This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TDA4VH-Q1: TISCI Secure Proxy Communication Issue Report

Part Number: TDA4VH-Q1
Other Parts Discussed in Thread: TDA4VH

Problem Description

Issue: DMSC returns stale/incorrect responses for TISCI messages other than VERSION  
Platform: J784S4, MCU Domain R5F (MCU_0_R5_1)  
SDK Version: [Your SDK version here]  
Severity: Critical - Prevents communication with DMSC for non-VERSION messages

Configuration

Secure Proxy Base Addresses

Target Data: 0x2A480000
- RT (Status): 0x2A380000

Thread IDs

TX Thread: TISCI_SEC_PROXY_MCU_0_R5_1_WRITE_HIGH_PRIORITY_THREAD_ID (7)
- RX Thread: TISCI_SEC_PROXY_MCU_0_R5_1_READ_RESPONSE_THREAD_ID (6)

Host Configuration

Host ID: TISCI_HOST_ID_MCU_0_R5_1 (4)

Test Sequence and Results

Initial Testing (VERSION message as "hello world")

Test A: Power cycle → send(VERSION, seq=0x01) → receive()
Result: Correct response
  - Response: {type=TISCI_MSG_VERSION (0x0002), host=0x04, seq=0x02, flags=0x00000002}
  - Magic Header: {magic=0x00000055, rsvd=0x00000000}
- Observation: seq incremented from 0x01 to 0x02 in response

Extended VERSION Testing

Test B: Power cycle → send(VERSION, seq=0x64) → receive()
Result: Correct response
  - Response: {type=TISCI_MSG_VERSION (0x0002), host=0x04, seq=0x02, flags=0x00000002}
  - Observation: Response seq remains 0x02 regardless of request seq value
  - Attempted to force different seq values - no effect observed

GET_TRACE_CONFIG Testing

Test C: Power cycle → flush_rx() → send(GET_TRACE_CONFIG, seq=0x03) → receive()
Result: Wrong response
  - Request sent: {type=0x0021, host=0x04, seq=0x03, flags=0x00000002}
  - Response received: {type=0x0002, host=0x04, seq=0x02, flags=0x00000002}
  - Expected response: {type=0x0021, host=0x04, seq=0x03, flags=0x00000002}
  
Test D: Power cycle → send(GET_TRACE_CONFIG, seq=0x04) → receive()
Result: Wrong response
  - Request sent: {type=0x0021, host=0x04, seq=0x04, flags=0x00000002}
  - Response received: {type=0x0002, host=0x04, seq=0x02, flags=0x00000002}
  - Pattern: Always receives VERSION response (type=0x0002, seq=0x02)

Power Cycling Protocol

- Board manually powered off before each test
- Power supply disconnected when necessary
- Clean cold boot for every test sequence

Detailed Operation Sequence

1. Flush RX Queue

flush_rx(thread_id_rx):
  → Read RX status register
  → Status count = 0 (queue empty)
  → Perform sequential read of all 64 bytes from FIFO to clear residual data
  → Result: Queue confirmed empty

2. Send Request

send(thread_id_tx, TISCI_MSG_GET_TRACE_CONFIG):
  Request Header: {type=0x0021, host=0x04, seq=0x03, flags=0x00000002}
  → Sequential write of message bytes to TX FIFO
  → Write to last register (offset 0x3C) to trigger PUSH
  → TX status shows no errors
→ Result: Write successful

3. Receive Response

receive(thread_id_rx):
  → Read RX status register
  → Status count = 1 (message available - confirms DMSC responded)
  → Sequential read of all 64 bytes from FIFO
  
  Response Header Received: {type=0x0002, host=0x04, seq=0x02, flags=0x00000002}
  Expected Header:          {type=0x0021, host=0x04, seq=0x03, flags=0x00000002}
  
Payload Content: Contains ASCII string remnants from previous VERSION response ("1.1")

Key Observations

1. Request Transmission Verified:
   - Memory dump confirms correct request structure before send
   - TX status registers show successful transmission
   - No errors reported by Secure Proxy hardware

2. DMSC Acknowledgment Confirmed:
   - RX status count increments from 0 to 1 after request
   - Proves DMSC received request and queued a response

3. Incorrect Response Type:
   - Received: TISCI_MSG_VERSION (0x0002)
   - Expected: TISCI_MSG_GET_TRACE_CONFIG (0x0021)
   - Pattern is consistent across multiple attempts

4. Stale Sequence Number:
   - Response seq=0x02 regardless of request seq value
   - Matches seq from initial VERSION test
   - Suggests response is from previous/cached message

