Memory System: Difference between revisions

From Vita Development Wiki
Jump to navigation Jump to search
m (→‎Bus Error handling: Fix incorrect intr_code for BusErrorSecure)
(→‎Control registers: Add RT+SI, cleanup Agent and PM)
(10 intermediate revisions by 2 users not shown)
Line 1: Line 1:
Kermit memory system internals
This page documents Kermit memory system internals.


This is all based on assumptions and may be completely wrong.
The [https://www.ti.com/lit/pdf/spruf98 OMAP35x Technical Reference Manual] provides information about the SonicsMX® interconnect used in Kermit ES1. Datasheets for some Microchip PIC32 microcontrollers (e.g. [https://www.microchip.com/en-us/solutions/displays/embedded-graphics-solutions/mcu-guided-selection-tool-for-graphics/pic32mz-ef-series PIC32MZ] family) provide information about the SonicsSX® interconnect used in Kermit ES2+.


=== Terminology ===
=== Glossary ===
* SMX
Abbreviation of SonicsMX®.
* SSX
Abbreviation of SonicsSX®.
* Module
Any device connected to the memory system, such as ARM cores, DMA controllers, LPDDR2...
Modules can be initiators, targets or both.
* Initiator
A module that can initiate read and write requests to the interconnect (e.g. ARM cores, DMA, ...).
* Target
A module that can only respond to requests from the interconnect. Targets may also be able to generate out-of-band signals such as interrupts.
* Agent
* Agent
A device connected to the memory system.
The connection between a module's port and the interconnect. If a module has multiple ports (e.g. an Initiator and Target module), each port is connected to the interconnect by a different agent (e.g. one IA and one TA).
* Access
An interface between an Agent and the memory
* TA
* TA
Short for Target Access?
Short for Target Agent. The agent connecting an Initiator module to the interconnect.
* IA
* IA
Short for Initiator Access?
Short for Initiator Agent. The agent connecting a Target module to the interconnect.
* Transaction
* OCP
A data exchange performed via the memory bus system.
[https://www.ocpip.org/ Open-core Protocol], a standard point-to-point protocol allowing communication between a master and a slave port.
Transactions transfer data between an IA and a TA.
* OCP Master Port
A transaction from X (an IA) to Y (a TA) is ''initiated'' by X and ''targets'' Y.
A port that can generate OCP commands. Initiators always include at least one master port.
* Bus
* OCP Slave Port
Short for time-shared bus.
A port that can respond to OCP commands. Targets always include one slave port.
A link between agents on which a single transaction may be in progress at a time.
* Interconnect
* XBar
Logic device enabling connection between initiator and target modules connected to it.
Short for Crossbar.
* Out-of-band error
A link between agents on which multiple transactions may be in progress at a time (as long as they do not target the same TA).
OCP signal associated to a device error-reporting scheme.
* Arbiter
This is opposed to an in-band error, which is associated to the protocol's error-reporting scheme.
This could be a single physical device of the memory system that allocates access to the bus/XBar to IAs (most plausible hypothesis).
However, the PS Vita may instead be using a decentralized bus arbitration system in which there is no single arbiter.
* Bus Master
When a transaction is occurring on a bus, the agent that started the transaction is referred to as the Bus Master.


== Generalities ==


There are three revisions of the memory system layout:
* Original layout for Kermit1.0 ES1 - uses the SMX interconnect (same as BeagleBoard SoC)
* Second revision for Kermit1.0 ES2 - very close to the final revision, uses the SSX interconnect
* Third and final revision for Kermit1.0 ES3 and later


There are three revisions of the memory system layout: One for Kermit1.0 ES1, one for Kermit1.0 ES2 (not documented but close to ES3) and one for Kermit1.0 ES3, ES4, and Kermit1.5 ES1.
In the following sections, you may see mentions of register names such as <code>BEBT</code> and <code>SBEBT</code>. Unless otherwise specified, a register prefixed with <code>S</code> is merely the ARM Secure variant of the register e.g. <code>SBEBT</code> is <code>BEBT</code> for ARM Secure. Everything that applies to a register should apply to its Secure variant, except that the register is updated by Secure bus transactions, instead of Non-Secure bus transactions.


