Re: [PATCH v4 24/33] gpu: nova-core: Hopper/Blackwell: add FSP Chain of Trust boot

[John Hubbard]

On 2/17/26 10:16 AM, Danilo Krummrich wrote:
> On Tue Feb 10, 2026 at 3:45 AM CET, John Hubbard wrote:
>> +    /// Creates FMC boot parameters structure for FSP.
>> +    ///
>> +    /// This structure tells FSP how to boot GSP-RM with the correct memory layout.
>> +    pub(crate) fn create_fmc_boot_params(
>> +        dev: &device::Device<device::Bound>,
>> +        wpr_meta_addr: u64,
>> +        wpr_meta_size: u32,
>> +        libos_addr: u64,
>> +    ) -> Result<kernel::dma::CoherentAllocation<GspFmcBootParams>> {
>> +        use kernel::dma::CoherentAllocation;
>> +
>> +        const GSP_DMA_TARGET_COHERENT_SYSTEM: u32 = 1;
>> +        const GSP_DMA_TARGET_NONCOHERENT_SYSTEM: u32 = 2;
>> +
>> +        let fmc_boot_params = CoherentAllocation::<GspFmcBootParams>::alloc_coherent(
>> +            dev,
>> +            1,
>> +            GFP_KERNEL | __GFP_ZERO,
>> +        )?;
> 
> I've mentioned this in another context already (where it doesn't work
> unfortunately), but I think we should add a constructor that takes a closure
> with a &mut [T] argument, so we don't have to use dma_write!() for
> initialization. If you want I can prepare a patch.

Yes please. I'm up to 37 patches in this series now and am starting
to worry about it getting even larger.

> 
>> +
>> +        // Configure ACR boot parameters (WPR metadata location) using dma_write! macro
>> +        kernel::dma_write!(
>> +            fmc_boot_params[0].boot_gsp_rm_params.target = GSP_DMA_TARGET_COHERENT_SYSTEM
>> +        )?;
>> +        kernel::dma_write!(
>> +            fmc_boot_params[0].boot_gsp_rm_params.gsp_rm_desc_offset = wpr_meta_addr
>> +        )?;
>> +        kernel::dma_write!(fmc_boot_params[0].boot_gsp_rm_params.gsp_rm_desc_size = wpr_meta_size)?;
>> +
>> +        // Blackwell FSP expects wpr_carveout_offset and wpr_carveout_size to be zero;
>> +        // it obtains WPR info from other sources.
>> +        kernel::dma_write!(fmc_boot_params[0].boot_gsp_rm_params.b_is_gsp_rm_boot = 1)?;
>> +
>> +        // Configure RM parameters (libos location) using dma_write! macro
>> +        kernel::dma_write!(
>> +            fmc_boot_params[0].gsp_rm_params.target = GSP_DMA_TARGET_NONCOHERENT_SYSTEM
>> +        )?;
>> +        kernel::dma_write!(fmc_boot_params[0].gsp_rm_params.boot_args_offset = libos_addr)?;
>> +
>> +        Ok(fmc_boot_params)
>> +    }
>> +
>> +    /// Boot GSP FMC with pre-extracted signatures.
>> +    ///
>> +    /// This version takes pre-extracted signatures and FMC image data.
>> +    /// Used when signatures are extracted separately from the full ELF file.
>> +    #[allow(clippy::too_many_arguments)]
> 
> Maybe we should just add a FmcBootArgs type with a corresponding constructor.
> This should also get us rid of the helper function create_fmc_boot_params().

Done.

> 
>> +    pub(crate) fn boot_gsp_fmc_with_signatures(
>>          dev: &device::Device<device::Bound>,
>>          bar: &crate::driver::Bar0,
>> +        chipset: crate::gpu::Chipset,
>> +        fmc_image_fw: &crate::dma::DmaObject, // Contains only the image section
>> +        fmc_boot_params: &kernel::dma::CoherentAllocation<GspFmcBootParams>,
>> +        total_reserved_size: u64,
>> +        resume: bool,
>>          fsp_falcon: &crate::falcon::Falcon<crate::falcon::fsp::Fsp>,
>> -        nvdm_type: u32,
>> -        packet: &[u8],
>> +        signatures: &FmcSignatures,
>>      ) -> Result<()> {
>> +        dev_dbg!(dev, "Starting FSP boot sequence for {}\n", chipset);
>> +
>> +        // Build FSP Chain of Trust message
>> +        let fmc_addr = fmc_image_fw.dma_handle(); // Now points to image data only
>> +        let fmc_boot_params_addr = fmc_boot_params.dma_handle();
>> +
>> +        // frts_offset is relative to FB end: FRTS_location = FB_END - frts_offset
>> +        let frts_offset = if !resume {
>> +            let mut frts_reserved_size =
>> +                if let Some(heap_size) = crate::fb::hal::fb_hal(chipset).non_wpr_heap_size() {
>> +                    u64::from(heap_size)
>> +                } else {
>> +                    total_reserved_size
>> +                };
>> +
>> +            // Add PMU reserved size
>> +            frts_reserved_size += u64::from(crate::fb::PMU_RESERVED_SIZE);
>> +
>> +            frts_reserved_size
>> +                .align_up(Alignment::new::<SZ_2M>())
>> +                .unwrap_or(frts_reserved_size)
>> +        } else {
>> +            0
>> +        };
>> +        let frts_size = if !resume { SZ_1M as u32 } else { 0 };
>> +
>> +        // Build the FSP message
> 
> This comment seems superfluous.

Removed.

> 
>> +        let msg = KBox::new(
>> +            FspMessage {
>> +                mctp_header: (mctp::HEADER_SOM << mctp::HEADER_SOM_SHIFT)
>> +                    | (mctp::HEADER_EOM << mctp::HEADER_EOM_SHIFT)
>> +                    | (mctp::HEADER_SEID << mctp::HEADER_SEID_SHIFT)
>> +                    | (mctp::HEADER_SEQ << mctp::HEADER_SEQ_SHIFT),
>> +
>> +                nvdm_header: (mctp::MSG_TYPE_VENDOR_PCI)
>> +                    | (mctp::VENDOR_ID_NV << mctp::NVDM_VENDOR_ID_SHIFT)
>> +                    | (mctp::NVDM_TYPE_COT << mctp::NVDM_TYPE_SHIFT),
>> +
>> +                cot: NvdmPayloadCot {
>> +                    version: chipset.fsp_cot_version(),
>> +                    size: core::mem::size_of::<NvdmPayloadCot>() as u16,
>> +                    gsp_fmc_sysmem_offset: fmc_addr,
>> +                    frts_sysmem_offset: 0,
>> +                    frts_sysmem_size: 0,
>> +                    frts_vidmem_offset: frts_offset,
>> +                    frts_vidmem_size: frts_size,
>> +                    hash384: signatures.hash384,
>> +                    public_key: signatures.public_key,
>> +                    signature: signatures.signature,
>> +                    gsp_boot_args_sysmem_offset: fmc_boot_params_addr,
>> +                },
>> +            },
>> +            GFP_KERNEL,
>> +        )?;
>> +
>> +        // Send COT message to FSP and wait for response
>> +        Self::send_sync_fsp(dev, bar, fsp_falcon, &*msg)?;
>> +
>> +        dev_dbg!(dev, "FSP Chain of Trust completed successfully\n");
>> +        Ok(())
>> +    }
> 
> <snip>
> 
>> diff --git a/drivers/gpu/nova-core/gpu.rs b/drivers/gpu/nova-core/gpu.rs
>> index f04e2a795e90..88b1546e3cb4 100644
>> --- a/drivers/gpu/nova-core/gpu.rs
>> +++ b/drivers/gpu/nova-core/gpu.rs
>> @@ -124,6 +124,18 @@ pub(crate) const fn arch(&self) -> Architecture {
>>              | Self::GB207 => Architecture::Blackwell,
>>          }
>>      }
>> +
>> +    /// Returns the FSP Chain of Trust (COT) protocol version for this chipset.
>> +    ///
>> +    /// Hopper (GH100) uses version 1, Blackwell uses version 2.
>> +    pub(crate) const fn fsp_cot_version(&self) -> u16 {
>> +        match self.arch() {
>> +            Architecture::Hopper => 1,
>> +            Architecture::Blackwell => 2,
>> +            // Other architectures don't use FSP COT
>> +            _ => 0,
> 
> I think we should use a new type to represent this version and use Option, i.e.
> return Option<FspCotVersion>.

Done.
 

thanks,
-- 
John Hubbard