Device Security
319
SLAU356I – March 2015 – Revised June 2019
Copyright © 2015–2019, Texas Instruments Incorporated
System Controller A (SYSCTL_A)
5.8.5 In-Field Updates
This section describes in-field updates for firmware or data on MSP432P4xx family of devices for an
unsecured, JTAG and SWD locked, and IP protected devices.
5.8.5.1
In-Field Updates: Unsecure Device
If no security (JTAG and SWD lock or IP protection) is enabled on the device, updates to the firmware or
data on the device can be done through the JTAG debugger, TI bootloader (BSL), or an application-
specific BSL.
5.8.5.2
In-Field Updates: Secure Device
As discussed in
, MSP432P4xx devices support two types of device security:
1. JTAG and SWD lock
2. IP protection
and
describe how in-field updates to firmware or data can be done for a
Secure Device.
5.8.5.3
In-Field Updates: Secure Device With JTAG and SWD Lock Enabled
Loading firmware or data to a JTAG and SWD locked device is done through the BSL. The update could
be either of the following categories:
1. Unencrypted update
2. Encrypted update
5.8.5.3.1 Unencrypted Update: JTAG and SWD Locked Device
Unencrypted update can be done invoking the BSL and then doing a data or code download through the
BSL into the required address. This is similar to the case of the unsecure device update except that it
does not work for data or code being updated into a IP protected zone flash memory. For firmware or data
updates to IP protected flash memory zones, see
5.8.5.3.2 Encrypted Update: JTAG and SWD Locked Device
Firmware and data update can be done to the device by taking advantage of the Encrypted Update boot
override mode. This mode is provided to prevent the hack of secure firmware or data from the device at a
communication interface level when the updates are being performed.
A data setup phase is required before using the encrypted update (see
). The password in this
figure must be the same as the password used when enabling the JTAG and SWD lock in the boot-
override mailbox (JTAG_SWD_LOCK_UNENC_PWD).
1. This password is appended to the end of the firmware or data to be updated.
2. The package is encrypted through an AES-CBC operation.
3. The encrypted payload is then transmitted through BSL into a free space in Bank 1 of the main flash
memory of the device.
4. The boot override command JTAG_SWD_LOCK_ENC_UPDATE is sent. See
for details
on boot overrides.
5. The device boot code reads the boot override command, decrypts the encrypted packet, and verifies
the authenticity by comparing the JTAG_SWD_LOCK_UNENC_PWD from the decrypted packet
against the value that was provided during JTAG and SWD lock setup
6. The boot code performs the update if the passwords match.
7. The status of the update is indicated in the ACK field of the specific command in the boot-override
mailbox.