• State TI Thinks Resolved
  • Locked Locked
  • Replies 3 replies
  • Answers 2 answers
  • Subscribers 39 subscribers
  • Views 115 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM263PX-RESTRICTED-SECURITY: MPU Firewalls

Kunukuntla Geetha
Intellectual 450 points

Part Number: AM263PX-RESTRICTED-SECURITY
Other Parts Discussed in Thread: SYSCONFIG

Hi Team,

In the SysConfig of the HSM firmware for the MPU, L2OCRAM_BANK0_SLV, the initiators allowed to access the region 0x70000000 to 0x70080000 are R5FSS0_0, R5FSS0_1, R5FSS1_0, R5FSS1_1, and M4_0. The MPPA permissions are configured as User Read, User Write, User Execute, Supervisor Read, Supervisor Execute, with Non-Secure (NS) = 1 and EMU = 0.

With these settings, I am not facing any issues. However, if I change the NS setting in the MPPA configuration from 1 to 0, the SBL fails, and the error interrupt is triggered.

Can you tell me why this violation occurs when NS = 0? and also what is the difference between these non secure and secure access ?? How it will decide secure access is taking place?


  • 0
    TI__Guru* 91071 points

    Hi Geetha,

    If the NS = 1, it means that a non-secure core, like the R5F could access that location as well. 

    If NS = 0, it means that only HSM (secure core) can access that location.

    Hence you are seeing this issue.

    Thanks and Regards,

    Nikhil Dasan

  • 0 in reply to Nikhil Dasan
    Prodigy 215 points

    Hi Nikhil,

    We are already specifying which initiators can access the resource (such as R5FSS0_0, M4_0, etc.). In that case, why is the NS field required? Since it also specifies whether HS or non-secure cores (such as R5FSS0_0 and others) can access the resource, what additional purpose does it serve?

    Or is it like this: if we set NS = 0, then we should not select R5FSS0_0 or any other non-secure cores as initiators? If we do select them, will it result in access errors?

  • 0 in reply to Sravya Kalluri
    TI__Guru* 91071 points

    Hi Sravya,

    There are 2 sets of check in the MPU IP. 

    One is with the AID (i.e. Priv ID) and other is with the MPPA (attributes). The NS is one of attribute that says if the access should be secure or non-secure. 

    This can be combined with Priv ID or used independently to block access.

    R5F cannot be set as Priv ID if NS bit is 0. This defaults to the HSM access.

    Please check the below for reference to block a region from other core access and provide access to HSM only

    Thanks and Regards,

    Nikhil Dasan