Skip to content

Commit 115f69b

Browse files
Pratham-Tpraneethbajjuri
Pratham-T
authored and
praneethbajjuri
committed
feat(security): Add Secure Boot documentation for AM62LX SoC
Secure boot page is missing AM62L specific documentation. Due to very large difference with other SoCs in the boot flow, this contains many differences in documentation as well. This commit adds any AM62L specific information in the Secure Boot section, and adds it to its TOC. Signed-off-by: T Pratham <t-pratham@ti.com>
1 parent a9d11d5 commit 115f69b

5 files changed

Lines changed: 206 additions & 89 deletions

File tree

‎configs/AM62LX/AM62LX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ linux/Foundational_Components/System_Security/Security_overview
8686
linux/Foundational_Components/System_Security/Auth_boot
8787
linux/Foundational_Components/System_Security/Memory_Firewalls
8888
linux/Foundational_Components/System_Security/Filesystem_Encryption
89+
linux/Foundational_Components_Secure_Boot
8990

9091
linux/Foundational_Components_Kernel_Users_Guide
9192
linux/Foundational_Components_Kernel_LTP-DDT_Validation

‎source/images/AM62L_BF.png‎

162 KB
Loading

‎source/images/AM62L_KF.png‎

71.3 KB
Loading

‎source/linux/Foundational_Components/System_Security/Security_overview.rst‎

Lines changed: 36 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,19 @@ Device Security
88
Security Overview
99
=================
1010

11-
The |__PART_FAMILY_DEVICE_NAMES__| SoC offers a comprehensive set of
12-
security features that protect embedded Linux applications. This guide
13-
offers a starting point to understand and implement these capabilities
11+
The |__PART_FAMILY_DEVICE_NAMES__| SoC offers a comprehensive set of
12+
security features that protect embedded Linux applications. This guide
13+
offers a starting point to understand and implement these capabilities
1414
as part of product development, with the following advantages:
1515

16-
* **Hardware-backed security** - Leverages built-in security hardware
16+
* **Hardware-backed security** - Leverages built-in security hardware
1717
for robust protection
1818
* **Defense in-depth** - Implements security at many levels including
1919
hardware, firmware, software to protect against wide range of attacks
2020
* **Industry standards compliance** - Incorporates security measures such
2121
as secure boot, TrustZone, and crypto acceleration that can help meet
2222
requirements in standards such as IEC 62443 and NIST guidelines
23-
* **Flexible implementation** - Allows security features that can be
23+
* **Flexible implementation** - Allows security features that can be
2424
tailored to specific application needs
2525

2626
================
@@ -31,7 +31,7 @@ Below is an overview of the security framework's main domains:
3131

3232
.. figure:: ./images/security_framework.png
3333

34-
These security domains create a chain of trust protecting the
34+
These security domains create a chain of trust protecting the
3535
|__PART_FAMILY_DEVICE_NAMES__| SoC from boot through runtime and storage,
3636
ensuring system integrity and data confidentiality.
3737

@@ -43,31 +43,35 @@ The following table lists some of the key Security Features:
4343