In the following sections, you may see register names such as <code>BEBT</code> and <code>SBEBT</code> mentioned.
== Control registers ==
Unless otherwise specified, a register prefixed with <code>S</code> is merely the ARM Secure variant of the register (e.g. <code>SBEBT</code> is <code>BEBT</code> for ARM Secure).
Everything that applies to a register should apply to its Secure variant, except that the register is updated by Secure bus transactions, instead of Non-Secure bus transactions.


== Control registers ==
There are several MMIO registers available to alter the behavior of the memory system, or query information about the memory system's state.
There are several MMIO registers available to alter the behavior of the memory system, or query information about the memory system's state.


=== IA/TA registers ===
Registers are always 64-bit, and register blocks are always 1KiB (0x400 bytes).
A common register group associated to every IA or TA of the memory system. The register group is 0x1000 bytes sized (but maybe not all room is used).
 
=== Agent registers ===
 
Each agent (IA/TA) has an associated register block.


(List of physical address for all these interfaces can be found on [[Physical Memory]] page - names start with <code>SSX_</code> - will be migrated here at some point)
(List of physical address for all these interfaces can be found on [[Physical Memory]] page - names start with <code>SSX_</code> - will be migrated here at some point)


{| class="wikitable"
{| class="wikitable"
|+ Known registers
|+ Agent registers description
|-
|-
! Name !! Offset in group !! Size !! Usage/Notes
! Name !! Offset !! Usage/Notes
|-
|-
| STATUS || 0x28 || 0x8 || Bit 0x0100_0000 indicates an error
| <code>COMPONENT</code> || 0x0
| Bits [31:16] contain component code (<code>CODE</code>)
 
Bits [15:0] contain component revision (<code>REV</code>)
 
?what is ''component'' referring to? SSX?
|-
|-
| ERROR_LOG || 0x58 || 0x8 ||
| <code>CORE</code> || 0x18
| Bits [47:32] contain vendor code (<code>VENDOR_CODE</code>)
 
Bits [31:16] contain core code (<code>CORE_CODE</code>)
 
Bits [15:0] contain revision code (<code>REV_CODE</code>)
|-
|-
| ADDR || 0x60 || 0x8 ||
| <code>AGENT_CONTROL</code> || 0x20 || ?
|-
| <code>AGENT_STATUS</code> || 0x28 || Bit 0x0100_0000 indicates an error
|-
| <code>AGENT_ERROR_LOG</code> || 0x58 ||
|-
| <code>AGENT_ERROR_LOG_ADDR</code> || 0x60 ||
|-
| ? || 0x100 || Seen values: 1
|}
|}


== Bus Error handling ==
==== Register Target ====
When a bus error occurs, an interrupt is delivered to ARM Secure (intr_code 0x21/33) or Non-Secure (intr_code 0x20/32). The OS considers all bus errors to be fatal and installs interrupt handlers that stop the system.


This requires more testing, but it seems that device-initiated bus errors (e.g. DMAC) are routed to Non-Secure interrupt; but there may be other rules to consider.
Each interconnect hosts a special TA called the '''R'''egister '''T'''arget (RT), used to access interconnect internal configuration registers. ?On SSX, the '''S'''ideband '''I'''nterconnect is also in this block?? or maybe the addresses are for SI and not RT??
 
{| class="wikitable mw-collapsible mw-collapsed" style="text-align: center"
|+ RT registers location
|-
! Address !! Interconnect name !! u64 @ offset 0x18
|-
| 0xEC000000 || Main Xbar || 0x1402010001001E00
|-
| 0xEC100000 || Center Xbar || 0x1402010001001F00
|-
| 0xEC200000 || Video Xbar || 0x1402010001002100
|-
| 0xEC300000 || IFTU Xbar || 0x1402010001001300
|-
| 0xEC400000 || VIP Xbar || 0x1402010001001500
|-
| 0xEC500000 || Debug Bus || 0x1402010001001400
|-
| 0xEC600000 || DMAC Xbar || 0x1402010001000E00
|-
| 0xED000000 || IO Slave Bus || 0x1402010001000F00
|-
| 0xED100000 || IO Master Bus || 0x1402010001000C00
|-
| 0xED200000 || Pervasive Bus || 0x1402010001000F00
|-
| 0xED300000 || Misc IO Bus || 0x1402010001002400
|-
| 0xED400000 || North IO Master Bus || 0x1402010001001700
|-
| 0xED500000 || Audio Bus || 0x1402010001001E00
|-
| 0xED600000 || North IO Slave Bus || 0x1402010001001800
|-
| 0xED700000 || SRC Bus || 0x1402010001001200
|-
| 0xED800000 || GPU Register Bus || 0x1402010001001300
|-
| 0xED900000 || IFTU Register Bus || 0x1402010001001600
|-
| 0xEE000000 || Camera Slave Bus || 0x1402010001001300
|-
| 0xEE100000 || Camera Master Bus || 0x1402010001001200
|-
| 0xEE200000 || USB Slave Bus || 0x1402010001001900
|-
| 0xEE300000 || USB Master Bus || 0x1402010001001900
|-
| 0xEE400000 || SubLCD Slave Bus || 0x1402010001001B00
|-
| 0xEE500000 || SubLCD Master Bus || 0x1402010001000D00
|-
| 0xEE600000 || Camera Register Bus || 0x1402010001001200
|-
|}
 
