CCS/MSP430FR5969: Understanding MPU

Hi Olli,

At first, trying to decipher how the linker file initializes the MPU and partitions memory can be very confusing, as you've already discovered. Additionally, a lot of variables seem to get set "automagically" but I'll try to breakdown how everything works.

There are three ways you can setup the MPU but let's start with how the compiler will handle it by default:

By default the compiler will create 3 memory sections with the following permissions and addresses

1. Segment 1: Persistent Variables, I/O buffer, Dynamic memory allocation
   1. NOTE: This is only if these variables exist in your code. Otherwise length = 0
   2. Permissions: Readable and Writable
   3. Starting Address: Start of FRAM
   4. Ending Address: Start of Segment 2 (aligned to 0x0400)
2. Segment 2: Intellectual Property Encapsulated (IPE) Code
   1. NOTE: This is only if IPE is enabled. Otherwise the section length = 0.
   2. Permissions: Readable, Writable, and Executable
   3. Starting Address: End of Segment 1 or start of FRAM if Seg1 length = 0.
   4. Ending Address: Start of Segment 3 (aligned to 0x0400)
3. Segment 3: Code
   1. Permissions: Readable and Executable
   2. Starting Address: End of Segment 2, end of Segment 1 if Seg2 length = 0, or beginning of FRAM if both Seg 1 and Seg 2 length = 0
   3. Ending Address: End of FRAM2

All these segment boundaries are determined "automagically" by this portion of code in the linker file:

GROUP(RW_IPE)
{

GROUP(READ_WRITE_MEMORY)
{

.TI.persistent : {} /* For #pragma persistent */
.cio : {} /* C I/O Buffer */
.sysmem : {} /* Dynamic memory allocation area */
} PALIGN(0x0400), RUN_START(fram_rw_start)

GROUP(IPENCAPSULATED_MEMORY)
{

.ipestruct : {} /* IPE Data structure */
.ipe : {} /* IPE */
.ipe_const : {} /* IPE Protected constants */
.ipe:_isr : {} /* IPE ISRs */
} PALIGN(0x0400), RUN_START(fram_ipe_start) RUN_END(fram_ipe_end) RUN_END(fram_rx_start)

} > 0x4000

The RUN_START macro assigns the starting address of the respective group to the variable passed to it. Similarly the RUN_END macro assigns the end address of the respective group to the variable passed to it. Finally the PALIGN macro aligns the memory to the boundary passed to it. So for example, let assume that you have 500kB of persistent variables, 2kB of IPE data, and 10kB of code. The variables seen above would be assigned as follows if using the MSP430FR5959:

• fram_rw_start = 0x4400
• fram_ipe_start = 0x4800 (due to 0x0400 alignment)
• fram_rx_start = 0x5000

This would then make the segment boundaries as follows:

• Segment 1 (RW): 0x4400 to 0x47FF
• Segment 2 (RWX): 0x4800 to 0x4FFF
• Segment 3 (RX): 0x5000 to 0x13FFF

This is would then be setup by this code in the linker file:

// Segment definitions
#ifdef _MPU_MANUAL // For custom sizes selected in the GUI
mpu_segment_border1 = _MPU_SEGB1 >> 4;
mpu_segment_border2 = _MPU_SEGB2 >> 4;
mpu_sam_value = (_MPU_SAM0 << 12) | (_MPU_SAM3 << 8) | (_MPU_SAM2 << 4) | _MPU_SAM1;
#else // Automated sizes generated by Linker
#ifdef _IPE_ENABLE //if IPE is used in project too
//seg1 = any read + write persistent variables
//seg2 = ipe = read + write + execute access
//seg3 = code, read + execute only
mpu_segment_border1 = fram_ipe_start >> 4;
mpu_segment_border2 = fram_rx_start >> 4;
mpu_sam_value = 0x1573; // Info R, Seg3 RX, Seg2 RWX, Seg1 RW
#else
mpu_segment_border1 = fram_rx_start >> 4;
mpu_segment_border2 = fram_rx_start >> 4;
mpu_sam_value = 0x1513; // Info R, Seg3 RX, Seg2 R, Seg1 RW
#endif
#endif

