Qoriq Trust Architecture 2.1 User Guide Fix -

The QorIQ Trust Architecture 2.1 User Guide is a restricted document for NXP Layerscape processors, covering secure boot, internal key protection, TrustZone, and hardware resource partitioning. Access to this documentation requires registration and approval through the NXP Support Portal due to the sensitive nature of the security information. For more information, visit NXP Support Portal NXP Community Trusted Architecture questions on ls1012a - NXP Community

In the era of edge computing, industrial IoT, and 5G infrastructure, the root of trust is no longer a luxury—it's a mandate. NXP’s QorIQ Trust Architecture 2.1 (TA 2.1) provides a hardware-anchored security foundation for high-performance embedded systems. Unlike software-only security, TA 2.1 ensures that even if an attacker compromises the operating system, the integrity of the boot process and cryptographic keys remains inviolable.

// Using /dev/crypto or keyctl #include <asm/crypto.h> struct caam_snvs_key key; key.slot = 0; memcpy(key.data, user_key, 16); ioctl(fd, CAAM_SNVS_ADD, &key); qoriq trust architecture 2.1 user guide

The Security Monitor is the central authority for sensing and controlling the security state of the device. It monitors for potential physical changes, detects tampering events via external inputs (TA_TMP_DETECT_B), and manages the device’s security state transitions. Detection of an external tamper event is reported in the Security Monitor registers (SecMon_HPSVSR and SecMon_LPSR).

The architecture is comprised of several integrated hardware blocks and software protocols that work in tandem to secure the platform: The QorIQ Trust Architecture 2

Secure Boot 2.1 relies on RSA (typically 2048 or 4096 bit) or Elliptic Curve Cryptography (ECC). Generate your private signing key and public validation key in a secure development environment:

Re-verify your code-signing pipeline and check for binary payload corruption. FSH (Fuse Hash Mismatch) Set to 1 if the key metadata does not match the SFP fuses. NXP’s QorIQ Trust Architecture 2

The ISBC uses an RSA public key (stored as a hash in fuses) to verify the digital signature of the initial boot image.

: The Security Monitor monitors and responds to potential physical changes to the underlying security features in the hardware. When a tamper event is detected, the system can be configured to take appropriate actions, such as clearing secrets, halting execution, or transitioning to a failsafe state.

NXP provides a range of software and tools to help you implement TA 2.1: