Restricted DMA

Right, it is common for those SoCs not to have a full blown IOMMU that supports both the translation and protection parts, but they have a memory protection unit. Given the memory controller architecture, each DMA capable peripheral is given an unique identifier and the memory controller arbitrates all accesses to DRAM. It becomes simple to have an on-chip memory that contains the protection (which can be protected itself with an additional layer of protection against the register space itself) to enforce, and an tuple consisting of {protection bits, client ID, range}.