The HSM or Hardware security Module is a subsystem that acts as the secure host by offering security services to the rest of the system. TI offers HS-FS (High Security - Field Securable) as the primary device for the customers. The MCU+ SDK supports HS-FS device type for AM263x. It supports loading the HSM firmware (TIFS-MCU) via SBL (Secondary Boot Loader), which enables access to the hardware resources for cryptographic operations for R5FSS.
The SBL for AM263x supports for loading firmware on the HSM. The firmware is provided in an encrypted form at source/drivers/hsmclient/soc/hsmRtImg.h
. The function Bootloader_socLoadHsmRtFw
sends a message to ROM and ROM loads the HSM firmware. After the HSM firmware is loaded and has done its init time operations, it sends a message to the SBL called HSM_MSG_BOOT_NOTIFY
.
By default, the access to the crypto resources are firewalled on HS-FS devices. The HSM firmware so loaded, bypasses the firewalls and makes the following crypto modules available for the R5FSS to use.
This provides ability for the R5F core to be able to do the following computations:
SBL should always wait for HSM_MSG_BOOT_NOTIFY
before using the crypto accelerator because HSM firmware initializes these firewalls. Failing to do so, the SBL or application may run into abort exception while accessing the MMR regions for the crypto accelerator.
The TIFS-MCU firmware that gets loaded on HSM provides the following services.
This page links to sub modules that enable authentication, data integrity and its confidentiality with the on-chip hardware accelarators.
The cryptographic accelarator on this device is supported via these modules in the SDK: