1.27. OP-TEE

barebox has support for loading and communicating with the Open Portable Trusted Execution Environment (OP-TEE).

1.27.1. Loading OP-TEE

barebox can start OP-TEE either during lowlevel board initialization in the prebootloader or prior to starting the linux kernel.

1.27.1.1. During the PBL

To start OP-TEE during the lowlevel initialization of your board in the PBL, enable the CONFIG_PBL_OPTEE configuration variable. Your board should then call the function start_optee_early(void* tee, void* fdt) with a valid tee and FDT. If you’re running on an i.MX6 platform your board code should call imx6q_start_optee_early() or imx6ul_start_optee_early() instead since it validates that the TZASC not bypassed and is configured as expected by OP-TEE.

Ensure that your OP-TEE is compiled with CFG_NS_ENTRY_ADDR unset, otherwise OP-TEE will not correctly return to barebox after startup. Since OP-TEE in the default configuration also modifies the device tree, don’t pass the barebox internal device tree, instead copy it into a different memory location and pass it to OP-TEE afterwards. The modified device tree can then be passed to the main barebox start function.

Note

Modification of the device tree usually makes it bigger. Some spare space must be left after the end of the device tree to accommodate this.

1.27.1.2. Before Linux start

Warning

Late loading of OP-TEE is deprecated, greatly increases the attack surface and is only supported on 32-bit ARM systems. Systems should prefer early loading OP-TEE whenever possible.

Enable the CONFIG_BOOTM_OPTEE configuration variable and configure the CONFIG_OPTEE_SIZE variable. This will reserve a memory area at the end of memory for OP-TEE to run, usually Barebox would relocate itself there. To load OP-TEE before the kernel is started, configure the global bootm.tee variable to point to a valid OPTEE v1 binary.

1.27.2. Communication with OP-TEE

Controlled by the CONFIG_OPTEE option, barebox has support for communicating with OP-TEE via secure monitor calls and dynamic shared memory. This is possible independently of whether OP-TEE was loaded by barebox or not.

The primary use cases currently is SCMI-over-OP-TEE, which is required on the STM32MP13.