gpu: Update to DDK 1.8@4688949

Update to DDK 1.8@4688949.

- Use ion_import() in gralloc mapper instances to fix memory accounting
  in the memtrack HAL.
- Stop advertising a second unusable queue family in the Vulkan driver.
- Fix around 100 dEQP-VK test failures.

Bug: 37999235
Bug: 37902016
Bug: 34887565

Change-Id: I1077f8859ae63fcfe9c0380a9fd6b4c2401cc441
Signed-off-by: Alistair Strachan <alistair.strachan@imgtec.com>

19 files changed, 355 insertions, 99 deletions

diff --git a/drivers/staging/imgtec/pvr_sync.c b/drivers/staging/imgtec/pvr_sync.c
index 3461310b7332..4b66695bb697 100644
--- a/drivers/staging/imgtec/pvr_sync.c
+++ b/drivers/staging/imgtec/pvr_sync.c
@@ -1244,7 +1244,8 @@ enum PVRSRV_ERROR pvr_sync_append_fences(
 			goto err_free_append_data;
 		}
 
-#if defined(CHROMIUMOS_WORKAROUNDS_KERNEL318)
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 4, 0)) && \
+    defined(CHROMIUMOS_WORKAROUNDS_KERNEL318)
 		update_fence = sync_fence_create(name, &update_point->pt.base);
 #else
 		update_fence = sync_fence_create(name, &update_point->pt);
@@ -1852,7 +1853,8 @@ static long pvr_sync_ioctl_sw_create_fence(struct sw_sync_timeline *timeline,
 	}
 
 	data.name[sizeof(data.name) - 1] = '\0';
-#if defined(CHROMIUMOS_WORKAROUNDS_KERNEL318)
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 4, 0)) && \
+    defined(CHROMIUMOS_WORKAROUNDS_KERNEL318)
 	fence = sync_fence_create(data.name, &sync_pt->base);
 #else
 	fence = sync_fence_create(data.name, sync_pt);
diff --git a/drivers/staging/imgtec/pvrversion.h b/drivers/staging/imgtec/pvrversion.h
index b71545cc26ee..f13ee3d7d21d 100644
--- a/drivers/staging/imgtec/pvrversion.h
+++ b/drivers/staging/imgtec/pvrversion.h
@@ -53,7 +53,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #define PVRVERSION_FAMILY           "rogueddk"
 #define PVRVERSION_BRANCHNAME       "1.8"
-#define PVRVERSION_BUILD             4662227
+#define PVRVERSION_BUILD             4688949
 #define PVRVERSION_BSCONTROL        "Rogue_DDK_Android"
 
 #define PVRVERSION_STRING           "Rogue_DDK_Android rogueddk 1.8@" PVR_STR2(PVRVERSION_BUILD)
@@ -61,8 +61,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #define COPYRIGHT_TXT               "Copyright (c) Imagination Technologies Ltd. All Rights Reserved."
 
-#define PVRVERSION_BUILD_HI          466
-#define PVRVERSION_BUILD_LO          2227
+#define PVRVERSION_BUILD_HI          468
+#define PVRVERSION_BUILD_LO          8949
 #define PVRVERSION_STRING_NUMERIC    PVR_STR2(PVRVERSION_MAJ) "." PVR_STR2(PVRVERSION_MIN) "." PVR_STR2(PVRVERSION_BUILD_HI) "." PVR_STR2(PVRVERSION_BUILD_LO)
 
 #define PVRVERSION_PACK(MAJ,MIN) ((((MAJ)&0xFFFF) << 16) | (((MIN)&0xFFFF) << 0))
diff --git a/drivers/staging/imgtec/rogue/cache_km.c b/drivers/staging/imgtec/rogue/cache_km.c
index 944df4598188..37100d6ad06d 100644
--- a/drivers/staging/imgtec/rogue/cache_km.c
+++ b/drivers/staging/imgtec/rogue/cache_km.c
@@ -40,7 +40,7 @@ COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */ /**************************************************************************/
-#if defined(CONFIG_SW_SYNC)
+#if defined(SUPPORT_NATIVE_FENCE_SYNC) && defined(CONFIG_SW_SYNC)
 #include <linux/version.h>
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0))
 #include <linux/sw_sync.h>
@@ -1206,7 +1206,7 @@ static PVRSRV_ERROR CacheOpExecRangeBased(PVRSRV_DATA *psPVRSRVData,
 
 			OSAtomicWrite(&ghCompletedCacheOpSeqNum, psCacheOpWorkItem->ui32OpSeqNum);
 
-#if defined(CONFIG_SW_SYNC)
+#if defined(SUPPORT_NATIVE_FENCE_SYNC) && defined(CONFIG_SW_SYNC)
 			sw_sync_timeline_inc(psCacheOpWorkItem->psTimeline->private_data, 1);
 			fput(psCacheOpWorkItem->psTimeline);
 #endif
@@ -1331,10 +1331,10 @@ static PVRSRV_ERROR CacheOpExecQueue (PMR **ppsPMR,
 
 		for (ui32Idx = 0; ui32Idx < ui32NumCacheOps; ui32Idx++)
 		{
-			eError = CacheOpExec(ppsPMR[ui32Idx],
-								 puiOffset[ui32Idx],
-								 puiSize[ui32Idx],
-								 puiCacheOp[ui32Idx]);
+			(void)CacheOpExec(ppsPMR[ui32Idx],
+							  puiOffset[ui32Idx],
+							  puiSize[ui32Idx],
+							  puiCacheOp[ui32Idx]);
 		}
 
 		/* No CacheOp fence dependencies */
@@ -1342,6 +1342,7 @@ static PVRSRV_ERROR CacheOpExecQueue (PMR **ppsPMR,
 	}
 	else
 	{
+		IMG_DEVMEM_SIZE_T uiLogicalSize;
 		CACHEOP_WORK_ITEM *psCacheOpWorkItem = NULL;
 
 		for (ui32Idx = 0; ui32Idx < ui32NumCacheOps; ui32Idx++)
@@ -1349,7 +1350,7 @@ static PVRSRV_ERROR CacheOpExecQueue (PMR **ppsPMR,
 			/* As PVRSRV_CACHE_OP_INVALIDATE is used to transfer
 			   device memory buffer ownership back to processor
 			   we cannot defer it so must action it immediately */
-			if (puiCacheOp[ui32Idx] == PVRSRV_CACHE_OP_INVALIDATE)
+			if (puiCacheOp[ui32Idx] & PVRSRV_CACHE_OP_INVALIDATE)
 			{
 				eError = CacheOpExec (ppsPMR[ui32Idx],
 									  puiOffset[ui32Idx],
@@ -1368,6 +1369,33 @@ static PVRSRV_ERROR CacheOpExecQueue (PMR **ppsPMR,
 				continue;
 			}
 
