SPRUII0F May 2019 – June 2024 TMS320F28384D , TMS320F28384D-Q1 , TMS320F28384S , TMS320F28384S-Q1 , TMS320F28386D , TMS320F28386D-Q1 , TMS320F28386S , TMS320F28386S-Q1 , TMS320F28388D , TMS320F28388S
Secure Flash boot mode is similar to Flash boot mode in that the boot flow branches to the configured memory address in Flash except only after the Flash memory contents have been authenticated. The Flash authentication uses a Cipher-based Message Authentication Protocol (CMAC) to authenticate 16-KB of Flash starting from the configured Flash entry point address. The CMAC calculation requires a user-defined 128-bit key programmed in the CPU1 User OTP Zone 1 Header OTP CMACKEY bit field. Additionally, the user must calculate the golden CMAC tag based on the 16-KB Flash memory range and store it along with the user code at a hardcoded address in Flash. During secure Flash boot, the calculated CMAC tag is compared to the user golden CMAC tag in Flash to determine the pass/fail status of the CMAC authentication. When authentication passes, boot flow continues and branches to Flash to begin executing the application. When authentication fails, the boot flow actions performed vary by core. Refer to Table 5-43 for details on failure actions for each core.
For the available secure Flash boot entry address options, refer to Section 5.7.3.
For generating the secure Flash golden CMAC tag for CPU1 or CPU2, refer to the section “Using Secure Flash Boot on TMS320F2838x Devices” in the TMS320C28x Assembly Language Tools User’s Guide for instructions.
For generating the secure Flash golden CMAC tag for CM, refer to the ARM Assembly Language Tools v19.6.0.STS, within section “Using Secure Flash Boot on TMS320F2838x Devices” for instructions.
Name | Address | Details |
---|---|---|
CMAC Golden Tag (128-bit) |
CPU1/CPU2:Flash Entry Point Address + 0x2 CM: Flash Entry Point Address + 0x4 |
Located in Flash, offset
from the entry point address, by 2 words (CPU1/CPU2) or 4 bytes
(CM). When CMAC calculations are performed, the golden tag location in memory is considered all 0xFs. Refer to Example5-1 for an example regarding linker configuration on CPU1. Lower memory contains the tag's MSW and higher memory contains the LSW |
Example (on CPU1): Tag = 0x00112233 44556677 8899AABB CCDDEEFF Address 0x0 = 0x00112233 Address 0x2 = 0x44556677 Address 0x4 = 0x8899AABB Address 0x6 = 0xCCDDEEFF |
||
CMAC 128-Bit Key | 0x0007 8018 | Located in CPU1 Zone 1
User Header OTP (CMACKEY0, CMACKEY1, CMACKEY2, CMACKEY3) CMACKEY0 contains the key's MSW and CMACKEY3 contains the LSW |
Example: Key = 0x00112233 44556677 8899AABB CCDDEEFF CMACKEY0 = 0x00112233 CMACKEY1 = 0x44556677 CMACKEY2 = 0x8899AABB CMACKEY3 = 0xCCDDEEFF |
CPU | Action on Failed Authentication |
---|---|
CPU1 | Reset the device (If using debugger, device halts) |
CPU2 | Send IPC message to CPU1, update CPU2 boot status to indicate failure, and return to wait boot |
CM | Send IPC message to CPU1, update CM boot status to indicate failure, and return to wait boot |
Step | Action |
---|---|
1 | Secure Flash boot CPU1 |
2 | CPU1 application configures CPU2 and CM to boot using Secure Flash Boot and releases CPU2/CM from reset |
3 | CPU2 and CM perform secure Flash boot |
4 | CPU2 and CM applications signal to CPU1 using IPC that booting is complete |
5 | For CPU1/CPU2/CM, any Flash beyond the first 16KB from the entry point that is planned for use must be authenticated by the user using a different CMAC golden tag embedded at an address somewhere within the already authenticated 16KB of Flash |