wolfBoot: TI C2000 C28x (16-bit) secure boot (LAUNCHXL-F28P55X) - #860
Draft
dgarske wants to merge 1 commit into
Draft
wolfBoot: TI C2000 C28x (16-bit) secure boot (LAUNCHXL-F28P55X)#860dgarske wants to merge 1 commit into
dgarske wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds an initial wolfBoot port for TI C2000 C28x (LAUNCHXL-F28P55X), focusing on a secure-boot MVP in a word-addressed CHAR_BIT==16 environment using the TI cl2000 toolchain, including host-side image/header conversion helpers and a minimal XIP test application.
Changes:
- Add C2000 (C28x) architecture/toolchain support in the build system and introduce a new F28P55x HAL + linker script for flash/RAM-function relocation and console output.
- Add wide-byte (
CHAR_BIT==16) image-header access helpers and a C28x-specific SHA-256 image hashing path to match the host signing octet serialization. - Add host/test tooling: firmware word-image ↔ octet-stream conversion script, a header-to-C emitter, and a documented build/sign flow + linker command file for the test app.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/scripts/c2000_flashimg.py | Host-side converter for C28x split header/firmware layout and signing flow. |
| test-app/gen_hdr_c.py | Generates a C source that places the signed header blob in a dedicated flash section. |
| test-app/f28p55x_sign.sh | Documents and automates build → extract → sign → header-cell-blob steps for bring-up. |
| test-app/f28p55x_app.cmd | Test-app linker layout aligning header base and XIP codestart in BOOT partition. |
| test-app/app_f28p55x.c | Minimal XIP test application emitting a SCIA banner to confirm verify+jump. |
| src/string.c | Ensures memcpy() stays in flash for C28x startup relocation ordering. |
| src/libwolfboot.c | Switch header fixed-field reads to new WOLFBOOT_HDR_GET_* helpers. |
| src/image.c | C28x-specific SHA-256 hashing order + stack mitigation via static ECC verify temporaries. |
| src/boot_c2000.c | New C2000 boot handoff implementation (do_boot, arch_reboot). |
| Makefile | Avoid GCC-only warning flags and adjust link-script passing for ARCH=C2000; set MAIN_TARGET for f28p55x. |
| include/wolfboot/wolfboot.h | Introduce fixed-field header access macros that account for wide-byte header storage. |
| include/user_settings.h | Configure wolfCrypt settings for C28x wide-byte / 16-bit CPU constraints and toolchain quirks. |
| include/c2000_stdint.h | Force-include shim providing uint8_t/int8_t aliases for a no-8-bit C28x environment. |
| hal/f28p55x.ld | wolfBoot linker script for bank0 execution + .TI.ramfunc LOAD/RUN relocation. |
| hal/f28p55x.c | New F28P55x HAL: clocks/init, SCIA console, and RAM-resident Flash API program/erase stubs. |
| config/examples/f28p55x.config | Example config enabling secure-boot MVP for LAUNCHXL-F28P55X. |
| arch.mk | Add ARCH=C2000 toolchain integration, flags, startup objects, and build rules. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+194
to
+196
| # define WOLFBOOT_HDR_GET_U16(p) \ | ||
| ((uint16_t)(((const uint8_t*)(p))[0] | \ | ||
| (((const uint8_t*)(p))[1] << 8))) |
Comment on lines
+189
to
+193
| # define WOLFBOOT_HDR_GET_U32(p) \ | ||
| ((uint32_t)((const uint8_t*)(p))[0] | \ | ||
| ((uint32_t)((const uint8_t*)(p))[1] << 8) | \ | ||
| ((uint32_t)((const uint8_t*)(p))[2] << 16) | \ | ||
| ((uint32_t)((const uint8_t*)(p))[3] << 24)) |
Comment on lines
+285
to
+293
| #if defined(__TMS320C28XX__) || defined(WOLFBOOT_ARCH_C2000) | ||
| /* C28x: the ecc_key struct and mp_ints are large relative to the 16-bit-SP | ||
| * low-RAM stack (WOLFSSL_NO_MALLOC keeps SP-256 verify temporaries on the | ||
| * stack too). Keep them in .bss to avoid overflowing the stack into | ||
| * adjacent RAM during verify; wolfBoot verifies images sequentially, so a | ||
| * single shared instance is safe. */ | ||
| static ecc_key ecc; | ||
| static mp_int r, s; | ||
| #else |
Comment on lines
+98
to
+102
| uint32_t spin = 20000; | ||
| while ((SCI_getTxFIFOStatus(SCIA_BASE) == SCI_FIFO_TX16) && (spin-- > 0)) | ||
| ; | ||
| SCI_writeCharNonBlocking(SCIA_BASE, c); | ||
| } |
Comment on lines
+211
to
+213
| while (SCI_getTxFIFOStatus(SCIA_BASE) != SCI_FIFO_TX0) | ||
| ; | ||
| DINT; |
Comment on lines
+18
to
+19
| data = open(sys.argv[1], "rb").read() | ||
| words = [struct.unpack_from("<H", data, i)[0] for i in range(0, 2 * N, 2)] |
Comment on lines
+198
to
+202
| # define WOLFBOOT_HDR_U32_SZ (sizeof(uint32_t)) | ||
| # define WOLFBOOT_HDR_U16_SZ (sizeof(uint16_t)) | ||
| # define WOLFBOOT_HDR_GET_U32(p) (*(uint32_t*)(p)) | ||
| # define WOLFBOOT_HDR_GET_U16(p) (*(uint16_t*)(p)) | ||
| #endif |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a wolfBoot port for the Texas Instruments C2000 C28x DSP, brought up on the LAUNCHXL-F28P55X (TMS320F28P550SJ, 150 MHz). This is wolfBoot's first word-addressed, 16-bit-byte (
CHAR_BIT == 16) target, built with the TIcl2000compiler.Features
WOLFSSL_WIDE_BYTE(CHAR_BIT != 8) work, with a split flash layout so the octet-stream image header and the native-word executable coexist.ARCH=C2000build target (cl2000toolchain), example config, and a minimal signed test-app for bring-up.Hardware / test status
Bench: LAUNCHXL-F28P55X over the onboard XDS110, DSLite flashing, SCIA console at 115200. Empty-boot and on-target header/integrity checks are validated on silicon; end-to-end verify-and-jump confirmation is the remaining bring-up step.
Scope
Secure-boot MVP with XIP. A/B update / rollback (partitions declared, HAL write/erase in place) is a follow-on.