+			/* Ensure request is valid before deferring to CacheOp thread */
+			eError = PMR_LogicalSize(ppsPMR[ui32Idx], &uiLogicalSize);
+			if (eError != PVRSRV_OK)
+			{
+				PVR_DPF((CACHEOP_DPFL,
+						"%s: PMR_LogicalSize failed (%u), cannot defer CacheOp",
+						__FUNCTION__, eError));
+
+				/* Signal the CacheOp thread to ensure queued items get processed */
+				(void) OSEventObjectSignal(psPVRSRVData->hCacheOpThreadEventObject);
+				PVR_LOG_IF_ERROR(eError, "OSEventObjectSignal");
+
+				return eError;
+			}
+			else if ((puiOffset[ui32Idx]+puiSize[ui32Idx]) > uiLogicalSize)
+			{
+				PVR_DPF((CACHEOP_DPFL,
+						"%s: Invalid parameters, cannot defer CacheOp",
+						__FUNCTION__));
+
+				/* Signal the CacheOp thread to ensure queued items get processed */
+				(void) OSEventObjectSignal(psPVRSRVData->hCacheOpThreadEventObject);
+				PVR_LOG_IF_ERROR(eError, "OSEventObjectSignal");
+
+				return PVRSRV_ERROR_INVALID_PARAMS;;
+			}
+
 			/* For now use dynamic alloc, static CCB _might_ be faster */
 			psCacheOpWorkItem = OSAllocMem(sizeof(CACHEOP_WORK_ITEM));
 			if (psCacheOpWorkItem == NULL)
@@ -1452,10 +1480,17 @@ static PVRSRV_ERROR CacheOpExecQueue(PMR **ppsPMR,
 
 	for (ui32Idx = 0; ui32Idx < ui32NumCacheOps; ui32Idx++)
 	{
-		eError = CacheOpExec(ppsPMR[ui32Idx],
-							 puiOffset[ui32Idx],
-							 puiSize[ui32Idx],
-							 puiCacheOp[ui32Idx]);
+		PVRSRV_ERROR eError2 = CacheOpExec(ppsPMR[ui32Idx],
+										   puiOffset[ui32Idx],
+										   puiSize[ui32Idx],
+										   puiCacheOp[ui32Idx]);
+		if (eError2 != PVRSRV_OK)
+		{
+			eError = eError2;
+			PVR_DPF((CACHEOP_DPFL,
+					"%s: CacheOpExec failed (%u)",
+					__FUNCTION__, eError));
+		}
 	}
 
 	/* For immediate RBF, common/completed are identical */
@@ -1633,7 +1668,7 @@ PVRSRV_ERROR CacheOpSetTimeline (IMG_INT32 i32Timeline)
 	psCacheOpWorkItem->pid = OSGetCurrentClientProcessIDKM();
 #endif
 
-#if defined(CONFIG_SW_SYNC)
+#if defined(SUPPORT_NATIVE_FENCE_SYNC) && defined(CONFIG_SW_SYNC)
 	psCacheOpWorkItem->psTimeline = fget(i32Timeline);
 	if (!psCacheOpWorkItem->psTimeline || 
 		!psCacheOpWorkItem->psTimeline->private_data)
@@ -1663,7 +1698,7 @@ PVRSRV_ERROR CacheOpSetTimeline (IMG_INT32 i32Timeline)
 		return PVRSRV_OK;
 	}
 
-#if defined(CONFIG_SW_SYNC)
+#if defined(SUPPORT_NATIVE_FENCE_SYNC) && defined(CONFIG_SW_SYNC)
 	psFile = fget(i32Timeline);
 	if (!psFile || !psFile->private_data)
 	{
@@ -1715,7 +1750,7 @@ PVRSRV_ERROR CacheOpQueue (IMG_UINT32 ui32NumCacheOps,
 	for (ui32Idx = 0; ui32Idx < ui32NumCacheOps; ui32Idx++)
 	{
 		uiCacheOp = SetCacheOp(uiCacheOp, puiCacheOp[ui32Idx]);
-		if (puiCacheOp[ui32Idx] == PVRSRV_CACHE_OP_INVALIDATE)
+		if (puiCacheOp[ui32Idx] & PVRSRV_CACHE_OP_INVALIDATE)
 		{
 			/* Cannot be deferred, action now */
 			bHasInvalidate = IMG_TRUE;
@@ -1861,7 +1896,7 @@ PVRSRV_ERROR CacheOpSetTimeline (IMG_INT32 i32Timeline)
 		return PVRSRV_OK;
 	}
 
-#if defined(CONFIG_SW_SYNC)
+#if defined(SUPPORT_NATIVE_FENCE_SYNC) && defined(CONFIG_SW_SYNC)
 	psFile = fget(i32Timeline);
 	if (!psFile || !psFile->private_data)
 	{
@@ -1902,6 +1937,7 @@ PVRSRV_ERROR CacheOpExec (PMR *psPMR,
 						  PVRSRV_CACHE_OP uiCacheOp)
 {
 	PVRSRV_ERROR eError;
+	IMG_DEVMEM_SIZE_T uiLogicalSize;
 	IMG_BOOL bUsedGlobalFlush = IMG_FALSE;
 #if	defined(CACHEOP_DEBUG)
 	/* This interface is always synchronous and not deferred;
@@ -1921,6 +1957,23 @@ PVRSRV_ERROR CacheOpExec (PMR *psPMR,
 		OSAtomicIncrement(&ghCommonCacheOpSeqNum) : sCacheOpWorkItem.ui32OpSeqNum;
 #endif
 
+	eError = PMR_LogicalSize(psPMR, &uiLogicalSize);
+	if (eError != PVRSRV_OK)
+	{
+		PVR_DPF((CACHEOP_DPFL,
+				"%s: PMR_LogicalSize failed (%u)",
+				__FUNCTION__, eError));
+		goto e0;
+	}
+	else if ((uiOffset+uiSize) > uiLogicalSize)
+	{
+		PVR_DPF((CACHEOP_DPFL,
+				"%s: Invalid parameters",
+				__FUNCTION__));
+		eError = PVRSRV_ERROR_INVALID_PARAMS;
+		goto e0;
+	}
+
 	/* Perform range-based cache maintenance operation */
 	eError = PMRLockSysPhysAddresses(psPMR);
 	if (eError != PVRSRV_OK)
diff --git a/drivers/staging/imgtec/rogue/module_common.c b/drivers/staging/imgtec/rogue/module_common.c
index 640f394c421a..edee32c731db 100644
--- a/drivers/staging/imgtec/rogue/module_common.c
+++ b/drivers/staging/imgtec/rogue/module_common.c
@@ -173,6 +173,13 @@ EXPORT_SYMBOL(RGXHWPerfConfigureAndEnableCounters);
 EXPORT_SYMBOL(RGXHWPerfDisableCounters);
 EXPORT_SYMBOL(RGXHWPerfAcquireEvents);
 EXPORT_SYMBOL(RGXHWPerfReleaseEvents);
+EXPORT_SYMBOL(RGXHWPerfConvertCRTimeStamp);
+#if defined(SUPPORT_KERNEL_HWPERF_TEST)
+EXPORT_SYMBOL(OSAddTimer);
+EXPORT_SYMBOL(OSEnableTimer);
+EXPORT_SYMBOL(OSDisableTimer);
+EXPORT_SYMBOL(OSRemoveTimer);
+#endif
 #endif
 
