Re: [PATCH] bootm: remove previously deprecated CONFIG_BOOTM_OPTEE

Hi,

On 8/5/26 4:48 PM, Ahmad Fatoum wrote:
> Early loading of OP-TEE for 32-bit platforms was added in 2020 shortly
> after initial (late) loading support was added in 2019.
> 
> CONFIG_BOOTM_OPTEE (practically OP-TEE in a FIT image alongside the
> kernel) has been documented as deprecated since 2025 as it greatly
> increases the trusted computing base by running all of barebox in
> secure monitor mode as opposed to only the prebootloader.
> 
> Additionally, a `tee =' key in the FIT is a barebox invention and the
> spec conforming way would be to reference the tee in the loadables
> property of a configuration.
> 
> For all these reasons, let's finally remove late loading.
> 
> Signed-off-by: Ahmad Fatoum <[email protected]>

Any objections?

Cheers,
Ahmad

> ---
>  .../migration-guides/migration-master.rst     | 13 ++++
>  Documentation/user/optee.rst                  | 12 ++--
>  Documentation/user/security.rst               |  3 -
>  arch/arm/cpu/start.c                          |  3 -
>  arch/arm/include/asm/armlinux.h               |  2 +-
>  arch/arm/lib32/Makefile                       |  1 -
>  arch/arm/lib32/armlinux.c                     | 10 +--
>  arch/arm/lib32/bootm.c                        | 64 +------------------
>  arch/arm/lib32/bootu.c                        |  2 +-
>  arch/arm/lib32/bootz.c                        |  2 +-
>  arch/arm/lib32/start-kernel-optee.S           | 16 -----
>  commands/bootm.c                              | 11 +---
>  common/bootm-android-image.c                  |  1 -
>  common/bootm-fit.c                            | 31 ++-------
>  common/bootm.c                                | 20 ++----
>  drivers/tee/optee/Kconfig                     |  2 +-
>  include/bootm.h                               |  6 --
>  include/loadable.h                            |  6 +-
>  lib/loadable.c                                |  2 -
>  security/Kconfig                              | 18 ------
>  20 files changed, 38 insertions(+), 187 deletions(-)
>  delete mode 100644 arch/arm/lib32/start-kernel-optee.S
> 
> diff --git a/Documentation/migration-guides/migration-master.rst b/Documentation/migration-guides/migration-master.rst
> index e28a608e53e9..68f0ef65756b 100644
> --- a/Documentation/migration-guides/migration-master.rst
> +++ b/Documentation/migration-guides/migration-master.rst
> @@ -17,3 +17,16 @@ ARCH=arm64
>  Use of ``ARCH=arm`` for 64-bit ARM builds is deprecated and now emits
>  a warning. Users should change build scripts to use ``ARCH=arm64``
>  instead when targetting ARMv8.
> +
> +Removal of deprecated CONFIG_BOOTM_OPTEE
> +----------------------------------------
> +
> +The support for late loading of OP-TEE had been deprecated and ultimately
> +removed as it greatly increased the attack surface and was only supported
> +on 32-bit ARM systems.
> +
> +OP-TEE loading is now only supported
> +:ref:`in the prebootloader <optee_early_loading>`.
> +
> +For i.MX6 boards, this can be enabled by enabling
> +``CONFIG_FIRMWARE_IMX6_OPTEE``.
> diff --git a/Documentation/user/optee.rst b/Documentation/user/optee.rst
> index 88e651ddec57..975dcdc3dbac 100644
> --- a/Documentation/user/optee.rst
> +++ b/Documentation/user/optee.rst
> @@ -39,15 +39,11 @@ main barebox start function.
>  Before Linux start
>  ^^^^^^^^^^^^^^^^^^
>  
> -.. warning:: Late loading of OP-TEE is deprecated, greatly increases the
> -   attack surface and is only supported on 32-bit ARM systems.
> -   Systems should prefer early loading OP-TEE whenever possible.
> +The support for late loading of OP-TEE had been deprecated and ultimately
> +removed as it greatly increased the attack surface and was only supported
> +on 32-bit ARM systems.
> +OP-TEE loading is now only supported :ref:`in the prebootloader <optee_early_loading>`.
