SWCU195A December 2024 – May 2025 CC2744R7-Q1 , CC2745P10-Q1 , CC2745R10-Q1 , CC2745R7-Q1 , CC2755R10
Much of the cryptographic functionality that the HSM provides is facilitated by way of the Hardware Security Modules Firmware (HSM FW). The HSM IP will always perform verification of the HSM FW through an RSA 3K public key to ensure that the HSM FW has been properly signed by the TI (part Manufacturer) RSA 3K private key. This ensures that only TI-sanctioned HSM FW can be used. Note that the HSM FW will not be programmed to the device from TI. Just as the customer is expected to program their own application and xCFG sectors, the customer is also expected to program the HSM FW as necessary.
Note that the HSM FW consumes at most 96KB of main flash. The System ROM will always write, erase, and read-protect the upper/last 96KB of main flash for this purpose. Because of this, the last 96KB of main flash will not be usable for application purposes and should be considered to be a reserved region. The HSM FW has both a version and a rollback ID associated with it, both of which can be requested from a device by sending the Get System Information SACI command. The version is used for quickly comparing one HSM FW to another. The rollback ID is used to facilitate anti-rollback protection. This means that if there ever comes a time in which a critical security vulnerability is found in a version of the HSM FW that has already been released to the public, TI will work to resolve the vulnerability with priority and release a patched HSM FW version. This version will include an incremented rollback ID. Once this theoretical-patched HSM FW has been programmed to the devices in the field, those devices are unable to accept the older and still vulnerable HSM FW versions, which protect the devices from being rolled back to a previously insecure HSM FW version.
Note: If a Chip Erase is performed on the device, then anti-rollback protections are reset. Thus, a device that has undergone a SACI Chip Erase will once again accept an older, potentially vulnerable HSM FW image. It is the expectation of the customer that the Guidelines for Securely configuring the device are followed so that this cannot happen.