OP-TEE StandAloneMM EFI variable service for Arm TrustZone
A bridge that lets Arm embedded systems store UEFI variables securely by routing them through OP-TEE's StandAloneMM service into eMMC RPMB storage, instead of using a traditional SPI flash variable store. It is used on small Arm TrustZone-based devices that pair Linux or U-Boot with OP-TEE, and was introduced in late 2023.
recommendation
Worth keeping but documenting its niche, because it serves a specific Arm embedded use case rather than mainstream PCs. On Arm TrustZone systems running OP-TEE, it provides EFI variable storage backed by eMMC RPMB through a StandAloneMM secure-world service, and upstream activity through 2025 and into 2026 shows it is actively maintained with no removal discussion.
repository signals
sources
- spinics.net
Introduction patch describes this as a TEE-based EFI runtime variable service driver for small embedded devices, using OP-TEE plus StandaloneMM and eMMC RPMB-backed storage.
- spinics.net
August 2025 cover letter reports a critical fix plus cleanups for the EFI StMM driver, indicating active maintenance rather than abandonment.
- spinics.net
A February 15, 2026 patch updates this driver again, showing continued upstream attention and no obvious removal trajectory.
- optee.readthedocs.io
Current OP-TEE documentation includes a StandAloneMM setup path for Arm platforms, with EFI variables stored in eMMC RPMB and Linux/U-Boot integration, showing the use case remains current.
- optee.readthedocs.io
OP-TEE is current software for Linux on Arm TrustZone systems, supporting the broader platform family this driver depends on.
codex reasoning notes (technical)
Local `exec_command` inspection showed `tee_stmm_efi.c` is a real kernel module/TEE client driver that overrides EFI variable operations, not a helper-only directory. Local `git log` via `exec_command` showed introduction on 2023-12-11 and substantive touches on 2025-08-26 and 2026-02-18. Web search found active mailing-list traffic on Spinics mirrors for 2025-2026 fixes/cleanups and no removal discussion. Web search also found current OP-TEE StandAloneMM docs describing active Arm embedded deployments using RPMB-backed EFI variables. Conclusion: keep, but annotate as a niche Arm secure-firmware path with low deployment volume rather than a broadly deployed PC-class EFI driver.