 CONNECTION_DATA *LinuxConnectionFromFile(struct file *pFile)
diff --git a/drivers/staging/imgtec/rogue/osfunc.h b/drivers/staging/imgtec/rogue/osfunc.h
index 68a2c20a10f1..26fb8e2a91d8 100644
--- a/drivers/staging/imgtec/rogue/osfunc.h
+++ b/drivers/staging/imgtec/rogue/osfunc.h
@@ -1688,6 +1688,12 @@ void OSUserModeAccessToPerfCountersEn(void);
 */ /**************************************************************************/
 PVRSRV_ERROR OSDebugSignalPID(IMG_UINT32 ui32PID);
 
+#if defined(LINUX) && defined(__KERNEL__)
+#define OSWarnOn(a) WARN_ON(a)
+#else
+#define OSWarnOn(a) do { if(!!(a)) { OSDumpStack(); } } while(0)
+#endif
+
 #if defined(CONFIG_L4)
 #include <asm/api-l4env/api.h>
 #include <asm/io.h>
diff --git a/drivers/staging/imgtec/rogue/pvr_notifier.c b/drivers/staging/imgtec/rogue/pvr_notifier.c
index b8eb324da790..dd7d1365d272 100644
--- a/drivers/staging/imgtec/rogue/pvr_notifier.c
+++ b/drivers/staging/imgtec/rogue/pvr_notifier.c
@@ -416,15 +416,6 @@ PVRSRVDebugRequest(PVRSRV_DEVICE_NODE *psDevNode,
 
 	PVR_ASSERT(psDebugTable);
 
-	if (!pfnDumpDebugPrintf)
-	{
-		/*
-		 * Only dump the call stack to the kernel log if the debug text is going
-		 * there.
-		 */
-		OSDumpStack();
-	}
-
 	OSWRLockAcquireRead(psDebugTable->hLock);
 
 	if (ui32VerbLevel < IMG_ARR_NUM_ELEMS(apszVerbosityTable))
@@ -479,4 +470,12 @@ PVRSRVDebugRequest(PVRSRV_DEVICE_NODE *psDevNode,
 
 	PVR_DUMPDEBUG_LOG("------------[ PVR DBG: END ]------------");
 	OSWRLockReleaseRead(psDebugTable->hLock);
+
+	if (!pfnDumpDebugPrintf)
+	{
+		/* Only dump the call stack to the kernel log if the debug
+		 * dump has gone there
+		 */
+		OSWarnOn(IMG_TRUE);
+	}
 }
diff --git a/drivers/staging/imgtec/rogue/pvrsrv_tlcommon.h b/drivers/staging/imgtec/rogue/pvrsrv_tlcommon.h
index c02244c20ea5..766d044a1716 100644
--- a/drivers/staging/imgtec/rogue/pvrsrv_tlcommon.h
+++ b/drivers/staging/imgtec/rogue/pvrsrv_tlcommon.h
@@ -179,10 +179,11 @@ typedef enum _PVRSRVTL_PACKETTYPE_
  *        stream descriptor. Read from on the stream descriptor opened
  *        with this flag will fail.
  */
-#define PVRSRV_STREAM_FLAG_NONE                 (0U)
-#define PVRSRV_STREAM_FLAG_ACQUIRE_NONBLOCKING  (1U<<0)
-#define PVRSRV_STREAM_FLAG_OPEN_WAIT            (1U<<1)
-#define PVRSRV_STREAM_FLAG_OPEN_WO              (1U<<2)
+#define PVRSRV_STREAM_FLAG_NONE                        (0U)
+#define PVRSRV_STREAM_FLAG_ACQUIRE_NONBLOCKING         (1U<<0)
+#define PVRSRV_STREAM_FLAG_OPEN_WAIT                   (1U<<1)
+#define PVRSRV_STREAM_FLAG_OPEN_WO                     (1U<<2)
+#define PVRSRV_STREAM_FLAG_DISABLE_PRODUCER_CALLBACK   (1U<<3)
 
 #if defined (__cplusplus)
 }
diff --git a/drivers/staging/imgtec/rogue/rgx_meta.h b/drivers/staging/imgtec/rogue/rgx_meta.h
index 8bb0808c8298..a0924492eeb0 100644
--- a/drivers/staging/imgtec/rogue/rgx_meta.h
+++ b/drivers/staging/imgtec/rogue/rgx_meta.h
@@ -236,35 +236,46 @@ typedef struct
 
 #define RGXFW_SEGMMU_META_DM_ID			(0x7)
 
-#if defined(HW_ERN_45914)
-/* SLC caching strategy is emitted through the segment MMU. All the segments configured 
-   through this macro are CACHED in the SLC. The interface has been kept the same to 
-   simplify the code changes. The bifdm argument is ignored (no longer relevant). */
-#if defined(HW_ERN_49144)
-#define RGXFW_SEGMMU_OUTADDR_TOP_S7(pers, coheren, mmu_ctx)     ( (((IMG_UINT64) ((pers)    & 0x3))  << 50) | \
-                                                                  (((IMG_UINT64) ((mmu_ctx) & 0xFF)) << 42) | \
-                                                                  (((IMG_UINT64) ((coheren) & 0x1))  << 40) )
-#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED(mmu_ctx)         RGXFW_SEGMMU_OUTADDR_TOP_S7(0x3, 0x0, mmu_ctx)
-#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED(mmu_ctx)       RGXFW_SEGMMU_OUTADDR_TOP_S7(0x0, 0x1, mmu_ctx)
 
+/*
+ * SLC caching strategy in S7 is emitted through the segment MMU. All the segments
+ * configured through the macro RGXFW_SEGMMU_OUTADDR_TOP are CACHED in the SLC.
+ * The interface has been kept the same to simplify the code changes.
+ * The bifdm argument is ignored (no longer relevant) in S7.
+ */
+#define RGXFW_SEGMMU_OUTADDR_TOP_S7_ERN_49144(pers, coheren, mmu_ctx)  ( (((IMG_UINT64) ((pers)    & 0x3))  << 50) | \
+                                                                         (((IMG_UINT64) ((mmu_ctx) & 0xFF)) << 42) | \
+                                                                         (((IMG_UINT64) ((coheren) & 0x1))  << 40) )
+#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED_ERN_49144(mmu_ctx)      RGXFW_SEGMMU_OUTADDR_TOP_S7_ERN_49144(0x3, 0x0, mmu_ctx)
+#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED_ERN_49144(mmu_ctx)    RGXFW_SEGMMU_OUTADDR_TOP_S7_ERN_49144(0x0, 0x1, mmu_ctx)
 /* Set FW code/data cached in the SLC as default */
-#define RGXFW_SEGMMU_OUTADDR_TOP(mmu_ctx, bifdm)                RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED(mmu_ctx | (bifdm&0x0))
-#else
-#define RGXFW_SEGMMU_OUTADDR_TOP_S7(pers, coheren, mmu_ctx)     ( (((IMG_UINT64) ((pers)    & 0x3))  << 52) | \
-                                                                  (((IMG_UINT64) ((mmu_ctx) & 0xFF)) << 44) | \
-                                                                  (((IMG_UINT64) ((coheren) & 0x1))  << 40) )
-#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED(mmu_ctx)         RGXFW_SEGMMU_OUTADDR_TOP_S7(0x3, 0x0, mmu_ctx)
-#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED(mmu_ctx)       RGXFW_SEGMMU_OUTADDR_TOP_S7(0x0, 0x1, mmu_ctx)
+#define RGXFW_SEGMMU_OUTADDR_TOP_ERN_49144(mmu_ctx, bifdm)             RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED_ERN_49144(mmu_ctx | (bifdm&0x0))
 
+#define RGXFW_SEGMMU_OUTADDR_TOP_S7_ERN_45914(pers, coheren, mmu_ctx)  ( (((IMG_UINT64) ((pers)    & 0x3))  << 52) | \
+                                                                         (((IMG_UINT64) ((mmu_ctx) & 0xFF)) << 44) | \
+                                                                         (((IMG_UINT64) ((coheren) & 0x1))  << 40) )
+#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED_ERN_45914(mmu_ctx)      RGXFW_SEGMMU_OUTADDR_TOP_S7_ERN_45914(0x3, 0x0, mmu_ctx)
+#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED_ERN_45914(mmu_ctx)    RGXFW_SEGMMU_OUTADDR_TOP_S7_ERN_45914(0x0, 0x1, mmu_ctx)
 /* Set FW code/data cached in the SLC as default */
-#define RGXFW_SEGMMU_OUTADDR_TOP(mmu_ctx, bifdm)                RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED(mmu_ctx | (bifdm&0x0))
-#endif
-#else
+#define RGXFW_SEGMMU_OUTADDR_TOP_ERN_45914(mmu_ctx, bifdm)             RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED_ERN_45914(mmu_ctx | (bifdm&0x0))
+
 /* To configure the Page Catalog and BIF-DM fed into the BIF for Garten accesses through this segment */
-#define RGXFW_SEGMMU_OUTADDR_TOP(pc, bifdm)			            ( (((IMG_UINT64) ((pc)    & 0xF)) << 44) | \
+#define RGXFW_SEGMMU_OUTADDR_TOP_PRE_S7(pc, bifdm)              ( (((IMG_UINT64) ((pc)    & 0xF)) << 44) | \
                                                                   (((IMG_UINT64) ((bifdm) & 0xF)) << 40) )
+
+#if !defined(__KERNEL__) && defined(RGX_FEATURE_META)
+#if defined(HW_ERN_49144)
+#define RGXFW_SEGMMU_OUTADDR_TOP                  RGXFW_SEGMMU_OUTADDR_TOP_ERN_49144
+#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED  RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED_ERN_49144
+#elif defined(HW_ERN_45914)
+#define RGXFW_SEGMMU_OUTADDR_TOP                  RGXFW_SEGMMU_OUTADDR_TOP_ERN_45914
+#define RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED  RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED_ERN_45914
+#else
+#define RGXFW_SEGMMU_OUTADDR_TOP                  RGXFW_SEGMMU_OUTADDR_TOP_PRE_S7
+#endif
 #endif
 
+
 /* META segments have 4kB minimum size */
 #define RGXFW_SEGMMU_ALIGN			(0x1000) 
 
@@ -333,7 +344,7 @@ typedef struct
 	#define RGX_META_COREMEM_STACK_SIZE  (RGX_META_STACK_SIZE*2)
 	#define RGX_META_COREMEM_BSS_SIZE    (0xF40)
 	#if defined(RGX_FEATURE_META_DMA)
-		#define RGX_META_COREMEM_CCBBUF_SIZE (0x300)
+		#define RGX_META_COREMEM_CCBBUF_SIZE (0x3C0)
 		#define RGX_META_COREMEM_DATA_SIZE   (RGX_META_COREMEM_CCBBUF_SIZE + RGX_META_COREMEM_BSS_SIZE + RGX_META_COREMEM_STACK_SIZE)
 	#else
 		#define RGX_META_COREMEM_DATA_SIZE   (RGX_META_COREMEM_BSS_SIZE + RGX_META_COREMEM_STACK_SIZE)
@@ -342,7 +353,7 @@ typedef struct
 	#define RGX_META_COREMEM_STACK_SIZE  (RGX_META_STACK_SIZE)
 	#define RGX_META_COREMEM_BSS_SIZE    (0xB00)
 	#if defined(RGX_FEATURE_META_DMA)
-		#define RGX_META_COREMEM_CCBBUF_SIZE (0x300)
+		#define RGX_META_COREMEM_CCBBUF_SIZE (0x3C0)
 		#define RGX_META_COREMEM_DATA_SIZE   (RGX_META_COREMEM_CCBBUF_SIZE + RGX_META_COREMEM_BSS_SIZE + RGX_META_COREMEM_STACK_SIZE)
 	#else
 		#define RGX_META_COREMEM_DATA_SIZE   (RGX_META_COREMEM_BSS_SIZE + RGX_META_COREMEM_STACK_SIZE)
diff --git a/drivers/staging/imgtec/rogue/rgxapi_km.h b/drivers/staging/imgtec/rogue/rgxapi_km.h
index 1075b9dcca73..0730f1a85d5c 100644
--- a/drivers/staging/imgtec/rogue/rgxapi_km.h
+++ b/drivers/staging/imgtec/rogue/rgxapi_km.h
@@ -270,6 +270,25 @@ PVRSRV_ERROR RGXHWPerfReleaseEvents(
 		RGX_HWPERF_STREAM_ID eStreamId);
 
 
+/**************************************************************************/ /*!
+@Function       RGXHWPerfConvertCRTimeStamp
+@Description    Converts the timestamp given by FW events to the common OS
+                timestamp. The first three inputs are obtained via
+                a CLK_SYNC event, ui64CRTimeStamp is the CR timestamp
+                from the FW event to be converted.
+@Input          ui32ClkSpeed            Clock speed given by sync event
+@Input          ui64CorrCRTimeStamp     CR Timestamp given by sync event
+@Input          ui64CorrOSTimeStamp     Correlating OS Timestamp given by sync
+                                        event
+@Input          ui64CRTimeStamp         CR Timestamp to convert
+@Return         IMG_UINT64:             Calculated OS Timestamp
+ */ /**************************************************************************/
+IMG_UINT64 RGXHWPerfConvertCRTimeStamp(
+		IMG_UINT32 ui32ClkSpeed,
+		IMG_UINT64 ui64CorrCRTimeStamp,
+		IMG_UINT64 ui64CorrOSTimeStamp,
+		IMG_UINT64 ui64CRTimeStamp);
+
 #endif /* __RGXAPI_KM_H__ */
 
 /******************************************************************************
diff --git a/drivers/staging/imgtec/rogue/rgxfwimageutils.c b/drivers/staging/imgtec/rogue/rgxfwimageutils.c
index 3671567e5ed1..437147fe9a21 100644
--- a/drivers/staging/imgtec/rogue/rgxfwimageutils.c
+++ b/drivers/staging/imgtec/rogue/rgxfwimageutils.c
@@ -249,7 +249,7 @@ static void RGXFWConfigureSegMMU(const void       *hPrivate,
                                  IMG_DEV_VIRTADDR *psFWDataDevVAddrBase,
                                  IMG_UINT32       **ppui32BootConf)
 {
-	IMG_UINT64 ui64SegOutAddr;
+	IMG_UINT64 ui64SegOutAddrTop;
 	IMG_UINT32 i;
 
