• State Resolved
  • Locked Locked
  • Replies 4 replies
  • Subscribers 98 subscribers
  • Views 430 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Original question:

AM62A7: Issues with HSM_care_package_kit_v00.08.0 on AM62Ax

AM62A7: Questions about SA3UL vs. SA2UL differences, AM62Ax usage, and SM2/SM3/SM4 support

Cesc Yang
Prodigy 221 points
Part Number: AM62A7

Tool/software:

Hi TI,

  I have a few questions regarding the security accelerators (SA2UL/SA3UL) on the AM62Ax platform:

  1.Driver Availability:

  In the HSM-Care Package, I see that the only driver provided is for SA2UL. However, in the MCU+SDK, there are examples for SA3UL but no mention of SA2UL. Could you clarify why there are separate driver implementations between these two packages?

  2.Hardware vs. Driver Differences:

  According to the "K3 Processor Security Accelerator" document, the AM62Ax is listed as having the SA3p1_UL. Could you explain whether the difference between SA2UL and SA3UL is at the hardware level, or if it's simply a matter of different driver implementations?

  3.AM62Ax SA Version:

  Can you confirm whether the AM62Ax uses SA3UL or SA2UL? There seems to be some ambiguity across the available documentation and SDK.

  4.Support for Chinese Algorithms:

  The documentation mentions that the SA supports SM2, SM3, and SM4 algorithms. However, the current drivers do not appear to provide implementation or access to these resources. Is there a timeline for when these will be available?

  Thank you in advance for your clarification.

Regards,

Yang

  • 0
    TI__Guru 70081 points

    Hello,

    1,2,3) The AM62A has SA3p1_UL accelerator. The names like SA2UL, SA3UL used anywhere are mere continuity of the drivers name for AM64, AM62 devices. The differences between the different accelerator versions is documented in the Security Accelerator TRM.

    4. The HSM care package is more of a demonstration package rather than supporting the full HSM development. So, there are no immediate plans to support any more functionality in the HSM care package.

    It is expected the customers either contact the 3P vendors for HSM stack or develop their own with the available documentations.

    Regards,

    Prashant

  • 0 in reply to Prashant Shivhare
    Prodigy 221 points

    Hi Prashant,

    Thank you for the clarification regarding the SA3p1_UL accelerator and the HSM care package.

    I would like to confirm a few details regarding the interaction between the A-core's TEE and the HSM on the AM62A platform:

    1. Can the A-core's TEE access the SA3 accelerator on an HS-SE device?
    2. If the SA3 accelerator accessed by the TEE and the SA3 accelerator used by the HSM are the same hardware engine, would there be any conflict during concurrent access from both the TEE and HSM?

    I would appreciate your insights on these questions to better understand the secure functionalities on the AM62A platform.

    Best regards,

    Yang

  • 0 in reply to Prashant Shivhare
    Prodigy 221 points

    Hi Prashant,

    I would like to introduce that we are Uni-Sentry, a TI partner (TI Partner Network) focusing on HSM stack development. We are currently working on the HSM stack for the AM62A platform to meet our customer requirements.

    As part of this effort, we would like to know if there are additional support channels or resources that TI could provide to assist us in this development.

    Best Regards,
    Yang
    yangzijiang@uni-sentry.com

  • +1 in reply to Cesc Yang
    TI__Guru 70081 points

    Hello,

    Cesc Yang said:
    Can the A-core's TEE access the SA3 accelerator on an HS-SE device?

    It can partially access the Security Accelerator.

    Please see the following SAx_UL init API in the OPTEE

    https://github.com/OP-TEE/optee_os/blob/96e8f740b7601089fcabb8806a06bbd704d33f3f/core/arch/arm/plat-k3/drivers/sa2ul.c#L38

    Cesc Yang said:
    If the SA3 accelerator accessed by the TEE and the SA3 accelerator used by the HSM are the same hardware engine, would there be any conflict during concurrent access from both the TEE and HSM?

    There wouldn't be any conflict. There are PKTDMA channels allocated for different hosts so the arbitration could be handled by the accelerator itself.

    Regards,

    Prashant