xref: /linux/drivers/gpu/drm/panthor/panthor_fw.c (revision 3d2452c2fb2fe37d8b1eb5b814561e71eb8652f3)
1 // SPDX-License-Identifier: GPL-2.0 or MIT
2 /* Copyright 2023 Collabora ltd. */
3 
4 #ifdef CONFIG_ARM_ARCH_TIMER
5 #include <asm/arch_timer.h>
6 #endif
7 
8 #include <linux/clk.h>
9 #include <linux/dma-mapping.h>
10 #include <linux/firmware.h>
11 #include <linux/iopoll.h>
12 #include <linux/iosys-map.h>
13 #include <linux/mutex.h>
14 #include <linux/platform_device.h>
15 #include <linux/pm_runtime.h>
16 
17 #include <drm/drm_drv.h>
18 #include <drm/drm_managed.h>
19 #include <drm/drm_print.h>
20 
21 #include "panthor_device.h"
22 #include "panthor_fw.h"
23 #include "panthor_fw_regs.h"
24 #include "panthor_gem.h"
25 #include "panthor_gpu.h"
26 #include "panthor_hw.h"
27 #include "panthor_mmu.h"
28 #include "panthor_sched.h"
29 #include "panthor_trace.h"
30 
31 #define CSF_FW_NAME "mali_csffw.bin"
32 
33 #define PING_INTERVAL_MS			12000
34 #define PROGRESS_TIMEOUT_CYCLES			(5ull * 500 * 1024 * 1024)
35 #define PROGRESS_TIMEOUT_SCALE_SHIFT		10
36 #define IDLE_HYSTERESIS_US			800
37 #define PWROFF_HYSTERESIS_US			10000
38 #define MCU_HALT_TIMEOUT_US			(1ULL * USEC_PER_SEC)
39 
40 /**
41  * struct panthor_fw_binary_hdr - Firmware binary header.
42  */
43 struct panthor_fw_binary_hdr {
44 	/** @magic: Magic value to check binary validity. */
45 	u32 magic;
46 #define CSF_FW_BINARY_HEADER_MAGIC		0xc3f13a6e
47 
48 	/** @minor: Minor FW version. */
49 	u8 minor;
50 
51 	/** @major: Major FW version. */
52 	u8 major;
53 #define CSF_FW_BINARY_HEADER_MAJOR_MAX		0
54 
55 	/** @padding1: MBZ. */
56 	u16 padding1;
57 
58 	/** @version_hash: FW version hash. */
59 	u32 version_hash;
60 
61 	/** @padding2: MBZ. */
62 	u32 padding2;
63 
64 	/** @size: FW binary size. */
65 	u32 size;
66 };
67 
68 /**
69  * enum panthor_fw_binary_entry_type - Firmware binary entry type
70  */
71 enum panthor_fw_binary_entry_type {
72 	/** @CSF_FW_BINARY_ENTRY_TYPE_IFACE: Host <-> FW interface. */
73 	CSF_FW_BINARY_ENTRY_TYPE_IFACE = 0,
74 
75 	/** @CSF_FW_BINARY_ENTRY_TYPE_CONFIG: FW config. */
76 	CSF_FW_BINARY_ENTRY_TYPE_CONFIG = 1,
77 
78 	/** @CSF_FW_BINARY_ENTRY_TYPE_FUTF_TEST: Unit-tests. */
79 	CSF_FW_BINARY_ENTRY_TYPE_FUTF_TEST = 2,
80 
81 	/** @CSF_FW_BINARY_ENTRY_TYPE_TRACE_BUFFER: Trace buffer interface. */
82 	CSF_FW_BINARY_ENTRY_TYPE_TRACE_BUFFER = 3,
83 
84 	/** @CSF_FW_BINARY_ENTRY_TYPE_TIMELINE_METADATA: Timeline metadata interface. */
85 	CSF_FW_BINARY_ENTRY_TYPE_TIMELINE_METADATA = 4,
86 
87 	/**
88 	 * @CSF_FW_BINARY_ENTRY_TYPE_BUILD_INFO_METADATA: Metadata about how
89 	 * the FW binary was built.
90 	 */
91 	CSF_FW_BINARY_ENTRY_TYPE_BUILD_INFO_METADATA = 6
92 };
93 
94 #define CSF_FW_BINARY_ENTRY_TYPE(ehdr)					((ehdr) & 0xff)
95 #define CSF_FW_BINARY_ENTRY_SIZE(ehdr)					(((ehdr) >> 8) & 0xff)
96 #define CSF_FW_BINARY_ENTRY_UPDATE					BIT(30)
97 #define CSF_FW_BINARY_ENTRY_OPTIONAL					BIT(31)
98 
99 #define CSF_FW_BINARY_IFACE_ENTRY_RD					BIT(0)
100 #define CSF_FW_BINARY_IFACE_ENTRY_WR					BIT(1)
101 #define CSF_FW_BINARY_IFACE_ENTRY_EX					BIT(2)
102 #define CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_NONE			(0 << 3)
103 #define CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_CACHED			(1 << 3)
104 #define CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_UNCACHED_COHERENT		(2 << 3)
105 #define CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_CACHED_COHERENT		(3 << 3)
106 #define CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_MASK			GENMASK(4, 3)
107 #define CSF_FW_BINARY_IFACE_ENTRY_PROT					BIT(5)
108 #define CSF_FW_BINARY_IFACE_ENTRY_SHARED				BIT(30)
109 #define CSF_FW_BINARY_IFACE_ENTRY_ZERO					BIT(31)
110 
111 #define CSF_FW_BINARY_IFACE_ENTRY_SUPPORTED_FLAGS			\
112 	(CSF_FW_BINARY_IFACE_ENTRY_RD |					\
113 	 CSF_FW_BINARY_IFACE_ENTRY_WR |					\
114 	 CSF_FW_BINARY_IFACE_ENTRY_EX |					\
115 	 CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_MASK |			\
116 	 CSF_FW_BINARY_IFACE_ENTRY_PROT |				\
117 	 CSF_FW_BINARY_IFACE_ENTRY_SHARED  |				\
118 	 CSF_FW_BINARY_IFACE_ENTRY_ZERO)
119 
120 /**
121  * struct panthor_fw_binary_section_entry_hdr - Describes a section of FW binary
122  */
123 struct panthor_fw_binary_section_entry_hdr {
124 	/** @flags: Section flags. */
125 	u32 flags;
126 
127 	/** @va: MCU virtual range to map this binary section to. */
128 	struct {
129 		/** @start: Start address. */
130 		u32 start;
131 
132 		/** @end: End address. */
133 		u32 end;
134 	} va;
135 
136 	/** @data: Data to initialize the FW section with. */
137 	struct {
138 		/** @start: Start offset in the FW binary. */
139 		u32 start;
140 
141 		/** @end: End offset in the FW binary. */
142 		u32 end;
143 	} data;
144 };
145 
146 struct panthor_fw_build_info_hdr {
147 	/** @meta_start: Offset of the build info data in the FW binary */
148 	u32 meta_start;
149 	/** @meta_size: Size of the build info data in the FW binary */
150 	u32 meta_size;
151 };
152 
153 /**
154  * struct panthor_fw_binary_iter - Firmware binary iterator
155  *
156  * Used to parse a firmware binary.
157  */
158 struct panthor_fw_binary_iter {
159 	/** @data: FW binary data. */
160 	const void *data;
161 
162 	/** @size: FW binary size. */
163 	size_t size;
164 
165 	/** @offset: Iterator offset. */
166 	size_t offset;
167 };
168 
169 /**
170  * struct panthor_fw_section - FW section
171  */
172 struct panthor_fw_section {
173 	/** @node: Used to keep track of FW sections. */
174 	struct list_head node;
175 
176 	/** @flags: Section flags, as encoded in the FW binary. */
177 	u32 flags;
178 
179 	/** @mem: Section memory. */
180 	struct panthor_kernel_bo *mem;
181 
182 	/**
183 	 * @name: Name of the section, as specified in the binary.
184 	 *
185 	 * Can be NULL.
186 	 */
187 	const char *name;
188 
189 	/**
190 	 * @data: Initial data copied to the FW memory.
191 	 *
192 	 * We keep data around so we can reload sections after a reset.
