8. Illegal access controller (IAC)

8.1 IAC introduction

The RIF (resource isolation framework) is a comprehensive set of hardware blocks designed to enforce and manage the isolation of STM32 hardware resources, such as memory and peripherals.

The RIF uses the IAC (illegal access controller) to centralize the detection of RIF-related illegal accesses, managed by a secure application.

8.2 IAC main features

• • Centralized detection of RIF-related illegal accesses, managed by a secure application. Supported illegal accesses are: secure, privileged.
• • Only accessible by secure privileged CPU

8.3 IAC implementation

The index of the peripherals managed by the IAC in this device is defined in Table 28 . Indexes 0 to 127 are also used in the RIFSC to configure the proper access control using RISUP blocks.

Table 28. Peripheral indexes in IAC

Table 28. Peripheral indexes in IAC (continued)

8.4 IAC functional description

8.4.1 IAC block diagram

Figure 9 shows the IAC block diagram, in context.

Figure 9. IAC block diagram

8.4.2 IAC internal signals

Table 29 lists the internal signals available at IAC level, not at product level.

Table 29. IAC internal signals

8.4.3 IAC reset and clocks

The IAC peripheral has a dedicated clock and reset control in the RCC.

The IAC requires its clock in order to trigger an interrupt request event.

8.4.4 IAC use in RIF

The IAC gathers illegal events generated within the system when an illegal access is detected. The IAC can then generate a secure interrupt towards the secure CPU, if needed. By default, all events in the IAC are masked.

The IAC has room for 160 interrupt sources. Each source corresponds to an IAC index from 0 to 159. The interrupt sources from non-RIF-aware peripherals occupy most of the first 128 indexes. The interrupt sources from RIF-aware peripherals and RIF firewalls occupy indexes from 128 onwards. All these sources are defined in Section 8.3 .

8.4.5 IAC management by trusted application

For each interrupt source of index <i>, an illegal access sets the IAFi flag in IAC_ISRx. A secure privileged application can clear this flag using the corresponding bit in IAC_ICRx. An IAC interrupt is triggered when IAFi is set while IAIEi is set in IAC_IERx.

Indexes between 0 to 127 are assigned to non-RIF-aware peripherals, with a RISUP block instantiated in front of its configuration port to filter configuration accesses. The programming of these RISUP blocks (in the RIFSC) uses the same index as the IAC.

Indexes 128 and above are assigned to RIF components and RIF-aware peripherals. These peripherals can block illegal accesses to their configuration registers (without RISUP).

For RIF-aware peripherals protecting a memory (RISAF), a secure privileged application can obtain, in the peripheral, more details about the cause of the illegal access event:

• • The illegal access status register (xx_IASR) indicates if it is a configuration access error (CAEF= 1), or/and a system bus access error (IAEF = 1).
• • The illegal access error status register (xx_IAESR) and the illegal address register (xx_IADDR) give detailed information on the system bus access error.

The IAC interrupt handler must clear IAFi in IAC_ISR before clearing the error flag(s) in the firewall peripheral xx (using xx_IACR register). Otherwise, an illegal access can occur between clearing the flags in the firewall and clearing the flag in the IAC, and the application is unaware of this error.

8.5 IAC interrupts

The RIF interrupt management in the IAC is summarized in Table 30 .

Note: Only secure privileged application can enable, read, and clear illegal access interrupts. If there is an illegal access to the IAC itself, the status flag corresponding to the IAC index in Section 8.3 is set.

Table 30. IAC interrupt request

8.6 IAC registers

All IAC registers are accessed only by words (32 bits).

8.6.1 IAC interrupt enable register x (IAC_IERx)

Address offset: 0x000 + 0x4 * x (x = 0 to 5)

Reset value: 0x0000 0000

Secure privileged, read and write only.

Bits 31:0 IAIE{i + 32 * x} : Illegal access interrupt enable for peripheral {i + 32 * x} (i = 0 to 31)

Each bit is set to unmask illegal access events from peripheral {i + 32 * x}.

0: Illegal access event from peripheral does not generate interrupt (masked).

1: Illegal access event from peripheral can generate interrupts (unmasked).

8.6.2 IAC interrupt status register x (IAC_ISRx)

Address offset: 0x080 + 0x4 * x (x = 0 to 5)

Reset value: 0x0000 0000

Secure privileged, read only.

Bits 31:0 IAF{i + 32 * x} : Illegal access interrupt enable for peripheral {i + 32 * x} (i = 0 to 31)

Each bit is set when an illegal access event occurs in the peripheral {i + 32 * x} (see Section 8.3 for details). This bit is cleared when the corresponding IAF bit is set in IAC_ICRx.

0: No illegal access event detected for the peripheral (since reset or the last time this bit was cleared).

1: At least one illegal access event has been detected for the peripheral (since the last time this bit was cleared).

8.6.3 IAC interrupt clear register x (IAC_ICRx)

Address offset: 0x100 + 0x4 * x (x = 0 to 5)

Reset value: 0x0000 0000

Secure, privileged write only.

Bits 31:0 IAF{i + 32 * x} : Illegal access flag clear for peripheral {i + 32 * x} (i = 0 to 31)

Setting each bit clears the status flag of the illegal access event {i + 32 * x} in IAC_ISRx.

0: IAF {i + 32 * x} flag status not affected

1: IAF {i + 32 * x} flag status cleared in IAC_ISRx

8.6.4 IAC ILAC input status register x (IAC_IISRx)

Address offset: 0x36C + 0x4 * x (x = 0 to 5)

Reset value: 0xFFFF FF7F, 0x77FF FFFF, 0x77DF F03B, 0x0000 05FF, 0x7BEF FFEF, 0x0000 0000

Bits 31:0 ILACIN{i + 32 * x} : Illegal access input {i + 32 * x} (i = 0 to 31)

0: ILAC input {i + 32 * x} to IAC not present

1: ILAC input {i + 32 * x} to IAC present

8.6.5 IAC register map

Table 31. IAC register map and reset values

Refer to Section 2.3: Memory organization for the register boundary addresses.