/* SPDX-License-Identifier: GPL-2.0 */
#ifndef GSP_PHYS_FWSEC_H
#define GSP_PHYS_FWSEC_H

#include <linux/types.h>
#include <linux/pci.h>
#include <linux/io.h>

#include "gsp_phys_boot.h"

/*
 * Real-GSP boot stage 3c: the FWSEC secure-verification run that carves
 * WPR2/FRTS on the claimed physical GPU, plus the teardown path that removes
 * WPR2 again before the device is handed back to the distribution driver.
 *
 * The stage is disabled by default (gsp_phys_fwsec=N); claim must be enabled
 * too (gsp_phys_gpu=1 + gsp_phys_hazard_ack=1) and the boot layout (stage 3b)
 * must have succeeded. Every step logs its register reads; failures abort and
 * the recovery path is attempted immediately.
 */

bool gsp_phys_fwsec_enabled(void);
bool gsp_phys_fwsec_dryrun_enabled(void);

/*
 * WPR2 state readers shared with the boot stages. WPR2 is up when the HI VAL
 * field is nonzero; the val accessors apply the register's DRF_VAL shift
 * (VALID bits live at 31:4). Read-only.
 */
bool gsp_phys_fwsec_wpr2_up(void __iomem *bar0);
u32 gsp_phys_fwsec_wpr2_lo_val(void __iomem *bar0);
u32 gsp_phys_fwsec_wpr2_hi_val(void __iomem *bar0);

/*
 * True when NV_FUSE_OPT_SECURE_GSP_DEBUG_DIS says the board is in debug mode
 * (fuse field 0). The stage-3d Booter Load path is built from the production
 * booter image and refuses a debug board through this predicate. Read-only
 * and logs the raw fuse read.
 */
bool gsp_phys_fwsec_board_debug(void __iomem *bar0);

/*
 * Decoded NV_PGC6_BSI_VPR_SECURE_SCRATCH_14 boot-sequence state: the ACR
 * binary version (bits 23:20), the four handoff bits (27:24, set in sequence
 * by Booter Load, AHESASC -> Booter Reload, Booter Reload -> ACR Unload and
 * ACR Unload -> Booter Unload) and the booter binary version (bits 31:28).
 * Read-only; shared by the stage-3d telemetry log.
 */
struct gsp_phys_scratch14 {
	u32 raw;
	u8 acr_version;			/* ACR binary version, bits 23:20 */
	u8 booter_load;			/* BOOTER_LOAD_HANDOFF, bit 24 */
	u8 ahesasc_booter_reload;	/* AHESASC_BOOTER_RELOAD_HANDOFF, bit 25 */
	u8 booter_reload_acr_unload;	/* BOOTER_RELOAD_ACR_UNLOAD_HANDOFF, 26 */
	u8 acr_unload_booter_unload;	/* ACR_UNLOAD_BOOTER_UNLOAD_HANDOFF, 27 */
	u8 booter_binary_version;	/* BOOTER_BINARY_VERSION, bits 31:28 */
};

void gsp_phys_fwsec_scratch14_read(void __iomem *bar0,
				   struct gsp_phys_scratch14 *s);

int gsp_phys_fwsec_run(struct gsp_phys_boot *boot, struct pci_dev *pdev,
		       void __iomem *bar0);

/*
 * Read-only subset of stage 3c: VBIOS/PROM read, IFR/expansion-ROM/BIT
 * parse, FWSEC ucode extraction, capacity-register reads and the complete
 * staging/placement computation, logged under the
 * "vgsp-fwsec-dryrun:" prefix. No BAR0 writes, no falcon resets, no DMA
 * kicks; readl() of state registers is the only device interaction. Mutually
 * exclusive with gsp_phys_fwsec=1 (both set is a hard refusal).
 */
int gsp_phys_fwsec_dryrun_run(struct gsp_phys_boot *boot, struct pci_dev *pdev,
			      void __iomem *bar0);

/*
 * Prepare the device for hand-back. If a FWSEC run programmed WPR2, run the
 * teardown (FWSEC-SB + booter unload) while the module still owns BAR0.
 * Returns nonzero when WPR2 could not be torn down: the caller must then
 * refuse to rebind the distribution driver and keep the power-domain locks.
 */
int gsp_phys_fwsec_release(struct gsp_phys_boot *boot, struct pci_dev *pdev,
			   void __iomem *bar0);

#endif /* GSP_PHYS_FWSEC_H */