You'll notice that when IPE is enabled, this code set's the segment 1 boundary to the beginning of the IPE section, and the segment 2 boundary to the beginning of the code segment. This effectively creates 3 memory sections as follows:

• 0x4400 to fram_ipe_start
• fram_ipe_start to fram_rx_start
• fram_rx_start to end of FRAM2

You'll also notice that if IPE is disabled that the mpu_segment_border1 = mpu_segment_border2. This is done purposefully and effectively sets the length of the IPE segment (Segment 2) to 0. In this scenario 3 sections are created as follows:

• 0x4400 to fram_rx_start
• fram_rx_start to fram_rx_start (length of 0)
• fram_rx_start to FRAM2 end

Additionally, when allowing the compiler to setup the MPU, by default the Non-Maskable Interrupt (NMI) that can be generated by the MPU is disabled. This does not mean that the MPU is not protecting these memory sections. It only means that no interrupt will be generated if an access violation is attempted but the memory is still protected from erroneous access. As you mentioned, you can enable NMI's while also letting the compiler handle the MPU setup by predefining _MPU_ENABLE_NMI. In this case, you'll need to provide an interrupt service routine for the NMI vector in your code.

Finally, you'll notice that this code sets the permissions for the sections allocated by the compiler:

mpu_sam_value = 0x1513; // Info R, Seg3 RX, Seg2 R, Seg1 RW

You can and should change this to meet the requirements of your application.

The second way to setup the MPU is using by selecting the "Manually specify memory segment boundaries and access rights" radio button in the project properties:

Here you can setup the boundaries and access rights to whatever you need for your application. The only difference is that the sections might not optimized to the size necessary for each segment like the compiler handles it. Additionally, you can select the "Lock configuration" and/or the "Enable NMI" checkboxes to predefine the _MPU_LOCK and the _MPU_ENABLE_NMI definitions automatically.

The last way to setup the MPU is in your code at the start of execution. This is difficult but can be done by carefully following the User Guide to setup the registers for your applications needs.

Finally, I'm not familiar with the RXI flag and I'm not sure what you mean by this question, could you elaborate more please:

Olli Mannisto said:

On subject of flags, Initialize flag I'm not sure about. Intiialize when? After boot? During flashing when the #pragma PERSISTENT stuff gets initialized once?

Best regards,
Caleb Overbay

The initialize flag is found in the MSP430 Assembly Language reference SLAU131 chapter 8.5.4.2.

attr specifies one to four attributes associated with the named range. Attributes are optional;
when used, they must be enclosed in parentheses. Attributes restrict the allocation of
output sections into certain memory ranges. If you do not use any attributes, you can
allocate any output section into any range with no restrictions. Any memory for which no
attributes are specified (including all memory in the default model) has all four attributes.
Valid attributes are:

So therefore constructing my own memory partitioning I specified

FRAMRO  (RX)            : origin = 0x4400, length = 0x0C00
FRAM         			: origin = 0x5000, length = 0xAF80
FRAMRO2 (RX)            : origin = 0x10000,length = 0x4000

Now do those flags actually do anything? 

From your example you're allocating majority of the FRAM for code (RX). What I personally tried to achieve was to create two read-only segments in the beginning of the 48kB block of FRAM and all of the 16kB block. I wanted to avoid declaring the "in between" part as RX as it contains a lot of "other" stuff i.e. signatures and interrupt vectors. I think those should be RO in fact, neither contains code and neither should be manipulated at runtime. 

Based on your explanation I'll remove those manually allocated segments as I'd have to babysit the code usage. Is this actually written down anywhere? For example SLAA685, SLAA628 and SPMA044A all address the memory protection but do not explain how it works automagically in code composer. Granted, some of those are fairly old e.g. SPMA044A is from 2012. 

Without PUC or NMI there's no indication of access fault which is a hallmark of runaway pointer which are rather difficult to debug on best case.. So I better assign NMI to kick over the CPU and increment watchdog flag:

        case 0x0E:                              //MPUSEG2IFG
            // Clear violation interrupt flag
            SYSNMIflag =1;                      // Set flag
            myconfig_rw.watchdog_l++;
            if(!myconfig_rw.watchdog_l){
                myconfig_rw.watchdog_h++;
            }
            /*
             * Goodbye cruel world!
             */
            PMM_trigPOR();
            break;