SPRUII0F May 2019 – June 2024 TMS320F28384D , TMS320F28384D-Q1 , TMS320F28384S , TMS320F28384S-Q1 , TMS320F28386D , TMS320F28386D-Q1 , TMS320F28386S , TMS320F28386S-Q1 , TMS320F28388D , TMS320F28388S
Within secure ROM of each core, functions are available to be called by the application to perform EXEONLY Flash/RAM tasks in a secure manner.
If a vector fetch request is given by the CPU (C28 or CM, depending on the subsystem) while the corresponding program counter (PC) is within the EXEONLY function API code of the Secure ROM, a reset occurs (RSN, if from C28; SYSRESETn, if from CM). The consequence of this is if an NMI, ITRAP, or Bus Fault occurs while the PC is executing one of the EXEONLY API functions, the NMI/ITRAP/Fault cannot be serviced because a reset occurs to that subsystem.
The secure copy code zone 1 and zone 2 functions allow EXEONLY Flash to be copied to EXEONLY RAM in a secure manner. The source must be from EXEONLY Flash and the destination to EXEONLY RAM. There is no support to copy EXEONLY ROM or EXEONLY RAM to RAM. Both Flash and RAM must be set to EXEONLY and configured for the same zone. Additionally, the copy size must not cross over the Flash sector boundary. Any violations of these requirements results in a failure status returned. Upon successful copy of the data, the number of 16-bit words copied is returned.
CPU | Function Prototype | Function Parameters | Function Return Value |
---|---|---|---|
CPU1, CPU2, CM | Uint16 SecureCopyCodeZ1(Uint32 size, Uint16 *dst, Uint16 *src) | 0xXXXX : Returns the number of 16-bit words copied | |
size : The number of 16-bit words to copy | |||
dst : The destination memory address in EXEONLY RAM | 0x0000 : Indicates one of the following: Copy length is zero; Copy size crosses over Flash sector boundary; Flash and RAM do not belong to the same zone; Flash or RAM are not set to EXEONLY; Error occurred during data copy | ||
Uint16 SecureCopyCodeZ2(Uint32 size, Uint16 *dst, Uint16 *src) | |||
src : The source memory address in EXEONLY Flash | |||
The secure CRC calculation zone 1 and zone 2 functions allow a safety CRC check of EXEONLY memory in a secure manner. The CRC length provided must be a value from 1 to 8 where 1 represents a CRC size of 32 16-bit words and 8 represents a CRC size of 4096 16-bit words. The source address specifies the starting address for the CRC and the destination address is the location that the resulting CRC value is stored. The source and destination memories must be configured for the same zone. Additionally, the CRC length must not cross over the Flash sector or RAM block boundary. On the CM, there is an additional requirement that CRCLOCK is not enabled. Any violations of these requirements results in a failure status returned. Upon successful CRC, the number of 16-bit words CRC'd is returned.
CPU | Function Prototype | Function Parameters | Function Return Value |
---|---|---|---|
CPU1, CPU2, CM | Uint16 SecureCRCCalcZ1(Uint16 len_id, Uint16 *dst, Uint16 *src) | 0xXXXX : Returns the number of 16-bit words CRC'd | |
len_id : A number from 1 to 8 which corresponds to length options of 32, 64, 128, 256, 512, 1024, 2048, or 4096 16-bit words | |||
dst : The destination memory address for resulting CRC | 0x0000 : Indicates one of the following: Invalid length option; Source address is not modulo of length value; Destination address is not within secure RAM; CRC size crosses over Flash sector or RAM block boundary; The source and destination memory do not belong to the same zone; On CM, CRCLOCK is enabled | ||
Uint16 SecureCRCCalcZ2(Uint16 size, Uint16 *dst, Uint16 *src) | |||
src : The source memory address to begin CRC calculation | |||
The calculate CMAC (Cipher-based Message Authentication Code) function calculates a CMAC tag for a specified memory range using the user-set CMAC key in OTP and returns pass or failure depending if the calculated tag matches the golden tag. The memory address range provided must align to a 128-bit boundary (split evenly into 128-bit blocks). If this requirement is not met, the function returns a status indicating a boundary violation. When using the CM CMAC function, there is an additional requirement that the CM must be running in privileged mode.
For generating the secure Flash golden CMAC tag for CPU1 or CPU2, refer to the section "Using Secure Flash Boot on TMS320F2838x Devices" in the TMS320C28x Assembly Language Tools User’s Guide for instructions.
For generating the secure Flash golden CMAC tag for CM, refer to the ARM Assembly Language Tools v19.6.0.STS, within section "Using Secure Flash Boot on TMS320F2838x Devices" for instructions.
The 128-bit golden CMAC tag:
CPU | Function Prototype | Function Parameters | Function Return Value |
---|---|---|---|
CPU1 | uint32_t CPU1BROM_calculateCMAC(uint32_t startAddress, uint32_t endAddress, uint32_t tagAddress) | startAddress : The starting memory address for the calculation (Example: 0x80000) | 0xFFFF FFFF : The calculated CMAC tag does not match the golden tag (failure) |
endAddress : The ending memory address for the calculation (Example: 0x82000) | 0xA5A5 A5A5 : The memory address range is not aligned to a 128-bit boundary or length is zero | ||
tagAddress : The starting memory address of where the golden CMAC tag is stored. (Example: 0x80002) | 0x0000 0000 : The calculated CMAC tag matches the golden tag (pass) | ||
CPU2 | uint32_t CPU2BROM_calculateCMAC(uint32_t startAddress, uint32_t endAddress, uint32_t tagAddress) | startAddress : The starting memory address for the calculation (Example: 0x80000) | 0xFFFF FFFF : The calculated CMAC tag does not match the golden tag (failure) |
endAddress : The ending memory address for the calculation (Example: 0x82000) | 0xA5A5 A5A5 : The memory address range is not aligned to a 128-bit boundary or length is zero | ||
tagAddress : The starting memory address of where the golden CMAC tag is stored. (Example: 0x80002) | 0x0000 0000 : The calculated CMAC tag matches the golden tag (pass) | ||
CM | uint32_t CMBROM_calculateCMAC(uint32_t startAddress, uint32_t endAddress, uint32_t tagAddress) | 0xFFFF FFFF : The calculated CMAC tag does not match the golden tag (failure) | |
startAddress : The starting memory address for the calculation (Example: 0x200000) | |||
0xA5A5 A5A5 : The memory address range is not aligned to a 128-bit boundary or length is zero | |||
endAddress : The ending memory address for the calculation (Example: 0x200000) | |||
0x5A5A 5A5A : The CM is not running in privileged mode | |||
tagAddress : The starting memory address of where the golden CMAC tag is stored. (Example: 0x200004) | |||
0xE1E1 E1E1: The CM AES engine timed out. AES engine can not be working as expected. | |||
0x0000 0000 : The calculated CMAC tag matches the golden tag (pass) |