5. Payload Data Contamination:
   - Response payload contains ASCII remnants: "1.1" (0x312E, 0x3131)
   - These match string data from VERSION response
   - Indicates response buffer contains old VERSION data

6. Message-Specific Behavior:
   - TISCI_MSG_VERSION: Works correctly
   - TISCI_MSG_GET_TRACE_CONFIG: Always returns VERSION response
   - No intermediate or partial successes observed

Implementation Details Verified

Secure Proxy Access Pattern

- Sequential volatile reads/writes to hardware registers
- Always read full 64-byte FIFO message (16 x 32-bit words)
- Byte-by-byte memory copy for endianness preservation
- Pointer increment for guaranteed sequential hardware access
- No compiler optimizations affecting volatile access

Multiple Implementation Approaches Tested

1. Array indexing with volatile pointers
2. Pointer arithmetic with explicit increment
3. Various byte-ordering and alignment strategies
4. All approaches show identical incorrect behavior

FIFO Management

- Complete 64-byte reads even for shorter messages
- Explicit flush operations before critical requests
- POP confirmation via last register read
- Status register monitoring at each step

Questions for Texas Instruments

1. Message Queuing: Is there a known issue with DMSC message queuing or response ordering on J784S4?

2. Permissions: Does TISCI_MSG_GET_TRACE_CONFIG require special permissions, initialization, or security context that differs from TISCI_MSG_VERSION?

3. Sequence Management: What is the expected behavior for the seq field in TISCI responses? Should it match the request or increment independently?

4. Flush Procedure: Is there a required flush/reset procedure after VERSION requests before sending other message types?

5. Timing Requirements: Are there timing constraints or delays required between sequential TISCI requests of different types?

6. Thread Context: Could the RX thread be receiving responses intended for a different context or boot stage?

7. Boot Stage: Does message support vary by boot stage? Could GET_TRACE_CONFIG be unavailable at this initialization point?

Additional Information Available

Upon request, we can provide:
- Memory dumps (hex) of request and response buffers
- Complete register traces of TX/RX status at each operation
- Hardware configuration details (clock settings, boot mode, etc.)
- Extended test results with additional TISCI message types

Expected Next Steps

We are seeking guidance on:
1. Root cause of incorrect response type
2. Proper initialization sequence if required
3. Any errata or known workarounds
4. Firmware updates that may address this issue (tifs.bin)

 

Thank you for your assistance in resolving this critical communication issue.

  • Hi Joaquín,

    The problem which you are facing is not able to get the correct response for any other message apart from TISCI_MSG_VERSION, correct me if I am wrong.

    1. Which sdk version you are testing with?
    2. Are you testing this on EVM or custom board ?
    3. There are some sciclient test example in the RTOS SDK, have you tried running that ? (<RTOS_SDK/<PDK>/packages/ti/drv/sciclient/example/sciclient_unit_testapp)

    Regards
    Diwakar

  • Hi Diwakar,

    Thank you for your prompt response.

    You are correct - we are unable to get the correct response for any TISCI message other than TISCI_MSG_VERSION. Specifically, we've tested with:

    • TISCI_MSG_GET_TRACE_CONFIG (0x0021)
    • TISCI_MSG_QUERY_FW_CAPS (0x0022)

    Both consistently return the VERSION response (type=0x0002, seq=0x02) instead of the expected message type.

    Test Environment:

    • RTOS SDK Version: 11_01_00_04
    • PDK Version: 11_01_00_17
    • Board: J784S4 EVM (TDA4VH-Q1)
    • Core: MCU_0_R5F_1 (Boot Core)

    Regarding the sciclient test example:
    We are implementing our own custom TISCI communication layer from scratch, starting from the entry point. The only component we've used from the PDK is the CCS debug initialization script (packages/ti/drv/sciclient/tools/ccsLoadDmsc/j784s4/launch.js), which we've configured as follows:

    isFreertos = 1;
    isSafertos = 0;
    pdkPath = "/opt/ti/ti-processor-sdk-rtos-j784s4-evm-11_01_00_04/pdk_j784s4_11_01_00_17";
    ccs_init_elf_file = pathSciclient+"sciclient_ccs_init_mcu1_0_release.xer5f";
    clearCLECSecureClaimFlag = 1;
    loadSciserverFlag = 0; // Disabled to implement our own sciserver
    sysfw_bin = pdkPath+"/packages/ti/drv/sciclient/soc/sysfw/binaries/ti-fs-firmware-j784s4-gp.bin"

    Rationale for custom implementation:
    Based on our understanding of the TRM, power domain configuration is locked by the DMSC and can only be accessed through TISCI messages from the Boot Core (MCU_0_R5F_1). We need direct control over the TISCI communication layer for our safety-critical application requirements. Could you confirm if this understanding is correct?

