Package: cysecuretools
This package contains security tools for creating keys, creating certificates, signing user applications, and provisioning Cypress MCUs.Table of ContentsPrerequisitesDocumentationInstalling packageSupported devicesInterface and UsagePSoC 64CYW20829XMC7100/7200LoggingInstalling libusb driverKnown issuesLicense and ContributionsHW/SW compatibilityPSoC 64Target/KitSilicon Revision1Silicon ID, Silicon Rev., Family IDCySecureTools VersionSecure FlashBoot VersionCyBootloader Version512Kcyb06xx5cy8cproto‑064b0s3A10xE70D, 0x12, 0x1054.2.04.0.2.18422.0.1.64412Mcyb06xxacy8ckit‑064b0s2‑4343wA10xE470, 0x12, 0x1024.2.04.0.3.23192.0.2.8102cys06xxacy8ckit‑064s0s2‑4343wA10xE4A0, 0x12, 0x024.2.04.0.3.23192.0.2.81021Mcyb06xx7cy8cproto‑064s1‑sbcy8cproto‑064b0s1‑blecy8cproto‑064b0s1‑ssaB30xE262, 0x24, 0x100
        0xE261, 0x24, 0x1004.2.04.0.2.18422.0.0.4041CYW20829Target/KitSilicon Revision1Silicon ID, Silicon Rev., Family IDCySecureTools VersionBootROM VersionRAM Applications Versioncyw20829A00xEB40, 0x11, 0x1104.2.01.0.0.71201.0.0.2857cyw20829B00xEB43, 0x21, 0x1104.2.01.2.0.82741.2.0.30731Specify--revoption for older revision of the silicon (e.g.$ cysecuretools -t cyw20829 --rev a0 <COMMAND>). Using the latest revision does not require specifying the option.PrerequisitesGeneralPython 3.6 or laterFor PSoC 64 devicesInstalled Cypress OpenOCDEnsure the KitProg3 programming mode isCMSIS-DAP BulkEnsure the power selection jumper is set to provide 2.5 V to the power supply pin related to eFuse power. This voltage level is required to blow eFusesFor CYW20829 devicesInstalled Cypress OpenOCDEnsure the KitProg3 programming mode isCMSIS-DAP BulkEnsure the power selection jumper is set to provide 2.5 V to the power supply pin related to eFuse power. This voltage level is required to blow eFusesDocumentationPSoC64 Secure MCU Secure Boot SDK User GuideChangelogInstalling PackageInvokepip installfrom the command line:$pipinstallcysecuretoolsTo update the already installed package:$pipinstall--upgrade--force-reinstallcysecuretoolsSupported devicesUsedevice-listcommand for output of the supported devices list.$cysecuretoolsdevice-listInterface and UsagePSoC 64SeeREADME_PSOC64.mdCYW20829SeeREADME_CYW20829.mdXMC7100/7200SeeREADME_XMC7XXX.mdLoggingEvery time the tool is invoked, a new log file is created in thelogsdirectory of the project. By default, the console output has INFO logging severity. The log file contains the DEBUG logging severity.Known issuesUsing the policy from version 4.0.0 in projects created by version 4.1.0 causes the CY_FB_INVALID_IMG_JWT_SIGNATURE error during re-provisioning on PSoC64-2M devices:...
  ERROR : SFB status: CY_FB_INVALID_IMG_JWT_SIGNATURE: Invalid image certificate signature. Check the log for detailsWorkaround:Open the policy file.Navigate to section 1 of theboot_upgrade/firmware.Setboot_authandbootloader_keysas follows:"boot_auth": [
    3
],
"bootloader_keys": [
    {
        "kid": 3,
        "key": "../keys/cy_pub_key.json"
    }
]During the installation of the package viapipon Mac OS Big Sur, the following exception is raised:...
  distutils.errors.DistutilsError: Setup script exited with error: SandboxViolation:
  mkdir('/private/var/root/Library/Caches/com.apple.python/private/tmp/easy_install-y8c1npmz', 511) {}

  The package setup script has attempted to modify files on your system
  that are not within the EasyInstall build area, and has been aborted.

  This package cannot be safely installed by EasyInstall, and may not
  support alternate installation locations even if you run its setup
  script by hand.  Please inform the package's author and the EasyInstall
  maintainers to find out if a fix or workaround is available.Solution:Upgrade thepippackage running the following command from the terminal:python3 -m pip install --upgrade pip.License and ContributionsThe software is provided under the Apache-2.0 license. Contributions to this project are accepted under the same license.
This project contains code from other projects. The original license text is included in those source files.ChangelogAll notable changes to this project will be documented in this file.5.0.0ChangedRemoved pyOCD support. OpenOCD is used as a default On-Chip debugger for all platformsHigh-level API module refactoringAddedSupport for XMC7100, XMC7200 devices4.2.0AddedSupport for CYW20829 B0 silicon revisionMulti-image NV counter for CYW20829Transition PSoC 64 devices to RMA LCSOpen PSoC 64 devices in RMA LCS for debuggingOpenOCD autodiscovery in ModusToolbox directoryAdd SW/HW compatibility table to the readmeChangedTargetcyw20829is used for the latest silicon revision. For the previous silicon revision (A0) add--revoption in the command line (-t cyw20829 --rev a0)4.1.0AddedOpenOCD support for PSoC 64 devicesCreating update package in the unsigned image (extend-imagecommand)ChangedFixed installation failure using pip 22.1CyBootloader 2.0.2.8102 for PSoC 64 2M:Improved performance of SWAP algorithmImage certificate signed with the Infineon key (id=3)Use Infineon key (id=3) for bootloader in the policy files4.0.0AddedSupport of CYW20829 devicesSupport Python 3.10Signing images with HSMChangedSeparated PSoC 64 and CYW20829 devices CLIUpdated PSoC 64 CyBootloader for 512k and 2M:added "reset_after_failure" featuredecreased boot timeProtect PSA API from NSPE in PSoC 64 2M-S0 policyPrevent signing of already signed imagesChange MCUboot image header padding to erase valueUse CyBootloader from the project directory if the project existsUpdated dependencies packages to the latest versionsUse pyocd 0.32.33.1.1ChangedFixed installation failure on macOS Big Sur and Apple M1 chipFixed installation failure in Python 3.93.1.0AddedSCRATCH with Status Partition swap modeSmall image slots support in the external memory3.0.0AddedImage SWAP using Status PartitionChangedCyBootloader 2.0Secure Flash Boot 4.0.2 support2.1.0AddedSupport PSoC64 1MNew command to read device die IDOptionally add boot record to the signed imageNew policy validators (address overlaps between images and bootloader, slots address alignment with the SMPU address limits, DAP closure, monotonic counter)Log the device response JWT during the provisioning processChangedFixed issue with using group private keyUse pyocd 0.27.32.0.0AddedSupport PSoC64 2M, PSoC64 512KCommand line interfaceEncrypted programmingSingle-image and multi-image policyChangedUpdate provisioning according to new Secure Flash Boot functionality (update system calls, reprovisioning, encrypted image support)New CyBootloaders (CY8CKIT-064B0S2-4343W, CY8CKIT-064S0S2-4343W, CY8CPROTO-064B0S3)Use pyocd 0.27.0