aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c (follow)
AgeCommit message (Collapse)AuthorFilesLines
2020-01-15drm/nouveau/secboot: removeBen Skeggs1-1217/+0
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/acr: implement new subdev to replace "secure boot"Ben Skeggs1-3/+1
ACR is responsible for managing the firmware for LS (Low Secure) falcons, this was previously handled in the driver by SECBOOT. This rewrite started from some test code that attempted to replicate the procedure RM uses in order to debug early Turing ACR firmwares that were provided by NVIDIA for development. Compared with SECBOOT, the code is structured into more individual steps, with the aim of making the process easier to follow/debug, whilst making it possible to support newer firmware versions that may have a different binary format or API interface. The HS (High Secure) binary(s) are now booted earlier in device init, to match the behaviour of RM, whereas SECBOOT would delay this until we try to boot the first LS falcon. There's also additional debugging features available, with the intention of making it easier to solve issues during FW/HW bring-up in the future. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/secboot: move code to boot LS falcons to subdevsBen Skeggs1-16/+3
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/flcn/cmdq: move command generation to subdevsBen Skeggs1-13/+4
This moves the code to generate commands for the ACR unit of the PMU/SEC2 LS firmwares to those subdevs. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/pmu: initialise SW state for falcon from constructorBen Skeggs1-1/+1
This will allow us to register the falcon with ACR, and further customise its behaviour by providing the nvkm_falcon_func structure directly. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2019-08-23drm/nouveau/secboot: Make acr_r352_ls_gpccs_func staticYueHaibing1-1/+1
Fix sparse warning: drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c:1092:1: warning: symbol 'acr_r352_ls_gpccs_func' was not declared. Should it be static? Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2019-06-07drm/nouveau/secboot: split out FW version-specific LS function pointersBen Skeggs1-12/+38
It's not enough to have per-falcon structures anymore, we have multiple versions of some firmware now that have interface differences. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2019-06-07drm/nouveau/secboot: pass max supported FW version to LS load funcsBen Skeggs1-3/+3
Will be passed to the FW loader function as an upper bound on the supported FW version to attempt to load. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2019-02-20drm/nouveau/secboot: fix missing newline in error messagesBen Skeggs1-2/+2
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2018-10-11drm/nouveau/secboot/acr: fix memory leakGustavo A. R. Silva1-0/+1
In case memory resources for *bl_desc* were allocated, release them before return. Addresses-Coverity-ID: 1472021 ("Resource leak") Fixes: 0d466901552a ("drm/nouveau/secboot/acr: Remove VLA usage") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Reviewed-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2018-07-16drm/nouveau/secboot/acr: Remove VLA usageKees Cook1-3/+22
In the quest to remove all stack VLA usage from the kernel[1], this allocates the working buffers before starting the writing so it won't abort in the middle. This needs an initial walk of the lists to figure out how large the buffer should be. [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-04-06drm/nouveau/secboot: start LS firmware in post-run hookAlexandre Courbot1-47/+0
The LS firmware post-run hook is the right place to start said LS firmware. Moving it here also allows to remove special handling in the ACR code. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-04-06drm/nouveau/secboot: let LS post_run hooks return errorAlexandre Courbot1-2/+5
A LS post-run hook can meet an error meaning the failure of secure boot. Make sure this can be reported. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-04-06drm/nouveau/secboot: pass instance to LS firmware loadersAlexandre Courbot1-4/+7
Having access to the secboot instance loading a LS firmware can be useful to LS firmware handlers. At least more useful than just having an out-of-context subdev pointer. GP10B's firmware will also need to know the WPR address, which can be obtained from the secboot instance. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-04-06drm/nouveau/secboot: allow to boot multiple falconsAlexandre Courbot1-10/+15
Change the secboot and msgqueue interfaces to take a mask of falcons to reset instead of a single falcon. The GP10B firmware interface requires FECS and GPCCS to be booted in a single firmware command. For firmwares that only support single falcon boot, it is trivial to loop over the mask and boot each falcons individually. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: put HS code loading code into own fileAlexandre Courbot1-98/+2
