TA 2.1 defines several states:
Recommendation: Start with OEM Closed in development; move to Secure Closed only for mass production. qoriq trust architecture 2.1 user guide
You need a signed version of U-Boot (u-boot.bin). First, build U-Boot from your SDK, then sign it using the SRK1 private key. Recommendation: Start with OEM Closed in development; move
../cst --sign-esbc --in u-boot.bin --out u-boot-signed.bin --key srk1_4096.pem --sec-fw
Key flags:
The result is u-boot-signed.bin + a separate u-boot-signed.bin.sig (signature appended in some formats). Key flags:
Once secure boot is active, leverage the Cryptographic Accelerator and Assurance Module (CAAM) for high-speed crypto.