Protection Personalities

This section describes the Protection personalities available in the Device Configurator.

In the default device configuration - By default, Protection level is set to 'Non-Secure' and PPC (Peripheral Protection Controllers) configuration is automatically configured to Non-secure Domain.

Configure Protection Level

User can change the protection level by clicking on the Protection Resource in the device configurator and select the target protection level from the parameters display on the right side. By selecting 'Secure Services + Peripherals' and 'Custom Security' user can customize PPC cofiguration for different PPC regions. Here is the brief description of various protection levels

• Non-Secure: All PPC regions are assigned to the M33_M55 protection domain and accessible to both cores.
• Secure Services: PPC regions required by secure services are assigned to the M33_S protection domain by default and only accessible to the M33 secure core.
• Secure Services + Peripherals: PPC regions required by secure services and peripherals are assigned to the M33_S protection domain by default and only accessible to the M33 secure core. Related regions are grouped together under one name and all share a security domain.
• Custom Security: All PPC regions are assigned to the M33_M55 protection domain by default and accessible to both cores. Each region can be assigned to different security domains independently.

Enable Secure Enclave

When the Secure Enclave option is enabled, user can use secure enclave runtime services. PPC regions required by secure enclave runtime are assigned to M33_S protection domain and only accessible to the M33 secure core.

PPC (Peripheral Protection Controllers) Personalities

There are two PERI instances listed under Peripheral Protection Controller (PPC) each consisting of several PPC regions. When user selects protection level as 'Secured Services + Peripherals' PPC ensures that peripherals are only accessed by the CPUs in matching security states. The following section will demonstrate the 'Secured Services + Peripherals' flow

The configurator warns of locations where two peripherals are connected but cross a security boundary. Many of these have suggested fixes.

If desired, you can disable the warnings under the Protection configuration’s Validation option by selecting 'None.'

Protection Domains

The Protection Domain personality allows you to configure security settings for device memory:

There are a number of default protection domains that are available for memory regions to select from. Users are also able to configure their own protection domains with settings they would like to apply to memory regions. Once a memory region selects a protection domain, it inherits the traits that protection domain is configured with, including security access settings and configuration settings for the MPC, SAU, and other security components.

Note

Users cannot modify the default protection domains. The only exception to this is within Custom Security mode in which case the User can enable/disable the access for the Debugger PC within the M33S default domain. This can be done by enabling/disabling a checkbox in the top level Protection resource. In other cases, Users must create their own protection domain and apply their desired settings.

Users must not assign the "reserved" protection domain to any user-defined memory regions. The "reserved" protection domain is for internal Device configurator use only. No code or configuration will be generated for memory regions assigned to this domain.

SAU (Security Attribution Units)

The Security Attribution Units (SAU) personality displays the current SAU security settings for device memory:

The display values are automatically calculated based on the configuration of the memory regions within the Memory tab. Because the SAU has a limited number of regions, it is primarily used to configure regions within memory that are designated as ‘Non-Secure Callable’ by the protection domain that memory regions are associated with.

By default for the SAU, all memory is ‘Secure’; and non-secure code can not access it or call functions stored in this memory. By configuring the memory to be ‘Non-Secure Callable’, it grants non-secure code permission to only call and execute functions stored in this memory. Configuring memory to be ‘Non-Secure’ grants non-secure code permission to read and/or modify this memory and in addition to executing code. Note: As mentioned, SAU is primarily used to configure memory regions that are 'Non-Secure Callable'. Therefore, it will calculate which regions are 'Non-Secure Callable', and mark all other parts of memory as 'Non-Secure'. Other security components, like the MPC, are used to configure memory regions between 'Secure' and 'Non-Secure' protection settings.

The SAU personality is available in Secure cores. After configuring region(s), when saved, the Device Configurator generates a file ‘cycfg_sau.h’ with the function Cy_SauInit(void) for SAU configuration. This function has to be called from the secure core main() function.

MPU (Memory Protection Units)

The Memory Protection Units (MPU) personality is available for each core:

Each MPU has 8 regions that can be created and configured.

Due to caching differences, some cores might have limited caching options.

MPU can be configured in the System tab of the Device Configurator.

After enabling a MPU region, the ‘Base Address’ and ‘Size (bytes)’ should be configured. 'End address' is generated based on the Base Address and Size. Once done, there are a few options for region security:

• 'Privileged Access only' – if marked, only privileged code (supervisor) can access this region.
• ‘Writable’ – configures if this memory can be written to. If not set – this region is read-only.
• ‘Executable’ – specifies if the code stored in this region can be executed.
• ‘Device Memory’: – sets either whether this memory is device peripherals or not. If not set, next options are available:
  • ‘Non-Cacheable’: This option disables caching for the memory region. Every read or write to this region is directly sent to the memory or peripheral without involving the cache. Non-cacheable memory is often used for memory-mapped I/O (e.g., peripheral registers) where caching can cause stale data or delayed writes.
  • Note: The ‘Cacheable’ parameter is used to indicate to the hardware that the data in an MPU region might be cached, not necessarily that it is cached. Selecting an option other than ‘Non-Cacheable’ for a memory region that is inherently non-cacheable, such as the ITCM/DTCM memory regions, will be treated as if the Non-Cacheable option is the selected option.
  • ‘Write-Back Non-Transient’: In write-back caching, data writes are first stored in the cache. The data is written back to the main memory only when necessary (e.g., when the cache block is replaced). The term non-transient indicates that this cache line is expected to remain valid over time and isn’t just for temporary use. In write-back caching, data writes are first stored in the cache. The data is written back to the main memory only when necessary (e.g., when the cache block is replaced). The term non-transient indicates that this cache line is expected to remain valid over time and isn’t just for temporary use.
  • ‘Write-Back Transient’: Similar to write-back non-transient, but this option is intended for data that is only expected to be in the cache for a short time (i.e., transient data). The cached data is written back to memory only when necessary. This option is suitable for temporary data or buffers that are not frequently reused and can be safely evicted from the cache.
  • ‘Write-Through Non-Transient’: In write-through caching, every write to the cache is immediately mirrored (written through) to the main memory. Non-transient indicates that the data will remain relevant over time. This is useful when you need to ensure that memory always has the most up-to-date data, but still want to take advantage of cache reads. This setting is typically used for important data that should not be lost even if the cache is flushed.
  • ‘Write-Through Transient’: As with write-through non-transient, every write operation is immediately reflected in the main memory. The transient part suggests that this data is temporary and is likely to be replaced soon. This is typically used for short-lived data, where you want to ensure consistency between the cache and memory but expect the data to be replaced or discarded soon.

• If set, next options are available:

  • ‘Device-nGnRnE’: No Gathering, No Reordering, No Early Acknowledgment. This is the strictest option, ensuring that memory accesses happen exactly as issued, with no optimizations. This is ideal for device memory where the timing and order of transactions are critical.
  • ‘Device-nGnRE’: No Gathering, No Reordering, Early Acknowledgment. Early write acknowledgment is allowed, meaning the processor can continue executing after writing to the device memory without waiting for the write to complete. This can be beneficial for performance but may not be suitable for all devices.
  • ‘Device-nGRE’: No Gathering, Reordering allowed, Early Acknowledgment. This allows for reordering and early acknowledgment, which may improve performance but sacrifices the strict control over memory access order and timing that is usually needed for device memory.
  • ‘Device-GRE’: Gathering, Reordering, Early Acknowledgment. This is the most relaxed setting, allowing the processor to optimize memory transactions heavily. This is generally not suitable for most device memory interactions where precise control over access is needed.

  After saving, the settings will be generated to cycfg_mpu_cm33_s_0.c file for secure MPU or cycfg_mpu_cm33_ns_0.c/ cycfg_mpu_cm55_ns_0.c for non-secure cores in GeneratedSource folder.

  To apply then call Cy_MpuInit_cm33_ns_0()/Cy_MpuInit_cm55_ns_0()/Cy_MpuInit_cm33_s_0() function.

  MPC (Memory Protection Controller)

  The Memory Protection Controllers (MPC) personality allows you to configure MPC domain security settings for device memory:

  

  MPC personality

  This personality allows to configure MPC responce on assess violation of the Security Domains.