We will also need to load HS blobs outside of acr_r352 (for instance, to run the NVDEC VPR scrubber), so make this code reusable. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: workaround bug when starting SEC2 firmwareAlexandre Courbot1-0/+33
For some unknown reason the LS SEC2 firmware needs to be started twice to operate. Detect and address that condition. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: support standard NVIDIA HS binariesAlexandre Courbot1-8/+52
I had the brilliant idea to "improve" the binary format by removing a useless indirection in the HS binary files. In the end it just makes things more complicated than they ought to be as NVIDIA-provided files need to be adapted. Since the format used can be identified by the header, support both. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: support for unload blob bootloaderAlexandre Courbot1-30/+34
If the load and unload falcons are different, then a different bootloader must also be used. Support this case. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: let callers interpret return value of blobsAlexandre Courbot1-6/+17
Since the HS blobs are provided and signed by NVIDIA, we cannot expect always-consistent behavior. In this case, on GP10x the unload blob may return 0x1d even though things have run perfectly well. This behavior has been confirmed by NVIDIA. So let the callers of the run_blob() hook receive the blob return's value (a positive integer) and decide what it means. This allows us to workaround the 0x1d code instead of issuing an error. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: support for different load and unload falconsAlexandre Courbot1-6/+6
On some secure boot instances (e.g. gp10x) the load and unload blobs do not run on the same falcon. Support this case by introducing a new member to the ACR structure and making related functions take the falcon to use as an argument instead of assuming the boot falcon is to be used. The rule is that the load blob can be run on either the SEC or PMU falcons, but the unload blob must be always run on PMU. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: support running ACR on SECAlexandre Courbot1-3/+15
Add support for running the ACR binary on the SEC falcon. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: get start address of blob from ACRAlexandre Courbot1-6/+4
The start address used for secure blobs is not unique to the ACR, but rather blob-dependent. Remove the unique member stored in the ACR structure and make the load function return the start address for the current blob instead. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: add shadow blob argumentAlexandre Courbot1-2/+14
ACR firmware from r364 on need a shadow region for the ACR to copy the WPR region into. Add a flag to indicate that a shadow region is required and manage memory allocations accordingly. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: check that WPR region is properly setAlexandre Courbot1-2/+39
The ACR firmware may return no error but fail nonetheless. Such cases can be detected by verifying that the WPR region has been properly set in FB. If this is not the case, this is an error, but the unload firmware should still not be run. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: support optional falconsAlexandre Courbot1-25/+37
PMU support has been enabled for r352 ACR, but it must remain optional if we want to preserve existing user-space that do not include it. Allow ACR to be instanciated with a list of optional LS falcons, that will not produce a fatal error if their firmware is not loaded. Also change the secure boot bootstrap logic to be able to fall back to legacy behavior if it turns out the boot falcon's LS firmware cannot be loaded. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: support PMU LS firmwareAlexandre Courbot1-0/+80
Add the PMU bootloader generator and PMU LS ops that will enable proper PMU operation if the PMU falcon is designated as managed. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: base support for PMU falconAlexandre Courbot1-16/+82
Adapt secboot's behavior if a PMU firmware is present, in particular the way LS falcons are reset. Without PMU firmware, secboot needs to be performed again from scratch so all LS falcons are reset. With PMU firmware, we can ask the PMU's ACR unit to reset a specific falcon through a PMU message. As we must preserve the old behavior to avoid breaking user-space, add a few conditionals to the way falcons are reset. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: add LS firmware post-run hooksAlexandre Courbot1-0/+11
Add the ability for LS firmwares to declare a post-run hook that is invoked right after the HS firmware is executed. This allows them to e.g. write some initialization data into the falcon's DMEM. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: abstract fixup_hs_desc functionAlexandre Courbot1-3/+5
As different firmare versions use different HS descriptor formats, we need to abstract this part as well. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: make specialized ls_ucode_img struct privateAlexandre Courbot1-0/+90
