Re: [PATCH] bootm: remove previously deprecated CONFIG_BOOTM_OPTEE

[Marco Felsch <m.felsch@pengutronix.de>]

On 26-08-21, Ahmad Fatoum wrote:
> Hi,
> 
> On 8/5/26 4:48 PM, Ahmad Fatoum wrote:
> > Early loading of OP-TEE for 32-bit platforms was added in 2020 shortly
> > after initial (late) loading support was added in 2019.
> > 
> > CONFIG_BOOTM_OPTEE (practically OP-TEE in a FIT image alongside the
> > kernel) has been documented as deprecated since 2025 as it greatly
> > increases the trusted computing base by running all of barebox in
> > secure monitor mode as opposed to only the prebootloader.
> > 
> > Additionally, a `tee =' key in the FIT is a barebox invention and the
> > spec conforming way would be to reference the tee in the loadables
> > property of a configuration.
> > 
> > For all these reasons, let's finally remove late loading.
> > 
> > Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> 
> Any objections?

Not from my site. It's easier for new users if there is only one option
which is the more secure one, therefore:

Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>

Regards,
  Marco

> 
> Cheers,
> Ahmad
> 
> > ---
> >  .../migration-guides/migration-master.rst     | 13 ++++
> >  Documentation/user/optee.rst                  | 12 ++--
> >  Documentation/user/security.rst               |  3 -
> >  arch/arm/cpu/start.c                          |  3 -
> >  arch/arm/include/asm/armlinux.h               |  2 +-
> >  arch/arm/lib32/Makefile                       |  1 -
> >  arch/arm/lib32/armlinux.c                     | 10 +--
> >  arch/arm/lib32/bootm.c                        | 64 +------------------
> >  arch/arm/lib32/bootu.c                        |  2 +-
> >  arch/arm/lib32/bootz.c                        |  2 +-
> >  arch/arm/lib32/start-kernel-optee.S           | 16 -----
> >  commands/bootm.c                              | 11 +---
> >  common/bootm-android-image.c                  |  1 -
> >  common/bootm-fit.c                            | 31 ++-------
> >  common/bootm.c                                | 20 ++----
> >  drivers/tee/optee/Kconfig                     |  2 +-
> >  include/bootm.h                               |  6 --
> >  include/loadable.h                            |  6 +-
> >  lib/loadable.c                                |  2 -
> >  security/Kconfig                              | 18 ------
> >  20 files changed, 38 insertions(+), 187 deletions(-)
> >  delete mode 100644 arch/arm/lib32/start-kernel-optee.S
> > 
> > diff --git a/Documentation/migration-guides/migration-master.rst b/Documentation/migration-guides/migration-master.rst
> > index e28a608e53e9..68f0ef65756b 100644
> > --- a/Documentation/migration-guides/migration-master.rst
> > +++ b/Documentation/migration-guides/migration-master.rst
> > @@ -17,3 +17,16 @@ ARCH=arm64
> >  Use of ``ARCH=arm`` for 64-bit ARM builds is deprecated and now emits
> >  a warning. Users should change build scripts to use ``ARCH=arm64``
> >  instead when targetting ARMv8.
> > +
> > +Removal of deprecated CONFIG_BOOTM_OPTEE
> > +----------------------------------------
> > +
> > +The support for late loading of OP-TEE had been deprecated and ultimately
> > +removed as it greatly increased the attack surface and was only supported
> > +on 32-bit ARM systems.
> > +
> > +OP-TEE loading is now only supported
> > +:ref:`in the prebootloader <optee_early_loading>`.
> > +
> > +For i.MX6 boards, this can be enabled by enabling
> > +``CONFIG_FIRMWARE_IMX6_OPTEE``.
> > diff --git a/Documentation/user/optee.rst b/Documentation/user/optee.rst
> > index 88e651ddec57..975dcdc3dbac 100644
> > --- a/Documentation/user/optee.rst
> > +++ b/Documentation/user/optee.rst
> > @@ -39,15 +39,11 @@ main barebox start function.
