Skip to content

Commit daeb0af

Browse files
Pratham-TPratham-T
committed
feat(security): Add Secure Boot documentation for AM62LX SoC
Secure boot page is missing AM62L specific documentation. Due to very large difference with other SoCs in the boot flow, this contains many differences in documentation as well. This commit adds any AM62L specific information in the Secure Boot section, and adds it to its TOC. Signed-off-by: T Pratham <t-pratham@ti.com>
1 parent 310c452 commit daeb0af

4 files changed

Lines changed: 170 additions & 57 deletions

File tree

‎configs/AM62LX/AM62LX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ linux/Foundational_Components/System_Security/Security_overview
8585
linux/Foundational_Components/System_Security/Auth_boot
8686
linux/Foundational_Components/System_Security/Memory_Firewalls
8787
linux/Foundational_Components/System_Security/Filesystem_Encryption
88+
linux/Foundational_Components_Secure_Boot
8889

8990
linux/Foundational_Components_Kernel_Users_Guide
9091
linux/Foundational_Components_Kernel_LTP-DDT_Validation

‎source/images/AM62L_BF.png‎

162 KB
Loading

‎source/images/AM62L_KF.png‎

53.6 KB
Loading

‎source/linux/Foundational_Components_Secure_Boot.rst‎

Lines changed: 169 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -32,92 +32,183 @@ The following is an example list where Chain-of-Trust should be maintained.
3232
- Disable kernel debug options
3333
- Disable/remove userspace debug tools, devmem disable, etc..
3434

35-
We offer methods for U-Boot's Secondary Program Loader (SPL) to securely verify the U-Boot
36-
proper. U-Boot calls Texas Instrument Foundational Security (TIFS) through Texas Instruments System Controller Interface (TISCI)
37-
to do this. For more information about using TISCI methods see the
38-
`TISCI User Guide <https://software-dl.ti.com/tisci/esd/latest/index.html>`__. U-Boot proper then securely verifies and decrypts the kernel, Device Tree Blobs (DTB), and initramfs.
35+
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
3936

40-
.. Image:: /images/K3_KF.png
41-
:scale: 70%
37+
The U-Boot's Secondary Program Loader (SPL) securely verifies the U-Boot
38+
proper. U-Boot uses its verified boot framework to do this. U-Boot proper
39+
then securely verifies and decrypts the kernel, Device Tree Blobs (DTB),
40+
and initramfs.
41+
42+
.. Image:: /images/AM62L_KF.png
43+
:scale: 70%
44+
45+
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
46+
47+
We offer methods for U-Boot's Secondary Program Loader (SPL) to securely
48+
verify the U-Boot proper. U-Boot calls Texas Instrument Foundational
49+
Security (TIFS) through Texas Instruments System Controller Interface
50+
(TISCI) to do this. For more information about using TISCI methods see the
51+
`TISCI User Guide <https://software-dl.ti.com/tisci/esd/latest/index.html>`__.
52+
U-Boot proper then securely verifies and decrypts the kernel, Device Tree
53+
Blobs (DTB), and initramfs.
54+
55+
.. Image:: /images/K3_KF.png
56+
:scale: 70%
4257

4358
Secure boot has layers. Some layers are trusted more than others. Secure ROM has the highest trust and Runtime Execution
4459
Environment (REE) non-trustzone user-space applications have the least. If a
4560
lower trust entity must load a higher trust code, an even higher trust entity
4661
must verify it and not allow access by the lower trust entity after that
4762
point. Some such trust inversions are as follows:
4863

49-
- R5 U-Boot loading ATF/OP-TEE
50-
- R5 Public Boot ROM loading TIFS
51-
- Linux loading Trusted applications(TA)
64+
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
65+
66+
- A53 Public Boot ROM loading TF-A/OP-TEE
67+
- A53 Public Boot ROM loading TIFS
68+
- Linux loading Trusted applications (TA)
69+
70+
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
71+
72+
- R5 U-Boot loading TF-A/OP-TEE
73+
- R5 Public Boot ROM loading TIFS
74+
- Linux loading Trusted applications (TA)
5275

5376
These are called out in the sequence as shown in the following image and their method of ensuring trust is explained.
5477

5578
Secure Boot Flow
5679
--------------------
5780

58-
.. Image:: /images/K3_BF.jpg
59-
:scale: 70%
81+
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
82+
83+
.. Image:: /images/AM62L_BF.png
84+
:scale: 70%
85+
86+
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
87+
88+
.. Image:: /images/K3_BF.jpg
89+
:scale: 70%
6090