193 	 */
194 	struct {
195 		/** @buf: Buffed used to store init data. */
196 		const void *buf;
197 
198 		/** @size: Size of @buf in bytes. */
199 		size_t size;
200 	} data;
201 };
202 
203 #define CSF_MCU_SHARED_REGION_START		0x04000000ULL
204 #define CSF_MCU_SHARED_REGION_SIZE		0x04000000ULL
205 
206 #define MIN_CS_PER_CSG				8
207 #define MIN_CSGS				3
208 
209 #define CSF_IFACE_VERSION(major, minor, patch)	\
210 	(((major) << 24) | ((minor) << 16) | (patch))
211 #define CSF_IFACE_VERSION_MAJOR(v)		((v) >> 24)
212 #define CSF_IFACE_VERSION_MINOR(v)		(((v) >> 16) & 0xff)
213 #define CSF_IFACE_VERSION_PATCH(v)		((v) & 0xffff)
214 
215 #define CSF_GROUP_CONTROL_OFFSET		0x1000
216 #define CSF_STREAM_CONTROL_OFFSET		0x40
217 #define CSF_UNPRESERVED_REG_COUNT		4
218 
219 /**
220  * struct panthor_fw_iface - FW interfaces
221  */
222 struct panthor_fw_iface {
223 	/** @global: Global interface. */
224 	struct panthor_fw_global_iface global;
225 
226 	/** @groups: Group slot interfaces. */
227 	struct panthor_fw_csg_iface groups[MAX_CSGS];
228 
229 	/** @streams: Command stream slot interfaces. */
230 	struct panthor_fw_cs_iface streams[MAX_CSGS][MAX_CS_PER_CSG];
231 };
232 
233 /**
234  * struct panthor_fw - Firmware management
235  */
236 struct panthor_fw {
237 	/** @iomem: CPU mapping of MCU_CONTROL iomem region */
238 	void __iomem *iomem;
239 
240 	/** @vm: MCU VM. */
241 	struct panthor_vm *vm;
242 
243 	/** @sections: List of FW sections. */
244 	struct list_head sections;
245 
246 	/** @shared_section: The section containing the FW interfaces. */
247 	struct panthor_fw_section *shared_section;
248 
249 	/** @iface: FW interfaces. */
250 	struct panthor_fw_iface iface;
251 
252 	/** @watchdog: Collection of fields relating to the FW watchdog. */
253 	struct {
254 		/** @ping_work: Delayed work used to ping the FW. */
255 		struct delayed_work ping_work;
256 	} watchdog;
257 
258 	/**
259 	 * @req_waitqueue: FW request waitqueue.
260 	 *
261 	 * Everytime a request is sent to a command stream group or the global
262 	 * interface, the caller will first busy wait for the request to be
263 	 * acknowledged, and then fallback to a sleeping wait.
264 	 *
265 	 * This wait queue is here to support the sleeping wait flavor.
266 	 */
267 	wait_queue_head_t req_waitqueue;
268 
269 	/** @booted: True is the FW is booted */
270 	bool booted;
271 
272 	/** @irq: Job irq data. */
273 	struct panthor_irq irq;
274 };
275 
276 struct panthor_vm *panthor_fw_vm(struct panthor_device *ptdev)
277 {
278 	return ptdev->fw->vm;
279 }
280 
281 /**
282  * panthor_fw_get_glb_iface() - Get the global interface
283  * @ptdev: Device.
284  *
285  * Return: The global interface.
286  */
287 struct panthor_fw_global_iface *
288 panthor_fw_get_glb_iface(struct panthor_device *ptdev)
289 {
290 	return &ptdev->fw->iface.global;
291 }
292 
293 /**
294  * panthor_fw_get_csg_iface() - Get a command stream group slot interface
295  * @ptdev: Device.
296  * @csg_slot: Index of the command stream group slot.
297  *
298  * Return: The command stream group slot interface.
299  */
300 struct panthor_fw_csg_iface *
301 panthor_fw_get_csg_iface(struct panthor_device *ptdev, u32 csg_slot)
302 {
303 	if (drm_WARN_ON(&ptdev->base, csg_slot >= MAX_CSGS))
304 		return NULL;
305 
306 	return &ptdev->fw->iface.groups[csg_slot];
307 }
308 
309 /**
310  * panthor_fw_get_cs_iface() - Get a command stream slot interface
311  * @ptdev: Device.
312  * @csg_slot: Index of the command stream group slot.
313  * @cs_slot: Index of the command stream slot.
314  *
315  * Return: The command stream slot interface.
316  */
317 struct panthor_fw_cs_iface *
318 panthor_fw_get_cs_iface(struct panthor_device *ptdev, u32 csg_slot, u32 cs_slot)
319 {
320 	if (drm_WARN_ON(&ptdev->base, csg_slot >= MAX_CSGS || cs_slot >= MAX_CS_PER_CSG))
321 		return NULL;
322 
323 	return &ptdev->fw->iface.streams[csg_slot][cs_slot];
324 }
325 
326 static bool panthor_fw_has_glb_state(struct panthor_device *ptdev)
327 {
328 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
329 
330 	return glb_iface->control->version >= CSF_IFACE_VERSION(4, 1, 0);
331 }
332 
333 static bool panthor_fw_has_64bit_ep_req(struct panthor_device *ptdev)
334 {
335 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
336 
337 	return glb_iface->control->version >= CSF_IFACE_VERSION(4, 0, 0);
338 }
339 
340 u64 panthor_fw_csg_endpoint_req_get(struct panthor_device *ptdev,
341 				    struct panthor_fw_csg_iface *csg_iface)
342 {
343 	if (panthor_fw_has_64bit_ep_req(ptdev))
344 		return csg_iface->input->endpoint_req2;
345 	else
346 		return csg_iface->input->endpoint_req;
347 }
348 
349 void panthor_fw_csg_endpoint_req_set(struct panthor_device *ptdev,
350 				     struct panthor_fw_csg_iface *csg_iface, u64 value)
351 {
352 	if (panthor_fw_has_64bit_ep_req(ptdev))
353 		csg_iface->input->endpoint_req2 = value;
354 	else
355 		csg_iface->input->endpoint_req = lower_32_bits(value);
356 }
357 
358 void panthor_fw_csg_endpoint_req_update(struct panthor_device *ptdev,
359 					struct panthor_fw_csg_iface *csg_iface, u64 value,
360 					u64 mask)
361 {
362 	if (panthor_fw_has_64bit_ep_req(ptdev))
363 		panthor_fw_update_reqs64(csg_iface, endpoint_req2, value, mask);
364 	else
365 		panthor_fw_update_reqs(csg_iface, endpoint_req, lower_32_bits(value),
366 				       lower_32_bits(mask));
367 }
368 
369 /**
370  * panthor_fw_conv_timeout() - Convert a timeout into a cycle-count
371  * @ptdev: Device.
372  * @timeout_us: Timeout expressed in micro-seconds.
373  *
374  * The FW has two timer sources: the GPU counter or arch-timer. We need
375  * to express timeouts in term of number of cycles and specify which
376  * timer source should be used.
377  *
378  * Return: A value suitable for timeout fields in the global interface.
379  */
380 static u32 panthor_fw_conv_timeout(struct panthor_device *ptdev, u32 timeout_us)
381 {
382 	bool use_cycle_counter = false;
383 	u32 timer_rate = 0;
384 	u64 mod_cycles;
385 
386 #ifdef CONFIG_ARM_ARCH_TIMER
387 	timer_rate = arch_timer_get_cntfrq();
388 #endif
389 
390 	if (!timer_rate) {
391 		use_cycle_counter = true;
392 		timer_rate = clk_get_rate(ptdev->clks.core);
393 	}
394 
395 	if (drm_WARN_ON(&ptdev->base, !timer_rate)) {
396 		/* We couldn't get a valid clock rate, let's just pick the
397 		 * maximum value so the FW still handles the core
398 		 * power on/off requests.
