Fabric and sNVM Update Protection Locks

These locks prevent FPGA and sNVM from being erased and written with a new bitstream. These locks can be temporarily unlocked by matching the FlashLock (UPK1) passcode through JTAG or SPI interface.

When the lock is cleared (either because it was never set, or was temporarily unlocked by a passcode match), and you have provisioned a user encryption key (UEK1 or UEK2), you need to use the bitstream encrypted with one of the user encryption keys to update either the fabric or the sNVM.

In the Configure Security Wizard, the Update Policy is used to apply the FPGA fabric and the sNVM update protection lock bits.

Auto Programming, Auto Update, IAP Services, and Programming Recovery are disabled for update when the preceding lock bits are set. FlashLock/UPK1 unlocking is only available for JTAG and SPI Slave programming.

Figure 1. Update Policy Page in Configure Security Wizard