Booting a signed Zephyr image with U-Boot on Arm Cortex-A: TI AM62L and QEMU

On a microcontroller, Zephyr runs first, so secure boot means adding a bootloader such as MCUboot. On a Cortex-A processor such as the TI AM62L, the boot ROM and several firmware stages run before Zephyr. Zephyr is the last stage, so U-Boot can check it before starting it.

The Arm Learning Path Boot a signed Zephyr image with U-Boot on Arm Cortex-A shows how to set this up step by step. You package Zephyr in a signed FIT image, add your public key to U-Boot, and configure U-Boot to refuse any image it cannot verify.

Steps

• See where U-Boot verifies Zephyr in the Cortex-A boot chain
• Build Zephyr with Workbench for Zephyr and sign it into a FIT image
• Build U-Boot with your public key, without changing its source
• Boot the signed image, then check that U-Boot refuses a wrong key and a tampered image
• Review what production needs: fusing your key on the AM62L, locking the console and boot environment, and signing during release

Targets

You can follow it on real silicon with the TI AM62L evaluation module (EVM), or in QEMU with no hardware. The signing and verification steps are the same on both.

Level: advanced.

Read the full Learning Path on learn.arm.com

Going further

The same chain of trust protects an embedded Linux system: each stage verifies the next, from the boot ROM to the kernel. Our Secured Embedded Linux Platform Build course (SEC8) covers secure boot, trusted boot and OP-TEE on Arm, and our Cyber Resilience Act course (SEC10) covers what the CRA requires from a connected product.