Intel® Arria® 10 Hard Processor System Technical Reference Manual

ID 683711
Date 8/28/2023
Public
Document Table of Contents

7.2.2.1. Firewall Diagrams

The system interconnect firewalls filter access to components on various buses.

Table 36.  System Interconnect Firewalls

Name

Function

Peripherals

The peripherals firewall filters access to slave peripherals in the following buses:

  • L4 main bus
  • L4 master peripheral bus
  • L4 AHB* bus
  • L4 slave peripherals bus
System

The system firewall filters access to system peripherals in the following components:

  • L4 system bus
  • L4 ECC bus
  • DAP
HPS-to-FPGA

The HPS-to-FPGA firewall filters access to FPGA through the following bridges:

  • HPS-to-FPGA bridge
  • Lightweight HPS-to-FPGA bridge
On-Chip RAM

The on-chip RAM firewall filters secure access to on-chip RAM

SDRAM

The SDRAM firewall filters access to DDR SDRAM

Figure 21. Peripheral FirewallSecurity Configuration Registers (SCRs) within the noc_fw_l4_per register group can be programmed to mark the security status of all available masters.
Table 37.  Peripheral Firewall

Bus Behind Firewall

Bus Slaves Behind Firewall Masters That Can Access Bus

L4 Main

DMA (secure/non-secure registers)

SPI 0/1/2/3

MPU

DAP

DMA

FPGA-to-HPS

L4 Master Peripheral Bus

EMAC 0/1/2

SD/MMC

QSPI

MPU

DAP

DMA

FPGA-to-HPS

L4 AHB* Bus

QSPI Data

NAND Data

USB OTG 0/1

MPU

DAP

DMA

FPGA-to-HPS

L4 Slave Peripheral Bus

UART 0/1

I2C 0/1/2/3/4

SP Timer 0/1

GPIO 0/1/2

MPU

DAP

DMA

FPGA-to-HPS

Figure 22. System FirewallThe system firewall filters accesses to all system peripherals. The system firewall policies can be programmed through the SCRs of the noc_fw_soc2fpga register group.
Table 38.  System Firewall

Bus Behind Firewall

Bus Slaves Behind Firewall Masters That Can Access Bus

L4 ECC

SD/MMC ECC

DMA ECC

QSPI ECC

NAND ECC

USB 0/1 ECC

On-Chip RAM ECC

EMAC 0/1/2 Rx ECC

EMAC 0/1/2 Tx ECC

NAND Read/Write ECC

MPU

FPGA-to-HPS

DAP

L4 System

FPGA Manager Data and Registers

OSC Timer 0/1

Watchdog 0/1

System Manager

L3 Interconnect Control and Status Registers (CSR)

L4 Interconnect firewall Security Control Registers (SCR)

MPU

FPGA-to-HPS

DAP

DMA

L4 DAP Bus

STM

DAP

MPU

FPGA-to-HPS

DAP

Figure 23. HPS-to-FPGA FirewallSCRs within the noc_fw_soc2fpga register group can be programmed to configure the security policy for the master-to-bridge pairs.
Table 39.  System Firewall

Bus Behind Firewall

Bus Slaves Masters that can Access Bus

L3

SD/MMC ECC

DMA ECC

QSPI ECC

NAND ECC

USB 0/1 ECC

On-Chip RAM ECC

EMAC 0/1/2 Rx ECC

EMAC 0/1/2 Tx ECC

NAND Read/Write ECC

MPU

FPGA-to-HPS

DAP

L4 System

FPGA Manager Data and Registers

OSC Timer 0/1

Watchdog 0/1

System Manager

L3 Interconnect CSR

L4 Interconnect firewall SCR

MPU

FPGA-to-HPS

DAP

DMA

L4 DAP Bus

STM

DAP

MPU

FPGA-to-HPS

DAP

Figure 24. On-Chip RAM FirewallUp to six regions of the on-chip RAM can be partitioned for non-secure accesses.
Figure 25. SDRAM firewallTransactions from the DMA, ETR, DAP, FPGA-to-HPS masters or HPS masters (USB, SD/MMC, EMAC, NAND) are routed to either the ACP or the SDRAM scheduler depending on the cacheable bit. Only cacheable transactions are routed to the ACP, with non-cacheable transactions being routed directly to the SDRAM scheduler. If an access to the ACP results in a cache miss in the L1 and L2 cache systems, then the MPU master M1 issues a transaction to the SDRAM scheduler. Only cacheable transactions go through to the ACP. If a cache miss occurs on the ACP cycle, then the MPU masters a new transaction to the SDRAM scheduler. Accesses from the MPU or FPGA-to-SOC masters that are tightly coupled to the MPU go through the DDR firewall only.
Note: The dotted line in the diagram represents the path taken when an ACP access occurs and misses in the L1 and L2 cache.