Infineon PSC3 Secure Debug

The PSoC Control C3 series supports secure debug to control access to the device's debug interface. This article describes how to configure J-Link to authenticate access to the Cortex-M33 (CM33) access port (AP).

Provisioning (Locking the CM33 AP)

Device provisioning should be performed using Infineon's ModusToolbox tools, such as the ModusToolbox Edge Protect Security Suite. For more information, refer to Infineon's official documentation.

Unlocking the CM33 AP

J-Link supports the following approaches to unlocking the CM33 AP:

• J-Link script files (recommended): Provide the most comprehensive support, including authentication during connection and reset sequences, as well as time-critical Test Mode Acquisition. They can be used with J-Link tools and third-party IDEs that support J-Link script files.
• Device Provisioner: Provides a standalone tool for authenticating access to the CM33 AP.
• Generic support: Provides built-in authentication for certain device variants, including PSC3xxE and PSC3xxF, without requiring a J-Link script file.

Using J-Link script files

The J-Link script files provided by SEGGER perform authentication automatically during the J-Link connection and reset sequences. They enable authentication with J-Link tools and third-party IDEs that support J-Link script files, and also support time-critical Test Mode Acquisition. CM33 access port authentication is implemented in the PSC3Mx_DebugAuth.JLinkScript files listed under J-Link script files. To use this feature, select the script for your device, configure it with the debug token and certificate type, and include it in your development environment as described below.

Setup

1. Download the J-Link script file for your device from J-Link script files.
2. Download the SEGGER Bin2C converter.
3. Convert your debug_token.bin file by running:
   • Bin2C.exe debug_token.bin
   • This generates debug_token.c in the current directory.
4. Open debug_token.c and copy the contents of the _acdebug_token array into the _aDebugCert array in the downloaded J-Link script file.
   • Omit the final 0x00 byte appended by Bin2C as a null terminator. This byte is not part of the debug token.
5. In the J-Link script file, set DEBUG_CERT_TYPE to the value corresponding to your certificate type:
   • DEBUG_CERT_TYPE_OEM for an OEM certificate.
   • DEBUG_CERT_TYPE_PROT_FW for a protected firmware certificate.
6. Configure your development environment to use the modified J-Link script file. For instructions, refer to Using J-Link script files.

Once configured, J-Link automatically performs authentication during connection and reset sequences.

J-Link script files

• File:PSC3M5 DebugAuth.JLinkScript
• File:PSC3M6 DebugAuth.JLinkScript
• File:PSC3M7 DebugAuth.JLinkScript
• File:PSC3M8 DebugAuth.JLinkScript

Using Device Provisioner

Device Provisioner is a dedicated tool included in the J-Link Software and Documentation Pack. It can be used to unlock the CM33 AP of PSoC Control C3 devices. For more information, refer to Infineon PSOC Control C3 Debug Port Authentication.

Generic support

J-Link provides built-in support for CM33 access port authentication for the following device variants, without requiring a custom J-Link script file:

• PSC3xxF
• PSC3xxE

Note:
These device variants do not support Test Mode Acquisition.

Setup

• The default key type is OEM_ROT_KEY_SIGNED. If support for PROT_FW_ROT_KEY_SIGNED is required, please contact SEGGER.
• To enable authentication, place the debug token at the following location so that the J-Link software can find it:
• [J-Link installation folder]/packets/debug_token.bin