 	PVR_UNREFERENCED_PARAMETER(psFWCodeDevVAddrBase);
@@ -257,10 +257,28 @@ static void RGXFWConfigureSegMMU(const void       *hPrivate,
 	/* Configure Segment MMU */
 	RGXCommentLogInit(hPrivate, "********** FW configure Segment MMU **********");
 
+#if defined(SUPPORT_KERNEL_SRVINIT)
+	if (RGXDeviceHasErnBrnInit(hPrivate, HW_ERN_49144_BIT_MASK))
+	{
+		ui64SegOutAddrTop = RGXFW_SEGMMU_OUTADDR_TOP_ERN_49144(META_MMU_CONTEXT_MAPPING, RGXFW_SEGMMU_META_DM_ID);
+	}
+	else if (RGXDeviceHasErnBrnInit(hPrivate, HW_ERN_45914_BIT_MASK))
+	{
+		ui64SegOutAddrTop = RGXFW_SEGMMU_OUTADDR_TOP_ERN_45914(META_MMU_CONTEXT_MAPPING, RGXFW_SEGMMU_META_DM_ID);
+	}
+	else
+	{
+		ui64SegOutAddrTop = RGXFW_SEGMMU_OUTADDR_TOP_PRE_S7(META_MMU_CONTEXT_MAPPING, RGXFW_SEGMMU_META_DM_ID);
+	}
+#else
+	ui64SegOutAddrTop =  RGXFW_SEGMMU_OUTADDR_TOP(META_MMU_CONTEXT_MAPPING, RGXFW_SEGMMU_META_DM_ID);
+#endif
+
 	for (i = 0; i < RGXFW_META_NUM_DATA_SEGMENTS ; i++)
 	{
-		ui64SegOutAddr = (psFWDataDevVAddrBase->uiAddr |
-		                  RGXFW_SEGMMU_OUTADDR_TOP(META_MMU_CONTEXT_MAPPING, RGXFW_SEGMMU_META_DM_ID)) +
+		IMG_UINT64 ui64SegOutAddr;
+
+		ui64SegOutAddr = (psFWDataDevVAddrBase->uiAddr | ui64SegOutAddrTop) +
 		                  asRGXMetaFWDataSegments[i].ui32FWMemOffset;
 
 		RGXFWConfigureSegID(hPrivate,
diff --git a/drivers/staging/imgtec/rogue/rgxfwutils.c b/drivers/staging/imgtec/rogue/rgxfwutils.c
index 6d828156909a..55991ffacb54 100644
--- a/drivers/staging/imgtec/rogue/rgxfwutils.c
+++ b/drivers/staging/imgtec/rogue/rgxfwutils.c
@@ -3594,6 +3594,7 @@ void RGXCheckFirmwareCCB(PVRSRV_RGXDEV_INFO *psDevInfo)
 			case RGXFWIF_FWCCB_CMD_DEBUG_DUMP:
 			{
 				RGXDumpDebugInfo(NULL,NULL,psDevInfo);
+				OSWarnOn(IMG_TRUE);
 				break;
 			}
 
@@ -4599,7 +4600,6 @@ PVRSRV_ERROR RGXReadMETAAddr(PVRSRV_RGXDEV_INFO	*psDevInfo, IMG_UINT32 ui32METAA
 	return PVRSRV_OK;
 }
 
-
 /*
 	RGXUpdateHealthStatus
 */
diff --git a/drivers/staging/imgtec/rogue/rgxhwperf.c b/drivers/staging/imgtec/rogue/rgxhwperf.c
index 4c736f2304b7..74e95da427ce 100644
--- a/drivers/staging/imgtec/rogue/rgxhwperf.c
+++ b/drivers/staging/imgtec/rogue/rgxhwperf.c
@@ -70,8 +70,10 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "pvr_gputrace.h"
 #endif
 
-/* Defined to ensure HWPerf packets are not delayed */
-#define SUPPORT_TL_PROODUCER_CALLBACK 1
+/* This is defined by default to enable producer callbacks.
+ * Clients of the TL interface can disable the use of the callback
+ * with PVRSRV_STREAM_FLAG_DISABLE_PRODUCER_CALLBACK. */
+#define SUPPORT_TL_PRODUCER_CALLBACK 1
 
 /* Defines size of buffers returned from acquire/release calls */
 #define FW_STREAM_BUFFER_SIZE (0x80000)
@@ -398,8 +400,8 @@ PVRSRV_ERROR RGXHWPerfDataStoreCB(PVRSRV_DEVICE_NODE *psDevInfo)
 }
 
 
-/* Not currently supported by default */
-#if defined(SUPPORT_TL_PROODUCER_CALLBACK)
+/* Currently supported by default */
+#if defined(SUPPORT_TL_PRODUCER_CALLBACK)
 static PVRSRV_ERROR RGXHWPerfTLCB(IMG_HANDLE hStream,
 		IMG_UINT32 ui32ReqOp, IMG_UINT32* ui32Resp, void* pvUser)
 {
@@ -618,7 +620,7 @@ PVRSRV_ERROR RGXHWPerfInitOnDemandResources(void)
 					ui32L2BufferSize, 
 					TL_FLAG_RESERVE_DROP_NEWER | TL_FLAG_NO_SIGNAL_ON_COMMIT, 
 					NULL, NULL,
-#if !defined(SUPPORT_TL_PROODUCER_CALLBACK)
+#if !defined(SUPPORT_TL_PRODUCER_CALLBACK)
 					NULL, NULL
 #else
 					/* Not enabled  by default */
@@ -1281,7 +1283,7 @@ void RGXHWPerfHostDeInit(void)
 	if (gpsRgxDevInfo && gpsRgxDevInfo->hLockHWPerfHostStream)
 	{
 		OSLockDestroy(gpsRgxDevInfo->hLockHWPerfHostStream);
-		gpsRgxDevInfo->hLockHWPerfHostStream = IMG_FALSE;
+		gpsRgxDevInfo->hLockHWPerfHostStream = NULL;
 	}
 
 	/* Clear global RGX device reference */
@@ -1581,21 +1583,33 @@ cleanup:
 	_PostFunctionEpilogue();
 }
 
-static inline IMG_UINT32 _FixNameSizeAndCalculateHostAllocPacketSize(
+#define UNKNOWN_SYNC_NAME "UnknownSync"
+
+static inline IMG_UINT32 _FixNameAndCalculateHostAllocPacketSize(
                                        RGX_HWPERF_HOST_RESOURCE_TYPE eAllocType,
-                                       const IMG_CHAR *psName,
+                                       const IMG_CHAR **ppsName,
                                        IMG_UINT32 *ui32NameSize)
 {
 	RGX_HWPERF_HOST_ALLOC_DATA *psData;
 	RGX_HWPERF_HOST_ALLOC_DETAIL *puData;
 	IMG_UINT32 ui32Size = sizeof(psData->ui32AllocType);
 