    Question:
    Before investigating the sciclient examples, we'd like to understand: Is there a known initialization sequence or permission setup required for messages other than VERSION? The fact that VERSION works 'correctly' but all other messages return the VERSION response suggests a possible initialization or context issue rather than a fundamental communication problem.

    Any guidance on required initialization steps or known limitations at this boot stage would be greatly appreciated.

    Best regards,
    Joaquín

  • Hi Joaquín,

    Rationale for custom implementation:
    Based on our understanding of the TRM, power domain configuration is locked by the DMSC and can only be accessed through TISCI messages from the Boot Core (MCU_0_R5F_1). We need direct control over the TISCI communication layer for our safety-critical application requirements. Could you confirm if this understanding is correct?

    I would like to clarify a few important architectural details regarding the TDA4VH/J784S4 device.

    The TDA4VH/J784S4 is an SMS-based system rather than a DMSC-based system. The architecture includes two Cortex-M4 cores within the SMS subsystem:

    - M4_0: Dedicated to running TIFS (TI Foundational Security) firmware
    - M4_1: Available for HSM (Hardware Security Module) firmware implementation

    The security firmware provides essential security features including secure boot capabilities, as well as runtime security functions such as firewall configuration.

    Regarding Device Manager (DM) functionality, which encompasses Resource Management (RM) and Power Management (PM), these services run on the MCU1_0 core. When a power management call is made directly from MCU1_0, the call flow follows this path:

    So the domain is not blocked by TIFS firmware, and it is handled by DM running on MCU1_0.

    Ref: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/general/TISCI_header.html

    Before investigating the sciclient examples, we'd like to understand: Is there a known initialization sequence or permission setup required for messages other than VERSION? The fact that VERSION works 'correctly' but all other messages return the VERSION response suggests a possible initialization or context issue rather than a fundamental communication problem.

    AFAIK, we don't have such documentation, But you can explore sciserver code base for the sec proxy implementation (Sciserver runs on MCU1_0 in the current architecture). The path for the same in RTOS sdk is <RTOS_SDK>/<pdk>/packages/ti/drv/sciclient/src/sciserver

    Ref:software-dl.ti.com/.../index_modules_sciclient_j784s4.html

    Regards
    Diwakar

  • Hi Diwakar,


    Thanks for the insights on the SMS/DM architecture. We have performed exhaustive testing to isolate the issue, comparing the standard SDK initialization against a clean custom initialization. We are executing our code on the Boot Core (MCU_Cortex_R5_0), operating in the Secure Context (Host ID 4 / TISCI_HOST_ID_MCU_0_R5_1). The results point to a blocking issue in the TIFS communication channel availability during a custom baremetal boot.
    Here is the breakdown of our two test scenarios and the specific failure modes in each:


    Scenario 1: Default Initialization (Potential Conflict)

    • Setup: CCS Script with loadSciserverFlag = 0, but the script still pre-loads standard PDK binary blobs onto MCU_R5F. Our custom firmware is then loaded on MCU_Cortex_R5_0.
    • Results:
    • TISCI_MSG_VERSION: Unstable. We receive a response, but the Sequence ID (seq) does not update on subsequent calls. This strongly suggests a Race Condition where the pre-loaded binary consumes the Secure Proxy message from the HW FIFO, leaving our firmware to read stale data from the shared memory buffer.
    • TISCI_MSG_BOOT_NOTIFICATION: Lost. Never received by our firmware (likely consumed by the pre-loaded binary).

    Scenario 2: Clean Initialization (The Core Issue)

    • Setup: Custom launch.js that only loads ti-fs-firmware-j784s4-gp.bin to the M4 (TIFS). No other binaries are loaded. MCU_Cortex_R5_0 runs strictly our baremetal code.
    • Goal: To act as the sole Device Manager/Boot Master from MCU_0_R5_1on MCU_Cortex_R5_0.
    • Results:
    • TISCI_MSG_VERSION: NO RESPONSE. The message is pushed to the TX FIFO (Current CNT changes from 9 to 10 after some clk cycles), but TIFS never places a response in the RX FIFO. Timeout.
    • TISCI_MSG_BOOT_NOTIFICATION: NO RESPONSE. The RX queue remains empty after boot.
    • TISCI_MSG_BOARD_CONFIG: NO RESPONSE.

