// SPDX-License-Identifier: GPL-2.0// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. //! Contains structures and functions dedicated to the parsing, building and patching of firmwares//! to be loaded into a given execution unit. use core::marker::PhantomData;use core::ops::Deref; use kernel::{    firmware,    prelude::*, //}; use crate::{    falcon::{        FalconDmaLoadTarget,        FalconFirmware, //    },    gpu,    gsp::boot_firmware_files,    num::IntoSafeCast, //}; pub(crate) mod booter;pub(crate) mod fsp;pub(crate) mod fwsec;pub(crate) mod gsp;pub(crate) mod riscv;pub(crate) mod tlv; /// Structure used to describe some firmwares, notably FWSEC-FRTS.#[repr(C)]#[derive(Debug, Clone, FromBytes)]pub(crate) struct FalconUCodeDescV2 {    /// Header defined by 'NV_BIT_FALCON_UCODE_DESC_HEADER_VDESC*' in OpenRM.    hdr: u32,    /// Stored size of the ucode after the header, compressed or uncompressed    stored_size: u32,    /// Uncompressed size of the ucode.  If store_size == uncompressed_size, then the ucode    /// is not compressed.    pub(crate) uncompressed_size: u32,    /// Code entry point    pub(crate) virtual_entry: u32,    /// Offset after the code segment at which the Application Interface Table headers are located.    pub(crate) interface_offset: u32,    /// Base address at which to load the code segment into 'IMEM'.    pub(crate) imem_phys_base: u32,    /// Size in bytes of the code to copy into 'IMEM' (includes both secure and non-secure    /// segments).    pub(crate) imem_load_size: u32,    /// Virtual 'IMEM' address (i.e. 'tag') at which the code should start.    pub(crate) imem_virt_base: u32,    /// Virtual address of secure IMEM segment.    pub(crate) imem_sec_base: u32,    /// Size of secure IMEM segment.    pub(crate) imem_sec_size: u32,    /// Offset into stored (uncompressed) image at which DMEM begins.    pub(crate) dmem_offset: u32,    /// Base address at which to load the data segment into 'DMEM'.    pub(crate) dmem_phys_base: u32,    /// Size in bytes of the data to copy into 'DMEM'.    pub(crate) dmem_load_size: u32,    /// "Alternate" Size of data to load into IMEM.    pub(crate) alt_imem_load_size: u32,    /// "Alternate" Size of data to load into DMEM.    pub(crate) alt_dmem_load_size: u32,} /// Structure used to describe some firmwares, notably FWSEC-FRTS.#[repr(C)]#[derive(Debug, Clone, FromBytes)]pub(crate) struct FalconUCodeDescV3 {    /// Header defined by `NV_BIT_FALCON_UCODE_DESC_HEADER_VDESC*` in OpenRM.    hdr: u32,    /// Stored size of the ucode after the header.    stored_size: u32,    /// Offset in `DMEM` at which the signature is expected to be found.    pub(crate) pkc_data_offset: u32,    /// Offset after the code segment at which the app headers are located.    pub(crate) interface_offset: u32,    /// Base address at which to load the code segment into `IMEM`.    pub(crate) imem_phys_base: u32,    /// Size in bytes of the code to copy into `IMEM`.    pub(crate) imem_load_size: u32,    /// Virtual `IMEM` address (i.e. `tag`) at which the code should start.    pub(crate) imem_virt_base: u32,    /// Base address at which to load the data segment into `DMEM`.    pub(crate) dmem_phys_base: u32,    /// Size in bytes of the data to copy into `DMEM`.    pub(crate) dmem_load_size: u32,    /// Mask of the falcon engines on which this firmware can run.    pub(crate) engine_id_mask: u16,    /// ID of the ucode used to infer a fuse register to validate the signature.    pub(crate) ucode_id: u8,    /// Number of signatures in this firmware.    pub(crate) signature_count: u8,    /// Versions of the signatures, used to infer a valid signature to use.    pub(crate) signature_versions: u16,    _reserved: u16,} /// Enum wrapping the different versions of Falcon microcode descriptors.////// This allows handling both V2 and V3 descriptor formats through a/// unified type, providing version-agnostic access to firmware metadata/// via the [`FalconUCodeDescriptor`] trait.