fix(security): Correct key flow diagram and text around it for AM64X by jsuhaas22 · Pull Request #654 · TexasInstruments/processor-sdk-doc

jsuhaas22 · 2026-04-08T16:12:40Z

The key-flow diagram and the information around it in AM64X's Secure Boot page state that U-Boot uses TI-SCI to authenticate the kernel image. This is no longer the case: U-Boot verifies the kernel image using the fitImage key contained in it without invoking TIFS. Therefore change the docs to reflect this.

New diagram:

shiva-ti · 2026-04-10T09:43:10Z

@jsuhaas22 let's enable the secure boot doc for am62x platforms in general, for am62l we should also highlight the FIT signing part

cshilwant

#654 (comment)

jsuhaas22 · 2026-04-13T10:21:42Z

@shiva-ti

@jsuhaas22 let's enable the secure boot doc for am62x platforms in general, for am62l we should also highlight the FIT signing part

For AM62x and AM62P, I have added changes to include the doc. AM62L will require more work, so I will send a separate PR for that in a day or two.

source/linux/Foundational_Components_Secure_Boot.rst

shiva-ti · 2026-04-13T17:49:26Z

@shiva-ti

@jsuhaas22 let's enable the secure boot doc for am62x platforms in general, for am62l we should also highlight the FIT signing part

For AM62x and AM62P, I have added changes to include the doc. AM62L will require more work, so I will send a separate PR for that in a day or two.

@jsuhaas22 sure, please address the relevant comments by the bot, looks fine otherwise.

jsuhaas22 · 2026-04-14T05:27:38Z

@shiva-ti

@jsuhaas22 let's enable the secure boot doc for am62x platforms in general, for am62l we should also highlight the FIT signing part

For AM62x and AM62P, I have added changes to include the doc. AM62L will require more work, so I will send a separate PR for that in a day or two.

@jsuhaas22 sure, please address the relevant comments by the bot, looks fine otherwise.

@shiva-ti Done. There are still some warnings left but those are invalid.

p-shivhare-ti · 2026-04-14T06:59:20Z

source/linux/Foundational_Components_Secure_Boot.rst

-Kernel/DTB/initfamfs. This is accomplished by calling into TIFS via TI-SCI (Texas Instruments System controller Interface). This allows us to use
-the same signing/encrypting tools used to authenticate the first-stage image. For more infomation using TI_SCI methods refer to the
-`TISCI User Guide <https://software-dl.ti.com/tisci/esd/22_01_02/index.html>`__.
+We offer methods for U-Boot's SPL loader to securely verify and encrypt the U-Boot proper. U-Boot calls TIFS through TI-SCI (Texas Instruments System Controller Interface)


@jsuhaas22 It should be "verify and decrypt the U-Boot proper".
Btw, we don't support the encrypted boot atleast for the U-Boot in the PSDK so it should only be "verify the U-Boot proper".

p-shivhare-ti · 2026-04-14T07:37:08Z

source/images/K3_KF.png

The fitImage box shows "u-boot-dtb*.dtb". Is it correct? It should be Kernel DTBs, right?

The key-flow diagram and the information around it in AM64X's Secure Boot page state that U-Boot uses TI-SCI to authenticate the kernel image. This is no longer the case: U-Boot verifies the kernel image using the fitImage key contained in it without invoking TIFS. Therefore change the docs to reflect this. Signed-off-by: Suhaas Joshi <s-joshi@ti.com>

jsuhaas22 · 2026-04-14T09:26:46Z

@p-shivhare-ti Addressed your comments.

StaticRocket

Acronyms should follow their definitions, not the other way around. File roles should be prioritized when they can be.

StaticRocket · 2026-04-14T19:24:50Z

source/linux/Foundational_Components_Secure_Boot.rst

+Secure boot has layers. Some layers are trusted more than others. Secure ROM has the highest trust and REE (Runtime Execution
 Environment) non-trustzone user-space applications have the least. If any higher trust code is to be loaded by a lower trust entity, it must be verified


Suggested change

Secure boot has layers. Some layers are trusted more than others. Secure ROM has the highest trust and REE (Runtime Execution

Environment) non-trustzone user-space applications have the least. If any higher trust code is to be loaded by a lower trust entity, it must be verified

Secure boot has layers. Some layers are trusted more than others. Secure ROM has the highest trust and Runtime Execution

Environment (REE) non-trustzone user-space applications have the least. If any higher trust code is to be loaded by a lower trust entity, it must be verified

