The Raspberry Pi Compute Module 4 (CM4) is a popular choice for industrial edge devices, but out of the box nothing enforces a hardware-rooted chain of trust over the OS it boots. wolfBoot now targets the CM4 (Broadcom BCM2711, quad-core Cortex-A72), replacing U-Boot with a verified boot chain rooted in your own keys.
How It Fits into the Boot Chain
The VideoCore firmware normally loads kernel8.img, typically U-Boot or the Linux kernel itself. wolfBoot takes that slot:
Anchoring the Root of Trust in CM4 OTP Fuses
wolfBoot’s public keys are compiled into kernel8.img itself, so whatever protects the boot partition protects your root of trust. On the CM4 that is Raspberry Pi EEPROM secure boot: the SoC authenticates the boot partition against a customer key whose hash is burned into One-Time-Programmable (OTP) fuses. Enable those OTP fuses in production to make sure no one can write to the boot partition and replace wolfBoot and its keys.
Updating wolfBoot is a file operation rather than a bootloader self-flash. kernel8.img lives on the FAT boot partition, so the running system can replace it in place, or the factory can re-flash it over rpiboot. With secure boot enabled, the replacement has to be signed with the fused key first, which makes a bootloader update a signed release artifact like any other. Key rotation follows the same route, since your public keys travel inside that image.
Verified A/B Boot directly from eMMC/microSD
Validated end to end on CM4 hardware:
- Massive footprint reduction: wolfBoot is ~14x smaller than U-Boot, 726 KB against 52 KB (and 61KB with debug console).
- Direct eMMC/microSD access: brings up the storage controller (EMMC2 / SDHCI), parses the GPT partition table and reads the signed A/B slots directly.
- Verification: SHA-384 integrity check and ECDSA P-384 signature verification before handing off to the ELF64 payload.
- Crypto agility: ECDSA P-384 by default, with RSA, ED25519 and PQC (ML-DSA, LMS, XMSS) also supported, including hybrid combinations.
Lean Linux Booting and Native RAUC Support
- RAUC (Robust Auto-Update Controller): records slot status in the standard U-Boot environment block, and wolfBoot uses these to maintain compatibility.
- Nothing changes in userspace – your existing rauc tooling keeps working as-is.
- Linux and Yocto integration: wolfBoot loads a signed Flattened Image Tree (FIT), verifies it and boots Linux, tested against a Yocto-generated rootfs.
Cryptographic Assurance with FIPS 140-3
For mission-critical or government-regulated deployments, wolfBoot runs every boot-time cryptographic operation inside the wolfCrypt FIPS 140-3 validated boundary. The DRBG is seeded from the BCM2711’s hardware TRNG, Power-On Self-Tests and in-core integrity checks run at boot, and the boot halts unless the module confirms FIPS 140-3 module operational.
Note: A full CMVP-validated production deployment requires the licensed wolfCrypt FIPS bundle rather than the fips-ready evaluation code, and compliance with the official Security Policy.
Resources & Further Reading
Have questions or need help integrating wolfBoot into your Pi CM4 workflow? Reach out to the team at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now