#[derive(Debug, Clone)]pub(crate) enum FalconUCodeDesc {    V2(FalconUCodeDescV2),    V3(FalconUCodeDescV3),} impl Deref for FalconUCodeDesc {    type Target = dyn FalconUCodeDescriptor;     fn deref(&self) -> &Self::Target {        match self {            FalconUCodeDesc::V2(v2) => v2,            FalconUCodeDesc::V3(v3) => v3,        }    }} /// Trait providing a common interface for accessing Falcon microcode descriptor fields.////// This trait abstracts over the different descriptor versions ([`FalconUCodeDescV2`] and/// [`FalconUCodeDescV3`]), allowing code to work with firmware metadata without needing to/// know the specific descriptor version. Fields not present return zero.pub(crate) trait FalconUCodeDescriptor {    fn hdr(&self) -> u32;    fn imem_load_size(&self) -> u32;    fn interface_offset(&self) -> u32;    fn dmem_load_size(&self) -> u32;    fn pkc_data_offset(&self) -> u32;    fn engine_id_mask(&self) -> u16;    fn ucode_id(&self) -> u8;    fn signature_count(&self) -> u8;    fn signature_versions(&self) -> u16;     /// Returns the size in bytes of the header.    fn size(&self) -> usize {        let hdr = self.hdr();         const HDR_SIZE_SHIFT: u32 = 16;        const HDR_SIZE_MASK: u32 = 0xffff0000;        ((hdr & HDR_SIZE_MASK) >> HDR_SIZE_SHIFT).into_safe_cast()    }     fn imem_sec_load_params(&self) -> FalconDmaLoadTarget;    fn imem_ns_load_params(&self) -> Option<FalconDmaLoadTarget>;    fn dmem_load_params(&self) -> FalconDmaLoadTarget;} impl FalconUCodeDescriptor for FalconUCodeDescV2 {    fn hdr(&self) -> u32 {        self.hdr    }    fn imem_load_size(&self) -> u32 {        self.imem_load_size    }    fn interface_offset(&self) -> u32 {        self.interface_offset    }    fn dmem_load_size(&self) -> u32 {        self.dmem_load_size    }    fn pkc_data_offset(&self) -> u32 {        0    }    fn engine_id_mask(&self) -> u16 {        0    }    fn ucode_id(&self) -> u8 {        0    }    fn signature_count(&self) -> u8 {        0    }    fn signature_versions(&self) -> u16 {        0    }     fn imem_sec_load_params(&self) -> FalconDmaLoadTarget {        // `imem_sec_base` is the *virtual* start address of the secure IMEM segment, so subtract        // `imem_virt_base` to get its physical offset.        let imem_sec_start = self.imem_sec_base.saturating_sub(self.imem_virt_base);         FalconDmaLoadTarget {            src_start: imem_sec_start,            dst_start: self.imem_phys_base.saturating_add(imem_sec_start),            len: self.imem_sec_size,        }    }     fn imem_ns_load_params(&self) -> Option<FalconDmaLoadTarget> {        Some(FalconDmaLoadTarget {            // Non-secure code always starts at offset 0.            src_start: 0,            dst_start: self.imem_phys_base,            // `imem_load_size` includes the size of the secure segment, so subtract it to            // get the correct amount of data to copy.            len: self.imem_load_size.saturating_sub(self.imem_sec_size),        })    }     fn dmem_load_params(&self) -> FalconDmaLoadTarget {        FalconDmaLoadTarget {            src_start: self.dmem_offset,            dst_start: self.dmem_phys_base,            len: self.dmem_load_size,        }    }} impl FalconUCodeDescriptor for FalconUCodeDescV3 {    fn hdr(&self) -> u32 {        self.hdr    }    fn imem_load_size(&self) -> u32 {        self.imem_load_size    }    fn interface_offset(&self) -> u32 {        self.interface_offset    }    fn dmem_load_size(&self) -> u32 {        self.dmem_load_size    }    fn pkc_data_offset(&self) -> u32 {        self.pkc_data_offset    }    fn engine_id_mask(&self) -> u16 {        self.engine_id_mask    }    fn ucode_id(&self) -> u8 {        self.ucode_id    }    fn signature_count(&self) -> u8 {        self.signature_count    }    fn signature_versions(&self) -> u16 {        self.signature_versions    }     fn imem_sec_load_params(&self) -> FalconDmaLoadTarget {        FalconDmaLoadTarget {            // IMEM segment always starts at offset 0.            