>  
> -Enable the `CONFIG_BOOTM_OPTEE` configuration variable and configure the
> -`CONFIG_OPTEE_SIZE` variable. This will reserve a memory area at the end
> -of memory for OP-TEE to run, usually Barebox would relocate itself there. To
> -load OP-TEE before the kernel is started, configure the global ``bootm.tee``
> -variable to point to a valid OPTEE v1 binary.
>  
>  Communication with OP-TEE
>  -------------------------
> diff --git a/Documentation/user/security.rst b/Documentation/user/security.rst
> index 94184ab8e893..f8cd6bd090f2 100644
> --- a/Documentation/user/security.rst
> +++ b/Documentation/user/security.rst
> @@ -69,9 +69,6 @@ Firmware) should happen as early as possible, i.e., within the barebox
>  barebox will run with elevated permission, which greatly increases the attack
>  surface.
>  
> -In concrete terms, the deprecated ``CONFIG_BOOTM_OPTEE`` option should be
> -disabled in favor of :ref:`loading OP-TEE early <optee_early_loading>`.
> -
>  Ensuring the kernel is verified
>  -------------------------------
>  
> diff --git a/arch/arm/cpu/start.c b/arch/arm/cpu/start.c
> index 6a9941275c12..f9f380444f81 100644
> --- a/arch/arm/cpu/start.c
> +++ b/arch/arm/cpu/start.c
> @@ -192,9 +192,6 @@ __noreturn void barebox_non_pbl_start(unsigned long membase,
>  
>  	handoff_data_set(hd);
>  
> -	if (IS_ENABLED(CONFIG_BOOTM_OPTEE))
> -		of_add_reserve_entry(endmem - OPTEE_SIZE, endmem - 1);
> -
>  	pr_debug("starting barebox...\n");
>  
>  	start_barebox();
> diff --git a/arch/arm/include/asm/armlinux.h b/arch/arm/include/asm/armlinux.h
> index 871664824643..83813a5dce97 100644
> --- a/arch/arm/include/asm/armlinux.h
> +++ b/arch/arm/include/asm/armlinux.h
> @@ -63,6 +63,6 @@ struct image_data;
>  
>  void start_linux(void *adr, int swap, unsigned long initrd_address,
>  		 unsigned long initrd_size, void *oftree,
> -		 enum arm_security_state, void *optee);
> +		 enum arm_security_state);
>  
>  #endif /* __ARCH_ARMLINUX_H */
> diff --git a/arch/arm/lib32/Makefile b/arch/arm/lib32/Makefile
> index 67c4f16f76ad..5598ab386052 100644
> --- a/arch/arm/lib32/Makefile
> +++ b/arch/arm/lib32/Makefile
> @@ -3,7 +3,6 @@
>  obj-$(CONFIG_ARM_LINUX)	+= armlinux.o
>  obj-$(CONFIG_CMD_BOOTZ)	+= bootz.o
>  obj-$(CONFIG_BOOTM)     += bootm.o
> -obj-$(CONFIG_BOOTM_OPTEE) += start-kernel-optee.o
>  obj-$(CONFIG_CMD_BOOTU) += bootu.o
>  obj-$(CONFIG_BOOT_ATAGS) += atags.o
>  obj-y	+= div0.o
> diff --git a/arch/arm/lib32/armlinux.c b/arch/arm/lib32/armlinux.c
> index 6890d9cb6fda..8bb3c5f9c273 100644
> --- a/arch/arm/lib32/armlinux.c
> +++ b/arch/arm/lib32/armlinux.c
> @@ -28,11 +28,9 @@
>  #include <asm/secure.h>
>  #include <asm/boot.h>
>  
> -void start_kernel_optee(void *optee, void *kernel, void *oftree);
> -
>  void start_linux(void *adr, int swap, unsigned long initrd_address,
>  		 unsigned long initrd_size, void *oftree,
> -		 enum arm_security_state state, void *optee)
> +		 enum arm_security_state state)
>  {
>  	phys_addr_t params = 0;
>  	unsigned architecture;
