fix(smmuv3): use an SMMUv3TestEngine that can issue Secure accesses
PCIe can only relay whether an access is NS or realm. So when Cactus
instructs the test engine to go talk to the SMMU pretending to be a
Secure device we're relying on behaviour that shouldn't be possible.
Models up to version 11.28 didn't check this so it would work despite
being incorrect. At some point after this release, though, a check has
been added making these accesses report failure (CMD reads
ENGINE_MIS_CFG when read back).
The fix is to not use a PCIe connected test engine. This can be done by
using a dma330x4 that can be converted to a test engine with
`-C pci.dma330x4.use_smmuv3testengine_not_dmacs=1`.
This now works on older and newer models.
Change-Id: I76a8deef78c640c4958d0a94df19ac29d3759cc0
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
diff --git a/spm/cactus/cactus_tests/cactus_tests_smmuv3.c b/spm/cactus/cactus_tests/cactus_tests_smmuv3.c
index 5308d93..ad98006 100644
--- a/spm/cactus/cactus_tests/cactus_tests_smmuv3.c
+++ b/spm/cactus/cactus_tests/cactus_tests_smmuv3.c
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2021-2023, Arm Limited. All rights reserved.
+ * Copyright (c) 2021-2025, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*/
@@ -24,6 +24,30 @@
#define NO_SUBSTREAMID (0xFFFFFFFFU)
#define LOOP_COUNT (5000U)
+/*
+ * This function will configure an SMMUv3TestEngine to make access to the Secure
+ * PAS. To do that it uses a regularly (non-PCIe) connected device in place of
+ * the PL 330 cluster. This is non standard and must be enabled on the FVP
+ * commandline with:
+ * -C pci.dma330x4.use_smmuv3testengine_not_dmacs=1
+ *
+ * Some notes about the model:
+ *
+ * A DMAC is a DMA-Controller a DMA-330 (a.k.a. DMAC_PL_330, a.k.a. PL_330). It
+ * is an ancient (32b) device that has its own little instruction set and
+ * several concurrent threads of execution that can be used to move memory
+ * about.
+ *
+ * The original DMAC cluster was put in so that it provides an easy work-load to
+ * program for the SMMU rather than a full PCIe device.
+ *
+ * The PCIe block diagram is not quite right depending on your point of view.
+ * The PCIe Subsystem is above the SMMU – i.e. all accesses made by PCIe devices
+ * go through the SMMU.
+ *
+ * The DMAC cluster is also above the same SMMU and so is (mostly)
+ * indistinguishable from the PCIe device traffic.
+ */
static bool run_testengine(uint32_t operation, uintptr_t source_addr,
uintptr_t target_addr, size_t transfer_size,
uint32_t attributes)
diff --git a/spm/cactus/plat/arm/fvp/fdts/cactus.dts b/spm/cactus/plat/arm/fvp/fdts/cactus.dts
index 03a7d17..3a11a41 100644
--- a/spm/cactus/plat/arm/fvp/fdts/cactus.dts
+++ b/spm/cactus/plat/arm/fvp/fdts/cactus.dts
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2019-2023, Arm Limited. All rights reserved.
+ * Copyright (c) 2019-2025, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*
@@ -114,10 +114,10 @@
/*
* SMMUv3TestEngine is a DMA IP modeled in the
* Base-RevC FVP Model.
- * User Frame: 0x2bfe0000
- * Privileged Frame: 0x2bff0000
+ * User Frame: 0x2b500000
+ * Privileged Frame: 0x25100000
*/
- base-address = <0x00000000 0x2bfe0000>;
+ base-address = <0x00000000 0x2b500000>;
pages-count = <32>; /* Two 64KB pages */
attributes = <0x3>; /* read-write */
smmu-id = <0>;
diff --git a/spm/cactus/plat/arm/fvp/include/sp_platform_def.h b/spm/cactus/plat/arm/fvp/include/sp_platform_def.h
index 390294f..173f4fd 100644
--- a/spm/cactus/plat/arm/fvp/include/sp_platform_def.h
+++ b/spm/cactus/plat/arm/fvp/include/sp_platform_def.h
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2020-2022, Arm Limited. All rights reserved.
+ * Copyright (c) 2020-2025, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*/
@@ -32,8 +32,8 @@
#define PLAT_CACTUS_MEMCPY_RANGE ULL(0x8000)
/* Base address of user and PRIV frames in SMMUv3TestEngine */
-#define USR_BASE_FRAME ULL(0x2BFE0000)
-#define PRIV_BASE_FRAME ULL(0x2BFF0000)
+#define USR_BASE_FRAME ULL(0x2B500000)
+#define PRIV_BASE_FRAME ULL(0x2B510000)
/* Base address for memory sharing tests. */
#define CACTUS_SP1_MEM_SHARE_BASE 0x7500000