Skip to content

Commit d507821

Browse files
shiva-tishiva-ti
committed
feat(security): add Security Overview page
- create new Security_overview.rst as the landing page for security documentation - provide comprehensive security framework details and features overview - add references to Security_overview in platform TOC files (AM62X, AM62AX, AM62PX, AM62LX) - add cross-reference links in related security documentation Signed-off-by: Shiva Tripathi <[email protected]>
1 parent acfa2f5 commit d507821

File tree

9 files changed

+89
-0
lines changed

9 files changed

+89
-0
lines changed

‎configs/AM62AX/AM62AX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ linux/Foundational_Components/Power_Management/pm_wakeup_sources
9393
linux/Foundational_Components/Power_Management/pm_sw_arch
9494
linux/Foundational_Components/Power_Management/pm_debug
9595

96+
linux/Foundational_Components/System_Security/Security_overview
9697
linux/Foundational_Components/System_Security/SELinux
9798
linux/Foundational_Components/System_Security/Auth_boot
9899

‎configs/AM62LX/AM62LX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ linux/Foundational_Components/Power_Management/pm_cpuidle
7878
linux/Foundational_Components/Power_Management/pm_am62lx_low_power_modes
7979
linux/Foundational_Components/Power_Management/pm_wakeup_sources
8080

81+
linux/Foundational_Components/System_Security/Security_overview
8182
#linux/Foundational_Components/System_Security/SELinux
8283
linux/Foundational_Components/System_Security/Auth_boot
8384

‎configs/AM62PX/AM62PX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ linux/Foundational_Components/Power_Management/pm_wakeup_sources
9898
linux/Foundational_Components/Power_Management/pm_sw_arch
9999
linux/Foundational_Components/Power_Management/pm_debug
100100

101+
linux/Foundational_Components/System_Security/Security_overview
101102
linux/Foundational_Components/System_Security/SELinux
102103
linux/Foundational_Components/System_Security/Auth_boot
103104

‎configs/AM62X/AM62X_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ linux/Foundational_Components/Power_Management/pm_wakeup_sources
9595
linux/Foundational_Components/Power_Management/pm_sw_arch
9696
linux/Foundational_Components/Power_Management/pm_debug
9797

98+
linux/Foundational_Components/System_Security/Security_overview
9899
linux/Foundational_Components/System_Security/SELinux
99100
linux/Foundational_Components/System_Security/Auth_boot
100101

‎source/linux/Foundational_Components/Kernel/Kernel_Drivers/Crypto/SA2UL_OMAP.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
.. _SAUL-Crypto-Accelerator:
2+
13
######
24
Crypto
35
######

‎source/linux/Foundational_Components/System_Security/Security_overview.rst‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
.. _Security_overview:
2+
3+
##########
4+
Overview
5+
##########
6+
7+
.. rubric:: Security Overview
8+
9+
The |__PART_FAMILY_DEVICE_NAMES__| SoC provides a comprehensive set of
10+
security features that protect embedded Linux applications. This guide
11+
offers a starting point to understand and implement these capabilities
12+
as part of product development, with the following advantages:
13+
14+
* **Hardware-backed security** - Leverages built-in security hardware
15+
for robust protection
16+
* **Defense in depth** - Creates multiple layers of security to protect
17+
against various threats
18+
* **Industry standards compliance** - Implements security features that
19+
help meet regulatory requirements
20+
* **Flexible implementation** - Allows security features that can be
21+
tailored to specific application needs
22+
23+
.. rubric:: Security Domains
24+
25+
Below is an overview of the security framework's main domains:
26+
27+
.. figure:: ./images/security_framework.png
28+
29+
Together, these security domains provide a comprehensive security
30+
architecture that protects the |__PART_FAMILY_DEVICE_NAMES__| at
31+
all stages of operation - from boot to runtime to data storage -
32+
creating a chain of trust that helps maintain system integrity
33+
and data confidentiality.
34+
35+
.. rubric:: Security Features at a Glance
36+
37+
The following table lists some of the key Security Features:
38+
39+
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
40+
41+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
42+
| **Security Feature** | **Description** | **Links** |
43+
+=========================+===========================================================+======================================+
44+
| **Authenticated Boot** | Verifies each boot component to ensure only authorized | :ref:`auth_boot_guide` |
45+
| | code executes on the device | |
46+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
47+
| **Crypto Acceleration** | Hardware driver support for cryptographic algorithms | :ref:`DTHEv2-Crypto-Accelerator` |
48+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
49+
| **Key Management** | Tools for secure key provisioning | :ref:`key-writer-lite-label` |
50+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
51+
| **Secure Storage** | Protection mechanisms for sensitive data | :ref:`secure-storage-with-rpmb` |
52+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
53+
| **Trusted Execution** | Implementation of secure monitor (EL3) firmware that | :ref:`foundational-components-atf` |
54+
| | manages the secure boot process and TrustZone transitions | |
55+
+ +-----------------------------------------------------------+--------------------------------------+
56+
| | Trusted Execution Environment that enables isolated | :ref:`foundational-components-optee` |
57+
| | execution of security-sensitive applications and services | |
58+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
59+
60+
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
61+
62+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
63+
| Security Feature | Description | Links |
64+
+=========================+===========================================================+======================================+
65+
| **Authenticated Boot** | Verifies each boot component to ensure only authorized | :ref:`auth_boot_guide` |
66+
| | code executes on the device | |
67+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
68+
| **Crypto Acceleration** | Hardware driver support for cryptographic algorithms | :ref:`SAUL-Crypto-Accelerator` |
69+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
70+
| **Secure Storage** | Protection mechanisms for sensitive data | :ref:`secure-storage-with-rpmb` |
71+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
72+
| **SELinux** | Kernel security module providing policy-based access | :ref:`selinux_guide` |
73+
| | control for processes, files, and system objects | |
74+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
75+
| **Trusted Execution** | Implementation of secure monitor (EL3) firmware that | :ref:`foundational-components-atf` |
76+
| | manages the secure boot process and TrustZone transitions | |
77+
+ +-----------------------------------------------------------+--------------------------------------+
78+
| | Trusted Execution Environment that enables isolated | :ref:`foundational-components-optee` |
79+
| | execution of security-sensitive applications and services | |
80+
+-------------------------+-----------------------------------------------------------+--------------------------------------+
81+

‎source/linux/Foundational_Components/System_Security/images/security_framework.png‎

38.4 KB
Loading

‎source/linux/Foundational_Components_OPTEE.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ of entropy can work around these issues.
7575
7676
$ make CROSS_COMPILE="$CROSS_COMPILE_32" CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=k3-|__OPTEE_PLATFORM_FLAVOR__| CFG_ARM64_core=y CFG_WITH_SOFTWARE_PRNG=y
7777
78+
.. _secure-storage-with-rpmb:
7879

7980
Secure Storage with RPMB (For HS)
8081
*********************************

‎source/linux/Foundational_Components_Security.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ Security
77
.. toctree::
88
:maxdepth: 5
99

10+
Foundational_Components/System_Security/Security_overview
1011
Foundational_Components_Migration_Guide
1112
Foundational_Components_Secure_Boot
1213
Foundational_Components/System_Security/SELinux

0 commit comments

Comments
 (0)