> @@ -79,9 +77,5 @@ void start_linux(void *adr, int swap, unsigned long initrd_address,
>  		__asm__ __volatile__("mcr p15, 0, %0, c1, c0" :: "r" (reg));
>  	}
>  
> -	if (optee && IS_ENABLED(CONFIG_BOOTM_OPTEE)) {
> -		start_kernel_optee(optee, adr, oftree);
> -	} else {
> -		__jump_to_linux(adr, architecture, params);
> -	}
> +	__jump_to_linux(adr, architecture, params);
>  }
> diff --git a/arch/arm/lib32/bootm.c b/arch/arm/lib32/bootm.c
> index e94bb979eff9..e2a80ada788b 100644
> --- a/arch/arm/lib32/bootm.c
> +++ b/arch/arm/lib32/bootm.c
> @@ -21,7 +21,6 @@
>  #include <binfmt.h>
>  #include <restart.h>
>  #include <globalvar.h>
> -#include <tee/optee.h>
>  #include <asm/byteorder.h>
>  #include <asm/setup.h>
>  #include <asm/barebox-arm.h>
> @@ -149,54 +148,6 @@ static int get_kernel_addresses(size_t image_size,
>  	return 0;
>  }
>  
> -static int optee_verify_header_request_region(struct image_data *data, struct optee_header *hdr)
> -{
> -	int ret;
> -
> -	ret = optee_verify_header(hdr);
> -	if (ret < 0) {
> -		pr_err("Could not verify header: %pe", ERR_PTR(ret));
> -		return ret;
> -	}
> -
> -	data->tee_res = request_sdram_region("TEE", hdr->init_load_addr_lo, hdr->init_size,
> -					     MEMTYPE_RESERVED, MEMATTRS_RW_DEVICE);
> -	if (!data->tee_res)
> -		return -EINVAL;
> -
> -	return 0;
> -}
> -
> -static int bootm_load_tee(struct image_data *data)
> -{
> -	int ret;
> -	struct optee_header hdr;
> -
> -	if (!data->tee)
> -		return 0;
> -
> -	ret = loadable_extract_into_buf(data->tee, &hdr, sizeof(hdr), 0,
> -					LOADABLE_EXTRACT_PARTIAL);
> -	if (ret < 0)
> -		return ret;
> -
> -	ret = optee_verify_header_request_region(data, &hdr);
> -	if (ret < 0)
> -		return ret;
> -
> -	ret = loadable_extract_into_buf(data->tee, (void *)data->tee_res->start,
> -					hdr.init_size, sizeof(hdr), 0);
> -	if (ret < 0) {
> -		release_region(data->tee_res);
> -		return ret;
> -	}
> -
> -	printf("Loaded TEE image to %pa, size 0x%08x\n",
> -	       (void *)data->tee_res->start, hdr.init_size);
> -
> -	return 0;
> -}
> -
>  static int __do_bootm_linux(struct image_data *data, unsigned long free_mem,
>  			    int swap, void *fdt)
>  {
> @@ -204,7 +155,6 @@ static int __do_bootm_linux(struct image_data *data, unsigned long free_mem,
>  	unsigned long initrd_start = 0, initrd_size = 0, initrd_end = 0;
>  	const struct resource *initrd_res, *sdram;
>  	struct resource gap;
> -	void *tee;
>  	enum arm_security_state state = bootm_arm_security_state();
>  	void *fdt_load_address = NULL;
>  	int ret;
> @@ -259,13 +209,6 @@ static int __do_bootm_linux(struct image_data *data, unsigned long free_mem,
>  			return PTR_ERR(fdt_res);
>  	}
>  
> -	if (IS_ENABLED(CONFIG_BOOTM_OPTEE)) {
> -		ret = bootm_load_tee(data);
> -		if (ret)
> -			return ret;
> -	}
> -
> -
>  	if (bootm_verbose(data)) {
>  		printf("\nStarting kernel at 0x%08lx", kernel);
>  		if (initrd_size)
> @@ -291,13 +234,8 @@ static int __do_bootm_linux(struct image_data *data, unsigned long free_mem,
>  	if (ret)
>  		return ret;
>  
> -	if (data->tee_res)
> -		tee = (void *)data->tee_res->start;
> -	else
> -		tee = NULL;
> -
>  	start_linux((void *)kernel, swap, initrd_start, initrd_size,
> -		    fdt_load_address, state, tee);
> +		    fdt_load_address, state);
>  
>  	restart_machine(0);
>  
> diff --git a/arch/arm/lib32/bootu.c b/arch/arm/lib32/bootu.c
> index 4b0f495aea5f..f7b6ccc8c651 100644
> --- a/arch/arm/lib32/bootu.c
> +++ b/arch/arm/lib32/bootu.c
> @@ -36,7 +36,7 @@ static int do_bootu(int argc, char *argv[])
>  	if (ret)
>  		return ret;
>  
> -	start_linux(kernel, 0, 0, 0, oftree, ARM_STATE_SECURE, NULL);
> +	start_linux(kernel, 0, 0, 0, oftree, ARM_STATE_SECURE);
>  
>  	return 1;
>  }
> diff --git a/arch/arm/lib32/bootz.c b/arch/arm/lib32/bootz.c
> index 5aa762b4912d..97607e43a645 100644
> --- a/arch/arm/lib32/bootz.c
> +++ b/arch/arm/lib32/bootz.c
> @@ -120,7 +120,7 @@ static int do_bootz(int argc, char *argv[])
>  	if (ret)
>  		return ret;
>  
> -	start_linux(zimage, swap, 0, 0, oftree, ARM_STATE_SECURE, NULL);
> +	start_linux(zimage, swap, 0, 0, oftree, ARM_STATE_SECURE);
>  
>  	return 0;
>  
> diff --git a/arch/arm/lib32/start-kernel-optee.S b/arch/arm/lib32/start-kernel-optee.S
> deleted file mode 100644
> index 261ab39ba7a3..000000000000
> --- a/arch/arm/lib32/start-kernel-optee.S
> +++ /dev/null
> @@ -1,16 +0,0 @@
> -/* SPDX-License-Identifier: GPL-2.0-only */
> -
> -#include <linux/linkage.h>
> -
> -ENTRY(start_kernel_optee)
> -	/*
> -	 * r0 = optee
> -	 * r1 = kernel
> -	 * r2 = oftree
> -	 */
> -	mov r4, r0
> -	mov r0, #0
> -	mov lr, r1
> -	mov r1, #0
> -	bx r4
> -ENDPROC(start_kernel_optee)
> diff --git a/commands/bootm.c b/commands/bootm.c
> index 24bce5ce6b64..9ff4b218fd1f 100644
> --- a/commands/bootm.c
> +++ b/commands/bootm.c
> @@ -28,7 +28,7 @@
>  #include <magicvar.h>
>  #include <asm-generic/memory_layout.h>
>  
> -#define BOOTM_OPTS_COMMON "sca:e:vo:fdt:"
> +#define BOOTM_OPTS_COMMON "sca:e:vo:fd"
>  
>  #ifdef CONFIG_BOOTM_INITRD
>  #define BOOTM_OPTS BOOTM_OPTS_COMMON "L:r:"
> @@ -88,9 +88,6 @@ static int do_bootm(int argc, char *argv[])
>  		case 'd':
>  			data.dryrun = 1;
>  			break;
> -		case 't':
> -			data.tee_file = optarg;
> -			break;
>  		default:
>  			return COMMAND_ERROR_USAGE;
>  		}
> @@ -129,9 +126,6 @@ BAREBOX_CMD_HELP_OPT ("-e OFFS\t","entry point to the image relative to start (0
>  #ifdef CONFIG_OFTREE
>  BAREBOX_CMD_HELP_OPT ("-o DTB\t","specify open firmware device tree")
>  #endif
> -#ifdef CONFIG_BOOTM_OPTEE
> -BAREBOX_CMD_HELP_OPT ("-t TEE\t","specify TEE image")
> -#endif
>  #ifdef CONFIG_BOOTM_VERBOSE
>  BAREBOX_CMD_HELP_OPT ("-v\t","verbose")
>  #endif
> @@ -150,9 +144,6 @@ BAREBOX_CMD_START(bootm)
>  #endif
>  #ifdef CONFIG_BOOTM_VERBOSE
>  					  "v"
> -#endif
> -#ifdef CONFIG_BOOTM_OPTEE
> -					  "t"
>  #endif
>  					  "] IMAGE")
>  	BAREBOX_CMD_GROUP(CMD_GRP_BOOT)
> diff --git a/common/bootm-android-image.c b/common/bootm-android-image.c
> index 6acc41c3dd66..f48c97741528 100644
> --- a/common/bootm-android-image.c
> +++ b/common/bootm-android-image.c
> @@ -54,7 +54,6 @@ static int do_bootm_aimage(struct image_data *img_data)
