[FAQ] F29x HSM & SSU: Frequently Asked Questions

For reference, please see F29x General FAQ for other IP/peripherals

F29x HSM Frequently Asked Questions

Is the size of the KEYSTORE region is fixed? Can a user expand the size of the KEYSTORE region?

• Yes, the size of KEYSTORE is fixed. There are fixed locations for the SMEK, BMEK, SMPK and BMPK. However, KEYSTORE also includes general-purpose OTP that could be used to store additional keys for use by HSM Runtime. The total size is ~3.7KB.

What happens to CPU1 if the authentication of CPU1 flash code fails during HSM secure boot?

• CPU1 will not boot if secure boot authentication fails.

If user code must follow X.509, is it possible to debug using an X.509 image file?

• HSM runtime generally manages debug authentication. User will need to scan in the correct certificate in order to open debug. HSM runtime can also be customized to restrict debug to certain ZONEs depending on the certificate provided.

Does F29x HSM feature a pseudo-random number generator (PRNG)? 

• Yes, there is a DRBG (PRNG), which is compliant to SP 800-90A.

For random number generation, can I specify a random number length (bit) when generating a random number using TRNG? Is there a maximum/minimum limit?

• The output length of the TRNG is fixed at 128 bits.

Can the HSM on F29x be debugged on chip?  Do I need a separate debugger instead of on-chip? 

•  Yes, HSM can be debugged on-chip. The device must be transitioned to HS-SE state first using the provisioning tools before HSM M4 debug can be opened.

What are the differences between AM263x and F29x secure boot and PKE? What does the porting effort look like? 

• The hardware differences between the PKA on AM263x and PKE on F29x will be abstracted at the driver porting layer. What is more relevant is external vs internal Flash boot. From the customer’s point of view, the process still mostly works the same way. They will prepare their application images using the same scripts; the main difference is now we program the image into internal Flash memory.

What is the units for Erase and Write to Flash for HSM?

•  The minimum size to erase is an HSM Flash bank sector (2KB). Programming is done on a word-by-word basis; one Flash word is 128 bits + 16 bits of ECC.

Do I need to have exclusive control on the Host side and HSM side when Write/Erase/Read for HSM Flash? 

• There is no dependency on the host side for programming HSM Flash.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

F29x SSU Frequently Asked Questions

Can CPU-based debug authentication be authenticated with CCS only? If possible, will it be C&R or signature verification?

• The implementation of CPU-based authentication is up to the customer. Authentication code running on the CPU will take in user input, and decide whether to enable the ZONE for debug. This code can read or write to the SEC-AP and execute a challenge-response algorithm. The HSM CPU also has access to these registers, and in practice we expect most users to implement challenge-response debug ZONE authentication using HSM software.

How do I switch SSU modes?

• You will need to program blank seccfg. If SECCFG is unable to be programmed (memory verify failed), disable Verify Flash after Program and Perform Blank Check before loading data to Flash memory (SSU Mode 1 Usage Only). If SECCFG is unable to be programmed (memory write failed), allow NonMain Flash erase before loading data to Flash memory.
• NOTE: Ensure this setting is unselected when not working with SECCFG programming.

If modifying an APR during runtime, is it necessary to disable the APR before it is changed?

• No, it can be changed while it is enabled.

Is it possible to change the START ADDRESS, END ADDRESS, and LINKID fields within the SSU APR registers dynamically during runtime?

• Yes, it can be updated during runtime. Only LINK2 has access to modify these registers. LINKx_CFG and STACKy_CFG cannot be modified during runtime.

If a file is included, as a part of a module configuration, is the entirety of the file getting captured through APRs?

• Yes, code and variables within the file are set as part of APRs for that LINK through the SSU Tool in SysConfig.