Intel® Arria® 10 Hard Processor System Technical Reference Manual

ID 683711
Date 8/28/2023
Public
Document Table of Contents

7.2.2.3. Privilege Filter

If a transaction packet has passed the security firewall, it may pass through a privilege filter. The privilege filter only applies to writes. All reads are passed without exception.

The privilege filter decodes the incoming user or privilege accesses and determines whether to pass or fail the transaction. It is separate from the security firewall and transactions generally carry both privilege and secure bits. The privilege filters are configured in the interconnect by executing a read-modify-write to the l4_priv register or setting individual bits in the l4_set register. If a privilege bit is set, both privilege and user mode transactions are allowed to the slave. If a privilege bit is cleared using the l4_clear register, then only privileged transactions are allowed to the slave.

The following slaves can be programmed using the privilege registers in the interconnect module:

  • HPS-to-FPGA bridge
  • Lightweight HPS-to-FPGA bridge
  • UARTs
  • SP Timers
  • I2C Modules
  • GPIO
  • SD/MMC
  • QSPI
  • EMAC Modules
  • SPI
  • Secure and non-secure DMA
  • USB
  • NAND Controller
The following table shows the result of privileged and user master accesses based on the value of the programmed privilege bit for a particular slave.
Note: All read accesses pass regardless of the privilege bit value.
Table 42.  Privilege Filter Transaction

Read/Write

Privilege Signal

Privilege bit Transaction Pass/Fail

Read

0

0 Pass

0

1 Pass

1

0 Pass

1

1 Pass

Write

0

0 Fail

0

1 Pass

1

0 Pass

1

1 Pass