SK-AM64B: Some firewall rules are not working

Renato Faria Iida

Prodigy 80 points

Part Number: SK-AM64B

Tool/software:

As I described in the previous post , i am setup the firewall on R5f from a u-boot/Linux configuration.

Based onthe last post I am using the function

Sciclient_firewallSetRegion

I having a problem with SA2_UL. Look the only region i can add a rule is the region 2

I need to add 2 more rules in different region.

From the documentation it have 8 and the region 0 is blocked, i tried from 3 to 7 and it fails in all the cases.

The related code is the files beolws

Fullscreen firewall.c Download


#include "firewall.h"


int32_t t2930_sw500_startFirewall(void)
{
    int32_t status = SystemP_SUCCESS;


        status = t2930_sw500_setupFirewall_I2c();

        status = t2930_sw500_setupFirewall_Spi();

        status = t2930_sw500_setupFirewall_Adc();

        status = t2930_sw500_setupFirewall_msram(MSRAM0_FWL_ID, REGION_MSRAM_ID, CONFIG_FW_MSRAM0_LOWER, CONFIG_FW_MSRAM0_UPPER);

        status = t2930_sw500_setupFirewall_msram(MSRAM1_FWL_ID, REGION_MSRAM_ID, CONFIG_FW_MSRAM1_LOWER, CONFIG_FW_MSRAM1_UPPER);

        status = t2930_sw500_setupFirewall_msram(MSRAM2_FWL_ID, REGION_MSRAM_ID, CONFIG_FW_MSRAM2_LOWER, CONFIG_FW_MSRAM2_UPPER);

        status = t2930_sw500_setupFirewall_msram(MSRAM3_FWL_ID, REGION_MSRAM_ID, CONFIG_FW_MSRAM3_LOWER, CONFIG_FW_MSRAM3_UPPER);

        status = t2930_sw500_setupFirewall_msram(MSRAM4_FWL_ID, REGION_MSRAM_ID, CONFIG_FW_MSRAM4_LOWER, CONFIG_FW_MSRAM4_UPPER);

        status = t2930_sw500_setupFirewall_msram(MSRAM5_FWL_ID, REGION_MSRAM_ID, CONFIG_FW_MSRAM5_LOWER, CONFIG_FW_MSRAM5_UPPER);

        status = t2930_sw500_setupFirewall_msram(MSRAM6_FWL_ID, REGION_MSRAM6_ID, CONFIG_FW_MSRAM6_LOWER, CONFIG_FW_MSRAM6_UPPER);

        status = t2930_sw500_setupFirewall_msram(MSRAM7_FWL_ID, REGION_MSRAM_ID, CONFIG_FW_MSRAM7_LOWER, CONFIG_FW_MSRAM7_UPPER);


    return status;

}


int32_t t2930_sw500_setupFirewall_Spi(void)
{
    int32_t status = SystemP_FAILURE;
    struct tisci_msg_fwl_set_firewall_region_req fwl_set_req;
    struct tisci_msg_fwl_set_firewall_region_resp fwl_set_resp = { 0 };
    fwl_set_req.fwl_id = SA2_UL0_FWL_ID;
    fwl_set_req.region = REGION_MCSPI0_ID;
    fwl_set_req.n_permission_regs = REGION_COUNT;
    fwl_set_req.control = FWL_CONTROL_ENABLE;
    fwl_set_req.permissions[0] = ((uint32_t) PRIVID_MAIN_0_R5_0_SECURE << 16) | ((FWL_PERM_SEC_MASK |
                            FWL_PERM_PRIV_MASK |
                            FWL_PERM_USER_MASK) & FWL_PERM_RW_ALL);
    fwl_set_req.start_address = CONFIG_FW_MCSPI0_LOWER;
    fwl_set_req.end_address = CONFIG_FW_MCSPI0_UPPER;

    status = Sciclient_firewallSetRegion(&fwl_set_req, &fwl_set_resp, SystemP_TIMEOUT);
    DebugP_log("firewall SPI %d\n", status);

