2 files changed, 47 insertions, 0 deletions
diff --git a/Documentation/vendorcode/eltan/index.md b/Documentation/vendorcode/eltan/index.md
new file mode 100644
index 0000000000..4484798a23
--- /dev/null
+++ b/Documentation/vendorcode/eltan/index.md
@@ -0,0 +1,8 @@
+# Eltan vendorcode-specific documentation
+
+This section contains documentation about coreboot on Eltan specific
+vendorcode.
+
+## Sections
+
+- [Security](security.md)
diff --git a/Documentation/vendorcode/eltan/security.md b/Documentation/vendorcode/eltan/security.md
new file mode 100644
index 0000000000..04537df23c
--- /dev/null
+++ b/Documentation/vendorcode/eltan/security.md
@@ -0,0 +1,39 @@
+# Eltan Security
+
+## Security
+This code enables measured boot and verified boot support.
+Verified boot is available in coreboot, but based on ChromeOS. This vendorcode
+uses a small encryption library and leave much more space in flash for the
+payload.
+
+## Hashing Library
+The library suppports SHA-1, SHA-256 and SHA-512. The required routines of
+`3rdparty/vboot/firmware/2lib` are used.
+
+## Measured boot
+measured boot support will use TPM2 device if available. The items specified
+in `mb_log_list[]` will be measured.
+
+## Verified boot
+verified boot support will use TPM2 device if available. The items specified
+in the next table will be verified:
+* `bootblock_verify_list[]`
+* `verify_item_t romstage_verify_list[]`
+* `ram_stage_additional_list[]`
+* `ramstage_verify_list[]`
+* `payload_verify_list[]`
+* `oprom_verify_list[]`
+
+## Enabling support
+
+* Measured boot can be enabled using **CONFIG_MBOOT**
+* Create mb_log_list table with list of item to measure
+* Create tables bootblock_verify_list[], verify_item_t romstage_verify_list[],
+  ram_stage_additional_list[], ramstage_verify_list[], payload_verify_list[],
+  oprom_verify_list[]
+* Verified boot can be enabled using **CONFIG_VERIFIED_BOOT**
+* Added Kconfig values for verbose console output
+
+## Debugging
+
+You can enable verbose console output in *menuconfig*.