| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20251203055923.1247681-17-jhubbard@nvidia.com>
Date: Tue, 2 Dec 2025 21:59:08 -0800
From: John Hubbard <jhubbard@...dia.com>
To: Danilo Krummrich <dakr@...nel.org>
Cc: Alexandre Courbot <acourbot@...dia.com>,
Joel Fernandes <joelagnelf@...dia.com>,
Timur Tabi <ttabi@...dia.com>,
Alistair Popple <apopple@...dia.com>,
Edwin Peer <epeer@...dia.com>,
Zhi Wang <zhiw@...dia.com>,
David Airlie <airlied@...il.com>,
Simona Vetter <simona@...ll.ch>,
Bjorn Helgaas <bhelgaas@...gle.com>,
Miguel Ojeda <ojeda@...nel.org>,
Alex Gaynor <alex.gaynor@...il.com>,
Boqun Feng <boqun.feng@...il.com>,
Gary Guo <gary@...yguo.net>,
Björn Roy Baron <bjorn3_gh@...tonmail.com>,
Benno Lossin <lossin@...nel.org>,
Andreas Hindborg <a.hindborg@...nel.org>,
Alice Ryhl <aliceryhl@...gle.com>,
Trevor Gross <tmgross@...ch.edu>,
nouveau@...ts.freedesktop.org,
rust-for-linux@...r.kernel.org,
LKML <linux-kernel@...r.kernel.org>,
John Hubbard <jhubbard@...dia.com>
Subject: [PATCH 16/31] gpu: nova-core: Hopper/Blackwell: add FSP message infrastructure
Add the FSP messaging infrastructure needed for Chain of Trust
communication on Hopper/Blackwell GPUs.
Signed-off-by: John Hubbard <jhubbard@...dia.com>
---
drivers/gpu/nova-core/falcon/fsp.rs | 77 +++++++++++++++++++++++++++++
drivers/gpu/nova-core/regs.rs | 48 ++++++++++++++++++
2 files changed, 125 insertions(+)
diff --git a/drivers/gpu/nova-core/falcon/fsp.rs b/drivers/gpu/nova-core/falcon/fsp.rs
index 9e796e82e556..0e8522b1171d 100644
--- a/drivers/gpu/nova-core/falcon/fsp.rs
+++ b/drivers/gpu/nova-core/falcon/fsp.rs
@@ -87,4 +87,81 @@ pub(crate) fn read_emem(&self, bar: &Bar0, offset: u32, data: &mut [u8]) -> Resu
Ok(())
}
+
+ /// Poll FSP for incoming data.
+ ///
+ /// Returns the size of available data in bytes, or 0 if no data is available.
+ ///
+ /// The FSP message queue is not circular - pointers are reset to 0 after each
+ /// message exchange, so `tail >= head` is always true when data is present.
+ #[allow(dead_code)]
+ pub(crate) fn poll_msgq(&self, bar: &Bar0) -> u32 {
+ let head = regs::NV_PFSP_MSGQ_HEAD::read(bar).address();
+ let tail = regs::NV_PFSP_MSGQ_TAIL::read(bar).address();
+
+ if head == tail {
+ return 0;
+ }
+
+ // TAIL points at last DWORD written, so add 4 to get total size
+ (tail - head) + 4
+ }
+
+ /// Send message to FSP.
+ ///
+ /// Writes a message to FSP EMEM and updates queue pointers to notify FSP.
+ ///
+ /// # Arguments
+ /// * `bar` - BAR0 memory mapping
+ /// * `packet` - Message data (must be 4-byte aligned in length)
+ ///
+ /// # Returns
+ /// `Ok(())` on success, `Err(EINVAL)` if packet is empty or not 4-byte aligned
+ #[allow(dead_code)]
+ pub(crate) fn send_msg(&self, bar: &Bar0, packet: &[u8]) -> Result {
+ if packet.is_empty() {
+ return Err(EINVAL);
+ }
+
+ // Write message to EMEM at offset 0 (validates 4-byte alignment)
+ self.write_emem(bar, 0, packet)?;
+
+ // Update queue pointers - TAIL points at last DWORD written
+ let tail_offset = u32::try_from(packet.len() - 4).map_err(|_| EINVAL)?;
+ regs::NV_PFSP_QUEUE_TAIL::default()
+ .set_address(tail_offset)
+ .write(bar);
+ regs::NV_PFSP_QUEUE_HEAD::default()
+ .set_address(0)
+ .write(bar);
+
+ Ok(())
+ }
+
+ /// Receive message from FSP.
