Programming the Hardware Security Module (HSM)

The HSM firmware is not flashed on the CC27xx out of the factory. In order to use the HSM, the developer must flash the device with the correct binary. This hsm binary can be found in <sdk root>/bin/hsm.

The HSM resides in flash between the addresses 0xE8000 - 0x1FFFFFF. This region is given special protection which includes write, erase, and read protections. Due to these protections, developers will be unable to use the debugger or any such application in order to read or modify the HSM firmware region.

To flash the HSM firmware, please follow the steps below for your preferred IDE. Additionally, the HSM may be flashed using Uniflash.

Note

This page is only applicable to the CC27xx family of devices. CC23xx does not have an HSM.

Warning

It is possible to erase the HSM firmware when executing a back-to-back chip erase. The first chip erase removes the contents of the CCFG, therefore removes protections for write/erase of the HSM firmware. On the second erase, since there are no protections, the HSM firmware is erased. Use the steps below to re-flash the HSM.

Uniflash

  1. Flash any application software to the device with a valid CCFG and SCFG. Any example that comes with the SimpleLink SDK will work, in addition to your own device application software.

Warning

Without a valid application image flashed to the device, the HSM flashing will fail.

  1. Start a Uniflash session for the CC27xx, and go to Settings & Utilities Page.

../_images/uniflash_hsm_programming.png

Figure 73. Programming the HSM.

  1. Under the HSM Image section, enter the path to the HSM binary. This path may be located in <sdk root>/bin/hsm/*.bin.

  2. Click the Program HSM Image.

  3. After programming, click the Read HSM System Information to verify that the HSM binary has been successfully flashed.

Code Composer Studio

  1. Flash any application software to the device with a valid CCFG and SCFG. Any example that comes with the SimpleLink SDK will work, in addition to your own device application software.

Warning

Without a valid application image flashed to the device, the HSM flashing will fail.

  1. Once flashed, start a debug session.

../_images/ccs_HSM_programming_debug.png

Figure 74. Starting a debug session in CCS.

  1. Once the debug session has started, click on Tools –> On-Chip Flash.

../_images/ccs_HSM_on_chip_flash.png

Figure 75. On-Chip Flash window.

  1. Program the HSM firmware. The firmware can be found in <sdk root>/bin/hsm/*.bin.

../_images/ccs_HSM_on_chip_flash_window.png

Figure 76. On-Chip Flash window.

IAR

  1. Flash any application software to the device with a valid CCFG and SCFG. Any example that comes with the SimpleLink SDK will work, in addition to your own device application software.

Warning

Without a valid application image flashed to the device, the HSM flashing will fail.

  1. Under the Project tab, go to Download –> Download file..

  2. Follow the instructions in the pop-up window, and flash the HSM IAR firmware found in <sdk root>/bin/hsm/*_iar.hex.

../_images/iar_HSM_programming.png

Figure 77. IAR programming.

Verifying HSM Firmware in Code

A developer may check the status of the HSM firmware by using the following API. This API is located in source/ti/common/hsm/HSMBareMetal.h.

/*!
 * @brief Struct to store HSM system versions.
 */
typedef struct
{
    uint8_t patch;
    uint8_t minor;
    uint8_t major;
} HSMBareMetal_systemInfoVersionStruct;


  /*!
 *  @brief  Returns the HSM FW image version number (major, minor, and patch)
 *  @pre    HSMBareMetal must be initialized using #HSMBareMetal_init()
 *
 *  This function sends a system info token and extracts HSM version numbers and returns the FW version.
 *
 *  @retval #HSMBAREMETAL_STATUS_SUCCESS               System info token returned data successfully.
 *  @retval #HSMBAREMETAL_STATUS_ERROR                 Error. System info failed or HSMBareMetal is not initialized.
 */
int_fast16_t HSMBareMetal_getHSMFirmwareVersion(HSMBareMetal_systemInfoVersionStruct *firmwareVersionStruct);