Architecture
100
SPRUH82C – April 2013 – Revised September 2016
Copyright © 2013–2016, Texas Instruments Incorporated
Memory Protection Unit (MPU)
5.2.4 Protection Check
During a memory access, the MPU checks if the address range of the input transfer overlaps one of the
address ranges. When the input transfer address is within a range the transfer parameters are checked
against the address range permissions.
The MPU first checks the transfers privilege ID against the AID settings. If the AID bit is 0, then the range
will not be checked; if the AID bit is 1, then the transfer parameters are checked against the memory
protection page attribute register (MPPA) values to detect an allowed access.
For non-debug accesses, the read, write, and execute permissions are also checked. There is a set of
permissions for supervisor mode and a set for user mode. For supervisor mode accesses, the SR, SW,
and SX bits are checked. For user mode accesses, the UR, UW, and UX bits are checked.
If the transfer address range does not match any address range then the transfer is either allowed or
disallowed based on the configuration of the MPU. The MPU can be configured for assumed allowed or
assumed disallowed mode as dictated by the ASSUME_ALLOWED bit in the configuration register
(CONFIG).
In the case that a transfer spans multiple address ranges, all the overlapped ranges must allow the
access, otherwise the access is not allowed. The final permissions given to the access are the lowest of
each type of permission from any hit range. Therefore, if a transfer matches 2 ranges, one that is RW and
one that is RX, then the final permission is just R.
5.2.5 MPU Register Protection
Access to the range start and end address registers (MPSAR and MPEAR) and memory protection page
attribute registers (MPPA) is also protected. All non-debug writes must be by a supervisor entity. A
protection fault can occur from a register write with invalid permissions and this triggers an interrupt just
like a memory access.
Faults are not recorded (nor interrupts generated) for debug accesses.
5.2.6 Invalid Accesses and Exceptions
When a transfer fails the protection check, the MPU does not pass the transfer to the output bus. The
MPU instead services the transfer locally to prevent a hang and returns a protection error to the requestor.
The behavior of the MPU depends on whether the access was a read or a write:
•
For a read: The MPU returns 0s, a permission value is 0 (no access allowed), a protection error status.
•
For a write: The MPU receives all the write data and returns a protection error status.
The MPU captures system faults due to addressing or protection violations in its registers. The MPU can
store the fault information for only one fault, so the first detected fault is recorded into the fault registers
and an interrupt is generated. Software must use the fault clear register (FLTCLR) to clear the fault status
so that another fault can be recorded. The MPU will not record another fault nor generate another interrupt
until the existing fault has been cleared. Also, additional faults will be ignored. Faults are not recorded (no
interrupts generated) for debug accesses.
5.2.7 Reset Considerations
After reset, the memory protection page attribute registers (MPPA) default to 0. This disables all protection
features.