+ ///
+ /// Reads a message from FSP EMEM and resets queue pointers.
+ ///
+ /// # Arguments
+ /// * `bar` - BAR0 memory mapping
+ /// * `buffer` - Buffer to receive message data
+ /// * `size` - Size of message to read in bytes (from `poll_msgq`)
+ ///
+ /// # Returns
+ /// `Ok(bytes_read)` on success, `Err(EINVAL)` if size is 0, exceeds buffer, or not aligned
+ #[allow(dead_code)]
+ pub(crate) fn recv_msg(&self, bar: &Bar0, buffer: &mut [u8], size: usize) -> Result<usize> {
+ if size == 0 || size > buffer.len() {
+ return Err(EINVAL);
+ }
+
+ // Read response from EMEM at offset 0 (validates 4-byte alignment)
+ self.read_emem(bar, 0, &mut buffer[..size])?;
+
+ // Reset message queue pointers after reading
+ regs::NV_PFSP_MSGQ_TAIL::default().set_address(0).write(bar);
+ regs::NV_PFSP_MSGQ_HEAD::default().set_address(0).write(bar);
+
+ Ok(size)
+ }
}
diff --git a/drivers/gpu/nova-core/regs.rs b/drivers/gpu/nova-core/regs.rs
index b642cee9611d..0d5c13f19073 100644
--- a/drivers/gpu/nova-core/regs.rs
+++ b/drivers/gpu/nova-core/regs.rs
@@ -401,6 +401,54 @@ pub(crate) fn mem_scrubbing_done(self) -> bool {
31:0 data as u32; // EMEM data register
});
+// FSP (Firmware System Processor) queue registers for Hopper/Blackwell Chain of Trust
+// These registers manage falcon EMEM communication queues
+register!(NV_PFSP_QUEUE_HEAD @ 0x008f2c00 {
+ 31:0 address as u32;
+});
+
+register!(NV_PFSP_QUEUE_TAIL @ 0x008f2c04 {
+ 31:0 address as u32;
+});
+
+register!(NV_PFSP_MSGQ_HEAD @ 0x008f2c80 {
+ 31:0 address as u32;
+});
+
+register!(NV_PFSP_MSGQ_TAIL @ 0x008f2c84 {
+ 31:0 address as u32;
+});
+
+// PTHERM registers
+
+// FSP secure boot completion status register used by FSP to signal boot completion.
+// This is the NV_THERM_I2CS_SCRATCH register.
+// Different architectures use different addresses:
+// - Hopper (GH100): 0x000200bc
+// - Blackwell (GB202): 0x00ad00bc
+#[allow(dead_code)]
+pub(crate) fn fsp_thermal_scratch_reg_addr(arch: Architecture) -> Result<usize> {
+ match arch {
+ Architecture::Hopper => Ok(0x000200bc),
+ Architecture::Blackwell => Ok(0x00ad00bc),
+ _ => Err(kernel::error::code::ENOTSUPP),
+ }
+}
+
+/// FSP writes this value to indicate successful boot completion.
+#[allow(dead_code)]
+pub(crate) const FSP_BOOT_COMPLETE_SUCCESS: u32 = 0xff;
+
+// Helper function to read FSP boot completion status from the correct register
+#[allow(dead_code)]
+pub(crate) fn read_fsp_boot_complete_status(
+ bar: &crate::driver::Bar0,
+ arch: Architecture,
+) -> Result<u32> {
+ let addr = fsp_thermal_scratch_reg_addr(arch)?;
+ Ok(bar.read32(addr))
+}
+
// The modules below provide registers that are not identical on all supported chips. They should
// only be used in HAL modules.
--
2.52.0
Powered by blists - more mailing lists