€• nŒsphinx.addnodes”Œdocument”“”)”}”(Œ rawsource”Œ”Œchildren”]”(Œ translations”Œ LanguagesNode”“”)”}”(hhh]”(hŒ pending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ refdomain”Œstd”Œreftype”Œdoc”Œ reftarget”Œ'/translations/zh_CN/gpu/nova/core/fwsec”Œmodname”NŒ classname”NŒ refexplicit”ˆuŒtagname”hhh ubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ'/translations/zh_TW/gpu/nova/core/fwsec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ'/translations/it_IT/gpu/nova/core/fwsec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ'/translations/ja_JP/gpu/nova/core/fwsec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ'/translations/ko_KR/gpu/nova/core/fwsec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒSpanish”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ'/translations/sp_SP/gpu/nova/core/fwsec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h hhŒ _document”hŒsource”NŒline”NubhŒcomment”“”)”}”(hŒ*SPDX-License-Identifier: (GPL-2.0+ OR MIT)”h]”hŒ*SPDX-License-Identifier: (GPL-2.0+ OR MIT)”…””}”hh£sbah}”(h]”h ]”h"]”h$]”h&]”Œ xml:space”Œpreserve”uh1h¡hhhžhhŸŒA/var/lib/git/docbuild/linux/Documentation/gpu/nova/core/fwsec.rst”h KubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒFWSEC (Firmware Security)”h]”hŒFWSEC (Firmware Security)”…””}”(hh»hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hh¶hžhhŸh³h KubhŒ paragraph”“”)”}”(hX½This document briefly/conceptually describes the FWSEC (Firmware Security) image and its role in the GPU boot sequence. As such, this information is subject to change in the future and is only current as of the Ampere GPU family. However, hopefully the concepts described will be useful for understanding the kernel code that deals with it. All the information is derived from publicly available sources such as public drivers and documentation.”h]”hX½This document briefly/conceptually describes the FWSEC (Firmware Security) image and its role in the GPU boot sequence. As such, this information is subject to change in the future and is only current as of the Ampere GPU family. However, hopefully the concepts described will be useful for understanding the kernel code that deals with it. All the information is derived from publicly available sources such as public drivers and documentation.”…””}”(hhËhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Khh¶hžhubhÊ)”}”(hŒðThe role of FWSEC is to provide a secure boot process. It runs in 'Heavy-secure' mode, and performs firmware verification after a GPU reset before loading various ucode images onto other microcontrollers on the GPU, such as the PMU and GSP.”h]”hŒôThe role of FWSEC is to provide a secure boot process. It runs in ‘Heavy-secure’ mode, and performs firmware verification after a GPU reset before loading various ucode images onto other microcontrollers on the GPU, such as the PMU and GSP.”…””}”(hhÙhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K hh¶hžhubhÊ)”}”(hX FWSEC itself is an application stored in the VBIOS ROM in the FWSEC partition of ROM (see vbios.rst for more details). It contains different commands like FRTS (Firmware Runtime Services) and SB (Secure Booting other microcontrollers after reset and loading them with other non-FWSEC ucode). The kernel driver only needs to perform FRTS, since Secure Boot (SB) has already completed by the time the driver is loaded.”h]”hX FWSEC itself is an application stored in the VBIOS ROM in the FWSEC partition of ROM (see vbios.rst for more details). It contains different commands like FRTS (Firmware Runtime Services) and SB (Secure Booting other microcontrollers after reset and loading them with other non-FWSEC ucode). The kernel driver only needs to perform FRTS, since Secure Boot (SB) has already completed by the time the driver is loaded.”