The CSC is expected to be a separate image from the main application. This allows a complete isolation of the CSC from the application as opposed to a scheme where the CSC functionality is embedded into the application as a single image.

At the first SYSRST following BOOTDONE, CSC will be invoked via the reset handler at 0x0. The pseudo-code below provides an overview of the CSC programming model.

void resetHandler(void)
{
_asm(“b __c_init00”); // this is the call to secure startup, which would issue INITDONE
}

The CSC will check if INITDONE has already been issued, and accordingly decide to perform application image authentication and security configuration before launching the authenticated image.

bool init_done = (*(volatile long *)(SYSCTL_SECCFG_SECTSTAT)) & 0x1;
If (! Init_done)
{
setupKeystorage(); // AES symmetric keys
entry_point = findImageEntryPoint ();
stack_ptr = findImageStackPtr();
setBankSwap(0 or 1); // depending on which bank the image is in

// setup SRAM boundary
copyFromFlashToSRAM();
setupSRAMBoundary();
lockSRAMBoundary();
setupFlashFirewalls();
INITDONE = 1; // *(volatile long *) (SYSCTL_SECCFG_INITDONE) = 1 | (0x9D << 24);
// This triggers a HW-initiated SYSRST
}

// we will come here if INITDONE = 1 after a SYSRST
launchApp(); // using entry_point and stack pointer base from image metadata

As outlined, the CSC would perform a set of security configuration actions that include:

• Transferring AES keys from flash memory to the secure key storage
• Identifying the correct application image to run and which bank it is located in. This step requires the startup code to use some pre-defined metadata scheme for where the app may be loaded, how to find the app version, how to authenticate the app, what its entry point is and where the app’s vector table is located.
• Set up bank swap information
• Set up SRAM boundary to separate code region from RW region
• Provision required read/write/IP protect flash firewalls
• Mark INITDONE

Note that the SRAM boundary set up is optional and needed only if the application intends to run any code (especially interrupt handlers) out of SRAM. This is motivated by a requirement to keep communications ISRs running while the main flash memory could be busy with integrity checks.

The final step would trigger a second SYSRST and the reset handler gets invoked a second time. Since init_done is now found to be set, CSC will simply invoke the main application at this point, using the entry_point that the CSC obtained from the application image.