AM2634-Q1: further questions about the services provided by default HSM runtime firmware

Will Gao

Part Number: AM2634-Q1

Hi BU,

in the early thread, you said that the default HSM run-time firmware (in binary format embedded into SBL image) provided by TI will only include following services: 1) GetVersion Service; 2) GetUID Service; 3) OpenDbgFirewall Service.

I am wondering: if I need to configure the system MPU/Firewall in HS-FS device (PG 1.1 version silicon), that means I must change the HSM run-time firmware by myself and authenticate/encrypt it with TI MPK?

Please give your instructions. Thanks.

over 2 years ago

0 Aakash Kedia over 2 years ago

TI__Mastermind 26145 points

Hi Will Gao,

We have released MCU+ Academy for AM26x devices - https://dev.ti.com/tirex/explore/node?node=A__AESgmqK3b93425uf.HP2zA__AM26X-ACADEMY__t0CaxbG__LATEST.
Please refer to the same. These will answer all of your questions automatically. Also, it will help you understand the TI's security deliverable. Incase, it does not, do reach out to the same thread.

Best Regards,
Aakash

0 Will Gao over 2 years ago in reply to Aakash Kedia

TI__Intellectual 2335 points

Hi Aakash,

I have read the academy, but I still have this question.

0 Will Gao over 2 years ago in reply to Aakash Kedia

TI__Intellectual 2335 points

OK, I found some statement as below. But if the application only wants to use Firewall feature but not the whole security features, what should do?

0 Aakash Kedia over 2 years ago in reply to Will Gao

TI__Mastermind 26145 points

Hi Will,

As mentioned in the Academy, the HS-FS firmware cannot b e modified as this is TI deliverable. But if the customer is a secure customer i.e. HS-SE owner, the TIFS-MCU Firmware will be owned by Customers. They are free to add or remove the software they feel not usable.

By default, TI will enable software for required for meeting the security goals which will setup a foundation for the users. Any security vulnerability in modified software shall be owned by the customer.

Best Regards,
Aakash

0 Will Gao over 2 years ago in reply to Aakash Kedia

TI__Intellectual 2335 points

Aakash,

From security perspective, I totally agree with what you said. I am asking this question because I am supporting customer to implement the safety mechanisms for R5F CPU. And the system MPU is one of these SMs. If in order to implement this SM, the application should implement all the security features, i.e. secure boot, keys management and so on, the cost is too high and also complicated.

BU can think about to add this feature service (system MPU) in the default HSM runtime firmware.

+1 Aakash Kedia over 2 years ago in reply to Will Gao

TI__Mastermind 26145 points

Hi Will Gao,

HSM Run Time Firmware supporting System MPU configurations via HSM Service is part of 09.00 MCU_PLUS_SDK release for HS-FS firmware. This will satisfy the use case of Safety customers. In case of HS-FS firmware, there is no secure boot, key management etc.

Best Regards,
Aakash

0 Will Gao over 2 years ago in reply to Aakash Kedia

TI__Intellectual 2335 points

Thanks.

Arm-based microcontrollers

Arm-based microcontrollers forum

AM2634-Q1: further questions about the services provided by default HSM runtime firmware