> >  Before Linux start
> >  ^^^^^^^^^^^^^^^^^^
> >  
> > -.. warning:: Late loading of OP-TEE is deprecated, greatly increases the
> > -   attack surface and is only supported on 32-bit ARM systems.
> > -   Systems should prefer early loading OP-TEE whenever possible.
> > +The support for late loading of OP-TEE had been deprecated and ultimately
> > +removed as it greatly increased the attack surface and was only supported
> > +on 32-bit ARM systems.
> > +OP-TEE loading is now only supported :ref:`in the prebootloader <optee_early_loading>`.
> >  
> > -Enable the `CONFIG_BOOTM_OPTEE` configuration variable and configure the
> > -`CONFIG_OPTEE_SIZE` variable. This will reserve a memory area at the end
> > -of memory for OP-TEE to run, usually Barebox would relocate itself there. To
> > -load OP-TEE before the kernel is started, configure the global ``bootm.tee``
> > -variable to point to a valid OPTEE v1 binary.
> >  
> >  Communication with OP-TEE
> >  -------------------------
> > diff --git a/Documentation/user/security.rst b/Documentation/user/security.rst
> > index 94184ab8e893..f8cd6bd090f2 100644
> > --- a/Documentation/user/security.rst
> > +++ b/Documentation/user/security.rst
> > @@ -69,9 +69,6 @@ Firmware) should happen as early as possible, i.e., within the barebox
> >  barebox will run with elevated permission, which greatly increases the attack
> >  surface.
> >  
> > -In concrete terms, the deprecated ``CONFIG_BOOTM_OPTEE`` option should be
> > -disabled in favor of :ref:`loading OP-TEE early <optee_early_loading>`.
> > -
> >  Ensuring the kernel is verified
> >  -------------------------------
> >  
> > diff --git a/arch/arm/cpu/start.c b/arch/arm/cpu/start.c
> > index 6a9941275c12..f9f380444f81 100644
> > --- a/arch/arm/cpu/start.c
> > +++ b/arch/arm/cpu/start.c
> > @@ -192,9 +192,6 @@ __noreturn void barebox_non_pbl_start(unsigned long membase,
> >  
> >  	handoff_data_set(hd);
> >  
> > -	if (IS_ENABLED(CONFIG_BOOTM_OPTEE))
> > -		of_add_reserve_entry(endmem - OPTEE_SIZE, endmem - 1);
> > -
> >  	pr_debug("starting barebox...\n");
> >  
> >  	start_barebox();
> > diff --git a/arch/arm/include/asm/armlinux.h b/arch/arm/include/asm/armlinux.h
> > index 871664824643..83813a5dce97 100644
> > --- a/arch/arm/include/asm/armlinux.h
> > +++ b/arch/arm/include/asm/armlinux.h
> > @@ -63,6 +63,6 @@ struct image_data;
> >  
> >  void start_linux(void *adr, int swap, unsigned long initrd_address,
> >  		 unsigned long initrd_size, void *oftree,
> > -		 enum arm_security_state, void *optee);
> > +		 enum arm_security_state);
> >  
> >  #endif /* __ARCH_ARMLINUX_H */
> > diff --git a/arch/arm/lib32/Makefile b/arch/arm/lib32/Makefile
> > index 67c4f16f76ad..5598ab386052 100644
> > --- a/arch/arm/lib32/Makefile
> > +++ b/arch/arm/lib32/Makefile
