SPRUIU1C July 2020 – February 2024 DRA821U , DRA821U-Q1
Firewalls (FW) and Initiator-side Security Controls (ISC) are important interconnect components that enable hardware isolation for freedom from interference or security uses. ISCs enable every transaction to be identified and tagged to precisely assign the source ID. Firewalls are downstream (target) components that provide the ability to filtering transactions based on the sideband information.
The device protection depends on firewalls. They are used to protect data and configuration spaces by managing the accesses to these memory regions.There are two types of firewalls - region based and channelized. There aren't channelized firewalls on system level. Only NAVSS0, MCU_NAVSS0 and DRU0 have channelized firewalls for the various DMA channels. Only region based firewalls are available on system level. See Section 3.3.4.2.2.1 and Section 3.3.4.2.3.1 for description of the region based and channelized firewalls.
Almost all slaves have a firewall right before the transaction reaches them. There are few exceptions such as WKUP_DMSC0, VPAC0, DMPAC0, NAVSS0 and MCU_NAVSS0 slave ports. These subsystems contain local interconnect with own firewalls inside the subsystem itself. The firewalls inside compute cluster (for A72SS0, C71SS0 and DRU) are also an exception. They are put on the master instead on the slave port side. To enable access for that master port to the slaves these master side firewalls must individually be programmed. Note that there is also a second firewall for C71SS0 that is put on the slave port side.
On devices supporting secure boot and secure DMSC, these components allow the SoC to support multi-tier security and provide segregation of secure and non-secure worlds. All configuration of ISCs and FWs are under exclusive control of DMSC, using a dedicated interconnect.
The number of ISC and Firewall blocks and placement of these blocks are based on the topology of each device. ISC and Firewall blocks are placed in host modules (AXI to VBUSM.C Bridge); or part of the interconnect (for example: CBASS).
Figure 3-2 presents a generic view of ISCs and Firewalls in SoC.