From mboxrd@z Thu Jan  1 00:00:00 1970
From: Andrew F. Davis <afd@ti.com>
Date: Wed, 13 Feb 2019 12:37:12 -0600
Subject: [U-Boot]  [PATCH 7/7] doc: Update info on using K3 secure devices
In-Reply-To: <20190213183712.7087-1-afd@ti.com>
References: <20190213183712.7087-1-afd@ti.com>
Message-ID: <20190213183712.7087-8-afd@ti.com>
List-Id: <u-boot.lists.denx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: u-boot@lists.denx.de

Signed-off-by: Andrew F. Davis <afd@ti.com>
---
 doc/README.ti-secure | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/doc/README.ti-secure b/doc/README.ti-secure
index 76950253ac..27c0eaa77f 100644
--- a/doc/README.ti-secure
+++ b/doc/README.ti-secure
@@ -138,7 +138,7 @@ Booting of U-Boot SPL
 	<INPUT_FILE>
 
 	Invoking the script for Keystone2 Secure Devices
-	=============================================
+	================================================
 
 	create-boot-image.sh \
 		<UNUSED> <INPUT_FILE> <OUTPUT_FILE> <UNUSED>
@@ -157,6 +157,18 @@ Booting of U-Boot SPL
 		boot from all media. Secure boot from SPI NOR flash is not
 		currently supported.
 
+	Invoking the script for K3 Secure Devices
+	=========================================
+
+	The signing steps required to produce a bootable SPL image on secure
+	K3 TI devices are the same as those performed on non-secure devices.
+	The only difference is the key is not checked on non-secure devices so
+	a dummy key is used when building U-Boot for those devices. For secure
+	K3 TI devices simply use the real hardware key for your device. This
+	real key can be set with the Kconfig option "K3_KEY". The environment
+	variable TI_SECURE_DEV_PKG is also searched for real keys when the
+	build targets secure devices.
+
 Booting of Primary U-Boot (u-boot.img)
 ======================================
 
@@ -181,10 +193,8 @@ Booting of Primary U-Boot (u-boot.img)
 	is enabled through the CONFIG_SPL_FIT_IMAGE_POST_PROCESS option which
 	must be enabled for the secure boot scheme to work. In order to allow
 	verifying proper operation of the secure boot chain in case of successful
-	authentication messages like "Authentication passed: CERT_U-BOOT-NOD" are
-	output by the SPL to the console for each blob that got extracted from the
-	FIT image. Note that the last part of this log message is the (truncated)
-	name of the signing certificate embedded into the blob that got processed.
+	authentication messages like "Authentication passed" are output by the
+	SPL to the console for each blob that got extracted from the FIT image.
 
 	The exact details of the how the images are secured is handled by the
 	SECDEV package. Within the SECDEV package exists a script to process
-- 
2.19.1