Humanoid Security Platform — Secure Boot Sequence

Chain of Trust from BootROM to Read-Only dm-verity Rootfs

Humanoid Security Platform — Secure Boot Sequence Chain of Trust from BootROM to Read-Only dm-verity Rootfs Verify BL31 signature & jump Load BL32 (OP-TEE Core) Authenticate & mount RPMB key Replay-protected NVRAM ready S-EL1 TEE & TAs initialized Authenticate & jump to BL33 (Linux) Probe /dev/tee0 via SMC fTPM & PKCS#11 TAs responsive Unpack & execute verified /init Verify Root Hash via SoftHSM cert Root Hash signature verified Activate dm-verity device-mapper Switch root to /dev/mapper/root-verity 1. Secure Firmware & TEE Boot 2. Kernel & TrustZone Binding 3. Storage Verification & Mount BootROM · EL3 Hardware RoT · Sequence participant BootROM EL3 Hardware RoT TF-A BL31 · EL3 Secure Monitor · Sequence participant TF-A BL31 EL3 Secure Monitor OP-TEE · S-EL1 Trusted OS · Sequence participant OP-TEE S-EL1 Trusted OS Virtual RPMB · Secure NVRAM · Sequence participant Virtual RPMB Secure NVRAM L4T Kernel · NS-EL1 Hardened · Sequence participant L4T Kernel NS-EL1 Hardened Initramfs · Early User Space · Sequence participant Initramfs Early User Space EROFS dm-verity · Verified Block Dev · Sequence participant EROFS dm-verity Verified Block Dev Legend main request return security message