(void *cpu_ptr, void *priv)
{
	struct rogue_fwif_sysdata *fwif_sysdata = cpu_ptr;
	struct pvr_device *pvr_dev = priv;
	u32 slc_size_in_kilobytes = 0;
	u32 config_flags = 0;

	WARN_ON(PVR_FEATURE_VALUE(pvr_dev, slc_size_in_kilobytes, &slc_size_in_kilobytes));

	if (slc_size_in_kilobytes < ROGUE_FWIF_SLC_MIN_SIZE_FOR_DM_OVERLAP_KB)
		config_flags |= ROGUE_FWIF_INICFG_DISABLE_DM_OVERLAP;

	fwif_sysdata->config_flags = config_flags;
}

static void
fw_runtime_cfg_init(void *cpu_ptr, void *priv)
{
	struct rogue_fwif_runtime_cfg *runtime_cfg = cpu_ptr;
	struct pvr_device *pvr_dev = priv;
	u32 clock_speed_hz = clk_get_rate(pvr_dev->core_clk);

	WARN_ON(!clock_speed_hz);

	runtime_cfg->core_clock_speed = clock_speed_hz;
	runtime_cfg->active_pm_latency_ms = 0;
	runtime_cfg->active_pm_latency_persistant = true;
	WARN_ON(PVR_FEATURE_VALUE(pvr_dev, num_clusters,
				  &runtime_cfg->default_dusts_num_init) != 0);

	/* Keep watchdog timer disabled. */
	runtime_cfg->wdg_period_us = 0;
}

static void
fw_gpu_util_fwcb_init(void *cpu_ptr, void *priv)
{
	struct rogue_fwif_gpu_util_fwcb *gpu_util_fwcb = cpu_ptr;

	gpu_util_fwcb->last_word = PVR_FWIF_GPU_UTIL_STATE_IDLE;
}

static int
pvr_fw_create_structures(struct pvr_device *pvr_dev)
{
	struct drm_device *drm_dev = from_pvr_device(pvr_dev);
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;
	struct pvr_fw_mem *fw_mem = &fw_dev->mem;
	int err;

	fw_dev->power_sync = pvr_fw_object_create_and_map(pvr_dev, sizeof(*fw_dev->power_sync),
							  PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
							  NULL, NULL, &fw_mem->power_sync_obj);
	if (IS_ERR(fw_dev->power_sync)) {
		drm_err(drm_dev, "Unable to allocate FW power_sync structure\n");
		return PTR_ERR(fw_dev->power_sync);
	}

	fw_dev->hwrinfobuf = pvr_fw_object_create_and_map(pvr_dev, sizeof(*fw_dev->hwrinfobuf),
							  PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
							  NULL, NULL, &fw_mem->hwrinfobuf_obj);
	if (IS_ERR(fw_dev->hwrinfobuf)) {
		drm_err(drm_dev,
			"Unable to allocate FW hwrinfobuf structure\n");
		err = PTR_ERR(fw_dev->hwrinfobuf);
		goto err_release_power_sync;
	}

	err = pvr_fw_object_create(pvr_dev, PVR_SYNC_OBJ_SIZE,
				   PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
				   NULL, NULL, &fw_mem->mmucache_sync_obj);
	if (err) {
		drm_err(drm_dev,
			"Unable to allocate MMU cache sync object\n");
		goto err_release_hwrinfobuf;
	}

	fw_dev->fwif_sysdata = pvr_fw_object_create_and_map(pvr_dev,
							    sizeof(*fw_dev->fwif_sysdata),
							    PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
							    fw_sysdata_init, pvr_dev,
							    &fw_mem->sysdata_obj);
	if (IS_ERR(fw_dev->fwif_sysdata)) {
		drm_err(drm_dev, "Unable to allocate FW SYSDATA structure\n");
		err = PTR_ERR(fw_dev->fwif_sysdata);
		goto err_release_mmucache_sync_obj;
	}

	err = pvr_fw_object_create(pvr_dev, PVR_ROGUE_FAULT_PAGE_SIZE,
				   PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
				   fw_fault_page_init, NULL, &fw_mem->fault_page_obj);
	if (err) {
		drm_err(drm_dev, "Unable to allocate FW fault page\n");
		goto err_release_sysdata;
	}

	err = pvr_fw_object_create(pvr_dev, sizeof(struct rogue_fwif_gpu_util_fwcb),
				   PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
				   fw_gpu_util_fwcb_init, pvr_dev, &fw_mem->gpu_util_fwcb_obj);
	if (err) {
		drm_err(drm_dev, "Unable to allocate GPU util FWCB\n");
		goto err_release_fault_page;
	}

	err = pvr_fw_object_create(pvr_dev, sizeof(struct rogue_fwif_runtime_cfg),
				   PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
				   fw_runtime_cfg_init, pvr_dev, &fw_mem->runtime_cfg_obj);
	if (err) {
		drm_err(drm_dev, "Unable to allocate FW runtime config\n");
		goto err_release_gpu_util_fwcb;
	}

	err = pvr_fw_trace_init(pvr_dev);
	if (err)
		goto err_release_runtime_cfg;

	fw_dev->fwif_osdata = pvr_fw_object_create_and_map(pvr_dev,
							   sizeof(*fw_dev->fwif_osdata),
							   PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
							   fw_osdata_init, pvr_dev,
							   &fw_mem->osdata_obj);
	if (IS_ERR(fw_dev->fwif_osdata)) {
		drm_err(drm_dev, "Unable to allocate FW OSDATA structure\n");
		err = PTR_ERR(fw_dev->fwif_osdata);
		goto err_fw_trace_fini;
	}

