Standardizing the Generation and Signing of Boot Images
summary
Binman replaces a tangled set of vendor shell scripts and a separate repo by describing final boot images as device-tree entries and packing them with a Python backend, producing a single TPL/DL image for TI K3-style SoCs. Extensions add a TI secure entry that uses OpenSSL to generate X.509 signatures, support external blobs and FIT headers, and require tests so the project reports 100% code coverage. Ongoing work adds CLI-passed firmware names and FIT signing; the result removes bespoke tooling and makes complex multi-core, multi-firmware images reproducible.
AI-written summary · about
chapters (13)
- 0:00Boot image standardization
- 1:03Motivation for standardization
- 2:28U-Boot and firmware overview
- 3:13Bootloader complexity evolution
- 8:17Heterogeneous SoC boot flow
- 10:26Security and authenticated boot
- 11:54Legacy custom scripts challenges
- 14:10Introducing binman tool
- 18:54Extending binman use cases
- 20:18Migration to binman in TI K3
- 23:11TI secure entry design
- 25:44Advantages of binman
- 27:13Current and future developments
related talks
28mStandardizing the Generation and Signing of Boot Images
42mPractical Application of Verified Boot
42mBecoming a tyrant: Implementing secure boot in embedded devices
49mSecure Boot from A to Z- 42mPractical Application of Verified Boot
55mVerified Boot: From ROM to Userspace
39mMCUboot: Multi-Image Support
01h 03mTrusted Firmware M : Trusted Boot