[PATCH v2 20/31] gpu: nova-core: handle the r000 load-and-execute HS binary event

[John Hubbard]

The r000 GSP boot protocol asks the driver to run a high-security binary
on the GSP falcon, and sends the framebuffer addresses of its code and
data in the event payload.

Nova-core has no handler for that event. It also has no way to restart
GSP-RM afterwards, which every load-and-execute event needs.

Add the handler. It DMAs the image into falcon memory, programs the BROM
registers that make the falcon verify the PKC signature, runs the binary,
and resumes GSP-RM. The aperture it loads through is context DMA slot 0,
set to local framebuffer, physical addressing and the BAR2 function 0
engine ID. Write FLCN_ERR_BINARY_NOT_STARTED to MAILBOX0 before
starting, which Open RM does so a binary that never runs is
distinguishable from one that succeeded, and which also clears the
suspend bit the next event polls.

Assisted-by: Cursor:claude-opus-5
Reviewed-by: Timur Tabi <ttabi@xxxxxxxxxx>
Signed-off-by: John Hubbard <jhubbard@xxxxxxxxxx>
---
 drivers/gpu/nova-core/falcon.rs   |  18 ++-
 drivers/gpu/nova-core/gsp/boot.rs | 229 +++++++++++++++++++++++++++++-
 drivers/gpu/nova-core/regs.rs     |   2 +
 3 files changed, 244 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/nova-core/falcon.rs b/drivers/gpu/nova-core/falcon.rs
index 644703c14924..43226ce16284 100644
--- a/drivers/gpu/nova-core/falcon.rs
+++ b/drivers/gpu/nova-core/falcon.rs
@@ -140,7 +140,6 @@ pub(crate) enum FalconMem {
 }
 
 /// Source offset of a raw falcon DMA transfer, added to the DMA base address.
-#[expect(dead_code)]
 #[derive(Copy, Clone)]
 pub(crate) enum FalconDmaSrcOffset {
     /// Byte offset from the DMA base address.
@@ -178,6 +177,17 @@ pub(crate) enum FalconFbifMemType with From<Bounded<u32, 1>> {
     }
 }
 
+bounded_enum! {
+    /// Engine ID a falcon DMA transfer is tagged with on its way through the FBIF.
+    #[derive(Debug, Copy, Clone)]
+    pub(crate) enum FalconFbifEngineIdFlag with From<Bounded<u32, 1>> {
+        /// Function 0's BAR2 engine ID.
+        Bar2Fn0 = 0,
+        /// The falcon's own engine ID.
+        Own = 1,
+    }
+}
+
 /// Type used to represent the `PFALCON` registers address base for a given falcon engine.
 pub(crate) struct PFalconBase(());
 
@@ -637,7 +647,6 @@ fn dma_wr(
     ///   target.
     /// - `ERANGE` if `src_addr` does not fit the `DMATRFBASE` register pair.
     /// - `EOVERFLOW` if a per-block source or destination offset exceeds `u32`.
-    #[expect(dead_code)]
     pub(crate) fn raw_dma_transfer(
         &self,
         ctx_dma: u8,
@@ -785,7 +794,10 @@ pub(crate) fn wait_till_halted(&self) -> Result<()> {
     ///
     /// The RISC-V GSP signals suspension by setting bit 31 (`0x8000_0000`) in `MAILBOX0`, rather
     /// than through `CPUCTL.halted`.
-    #[expect(dead_code)]
+    ///
+    /// Nothing else clears that bit, so the caller must write `MAILBOX0` before starting the
+    /// falcon CPU. A caller that runs this twice without an intervening write sees the first
+    /// suspension both times.
     pub(crate) fn wait_for_processor_suspend(&self) -> Result<()> {
         const INTERRUPT_PROCESSOR_SUSPENDED: u32 = 0x8000_0000;
 
diff --git a/drivers/gpu/nova-core/gsp/boot.rs b/drivers/gpu/nova-core/gsp/boot.rs
index dfc5be27384a..c8cb7597e532 100644
--- a/drivers/gpu/nova-core/gsp/boot.rs
+++ b/drivers/gpu/nova-core/gsp/boot.rs
@@ -3,9 +3,15 @@
 
 use kernel::{
     bits,
-    io::poll::read_poll_timeout,
+    device,
+    io::{
+        poll::read_poll_timeout,
+        register::WithBase,
+        Io, //
+    },
     prelude::*,
     time::Delta,
+    transmute::FromBytes,
     types::ScopeGuard, //
 };
 
@@ -13,13 +19,21 @@
     driver::Bar0,
     falcon::{
         gsp::Gsp,
-        Falcon, //
+        sec2::Sec2,
+        Falcon,
+        FalconDmaSrcOffset,
+        FalconFbifEngineIdFlag,
+        FalconFbifMemType,
+        FalconFbifTarget,
+        FalconMem,
+        FalconModSelAlgo, //
     },
     firmware::gsp::GspFirmware,
     gsp::{
         cmdq::Cmdq,
         commands, //
     },
+    regs, //
 };
 
 impl super::Gsp {
@@ -86,6 +100,181 @@ pub(crate) fn boot(
         Ok(unload_guard.dismiss().1)
     }
 