399 		 */
400 		return GLB_TIMER_VAL(~0) |
401 		       GLB_TIMER_SOURCE_GPU_COUNTER;
402 	}
403 
404 	mod_cycles = DIV_ROUND_UP_ULL((u64)timeout_us * timer_rate,
405 				      1000000ull << 10);
406 	if (drm_WARN_ON(&ptdev->base, mod_cycles > GLB_TIMER_VAL(~0)))
407 		mod_cycles = GLB_TIMER_VAL(~0);
408 
409 	return GLB_TIMER_VAL(mod_cycles) |
410 	       (use_cycle_counter ? GLB_TIMER_SOURCE_GPU_COUNTER : 0);
411 }
412 
413 static int panthor_fw_binary_iter_read(struct panthor_device *ptdev,
414 				       struct panthor_fw_binary_iter *iter,
415 				       void *out, size_t size)
416 {
417 	size_t new_offset = iter->offset + size;
418 
419 	if (new_offset > iter->size || new_offset < iter->offset) {
420 		drm_err(&ptdev->base, "Firmware too small\n");
421 		return -EINVAL;
422 	}
423 
424 	memcpy(out, iter->data + iter->offset, size);
425 	iter->offset = new_offset;
426 	return 0;
427 }
428 
429 static int panthor_fw_binary_sub_iter_init(struct panthor_device *ptdev,
430 					   struct panthor_fw_binary_iter *iter,
431 					   struct panthor_fw_binary_iter *sub_iter,
432 					   size_t size)
433 {
434 	size_t new_offset = iter->offset + size;
435 
436 	if (new_offset > iter->size || new_offset < iter->offset) {
437 		drm_err(&ptdev->base, "Firmware entry too long\n");
438 		return -EINVAL;
439 	}
440 
441 	sub_iter->offset = 0;
442 	sub_iter->data = iter->data + iter->offset;
443 	sub_iter->size = size;
444 	iter->offset = new_offset;
445 	return 0;
446 }
447 
448 static void panthor_fw_init_section_mem(struct panthor_device *ptdev,
449 					struct panthor_fw_section *section)
450 {
451 	bool was_mapped = !!section->mem->kmap;
452 	int ret;
453 
454 	if (!section->data.size &&
455 	    !(section->flags & CSF_FW_BINARY_IFACE_ENTRY_ZERO))
456 		return;
457 
458 	ret = panthor_kernel_bo_vmap(section->mem);
459 	if (drm_WARN_ON(&ptdev->base, ret))
460 		return;
461 
462 	memcpy(section->mem->kmap, section->data.buf, section->data.size);
463 	if (section->flags & CSF_FW_BINARY_IFACE_ENTRY_ZERO) {
464 		memset(section->mem->kmap + section->data.size, 0,
465 		       panthor_kernel_bo_size(section->mem) - section->data.size);
466 	}
467 
468 	if (!was_mapped)
469 		panthor_kernel_bo_vunmap(section->mem);
470 }
471 
472 /**
473  * panthor_fw_alloc_queue_iface_mem() - Allocate a ring-buffer interfaces.
474  * @ptdev: Device.
475  * @input: Pointer holding the input interface on success.
476  * Should be ignored on failure.
477  * @output: Pointer holding the output interface on success.
478  * Should be ignored on failure.
479  * @input_fw_va: Pointer holding the input interface FW VA on success.
480  * Should be ignored on failure.
481  * @output_fw_va: Pointer holding the output interface FW VA on success.
482  * Should be ignored on failure.
483  *
484  * Allocates panthor_fw_ringbuf_{input,out}_iface interfaces. The input
485  * interface is at offset 0, and the output interface at offset 4096.
486  *
487  * Return: A valid pointer in case of success, an ERR_PTR() otherwise.
488  */
489 struct panthor_kernel_bo *
490 panthor_fw_alloc_queue_iface_mem(struct panthor_device *ptdev,
491 				 struct panthor_fw_ringbuf_input_iface **input,
492 				 const struct panthor_fw_ringbuf_output_iface **output,
493 				 u32 *input_fw_va, u32 *output_fw_va)
494 {
495 	struct panthor_kernel_bo *mem;
496 	int ret;
497 
498 	mem = panthor_kernel_bo_create(ptdev, ptdev->fw->vm, SZ_8K,
499 				       DRM_PANTHOR_BO_NO_MMAP,
500 				       DRM_PANTHOR_VM_BIND_OP_MAP_NOEXEC |
501 				       DRM_PANTHOR_VM_BIND_OP_MAP_UNCACHED,
502 				       PANTHOR_VM_KERNEL_AUTO_VA,
503 				       "Queue FW interface");
504 	if (IS_ERR(mem))
505 		return mem;
506 
507 	ret = panthor_kernel_bo_vmap(mem);
508 	if (ret) {
509 		panthor_kernel_bo_destroy(mem);
510 		return ERR_PTR(ret);
511 	}
512 
513 	memset(mem->kmap, 0, panthor_kernel_bo_size(mem));
514 	*input = mem->kmap;
515 	*output = mem->kmap + SZ_4K;
516 	*input_fw_va = panthor_kernel_bo_gpuva(mem);
517 	*output_fw_va = *input_fw_va + SZ_4K;
518 
519 	return mem;
520 }
521 
522 /**
523  * panthor_fw_alloc_suspend_buf_mem() - Allocate a suspend buffer for a command stream group.
524  * @ptdev: Device.
525  * @size: Size of the suspend buffer.
526  *
527  * Return: A valid pointer in case of success, an ERR_PTR() otherwise.
528  */
529 struct panthor_kernel_bo *
530 panthor_fw_alloc_suspend_buf_mem(struct panthor_device *ptdev, size_t size)
531 {
532 	return panthor_kernel_bo_create(ptdev, panthor_fw_vm(ptdev), size,
533 					DRM_PANTHOR_BO_NO_MMAP,
534 					DRM_PANTHOR_VM_BIND_OP_MAP_NOEXEC,
535 					PANTHOR_VM_KERNEL_AUTO_VA,
536 					"FW suspend buffer");
537 }
538 
539 static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
540 					 const struct firmware *fw,
541 					 struct panthor_fw_binary_iter *iter,
542 					 u32 ehdr)
543 {
544 	ssize_t vm_pgsz = panthor_vm_page_size(ptdev->fw->vm);
545 	struct panthor_fw_binary_section_entry_hdr hdr;
546 	struct panthor_fw_section *section;
547 	u32 section_size;
548 	u32 data_size;
549 	u32 name_len;
550 	int ret;
551 
552 	ret = panthor_fw_binary_iter_read(ptdev, iter, &hdr, sizeof(hdr));
553 	if (ret)
554 		return ret;
555 
556 	if (hdr.data.end < hdr.data.start) {
557 		drm_err(&ptdev->base, "Firmware corrupted, data.end < data.start (0x%x < 0x%x)\n",
558 			hdr.data.end, hdr.data.start);
559 		return -EINVAL;
560 	}
561 
562 	if (hdr.va.end < hdr.va.start) {
563 		drm_err(&ptdev->base, "Firmware corrupted, hdr.va.end < hdr.va.start (0x%x < 0x%x)\n",
564 			hdr.va.end, hdr.va.start);
565 		return -EINVAL;
566 	}
567 
568 	if (hdr.data.end > fw->size) {
569 		drm_err(&ptdev->base, "Firmware corrupted, file truncated? data_end=0x%x > fw size=0x%zx\n",
570 			hdr.data.end, fw->size);
571 		return -EINVAL;
572 	}
573 
574 	if (!IS_ALIGNED(hdr.va.start, vm_pgsz) || !IS_ALIGNED(hdr.va.end, vm_pgsz)) {
575 		drm_err(&ptdev->base, "Firmware corrupted, virtual addresses not page aligned: 0x%x-0x%x\n",
576 			hdr.va.start, hdr.va.end);
577 		return -EINVAL;
578 	}
579 
580 	if (hdr.flags & ~CSF_FW_BINARY_IFACE_ENTRY_SUPPORTED_FLAGS) {
581 		drm_err(&ptdev->base, "Firmware contains interface with unsupported flags (0x%x)\n",
582 			hdr.flags);
583 		return -EINVAL;
584 	}
585 
586 	if (hdr.flags & CSF_FW_BINARY_IFACE_ENTRY_PROT) {
587 		drm_warn(&ptdev->base,
588 			 "Firmware protected mode entry is not supported, ignoring");
589 		return 0;
590 	}
591 
592 	if (hdr.va.start == CSF_MCU_SHARED_REGION_START &&
593 	    !(hdr.flags & CSF_FW_BINARY_IFACE_ENTRY_SHARED)) {
594 		drm_err(&ptdev->base,
595 			"Interface at 0x%llx must be shared", CSF_MCU_SHARED_REGION_START);
596 		return -EINVAL;
597 	}
598 
599 	section_size = hdr.va.end - hdr.va.start;
600 	data_size = hdr.data.end - hdr.data.start;
601 	if (data_size > section_size) {
602 		drm_err(&ptdev->base, "Firmware corrupted, section data exceeds section size\n");
603 		return -EINVAL;
604 	}
605 
606 	name_len = iter->size - iter->offset;
607 
608 	section = drmm_kzalloc(&ptdev->base, sizeof(*section), GFP_KERNEL);
609 	if (!section)
610 		return -ENOMEM;
611 
612 	list_add_tail(&section->node, &ptdev->fw->sections);
613 	section->flags = hdr.flags;
614 	section->data.size = data_size;
615 
616 	if (section->data.size > 0) {
617 		void *data = drmm_kmalloc(&ptdev->base, section->data.size, GFP_KERNEL);
618 
619 		if (!data)
620 			return -ENOMEM;
621 
622 		memcpy(data, fw->data + hdr.data.start, section->data.size);
623 		section->data.buf = data;
624 	}
625 
626 	if (name_len > 0) {
627 		char *name = drmm_kmalloc(&ptdev->base, name_len + 1, GFP_KERNEL);
628 
629 		if (!name)
630 			return -ENOMEM;
631 
632 		memcpy(name, iter->data + iter->offset, name_len);
633 		name[name_len] = '\0';
634 		section->name = name;
635 	}
636 
637 	if (section_size) {
638 		u32 cache_mode = hdr.flags & CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_MASK;
639 		struct panthor_gem_object *bo;
640 		u32 vm_map_flags = 0;
641 		u64 va = hdr.va.start;
642 
643 		if (!(hdr.flags & CSF_FW_BINARY_IFACE_ENTRY_WR))
644 			vm_map_flags |= DRM_PANTHOR_VM_BIND_OP_MAP_READONLY;
645 
646 		if (!(hdr.flags & CSF_FW_BINARY_IFACE_ENTRY_EX))
647 			vm_map_flags |= DRM_PANTHOR_VM_BIND_OP_MAP_NOEXEC;
648 
649 		/* TODO: CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_*_COHERENT are mapped to
650 		 * non-cacheable for now. We might want to introduce a new
651 		 * IOMMU_xxx flag (or abuse IOMMU_MMIO, which maps to device
652 		 * memory and is currently not used by our driver) for
653 		 * AS_MEMATTR_AARCH64_SHARED memory, so we can take benefit
654 		 * of IO-coherent systems.
