From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 46C20C43334 for ; Wed, 8 Jun 2022 10:25:53 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id C59206102C; Wed, 8 Jun 2022 10:25:52 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6hZ0HgfjP41d; Wed, 8 Jun 2022 10:25:52 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by smtp3.osuosl.org (Postfix) with ESMTPS id AE33E61006; Wed, 8 Jun 2022 10:25:51 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 96083C0039; Wed, 8 Jun 2022 10:25:51 +0000 (UTC) Received: from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133]) by lists.linuxfoundation.org (Postfix) with ESMTP id 05405C002D for ; Wed, 8 Jun 2022 10:25:51 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id D7C8F4013D for ; Wed, 8 Jun 2022 10:25:50 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Authentication-Results: smtp2.osuosl.org (amavisd-new); dkim=pass (2048-bit key) header.d=collabora.com Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JYbwVQmx6OFr for ; Wed, 8 Jun 2022 10:25:50 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0 Received: from madras.collabora.co.uk (madras.collabora.co.uk [46.235.227.172]) by smtp2.osuosl.org (Postfix) with ESMTPS id E543740126 for ; Wed, 8 Jun 2022 10:25:49 +0000 (UTC) Received: from [192.168.1.100] (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by madras.collabora.co.uk (Postfix) with ESMTPSA id 246C0660181B; Wed, 8 Jun 2022 11:25:47 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1654683948; bh=CbCEHZf0MESeLkAV+KaRIb58SJLwsWDBEd1XfSKloiU=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=JL6CAQRzPNxS11sdv1lqG3+jYQQBX0szDXfzGlqNeAmSTxcSN4hrnxHXiJK4TI/5o 4lG3gsRwQhONwG+w5NxnfRzA+cI5lF3VjstoVw0s3HPCKYvYr7kER2ucKauN9+qgMT mTsntlQDlE0JrPQUTJURaOqHDSkyIi90kFHMkUae1FEGncdiXfftKujwqhZzPtMcGC hldbDeeSFn1Hvs5EIWixyoS9jStUbJyl1AVxxnbAxcZhEJiSgkRbwBUWK0306fSYfO mWuaO/tU/mF4L7Eqymam34ABQMq66ZhWoW9r442GAmDfk2QCk2U4rXjVa10NTpdz0t 8aV3MpGHtXuKQ== Message-ID: <4f6f1ec4-2c68-5446-e0e0-85e1631a84cf@collabora.com> Date: Wed, 8 Jun 2022 12:25:44 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.9.0 Subject: Re: [PATCH 1/6] iommu/qcom: Use the asid read from device-tree if specified Content-Language: en-US To: Konrad Dybcio , Rob Clark , Will Deacon References: <20220527212901.29268-1-konrad.dybcio@somainline.org> <20220527212901.29268-2-konrad.dybcio@somainline.org> <20220531154631.GA25502@willie-the-truck> <20220531161910.GE25502@willie-the-truck> <6efeafbc-d366-bddd-faa4-4359f3a56f4a@somainline.org> From: AngeloGioacchino Del Regno In-Reply-To: <6efeafbc-d366-bddd-faa4-4359f3a56f4a@somainline.org> Cc: "open list:OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS" , linux-arm-msm , Linux Kernel Mailing List , jamipkettunen@somainline.org, Rob Herring , "list@263.net:IOMMU DRIVERS" , Andy Gross , Martin Botka , ~postmarketos/upstreaming@lists.sr.ht, Krzysztof Kozlowski , AngeloGioacchino Del Regno , Marijn Suijten , Robin Murphy , "moderated list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE" X-BeenThere: iommu@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Development issues for Linux IOMMU support List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: iommu-bounces@lists.linux-foundation.org Sender: "iommu" Il 03/06/22 20:03, Konrad Dybcio ha scritto: > > > On 31.05.2022 22:57, Rob Clark wrote: >> On Tue, May 31, 2022 at 9:19 AM Will Deacon wrote: >>> >>> On Tue, May 31, 2022 at 09:15:22AM -0700, Rob Clark wrote: >>>> On Tue, May 31, 2022 at 8:46 AM Will Deacon wrote: >>>>> >>>>> On Fri, May 27, 2022 at 11:28:56PM +0200, Konrad Dybcio wrote: >>>>>> From: AngeloGioacchino Del Regno >>>>>> >>>>>> As specified in this driver, the context banks are 0x1000 apart. >>>>>> Problem is that sometimes the context number (our asid) does not >>>>>> match this logic and we end up using the wrong one: this starts >>>>>> being a problem in the case that we need to send TZ commands >>>>>> to do anything