search for: gpccs

This was the first step of the secure boot refactoring - as Ben asked for some fixes, I now submit it as its own series to make it easier to review (and also because rebasing secure boot on top of this takes time and I don't want to do it until this is validated!). This series attempts to factorize the duplicate falcon-related code into a single library, using the existing nvkm_falcon

...t; + [NVKM_SECBOOT_FALCON_PMU] = "PMU", > + [NVKM_SECBOOT_FALCON_RESERVED] = "<invalid>", "<reserved>" perhaps ? we already have one invalid below. > + [NVKM_SECBOOT_FALCON_FECS] = "FECS", > + [NVKM_SECBOOT_FALCON_GPCCS] = "GPCCS", > + [NVKM_SECBOOT_FALCON_END] = "<invalid>", > +}; > + [snip] > +int > +nvkm_secboot_ctor(const struct nvkm_secboot_func *func, > + struct nvkm_device *device, int index, > + struct nvkm_secboot *sb) &...

This was the first step of the secure boot refactoring - as Ben asked for some fixes, I now submit it as its own series to make it easier to review (and also because rebasing secure boot on top of this takes time and I don't want to do it until this is validated!). This series attempts to factorize the duplicate falcon-related code into a single library, using the existing nvkm_falcon

Fixes secure boot on my gp107. No idea why. Otherwise the GPU enters complete lockdown after starting the gpccs and fecs with the LS images loaded. Signed-off-by: Karol Herbst <kherbst at redhat.com> --- drm/nouveau/nvkm/engine/gr/gf100.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drm/nouveau/nvkm/engine/gr/gf100.c b/drm/nouveau/nvkm/engine/gr/gf100.c index 2f8dc107..322d9fa6 100644 -...

Hi, all. Below is a link to a brief document describing some changes in NVIDIA Falcon processors ("fuc", in Nouveau-speak, IIUC) that happened in Maxwell: certain aspects of the chip will only be available to Falcon firmware images signed by NVIDIA. So far, the set of restricted things is pretty small, but I expect this list will slowly grow over future hardware generations.

...ence over the content: the engineers working on > Falcon microcode assume it changes in lock-step with NVIDIA's nvidia.ko, > so there are no backwards compatibility guarantees. How painful has > the lack of backwards compatibility been for Nouveau thus far? So far the use of your FECS/GPCCS ucode has been treated as a "last resort" deal, with a strong preference of using our own when we finally manage to get it working. We haven't really changed the process much over time, and it's probably luck that it's kept "working" to an extent. The simplest thin...

...4:36 PM, Tobias Klausmann <tobias.johannes.klausmann at mni.thm.de> wrote: > Hi, > > comments inline > > On 11/28/17 2:11 PM, Karol Herbst wrote: >> >> Fixes secure boot on my gp107. No idea why. Otherwise the GPU enters >> complete lockdown after starting the gpccs and fecs with the LS images >> loaded. >> >> Signed-off-by: Karol Herbst <kherbst at redhat.com> >> --- >> drm/nouveau/nvkm/engine/gr/gf100.c | 7 +++++++ >> 1 file changed, 7 insertions(+) >> >> diff --git a/drm/nouveau/nvkm/engine/gr/gf100....

...t; > - Should the firmware be released under /lib/firmware/nouveau or > /lib/firmware/nvidia ? (this directory already exists for Tegra USB > firmware and makes more sense to me, since the firmware is not > Nouveau-specific) I think /lib/firmware/nvidia makes sense here too. > - For GPCCS/FECS firmware, should we release the netlist "pack" file > or adopt the same format as Nouveau does? (1 file per firmware) > - Should we keep the current files names (e.g. nvxx_fucxxxx[cd]), or > try to switch to more meaningful ones? I'd actually prefer to have the entire ne...

...t;<invalid>", > "<reserved>" perhaps ? we already have one invalid below. Does <reserved> really mean: "we don't want to tell you?" here? :) > >> + [NVKM_SECBOOT_FALCON_FECS] = "FECS", >> + [NVKM_SECBOOT_FALCON_GPCCS] = "GPCCS", >> + [NVKM_SECBOOT_FALCON_END] = "<invalid>", >> +}; >> + > > [snip] >> +int >> +nvkm_secboot_ctor(const struct nvkm_secboot_func *func, >> + struct nvkm_device *device, int index, >> +...

Hi, comments inline On 11/28/17 2:11 PM, Karol Herbst wrote: > Fixes secure boot on my gp107. No idea why. Otherwise the GPU enters > complete lockdown after starting the gpccs and fecs with the LS images > loaded. > > Signed-off-by: Karol Herbst <kherbst at redhat.com> > --- > drm/nouveau/nvkm/engine/gr/gf100.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drm/nouveau/nvkm/engine/gr/gf100.c b/drm/nouveau/nvkm/engine/gr/g...

