Integrated in WKUP domain is the Device Management and Security Controller (WKUP_DMSC) which provides control over the device boot sequencing, device management, power management, and security. With the factory-sealed firmware, DMSC main functions include:
- Device management
- On-chip power management and wake-up control
- Device boot configuration and sequence
- Secure boot setup
- Decryption routines
- Firewall control for isolation and Security
- Runtime Security Management and resource allocation
Arm Cortex-M3 based DMSC acts as a system security master and protects critical security assets during run-time. As part of booting a High Security (HS) device, DMSC uses on-chip keys to establish root-of-trust and authenticate images to reinforce trust. DMSC controls the power management of device, hence is responsible to bring device cleanly out of reset and enforce clock and reset rules. DMSC power management functions are critical to bring device to low power modes and sense wakeup events to bring device back to active state. DMSC acts also as main boot processor and as such is the very first subsystem that is brought out of reset after device power-on-reset
Main components of the DMSC are:
- Arm Cortex-M3 processor core (ARMv7-M architecture profile)
- 160KB ROM to allow boot sequence, authentication and provide security service (M3 accessible only)
- Two separate local memory banks for Instruction code (I-code) and Data space (D-code) with single error correction and double error detection
- Firewall enabled 32-bit VBUSP CBASS interconnect
- Interrupt Aggregator with support of up to 80 interrupt inputs to the DMSC
- Four dual-mode 32-bit timers
- One RTI/WWDT module capable of issuing warm reset to the SoC
- DMSC control module - contains various control, configuration and status MMRs for power management functions
- Debug and trace related modules
- Security Manager module for device security management, device type control (GP, EMU, HS), emulation and JTAG control, and key management
- AES engine with 128, 192 and 256-bits support and DPA/EMA countermeasures