>  	struct bootm_data bootm_data = {
>  		.oftree_file = img_data->oftree_file,
>  		.initrd_file = img_data->initrd_file,
> -		.tee_file = img_data->tee_file,
>  		.verbose = img_data->verbose,
>  		.verify = img_data->verify,
>  		.force = img_data->force,
> diff --git a/common/bootm-fit.c b/common/bootm-fit.c
> index 995bd7181223..f7742b871785 100644
> --- a/common/bootm-fit.c
> +++ b/common/bootm-fit.c
> @@ -87,30 +87,6 @@ static bool loadable_from_fit_oftree(struct image_data *data,
>  	return true;
>  }
>  
> -/*
> - * loadable_from_fit_tee() - create tee loadable from FIT
> - * @data:		image data context
> - * @fit:		handle of FIT image
> - * @config:		config to look up kernel in
> - *
> - * This creates a loadable for the first trusted execution environment
> - * in the config.
> - *
> - * Return: true if a TEE exists or
> - *         false otherwise.
> - */
> -static bool loadable_from_fit_tee(struct image_data *data,
> -				struct fit_handle *fit,
> -				void *config)
> -{
> -	if (!fit_has_image(fit, config, "tee"))
> -		return false;
> -
> -	loadable_release(&data->tee);
> -	data->tee = loadable_from_fit(fit, config, "tee", 0, LOADABLE_TEE);
> -	return true;
> -}
> -
>  static bool bootm_fit_config_valid(struct fit_handle *fit,
>  				   struct device_node *config)
>  {
> @@ -164,6 +140,12 @@ int bootm_open_fit(struct image_data *data, bool override)
>  		goto err;
>  	}
>  
> +	if (fit_has_image(fit, fit_config, "tee")) {
> +		pr_err("Late-loaded tee is insecure and no longer supported\n");
> +		ret = -ENOSYS;
> +		goto err;
> +	}
> +
>  	loadable_from_fit_os(data, fit, fit_config);
>  	if (override)
>  		data->is_override.os = true;
> @@ -171,7 +153,6 @@ int bootm_open_fit(struct image_data *data, bool override)
>  		data->is_override.initrd = true;
>  	if (loadable_from_fit_oftree(data, fit, fit_config) && override)
>  		data->is_override.oftree = true;
> -	loadable_from_fit_tee(data, fit, fit_config);
>  
>  	data->kernel_type = bootm_fit_update_os_header(data);
>  
> diff --git a/common/bootm.c b/common/bootm.c
> index de1b87fe2072..27da1a590bf1 100644
> --- a/common/bootm.c
> +++ b/common/bootm.c
> @@ -95,7 +95,6 @@ void bootm_data_init_defaults(struct bootm_data *data)
>  	data->os_address = UIMAGE_SOME_ADDRESS;
>  	data->os_entry = UIMAGE_SOME_ADDRESS;
>  	data->oftree_file = getenv_nonempty("global.bootm.oftree");
> -	data->tee_file = getenv_nonempty("global.bootm.tee");
>  	data->os_file = getenv_nonempty("global.bootm.image");
>  	getenv_ul("global.bootm.image.loadaddr", &data->os_address);
>  	if (IS_ENABLED(CONFIG_BOOTM_INITRD)) {
> @@ -117,7 +116,6 @@ void bootm_data_init_defaults(struct bootm_data *data)
>  void bootm_data_restore_defaults(const struct bootm_data *data)
>  {
>  	globalvar_set("bootm.oftree", data->oftree_file);
> -	globalvar_set("bootm.tee", data->tee_file);
>  	globalvar_set("bootm.image", data->os_file);
>  	pr_setenv("global.bootm.image.loadaddr", "0x%lx", data->os_address);
>  	if (IS_ENABLED(CONFIG_BOOTM_INITRD)) {
> @@ -495,12 +493,6 @@ static int bootm_open_files(struct image_data *data)