{| class="wikitable"
|+ RT registers description
|-
! Name !! Offset !! Usage/Notes
|-
| <code>COMPONENT</code> || 0x0 || See Agent registers
 
?what is ''component'' referring to?
|-
| <code>INITID_READBACK</code>? || 0x70 || Initiator ID of the reader is returned in bits [7:0]?
|-
| ?<code>SI_FLAG_STATUS_0</code>? || 0x110 || Sideband Interconnect error status 0
|-
| ?<code>SI_FLAG_STATUS_1</code>? || 0x130 || Sideband Interconnect error status 1
|-
| ?<code>SI_FLAG_STATUS_2</code>? || 0x150 || Sideband Interconnect error status 2
|-
| ?<code>SI_FLAG_STATUS_3</code>? || 0x170 || Sideband Interconnect error status 3
|-
| ?<code>SI_FLAG_STATUS_4</code>? || 0x190 || Sideband Interconnect error status 4
|-
|}
 
=== SI registers ===
 
Each interconnect hosts a register block called '''S'''ideband '''I'''nterconnect, used for error reporting.
 
=== PM registers ===
 
Each Target Agent may be equipped with a Firewall (also called '''P'''rotection '''M'''echanism), which can be used to restrict or filter access to it based on various criteria.
 
{| class="wikitable"
|+ PM registers location
|-
! Base address !! Protected TA
|-
| 0xEC060000? || <code>Spad_32KiB</code>?
|-
| 0xEC060400 || <code>LPDDR0</code> (Main LPDDR2 + Controller I/F)
|-
| 0xEC160000? || <code>Compati_2MiB</code>?
|-
| 0xEC160400? || <code>DevNull</code>?
|-
| 0xEC260000? || <code>Spad_128KiB</code>?
|-
| 0xEC560000? || <code>SDIO0</code>?
|-
| 0xEC560400? || <code>SDIO1</code>?
|-
| 0xEC560800? || <code>LPDDR1</code>? (TOOL LPDDR2 + Controller I/F)
|}
 
== Bus Errors ==
 
When a bus error occurs, an interrupt is delivered to ARM Secure (Interrupt ID 0x21=33) or Non-Secure (Interrupt ID 0x20=32).
The OS considers all bus errors to be fatal. The interrupt handlers installed for these IDs perform a register dump then stop the system.
 
It appears that device-initiated bus errors (e.g. DMAC) are always routed to Non-Secure interrupt. There may be other rules to consider (e.g. some register to set whether a device is Secure/Non-Secure).


