Agilex™ 7 Hard Processor System Technical Reference Manual

ID 683567
Date 10/31/2025
Public
Document Table of Contents

6.1.2.1.3. Slave Security

The system interconnect enforces security through the slave settings. The slave settings are controlled by the Interconnect Security Control Register (SCR) in the service network.

Firewalls protect certain L3 and L4 slaves. Each of these slaves has its own security check and programmable security settings. After reset, every slave of the system interconnect is in a secure state. This feature is called boot secure. Only secure masters can access secure slaves.

The system interconnect implements seven firewalls to check the security state of each slave, as listed in the following table. At reset time, all firewalls default to the secure state.
Table 53.  System Interconnect FirewallsThis table shows the firewall configurations in the main system interconnect.
Name Description

Peripherals Firewall

(0xFFD21000.noc_fw_l4_per_scr)

Filter access to slave peripherals (SPs) in the following buses:
  • L4_main bus
  • L4_MP master peripherals bus
  • L4_AHB bus
  • L4_SP slave peripherals bus

System Firewall

(0xFFD21000.noc_fw_l4_sys_scr)

Filter access to system peripherals in the following components:
  • L4_SYS system bus
  • L4_ECC bus
  • DAP
  • STM (System Trace Macrocell)
  • HMC (L4 Hard Memory Controller)
  • L4_bus_SCR (SCR firewall and probes)

H2F Firewall

(0xFFD21000.noc_fw_soc2fpga_scr)

Filters access to FPGA through the H2F bridge
Lightweight H2F Firewall Controls access through the lightweight H2F bridge
TCU Firewall Controls access to the TCU
DAP Firewall Controls access to the CoreSight* APB DAP

MPFE Firewalls (F2H/DDR)

(0xF8010000.firewall_mpu_ddr)

(0xF8010000.firewall_ddr_fpga2sdram_inst_0_scr)

(0xF8010000.firewall_ddr_scheduler_mpfe_scr)

Filter access to DDR and HMC Configuration Register.
In addition to the firewalls listed above, the following slaves are protected by firewalls implemented outside the system interconnect:
Table 54.  Firewalls Outside the System Interconnect
Slave Name Comment

On-chip RAM Module – 256KB

(0xF7100204)

(0xF7100208)

(0xF710020C)

(0xF7100210)

Firewall in CCU. Four regions within the on-chip RAM (OCRAM) space that can be configured for secure and privileged access.
Note: At reset, the privilege filters are configured to allow certain L4 slaves to receive only secure transactions. Software must either configure bridge secure at startup, or reconfigure the privilege filters to accept non-secure transactions.

To change the security state, you must perform a secure write to the appropriate SCR register of a secure slave. A non-secure access to the SCR register of a secure slave triggers a bus error.

The following slaves are not protected by firewalls:
Table 55.  Slaves Without Firewalls
Slave Name Comment
GIC GIC implements its own security extensions
STM STM implements its own master security through master IDs
L4_Generic Timestamp Fixed Secure/Non-Secure by interconnect, no configuration required.
DMA DMA implements its own security extensions
The following table shows the details for the peripheral target firewall.
Table 56.  Peripheral Target Firewall
Target Name Bus Configuration Register
NAND Controller Module Registers L4 MP 0xFFD21000.nand_register
USB2.x Controller Module Registers L4 AHB

0xFFD21000.usb0_register

0xFFD21000.usb1_register

SPI Module initiators L4 main

0xFFD21000.spi_master0

0xFFD21000.spi_master1

SPI Module targets L4 main

0xFFD21000.spi_slave0

0xFFD21000.spi_slave1

EMAC Modules L4 MP

0xFFD21000.emac0

0xFFD21000.emac1

0xFFD21000.emac2

SDMMC Module L4 MP 0xFFD21000.sdmmc
GPIO Modules L4 SP

0xFFD21000.gpio0

0xFFD21000.gpio1

I2C Modules L4 SP

0xFFD21000.i2c0

0xFFD21000.i2c1

0xFFD21000.i2c2

0xFFD21000.i2c3

0xFFD21000.i2c4

SP Timer Modules L4 SP

0xFFD21000.sp_timer0

0xFFD21000.sp_timer1

UART Modules L4 SP

0xFFD21000.uart0

0xFFD21000.uart1

The following table shows the details for the system target firewall.
Table 57.  System Target Firewall
Target Name Bus Configuration Register
DMA ECC Register L4 ECC 0xFFD21100.dma_ecc
EMAC ECC Registers L4 ECC

0xFFD21100.emac0rx_ecc

0xFFD21100.emac0tx_ecc

0xFFD21100.emac1rx_ecc

0xFFD21100.emac1tx_ecc

0xFFD21100.emac2rx_ecc

0xFFD21100.emac2tx_ecc

NAND ECC Registers L4 ECC

0xFFD21100.nand_ecc

0xFFD21100.nand_read_ecc

0xFFD21100.nand_write_ecc

OCRAM ECC Register L4 ECC 0xFFD21100.ocram_ecc
SDMMC ECC Register L4 ECC 0xFFD21100.sdmmc_ecc
USB ECC Registers L4 ECC

0xFFD21100.usb0_ecc

0xFFD21100.usb1_ecc

Clock Manager Module L4 sys 0xFFD21100.clock_manager
IO Manager Module L4 sys 0xFFD21100.io_manager
Reset Manager Module L4 sys 0xFFD21100.reset_manager
System Manager Module L4 sys 0xFFD21100.system_manager
OSC Timer Modules L4 sys

0xFFD21100.osc0_timer

0xFFD21100.osc1_timer

Watchdog Modules L4 sys

0xFFD21100.watchdog0

0xFFD21100.watchdog1

0xFFD21100.watchdog2

0xFFD21100.watchdog3

DAP L4 sys 0xFFD21100.dap
L4 NOC probes L4 sys 0xFFD21100.noc_probes
L4 NOC QOS L4 sys 0xFFD21100.noc_qos
The following table shows the details for the L3 Bus firewall.
Table 58.  L3 Bus Firewalls
Target Name Bus Comment
HPS2FPGAHPS2FPGA L3 0xFFD21200.soc2fpga
LWHPS2FPGA L3 0xFFD21300.lwsoc2fpga
TCU L3 0xFFD21400.tcu