OP-TEE · Qualcomm Platforms
The Firmware Replacement
PBL and XBL stay proprietary — they still load and authenticate the next stage. Everything after them is replaced with open firmware: TF-A, OP-TEE, KVM, and U-Boot / UEFI.
| Stock (proprietary) | EL / world | Open replacement | EL / world |
|---|---|---|---|
| PBL (ROM) | — | unchanged | — |
| XBL / SBL | EL3 | unchanged — loads BL2 |
EL3 |
| — | — | TF-A BL2 (loader) |
EL3 → loads BL31/32/33 |
| TZ / QTEE monitor | EL3 · secure | TF-A BL31 |
EL3 · secure |
| QTEE secure OS + PIL | S-EL1 · secure | OP-TEE (BL32) |
S-EL1 · secure |
| QHEE / Gunyah | EL2 · NS | KVM | EL2 · NS |
| downstream UEFI / ABL | EL2 · NS | upstream UEFI or U-Boot (BL33) |
EL2 · NS |
PBL
ROM · proprietary
→
XBL
EL3 · proprietary
→
BL2
TF-A loader
→
BL31
TF-A · EL3
→
BL32
OP-TEE · S-EL1
→
BL33
U-Boot / UEFI · EL2
PAS / PIL — authenticating and loading the remote-processor firmware (modem, ADSP, CDSP, video) — moves from QTEE into OP-TEE, not TF-A. With QHEE replaced by KVM, the old HYP↔QTEE nested-SMC authentication path collapses into the secure world.