TMS320F28P650DH: Integrate secure boot beyond 16KB to existing bootloader (>16KB)

Hello Hang,

Let me loop you in with our DCSM expert.

Regards,

Joseph

Hi Hang,

this would be complex, but you could have a simple bootloader that simply authenticates your customer's bootloader before jumping to it. This simple bootloader would live in the first 16k and your customer's bootloader would live outside of the first 16k. The application code would need to live in a separate region outside of the regions described above.

Thank you,

Luke

Hi Luke,

Are you able to provide us the best documentation/sample project to enable this?  That may allow Hang and I to engage further with the customer.  We realize this is probably not something already developed necessarily, but any additional pointers are welcomed.

Regards,

Chris 

Hi Chris,

We don't have a specific software example for this scenario since two bootloaders would be involved here, but all of the concepts required are described in the Secure Boot application note. You would likely need to observe the generated CMAC tags that get generated in the original secure boot binary and hard code them in a subsequent revision since you are performing the authentication twice. I'd recommend starting with the secure boot app note and modify it to attempt what you're doing, I can provide assistance once you or the customer run into issues.

Thank you,

Luke

Hi Luke,

This is solid guidance.  Hang and I appreciate this very much.  We'll probably need to first run this by the customer to see if it makes sense and fits their needs.  Then we will need to figure out the workload and if the customer is willing to partake in some of it.

Hi Hang,

Would you care to run this by the customer first, just to make sure we are aligned?

Thank you both,

Chris 

Hi Chris,

Let me know if you need anything else from me.

Thank you,

Luke