• State TI Thinks Resolved
  • Locked Locked
  • Replies 10 replies
  • Answers 2 answers
  • Subscribers 31 subscribers
  • Views 806 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM2632: Usage of MPU in AM2632

Jo Scho
Intellectual 300 points

Part Number: AM2632
Other Parts Discussed in Thread: SYSCONFIG

Tool/software:

Hello,

we are using AM2632 in lookstep mode. 


Cluster R5SS1 is currently started and exexcutes pBIST for R5SS0-memory areas and has no further tasks at the moment.
Cluster R5SS0 is our "main" core and  shall be used for our functional safety tasks. But there are still big parts of firmware, which are not safety relevant.


On the main core (R5SS0) we do not want to make all parts of firmware to to safety relevant code, because it is a much more effort, to get safety certification for the whole firmware, than for the safety relevant parts only.
We do not use a operating system on our system, we use bare metal option.


In this context I try to understand the MPU units of the AM263x, but I am a little confused at the moment.

For my understanding, AM263x separates between the ARM MPU and the system MPU Firmware (provided by HSM). Is my understanding correct?
The possibilities of

What is our aim:

We want to execute all our safety relevant tasks from one function, our "functional safety task". 
My idea is now, that the functional safety task uses its own memory area, to hold the safety relevant runtime data. Therefore I implemented an own memory area on a specific RAM adress in the linker command file for that safety data.

The safety data should be read- and writeable by the "functional safety task" and only readable (not writeable) by the rest of the firmware ("non-functional safety firmware parts").

My question is now the following.
Is it possible to achieve such a data separation and protection with the MPU, which is configurable by SysConfig?

In my SysConfig-Configuration I have introduced a new region (region 5) which represents the safety data area. Full access to the safety data is only possible in supervisor mode, user mode can only read the data.



My questions are now:

- Is that a good approach, to achieve the data separation between functional safety and non-functional-safety on one core?  Is that the right application of the MPU?


- my system is still not running with that configuration. I can switch to the user mode, but I am not sure, how to switch the supervisor mode, at the begin of my safety application, can you give me some example?




Best regards
Jo


 

  • 0
    TI__Guru 61290 points

    Hi Jo,

    Jo Scho said:
    For my understanding, AM263x separates between the ARM MPU and the system MPU Firmware (provided by HSM). Is my understanding correct?
    The possibilities of

    Yes this is correct Jo.

  • 0
    TI__Guru 61290 points
    Jo Scho said:
    We want to execute all our safety relevant tasks from one function, our "functional safety task". 
    My idea is now, that the functional safety task uses its own memory area, to hold the safety relevant runtime data. Therefore I implemented an own memory area on a specific RAM adress in the linker command file for that safety data.

    The safety data should be read- and writeable by the "functional safety task" and only readable (not writeable) by the rest of the firmware ("non-functional safety firmware parts").

    My question is now the following.
    Is it possible to achieve such a data separation and protection with the MPU, which is configurable by SysConfig?

    I have few question here: 1. Are both safe and non-safe task running on same core?

  • 0 in reply to Nilabh Anand
    Intellectual 300 points

    yes, safe and non-safe firmware parts should run on the same core

  • 0 in reply to Jo Scho
    TI__Guru 61290 points

    Hi Jo 

    Few clarification on Firewall and MPU to understand their distinction:

    The firewalls are SoC specific feature whereas the MPUs are core specific feature. The aim to using both is prevent unwanted accesses to memory regions. Now which one you use would depend on the context from which you want to prevent the unwanted access. So that means when you configure the firewall  for a memory region would affect the transactions from any entity on present on the SoC while the MPU configurations are local to the core....

  • 0 in reply to Nilabh Anand
    Intellectual 300 points

    OK, this difference I have understood now. But that sounds to activate both feature, if I want to be sure, that my data are protected against unwanted modification.

    How can I get then a priviledge to get write-acess to the data from my saatey functions then? Is the right way, to use the core in user mode and to switch to supervisor mode then?


  • 0 in reply to Jo Scho
    TI__Guru 61290 points

    You can refer to ARM R5F Technical reference manual for details on how to enable Previlage mode

  • 0 in reply to Nilabh Anand
    TI__Guru 61290 points

    Also I would highly recommend reading this white paper from Wittenstein on safety solution in single core architecture

    https://highintegritysystems.com/downloads/white_papers/Using_an_MPU_to_Enforce_Spatial_Separation.pdf

    It talks about the architecture that you are planning to use along with the challenges. 

    Let me know if you have any other query.

  • 0 in reply to Nilabh Anand
    Intellectual 300 points

    Hi Nilabh,

    thank you very much for the provided information, it helps me a lot, especially the white paper contains worthful information.


    I tried to switch to the SVC mode by executing the SVC instruction



    This works and my application jumps to the SVC Handler function of the SDK library, which I have modified.

    How can I achieve that the SVC Handler jumps correctly back to my application, after done work?
    AT my example, the system crashes after leaving the SVC handler function.
    Is there something special to do after SVC?

    Can you give me an example, how to get back to my application?

    Best regards
    Jo

  • 0 in reply to Jo Scho
    TI__Guru 61290 points

    Hi Jo,

    You need to save the context of the user mode before you do the jump, for that I would recommend looking at this file in SDK, which does the context save before entering an interrupt and restores it back before exiting it.

    source\kernel\nortos\dpl\r5\HwiP_armv7r_handlers_nortos_asm.S

    Also note that svc mode is used in SDK for software interrupts.

  • 0 in reply to Nilabh Anand
    TI__Guru 61290 points

    Hi Jo, Were you able to get the above solution working. As mentioned in the whitepaper,,there might be challenges if you are using software interrupt as your code execution and software interrupt would happen in same mode, so once problem i see if you are triggering a sw interrupt from the safety code it would try to re enter the svc mode, which is not a expected state, and it would lead to loss of interrupt signal.