+    /// Restart GSP-RM once a load-and-execute image has run to completion.
+    ///
+    /// Resets the GSP falcon into RISC-V, hands it the libos boot arguments address through its
+    /// mailboxes, and starts SEC2, which is what brings GSP-RM back up. Open RM calls this
+    /// `kgspExecuteCoreResume`.
+    ///
+    /// # Errors
+    ///
+    /// - `EIO` if SEC2 reports a failure, or if the GSP is not running RISC-V afterwards.
+    /// - `ETIMEDOUT` if SEC2 does not complete the reload in time.
+    fn core_resume(
+        gsp_falcon: &Falcon<'_, Gsp>,
+        sec2_falcon: &Falcon<'_, Sec2>,
+        dev: &device::Device,
+        bootloader_app_version: u32,
+        libos_dma_handle: u64,
+    ) -> Result {
+        gsp_falcon.reset()?;
+
+        gsp_falcon.write_mailboxes(
+            Some(libos_dma_handle as u32),
+            Some((libos_dma_handle >> 32) as u32),
+        );
+
+        sec2_falcon.start()?;
+
+        gsp_falcon
+            .check_reload_completed(Delta::from_secs(2))
+            .inspect_err(|_| {
+                let mbox0 = sec2_falcon.read_mailbox0();
+                dev_err!(
+                    dev,
+                    "Timeout waiting for SEC2 to resume GSP-RM (SEC2 mbox0={:#x})\n",
+                    mbox0
+                );
+            })?;
+
+        let sec2_mbox0 = sec2_falcon.read_mailbox0();
+        if sec2_mbox0 != 0 {
+            dev_err!(
+                dev,
+                "SEC2 reported error during core resume: {:#x}\n",
+                sec2_mbox0
+            );
+            return Err(EIO);
+        }
+
+        gsp_falcon.write_os_version(bootloader_app_version);
+
+        if !gsp_falcon.is_riscv_active() {
+            dev_err!(dev, "GSP RISC-V not active after core resume\n");
+            return Err(EIO);
+        }
+
+        Ok(())
+    }
+
+    /// Handle a `GSP_LOAD_EXEC_HS_BINARY` event.
+    ///
+    /// The GSP asks the driver to run a high-security binary that it has already placed in the
+    /// framebuffer. The driver DMAs the image into falcon memory, programs the BROM registers
+    /// that make the falcon verify its PKC signature, runs it, and resumes GSP-RM.
+    ///
+    /// # Errors
+    ///
+    /// - `EINVAL` if the payload is shorter than the parameter block, or the ucode id does not
+    ///   fit the BROM register field.
+    /// - `ETIMEDOUT` if the GSP does not suspend, or the binary does not halt, in time.
+    #[expect(dead_code)]
+    fn handle_load_exec_hs_binary(
+        payload: &[u8],
+        gsp_falcon: &Falcon<'_, Gsp>,
+        sec2_falcon: &Falcon<'_, Sec2>,
+        bar: Bar0<'_>,
+        dev: &device::Device,
+        bootloader_app_version: u32,
+        libos_dma_handle: u64,
+    ) -> Result {
+        let params = HsBinaryParams::from_bytes_prefix(payload).ok_or(EINVAL)?.0;
+
+        gsp_falcon.wait_for_processor_suspend().inspect_err(|_| {
+            dev_err!(
+                dev,
+                "Timeout waiting for GSP suspend (mbox0={:#x})\n",
+                gsp_falcon.read_mailbox0()
+            );
+        })?;
+
+        gsp_falcon.reset()?;
+
+        gsp_falcon.dma_reset();
+        bar.update(
+            regs::NV_PFALCON_FBIF_TRANSCFG::of::<Gsp>().at(usize::from(HS_BINARY_CTX_DMA)),
+            |v| {
+                v.with_target(FalconFbifTarget::LocalFb)
+                    .with_mem_type(FalconFbifMemType::Physical)
+                    .with_engine_id_flag(FalconFbifEngineIdFlag::Bar2Fn0)
+            },
+        );
+
+        if params.ucode_imem_size > 0 {
+            gsp_falcon.raw_dma_transfer(
+                HS_BINARY_CTX_DMA,
+                params.imem_phys_addr,
+                FalconMem::ImemSecure,
+                FalconDmaSrcOffset::Offset(params.ucode_imem_va),
+                params.ucode_imem_pa,
+                params.ucode_imem_size,
+            )?;
+        }
+
+        if params.ucode_dmem_size > 0 {
+            // A valid DMEM virtual address makes the engine tag each loaded block with it, which
+            // is how the binary reaches its data.
+            let src = if params.ucode_dmem_va == FLCN_DMEM_VA_INVALID {
+                FalconDmaSrcOffset::Offset(0)
