Isolating PL Masters

PL masters, such as MicroBlaze or AXI DMA, do not output a MasterID, nor do they utilize the AxUser side-channel. Therefore, such masters cannot be differentiated from each other on that basis. The following figure shows MicroBlaze processors that supports a Non_Secure operating mode.

Figure 1. Secure and Non_Secure MicroBlazes

The Non_Secure[0:3] inputs may be asserted by a constant in the IPI block design. Each of the four bits control the Security level (AxProt[1]) for each of the AXI master ports (M_AXI_DP,M_AXI_IP,M_AXI_DC,M_AXI_IC).

For the configuration above, it is recommended to disable the MasterID checks in the region configuration, Rxx_CONFIG[MidCheckDisable], and rely on the security level to differentiate between the processors.

Figure 2. S_AXI_XMPU Isolated to Secure MicroBlaze

The previous figure shows an example of isolating the S_AXI_XMPU configuration port to the secure MicroBlaze. Additional protections are not required as only the secure MicroBlaze has a physical connection. Similarly, the designer can establish a path to any secure processor, in the PL or PS, of their choosing to configure and manage any XMPU_PL in the system.

Figure 3. MicroBlaze with Dedicated XMPU

The previous example exhibits that each and every MicroBlaze processor has a dedicated XMPU_PL. There is no need to differentiate between masters in this configuration.