|
| 1 | +.. SPDX-License-Identifier: (GPL-2.0+ OR MIT) |
| 2 | +
|
| 3 | +========== |
| 4 | +VBIOS |
| 5 | +========== |
| 6 | +This document describes the layout of the VBIOS image which is a series of concatenated |
| 7 | +images in the ROM of the GPU. The VBIOS is mirrored onto the BAR 0 space and is read |
| 8 | +by both Boot ROM firmware (also known as IFR or init-from-rom firmware) on the GPU to |
| 9 | +bootstrap various microcontrollers (PMU, SEC, GSP) with critical initialization before |
| 10 | +the driver loads, as well as by the nova-core driver in the kernel to boot the GSP. |
| 11 | + |
| 12 | +The format of the images in the ROM follow the "BIOS Specification" part of the |
| 13 | +PCI specification, with Nvidia-specific extensions. The ROM images of type FwSec |
| 14 | +are the ones that contain Falcon ucode and what we are mainly looking for. |
| 15 | + |
| 16 | +As an example, the following are the different image types that can be found in the |
| 17 | +VBIOS of an Ampere GA102 GPU which is supported by the nova-core driver. |
| 18 | + |
| 19 | +- PciAt Image (Type 0x00) - This is the standard PCI BIOS image, whose name |
| 20 | + likely comes from the "IBM PC/AT" architecture. |
| 21 | + |
| 22 | +- EFI Image (Type 0x03) - This is the EFI BIOS image. It contains the UEFI GOP |
| 23 | + driver that is used to display UEFI graphics output. |
| 24 | + |
| 25 | +- First FwSec Image (Type 0xE0) - The first FwSec image (Secure Firmware) |
| 26 | + |
| 27 | +- Second FwSec Image (Type 0xE0) - The second FwSec image (Secure Firmware) |
| 28 | + contains various microcodes (also known as an applications) that do a range |
| 29 | + of different functions. The FWSEC ucode is run in heavy-secure mode and |
| 30 | + typically runs directly on the GSP (it could be running on a different |
| 31 | + designated processor in future generations but as of Ampere, it is the GSP). |
| 32 | + This firmware then loads other firmware ucodes onto the PMU and SEC2 |
| 33 | + microcontrollers for gfw initialization after GPU reset and before the driver |
| 34 | + loads (see devinit.rst). The DEVINIT ucode is itself another ucode that is |
| 35 | + stored in this ROM partition. |
| 36 | + |
| 37 | +Once located, the Falcon ucodes have "Application Interfaces" in their data |
| 38 | +memory (DMEM). For FWSEC, the application interface we use for FWSEC is the |
| 39 | +"DMEM mapper" interface which is configured to run the "FRTS" command. This |
| 40 | +command carves out the WPR2 (Write-Protected Region) in VRAM. It then places |
| 41 | +important power-management data, called 'FRTS', into this region. The WPR2 |
| 42 | +region is only accessible to heavy-secure ucode. |
| 43 | + |
| 44 | +.. note:: |
| 45 | + It is not clear why FwSec has 2 different partitions in the ROM, but they both |
| 46 | + are of type 0xE0 and can be identified as such. This could be subject to change |
| 47 | + in future generations. |
| 48 | + |
| 49 | +VBIOS ROM Layout |
| 50 | +---------------- |
| 51 | +The VBIOS layout is roughly a series of concatenated images laid out as follows:: |
| 52 | + |
| 53 | + +----------------------------------------------------------------------------+ |
| 54 | + | VBIOS (Starting at ROM_OFFSET: 0x300000) | |
| 55 | + +----------------------------------------------------------------------------+ |
| 56 | + | +-----------------------------------------------+ | |
| 57 | + | | PciAt Image (Type 0x00) | | |
| 58 | + | +-----------------------------------------------+ | |
| 59 | + | | +-------------------+ | | |
| 60 | + | | | ROM Header | | | |
| 61 | + | | | (Signature 0xAA55)| | | |
| 62 | + | | +-------------------+ | | |
| 63 | + | | | rom header's pci_data_struct_offset | | |
| 64 | + | | | points to the PCIR structure | | |
| 65 | + | | V | | |
| 66 | + | | +-------------------+ | | |
| 67 | + | | | PCIR Structure | | | |
| 68 | + | | | (Signature "PCIR")| | | |
| 69 | + | | | last_image: 0x80 | | | |
| 70 | + | | | image_len: size | | | |
| 71 | + | | | in 512-byte units | | | |
| 72 | + | | +-------------------+ | | |
| 73 | + | | | | | |
| 74 | + | | | NPDE immediately follows PCIR | | |
| 75 | + | | V | | |
| 76 | + | | +-------------------+ | | |
| 77 | + | | | NPDE Structure | | | |
| 78 | + | | | (Signature "NPDE")| | | |
| 79 | + | | | last_image: 0x00 | | | |
| 80 | + | | +-------------------+ | | |
| 81 | + | | | | |
| 82 | + | | +-------------------+ | | |
| 83 | + | | | BIT Header | (Signature scanning | | |
| 84 | + | | | (Signature "BIT") | provides the location | | |
| 85 | + | | +-------------------+ of the BIT table) | | |
| 86 | + | | | header is | | |
| 87 | + | | | followed by a table of tokens | | |