	fw_dev->fwif_osinit =
		pvr_fw_object_create_and_map_offset(pvr_dev,
						    fw_dev->fw_heap_info.config_offset +
						    PVR_ROGUE_FWIF_OSINIT_OFFSET,
						    sizeof(*fw_dev->fwif_osinit),
						    PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
						    fw_osinit_init, pvr_dev, &fw_mem->osinit_obj);
	if (IS_ERR(fw_dev->fwif_osinit)) {
		drm_err(drm_dev, "Unable to allocate FW OSINIT structure\n");
		err = PTR_ERR(fw_dev->fwif_osinit);
		goto err_release_osdata;
	}

	fw_dev->fwif_sysinit =
		pvr_fw_object_create_and_map_offset(pvr_dev,
						    fw_dev->fw_heap_info.config_offset +
						    PVR_ROGUE_FWIF_SYSINIT_OFFSET,
						    sizeof(*fw_dev->fwif_sysinit),
						    PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
						    fw_sysinit_init, pvr_dev, &fw_mem->sysinit_obj);
	if (IS_ERR(fw_dev->fwif_sysinit)) {
		drm_err(drm_dev, "Unable to allocate FW SYSINIT structure\n");
		err = PTR_ERR(fw_dev->fwif_sysinit);
		goto err_release_osinit;
	}

	return 0;

err_release_osinit:
	pvr_fw_object_unmap_and_destroy(fw_mem->osinit_obj);

err_release_osdata:
	pvr_fw_object_unmap_and_destroy(fw_mem->osdata_obj);

err_fw_trace_fini:
	pvr_fw_trace_fini(pvr_dev);

err_release_runtime_cfg:
	pvr_fw_object_destroy(fw_mem->runtime_cfg_obj);

err_release_gpu_util_fwcb:
	pvr_fw_object_destroy(fw_mem->gpu_util_fwcb_obj);

err_release_fault_page:
	pvr_fw_object_destroy(fw_mem->fault_page_obj);

err_release_sysdata:
	pvr_fw_object_unmap_and_destroy(fw_mem->sysdata_obj);

err_release_mmucache_sync_obj:
	pvr_fw_object_destroy(fw_mem->mmucache_sync_obj);

err_release_hwrinfobuf:
	pvr_fw_object_unmap_and_destroy(fw_mem->hwrinfobuf_obj);

err_release_power_sync:
	pvr_fw_object_unmap_and_destroy(fw_mem->power_sync_obj);

	return err;
}

static void
pvr_fw_destroy_structures(struct pvr_device *pvr_dev)
{
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;
	struct pvr_fw_mem *fw_mem = &fw_dev->mem;

	pvr_fw_trace_fini(pvr_dev);
	pvr_fw_object_destroy(fw_mem->runtime_cfg_obj);
	pvr_fw_object_destroy(fw_mem->gpu_util_fwcb_obj);
	pvr_fw_object_destroy(fw_mem->fault_page_obj);
	pvr_fw_object_unmap_and_destroy(fw_mem->sysdata_obj);
	pvr_fw_object_unmap_and_destroy(fw_mem->sysinit_obj);

	pvr_fw_object_destroy(fw_mem->mmucache_sync_obj);
	pvr_fw_object_unmap_and_destroy(fw_mem->hwrinfobuf_obj);
	pvr_fw_object_unmap_and_destroy(fw_mem->power_sync_obj);
	pvr_fw_object_unmap_and_destroy(fw_mem->osdata_obj);
	pvr_fw_object_unmap_and_destroy(fw_mem->osinit_obj);
}

/**
 * pvr_fw_process() - Process firmware image, allocate FW memory and create boot
 *                    arguments
 * @pvr_dev: Device pointer.
 *
 * Returns:
 *  * 0 on success, or
 *  * Any error returned by pvr_fw_object_create_and_map_offset(), or
 *  * Any error returned by pvr_fw_object_create_and_map().
 */
static int
pvr_fw_process(struct pvr_device *pvr_dev)
{
	struct drm_device *drm_dev = from_pvr_device(pvr_dev);
	struct pvr_fw_mem *fw_mem = &pvr_dev->fw_dev.mem;
	const u8 *fw = pvr_dev->fw_dev.firmware->data;
	const struct pvr_fw_layout_entry *private_data;
	u8 *fw_code_ptr;
	u8 *fw_data_ptr;
	u8 *fw_core_code_ptr;
	u8 *fw_core_data_ptr;
	int err;

	layout_get_sizes(pvr_dev);

	private_data = pvr_fw_find_private_data(pvr_dev);
	if (!private_data)
		return -EINVAL;