It is unknown whether or not CMeP can receive bus error interrupts or how CMeP fits in the memory system.
It is unknown whether or not CMeP can receive bus error interrupts or how CMeP fits in the memory system.
There are two kind of bus errors: ''Internal Bus'' error and ''Target Device'' error.
An Internal Bus error occurs when the memory system fails to deliver a request to a target device - for example, trying to access non-existent memory.
A Target Device error occurs when a device successfully receives a request but is unable to handle it - for example, accessing the non-existent part of a device's memory.
=== Bus Error Attribute ===
The bus error attribute is a 32-bit value that can be recovered in a per-device MMIO register along with the bus error address.
The attribute holds multiple informations: who (?which agent?) was the bus master when the error occurred, what bus command was ongoing, and when available the reason of the bus error.
{| class="wikitable"
|+ Bus error attribute meaning
|-
! Bitmask !! Name !! Notes
|-
| <code>0x003F_0000</code> || master || Bus master
|-
| <code>0x0000_0700</code> || cmd || Type of transfer requested
|-
| <code>0x0000_0008</code> || Burst Access Error ||
|-
| <code>0x0000_0004</code> || Register Permission Error ||
|-
| <code>0x0000_0001</code> || Address Hole Error || If set, the error occurred because the address was invalid.
|}
Note that for some devices (Spad32K, Spad128K, Compati SRAM), the only valid attribute is <code>0x1</code>, indicating an invalid address.
To decode the meaning of <code>master</code> and <code>cmd</code>, shift them by 16 and 8 respectively to obtain a value between 0-63/0-7 and use the following tables:
{| class="wikitable mw-collapsible mw-collapsed"
|+ <code>cmd</code> decoding table
|-
! Value !! Command
|-
| 0 || Idle
|-
| 1 || Write
|-
| 2 || Read
|-
| 3 || ReadEx
|-
| 4 || ReadLinked
|-
| 5 || WriteNonPost
|-
| 6 || WriteConditional
|-
| 7 || Broadcast
|}
{| class="wikitable mw-collapsible mw-collapsed"
|+ <code>master</code> decoding table
|-
! Value !! Command
|-
| 0 || Reserved
|-
| 1 || ARM Core0
|-
| 2 || ARM Core1
|-
| 3 || ARM Core2
|-
| 4 || ARM Core3
|-
| 5 || ARM L2
|-
| 6 || Reserved
|-
| 7 || Reserved
|-
| 8 || Reserved
|-
| 9 || Reserved
|-
| 10 || Reserved
|-
| 11 || Reserved
|-
| 12 || Reserved
|-
| 13 || Reserved
|-
| 14 || Reserved
|-
| 15 || Reserved
|-
| 16 || DMAC0
|-
| 17 || DMAC1
|-
| 18 || DMAC2
|-
| 19 || DMAC3
|-
| 20 || DMAC4
|-
| 21 || DMAC5
|-
| 22 || Reserved
|-
| 23 || GPU
|-
| 24 || Venezia
|-
| 25 || VIP vdpd
|-
| 26 || VIP vdpm
|-
| 27 || VIP bap
|-
| 28 || Reserved
|-
| 29 || IFTU0a
|-
| 30 || IFTU0b
|-
| 31 || IFTU1a
|-
| 32 || IFTU1b
|-
| 33 || IFTU2
|-
| 34 || Reserved
|-
| 35 || Reserved
|-
| 36 || USB1 Host EHCI
|-
| 37 || USB1 Host OCHI
|-
| 38 || Reserved
|-
| 39 || Sensor in 0
|-
| 40 || Sensor in 1
|-
| 41 || Reserved
|-
| 42 || LCD DMAC
|-
| 43 || Performance Monitor
|-
| 44 || USB2 Device DMAC
|-
| 45 || Sub LCD
|-
| 46 || DMAC6
|-
| 47 || USB0 Host EHCI
|-
| 48 || USB0 Host OHCI
|-
| 49 || USB2 Host EHCI
|-
| 50 || USB2 Host OHCI
|-
| 51 || USB0 Device DMAC
|-
| 52 || Reserved
|-
| 53 || Reserved
|-
| 54 || Reserved
|-
| 55 || USB1 Device DMAC
|-
| 56 || Reserved
|-
| 57 || Reserved
|-
| 58 || Reserved
|-
| 59 || SD/HSMMC0
|-
| 60 || SD/HSMMC1
|-
| 61 || SD/HSMMC2
|-
| 62 || SD/HSMMC3
|-
| 63 || Memory Stick
|}


=== Clear TA error ===
=== Clear TA error ===
In old firmwares (e.g. 0.920 - pre-ES3, so this may no longer be valid), there exists a function named <code>BusErrorClearTA</code> which works the following way.
 
In old System Software versions (e.g. 0.920 - pre-ES3, so this may no longer be valid), there exists inside the bus error module a function named <code>BusErrorClearTA</code> which works the following way.


First, choose a bus/XBar that will serve as start point (MainXBar for ES2).
First, choose a bus/XBar that will serve as start point (MainXBar for ES2).
Line 70: Line 398:
Third, walk the obtained tree. Check the <code>STATUS</code> of all TAs. If an error is present, repeat the procedure recursively (if bus/XBar) then clear the error.
Third, walk the obtained tree. Check the <code>STATUS</code> of all TAs. If an error is present, repeat the procedure recursively (if bus/XBar) then clear the error.


