[PATCH 3/3] ARM: i.MX6: load optee in PBL before barebox proper

[Sascha Hauer]

On Mon, Dec 08, 2025 at 10:28:40AM +0100, Fabian Pflug wrote:
> This patch uses the space in the scratch memory to hand over to OP-TEE
> for device-tree overlays. If OP-TEE is configured with CFG_DT_ADDR=,
> then it will write its devicetree-overlay into the address and it will
> be picked up and applied by barebox.
> 
> This allows for generic OP-TEE loading for i.MX6 devices without changes
> to the board or lowlevel code.
> 
> Signed-off-by: Fabian Pflug <f.pflug at pengutronix.de>
> ---
>  arch/arm/mach-imx/esdctl.c | 49 +++++++++++++++++++++++++++++++++++++++++++---
>  common/Kconfig             |  1 +
>  firmware/Kconfig           |  8 ++++++++
>  firmware/Makefile          |  1 +
>  include/tee/optee.h        |  9 ++++++++-
>  5 files changed, 64 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/arm/mach-imx/esdctl.c b/arch/arm/mach-imx/esdctl.c
> index b9393fba4a..2434844c96 100644
> --- a/arch/arm/mach-imx/esdctl.c
> +++ b/arch/arm/mach-imx/esdctl.c
> @@ -6,6 +6,7 @@
>  #include <common.h>
>  #include <io.h>
>  #include <errno.h>
> +#include <firmware.h>
>  #include <linux/sizes.h>
>  #include <init.h>
>  #include <of.h>
> @@ -30,6 +31,7 @@
>  #include <mach/imx/imx7-regs.h>
>  #include <mach/imx/imx9-regs.h>
>  #include <mach/imx/scratch.h>
> +#include <mach/imx/tzasc.h>
>  #include <tee/optee.h>
>  
>  struct imx_esdctl_data {
> @@ -976,18 +978,59 @@ void __noreturn imx53_barebox_entry(void *boarddata)
>  static void __noreturn
>  imx6_barebox_entry(unsigned long membase, void *boarddata)
>  {
> -	barebox_arm_entry(membase,
> -			  imx6_mmdc_sdram_size(IOMEM(MX6_MMDC_P0_BASE_ADDR)),
> -			  boarddata);
> +	ulong memsize = imx6_mmdc_sdram_size(IOMEM(MX6_MMDC_P0_BASE_ADDR));
> +
> +	if (IS_ENABLED(CONFIG_FIRMWARE_IMX6_OPTEE) &&
> +	    IS_ENABLED(CONFIG_PBL_OPTEE) && imx6_can_access_tzasc()) {
> +		void *fdto;
> +		unsigned int fdto_size;
> +		int tee_size;
> +		void *tee;
> +
> +		get_builtin_firmware(imx6_optee_bin, &tee, &tee_size);
> +
> +		ulong endmem = arm_mem_barebox_image_end(membase + memsize);
> +		imx_init_scratch_space(endmem, 1);
> +		imx_scratch_get_optee_fdto(&fdto, &fdto_size);
> +		if (!fdto_size) {
> +			pr_warn("No space configured for OP-TEE devicetree\n");
> +			fdto = NULL;
> +		}
> +
> +		start_optee_early(fdto, tee);
> +		if (fdto_size)
> +			handoff_data_add(HANDOFF_DATA_BL32_DT_OVL, fdto,
> +					 fdto_size);
> +	}
> +
> +	barebox_arm_entry(membase, memsize, boarddata);
>  }
>  
>  void __noreturn imx6q_barebox_entry(void *boarddata)
>  {
> +	if (IS_ENABLED(CONFIG_FIRMWARE_IMX6_OPTEE) &&
> +	    IS_ENABLED(CONFIG_PBL_OPTEE) && imx6_can_access_tzasc()) {
> +		if (imx6q_tzc380_is_bypassed())
> +			panic("TZC380 is bypassed, abort OP-TEE loading\n");
> +
> +		/* Add early non-secure TZASC region1 to pass DTO */
> +		imx6q_tzc380_early_ns_region1();
> +	}
> +
>  	imx6_barebox_entry(MX6_MMDC_PORT01_BASE_ADDR, boarddata);
>  }
>  
>  void __noreturn imx6ul_barebox_entry(void *boarddata)
>  {
> +	if (IS_ENABLED(CONFIG_FIRMWARE_IMX6_OPTEE) &&
> +	    IS_ENABLED(CONFIG_PBL_OPTEE) && imx6_can_access_tzasc()) {
> +		if (imx6ul_tzc380_is_bypassed())
> +			panic("TZC380 is bypassed, abort OP-TEE loading\n");
> +
> +		/* Add early non-secure TZASC region1 to pass DTO */
> +		imx6ul_tzc380_early_ns_region1();
> +	}
> +
>  	imx6_barebox_entry(MX6_MMDC_PORT0_BASE_ADDR, boarddata);
>  }
>  
> diff --git a/common/Kconfig b/common/Kconfig
> index c42dc88ccf..20012cdc2c 100644
> --- a/common/Kconfig
> +++ b/common/Kconfig
> @@ -322,6 +322,7 @@ config SCRATCH_FDTO_SIZE
>  	hex
>  	default 0x0
>  	default 0x4000 if PBL_EARLY_FDT_LOAD
> +	default 0x4000 if FIRMWARE_IMX6_OPTEE
>  	prompt "Scratch FDTO size"
>  	help
>  	  The size of possible FDT overlay areas used by BL3x binaries to store
> diff --git a/firmware/Kconfig b/firmware/Kconfig
> index a97a1e0dd3..3e4245989c 100644
> --- a/firmware/Kconfig
> +++ b/firmware/Kconfig
> @@ -49,6 +49,14 @@ config FIRMWARE_IMX93_ATF
>  config FIRMWARE_AGILEX5_ATF
>  	bool
>  
> +config FIRMWARE_IMX6_OPTEE
> +	bool "install OP-TEE on i.MX6 boards"
> +	depends on PBL_OPTEE
> +	help
> +	  This enables OP-TEE loading and starting on i.MX6. Place the OP-TEE binary
> +	  in CONFIG_EXTRA_FIRMWARE_DIR/imx6-optee.bin. If this is enabled, then
> +	  the OP-TEE will automagically be loaded during boot.

automatically please.

> -int start_optee_early(void* fdt, void* tee);
> +int start_optee_early(void *fdt, void *tee);
>  int imx6q_start_optee_early(void *fdt, void *tee, void *data_location,
>  			    unsigned int data_location_size);
>  int imx6ul_start_optee_early(void *fdt, void *tee, void *data_location,
>  			     unsigned int data_location_size);
>  
> +#else
> +
> +static inline int start_optee_early(void *fdt, void *tee)
> +{
> +	return -ENOSYS;
> +}

Is this needed?

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |