Visible to Intel only — GUID: sfo1410068089301
Ixiasoft
Visible to Intel only — GUID: sfo1410068089301
Ixiasoft
8.2.8.1.1. Slave Security
The system interconnect enforces security through the slave settings. The slave settings are controlled by the NoC Security Control Register (SCR) in the service network. Each L3 and L4 slave has its own security check and programmable security settings. After reset, every slave of the system interconnect is set to a secure state (referred to as boot secure). Only secure masters are allowed to access secure slaves.
The NoC implements five firewalls to check the security state of each slave, as listed in the following table. At reset time, all firewalls default to the secure state.
Name | Function |
---|---|
On-Chip RAM Firewall | Filter access to on-chip RAM |
Peripherals Firewall | Filter access to slave peripherals (SPs) in the following buses:
|
System Firewall | Filter access to system peripherals in the following components:
|
HPS-to-FPGA Firewall | Filter access to FPGA through the following bridges:
|
DDR and DDR L3 Firewalls | Filter access to DDR SDRAM |
At reset, the privilege filters are configured to allow certain L4 slaves to receive only secure transactions. Software must either configure bridges secure at startup, or reconfigure the privilege filters to accept nonsecure transactions. You can reconfigure the privilege filters through the l4_priv register in the noc_l4_priv_l4_priv_filter module.
To change the security state, you must perform a secure write to the appropriate SCR register of a secure slave. A nonsecure access to the SCR register of a secure slave triggers a response with random data.