{"type":"doc","content":[{"type":"layoutSection","marks":[{"type":"breakout","attrs":{"mode":"full-width"}}],"content":[{"type":"layoutColumn","attrs":{"width":66.66},"content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"About this project","type":"text"}]},{"type":"paragraph","content":[{"text":"Trusted Substrate is an effort to provide software for secure connected devices. It does so by having a holistic view of the device and the software ecosystem. Starting from a SystemReady compliant firmware, booting an OS or an OS installer with UEFI and provisioning the device.","type":"text"}]},{"type":"paragraph","content":[{"text":"For the firmware, Linaro provides a meta-layer in OpenEmbedded aimed toward board makers who want to produce an ","type":"text"},{"text":"Arm SystemReady","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.arm.com/architecture/system-architectures/systemready-certification-program"}}]},{"text":" compliant firmware and ensure consistent behavior, tamper protection and common features across platforms. In a nutshell, TrustedSubstrate is building firmware for devices which verifies the running software hasn’t been tampered with. It does so by utilizing a well-known set of standards.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"UEFI secure boot enabled by default","type":"text","marks":[{"type":"strong"}]},{"text":" UEFI Secure Boot is a verification mechanism for ensuring that code launched by a computer’s UEFI firmware is trusted. It is designed to protect a system against malicious code being loaded and executed early in the boot process before the operating system has been loaded.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Measured boot. ","type":"text","marks":[{"type":"strong"}]},{"text":"With a discrete or firmware-TPM, Measured Boot is a method where each of the software layers in the boot sequence of the device, measures the next layer in the execution order and extends the value in a designated TPM PCR. Measured boot further validates the boot process beyond Secure Boot.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Dual banked firmware updates with rollback and bricking protection","type":"text","marks":[{"type":"strong"}]},{"text":" provides protection to the firmware update mechanism and shield the device against bricking as well as rollback attacks.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Apart from the firmware we are working on ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"EFI HTTPs boot and FIDO secure device onboarding","type":"text","marks":[{"type":"strong"}]},{"text":", to automate the OS installation and provisioning of IoT devices","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Standards participation","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Distro support","type":"text","marks":[{"type":"strong"}]},{"text":", make sure that COTS distros work out of the box on embedded boards","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Requirements and specifications","type":"text"}]},{"type":"paragraph","content":[{"text":"Trusted Substrate interfaces rely on a combination of existing standards:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SystemReady DT compliance","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.arm.com/architecture/system-architectures/systemready-certification-program"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"PSA Trusted Services","type":"text","marks":[{"type":"link","attrs":{"href":"https://trusted-services.readthedocs.io/en/stable/"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Global Platform TEE compliance","type":"text","marks":[{"type":"link","attrs":{"href":"https://globalplatform.org/specs-library/"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Firmware handoff ","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/FirmwareHandoff/firmware_handoff"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A/B updates ","type":"text","marks":[{"type":"link","attrs":{"href":"https://mbfw.readthedocs.io/"}}]}]}]}]},{"type":"paragraph","content":[{"text":"The following diagram shows how Trusted Substrate can be seen from upper layers:","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":40.0},"content":[{"type":"media","attrs":{"width":2431,"id":"bb3ee612-6c8e-4ebd-baca-79d51cc79374","collection":"contentId-28475720738","type":"file","height":1060}}]},{"type":"paragraph","content":[{"text":"The primary goal of the project is to upstream all necessary technologies in a number of open-source projects and Linux distros to seed SystemReady compliance. Linaro Edge group hardware as well as QEMU will be used as reference platforms for the development.","type":"text"}]},{"type":"paragraph","content":[{"text":"Development of Trusted Substrate is \"feature orientated\" rather than upstream project orientated. In other words, when a feature is planned, activities in relevant upstream projects is identified and monitored for completion as a whole. Each upstream project has its own roadmap that is not related to SystemReady compliance and is independent from other projects. So if you are evaluating what community to join, the decision criteria is whether your goal is holistic or just focused at an individual project.