This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TMDS243EVM: Interconnect Firewall usage and exception handling

Part Number: TMDS243EVM

Hello TI Team,

I'm currently trying to implement and use the Interconnect Firewalls in our project. During development a couple of questions arose which I want to address to you.
We want to use the Firewall as an additional safety measure with the MPU to separate cores from each other.
I am specifically interested in the exception handling of firewall faults.

SDK version in use 08.06.43

Documents referred to in this post:
[A] Technical Reference Manual AM64x/AM243x, literature number SPRUIM2F
[B] TISCI 08.06.04 software-dl.ti.com/.../index.html
[C] AM243x MCU+ SDK 08.06.00 User Guide dev.ti.com/.../node


For testing purposes I have configured the Firewall for DDR16SS0 (Firewall ID 1) from R5F_0_0 in main() running a freeRTOS.
I configured 7 regions tied to specific cores and purposes (private, dedicated shared memory for up to 2 cores) and 1 background region spanning the whole 2GB of DDR space.
When entering the initial freeRTOS task I provoke a fault by reading from firewalled memory.

1. Firewall configuration
[C] suggests using the firewall driver from <drivers/firewall.h>. Inspecting the implementation the driver configures firewall regions by directly writing to the registers.
As [B]-FirewallFAQ states that firewalls not owned by DMSC are only programmable through the TISCI interface only and "Firewall configuration registers are only writable by System Firmware".
Question: Don't these facts contradict each other? What is the preferred way of programming the firewalls?

2. Firewall exception registers
The chapter 3.3.2.1 in [A] mentions multiple bits in multiple registers:
- CBASS_EXCEPTION_LOGGING_CONTROL[0]:DISABLE_F
- CBASS_EXCEPTION_LOGGING_CONTROL[1] DISABLE_PEND
- CBASS_EXCEPTION_PEND_SET[0] PEND_SET
- CBASS_EXCEPTION_PEND_CLEAR[0] PEND_CLR
I could not find any reference in the subchapters under 3.4 System Interconnect Registers and the exact naming is never mentioned again in [A].
Question: Where can I find these registers? Are they under DMSC control?

3. CBASS Registers vs. CBASS_FW Registers
Chapter 3.4 System Interconnect Registers in document [A] contains subchapters called CBASS Registers and CBASS_FW Registers.
When reading the CBASS0_pid register from 0x3A000000 it returns plausible values. When reading CBASS_FW0_pid then 0 is returned
Question: To which of these collection of registers does the firewall functional description refer to? Which one shall be used for error handling?
Question: When provoking a Firewall exception by reading from firewalled memory - the CBASS_EXCEPTION_LOGGING registers all remain 0x0 when reading from DataAbort Handler. How can I retrieve the exception info?

4. CBASS_EXCEPTION_LOGGING_DATA0
The description in [A] for this register is "Lower 32 address bits (31:0) of the incoming transaction"
Question: What exactly is meant here as "incoming transaction"? Does this field correlate to the DFAR value when in DataAbort mode?

5. CBASS0_EXCEPTION_LOGGING registers contain data when halting on breakpoint entering main()
After power cycling the TMDS243EVM and running a debug session on R5F_0_0 I halt execution on entering main() for ~20 seconds.
I could observe from the Memory Browser that the exception logging registers starting at 0x3A000000 get updated with seemingly plausible data.
For example the CBASS_EXCEPTION_LOGGING_DATA0 contains 0x39FFFFAC - an address which is observable concurrently in the Memory Browser.
Question: What could be causing this exception given that I am looking at the correct registers?

Greetings

Simon

  • 08.06.43

    Of course I mean 08.06.00.43

  • Hi ,

    Question: Don't these facts contradict each other? What is the preferred way of programming the firewalls?

    If you check the Bootloader_socOpenFirewalls function which configures the Firewalls, it does it via SciClient. For GP device, the direct writing into the registers might have worked, but for HS devices, user must use the SciClient only.

    For other queries let me come back by tomorrow.

    Best Regards,
    Aakash

  • Unfortunately this sentence confuses me even more. 

    For GP device, the direct writing into the registers might have worked, but for HS devices, user must use the SciClient only.

    There is a dedicated Firewall driver in the SDK. Firewall_open() specifically checks for SOC_isHsDevice() and only in case of HS device writes the region config directly to the registers.

    Why does this driver exist if it should not be used?
    I can clearly program the firewall using this driver. Why must I use SciClient?

  • Hi Simon,

    I discussed internally and confirmed this.

    The Firewalls are suppose to be configured by the Security Core only. By default, the Security core is DMSC core i.e. Cortex M3. So the configuration of firewalls are done via SciClient.

    If you check the Bootloader_socCpuResetReleaseSelf , this you will find the Security Handover is called. This means the device has ensured that R5F0_0 is now the secure core. As R5F is now the secure core, the Firewall Configurations can also be done by R5F0_0 by directly writing into the registers.

    Hope this helps.

    Best Regards,
    Aakash

  • Hi Simon,

    Do you have access to https://software-dl.ti.com/secure/software/sitara-sec/AM243X-RESTRICTED-SECURITY/HW_docs/spruim0b.pdf?__gda__=1688127307_6abf42e9da459c475ae4885642b1a141 ?

    This security hardware addendum of K3 device i.e. AM243x.

    This has more information regarding CBASS.

    Also I do find the information of CBASS registers in Technical Reference Manual as well --

    Ref : SPRUIM2C – MAY 2020 – REVISED SEPTEMBER 2021

    Best Regards,
    Aakash

  • Good Morning Aakash,

    thank you and yes, this helped me in this matter!

  • My Problem was not "I don't find where the registers are documented generally". In my initial post I specifically mentioned several registers which are not at all present in the chapter 3.4 (which I also mentioned in my initial post).
    CBASS_EXCEPTION_LOGGING_CONTROL,  CBASS_EXCEPTION_PEND_SET, CBASS_EXCEPTION_PEND_CLEAR: where are they? Are they now referred to with a different acronym?

  • Hi Simon,

    Apologies for discrepancies there, these should  be CBASS0_EXCEPTION_LOGGING_CONTROL, CBASS0_EXCEPTION_PEND_SET, CBASS0_EXCEPTION_PEND_CLEAR. Will confirm internally that its the case and update the TRM accordingly or will update otherwise accordingly here.

    Best Regards, Shiv

  • Hi Shiv!
    For clarification: these registers

    refer to which of these: 
    CBASS_EXCEPTION_LOGGING_CONTROL
    CBASS_EXCEPTION_PEND_SET
    CBASS_EXCEPTION_PEND_CLEAR

    Also I would like to ask about the initial questions 3) to 5) in my post. If you could provide me with some information here.

    Thanks and greetings!

    Simon

  • Hi Simon, 

    Apologies for the delay here as I am still trying to get the clarification from internal team. Will update here at the earliest.

    Best Regards, Shiv

  • Hello Simon,

    Here is information that was received regarding the missing registers in your query:

    - CBASS_EXCEPTION_LOGGING_CONTROL[0]:DISABLE_F
    - CBASS_EXCEPTION_LOGGING_CONTROL[1] DISABLE_PEND

    EXCEPTION_LOGGING_CONTROL (Exception Logging Control Register).

    The Exception Logging Control Register controls the exception logging.

    Bit

    Name

    Type

    Reset

    Description

    31:2

    reserved

    r

    0x0

    Reserved

    1

    disable_intr

    rw

    0x0

    Disables logging interrupt when set. This will not disable logging, so if cleared the current log should also be cleared to guarantee the next log generates the interrupt.

    0

    disable_f

    rw

    0x0

    Disables logging when set. This will also disable interrupts.

    CBASS_EXCEPTION_PEND_SET

    EXCEPTION_PEND_SET (Exception Logging Interrupt Pending Set Register).

    The Exception Logging Interrupt Pending Set Register allows to set the pend signal.

    Bit

    Name

    Type

    Reset

    Description

    31:1

    reserved

    r

    0x0

    Reserved

    0

    pend_set

    rw1ts

    0x0

    Write a 1 to set the exception pend signal.

    CBASS_EXCEPTION_PEND_CLEAR[0] PEND_CLR

    EXCEPTION_PEND_CLEAR (Exception Logging Interrupt Pending Clear Register).

    The Exception Logging Interrupt Pending Clear Register allows to clear the pend signal.

    Bit

    Name

    Type

    Reset

    Description

    31:1

    reserved

    r

    0x0

    Reserved

    0

    pend_clr

    rw1tc

    0x0

    Write a 1 to clear the exception pend signal.

    Best Regards,

    Ralph Jacobi

  • Hello,

    I am adding a few more answers based on additional inputs from internal teams.

    3. CBASS Registers vs. CBASS_FW Registers
    Chapter 3.4 System Interconnect Registers in document [A] contains subchapters called CBASS Registers and CBASS_FW Registers.
    When reading the CBASS0_pid register from 0x3A000000 it returns plausible values. When reading CBASS_FW0_pid then 0 is returned
    Question: To which of these collection of registers does the firewall functional description refer to? Which one shall be used for error handling?

    • see the _err_intr in the link below


    Question: When provoking a Firewall exception by reading from firewalled memory - the CBASS_EXCEPTION_LOGGING registers all remain 0x0 when reading from DataAbort Handler. How can I retrieve the exception info?

    • See the Default_exp in the link below

    4. CBASS_EXCEPTION_LOGGING_DATA0
    The description in [A] for this register is "Lower 32 address bits (31:0) of the incoming transaction"
    Question: What exactly is meant here as "incoming transaction"? Does this field correlate to the DFAR value when in DataAbort mode?

    • The incoming transaction here refers to the transaction that violates the firewall protection.

    5. CBASS0_EXCEPTION_LOGGING registers contain data when halting on breakpoint entering main()
    After power cycling the TMDS243EVM and running a debug session on R5F_0_0 I halt execution on entering main() for ~20 seconds.
    I could observe from the Memory Browser that the exception logging registers starting at 0x3A000000 get updated with seemingly plausible data.
    For example the CBASS_EXCEPTION_LOGGING_DATA0 contains 0x39FFFFAC - an address which is observable concurrently in the Memory Browser.
    Question: What could be causing this exception given that I am looking at the correct registers?

    • The details of the transaction that violates the firewall and the source of the transaction can be found in the details of the Table 1 in the link below

    /cfs-file/__key/communityserver-discussions-components-files/908/Interrupt-Condition-for-Interconnect.pdf

    Thanks,

    Anita