SPRADN0 December   2024 F29H850TU , F29H859TU-Q1

 

  1.   1
  2.   Abstract
  3.   Trademarks
  4. 1Programming Fundamentals
  5. 2Introduction
    1. 2.1 Hardware Security Module
    2. 2.2 ROM Bootloader
    3. 2.3 Combined Image with X.509 Certificate
  6. 3Flash Kernel Implementation
    1. 3.1 CPU1 Firmware Upgrade (HS-FS)
    2. 3.2 Key Provision (HS-FS to HS-KP)
    3. 3.3 CPU1 Secure Firmware Upgrade (HS-KP/SE to HS-SE)
    4. 3.4 HSM Firmware Upgrade (HS-KP/SE to HS-SE)
    5. 3.5 SECCFG Code Provisioning (HS-KP/SE to HS-SE)
  7. 4Host Application: UART Flash Programmer
    1. 4.1 Overview
    2. 4.2 Build UART Flash Programmer with Visual Studio
    3. 4.3 Build UART Flash Programmer with CMake
    4. 4.4 Packet Format
    5. 4.5 Kernel Commands
  8. 5Example Usage
    1. 5.1 Loading the Flash Kernel onto the Device
      1. 5.1.1 Hardware Setup
      2. 5.1.2 Running the UART Flash Programmer
    2. 5.2 CPU1 Device Firmware Upgrade (HS-FS only)
    3. 5.3 Convert HS-FS to HS-SE
    4. 5.4 Loading a RAM-based HSMRt Image
    5. 5.5 Key Provision (HS-FS to HS-KP)
    6. 5.6 Code Provision (HS-KP/SE to HS-SE)
  9. 6Troubleshooting
    1. 6.1 General
    2. 6.2 UART Boot
    3. 6.3 Application Load
  10. 7Summary
  11. 8References

5.4 Loading a RAM-based HSMRt Image

For all functionality associated with Key and Code Provision, loading a RAM-based HSM runtime (HSMRt) image is required.

HSMRt service HSM requests from the flash kernel, and once authenticated, this programs a set of field required to convert the device to a different state. For more information on the fields being programmed, refer to the OTP Keywriter section in Section 2.1.

After the flash kernel has been booted onto the device via BootROM in UART boot mode, select Load HSMRt Image (option 2). The host sends a RAM-based HSMRt image to the C29 CPU1, which is subsequently validated by HSM. Upon successful validation, this RAM-based HSMRt begins executing in shared RAM.

Note that two separate HSMRt binary are needed for Key and Code Provision, each with different key certificate. In Key Provision for HS-FS, the key certificate needs to be the default TI-provided key, whereas Code Provision is using the user's custom key certificate.