On Tue Feb 10, 2026 at 3:45 AM CET, John Hubbard wrote:
> + /// Creates FMC boot parameters structure for FSP.
> + ///
> + /// This structure tells FSP how to boot GSP-RM with the correct memory
> layout.
> + pub(crate) fn create_fmc_boot_params(
> + dev: &device::Device<device::Bound>,
> + wpr_meta_addr: u64,
> + wpr_meta_size: u32,
> + libos_addr: u64,
> + ) -> Result<kernel::dma::CoherentAllocation<GspFmcBootParams>> {
> + use kernel::dma::CoherentAllocation;
> +
> + const GSP_DMA_TARGET_COHERENT_SYSTEM: u32 = 1;
> + const GSP_DMA_TARGET_NONCOHERENT_SYSTEM: u32 = 2;
> +
> + let fmc_boot_params =
> CoherentAllocation::<GspFmcBootParams>::alloc_coherent(
> + dev,
> + 1,
> + GFP_KERNEL | __GFP_ZERO,
> + )?;
I've mentioned this in another context already (where it doesn't work
unfortunately), but I think we should add a constructor that takes a closure
with a &mut [T] argument, so we don't have to use dma_write!() for
initialization. If you want I can prepare a patch.
> +
> + // Configure ACR boot parameters (WPR metadata location) using
> dma_write! macro
> + kernel::dma_write!(
> + fmc_boot_params[0].boot_gsp_rm_params.target =
> GSP_DMA_TARGET_COHERENT_SYSTEM
> + )?;
> + kernel::dma_write!(
> + fmc_boot_params[0].boot_gsp_rm_params.gsp_rm_desc_offset =
> wpr_meta_addr
> + )?;
> +
> kernel::dma_write!(fmc_boot_params[0].boot_gsp_rm_params.gsp_rm_desc_size =
> wpr_meta_size)?;
> +
> + // Blackwell FSP expects wpr_carveout_offset and wpr_carveout_size
> to be zero;
> + // it obtains WPR info from other sources.
> +
> kernel::dma_write!(fmc_boot_params[0].boot_gsp_rm_params.b_is_gsp_rm_boot =
> 1)?;
> +
> + // Configure RM parameters (libos location) using dma_write! macro
> + kernel::dma_write!(
> + fmc_boot_params[0].gsp_rm_params.target =
> GSP_DMA_TARGET_NONCOHERENT_SYSTEM
> + )?;
> + kernel::dma_write!(fmc_boot_params[0].gsp_rm_params.boot_args_offset
> = libos_addr)?;
> +
> + Ok(fmc_boot_params)
> + }
> +
> + /// Boot GSP FMC with pre-extracted signatures.
> + ///
> + /// This version takes pre-extracted signatures and FMC image data.
> + /// Used when signatures are extracted separately from the full ELF file.
> + #[allow(clippy::too_many_arguments)]
Maybe we should just add a FmcBootArgs type with a corresponding constructor.
This should also get us rid of the helper function create_fmc_boot_params().
> + pub(crate) fn boot_gsp_fmc_with_signatures(
> dev: &device::Device<device::Bound>,
> bar: &crate::driver::Bar0,
> + chipset: crate::gpu::Chipset,
> + fmc_image_fw: &crate::dma::DmaObject, // Contains only the image
> section
> + fmc_boot_params: &kernel::dma::CoherentAllocation<GspFmcBootParams>,
> + total_reserved_size: u64,
> + resume: bool,
> fsp_falcon: &crate::falcon::Falcon<crate::falcon::fsp::Fsp>,
> - nvdm_type: u32,
> - packet: &[u8],
> + signatures: &FmcSignatures,
> ) -> Result<()> {
> + dev_dbg!(dev, "Starting FSP boot sequence for {}\n", chipset);
> +
> + // Build FSP Chain of Trust message
> + let fmc_addr = fmc_image_fw.dma_handle(); // Now points to image
> data only
> + let fmc_boot_params_addr = fmc_boot_params.dma_handle();
> +
> + // frts_offset is relative to FB end: FRTS_location = FB_END -
> frts_offset
> + let frts_offset = if !resume {
> + let mut frts_reserved_size =
> + if let Some(heap_size) =
> crate::fb::hal::fb_hal(chipset).non_wpr_heap_size() {
> + u64::from(heap_size)
> + } else {
> + total_reserved_size
> + };
> +
> + // Add PMU reserved size
> + frts_reserved_size += u64::from(crate::fb::PMU_RESERVED_SIZE);
> +
> + frts_reserved_size
> + .align_up(Alignment::new::<SZ_2M>())
> + .unwrap_or(frts_reserved_size)
> + } else {
> + 0
> + };
> + let frts_size = if !resume { SZ_1M as u32 } else { 0 };
> +
> + // Build the FSP message
This comment seems superfluous.
> + let msg = KBox::new(
> + FspMessage {
> + mctp_header: (mctp::HEADER_SOM << mctp::HEADER_SOM_SHIFT)
> + | (mctp::HEADER_EOM << mctp::HEADER_EOM_SHIFT)
> + | (mctp::HEADER_SEID << mctp::HEADER_SEID_SHIFT)
> + | (mctp::HEADER_SEQ << mctp::HEADER_SEQ_SHIFT),
> +
> + nvdm_header: (mctp::MSG_TYPE_VENDOR_PCI)
> + | (mctp::VENDOR_ID_NV << mctp::NVDM_VENDOR_ID_SHIFT)
> + | (mctp::NVDM_TYPE_COT << mctp::NVDM_TYPE_SHIFT),
> +
> + cot: NvdmPayloadCot {
> + version: chipset.fsp_cot_version(),
> + size: core::mem::size_of::<NvdmPayloadCot>() as u16,
> + gsp_fmc_sysmem_offset: fmc_addr,
> + frts_sysmem_offset: 0,
> + frts_sysmem_size: 0,
> + frts_vidmem_offset: frts_offset,
> + frts_vidmem_size: frts_size,
> + hash384: signatures.hash384,
> + public_key: signatures.public_key,
> + signature: signatures.signature,
> + gsp_boot_args_sysmem_offset: fmc_boot_params_addr,
> + },
> + },
> + GFP_KERNEL,
> + )?;
> +
> + // Send COT message to FSP and wait for response
> + Self::send_sync_fsp(dev, bar, fsp_falcon, &*msg)?;
> +
> + dev_dbg!(dev, "FSP Chain of Trust completed successfully\n");
> + Ok(())
> + }
<snip>
> diff --git a/drivers/gpu/nova-core/gpu.rs b/drivers/gpu/nova-core/gpu.rs
> index f04e2a795e90..88b1546e3cb4 100644
> --- a/drivers/gpu/nova-core/gpu.rs
> +++ b/drivers/gpu/nova-core/gpu.rs
> @@ -124,6 +124,18 @@ pub(crate) const fn arch(&self) -> Architecture {
> | Self::GB207 => Architecture::Blackwell,
> }
> }
> +
> + /// Returns the FSP Chain of Trust (COT) protocol version for this
> chipset.
> + ///
> + /// Hopper (GH100) uses version 1, Blackwell uses version 2.
> + pub(crate) const fn fsp_cot_version(&self) -> u16 {
> + match self.arch() {
> + Architecture::Hopper => 1,
> + Architecture::Blackwell => 2,
> + // Other architectures don't use FSP COT
> + _ => 0,
I think we should use a new type to represent this version and use Option, i.e.
return Option<FspCotVersion>.