> > @@ -3,7 +3,6 @@
> >  obj-$(CONFIG_ARM_LINUX)	+= armlinux.o
> >  obj-$(CONFIG_CMD_BOOTZ)	+= bootz.o
> >  obj-$(CONFIG_BOOTM)     += bootm.o
> > -obj-$(CONFIG_BOOTM_OPTEE) += start-kernel-optee.o
> >  obj-$(CONFIG_CMD_BOOTU) += bootu.o
> >  obj-$(CONFIG_BOOT_ATAGS) += atags.o
> >  obj-y	+= div0.o
> > diff --git a/arch/arm/lib32/armlinux.c b/arch/arm/lib32/armlinux.c
> > index 6890d9cb6fda..8bb3c5f9c273 100644
> > --- a/arch/arm/lib32/armlinux.c
> > +++ b/arch/arm/lib32/armlinux.c
> > @@ -28,11 +28,9 @@
> >  #include <asm/secure.h>
> >  #include <asm/boot.h>
> >  
> > -void start_kernel_optee(void *optee, void *kernel, void *oftree);
> > -
> >  void start_linux(void *adr, int swap, unsigned long initrd_address,
> >  		 unsigned long initrd_size, void *oftree,
> > -		 enum arm_security_state state, void *optee)
> > +		 enum arm_security_state state)
> >  {
> >  	phys_addr_t params = 0;
> >  	unsigned architecture;
> > @@ -79,9 +77,5 @@ void start_linux(void *adr, int swap, unsigned long initrd_address,
> >  		__asm__ __volatile__("mcr p15, 0, %0, c1, c0" :: "r" (reg));
> >  	}
> >  
> > -	if (optee && IS_ENABLED(CONFIG_BOOTM_OPTEE)) {
> > -		start_kernel_optee(optee, adr, oftree);
> > -	} else {
> > -		__jump_to_linux(adr, architecture, params);
> > -	}
> > +	__jump_to_linux(adr, architecture, params);
> >  }
> > diff --git a/arch/arm/lib32/bootm.c b/arch/arm/lib32/bootm.c
> > index e94bb979eff9..e2a80ada788b 100644
> > --- a/arch/arm/lib32/bootm.c
> > +++ b/arch/arm/lib32/bootm.c
> > @@ -21,7 +21,6 @@
> >  #include <binfmt.h>
> >  #include <restart.h>
> >  #include <globalvar.h>
> > -#include <tee/optee.h>
> >  #include <asm/byteorder.h>
> >  #include <asm/setup.h>
> >  #include <asm/barebox-arm.h>
> > @@ -149,54 +148,6 @@ static int get_kernel_addresses(size_t image_size,
> >  	return 0;
> >  }
> >  
> > -static int optee_verify_header_request_region(struct image_data *data, struct optee_header *hdr)
> > -{
> > -	int ret;
> > -
> > -	ret = optee_verify_header(hdr);
> > -	if (ret < 0) {
> > -		pr_err("Could not verify header: %pe", ERR_PTR(ret));
> > -		return ret;
> > -	}
> > -
> > -	data->tee_res = request_sdram_region("TEE", hdr->init_load_addr_lo, hdr->init_size,
> > -					     MEMTYPE_RESERVED, MEMATTRS_RW_DEVICE);
> > -	if (!data->tee_res)
> > -		return -EINVAL;
> > -
> > -	return 0;
> > -}
> > -
> > -static int bootm_load_tee(struct image_data *data)
> > -{
> > -	int ret;
> > -	struct optee_header hdr;
> > -
> > -	if (!data->tee)
> > -		return 0;
> > -
> > -	ret = loadable_extract_into_buf(data->tee, &hdr, sizeof(hdr), 0,
> > -					LOADABLE_EXTRACT_PARTIAL);
> > -	if (ret < 0)
> > -		return ret;
> > -
> > -	ret = optee_verify_header_request_region(data, &hdr);
> > -	if (ret < 0)
> > -		return ret;
> > -
> > -	ret = loadable_extract_into_buf(data->tee, (void *)data->tee_res->start,
