similar to: [PATCH] secboot: print status message on success

On GM20x and later GPUs, firmware for some essential falcons (notably FECS) must be authenticated by a NVIDIA-produced signature and loaded by a high-secure falcon in order to access certain registers, in a process known as Secure Boot. Secure Boot requires the building of a binary blob containing the firmwares and signatures of the falcons to be loaded. This blob is then given to a high-secure

Secure firmwares provided by NVIDIA will follow the same overall principle, but may slightly differ in format, or not use the same bootloader descriptor even on the same chip. In order to handle this as gracefully as possible, turn the LS firmware functions into hooks that can be overloaded as needed. The current hooks cover the external firmware loading as well as the bootloader descriptor

Add secure-boot for the dGPU set of GM20X chips, using the PMU as the high-secure falcon. This work is based on Deepak Goyal's initial port of Secure Boot to Nouveau. Signed-off-by: Alexandre Courbot <acourbot at nvidia.com> --- drm/nouveau/include/nvkm/subdev/secboot.h | 2 + drm/nouveau/nvkm/engine/device/base.c | 2 + drm/nouveau/nvkm/engine/gr/gm200.c | 8 +-

Make sure we are not disturbed by spurious interrupts, as we poll the halt bit anyway. Signed-off-by: Alexandre Courbot <acourbot at nvidia.com> --- drm/nouveau/nvkm/subdev/secboot/gm200.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drm/nouveau/nvkm/subdev/secboot/gm200.c b/drm/nouveau/nvkm/subdev/secboot/gm200.c index 4932757ab1a2..5801babdf959 100644 ---

The IRQ mask of the PMU falcon was left - replace it with the proper irq_mask variable. Signed-off-by: Alexandre Courbot <acourbot at nvidia.com> --- drm/nouveau/nvkm/subdev/secboot/base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drm/nouveau/nvkm/subdev/secboot/base.c b/drm/nouveau/nvkm/subdev/secboot/base.c index b718ba79177c..05c62549c39b 100644 ---

Split the reset function into more meaningful and reusable ones. Signed-off-by: Alexandre Courbot <acourbot at nvidia.com> --- drm/nouveau/include/nvkm/subdev/secboot.h | 3 ++ drm/nouveau/nvkm/subdev/secboot/acr_r352.c | 78 ++++++++++++++++++++---------- 2 files changed, 56 insertions(+), 25 deletions(-) diff --git a/drm/nouveau/include/nvkm/subdev/secboot.h

Use the HS hook to completely generate the HS BL descriptor, similarly to what is done in the LS hook, instead of (arbitrarily) using the acr_v1 format as an intermediate. This allows us to make the bootloader descriptor structures private to each implementation, resulting in a cleaner an more consistent design. Signed-off-by: Alexandre Courbot <acourbot at nvidia.com> ---

From: Thierry Reding <treding at nvidia.com> The GPUs found on Tegra SoCs have registers that can be used to read the WPR configuration. Use these registers instead of reaching into the memory controller's register space to read the same information. Signed-off-by: Thierry Reding <treding at nvidia.com> --- .../drm/nouveau/nvkm/subdev/secboot/gm200.h | 2 +-

On Tue, Sep 17, 2019 at 01:49:57PM +1000, Ben Skeggs wrote: > On Tue, 17 Sep 2019 at 01:04, Thierry Reding <thierry.reding at gmail.com> wrote: > > > > From: Thierry Reding <treding at nvidia.com> > > > > The GPUs found on Tegra SoCs have registers that can be used to read the > > WPR configuration. Use these registers instead of reaching into the >

The state of the falcons was not properly updated after running the unload ACR, which caused it to be run again (and thus fail) when nvkm_secboot_fini() was called during resume. Signed-off-by: Alexandre Courbot <acourbot at nvidia.com> --- Ben, please feel free to squash this into the gm200 secboot implementation patch - this fixes a bug that should not have been here to begin with.

This is needed for using Nouveaus PMU image after performing secboot. This will be helpfull for Maxwell2 reclocking on boards without externally controlled fans like on most laptops or fanless boards. Signed-off-by: Karol Herbst <karolherbst at gmail.com> --- drm/nouveau/nvkm/subdev/secboot/acr_r352.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git

On Tue, 17 Sep 2019 at 01:04, Thierry Reding <thierry.reding at gmail.com> wrote: > > From: Thierry Reding <treding at nvidia.com> > > The GPUs found on Tegra SoCs have registers that can be used to read the > WPR configuration. Use these registers instead of reaching into the > memory controller's register space to read the same information. > >

On 07/05/2017 03:35 AM, Karol Herbst wrote: > This is needed for using Nouveaus PMU image after performing secboot. This will > be helpfull for Maxwell2 reclocking on boards without externally controlled > fans like on most laptops or fanless boards. I get the idea in principal, but have some concerns: - Does this screw up re-running secboot during channel recovery (ie. page fault on

Hello Alexandre Courbot, The patch 5429f82f3415: "drm/nouveau/secboot: add gp102/gp104/gp106/gp107 support" from Jan 26, 2017, leads to the following static checker warning: drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gp102.c:63 gp102_run_secure_scrub() warn: passing zero to 'PTR_ERR' drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gp102.c 46 static int 47

Hello Alexandre Courbot, The patch 923f1bd27bf1: "drm/nouveau/secboot/gm20b: add secure boot support" from Feb 24, 2016, leads to the following static checker warning: drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c:129 gm20b_secboot_new() warn: did you mean to set '*psb' instead of 'psb' drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c 103 int 104

We were returning PTR_ERR() on a NULL pointer, which obviously won't work. nvkm_engine_ref() will return an error in case something went wrong. Signed-off-by: Alexandre Courbot <acourbot at nvidia.com> Reported-by: Dan Carpenter <dan.carpenter at oracle.com> --- drm/nouveau/nvkm/subdev/secboot/gp102.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git

This is a highly changed revision of the first patch series that adds secure boot support to Nouveau. This code still depends on NVIDIA releasing official firmware files, but the files released with SHIELD TV and Pixel C can already be used on a Jetson TX1. As you know we are working hard to release the official firmware files, however in the meantime it doesn't hurt to review the code so it

This was the first step of the secure boot refactoring - as Ben asked for some fixes, I now submit it as its own series to make it easier to review (and also because rebasing secure boot on top of this takes time and I don't want to do it until this is validated!). This series attempts to factorize the duplicate falcon-related code into a single library, using the existing nvkm_falcon

This was the first step of the secure boot refactoring - as Ben asked for some fixes, I now submit it as its own series to make it easier to review (and also because rebasing secure boot on top of this takes time and I don't want to do it until this is validated!). This series attempts to factorize the duplicate falcon-related code into a single library, using the existing nvkm_falcon

New version of the secure boot code that works with the blobs just merged into linux-firmware. Since the required Mesa patches are also merged, this set is the last piece of the puzzle to get out-of-the-box accelerated Maxwell 2. The basic code remains the same, with a few improvements with respect to how secure falcons are started. Hopefully the patchset is better split too. I have a