System Memory Protection Unit (SMPU) RM0349 for two cycles, the first with hready
negated and the second with hready
asserted. To perform these termination functions, the SMPU “intercepts” the hready
and hresp[*] signals from the slave devices, performs the required logic functions to force the response on the bus cycle with a protection error, and then outputs the adjusted values to the crossbar switch.
SMPU provides 2 alarms for functional safety purposes:
1.
Protection violation
SMPU generates this alarm whenever there is a protection error (as explained in previous
Section 17.7.2
) found on any access based on SMPU programming.
a) SMPU faults are covered by a protocol checker. In order to protect from valid transactions affected due to SMPU internal failures, SMPU supervision is implemented based on a transaction monitor which checks that input and output transactions are consistent when no access violation is found.
b) In the event of consistency mismatch between the input and output transactions across the SMPU, an RCCU generates error output to FCCU.
The reset state of SMPU_CESR[VLD] disables the entire module. Recall while the SMPU is disabled, all accesses from all bus masters are allowed. This state also minimizes the power dissipation of the SMPU. The power dissipation of each access evaluation macro is minimized when the associated region descriptor is marked as invalid or when
SMPU_CESR[VLD] = 0.
Typically the appropriate number of region descriptors (SMPU_RGD n ) are loaded at system startup, including the setting of the SMPU_RGDn_WORD3[VLD] bits, before
SMPU_CESR[VLD] is set, enabling the module. This approach allows all the loaded region descriptors to be enabled simultaneously. Recall if a memory reference does not hit in any region descriptor, the attempted access is terminated with an error.
360/1658
In an operational system, interfacing with the SMPU can generally be classified into the following activities:
1.
Creation of a new memory region requires loading the appropriate region descriptor into an available register location. When a new descriptor is loaded into a RGD n , it would typically be performed using four 32-bit word writes. As discussed in
Section 17.6.4.4
, the hardware assists in the maintenance of the valid bit, so if this approach is followed, there are no coherency issues associated with the multi-cycle descriptor writes. Deletion/removal of an existing memory region is performed simply by clearing SMPU_RGDn_WORD3[VLD].
2.
If only the access rights for an existing region descriptor need to change, a 32-bit write to the alternate version of the access control word (SMPU_RGDAACn) would typically be performed. Recall writes to the region descriptor using this alternate access control
DocID024507 Rev 6
RM0349 System Memory Protection Unit (SMPU) location do not affect the valid bit, so there are, by definition, no coherency issues involved with the update. The access rights associated with the memory region switch instantaneously to the new value as the IPS write completes.
3.
If the region’s start and end addresses are to be changed, this would typically be performed by writing a minimum of three words of the region descriptor:
SMPU_RGDn_WORD{0,1,3}, where the writes to Word0 and Word1 redefine the start and end addresses respectively and the write to Word3 re-enables the region descriptor valid bit. In many situations, all four words of the region descriptor would be rewritten.
4.
Typically, references to the SMPU’s programming model would be restricted to supervisor mode accesses from a specific processor(s), so a region descriptor would be specifically allocated for this purpose with attempted accesses from other masters or while in user mode terminated with an error.
5.
When the SMPU detects an access error, the current AHB bus cycle is terminated with an error response and information on the faulting reference captured in the
SMPU_EAR n and SMPU_EDR n registers. The error-terminated AHB bus cycle typically initiates some type of error response in the originating bus master. For example, a processor core may respond with a bus error exception, while a data movement bus master may respond with an error interrupt. In any event, the processor can retrieve the captured error address and detail information simply be reading the
SMPU_E{A,D}R n registers. Information on which error registers contain captured fault data is signaled by SMPU_CESR[SPERR].
6.
Finally, consider the use of overlapping region descriptors. Application of overlapping regions can often reduce the number of descriptors required for a given set of access controls. It is important to note that, in the overlapping memory space, the protection rights of the corresponding region descriptors are logically summed together (the boolean OR operator). In the following example of a dual-core system, there are four bus masters: the two processors (CP0, CP1) and two DMA engines (DMA1, a traditional data movement engine transferring data between RAM and peripherals and
DMA2, a second engine transferring data to/from the RAM only).
Consider the region descriptor assignments in
Table 162
. In this example, there are 8 descriptors used to span 9 regions in the three main spaces of the system memory map (flash, RAM and IPS peripheral space). Each region indicates the specific permissions for each of the four bus masters and this definition provides an appropriate set of shared, private and executable memory spaces.
Of particular interest are the two overlapping spaces: region descriptors 2 & 3 and 3 &
4.
The space defined by RGD2 with no overlap is a private data and stack area that provides read/write access to CP0 only. The overlapping space between RGD2 and
RGD3 defines a shared data space for passing data from CP0 to CP1 and the access controls are defined by the logical OR of the two region descriptors. Thus, CP0 has
( rw- | r--
) = ( rw-
) permissions, while CP1 has (
--- | r--
) = ( r--
) permission in this space. Both DMA engines are excluded from this shared processor data region.
The overlapping spaces between RGD3 and RGD4 defines another shared data space, this one for passing data from CP1 to CP0. For this overlapping space, CP0 has
( r-- | ---
) = ( r--
) permission, while CP1 has ( rw- | r--
) = ( rw-
) permission.
The non-overlapped space of RGD4 defines a private data and stack area for CP1 only.
The space defined by RGD5 is a shared data region, accessible by all four bus masters. Finally, the slave peripheral space mapped onto the IPS bus is partitioned into
DocID024507 Rev 6 361/1658
362
System Memory Protection Unit (SMPU) RM0349 two regions: one containing the SMPU’s programming model accessible only to the two processor cores and the remaining peripheral region accessible to both processors and the traditional DMA1 master.
This simple example is intended to show one possible application of the capabilities of the System Memory Protection Unit in a typical system.
Table 162. Overlapping region descriptor example
Region description RGD n CP0 CP1 DMA1 DMA2
System space
CP0 code
CP1 code
CP0 data and stack
CP0 → CP1 shared data
CP1 → CP0 shared data
CP1 data and stack
Shared DMA data
SMPU
Peripherals
4
5
6
7
0
1
2
3 rwx r-rwr--
--rwrwrwr-rwx
--r-rwrwrwrw-
--
-rw
-rw
--
--
--
-rw
--
--
--
--
--
--
Flash memory
SRAM
IPS
362/1658 DocID024507 Rev 6
