Security

Table of Contents

• Introduction
  • Getting started
    • Bootloader_socLoadHsmRtFw
      • HSMRt Firewall Configurations
    • Resources available
    • Services
    • Modules

Introduction

Getting started

The HSM or Hardware security Module is a subsystem that acts as the secure host by offering security services to the rest of the system. TI offers HS-FS (High Security - Field Securable) as the primary device for the customers. The MCU+ SDK supports HS-FS device type for AM263x/AM263Px. It supports loading the HSM firmware (TIFS-MCU) via SBL (Secondary Boot Loader), which enables access to the hardware resources for cryptographic operations for R5FSS.

Bootloader_socLoadHsmRtFw

The SBL for AM263x/AM263Px/AM273x supports for loading firmware on the HSM. The firmware is provided in an encrypted form at source/drivers/hsmclient/soc/hsmRtImg.h. The function Bootloader_socLoadHsmRtFw sends a message to ROM and ROM loads the HSM firmware. After the HSM firmware is loaded and has done its init time operations, it sends a message to the SBL called HSM_MSG_BOOT_NOTIFY.

int main()
{
    ...
    Drivers_open();
    Bootloader_profileAddProfilePoint("Drivers_open");
 
    DebugP_log("\r\n");
    Bootloader_socLoadHsmRtFw(gHsmRtFw, HSMRT_IMG_SIZE_IN_BYTES);
    Bootloader_profileAddProfilePoint("LoadHsmRtFw");
 
    DebugP_log("Starting QSPI Bootloader ... \r\n");
    ...
}

HSMRt Firewall Configurations

HSMRt does the following firewall configurations. These configurations gives necessary access of various memory regions to host cores.

Note

Following configurations are done considering R5FSS0_0 as secure host 0 and C66x as secure host 1.

A secure host refers specifically to a host that is configured to communicate with an HSM (Hardware Security Module), rather than simply implying a host that is inherently secure.

Firewall/MPU	Programmable Region Num.	Start Address	End Address	AID/privID permissions	SR	SW	SX	UR	UW	UX	NS	Debug	Comments
FW HSM_SLV	0	0x44000400	0x440007FF	R5FSS0_0, R5FSS0_1, DSS	1	1	0	1	1	0	1	1	HSM MBOX region R5/C66->HSM queues
	1	0x44000000	0x440003FF	R5FSS0_0, R5FSS0_1, DSS	1	0	0	1	0	0	1	1	HSM MBOX region HSM->R5/C66 queues
	2	0x40020000	0x4005FFFF	R5FSS0_0, R5FSS0_1, DSS	1	0	0	1	0	0	1	0	MPU Region Space
	3	0x40080000	0x4021FFFF	R5FSS0_0, R5FSS0_1, DSS	1	0	0	1	0	0	1	0	MPU Region Space
FW DTHE_SLV	0	0xCE007000	0xCE007FFF	All AIDs can access	1	1	1	1	1	1	1	1	HSM AES (public context)
	1	0xCE005000	0xCE005FFF	All AIDs can access	1	1	1	1	1	1	1	1	HSM SHA (public context)
	2	0xCE000800	0xCE000FFF	All AIDs can access	1	1	1	1	1	1	1	1	HSM DTHE (public context)
FW MSS_PCRA	0	0x2F7A800	0x2F7ABFF	HSM	1	1	1	1	1	1	1	1	Secure Asset and is protected during runtime
	1	0x2000000	0x2F7A7FF	All AIDs can access	1	1	1	1	1	1	1	1	To access peripheral region master side MPU
	2	0x2F7AC00	0x2FFFFFF	All AIDs can access	1	1	1	1	1	1	1	1	To access peripheral region master side MPU

Resources available

By default, the access to the crypto resources are firewalled on HS-FS devices. The HSM firmware so loaded, bypasses the firewalls and makes the following crypto modules available for the R5FSS to use.

• AES (public context)
• SHA (public context)

This provides ability for the R5F core to be able to do the following computations:

• AES encryption/decryption
• SHA/HMAC hash calculation

SBL should always wait for HSM_MSG_BOOT_NOTIFY before using the crypto accelerator because HSM firmware initializes these firewalls. Failing to do so, the SBL or application may run into abort exception while accessing the MMR regions for the crypto accelerator.

Services

The TIFS-MCU firmware that gets loaded on HSM provides the variety of services. For more information refer HSM client

Modules

This page links to sub modules that enable authentication, data integrity and its confidentiality with the on-chip hardware accelarators.

The cryptographic accelarator on this device is supported via these modules in the SDK:

• Cryptography Modules
  • DTHE (Data Transform and Hashing Engine)
    • Description of DTHE architecture and APIs available to use AES and SHA engine.

Note

EDMA support for AES and SHA will be added in future releases. Currently, the drivers only operate in CPU mode of data copy.