Hard Processor System Technical Reference Manual: Agilex™ 5 SoCs

ID 814346
Date 4/01/2024
Public
Document Table of Contents

13.4.2.4.2. CSR Firewall

The CHI protocol no longer supports a user/privilege indication like the AXI AxPROT[0] signal. This is because rich Operating Systems and Hypervisors have a large attack surface that could potentially be compromised to circumvent system security. Therefore, only secure transactions from trusted software should be allowed to modify the system configuration.

To that end, the CSRs for the IOBank0, IOBank1, MPFE NoC sideband manager, probes, and QoS, can only be accessed by secure transactions. A firewall is implemented that checks the Secure bit of a transaction against the Secure state of the slave. A transaction that passes the firewall proceeds normally to the slave. A transaction that fails the Firewall receives an error response with random data. Transactions that fail the firewall must never be presented to the Slave interface.