-	/* first strip the terminator */
-	if (psName[*ui32NameSize - 1] == '\0')
-		*ui32NameSize -= 1;
-	/* if string longer than maximum cut it (leave space for '\0') */
-	if (*ui32NameSize >= SYNC_MAX_CLASS_NAME_LEN)
-		*ui32NameSize = SYNC_MAX_CLASS_NAME_LEN - 1;
+	if (*ppsName != NULL && *ui32NameSize > 0)
+	{
+		/* first strip the terminator */
+		if ((*ppsName)[*ui32NameSize - 1] == '\0')
+			*ui32NameSize -= 1;
+		/* if string longer than maximum cut it (leave space for '\0') */
+		if (*ui32NameSize >= SYNC_MAX_CLASS_NAME_LEN)
+			*ui32NameSize = SYNC_MAX_CLASS_NAME_LEN - 1;
+	}
+	else
+	{
+		PVR_DPF((PVR_DBG_WARNING, "RGXHWPerfHostPostAllocEvent: Invalid"
+		        " resource name given."));
+		*ppsName = UNKNOWN_SYNC_NAME;
+		*ui32NameSize = sizeof(UNKNOWN_SYNC_NAME) - 1;
+	}
 
 	switch (eAllocType)
 	{
@@ -1623,12 +1637,20 @@ static inline void _SetupHostAllocPacketData(IMG_UINT8 *pui8Dest,
 	RGX_HWPERF_HOST_ALLOC_DATA *psData = (RGX_HWPERF_HOST_ALLOC_DATA *)
 	        (pui8Dest + sizeof(RGX_HWPERF_V2_PACKET_HDR));
 	psData->ui32AllocType = eAllocType;
-	psData->uAllocDetail.sSyncAlloc.ui32FWAddr = ui32FWAddr;
-	OSStringNCopy(psData->uAllocDetail.sSyncAlloc.acName, psName,
-	              ui32NameSize);
-	/* we know here that string is not null terminated and that we have enough
-	 * space for the terminator */
-	psData->uAllocDetail.sSyncAlloc.acName[ui32NameSize] = '\0';
+
+	if (ui32NameSize)
+	{
+		OSStringNCopy(psData->uAllocDetail.sSyncAlloc.acName, psName,
+		              ui32NameSize);
+		/* we know here that string is not null terminated and that we have
+		 *enough space for the terminator */
+		psData->uAllocDetail.sSyncAlloc.acName[ui32NameSize] = '\0';
+	}
+	else
+	{
+		/* In case no name was given make sure we don't access random memory */
+		psData->uAllocDetail.sSyncAlloc.acName[0] = '\0';
+	}
 }
 
 void RGXHWPerfHostPostAllocEvent(RGX_HWPERF_HOST_RESOURCE_TYPE eAllocType,
@@ -1637,9 +1659,9 @@ void RGXHWPerfHostPostAllocEvent(RGX_HWPERF_HOST_RESOURCE_TYPE eAllocType,
                                  IMG_UINT32 ui32NameSize)
 {
 	IMG_UINT8 *pui8Dest;
-	IMG_UINT32 ui32Size =
-	        _FixNameSizeAndCalculateHostAllocPacketSize(eAllocType, psName,
-	                                                    &ui32NameSize);
+	IMG_UINT32 ui32Size = _FixNameAndCalculateHostAllocPacketSize(eAllocType,
+	                                                             &psName,
+	                                                             &ui32NameSize);
 
 	_PostFunctionPrologue();
 
@@ -1791,8 +1813,8 @@ static PVRSRV_ERROR RGXHWPerfFTraceGPUEnable(void)
 		IMG_UINT64 ui64UFOFilter = RGX_HWPERF_EVENT_MASK_VALUE(RGX_HWPERF_UFO) &
 								   gpsRgxDevInfo->ui64HWPerfFilter;
 
-		eError = PVRSRVRGXCtrlHWPerfKM(NULL, gpsRgxDevNode, IMG_FALSE,
-		                               RGX_HWPERF_STREAM_ID0_FW,
+		eError = PVRSRVRGXCtrlHWPerfKM(NULL, gpsRgxDevNode,
+		                               RGX_HWPERF_STREAM_ID0_FW, IMG_FALSE,
 		                               RGX_HWPERF_EVENT_MASK_HW_KICKFINISH |
 		                               ui64UFOFilter);
 		PVR_LOGG_IF_ERROR(eError, "PVRSRVRGXCtrlHWPerfKM", err_out);
@@ -2603,6 +2625,10 @@ PVRSRV_ERROR RGXHWPerfOpen(
 	RGX_KM_HWPERF_DEVDATA* psDevData = (RGX_KM_HWPERF_DEVDATA*) hDevData;
 	IMG_UINT32 ui32BufSize;
 
+	/* Disable producer callback by default for the Kernel API. */
+	IMG_UINT32 ui32StreamFlags = PVRSRV_STREAM_FLAG_ACQUIRE_NONBLOCKING |
+			                     PVRSRV_STREAM_FLAG_DISABLE_PRODUCER_CALLBACK;
+
 	/* Valid input argument values supplied by the caller */
 	if (!psDevData)
 	{
@@ -2650,7 +2676,7 @@ PVRSRV_ERROR RGXHWPerfOpen(
 	/* Open the RGX TL stream for reading in this session */
 	eError = TLClientOpenStream(DIRECT_BRIDGE_HANDLE,
 								PVRSRV_TL_HWPERF_RGX_FW_STREAM,
-								PVRSRV_STREAM_FLAG_ACQUIRE_NONBLOCKING,
+								ui32StreamFlags,
 								&psDevData->hSD[RGX_HWPERF_STREAM_ID0_FW]);
 	if (eError != PVRSRV_OK)
 	{
@@ -3085,6 +3111,35 @@ const IMG_CHAR *RGXHWPerfKickTypeToStr(RGX_HWPERF_KICK_TYPE eKickType)
 	return aszKickType[eKickType];
 }
 