    The Critical Blockers
    In Scenario 2, we have eliminated the software conflict, but communication is dead. This implies missing hardware initialization that is normally performed by the SBL/SPL or the standard Gel scripts.

    • Secure Proxy Initialization: When loading TIFS directly via CCS, are the Secure Proxy Backing Memory regions (Target Data) enabled and accessible to MCU_Cortex_R5_0 by default? Or does the TIFS require a specific "ROM-like" handshake or register configuration to enable the Proxy threads for the MCU domain?
    • Host ID Validity: In a "Clean" boot state (TIFS only), is MCU_0_R5_1 (Host ID 4) authorized to initiate the VERSION handshake?
    • Missing Step: Since VERSION works in Scenario 1 (albeit with conflicts) but fails in Scenario 2, there is clearly an initialization step (Firewall unlocking, RAT config, or Clock enabling) contained in the standard SDK binaries that we are missing in our baremetal setup.

    Question:
    For a custom baremetal implementation on J784S4 that replaces the TI Sciserver: What is the absolute minimum hardware initialization sequence required on the R5F before TIFS will respond to a TISCI_MSG_VERSION on the Secure Proxy?
    We need to bridge the gap between "TIFS Loaded" and "TIFS Responsive".


    Best regards,
    Joaquín

  • Hi Joaquín

    How you are loading TIFS binary to M4_0 ? What boot mode are you using ?

    Response to GET_TRACE_CONFIG msg will be sent only when board config data is parsed by TIFS. TIFS send debug trace configuration in response to TISCI_MSG_GET_TRACE_CONFIG msg, this information is populated by TIFS after parsing the board config data. 

    So we need to send all the board config (RM, PM, security, board config) data to TIFS, before it can respond to all the supported messages.

    Ref:https://software-dl.ti.com/tisci/esd/latest/3_boardcfg/BOARDCFG.html#design-details-for-system-firmware-debug-console

    Regards
    Diwakar

  • Hi Diwakar,
    Thank you for the reference regarding GET_TRACE_CONFIG. We understand that BOARD_CFG is requisite for debug traces. However, we are currently blocked at a strictly lower level: establishing the initial communication link with TIFS in a custom NO-BOOT environment.
    We have isolated the issue to the initialization performed by the SDK helper binary (sciclient_ccs_init_mcu1_0_release.xer5f).
    Current Observation:

    • With SDK Helper (xer5f): When this binary is loaded via launch.js, we infer that TIFS sends BOOT_NOTIFICATION and responds to TISCI_MSG_VERSION during the helper's execution. However, when our custom binary runs immediately afterwards, we encounter a stale state where every request returns a cached VERSION response (seq=2).
    • Without SDK Helper (Clean Setup): When we bypass the helper and load only tifs.bin and our baremetal firmware, TIFS is completely unresponsive. It does not send BOOT_NOTIFICATION, and TISCI_MSG_VERSION requests time out, despite the Secure Proxy TX FIFO incrementing.

    Conclusion:
    The SDK helper binary performs critical hardware initialization that enables TIFS communication. Without this step, TIFS remains unreachable, preventing us from sending the BOARD_CFG.
    Request:
    We need to replicate this initialization in our safety-critical bootloader. Please provide the complete hardware initialization sequence required on the R5F (Host ID 4) to:

    • Receive the initial TISCI_MSG_BOOT_NOTIFICATION.
    • Successfully exchange the TISCI_MSG_VERSION.

    Once we can reliably establish this handshake in our custom environment, we will proceed with the BOARD_CFG transmission.
    We look forward to your guidance on this specific initialization gap.
    Best regards,
    Joaquín

  • Hi Joaquín

    Without SDK Helper (Clean Setup): When we bypass the helper and load only tifs.bin and our baremetal firmware, TIFS is completely unresponsive. It does not send BOOT_NOTIFICATION, and TISCI_MSG_VERSION requests time out, despite the Secure Proxy TX FIFO incrementing.

    Are you reading the BOOT_NOTIFCATION from the notify thread or from the response thread? You will get BOOT_NOTIFCATION to notify thread.

    ould you help us understand the specific requirement driving this approach? The TI SDK's sciclient implementation is well-tested
    and handles all PM/RM communication patterns. I'd recommend reviewing how SBL manages these interactions and adapting that proven implementation to your needs, rather than building from scratch.

