• State Resolved
  • Locked Locked
  • Replies 5 replies
  • Subscribers 30 subscribers
  • Views 196 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Original question:

AM263P4-Q1: Firewall Configuration

AM263P4-Q1: HS-SE device failure to access OCRAM banks 4/5

Rens Bossers
Prodigy 135 points
Part Number: AM263P4-Q1

Tool/software:

Hello,

We seem to be experiencing an MPU/Firewall related issue for a device recently converted to HS-SE, where this is not seen on a HS-FS device.

Setup is baremetal, cores 0+1 in lockstep, cores 2+3 standalone.

Just after switch from bootloader into Application, when accessed from core0, all of our OCRAM banks (0-5) seem to be initialised as RAM adress 0x702FFFFF is visible from core0:

However, when looking at the same memory space from core 2, this memory space shows up as uninitialised:

instead, we can see memory space up to 0x701FFFFF or thereabouts) being initialised:

The same is the case for core3.

This implies that for R5SS0 OCRAM banks 0-5 are initialised OK, but for R5SS1 only OCRAM banks 0-3 are initialised OK.

Looking at the TRM, the default MPPA regions for MPU regions does differ between HSFS and HSSE modes - but we do have priviledged access for R5CORE0 for all OCRAM banks.

But currently doing some more decoding where this could be coming from. We're only initialising OCRAM from core0 instead of through the HSM, maybe that's a mistake?

Will read out and try decode MPPA_X regions for MPU regions setting bank4 and bank5 permissions.

We currently don't specify firewalls in the SBL directly, maybe something needs to be configured there to allow initialisation of R5SS1 through R5SS0.

Does anyone have any pointers how to debug this further? We don't see this behaviour for HSFS devices, but the only relevant variation from HSFS to HSSE I can find is that section mentioned above in the TRM on this topic.

Thanks,
Rens

  • 0
    TI__Guru* 84786 points

    Hi Rens,

    Is the firewall configuration the default one as provided in the TIFS SDK? 

    Thanks and Regards,

    Nikhil Dasan

  • 0 in reply to Nikhil Dasan
    Prodigy 135 points

    Hi Nikhil,

    This was with a HSM image generated for the hsm_getversion example. Comparing the hsm_getversion syscfg to the default one under \tifs_am263px_10_00_00_05\hsm_firmware\am263px\hsse\hsm0-0_nortos\example.syscfg, it does seem like many firewall configs are missing.

    I'm presuming these need to be added in? Will try recompile HSM image with the default firewall config.

  • 0 in reply to Rens Bossers
    Prodigy 135 points

    Apologies, I was confusing the R5F image to the HSM syscfg there.

    I can confirm the HSM image was original as in the SDK. 

    I've also checked the permissions set on the default hsm image firewalls. In generated syscfg code, it seems the permissions for all L2OCRAM banks are correctly set for access from all cores:

    In the related post you pointed to a bug in gMpuFirewallConfig (in mpu_firewall_v0_cfg.c) where definitions for CSL_FW_L2OCRAM_BANKx_SLV_CFG_ADDR are not set for both banks 4 and bank5 of OCRAM.

    Have added definitions for bank 4 and 5, will generate a test build and report back.

  • +1 in reply to Rens Bossers
    Prodigy 135 points

    Adding definitions for bank4/Bank5 OCRAM fixed the issue. We also had to add in firewall config for the RL2 cache as the application was running from XIP and so configured with one. 

    The detail that between HS-FS and HS-SE devices, custom firewall configuration becomes mandatory wasn't overly clear, would be useful if this statement could be added into the documentation where differences between the two are outlined. 

    Thanks

  • 0 in reply to Rens Bossers
    TI__Guru* 84786 points

    Thank you for the confirmation. This is an existing bug being tracked internally and will be fixed in the next release. 

    Rens Bossers said:
    The detail that between HS-FS and HS-SE devices, custom firewall configuration becomes mandatory wasn't overly clear, would be useful if this statement could be added into the documentation where differences between the two are outlined.

    The initial firewall configuration on HS_FS cannot be changed, but the HSMClient service is provided to add firewall configuration. 

    Whereas in case of HS-SE device, the init-time firewall should be adaptable to customer usecase. Hence, only the fixed configurations on HS-FS is being documented as part of SDK documentation

    AM263Px MCU+ SDK: Security

    Thanks and Regards,

    Nikhil Dasan