
Description
Width
Field
Upper limit of address. Incoming addresses match if they are less than or equal
to this value.
12
Address_
high
A value of 00 indicates that the protection bit is not set; a value of 01 sets the
protection bit. Systems that do not set AXI protection to a known value should
program this for either protection value.
2
Protection
Set this value to 1 to force the operation to fail or succeed.
1
Fail/allow
Note to Table:
1. Although TID and Port Mask could be redundant, including both in the table allows possible compression
of rules. If masters connected to a port do not have contiguous TIDs, a port-based rule might be more
efficient than a TID-based rule, in terms of the number of rules needed.
A port has a default access status of either allow or fail, nd rules with the opposite allow/fail value can override
the default. The system evaluates each transaction against every rule in the memory protection table. A
transaction received on a port which by default allows access, would fail only if a rule with the fail bit matches
the transaction. Conversely, a port which by default prevents access, would allow access only if a rule allows
that transaction to pass.
Exclusive transactions are security checked on the read operation only. A write operation can occur only if
a valid read is marked in the internal exclusive table. Consequently, a master performing an exclusive read
followed by a write, can write to memory only if the exclusive read was successful.
Related Information
Information about TrustZone
Example of Configuration for TrustZone
For a TrustZone configuration, memory is divided into a range of memory accessible by secure masters and
a range of memory accessible by nonsecure masters. The two memory address ranges may have a range of
memory that overlaps.
This example implements the following memory configuration:
• 2 GB total RAM size
• 0—512 MB dedicated secure area
• 513—576 MB shared area
• 577—2048 MB dedicated nonsecure area
In this example, each port is configured by default to disallow all accesses. The following table shows the
two rules programmed into the memory protection table.
Table 8-5: Rules in Memory Protection Table for Example Configuration
Fail/Allow
Prot
Address High
Address Low
TID High
TID Low
Port Mask
Rule #
allow
b01
576
0
4095
0
0’b1111111111
1
allow
b00
2047
512
4095
0
0’b1111111111
2
SDRAM Controller Subsystem
Altera Corporation
cv_54008
Example of Configuration for TrustZone
8-14
2013.12.30