• State
  • Locked Locked
  • Replies 3 replies
  • Subscribers 97 subscribers
  • Views 157 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Original question:

[FAQ] How to sign u-boot binary on an external secure key server

AM62L-LINUX-RT-SDK: U-Boot signing with an HSM

TO
Prodigy 180 points

Part Number: AM62L-LINUX-RT-SDK
Other Parts Discussed in Thread: AM62L

Hi Support,

We are developing a custom board using AM62L, and we are using SDK version 11.02.08.02 of the AM62L-LINUX-RT-SDK.
 
We also identified that SDK version 11.02.08.02 was unable to perform U-Boot signing and verification; however, by applying the following two patches to U-Boot, we successfully achieved both signing and verification.
 
For the signing of tiboot3, tispl, u-boot.img, and fitImage, we would like to use an HSM via OpenSSL instead of referencing the key files directly.
 
Referring to the following materials, but it appears that the U-Boot signing method differs between AM62 and AM62L.
 
Please advise on how to implement U-Boot signing using an HSM. We were able to support tiboot3 and tispl by modifying u-boot/tools/binman/btool/openssl.py.
 
Best Regards,
TO