655 		 */
656 		if (cache_mode != CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_CACHED)
657 			vm_map_flags |= DRM_PANTHOR_VM_BIND_OP_MAP_UNCACHED;
658 
659 		section->mem = panthor_kernel_bo_create(ptdev, panthor_fw_vm(ptdev),
660 							section_size,
661 							DRM_PANTHOR_BO_NO_MMAP,
662 							vm_map_flags, va, "FW section");
663 		if (IS_ERR(section->mem))
664 			return PTR_ERR(section->mem);
665 
666 		if (drm_WARN_ON(&ptdev->base, section->mem->va_node.start != hdr.va.start))
667 			return -EINVAL;
668 
669 		if (section->flags & CSF_FW_BINARY_IFACE_ENTRY_SHARED) {
670 			ret = panthor_kernel_bo_vmap(section->mem);
671 			if (ret)
672 				return ret;
673 		}
674 
675 		panthor_fw_init_section_mem(ptdev, section);
676 
677 		bo = to_panthor_bo(section->mem->obj);
678 
679 		/* An sgt should have been requested when the kernel BO was GPU-mapped. */
680 		if (drm_WARN_ON_ONCE(&ptdev->base, !bo->dmap.sgt))
681 			return -EINVAL;
682 
683 		dma_sync_sgtable_for_device(ptdev->base.dev, bo->dmap.sgt, DMA_TO_DEVICE);
684 	}
685 
686 	if (hdr.va.start == CSF_MCU_SHARED_REGION_START)
687 		ptdev->fw->shared_section = section;
688 
689 	return 0;
690 }
691 
692 static int panthor_fw_read_build_info(struct panthor_device *ptdev,
693 				      const struct firmware *fw,
694 				      struct panthor_fw_binary_iter *iter,
695 				      u32 ehdr)
696 {
697 	struct panthor_fw_build_info_hdr hdr;
698 	static const char git_sha_header[] = "git_sha: ";
699 	const int header_len = sizeof(git_sha_header) - 1;
700 	int ret;
701 
702 	ret = panthor_fw_binary_iter_read(ptdev, iter, &hdr, sizeof(hdr));
703 	if (ret)
704 		return ret;
705 
706 	if (hdr.meta_start > fw->size ||
707 	    hdr.meta_start + hdr.meta_size > fw->size) {
708 		drm_err(&ptdev->base, "Firmware build info corrupt\n");
709 		/* We don't need the build info, so continue */
710 		return 0;
711 	}
712 
713 	if (memcmp(git_sha_header, fw->data + hdr.meta_start, header_len)) {
714 		/* Not the expected header, this isn't metadata we understand */
715 		return 0;
716 	}
717 
718 	/* Check that the git SHA is NULL terminated as expected */
719 	if (fw->data[hdr.meta_start + hdr.meta_size - 1] != '\0') {
720 		drm_warn(&ptdev->base, "Firmware's git sha is not NULL terminated\n");
721 		/* Don't treat as fatal */
722 		return 0;
723 	}
724 
725 	drm_info(&ptdev->base, "Firmware git sha: %s\n",
726 		 fw->data + hdr.meta_start + header_len);
727 
728 	return 0;
729 }
730 
731 static void
732 panthor_reload_fw_sections(struct panthor_device *ptdev, bool full_reload)
733 {
734 	struct panthor_fw_section *section;
735 
736 	list_for_each_entry(section, &ptdev->fw->sections, node) {
737 		struct sg_table *sgt;
738 
739 		if (!full_reload && !(section->flags & CSF_FW_BINARY_IFACE_ENTRY_WR))
740 			continue;
741 
742 		panthor_fw_init_section_mem(ptdev, section);
743 
744 		/* An sgt should have been requested when the kernel BO was GPU-mapped. */
745 		sgt = to_panthor_bo(section->mem->obj)->dmap.sgt;
746 		if (!drm_WARN_ON_ONCE(&ptdev->base, !sgt))
747 			dma_sync_sgtable_for_device(ptdev->base.dev, sgt, DMA_TO_DEVICE);
748 	}
749 }
750 
751 static int panthor_fw_load_entry(struct panthor_device *ptdev,
752 				 const struct firmware *fw,
753 				 struct panthor_fw_binary_iter *iter)
754 {
755 	struct panthor_fw_binary_iter eiter;
756 	u32 ehdr;
757 	int ret;
758 
759 	ret = panthor_fw_binary_iter_read(ptdev, iter, &ehdr, sizeof(ehdr));
760 	if (ret)
761 		return ret;
762 
763 	if ((iter->offset % sizeof(u32)) ||
764 	    (CSF_FW_BINARY_ENTRY_SIZE(ehdr) % sizeof(u32))) {
765 		drm_err(&ptdev->base, "Firmware entry is not 32-bit aligned, offset=0x%x size=0x%x\n",
766 			(u32)(iter->offset - sizeof(u32)), CSF_FW_BINARY_ENTRY_SIZE(ehdr));
767 		return -EINVAL;
768 	}
769 
770 	if (panthor_fw_binary_sub_iter_init(ptdev, iter, &eiter,
771 					    CSF_FW_BINARY_ENTRY_SIZE(ehdr) - sizeof(ehdr)))
772 		return -EINVAL;
773 
774 	switch (CSF_FW_BINARY_ENTRY_TYPE(ehdr)) {
775 	case CSF_FW_BINARY_ENTRY_TYPE_IFACE:
776 		return panthor_fw_load_section_entry(ptdev, fw, &eiter, ehdr);
777 	case CSF_FW_BINARY_ENTRY_TYPE_BUILD_INFO_METADATA:
778 		return panthor_fw_read_build_info(ptdev, fw, &eiter, ehdr);
779 
780 	/* FIXME: handle those entry types? */
781 	case CSF_FW_BINARY_ENTRY_TYPE_CONFIG:
782 	case CSF_FW_BINARY_ENTRY_TYPE_FUTF_TEST:
783 	case CSF_FW_BINARY_ENTRY_TYPE_TRACE_BUFFER:
784 	case CSF_FW_BINARY_ENTRY_TYPE_TIMELINE_METADATA:
785 		return 0;
786 	default:
787 		break;
788 	}
789 
790 	if (ehdr & CSF_FW_BINARY_ENTRY_OPTIONAL)
791 		return 0;
792 
793 	drm_err(&ptdev->base,
794 		"Unsupported non-optional entry type %u in firmware\n",
795 		CSF_FW_BINARY_ENTRY_TYPE(ehdr));
796 	return -EINVAL;
797 }
798 
799 static int panthor_fw_load(struct panthor_device *ptdev)
800 {
801 	const struct firmware *fw = NULL;
802 	struct panthor_fw_binary_iter iter = {};
803 	struct panthor_fw_binary_hdr hdr;
804 	char fw_path[128];
805 	int ret;
806 
807 	snprintf(fw_path, sizeof(fw_path), "arm/mali/arch%d.%d/%s",
808 		 (u32)GPU_ARCH_MAJOR(ptdev->gpu_info.gpu_id),
809 		 (u32)GPU_ARCH_MINOR(ptdev->gpu_info.gpu_id),
810 		 CSF_FW_NAME);
811 
812 	ret = request_firmware(&fw, fw_path, ptdev->base.dev);
813 	if (ret) {
814 		drm_err(&ptdev->base, "Failed to load firmware image '%s'\n",
815 			CSF_FW_NAME);
816 		return ret;
817 	}
818 
819 	iter.data = fw->data;
820 	iter.size = fw->size;
821 	ret = panthor_fw_binary_iter_read(ptdev, &iter, &hdr, sizeof(hdr));
822 	if (ret)
823 		goto out;
824 
825 	if (hdr.magic != CSF_FW_BINARY_HEADER_MAGIC) {
826 		ret = -EINVAL;
827 		drm_err(&ptdev->base, "Invalid firmware magic\n");
828 		goto out;
829 	}
830 
831 	if (hdr.major != CSF_FW_BINARY_HEADER_MAJOR_MAX) {
832 		ret = -EINVAL;
833 		drm_err(&ptdev->base, "Unsupported firmware binary header version %d.%d (expected %d.x)\n",
834 			hdr.major, hdr.minor, CSF_FW_BINARY_HEADER_MAJOR_MAX);
835 		goto out;
836 	}
837 
838 	if (hdr.size > iter.size) {
839 		ret = -EINVAL;
840 		drm_err(&ptdev->base, "Firmware image is truncated\n");
841 		goto out;
842 	}
843 
844 	iter.size = hdr.size;
845 
846 	while (iter.offset < hdr.size) {
847 		ret = panthor_fw_load_entry(ptdev, fw, &iter);
848 		if (ret)
849 			goto out;
850 	}
851 
