TDA4VM: Firewall Descriptions

Hi Sarath,

Baby Sarath Sasidharan Nair said:

I am looking for the information on firewalls that system firmware configures by default at boot time in TDA4VM.

Please go through the TISCI documentation for the same.

Baby Sarath Sasidharan Nair said:

1. Configuration hints to disable them

TIFS configures some firewalls to protect security resources. These firewalls cannot be modified as they are owned by TIFS only. Firewall configurations marked as none can be modified using the TISCI API TISCI_MSG_SET_FWL_REGION .

Ref:

• https://www.ti.com/lit/an/spracx6/spracx6.pdf?ts=1667564383034&ref_url=https%253A%252F%252Fwww.ti.com%252Fproduct%252FTDA4VM%253FkeyMatch%253DTDA4VM
• https://software-dl.ti.com/tisci/esd/latest/6_topic_user_guides/firewall_faq.html

Regards
Diwakar

Hi Diwakar,

Thanks for the response.

I am looking specifically for the TDA4VM GP devices  with DMSC.

In this case , are all the firewall IDs listed in J721E Firewall Descriptions — TISCI User Guide applicable ?

Also the register defnitions of channelized firewalls seems missing in the doc SPRUIM0C.

Kindly share the document or web page link, where the register details are available.

Best regards,

Sarath

Hi Sarath,

Baby Sarath Sasidharan Nair said:

In this case , are all the firewall IDs listed in J721E Firewall Descriptions — TISCI User Guide applicable ?

The firewall configuration mentioned in the document remain the same irrespective of device type (GP,HS-FS,HS-SE).

Channelized firewall configuration is done by TIFS as a part of DM resource allocation process. So, we don't need to configure the channelized firewall manually in the application.

Regards
Diwakar

Hi Diwakar,

Thanks for the updates.

Based on the internal analysis , it looks like below listed firewalls also accessed by the DMSC and are missing in J721E Firewall Descriptions — TISCI User Guide.

1. Region based Firewall ID 513 , region 1
2. Channelized Firewall 6272, start channel -0 ,end channel 3
3. Channelized Firewall 6272, start channel -5 ,end channel 29

Could you please kindly double check them ?

Also we need this info in a documented way (preferably in pdf format) for our product certification.

However ,it is missed in in the existing TI document ,SPRUIM0C

Would it be possible to append this info to existing TI document,SPRUIM0C ?

or share it as new document ?

Best regards,

Sarath

Hi Diwakar,

Please find the response below.

We are not seeing region 1 getting configured inside TIFS , can you help me with the methodology used to get this data ?

In an attempt to replace TIFS with in house developed firmware, all the firewalls accessed by the TIFS SW were logged with debugger.

The outcome was compared with the  list of firewalls described in https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/j721e/firewalls.html

Are we referring to TRM here ? 

SPRUIM0C is the reference gude for the K3 security hardware architecture abd provide technical details about TIFS.

Regards,

Sarath

Hi Sarath,

Baby Sarath Sasidharan Nair said:

In an attempt to replace TIFS with in house developed firmware, all the firewalls accessed by the TIFS SW were logged with debugger.

Are you using Prime device ?

I looked into the code but was not able to find the configuration related to 513.

Can you point me to the file where you are seeing this configuration.

Baby Sarath Sasidharan Nair said:

SPRUIM0C is the reference gude for the K3 security hardware architecture abd provide technical details about TIFS.

Thanks for the confirmation. The document is specifically for providing the details on security offering of the device, software related changes like firewall configuration done by TIFS can not be included in that.

Regards
Diwakar

Hi Diwakar,

Can you point me to the file where you are seeing this configuration.

It's configured in firewall_bootcfg.c .

On logging the firewall ids and regions accessed in function 'fwl_reg_write_perm' using the debugger, the below listed firewalls are noted

1. Region based Firewall ID 513 , region 1
2. Channelized Firewall 6272, start channel -0 ,end channel 3
3. Channelized Firewall 6272, start channel -5 ,end channel 29

Best regards,

Sarath

Hi Sarath,

Allow me some time to check on this.

Also, can you confirm this.

Diwakar Dhyani said:

Are you using Prime device ?

Regards
Diwakar

Hi Diwakar,

Yes.

Regards,

Sarath

Hi Sarath,

Thanks for the confirmation.

We have filed a Jira ticket to update the documentation regarding channelized firewall information.

Regarding firewall ID 513, we are not seeing any logic where region 1 is getting configured. 513 protect DMSC memory so it should be protected from early boot phase itself by ROM.

Regards
Diwakar

Hi Diwakar,

Thanks for the update.

is there any documentation that provides the more information about configurations / actions done in ROM code ?

In my case, system was unable to boot up with out disabling firewall ID 513 region 1 in the system firmware.

 An offical documentation about the firewall ID 513 region 1 is needed for the certification aspects of the system firmware ,

Thanks

Sarath