This structure does not need to be shared anymore. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: store ucode offset in base image structureAlexandre Courbot1-5/+4
This allows the bootloader descriptor generation code to not rely on specialized ls_ucode_img structures, making it reusable in other instances. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: fix usage of hsf_load_headerAlexandre Courbot1-3/+3
Offsets were not properly computed. This went unnoticed because we are only using one app for now. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: prevent address trimmingAlexandre Courbot1-2/+2
Using 32-bit integers would trim the WPR address if it is allocated above 4GB. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: fix WPR region alignmentAlexandre Courbot1-2/+2
A WPR region smaller than 256K will result in secure boot failure. Adjust the minimal size. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: fix WPR address to be 64-bitAlexandre Courbot1-1/+1
The WPR address parameter of the ls_write_wpr hook was defined as a u32, which will very likely overflow on boards with more than 4GB VRAM. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: make sure requested falcons are supportedAlexandre Courbot1-0/+7
Check at contruction time that we have support for all the LS firmwares asked by the caller. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-03-07drm/nouveau/secboot: remove unused hookAlexandre Courbot1-27/+0
Remove a leftover that became obsolete with the falcon interface. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: clear halt interrupt after ACR is runAlexandre Courbot1-0/+2
The halt interrupt must be cleared after ACR is run, otherwise the LS PMU firmware will not be able to run. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: add lazy-bootstrap flagAlexandre Courbot1-0/+4
When the PMU firmware is present, the falcons it manages need to have the lazy-bootstrap flag of their WPR header set so the ACR does not boot them. Add support for this. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: fix WPR descriptor generationAlexandre Courbot1-9/+12
Generate the WPR descriptor closer to what RM does. In particular, set the expected masks, and only set the ucode members on Tegra. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: add missing fields to BL structureAlexandre Courbot1-0/+4
Since DMEM was initialized to zero, these fields went unnoticed. Add them for safety. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: safer zeroing of BL descriptorsAlexandre Courbot1-2/+2
Perform the zeroing of BL descriptors in the caller function instead of trusting each generator will do it. This could avoid a few pulled hairs. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: abstract LS firmware loading functionsAlexandre Courbot1-40/+62
The WPR and LSB headers, used to generate the LS blob, may have a different layout and sizes depending on the driver version they come from. Abstract them and confine their use to driver-specific code. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: remove ls_ucode_mgrAlexandre Courbot1-57/+33
This was used only locally to one function and can be replaced by ad-hoc variables. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: remove unneeded ls_ucode_img memberAlexandre Courbot1-18/+7
ucode_header is not used anywhere, so just get rid of it. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: split reset functionAlexandre Courbot1-25/+53
Split the reset function into more meaningful and reusable ones. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: add LS flags to LS func structureAlexandre Courbot1-6/+4
Add a flag that can be set when declaring how a LS firmware should be loaded. This allows us to remove falcon-specific code in the loader. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2017-02-17drm/nouveau/secboot: reorganize into more filesAlexandre Courbot1-0/+910
Split the act of building the ACR blob from firmware files from the rest of the (chip-dependent) secure boot logic. ACR logic is moved into acr_rxxx.c files, where rxxx corresponds to the compatible release of the NVIDIA driver. At the moment r352 and r361 are supported since firmwares have been released for these versions. Some abstractions are added on top of r352 so r361 can easily be implemented on top of it by just overriding a few hooks. This split makes it possible and easy to reuse the same ACR version on different chips. It also hopefully makes the code much more readable as the different secure boot logics are separated. As more chips and firmware versions will be supported, this is a necessity to not get lost in code that is already quite complex. This is a big commit, but it essentially moves things around (and split the nvkm_secboot structure into two, nvkm_secboot and nvkm_acr). Code semantics should not be affected. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.