PSoC 64 Secure Boot MCU - Components101

PRELIMINARYPSoC 6 MCU:CYB06445LQI-S3D42 DatasheetThis product line has up to 512 KB of flash; however 64 KB is reserved for system usage, leaving 448 KB for applications. It also hasup to 256 KB of SRAM; however 104 KB is reserved for system usage, leaving 152 KB for applications.The PSoC 64 devices offer an immutable, RoT-based boot-up process, which allows only signed applications to be booted up. Inaddition, secure user assets such as keys and debug policies can be securely provisioned on the device in an HSM environment andmade immutable The PSoC 64 line of Secure MCUs also allow for secure Root-of-Trust based cryptography services which can beaccessed using System calls.There are three debug access ports, one each for CM4 and CM0 , and a system port. All debug and test interfaces can be permanentlydisabled during final production provisioning to avoid any malicious reprogramming or reading of flash and register contents.The PSoC 6 devices include extensive support for programming, testing, debugging, and tracing both hardware and firmware. Alldevice interfaces can be permanently disabled (device security) for applications concerned about attacks due to a maliciouslyreprogrammed device or attempts to defeat security by starting and interrupting flash programming sequences. All programming,debug, and test interfaces are disabled when maximum device security is enabled. The security level is settable by the user.Complete debug-on-chip functionality enables full device debugging in the final system using the standard production device. It doesnot require special interfaces, debugging pods, simulators, or emulators. Only the standard programming connections are requiredto fully support debug.The ModusToolbox Integrated Development Environment (IDE) provides fully integrated programming and debug support for thesedevices. The SWJ (SWD and JTAG) interface is fully compatible with industry-standard third party probes. With the ability to disabledebug features, with very robust flash protection, and by allowing customer-proprietary functionality to be implemented in on-chipprogrammable blocks, PSoC 6 provides a very high level of security.Document Number: 002-28785 Rev. *BPage 6 of 68

PSoC 6 MCU:CYB06445LQI-S3D42 DatasheetPRELIMINARYFunctional DescriptionThe following sections provide an overview of the features,capabilities and operation of each functional block identified inthe block diagram in Figure 2. For more detailed information,refer to the following three references. Peripheral Driver Library (PDL) Application ProgrammingInterface (API) Reference Manual.PDL provides low-level drivers for each resource in the device, and supports the entire PSoC 6 MCU portfolio. PDL isan element of the PSoC 6 SDK, which is installed as part ofModusToolbox. With ModusToolbox installed, you can accessthe PDL API reference manual either from the Documentationtab of the Quick Panel, or you can navigate directly to it at install directory \ModusToolbox version \libraries\psoc6sw- version \docs. UsingPDL should be the primary means of interacting with thePSoC 6 MCU hardware. CM0 is the secondary CPU; it is used to implement system callsand device-level security, safety, and protection features. CM0 provides a secure, uninterruptible boot function. This guaranteesthat post boot, system integrity is checked and memory andperipheral access privileges are enforced.CM0 implements the Armv6-M Thumb instruction set (definedin the Armv6-M Architecture Reference Manual).The CPUs have the following power draw, at VDD 3.3 V andusing the internal buck regulator:Table 1. Active Current Slope at VDD 3.3 V Using the InternalBuck RegulatorSystem Power ModeULPArchitecture Technical Reference Manual (TRM)The architecture TRM provides the detailed description ofeach resource in the device. This is the next reference to useif it is necessary to understand the operation of the hardwarebelow the software provided by PDL. It describes the architecture and functionality of each resource and explains theoperation of each resource in all modes. It provides specificguidance regarding the use of associated registers. of CM4. Thus, for CM4 running at 150 MHz, CM0 andperipherals are limited to 75 MHz.Register Technical Reference ManualThe register TRM provides the complete list of all registers inthe device. It includes the breakdown of all register fields,their possible settings, read/write