feature request for RPi5 : Add firmware support for preloading BL32
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 30/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Domain
- embedded-iot
Research direction
Review the RPi5 config.txt flow and the existing armstub=bl31.bin handling, then compare them with TF-A's documented BL32 boot-time loading model. Done means the boot flow supports an optional BL32 or OP-TEE image and address in the configuration while preserving the existing BL31 path.
Written by the indexing model from the issue text.
Description
Raspberry Pi 5 has basic upstream OP-TEE support in optee_os:
https://github.com/OP-TEE/optee_os/commit/e1e6e2c6ffd64dc8a5ca649214c39cbad872c4d2
However the current integration appears to rely on TF-A being built with OPTEE_ALLOW_SMC_LOAD=1,
meaning OP-TEE is loaded later via SMC rather than being preloaded as the BL32 payload during boot sequence.
TF-A documentation describes BL32 boot-time loading as the recommended OP-TEE integration mode while OPTEE_ALLOW_SMC_LOAD is mainly a fallback mechanism.
RPi5 already supports loading a custom TF-A BL31 image using:
armstub=bl31.bin
It would be very useful if the RPi5 bootloader config.txt flow could also preload an optional BL32 image, for example:
bl32=tee.bin
bl32_address=0x1d000000
or alternatively:
optee=tee.bin
optee_address=0x1d000000
This would allow Raspberry Pi 5 to use the standard TF-A + OP-TEE boot model and would be useful for TrustZone development, OP-TEE Trusted Application testing, educational use and embedded security research.
I understand that BCM2712 may not provide hardware-enforced secure DRAM isolation, so this request is not claiming full production-grade TEE security intergation.
- Dominant language
- No language data
- Stars
- 5.6k
- Forks
- 1.7k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from raspberrypi/firmware
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
raspberrypi/firmware#2042 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
raspberrypi/firmware#2040 · 2 comments ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
raspberrypi/firmware#2039 · 6 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
raspberrypi/firmware#2038 · 4 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
raspberrypi/firmware#2037 · 4 comments ·
All issues in raspberrypi/firmware
Similar issues
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
[adam] AdamNet network read doesn't cap to MAX_ADAM_PACKET_LEN, overflows client receive buffers Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
FujiNetWIFI/fujinet-firmware#1649 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
espressif/esp-iot-solution#786 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100