on a specific context. >>>>> >>>>> I don't understand this. The ASID is a software construct, so it shouldn't >>>>> matter what we use. If it does matter, then please can you explain why? The >>>>> fact that the context banks are 0x1000 apart seems unrelated. >>>> >>>> I think the connection is that mapping from ctx bank to ASID is 1:1 >>> >>> But in what sense? How is the ASID used beyond a tag in the TLB? The commit >>> message hints at "TZ commands" being a problem. >>> >>> I'm not doubting that this is needed to make the thing work, I just don't >>> understand why. >> >> (disclaimer, it has been quite a while since I've looked at the smmu >> setup with earlier tz, ie. things that use qcom_iommu, but from >> memory...) >> >> We cannot actually assign the context banks ourselves, so in the dt >> bindings the "ASID" is actually the context bank index. > I think so. > > I don't >> remember exactly if this was a limitation of the tz interface, or >> result of not being able to program the smmu's global registers >> ourselves. > > As far as I understand, it's the latter, as changing the defaults is not allowed by the security policy on consumer devices. > > Qualcomm arbitrarily chose some numbers that may or may have not aligned with their usual index-is-offset-divided-by-0x1000 and hardcoded them in the BSP, and now the secure side (if required, and well, it is..) expects precisely that configuration. > > > Konrad > I can confirm that it's the latter, as described by Konrad. The inability of programming the global registers from Linux is due to the hypervisor disallowing that (in different ways depending on the SoC's firmware but with the same outcome: AP reset by HYP). Cheers, Angelo _______________________________________________ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 660F6C43334 for ; Wed, 8 Jun 2022 10:30:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:From:References:Cc:To:Subject: MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=x5AVtg3Leza3QEuppjnWXTaXfbJ3uIWFxoE+MfLgsRg=; b=QniTZg08NzXog1 mUNECw0aE72XHNUJkX2YChQxMRA0pzBQEYiafFmjF+3jyUsRvZymuXJE3RSANz4KxSUaRqua4xTeZ S/OzoLRK4fzb3av1e1fJjEJ8aABHCPouNo/d+G7SUF/q3ST+o8US3DxU1ioXV07NiKoHXGMISBP9z DdnU9AxYWciSqkMBn3WUviL1GClhNvpelTiz2sje0LgOyZPjN2BakaGwUFngs5KGjqeeRcSngKOtV qzRX0RRg3WDJjsfClil4AbqbYF92TGeNEc+6sv1EXbOy5Q6czy+d2VoU/jiFApguA+zd+6UBgGHZd u3679C4LH4o1PRObKH5Q==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nyswM-00Cl17-SI; Wed, 08 Jun 2022 10:29:32 +0000 Received: from madras.collabora.co.uk ([2a00:1098:0:82:1000:25:2eeb:e5ab]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nyssr-00CjSM-MZ for linux-arm-kernel@lists.infradead.org; Wed, 08 Jun 2022 10:25:55 +0000 Received: from [192.168.1.100] (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by madras.collabora.co.uk (Postfix) with ESMTPSA id 246C0660181B; Wed, 8 Jun 2022 11:25:47 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1654683948; bh=CbCEHZf0MESeLkAV+KaRIb58SJLwsWDBEd1XfSKloiU=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=JL6CAQRzPNxS11sdv1lqG3+jYQQBX0szDXfzGlqNeAmSTxcSN4hrnxHXiJK4TI/5o 4lG3gsRwQhONwG+w5NxnfRzA+cI5lF3VjstoVw0s3HPCKYvYr7kER2ucKauN9+qgMT mTsntlQDlE0JrPQUTJURaOqHDSkyIi90kFHMkUae1FEGncdiXfftKujwqhZzPtMcGC hldbDeeSFn1Hvs5EIWixyoS9jStUbJyl1AVxxnbAxcZhEJiSgkRbwBUWK0306fSYfO mWuaO/tU/mF4L7Eqymam34ABQMq66ZhWoW9r442GAmDfk2QCk2U4rXjVa10NTpdz0t 8aV3MpGHtXuKQ== Message-ID: <4f6f1ec4-2c68-5446-e0e0-85e1631a84cf@collabora.com> Date: Wed, 8 Jun 2022 12:25:44 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.9.0 Subject: Re: [PATCH 1/6] iommu/qcom: Use the asid read from device-tree if specified Content-Language: en-US To: Konrad Dybcio , Rob Clark , Will Deacon Cc: ~postmarketos/upstreaming@lists.sr.ht, linux-arm-msm , Bjorn Andersson , "moderated list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE" , "list@263.net:IOMMU DRIVERS" , Joerg Roedel , Martin Botka , AngeloGioacchino Del Regno , Marijn Suijten , jamipkettunen@somainline.org, Andy Gross , Rob Herring , Krzysztof Kozlowski , Robin Murphy , "open list:OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS" , Linux Kernel Mailing List References: <20220527212901.29268-1-konrad.dybcio@somainline.org> <20220527212901.29268-2-konrad.dybcio@somainline.org> <20220531154631.GA25502@willie-the-truck> <20220531161910.GE25502@willie-the-truck> <6efeafbc-d366-bddd-faa4-4359f3a56f4a@somainline.org> From: AngeloGioacchino Del Regno In-Reply-To: <6efeafbc-d366-bddd-faa4-4359f3a56f4a@somainline.