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Related Linaro software development projects","type":"text"}]},{"type":"paragraph","content":[{"text":"The Trusted Substrate project covers a wide range of software components as stated above. To orchestrate engineering activities in manageable pieces, the development is split between the following projects (Trusted Substrate project leadership ensure coherency and completeness across projects):","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://linaro.atlassian.net/wiki/spaces/LOC"}},{"text":" - while most OP-TEE activities related to SystemReady are guided by Dependable Boot, some long term changes such as Trusted Application lifecycle and distribution scenarios may actually be driven by this project.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://linaro.atlassian.net/wiki/spaces/YGAI"}},{"text":" - Generic Arm64 image contributions and testing for SystemReady","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://linaro.atlassian.net/wiki/spaces/UBOOT"}},{"text":" - Generic U-Boot improvements and testing","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Deliverables","type":"text"}]},{"type":"paragraph","content":[{"text":"Trusted Substrate project deliverables are upstream patches in many upstream projects. The development is driven by the Linaro projects as said above.","type":"text"}]},{"type":"paragraph","content":[{"text":"Upstream activity can be found in:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"meta-ts","type":"text","marks":[{"type":"link","attrs":{"href":"https://gitlab.com/Linaro/trustedsubstrate/meta-ts"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"U-Boot, EDK2","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Trusted-Firmware A, OP-TEE","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Linux kernel","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Firmware images for supported hardware are provided ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://gitlab.com/Linaro/trustedsubstrate/meta-ts#images"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Services","type":"text"}]},{"type":"paragraph","content":[{"text":"Linaro is evaluating the opportunity to create SystemReady and Trusted Substrate services such as:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Board SystemReady DT readiness, i.e. making sure the board will pass SystemReady DT certification","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Include SystemReady DT CI/CD loops","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Collaborative maintenance of Trusted Substrate project","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Should you want to have more information or more generally discuss any of the above, please ","type":"text"},{"text":"contact us","type":"text","marks":[{"type":"link","attrs":{"href":"mailto:contact@linaro.org"}}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Get Involved","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Mailing List","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Linaro Boot Architecture mailing list subscription","type":"text","marks":[{"type":"link","attrs":{"href":"https://lists.linaro.org/mailman3/lists/boot-architecture.lists.linaro.org"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Gitlab repos","type":"text","marks":[{"type":"link","attrs":{"href":"https://gitlab.com/Linaro/trustedsubstrate/meta-ts"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Firmware Binaries","type":"text","marks":[{"type":"link","attrs":{"href":"https://gitlab.com/Linaro/trustedsubstrate/meta-ts#images"}}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Project membership for roadmap steering and resources allocation","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Please","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff0000"}}]},{"text":"contact us","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff0000"}},{"type":"link","attrs":{"href":"mailto:contact@linaro.org"}}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Board integration in CI","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Please","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff0000"}}]},{"text":"contact us","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff0000"}},{"type":"link","attrs":{"href":"mailto:contact@linaro.org"}}]}]}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"layoutColumn","attrs":{"width":33.33},"content":[{"type":"paragraph","content":[{"text":"Meetings","type":"text"}]},{"type":"paragraph","content":[{"text":"This calendar is displayed using UTC timezone with no DST offsets.","type":"text"}]},{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"easy-html","parameters":{"macroParams":{"theme":{"value":"{\"label\":\"kuroir\",\"value\":\"kuroir\"}"},"contentByMode":{"value":"{\"html\":\"\",\"javascript\":\"\",\"css\":\"\"}"},"__bodyContent":{"value":""}},"macroMetadata":{"macroId":{"value":"7c234c54-73b9-4003-9270-f31fead5de8f"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://macrosuite-production.web.app/img/MacroSuiteIcon.svg"}}],"title":"Easy HTML (by Optics)"}}}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Project Contacts","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Project lead: ","type":"text","marks":[{"type":"em"}]},{"text":"ilias.apalodimas@linaro.org","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"mailto:ilias.apalodimas@linaro.org"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Project manager: ","type":"text","marks":[{"type":"em"}]},{"text":"julianus.larson@linaro.org","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"#"}}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Continuous integration","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Qemu","type":"text","marks":[{"type":"link","attrs":{"href":"https://ledge.validation.linaro.org/scheduler/alljobs?length=25&search=ledge+qemu+aarch64+#table"}}]},{"type":"hardBreak"}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"rule"},{"type":"heading","attrs":{"level":1},"content":[{"text":"Roadmap","type":"text"}]},{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"widget","parameters":{"macroParams":{"width":{"value":"1280"},"url":{"value":"https://docs.google.com/presentation/d/1q3o0T9trUGnGZEu8V7uICH0n_JlmbrxHurk_YrAowUY/edit?usp=sharing"},"height":{"value":"720"}},"macroMetadata":{"macroId":{"value":"94480fad61e721d702e659c428d05882"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"image","data":{"url":"/plugins/servlet/widgetconnector/placeholder?thumb=docs.google.com&width=300&height=225"}}],"title":"Widget Connector"}}}},{"type":"heading","attrs":{"level":1},"content":[{"text":" Current plan","type":"text"}]},{"type":"extension","attrs":{"layout":"full-width","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"jira","parameters":{"macroParams":{"server":{"value":"System JIRA"},"columns":{"value":"key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution"},"maximumIssues":{"value":"20"},"jqlQuery":{"value":"project = TS AND component = \"Dependable Boot\" AND status in (\"In Progress\", ToDo, Review, Blocked) "},"serverId":{"value":"59107c6f-1e52-32bc-b58f-400d54bba998"}},"macroMetadata":{"macroId":{"value":"7a3e2d37-1eeb-4abe-be2b-28028027d0ba"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"image","data":{"url":"/download/resources/confluence.extra.jira/jira-table.png"}}],"title":"Jira Legacy"}}}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Backlog","type":"text"}]},{"type":"extension","attrs":{"layout":"full-width","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"jira","parameters":{"macroParams":{"server":{"value":"System JIRA"},"columns":{"value":"key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution"},"maximumIssues":{"value":"20"},"jqlQuery":{"value":"project = TS AND component = \"Dependable Boot\" AND fixVersion is EMPTY AND status not in (Closed,Open) ORDER BY fixVersion ASC "},"serverId":{"value":"59107c6f-1e52-32bc-b58f-400d54bba998"}},"macroMetadata":{"macroId":{"value":"3e5217b4-4a51-4304-9c07-cd42bef28c56"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"image","data":{"url":"/download/resources/confluence.extra.jira/jira-table.png"}}],"title":"Jira Legacy"}}}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Accomplished","type":"text"}]},{"type":"extension","attrs":{"layout":"full-width","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"jira","parameters":{"macroParams":{"server":{"value":"System JIRA"},"columns":{"value":"key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution"},"maximumIssues":{"value":"20"},"jqlQuery":{"value":"project = TS AND component = \"Dependable Boot\" AND status = Closed and resolution in (Delivered,Done) AND resolved <= endOfMonth(\"-12\") "},"serverId":{"value":"59107c6f-1e52-32bc-b58f-400d54bba998"}},"macroMetadata":{"macroId":{"value":"08389276-7aa6-4393-8970-55a463990462"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"image","data":{"url":"/download/resources/confluence.extra.jira/jira-table.png"}}],"title":"Jira Legacy"}}}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Active Members","type":"text"}]},{"type":"rule"},{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"easy-html-macro","parameters":{"macroParams":{"theme":{"value":"{\"label\":\"solarized_dark\",\"value\":\"solarized_dark\"}"},"contentByMode":{"value":"{\"html\":\"\\n\",\"javascript\":\"\",\"css\":\"\"}"},"__bodyContent":{"value":""}},"macroMetadata":{"macroId":{"value":"b6bc791c-28dd-48d5-bedb-6479276a8ef6"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://macrosuite-production.web.app/img/MacroSuiteIcon.svg"}}],"title":"Easy HTML (by Optics)"}}}},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"easy-html-macro","parameters":{"macroParams":{"contentByMode":{"value":"{\"html\":\"

\",\"javascript\":\"\",\"css\":\"\"}"},"__bodyContent":{"value":""}},"macroMetadata":{"macroId":{"value":"430c5659-5952-4c61-844a-3d4a1c769065"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://macrosuite-production.web.app/img/MacroSuiteIcon.svg"}}],"title":"Easy HTML (by Optics)"}}}},{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"easy-html-macro","parameters":{"macroParams":{"theme":{"value":"{\"label\":\"solarized_dark\",\"value\":\"solarized_dark\"}"},"contentByMode":{"value":"{\"html\":\"\\n\",\"javascript\":\"\",\"css\":\"\"}"},"__bodyContent":{"value":""}},"macroMetadata":{"macroId":{"value":"3da3db88-29ed-4ffa-a1ee-9f7bfd4c7967"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://macrosuite-production.web.app/img/MacroSuiteIcon.svg"}}],"title":"Easy HTML (by Optics)"}}}}],"version":1}