core: add support for secure boot

On GM200 and later GPUs, firmware for some essential falcons (notably
GR ones) must be authenticated by a NVIDIA-produced signature and
loaded by a high-secure falcon in order to be able to access privileged
registers, in a process known as Secure Boot.

Secure Boot requires building a binary blob containing the firmwares
and signatures of the falcons to be loaded. This blob is then given to
a high-secure falcon running a signed loader firmware that copies the
blob into a write-protected region, checks that the signatures are
valid, and finally loads the verified firmware into the managed falcons
and switches them to privileged mode.

This patch adds infrastructure code to support this process on chips
that require it.

v2:
- The IRQ mask of the PMU falcon was left - replace it with the proper
  irq_mask variable.
- The falcon reset procedure expecting a falcon in an initialized state,
  which was accidentally provided by the PMU subdev. Make sure that
  secboot can manage the falcon on its own.

Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

1 files changed, 16 insertions, 1 deletions

diff --git a/lib/include/nvif/os.h b/lib/include/nvif/os.h
index 85c958881..fbde224ba 100644
--- a/lib/include/nvif/os.h
+++ b/lib/include/nvif/os.h
@@ -233,7 +233,7 @@ hweight32(u32 v) {
 #define BITMAP_BIT(b) ((b) % BITS_PER_LONG)
 
 static inline int
-test_bit(int bit, volatile unsigned long *ptr)
+test_bit(int bit, const volatile unsigned long *ptr)
 {
 	return !!(ptr[BITMAP_POS(bit)] & (1UL << BITMAP_BIT(bit)));
 }
@@ -285,6 +285,17 @@ __set_bit(long bit, volatile unsigned long *addr)
 }
 
 static inline long
+find_next_bit(const volatile unsigned long *addr, int bits, int bit)
+{
+	while (bit < bits) {
+		if (test_bit(bit, addr))
+			break;
+		bit++;
+	}
+	return bit;
+}
+
+static inline long
 find_first_zero_bit(volatile unsigned long *addr, int bits)
 {
 	int bit;
@@ -310,6 +321,10 @@ bitmap_clear(unsigned long *addr, unsigned int pos, unsigned int bits)
 		__clear_bit(pos++, addr);
 }
 
+#define for_each_set_bit(bit, addr, size)                                      \
+	for ((bit) = find_next_bit((addr), (size), 0); (bit) < (size);         \
+	     (bit) = find_next_bit((addr), (size), (bit) + 1))
+
 /******************************************************************************
  * atomics
  *****************************************************************************/