src_start: 0,            dst_start: self.imem_phys_base,            len: self.imem_load_size,        }    }     fn imem_ns_load_params(&self) -> Option<FalconDmaLoadTarget> {        // Not used on V3 platforms        None    }     fn dmem_load_params(&self) -> FalconDmaLoadTarget {        FalconDmaLoadTarget {            // DMEM segment starts right after the IMEM one.            src_start: self.imem_load_size,            dst_start: self.dmem_phys_base,            len: self.dmem_load_size,        }    }} /// Trait implemented by types defining the signed state of a firmware.trait SignedState {} /// Type indicating that the firmware must be signed before it can be used.struct Unsigned;impl SignedState for Unsigned {} /// Type indicating that the firmware is signed and ready to be loaded.struct Signed;impl SignedState for Signed {} /// Microcode to be loaded into a specific falcon.////// This is module-local and meant for sub-modules to use internally.////// After construction, a firmware is [`Unsigned`], and must generally be patched with a signature/// before it can be loaded (with an exception for development hardware). The/// [`Self::patch_signature`] and [`Self::no_patch_signature`] methods are used to transition the/// firmware to its [`Signed`] state.// TODO: Consider replacing this with a coherent memory object once `CoherentAllocation` supports// temporary CPU-exclusive access to the object without unsafe methods.struct FirmwareObject<F: FalconFirmware, S: SignedState>(KVVec<u8>, PhantomData<(F, S)>); /// Trait for signatures to be patched directly into a given firmware.////// This is module-local and meant for sub-modules to use internally.trait FirmwareSignature<F: FalconFirmware>: AsRef<[u8]> {} impl<F: FalconFirmware> FirmwareObject<F, Unsigned> {    /// Patches the firmware at offset `signature_start` with `signature`.    fn patch_signature<S: FirmwareSignature<F>>(        mut self,        signature: &S,        signature_start: usize,    ) -> Result<FirmwareObject<F, Signed>> {        let signature_bytes = signature.as_ref();        let signature_end = signature_start            .checked_add(signature_bytes.len())            .ok_or(EOVERFLOW)?;        let dst = self            .0            .get_mut(signature_start..signature_end)            .ok_or(EINVAL)?;         // PANIC: `dst` and `signature_bytes` have the same length.        dst.copy_from_slice(signature_bytes);         Ok(FirmwareObject(self.0, PhantomData))    }     /// Mark the firmware as signed without patching it.    ///    /// This method is used to explicitly confirm that we do not need to sign the firmware, while    /// allowing us to continue as if it was. This is typically only needed for development    /// hardware.    fn no_patch_signature(self) -> FirmwareObject<F, Signed> {        FirmwareObject(self.0, PhantomData)    }} pub(crate) struct ModInfoBuilder<const N: usize>(firmware::ModInfoBuilder<N>); impl<const N: usize> ModInfoBuilder<N> {    const fn make_entry_file(self, chipset: &str, fw: &str) -> Self {        ModInfoBuilder(            self.0                .new_entry()                .push("nvidia/")                .push(chipset)                .push("/gsp/")                .push(fw),        )    }     const fn make_entry_chipset(self, chipset: gpu::Chipset) -> Self {        let name = chipset.name();         // GSP firmware files are always present.        let mut this = self            .make_entry_file(name, "gsp_bootloader.tlv")            .make_entry_file(name, "gsp.tlv")            .make_entry_file(name, "gsp.bin");         // Add the firmware files specific to the GSP boot method of `chipset`.        let boot_files = boot_firmware_files(chipset);        let mut i = 0;        while i < boot_files.len() {            this = this.make_entry_file(name, boot_files[i]);            i += 1;        }         this    }     pub(crate) const fn create(        module_name: &'static core::ffi::CStr,    ) -> firmware::ModInfoBuilder<N> {        let mut this = Self(firmware::ModInfoBuilder::new(module_name));        let mut i = 0;         while i < gpu::Chipset::ALL.len() {            this = this.make_entry_chipset(gpu::Chipset::ALL[i]);            i += 1;        }         this.0    }}