[PATCH v3 0/2] Add generic OP-TEE loading for i.MX6

[PATCH v3 0/2] Add generic OP-TEE loading for i.MX6

[Fabian Pflug]

Add a generic way to load OP-TEE from i.MX6 CPU's with config options
instead of board and lowlevel code.

If the generic i.MX6 OPTEE firmware gets enabled, it will be loaded
during boot, if the boardcode is using the imx6*_barebox_entry function
to start barebox instead of the generic barebox_arm_entry. These will
make sure, that OP-TEE is configured correctly and if the space for the
overlay is configured, they will also apply the devicetree overlay
provided by OP-TEE.

This is build upon the work of Marco for i.MX8M.

Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
---
Changes in v3:
- Update to newest version of dependend series.
- Link to dependen series: https://lore.barebox.org/barebox/20260211-v2025-09-0-topic-optee-of-handling-v3-0-dd83358ae624@pengutronix.de/
- Link to v2: https://lore.barebox.org/barebox/20251210-v2025-11-0-topic-optee-imx6-start-v2-0-5328020f7f80@pengutronix.de

Changes in v2:
- Dropped double substraction of OPTEE_SIZE from memory layout
  - from barebox-arm.h
  - from esdctl.c
- Automagically -> automatically
- Link to v1: https://lore.barebox.org/barebox/20251208-v2025-11-0-topic-optee-imx6-start-v1-0-0907128cdb8f@pengutronix.de

---
Fabian Pflug (2):
      ARM: i.MX: scratch: add generic init for imx
      ARM: i.MX6: load optee in PBL before barebox proper

 arch/arm/mach-imx/Kconfig   |  2 +-
 arch/arm/mach-imx/esdctl.c  | 48 ++++++++++++++++++++++++++++++++++++++++++---
 arch/arm/mach-imx/scratch.c | 18 ++++++++---------
 firmware/Kconfig            |  8 ++++++++
 firmware/Makefile           |  1 +
 include/mach/imx/scratch.h  |  1 +
 include/tee/optee.h         |  9 ++++++++-
 7 files changed, 73 insertions(+), 14 deletions(-)
---
base-commit: 7ca10210121e51856cdb99f85eb7f9801b29ddb2
change-id: 20251205-v2025-11-0-topic-optee-imx6-start-c6aec57d1a13
prerequisite-change-id: 20251110-v2025-09-0-topic-optee-of-handling-e9f51531c464:v3
prerequisite-patch-id: ed054cfa1582d9b49e2be540106cd90107bde600
prerequisite-patch-id: f916f25d3fe0064ce6455fff58a7ba45494188cd
prerequisite-patch-id: e9d8948b45921666d931253bfed355de5ac54c0f
prerequisite-patch-id: f25764d9a13e9631e71f9eb1cef9740b240d80e1
prerequisite-patch-id: 432b1305e98b2b406eb676f9e67b91589a8c28d8
prerequisite-patch-id: 0f6d0d30b46e432859ab824b7aec3aa3b60af3c3
prerequisite-patch-id: 3e1fa756532433c41f45ab0faaf16d0930e4c060
prerequisite-patch-id: a6b464e45b729c5050b6a666708f956af926d086
prerequisite-patch-id: 6f39185bb4f3693d764b309cca4b2745ddb8435e
prerequisite-patch-id: 03c1dad70551c5994ef195b774edf3e9a99d5502
prerequisite-patch-id: 12ab30ee2ed7982d37ef1ca5f6080c10bafce92a
prerequisite-patch-id: cce3aa8abd3e87aa7536cbf70a1a9a847322d590
prerequisite-patch-id: 528bc53ad2f52a81c42f0da0a6f77e7cd22b1b6f
prerequisite-patch-id: a999583ab806be64268eb52f47fbd8d5f4610d19

Best regards,
-- 
Fabian Pflug <f.pflug@pengutronix.de>

[PATCH v3 1/2] ARM: i.MX: scratch: add generic init for imx

[Fabian Pflug]

The zero_init, memset and scratch assignment were the same, and will be
the same for i.MX6. Why not make it generic?

Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
---
 arch/arm/mach-imx/Kconfig   |  2 +-
 arch/arm/mach-imx/scratch.c | 18 +++++++++---------
 include/mach/imx/scratch.h  |  1 +
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index ef181d3868..ce121e3434 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -60,7 +60,7 @@ config ARCH_IMX_ROMAPI
 
 config ARCH_IMX_SCRATCHMEM
 	def_bool y
-	depends on ARCH_IMX8M || ARCH_IMX9
+	depends on ARCH_IMX6 || ARCH_IMX8M || ARCH_IMX9
 
 config ARCH_IMX_TZASC
 	bool
diff --git a/arch/arm/mach-imx/scratch.c b/arch/arm/mach-imx/scratch.c
index fba4b41040..ccfc81a14d 100644
--- a/arch/arm/mach-imx/scratch.c
+++ b/arch/arm/mach-imx/scratch.c
@@ -32,25 +32,25 @@ static_assert(sizeof(struct imx_scratch_space) -
 
 static struct imx_scratch_space *scratch;
 