To clear the error, simply write <code>0x0000_0000_01000_0000ull</code> to <code>STATUS</code>
To detect an error, check if bit <code>0x01000_0000ull</code> is present in <code>STATUS</code>
 
To clear the error, simply write <code>0x01000_0000ull</code> to <code>STATUS</code>.
NOTE: old firmwares do not have informations about IAs, only TAs. This could explain the routine's name, but also means this procedure may also work/be needed on IA side.


== Misc ==
NOTE: old System Software versions do not have informations about IAs, but only TAs. This could explain the routine's name, but also means this procedure may also work/be needed on IA side.


The memory system is able to distinguish if a transaction is originating from ARM Secure state or Non-Secure state because ARM Cortex-A9 processors with Security Extensions have [https://developer.arm.com/documentation/den0013/d/Security/TrustZone-hardware-architecture an additional bit indicating whether the access is Secure or Non-Secure added to all memory system transactions].
== Miscellaneous ==


?All devices on the Kermit bus diagram that have an IA are treated as ARM NS.? (attempting to perform a DMAC memcpy() from Secure to Non-Secure LPDDR0 region results in a NS bus error)
The memory system is able to distinguish if a transaction is originating from ARM Secure state or Non-Secure state because ARM Cortex-A9 processors with Security Extensions have [https://developer.arm.com/documentation/den0013/d/Security/TrustZone-hardware-architecture a bit indicating whether the access is Secure or Non-Secure added to all memory system transactions].


On ES1 hardware, the bus registers are prefixed with <code>SMX</code> instead of <code>SSX</code>. The meaning of both these acronyms is unknown.
Attempting to perform a DMAC memcpy() from Secure to Non-Secure LPDDR0 region results in a NS bus error. The current hypothesis is that all devices on the Kermit bus diagram that have an IA are treated as ARM NS.

Revision as of 22:59, 21 August 2024

This page documents Kermit memory system internals.

The OMAP35x Technical Reference Manual provides information about the SonicsMX® interconnect used in Kermit ES1. Datasheets for some Microchip PIC32 microcontrollers (e.g. PIC32MZ family) provide information about the SonicsSX® interconnect used in Kermit ES2+.

Glossary

  • SMX

Abbreviation of SonicsMX®.

  • SSX

Abbreviation of SonicsSX®.

  • Module

Any device connected to the memory system, such as ARM cores, DMA controllers, LPDDR2... Modules can be initiators, targets or both.

  • Initiator

A module that can initiate read and write requests to the interconnect (e.g. ARM cores, DMA, ...).

  • Target

A module that can only respond to requests from the interconnect. Targets may also be able to generate out-of-band signals such as interrupts.

  • Agent

The connection between a module's port and the interconnect. If a module has multiple ports (e.g. an Initiator and Target module), each port is connected to the interconnect by a different agent (e.g. one IA and one TA).

  • TA

Short for Target Agent. The agent connecting an Initiator module to the interconnect.

  • IA

Short for Initiator Agent. The agent connecting a Target module to the interconnect.

  • OCP

Open-core Protocol, a standard point-to-point protocol allowing communication between a master and a slave port.

  • OCP Master Port

A port that can generate OCP commands. Initiators always include at least one master port.

  • OCP Slave Port

A port that can respond to OCP commands. Targets always include one slave port.

  • Interconnect

Logic device enabling connection between initiator and target modules connected to it.

  • Out-of-band error

OCP signal associated to a device error-reporting scheme. This is opposed to an in-band error, which is associated to the protocol's error-reporting scheme.

Generalities

There are three revisions of the memory system layout:

  • Original layout for Kermit1.0 ES1 - uses the SMX interconnect (same as BeagleBoard SoC)
  • Second revision for Kermit1.0 ES2 - very close to the final revision, uses the SSX interconnect
  • Third and final revision for Kermit1.0 ES3 and later

In the following sections, you may see mentions of register names such as BEBT and SBEBT. Unless otherwise specified, a register prefixed with S is merely the ARM Secure variant of the register e.g. SBEBT is BEBT for ARM Secure. Everything that applies to a register should apply to its Secure variant, except that the register is updated by Secure bus transactions, instead of Non-Secure bus transactions.

Control registers

There are several MMIO registers available to alter the behavior of the memory system, or query information about the memory system's state.