	/* Allocate and map memory for firmware sections. */

	/*
	 * Code allocation must be at the start of the firmware heap, otherwise
	 * firmware processor will be unable to boot.
	 *
	 * This has the useful side-effect that for every other object in the
	 * driver, a firmware address of 0 is invalid.
	 */
	fw_code_ptr = pvr_fw_object_create_and_map_offset(pvr_dev, 0, fw_mem->code_alloc_size,
							  PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
							  NULL, NULL, &fw_mem->code_obj);
	if (IS_ERR(fw_code_ptr)) {
		drm_err(drm_dev, "Unable to allocate FW code memory\n");
		return PTR_ERR(fw_code_ptr);
	}

	if (pvr_dev->fw_dev.defs->has_fixed_data_addr) {
		u32 base_addr = private_data->base_addr & pvr_dev->fw_dev.fw_heap_info.offset_mask;

		fw_data_ptr =
			pvr_fw_object_create_and_map_offset(pvr_dev, base_addr,
							    fw_mem->data_alloc_size,
							    PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
							    NULL, NULL, &fw_mem->data_obj);
	} else {
		fw_data_ptr = pvr_fw_object_create_and_map(pvr_dev, fw_mem->data_alloc_size,
							   PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
							   NULL, NULL, &fw_mem->data_obj);
	}
	if (IS_ERR(fw_data_ptr)) {
		drm_err(drm_dev, "Unable to allocate FW data memory\n");
		err = PTR_ERR(fw_data_ptr);
		goto err_free_fw_code_obj;
	}

	/* Core code and data sections are optional. */
	if (fw_mem->core_code_alloc_size) {
		fw_core_code_ptr =
			pvr_fw_object_create_and_map(pvr_dev, fw_mem->core_code_alloc_size,
						     PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
						     NULL, NULL, &fw_mem->core_code_obj);
		if (IS_ERR(fw_core_code_ptr)) {
			drm_err(drm_dev,
				"Unable to allocate FW core code memory\n");
			err = PTR_ERR(fw_core_code_ptr);
			goto err_free_fw_data_obj;
		}
	} else {
		fw_core_code_ptr = NULL;
	}

	if (fw_mem->core_data_alloc_size) {
		fw_core_data_ptr =
			pvr_fw_object_create_and_map(pvr_dev, fw_mem->core_data_alloc_size,
						     PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
						     NULL, NULL, &fw_mem->core_data_obj);
		if (IS_ERR(fw_core_data_ptr)) {
			drm_err(drm_dev,
				"Unable to allocate FW core data memory\n");
			err = PTR_ERR(fw_core_data_ptr);
			goto err_free_fw_core_code_obj;
		}
	} else {
		fw_core_data_ptr = NULL;
	}

	fw_mem->code = kzalloc(fw_mem->code_alloc_size, GFP_KERNEL);
	fw_mem->data = kzalloc(fw_mem->data_alloc_size, GFP_KERNEL);
	if (fw_mem->core_code_alloc_size)
		fw_mem->core_code = kzalloc(fw_mem->core_code_alloc_size, GFP_KERNEL);
	if (fw_mem->core_data_alloc_size)
		fw_mem->core_data = kzalloc(fw_mem->core_data_alloc_size, GFP_KERNEL);

	if (!fw_mem->code || !fw_mem->data ||
	    (!fw_mem->core_code && fw_mem->core_code_alloc_size) ||
	    (!fw_mem->core_data && fw_mem->core_data_alloc_size)) {
		err = -ENOMEM;
		goto err_free_kdata;
	}

	err = pvr_dev->fw_dev.defs->fw_process(pvr_dev, fw,
					       fw_mem->code, fw_mem->data, fw_mem->core_code,
					       fw_mem->core_data, fw_mem->core_code_alloc_size);

	if (err)
		goto err_free_kdata;

	memcpy(fw_code_ptr, fw_mem->code, fw_mem->code_alloc_size);
	memcpy(fw_data_ptr, fw_mem->data, fw_mem->data_alloc_size);
	if (fw_mem->core_code)
		memcpy(fw_core_code_ptr, fw_mem->core_code, fw_mem->core_code_alloc_size);
	if (fw_mem->core_data)
		memcpy(fw_core_data_ptr, fw_mem->core_data, fw_mem->core_data_alloc_size);

	/* We're finished with the firmware section memory on the CPU, unmap. */
	if (fw_core_data_ptr) {
		pvr_fw_object_vunmap(fw_mem->core_data_obj);
		fw_core_data_ptr = NULL;
	}
	if (fw_core_code_ptr) {
		pvr_fw_object_vunmap(fw_mem->core_code_obj);
		fw_core_code_ptr = NULL;
	}
	pvr_fw_object_vunmap(fw_mem->data_obj);
	fw_data_ptr = NULL;
	pvr_fw_object_vunmap(fw_mem->code_obj);
	fw_code_ptr = NULL;

	err = pvr_fw_create_fwif_connection_ctl(pvr_dev);
	if (err)
		goto err_free_kdata;

	return 0;

err_free_kdata:
	kfree(fw_mem->core_data);
	kfree(fw_mem->core_code);
	kfree(fw_mem->data);
	kfree(fw_mem->code);

	if (fw_core_data_ptr)
		pvr_fw_object_vunmap(fw_mem->core_data_obj);
	if (fw_mem->core_data_obj)
		pvr_fw_object_destroy(fw_mem->core_data_obj);

err_free_fw_core_code_obj:
	if (fw_core_code_ptr)
		pvr_fw_object_vunmap(fw_mem->core_code_obj);
	if (fw_mem->core_code_obj)
		pvr_fw_object_destroy(fw_mem->core_code_obj);

err_free_fw_data_obj:
	if (fw_data_ptr)
		pvr_fw_object_vunmap(fw_mem->data_obj);
	pvr_fw_object_destroy(fw_mem->data_obj);