> > -					hdr.init_size, sizeof(hdr), 0);
> > -	if (ret < 0) {
> > -		release_region(data->tee_res);
> > -		return ret;
> > -	}
> > -
> > -	printf("Loaded TEE image to %pa, size 0x%08x\n",
> > -	       (void *)data->tee_res->start, hdr.init_size);
> > -
> > -	return 0;
> > -}
> > -
> >  static int __do_bootm_linux(struct image_data *data, unsigned long free_mem,
> >  			    int swap, void *fdt)
> >  {
> > @@ -204,7 +155,6 @@ static int __do_bootm_linux(struct image_data *data, unsigned long free_mem,
> >  	unsigned long initrd_start = 0, initrd_size = 0, initrd_end = 0;
> >  	const struct resource *initrd_res, *sdram;
> >  	struct resource gap;
> > -	void *tee;
> >  	enum arm_security_state state = bootm_arm_security_state();
> >  	void *fdt_load_address = NULL;
> >  	int ret;
> > @@ -259,13 +209,6 @@ static int __do_bootm_linux(struct image_data *data, unsigned long free_mem,
> >  			return PTR_ERR(fdt_res);
> >  	}
> >  
> > -	if (IS_ENABLED(CONFIG_BOOTM_OPTEE)) {
> > -		ret = bootm_load_tee(data);
> > -		if (ret)
> > -			return ret;
> > -	}
> > -
> > -
> >  	if (bootm_verbose(data)) {
> >  		printf("\nStarting kernel at 0x%08lx", kernel);
> >  		if (initrd_size)
> > @@ -291,13 +234,8 @@ static int __do_bootm_linux(struct image_data *data, unsigned long free_mem,
> >  	if (ret)
> >  		return ret;
> >  
> > -	if (data->tee_res)
> > -		tee = (void *)data->tee_res->start;
> > -	else
> > -		tee = NULL;
> > -
> >  	start_linux((void *)kernel, swap, initrd_start, initrd_size,
> > -		    fdt_load_address, state, tee);
> > +		    fdt_load_address, state);
> >  
> >  	restart_machine(0);
> >  
> > diff --git a/arch/arm/lib32/bootu.c b/arch/arm/lib32/bootu.c
> > index 4b0f495aea5f..f7b6ccc8c651 100644
> > --- a/arch/arm/lib32/bootu.c
> > +++ b/arch/arm/lib32/bootu.c
> > @@ -36,7 +36,7 @@ static int do_bootu(int argc, char *argv[])
> >  	if (ret)
> >  		return ret;
> >  
> > -	start_linux(kernel, 0, 0, 0, oftree, ARM_STATE_SECURE, NULL);
> > +	start_linux(kernel, 0, 0, 0, oftree, ARM_STATE_SECURE);
> >  
> >  	return 1;
> >  }
> > diff --git a/arch/arm/lib32/bootz.c b/arch/arm/lib32/bootz.c
> > index 5aa762b4912d..97607e43a645 100644
> > --- a/arch/arm/lib32/bootz.c
> > +++ b/arch/arm/lib32/bootz.c
> > @@ -120,7 +120,7 @@ static int do_bootz(int argc, char *argv[])
> >  	if (ret)
> >  		return ret;
> >  
> > -	start_linux(zimage, swap, 0, 0, oftree, ARM_STATE_SECURE, NULL);
> > +	start_linux(zimage, swap, 0, 0, oftree, ARM_STATE_SECURE);
> >  
> >  	return 0;
> >  
> > diff --git a/arch/arm/lib32/start-kernel-optee.S b/arch/arm/lib32/start-kernel-optee.S
> > deleted file mode 100644
> > index 261ab39ba7a3..000000000000
> > --- a/arch/arm/lib32/start-kernel-optee.S
> > +++ /dev/null
> > @@ -1,16 +0,0 @@
> > -/* SPDX-License-Identifier: GPL-2.0-only */
