AM263P4-Q1: Firewall Configuration

Hi Nikhil,

Please help answer these questions based on the project they have provided in TI drive.

Here is an additional question:

The TRM(3.2 CORE VBUSM Interconnect) indicates that OCSRAM and FLASH can have different access rights for each core. How can they configure something like below in SysConfig? (They plan on doing all MPU Firewall configs from Core0)
Core0 |Core1-0 |Core1-1
Read/Write |No Access|Read

Best regards,

Mari Tsunoda

Hi Mari,

Sure, let me look into this and get back to you by Tuesday

Thanks and regards,

Nikhil Dasan

Hi Mari,

The firewall issue seems to be a bug in the TIFS.
I have raised this issue internally. Placing the jira link here for internal tracking.

[TIFSMCU-3794] Firewall setting error for region 18 to 23 - Texas Instruments JIRA

The struct the contains all the parameters for all firewalls in the SOC, which used to validate the set firewall does not have the regions 18-23 (which includes L2OCRAM Bank 4 and Bank 5)

Because of which these, currently firewalls to these regions cannot be set.

I could provide a patch for this fix, but this could only be for HS-SE device. 

As the source code for HS-FS is not provided, the fix for this on HS-FS would only be available by the next TIFS release.

May I know why would customer want to enable firewall features in HS-FS device? Are they planning to use HS-SE device in the future for production?

Thanks and regards,

Nikhil Dasan

Hi Nikhil,

Thanks for the response.

I believe the main reason they are configuring firewall is to restrict access to OCSRAM and flash such that only Core0 can write to it, while other cores have read access or no access at all and will boot through XIP. Is there another implementation method for this? This is to ensure that SRAM and flash contents are not re-written.

Please check the E2E below for more context as I previously got a reply from Nilabh on this.

AM263P4-Q1: XIP Boot Rewrite Registers using OSPI - Arm-based microcontrollers - INTERNAL forum - Arm-based microcontrollers - INTERNAL - TI E2E support forums

"You will need to firewall the OSPI configuration regsiter so that other cores do not cause change from XIP to OSPI write modes."

Best regards,

Mari Tsunoda

Also following-up on the other questions in this thread. 

Mari Tsunoda said:

When they configure Region Number 0 for each MPU Firewall, there is a MPU firewall that cannot be enabled. (L2OCRAM BANK0 SLV) Is it not possible to configure Region Number 0? If there are regions that are not configurable, could you list which regions are not?

You mentioned that this is already configured in TIFS SDK side by default. Does that mean that customer does not have to configure this in their sysconfig? What is the interaction here between TIFS and SDK?

Hi Mari,

Mari Tsunoda said:

"You will need to firewall the OSPI configuration regsiter so that other cores do not cause change from XIP to OSPI write modes."

For doing the above, you need not configure the MPU firewall.

The R5F MPU configuration is sufficient to block the respective core from accessing the OSPI registers.

Can you ask Kawasaki to try this way?

Thanks and Regards,

Nikhil Dasan

Hi Mari, 

To protect a particular address from getting written, we can use the MPU configuration.

Here is a basic idea of how it works,

1. To protect OSPI registers from getting written, we can assign an MPU configuration to address space of the register. This means that, we will label the OSPI register addresses as read only from the R5 Core.

2. Since it is read only, the R5 Core will not be able to write to the address. Doing so would result in an exception.

If the requirement is to prevent a core (for instance Core 0-1) from writing into OSPI registers, then the idea would be to assign an MPU configuration to OSPI registers from core 0-1 such that, any write actions taken by this core will result in an exception.

Please see the below steps to see how to assign an MPU configuration.

1. Open the required core's SysConfig and go to MPU region. Sysconfig > TI Driver Porting Layer > MPU ARMv7.

2. Inside, create a new instance by pressing the add button. You will see a new CONFIG_MPU_REGIONx instance opening up.

3. By default, this would be the case

4. For instance, since we are trying to protect OSPI registers, we need to assign the start address of OSPI registers in the Region Start Address (hex) text field.

5. For the size, we can mention the range upto which OSPI registers span in the Region Size text field.

6. Since we need to protect the registers from write, the access permission should be Supervisor RD, User RD

7. Keep the region attributes as Strongly Ordered.

After following Steps 4-7, the CONFIG_MPU_REGION instance would look like this

To prevent core0-1 from accessing these registers, make sure that the Sysconfig which is being used to related to project that will be loaded in the core.

+ Please refer to the AM263Px register addendum to see the register addresses for protection.

https://www.ti.com/lit/ug/spruj57a/spruj57a.pdf?ts=1747993078296&ref_url=https%253A%252F%252Fwww.ti.com%252Fproduct%252FAM263P4

+ Please refer to ARM Cortex R5 reference manual to understand more about MPU configuration - Check Chapter 7

https://developer.arm.com/documentation/ddi0460/latest/

Regards,

Aswin