err_free_fw_code_obj:
	if (fw_code_ptr)
		pvr_fw_object_vunmap(fw_mem->code_obj);
	pvr_fw_object_destroy(fw_mem->code_obj);

	return err;
}

static int
pvr_copy_to_fw(struct pvr_fw_object *dest_obj, u8 *src_ptr, u32 size)
{
	u8 *dest_ptr = pvr_fw_object_vmap(dest_obj);

	if (IS_ERR(dest_ptr))
		return PTR_ERR(dest_ptr);

	memcpy(dest_ptr, src_ptr, size);

	pvr_fw_object_vunmap(dest_obj);

	return 0;
}

static int
pvr_fw_reinit_code_data(struct pvr_device *pvr_dev)
{
	struct pvr_fw_mem *fw_mem = &pvr_dev->fw_dev.mem;
	int err;

	err = pvr_copy_to_fw(fw_mem->code_obj, fw_mem->code, fw_mem->code_alloc_size);
	if (err)
		return err;

	err = pvr_copy_to_fw(fw_mem->data_obj, fw_mem->data, fw_mem->data_alloc_size);
	if (err)
		return err;

	if (fw_mem->core_code) {
		err = pvr_copy_to_fw(fw_mem->core_code_obj, fw_mem->core_code,
				     fw_mem->core_code_alloc_size);
		if (err)
			return err;
	}

	if (fw_mem->core_data) {
		err = pvr_copy_to_fw(fw_mem->core_data_obj, fw_mem->core_data,
				     fw_mem->core_data_alloc_size);
		if (err)
			return err;
	}

	return 0;
}

static void
pvr_fw_cleanup(struct pvr_device *pvr_dev)
{
	struct pvr_fw_mem *fw_mem = &pvr_dev->fw_dev.mem;

	pvr_fw_fini_fwif_connection_ctl(pvr_dev);

	kfree(fw_mem->core_data);
	kfree(fw_mem->core_code);
	kfree(fw_mem->data);
	kfree(fw_mem->code);

	if (fw_mem->core_code_obj)
		pvr_fw_object_destroy(fw_mem->core_code_obj);
	if (fw_mem->core_data_obj)
		pvr_fw_object_destroy(fw_mem->core_data_obj);
	pvr_fw_object_destroy(fw_mem->code_obj);
	pvr_fw_object_destroy(fw_mem->data_obj);
}

/**
 * pvr_wait_for_fw_boot() - Wait for firmware to finish booting
 * @pvr_dev: Target PowerVR device.
 *
 * Returns:
 *  * 0 on success, or
 *  * -%ETIMEDOUT if firmware fails to boot within timeout.
 */
int
pvr_wait_for_fw_boot(struct pvr_device *pvr_dev)
{
	ktime_t deadline = ktime_add_us(ktime_get(), FW_BOOT_TIMEOUT_USEC);
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;

	while (ktime_to_ns(ktime_sub(deadline, ktime_get())) > 0) {
		if (READ_ONCE(fw_dev->fwif_sysinit->firmware_started))
			return 0;
	}

	return -ETIMEDOUT;
}

/*
 * pvr_fw_heap_info_init() - Calculate size and masks for FW heap
 * @pvr_dev: Target PowerVR device.
 * @log2_size: Log2 of raw heap size.
 * @reserved_size: Size of reserved area of heap, in bytes. May be zero.
 */
void
pvr_fw_heap_info_init(struct pvr_device *pvr_dev, u32 log2_size, u32 reserved_size)
{
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;

	fw_dev->fw_heap_info.gpu_addr = PVR_ROGUE_FW_MAIN_HEAP_BASE;
	fw_dev->fw_heap_info.log2_size = log2_size;
	fw_dev->fw_heap_info.reserved_size = reserved_size;
	fw_dev->fw_heap_info.raw_size = 1 << fw_dev->fw_heap_info.log2_size;
	fw_dev->fw_heap_info.offset_mask = fw_dev->fw_heap_info.raw_size - 1;
	fw_dev->fw_heap_info.config_offset = fw_dev->fw_heap_info.raw_size -
					     PVR_ROGUE_FW_CONFIG_HEAP_SIZE;
	fw_dev->fw_heap_info.size = fw_dev->fw_heap_info.raw_size -
				    (PVR_ROGUE_FW_CONFIG_HEAP_SIZE + reserved_size);
}

/**
 * pvr_fw_validate_init_device_info() - Validate firmware and initialise device information
 * @pvr_dev: Target PowerVR device.
 *
 * This function must be called before querying device information.
 *
 * Returns:
 *  * 0 on success, or
 *  * -%EINVAL if firmware validation fails.
 */
int
pvr_fw_validate_init_device_info(struct pvr_device *pvr_dev)
{
	int err;

	err = pvr_fw_validate(pvr_dev);
	if (err)
		return err;

	return pvr_fw_get_device_info(pvr_dev);
}

/**
 * pvr_fw_init() - Initialise and boot firmware
 * @pvr_dev: Target PowerVR device
 *
 * On successful completion of the function the PowerVR device will be
 * initialised and ready to use.
 *
 * Returns:
 *  * 0 on success,
 *  * -%EINVAL on invalid firmware image,
 *  * -%ENOMEM on out of memory, or
 *  * -%ETIMEDOUT if firmware processor fails to boot or on register poll timeout.
 */
int
pvr_fw_init(struct pvr_device *pvr_dev)
{
	static const struct pvr_fw_defs *fw_defs[PVR_FW_PROCESSOR_TYPE_COUNT] = {
		[PVR_FW_PROCESSOR_TYPE_META] = &pvr_fw_defs_meta,
		[PVR_FW_PROCESSOR_TYPE_MIPS] = &pvr_fw_defs_mips,
		[PVR_FW_PROCESSOR_TYPE_RISCV] = &pvr_fw_defs_riscv,
	};