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220608_032554_019206_F519A4FB X-CRM114-Status: GOOD ( 25.29 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Il 03/06/22 20:03, Konrad Dybcio ha scritto: > > > On 31.05.2022 22:57, Rob Clark wrote: >> On Tue, May 31, 2022 at 9:19 AM Will Deacon wrote: >>> >>> On Tue, May 31, 2022 at 09:15:22AM -0700, Rob Clark wrote: >>>> On Tue, May 31, 2022 at 8:46 AM Will Deacon wrote: >>>>> >>>>> On Fri, May 27, 2022 at 11:28:56PM +0200, Konrad Dybcio wrote: >>>>>> From: AngeloGioacchino Del Regno >>>>>> >>>>>> As specified in this driver, the context banks are 0x1000 apart. >>>>>> Problem is that sometimes the context number (our asid) does not >>>>>> match this logic and we end up using the wrong one: this starts >>>>>> being a problem in the case that we need to send TZ commands >>>>>> to do anything on a specific context. >>>>> >>>>> I don't understand this. The ASID is a software construct, so it shouldn't >>>>> matter what we use. If it does matter, then please can you explain why? The >>>>> fact that the context banks are 0x1000 apart seems unrelated. >>>> >>>> I think the connection is that mapping from ctx bank to ASID is 1:1 >>> >>> But in what sense? How is the ASID used beyond a tag in the TLB? The commit >>> message hints at "TZ commands" being a problem. >>> >>> I'm not doubting that this is needed to make the thing work, I just don't >>> understand why. >> >> (disclaimer, it has been quite a while since I've looked at the smmu >> setup with earlier tz, ie. things that use qcom_iommu, but from >> memory...) >> >> We cannot actually assign the context banks ourselves, so in the dt >> bindings the "ASID" is actually the context bank index. > I think so. > > I don't >> remember exactly if this was a limitation of the tz interface, or >> result of not being able to program the smmu's global registers >> ourselves. > > As far as I understand, it's the latter, as changing the defaults is not allowed by the security policy on consumer devices. > > Qualcomm arbitrarily chose some numbers that may or may have not aligned with their usual index-is-offset-divided-by-0x1000 and hardcoded them in the BSP, and now the secure side (if required, and well, it is..) expects precisely that configuration. > > > Konrad > I can confirm that it's the latter, as described by Konrad. The inability of programming the global registers from Linux is due to the hypervisor disallowing that (in different ways depending on the SoC's firmware but with the same outcome: AP reset by HYP). Cheers, Angelo _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E030C433EF for ; Wed, 8 Jun 2022 10:35:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236459AbiFHKfG (ORCPT ); Wed, 8 Jun 2022 06:35:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33226 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236929AbiFHKdB (ORCPT ); Wed, 8 Jun 2022 06:33:01 -0400 Received: from madras.collabora.co.uk (madras.collabora.co.uk [IPv6:2a00:1098:0:82:1000:25:2eeb:e5ab]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 107FB1C4203; Wed, 8 Jun 2022 03:25:59 -0700 (PDT) Received: from [192.168.1.100] (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by madras.collabora.co.uk (Postfix) with ESMTPSA id 246C0660181B; Wed, 8 Jun 2022 11:25:47 