TF-A: Dynamic Configuration and PIE support
summary
Trusted Firmware-A adds runtime device-style config files (example TB_FW_config) passed as extra boot arguments between BL stages so stages can enable/disable trusted boot, share a kernel DTB address, and share an Amber TLS heap (saving ~13 KB in BL2). AArch64 TF‑A implements PIE by per-image dynamic relocation fixup (GOT and RELA handling) so images can load anywhere; PIE adds ~5KB to a release binary. Limitations: BL1 disjoint ROM/RAM layout, linker-fixed carve-outs and init overlays break current fixups.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:16Dynamic Configuration Recap
- 3:43Dynamic Configuration Introduction
- 12:27What dynamic configuration is and is not
- 13:20Adding PIE support
- 19:50Some limitations of PIE support • The current fuo code assumes that Bl binary is a contiguous binary that is relocated as single blob at
- 38:14Finding the relevant sections for fixup
related talks
01h 03mTrusted Firmware M : Trusted Boot
41mTrusted Firmware M: Introduction
27mZephyr and Trusted Execution Environments
25mTPM 2.0 Attestable Firmware: Recovering Trust After Firmware Flaws
40mWhat should I know about secure boot and TEEs?
57mTrusted Firmware M : Core and Partition Manager
42mDefending the Branch: PAC, BTI & GCS on Linux
16mPatchlings: Enabling A/B-Equivalent OTA Updates for Deeply Embedded...