TDA4VM: How to setup firewall for a device

max

Part Number: TDA4VM

Hi,

We are trying to setup firewall for a device say SPI0 but having issue that Sciclient_firewallGetRegion or Sciclient_firewallSetRegion will report error because sciResp.flags variable will not having TISCI_MSG_FLAG_ACK. Any idea what is going wrong?

struct tisci_msg_fwl_change_owner_info_req req = {
    .fwl_id = 2136,
    .region = 1,
    .owner_index = 40
};

- Sciclient_firewallChangeOwnerInfo will have no problem.

struct tisci_msg_fwl_get_firewall_region_req req2 = {
.fwl_id = 2136,
.region = 1,
.n_permission_regs = 3,
};

- Sciclient_firewallGetRegion will not have ACK in response structure.

- TISCI_MSG_FLAG_AOP | TISCI_MSG_FLAG_ACK flags are also used for TISCI_MSG_GET_FWL_REGION message.

Versions:

SYSFW ABI: 2.9 (firmware rev 0x0013 '19.12.1-v2019.12a (Terrific Lla')
J7X-BASE-CPB rev E3
J7X-VSC8514-ETH rev E2

Thanks

over 4 years ago

0 max over 4 years ago

Intellectual 595 points

Hi Team,

I am following https://e2e.ti.com/support/processors/f/processors-forum/958666/faq-processor-sdk-dra8x-tda4x-how-to-build-uboot-and-spl-for-the-hs-device using https://software-dl.ti.com/jacinto7/esd/processor-sdk-linux-jacinto7/07_02_00_07/exports/ti-processor-sdk-linux-j7-evm-07_02_00_07-Linux-x86-Install.bin but seeing that Uboot is not booting if HS compiled files are deployed to the boot partition after doing compilation by using instructions from the above link.

Following are the sizes of the files used:

	sysfw.itb	tiboot3.bin	tispl.bin	u-boot.img	Behaviour
GP	269278	250297	893676	1035160	Uboot is booting
HS	269278	239989	903816	1037512	Nothing printed on console

Please guide how J7 EVM can be run in HS mode.

Thanks

0 max over 4 years ago in reply to max

Intellectual 595 points

Hi Team, Any idea what are we missing due to which UBoot is not booting on using HS enabled files?

Thanks

0 Anuraag Tummanapally over 4 years ago in reply to max

TI__Intellectual 1600 points

Hi Max,

I can see that sysfw.itb file is of same size for GP and HS.

Are you using same sysfw for both GP and HS?

On a HS device, the sysfw has to be dual signed (both with customer key and TI keys).

On the Page "How to build uboot and SPL for the HS device?"

there is no detail about sysfw.itb, can you mention the steps/source for you r sysfw.itb file?

Thanks,

Anuraag

0 max over 4 years ago in reply to Anuraag Tummanapally

Intellectual 595 points

Hi Anuraag,

Yes I am using the same sysfw.itb in both cases. https://e2e.ti.com/support/processors/f/processors-forum/958666/faq-processor-sdk-dra8x-tda4x-how-to-build-uboot-and-spl-for-the-hs-device is not mentioning that we need to sign sysfw.itb so I am not doing it. Can you send those instructions?

Thanks

0 Anuraag Tummanapally over 4 years ago in reply to max

TI__Intellectual 1600 points

Hi Max,

https://e2e.ti.com/support/processors/f/processors-forum/963964/faq-processor-sdk-dra8x-tda4x-how-to-build-sysfw-itb-file-for-hs-device

This page describes the procedure to build sysfw.itb for SDK 7.0,

You can use ti-fs-* instead of ti-sci-* files in step 3, for SDK7.2

Thanks,

Anuraag

0 max over 4 years ago in reply to Anuraag Tummanapally

Intellectual 595 points

Hi Anuraag,

I have produced the sysfw-image using SDK7.2 build system as well as makefile available on the above mentioned link. The end result is same that hardware is not booting.

Other than ti-fs-* change, it is observed that Updated_MSMC_Size.patch is not required as change is already available in the code.

Thanks

0 Anuraag Tummanapally over 4 years ago in reply to max

TI__Intellectual 1600 points

Hi Max,

I have confirmed the following from the author of https://e2e.ti.com/support/processors/f/processors-forum/963964/faq-processor-sdk-dra8x-tda4x-how-to-build-sysfw-itb-file-for-hs-device

"Old uboot from SDK7.0 will not work for TIFS, due to sysfw re-arch.

They need to install PSDKLA7.2 and then change u-boot from SDK7.3 (RC) release. This is only way to get TIFS working with uboot."

Thanks,

Anuraag

0 max over 4 years ago in reply to Anuraag Tummanapally

Intellectual 595 points

Hi Anuraag,

How can I access SDK 7.3 (RC)?

I am okay to work with any older revision of SDK too. I got SDK 6.02.

I was looking into different tickets on e2e forum and found that J7 HS device has been discussed. Currently I am using J721EX SOMG01EVM and hoping that this platform can be configured for HS mode. Am I right?

Can we say that GP or HS is just software based configuration option which defines the behaviour of the device?

Thanks

0 max over 4 years ago in reply to max

Intellectual 595 points

Hi Anuraag,

How can I access SDK 7.3 (RC)?

I am okay to work with any older revision of SDK too. I have tried SDK 07.00.01.01 and having the same issue that hardware is not booting.

Going back to my original issue, could you think of any reason why calls to Sciclient_firewallGetRegion or Sciclient_firewallSetRegion APIs will end up with error because TISCI_MSG_FLAG_ACK flag is not available in response message? Is it because of device is in GP configuration mode?

Thanks

0 Karthik Ramanan over 4 years ago in reply to max

TI__Guru** 113810 points

Max,

The SDK will be available mid next week, there is no possibility to share the release candidate with you.

Request you to try it on the SDK 7.3 when it is available.

Regards

Karthik

0 max over 4 years ago in reply to Karthik Ramanan

Intellectual 595 points

Thanks Karthik. I will keep an eye on the next release.

What do you reckon about the other two questions?

Regards

0 max over 4 years ago in reply to max

Intellectual 595 points

Hi Team,

I have tried the lasted Linux SDK 07.03.00.05 and seeing following on console:

U-Boot SPL 2020.01-dirty (Apr 19 2021 - 13:54:01 +0100)
SYSFW ABI: 3.1 (firmware rev 0x0015 '21.1.1--v2021.01a (Terrific Lla')
Trying to boot from MMC2
Authentication failed!
### ERROR ### Please RESET the board ###

I made a notice that makefile attached to https://e2e.ti.com/support/processors/f/processors-forum/963964/faq-processor-sdk-dra8x-tda4x-how-to-build-sysfw-itb-file-for-hs-device for sysfw-image is setting up PLATFORM=j7-hs-evm so I updated my vanilla Rules.make shipped with ti-processor-sdk-linux-j7-evm-07_03_00_05 to use this platform instead of PLATFORM=j7-evm and rebuilt uboot and sysfw. In this case, console does not showing anything.

0 max over 4 years ago in reply to max

Intellectual 595 points

Hi Team, Any idea what are we missing due to which UBoot is not booting on using HS enabled files?

0 Brijesh Jadav over 4 years ago in reply to max

TI__Guru**** 490625 points

hi max,

for hs device, uboot, sysfw, spl needs to be signed. If it is not signed, it will not boot.

Regards,

Brijesh

0 max over 4 years ago in reply to Brijesh Jadav

Intellectual 595 points

Hi Brijesh,

I am following https://e2e.ti.com/support/processors/f/processors-forum/963964/faq-processor-sdk-dra8x-tda4x-how-to-build-sysfw-itb-file-for-hs-device and https://e2e.ti.com/support/processors/f/processors-forum/958666/faq-processor-sdk-dra8x-tda4x-how-to-build-uboot-and-spl-for-the-hs-device. Are these links covering signing your are referring? If not please let me know where I can find such instructions.

Thanks

0 Brijesh Jadav over 4 years ago in reply to max

TI__Guru**** 490625 points

Hi max,

This is old faq, applicable to older release. Some minor changes required in the faq on the later release.

Let me update it and share it across.

Regards,

Brijesh

0 max over 4 years ago in reply to Brijesh Jadav

Intellectual 595 points

Hi Brijesh,

What do you reckon about the original problem we are facing that Sciclient_firewallGetRegion or Sciclient_firewallSetRegion are having error. Is it because HS mode is not enabled?

Thanks

0 KB over 4 years ago in reply to max

TI__Guru*** 126851 points

Hi Max,

The Sciclient_firewallGetRegion or Sciclient_firewallSetRegion, APIs will function on a GP device.

In regards to the commands being sent, is the owner host id correct for the setup under test, where 40 maps as below:

/** MAIN_1_R5_0(Non Secure): Cortex R5_1 context 0 on Main island */
#define HOST_ID_MAIN_1_R5_0 (40U)

Thanks,

0 max over 4 years ago in reply to KB

Intellectual 595 points

Hi KB, My app is running on R5F-1_0 of Main Domain so that's why I am using it.

Another question http://software-dl.ti.com/tisci/esd/19_12_01/5_soc_doc/j721e/hosts.html#enumeration-of-host-ids is showing security status. What exactly it means?

Regards,

0 max over 4 years ago in reply to max

Intellectual 595 points

Hi KB, Did you get a chance to look this?
Thanks

0 KB over 4 years ago in reply to max

TI__Guru*** 126851 points

Hi Max,

Apologies for delayed response. For an understanding of secure vs. non-secure host id, please take a look "Fig. 4 Software on different cores and secure proxy communication channels"

Texas Instruments System Controller Interface (TISCI) — TISCI User Guide

Secure threads are used for directly communicating with the DMSC, while non-secure threads are used to communicate with the Sciserver.

Regards,

Processors

Processors forum

TDA4VM: How to setup firewall for a device