| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20251216-nova-unload-v1-7-6a5d823be19d@nvidia.com>
Date: Tue, 16 Dec 2025 14:13:33 +0900
From: Alexandre Courbot <acourbot@...dia.com>
To: Danilo Krummrich <dakr@...nel.org>, Alice Ryhl <aliceryhl@...gle.com>,
David Airlie <airlied@...il.com>, Simona Vetter <simona@...ll.ch>,
Bjorn Helgaas <bhelgaas@...gle.com>,
Krzysztof Wilczyński <kwilczynski@...nel.org>,
Miguel Ojeda <ojeda@...nel.org>, Boqun Feng <boqun.feng@...il.com>,
Gary Guo <gary@...yguo.net>,
Björn Roy Baron <bjorn3_gh@...tonmail.com>,
Benno Lossin <lossin@...nel.org>, Andreas Hindborg <a.hindborg@...nel.org>,
Trevor Gross <tmgross@...ch.edu>
Cc: John Hubbard <jhubbard@...dia.com>,
Alistair Popple <apopple@...dia.com>,
Joel Fernandes <joelagnelf@...dia.com>, Timur Tabi <ttabi@...dia.com>,
Edwin Peer <epeer@...dia.com>, Eliot Courtney <ecourtney@...dia.com>,
nouveau@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
linux-kernel@...r.kernel.org, linux-pci@...r.kernel.org,
rust-for-linux@...r.kernel.org, Alexandre Courbot <acourbot@...dia.com>
Subject: [PATCH 7/7] gpu: nova-core: run Booter Unloader and FWSEC-SB upon
unbinding
When probing the driver, the FWSEC-FRTS firmware created a WPR2 secure
memory region to store the GSP firmware, and the booter loader loaded
and started that firmware into the GSP, making it run in RISC-V mode.
These operations need to be reverted upon unloading, particularly the
WPR2 secure region creation, as its presence will prevent the driver
from subsequently probing.
Thus, load and run the Booter Unloader and FWSEC-SB firmwares at unbind
time to put the GPU into a state where it can be probed again.
Signed-off-by: Alexandre Courbot <acourbot@...dia.com>
---
drivers/gpu/nova-core/firmware/booter.rs | 1 -
drivers/gpu/nova-core/firmware/fwsec.rs | 1 -
drivers/gpu/nova-core/gpu.rs | 8 +++++++-
drivers/gpu/nova-core/gsp/boot.rs | 35 ++++++++++++++++++++++++++++++++
drivers/gpu/nova-core/regs.rs | 5 +++++
5 files changed, 47 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/nova-core/firmware/booter.rs b/drivers/gpu/nova-core/firmware/booter.rs
index f107f753214a..d435ff11c5ec 100644
--- a/drivers/gpu/nova-core/firmware/booter.rs
+++ b/drivers/gpu/nova-core/firmware/booter.rs
@@ -270,7 +270,6 @@ fn new_booter(dev: &device::Device<device::Bound>, data: &[u8]) -> Result<Self>
#[derive(Copy, Clone, Debug, PartialEq)]
pub(crate) enum BooterKind {
Loader,
- #[expect(unused)]
Unloader,
}
diff --git a/drivers/gpu/nova-core/firmware/fwsec.rs b/drivers/gpu/nova-core/firmware/fwsec.rs
index b98b1286dc94..0758867a57a6 100644
--- a/drivers/gpu/nova-core/firmware/fwsec.rs
+++ b/drivers/gpu/nova-core/firmware/fwsec.rs
@@ -150,7 +150,6 @@ pub(crate) enum FwsecCommand {
/// image into it.
Frts { frts_addr: u64, frts_size: u64 },
/// Asks [`FwsecFirmware`] to load pre-OS apps on the PMU.