    Regards
    Diwakar

  • Hi Diwakar,

    To move this forward and rule out implementation errors on our side, I have prepared a minimal, compressed CCS project (attached) that reproduces the issue on the J784S4 EVM.

    1. Reproduction of the "Stale Sequence" Issue (Standard Launch) We followed the exact procedure described in the manual for this SoC (CCS 12.4):

    1. Run Target Configuration with the standard Gel files.

    2. Execute the standard PDK launch script in the Scripting Console: loadJSFile(".../packages/ti/drv/sciclient/tools/ccsLoadDmsc/j784s4/launch.js");

    3. Load the attached compiled project into MCU_Cortex_R5_0.

    Observation: Immediately upon running, our driver reads a seq mismatch. The system appears "stuck" returning a stale response (likely from the initialization performed by the script). Even if we send TISCI_MSG_QUERY_FW_CAPS or force an invalid message to provoke a NACK, the system does not respond correctly. This indicates that the "well-tested" SDK code leaves the Secure Proxy hardware in a state that conflicts with a clean driver implementation.

    2. Critical Finding: The 4-Byte Offset Discrepancy To investigate why the standard code works but ours fails, we modified launch_sbl_debug.js to skip the sciclient initialization.

    • Test A (Our Code): With tifs.bin loaded but no helper init, our code sends the message but receives no response (timeout), though it detects the message is "picked up".

    • Test B (SDK Code): We loaded sciclient_ccs_initmain.c in this same context. Stepping through the assembly/memory, we confirmed it uses the exact same Thread IDs and Host ID as we do.

    However, we found a major discrepancy in the address access:

    • Our Driver: Writes to the Thread 7 Target Data Base: 0x2A487000.

    • SDK Driver: Writes to 0x2A487004 and reads from 0x2A486004.

    It appears the SDK implementation is applying a 4-byte offset, effectively skipping the first 32-bit word of the message aperture (which corresponds to the header in our map). Even if we ignore the first word in our read operation, the rest of the message payload remains incorrect in our tests.

    Questions for TI:

    1. Stale State: Why does the execution of the standard launch.js leave the Secure Proxy in a state where subsequent custom requests (even valid ones like FW_CAPS) receive stale/incorrect sequence IDs? Is there a specific "reset" or "claim" sequence required to take over after the JS script runs?

    2. Address Offset: Why does the PDK implementation apply a 4-byte offset (writing to ...004 instead of ...000) for the Secure Proxy threads? Is the first word reserved or ignored by the hardware in this specific context?

    We suspect this offset handling is the root cause of the "stale" data, as we might be reading/writing to a misaligned buffer relative to what TIFS expects.

    Regards, Joaquín


    Sec_proxy_test.zip

  • Hi Joaquín,

    Address Offset: Why does the PDK implementation apply a 4-byte offset (writing to ...004 instead of ...000) for the Secure Proxy threads? Is the first word reserved or ignored by the hardware in this specific context?

    First world of SEC_PROXY_DATA_j is used for credits management for each proxy thread by the hardware. This will include saving the proxy thread ID used within the proxy. While writing the data, we should not touch this. For more detail, you can refer to section "10.2.6.2.2.2 Proxy Private Word" of TRM. The same is implemented in PDK as well.

    Also while reading the data, TIFS will read the header from +0x04 offset, if this is corrupted you may see unwanted behaviour.

    Regards
    Diwakar

  • Hi Diwakar,

    Thank you for the reference to TRM Section 10.2.6.2.2.2 (Proxy Private Word). That was indeed the root cause of the behavior we were seeing.

    We have corrected our driver implementation accordingly:

    1. TX (Write): We applied the 4-byte offset to strictly avoid touching the first word (Private Word) during transmission. We also ensured the Secure Header is correctly populated whenever the Host ID configuration requires it.

    2. RX (Read): We decided not to apply the hardware offset during the physical read (we capture the full FIFO including the reserved word for potential future analysis), but we logically parse the response starting from the +0x04 offset. We also conditioned the Secure Header parsing based on the specific message type received.

    Results: With these changes, TISCI_MSG_VERSION now correctly handles sequence (seq) increments. Furthermore, after executing the standard launch.js, we are now able to successfully exchange other messages (such as TISCI_MSG_GET_TRACE_CONFIG) without the stale response issues.

    This resolves the communication issue. Thank you for your support.

    Regards, Joaquín

  • Hi Joaquín 

    Glad to hear that the issue is resolved. If no further follow-up question on this, can we close this thread?

    Regards
    Diwakar