accessibility, and defaultstates. All registers that have a reasonable use in typical applications have functions to access them from within PDL.Note that ModusToolbox and PDL may provide software default conditions for some registers that are different from andoverride the hardware defaults.CPU and Memory SubsystemCPULPCortex-M0 15 A/MHz 20 A/MHzCortex-M422 A/MHz 40 A/MHzThe CPUs can be selectively placed in their Sleep and DeepSleep power modes as defined by Arm.Both CPUs have nested vectored interrupt controllers (NVIC) forrapid and deterministic interrupt response, and wakeup interruptcontrollers (WIC) for CPU wakeup from Deep Sleep powermode.The CPUs have extensive debug support. PSoC 6 has a debugaccess port (DAP) that acts as the interface for deviceprogramming and debug. An external programmer or debugger(the “host”) communicates with the DAP through the deviceserial wire debug (SWD) or Joint Test Action Group (JTAG)interface pins. Through the DAP (and subject to device securityrestrictions), the host can access the device memory andperipherals as well as the registers in both CPUs.Each CPU offers debug and trace features as follows:PSoC 6 has multiple bus masters, as Figure 2 shows. They are:CPUs, DMA controllers, SD Host controllers, and a Crypto block.Generally, all memory and peripherals can be accessed andshared by all bus masters through multi-layer Arm AMBAhigh-performance bus (AHB) arbitration. Accesses betweenCores can be synchronized using an inter-processorcommunication (IPC) block. CM4 supports six hardware breakpoints and four watchpoints,4-bit embedded trace macrocell (ETM), serial wire viewer(SWV), and printf()-style debugging through the single wireoutput (SWO) pin. CM0 supports four hardware breakpoints and two watchpoints, and a micro trace buffer (MTB) with 4 KB dedicatedRAM.CPUsPSoC 6 also has an Embedded Cross Trigger for synchronizeddebugging and tracing of both CPUs.There are two Arm Cortex CPUs:The Cortex-M4 (CM4) has single-cycle multiply, a floating-pointunit (FPU), and a memory protection unit (MPU). It can run at upto 150 MHz. This is the main CPU, designed for a short interruptresponse time, high code density, and high throughput.CM4 implements a version of the Thumb instruction set basedon Thumb-2 technology (defined in the Armv7-M ArchitectureReference Manual).The Cortex-M0 (CM0 ) has single-cycle multiply, and an MPU.It can run at up to 100 MHz; however, for CM4 speeds above100 MHz, CM0 and bus peripherals are limited to half the speedDocument Number: 002-28785 Rev. *BInterruptsPSoC 6 has 122 system and peripheral interrupt sources andsupports interrupts and system exception on both CPUs. CM4has 122 interrupt request lines (IRQ), with the interrupt source ‘n’directly connected to IRQn. CM0 has eight interrupts IRQ[7:0]with configurable mapping of one or more interrupt sources toany of the IRQ[7:0]. CM0 also supports eight internal (softwareonly) interrupts.Each interrupt supports configurable priority levels (eight levelsfor CM4 and four levels for CM0 ). Up to four system interruptscan be mapped to each of the CPUs' non-maskable interruptsPage 7 of 68

PSoC 6 MCU:CYB06445LQI-S3D42 DatasheetPRELIMINARY(NMI). Up to 39 interrupt sources are capable of waking thedevice from Deep Sleep power mode using the WIC. Refer to thetechnical reference manual for details.Direct Memory Access (DMA) ControllersPSoC 64 has three DMA controllers, which supportCPU-independent accesses to memory and peripherals. Two ofthem have 22 channels each and the third has 2 channels. Thedescriptors for DMA channels can be in SRAM or flash.Therefore, the number of descriptors are limited only by the sizeof the memory. Each descriptor can transfer data in two nestedloops with configurable address increments to the source anddestination. The size of data transfer per descriptor varies basedon the type of DMA channel. Refer to the technical referencemanual for detail.MemoryIn the PSoC 64 line of processors, the SMPUs are set up bydefault and cannot be modified by the user. See section 8 in theArchitecture TRM for the protection context assignment.PSoC 6 contains flash, SRAM, ROM, and eFuse memory blocks. This product line has up to 512 KB of flash; however 64 KB isreserved for system usage, leaving 448 KB for applicationsthat is organized in 256-KB sectors. There are also two 32-KBflash sectors: Auxiliary flash (AUXflash), typically used for EEPROM emulation Supervisory flash (Sflash). Data stored in Sflash includes device trim values, Flash Boot code, and encryption keys. Afterthe device transitions into the Secure lifecycle stage, Sflashcan no longer be changed.The flash uses 128-bit-wide accesses to reduce power. Writeoperations can be performed at the row level. A row is 512bytes. Read operations are supported in both System LowPower and Ultra-Low Power modes, however write operations may not be performed in System Ultra-Low Powermode.Cryptography Accelerator (Crypto)This subsystem consists of hardware implementation andacceleration of cryptographic functions and random numbergenerators. The Crypto subsystem supports the following: Encryption/Decryption Functions Data Encryption Standard (DES) Triple DES (3DES) Advanced Encryption Standard (AES) (128-, 192-, 256-bit) Elliptic Curve Cryptography (ECC) RSA cryptography functions Hashing functions Secure Hash Algorithm (SHA) SHA1 SHA224/256/384/512 Message authentication functions (MAC) Hashed message authentication code (HMAC) Cipher-based message authentication code (CMAC) 32-bit cyclic redundancy code (CRC) generator Random number generators Pseudo random number generator (PRNG) True random number generator (TRNG)The flash controller has two caches, one for each CPU. Eachcache is 8 KB, with 4-way set associativity. Protection units support memory and peripheral accessattributes including address range, read/write, code/data,privilege level, secure/non-secure, and protection context.Protection units are configured at secure boot to control accessprivileges and rights for bus masters and peripherals.Up to eight protection contexts (secure boot is in protectioncontext 0) allow access privileges for memory and systemresources to be set by the secure boot process per protectioncontext by bus master and code privilege level. Multipleprotection contexts are supported on a single CPU.Document Number: 002-28785 Rev. *BSRAMIt also has up to 256 KB of SRAM; however, 104 KB is reserved for system usage, leaving 152 KB for applications.Power control and retention granularity is implemented in 32KB blocks allowing the user to control the amount of memoryretained in Deep Sleep. Memory is not retained in Hibernatemode. ROMThe 64-KB ROM, also referred to as the supervisory ROM(SROM), provides code (ROM Boot) for several system functions. The PSoC 6 MCU ROM contains device initialization,flash write, security, eFuse programming, and other system-level routines. ROM code is executed only by the CM0 CPU, in protection context 0. A system function can be initiated by either CPU, or through the DAP. This causes an NMIin CM0 , which causes CM0 to execute the system function.Protection UnitsPSoC 64 has multiple types of protection units to controlerroneous or unauthorized access to memory and peripheralregisters. CM4 and CM0 have Arm MPUs for protection at thebus master level. Other bus masters use additional MPUs.Shared memory protection units (SMPUs) help implementmemory protection for memory/ resources that are sharedamong multiple bus masters. Peripheral protection units (PPU)are similar to SMPUs but are designed for protecting theperipheral register space.Flash eFuseA one-time-programmable (OTP) eFuse array consists of1024 bits, of which 512 are reserved for system use, such asdie ID, device ID, initial trim settings, device life cycle, andsecurity settings. The remaining bits are available for storingsecurity key information, hash values, unique IDs or similarcustom content.Each fuse is individually programmed; once programmed (or“blown”), its state cannot be changed. Blowing a fuse transitions it from the default state of 0 to 1. To program an eFuse,VDDIO0 must be at 2.5 V 5%, at 14 mA.Because blowing an eFuse is an irreversible process, programming is recommended only in mass production programming under controlled factory conditions. For more information, see PSoC 6 MCU Programming Specifications.Page 8 of 68