+            } else {
+                FalconDmaSrcOffset::DmemVa(params.ucode_dmem_va)
+            };
+
+            gsp_falcon.raw_dma_transfer(
+                HS_BINARY_CTX_DMA,
+                params.dmem_phys_addr,
+                FalconMem::Dmem,
+                src,
+                params.ucode_dmem_pa,
+                params.ucode_dmem_size,
+            )?;
+        }
+
+        bar.write(
+            WithBase::of::<Gsp>().at(0),
+            regs::NV_PFALCON2_FALCON_BROM_PARAADDR::zeroed().with_value(params.hs_sig_dmem_addr),
+        );
+        bar.write(
+            WithBase::of::<Gsp>(),
+            regs::NV_PFALCON2_FALCON_BROM_ENGIDMASK::zeroed().with_value(params.engine_id_mask),
+        );
+        bar.write(
+            WithBase::of::<Gsp>(),
+            regs::NV_PFALCON2_FALCON_BROM_CURR_UCODE_ID::zeroed()
+                .with_ucode_id(u8::try_from(params.ucode_id).map_err(|_| EINVAL)?),
+        );
+        bar.write(
+            WithBase::of::<Gsp>(),
+            regs::NV_PFALCON2_FALCON_MOD_SEL::zeroed().with_algo(FalconModSelAlgo::Rsa3k),
+        );
+
+        // Also clears the suspend bit that `wait_for_processor_suspend` polls, so the next
+        // load-and-execute event does not read this one's suspension.
+        gsp_falcon.write_mailboxes(Some(FLCN_ERR_BINARY_NOT_STARTED), None);
+
+        bar.write(
+            WithBase::of::<Gsp>(),
+            regs::NV_PFALCON_FALCON_BOOTVEC::zeroed().with_value(params.ucode_imem_va),
+        );
+
+        gsp_falcon.start()?;
+        gsp_falcon.wait_till_halted().inspect_err(|_| {
+            dev_err!(
+                dev,
+                "Timeout waiting for HS binary to halt (mbox0={:#x})\n",
+                gsp_falcon.read_mailbox0()
+            );
+        })?;
+
+        Self::core_resume(
+            gsp_falcon,
+            sec2_falcon,
+            dev,
+            bootloader_app_version,
+            libos_dma_handle,
+        )
+    }
+
     /// Shut down the GSP and wait until it is offline.
     fn shutdown_gsp(
         cmdq: &Cmdq,
@@ -146,3 +335,39 @@ pub(crate) fn unload(
         res.inspect(|()| dev_info!(dev, "GSP successfully unloaded\n"))
     }
 }
+
+/// Value Open RM leaves in `MAILBOX0` before starting a falcon binary, so a binary that never
+/// runs is distinguishable from one that ran and returned success.
+const FLCN_ERR_BINARY_NOT_STARTED: u32 = 0xfe;
+
+/// `ucode_dmem_va` value meaning the binary has no DMEM virtual address.
+const FLCN_DMEM_VA_INVALID: u32 = 0xffff_ffff;
+
+/// Context DMA slot the HS binary is loaded through. Open RM hardcodes slot 0 for this event and
+/// points it at local framebuffer.
+const HS_BINARY_CTX_DMA: u8 = 0;
+
+/// Parameters for loading and executing an HS (High-Security) binary.
+///
+/// Sent by GSP-RM as the payload of `GSP_LOAD_EXEC_HS_BINARY`. The firmware
+/// code and data are located in framebuffer memory at the given physical addresses.
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+struct HsBinaryParams {
+    imem_phys_addr: u64,
+    dmem_phys_addr: u64,
+    _reserved64: [u64; 2],
+    ucode_imem_va: u32,
+    ucode_imem_pa: u32,
+    ucode_imem_size: u32,
+    ucode_dmem_va: u32,
+    ucode_dmem_pa: u32,
+    ucode_dmem_size: u32,
+    hs_sig_dmem_addr: u32,
+    engine_id_mask: u32,
+    ucode_id: u32,
+    _reserved32: [u32; 3],
+}
+
+// SAFETY: This struct only contains integer types for which all bit patterns are valid.
+unsafe impl FromBytes for HsBinaryParams {}
diff --git a/drivers/gpu/nova-core/regs.rs b/drivers/gpu/nova-core/regs.rs
index 5501c36a56af..a3319694ec28 100644
--- a/drivers/gpu/nova-core/regs.rs
+++ b/drivers/gpu/nova-core/regs.rs
@@ -19,6 +19,7 @@
         FalconCoreRev,
         FalconCoreRevSubversion,
         FalconEngine,
+        FalconFbifEngineIdFlag,
         FalconFbifMemType,
         FalconFbifTarget,
         FalconMem,
@@ -353,6 +354,7 @@ pub(crate) fn usable_fb_size(self) -> u64 {
     }
 
     pub(crate) NV_PFALCON_FBIF_TRANSCFG(u32)[8] @ PFalconBase + 0x00000600 {
+        16:16   engine_id_flag => FalconFbifEngineIdFlag;
         2:2     mem_type => FalconFbifMemType;
         1:0     target ?=> FalconFbifTarget;
     }
-- 
2.55.0