-void imx8m_init_scratch_space(int ddr_buswidth, bool zero_init)
+void imx_init_scratch_space(ulong endmem, bool zero_init)
 {
-	ulong endmem = MX8M_DDR_CSD1_BASE_ADDR +
-		imx8m_barebox_earlymem_size(ddr_buswidth);
-
 	scratch = (void *)arm_mem_scratch(endmem);
 
 	if (zero_init)
 		memset(scratch, 0, sizeof(*scratch));
 }
 
+void imx8m_init_scratch_space(int ddr_buswidth, bool zero_init)
+{
+	ulong endmem = MX8M_DDR_CSD1_BASE_ADDR +
+		imx8m_barebox_earlymem_size(ddr_buswidth);
+	imx_init_scratch_space(endmem, zero_init);
+}
+
 void imx93_init_scratch_space(bool zero_init)
 {
 	ulong endmem = MX9_DDR_CSD1_BASE_ADDR + imx9_ddrc_sdram_size();
-
-	scratch = (void *)arm_mem_scratch(endmem);
-
-	if (zero_init)
-		memset(scratch, 0, sizeof(*scratch));
+	imx_init_scratch_space(endmem, zero_init);
 }
 
 void imx8m_scratch_save_bootrom_log(const u32 *rom_log)
diff --git a/include/mach/imx/scratch.h b/include/mach/imx/scratch.h
index b74d19a560..3c302b3a34 100644
--- a/include/mach/imx/scratch.h
+++ b/include/mach/imx/scratch.h
@@ -3,6 +3,7 @@
 #ifndef __MACH_IMX_SCRATCH_H
 #define __MACH_IMX_SCRATCH_H
 
+void imx_init_scratch_space(ulong endmem, bool zero_init);
 void imx8m_init_scratch_space(int ddr_buswidth, bool zero_init);
 void imx93_init_scratch_space(bool zero_init);
 

-- 
2.47.3

[PATCH v3 2/2] ARM: i.MX6: load optee in PBL before barebox proper

[Fabian Pflug]

This patch uses the space in the scratch memory to hand over to OP-TEE
for device-tree overlays. If OP-TEE is configured with CFG_DT_ADDR=,
then it will write its devicetree-overlay into the address and it will
be picked up and applied by barebox.

This allows for generic OP-TEE loading for i.MX6 devices without changes
to the board or lowlevel code.

Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
---
 arch/arm/mach-imx/esdctl.c | 48 +++++++++++++++++++++++++++++++++++++++++++---
 firmware/Kconfig           |  8 ++++++++
 firmware/Makefile          |  1 +
 include/tee/optee.h        |  9 ++++++++-
 4 files changed, 62 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mach-imx/esdctl.c b/arch/arm/mach-imx/esdctl.c
index f8b8089cb0..b72382e98e 100644
--- a/arch/arm/mach-imx/esdctl.c
+++ b/arch/arm/mach-imx/esdctl.c
@@ -6,6 +6,7 @@
 #include <common.h>
 #include <io.h>
 #include <errno.h>
+#include <firmware.h>
 #include <linux/sizes.h>
 #include <init.h>
 #include <of.h>
@@ -30,6 +31,7 @@
 #include <mach/imx/imx7-regs.h>
 #include <mach/imx/imx9-regs.h>
 #include <mach/imx/scratch.h>
+#include <mach/imx/tzasc.h>
 #include <tee/optee.h>
 
 struct imx_esdctl_data {
@@ -1016,18 +1018,58 @@ void __noreturn imx53_barebox_entry(void *boarddata)
 static void __noreturn
 imx6_barebox_entry(unsigned long membase, void *boarddata)
 {
-	barebox_arm_entry(membase,
-			  imx6_mmdc_sdram_size(IOMEM(MX6_MMDC_P0_BASE_ADDR)),
-			  boarddata);
+	ulong memsize = imx6_mmdc_sdram_size(IOMEM(MX6_MMDC_P0_BASE_ADDR));
+
+	if (IS_ENABLED(CONFIG_FIRMWARE_IMX6_OPTEE) &&
+	    IS_ENABLED(CONFIG_PBL_OPTEE) && imx6_can_access_tzasc()) {
+		void *fdto;
+		unsigned int fdto_size;
+		int tee_size;
+		void *tee;
+
+		get_builtin_firmware(imx6_optee_bin, &tee, &tee_size);
+
+		imx_init_scratch_space(membase + memsize, 1);
+		fdto = imx_scratch_get_fdt(&fdto_size);
+		if (IS_ERR(fdto)) {
+			pr_warn("Failed to get FDT scratch mem.\n");
+			fdto = NULL;
+		} else if (IS_NULL(fdto))
+			pr_warn("No space configured for OP-TEE devicetree\n");
+
+		start_optee_early(fdto, tee);
+		if (!IS_ERR(fdto))
+			optee_handoff_overlay(fdto, fdto_size);
+	}
+
+	barebox_arm_entry(membase, memsize, boarddata);
 }
 
