For Allwinner boxes you need to add this line to your u-boot defconfig. CONFIG_SPL_IMAGE_TYPE_SUNXI_TOC0=y   To generate a TOC0 image from a binary, you will need an RSA key (pair) file. As most secure-boot enabled devices do not burn the VENDOR_ID eFUSE, you can use any RSA key, so just generate one, for instance with the openssl tool (would only need to be done once): openssl genrsa -out root_key.pem   Your root_key.pem needs to be in the u-boot root directory.