基于NAND Flash的CPU安全启动设计与实现

NAND Flash存储器以其容量大、成本低和速度快的优势，在嵌入式系统中得到广泛的应用。但是,由于NAND Flash固有的器件特性，必须要有驱动才能对其进行读写，存储于其上的代码不能直接执行，因此其并不适合作为系统启动代码的存储介质。一般采用NOR Flash存储启动代码并直接执行，然后再引导存储于NAND Flash中的操作系统镜像，这增大了系统成本和功耗。设计并实现了一种基于NAND Flash的CPU安全启动方法。该方法首先通过软硬件结合的方式，在片内NAND Flash控制器中增加块映射表结构，并由NAND Flash中第1块空间存储的代码进行好块寻找和块映射表填写，使NAND Flash的一部分存储空间可以直接映射为硬件可访问的内存空间，从而使得NAND Flash可以作为系统启动的存储介质，实现仅需NAND Flash存储的系统。还提出了一种扩展BootROM的方案，结合NAND Flash地址映射结构，将片内BootROM的一部分扩展到NAND Flash的第1块存储空间中，并通过Hash比对验证BootROM，从而有效降低了片内BootROM的设计复杂度，减少了代码量。通过提出的方法，可以有效地实现单NAND Flash系统的安全启动，降低了系统成本，提高了系统的安全特性。

Design and implementation ofCPU secure boot based on NAND Flash

NAND Flash memory is widely used as storage device in embedded systems, because of its advantages on capacity, cost and speed. However, due to the inherent device characteristics of NAND Flash, complex driver is required to read and write it, and the code stored on it cannot be ex- ecuted directly. Therefore, NAND Flash is not suitable for boot code storage. Generally, boot code is stored on NOR Flash and executed on it directly. The boot code on NOR Flash will boot the operating system stored in NAND Flash, which increases the system cost and power consumption. This paper designs and implements a CPU secure boot method based on NAND Flash. The structure of block mapping table is added in NAND Flash controller, and the code stored in the first block of NAND Flash is used to search and fill in the block mapping table. Using this method, part of NAND Flash storage blocks can be directly mapped to memory space, so that the boot code stored on NAND Flash can be executed directly without drivers. Besides, an extended BootRom scheme is proposed. Combining with the structure of NAND Flash address mapping, part of on-chip BootRom is extended to the first block of NAND Flash. Hash comparison is used to verify the extended BootROM, which effectively reduces the design complexity and code amount of on-chip BootRom. Our method can effectively implement the secure boot of single NAND Flash system, thus reducing the system cost and improving the system security.