diff --git a/src/arch/arm64/Kconfig b/src/arch/arm64/Kconfig
index 8ebf76edf3..8c16732034 100644
--- a/src/arch/arm64/Kconfig
+++ b/src/arch/arm64/Kconfig
@@ -44,3 +44,13 @@ config ARM64_USE_ARM_TRUSTED_FIRMWARE
 	bool
 	default n
 	depends on ARCH_RAMSTAGE_ARM64
+
+config ARM64_USE_SECURE_OS
+	bool
+	default n
+	depends on ARM64_USE_ARM_TRUSTED_FIRMWARE
+
+config ARM64_SECURE_OS_FILE
+	string "Secure OS binary file"
+	help
+	  Secure OS binary file.
diff --git a/src/arch/arm64/Makefile.inc b/src/arch/arm64/Makefile.inc
index 1aeef7654c..86d6f7dce6 100644
--- a/src/arch/arm64/Makefile.inc
+++ b/src/arch/arm64/Makefile.inc
@@ -217,6 +217,16 @@ $(BL31_CBFS)-type := stage
 $(BL31_CBFS)-compression := $(CBFS_COMPRESS_FLAG)
 cbfs-files-y += $(BL31_CBFS)
 
+ifeq ($(CONFIG_ARM64_USE_SECURE_OS),y)
+
+SECURE_OS_FILE := $(CONFIG_ARM64_SECURE_OS_FILE)
+SECURE_OS_FILE_CBFS := $(call strip_quotes,$(CONFIG_CBFS_PREFIX))/secure_os
+$(SECURE_OS_FILE_CBFS)-file := $(SECURE_OS_FILE)
+$(SECURE_OS_FILE_CBFS)-type := stage
+cbfs-files-y += $(SECURE_OS_FILE_CBFS)
+
+endif # CONFIG_ARM64_USE_SECURE_OS
+
 endif # CONFIG_ARM64_USE_ARM_TRUSTED_FIRMWARE
 
 endif # CONFIG_ARCH_RAMSTAGE_ARM64
diff --git a/src/arch/arm64/arm_tf.c b/src/arch/arm64/arm_tf.c
index 29dc7c344f..9b0f19fc63 100644
--- a/src/arch/arm64/arm_tf.c
+++ b/src/arch/arm64/arm_tf.c
@@ -18,6 +18,8 @@
  */
 
 #include <arch/cache.h>
+#include <arch/lib_helpers.h>
+#include <arch/transition.h>
 #include <arm_tf.h>
 #include <assert.h>
 #include <cbfs.h>
@@ -32,8 +34,8 @@
 static image_info_t bl31_image_info;
 static image_info_t bl32_image_info;
 static image_info_t bl33_image_info;
-static entry_point_info_t bl32_ep_info;
  */
+static entry_point_info_t bl32_ep_info;
 static entry_point_info_t bl33_ep_info;
 static bl31_params_t bl31_params;
 
@@ -57,6 +59,22 @@ void arm_tf_run_bl31(u64 payload_entry, u64 payload_arg0, u64 payload_spsr)
 	bl31_entry = prog_entry(&bl31);
 
 	SET_PARAM_HEAD(&bl31_params, PARAM_BL31, VERSION_1, 0);
+
+	if (IS_ENABLED(CONFIG_ARM64_USE_SECURE_OS)) {
+		struct prog bl32 = PROG_INIT(ASSET_BL32, CONFIG_CBFS_PREFIX"/secure_os");
+
+		if (prog_locate(&bl32))
+			die("BL31 not found");
+
+		if (cbfs_prog_stage_load(&bl32))
+			die("BL31 load failed");
+
+		SET_PARAM_HEAD(&bl32_ep_info, PARAM_EP, VERSION_1, PARAM_EP_SECURE);
+		bl32_ep_info.pc = (uintptr_t)prog_entry(&bl32);
+		bl32_ep_info.spsr = SPSR_EXCEPTION_MASK | get_eret_el(EL1, SPSR_USE_L);
+		bl31_params.bl32_ep_info = &bl32_ep_info;
+	}
+
 	bl31_params.bl33_ep_info = &bl33_ep_info;
 
 	SET_PARAM_HEAD(&bl33_ep_info, PARAM_EP, VERSION_1, PARAM_EP_NON_SECURE);
diff --git a/src/include/assets.h b/src/include/assets.h
index 9c757edc5e..2368508b02 100644
--- a/src/include/assets.h
+++ b/src/include/assets.h
@@ -33,6 +33,7 @@ enum asset_type {
 	ASSET_REFCODE,
 	ASSET_PAYLOAD,
 	ASSET_BL31,
+	ASSET_BL32,
 };
 
 struct asset {