852 	if (!ptdev->fw->shared_section) {
853 		drm_err(&ptdev->base, "Shared interface region not found\n");
854 		ret = -EINVAL;
855 		goto out;
856 	}
857 
858 out:
859 	release_firmware(fw);
860 	return ret;
861 }
862 
863 /**
864  * iface_fw_to_cpu_addr() - Turn an MCU address into a CPU address
865  * @ptdev: Device.
866  * @mcu_va: MCU address.
867  * @size: Size of the object pointed to by @mcu_va.
868  *
869  * Return: NULL if the object is not part of the shared section, non-NULL otherwise.
870  */
871 static void *iface_fw_to_cpu_addr(struct panthor_device *ptdev, u32 mcu_va, size_t size)
872 {
873 	u64 shared_mem_start = panthor_kernel_bo_gpuva(ptdev->fw->shared_section->mem);
874 	size_t shared_mem_size = panthor_kernel_bo_size(ptdev->fw->shared_section->mem);
875 	u64 offset;
876 
877 	if (mcu_va < shared_mem_start)
878 		return NULL;
879 
880 	offset = mcu_va - shared_mem_start;
881 	if (offset > shared_mem_size || size > shared_mem_size - offset)
882 		return NULL;
883 
884 	return ptdev->fw->shared_section->mem->kmap + offset;
885 }
886 
887 static int panthor_init_cs_iface(struct panthor_device *ptdev,
888 				 unsigned int csg_idx, unsigned int cs_idx)
889 {
890 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
891 	struct panthor_fw_csg_iface *csg_iface = panthor_fw_get_csg_iface(ptdev, csg_idx);
892 	struct panthor_fw_cs_iface *cs_iface = &ptdev->fw->iface.streams[csg_idx][cs_idx];
893 	u64 shared_section_sz = panthor_kernel_bo_size(ptdev->fw->shared_section->mem);
894 	u32 iface_offset = CSF_GROUP_CONTROL_OFFSET +
895 			   (csg_idx * glb_iface->control->group_stride) +
896 			   CSF_STREAM_CONTROL_OFFSET +
897 			   (cs_idx * csg_iface->control->stream_stride);
898 	struct panthor_fw_cs_iface *first_cs_iface =
899 		panthor_fw_get_cs_iface(ptdev, 0, 0);
900 
901 	if (iface_offset + sizeof(*cs_iface) >= shared_section_sz)
902 		return -EINVAL;
903 
904 	spin_lock_init(&cs_iface->lock);
905 	cs_iface->control = ptdev->fw->shared_section->mem->kmap + iface_offset;
906 	cs_iface->input = iface_fw_to_cpu_addr(ptdev, cs_iface->control->input_va,
907 					       sizeof(*cs_iface->input));
908 	cs_iface->output = iface_fw_to_cpu_addr(ptdev, cs_iface->control->output_va,
909 						sizeof(*cs_iface->output));
910 
911 	if (!cs_iface->input || !cs_iface->output) {
912 		drm_err(&ptdev->base, "Invalid stream control interface input/output VA");
913 		return -EINVAL;
914 	}
915 
916 	if (cs_iface != first_cs_iface) {
917 		if (cs_iface->control->features != first_cs_iface->control->features) {
918 			drm_err(&ptdev->base, "Expecting identical CS slots");
919 			return -EINVAL;
920 		}
921 	} else {
922 		u32 reg_count = CS_FEATURES_WORK_REGS(cs_iface->control->features);
923 
924 		ptdev->csif_info.cs_reg_count = reg_count;
925 		ptdev->csif_info.unpreserved_cs_reg_count = CSF_UNPRESERVED_REG_COUNT;
926 	}
927 
928 	return 0;
929 }
930 
931 static bool compare_csg(const struct panthor_fw_csg_control_iface *a,
932 			const struct panthor_fw_csg_control_iface *b)
933 {
934 	if (a->features != b->features)
935 		return false;
936 	if (a->suspend_size != b->suspend_size)
937 		return false;
938 	if (a->protm_suspend_size != b->protm_suspend_size)
939 		return false;
940 	if (a->stream_num != b->stream_num)
941 		return false;
942 	return true;
943 }
944 
945 static int panthor_init_csg_iface(struct panthor_device *ptdev,
946 				  unsigned int csg_idx)
947 {
948 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
949 	struct panthor_fw_csg_iface *csg_iface = &ptdev->fw->iface.groups[csg_idx];
950 	u64 shared_section_sz = panthor_kernel_bo_size(ptdev->fw->shared_section->mem);
951 	u32 iface_offset = CSF_GROUP_CONTROL_OFFSET + (csg_idx * glb_iface->control->group_stride);
952 	unsigned int i;
953 
954 	if (iface_offset + sizeof(*csg_iface) >= shared_section_sz)
955 		return -EINVAL;
956 
957 	spin_lock_init(&csg_iface->lock);
958 	csg_iface->control = ptdev->fw->shared_section->mem->kmap + iface_offset;
959 	csg_iface->input = iface_fw_to_cpu_addr(ptdev, csg_iface->control->input_va,
960 						sizeof(*csg_iface->input));
961 	csg_iface->output = iface_fw_to_cpu_addr(ptdev, csg_iface->control->output_va,
962 						 sizeof(*csg_iface->output));
963 
964 	if (csg_iface->control->stream_num < MIN_CS_PER_CSG ||
965 	    csg_iface->control->stream_num > MAX_CS_PER_CSG)
966 		return -EINVAL;
967 
968 	if (!csg_iface->input || !csg_iface->output) {
969 		drm_err(&ptdev->base, "Invalid group control interface input/output VA");
970 		return -EINVAL;
971 	}
972 
973 	if (csg_idx > 0) {
974 		struct panthor_fw_csg_iface *first_csg_iface =
975 			panthor_fw_get_csg_iface(ptdev, 0);
976 
977 		if (!compare_csg(first_csg_iface->control, csg_iface->control)) {
978 			drm_err(&ptdev->base, "Expecting identical CSG slots");
979 			return -EINVAL;
980 		}
981 	}
982 
983 	for (i = 0; i < csg_iface->control->stream_num; i++) {
984 		int ret = panthor_init_cs_iface(ptdev, csg_idx, i);
985 
986 		if (ret)
987 			return ret;
988 	}
989 
990 	return 0;
991 }
992 
993 static u32 panthor_get_instr_features(struct panthor_device *ptdev)
994 {
995 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
996 
997 	if (glb_iface->control->version < CSF_IFACE_VERSION(1, 1, 0))
998 		return 0;
999 
1000 	return glb_iface->control->instr_features;
1001 }
1002 
1003 static int panthor_fw_init_ifaces(struct panthor_device *ptdev)
1004 {
1005 	struct panthor_fw_global_iface *glb_iface = &ptdev->fw->iface.global;
1006 	unsigned int i;
1007 
1008 	if (!ptdev->fw->shared_section->mem->kmap)
1009 		return -EINVAL;
1010 
1011 	spin_lock_init(&glb_iface->lock);
1012 	glb_iface->control = ptdev->fw->shared_section->mem->kmap;
1013 
1014 	if (!glb_iface->control->version) {
1015 		drm_err(&ptdev->base, "Firmware version is 0. Firmware may have failed to boot");
1016 		return -EINVAL;
1017 	}
1018 
1019 	glb_iface->input = iface_fw_to_cpu_addr(ptdev, glb_iface->control->input_va,
1020 						sizeof(*glb_iface->input));
1021 	glb_iface->output = iface_fw_to_cpu_addr(ptdev, glb_iface->control->output_va,
1022 						 sizeof(*glb_iface->output));
1023 	if (!glb_iface->input || !glb_iface->output) {
1024 		drm_err(&ptdev->base, "Invalid global control interface input/output VA");
1025 		return -EINVAL;
1026 	}
