SPRUIV7B May 2022 – September 2023 AM620-Q1 , AM623 , AM625 , AM625-Q1 , AM625SIP
The region based firewall provides a memory region based protection and isolation mechanism. For each defined memory region, it checks the transaction attributes such as secure vs non-secure, debug vs non-debug, supervisor vs user mode, read vs write and so on. The transaction is dropped, if it does not match the configuration and appropriate violation code is registered with offending parameters.
Host modules (for example, AXI2VBUSMC bridge or CBASSes) provide transaction attributes that are checked by the firewalls, which then determine if the transaction should be blocked or passed. The firewall implements filtering algorithm that compares these host incoming transaction parameters against the region policy to give block indication to the host. Firewall region registers configure the filtering mechanism which includes setting region address range, region permission registers and region control register. There are also firewall exception registers used for violation reporting and logging.
The region based firewall supports multiple regions. Each one is defined by address range and associated access permission. The minimum memory region size is 4KB. The firewall concurrently checks the incoming transaction against all enabled regions looking for violations.
Each firewall is associated with the following registers:
Each region is defined by start and end physical address and associated permission and control registers. A firewall can have 1-24 regions. In case there is more than 1 region, then these registers are duplicated for all regions. Setting the CBASS_FW_REGION_i_CONTROL[3-0] ENABLE field to 0xA enables the region and makes firewall check active for this region. Setting to 0x1 the CBASS_FW_REGION_i_CONTROL[8] BACKGROUND bit indicates to the firewall that the region is background region. Setting to 0x1 the CBASS_FW_REGION_i_CONTROL[9] CACHE_MODE bit ignores cacheable check, so that it cannot fail. In this case the access check is performed based on the READ and WRITE bits in CBASS_FW_REGION_i_PERMISSION_x. Clearing CACHE_MODE enables the cacheable check, so that cacheable transactions are allowed only when the corresponding cacheable permission bit (CBASS_FW_REGION_i_PERMISSION_x [y_CACHEABLE]) is set. If the CBASS_FW_REGION_i_CONTROL[4] LOCK bit is set to 0x1, then the region configuration cannot be changed at all. This is one-time change. This bit is typically used for primary controller to consume and lock its resources and then pass firewall control to secondary controller.
In case two regions overlap, the CBASS_FW_REGION_i_CONTROL[8] BACKGROUND bit is used to select the appropriate permission to be used. The region whose BACKGROUND bit is 0x0 (foreground) takes precedence and its permissions are taken into effect. The background region is ignored.
There can be only one background region per firewall. Foreground regions can have overlapping addresses only with the background region.
It is a software mistake to have overlapping regions with the BACKGROUND bit set to the same value (either background or foreground). Software must be careful to not configure two overlapping regions with the BACKGROUND bit set to the same value.
The firewall also checks if the transaction crosses a 4KB boundary. If so, the transaction is blocked regardless of any matching regions.
When a region is set to be debugable through the corresponding CBASS_FW_REGION_i_PERMISSION_x [y_DEBUG] bit, the firewall ignores the read and write checks for any debug transactions, so that it cannot fail. This allows debug breakpoints to be written out to code even in read-only regions.
When a region is set to be cacheable through the corresponding CBASS_FW_REGION_i_PERMISSION_x [y_CACHEABLE] bit and CACHE_MODE = 0x0, the firewall ignores the read and write checks for any transaction (cacheable or not), so that it cannot fail due to these checks. This allows a write allocated cache to read a cache line even in write-only regions. Due to caches not protecting user and supervisor data from each other, the firewall allows cacheable access to the region when either the user cacheable permission or the supervisor cacheable permission is set.
The firewall notifies the host that the transaction is blocked in case of the following violation conditions:
All violation parameters caused the exception are logged in the firewall exception registers described in Firewall Exception Registers. Table 3-5 shows the mapping between the register fields and violation parameters. If the CBASS_EXCEPTION_LOGGING_CONTROL[0] DISABLE_F bit is set to 0x1, logging is disabled.
If violation occurs, the corresponding firewall notifies the Security Manager (SMS) driving high a dedicated signal. The notification (that is, the signal) can be masked by setting to 0x1 the CBASS_EXCEPTION_LOGGING_CONTROL[1] DISABLE_PEND bit. The firewall exception notification signal gets automatically cleared when the CBASS_EXCEPTION_LOGGING_DATA3 register is read. That signal can be manually set via the CBASS_EXCEPTION_PEND_SET[0] PEND_SET bit and cleared via the CBASS_EXCEPTION_PEND_CLEAR[0] PEND_CLR bit. Reading one of these two bits returns the status of the signal (that is, violation occurred or not).
Field | Value | Description |
---|---|---|
CBASS_EXCEPTION_LOGGING_HEADER0[31-24] TYPE_F | 0x1 | Exception type for firewall violation. This is fixed for the SoC firewalls and is used by software to detect that this corresponding violation comes from a firewall. |
CBASS_EXCEPTION_LOGGING_HEADER0[23-8] SRC_ID | 0x- | Firewall ID. Unique for each firewall. This is used to identify the exact firewall that issued violation so that software detects the precise source. |
CBASS_EXCEPTION_LOGGING_HEADER0[7-0] DEST_ID | 0x- | Destination ID of node where the firewall violation has be to routed. |
CBASS_EXCEPTION_LOGGING_HEADER1[31-24] GROUP | 0x0 | Exception group. This is used to group exceptions to category. All firewall exceptions are in one group. |
CBASS_EXCEPTION_LOGGING_HEADER1[23-16] CODE | Exception code: | |
0x0 | Reserved. | |
0x1 | No region enabled. | |
0x2 | Incoming address does not hit any active region and transaction is dropped. | |
0x3 | Reserved. | |
0x4 | Cacheable error. A cacheable transaction attempting to read/write non-cached marked region. | |
0x5 | Debug error. A debug transaction attempting to read/write a non-allowed debug region. | |
0x6 | Read error. A Read transaction attempting to read from non-allowed read region. | |
0x7 | Write error. A Write transaction attempting to write from non-allowed write region. | |
0x8 | 4KB crossing error. A transaction attempting to cross a 4KB boundary. | |
CBASS_EXCEPTION_LOGGING_DATA0[31-0] ADDR_L | 0x- | Lower 32 address bits (31:0) of the incoming transaction |
CBASS_EXCEPTION_LOGGING_DATA1[15-0] ADDR_H | 0x- | Upper 16 address bits (47:32) of the incoming transaction |
CBASS_EXCEPTION_LOGGING_DATA2[7-0] PRIV_ID | Not used | Incoming transaction parameters |
CBASS_EXCEPTION_LOGGING_DATA2[8] SECURE | 0x- | |
CBASS_EXCEPTION_LOGGING_DATA2[9] PRIV | 0x- | |
CBASS_EXCEPTION_LOGGING_DATA2[10] CACHEABLE | 0x- | |
CBASS_EXCEPTION_LOGGING_DATA2[11] DEBUG | 0x- | |
CBASS_EXCEPTION_LOGGING_DATA2[12] READ | 0x- | |
CBASS_EXCEPTION_LOGGING_DATA2[13] WRITE | 0x- | |
CBASS_EXCEPTION_LOGGING_DATA2[27-16] ROUTEID | ||
0x- | ||
CBASS_EXCEPTION_LOGGING_DATA3[9-0] BYTECNT | 0x- | Byte count of the incoming transaction |