> > -
> > -#include <linux/linkage.h>
> > -
> > -ENTRY(start_kernel_optee)
> > -	/*
> > -	 * r0 = optee
> > -	 * r1 = kernel
> > -	 * r2 = oftree
> > -	 */
> > -	mov r4, r0
> > -	mov r0, #0
> > -	mov lr, r1
> > -	mov r1, #0
> > -	bx r4
> > -ENDPROC(start_kernel_optee)
> > diff --git a/commands/bootm.c b/commands/bootm.c
> > index 24bce5ce6b64..9ff4b218fd1f 100644
> > --- a/commands/bootm.c
> > +++ b/commands/bootm.c
> > @@ -28,7 +28,7 @@
> >  #include <magicvar.h>
> >  #include <asm-generic/memory_layout.h>
> >  
> > -#define BOOTM_OPTS_COMMON "sca:e:vo:fdt:"
> > +#define BOOTM_OPTS_COMMON "sca:e:vo:fd"
> >  
> >  #ifdef CONFIG_BOOTM_INITRD
> >  #define BOOTM_OPTS BOOTM_OPTS_COMMON "L:r:"
> > @@ -88,9 +88,6 @@ static int do_bootm(int argc, char *argv[])
> >  		case 'd':
> >  			data.dryrun = 1;
> >  			break;
> > -		case 't':
> > -			data.tee_file = optarg;
> > -			break;
> >  		default:
> >  			return COMMAND_ERROR_USAGE;
> >  		}
> > @@ -129,9 +126,6 @@ BAREBOX_CMD_HELP_OPT ("-e OFFS\t","entry point to the image relative to start (0
> >  #ifdef CONFIG_OFTREE
> >  BAREBOX_CMD_HELP_OPT ("-o DTB\t","specify open firmware device tree")
> >  #endif
> > -#ifdef CONFIG_BOOTM_OPTEE
> > -BAREBOX_CMD_HELP_OPT ("-t TEE\t","specify TEE image")
> > -#endif
> >  #ifdef CONFIG_BOOTM_VERBOSE
> >  BAREBOX_CMD_HELP_OPT ("-v\t","verbose")
> >  #endif
> > @@ -150,9 +144,6 @@ BAREBOX_CMD_START(bootm)
> >  #endif
> >  #ifdef CONFIG_BOOTM_VERBOSE
> >  					  "v"
> > -#endif
> > -#ifdef CONFIG_BOOTM_OPTEE
> > -					  "t"
> >  #endif
> >  					  "] IMAGE")
> >  	BAREBOX_CMD_GROUP(CMD_GRP_BOOT)
> > diff --git a/common/bootm-android-image.c b/common/bootm-android-image.c
> > index 6acc41c3dd66..f48c97741528 100644
> > --- a/common/bootm-android-image.c
> > +++ b/common/bootm-android-image.c
> > @@ -54,7 +54,6 @@ static int do_bootm_aimage(struct image_data *img_data)
> >  	struct bootm_data bootm_data = {
> >  		.oftree_file = img_data->oftree_file,
> >  		.initrd_file = img_data->initrd_file,
> > -		.tee_file = img_data->tee_file,
> >  		.verbose = img_data->verbose,
> >  		.verify = img_data->verify,
> >  		.force = img_data->force,
> > diff --git a/common/bootm-fit.c b/common/bootm-fit.c
> > index 995bd7181223..f7742b871785 100644
> > --- a/common/bootm-fit.c
> > +++ b/common/bootm-fit.c
> > @@ -87,30 +87,6 @@ static bool loadable_from_fit_oftree(struct image_data *data,
> >  	return true;
> >  }
> >  
> > -/*
> > - * loadable_from_fit_tee() - create tee loadable from FIT
> > - * @data:		image data context
> > - * @fit:		handle of FIT image
> > - * @config:		config to look up kernel in
> > - *
> > - * This creates a loadable for the first trusted execution environment
> > - * in the config.
> > - *
> > - * Return: true if a TEE exists or
> > - *         false otherwise.
> > - */
> > -static bool loadable_from_fit_tee(struct image_data *data,
> > -				struct fit_handle *fit,
> > -				void *config)
> > -{
> > -	if (!fit_has_image(fit, config, "tee"))
> > -		return false;
> > -
> > -	loadable_release(&data->tee);
> > -	data->tee = loadable_from_fit(fit, config, "tee", 0, LOADABLE_TEE);
> > -	return true;
> > -}
> > -
> >  static bool bootm_fit_config_valid(struct fit_handle *fit,
> >  				   struct device_node *config)
> >  {
> > @@ -164,6 +140,12 @@ int bootm_open_fit(struct image_data *data, bool override)
> >  		goto err;
> >  	}
> >  
> > +	if (fit_has_image(fit, fit_config, "tee")) {
> > +		pr_err("Late-loaded tee is insecure and no longer supported\n");
> > +		ret = -ENOSYS;
> > +		goto err;
> > +	}
> > +
> >  	loadable_from_fit_os(data, fit, fit_config);
> >  	if (override)
> >  		data->is_override.os = true;
> > @@ -171,7 +153,6 @@ int bootm_open_fit(struct image_data *data, bool override)
> >  		data->is_override.initrd = true;
> >  	if (loadable_from_fit_oftree(data, fit, fit_config) && override)
> >  		data->is_override.oftree = true;
> > -	loadable_from_fit_tee(data, fit, fit_config);
> >  
> >  	data->kernel_type = bootm_fit_update_os_header(data);
> >  
> > diff --git a/common/bootm.c b/common/bootm.c
> > index de1b87fe2072..27da1a590bf1 100644
> > --- a/common/bootm.c
> > +++ b/common/bootm.c
> > @@ -95,7 +95,6 @@ void bootm_data_init_defaults(struct bootm_data *data)
> >  	data->os_address = UIMAGE_SOME_ADDRESS;
> >  	data->os_entry = UIMAGE_SOME_ADDRESS;
> >  	data->oftree_file = getenv_nonempty("global.bootm.oftree");
> > -	data->tee_file = getenv_nonempty("global.bootm.tee");
> >  	data->os_file = getenv_nonempty("global.bootm.image");
> >  	getenv_ul("global.bootm.image.loadaddr", &data->os_address);
> >  	if (IS_ENABLED(CONFIG_BOOTM_INITRD)) {
> > @@ -117,7 +116,6 @@ void bootm_data_init_defaults(struct bootm_data *data)
> >  void bootm_data_restore_defaults(const struct bootm_data *data)
> >  {
> >  	globalvar_set("bootm.oftree", data->oftree_file);
> > -	globalvar_set("bootm.tee", data->tee_file);
> >  	globalvar_set("bootm.image", data->os_file);
> >  	pr_setenv("global.bootm.image.loadaddr", "0x%lx", data->os_address);
> >  	if (IS_ENABLED(CONFIG_BOOTM_INITRD)) {
> > @@ -495,12 +493,6 @@ static int bootm_open_files(struct image_data *data)
> >  			return ret;
> >  	}
> >  
> > -	if (data->tee_file) {
> > -		data->tee = loadable_from_file(data->tee_file, LOADABLE_TEE);
> > -		if (IS_ERR(data->tee))
> > -			return PTR_ERR(data->tee);
> > -	}
> > -
> >  	return 0;
> >  }
> >  
> > @@ -545,13 +537,16 @@ struct image_data *bootm_boot_prep(const struct bootm_data *bootm_data)
> >  		return ERR_PTR(-ENOENT);
> >  	}
> >  
> > +	if (nonempty(globalvar_get("bootm.tee"))) {
> > +		pr_err("Late-loaded tee is insecure and no longer supported\n");
> > +		return ERR_PTR(-ENOSYS);
> > +	}
> > +
> >  	data = xzalloc(sizeof(*data));
> >  
> >  	bootm_image_name_and_part(bootm_data->os_file, &data->os_file, &data->os_part);