1027 
1028 	if (glb_iface->control->group_num > MAX_CSGS ||
1029 	    glb_iface->control->group_num < MIN_CSGS) {
1030 		drm_err(&ptdev->base, "Invalid number of control groups");
1031 		return -EINVAL;
1032 	}
1033 
1034 	for (i = 0; i < glb_iface->control->group_num; i++) {
1035 		int ret = panthor_init_csg_iface(ptdev, i);
1036 
1037 		if (ret)
1038 			return ret;
1039 	}
1040 
1041 	drm_info(&ptdev->base, "CSF FW using interface v%d.%d.%d, Features %#x Instrumentation features %#x",
1042 		 CSF_IFACE_VERSION_MAJOR(glb_iface->control->version),
1043 		 CSF_IFACE_VERSION_MINOR(glb_iface->control->version),
1044 		 CSF_IFACE_VERSION_PATCH(glb_iface->control->version),
1045 		 glb_iface->control->features,
1046 		 panthor_get_instr_features(ptdev));
1047 	return 0;
1048 }
1049 
1050 static void panthor_fw_init_global_iface(struct panthor_device *ptdev)
1051 {
1052 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
1053 
1054 	/* Enable all cores. */
1055 	glb_iface->input->core_en_mask = ptdev->gpu_info.shader_present;
1056 
1057 	/* Setup timers. */
1058 	glb_iface->input->poweroff_timer = panthor_fw_conv_timeout(ptdev, PWROFF_HYSTERESIS_US);
1059 	glb_iface->input->progress_timer = PROGRESS_TIMEOUT_CYCLES >> PROGRESS_TIMEOUT_SCALE_SHIFT;
1060 	glb_iface->input->idle_timer = panthor_fw_conv_timeout(ptdev, IDLE_HYSTERESIS_US);
1061 
1062 	/* Enable interrupts we care about. */
1063 	glb_iface->input->ack_irq_mask = GLB_CFG_ALLOC_EN |
1064 					 GLB_PING |
1065 					 GLB_CFG_PROGRESS_TIMER |
1066 					 GLB_CFG_POWEROFF_TIMER |
1067 					 GLB_IDLE_EN |
1068 					 GLB_IDLE;
1069 
1070 	if (panthor_fw_has_glb_state(ptdev))
1071 		glb_iface->input->ack_irq_mask |= GLB_STATE_MASK;
1072 
1073 	panthor_fw_update_reqs(glb_iface, req, GLB_IDLE_EN | GLB_COUNTER_EN,
1074 			       GLB_IDLE_EN | GLB_COUNTER_EN);
1075 	panthor_fw_toggle_reqs(glb_iface, req, ack,
1076 			       GLB_CFG_ALLOC_EN |
1077 			       GLB_CFG_POWEROFF_TIMER |
1078 			       GLB_CFG_PROGRESS_TIMER);
1079 
1080 	panthor_fw_ring_doorbell(ptdev, CSF_GLB_DOORBELL_ID);
1081 
1082 	/* Kick the watchdog. */
1083 	mod_delayed_work(ptdev->reset.wq, &ptdev->fw->watchdog.ping_work,
1084 			 msecs_to_jiffies(PING_INTERVAL_MS));
1085 }
1086 
1087 static void panthor_job_irq_handler(struct panthor_device *ptdev, u32 status)
1088 {
1089 	u32 duration;
1090 	u64 start = 0;
1091 
1092 	if (tracepoint_enabled(gpu_job_irq))
1093 		start = ktime_get_ns();
1094 
1095 	gpu_write(ptdev->fw->irq.iomem, INT_CLEAR, status);
1096 
1097 	if (!ptdev->fw->booted && (status & JOB_INT_GLOBAL_IF))
1098 		ptdev->fw->booted = true;
1099 
1100 	wake_up_all(&ptdev->fw->req_waitqueue);
1101 
1102 	/* If the FW is not booted, don't process IRQs, just flag the FW as booted. */
1103 	if (!ptdev->fw->booted)
1104 		return;
1105 
1106 	panthor_sched_report_fw_events(ptdev, status);
1107 
1108 	if (tracepoint_enabled(gpu_job_irq) && start) {
1109 		if (check_sub_overflow(ktime_get_ns(), start, &duration))
1110 			duration = U32_MAX;
1111 		trace_gpu_job_irq(ptdev->base.dev, status, duration);
1112 	}
1113 }
1114 PANTHOR_IRQ_HANDLER(job, panthor_job_irq_handler);
1115 
1116 static int panthor_fw_start(struct panthor_device *ptdev)
1117 {
1118 	struct panthor_fw *fw = ptdev->fw;
1119 	bool timedout = false;
1120 
1121 	ptdev->fw->booted = false;
1122 	panthor_job_irq_enable_events(&ptdev->fw->irq, ~0);
1123 	panthor_job_irq_resume(&ptdev->fw->irq);
1124 	gpu_write(fw->iomem, MCU_CONTROL, MCU_CONTROL_AUTO);
1125 
1126 	if (!wait_event_timeout(ptdev->fw->req_waitqueue,
1127 				ptdev->fw->booted,
1128 				msecs_to_jiffies(1000))) {
1129 		if (!ptdev->fw->booted &&
1130 		    !(gpu_read(fw->irq.iomem, INT_STAT) & JOB_INT_GLOBAL_IF))
1131 			timedout = true;
1132 	}
1133 
1134 	if (timedout) {
1135 		static const char * const status_str[] = {
1136 			[MCU_STATUS_DISABLED] = "disabled",
1137 			[MCU_STATUS_ENABLED] = "enabled",
1138 			[MCU_STATUS_HALT] = "halt",
1139 			[MCU_STATUS_FATAL] = "fatal",
1140 		};
1141 		u32 status = gpu_read(fw->iomem, MCU_STATUS);
1142 
1143 		drm_err(&ptdev->base, "Failed to boot MCU (status=%s)",
1144 			status < ARRAY_SIZE(status_str) ? status_str[status] : "unknown");
1145 		return -ETIMEDOUT;
1146 	}
1147 
1148 	return 0;
1149 }
1150 
1151 static void panthor_fw_stop(struct panthor_device *ptdev)
1152 {
1153 	struct panthor_fw *fw = ptdev->fw;
1154 	u32 status;
1155 
1156 	gpu_write(fw->iomem, MCU_CONTROL, MCU_CONTROL_DISABLE);
1157 	if (gpu_read_poll_timeout(fw->iomem, MCU_STATUS, status,
1158 				  status == MCU_STATUS_DISABLED, 10, 100000))
1159 		drm_err(&ptdev->base, "Failed to stop MCU");
1160 }
1161 
1162 static bool panthor_fw_mcu_halted(struct panthor_device *ptdev)
1163 {
1164 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
1165 	bool halted;
1166 
1167 	halted = gpu_read(ptdev->fw->iomem, MCU_STATUS) == MCU_STATUS_HALT;
1168 
1169 	if (panthor_fw_has_glb_state(ptdev))
1170 		halted &= (GLB_STATE_GET(glb_iface->output->ack) == GLB_STATE_HALT);
1171 
1172 	return halted;
1173 }
1174 
1175 static void panthor_fw_halt_mcu(struct panthor_device *ptdev)
1176 {
1177 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
1178 
1179 	if (panthor_fw_has_glb_state(ptdev))
1180 		panthor_fw_update_reqs(glb_iface, req, GLB_STATE(GLB_STATE_HALT), GLB_STATE_MASK);
1181 	else
1182 		panthor_fw_update_reqs(glb_iface, req, GLB_HALT, GLB_HALT);
1183 
1184 	panthor_fw_ring_doorbell(ptdev, CSF_GLB_DOORBELL_ID);
1185 }
1186 
1187 static bool panthor_fw_wait_mcu_halted(struct panthor_device *ptdev)
1188 {
1189 	bool halted = false;
1190 
1191 	if (read_poll_timeout_atomic(panthor_fw_mcu_halted, halted, halted, 10,
1192 				     MCU_HALT_TIMEOUT_US, 0, ptdev)) {
1193 		drm_warn(&ptdev->base, "Timed out waiting for MCU to halt");
1194 		return false;
1195 	}
1196 
1197 	return true;
1198 }
1199 
1200 static void panthor_fw_mcu_set_active(struct panthor_device *ptdev)
1201 {
1202 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
1203 
1204 	if (panthor_fw_has_glb_state(ptdev))
1205 		panthor_fw_update_reqs(glb_iface, req, GLB_STATE(GLB_STATE_ACTIVE), GLB_STATE_MASK);
1206 	else
1207 		panthor_fw_update_reqs(glb_iface, req, 0, GLB_HALT);
1208 }
1209 
1210 /**
1211  * panthor_fw_pre_reset() - Call before a reset.
