u-boot/doc/README.ti-secure

22 Booting of U-Boot SPL
25 	When CONFIG_TI_SECURE_DEVICE is set, the U-Boot SPL build process
29 	SECDEV package. If the TI_SECURE_DEV_PKG variable is not defined or
32 	bootable image was not created.
36 	${TI_SECURE_DEV_PKG}/scripts/create-boot-image.sh
38 	This is called as part of the SPL/u-boot build process. As the secure
49 	create-boot-image.sh \
55 		SPI_X-LOADER - Generates an image for SPI flash (byte swapped)
56 		X-LOADER - Generates an image for non-XIP flash
57 		MLO - Generates an image for SD/MMC/eMMC media
58 		2ND - Generates an image for USB, UART and Ethernet
59 		XIP_X-LOADER - Generates a single stage u-boot for NOR/QSPI XiP
63 	either u-boot-spl.bin or u-boot.bin).
67 	non-secure binary images (see the platform-specific user's guides and
68 	releases notes for how the non-secure images are typically used)
69 	u-boot-spl_HS_SPI_X-LOADER - byte swapped boot image for SPI flash
70 	u-boot-spl_HS_X-LOADER - boot image for NAND or SD/MMC/eMMC rawmode
71 	u-boot-spl_HS_MLO - boot image for SD/MMC/eMMC media
72 	u-boot-spl_HS_2ND - boot image for USB, UART and Ethernet
73 	u-boot_HS_XIP_X-LOADER - boot image for NOR or QSPI Xip flash
81 	create-boot-image.sh \
87 		SPI_X-LOADER - Generates an image for SPI flash (byte
88 			swapped)
89 		XIP_X-LOADER - Generates a single stage u-boot for
91 		ISSW - Generates an image for all other boot modes
95 	either u-boot-spl.bin or u-boot.bin).
99 	non-secure binary images (see the platform-specific user's guides and
100 	releases notes for how the non-secure images are typically used)
101 	u-boot-spl_HS_SPI_X-LOADER - byte swapped boot image for SPI flash
102 	u-boot_HS_XIP_X-LOADER - boot image for NOR or QSPI flash
103 	u-boot-spl_HS_ISSW - boot image for all other boot media
111 	create-boot-image.sh \
117 		X-LOADER - Generates an image for NOR or QSPI boot modes
118 		MLO - Generates an image for SD/MMC/eMMC boot modes
119 		ULO - Generates an image for USB/UART peripheral boot modes
122 	loader binary file (for this platform, this is always u-boot-spl.bin).
126 	non-secure binary images (see the platform-specific user's guides
127 	and releases notes for how the non-secure images are typically used)
128 	u-boot-spl_HS_MLO - boot image for SD/MMC/eMMC. This image is
132 		non-secure devices)
133 	u-boot-spl_HS_ULO - boot image for USB/UART peripheral boot modes
134 	u-boot-spl_HS_X-LOADER - boot image for all other flash memories
143 	create-boot-image.sh \
149 	loader binary file (only u-boot.bin is currently supported on
150 	Keystone2 devices, u-boot-spl.bin is not currently supported).
154 	non-secure binary images (see the platform-specific user's guides
155 	and releases notes for how the non-secure images are typically used)
156 	u-boot_HS_MLO - signed and encrypted boot image that can be used to
157 		boot from all media. Secure boot from SPI NOR flash is not
160 Booting of Primary U-Boot (u-boot.img)
164 	which is the main u-boot image. For secure TI devices, the SPL will
167 	process, the authenticated SPL must authenticate the main u-boot
171 	process use the FIT image format for the u-boot.img (CONFIG_SPL_FRAMEWORK
173 	components that the SPL loads include a specific DTB image and u-boot
179 	from the FIT image at boot time, they are post-processed to verify that
180 	they are still secure. The outlined security-related SPL post-processing
184 	authentication messages like "Authentication passed: CERT_U-BOOT-NOD" are
193 	${TI_SECURE_DEV_PKG}/scripts/secure-binary-image.sh
195 	This is called as part of the u-boot build process. As the secure
199 	TI SECDEV package for creating a u-boot.img image for secure TI
202 	The SPL/u-boot code contains calls to dedicated secure ROM functions
206 	the device's secure ROM (fixed read-only-memory that is secure and
209 	Invoking the secure-binary-image script for Secure Devices
212 	secure-binary-image.sh <INPUT_FILE> <OUTPUT_FILE>