StaticRocket · 2026-04-14T19:25:17Z

source/linux/Foundational_Components_Secure_Boot.rst

-Kernel/DTB/initfamfs. This is accomplished by calling into TIFS via TI-SCI (Texas Instruments System controller Interface). This allows us to use
-the same signing/encrypting tools used to authenticate the first-stage image. For more infomation using TI_SCI methods refer to the
-`TISCI User Guide <https://software-dl.ti.com/tisci/esd/22_01_02/index.html>`__.
+We offer methods for U-Boot's SPL loader to securely verify the U-Boot proper. U-Boot calls TIFS through TI-SCI (Texas Instruments System Controller Interface)


Suggested change

We offer methods for U-Boot's SPL loader to securely verify the U-Boot proper. U-Boot calls TIFS through TI-SCI (Texas Instruments System Controller Interface)

We offer methods for U-Boot's SPL loader to securely verify the U-Boot proper. U-Boot calls TIFS through Texas Instruments System Controller Interface (TI-SCI)

StaticRocket · 2026-04-14T19:25:54Z

source/linux/Foundational_Components_Secure_Boot.rst


    The ti-linux-firmware is a TI repository where all firmware releases are stored. Firmwares for a device family can also be found in the pre-built SDK
-    under <path-to-tisdk>/board-support/prebuilt-images/am64xx-evm. Binman expects to find the device firmware with the following appended to u-boot build command:
+    under <path-to-tisdk>/board-support/prebuilt-images/<evm>. Binman expects to find the device firmware with the following appended to u-boot build command:


Suggested change

under <path-to-tisdk>/board-support/prebuilt-images/<evm>. Binman expects to find the device firmware with the following appended to u-boot build command:

under :file:`<path-to-tisdk>/board-support/prebuilt-images/<evm>`. Binman expects to find the device firmware with the following appended to u-boot build command:

jsuhaas22 · 2026-04-15T02:04:44Z

Addressed your comments, @StaticRocket

manorit2001 · 2026-04-15T06:49:34Z

It seems like a common change @jsuhaas22 , I think it can be put for the j7 devices as well. Thanks for catching and correcting it. LGTM

manorit2001 · 2026-04-15T06:52:59Z

source/linux/Foundational_Components_Secure_Boot.rst

-    - `AM62x TRM <https://www.ti.com/lit/pdf/spruiv7>`_
+   .. ifconfig:: CONFIG_part_variant in ('AM62X')

-    The contents of this first stage image are authenticated and decrypted by the Secure ROM. Contents include:


why are we putting TRM links here btw..? I think this can remain in some common location right and not related to security..

manorit2001 · 2026-04-15T06:55:08Z

source/linux/Foundational_Components_Secure_Boot.rst

Maybe change this to introduction? I already see an authenticated boot guide added for sitara platforms.. maybe better to avoid confusion using same terms

p-shivhare-ti · 2026-04-15T09:03:06Z

source/linux/Foundational_Components_Secure_Boot.rst

+We offer methods for U-Boot's Secondary Program Loader (SPL) to securely verify the U-Boot
+proper. U-Boot calls Texas Instrument Foundational Security (TIFS) through Texas Instruments System Controller Interface (TISCI)
+to do this. For more information about using TISCI methods see the
+`TISCI User Guide <https://software-dl.ti.com/tisci/esd/22_01_02/index.html>`__. U-Boot proper then securely verifies and decrypts the kernel, Device Tree Blobs (DTB), and initramfs.


@jsuhaas22 The TISCI links should always use the latest version.
https://software-dl.ti.com/tisci/esd/latest/index.html

jsuhaas22 · 2026-04-15T09:07:25Z

@manorit2001 @p-shivhare-ti

Updated the PR with your changes. Manorit -- I have added the doc to all devices.

manorit2001

Rest LGTM

manorit2001 · 2026-04-15T10:09:59Z

configs/J721S2/J721S2_linux_toc.txt


 linux/Documentation_Tarball

-linux/Demo_User_Guides/Chromium_Browser


random diff..?

manorit2001 · 2026-04-15T10:16:05Z

source/linux/Foundational_Components_Secure_Boot.rst


 .. rubric:: U-Boot

 The boot flow continues as it does on a non-secure device, until loading the next FIT image named `fitImage`. This FIT image includes the Linux kernel, DTB, and


ig maybe an explicit mention of this being done by U-boot and pointing to respective guide to set it up correctly would be good for this. Rest everything is TIFS based ig..

