wolfBoot: TI C2000 C28x (16-bit) secure boot (LAUNCHXL-F28P55X)

[dgarske]

Summary

Adds a wolfBoot port for the Texas Instruments C2000 C28x DSP, brought up on the LAUNCHXL-F28P55X (TMS320F28P550SJ, 150 MHz). This is wolfBoot's first word-addressed, 16-bit-byte (CHAR_BIT == 16) target, built with the TI cl2000 compiler.

Features

• Secure boot: verify a resident signed application, then execute it in place (XIP) from flash.
• ECC P-256 signatures with SHA-256 image integrity.
• 16-bit-byte support: builds wolfBoot and wolfCrypt against the WOLFSSL_WIDE_BYTE (CHAR_BIT != 8) work, with a split flash layout so the octet-stream image header and the native-word executable coexist.
• New HAL for the F28P55x: clocks/flash bring-up, SCIA console, and the TI Flash API (Fapi) program/erase path for future A/B updates.
• ARCH=C2000 build target (cl2000 toolchain), example config, and a minimal signed test-app for bring-up.

Hardware / test status

Validated end-to-end on the LAUNCHXL-F28P55X (XDS110, DSLite flashing, SCIA console at 115200): wolfBoot boots from flash, checks image integrity, verifies the ECC P-256 signature, and jumps to the signed application, which runs and prints over the console. Clock and UART were confirmed correct on silicon (150 MHz PLL, 115200 baud).

Scope

Secure-boot MVP with XIP; validated end-to-end on hardware. A/B update / rollback is a follow-on: partitions are declared but the update path (flash erase/write, swap, trailer) is not yet wide-byte-hardened -- 16-bit-int partition-length handling, the Fapi sector/alignment rules and RAM placement, the SHA-384/SHA3 and delta-update octet paths, and the trailer/partition-state arithmetic are the tracked next steps, along with docs and CI coverage for the target.

[Copilot]

Pull request overview

This PR adds an initial wolfBoot port for TI C2000 C28x (LAUNCHXL-F28P55X), focusing on a secure-boot MVP in a word-addressed CHAR_BIT==16 environment using the TI cl2000 toolchain, including host-side image/header conversion helpers and a minimal XIP test application.

Changes:

• Add C2000 (C28x) architecture/toolchain support in the build system and introduce a new F28P55x HAL + linker script for flash/RAM-function relocation and console output.
• Add wide-byte (CHAR_BIT==16) image-header access helpers and a C28x-specific SHA-256 image hashing path to match the host signing octet serialization.
• Add host/test tooling: firmware word-image ↔ octet-stream conversion script, a header-to-C emitter, and a documented build/sign flow + linker command file for the test app.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tools/scripts/c2000_flashimg.py	Host-side converter for C28x split header/firmware layout and signing flow.
test-app/gen_hdr_c.py	Generates a C source that places the signed header blob in a dedicated flash section.
test-app/f28p55x_sign.sh	Documents and automates build → extract → sign → header-cell-blob steps for bring-up.
test-app/f28p55x_app.cmd	Test-app linker layout aligning header base and XIP codestart in BOOT partition.
test-app/app_f28p55x.c	Minimal XIP test application emitting a SCIA banner to confirm verify+jump.
src/string.c	Ensures memcpy() stays in flash for C28x startup relocation ordering.
src/libwolfboot.c	Switch header fixed-field reads to new WOLFBOOT_HDR_GET_* helpers.
src/image.c	C28x-specific SHA-256 hashing order + stack mitigation via static ECC verify temporaries.
src/boot_c2000.c	New C2000 boot handoff implementation (do_boot, arch_reboot).
Makefile	Avoid GCC-only warning flags and adjust link-script passing for ARCH=C2000; set MAIN_TARGET for f28p55x.
include/wolfboot/wolfboot.h	Introduce fixed-field header access macros that account for wide-byte header storage.
include/user_settings.h	Configure wolfCrypt settings for C28x wide-byte / 16-bit CPU constraints and toolchain quirks.
include/c2000_stdint.h	Force-include shim providing uint8_t/int8_t aliases for a no-8-bit C28x environment.
hal/f28p55x.ld	wolfBoot linker script for bank0 execution + .TI.ramfunc LOAD/RUN relocation.
hal/f28p55x.c	New F28P55x HAL: clocks/init, SCIA console, and RAM-resident Flash API program/erase stubs.
config/examples/f28p55x.config	Example config enabling secure-boot MVP for LAUNCHXL-F28P55X.
arch.mk	Add ARCH=C2000 toolchain integration, flags, startup objects, and build rules.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.