| 88 | + | | V one of which is for falcon data. | | |
| 89 | + | | +-------------------+ | | |
| 90 | + | | | BIT Tokens | | | |
| 91 | + | | | ______________ | | | |
| 92 | + | | | | Falcon Data | | | | |
| 93 | + | | | | Token (0x70)|---+------------>------------+--+ | |
| 94 | + | | | +-------------+ | falcon_data_ptr() | | | |
| 95 | + | | +-------------------+ | V | |
| 96 | + | +-----------------------------------------------+ | | |
| 97 | + | (no gap between images) | | |
| 98 | + | +-----------------------------------------------+ | | |
| 99 | + | | EFI Image (Type 0x03) | | | |
| 100 | + | +-----------------------------------------------+ | | |
| 101 | + | | Contains the UEFI GOP driver (Graphics Output)| | | |
| 102 | + | | +-------------------+ | | | |
| 103 | + | | | ROM Header | | | | |
| 104 | + | | +-------------------+ | | | |
| 105 | + | | | PCIR Structure | | | | |
| 106 | + | | +-------------------+ | | | |
| 107 | + | | | NPDE Structure | | | | |
| 108 | + | | +-------------------+ | | | |
| 109 | + | | | Image data | | | | |
| 110 | + | | +-------------------+ | | | |
| 111 | + | +-----------------------------------------------+ | | |
| 112 | + | (no gap between images) | | |
| 113 | + | +-----------------------------------------------+ | | |
| 114 | + | | First FwSec Image (Type 0xE0) | | | |
| 115 | + | +-----------------------------------------------+ | | |
| 116 | + | | +-------------------+ | | | |
| 117 | + | | | ROM Header | | | | |
| 118 | + | | +-------------------+ | | | |
| 119 | + | | | PCIR Structure | | | | |
| 120 | + | | +-------------------+ | | | |
| 121 | + | | | NPDE Structure | | | | |
| 122 | + | | +-------------------+ | | | |
| 123 | + | | | Image data | | | | |
| 124 | + | | +-------------------+ | | | |
| 125 | + | +-----------------------------------------------+ | | |
| 126 | + | (no gap between images) | | |
| 127 | + | +-----------------------------------------------+ | | |
| 128 | + | | Second FwSec Image (Type 0xE0) | | | |
| 129 | + | +-----------------------------------------------+ | | |
| 130 | + | | +-------------------+ | | | |
| 131 | + | | | ROM Header | | | | |
| 132 | + | | +-------------------+ | | | |
| 133 | + | | | PCIR Structure | | | | |
| 134 | + | | +-------------------+ | | | |
| 135 | + | | | NPDE Structure | | | | |
| 136 | + | | +-------------------+ | | | |
| 137 | + | | | | | |
| 138 | + | | +-------------------+ | | | |
| 139 | + | | | PMU Lookup Table | <- falcon_data_offset <----+ | |
| 140 | + | | | +-------------+ | pmu_lookup_table | | |
| 141 | + | | | | Entry 0x85 | | | | |
| 142 | + | | | | FWSEC_PROD | | | | |
| 143 | + | | | +-------------+ | | | |
| 144 | + | | +-------------------+ | | |
| 145 | + | | | | | |
| 146 | + | | | points to | | |
| 147 | + | | V | | |
| 148 | + | | +-------------------+ | | |
| 149 | + | | | FalconUCodeDescV3 | <- falcon_ucode_offset | | |
| 150 | + | | | (FWSEC Firmware) | fwsec_header() | | |
| 151 | + | | +-------------------+ | | |
| 152 | + | | | immediately followed by... | | |
| 153 | + | | V | | |
| 154 | + | | +----------------------------+ | | |
| 155 | + | | | Signatures + FWSEC Ucode | | | |
| 156 | + | | | fwsec_sigs(), fwsec_ucode()| | | |
| 157 | + | | +----------------------------+ | | |
| 158 | + | +-----------------------------------------------+ | |
| 159 | + | | |
| 160 | + +----------------------------------------------------------------------------+ |
| 161 | + |
| 162 | +.. note:: |
| 163 | + This diagram is created based on an GA-102 Ampere GPU as an example and could |
| 164 | + vary for future or other GPUs. |
| 165 | + |
| 166 | +.. note:: |
| 167 | + For more explanations of acronyms, see the detailed descriptions in `vbios.rs`. |
| 168 | + |
| 169 | +Falcon data Lookup |
| 170 | +------------------ |
| 171 | +A key part of the VBIOS extraction code (vbios.rs) is to find the location of the |
| 172 | +Falcon data in the VBIOS which contains the PMU lookup table. This lookup table is |
| 173 | +used to find the required Falcon ucode based on an application ID. |
| 174 | + |
| 175 | +The location of the PMU lookup table is found by scanning the BIT (`BIOS Information Table`_) |
| 176 | +tokens for a token with the id `BIT_TOKEN_ID_FALCON_DATA` (0x70) which indicates the |
| 177 | +offset of the same from the start of the VBIOS image. Unfortunately, the offset |
| 178 | +does not account for the EFI image located between the PciAt and FwSec images. |
| 179 | +The `vbios.rs` code compensates for this with appropriate arithmetic. |
| 180 | + |
| 181 | +.. _`BIOS Information Table`: https://download.nvidia.com/open-gpu-doc/BIOS-Information-Table/1/BIOS-Information-Table.html |
0 commit comments