TrustZone Bring-Up on Qualcomm QCM6490: Open Firmware from EL3 to Linux EL2 with a Buildroot Developer Workflow

Jorge Ramirez-Ortiz

A complete open-source TrustZone stack — TF-A at EL3, OP-TEE at Secure EL1, U-Boot and Linux at EL2 — built from source on the Qualcomm RB3 Gen2 (QCM6490/Kodiak).

This talk describes the boot architecture of the platform while walking through the constraints that make this SoC non-trivial to bring up: Sectools signing, running Linux at EL2 without Gunyah, QTEE vs OP-TEE device tree conflicts, and DSP remoteproc bring-up.

Qualcomm Linux ships official support via meta-qcom, but a multi-hour Yocto build is a poor inner loop for firmware developers; a Buildroot-based alternative — integrated into OP-TEE/build.git — enables fast iteration at any layer of the stack and live OP-TEE regression testing, which will be demonstrated.

Work will be upstreamed to OP-TEE/build.git

The Qualcomm RB3 Gen2 (QCM6490/Kodiak) is a commercially available AArch64 development board with upstream Linux and U-Boot support.

The official firmware environment is delivered through Qualcomm Linux and meta-qcom — a comprehensive but heavyweight Yocto-based BSP that is the right answer for production integration but a slow inner loop for firmware engineers iterating on TF-A, OP-TEE, or the boot chain.

This talk describes the boot architecture of the QCM6490 platform while providing a Buildroot-based developer workflow — integrated into OP-TEE/build.git — as a fast alternative to meta-qcom for firmware engineers. A single make all builds the full stack from source. From that point, rebuilding any individual component in the bootloader stack or the kernel UKI — and regenerating and flashing the resulting image — becomes a lightweight operation, enabling fast iteration at any layer.

The architecture is the main thread. Topics covered include:

  • Exception level layout
  • Boot chain: PBL → XBL → BL2 (TF-A, signed with Qualcomm Sectools in TEST mode) → FIP (OP-TEE + U-Boot) → Unified Kernel Image (UKI) containing kernel, DTB, initramfs, and cmdline as a single EFI binary.
  • OP-TEE integration
  • DSP remoteproc chain: sourcing ADSP/CDSP firmware and embedding the qcom_pas PAS Trusted Application as an OP-TEE early TA
  • Developer ergonomics vs. meta-qcom: a fetch-blobs target that pulls Qualcomm boot binaries from public Qualcomm and CodeLinaro repositories in minutes, replacing the need for a full Yocto build during development.

Demo
The talk closes with a live run of the OP-TEE xtest regression suite on the board, demonstrating the full Normal/Secure World path end to end.

The talk is aimed at firmware engineers working on Qualcomm Arm platforms, and more broadly at anyone integrating OP-TEE with a vendor boot chain that diverges from the standard reference flow.

< Back to featured talks