+
+IMG_UINT64 RGXHWPerfConvertCRTimeStamp(
+		IMG_UINT32 ui32ClkSpeed,
+		IMG_UINT64 ui64CorrCRTimeStamp,
+		IMG_UINT64 ui64CorrOSTimeStamp,
+		IMG_UINT64 ui64CRTimeStamp)
+{
+	IMG_UINT32 ui32Remainder;
+	IMG_UINT64 ui64CRDeltaToOSDeltaKNs;
+	IMG_UINT64 ui64EventOSTimestamp, deltaRgxTimer, delta_ns;
+
+	if (!(ui64CRTimeStamp) || !(ui32ClkSpeed) || !(ui64CorrCRTimeStamp) || !(ui64CorrOSTimeStamp))
+	{
+		return 0;
+	}
+
+	ui64CRDeltaToOSDeltaKNs = RGXFWIF_GET_CRDELTA_TO_OSDELTA_K_NS(ui32ClkSpeed,
+																  ui32Remainder);
+
+	/* RGX CR timer ticks delta */
+	deltaRgxTimer = ui64CRTimeStamp - ui64CorrCRTimeStamp;
+	/* RGX time delta in nanoseconds */
+	delta_ns = RGXFWIF_GET_DELTA_OSTIME_NS(deltaRgxTimer, ui64CRDeltaToOSDeltaKNs);
+	/* Calculate OS time of HWPerf event */
+	ui64EventOSTimestamp = ui64CorrOSTimeStamp + delta_ns;
+
+	return ui64EventOSTimestamp;
+}
+
 /******************************************************************************
  End of file (rgxhwperf.c)
 ******************************************************************************/
diff --git a/drivers/staging/imgtec/rogue/rgxlayer.h b/drivers/staging/imgtec/rogue/rgxlayer.h
index fd843093912e..c23a2cf18c02 100644
--- a/drivers/staging/imgtec/rogue/rgxlayer.h
+++ b/drivers/staging/imgtec/rogue/rgxlayer.h
@@ -178,6 +178,21 @@ void RGXErrorLogInit(const void *hPrivate,
 ******************************************************************************/
 IMG_INTERNAL
 IMG_BOOL RGXDeviceHasFeatureInit(const void *hPrivate, IMG_UINT64 ui64Feature);
+
+/*!
+*******************************************************************************
+
+ @Function       RGXDeviceHasErnBrnInit
+
+ @Description    Checks if a device has a particular errata
+
+ @Input          hPrivate     : Implementation specific data
+ @Input          ui64ErnsBrns : Flags to check
+
+ @Return         IMG_TRUE if the given errata is available, IMG_FALSE otherwise
+
+******************************************************************************/
+IMG_BOOL RGXDeviceHasErnBrnInit(const void *hPrivate, IMG_UINT64 ui64ErnsBrns);
 #endif
 
 /*!
diff --git a/drivers/staging/imgtec/rogue/rgxlayer_impl.c b/drivers/staging/imgtec/rogue/rgxlayer_impl.c
index 8ed4f5340d24..e3e40810a680 100644
--- a/drivers/staging/imgtec/rogue/rgxlayer_impl.c
+++ b/drivers/staging/imgtec/rogue/rgxlayer_impl.c
@@ -136,6 +136,19 @@ IMG_BOOL RGXDeviceHasFeatureInit(const void *hPrivate, IMG_UINT64 ui64Feature)
 
 	return (psDevInfo->sDevFeatureCfg.ui64Features & ui64Feature) != 0;
 }
+
+IMG_BOOL RGXDeviceHasErnBrnInit(const void *hPrivate, IMG_UINT64 ui64ErnsBrns)
+{
+	PVRSRV_DEVICE_NODE *psDeviceNode;
+	PVRSRV_RGXDEV_INFO *psDevInfo;
+
+	PVR_ASSERT(hPrivate != NULL);
+
+	psDeviceNode = (PVRSRV_DEVICE_NODE *)(((RGX_INIT_LAYER_PARAMS *)hPrivate)->hServices);
+	psDevInfo = (PVRSRV_RGXDEV_INFO *)psDeviceNode->pvDevice;
+
+	return (psDevInfo->sDevFeatureCfg.ui64ErnsBrns & ui64ErnsBrns) != 0;
+}
 #endif
 
 IMG_UINT32 RGXGetFWCorememSize(const void *hPrivate)
diff --git a/drivers/staging/imgtec/rogue/rgxlayer_km_impl.c b/drivers/staging/imgtec/rogue/rgxlayer_km_impl.c
index e394c192ce49..a4121240fb78 100644
--- a/drivers/staging/imgtec/rogue/rgxlayer_km_impl.c
+++ b/drivers/staging/imgtec/rogue/rgxlayer_km_impl.c
@@ -521,6 +521,24 @@ IMG_BOOL RGXDoFWSlaveBoot(const void *hPrivate)
 	return PVRSRVSystemSnoopingOfCPUCache(psDevConfig);
 }
 
+static PVRSRV_ERROR RGXWriteMetaRegThroughSP(const void *hPrivate, IMG_UINT32 ui32RegAddr, IMG_UINT32 ui32RegValue)
+{
+	PVRSRV_ERROR eError = PVRSRV_OK;
+
+	/* Wait for Slave Port to be Ready */
+	eError = RGXPollReg32(hPrivate,
+	                      RGX_CR_META_SP_MSLVCTRL1,
+	                      RGX_CR_META_SP_MSLVCTRL1_READY_EN|RGX_CR_META_SP_MSLVCTRL1_GBLPORT_IDLE_EN,
+	                      RGX_CR_META_SP_MSLVCTRL1_READY_EN|RGX_CR_META_SP_MSLVCTRL1_GBLPORT_IDLE_EN);
+	if (eError != PVRSRV_OK) return eError;
+
+	/* Issue a Write */
+	RGXWriteReg32(hPrivate, RGX_CR_META_SP_MSLVCTRL0, ui32RegAddr);
+	RGXWriteReg32(hPrivate, RGX_CR_META_SP_MSLVDATAT, ui32RegValue);
+
+	return eError;
+}
+
 PVRSRV_ERROR RGXIOCoherencyTest(const void *hPrivate)
 {
 	PVRSRV_RGXDEV_INFO *psDevInfo;
@@ -529,8 +547,10 @@ PVRSRV_ERROR RGXIOCoherencyTest(const void *hPrivate)
 	RGXFWIF_DEV_VIRTADDR sCoherencyTestBuffer;
 	IMG_DEVMEM_SIZE_T uiCoherencyBlockSize = sizeof(IMG_UINT64);
 	IMG_DEVMEM_ALIGN_T uiCoherencyBlockAlign = sizeof(IMG_UINT64);
-	IMG_UINT32 ui32SLCCTRL;
+	IMG_UINT64 ui64SegOutAddrTopCached = 0, ui64SegOutAddrTopUncached = 0;
+	IMG_UINT32 ui32SLCCTRL = 0;
 	IMG_UINT32 ui32TestNum;
+	IMG_BOOL   bFeatureS7;
 	PVRSRV_ERROR eError = PVRSRV_OK;
 
 	PVR_ASSERT(hPrivate != NULL);
@@ -583,11 +603,33 @@ PVRSRV_ERROR RGXIOCoherencyTest(const void *hPrivate)
 		sCoherencyTestBuffer.ui32Addr |= RGXFW_SEGMMU_DATA_META_UNCACHED;
 	}
 