    return status;
}


int32_t t2930_sw500_setupFirewall_Adc(void)
{
    int32_t status = SystemP_FAILURE;
    struct tisci_msg_fwl_set_firewall_region_req fwl_set_req;
    struct tisci_msg_fwl_set_firewall_region_resp fwl_set_resp = { 0 };
    fwl_set_req.fwl_id = SA2_UL0_FWL_ID;
    fwl_set_req.region = REGION_ADC_ID;
    fwl_set_req.n_permission_regs = REGION_COUNT;
    fwl_set_req.control = FWL_CONTROL_ENABLE;
    fwl_set_req.permissions[0] = ((uint32_t) PRIVID_MAIN_0_R5_0_SECURE << 16) | ((FWL_PERM_SEC_MASK |
                            FWL_PERM_PRIV_MASK |
                            FWL_PERM_USER_MASK) & FWL_PERM_RW_ALL);
    fwl_set_req.start_address = CONFIG_FW_ADC_FIFO_REGION0_LOWER;
    fwl_set_req.end_address = CONFIG_FW_ADC_FIFO_REGION0_UPPER;

    status = Sciclient_firewallSetRegion(&fwl_set_req, &fwl_set_resp, SystemP_TIMEOUT);
    DebugP_log("firewall ADC %d\n", status);

    return status;
}


int32_t t2930_sw500_setupFirewall_I2c(void)
{
    int32_t status = SystemP_FAILURE;
    struct tisci_msg_fwl_set_firewall_region_req fwl_set_req;
    struct tisci_msg_fwl_set_firewall_region_resp fwl_set_resp = { 0 };
    fwl_set_req.fwl_id = SA2_UL0_FWL_ID;
    fwl_set_req.region = REGION_I2C1_ID;
    fwl_set_req.n_permission_regs = REGION_COUNT;
    fwl_set_req.control = FWL_CONTROL_ENABLE;
    fwl_set_req.permissions[0] = ((uint32_t) PRIVID_MAIN_0_R5_0_SECURE << 16) | ((FWL_PERM_SEC_MASK |
                            FWL_PERM_PRIV_MASK |
                            FWL_PERM_USER_MASK) & FWL_PERM_RW_ALL);
    fwl_set_req.start_address = CONFIG_FW_I2C1_LOWER;
    fwl_set_req.end_address = CONFIG_FW_I2C1_UPPER;

    status = Sciclient_firewallSetRegion(&fwl_set_req, &fwl_set_resp, SystemP_TIMEOUT);
    DebugP_log("firewall I2C %d\n", status);

    return status;
}


int32_t t2930_sw500_setupFirewall_msram (uint16_t fwl_id, uint16_t region_id, uint64_t start_address, uint64_t end_address)
{
    int32_t status = SystemP_FAILURE;
    struct tisci_msg_fwl_set_firewall_region_req fwl_set_req;
    struct tisci_msg_fwl_set_firewall_region_resp fwl_set_resp = { 0 };
    fwl_set_req.fwl_id = fwl_id;
    fwl_set_req.region = region_id;
    fwl_set_req.n_permission_regs = REGION_COUNT;
    fwl_set_req.control = FWL_CONTROL_ENABLE;
    fwl_set_req.permissions[0] = ((uint32_t) PRIVID_MAIN_0_R5_0_SECURE << 16) | ((FWL_PERM_SEC_MASK |
                            FWL_PERM_PRIV_MASK |
                            FWL_PERM_USER_MASK) & FWL_PERM_RW_ALL);
    fwl_set_req.start_address = start_address;
    fwl_set_req.end_address = end_address;

    status = Sciclient_firewallSetRegion(&fwl_set_req, &fwl_set_resp, SystemP_TIMEOUT);
    DebugP_log("firewall MSRAM id %d status %d\n", fwl_id, status);

    return status;
}

5483.firewall.h

The output is curent

r5f0-0] 0.009179s : firewall I2C -1
[r5f0-0] 0.009262s : firewall SPI -1
[r5f0-0] 0.009392s : firewall ADC 0
[r5f0-0] 0.009504s : firewall MSRAM id 14 status 0
[r5f0-0] 0.009619s : firewall MSRAM id 15 status 0
[r5f0-0] 0.009738s : firewall MSRAM id 16 status 0
[r5f0-0] 0.009851s : firewall MSRAM id 19 status 0
[r5f0-0] 0.009962s : firewall MSRAM id 18 status 0
[r5f0-0] 0.010080s : firewall MSRAM id 17 status 0
[r5f0-0] 0.010201s : firewall MSRAM id 23 status 0
[r5f0-0] 0.010286s : firewall MSRAM id 24 status -1

10 months ago

0 Prashant Shivhare 10 months ago

TI__Guru 74091 points

Hello,

The SA2UL module is owned by the SYSFW. It sets up the necessary firewall configuration & does not allow the user applications to change those configurations.

