Skip to content

Commit c176784

Browse files
shiva-tishiva-ti
committed
feat(security): add Security Overview page
- create new Security_overview.rst as the landing page for security documentation - provide comprehensive security framework details and features overview - add references to Security_overview in platform TOC files (AM62X, AM62AX, AM62PX, AM62LX) - add cross-reference links in related security documentation Signed-off-by: Shiva Tripathi <[email protected]>
1 parent acfa2f5 commit c176784

File tree

9 files changed

+93
-0
lines changed

9 files changed

+93
-0
lines changed

‎configs/AM62AX/AM62AX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ linux/Foundational_Components/Power_Management/pm_wakeup_sources
9393
linux/Foundational_Components/Power_Management/pm_sw_arch
9494
linux/Foundational_Components/Power_Management/pm_debug
9595

96+
linux/Foundational_Components/System_Security/Security_overview
9697
linux/Foundational_Components/System_Security/SELinux
9798
linux/Foundational_Components/System_Security/Auth_boot
9899

‎configs/AM62LX/AM62LX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ linux/Foundational_Components/Power_Management/pm_cpuidle
7878
linux/Foundational_Components/Power_Management/pm_am62lx_low_power_modes
7979
linux/Foundational_Components/Power_Management/pm_wakeup_sources
8080

81+
linux/Foundational_Components/System_Security/Security_overview
8182
#linux/Foundational_Components/System_Security/SELinux
8283
linux/Foundational_Components/System_Security/Auth_boot
8384

‎configs/AM62PX/AM62PX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ linux/Foundational_Components/Power_Management/pm_wakeup_sources
9898
linux/Foundational_Components/Power_Management/pm_sw_arch
9999
linux/Foundational_Components/Power_Management/pm_debug
100100

101+
linux/Foundational_Components/System_Security/Security_overview
101102
linux/Foundational_Components/System_Security/SELinux
102103
linux/Foundational_Components/System_Security/Auth_boot
103104

‎configs/AM62X/AM62X_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ linux/Foundational_Components/Power_Management/pm_wakeup_sources
9595
linux/Foundational_Components/Power_Management/pm_sw_arch
9696
linux/Foundational_Components/Power_Management/pm_debug
9797

98+
linux/Foundational_Components/System_Security/Security_overview
9899
linux/Foundational_Components/System_Security/SELinux
99100
linux/Foundational_Components/System_Security/Auth_boot
100101

‎source/linux/Foundational_Components/Kernel/Kernel_Drivers/Crypto/SA2UL_OMAP.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
.. _SAUL-Crypto-Accelerator:
2+
13
######
24
Crypto
35
######

‎source/linux/Foundational_Components/System_Security/Security_overview.rst‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
.. _Security_overview:
2+
3+
########
4+
Overview
5+
########
6+
7+
=================
8+
Security Overview
9+
=================
10+
11+
The |__PART_FAMILY_DEVICE_NAMES__| SoC offers a comprehensive set of
12+
security features that protect embedded Linux applications. This guide
13+
offers a starting point to understand and implement these capabilities
14+
as part of product development, with the following advantages:
15+
16+
* **Hardware-backed security** - Leverages built-in security hardware
17+
for robust protection
18+
* **Defense in-depth** - Creates many layers of security to protect
19+
against various threats
20+
* **Industry standards compliance** - Implements security features that
21+
help meet regulatory requirements
22+
* **Flexible implementation** - Allows security features that can be
23+
tailored to specific application needs
24+
25+
================
26+
Security Domains
27+
================
28+
29+
Below is an overview of the security framework's main domains:
30+
31+
.. figure:: ./images/security_framework.png
32+
33+
These security domains create a chain of trust protecting the
34+
|__PART_FAMILY_DEVICE_NAMES__| from boot through runtime and storage,
35+
ensuring system integrity and data confidentiality.
36+
37+
=============================
38+
Security Features at a Glance
39+
=============================
40+
41+
The following table lists some of the key Security Features:
42+
43+
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
44+
45+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
46+
| **Security Feature** | **Description** | **Links** |
47+
+=========================+===========================================================+======================================+
48+
| **Authenticated Boot** | Verifies each boot component to ensure only authorized | :ref:`auth_boot_guide` |
49+
| | code executes on the device | |
50+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
51+
| **Crypto Acceleration** | Hardware driver support for cryptographic algorithms | :ref:`DTHEv2-Crypto-Accelerator` |
52+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
53+
| **Key Management** | Tools for secure key provisioning | :ref:`key-writer-lite-label` |
54+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
55+
| **Secure Storage** | Protection mechanisms for sensitive data | :ref:`secure-storage-with-rpmb` |
56+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
57+
| **Trusted Execution** | Implementation of secure monitor (EL3) firmware that | :ref:`foundational-components-atf` |
58+
| | manages the secure boot process and TrustZone transitions | |
59+
+ +-----------------------------------------------------------+--------------------------------------+
60+
| | Trusted Execution Environment that enables isolated | :ref:`foundational-components-optee` |
61+
| | execution of security-sensitive applications and services | |
62+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
63+
64+
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
65+
66+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
67+
| Security Feature | Description | Links |
68+
+=========================+===========================================================+======================================+
69+
| **Authenticated Boot** | Verifies each boot component to ensure only authorized | :ref:`auth_boot_guide` |
70+
| | code executes on the device | |
71+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
72+
| **Crypto Acceleration** | Hardware driver support for cryptographic algorithms | :ref:`SAUL-Crypto-Accelerator` |
73+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
74+
| **Secure Storage** | Protection mechanisms for sensitive data | :ref:`secure-storage-with-rpmb` |
75+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
76+
| **SELinux** | Kernel security module providing policy-based access | :ref:`selinux_guide` |
77+
| | control for processes, files, and system objects | |
78+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
79+
| **Trusted Execution** | Implementation of secure monitor (EL3) firmware that | :ref:`foundational-components-atf` |
80+
| | manages the secure boot process and TrustZone transitions | |
81+
+ +-----------------------------------------------------------+--------------------------------------+
82+
| | Trusted Execution Environment that enables isolated | :ref:`foundational-components-optee` |
83+
| | execution of security-sensitive applications and services | |
84+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
85+

‎source/linux/Foundational_Components/System_Security/images/security_framework.png‎

38.4 KB
Loading

‎source/linux/Foundational_Components_OPTEE.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ of entropy can work around these issues.
7575
7676
$ make CROSS_COMPILE="$CROSS_COMPILE_32" CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=k3-|__OPTEE_PLATFORM_FLAVOR__| CFG_ARM64_core=y CFG_WITH_SOFTWARE_PRNG=y
7777
78+
.. _secure-storage-with-rpmb:
7879

7980
Secure Storage with RPMB (For HS)
8081
*********************************

‎source/linux/Foundational_Components_Security.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ Security
77
.. toctree::
88
:maxdepth: 5
99

10+
Foundational_Components/System_Security/Security_overview
1011
Foundational_Components_Migration_Guide
1112
Foundational_Components_Secure_Boot
1213
Foundational_Components/System_Security/SELinux

0 commit comments

Comments
 (0)