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1654683948; bh=CbCEHZf0MESeLkAV+KaRIb58SJLwsWDBEd1XfSKloiU=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=JL6CAQRzPNxS11sdv1lqG3+jYQQBX0szDXfzGlqNeAmSTxcSN4hrnxHXiJK4TI/5o 4lG3gsRwQhONwG+w5NxnfRzA+cI5lF3VjstoVw0s3HPCKYvYr7kER2ucKauN9+qgMT mTsntlQDlE0JrPQUTJURaOqHDSkyIi90kFHMkUae1FEGncdiXfftKujwqhZzPtMcGC hldbDeeSFn1Hvs5EIWixyoS9jStUbJyl1AVxxnbAxcZhEJiSgkRbwBUWK0306fSYfO mWuaO/tU/mF4L7Eqymam34ABQMq66ZhWoW9r442GAmDfk2QCk2U4rXjVa10NTpdz0t 8aV3MpGHtXuKQ== Message-ID: <4f6f1ec4-2c68-5446-e0e0-85e1631a84cf@collabora.com> Date: Wed, 8 Jun 2022 12:25:44 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.9.0 Subject: Re: [PATCH 1/6] iommu/qcom: Use the asid read from device-tree if specified Content-Language: en-US To: Konrad Dybcio , Rob Clark , Will Deacon Cc: ~postmarketos/upstreaming@lists.sr.ht, linux-arm-msm , Bjorn Andersson , "moderated list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE" , "list@263.net:IOMMU DRIVERS" , Joerg Roedel , Martin Botka , AngeloGioacchino Del Regno , Marijn Suijten , jamipkettunen@somainline.org, Andy Gross , Rob Herring , Krzysztof Kozlowski , Robin Murphy , "open list:OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS" , Linux Kernel Mailing List References: <20220527212901.29268-1-konrad.dybcio@somainline.org> <20220527212901.29268-2-konrad.dybcio@somainline.org> <20220531154631.GA25502@willie-the-truck> <20220531161910.GE25502@willie-the-truck> <6efeafbc-d366-bddd-faa4-4359f3a56f4a@somainline.org> From: AngeloGioacchino Del Regno In-Reply-To: <6efeafbc-d366-bddd-faa4-4359f3a56f4a@somainline.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org Il 03/06/22 20:03, Konrad Dybcio ha scritto: > > > On 31.05.2022 22:57, Rob Clark wrote: >> On Tue, May 31, 2022 at 9:19 AM Will Deacon wrote: >>> >>> On Tue, May 31, 2022 at 09:15:22AM -0700, Rob Clark wrote: >>>> On Tue, May 31, 2022 at 8:46 AM Will Deacon wrote: >>>>> >>>>> On Fri, May 27, 2022 at 11:28:56PM +0200, Konrad Dybcio wrote: >>>>>> From: AngeloGioacchino Del Regno >>>>>> >>>>>> As specified in this driver, the context banks are 0x1000 apart. >>>>>> Problem is that sometimes the context number (our asid) does not >>>>>> match this logic and we end up using the wrong one: this starts >>>>>> being a problem in the case that we need to send TZ commands >>>>>> to do anything on a specific context. >>>>> >>>>> I don't understand this. The ASID is a software construct, so it shouldn't >>>>> matter what we use. If it does matter, then please can you explain why? The >>>>> fact that the context banks are 0x1000 apart seems unrelated. >>>> >>>> I think the connection is that mapping from ctx bank to ASID is 1:1 >>> >>> But in what sense? How is the ASID used beyond a tag in the TLB? The commit >>> message hints at "TZ commands" being a problem. >>> >>> I'm not doubting that this is needed to make the thing work, I just don't >>> understand why. >> >> (disclaimer, it has been quite a while since I've looked at the smmu >> setup with earlier tz, ie. things that use qcom_iommu, but from >> memory...) >> >> We cannot actually assign the context banks ourselves, so in the dt >> bindings the "ASID" is actually the context bank index. > I think so. > > I don't >> remember exactly if this was a limitation of the tz interface, or >> result of not being able to program the smmu's global registers >> ourselves. > > As far as I understand, it's the latter, as changing the defaults is not allowed by the security policy on consumer devices. > > Qualcomm arbitrarily chose some numbers that may or may have not aligned with their usual index-is-offset-divided-by-0x1000 and hardcoded them in the BSP, and now the secure side (if required, and well, it is..) expects precisely that configuration. > > > Konrad > I can confirm that it's the latter, as described by Konrad. The inability of programming the global registers from Linux is due to the hypervisor disallowing that (in different ways depending on the SoC's firmware but with the same outcome: AP reset by HYP). Cheers, Angelo