Regards,

Prashant

0 Renato Faria Iida 10 months ago in reply to Prashant Shivhare

Prodigy 80 points

So to add more rules for SA2UL i need to setup in the OPTEE ? when it load the SA2UL drivers ?

0 Prashant Shivhare 10 months ago in reply to Renato Faria Iida

TI__Guru 74091 points

I think I misunderstood your original query.

My previous response was specifically related to the firewall configurations for the actual SA2UL IP memory regions

If you are looking to configure the fireawalls for ADC, I2C memory regions which comes under the same firewall id 35 then the only regions available for firewall configurations are REGION 2, REGION 3, REGION 5, and REGION 6.

0 Renato Faria Iida 10 months ago in reply to Prashant Shivhare

Prodigy 80 points

The only region that worked were the REGION 2. I tried the other regions and return -1

The code that i used to setup the SPI is

#define CONFIG_FW_MCSPI0_LOWER (0x20100000) /*!< Lower Range of MCSPI0 Memory region */

#define CONFIG_FW_MCSPI0_UPPER (0x201003FF) /*!< Upper Range of MCSPI0 Memory region */

#define SA2_UL0_FWL_ID (35) /*!< Firewall ID of SA2_UL *

#define REGION_MCSPI0_ID (6) /*!< Region ID of MCSPI0 */

#define REGION_COUNT (1) /*!< Region Count on the firewall */

int32_t t2930_sw500_setupFirewall_Spi(void)

{

int32_t status = SystemP_FAILURE;

struct tisci_msg_fwl_set_firewall_region_req fwl_set_req;

struct tisci_msg_fwl_set_firewall_region_resp fwl_set_resp = { 0 };

fwl_set_req.fwl_id = SA2_UL0_FWL_ID;

fwl_set_req.region = REGION_MCSPI0_ID;

fwl_set_req.n_permission_regs = REGION_COUNT;

fwl_set_req.control = FWL_CONTROL_ENABLE;

fwl_set_req.permissions[0] = ((uint32_t) PRIVID_MAIN_0_R5_0_SECURE << 16) | ((FWL_PERM_SEC_MASK |

FWL_PERM_PRIV_MASK |

FWL_PERM_USER_MASK) & FWL_PERM_RW_ALL);

fwl_set_req.start_address = CONFIG_FW_MCSPI0_LOWER;

fwl_set_req.end_address = CONFIG_FW_MCSPI0_UPPER;

status = Sciclient_firewallSetRegion(&fwl_set_req, &fwl_set_resp, SystemP_TIMEOUT);

DebugP_log("firewall SPI region % d status: %d\n", fwl_set_req.region, status);

return status;

}

0 Prashant Shivhare 9 months ago in reply to Renato Faria Iida

TI__Guru 74091 points

Renato Faria Iida said:
fwl_set_req.control = FWL_CONTROL_ENABLE;

What is the control value here?

If the control value includes setting the BACKGROUND bit then the failure is expected. It needs to be set as FOREGROUND region.

0 Renato Faria Iida 9 months ago in reply to Prashant Shivhare

Prodigy 80 points

The value is

#define FWL_CONTROL_ENABLE (0xAU) /*!< Enable Region of Memory in the Firewall */

0 Prashant Shivhare 9 months ago in reply to Renato Faria Iida

TI__Guru 74091 points

Renato Faria Iida said:
#define FWL_CONTROL_ENABLE (0xAU) /*!< Enable Region of Memory in the Firewall */

This looks good.

I have tried setting REGION 6 to firewall MCSPI address space & it works for me. It could be a setup issue on your end.

Can you please share what all regions you have already configured & their settings as well?

Processors

Processors forum

SK-AM64B: Some firewall rules are not working