AM6422: Preventing PKTDMA Access

William Durocher

Part Number: AM6422

We need to prevent access to all PKTDMAs 2 method were recommanded

1) Remove from rm boardcfg (.resasg_entries)

This seems straight forward. However, can you confirm this will cause DMSC to create the firewall. We want to ensure any access to PKTDMA are prevented and flagged.

2) Manuallt create a firewall

The recommanded firewall ID is 48 which is not present in the TRM leading us to believe this firewall can not be created by us. Is that so

17 days ago

0 Hong Guan64 16 days ago

TI__Guru* 79930 points

Hi,
- please refer to <Table 3-8. Region Based Firewalls> in AM64x TRM(Rev. J), where the PKTDMA related FW configuration is under FW_ID(22)
- TIFS/SYSFW pre-configured some PKTDMA related FW as listed in the table
https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/am64x/firewalls.html

1/. will you provide more details on your use case?
2/. which SDK (Linux SDK or MCU+SDK) is used in your design?

Best,
-Hong

0 William Durocher 16 days ago

Prodigy 70 points

We want to ensure that no PKTDMA are accessed in a life critical application. We are using BCDMA. This is running on A53 Bare metal. SDK is currently SDK 9, we are considering updating to SDK 12

AI recommended removing entries in .resasg_entries. Is that sufficient ?

Will that create the blocking firewalls?

TISCI doc does not have any mention of PKTDMA regions only DMA which leads me to believe it would cover everything. Also, isn't region 0 a very global hardware region covering all of the SoC ?

TRM table 3-8 Does provide information on PKTDMA.

0 Hong Guan64 15 days ago in reply to William Durocher

TI__Guru* 79930 points

Hi,
Let me loop in my collegue to help on your questions on A53 bare metal SW.
Best,
-Hong

0 Prashant Shivhare 15 days ago in reply to Hong Guan64

TI__Guru* 88981 points

Hello,

If you configure the PKTDMA related firewalls and remove the PKTDMA entries from RM board configs, it should not be possible to use the PKTDMA. Please note this is in the application after the Security Handover requested by SBL. Before that (SBL stage), the SYSFW will have the exclusive control of the PKTDMA by owning the relevant firewalls and also using the PKTDMA with SA2UL to authenticate the images.

FWL ID 22 configurations by SYSFW

software-dl.ti.com/.../firewalls.html

0 William Durocher 12 days ago in reply to Prashant Shivhare

Prodigy 70 points

The hope is that we do not need to create a firewall if we remove all PKTDMA from board config. Are you saying that we still need to do both ?

0 Prashant Shivhare 11 days ago in reply to William Durocher

TI__Guru* 88981 points

William Durocher said:
The hope is that we do not need to create a firewall if we remove all PKTDMA from board config. Are you saying that we still need to do both ?

I do not have complete understanding of the DMA architecture but I am a bit skeptical if removing PKTDMA entries from board configs is enough. After security handover, the firewalls are open for configuration by the host requesting the security handover. So, the host (default R5FSS0-0 core) may reconfigure the relevant firewalls to configure the PKTDMA as needed without relying on SYSFW.

Will discuss internally and get back to you.

0 William Durocher 2 days ago in reply to Prashant Shivhare

Prodigy 70 points

Did you get an answer on this ?

Processors

Processors forum

AM6422: Preventing PKTDMA Access