6191
.. rubric:: ROM
6292

63-
On device startup, execution begins with the ROM bootloader (Secure ROM) running on the DSMC/TIFS core. After initial device security
64-
setup the Secure ROM starts the Public ROM running on the R5 core. The Public Boot ROM handles loading the first stage image `tiboot3.bin` from a
65-
peripheral as selected by the BOOTMODE pins. This image is placed into on chip SRAM as external memory interfaces such as DDR are not yet enabled.
66-
The exact location is device dependent. More details can be found in the device "Technical Reference Manual".
93+
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
94+
95+
On device startup, execution begins with the ROM bootloader (Secure ROM)
96+
running on the DSMC/TIFS core. After initial device security setup the
97+
Secure ROM starts the Public ROM running on the R5 core. The Public Boot ROM
98+
handles loading the first stage image :file:`tiboot3.bin` from a peripheral
99+
as selected by the BOOTMODE pins. This image is placed into on chip SRAM as
100+
external memory interfaces such as DDR are not yet enabled. The exact
101+
location is device dependent. More details can be found in the device
102+
"Technical Reference Manual".
103+
104+
.. ifconfig:: CONFIG_part_variant in ('AM64X')
105+
106+
The contents of this first stage image are authenticated and decrypted by
107+
the Secure ROM. Contents include:
67108

68-
.. ifconfig:: CONFIG_part_variant in ('AM64x')
109+
* DMSC firmware: `Texas Instruments Foundational Security (TIFS)` + Device/Power Manager: After authentication/decryption, DMSC firmware replaces the Secure ROM as the authenticator entity executing on the DMSC core.
110+
* R5 SPL: The R5 SPL bootloader is executed on the R5 core.
69111

70-
The contents of this first stage image are authenticated and decrypted by the Secure ROM. Contents include:
112+
.. ifconfig:: CONFIG_part_variant not in ('AM64X')
71113

72-
* DMSC firmware: `Texas Instruments Foundational Security (TIFS)` + Device/Power Manager: After authentication/decryption, DMSC firmware replaces the Secure ROM as the authenticator entity executing on the DMSC core.
73-
* R5 SPL: The R5 SPL bootloader is executed on the R5 core.
114+
The contents of this first stage image are authenticated and decrypted by
115+
the Secure ROM. Contents include:
74116

75-
.. ifconfig:: CONFIG_part_variant not in ('AM64X')
117+
* `Texas Instruments Foundational Security (TIFS)` firmware: After authentication/decryption, TIFS firmware replaces the Secure ROM as the authenticator entity executing on the TIFS core.
118+
* R5 SPL: The R5 SPL bootloader is executed on the R5 core.
119+
120+
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
121+
122+
On device startup, execution begins with the ROM bootloader (Secure ROM)
123+
running on SMS M4 core. After initial device security setup, the Secure ROM
124+
starts the Public ROM running on the A53 core. The Public ROM handles
125+
loading the first stage image :file:`tiboot3.bin` from a peripheral as
126+
selected by the BOOTMODE pins. This image is placed into on-chip SRAM as
127+
external memory interfaces such as DDR are not yet enabled. The exact
128+
location is device dependent. More details can be found in the device
129+
"Technical Reference Manual".
76130

77131
The contents of this first stage image are authenticated and decrypted by the Secure ROM. Contents include:
78132

79-
* `Texas Instruments Foundational Security (TIFS)` firmware: After authentication/decryption, TIFS firmware replaces the Secure ROM as the authenticator entity executing on the TIFS core.
80-
* R5 SPL`: The R5 SPL bootloader is executed on the R5 core.
133+
* `Texas Instruments Foundational Security (TIFS)` firmware: After authentication/decryption, TIFS firmware replaces the Secure ROM as the authenticator entity executing on the M4 core in the 2nd phase of the boot.
134+
* BL-1: The pre-bootloader executed on the A53 core, initializes the console and DDR for the 2nd phase of the boot.
81135

82-
.. rubric:: R5 SPL
136+
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
83137

84-
R5 SPL loads the second boot stage FIT image `tispl.bin` from the peripheral as selected by the BOOTMODE pins. From this FIT image, TF-A, OPTEE, A53 SPL,
85-
and SPL DTB are extracted and authenticated and/or decrypted by TIFS. If authentication passed, the R5 SPL starts the ARM64 core. TF-A, OPTEE, and A53 SPL
86-
will begin execution on the ARM64 core. R5 SPL also configures DDR and the console so the user can see the first prints as seen below:
138+
.. rubric:: R5 SPL
87139