>  			return ret;
>  	}
>  
> -	if (data->tee_file) {
> -		data->tee = loadable_from_file(data->tee_file, LOADABLE_TEE);
> -		if (IS_ERR(data->tee))
> -			return PTR_ERR(data->tee);
> -	}
> -
>  	return 0;
>  }
>  
> @@ -545,13 +537,16 @@ struct image_data *bootm_boot_prep(const struct bootm_data *bootm_data)
>  		return ERR_PTR(-ENOENT);
>  	}
>  
> +	if (nonempty(globalvar_get("bootm.tee"))) {
> +		pr_err("Late-loaded tee is insecure and no longer supported\n");
> +		return ERR_PTR(-ENOSYS);
> +	}
> +
>  	data = xzalloc(sizeof(*data));
>  
>  	bootm_image_name_and_part(bootm_data->os_file, &data->os_file, &data->os_part);
>  	bootm_image_name_and_part(bootm_data->oftree_file, &data->oftree_file, &data->oftree_part);
>  	bootm_image_name_and_part(bootm_data->initrd_file, &data->initrd_file, &data->initrd_part);
> -	if (bootm_data->tee_file)
> -		data->tee_file = xstrdup(bootm_data->tee_file);
>  	data->verbose = bootm_data->verbose;
>  	data->verify = bootm_data->verify;
>  	data->force = bootm_data->force;
> @@ -581,7 +576,6 @@ struct image_data *bootm_boot_prep(const struct bootm_data *bootm_data)
>  		 */
>  		data->oftree_file = NULL;
>  		data->initrd_file = NULL;
> -		data->tee_file = NULL;
>  		if (data->image_type != filetype_fit) {
>  			pr_err("Signed boot and image is no FIT image, aborting\n");
>  			ret = -EINVAL;
> @@ -803,11 +797,9 @@ void bootm_boot_cleanup(struct image_data *data)
>  		of_del_reserve_entry(data->initrd_res->start, data->initrd_res->end);
>  	release_sdram_region(data->initrd_res);
>  	release_sdram_region(data->oftree_res);
> -	release_sdram_region(data->tee_res);
>  	loadable_release(&data->oftree);
>  	loadable_release(&data->initrd);
>  	loadable_release(&data->os);
> -	loadable_release(&data->tee);
>  	if (data->of_root_node)
>  		of_delete_node(data->of_root_node);
>  
> @@ -816,7 +808,6 @@ void bootm_boot_cleanup(struct image_data *data)
>  	free(data->os_file);
>  	free(data->oftree_file);
>  	free(data->initrd_file);
> -	free(data->tee_file);
>  	free(data);
>  }
>  
> @@ -921,7 +912,6 @@ BAREBOX_MAGICVAR(global.bootm.image.loadaddr, "bootm default boot image loadaddr
>  BAREBOX_MAGICVAR(global.bootm.initrd, "bootm default initrd");
>  BAREBOX_MAGICVAR(global.bootm.initrd.loadaddr, "bootm default initrd loadaddr");
>  BAREBOX_MAGICVAR(global.bootm.oftree, "bootm default oftree");
> -BAREBOX_MAGICVAR(global.bootm.tee, "bootm default tee image");
>  BAREBOX_MAGICVAR(global.bootm.dryrun, "bootm default dryrun level");
>  BAREBOX_MAGICVAR(global.bootm.verify, "bootm default verify level");
>  #ifdef CONFIG_EFI_LOADER
> diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig
> index fcaca29a5df7..73e77d0559c4 100644
> --- a/drivers/tee/optee/Kconfig
> +++ b/drivers/tee/optee/Kconfig
> @@ -18,7 +18,7 @@ config OPTEE
>  	  For more information see: https://www.op-tee.org
>  
>  	  This driver doesn't actually load OP-TEE. For that see
> -	  CONFIG_BOOTM_OPTEE and PBL_OPTEE.
> +	  CONFIG_PBL_OPTEE.
>  
>  	  If unsure, say n here.