	u32 kccb_size_log2 = ROGUE_FWIF_KCCB_NUMCMDS_LOG2_DEFAULT;
	u32 kccb_rtn_size = (1 << kccb_size_log2) * sizeof(*pvr_dev->kccb.rtn);
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;
	int err;

	if (fw_dev->processor_type >= PVR_FW_PROCESSOR_TYPE_COUNT)
		return -EINVAL;

	fw_dev->defs = fw_defs[fw_dev->processor_type];

	err = fw_dev->defs->init(pvr_dev);
	if (err)
		return err;

	drm_mm_init(&fw_dev->fw_mm, ROGUE_FW_HEAP_BASE, fw_dev->fw_heap_info.raw_size);
	fw_dev->fw_mm_base = ROGUE_FW_HEAP_BASE;
	spin_lock_init(&fw_dev->fw_mm_lock);

	INIT_LIST_HEAD(&fw_dev->fw_objs.list);
	err = drmm_mutex_init(from_pvr_device(pvr_dev), &fw_dev->fw_objs.lock);
	if (err)
		goto err_mm_takedown;

	err = pvr_fw_process(pvr_dev);
	if (err)
		goto err_mm_takedown;

	/* Initialise KCCB and FWCCB. */
	err = pvr_kccb_init(pvr_dev);
	if (err)
		goto err_fw_cleanup;

	err = pvr_fwccb_init(pvr_dev);
	if (err)
		goto err_kccb_fini;

	/* Allocate memory for KCCB return slots. */
	pvr_dev->kccb.rtn = pvr_fw_object_create_and_map(pvr_dev, kccb_rtn_size,
							 PVR_BO_FW_FLAGS_DEVICE_UNCACHED,
							 NULL, NULL, &pvr_dev->kccb.rtn_obj);
	if (IS_ERR(pvr_dev->kccb.rtn)) {
		err = PTR_ERR(pvr_dev->kccb.rtn);
		goto err_fwccb_fini;
	}

	err = pvr_fw_create_structures(pvr_dev);
	if (err)
		goto err_kccb_rtn_release;

	err = pvr_fw_start(pvr_dev);
	if (err)
		goto err_destroy_structures;

	err = pvr_wait_for_fw_boot(pvr_dev);
	if (err) {
		drm_err(from_pvr_device(pvr_dev), "Firmware failed to boot\n");
		goto err_fw_stop;
	}

	fw_dev->booted = true;

	return 0;

err_fw_stop:
	pvr_fw_stop(pvr_dev);

err_destroy_structures:
	pvr_fw_destroy_structures(pvr_dev);

err_kccb_rtn_release:
	pvr_fw_object_unmap_and_destroy(pvr_dev->kccb.rtn_obj);

err_fwccb_fini:
	pvr_ccb_fini(&pvr_dev->fwccb);

err_kccb_fini:
	pvr_kccb_fini(pvr_dev);

err_fw_cleanup:
	pvr_fw_cleanup(pvr_dev);

err_mm_takedown:
	drm_mm_takedown(&fw_dev->fw_mm);

	if (fw_dev->defs->fini)
		fw_dev->defs->fini(pvr_dev);

	return err;
}

/**
 * pvr_fw_fini() - Shutdown firmware processor and free associated memory
 * @pvr_dev: Target PowerVR device
 */
void
pvr_fw_fini(struct pvr_device *pvr_dev)
{
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;

	fw_dev->booted = false;

	pvr_fw_destroy_structures(pvr_dev);
	pvr_fw_object_unmap_and_destroy(pvr_dev->kccb.rtn_obj);

	/*
	 * Ensure FWCCB worker has finished executing before destroying FWCCB. The IRQ handler has
	 * been unregistered at this point so no new work should be being submitted.
	 */
	pvr_ccb_fini(&pvr_dev->fwccb);
	pvr_kccb_fini(pvr_dev);
	pvr_fw_cleanup(pvr_dev);

	mutex_lock(&pvr_dev->fw_dev.fw_objs.lock);
	WARN_ON(!list_empty(&pvr_dev->fw_dev.fw_objs.list));
	mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock);

	drm_mm_takedown(&fw_dev->fw_mm);

	if (fw_dev->defs->fini)
		fw_dev->defs->fini(pvr_dev);
}

/**
 * pvr_fw_mts_schedule() - Schedule work via an MTS kick
 * @pvr_dev: Target PowerVR device
 * @val: Kick mask. Should be a combination of %ROGUE_CR_MTS_SCHEDULE_*
 */
void
pvr_fw_mts_schedule(struct pvr_device *pvr_dev, u32 val)
{
	/* Ensure memory is flushed before kicking MTS. */
	wmb();

	pvr_cr_write32(pvr_dev, ROGUE_CR_MTS_SCHEDULE, val);

	/* Ensure the MTS kick goes through before continuing. */
	mb();
}

/**
 * pvr_fw_structure_cleanup() - Send FW cleanup request for an object
 * @pvr_dev: Target PowerVR device.
 * @type: Type of object to cleanup. Must be one of &enum rogue_fwif_cleanup_type.
 * @fw_obj: Pointer to FW object containing object to cleanup.
 * @offset: Offset within FW object of object to cleanup.
 *
 * Returns:
 *  * 0 on success,
 *  * -EBUSY if object is busy,
 *  * -ETIMEDOUT on timeout, or
 *  * -EIO if device is lost.
 */
int
pvr_fw_structure_cleanup(struct pvr_device *pvr_dev, u32 type, struct pvr_fw_object *fw_obj,
			 u32 offset)
{
	struct rogue_fwif_kccb_cmd cmd;
	int slot_nr;
	int idx;
	int err;
	u32 rtn;

	struct rogue_fwif_cleanup_request *cleanup_req = &cmd.cmd_data.cleanup_data;

	down_read(&pvr_dev->reset_sem);

	if (!drm_dev_enter(from_pvr_device(pvr_dev), &idx)) {
		err = -EIO;
		goto err_up_read;
	}

	cmd.cmd_type = ROGUE_FWIF_KCCB_CMD_CLEANUP;
	cmd.kccb_flags = 0;
	cleanup_req->cleanup_type = type;

	switch (type) {
	case ROGUE_FWIF_CLEANUP_FWCOMMONCONTEXT:
		pvr_fw_object_get_fw_addr_offset(fw_obj, offset,
						 &cleanup_req->cleanup_data.context_fw_addr);
		break;
	case ROGUE_FWIF_CLEANUP_HWRTDATA:
		pvr_fw_object_get_fw_addr_offset(fw_obj, offset,
						 &cleanup_req->cleanup_data.hwrt_data_fw_addr);
		break;
	case ROGUE_FWIF_CLEANUP_FREELIST:
		pvr_fw_object_get_fw_addr_offset(fw_obj, offset,
						 &cleanup_req->cleanup_data.freelist_fw_addr);
		break;
	default:
		err = -EINVAL;
		goto err_drm_dev_exit;
	}

	err = pvr_kccb_send_cmd(pvr_dev, &cmd, &slot_nr);
	if (err)
		goto err_drm_dev_exit;

	err = pvr_kccb_wait_for_completion(pvr_dev, slot_nr, HZ, &rtn);
	if (err)
		goto err_drm_dev_exit;

	if (rtn & ROGUE_FWIF_KCCB_RTN_SLOT_CLEANUP_BUSY)
		err = -EBUSY;

err_drm_dev_exit:
	drm_dev_exit(idx);

err_up_read:
	up_read(&pvr_dev->reset_sem);

	return err;
}

/**
 * pvr_fw_object_fw_map() - Map a FW object in firmware address space
 * @pvr_dev: Device pointer.
 * @fw_obj: FW object to map.
 * @dev_addr: Desired address in device space, if a specific address is
 *            required. 0 otherwise.
 *
 * Returns:
 *  * 0 on success, or
 *  * -%EINVAL if @fw_obj is already mapped but has no references, or
 *  * Any error returned by DRM.
 */
static int
pvr_fw_object_fw_map(struct pvr_device *pvr_dev, struct pvr_fw_object *fw_obj, u64 dev_addr)
{
	struct pvr_gem_object *pvr_obj = fw_obj->gem;
	struct drm_gem_object *gem_obj = gem_from_pvr_gem(pvr_obj);
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;

	int err;

	spin_lock(&fw_dev->fw_mm_lock);

	if (drm_mm_node_allocated(&fw_obj->fw_mm_node)) {
		err = -EINVAL;
		goto err_unlock;
	}

	if (!dev_addr) {
		/*
		 * Allocate from the main heap only (firmware heap minus
		 * config space).
		 */
		err = drm_mm_insert_node_in_range(&fw_dev->fw_mm, &fw_obj->fw_mm_node,
						  gem_obj->size, 0, 0,
						  fw_dev->fw_heap_info.gpu_addr,
						  fw_dev->fw_heap_info.gpu_addr +
						  fw_dev->fw_heap_info.size, 0);
		if (err)
			goto err_unlock;
	} else {
		fw_obj->fw_mm_node.start = dev_addr;
		fw_obj->fw_mm_node.size = gem_obj->size;
		err = drm_mm_reserve_node(&fw_dev->fw_mm, &fw_obj->fw_mm_node);
		if (err)
			goto err_unlock;
	}

	spin_unlock(&fw_dev->fw_mm_lock);

	/* Map object on GPU. */
	err = fw_dev->defs->vm_map(pvr_dev, fw_obj);
	if (err)
		goto err_remove_node;

	fw_obj->fw_addr_offset = (u32)(fw_obj->fw_mm_node.start - fw_dev->fw_mm_base);

	return 0;

err_remove_node:
	spin_lock(&fw_dev->fw_mm_lock);
	drm_mm_remove_node(&fw_obj->fw_mm_node);

err_unlock:
	spin_unlock(&fw_dev->fw_mm_lock);

	return err;
}

/**
 * pvr_fw_object_fw_unmap() - Unmap a previously mapped FW object
 * @fw_obj: FW object to unmap.
 *
 * Returns:
 *  * 0 on success, or
 *  * -%EINVAL if object is not currently mapped.
 */
static int
pvr_fw_object_fw_unmap(struct pvr_fw_object *fw_obj)
{
	struct pvr_gem_object *pvr_obj = fw_obj->gem;
	struct drm_gem_object *gem_obj = gem_from_pvr_gem(pvr_obj);
	struct pvr_device *pvr_dev = to_pvr_device(gem_obj->dev);
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;

	fw_dev->defs->vm_unmap(pvr_dev, fw_obj);

	spin_lock(&fw_dev->fw_mm_lock);

	if (!drm_mm_node_allocated(&fw_obj->fw_mm_node)) {
		spin_unlock(&fw_dev->fw_mm_lock);
		return -EINVAL;
	}

	drm_mm_remove_node(&fw_obj->fw_mm_node);

	spin_unlock(&fw_dev->fw_mm_lock);

	return 0;
}

static void *
pvr_fw_object_create_and_map_common(struct pvr_device *pvr_dev, size_t size,
				    u64 flags, u64 dev_addr,
				    void (*init)(void *cpu_ptr, void *priv),
				    void *init_priv, struct pvr_fw_object **fw_obj_out)
{
	struct pvr_fw_object *fw_obj;
	void *cpu_ptr;
	int err;

	/* %DRM_PVR_BO_PM_FW_PROTECT is implicit for FW objects. */
	flags |= DRM_PVR_BO_PM_FW_PROTECT;

	fw_obj = kzalloc(sizeof(*fw_obj), GFP_KERNEL);
	if (!fw_obj)
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&fw_obj->node);
	fw_obj->init = init;
	fw_obj->init_priv = init_priv;

	fw_obj->gem = pvr_gem_object_create(pvr_dev, size, flags);
	if (IS_ERR(fw_obj->gem)) {
		err = PTR_ERR(fw_obj->gem);
		fw_obj->gem = NULL;
		goto err_put_object;
	}

	err = pvr_fw_object_fw_map(pvr_dev, fw_obj, dev_addr);
	if (err)
		goto err_put_object;

	cpu_ptr = pvr_fw_object_vmap(fw_obj);
	if (IS_ERR(cpu_ptr)) {
		err = PTR_ERR(cpu_ptr);
		goto err_put_object;
	}

	*fw_obj_out = fw_obj;

	if (fw_obj->init)
		fw_obj->init(cpu_ptr, fw_obj->init_priv);

	mutex_lock(&pvr_dev->fw_dev.fw_objs.lock);
	list_add_tail(&fw_obj->node, &pvr_dev->fw_dev.fw_objs.list);
	mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock);

	return cpu_ptr;

err_put_object:
	pvr_fw_object_destroy(fw_obj);

	return ERR_PTR(err);
}

/**
 * pvr_fw_object_create() - Create a FW object and map to firmware
 * @pvr_dev: PowerVR device pointer.
 * @size: Size of object, in bytes.
 * @flags: Options which affect both this operation and future mapping
 * operations performed on the returned object. Must be a combination of
 * DRM_PVR_BO_* and/or PVR_BO_* flags.
 * @init: Initialisation callback.
 * @init_priv: Private pointer to pass to initialisation callback.
 * @fw_obj_out: Pointer to location to store created object pointer.
 *
 * %DRM_PVR_BO_DEVICE_PM_FW_PROTECT is implied for all FW objects. Consequently,
 * this function will fail if @flags has %DRM_PVR_BO_CPU_ALLOW_USERSPACE_ACCESS
 * set.
 *
 * Returns:
 *  * 0 on success, or
 *  * Any error returned by pvr_fw_object_create_common().
 */
int
pvr_fw_object_create(struct pvr_device *pvr_dev, size_t size, u64 flags,
		     void (*init)(void *cpu_ptr, void *priv), void *init_priv,
		     struct pvr_fw_object **fw_obj_out)
{
	void *cpu_ptr;

	cpu_ptr = pvr_fw_object_create_and_map_common(pvr_dev, size, flags, 0, init, init_priv,
						      fw_obj_out);
	if (IS_ERR(cpu_ptr))
		return PTR_ERR(cpu_ptr);

	pvr_fw_object_vunmap(*fw_obj_out);

	return 0;
}

/**
 * pvr_fw_object_create_and_map() - Create a FW object and map to firmware and CPU
 * @pvr_dev: PowerVR device pointer.
 * @size: Size of object, in bytes.
 * @flags: Options which affect both this operation and future mapping
 * operations performed on the returned object. Must be a combination of
 * DRM_PVR_BO_* and/or PVR_BO_* flags.
 * @init: Initialisation callback.
 * @init_priv: Private pointer to pass to initialisation callback.
 * @fw_obj_out: Pointer to location to store created object pointer.
 *
 * %DRM_PVR_BO_DEVICE_PM_FW_PROTECT is implied for all FW objects. Consequently,
 * this function will fail if @flags has %DRM_PVR_BO_CPU_ALLOW_USERSPACE_ACCESS
 * set.
 *
 * Caller is responsible for calling pvr_fw_object_vunmap() to release the CPU
 * mapping.
 *
 * Returns:
 *  * Pointer to CPU mapping of newly created object, or
 *  * Any error returned by pvr_fw_object_create(), or
 *  * Any error returned by pvr_fw_object_vmap().
 */
void *
pvr_fw_object_create_and_map(struct pvr_device *pvr_dev, size_t size, u64 flags,
			     void (*init)(void *cpu_ptr, void *priv),
			     void *init_priv, struct pvr_fw_object **fw_obj_out)
{
	return pvr_fw_object_create_and_map_common(pvr_dev, size, flags, 0, init, init_priv,
						   fw_obj_out);
}

/**
 * pvr_fw_object_create_and_map_offset() - Create a FW object and map to
 * firmware at the provided offset and to the CPU.
 * @pvr_dev: PowerVR device pointer.
 * @dev_offset: Base address of desired FW mapping, offset from start of FW heap.
 * @size: Size of object, in bytes.
 * @flags: Options which affect both this operation and future mapping
 * operations performed on the returned object. Must be a combination of
 * DRM_PVR_BO_* and/or PVR_BO_* flags.
 * @init: Initialisation callback.
 * @init_priv: Private pointer to pass to initialisation callback.
 * @fw_obj_out: Pointer to location to store created object pointer.
 *
 * %DRM_PVR_BO_DEVICE_PM_FW_PROTECT is implied for all FW objects. Consequently,
 * this function will fail if @flags has %DRM_PVR_BO_CPU_ALLOW_USERSPACE_ACCESS
 * set.
 *
 * Caller is responsible for calling pvr_fw_object_vunmap() to release the CPU
 * mapping.
 *
 * Returns:
 *  * Pointer to CPU mapping of newly created object, or
 *  * Any error returned by pvr_fw_object_create(), or
 *  * Any error returned by pvr_fw_object_vmap().
 */
void *
pvr_fw_object_create_and_map_offset(struct pvr_device *pvr_dev,
				    u32 dev_offset, size_t size, u64 flags,
				    void (*init)(void *cpu_ptr, void *priv),
				    void *init_priv, struct pvr_fw_object **fw_obj_out)
{
	u64 dev_addr = pvr_dev->fw_dev.fw_mm_base + dev_offset;

	return pvr_fw_object_create_and_map_common(pvr_dev, size, flags, dev_addr, init, init_priv,
						   fw_obj_out);
}

/**
 * pvr_fw_object_destroy() - Destroy a pvr_fw_object
 * @fw_obj: Pointer to object to destroy.
 */
void pvr_fw_object_destroy(struct pvr_fw_object *fw_obj)
{
	struct pvr_gem_object *pvr_obj = fw_obj->gem;
	struct drm_gem_object *gem_obj = gem_from_pvr_gem(pvr_obj);
	struct pvr_device *pvr_dev = to_pvr_device(gem_obj->dev);

	mutex_lock(&pvr_dev->fw_dev.fw_objs.lock);
	list_del(&fw_obj->node);
	mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock);

	if (drm_mm_node_allocated(&fw_obj->fw_mm_node)) {
		/* If we can't unmap, leak the memory. */
		if (WARN_ON(pvr_fw_object_fw_unmap(fw_obj)))
			return;
	}

	if (fw_obj->gem)
		pvr_gem_object_put(fw_obj->gem);

	kfree(fw_obj);
}

/**
 * pvr_fw_object_get_fw_addr_offset() - Return address of object in firmware address space, with
 * given offset.
 * @fw_obj: Pointer to object.
 * @offset: Desired offset from start of object.
 * @fw_addr_out: Location to store address to.
 */
void pvr_fw_object_get_fw_addr_offset(struct pvr_fw_object *fw_obj, u32 offset, u32 *fw_addr_out)
{
	struct pvr_gem_object *pvr_obj = fw_obj->gem;
	struct pvr_device *pvr_dev = to_pvr_device(gem_from_pvr_gem(pvr_obj)->dev);

	*fw_addr_out = pvr_dev->fw_dev.defs->get_fw_addr_with_offset(fw_obj, offset);
}

u64
pvr_fw_obj_get_gpu_addr(struct pvr_fw_object *fw_obj)
{
	struct pvr_device *pvr_dev = to_pvr_device(gem_from_pvr_gem(fw_obj->gem)->dev);
	struct pvr_fw_device *fw_dev = &pvr_dev->fw_dev;

	return fw_dev->fw_heap_info.gpu_addr + fw_obj->fw_addr_offset;
}

/*
 * pvr_fw_hard_reset() - Re-initialise the FW code and data segments, and reset all global FW
 *                       structures
 * @pvr_dev: Device pointer
 *
 * If this function returns an error then the caller must regard the device as lost.
 *
 * Returns:
 *  * 0 on success, or
 *  * Any error returned by pvr_fw_init_dev_structures() or pvr_fw_reset_all().
 */
int
pvr_fw_hard_reset(struct pvr_device *pvr_dev)
{
	struct list_head *pos;
	int err;

	/* Reset all FW objects */
	mutex_lock(&pvr_dev->fw_dev.fw_objs.lock);

	list_for_each(pos, &pvr_dev->fw_dev.fw_objs.list) {
		struct pvr_fw_object *fw_obj = container_of(pos, struct pvr_fw_object, node);
		void *cpu_ptr = pvr_fw_object_vmap(fw_obj);

		WARN_ON(IS_ERR(cpu_ptr));

		if (!(fw_obj->gem->flags & PVR_BO_FW_NO_CLEAR_ON_RESET)) {
			memset(cpu_ptr, 0, pvr_gem_object_size(fw_obj->gem));

			if (fw_obj->init)
				fw_obj->init(cpu_ptr, fw_obj->init_priv);
		}

		pvr_fw_object_vunmap(fw_obj);
	}

	mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock);

	err = pvr_fw_reinit_code_data(pvr_dev);
	if (err)
		return err;

	return 0;
}