1212  * @ptdev: Device.
1213  * @on_hang: true if the reset was triggered on a GPU hang.
1214  *
1215  * If the reset is not triggered on a hang, we try to gracefully halt the
1216  * MCU, so we can do a fast-reset when panthor_fw_post_reset() is called.
1217  */
1218 void panthor_fw_pre_reset(struct panthor_device *ptdev, bool on_hang)
1219 {
1220 	/* Make sure we won't be woken up by a ping. */
1221 	cancel_delayed_work_sync(&ptdev->fw->watchdog.ping_work);
1222 
1223 	ptdev->reset.fast = false;
1224 
1225 	if (!on_hang) {
1226 		panthor_fw_halt_mcu(ptdev);
1227 		if (!panthor_fw_wait_mcu_halted(ptdev))
1228 			drm_warn(&ptdev->base, "Failed to cleanly suspend MCU");
1229 		else
1230 			ptdev->reset.fast = true;
1231 	}
1232 
1233 	panthor_job_irq_suspend(&ptdev->fw->irq);
1234 	panthor_fw_stop(ptdev);
1235 }
1236 
1237 /**
1238  * panthor_fw_post_reset() - Call after a reset.
1239  * @ptdev: Device.
1240  *
1241  * Start the FW. If this is not a fast reset, all FW sections are reloaded to
1242  * make sure we can recover from a memory corruption.
1243  */
1244 int panthor_fw_post_reset(struct panthor_device *ptdev)
1245 {
1246 	int ret;
1247 
1248 	/* Make the MCU VM active. */
1249 	ret = panthor_vm_active(ptdev->fw->vm);
1250 	if (ret)
1251 		return ret;
1252 
1253 	if (!ptdev->reset.fast) {
1254 		/* On a slow reset, reload all sections, including RO ones.
1255 		 * We're not supposed to end up here anyway, let's just assume
1256 		 * the overhead of reloading everything is acceptable.
1257 		 */
1258 		panthor_reload_fw_sections(ptdev, true);
1259 	} else {
1260 		/*
1261 		 * If the FW was previously successfully halted in the pre-reset
1262 		 * operation, we need to transition it to active again before
1263 		 * the FW is rebooted.
1264 		 * This is not needed on a slow reset because FW sections are
1265 		 * re-initialized.
1266 		 */
1267 		panthor_fw_mcu_set_active(ptdev);
1268 	}
1269 
1270 	ret = panthor_fw_start(ptdev);
1271 	if (ret) {
1272 		drm_err(&ptdev->base, "FW %s reset failed",
1273 			ptdev->reset.fast ?  "fast" : "slow");
1274 		return ret;
1275 	}
1276 
1277 	/* We must re-initialize the global interface even on fast-reset. */
1278 	panthor_fw_init_global_iface(ptdev);
1279 	return 0;
1280 }
1281 
1282 /**
1283  * panthor_fw_unplug() - Called when the device is unplugged.
1284  * @ptdev: Device.
1285  *
1286  * This function must make sure all pending operations are flushed before
1287  * will release device resources, thus preventing any interaction with
1288  * the HW.
1289  *
1290  * If there is still FW-related work running after this function returns,
1291  * they must use drm_dev_{enter,exit}() and skip any HW access when
1292  * drm_dev_enter() returns false.
1293  */
1294 void panthor_fw_unplug(struct panthor_device *ptdev)
1295 {
1296 	struct panthor_fw_section *section;
1297 
1298 	disable_delayed_work_sync(&ptdev->fw->watchdog.ping_work);
1299 
1300 	if (!IS_ENABLED(CONFIG_PM) || pm_runtime_active(ptdev->base.dev)) {
1301 		/* Make sure the IRQ handler cannot be called after that point. */
1302 		panthor_job_irq_suspend(&ptdev->fw->irq);
1303 		panthor_fw_stop(ptdev);
1304 	}
1305 
1306 	list_for_each_entry(section, &ptdev->fw->sections, node)
1307 		panthor_kernel_bo_destroy(section->mem);
1308 
1309 	/* We intentionally don't call panthor_vm_idle() and let
1310 	 * panthor_mmu_unplug() release the AS we acquired with
1311 	 * panthor_vm_active() so we don't have to track the VM active/idle
1312 	 * state to keep the active_refcnt balanced.
1313 	 */
1314 	panthor_vm_put(ptdev->fw->vm);
1315 	ptdev->fw->vm = NULL;
1316 
1317 	if (!IS_ENABLED(CONFIG_PM) || pm_runtime_active(ptdev->base.dev))
1318 		panthor_hw_l2_power_off(ptdev);
1319 }
1320 
1321 /**
1322  * panthor_fw_wait_acks() - Wait for requests to be acknowledged by the FW.
1323  * @req_ptr: Pointer to the req register.
1324  * @ack_ptr: Pointer to the ack register.
1325  * @wq: Wait queue to use for the sleeping wait.
1326  * @req_mask: Mask of requests to wait for.
1327  * @acked: Pointer to field that's updated with the acked requests.
1328  * If the function returns 0, *acked == req_mask.
1329  * @timeout_ms: Timeout expressed in milliseconds.
1330  *
1331  * Return: 0 on success, -ETIMEDOUT otherwise.
1332  */
1333 static int panthor_fw_wait_acks(const u32 *req_ptr, const u32 *ack_ptr,
1334 				wait_queue_head_t *wq,
1335 				u32 req_mask, u32 *acked,
1336 				u32 timeout_ms)
1337 {
1338 	u32 ack, req = READ_ONCE(*req_ptr) & req_mask;
1339 	int ret;
1340 
1341 	/* Busy wait for a few µsecs before falling back to a sleeping wait. */
1342 	*acked = req_mask;
1343 	ret = read_poll_timeout_atomic(READ_ONCE, ack,
1344 				       (ack & req_mask) == req,
1345 				       0, 10, 0,
1346 				       *ack_ptr);
1347 	if (!ret)
1348 		return 0;
1349 
1350 	if (wait_event_timeout(*wq, (READ_ONCE(*ack_ptr) & req_mask) == req,
1351 			       msecs_to_jiffies(timeout_ms)))
1352 		return 0;
1353 
1354 	/* Check one last time, in case we were not woken up for some reason. */
1355 	ack = READ_ONCE(*ack_ptr);
1356 	if ((ack & req_mask) == req)
1357 		return 0;
1358 
1359 	*acked = ~(req ^ ack) & req_mask;
1360 	return -ETIMEDOUT;
1361 }
1362 
1363 /**
1364  * panthor_fw_glb_wait_acks() - Wait for global requests to be acknowledged.