-	/* Bypass the SLC when IO coherency is enabled */
-	ui32SLCCTRL = RGXReadReg32(hPrivate, RGX_CR_SLC_CTRL_BYPASS);
-	RGXWriteReg32(hPrivate,
-	              RGX_CR_SLC_CTRL_BYPASS,
-	              ui32SLCCTRL | RGX_CR_SLC_CTRL_BYPASS_BYP_CC_EN);
+	bFeatureS7 = RGXDeviceHasFeaturePower(hPrivate, RGX_FEATURE_S7_TOP_INFRASTRUCTURE_BIT_MASK);
+
+	if (bFeatureS7)
+	{
+		if (RGXDeviceHasErnBrnPower(hPrivate, HW_ERN_49144_BIT_MASK))
+		{
+			ui64SegOutAddrTopCached   = RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED_ERN_49144(META_MMU_CONTEXT_MAPPING);
+			ui64SegOutAddrTopUncached = RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED_ERN_49144(META_MMU_CONTEXT_MAPPING);
+		}
+		else if (RGXDeviceHasErnBrnPower(hPrivate, HW_ERN_45914_BIT_MASK))
+		{
+			ui64SegOutAddrTopCached   = RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_CACHED_ERN_45914(META_MMU_CONTEXT_MAPPING);
+			ui64SegOutAddrTopUncached = RGXFW_SEGMMU_OUTADDR_TOP_S7_SLC_UNCACHED_ERN_45914(META_MMU_CONTEXT_MAPPING);
+		}
+
+		/* Configure META to use SLC force-linefill for the bootloader segment */
+		RGXWriteMetaRegThroughSP(hPrivate, META_CR_MMCU_SEGMENTn_OUTA1(6),
+		                         (ui64SegOutAddrTopUncached |  RGXFW_BOOTLDR_DEVV_ADDR) >> 32);
+	}
+	else
+	{
+		/* Bypass the SLC when IO coherency is enabled */
+		ui32SLCCTRL = RGXReadReg32(hPrivate, RGX_CR_SLC_CTRL_BYPASS);
+		RGXWriteReg32(hPrivate,
+		              RGX_CR_SLC_CTRL_BYPASS,
+		              ui32SLCCTRL | RGX_CR_SLC_CTRL_BYPASS_BYP_CC_EN);
+	}
 
 	for (ui32TestNum = 1; ui32TestNum < 3; ui32TestNum++)
 	{
@@ -636,8 +678,17 @@ PVRSRV_ERROR RGXIOCoherencyTest(const void *hPrivate)
 		         ui32TestNum, bPassed));
 	}
 
-	/* Restore SLC bypass settings */
-	RGXWriteReg32(hPrivate, RGX_CR_SLC_CTRL_BYPASS, ui32SLCCTRL);
+	if (bFeatureS7)
+	{
+		/* Restore bootloader segment settings */
+		RGXWriteMetaRegThroughSP(hPrivate, META_CR_MMCU_SEGMENTn_OUTA1(6),
+		                         (ui64SegOutAddrTopCached |  RGXFW_BOOTLDR_DEVV_ADDR) >> 32);
+	}
+	else
+	{
+		/* Restore SLC bypass settings */
+		RGXWriteReg32(hPrivate, RGX_CR_SLC_CTRL_BYPASS, ui32SLCCTRL);
+	}
 
 	RGXUnsetFirmwareAddress(psIOCoherencyTestMemDesc);
 	DevmemReleaseCpuVirtAddr(psIOCoherencyTestMemDesc);
diff --git a/drivers/staging/imgtec/rogue/rgxmipsmmuinit.h b/drivers/staging/imgtec/rogue/rgxmipsmmuinit.h
index 2983de3f6243..67fe49232a55 100644
--- a/drivers/staging/imgtec/rogue/rgxmipsmmuinit.h
+++ b/drivers/staging/imgtec/rogue/rgxmipsmmuinit.h
@@ -46,7 +46,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
    being otherwise cluttered by the contents of the latter */
 
 #ifndef _SRVKM_RGXMIPSMMUINIT_H_
-#define _SRVKM_RGXMMIPSMUINIT_H_
+#define _SRVKM_RGXMIPSMMUINIT_H_
 
 #include "device.h"
 #include "img_types.h"
diff --git a/drivers/staging/imgtec/rogue/tlintern.h b/drivers/staging/imgtec/rogue/tlintern.h
index 4b43373e5238..fbcc28b5e52e 100644
--- a/drivers/staging/imgtec/rogue/tlintern.h
+++ b/drivers/staging/imgtec/rogue/tlintern.h
@@ -253,7 +253,9 @@ IMG_BOOL  TLUnrefDescAndTryFreeStreamNode(PTL_SNODE psRemove, PTL_STREAM_DESC ps
  * Transport Layer stream interface to server part declared here to avoid
  * circular dependency.
  */
-IMG_UINT32 TLStreamAcquireReadPos(PTL_STREAM psStream, IMG_UINT32* puiReadOffset);
+IMG_UINT32 TLStreamAcquireReadPos(PTL_STREAM psStream,
+                                  IMG_BOOL bDisableCallback,
+                                  IMG_UINT32* puiReadOffset);
 void TLStreamAdvanceReadPos(PTL_STREAM psStream, IMG_UINT32 uiReadLen);
 
 DEVMEM_MEMDESC* TLStreamGetBufferPointer(PTL_STREAM psStream);
diff --git a/drivers/staging/imgtec/rogue/tlserver.c b/drivers/staging/imgtec/rogue/tlserver.c
index f7ff7515edfb..d300403ad1ab 100644
--- a/drivers/staging/imgtec/rogue/tlserver.c
+++ b/drivers/staging/imgtec/rogue/tlserver.c
@@ -527,7 +527,9 @@ TLServerAcquireDataKM(PTL_STREAM_DESC psSD,
 	//PVR_DPF((PVR_DBG_VERBOSE, "TLServerAcquireDataKM evList=%p, evObj=%p", psSD->psNode->hReadEventObj, psSD->hReadEvent));
 
 	/* Check for data in the associated stream buffer, sleep/wait if none */
-	while (((uiTmpLen = TLStreamAcquireReadPos(psNode->psStream, &uiTmpOffset)) == 0) &&
+	while (((uiTmpLen = TLStreamAcquireReadPos(psNode->psStream,
+			 psSD->ui32Flags & PVRSRV_STREAM_FLAG_DISABLE_PRODUCER_CALLBACK,
+			 &uiTmpOffset)) == 0) &&
 	       (!(psSD->ui32Flags&PVRSRV_STREAM_FLAG_ACQUIRE_NONBLOCKING)) )
 	{
 		PVR_DPF((PVR_DBG_VERBOSE, "TLAcquireDataKM sleeping..."));
diff --git a/drivers/staging/imgtec/rogue/tlstream.c b/drivers/staging/imgtec/rogue/tlstream.c
index 27c1fbb89d7f..2ae6ee4d9ea4 100644
--- a/drivers/staging/imgtec/rogue/tlstream.c
+++ b/drivers/staging/imgtec/rogue/tlstream.c
@@ -903,7 +903,9 @@ TLStreamSync(IMG_HANDLE psStream)
  * these functions are internal.
  */
 IMG_UINT32
-TLStreamAcquireReadPos(PTL_STREAM psStream, IMG_UINT32* puiReadOffset)
+TLStreamAcquireReadPos(PTL_STREAM psStream,
+                       IMG_BOOL bDisableCallback,
+                       IMG_UINT32* puiReadOffset)
 {
 	IMG_UINT32 uiReadLen = 0;
 	IMG_UINT32 ui32LRead, ui32LWrite;
@@ -918,7 +920,7 @@ TLStreamAcquireReadPos(PTL_STREAM psStream, IMG_UINT32* puiReadOffset)
 	ui32LWrite = psStream->ui32Write;
 
 	/* No data available and CB defined - try and get data */
-	if ((ui32LRead == ui32LWrite) && psStream->pfProducerCallback)
+	if ((ui32LRead == ui32LWrite) && psStream->pfProducerCallback && !bDisableCallback)
 	{
 		PVRSRV_ERROR eRc;
 		IMG_UINT32   ui32Resp = 0;