F29H85X-SOM-EVM: Questions about SSU usage

Hello,

? ? said:

I am trying to use SSU in AutoSAR project, should I add all project files to Code & Data - Sections, since SSU require code to bind to LINK. Or there is simple method?

Which SSU Mode do you plan to use? If you are making use of LINK and STACK feature in the SSU then yes, all of the code needs to bind to a LINK. The easiest way to do this is to include the files through the Code & Data Section of each of the LINKs. Out of curiosity, around how many files do you have within your project?

? ? said:

In addition, can I change the value of LINKID START, END, ACCESS register in APR, by software, during program execution?

Is the intent here to change permissions during program execution? SECCFG (The region in flash where all of the SSU settings are stored) is only loaded at boot time. Any change to the SSU permissions during program execution would not take effect during that program execution.

Best Regards,

Marlyn

Hello Marlyn,
For the first question, I making use of LINK and STACK feature in SSU Mode2. Not so much files in my project at this time, but consider for further, more files may be added to the project. Can I use Custom Sections in APPLICATION MODE? First make all function code to one section, and then add this section to one APPLICATION MODE?

For the second question, I am trying to meet the AUTOSAR requirment which is Prevent write access to the private stack of Tasks/Category 2 ISRs of a non-trusted application from all other Tasks/ISRs in the same OS-Application.
I notice in TRM 10.2 Access Protection Ranges, The access protection registers are loaded at boot time, but can be modified afterward by code running with security root privileges.
So, can I use this proposal:
1. Use 2 APRs, APR1 START and END address is all task's stack address range. APR2 START and END address is the current running task stack address range. Both the APR's ACCESS is R/W for all LINK.
2. The ARP2 START and END address will be changed to the current running Task's stack address range, and at this time the APR1 is disabled, so that the current task can only read and write it's owner stack.
3. When the task is terminated, the APR2 is disabled, and the ARP1 is enabled. So that the system could have the asscess to manage the task stack.

Hello,

? ? said:

For the first question, I making use of LINK and STACK feature in SSU Mode2. Not so much files in my project at this time, but consider for further, more files may be added to the project. Can I use Custom Sections in APPLICATION MODE? First make all function code to one section, and then add this section to one APPLICATION MODE?

Yes, there are a few ways to map code and data to different LINKs (application Modules) using the SSU Tool. One is as discussed previously, you include the files as part of the LINK and that will associate all of the code and data within that file to the LINK that you include it for. Another option is to assign code and or data to a section and that enable 'Use Custom Section' within the application module and add the section to the application module. Both can be done together as well. For example, if you include a file as part of LINK3 but you have a function within that file that you want associated with LINK4 then you can put that function in a specific section that you define then include that section within LINK4. Please let me know if that is not clear and I can gladly explain further. 

? ? said:

AUTOSAR requirment which is Prevent write access to the private stack of Tasks/Category 2 ISRs of a non-trusted application from all other Tasks/ISRs in the same OS-Application.

Okay, to make sure I understand, within the AUTOSAR OS application there are different Tasks and each of these tasks has a private stack. The requirement is that each of these task's stacks need isolation from other task's stacks such that there is no write access permissions enabled?

? ? said:

The access protection registers are loaded at boot time, but can be modified afterward by code running with security root privileges.

Yes this is true. For APRs, LINK2 has the ability to modify the APR registers unless SECCFG marked them as locked. 

Access protection range definitions must not overlap each other. The proposal suggests that you have APR2 within the bounds of APR1 but this is not possible. The configuration will yield an error of conflicting APR coverage ranges.I understand that the intent is to disable and enable APR1 and APR2 depending on the context but I don't know that the timing will work (ie 'switch' APRs by the time the OS has to schedule a new task execution'). How do you know which task is the current task of execution and is there a way to preemptively know this?

Do you have a graphical representation of how you plan to partition your OS application with the use of SSU? I'd be happy to meet and discuss this together to work through the details of how we can accomplish the AUTOSAR requirement.

Best Regards,

Marlyn

Hello Marlyn,

Marlyn Rosales Castaneda20 said:

Yes, there are a few ways to map code and data to different LINKs (application Modules) using the SSU Tool. One is as discussed previously, you include the files as part of the LINK and that will associate all of the code and data within that file to the LINK that you include it for. Another option is to assign code and or data to a section and that enable 'Use Custom Section' within the application module and add the section to the application module. Both can be done together as well. For example, if you include a file as part of LINK3 but you have a function within that file that you want associated with LINK4 then you can put that function in a specific section that you define then include that section within LINK4. Please let me know if that is not clear and I can gladly explain further. 

It's clear, I can understand.

Marlyn Rosales Castaneda20 said:

Okay, to make sure I understand, within the AUTOSAR OS application there are different Tasks and each of these tasks has a private stack. The requirement is that each of these task's stacks need isolation from other task's stacks such that there is no write access permissions enabled?

Yes, you are right. There are different Tasks and each of these tasks has a private stack.The requirement is that each of these task's stacks need isolation from other task's stacks such that there is no write access permissions enabled.

Marlyn Rosales Castaneda20 said:

Access protection range definitions must not overlap each other. The proposal suggests that you have APR2 within the bounds of APR1 but this is not possible. The configuration will yield an error of conflicting APR coverage ranges.

Ok, so I think I can use only one APR for stack address swtich. I will change the START and END register dynamically before task will run.

Marlyn Rosales Castaneda20 said:

I understand that the intent is to disable and enable APR1 and APR2 depending on the context but I don't know that the timing will work (ie 'switch' APRs by the time the OS has to schedule a new task execution'). How do you know which task is the current task of execution and is there a way to preemptively know this?

Yes, we have a MPU switch operation by the time the OS has to schedule a new task execution.

Thanks a lot, I'd glad to discuss the questions with you in the meeting later.

I include the OS files to project, but build error occours, I did used the functions in OS files. Why this problem happen?

Please see the graph below.

Best Regards,

Zhang Yu

Hi Zhang,

Do you see an error for Os_Alarm.c?

It's the first OS file that I see included but I would like to know if you see a build error for the linker not finding that file.

Best Regards,

Marlyn

I try the second way, use Custom Sections in APPLICATION MODE, but it also makes build error. And there is no OS section in .map file, the OS function address is also not correct.

Yes, I make this mistake, but it still has some errors, the OS function does not fill into LINK2_CODEAPR_FLASH.

Hi Marlyn,

I increased the size of LINK 2 Flash and RW Data in RAM. Build issue is OK.

But now the ssu_ex1_mode2.out can't be download into flash, please see errors showing in below.

I have make the ‘Allow NonMain Flash erase...' options selected.

What may case this issue?

Best Regards,

Yu Zhang

This method works well, ,out file can be load into board successfully.

Thank you.

Hi Marlyn,
I add a Application Module 3 which belongs to LINK7 and STACK2 based on ssu_ex1_mode2 Demo, and the OS code belongs to LINK2_CODEAPR_FLASH.
OS code call.port @__c29_secure_lp_memset which is common code belongs to LINK3, the CURRLINK should be LINK3, but it dosen't change.
Before I add Application Module 3, the CURRLINK will change to LINK3 when the program running in the same place (OS code call.port @__c29_secure_lp_memset).
If the CURRLINK dosen't change, the APR ACCESS will not effective.
What may cause it?

Best Regards

Yu Zhang

Hi Yu,

Thank you for sharing your latest question. Lets continue the discussion through email as I have questions regarding the project that you sent. Once appropriate, we can continue back the discussion on E2E. 

Best Regards,

Marlyn