4444
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
4545

46-
+-------------------------+-----------------------------------------------------------+--------------------------------------+
47-
| **Security Feature** | **Description** | **Links** |
48-
+=========================+===========================================================+======================================+
49-
| **Authenticated Boot** | Verifies each boot component to ensure only authorized | :ref:`auth_boot_guide` |
50-
| | code executes on the device | |
51-
+-------------------------+-----------------------------------------------------------+--------------------------------------+
52-
| **Crypto Acceleration** | Hardware driver support for cryptographic algorithms and | :ref:`crypto-accelerator` |
53-
| **and TRNG** | hardware entropy based secure random number generation | |
54-
+-------------------------+-----------------------------------------------------------+--------------------------------------+
55-
| **Key Management** | Tools for secure key provisioning | :ref:`key-writer-lite-label` |
56-
+-------------------------+-----------------------------------------------------------+--------------------------------------+
57-
| **Secure Storage** | Protection mechanisms for sensitive data | :ref:`secure-storage-with-rpmb` |
58-
+-------------------------+-----------------------------------------------------------+--------------------------------------+
59-
| **Trusted Execution** | Implementation of secure monitor (EL3) firmware that | :ref:`foundational-components-atf` |
60-
| | manages the secure boot process and TrustZone transitions | |
61-
+ +-----------------------------------------------------------+--------------------------------------+
62-
| | Trusted Execution Environment that enables isolated | :ref:`foundational-components-optee` |
63-
| | execution of security-sensitive applications and services | |
64-
+-------------------------+-----------------------------------------------------------+--------------------------------------+
65-
| **Memory Firewalls** | Prevents unauthorized access through hardware-enforced | :ref:`memory-firewalls` |
66-
| | security boundaries | |
67-
+-------------------------+-----------------------------------------------------------+--------------------------------------+
68-
|**fTPM based** | Yocto reference implemenation of filesystem encryption | :ref:`filesystem-encryption` |
69-
|**Filesystem Encryption**| using LUKS2 with TPM-sealed keys | |
70-
+-------------------------+-----------------------------------------------------------+--------------------------------------+
46+
+-------------------------+-----------------------------------------------------------+-----------------------------------------+
47+
| **Security Feature** | **Description** | **Links** |
48+
+=========================+===========================================================+=========================================+
49+
| **Secure Boot** | Verifies and decrypts each boot stage, establishing a | :ref:`foundational-secure-boot` |
50+
| | hardware-backed chain of trust from ROM to Linux using | |
51+
| | customer-programmable keys | |
52+
+-------------------------+-----------------------------------------------------------+-----------------------------------------+
53+
| **Authenticated Boot** | Verifies each boot component to ensure only authorized | :ref:`auth_boot_guide` |
54+
| | code executes on the device | |
55+
+-------------------------+-----------------------------------------------------------+-----------------------------------------+
56+
| **Crypto Acceleration** | Hardware driver support for cryptographic algorithms and | :ref:`crypto-accelerator` |
57+
| **and TRNG** | hardware entropy based secure random number generation | |
58+
+-------------------------+-----------------------------------------------------------+-----------------------------------------+
59+
| **Key Management** | Tools for secure key provisioning | :ref:`key-writer-lite-label` |
60+
+-------------------------+-----------------------------------------------------------+-----------------------------------------+
61+
| **Secure Storage** | Protection mechanisms for sensitive data | :ref:`secure-storage-with-rpmb` |
62+
+-------------------------+-----------------------------------------------------------+-----------------------------------------+
63+
| **Trusted Execution** | Implementation of secure monitor (EL3) firmware that | :ref:`foundational-components-atf` |
64+
| | manages the secure boot process and TrustZone transitions | |
65+
+ +-----------------------------------------------------------+-----------------------------------------+
66+
| | Trusted Execution Environment that enables isolated | :ref:`foundational-components-optee` |
67+
| | execution of security-sensitive applications and services | |
68+
+-------------------------+-----------------------------------------------------------+-----------------------------------------+
69+
| **Memory Firewalls** | Prevents unauthorized access through hardware-enforced | :ref:`memory-firewalls` |
70+
| | security boundaries | |
71+
+-------------------------+-----------------------------------------------------------+-----------------------------------------+
72+
|**fTPM based** | Yocto reference implemenation of filesystem encryption | :ref:`filesystem-encryption` |
73+
|**Filesystem Encryption**| using LUKS2 with TPM-sealed keys | |
74+
+-------------------------+-----------------------------------------------------------+-----------------------------------------+
7175

7276

7377
.. ifconfig:: CONFIG_part_variant in ('AM62X', 'AM62PX', 'AM62AX')
@@ -120,6 +124,6 @@ The following table lists some of the key Security Features:
120124
| | execution of security-sensitive applications and services | |
121125
+-------------------------+-----------------------------------------------------------+--------------------------------------+
122126
| **Memory Firewalls** | Prevents unauthorized access through hardware-enforced | :ref:`memory-firewalls` |
123-
| | security boundaries | |
127+
| | security boundaries | |
124128
+-------------------------+-----------------------------------------------------------+--------------------------------------+
125129

0 commit comments

Comments
 (0)