1365  * @ptdev: Device.
1366  * @req_mask: Mask of requests to wait for.
1367  * @acked: Pointer to field that's updated with the acked requests.
1368  * If the function returns 0, *acked == req_mask.
1369  * @timeout_ms: Timeout expressed in milliseconds.
1370  *
1371  * Return: 0 on success, -ETIMEDOUT otherwise.
1372  */
1373 int panthor_fw_glb_wait_acks(struct panthor_device *ptdev,
1374 			     u32 req_mask, u32 *acked,
1375 			     u32 timeout_ms)
1376 {
1377 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
1378 
1379 	/* GLB_HALT doesn't get acked through the FW interface. */
1380 	if (drm_WARN_ON(&ptdev->base, req_mask & (~GLB_REQ_MASK | GLB_HALT)))
1381 		return -EINVAL;
1382 
1383 	return panthor_fw_wait_acks(&glb_iface->input->req,
1384 				    &glb_iface->output->ack,
1385 				    &ptdev->fw->req_waitqueue,
1386 				    req_mask, acked, timeout_ms);
1387 }
1388 
1389 /**
1390  * panthor_fw_csg_wait_acks() - Wait for command stream group requests to be acknowledged.
1391  * @ptdev: Device.
1392  * @csg_slot: CSG slot ID.
1393  * @req_mask: Mask of requests to wait for.
1394  * @acked: Pointer to field that's updated with the acked requests.
1395  * If the function returns 0, *acked == req_mask.
1396  * @timeout_ms: Timeout expressed in milliseconds.
1397  *
1398  * Return: 0 on success, -ETIMEDOUT otherwise.
1399  */
1400 int panthor_fw_csg_wait_acks(struct panthor_device *ptdev, u32 csg_slot,
1401 			     u32 req_mask, u32 *acked, u32 timeout_ms)
1402 {
1403 	struct panthor_fw_csg_iface *csg_iface = panthor_fw_get_csg_iface(ptdev, csg_slot);
1404 	int ret;
1405 
1406 	if (drm_WARN_ON(&ptdev->base, req_mask & ~CSG_REQ_MASK))
1407 		return -EINVAL;
1408 
1409 	ret = panthor_fw_wait_acks(&csg_iface->input->req,
1410 				   &csg_iface->output->ack,
1411 				   &ptdev->fw->req_waitqueue,
1412 				   req_mask, acked, timeout_ms);
1413 
1414 	/*
1415 	 * Check that all bits in the state field were updated, if any mismatch
1416 	 * then clear all bits in the state field. This allows code to do
1417 	 * (acked & CSG_STATE_MASK) and get the right value.
1418 	 */
1419 
1420 	if ((*acked & CSG_STATE_MASK) != CSG_STATE_MASK)
1421 		*acked &= ~CSG_STATE_MASK;
1422 
1423 	return ret;
1424 }
1425 
1426 void panthor_fw_ring_doorbell(struct panthor_device *ptdev, u32 doorbell_id)
1427 {
1428 	gpu_write(ptdev->iomem, CSF_DOORBELL(doorbell_id), 1);
1429 }
1430 
1431 /**
1432  * panthor_fw_ring_csg_doorbells() - Ring command stream group doorbells.
1433  * @ptdev: Device.
1434  * @csg_mask: Bitmask encoding the command stream group doorbells to ring.
1435  *
1436  * This function is toggling bits in the doorbell_req and ringing the
1437  * global doorbell. It doesn't require a user doorbell to be attached to
1438  * the group.
1439  */
1440 void panthor_fw_ring_csg_doorbells(struct panthor_device *ptdev, u32 csg_mask)
1441 {
1442 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
1443 
1444 	panthor_fw_toggle_reqs(glb_iface, doorbell_req, doorbell_ack, csg_mask);
1445 	panthor_fw_ring_doorbell(ptdev, CSF_GLB_DOORBELL_ID);
1446 }
1447 
1448 static void panthor_fw_ping_work(struct work_struct *work)
1449 {
1450 	struct panthor_fw *fw = container_of(work, struct panthor_fw, watchdog.ping_work.work);
1451 	struct panthor_device *ptdev = fw->irq.ptdev;
1452 	struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
1453 	u32 acked;
1454 	int ret;
1455 
1456 	if (panthor_device_reset_is_pending(ptdev))
1457 		return;
1458 
1459 	panthor_fw_toggle_reqs(glb_iface, req, ack, GLB_PING);
1460 	panthor_fw_ring_doorbell(ptdev, CSF_GLB_DOORBELL_ID);
1461 
1462 	ret = panthor_fw_glb_wait_acks(ptdev, GLB_PING, &acked, 100);
1463 	if (ret) {
1464 		panthor_device_schedule_reset(ptdev);
1465 		drm_err(&ptdev->base, "FW ping timeout, scheduling a reset");
1466 	} else {
1467 		mod_delayed_work(ptdev->reset.wq, &fw->watchdog.ping_work,
1468 				 msecs_to_jiffies(PING_INTERVAL_MS));
1469 	}
1470 }
1471 
1472 /**
1473  * panthor_fw_init() - Initialize FW related data.
1474  * @ptdev: Device.
1475  *
1476  * Return: 0 on success, a negative error code otherwise.
1477  */
1478 int panthor_fw_init(struct panthor_device *ptdev)
1479 {
1480 	struct panthor_fw *fw;
1481 	int ret, irq;
1482 
1483 	fw = drmm_kzalloc(&ptdev->base, sizeof(*fw), GFP_KERNEL);
1484 	if (!fw)
1485 		return -ENOMEM;
1486 
1487 	fw->iomem = ptdev->iomem + MCU_CONTROL_BASE;
1488 	ptdev->fw = fw;
1489 	init_waitqueue_head(&fw->req_waitqueue);
1490 	INIT_LIST_HEAD(&fw->sections);
1491 	INIT_DELAYED_WORK(&fw->watchdog.ping_work, panthor_fw_ping_work);
1492 
1493 	irq = platform_get_irq_byname(to_platform_device(ptdev->base.dev), "job");
1494 	if (irq <= 0)
1495 		return -ENODEV;
1496 
1497 	ret = panthor_request_job_irq(ptdev, &fw->irq, irq,
1498 				      ptdev->iomem + JOB_INT_BASE);
1499 	if (ret) {
1500 		drm_err(&ptdev->base, "failed to request job irq");
1501 		return ret;
1502 	}
1503 
1504 	ret = panthor_hw_l2_power_on(ptdev);
1505 	if (ret)
1506 		return ret;
1507 
1508 	fw->vm = panthor_vm_create(ptdev, true,
1509 				   0, SZ_4G,
1510 				   CSF_MCU_SHARED_REGION_START,
1511 				   CSF_MCU_SHARED_REGION_SIZE);
1512 	if (IS_ERR(fw->vm)) {
1513 		ret = PTR_ERR(fw->vm);
1514 		fw->vm = NULL;
1515 		goto err_unplug_fw;
1516 	}
1517 
1518 	ret = panthor_fw_load(ptdev);
1519 	if (ret)
1520 		goto err_unplug_fw;
1521 
1522 	ret = panthor_vm_active(fw->vm);
1523 	if (ret)
1524 		goto err_unplug_fw;
1525 
1526 	ret = panthor_fw_start(ptdev);
1527 	if (ret)
1528 		goto err_unplug_fw;
1529 
1530 	ret = panthor_fw_init_ifaces(ptdev);
1531 	if (ret)
1532 		goto err_unplug_fw;
1533 
1534 	panthor_fw_init_global_iface(ptdev);
1535 	return 0;
1536 
1537 err_unplug_fw:
1538 	panthor_fw_unplug(ptdev);
1539 	return ret;
1540 }
1541 
1542 MODULE_FIRMWARE("arm/mali/arch10.8/mali_csffw.bin");
1543 MODULE_FIRMWARE("arm/mali/arch10.10/mali_csffw.bin");
1544 MODULE_FIRMWARE("arm/mali/arch10.12/mali_csffw.bin");
1545 MODULE_FIRMWARE("arm/mali/arch11.8/mali_csffw.bin");
1546 MODULE_FIRMWARE("arm/mali/arch12.8/mali_csffw.bin");
1547 MODULE_FIRMWARE("arm/mali/arch13.8/mali_csffw.bin");
1548 MODULE_FIRMWARE("arm/mali/arch14.8/mali_csffw.bin");
1549