Module authorization 

Whole-descriptor receive authorization (Atlas). Whole-descriptor receive authorization, before any AXI write is issued.

Routing answers where a packet goes. This guard answers whether its trusted ingress may modify the entire requested interval there. The fabric must latch the verdict at descriptor acceptance and drain rejected packets without issuing writes. Checking each beat after forwarding earlier beats is too late.

Windows are trusted configuration, never supplied by the packet. One window describes one contiguous entry owned by one source at one destination. Use separate windows for interleaved slots; adjacent windows are not combined to authorize a crossing write. Configuration changes require a drained fabric. Validate wider host fields before narrowing to these port widths. Malformed windows grant nothing individually; another valid matching window may still authorize. Physical bounds concern the requested bytes, not a global audit of unused configured address space. The fabric must enforce actual length, strobes and framing against the accepted descriptor as it forwards data. This guard does not provide atomic publication or non-equivocation.

Structs

OwnedCheck

One write descriptor, from any ingress, as the trusted ingress latched it.

OwnedWindow

A WriteWindow with an owner epoch and the ingress classes it admits (N21). Every write into protected memory, whatever its path, is checked against these windows by authorize_owned_write.

WriteCheck

Decoded descriptor plus trusted fabric configuration.

WriteVerdict

Authorization outcome. The fabric counts rejected descriptors once on acceptance; this combinational guard has no counter or handshake state.

WriteWindow

One trusted source-owned contiguous interval, relative to destination base.

Constants

INGRESS_DEBUG

Ingress class: debug/JTAG/ILA write access.

INGRESS_DMA

Ingress class: a card-local DMA engine.

INGRESS_HOST

Ingress class: the PCIe host (driver/MMIO) path.

INGRESS_REMOTE

Ingress class of a write: a remote replica’s fabric/RoCE connection.

Functions

authorize_owned_write

Authorize one descriptor against owner-epoch windows, for every ingress class. Reasons as authorize_write, plus 6 for a stale owner epoch: some window matches source, class and interval, but under another epoch. Remote writes require distinct in-range members (as authorize_write); local classes require only an in-range destination.

authorize_write

Authorize the complete interval using subtraction after explicit size checks. Intermediate unsigned differences may wrap, but never authorize on their own: every comparison is paired with the corresponding lower-bound/size predicate.