Conversation
787f0e5 to
6deeb7c
Compare
|
thanks @zelvam95 for picking this up for the upcoming release. having a look now |
|
@zelvam95 lets move PAS. We have For the PAS section, please mention that the architecture depends on Linux executing at EL2 so that the kernel can set up the translation tables (memory resources) required by the coprocessors to access memory. Maybe a good idea to implement a security disclaimer just as NXP does - there seems to be an expectation from the user side that the firmware should be secure by default (which will never be the case). Also perhaps a suggestion to review the TF-A source for the platform's bl31 security settings seems appropiate as well (XPU gets enabled there for Hoya). Still lets aim to make these reference docs as minimal as possible so they dont decay. lets see if we can provide links to the TRMs - should be available publicly soon |
|
also I am clearly not an UX designer, but could you check how scalable this format is going to be - thinking about the table. |
6deeb7c to
eb0e2db
Compare
Refresh driver and configuration references on the Hoya and top-level Qualcomm pages to match the current plat-qcom implementation, which has continued to evolve upstream. Signed-off-by: Selvam Sathappan Periakaruppan <selvam.periakaruppan@oss.qualcomm.com> Assisted-by: Claude:sonnet-5
eb0e2db to
63a035c
Compare
|
@ldts, Thanks for the feedback. Have added note on TF-A BL31 security settings and Kernel EL2 translation setup/etc.. Let me know if you have any other feedback. |
2ae4e5a to
965d6fb
Compare
Explain the purpose and chipset scope of Hoya and Bobcat drivers and services so integrators can identify the features each chipset provides. Distinguish common from platform-dependent features in the Qualcomm overview. Document Kodiak's 0.95 V MX-rail workaround for fuse blowing and the Command DB lookup followed by an RPMh vote. Add a Hoya comparison of PAS signature-authentication support and Hardware Unique Key sources, and explain the secure-boot fuse condition for signature enforcement. Signed-off-by: Selvam Sathappan Periakaruppan <selvam.periakaruppan@oss.qualcomm.com> Assisted-by: Claude:sonnet-5
Add a PAS architecture page describing the TA's direct calls to the core and fuse PTAs. Explain the split between signature and segment-hash verification and the secure-boot fuse policy on Lemans, and document chipset coverage and the kernel's EL2 execution requirement. Add a platform-wide security disclaimer explaining that OP-TEE relies on the product's secure-boot and memory-protection configuration, including settings in TF-A. Link the PAS page from Hoya and the Qualcomm overview. Add the PAS and security-disclaimer pages to the overview's security-topic toctree. Signed-off-by: Selvam Sathappan Periakaruppan <selvam.periakaruppan@oss.qualcomm.com> Assisted-by: Claude:sonnet-5
965d6fb to
5540419
Compare
Add a Wildcat architecture page for Nord, documenting its 18 Oryon cores and GICv4 configuration. Link the page from the Qualcomm architecture list and toctree, and update the platform-support note for three architecture families. Explain that the Trust Management Engine (TME) configures DARE-TZ inline memory encryption, so this setup is outside the OP-TEE and TF-A code covered by the documentation. Signed-off-by: Selvam Sathappan Periakaruppan <selvam.periakaruppan@oss.qualcomm.com> Assisted-by: Claude:sonnet-5
10f110f to
969ee1c
Compare
Summary
Update the Qualcomm platform documentation to reflect current upstream
support and clarify driver scope, authentication behavior, and platform
security responsibilities.
Hoya and Bobcat: Correct stale configuration references and expand
the documentation to explain driver and service purposes and chipset
coverage. Document Kodiak's specific software workaround to vote for
0.95 V on the MX rail during fuse blowing, including the Command DB
lookup and RPMh vote. Add a Hoya comparison table covering PAS
signature-authentication support and Hardware Unique Key sources.
Qualcomm overview: Distinguish common features from platform-dependent
features and provide navigation to the architecture-family pages and
separate security topics.
PAS authentication: Add an architecture overview describing the
REE-facing TA and its direct calls to the PAS core and fuse PTAs, with
a high-level authentication and bring-up sequence diagram. Document
chipset coverage, the kernel's EL2 execution requirement, and the
distinction between signature verification and firmware hash checks.
Clarify that, with authentication support enabled, signature verification
is skipped only when secure-boot fuses explicitly report that secure
boot is disabled; firmware hashes are still checked.
Security disclaimer: Add a platform-wide page explaining that product
security depends on correctly configured secure boot and memory
protection, including settings managed by TF-A.
Wildcat: Add a page for the
nordchipset documenting its 18-coreOryon configuration and GICv4 support, and link it from the Qualcomm
overview. Explain in the security disclaimer that Wildcat's DARE-TZ
inline memory encryption is configured by the Trust Management Engine
(TME), outside the OP-TEE and TF-A code covered by this documentation.