Re: [PATCH v4 01/26] dt-bindings: interrupt-controller: Add Arm GICv5

[Lorenzo Pieralisi <lpieralisi@kernel.org>]

On Thu, May 29, 2025 at 02:17:26PM +0100, Peter Maydell wrote:
> On Thu, 29 May 2025 at 13:44, Lorenzo Pieralisi <lpieralisi@kernel.org> wrote:
> >
> > [+Andre, Peter]
> >
> > On Tue, May 13, 2025 at 07:47:54PM +0200, Lorenzo Pieralisi wrote:
> > > +      reg:
> > > +        minItems: 1
> > > +        items:
> > > +          - description: IRS control frame
> >
> > I came across it while testing EL3 firmware, raising the topic for
> > discussion.
> >
> > The IRS (and the ITS) has a config frame (need to patch the typo
> > s/control/config, already done) per interrupt domain supported, that is,
> > it can have up to 4 config frames:
> >
> > - EL3
> > - Secure
> > - Realm
> > - Non-Secure
> >
> > The one described in this binding is the non-secure one.
> >
> > IIUC, everything described in the DT represents the non-secure address
> > space.
> 
> The dt bindings do allow for describing Secure-world devices:
> Documentation/devicetree/bindings/arm/secure.txt has the
> details. We use this in QEMU so we can provide a DTB to
> guest EL3 firmware that tells it where the hardware is
> (and which EL3 can then pass on to an NS kernel). It would
> be helpful for the GICv5 binding to be defined in a way that
> we can do this for a GICv5 system too.
> 
> > Two questions:
> >
> > - I don't have to spell out the IRS/ITS config frame (and SETLPI, by
> >   the way) as non-secure, since that's implicit, is that correct ?
> 
> Do you want the DT binding to handle the case of "CPU and GIC do not
> implement EL3, and the only implemented security state is Secure"
> without the kernel needing to do something different from "ditto ditto
> but the only implemented security state is Nonsecure" ?

Not sure I follow you here sorry :)

> (Currently booting.html says you must be in NS, so we effectively
> say we don't support booting on this particular unicorn :-)
> But the secure.txt bindings envisage "kernel got booted in S",
> mostly for the benefit of aarch32.)
> 
> > - How can the schema describe, if present, EL3, Secure and Realm frames ?
> 
> The tempting thing to do is to have regs[] list the frames
> in some given order, but the spec makes them not simple
> supersets, allowing all of:
>  * NS
>  * S
>  * NS, S, EL3
>  * NS, Realm, EL3
>  * NS, Realm, S, EL3
> 
> secure.txt says:
> # The general principle of the naming scheme for Secure world bindings
> # is that any property that needs a different value in the Secure world
> # can be supported by prefixing the property name with "secure-". So for
> # instance "secure-foo" would override "foo".
> 
> So maybe we could have
>  reg : the NS frame(s)
>  secure-reg : the S frame(s)
>  realm-reg : the Realm frame(s)
>  root-reg : the EL3 frame(s)
> 
> ??

I assume someone has to write the root/realm binding extensions.

In Documentation/devicetree/bindings/arm/secure.txt I don't think that
reg is a contemplated property - I don't know if the list of properties
is up-to-date.

If what you suggest is OK, is it really needed to add the
{secure/realm/root}-reg property to this binding ?

Or implicitly a, say, realm-reg property is allowed using the
yet-to-be-written realm.txt rules ?

This would also slightly change the "required" properties, a "reg"
property would not be required if eg the GIC does not implement a NS
interrupt domain (but we would require a secure-reg if it implements a
secure interrupt domain). I am making this up, obviously, I don't know
what's best to do here.

Lorenzo