Skip to content

fix(security): Correct key flow diagram and text around it for AM64X #654

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jsuhaas22 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

fix(security): Correct key flow diagram and text around it for AM64X #654

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4a80bf5
fix(security): Correct key flow diagram and text around it for AM64X
jsuhaas22 Apr 8, 2026
4c41802
feat(security): Generalize boot flow page for non-AM64x SoCs
jsuhaas22 Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions configs/AM62PX/AM62PX_linux_toc.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ linux/Foundational_Components/System_Security/Security_overview
linux/Foundational_Components/System_Security/SELinux
linux/Foundational_Components/System_Security/Auth_boot
linux/Foundational_Components/System_Security/Memory_Firewalls
linux/Foundational_Components_Secure_Boot

linux/Foundational_Components_Kernel_Users_Guide
linux/Foundational_Components_Kernel_LTP-DDT_Validation
Expand Down
1 change: 1 addition & 0 deletions configs/AM62X/AM62X_linux_toc.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,7 @@ linux/Foundational_Components/System_Security/Security_overview
linux/Foundational_Components/System_Security/SELinux
linux/Foundational_Components/System_Security/Auth_boot
linux/Foundational_Components/System_Security/Memory_Firewalls
linux/Foundational_Components_Secure_Boot

linux/Foundational_Components_PRU_Subsystem
linux/Foundational_Components/PRU-ICSS-Linux-Drivers
Expand Down
Binary file removed source/images/K3_KF.JPG
View file
Open in desktop
Binary file not shown.
Binary file added source/images/K3_KF.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
33 changes: 19 additions & 14 deletions source/linux/Foundational_Components_Secure_Boot.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,15 +30,14 @@
- Disable kernel debug options
- Disable/remove userspace debug tools, devmem disable, etc..

We provide methods for U-Boot's SPL loader to securely verify/decrypt the U-Boot proper, and this U-Boot proper to securely verify/decrypt the
Kernel/DTB/initfamfs. This is accomplished by calling into TIFS via TI-SCI (Texas Instruments System controller Interface). This allows us to use
the same signing/encrypting tools used to authenticate the first-stage image. For more infomation using TI_SCI methods refer to the
`TISCI User Guide <https://software-dl.ti.com/tisci/esd/22_01_02/index.html>`__.
We provide methods for U-Boot's SPL loader to securely verify/encrypt the U-Boot proper. This is accomplished by calling into TIFS via TI-SCI

Check warning on line 33 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.TermsSuggestions] Depending on the context, consider using 'through', 'by', 'from', 'on', or 'by using' rather than 'via'.

Raw Output:
{"message": "[RedHat.TermsSuggestions] Depending on the context, consider using 'through', 'by', 'from', 'on', or 'by using' rather than 'via'.", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 33, "column": 132}}}, "severity": "INFO"}

Check warning on line 33 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.Definitions] Define acronyms and abbreviations (such as 'TIFS') on first occurrence if they're likely to be unfamiliar.

Raw Output:
{"message": "[RedHat.Definitions] Define acronyms and abbreviations (such as 'TIFS') on first occurrence if they're likely to be unfamiliar.", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 33, "column": 127}}}, "severity": "INFO"}

Check warning on line 33 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.PassiveVoice] 'is accomplished' is passive voice. In general, use active voice. Consult the style guide for acceptable use of passive voice.

Raw Output:
{"message": "[RedHat.PassiveVoice] 'is accomplished' is passive voice. In general, use active voice. Consult the style guide for acceptable use of passive voice.", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 33, "column": 95}}}, "severity": "INFO"}

Check warning on line 33 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.Slash] Use either 'or' or 'and' in 'verify/encrypt'

Raw Output:
{"message": "[RedHat.Slash] Use either 'or' or 'and' in 'verify/encrypt'", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 33, "column": 56}}}, "severity": "WARNING"}

Check warning on line 33 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.Definitions] Define acronyms and abbreviations (such as 'SPL') on first occurrence if they're likely to be unfamiliar.

Raw Output:
{"message": "[RedHat.Definitions] Define acronyms and abbreviations (such as 'SPL') on first occurrence if they're likely to be unfamiliar.", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 33, "column": 33}}}, "severity": "INFO"}

Check warning on line 33 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.SimpleWords] Use simple language. Consider using 'give' or 'offer' rather than 'provide'.

Raw Output:
{"message": "[RedHat.SimpleWords] Use simple language. Consider using 'give' or 'offer' rather than 'provide'.", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 33, "column": 4}}}, "severity": "INFO"}
(Texas Instruments System Controller Interface). For more infomation using TI_SCI methods refer to the

Check warning on line 34 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.TermsSuggestions] Depending on the context, consider using 'see' rather than 'refer to'.

Raw Output:
{"message": "[RedHat.TermsSuggestions] Depending on the context, consider using 'see' rather than 'refer to'.", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 34, "column": 91}}}, "severity": "INFO"}

Check warning on line 34 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.Definitions] Define acronyms and abbreviations (such as 'SCI') on first occurrence if they're likely to be unfamiliar.

Raw Output:
{"message": "[RedHat.Definitions] Define acronyms and abbreviations (such as 'SCI') on first occurrence if they're likely to be unfamiliar.", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 34, "column": 79}}}, "severity": "INFO"}

Check warning on line 34 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.Using] Use 'by using' instead of 'using' when it follows a noun for clarity and grammatical correctness.

Raw Output:
{"message": "[RedHat.Using] Use 'by using' instead of 'using' when it follows a noun for clarity and grammatical correctness.", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 34, "column": 59}}}, "severity": "WARNING"}

Check warning on line 34 in source/linux/Foundational_Components_Secure_Boot.rst

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[RedHat.Spelling] Verify the word 'infomation'. It is not in the American English or Red Hat terminology spelling dictionaries used by Vale.

Raw Output:
{"message": "[RedHat.Spelling] Verify the word 'infomation'. It is not in the American English or Red Hat terminology spelling dictionaries used by Vale.", "location": {"path": "source/linux/Foundational_Components_Secure_Boot.rst", "range": {"start": {"line": 34, "column": 59}}}, "severity": "WARNING"}
`TISCI User Guide <https://software-dl.ti.com/tisci/esd/22_01_02/index.html>`__. U-Boot proper then securely verifies/decrypts the Kernel/DTB/initramfs.

.. Image:: /images/K3_KF.JPG
.. Image:: /images/K3_KF.png
:scale: 70%

Secure boot is like an onion, it has layers. Some layers are trusted more than others. Secure ROM has the highest trust and REE (Run-time Execution
Secure boot has layers. Some layers are trusted more than others. Secure ROM has the highest trust and REE (Run-time Execution
Environment) non-trustzone user-space applications have the least. If any higher trust code is to be loaded by a lower trust entity, it must be verified
by an even higher trust entity and not allowed to be accessed by the lower trust entity after that point. Some such trust inversions are listed below:

Expand Down Expand Up @@ -70,14 +69,20 @@
* DMSC firmware: `Texas Instruments Foundational Security (TIFS)` + Device/Power Manager: After authentication/decryption, DMSC firmware replaces the Secure ROM as the authenticator entity executing on the DMSC core.
* R5 SPL: The R5 SPL bootloader is executed on the R5 core.

.. ifconfig:: CONFIG_part_variant in ('AM62x')
.. ifconfig:: CONFIG_part_variant not in ('AM64X')

- `AM62x TRM <https://www.ti.com/lit/pdf/spruiv7>`_
.. ifconfig:: CONFIG_part_variant in ('AM62X')

The contents of this first stage image are authenticated and decrypted by the Secure ROM. Contents include:
- `AM62x TRM <https://www.ti.com/lit/pdf/spruiv7>`_

.. ifconfig:: CONFIG_part_variant in ('AM62PX')

- `AM62P TRM <https://www.ti.com/lit/pdf/spruj83>`_

The contents of this first stage image are authenticated and decrypted by the Secure ROM. Contents include:

* `Texas Instruments Foundational Security (TIFS)` firmware: After authentication/decryption, TIFS firmware replaces the Secure ROM as the authenticator entity executing on the TIFS core.
* R5 SPL`: The R5 SPL bootloader is executed on the R5 core.
* `Texas Instruments Foundational Security (TIFS)` firmware: After authentication/decryption, TIFS firmware replaces the Secure ROM as the authenticator entity executing on the TIFS core.
* R5 SPL`: The R5 SPL bootloader is executed on the R5 core.

.. rubric:: R5 SPL

Expand Down Expand Up @@ -196,9 +201,9 @@

U-boot:

The ti-u-boot source is a project used to create tiboot3.bin, tispl.bin, and u-boot.img. To create tiboot3.bin for AM64x family devices, u-boot builds R5 SPL and
The ti-u-boot source is a project used to create tiboot3.bin, tispl.bin, and u-boot.img. To create tiboot3.bin for Sitara family devices, u-boot builds R5 SPL and
binman packages it in a `tiboot3.bin` image. To build A53 SPL, binman takes ATF (bl31.bin), OPTEE (bl32.bin), A53 SPL, and A53 DTBs and packages
them in a `tispl.bin` image. The openssl library can then then be used to sign each component as specified in k3-am64x-binman.dtsi.
them in a `tispl.bin` image. The openssl library can then then be used to sign each component as specified in k3-<soc>-binman.dtsi.

.. code-block:: console

Expand Down Expand Up @@ -247,7 +252,7 @@
Ti-linux-firmware:

The ti-linux-firmware is a TI repository where all firmware releases are stored. Firmwares for a device family can also be found in the pre-built SDK
under <path-to-tisdk>/board-support/prebuilt-images/am64xx-evm. Binman expects to find the device firmware with the following appended to u-boot build command:
under <path-to-tisdk>/board-support/prebuilt-images/<evm>. Binman expects to find the device firmware with the following appended to u-boot build command:
BINMAN_INDIRS=<path-to-tisdk>/board-support/prebuilt-images, and expects to find a ti-sysfw directory in this path.

.. code-block:: console
Expand Down
Loading