…””}”(hhçhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Khh¶hžhubhÊ)”}”(hŒËThe FRTS command carves out the WPR2 region (Write protected region) which contains data required for power management. Once setup, only HS mode ucode can access it (see falcon.rst for privilege levels).”h]”hŒËThe FRTS command carves out the WPR2 region (Write protected region) which contains data required for power management. Once setup, only HS mode ucode can access it (see falcon.rst for privilege levels).”…””}”(hhõhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Khh¶hžhubhÊ)”}”(hŒèThe FWSEC image is located in the VBIOS ROM in the partition of the ROM that contains various ucode images (also known as applications) -- one of them being FWSEC. For how it is extracted, see vbios.rst and the vbios.rs source code.”h]”hŒèThe FWSEC image is located in the VBIOS ROM in the partition of the ROM that contains various ucode images (also known as applications) -- one of them being FWSEC. For how it is extracted, see vbios.rst and the vbios.rs source code.”…””}”(hjhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Khh¶hžhubhÊ)”}”(hXAThe Falcon data for each ucode images (including the FWSEC image) is a combination of headers, data sections (DMEM) and instruction code sections (IMEM). All these ucode images are stored in the same ROM partition and the PMU table is used to look up the application to load it based on its application ID (see vbios.rs).”h]”hXAThe Falcon data for each ucode images (including the FWSEC image) is a combination of headers, data sections (DMEM) and instruction code sections (IMEM). All these ucode images are stored in the same ROM partition and the PMU table is used to look up the application to load it based on its application ID (see vbios.rs).”…””}”(hjhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K!hh¶hžhubhÊ)”}”(hŒðFor the nova-core driver, the FWSEC contains an 'application interface' called DMEMMAPPER. This interface is used to execute the 'FWSEC-FRTS' command, among others. For Ampere, FWSEC is running on the GSP in Heavy-secure mode and runs FRTS.”h]”hŒøFor the nova-core driver, the FWSEC contains an ‘application interface’ called DMEMMAPPER. This interface is used to execute the ‘FWSEC-FRTS’ command, among others. For Ampere, FWSEC is running on the GSP in Heavy-secure mode and runs FRTS.”…””}”(hjhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K&hh¶hžhubhµ)”}”(hhh]”(hº)”}”(hŒFWSEC Memory Layout”h]”hŒFWSEC Memory Layout”…””}”(hj0hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj-hžhhŸh³h K+ubhÊ)”}”(hŒ4The memory layout of the FWSEC image is as follows::”h]”hŒ3The memory layout of the FWSEC image is as follows:”…””}”(hj>hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K,hj-hžhubhŒ literal_block”“”)”}”(hX÷+---------------------------------------------------------------+ | FWSEC ROM image (type 0xE0) | | | | +---------------------------------+ | | | PMU Falcon Ucode Table | | | | (PmuLookupTable) | | | | +-------------------------+ | | | | | Table Header | | | | | | - version: 0x01 | | | | | | - header_size: 6 | | | | | | - entry_size: 6 | | | | | | - entry_count: N | | | | | | - desc_version:3(unused)| | | | | +-------------------------+ | | | | ... | | | | +-------------------------+ | | | | | Entry for FWSEC (0x85) | | | | | | (PmuLookupTableEntry) | | | | | | - app_id: 0x85 (FWSEC) |----|----+ | | | | - target_id: 0x01 (PMU) | | | | | | | - data: offset ---------|----|----|---+ look up FWSEC | | | +-------------------------+ | | | | | +---------------------------------+ | | | | | | | | | | | | +---------------------------------+ | | | | | FWSEC Ucode Component |<---+ | | | | (aka Falcon data) | | | | | +-------------------------+ | | | | | | FalconUCodeDescV3 |<---|--------+ | | | | - hdr | | | | | | - stored_size | | | | | | - pkc_data_offset | | | | | | - interface_offset -----|----|----------------+ | | | | - imem_phys_base | | | | | | | - imem_load_size | | | | | | | - imem_virt_base | | | | | | | - dmem_phys_base | | | | | | | - dmem_load_size | | | | | | | - engine_id_mask | | | | | | | - ucode_id | | | | | | | - signature_count | | look up sig | | | | | - signature_versions --------------+ | | | | +-------------------------+ | | | | | | (no gap) | | | | | | +-------------------------+ | | | | | | | Signatures Section |<---|-----+ | | | | | (384 bytes per sig) | | | | | | | - RSA-3K Signature 1 | | | | | | | - RSA-3K Signature 2 | | | | | | | ... | | | | | | +-------------------------+ | | | | | | | | | | +-------------------------+ | | | | | | IMEM Section (Code) | | | | | | | | | | | | | | Contains instruction | | | | | | | code etc. | | | | | | +-------------------------+ | | | | | | | | | | +-------------------------+ | | | | | | DMEM Section (Data) | | | | | | | | | | | | | | +---------------------+ | | | | | | | | Application | |<---|----------------+ | | | | | Interface Table | | | | | | | | (FalconAppifHdrV1) | | | | | | | | Header: | | | | | | | | - version: 0x01 | | | | | | | | - header_size: 4 | | | | | | | | - entry_size: 8 | | | | | | | | - entry_count: N | | | | | | | | | | | | | | | | Entries: | | | | | | | | +-----------------+ | | | | | | | | | DEVINIT (ID 1) | | | | | | | | | | - id: 0x01 | | | | | | | | | | - dmemOffset X -|-|-|----+ | | | | | +-----------------+ | | | | | | | | +-----------------+ | | | | | | | | | DMEMMAPPER(ID 4)| | | | | | | | | | - id: 0x04 | | | | Used only for DevInit | | | | | | (NVFW_FALCON_ | | | | application (not FWSEC) | | | | | | APPIF_ID_DMEMMAPPER) | | | | | | | - dmemOffset Y -|-|-|----|-----+ | | | | | +-----------------+ | | | | | | | | +---------------------+ | | | | | | | | | | | | | | +---------------------+ | | | | | | | | DEVINIT Engine |<|----+ | Used by FWSEC | | | | | Interface | | | | app. | | | | +---------------------+ | | | | | | | | | | | | | | +---------------------+ | | | | | | | | DMEM Mapper (ID 4) |<|----+-----+ | | | | | (FalconAppifDmemmapperV3) | | | | | | - signature: "DMAP" | | | | | | | | - version: 0x0003 | | | | | | | | - Size: 64 bytes | | | | | | | | - cmd_in_buffer_off | |----|------------+ | | | | | - cmd_in_buffer_size| | | | | | | | | - cmd_out_buffer_off| |----|------------|-----+ | | | | | - cmd_out_buffer_sz | | | | | | | | | | - init_cmd | | | | | | | | | | - features | | | | | | | | | | - cmd_mask0/1 | | | | | | | | | +---------------------+ | | | | | | | | | | | | | | | | +---------------------+ | | | | | | | | | Command Input Buffer|<|----|------------+ | | | | | | - Command data | | | | | | | | | - Arguments | | | | | | | | +---------------------+ | | | | | | | | | | | | | | +---------------------+ | | | | | | | | Command Output |<|----|------------------+ | | | | | Buffer | | | | | | | | - Results | | | | | | | | - Status | | | | | | | +---------------------+ | | | | | +-------------------------+ | | | +---------------------------------+ | | | +---------------------------------------------------------------+”h]”hX÷+---------------------------------------------------------------+ | FWSEC ROM image (type 0xE0) | | | | +---------------------------------+ | | | PMU Falcon Ucode Table | | | | (PmuLookupTable) | | | | +-------------------------+ | | | | | Table Header | | | | | | - version: 0x01 | | | | | | - header_size: 6 | | | | | | - entry_size: 6 | | | | | | - entry_count: N | | | | | | - desc_version:3(unused)| | | | | +-------------------------+ | | | | ... | | | | +-------------------------+ | | | | | Entry for FWSEC (0x85) | | | | | | (PmuLookupTableEntry) | | | | | | - app_id: 0x85 (FWSEC) |----|----+ | | | | - target_id: 0x01 (PMU) | | | | | | | - data: offset ---------|----|----|---+ look up FWSEC | | | +-------------------------+ | | | | | +---------------------------------+ | | | | | | | | | | | | +---------------------------------+ | | | | | FWSEC Ucode Component |<---+ | | | | (aka Falcon data) | | | | | +-------------------------+ | | | | | | FalconUCodeDescV3 |<---|--------+ | | | | - hdr | | | | | | - stored_size | | | | | | - pkc_data_offset | | | | | | - interface_offset -----|----|----------------+ | | | | - imem_phys_base | | | | | | | - imem_load_size | | | | | | | - imem_virt_base | | | | | | | - dmem_phys_base | | | | | | | - dmem_load_size | | | | | | | - engine_id_mask | | | | | | | - ucode_id | | | | | | | - signature_count | | look up sig | | | | | - signature_versions --------------+ | | | | +-------------------------+ | | | | | | (no gap) | | | | | | +-------------------------+ | | | | | | | Signatures Section |<---|-----+ | | | | | (384 bytes per sig) | | | | | | | - RSA-3K Signature 1 | | | | | | | - RSA-3K Signature 2 | | | | | | | ... | | | | | | +-------------------------+ | | | | | | | | | | +-------------------------+ | | | | | | IMEM Section (Code) | | | | | | | | | | | | | | Contains instruction | | | | | | | code etc. | | | | | | +-------------------------+ | | | | | | | | | | +-------------------------+ | | | | | | DMEM Section (Data) | | | | | | | | | | | | | | +---------------------+ | | | | | | | | Application | |<---|----------------+ | | | | | Interface Table | | | | | | | | (FalconAppifHdrV1) | | | | | | | | Header: | | | | | | | | - version: 0x01 | | | | | | | | - header_size: 4 | | | | | | | | - entry_size: 8 | | | | | | | | - entry_count: N | | | | | | | | | | | | | | | | Entries: | | | | | | | | +-----------------+ | | | | | | | | | DEVINIT (ID 1) | | | | | | | | | | - id: 0x01 | | | | | | | | | | - dmemOffset X -|-|-|----+ | | | | | +-----------------+ | | | | | | | | +-----------------+ | | | | | | | | | DMEMMAPPER(ID 4)| | | | | | | | | | - id: 0x04 | | | | Used only for DevInit | | | | | | (NVFW_FALCON_ | | | | application (not FWSEC) | | | | | | APPIF_ID_DMEMMAPPER) | | | | | | | - dmemOffset Y -|-|-|----|-----+ | | | | | +-----------------+ | | | | | | | | +---------------------+ | | | | | | | | | | | | | | +---------------------+ | | | | | | | | DEVINIT Engine |<|----+ | Used by FWSEC | | | | | Interface | | | | app. | | | | +---------------------+ | | | | | | | | | | | | | | +---------------------+ | | | | | | | | DMEM Mapper (ID 4) |<|----+-----+ | | | | | (FalconAppifDmemmapperV3) | | | | | | - signature: "DMAP" | | | | | | | | - version: 0x0003 | | | | | | | | - Size: 64 bytes | | | | | | | | - cmd_in_buffer_off | |----|------------+ | | | | | - cmd_in_buffer_size| | | | | | | | | - cmd_out_buffer_off| |----|------------|-----+ | | | | | - cmd_out_buffer_sz | | | | | | | | | | - init_cmd | | | | | | | | | | - features | | | | | | | | | | - cmd_mask0/1 | | | | | | | | | +---------------------+ | | | | | | | | | | | | | | | | +---------------------+ | | | | | | | | | Command Input Buffer|<|----|------------+ | | | | | | - Command data | | | | | | | | | - Arguments | | | | | | | | +---------------------+ | | | | | | | | | | | | | | +---------------------+ | | | | | | | | Command Output |<|----|------------------+ | | | | | Buffer | | | | | | | | - Results | | | | | | | | - Status | | | | | | | +---------------------+ | | | | | +-------------------------+ | | | +---------------------------------+ | | | +---------------------------------------------------------------+”…””}”hjNsbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jLhŸh³h K.hj-hžhubhŒnote”“”)”}”(hŒPThis is using an GA-102 Ampere GPU as an example and could vary for future GPUs.”h]”hÊ)”}”(hj`h]”hŒPThis is using an GA-102 Ampere GPU as an example and could vary for future GPUs.”