PRELIMINARYTable 2. Address Map for CM4 and CM0 (continued)Boot CodeTwo blocks of code, ROM Boot and Flash Boot, arepre-programmed into the device and work together to providedevice startup and configuration, basic security features,life-cycle stage management and other system functions. ROM BootAddress RangeFlash BootFlash boot is firmware stored in SFlash that ensures that onlya validated application may run on the device. It also ensuresthat the firmware image has not been modified, such as by amalicious third party.Flash boot:Is validated by ROM Boot Runs after ROM Boot and before the user application Verifies the integrity of the user application Enables system calls Configures the Debug Access Port Launches the user application in the CM0 (CM4 forsingle-CPU devices).If the user application cannot be validated, then flash bootensures that the device is transitioned into a safe state.Both CPUs have a fixed address map, with shared access tomemory and peripherals. The 32-bit (4 GB) address space isdivided into the regions shown in Table 2. Note that code can beexecuted from the code and SRAM regions.Table 2. Address Map for CM4 and CM0 Address RangeUseDeviceDevice-specific systemregisters.The device memory map shown in Table 3 applies to both CPUs.That is, the CPUs share access to all PSoC 6 MCU memory andperipheral registers. Note that code can be executed from theCode, SRAM, and External RAM regions.Table 3. Internal Memory Address Map for CM4 and CM0 Address RangeMemory Type0x0000 0000 – 0x0000 FFFFSROM, initial ROMboot code64 KB0x0800 0000 – 0x0802 5FFF0x0802 6000 - 0x0803 FFFFApplication SRAMSystem SRAMUp to 152 KB104 KB0x1000 0000 – 0x1006 FFFF0x1007 0000 - 0x1007 FFFF Memory MapNamePrivate Provides access to0xE000 0000 – 0xE00F FFFF Peripheral peripheral registers withinBusthe CPU core.0xE010 0A000 – 0xFFFF FFFFOn a device reset, the boot code in ROM is the first code toexecute. This code performs the following: Integrity checks of flash boot code Device trim setting (calibration) Setting the device protection units Setting device access restrictions for secure life-cycle statesROM cannot be changed and acts as the Root of Trust in asecure system. PSoC 6 MCU:CYB06445LQI-S3D42 DatasheetSizeApplication flashUp to 448 KBSecure Code Flash 64 KBUsed for secure boot,secure bootloader, andsystem callsAuxiliary Flash, can be0x1400 0000 – 0x1400 7FFF used for EEPROM em- 32 KBulation0x1600 0000 – 0x1600 7FFFSupervisory Flash, for32 KBsecure accessSystem ResourcesPower SystemThe power system provides assurance that voltage levels are asrequired for each respective mode and will either delay modeentry (on power-on reset (POR), for example) until voltage levelsare as required for proper function or generate resets (brown-outdetect (BOD)) when the power supply drops below specifiedlevels. The design guarantees safe chip operation betweenpower supply voltage dropping below specified levels (forexample, below 1.7 V) and the reset occurring. There are novoltage sequencing requirements.NameUse0x0000 0000 – 0x1FFF FFFFCodeProgram code region. Datacan also be placed here. Itincludes the exceptionvector table, which starts ataddress 0.The VDD supply (1.7 to 3.6 V) powers an on-chip buck regulatoror an LDO, selectable by the user. In addition, both the buck andthe LDO offer a selectable (0.9 or 1.1 V) core operating voltage(VCCD). The selection lets users choose between two systempower modes:0x2000 0000 – 0x3FFF FFFFSRAMThis region is not supportedin PSoC 6. System Low Power (LP) operates VCCD at 1.1 V and offers highperformance, with no restrictions on any of the device configurations. System Ultra Low Power (ULP) operates VCCD at 0.9 V forexceptional low power results, but imposes limitations onmaximum clock speeds.All peripheral registers.Code cannot be executed0x4000 0000 – 0x5FFF FFFF Peripheral from this region. CM4bit-band in this region is notsupported in PSoC 6.0x6000 0000 – 0x9FFF FFFFExternalRAMSMIF or Quad SPI, (see theQuad-SPI (QSPI)/SerialMemory Interface (SMIF)section). Code can beexecuted from this region.0xA000 0000 – 0xDFFF FFFFExternalDeviceNot used.Document Number: 002-28785 Rev. *BAn additional, backup domain adds an “always on” functionalityusing a separate power domain supplied by a backup supply(VBACKUP) such as a battery or supercapacitor. It includes areal-time clock (RTC) with alarm feature, supported by nagement IC (PMIC) control.Page 9 of 68

PRELIMINARYPower ModesPSoC 6 MCU can operate in four system and three CPU powermodes. These modes are intended to minimize the averagepower consumption in an application. For more details on powermodes and other power-saving configuration options, see theapplication note, AN219

PSoC 6 MCU: CYB06445LQI-S3D42 Datasheet Development Ecosystem PSoC 6 MCU Resources Cypress provides a wealth of data at www.cypress.com to help you select the right PSoC device and quickly and effectively integrate it into your design. The following is an abbreviated, hyper