AT32UC3A3128 Atmel Corporation, AT32UC3A3128 Datasheet - Page 59

• Manufacturer Part Number: AT32UC3A3128
• Manufacturer: Atmel Corporation

Specifications of AT32UC3A3128

• Flash (kbytes): 128 Kbytes
• Pin Count: 144
• Max. Operating Frequency: 66 MHz
• Cpu: 32-bit AVR
• # Of Touch Channels: 32
• Hardware Qtouch Acquisition: No
• Max I/o Pins: 110
• Ext Interrupts: 110
• Usb Transceiver: 1
• Usb Speed: Hi-Speed
• Usb Interface: Device + OTG
• Spi: 6
• Twi (i2c): 2
• Uart: 4
• Lin: 4
• Ssc: 1
• Sd / Emmc: 1
• Graphic Lcd: No
• Video Decoder: No
• Camera Interface: No
• Adc Channels: 8
• Adc Resolution (bits): 10
• Adc Speed (ksps): 384
• Resistive Touch Screen: No
• Dac Channels: 2
• Dac Resolution (bits): 16
• Temp. Sensor: No
• Crypto Engine: No
• Sram (kbytes): 128
• Self Program Memory: YES
• External Bus Interface: 1
• Dram Memory: sdram
• Nand Interface: Yes
• Picopower: No
• Temp. Range (deg C): -40 to 85
• I/o Supply Class: 3.0 to 3.6
• Operating Voltage (vcc): 3.0 to 3.6
• Fpu: No
• Mpu / Mmu: Yes / No
• Timers: 6
• Output Compare Channels: 18
• Input Capture Channels: 12
• Pwm Channels: 12
• 32khz Rtc: Yes
• Calibrated Rc Oscillator: Yes

5. Secure State
5.1
5.2
32002F–03/2010
Basic concept
Typical use scenario
Revision 3 of the AVR32 architecture introduced a separate system state allowing execution of
secure or secret code alongside nonsecure code on the same processor. The secret code will
execute in the secure state, and therefore be protected from hacking or readout by the code
executing in the nonsecure state.
Customers not needing the secure state functionality can just leave the associated hardware
disabled, as it is by default, and the device will behave as previous versions of the AVR32UC.
The secure state architecture extension divides the memory space into two sections, a secure
section and a nonsecure section. The processor can be in one of two execution states, secure or
nonsecure. The SS bit in the Status Register indicates which mode the processor is in. If the
processor is in the secure state, it can access both secure and nonsecure memory spaces, but if
it is in the nonsecure state, only nonsecure memory sections can be accessed. The SS_ADRR
and SS_ADRF registers are used to configure the sizes of these secure sections. How the
SS_ADR registers map secure sections of the associated memories is determined by the indi-
vidual memories, but usually SS_ADR is programmed with a secure memory size starting from
the first address in the associated memory, ie. if SS_ADRF is programmed with the value 0x800,
the secure section of the flash contains the addresses from 0x8000_0000 to 0x8000_07FF. Any
sections of the RAM and Flash that are not in a secure section are considered nonsecure.
The processor can pass between the secure and nonsecure state by using dedicated sscall and
retss instructions. If an access to secure memory is attempted from nonsecure space, a bus
error exception is asserted and the access is aborted.
The secure state hardware support allows our customers to program their proprietary IP code
such as telecom stacks, DSP libraries etc into the secure section of the memories. This secret
code must be placed in a special secure section of the flash program memory, and locate its
secret data structures in a special secure section of the RAM. Thereafter a dedicated fuse in
non-volatile memory, called the Secure State Enable (SSE) fuse, is programmed. When set, this
fuse blocks all external access to the secure memories, both from debuggers and programs run-
ning in the nonsecure sections of the processor. The SSE fuse can only be erased by a full chip
erase, which will also erase all data in the memory secure sections.
This partially programmed device can then be sold to customers who will program their software
application into the nonsecure section of the memories. This software can communicate with the
secret IP code through a secure API provided by the secret code. This allows the application to
call routines in the secret software IP, however this IP is protected from hacking or unauthorized
copying. After the application has been programmed into the partially programmed device, the
security fuse in the flash is set, protecting the entire application from unauthorized readout by
any end user.
AVR32
59