diff --git a/scripts/xtensa-build-all.sh b/scripts/xtensa-build-all.sh
index bbdea6328faf..c74a97c8d22c 100755
--- a/scripts/xtensa-build-all.sh
+++ b/scripts/xtensa-build-all.sh
@@ -18,6 +18,15 @@ PATH=$pwd/local/bin:$PATH
 
 pwd=$(pwd)
 
+die()
+{
+	>&2 printf '%s ERROR: ' "$0"
+	# We want die() to be usable exactly like printf
+	# shellcheck disable=SC2059
+	>&2 printf "$@"
+	exit 1
+}
+
 print_usage()
 {
     cat <<EOF
@@ -30,16 +39,19 @@ usage: xtensa-build.sh [options] platform(s)
        -u Force UP ARCH
        -d Enable debug build
        -c Interactive menuconfig
+       -o copies the file argument from src/arch/xtensa/configs/override/$arg.config
+	  to the build directory after invoking CMake and before Make.
        -k Use private key
        -v Verbose Makefile log
        -j n Set number of make build jobs. Jobs=#cores when no flag. \
 Infinte when not specified.
+	-m path to MEU tool. Switches signing step to use MEU instead of rimage.
        Supported platforms ${SUPPORTED_PLATFORMS[*]}
 EOF
 }
 
 # parse the args
-while getopts "rudj:ckva" OPTION; do
+while getopts "rudj:ckvao:m:" OPTION; do
         case "$OPTION" in
 		r) BUILD_ROM=yes ;;
 		u) BUILD_FORCE_UP=yes ;;
@@ -47,13 +59,31 @@ while getopts "rudj:ckva" OPTION; do
 		j) BUILD_JOBS=$OPTARG ;;
 		c) MAKE_MENUCONFIG=yes ;;
 		k) USE_PRIVATE_KEY=yes ;;
+		o) OVERRIDE_CONFIG=$OPTARG ;;
 		v) BUILD_VERBOSE='VERBOSE=1' ;;
 		a) PLATFORMS=("${SUPPORTED_PLATFORMS[@]}") ;;
+		m) MEU_TOOL_PATH=$OPTARG ;;
 		*) print_usage; exit 1 ;;
         esac
 done
 shift $((OPTIND-1))
 
+#default signing tool
+SIGNING_TOOL=RIMAGE
+
+if [ -n "${OVERRIDE_CONFIG}" ]
+then
+	OVERRIDE_CONFIG="src/arch/xtensa/configs/override/$OVERRIDE_CONFIG.config"
+	[ -f "${OVERRIDE_CONFIG}" ] || die 'Invalid override config file %s\n' "${OVERRIDE_CONFIG}"
+fi
+
+if [ -n "${MEU_TOOL_PATH}" ]
+then
+	[ -d "${MEU_TOOL_PATH}" ] || die 'Invalid MEU TOOL PATH %s\n' "${MEU_TOOL_PATH}"
+	MEU_PATH_OPTION=-DMEU_PATH="${MEU_TOOL_PATH}"
+	SIGNING_TOOL=MEU
+fi
+
 # parse platform args
 for arg in "$@"; do
 	platform=none
@@ -77,6 +107,7 @@ if [ ${#PLATFORMS[@]} -eq 0 ];
 then
 	echo "Error: No platforms specified. Supported are: " \
 		"${SUPPORTED_PLATFORMS[*]}"
+	print_usage
 	exit 1
 fi
 
@@ -200,10 +231,15 @@ do
 		tgl)
 			PLATFORM="tigerlake"
 			ARCH="xtensa-smp"
-			XTENSA_CORE="X6H3CNL_2017_8"
+			XTENSA_CORE="cavs2x_LX6HiFi3_2017_8"
 			HOST="xtensa-cnl-elf"
 			XTENSA_TOOLS_VERSION="RG-2017.8-linux"
 			HAVE_ROM='yes'
+			# default key for TGL
+			if [ -z "$PRIVATE_KEY_OPTION" ]
+			then
+				PRIVATE_KEY_OPTION="-D${SIGNING_TOOL}_PRIVATE_KEY=$pwd/keys/otc_private_key_3k.pem"
+			fi
 			;;
 		jsl)
 			PLATFORM="jasperlake"
@@ -287,19 +323,24 @@ do
 	( set -x # log the main commands and their parameters
 	cmake -DTOOLCHAIN="$TOOLCHAIN" \
 		-DROOT_DIR="$ROOT" \
+		-DMEU_OPENSSL="${MEU_OPENSSL}" \
+		"${MEU_PATH_OPTION}" \
 		"${PRIVATE_KEY_OPTION}" \
 		..
 
 	make ${PLATFORM}${DEFCONFIG_PATCH}_defconfig
 	)
 
+	if [ -n "$OVERRIDE_CONFIG" ]
+	then
+		cp "../$OVERRIDE_CONFIG" override.config
+	fi
+
 	if [[ "x$MAKE_MENUCONFIG" == "xyes" ]]
 	then
 		make menuconfig
 	fi
 
-	rm -fr override.config
-
 	if [[ "x$BUILD_DEBUG" == "xyes" ]]
 	then
 		echo "CONFIG_DEBUG=y" >> override.config
@@ -322,13 +363,15 @@ do
 		make overrideconfig
 	fi
 
-	if [ 'tgl' != "${platform}" ]; then
-		make bin -j "${BUILD_JOBS}" ${BUILD_VERBOSE}
-	else # FIXME: finish gcc support for tgl
+	# TGL needs MEU tool for signing
+	if [ 'tgl' = "${platform}" ] && [ "${SIGNING_TOOL}" = "RIMAGE" ]
+	then # build unsigned FW binary
 		make sof -j "${BUILD_JOBS}" ${BUILD_VERBOSE}
 		if [ "$BUILD_ROM" = "yes" ]; then
 			make rom_dump  ${BUILD_VERBOSE}
 		fi
+	else # build signed FW binary
+		make bin -j "${BUILD_JOBS}" ${BUILD_VERBOSE}
 	fi
 
 	cd "$WORKDIR"
diff --git a/src/arch/xtensa/CMakeLists.txt b/src/arch/xtensa/CMakeLists.txt
index 2f08553ac8fc..d664ed5f0592 100644
--- a/src/arch/xtensa/CMakeLists.txt
+++ b/src/arch/xtensa/CMakeLists.txt
@@ -368,6 +368,13 @@ if(NOT DEFINED RIMAGE_IMR_TYPE)
 	set(RIMAGE_IMR_TYPE 3)
 endif()
 
+if(NOT MEU_OPENSSL)
+	set(MEU_OPENSSL "/usr/bin/openssl")
+endif()
+# Don't ask users to keep secret their openssl location depending on
+# what they build in the moment.
+set(silenceUnusedWarning "${MEU_OPENSSL}")
+
 if(MEU_PATH OR DEFINED MEU_NO_SIGN)
 	if(NOT DEFINED MEU_OFFSET)
 		execute_process(
@@ -410,10 +417,6 @@ if(MEU_PATH OR DEFINED MEU_NO_SIGN)
 		add_dependencies(run_rimage run_smex)
 	endif()
 
-	if(NOT DEFINED MEU_OPENSSL)
-		set(MEU_OPENSSL "/usr/bin/openssl")
-	endif()
-
 	if(NOT DEFINED MEU_FLAGS)
 		set(MEU_FLAGS
 			-f ${MEU_PATH}/generic_meu_conf.xml