1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
|
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef GSP_PHYS_FWSEC_H
#define GSP_PHYS_FWSEC_H
#include <linux/types.h>
#include <linux/pci.h>
#include <linux/io.h>
#include "gsp_phys_boot.h"
/*
* Real-GSP boot stage 3c: the FWSEC secure-verification run that carves
* WPR2/FRTS on the claimed physical GPU, plus the teardown path that removes
* WPR2 again before the device is handed back to the distribution driver.
*
* The stage is disabled by default (gsp_phys_fwsec=N); claim must be enabled
* too (gsp_phys_gpu=1 + gsp_phys_hazard_ack=1) and the boot layout (stage 3b)
* must have succeeded. Every step logs its register reads; failures abort and
* the recovery path is attempted immediately.
*/
bool gsp_phys_fwsec_enabled(void);
bool gsp_phys_fwsec_dryrun_enabled(void);
/*
* WPR2 state readers shared with the boot stages. WPR2 is up when the HI VAL
* field is nonzero; the val accessors apply the register's DRF_VAL shift
* (VALID bits live at 31:4). Read-only.
*/
bool gsp_phys_fwsec_wpr2_up(void __iomem *bar0);
u32 gsp_phys_fwsec_wpr2_lo_val(void __iomem *bar0);
u32 gsp_phys_fwsec_wpr2_hi_val(void __iomem *bar0);
/*
* True when NV_FUSE_OPT_SECURE_GSP_DEBUG_DIS says the board is in debug mode
* (fuse field 0). The stage-3d Booter Load path is built from the production
* booter image and refuses a debug board through this predicate. Read-only
* and logs the raw fuse read.
*/
bool gsp_phys_fwsec_board_debug(void __iomem *bar0);
/*
* Decoded NV_PGC6_BSI_VPR_SECURE_SCRATCH_14 boot-sequence state: the ACR
* binary version (bits 23:20), the four handoff bits (27:24, set in sequence
* by Booter Load, AHESASC -> Booter Reload, Booter Reload -> ACR Unload and
* ACR Unload -> Booter Unload) and the booter binary version (bits 31:28).
* Read-only; shared by the stage-3d telemetry log.
*/
struct gsp_phys_scratch14 {
u32 raw;
u8 acr_version; /* ACR binary version, bits 23:20 */
u8 booter_load; /* BOOTER_LOAD_HANDOFF, bit 24 */
u8 ahesasc_booter_reload; /* AHESASC_BOOTER_RELOAD_HANDOFF, bit 25 */
u8 booter_reload_acr_unload; /* BOOTER_RELOAD_ACR_UNLOAD_HANDOFF, 26 */
u8 acr_unload_booter_unload; /* ACR_UNLOAD_BOOTER_UNLOAD_HANDOFF, 27 */
u8 booter_binary_version; /* BOOTER_BINARY_VERSION, bits 31:28 */
};
void gsp_phys_fwsec_scratch14_read(void __iomem *bar0,
struct gsp_phys_scratch14 *s);
int gsp_phys_fwsec_run(struct gsp_phys_boot *boot, struct pci_dev *pdev,
void __iomem *bar0);
/*
* Read-only subset of stage 3c: VBIOS/PROM read, IFR/expansion-ROM/BIT
* parse, FWSEC ucode extraction, capacity-register reads and the complete
* staging/placement computation, logged under the
* "gsp-phys-fwsec-dryrun:" prefix. No BAR0 writes, no falcon resets, no DMA
* kicks; readl() of state registers is the only device interaction. Mutually
* exclusive with gsp_phys_fwsec=1 (both set is a hard refusal).
*/
int gsp_phys_fwsec_dryrun_run(struct gsp_phys_boot *boot, struct pci_dev *pdev,
void __iomem *bar0);
/*
* Prepare the device for hand-back. If a FWSEC run programmed WPR2, run the
* teardown (FWSEC-SB + booter unload) while the module still owns BAR0.
* Returns nonzero when WPR2 could not be torn down: the caller must then
* refuse to rebind the distribution driver and keep the power-domain locks.
*/
int gsp_phys_fwsec_release(struct gsp_phys_boot *boot, struct pci_dev *pdev,
void __iomem *bar0);
#endif /* GSP_PHYS_FWSEC_H */
|
