A complete open-source TrustZone stack — TF-A at EL3, OP-TEE at Secure EL1, U-Boot and Linux at EL2 — built from source on the Qualcomm RB3 Gen2 (QCM6490/Kodiak).
This talk describes the boot architecture of the platform while walking through the constraints that make this SoC non-trivial to bring up: Sectools signing, running Linux at EL2 without Gunyah, QTEE vs OP-TEE device tree conflicts, and DSP remoteproc bring-up.
Qualcomm Linux ships official support via meta-qcom, but a multi-hour Yocto build is a poor inner loop for firmware developers; a Buildroot-based alternative — integrated into OP-TEE/build.git — enables fast iteration at any layer of the stack and live OP-TEE regression testing, which will be demonstrated.
Work will be upstreamed to OP-TEE/build.git
The Qualcomm RB3 Gen2 (QCM6490/Kodiak) is a commercially available AArch64 development board with upstream Linux and U-Boot support.
The official firmware environment is delivered through Qualcomm Linux and meta-qcom — a comprehensive but heavyweight Yocto-based BSP that is the right answer for production integration but a slow inner loop for firmware engineers iterating on TF-A, OP-TEE, or the boot chain.
This talk describes the boot architecture of the QCM6490 platform while providing a Buildroot-based developer workflow — integrated into OP-TEE/build.git — as a fast alternative to meta-qcom for firmware engineers. A single make all builds the full stack from source. From that point, rebuilding any individual component in the bootloader stack or the kernel UKI — and regenerating and flashing the resulting image — becomes a lightweight operation, enabling fast iteration at any layer.
The architecture is the main thread. Topics covered include:
- Exception level layout
- Boot chain: PBL → XBL → BL2 (TF-A, signed with Qualcomm Sectools in TEST mode) → FIP (OP-TEE + U-Boot) → Unified Kernel Image (UKI) containing kernel, DTB, initramfs, and cmdline as a single EFI binary.
- OP-TEE integration
- DSP remoteproc chain: sourcing ADSP/CDSP firmware and embedding the qcom_pas PAS Trusted Application as an OP-TEE early TA
- Developer ergonomics vs. meta-qcom: a fetch-blobs target that pulls Qualcomm boot binaries from public Qualcomm and CodeLinaro repositories in minutes, replacing the need for a full Yocto build during development.
Demo
The talk closes with a live run of the OP-TEE xtest regression suite on the board, demonstrating the full Normal/Secure World path end to end.
The talk is aimed at firmware engineers working on Qualcomm Arm platforms, and more broadly at anyone integrating OP-TEE with a vendor boot chain that diverges from the standard reference flow.
Jorge Ramirez-Ortiz is a software engineer at the Qualcomm Innovation Center.
He is a maintainer of the Qualcomm platform ports in Trusted Firmware-A and OP-TEE, and a long-term contributor and maintainer across a broad range of open-source projects — FFmpeg, Zephyr, U-Boot, Linux, OpenSSL, and cryptographic libraries, among others. He is part of the open boot firmware
strategy at Qualcomm, working across multiple boards to bring up fully open-source firmware stacks.