88-
R5 SPL's output will be similar to this:
89-
Notice the "Authentication passed" lines as TF-A, OPTEE, A53 SPL, and SPL DTB are authenticated.
140+
R5 SPL loads the second boot stage FIT image `tispl.bin` from the
141+
peripheral as selected by the BOOTMODE pins. From this FIT image, TF-A,
142+
OPTEE, A53 SPL, and SPL DTB are extracted and authenticated and/or decrypted
143+
by TIFS. If authentication passed, the R5 SPL starts the ARM64 core. TF-A,
144+
OPTEE, and A53 SPL will begin execution on the ARM64 core. R5 SPL also
145+
configures DDR and the console so the user can see the first prints as seen
146+
below:
90147

91-
.. code-block:: console
148+
R5 SPL's output will be similar to this:
149+
Notice the "Authentication passed" lines as TF-A, OPTEE, A53 SPL, and SPL DTB are authenticated.
150+
151+
.. code-block:: console
92152
93-
U-Boot SPL 2021.01-dirty (May 13 2022 - 15:05:11 -0500)
94-
SYSFW ABI: 3.1 (firmware rev 0x0008 '8.4.0-3-gd5cb1+ (Jolly Jellyfis')
95-
SPL initial stack usage: 13392 bytes
96-
Trying to boot from MMC2
97-
Authentication passed
98-
Authentication passed
99-
Authentication passed
100-
Authentication passed
101-
Starting ATF on ARM64 core...
153+
U-Boot SPL 2021.01-dirty (May 13 2022 - 15:05:11 -0500)
154+
SYSFW ABI: 3.1 (firmware rev 0x0008 '8.4.0-3-gd5cb1+ (Jolly Jellyfis')
155+
SPL initial stack usage: 13392 bytes
156+
Trying to boot from MMC2
157+
Authentication passed
158+
Authentication passed
159+
Authentication passed
160+
Authentication passed
161+
Starting ATF on ARM64 core...
102162
103-
.. ifconfig:: CONFIG_part_variant in ('AM62x')
163+
.. ifconfig:: CONFIG_part_variant in ('AM62x')
104164

105-
After R5 SPL, the device/power manager firmware continues running on the R5 core.
165+
After R5 SPL, the device/power manager firmware continues running on the R5 core.
106166

107167
.. rubric:: A53 SPL
108168

109-
A53 SPL then loads the U-Boot proper FIT image `U-boot.img` from the peripheral as selected by the BOOTMODE pins. From this FIT image, the U-boot bootloader
110-
and DTB are extracted before passing execution to u-boot proper.
169+
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
111170

112-
A53 SPL's output will be similar to this: (notice the "Authentication passed" lines as U-Boot and the DTB are authenticated).
171+
A53 SPL then loads the U-Boot proper FIT image :file:`u-boot.img` from the
172+
peripheral as selected by the BOOTMODE pins. From this FIT image, the U-Boot
173+
bootloader and DTB are extracted before passing execution to U-Boot proper.
113174

114-
.. code-block:: console
175+
A53 SPL's output will be similar to this: (notice the "Authentication passed" lines as U-Boot and the DTB are authenticated).
176+
177+
.. code-block:: console
178+
179+
U-Boot SPL 2021.01-g2de57d278b (May 16 2022 - 14:28:40 +0000)
180+
SYSFW ABI: 3.1 (firmware rev 0x0008 '8.4.0-3-gd5cb1+ (Jolly Jellyfis')
181+
Trying to boot from MMC2
182+
Authentication passed
183+
Authentication passed
184+
185+
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
186+
187+
Public ROM loads the second boot stage image :file:`tispl.bin` from the
188+
peripheral as selected by the BOOTMODE pins. From this image, TF-A, OP-TEE,
189+
A53 SPL (U-Boot SPL) and SPL DTB are extracted and authenticated and/or
190+
decrypted by the Secure ROM. If authenticated, the Secure ROM resets the A53
191+
core. TF-A, OP-TEE and U-Boot SPL begin execution on the A53 core.
192+
193+
U-Boot SPL then loads the U-Boot proper FIT image :file:`u-boot.img` from
194+
the peripheral as selected by the BOOTMODE pins. The U-Boot SPL verifies the
195+
signed FIT image independently, without using TIFS. From this FIT image, the
196+
U-Boot bootloader and DTB are extracted before passing execution to U-Boot
197+
proper.
198+
199+
U-Boot SPL's output will be similar to this: (notice the "Checking hash(es)"
200+
lines as U-Boot and DTB are authenticated).
201+
202+
.. code-block:: console
115203
116-
U-Boot SPL 2021.01-g2de57d278b (May 16 2022 - 14:28:40 +0000)
117-
SYSFW ABI: 3.1 (firmware rev 0x0008 '8.4.0-3-gd5cb1+ (Jolly Jellyfis')
118-
Trying to boot from MMC2
119-
Authentication passed
120-
Authentication passed
204+
U-Boot SPL 2026.01-ti-gee3048ee0822 (Apr 09 2026 - 00:09:07 +0000)
205+
SPL initial stack usage: 1936 bytes
206+
Trying to boot from DFU
207+
######DOWNLOAD ... OK
208+
Ctrl+C to exit ...
209+
## Checking hash(es) for config conf-0 ... sha512,rsa4096:custMpk+ OK
210+
## Checking hash(es) for Image uboot ... sha512+ OK
211+
## Checking hash(es) for Image fdt-0 ... sha512+ OK
121212
122213
.. rubric:: U-Boot
123214

@@ -194,17 +285,38 @@ HS Boot Flow Tools
194285

195286
U-boot:
196287

197-
The ti-u-boot source is a project used to create tiboot3.bin, tispl.bin, and u-boot.img. To create tiboot3.bin for K3 family devices, u-boot builds R5 SPL and
198-
binman packages it in a `tiboot3.bin` image. To build A53 SPL, binman takes ATF (bl31.bin), OPTEE (bl32.bin), A53 SPL, and A53 DTBs and packages
199-
them in a `tispl.bin` image. U-Boot can then use the openssl library to sign each component as specified in k3-<soc>-binman.dtsi.
288+
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
200289

201-
.. code-block:: console
290+
The ti-u-boot source is a project used to create tiboot3.bin, tispl.bin, and u-boot.img. To create tiboot3.bin for K3 family devices, u-boot builds R5 SPL and
291+
binman packages it in a `tiboot3.bin` image. To build A53 SPL, binman takes TF-A (bl31.bin), OPTEE (bl32.bin), A53 SPL, and A53 DTBs and packages
292+
them in a `tispl.bin` image. U-Boot can then use the openssl library to sign each component as specified in k3-<soc>-binman.dtsi.
202293

203-
$ git clone https://git.ti.com/git/ti-u-boot/ti-u-boot.git
294+
.. code-block:: console
204295
205-
Example use:
206-
$ make ARCH=arm CROSS_COMPILE=aarch64-none-linux-gnu- am64x_evm_a53_defconfig
207-
$ make CROSS_COMPILE=aarch64-none-linux-gnu- ATF=bl31.bin TEE=tee-pager_v2.bin BINMAN_INDIRS=<path-to-tisdk>/board-support/prebuilt-images
296+
$ git clone https://git.ti.com/git/ti-u-boot/ti-u-boot.git
297+
298+
$ # Example use:
299+
$ make ARCH=arm CROSS_COMPILE=aarch64-none-linux-gnu- am64x_evm_a53_defconfig
300+
$ make CROSS_COMPILE=aarch64-none-linux-gnu- BL31=bl31.bin TEE=tee-pager_v2.bin BINMAN_INDIRS=<path-to-tisdk>/board-support/prebuilt-images
301+
302+
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
303+
304+
The ti-u-boot source is a project used to create :file:`tiboot3.bin`,
305+
:file:`tispl.bin`, and :file:`u-boot.img`. To create :file:`tiboot3.bin`
306+
for K3 family devices, U-Boot builds BL-1 and binman packages it in a
307+
:file:`tiboot3.bin` image. To build A53 SPL, binman takes TF-A
308+
(:file:`bl31.bin`), OPTEE (:file:`bl32.bin`), A53 SPL, and A53 DTBs and
309+
packages them in a :file:`tispl.bin` image. U-Boot can then use the
310+
openssl library to sign each component as specified in
311+
:file:`k3-am62l3-evm-binman.dtsi`.
312+
313+
.. code-block:: console
314+
315+
$ git clone https://git.ti.com/git/ti-u-boot/ti-u-boot.git
316+
317+
$ # Example use:
318+
$ make ARCH=arm CROSS_COMPILE=aarch64-none-linux-gnu- am62lx_evm_defconfig
319+
$ make CROSS_COMPILE=aarch64-none-linux-gnu- BL1=bl1.bin BL31=bl31.bin TEE=tee-pager_v2.bin BINMAN_INDIRS=<path-to-tisdk>/board-support/prebuilt-images
208320
209321
Linux:
210322

0 commit comments

Comments
 (0)