Skip to content

Commit f23d0bf

Browse files
shiva-tishiva-ti
committed
feat(security): add Security Overview page
- create new Security_overview.rst as the landing page for security documentation - provide comprehensive security framework details and features overview - add references to Security_overview in platform TOC files (AM62X, AM62AX, AM62PX, AM62LX) - add cross-reference links in related security documentation Signed-off-by: Shiva Tripathi <[email protected]>
1 parent acfa2f5 commit f23d0bf

File tree

10 files changed

+96
-0
lines changed

10 files changed

+96
-0
lines changed

‎configs/AM62AX/AM62AX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ linux/Foundational_Components/Power_Management/pm_wakeup_sources
9393
linux/Foundational_Components/Power_Management/pm_sw_arch
9494
linux/Foundational_Components/Power_Management/pm_debug
9595

96+
linux/Foundational_Components/System_Security/Security_overview
9697
linux/Foundational_Components/System_Security/SELinux
9798
linux/Foundational_Components/System_Security/Auth_boot
9899

‎configs/AM62LX/AM62LX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ linux/Foundational_Components/Power_Management/pm_cpuidle
7878
linux/Foundational_Components/Power_Management/pm_am62lx_low_power_modes
7979
linux/Foundational_Components/Power_Management/pm_wakeup_sources
8080

81+
linux/Foundational_Components/System_Security/Security_overview
8182
#linux/Foundational_Components/System_Security/SELinux
8283
linux/Foundational_Components/System_Security/Auth_boot
8384

‎configs/AM62PX/AM62PX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ linux/Foundational_Components/Power_Management/pm_wakeup_sources
9898
linux/Foundational_Components/Power_Management/pm_sw_arch
9999
linux/Foundational_Components/Power_Management/pm_debug
100100

101+
linux/Foundational_Components/System_Security/Security_overview
101102
linux/Foundational_Components/System_Security/SELinux
102103
linux/Foundational_Components/System_Security/Auth_boot
103104

‎configs/AM62X/AM62X_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ linux/Foundational_Components/Power_Management/pm_wakeup_sources
9595
linux/Foundational_Components/Power_Management/pm_sw_arch
9696
linux/Foundational_Components/Power_Management/pm_debug
9797

98+
linux/Foundational_Components/System_Security/Security_overview
9899
linux/Foundational_Components/System_Security/SELinux
99100
linux/Foundational_Components/System_Security/Auth_boot
100101

‎source/linux/Foundational_Components/Kernel/Kernel_Drivers/Crypto/DTHEv2.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
.. _DTHEv2-Crypto-Accelerator:
2+
.. _crypto-accelerator:
23

34
######
45
Crypto

‎source/linux/Foundational_Components/Kernel/Kernel_Drivers/Crypto/SA2UL_OMAP.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
.. _SAUL-Crypto-Accelerator:
2+
.. _crypto-accelerator:
3+
14
######
25
Crypto
36
######

‎source/linux/Foundational_Components/System_Security/Security_overview.rst‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
.. _Security_overview:
2+
3+
###############
4+
Device Security
5+
###############
6+
7+
=================
8+
Security Overview
9+
=================
10+
11+
The |__PART_FAMILY_DEVICE_NAMES__| SoC offers a comprehensive set of
12+
security features that protect embedded Linux applications. This guide
13+
offers a starting point to understand and implement these capabilities
14+
as part of product development, with the following advantages:
15+
16+
* **Hardware-backed security** - Leverages built-in security hardware
17+
for robust protection
18+
* **Defense in-depth** - Implements security at multiple level including
19+
hardware, firmware, software to protect against wide range of attacks
20+
* **Industry standards compliance** - Incorporates security measures
21+
like secure boot, TrustZone, and crypto acceleration that can help meet
22+
requirements in standards such as IEC 62443 and NIST guidelines
23+
* **Flexible implementation** - Allows security features that can be
24+
tailored to specific application needs
25+
26+
================
27+
Security Domains
28+
================
29+
30+
Below is an overview of the security framework's main domains:
31+
32+
.. figure:: ./images/security_framework.png
33+
34+
These security domains create a chain of trust protecting the
35+
|__PART_FAMILY_DEVICE_NAMES__| SoC from boot through runtime and storage,
36+
ensuring system integrity and data confidentiality.
37+
38+
=============================
39+
Security Features at a Glance
40+
=============================
41+
42+
The following table lists some of the key Security Features:
43+
44+
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
45+
46+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
47+
| **Security Feature** | **Description** | **Links** |
48+
+=========================+===========================================================+======================================+
49+
| **Authenticated Boot** | Verifies each boot component to ensure only authorized | :ref:`auth_boot_guide` |
50+
| | code executes on the device | |
51+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
52+
| **Crypto Acceleration** | Hardware driver support for cryptographic algorithms | :ref:`crypto-accelerator` |
53+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
54+
| **Key Management** | Tools for secure key provisioning | :ref:`key-writer-lite-label` |
55+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
56+
| **Secure Storage** | Protection mechanisms for sensitive data | :ref:`secure-storage-with-rpmb` |
57+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
58+
| **Trusted Execution** | Implementation of secure monitor (EL3) firmware that | :ref:`foundational-components-atf` |
59+
| | manages the secure boot process and TrustZone transitions | |
60+
+ +-----------------------------------------------------------+--------------------------------------+
61+
| | Trusted Execution Environment that enables isolated | :ref:`foundational-components-optee` |
62+
| | execution of security-sensitive applications and services | |
63+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
64+
65+
.. ifconfig:: CONFIG_part_variant in ('AM62X', 'AM62PX', 'AM62AX')
66+
67+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
68+
| Security Feature | Description | Links |
69+
+=========================+===========================================================+======================================+
70+
| **Authenticated Boot** | Verifies each boot component to ensure only authorized | :ref:`auth_boot_guide` |
71+
| | code executes on the device | |
72+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
73+
| **Crypto Acceleration** | Hardware driver support for cryptographic algorithms | :ref:`crypto-accelerator` |
74+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
75+
| **Secure Storage** | Protection mechanisms for sensitive data | :ref:`secure-storage-with-rpmb` |
76+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
77+
| **SELinux** | Kernel security module providing policy-based access | :ref:`selinux_guide` |
78+
| | control for processes, files, and system objects | |
79+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
80+
| **Trusted Execution** | Implementation of secure monitor (EL3) firmware that | :ref:`foundational-components-atf` |
81+
| | manages the secure boot process and TrustZone transitions | |
82+
+ +-----------------------------------------------------------+--------------------------------------+
83+
| | Trusted Execution Environment that enables isolated | :ref:`foundational-components-optee` |
84+
| | execution of security-sensitive applications and services | |
85+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
86+

‎source/linux/Foundational_Components/System_Security/images/security_framework.png‎

38.4 KB
Loading

‎source/linux/Foundational_Components_OPTEE.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ of entropy can work around these issues.
7575
7676
$ make CROSS_COMPILE="$CROSS_COMPILE_32" CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=k3-|__OPTEE_PLATFORM_FLAVOR__| CFG_ARM64_core=y CFG_WITH_SOFTWARE_PRNG=y
7777
78+
.. _secure-storage-with-rpmb:
7879

7980
Secure Storage with RPMB (For HS)
8081
*********************************

‎source/linux/Foundational_Components_Security.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ Security
77
.. toctree::
88
:maxdepth: 5
99

10+
Foundational_Components/System_Security/Security_overview
1011
Foundational_Components_Migration_Guide
1112
Foundational_Components_Secure_Boot
1213
Foundational_Components/System_Security/SELinux

0 commit comments

Comments
 (0)