Skip to content

Commit 4c41802

Browse files
committed
feat(security): Generalize boot flow page for non-AM64x SoCs
Currently, the secure boot section is tailored for AM64x. But the same information is applicable to non-AM64x SoCs, that is AM62x, AM62P. Therefore generalize the page and add it these other devices' TOCs. Signed-off-by: Suhaas Joshi <s-joshi@ti.com>
1 parent 4a80bf5 commit 4c41802

3 files changed

Lines changed: 16 additions & 8 deletions

File tree

configs/AM62PX/AM62PX_linux_toc.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ linux/Foundational_Components/System_Security/Security_overview
103103
linux/Foundational_Components/System_Security/SELinux
104104
linux/Foundational_Components/System_Security/Auth_boot
105105
linux/Foundational_Components/System_Security/Memory_Firewalls
106+
linux/Foundational_Components_Secure_Boot
106107

107108
linux/Foundational_Components_Kernel_Users_Guide
108109
linux/Foundational_Components_Kernel_LTP-DDT_Validation

configs/AM62X/AM62X_linux_toc.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ linux/Foundational_Components/System_Security/Security_overview
100100
linux/Foundational_Components/System_Security/SELinux
101101
linux/Foundational_Components/System_Security/Auth_boot
102102
linux/Foundational_Components/System_Security/Memory_Firewalls
103+
linux/Foundational_Components_Secure_Boot
103104

104105
linux/Foundational_Components_PRU_Subsystem
105106
linux/Foundational_Components/PRU-ICSS-Linux-Drivers

source/linux/Foundational_Components_Secure_Boot.rst

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -69,14 +69,20 @@ The exact location is device dependent. More details can be found in the device
6969
* DMSC firmware: `Texas Instruments Foundational Security (TIFS)` + Device/Power Manager: After authentication/decryption, DMSC firmware replaces the Secure ROM as the authenticator entity executing on the DMSC core.
7070
* R5 SPL: The R5 SPL bootloader is executed on the R5 core.
7171

72-
.. ifconfig:: CONFIG_part_variant in ('AM62x')
72+
.. ifconfig:: CONFIG_part_variant not in ('AM64X')
7373

74-
- `AM62x TRM <https://www.ti.com/lit/pdf/spruiv7>`_
74+
.. ifconfig:: CONFIG_part_variant in ('AM62X')
7575

76-
The contents of this first stage image are authenticated and decrypted by the Secure ROM. Contents include:
76+
- `AM62x TRM <https://www.ti.com/lit/pdf/spruiv7>`_
77+
78+
.. ifconfig:: CONFIG_part_variant in ('AM62PX')
79+
80+
- `AM62P TRM <https://www.ti.com/lit/pdf/spruj83>`_
81+
82+
The contents of this first stage image are authenticated and decrypted by the Secure ROM. Contents include:
7783

78-
* `Texas Instruments Foundational Security (TIFS)` firmware: After authentication/decryption, TIFS firmware replaces the Secure ROM as the authenticator entity executing on the TIFS core.
79-
* R5 SPL`: The R5 SPL bootloader is executed on the R5 core.
84+
* `Texas Instruments Foundational Security (TIFS)` firmware: After authentication/decryption, TIFS firmware replaces the Secure ROM as the authenticator entity executing on the TIFS core.
85+
* R5 SPL`: The R5 SPL bootloader is executed on the R5 core.
8086

8187
.. rubric:: R5 SPL
8288

@@ -195,9 +201,9 @@ HS Boot Flow Tools
195201

196202
U-boot:
197203

198-
The ti-u-boot source is a project used to create tiboot3.bin, tispl.bin, and u-boot.img. To create tiboot3.bin for AM64x family devices, u-boot builds R5 SPL and
204+
The ti-u-boot source is a project used to create tiboot3.bin, tispl.bin, and u-boot.img. To create tiboot3.bin for Sitara family devices, u-boot builds R5 SPL and
199205
binman packages it in a `tiboot3.bin` image. To build A53 SPL, binman takes ATF (bl31.bin), OPTEE (bl32.bin), A53 SPL, and A53 DTBs and packages
200-
them in a `tispl.bin` image. The openssl library can then then be used to sign each component as specified in k3-am64x-binman.dtsi.
206+
them in a `tispl.bin` image. The openssl library can then then be used to sign each component as specified in k3-<soc>-binman.dtsi.
201207

202208
.. code-block:: console
203209
@@ -246,7 +252,7 @@ OPTEE:
246252
Ti-linux-firmware:
247253

248254
The ti-linux-firmware is a TI repository where all firmware releases are stored. Firmwares for a device family can also be found in the pre-built SDK
249-
under <path-to-tisdk>/board-support/prebuilt-images/am64xx-evm. Binman expects to find the device firmware with the following appended to u-boot build command:
255+
under <path-to-tisdk>/board-support/prebuilt-images/<evm>. Binman expects to find the device firmware with the following appended to u-boot build command:
250256
BINMAN_INDIRS=<path-to-tisdk>/board-support/prebuilt-images, and expects to find a ti-sysfw directory in this path.
251257

252258
.. code-block:: console

0 commit comments

Comments
 (0)