Intel® Arria® 10 Core Fabric and General Purpose I/Os Handbook

ID 683461
Date 10/25/2023
Public
Document Table of Contents

7.5.2. Security Modes

Table 106.  Security Modes Available in Arria® 10 Devices
Note: For additional details on these instructions or how to burn the fuse for each mode, contact your Intel technical support. Alternatively, you can use the Qcrypt tool to enable all of these design security modes. The Qcrypt tool provides an impermanent solution compared to the burning the fuse which has the one-time programming limitation.
Security Mode JTAG Instruction Security Feature
JTAG Secure40 EXT_JTAG_SECURE Allows only mandatory IEEE Std. 1149.1 BST JTAG instructions. See the Mandatory and Non-Mandatory IEEE Standard 1149.1 BST JTAG Instructions table.
Tamper Protection OTP_VOLKEY_SECURE Allows only configuration file encrypted with the correct key to be loaded into the Arria® 10 device. Unencrypted or wrong encryption key results in configuration failure.
JTAG Bypass EXTERNAL_JTAG_BYPASS Disables all the direct control from external JTAG pins or HPS JTAG. Compared to the JTAG Secure mode, devices in JTAG Bypass mode allow access to external JTAG pins or HPS JTAG interface through internal JTAG core.
Key Related Instruction Disable KEY_EXT_JTAG_DISABLE Disables all JTAG instructions related to AES key issued from the external JTAG pins.
HPS Configuration Only FORCE_HPS_CONFIG Disables the external JTAG pins from configuring or partially reconfiguring the device. Only HPS controls the configuration pins and the MSEL pins will be in passive mode.
HPS JTAG Bypass EXTERNAL_JTAG_BYPASS Bypasses the HPS JTAG controller and disables the HPS internal master control.
PR and Scrubbing Disable PR_SCRUBBING_DISABLE Disables partial reconfiguration and external scrubbing from external pins and HPS. Only the FPGA core can perform partial reconfiguration.
Volatile Key Lock VOLKEY_LOCK Locks the volatile key being zeroed-out or reprogrammed. However, you can erase the volatile key using KEY_CLR_VREG instruction. You can issue the VOLKEY_LOCK instruction only after volatile key is programmed into the device.
Volatile Key Disable VOLKEY_DISABLE Disables any future volatile key programming. If there is an existing volatile key programmed into the device, it will not be used to decrypt the configuration file.
Non-Volatile Key Disable OTP_DISABLE Disables any future non-volatile key programming. If there is an existing non-volatile key programmed into the device, it will not be used to decrypt the configuration file.
Test Disable Mode TEST_DISABLE Disables all test modes and all test-related JTAG instructions. This process is irreversible and prevents Intel from carrying out failure analysis.
40 Enabling the JTAG Secure or Test Disable mode disables the test mode in Arria® 10 devices and disables programming through the JTAG interface. This process is irreversible and prevents Intel from carrying out failure analysis.