Hard Processor System Technical Reference Manual: Agilex™ 3 SoCs

ID 848530
Date 6/23/2025
Public
Document Table of Contents

4.4.5.1. Region Configuration

To configure a specific firewall region X (where X is 0 to 3), follow these steps:

  1. Disable the region by writing a 32-bit value with the bit X set to the enable_clear register.
  2. Set the base address by writing the region X _base_address register:
    • Bits [32:28] set to zero
    • Bits [27:12] define upper bits of the address
    • Bits [11:0] set to zero, to ensure 4 KB alignment
  3. Set the limit address by writing the region X _limit_address register:
    • Bits [32:28] set to zero
    • Bits [27:12] define upper bits of the address
    • Bits [11:0] set to 0xFFF, to ensure 4 KB alignment
  4. Configure access permissions using the region X _access register:
    • 0x1: only secure accesses allowed
    • 0x0: allow both secure and non-secure accesses
  5. Enable the region by writing a 32-bit value with the bit X set to the enable_set register.

All base and limit addresses are relative to the OCRAM address space, with address 0 corresponding to the start of OCRAM.

Warning: Byte 0 of the region X _base_address and region X _limit_address registers must never be written, otherwise a bus error can occur. Since the value in byte 0 is fixed for these registers, you need to write the other 3 bytes with the desired values individually.
Instead of issuing a single 32-bit memory write, as shown below:
write32(address, 0xXXYYZZTT)
you must issue three equivalent 8 bit memory writes, which do not touch byte 0:
write8(address + 1, 0xZZ)
write8(address + 2, 0xYY)
write8(address + 2, 0xXX)

The firewall configuration registers are part of the OCRAM Security Control Registers (SCR).