Currently, the secure boot section is tailored for AM64x. But the same information is applicable to non-AM64x SoCs. Therefore generalize the page and add it these other devices' TOCs. In addition, fix the language in the file to simplify it by changing a few passive voice statements into active voice, using easier words etc. Also fix headings and remove TRM links. Signed-off-by: Suhaas Joshi <s-joshi@ti.com>

jsuhaas22 requested review from StaticRocket, VeeruPrudhvi, cshilwant, gehariprasath, jeevantelukula, praneethbajjuri and uditkumarti as code owners April 8, 2026 16:12

cshilwant requested changes Apr 11, 2026

View reviewed changes

jsuhaas22 force-pushed the diagram-bootflow branch from 0905fa3 to 4c41802 Compare April 13, 2026 10:18

shiva-ti reviewed Apr 13, 2026

View reviewed changes

source/linux/Foundational_Components_Secure_Boot.rst Outdated Show resolved Hide resolved

jsuhaas22 force-pushed the diagram-bootflow branch from 4c41802 to 5ae0b72 Compare April 14, 2026 05:19

jsuhaas22 force-pushed the diagram-bootflow branch from 5ae0b72 to ab2bac8 Compare April 14, 2026 06:25

github-actions bot assigned devarsht, gehariprasath, praneethbajjuri, r-vignesh and uditkumarti Apr 14, 2026

github-actions bot requested review from devarsht and r-vignesh April 14, 2026 06:25

shiva-ti previously approved these changes Apr 14, 2026

View reviewed changes

p-shivhare-ti reviewed Apr 14, 2026

View reviewed changes

source/images/K3_KF.png

Copy link
Copy Markdown

p-shivhare-ti Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fitImage box shows "u-boot-dtb*.dtb". Is it correct? It should be Kernel DTBs, right?

jsuhaas22 dismissed shiva-ti’s stale review via 89adb86 April 14, 2026 09:21

jsuhaas22 force-pushed the diagram-bootflow branch from ab2bac8 to 89adb86 Compare April 14, 2026 09:21

StaticRocket requested changes Apr 14, 2026

View reviewed changes

jsuhaas22 force-pushed the diagram-bootflow branch 3 times, most recently from b683f64 to 526f6c6 Compare April 15, 2026 02:01

manorit2001 reviewed Apr 15, 2026

View reviewed changes

jsuhaas22 force-pushed the diagram-bootflow branch from 526f6c6 to 50799fa Compare April 15, 2026 08:56

p-shivhare-ti reviewed Apr 15, 2026

View reviewed changes

jsuhaas22 force-pushed the diagram-bootflow branch from 50799fa to 90239a1 Compare April 15, 2026 09:06

manorit2001 approved these changes Apr 15, 2026

View reviewed changes

jsuhaas22 force-pushed the diagram-bootflow branch from 90239a1 to 27ff2f6 Compare April 15, 2026 10:55

jsuhaas22 force-pushed the diagram-bootflow branch from 27ff2f6 to 28a23dd Compare April 15, 2026 11:02

		Secure boot has layers. Some layers are trusted more than others. Secure ROM has the highest trust and REE (Runtime Execution
		Environment) non-trustzone user-space applications have the least. If any higher trust code is to be loaded by a lower trust entity, it must be verified

	We offer methods for U-Boot's SPL loader to securely verify the U-Boot proper. U-Boot calls TIFS through TI-SCI (Texas Instruments System Controller Interface)
	We offer methods for U-Boot's SPL loader to securely verify the U-Boot proper. U-Boot calls TIFS through Texas Instruments System Controller Interface (TI-SCI)

	under <path-to-tisdk>/board-support/prebuilt-images/<evm>. Binman expects to find the device firmware with the following appended to u-boot build command:
	under :file:`<path-to-tisdk>/board-support/prebuilt-images/<evm>`. Binman expects to find the device firmware with the following appended to u-boot build command:


		linux/Documentation_Tarball

		linux/Demo_User_Guides/Chromium_Browser No newline at end of file


		.. rubric:: U-Boot

		The boot flow continues as it does on a non-secure device, until loading the next FIT image named `fitImage`. This FIT image includes the Linux kernel, DTB, and

Conversation

jsuhaas22 commented Apr 8, 2026

Uh oh!

shiva-ti commented Apr 10, 2026

Uh oh!

cshilwant left a comment

Choose a reason for hiding this comment

Uh oh!

jsuhaas22 commented Apr 13, 2026

Uh oh!

Uh oh!

shiva-ti commented Apr 13, 2026

Uh oh!

jsuhaas22 commented Apr 14, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jsuhaas22 commented Apr 14, 2026

Uh oh!

StaticRocket left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jsuhaas22 commented Apr 15, 2026

Uh oh!

manorit2001 commented Apr 15, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jsuhaas22 commented Apr 15, 2026

Uh oh!

manorit2001 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants