gsp-phys: real GSP boot stages 3d/3e and the GSP-RM run-sequencer event

Stage 3d stages the GSP-RM boot from host sysmem (FMC, radix3 over the GSP-RM ELF, signature, message queues, libos LOGINIT/LOGRM/RMARGS and GSP arguments) and runs Booter Load on SEC2: GSP RISC-V reset, libos mailbox, IMEM/DMEM direct load, BOOTVEC=0, M0==0, FALCON_OS, RISC-V active. Stage 3e links the status queue and polls for GSP-RM events; it now also executes the inline run-sequencer command buffer (event 0x1002) against BAR0 (REG_WRITE/MODIFY/POLL, DELAY, STORE, CORE_* including CORE_RESUME) and then waits for GSP_INIT_DONE 0x1001.

Gated by gsp_phys_boot / gsp_phys_boot_dryrun (default off; the normal load path writes nothing). gsp_phys_fwsec=1 without gsp_phys_boot=1 is refused: a FWSEC-only carve cannot pass the booter-unload handoff gate. Release quiesces the GSP, runs the existing FWSEC-SB/booter-unload teardown and frees all staging.

tools/gen_gsp_bindata.py decodes the public generated archives into the Booter Load image (prod signature patched at 0x8700) and the GSP-RM boot (FMC) image; both are self-checked at build time.

1 files changed, 37 insertions, 0 deletions

diff --git a/kernel/gsp_phys_fwsec.h b/kernel/gsp_phys_fwsec.h
index cb8a499..d603a81 100644
--- a/kernel/gsp_phys_fwsec.h
+++ b/kernel/gsp_phys_fwsec.h
@@ -22,6 +22,43 @@
 bool gsp_phys_fwsec_enabled(void);
 bool gsp_phys_fwsec_dryrun_enabled(void);
 
+/*
+ * WPR2 state readers shared with the boot stages. WPR2 is up when the HI VAL
+ * field is nonzero; the val accessors apply the register's DRF_VAL shift
+ * (VALID bits live at 31:4). Read-only.
+ */
+bool gsp_phys_fwsec_wpr2_up(void __iomem *bar0);
+u32 gsp_phys_fwsec_wpr2_lo_val(void __iomem *bar0);
+u32 gsp_phys_fwsec_wpr2_hi_val(void __iomem *bar0);
+
+/*
+ * True when NV_FUSE_OPT_SECURE_GSP_DEBUG_DIS says the board is in debug mode
+ * (fuse field 0). The stage-3d Booter Load path is built from the production
+ * booter image and refuses a debug board through this predicate. Read-only
+ * and logs the raw fuse read.
+ */
+bool gsp_phys_fwsec_board_debug(void __iomem *bar0);
+
+/*
+ * Decoded NV_PGC6_BSI_VPR_SECURE_SCRATCH_14 boot-sequence state: the ACR
+ * binary version (bits 23:20), the four handoff bits (27:24, set in sequence
+ * by Booter Load, AHESASC -> Booter Reload, Booter Reload -> ACR Unload and
+ * ACR Unload -> Booter Unload) and the booter binary version (bits 31:28).
+ * Read-only; shared by the stage-3d telemetry log.
+ */
+struct gsp_phys_scratch14 {
+	u32 raw;
+	u8 acr_version;			/* ACR binary version, bits 23:20 */
+	u8 booter_load;			/* BOOTER_LOAD_HANDOFF, bit 24 */
+	u8 ahesasc_booter_reload;	/* AHESASC_BOOTER_RELOAD_HANDOFF, bit 25 */
+	u8 booter_reload_acr_unload;	/* BOOTER_RELOAD_ACR_UNLOAD_HANDOFF, 26 */
+	u8 acr_unload_booter_unload;	/* ACR_UNLOAD_BOOTER_UNLOAD_HANDOFF, 27 */
+	u8 booter_binary_version;	/* BOOTER_BINARY_VERSION, bits 31:28 */
+};
+
+void gsp_phys_fwsec_scratch14_read(void __iomem *bar0,
+				   struct gsp_phys_scratch14 *s);
+
 int gsp_phys_fwsec_run(struct gsp_phys_boot *boot, struct pci_dev *pdev,
 		       void __iomem *bar0);