PPU (Peripheral Protection Unit STL module)

General Description

Functional self-test for the Peripheral Protection Unit (PPU) of the PERI_MS block (CAT1C / XMC7000).

More Information

On XMC7000 platform the PPU is configured from CM0+ (PC0) during startup, before CM7 is enabled: the CM7 application cores cannot program a PPU at run time. The self-test therefore does not configure any PPU. It verifies the protection CM0+ already established: the application supplies the address of a peripheral register that the final protection policy denies to the calling core's protection context, and the self-test attempts an unauthorized access and checks that:

1. the expected peripheral-protection violation is captured in the supplied fault structure: source stl_ppu_entry_t::expectedFault (a CY_SYSFAULT_MS_PPU_* value) and DATA0 equal to the accessed address, and
2. the register content is unchanged. This is checked only when stl_ppu_entry_t::checkIntegrity is true, which requires a read-allowed testReg; otherwise only the denial is verified.

The calling core must run at a non-zero protection context: PC0 always has access to PPU-protected peripherals, so a denial cannot be observed at PC0. PPU structures hold separate user and privileged permissions, the policy must deny the write at the privilege level the self-test runs at.

The self-test performs a denied write. With CPUSS_BUFF_CTL.WRITE_BUFF = 1 (reset default) and testReg mapped as bufferable memory (see stl_ppu_entry_t::testReg), the bus bridge buffers the write, the CPU receives no bus error, and the violation captured in the fault structure is the bus error response. The self-test installs no BusFault handler; if either condition is not met, the denied write causes a HardFault. See the XMC7000 architecture reference manual for details.

Coverage of safety-related areas: one call verifies one access attempt on one register. Call SelfTest_PPU() once per safety-related area, that is, once per PPU structure that enforces the safety-related policy against the calling core: one call per fixed PPU structure (PERI_MS_PPU_FX_*, for example PERI_MS_PPU_FX_GPIO_PRT2_PRT and PERI_MS_PPU_FX_GPIO_PRT2_CFG are two areas) and one call per programmable PPU region. For each area pick one representative register inside the address range of that PPU structure that meets the stl_ppu_entry_t::testReg requirements; the PPU structure applies one set of permissions to its whole range. The same fault structure can be used for all calls.

Note

This is a startup-only test. Run it during system initialization, after the final application PPU policy has been applied and before any protection lock.

API Reference
	Macros
	Data Structures
	Functions