SWCU195A December 2024 – May 2025 CC2744R7-Q1 , CC2745P10-Q1 , CC2745R10-Q1 , CC2745R7-Q1 , CC2755R10
The Version Log is a dedicated area of non-main flash memory of 0x800 (2048) bytes in size, used to store records for security counter, version, and hash lock, for either SSB, App 0, or App1 image types, independently. The first 8 bytes of VLOG are reserved to store the Crypto Officer ID for the HSM. Therefore, only 0x7f8 (2040) bytes are available to store VLOG records.
The Version Log area of memory is only accessible to System ROM. This allows Secure Boot to reject update images that do not meet the antirollback conditions for an update. In addition, a hash lock record is used to detect if the target to boot matches the expected hash lock, and to only proceed to boot it if the hash retrieved from VLOG for a given target matches the hash computed by Secure Boot.
A new security counter record will only be created if the security counter of the new image is greater than the current security counter for an image of a given type. As each security counter record consumes 11 bytes, if each update increments the security counter, a total of 2040 / 11 = 185 security counter updates would be allowed.
If scfg.secBootCfg.policyCfg.authMethod = SCFG_POLICY_HASH_LOCK, then a new hash lock record will be created only if an update for SSB, App 0, or App 1 has been accepted. As each hash lock record consumes 41 bytes, assuming no security counter increments occur, a total of 2040 / 41 = 49 hash lock updates would be allowed. Alternatively, if each update incremented the security counter, a total of 2040 / (41 + 11) = 39 updates would be allowed.
Once VLOG is full, no more updates that require the creation of a VLOG record will be allowed, unless the device is subject to a Chip Erase.