Registers are always 64-bit, and register blocks are always 1KiB (0x400 bytes).

Agent registers

Each agent (IA/TA) has an associated register block.

(List of physical address for all these interfaces can be found on Physical Memory page - names start with SSX_ - will be migrated here at some point)

Agent registers description
Name Offset Usage/Notes
COMPONENT 0x0 Bits [31:16] contain component code (CODE)

Bits [15:0] contain component revision (REV)

?what is component referring to? SSX?

CORE 0x18 Bits [47:32] contain vendor code (VENDOR_CODE)

Bits [31:16] contain core code (CORE_CODE)

Bits [15:0] contain revision code (REV_CODE)

AGENT_CONTROL 0x20 ?
AGENT_STATUS 0x28 Bit 0x0100_0000 indicates an error
AGENT_ERROR_LOG 0x58
AGENT_ERROR_LOG_ADDR 0x60
? 0x100 Seen values: 1

Register Target

Each interconnect hosts a special TA called the Register Target (RT), used to access interconnect internal configuration registers. ?On SSX, the Sideband Interconnect is also in this block?? or maybe the addresses are for SI and not RT??

RT registers location
Address Interconnect name u64 @ offset 0x18
0xEC000000 Main Xbar 0x1402010001001E00
0xEC100000 Center Xbar 0x1402010001001F00
0xEC200000 Video Xbar 0x1402010001002100
0xEC300000 IFTU Xbar 0x1402010001001300
0xEC400000 VIP Xbar 0x1402010001001500
0xEC500000 Debug Bus 0x1402010001001400
0xEC600000 DMAC Xbar 0x1402010001000E00
0xED000000 IO Slave Bus 0x1402010001000F00
0xED100000 IO Master Bus 0x1402010001000C00
0xED200000 Pervasive Bus 0x1402010001000F00
0xED300000 Misc IO Bus 0x1402010001002400
0xED400000 North IO Master Bus 0x1402010001001700
0xED500000 Audio Bus 0x1402010001001E00
0xED600000 North IO Slave Bus 0x1402010001001800
0xED700000 SRC Bus 0x1402010001001200
0xED800000 GPU Register Bus 0x1402010001001300
0xED900000 IFTU Register Bus 0x1402010001001600
0xEE000000 Camera Slave Bus 0x1402010001001300
0xEE100000 Camera Master Bus 0x1402010001001200
0xEE200000 USB Slave Bus 0x1402010001001900
0xEE300000 USB Master Bus 0x1402010001001900
0xEE400000 SubLCD Slave Bus 0x1402010001001B00
0xEE500000 SubLCD Master Bus 0x1402010001000D00
0xEE600000 Camera Register Bus 0x1402010001001200
RT registers description
Name Offset Usage/Notes
COMPONENT 0x0 See Agent registers

?what is component referring to?

INITID_READBACK? 0x70 Initiator ID of the reader is returned in bits [7:0]?
?SI_FLAG_STATUS_0? 0x110 Sideband Interconnect error status 0
?SI_FLAG_STATUS_1? 0x130 Sideband Interconnect error status 1
?SI_FLAG_STATUS_2? 0x150 Sideband Interconnect error status 2
?SI_FLAG_STATUS_3? 0x170 Sideband Interconnect error status 3
?SI_FLAG_STATUS_4? 0x190 Sideband Interconnect error status 4

SI registers

Each interconnect hosts a register block called Sideband Interconnect, used for error reporting.

PM registers

Each Target Agent may be equipped with a Firewall (also called Protection Mechanism), which can be used to restrict or filter access to it based on various criteria.

PM registers location
Base address Protected TA
0xEC060000? Spad_32KiB?
0xEC060400 LPDDR0 (Main LPDDR2 + Controller I/F)
0xEC160000? Compati_2MiB?
0xEC160400? DevNull?
0xEC260000? Spad_128KiB?
0xEC560000? SDIO0?
0xEC560400? SDIO1?
0xEC560800? LPDDR1? (TOOL LPDDR2 + Controller I/F)

Bus Errors

When a bus error occurs, an interrupt is delivered to ARM Secure (Interrupt ID 0x21=33) or Non-Secure (Interrupt ID 0x20=32). The OS considers all bus errors to be fatal. The interrupt handlers installed for these IDs perform a register dump then stop the system.

