TL;DR
- It came up secure end-to-end: memory map + DDR firewall, a real hardware TRNG
(RK3576’s RKRNG, not RK3588’s TRNG_V1), and an OTP-derived Hardware Unique Key —
xtestpasses 113/114 on hardware, and the one miss was a build config, not the platform. - The silent console was a forced-override bug. TF-A hands RK3576’s BL32 no
non-secure DT pointer, so the normal console probe never runs; needs
CFG_EARLY_CONSOLEforced on (not just defaulted) and TF-A/OP-TEE agreeing on UART0. - The OTP key is a one-way door, and it’s treated like one: ephemeral HUK by default, persistent fuse-burning gated behind an explicit off-by-default flag until the OTP index is confirmed — burn the wrong row and it’s permanent.
- Base platform support (#7821) is merged into mainline OP-TEE; the OTP key-derivation half (#7841) is still in review, split out deliberately so the irreversible part gets its own scrutiny.