* [U-Boot] [PATCH] Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"
@ 2019-06-04 2:54 Breno Matheus Lima
2019-06-04 2:56 ` Fabio Estevam
2019-06-04 9:14 ` Bryan O'Donoghue
0 siblings, 2 replies; 3+ messages in thread
From: Breno Matheus Lima @ 2019-06-04 2:54 UTC (permalink / raw)
To: u-boot
Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to
non-TrustZone") breaks HABv4 encrypted boot support in the
following i.MX devices:
- i.MX6UL
- i.MX7S
- i.MX7D
- i.MX7ULP
For preparing a HABv4 encrypted boot image it's necessary to
encapsulate the generated DEK in a blob. In devices listed
above the blob generation function takes into consideration
the Job Ring TrustZone ownership configuration (JROWN_NS)
and can be only decapsulated by the same configuration.
The ROM code expects DEK blobs encapsulated by the Secure World
environments which commonly have JROWN_NS = 0.
As U-Boot is running in Secure World we must have JROWN_NS = 0
so the blobs generated by dek_blob tool can be decapsulated
by the ROM code.
Job-rings assignment is now handled in OP-TEE OS, this commit can
be safely reverted.
https://github.com/OP-TEE/optee_os/pull/2986
This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041.
Signed-off-by: Breno Lima <breno.lima@nxp.com>
---
drivers/crypto/fsl/jr.c | 9 ---------
drivers/crypto/fsl/jr.h | 2 --
2 files changed, 11 deletions(-)
diff --git a/drivers/crypto/fsl/jr.c b/drivers/crypto/fsl/jr.c
index cc8d3b02a5..3121762364 100644
--- a/drivers/crypto/fsl/jr.c
+++ b/drivers/crypto/fsl/jr.c
@@ -578,8 +578,6 @@ int sec_init_idx(uint8_t sec_idx)
{
ccsr_sec_t *sec = (void *)SEC_ADDR(sec_idx);
uint32_t mcr = sec_in32(&sec->mcfgr);
- uint32_t jrown_ns;
- int i;
int ret = 0;
#ifdef CONFIG_FSL_CORENET
@@ -635,13 +633,6 @@ int sec_init_idx(uint8_t sec_idx)
#endif
#endif
- /* Set ownership of job rings to non-TrustZone mode by default */
- for (i = 0; i < ARRAY_SIZE(sec->jrliodnr); i++) {
- jrown_ns = sec_in32(&sec->jrliodnr[i].ms);
- jrown_ns |= JROWN_NS | JRMID_NS;
- sec_out32(&sec->jrliodnr[i].ms, jrown_ns);
- }
-
ret = jr_init(sec_idx);
if (ret < 0) {
printf("SEC initialization failed\n");
diff --git a/drivers/crypto/fsl/jr.h b/drivers/crypto/fsl/jr.h
index f6fbb44383..ffd3a19273 100644
--- a/drivers/crypto/fsl/jr.h
+++ b/drivers/crypto/fsl/jr.h
@@ -33,8 +33,6 @@
#define JRNSLIODN_MASK 0x0fff0000
#define JRSLIODN_SHIFT 0
#define JRSLIODN_MASK 0x00000fff
-#define JROWN_NS 0x00000008
-#define JRMID_NS 0x00000001
#define JQ_DEQ_ERR -1
#define JQ_DEQ_TO_ERR -2
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [U-Boot] [PATCH] Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"
2019-06-04 2:54 [U-Boot] [PATCH] Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone" Breno Matheus Lima
@ 2019-06-04 2:56 ` Fabio Estevam
2019-06-04 9:14 ` Bryan O'Donoghue
1 sibling, 0 replies; 3+ messages in thread
From: Fabio Estevam @ 2019-06-04 2:56 UTC (permalink / raw)
To: u-boot
Hi Breno,
On Mon, Jun 3, 2019 at 11:55 PM Breno Matheus Lima <breno.lima@nxp.com> wrote:
>
> Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to
> non-TrustZone") breaks HABv4 encrypted boot support in the
> following i.MX devices:
>
> - i.MX6UL
> - i.MX7S
> - i.MX7D
> - i.MX7ULP
>
> For preparing a HABv4 encrypted boot image it's necessary to
> encapsulate the generated DEK in a blob. In devices listed
> above the blob generation function takes into consideration
> the Job Ring TrustZone ownership configuration (JROWN_NS)
> and can be only decapsulated by the same configuration.
>
> The ROM code expects DEK blobs encapsulated by the Secure World
> environments which commonly have JROWN_NS = 0.
>
> As U-Boot is running in Secure World we must have JROWN_NS = 0
> so the blobs generated by dek_blob tool can be decapsulated
> by the ROM code.
>
> Job-rings assignment is now handled in OP-TEE OS, this commit can
> be safely reverted.
> https://github.com/OP-TEE/optee_os/pull/2986
>
> This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041.
>
> Signed-off-by: Breno Lima <breno.lima@nxp.com>
Thanks for the fix:
Reviewed-by: Fabio Estevam <festevam@gmail.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [U-Boot] [PATCH] Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"
2019-06-04 2:54 [U-Boot] [PATCH] Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone" Breno Matheus Lima
2019-06-04 2:56 ` Fabio Estevam
@ 2019-06-04 9:14 ` Bryan O'Donoghue
1 sibling, 0 replies; 3+ messages in thread
From: Bryan O'Donoghue @ 2019-06-04 9:14 UTC (permalink / raw)
To: u-boot
On 04/06/2019 03:54, Breno Matheus Lima wrote:
> Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to
> non-TrustZone") breaks HABv4 encrypted boot support in the
> following i.MX devices:
>
> - i.MX6UL
> - i.MX7S
> - i.MX7D
> - i.MX7ULP
>
> For preparing a HABv4 encrypted boot image it's necessary to
> encapsulate the generated DEK in a blob. In devices listed
> above the blob generation function takes into consideration
> the Job Ring TrustZone ownership configuration (JROWN_NS)
> and can be only decapsulated by the same configuration.
>
> The ROM code expects DEK blobs encapsulated by the Secure World
> environments which commonly have JROWN_NS = 0.
>
> As U-Boot is running in Secure World we must have JROWN_NS = 0
> so the blobs generated by dek_blob tool can be decapsulated
> by the ROM code.
>
> Job-rings assignment is now handled in OP-TEE OS, this commit can
> be safely reverted.
> https://github.com/OP-TEE/optee_os/pull/2986
>
> This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041.
>
> Signed-off-by: Breno Lima <breno.lima@nxp.com>
Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
as this change has been applied https://github.com/OP-TEE/optee_os/pull/2986
---
bod
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-06-04 9:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-04 2:54 [U-Boot] [PATCH] Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone" Breno Matheus Lima
2019-06-04 2:56 ` Fabio Estevam
2019-06-04 9:14 ` Bryan O'Donoghue
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.