...sts git bisect bad e21bfd171a192dfba4a8907f2fcc41acac0f685f # bad: [eeb0558e074215656ae11a170059a5f2ce29963f] drm/gf104/gr: rename gf104 (nvc4), it came before gf106 (nvc3) git bisect bad eeb0558e074215656ae11a170059a5f2ce29963f # bad: [6acc09b99d5d8f276a4f9bffc32f0bb0f939c7ca] drm/nvc0-/graph: fix gpccs fuc stack setup git bisect bad 6acc09b99d5d8f276a4f9bffc32f0bb0f939c7ca # bad: [457e77b26428ab4a24998eecfb99f27fa4195397] drm/nouveau/bios: add more checks to PRAMIN image fetching git bisect bad 457e77b26428ab4a24998eecfb99f27fa4195397 Than I saw your posting on LKML and tried your fix and your f...

...<reserved> really mean: "we don't want to tell you?" here? :) > That or we have some secret WIP that we're haven't decided if it'll work out :-) >> >>> + [NVKM_SECBOOT_FALCON_FECS] = "FECS", >>> + [NVKM_SECBOOT_FALCON_GPCCS] = "GPCCS", >>> + [NVKM_SECBOOT_FALCON_END] = "<invalid>", >>> +}; >>> + >> >> [snip] >>> +int >>> +nvkm_secboot_ctor(const struct nvkm_secboot_func *func, >>> + struct nvkm_device *dev...

...struct nvkm_secboot *sb, struct acr_r352 *acr = acr_r352(_acr); int ret; - /* Make sure all blobs are ready */ - ret = acr_r352_load_blobs(acr, sb); - if (ret) - return ret; - /* * Dummy GM200 implementation: perform secure boot each time we are * called on FECS. Since only FECS and GPCCS are managed and started @@ -776,16 +819,11 @@ acr_r352_reset(struct nvkm_acr *_acr, struct nvkm_secboot *sb, if (falcon != NVKM_FALCON_FECS) goto end; - /* If WPR is set and we have an unload blob, run it to unlock WPR */ - if (acr->unload_blob && - acr->falcon_state[NVKM_F...

...X1 SoC. This series adds initial support for it, based on a rework of the already-supported GK20A. It also introduces support for NVIDIA-provided firmware files, which is why I have added a few NVIDIA people who are relevant to this discussion. The first patch adds support for loading the FECS and GPCCS firmwares from firmware files officially released by NVIDIA. As you know such firmwares will soon become a necessity for newer GPUs because some falcons will require signed firmware to operate. In addition there is no reverse-engineered version of the GK20A firmwares yet, so since an external file...

...USE OR OTHER + * DEALINGS IN THE SOFTWARE. + */ + +#ifndef __NVKM_SECURE_BOOT_H__ +#define __NVKM_SECURE_BOOT_H__ + +#include <core/subdev.h> + +enum nvkm_secboot_falcon { + NVKM_SECBOOT_FALCON_PMU = 0, + NVKM_SECBOOT_FALCON_RESERVED = 1, + NVKM_SECBOOT_FALCON_FECS = 2, + NVKM_SECBOOT_FALCON_GPCCS = 3, + NVKM_SECBOOT_FALCON_END = 4, + NVKM_SECBOOT_FALCON_INVALID = 0xffffffff, +}; + +/** + * @falcon_id: falcon that will perform secure boot + * @base: base IO address of the falcon performing secure boot + * @irq_mask: IRQ mask of the falcon performing secure boot + * @enable_mask: enable ma...

...nerate_hs_bl_desc, .hs_bl_desc_size = sizeof(struct acr_r352_flcn_bl_desc), + .ls_ucode_img_load = acr_r352_ls_ucode_img_load, + .ls_fill_headers = acr_r352_ls_fill_headers, + .ls_write_wpr = acr_r352_ls_write_wpr, .ls_func = { [NVKM_FALCON_FECS] = &acr_r352_ls_fecs_func, [NVKM_FALCON_GPCCS] = &acr_r352_ls_gpccs_func, diff --git a/drm/nouveau/nvkm/subdev/secboot/acr_r352.h b/drm/nouveau/nvkm/subdev/secboot/acr_r352.h index f6068404ba98..b2a4b2ec9af5 100644 --- a/drm/nouveau/nvkm/subdev/secboot/acr_r352.h +++ b/drm/nouveau/nvkm/subdev/secboot/acr_r352.h @@ -23,11 +23,116 @@ #defin...

This is a rework of the secure boot code that moves the building of the blob into its own set of source files (and own hooks), making the code more flexible and (hopefully) easier to understand as well. This rework is needed to support more signed firmware for existing and new chips. Since the firmwares in question are not available yet I cannot send the code to manage then, but hopefully the

This is a rework of the secure boot code that moves the building of the blob into its own set of source files (and own hooks), making the code more flexible and (hopefully) easier to understand as well. This rework is needed to support more signed firmware for existing and new chips. Since the firmwares in question are not available yet I cannot send the code to manage then, but hopefully the

GP10B is the chip used in Tegra X2 SoCs. This patchset adds support for its base engines after reworking secboot a bit to accomodate its calling convention better. This patchset has been tested rendering simple off-screen buffers using Mesa and yielded the expected result. Alexandre Courbot (15): secboot: allow to boot multiple falcons secboot: pass instance to LS firmware loaders secboot:

This is a highly changed revision of the first patch series that adds secure boot support to Nouveau. This code still depends on NVIDIA releasing official firmware files, but the files released with SHIELD TV and Pixel C can already be used on a Jetson TX1. As you know we are working hard to release the official firmware files, however in the meantime it doesn't hurt to review the code so it