…””}”(hjbhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K¬hj^ubah}”(h]”h ]”h"]”h$]”h&]”uh1j\hj-hžhhŸh³h Nubj])”}”(hX>The FWSEC image also plays a role in memory scrubbing (ECC initialization) and VPR (Video Protected Region) initialization as well. Before the nova-core driver is even loaded, the FWSEC image is running on the GSP in heavy-secure mode. After the devinit sequence completes, it does VRAM memory scrubbing (ECC initialization). On consumer GPUs, it scrubs only part of memory and then initiates 'async scrubbing'. Before this async scrubbing completes, the unscrubbed VRAM cannot be used for allocation (thus DRM memory allocators need to wait for this scrubbing to complete).”h]”hÊ)”}”(hX>The FWSEC image also plays a role in memory scrubbing (ECC initialization) and VPR (Video Protected Region) initialization as well. Before the nova-core driver is even loaded, the FWSEC image is running on the GSP in heavy-secure mode. After the devinit sequence completes, it does VRAM memory scrubbing (ECC initialization). On consumer GPUs, it scrubs only part of memory and then initiates 'async scrubbing'. Before this async scrubbing completes, the unscrubbed VRAM cannot be used for allocation (thus DRM memory allocators need to wait for this scrubbing to complete).”h]”hXBThe FWSEC image also plays a role in memory scrubbing (ECC initialization) and VPR (Video Protected Region) initialization as well. Before the nova-core driver is even loaded, the FWSEC image is running on the GSP in heavy-secure mode. After the devinit sequence completes, it does VRAM memory scrubbing (ECC initialization). On consumer GPUs, it scrubs only part of memory and then initiates ‘async scrubbing’. Before this async scrubbing completes, the unscrubbed VRAM cannot be used for allocation (thus DRM memory allocators need to wait for this scrubbing to complete).”…””}”(hjyhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K¯hjuubah}”(h]”h ]”h"]”h$]”h&]”uh1j\hj-hžhhŸh³h Nubeh}”(h]”Œfwsec-memory-layout”ah ]”h"]”Œfwsec memory layout”ah$]”h&]”uh1h´hh¶hžhhŸh³h K+ubeh}”(h]”Œfwsec-firmware-security”ah ]”h"]”Œfwsec (firmware security)”ah$]”h&]”uh1h´hhhžhhŸh³h Kubeh}”(h]”h ]”h"]”h$]”h&]”Œsource”h³uh1hŒcurrent_source”NŒ current_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(h¹NŒ generator”NŒ datestamp”NŒ source_link”NŒ source_url”NŒ toc_backlinks”Œentry”Œfootnote_backlinks”KŒ sectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒ strip_classes”NŒ report_level”KŒ halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ traceback”ˆŒinput_encoding”Œ utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”jÀŒerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œ language_code”Œen”Œrecord_dependencies”NŒconfig”NŒ id_prefix”hŒauto_id_prefix”Œid”Œ dump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h³Œ _destination”NŒ _config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒ raw_enabled”KŒline_length_limit”M'Œpep_references”NŒ pep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒ rfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œ smart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œ docinfo_xform”KŒsectsubtitle_xform”‰Œ image_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”Œnameids”}”(jšj—j’juŒ nametypes”}”(jš‰j’‰uh}”(j—h¶jj-uŒ footnote_refs”}”Œ citation_refs”}”Œ autofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ footnotes”]”Œ citations”]”Œautofootnote_start”KŒsymbol_footnote_start”KŒ id_counter”Œ collections”ŒCounter”“”}”…”R”Œparse_messages”]”Œtransform_messages”]”Œ transformer”NŒ include_log”]”Œ decoration”Nhžhub.