AM2634: HSM Integration in SDK SBL

Hi Abdelrhman Afifi,

The HSM firmware integration is already covered as part of SBL for HS-FS devices as mentioned below - https://software-dl.ti.com/mcu-plus-sdk/esd/AM263X/latest/exports/docs/api_guide_am263x/SECURITY_PAGE.html

If you need more insights on integration and enablement of Security on AM263x devices, please refer to AM26x MCU+ Academy - "Enabling Security" --

https://dev.ti.com/tirex/explore/node?node=A__AESgmqK3b93425uf.HP2zA__AM26X-ACADEMY__t0CaxbG__LATEST

Best Regards,
Aakash

Hi Abdelrhman Afifi,

As per the secure boot flow, the SBL is responsible for HSM Run Time. After the HSM Run Time is loaded, SBL or Application can leverage the same.

This will inform about the same - https://software-dl.ti.com/mcu-plus-sdk/esd/AM263X/latest/exports/docs/api_guide_am263x/EXAMPLES_HSM_SERVICES.html#autotoc_md1575

Best Regards,
Aakash

Hi Abdelrhman Afifi,

By default the debug access to HSM as well as public cores are disabled in case of HS-SE devices. The request can be requested via HSM Client service as mentioned here - https://software-dl.ti.com/mcu-plus-sdk/esd/AM263X/latest/exports/docs/api_guide_am263x/EXAMPLES_HSM_SERVICES.html

More details in My Secure SW link here - https://software-dl.ti.com/secure/software/sitara-sec/AM263X-RESTRICTED-SECURITY/TIFS_MCU/v08_06/tifs_am263x_08_06_00_05_docs_only/docs/api_guide_am263x/html/HSM_DBG_SRV.html?__gda__=1691584887_6db356badf79dfd78f25461319c0c8dd

Hope it helps.

Best Regards,
Aakash

Hi,

Abdelrhman Afifi said:

What are the types of reset that will require HSM firmware reloading? (i.e. power-on reset, warm reset,....)

In terms of reset, there are warm reset and cold reset(PORZ). For either of the cases the HSM needs to be reloaded.

Abdelrhman Afifi said:

Does resetting the Host core will reset the HSM core as well?

If you mean by FSM trigger, it only resets the subsystem. It has no impact on SoC, hence no impact on HSM core as well.

Best Regards,
Aakash

Hi Abdelrhman Afifi,

Abdelrhman Afifi said:

what are the required APIs the application should call in order to use the HSM?

All the mentioned APIs in the HSM Client details are explained in the link above.

Abdelrhman Afifi said:

The application does not need to reload the firmware again, but does it need to call the init API for example?

HSM will be initialized during its installation. Application can directly invoke client APIs to use HSM Services. Client Init at application end will be handled via System_Init code generated as part of syscfg.

Hope it helps.

Best Regards,
Aakash