- #[expect(dead_code)]
Sb,
}
diff --git a/drivers/gpu/nova-core/gpu.rs b/drivers/gpu/nova-core/gpu.rs
index b94784f57b36..f98b195994ce 100644
--- a/drivers/gpu/nova-core/gpu.rs
+++ b/drivers/gpu/nova-core/gpu.rs
@@ -302,7 +302,13 @@ pub(crate) fn unbind(self: Pin<&mut Self>, dev: &device::Device<device::Core>) {
return;
};
- let _ = kernel::warn_on_err!(this.gsp.unload(dev, bar, this.gsp_falcon,));
+ let _ = kernel::warn_on_err!(this.gsp.unload(
+ dev,
+ bar,
+ this.spec.chipset,
+ this.gsp_falcon,
+ this.sec2_falcon,
+ ));
this.sysmem_flush.unregister(bar);
}
diff --git a/drivers/gpu/nova-core/gsp/boot.rs b/drivers/gpu/nova-core/gsp/boot.rs
index e12e1d3fd53f..9525ac912ee9 100644
--- a/drivers/gpu/nova-core/gsp/boot.rs
+++ b/drivers/gpu/nova-core/gsp/boot.rs
@@ -261,7 +261,9 @@ pub(crate) fn unload(
self: Pin<&mut Self>,
dev: &device::Device<device::Bound>,
bar: &Bar0,
+ chipset: Chipset,
gsp_falcon: &Falcon<Gsp>,
+ sec2_falcon: &Falcon<Sec2>,
) -> Result {
let this = self.project();
@@ -271,6 +273,39 @@ pub(crate) fn unload(
.inspect_err(|e| dev_err!(dev, "unload guest driver failed: {:?}", e))?;
dev_dbg!(dev, "GSP shut down\n");
+ /* Run FWSEC-SB to reset the GSP falcon to its pre-libos state. */
+
+ let bios = Vbios::new(dev, bar)?;
+ let fwsec_sb = FwsecFirmware::new(dev, gsp_falcon, bar, &bios, FwsecCommand::Sb)?;
+ fwsec_sb.run(dev, gsp_falcon, bar)?;
+ dev_dbg!(dev, "FWSEC SB completed\n");
+
+ /* Remove WPR2 region if set. */
+
+ let wpr2_hi = regs::NV_PFB_PRI_MMU_WPR2_ADDR_HI::read(bar);
+ dev_dbg!(dev, "WPR2 HI: {:?}\n", wpr2_hi);
+ if wpr2_hi.is_wpr2_set() {
+ let booter_unloader = BooterFirmware::new(
+ dev,
+ BooterKind::Unloader,
+ chipset,
+ FIRMWARE_VERSION,
+ sec2_falcon,
+ bar,
+ )?;
+
+ dev_dbg!(dev, "Booter unloader created\n");
+
+ sec2_falcon.reset(bar)?;
+ sec2_falcon.dma_load(bar, &booter_unloader)?;
+ let _ = sec2_falcon.boot(bar, Some(0xff), Some(0xff))?;
+ dev_dbg!(
+ dev,
+ "WPR2 HI: {:?}\n",
+ regs::NV_PFB_PRI_MMU_WPR2_ADDR_HI::read(bar)
+ );
+ }
+
Ok(())
}
}
diff --git a/drivers/gpu/nova-core/regs.rs b/drivers/gpu/nova-core/regs.rs
index 82cc6c0790e5..6f53ac096e1e 100644
--- a/drivers/gpu/nova-core/regs.rs
+++ b/drivers/gpu/nova-core/regs.rs
@@ -156,6 +156,11 @@ impl NV_PFB_PRI_MMU_WPR2_ADDR_HI {
pub(crate) fn higher_bound(self) -> u64 {
u64::from(self.hi_val()) << 12
}
+
+ /// Returns whether the WPR2 regions is currently set.
+ pub(crate) fn is_wpr2_set(self) -> bool {
+ self.hi_val() != 0
+ }
}
// PGC6 register space.
--
2.52.0
Powered by blists - more mailing lists