Intel Stratix 10 SoC UEFI Boot Loader User Guide

Download PDF
ID 683134
Date 6/19/2020
Public
Document Table of Contents
Document Table of Contents x
1. Overview 2. System Requirements 3. Getting Started 4. Running UEFI on Intel Stratix 10 Hardware 5. Document Revision History for Intel Stratix 10 SoC UEFI Boot Loader User Guide
2. System Requirements x
2.1. Minimum Hardware Requirements 2.2. Minimum Software Requirements
3. Getting Started x
3.1. Installing Software Components 3.2. Building the Secure Monitor 3.3. Building the UEFI Boot Loader
3.1. Installing Software Components x
3.1.1. Installing the Intel SoC EDS 3.1.2. Installing the Compiler Toolchain
3.2. Building the Secure Monitor x
3.2.1. User Configuration 3.2.2. Getting the Arm* Trusted Firmware Source Code 3.2.3. Building the ATF
3.3. Building the UEFI Boot Loader x
3.3.1. Prerequisites 3.3.2. Obtaining the UEFI Source Code 3.3.3. Obtaining the edk2 Platform Source Code 3.3.4. Compiling the UEFI Source Code with the Linaro Tool Chain 3.3.5. UEFI Generated Files 3.3.6. Generating the FIP
4. Running UEFI on Intel Stratix 10 Hardware x
4.1. Running on a Physical Board with ATF and UEFI Bootloader 4.2. Booting Linux
4.1. Running on a Physical Board with ATF and UEFI Bootloader x
4.1.1. Generate a .sof file with ATF 4.1.2. Creating an SD Card Image 4.1.3. Running the Secure Monitor 4.1.4. Debugging with DS
4.2. Booting Linux x
4.2.1. Booting from the UEFI Shell
1. Overview
2. System Requirements
3. Getting Started
4. Running UEFI on Intel Stratix 10 Hardware
5. Document Revision History for Intel Stratix 10 SoC UEFI Boot Loader User Guide

3.2. Building the Secure Monitor

As security becomes more and more important, a secured boot solution becomes a requirement in the embedded world. To ensure comprehensive security and a trusted platform, secure partitioning is required. The Intel Stratix 10 device achieves secure partitioning by implementing the TrustZone model with Arm* Trusted Firmware (ATF). The TrustZone model splits the computing environment into two isolated worlds, the secure world and normal world, which are linked by a software monitor called the Secure Monitor. The two worlds have separated logical address space and peripherals. Communication between the two worlds is only possible by calling the privileged Secure Monitor call (SMC) instruction.

The full secure boot solution is:
  • BootRom
  • Secure Device Manager
  • Secure Monitor
  • Uboot/UEFI
  • Hypervisor
  • OS

Secure Monitor mode is a privileged mode and is always secure regardless of the state of the NS bit. The Secure Monitor is code that runs in Secure Monitor mode and processes switches to and from the Secure world. The overall security of the software relies on the security of this code along with the Secure boot code.

Related Information
Level Two Title