>  
> diff --git a/include/bootm.h b/include/bootm.h
> index 1a556e1e95b5..946713971eb5 100644
> --- a/include/bootm.h
> +++ b/include/bootm.h
> @@ -24,7 +24,6 @@ struct bootm_data {
>  	const char *os_file;
>  	const char *initrd_file;
>  	const char *oftree_file;
> -	const char *tee_file;
>  	const char *root_dev;
>  	const char *root_param;
>  	int verbose;
> @@ -130,11 +129,6 @@ struct image_data {
>  	 * it.
>  	 */
>  	void *os_header;
> -	char *tee_file;
> -	struct resource *tee_res;
> -
> -	/* Future default case: A generic loadable object */
> -	struct loadable *tee;
>  
>  	/* Type of OS image, e.g. filetype_fit or the same as kernel_type */
>  	enum filetype image_type;
> diff --git a/include/loadable.h b/include/loadable.h
> index 79b1579be291..9cc89ea4581c 100644
> --- a/include/loadable.h
> +++ b/include/loadable.h
> @@ -17,14 +17,12 @@ struct loadable;
>   * @LOADABLE_KERNEL: kernel image
>   * @LOADABLE_INITRD: initial ramdisk
>   * @LOADABLE_FDT: flattened device tree
> - * @LOADABLE_TEE: trusted execution environment
>   */
>  enum loadable_type {
>  	LOADABLE_UNSPECIFIED,
>  	LOADABLE_KERNEL,
>  	LOADABLE_INITRD,
>  	LOADABLE_FDT,
> -	LOADABLE_TEE,
>  };
>  
>  /**
> @@ -130,7 +128,7 @@ struct loadable_ops {
>  /**
>   * struct loadable - lazy-loadable boot component
>   * @name: descriptive name for debugging
> - * @type: type of component (kernel, initrd, fdt, tee)
> + * @type: type of component (kernel, initrd, fdt)
>   * @ops: operations for this loadable
>   * @priv: format-specific private data
>   * @info: cached metadata populated by get_info()
> @@ -139,7 +137,7 @@ struct loadable_ops {
>   * @chained_loadables: list of additional loadables chained to this one
>   * @list: list node for chained_loadables
>   *
> - * Represents something that can be loaded to RAM (kernel, initrd, fdt, tee).
> + * Represents something that can be loaded to RAM (kernel, initrd, fdt).
>   * Metadata can be queried without loading. Actual loading happens on extract
>   * or via mmap.
>   */
> diff --git a/lib/loadable.c b/lib/loadable.c
> index 65121a7dbf90..8c016c125d87 100644
> --- a/lib/loadable.c
> +++ b/lib/loadable.c
> @@ -31,8 +31,6 @@ const char *loadable_type_tostr(enum loadable_type type)
>  		return "initrd";
>  	case LOADABLE_FDT:
>  		return "fdt";
> -	case LOADABLE_TEE:
> -		return "tee";
>  	default:
>  		return NULL;
>  	}
> diff --git a/security/Kconfig b/security/Kconfig
> index b14803348b68..cb5cc2b92bc2 100644
> --- a/security/Kconfig
> +++ b/security/Kconfig
> @@ -156,24 +156,6 @@ config OPTEE_SHM_SIZE
>  	  mode supported by barebox anyway, but support needs to be enabled
>  	  in OP-TEE at compile-time.
>  
> -config BOOTM_OPTEE
> -	bool
> -	prompt "support booting OP-TEE"
> -	depends on BOOTM && ARM32
> -	select HAVE_OPTEE
> -	select HAS_INSECURE_DEFAULTS
> -	help
> -	  OP-TEE is a trusted execution environment (TEE). With this option
> -	  enabled barebox supports starting optee_os as part of the bootm command.
> -	  Instead of the kernel bootm starts the optee_os binary which then starts
> -	  the kernel in nonsecure mode. Pass the optee_os binary with the -t option
> -	  or in the global.bootm.tee variable.
> -
> -	  This mode of late loading OP-TEE just before the kernel is deprecated
> -	  in favor of early loading OP-TEE in the PBL (CONFIG_PBL_OPTEE).
> -	  Early-loading greatly reduces the attack surface and is the only mode
> -	  supported outside of ARMv7.
> -
>  config PBL_OPTEE
>  	bool "Enable OP-TEE early start"
>  	depends on ARM

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |