fix(security): Correct key flow diagram and text around it for AM64X#654
fix(security): Correct key flow diagram and text around it for AM64X#654jsuhaas22 wants to merge 2 commits intoTexasInstruments:masterfrom
Conversation
jsuhaas22
requested review from
StaticRocket,
VeeruPrudhvi,
cshilwant,
gehariprasath,
jeevantelukula,
praneethbajjuri and
uditkumarti
as code owners
|
@jsuhaas22 let's enable the secure boot doc for am62x platforms in general, for am62l we should also highlight the FIT signing part |
jsuhaas22
force-pushed
the
diagram-bootflow
branch
from
0905fa3 to
4c41802
Compare
For AM62x and AM62P, I have added changes to include the doc. AM62L will require more work, so I will send a separate PR for that in a day or two. |
@jsuhaas22 sure, please address the relevant comments by the bot, looks fine otherwise. |
jsuhaas22
force-pushed
the
diagram-bootflow
branch
from
4c41802 to
5ae0b72
Compare
@shiva-ti Done. There are still some warnings left but those are invalid. |
jsuhaas22
force-pushed
the
diagram-bootflow
branch
from
5ae0b72 to
ab2bac8
Compare
github-actions
bot
assigned
devarsht,
gehariprasath,
praneethbajjuri,
r-vignesh and
uditkumarti
The key-flow diagram and the information around it in AM64X's Secure Boot page state that U-Boot uses TI-SCI to authenticate the kernel image. This is no longer the case: U-Boot verifies the kernel image using the fitImage key contained in it without invoking TIFS. Therefore change the docs to reflect this. Signed-off-by: Suhaas Joshi <s-joshi@ti.com>
jsuhaas22
force-pushed
the
diagram-bootflow
branch
from
ab2bac8 to
89adb86
Compare
|
@p-shivhare-ti Addressed your comments. |
StaticRocket
left a comment
StaticRocket
left a comment
There was a problem hiding this comment.
Acronyms should follow their definitions, not the other way around. File roles should be prioritized when they can be.
jsuhaas22
force-pushed
the
diagram-bootflow
branch
3 times, most recently
from
b683f64 to
526f6c6
Compare
|
Addressed your comments, @StaticRocket |
|
It seems like a common change @jsuhaas22 , I think it can be put for the j7 devices as well. Thanks for catching and correcting it. LGTM |
jsuhaas22
force-pushed
the
diagram-bootflow
branch
from
526f6c6 to
50799fa
Compare
jsuhaas22
force-pushed
the
diagram-bootflow
branch
from
50799fa to
90239a1
Compare
|
Updated the PR with your changes. Manorit -- I have added the doc to all devices. |
jsuhaas22
force-pushed
the
diagram-bootflow
branch
3 times, most recently
from
28a23dd to
d7523a4
Compare
Currently, the secure boot section is tailored for AM64x. But the same information is applicable to non-AM64x SoCs. Therefore generalize the page and add it these other devices' TOCs. In addition, fix the language in the file to simplify it by changing a few passive voice statements into active voice, using easier words etc. Also fix headings and remove TRM links. Signed-off-by: Suhaas Joshi <s-joshi@ti.com>
jsuhaas22
force-pushed
the
diagram-bootflow
branch
from
d7523a4 to
6474e81
Compare
|
Done @manorit2001 |
| other required boot artifacts. U-boot verifies the signed images on boot independently, without using TIFS. U-boot extracts each component from the FIT image and verifies its signature. Once u-boot verifies all components, it starts Linux. For more information, see: `U-Boot FIT Signature Documentation <https://docs.u-boot.org/en/latest/usage/fit/signature.html>`__ | ||
|
|
||
| U-boot's output will be similar to this: (notice the "Authentication passed" lines as we authenticate the Linux kernel and DTB). | ||
| U-boot's output will be similar to this: (notice the "Authentication passed" lines as u-boot verifies the Linux kernel and DTB). |
There was a problem hiding this comment.
Do we see Authentication passed? I think that was due to TIFS flows that we see this print, maybe updating the boot log would be good as well with this flow but a non blocker, you can remove these confusing lines as an alternative.
11 participants
The key-flow diagram and the information around it in AM64X's Secure Boot page state that U-Boot uses TI-SCI to authenticate the kernel image. This is no longer the case: U-Boot verifies the kernel image using the fitImage key contained in it without invoking TIFS. Therefore change the docs to reflect this.
New diagram:
