The TZC-400 provides the following key features.
- The ability to define up to eight address regions in the address map.
- A default base region to cover all remaining portions of the address map.
- Software programmable security access permissions for each address region through an APB4 interface. This includes the default base region, Region 0.
- Filter units only allow data transfer between an ACE-Lite master and an ACE-Lite slave if the security status of the ACE-Lite transaction and its identity match the security settings of the memory region it addresses.
- Common region configuration register settings that are shared between multiple filter units.
- The filter units can support asynchronous clocks that are independent of each other and of the control unit that is clocked by the APB interface clock.
Dual read access path:
Fast path for low-latency accesses but with limited outstanding access support.
- Normal path for accesses with a much higher outstanding access support.
- Identity-based filtering of Non-secure accesses.
- Reporting and interrupt signaling that is configurable from software to manage failed permission checks.
- Speculative accesses to support QVN and fast path. This feature can be disabled.
- AXI low-power interface for each clock domain.
- Gate keeper to allow or block accesses to each filter unit.
- Support for 256 outstanding transactions on the normal paths.