 void __noreturn imx6q_barebox_entry(void *boarddata)
 {
+	if (IS_ENABLED(CONFIG_FIRMWARE_IMX6_OPTEE) &&
+	    IS_ENABLED(CONFIG_PBL_OPTEE) && imx6_can_access_tzasc()) {
+		if (imx6q_tzc380_is_bypassed())
+			panic("TZC380 is bypassed, abort OP-TEE loading\n");
+
+		/* Add early non-secure TZASC region1 to pass DTO */
+		imx6q_tzc380_early_ns_region1();
+	}
+
 	imx6_barebox_entry(MX6_MMDC_PORT01_BASE_ADDR, boarddata);
 }
 
 void __noreturn imx6ul_barebox_entry(void *boarddata)
 {
+	if (IS_ENABLED(CONFIG_FIRMWARE_IMX6_OPTEE) &&
+	    IS_ENABLED(CONFIG_PBL_OPTEE) && imx6_can_access_tzasc()) {
+		if (imx6ul_tzc380_is_bypassed())
+			panic("TZC380 is bypassed, abort OP-TEE loading\n");
+
+		/* Add early non-secure TZASC region1 to pass DTO */
+		imx6ul_tzc380_early_ns_region1();
+	}
+
 	imx6_barebox_entry(MX6_MMDC_PORT0_BASE_ADDR, boarddata);
 }
 
diff --git a/firmware/Kconfig b/firmware/Kconfig
index 3aeba3fc35..81ad6b705b 100644
--- a/firmware/Kconfig
+++ b/firmware/Kconfig
@@ -49,6 +49,14 @@ config FIRMWARE_IMX93_ATF
 config FIRMWARE_AGILEX5_ATF
 	bool
 
+config FIRMWARE_IMX6_OPTEE
+	bool "install OP-TEE on i.MX6 boards"
+	depends on PBL_OPTEE
+	help
+	  This enables OP-TEE loading and starting on i.MX6. Place the OP-TEE binary
+	  in CONFIG_EXTRA_FIRMWARE_DIR/imx6-optee.bin. If this is enabled, then
+	  the OP-TEE will automatically be loaded during boot.
+
 config FIRMWARE_IMX8MM_OPTEE
 	bool "install OP-TEE on i.MX8MM boards"
 	depends on FIRMWARE_IMX8MM_ATF && PBL_OPTEE
diff --git a/firmware/Makefile b/firmware/Makefile
index 163055554d..fef7b837d1 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -22,6 +22,7 @@ pbl-firmware-$(CONFIG_FIRMWARE_IMX8MP_ATF) += imx8mp-bl31.bin$(if $(CONFIG_FIRMW
 pbl-firmware-$(CONFIG_FIRMWARE_IMX8MQ_ATF) += imx8mq-bl31.bin
 pbl-firmware-$(CONFIG_FIRMWARE_IMX93_ATF) += imx93-bl31.bin$(if $(CONFIG_FIRMWARE_IMX93_OPTEE),-optee,)
 pbl-firmware-$(CONFIG_FIRMWARE_AGILEX5_ATF) += agilex5-bl31.bin
+pbl-firmware-$(CONFIG_FIRMWARE_IMX6_OPTEE) += imx6-optee.bin
 fw-external-$(CONFIG_FIRMWARE_IMX8MM_OPTEE) += imx8mm-bl32.bin
 fw-external-$(CONFIG_FIRMWARE_IMX8MN_OPTEE) += imx8mn-bl32.bin
 fw-external-$(CONFIG_FIRMWARE_IMX8MP_OPTEE) += imx8mp-bl32.bin
diff --git a/include/tee/optee.h b/include/tee/optee.h
index 45e042cbcc..535811278d 100644
--- a/include/tee/optee.h
+++ b/include/tee/optee.h
@@ -69,12 +69,19 @@ static inline bool optee_overlay_registered(void)
 
 #ifdef __PBL__
 
-int start_optee_early(void* fdt, void* tee);
+int start_optee_early(void *fdt, void *tee);
 int imx6q_start_optee_early(void *fdt, void *tee, void *data_location,
 			    unsigned int data_location_size);
 int imx6ul_start_optee_early(void *fdt, void *tee, void *data_location,
 			     unsigned int data_location_size);
 
+#else
+
+static inline int start_optee_early(void *fdt, void *tee)
+{
+	return -ENOSYS;
+}
+
 #endif /* __PBL__ */
 
 struct device_node;

-- 
2.47.3