2.9.3 Bootstrap Image Format
A bootstrap image stored in NVM must have a defined format to be launched by the ROM code. Depending on the mode of operation and configuration, the format may differ.
In all formats, a valid image starts with a fixed size header:
| Field Name | Size (bits) | Notes |
|---|---|---|
| Magic word | 32 | A magic value describing the type of image |
| Image size | 32 | Actual image size in bytes, not including header and security data |
| Authentication data | 32 | Parameters for authentication |
| Dual boot info | 32 | Dual boot identification information |
| Tag | 256 | Header tag (SHA256) |
- Magic word:
0x42535031-> ‘BSP1’: Plain text bootstrap image version 10x42534331-> ‘BSC1’: Secure bootstrap image version 1
- Image size: Actual size in bytes of the padded bootstrap image. The image must be a multiple of 128-bit blocks.
- Authentication data:
Parameters for authentication are as follows:
Bit 31 30 29 28 27 26 25 24 Steps RFU RFU RFU RFU Auth. algorithm RFU Bit 23 22 21 20 19 18 17 16 RFU Bit 15 14 13 12 11 10 9 8 Security data size Bit 7 6 5 4 3 2 1 0 Security data size - Bit 31 – Steps: Used
in image verification
- 0: Single-step verification
- 1: Double-step verification
- Bit 26:25 – Authentication
algorithm
- 00: No authentication
- 01: AES-CMAC
- 10: RSA
- 11: ECDSA
- Bits 15:0 – Security data size: Size in bytes of security data present after the image
- Other bits – RFU: Must be set to 0b0.
- Bit 31 – Steps: Used
in image verification
- Dual boot info: Dual boot
identification information as follows:
Field Size Description Bootstrap Major Version Number 16 Major version number Bootstrap Minor Version Number 16 Minor version number - Tag: Must be 256 bits long:
- In Plain Text mode, contains the header SHA256 digest.
- In Secure mode, refer to the following table:
Field Size Description Plain bootstrap TAG 128 AES-CMAC of the plain bootstrap image Header TAG 128 AES-CMAC of the image header To clear the bootstrap, the tag must be comprised of random values if the image is configured for a single-step verification.