It appears that device-initiated bus errors (e.g. DMAC) are always routed to Non-Secure interrupt. There may be other rules to consider (e.g. some register to set whether a device is Secure/Non-Secure).

It is unknown whether or not CMeP can receive bus error interrupts or how CMeP fits in the memory system.

There are two kind of bus errors: Internal Bus error and Target Device error. An Internal Bus error occurs when the memory system fails to deliver a request to a target device - for example, trying to access non-existent memory. A Target Device error occurs when a device successfully receives a request but is unable to handle it - for example, accessing the non-existent part of a device's memory.

Bus Error Attribute

The bus error attribute is a 32-bit value that can be recovered in a per-device MMIO register along with the bus error address.

The attribute holds multiple informations: who (?which agent?) was the bus master when the error occurred, what bus command was ongoing, and when available the reason of the bus error.

Bus error attribute meaning
Bitmask Name Notes
0x003F_0000 master Bus master
0x0000_0700 cmd Type of transfer requested
0x0000_0008 Burst Access Error
0x0000_0004 Register Permission Error
0x0000_0001 Address Hole Error If set, the error occurred because the address was invalid.

Note that for some devices (Spad32K, Spad128K, Compati SRAM), the only valid attribute is 0x1, indicating an invalid address.

To decode the meaning of master and cmd, shift them by 16 and 8 respectively to obtain a value between 0-63/0-7 and use the following tables:

cmd decoding table
Value Command
0 Idle
1 Write
2 Read
3 ReadEx
4 ReadLinked
5 WriteNonPost
6 WriteConditional
7 Broadcast
master decoding table
Value Command
0 Reserved
1 ARM Core0
2 ARM Core1
3 ARM Core2
4 ARM Core3
5 ARM L2
6 Reserved
7 Reserved
8 Reserved
9 Reserved
10 Reserved
11 Reserved
12 Reserved
13 Reserved
14 Reserved
15 Reserved
16 DMAC0
17 DMAC1
18 DMAC2
19 DMAC3
20 DMAC4
21 DMAC5
22 Reserved
23 GPU
24 Venezia
25 VIP vdpd
26 VIP vdpm
27 VIP bap
28 Reserved
29 IFTU0a
30 IFTU0b
31 IFTU1a
32 IFTU1b
33 IFTU2
34 Reserved
35 Reserved
36 USB1 Host EHCI
37 USB1 Host OCHI
38 Reserved
39 Sensor in 0
40 Sensor in 1
41 Reserved
42 LCD DMAC
43 Performance Monitor
44 USB2 Device DMAC
45 Sub LCD
46 DMAC6
47 USB0 Host EHCI
48 USB0 Host OHCI
49 USB2 Host EHCI
50 USB2 Host OHCI
51 USB0 Device DMAC
52 Reserved
53 Reserved
54 Reserved
55 USB1 Device DMAC
56 Reserved
57 Reserved
58 Reserved
59 SD/HSMMC0
60 SD/HSMMC1
61 SD/HSMMC2
62 SD/HSMMC3
63 Memory Stick

Clear TA error

In old System Software versions (e.g. 0.920 - pre-ES3, so this may no longer be valid), there exists inside the bus error module a function named BusErrorClearTA which works the following way.

First, choose a bus/XBar that will serve as start point (MainXBar for ES2). Second, recursively build a list of all TAs connected to this start point. Repeat the process for all TAs that are busses or XBars. Third, walk the obtained tree. Check the STATUS of all TAs. If an error is present, repeat the procedure recursively (if bus/XBar) then clear the error.

To detect an error, check if bit 0x01000_0000ull is present in STATUS To clear the error, simply write 0x01000_0000ull to STATUS.

NOTE: old System Software versions do not have informations about IAs, but only TAs. This could explain the routine's name, but also means this procedure may also work/be needed on IA side.

Miscellaneous

The memory system is able to distinguish if a transaction is originating from ARM Secure state or Non-Secure state because ARM Cortex-A9 processors with Security Extensions have a bit indicating whether the access is Secure or Non-Secure added to all memory system transactions.

Attempting to perform a DMAC memcpy() from Secure to Non-Secure LPDDR0 region results in a NS bus error. The current hypothesis is that all devices on the Kermit bus diagram that have an IA are treated as ARM NS.

Retrieved from "http://wiki.henkaku.xyz/index.php?title=Memory_System&oldid=21330"