> >  	bootm_image_name_and_part(bootm_data->oftree_file, &data->oftree_file, &data->oftree_part);
> >  	bootm_image_name_and_part(bootm_data->initrd_file, &data->initrd_file, &data->initrd_part);
> > -	if (bootm_data->tee_file)
> > -		data->tee_file = xstrdup(bootm_data->tee_file);
> >  	data->verbose = bootm_data->verbose;
> >  	data->verify = bootm_data->verify;
> >  	data->force = bootm_data->force;
> > @@ -581,7 +576,6 @@ struct image_data *bootm_boot_prep(const struct bootm_data *bootm_data)
> >  		 */
> >  		data->oftree_file = NULL;
> >  		data->initrd_file = NULL;
> > -		data->tee_file = NULL;
> >  		if (data->image_type != filetype_fit) {
> >  			pr_err("Signed boot and image is no FIT image, aborting\n");
> >  			ret = -EINVAL;
> > @@ -803,11 +797,9 @@ void bootm_boot_cleanup(struct image_data *data)
> >  		of_del_reserve_entry(data->initrd_res->start, data->initrd_res->end);
> >  	release_sdram_region(data->initrd_res);
> >  	release_sdram_region(data->oftree_res);
> > -	release_sdram_region(data->tee_res);
> >  	loadable_release(&data->oftree);
> >  	loadable_release(&data->initrd);
> >  	loadable_release(&data->os);
> > -	loadable_release(&data->tee);
> >  	if (data->of_root_node)
> >  		of_delete_node(data->of_root_node);
> >  
> > @@ -816,7 +808,6 @@ void bootm_boot_cleanup(struct image_data *data)
> >  	free(data->os_file);
> >  	free(data->oftree_file);
> >  	free(data->initrd_file);
> > -	free(data->tee_file);
> >  	free(data);
> >  }
> >  
> > @@ -921,7 +912,6 @@ BAREBOX_MAGICVAR(global.bootm.image.loadaddr, "bootm default boot image loadaddr
> >  BAREBOX_MAGICVAR(global.bootm.initrd, "bootm default initrd");
> >  BAREBOX_MAGICVAR(global.bootm.initrd.loadaddr, "bootm default initrd loadaddr");
> >  BAREBOX_MAGICVAR(global.bootm.oftree, "bootm default oftree");
> > -BAREBOX_MAGICVAR(global.bootm.tee, "bootm default tee image");
> >  BAREBOX_MAGICVAR(global.bootm.dryrun, "bootm default dryrun level");
> >  BAREBOX_MAGICVAR(global.bootm.verify, "bootm default verify level");
> >  #ifdef CONFIG_EFI_LOADER
> > diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig
> > index fcaca29a5df7..73e77d0559c4 100644
> > --- a/drivers/tee/optee/Kconfig
> > +++ b/drivers/tee/optee/Kconfig
> > @@ -18,7 +18,7 @@ config OPTEE
> >  	  For more information see: https://www.op-tee.org
> >  
> >  	  This driver doesn't actually load OP-TEE. For that see
> > -	  CONFIG_BOOTM_OPTEE and PBL_OPTEE.
> > +	  CONFIG_PBL_OPTEE.
> >  
> >  	  If unsure, say n here.
> >  
> > diff --git a/include/bootm.h b/include/bootm.h
> > index 1a556e1e95b5..946713971eb5 100644
> > --- a/include/bootm.h
> > +++ b/include/bootm.h
> > @@ -24,7 +24,6 @@ struct bootm_data {
> >  	const char *os_file;
> >  	const char *initrd_file;
> >  	const char *oftree_file;
> > -	const char *tee_file;
> >  	const char *root_dev;
> >  	const char *root_param;
> >  	int verbose;
> > @@ -130,11 +129,6 @@ struct image_data {
> >  	 * it.
> >  	 */
> >  	void *os_header;
> > -	char *tee_file;
> > -	struct resource *tee_res;
> > -
> > -	/* Future default case: A generic loadable object */
> > -	struct loadable *tee;
> >  
> >  	/* Type of OS image, e.g. filetype_fit or the same as kernel_type */
> >  	enum filetype image_type;
> > diff --git a/include/loadable.h b/include/loadable.h
> > index 79b1579be291..9cc89ea4581c 100644
> > --- a/include/loadable.h
> > +++ b/include/loadable.h
> > @@ -17,14 +17,12 @@ struct loadable;
> >   * @LOADABLE_KERNEL: kernel image
> >   * @LOADABLE_INITRD: initial ramdisk
> >   * @LOADABLE_FDT: flattened device tree
> > - * @LOADABLE_TEE: trusted execution environment
> >   */
> >  enum loadable_type {
> >  	LOADABLE_UNSPECIFIED,
> >  	LOADABLE_KERNEL,
> >  	LOADABLE_INITRD,
> >  	LOADABLE_FDT,
> > -	LOADABLE_TEE,
> >  };
> >  
> >  /**
> > @@ -130,7 +128,7 @@ struct loadable_ops {
> >  /**
> >   * struct loadable - lazy-loadable boot component
> >   * @name: descriptive name for debugging
> > - * @type: type of component (kernel, initrd, fdt, tee)
> > + * @type: type of component (kernel, initrd, fdt)
> >   * @ops: operations for this loadable
> >   * @priv: format-specific private data
> >   * @info: cached metadata populated by get_info()
> > @@ -139,7 +137,7 @@ struct loadable_ops {
> >   * @chained_loadables: list of additional loadables chained to this one
> >   * @list: list node for chained_loadables
> >   *
> > - * Represents something that can be loaded to RAM (kernel, initrd, fdt, tee).
> > + * Represents something that can be loaded to RAM (kernel, initrd, fdt).
> >   * Metadata can be queried without loading. Actual loading happens on extract
> >   * or via mmap.
> >   */
> > diff --git a/lib/loadable.c b/lib/loadable.c
> > index 65121a7dbf90..8c016c125d87 100644
> > --- a/lib/loadable.c
> > +++ b/lib/loadable.c
> > @@ -31,8 +31,6 @@ const char *loadable_type_tostr(enum loadable_type type)
> >  		return "initrd";
> >  	case LOADABLE_FDT:
> >  		return "fdt";
> > -	case LOADABLE_TEE:
> > -		return "tee";
> >  	default:
> >  		return NULL;
> >  	}
> > diff --git a/security/Kconfig b/security/Kconfig
> > index b14803348b68..cb5cc2b92bc2 100644
> > --- a/security/Kconfig
> > +++ b/security/Kconfig
> > @@ -156,24 +156,6 @@ config OPTEE_SHM_SIZE
> >  	  mode supported by barebox anyway, but support needs to be enabled
> >  	  in OP-TEE at compile-time.
> >  
> > -config BOOTM_OPTEE
> > -	bool
> > -	prompt "support booting OP-TEE"
> > -	depends on BOOTM && ARM32
> > -	select HAVE_OPTEE
> > -	select HAS_INSECURE_DEFAULTS
> > -	help
> > -	  OP-TEE is a trusted execution environment (TEE). With this option
> > -	  enabled barebox supports starting optee_os as part of the bootm command.
> > -	  Instead of the kernel bootm starts the optee_os binary which then starts
> > -	  the kernel in nonsecure mode. Pass the optee_os binary with the -t option
> > -	  or in the global.bootm.tee variable.
> > -
> > -	  This mode of late loading OP-TEE just before the kernel is deprecated
> > -	  in favor of early loading OP-TEE in the PBL (CONFIG_PBL_OPTEE).
> > -	  Early-loading greatly reduces the attack surface and is the only mode
> > -	  supported outside of ARMv7.
> > -
> >  config PBL_OPTEE
> >  	bool "Enable OP-TEE early start"
> >  	depends on ARM
> 
> -- 
> Pengutronix e.K.                  |                             |
> Steuerwalder Str. 21              | http://www.pengutronix.de/  |
> 31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
> Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |
> 
> 
> 

-- 
#gernperDu 
#CallMeByMyFirstName

Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |