u-boot.lists.denx.de archive mirror
 help / color / mirror / Atom feed
From: ZHIZHIKIN Andrey <andrey.zhizhikin@leica-geosystems.com>
To: Gaurav Jain <gaurav.jain@nxp.com>,
	"u-boot@lists.denx.de" <u-boot@lists.denx.de>
Cc: Stefano Babic <sbabic@denx.de>,
	Fabio Estevam <festevam@gmail.com>, Peng Fan <peng.fan@nxp.com>,
	Simon Glass <sjg@chromium.org>, Michael Walle <michael@walle.cc>,
	Priyanka Jain <priyanka.jain@nxp.com>, Ye Li <ye.li@nxp.com>,
	Horia Geanta <horia.geanta@nxp.com>, Ji Luo <ji.luo@nxp.com>,
	Franck Lenormand <franck.lenormand@nxp.com>,
	Silvano Di Ninno <silvano.dininno@nxp.com>,
	Sahil Malhotra <sahil.malhotra@nxp.com>,
	Pankaj Gupta <pankaj.gupta@nxp.com>,
	Varun Sethi <V.Sethi@nxp.com>, dl-uboot-imx <uboot-imx@nxp.com>,
	Shengzhou Liu <shengzhou.liu@nxp.com>,
	Mingkai Hu <mingkai.hu@nxp.com>,
	Rajesh Bhagat <rajesh.bhagat@nxp.com>,
	Meenakshi Aggarwal <meenakshi.aggarwal@nxp.com>,
	Wasim Khan <wasim.khan@nxp.com>,
	Alison Wang <alison.wang@nxp.com>,
	Pramod Kumar <pramod.kumar_1@nxp.com>,
	Andy Tang <andy.tang@nxp.com>,
	Adrian Alonso <adrian.alonso@nxp.com>,
	Vladimir Oltean <olteanv@gmail.com>,
	Rouven Czerwinski <r.czerwinski@pengutronix.de>
Subject: RE: [EXT] RE: [PATCH v10 02/14] i.MX8M: crypto: updated device tree for supporting DM in SPL
Date: Fri, 11 Feb 2022 16:26:02 +0000	[thread overview]
Message-ID: <AM6PR06MB4691178347827CB77F44F537A6309@AM6PR06MB4691.eurprd06.prod.outlook.com> (raw)
In-Reply-To: <VI1PR04MB53429DC8785F354E6A6CF6B8E7309@VI1PR04MB5342.eurprd04.prod.outlook.com>

Hello Gaurav,

Sorry, I somehow missed you last reply here.

Cc: Rouven

> -----Original Message-----
> From: U-Boot <u-boot-bounces@lists.denx.de> On Behalf Of Gaurav Jain
> Sent: Friday, February 11, 2022 10:48 AM
> To: ZHIZHIKIN Andrey <andrey.zhizhikin@leica-geosystems.com>; u-
> boot@lists.denx.de
> Cc: Stefano Babic <sbabic@denx.de>; Fabio Estevam <festevam@gmail.com>; Peng Fan
> <peng.fan@nxp.com>; Simon Glass <sjg@chromium.org>; Michael Walle
> <michael@walle.cc>; Priyanka Jain <priyanka.jain@nxp.com>; Ye Li <ye.li@nxp.com>;
> Horia Geanta <horia.geanta@nxp.com>; Ji Luo <ji.luo@nxp.com>; Franck Lenormand
> <franck.lenormand@nxp.com>; Silvano Di Ninno <silvano.dininno@nxp.com>; Sahil
> Malhotra <sahil.malhotra@nxp.com>; Pankaj Gupta <pankaj.gupta@nxp.com>; Varun
> Sethi <V.Sethi@nxp.com>; dl-uboot-imx <uboot-imx@nxp.com>; Shengzhou Liu
> <shengzhou.liu@nxp.com>; Mingkai Hu <mingkai.hu@nxp.com>; Rajesh Bhagat
> <rajesh.bhagat@nxp.com>; Meenakshi Aggarwal <meenakshi.aggarwal@nxp.com>; Wasim
> Khan <wasim.khan@nxp.com>; Alison Wang <alison.wang@nxp.com>; Pramod Kumar
> <pramod.kumar_1@nxp.com>; Andy Tang <andy.tang@nxp.com>; Adrian Alonso
> <adrian.alonso@nxp.com>; Vladimir Oltean <olteanv@gmail.com>
> Subject: RE: [EXT] RE: [PATCH v10 02/14] i.MX8M: crypto: updated device tree for
> supporting DM in SPL
> 
> Hello Andrey
> 
> I responded to your comments on this patch.
> If you are good, can this patch series merged?
> 
> Regards
> Gaurav Jain
> 
> > -----Original Message-----
> > From: Gaurav Jain
> > Sent: Thursday, February 3, 2022 10:58 AM
> > To: ZHIZHIKIN Andrey <andrey.zhizhikin@leica-geosystems.com>; u-
> > boot@lists.denx.de
> > Cc: Stefano Babic <sbabic@denx.de>; Fabio Estevam <festevam@gmail.com>;
> > Peng Fan <peng.fan@nxp.com>; Simon Glass <sjg@chromium.org>; Michael
> > Walle <michael@walle.cc>; Priyanka Jain <priyanka.jain@nxp.com>; Ye Li
> > <ye.li@nxp.com>; Horia Geanta <horia.geanta@nxp.com>; Ji Luo
> > <ji.luo@nxp.com>; Franck Lenormand <franck.lenormand@nxp.com>; Silvano Di
> > Ninno <silvano.dininno@nxp.com>; Sahil Malhotra <sahil.malhotra@nxp.com>;
> > Pankaj Gupta <pankaj.gupta@nxp.com>; Varun Sethi <V.Sethi@nxp.com>; dl-
> > uboot-imx <uboot-imx@nxp.com>; Shengzhou Liu <shengzhou.liu@nxp.com>;
> > Mingkai Hu <mingkai.hu@nxp.com>; Rajesh Bhagat <rajesh.bhagat@nxp.com>;
> > Meenakshi Aggarwal <meenakshi.aggarwal@nxp.com>; Wasim Khan
> > <wasim.khan@nxp.com>; Alison Wang <alison.wang@nxp.com>; Pramod
> > Kumar <pramod.kumar_1@nxp.com>; Andy Tang <andy.tang@nxp.com>;
> > Adrian Alonso <adrian.alonso@nxp.com>; Vladimir Oltean <olteanv@gmail.com>
> > Subject: RE: [EXT] RE: [PATCH v10 02/14] i.MX8M: crypto: updated device tree
> > for supporting DM in SPL
> >
> > Hello Andrey
> >
> > > -----Original Message-----
> > > From: ZHIZHIKIN Andrey <andrey.zhizhikin@leica-geosystems.com>
> > > Sent: Tuesday, February 1, 2022 3:15 AM
> > > To: Gaurav Jain <gaurav.jain@nxp.com>; u-boot@lists.denx.de
> > > Cc: Stefano Babic <sbabic@denx.de>; Fabio Estevam
> > > <festevam@gmail.com>; Peng Fan <peng.fan@nxp.com>; Simon Glass
> > > <sjg@chromium.org>; Michael Walle <michael@walle.cc>; Priyanka Jain
> > > <priyanka.jain@nxp.com>; Ye Li <ye.li@nxp.com>; Horia Geanta
> > > <horia.geanta@nxp.com>; Ji Luo <ji.luo@nxp.com>; Franck Lenormand
> > > <franck.lenormand@nxp.com>; Silvano Di Ninno
> > > <silvano.dininno@nxp.com>; Sahil Malhotra <sahil.malhotra@nxp.com>;
> > > Pankaj Gupta <pankaj.gupta@nxp.com>; Varun Sethi <V.Sethi@nxp.com>;
> > > dl- uboot-imx <uboot-imx@nxp.com>; Shengzhou Liu
> > > <shengzhou.liu@nxp.com>; Mingkai Hu <mingkai.hu@nxp.com>; Rajesh
> > > Bhagat <rajesh.bhagat@nxp.com>; Meenakshi Aggarwal
> > > <meenakshi.aggarwal@nxp.com>; Wasim Khan <wasim.khan@nxp.com>;
> > Alison
> > > Wang <alison.wang@nxp.com>; Pramod Kumar
> > <pramod.kumar_1@nxp.com>;
> > > Andy Tang <andy.tang@nxp.com>; Adrian Alonso <adrian.alonso@nxp.com>;
> > > Vladimir Oltean <olteanv@gmail.com>
> > > Subject: [EXT] RE: [PATCH v10 02/14] i.MX8M: crypto: updated device
> > > tree for supporting DM in SPL
> > >
> > > Caution: EXT Email
> > >
> > > Hello Gaurav,
> > >
> > > > -----Original Message-----
> > > > From: U-Boot <u-boot-bounces@lists.denx.de> On Behalf Of Gaurav Jain
> > > > Sent: Wednesday, January 12, 2022 2:31 PM
> > > > To: u-boot@lists.denx.de
> > > > Cc: Stefano Babic <sbabic@denx.de>; Fabio Estevam
> > > > <festevam@gmail.com>; Peng Fan <peng.fan@nxp.com>; Simon Glass
> > > > <sjg@chromium.org>; Michael Walle <michael@walle.cc>; Priyanka Jain
> > > > <priyanka.jain@nxp.com>; Ye Li <ye.li@nxp.com>; Horia Geanta
> > > > <horia.geanta@nxp.com>; Ji Luo <ji.luo@nxp.com>; Franck Lenormand
> > > > <franck.lenormand@nxp.com>; Silvano Di Ninno
> > > > <silvano.dininno@nxp.com>; Sahil malhotra <sahil.malhotra@nxp.com>;
> > > > Pankaj Gupta <pankaj.gupta@nxp.com>; Varun Sethi <V.Sethi@nxp.com>;
> > > > NXP i . MX U-Boot Team <uboot-imx@nxp.com>; Shengzhou Liu
> > > > <Shengzhou.Liu@nxp.com>; Mingkai Hu <mingkai.hu@nxp.com>; Rajesh
> > > > Bhagat <rajesh.bhagat@nxp.com>; Meenakshi Aggarwal
> > > > <meenakshi.aggarwal@nxp.com>; Wasim Khan <wasim.khan@nxp.com>;
> > > Alison
> > > > Wang <alison.wang@nxp.com>; Pramod Kumar
> > > <pramod.kumar_1@nxp.com>;
> > > > Tang Yuantian <andy.tang@nxp.com>; Adrian Alonso
> > > > <adrian.alonso@nxp.com>; Vladimir Oltean <olteanv@gmail.com>; Gaurav
> > > > Jain <gaurav.jain@nxp.com>
> > > > Subject: [PATCH v10 02/14] i.MX8M: crypto: updated device tree for
> > > > supporting DM in SPL
> > > >
> > > > disabled use of JR0 in SPL and uboot, as JR0 is reserved for secure
> > > > boot.
> > >
> > > I'd like to return the original question here, which was not
> > > completely clarified during previous reviews: where does the reservation
> > restriction is coming from?
> >
> > As mentioned earlier JR0 is being used by high assurance boot (HAB). This
> > prevents JR0 being used by any other software layer.

From what I understood reading AN4581 and companion AN12056, HAB requires
JR only in case when Encrypted Boot is performed. For image signature
verification it is not required, hence this reservation does sound a bit
artificial to me. Please correct me here if my understanding is not complete,
I was not able to get this information from all the answers you provided
before on the purpose of this reservation.

This fact, coupled with the one that upstream TF-A does release all JR to
NS-World, suggests that the reservation is not actually necessary, and
moreover - it will not reflect what the HW configuration it will have in
all combinations of BootROM->SPL->TF-A->(potentially OP-TEE)->Kernel.

Please note, that in case of downstream NXP TF-A is used here - this
reservation is rather valid, but it leads to "vendor locking" of
upstream U-Boot as it cannot be expected that all board/device vendors
are using downstream TF-A.

You do suggest below that this TF-A "mismatch" will be addressed in
upstream, but until this is done it is not reasonable to imply this
reservation IMHO.

As a side note: I had a patch series in the Kernel that performs
exactly the same reservation, but had to hold it back exactly because
of the reason I stated above: upstream TF-A does behave different from
downstream NXP one, hence booting Kernel with either one of those would
have different results with respect to JR0 reservation, see [1]. So you
can say that I'm and "interested party" here, since depending on how this
is solved in the boot chain would influence my next version of the patch
set to the Kernel.

> > >
> > > BootROM does reserve the JR0 and JR1, which are later released by ATF.
> > > NXP downstream ATF keeps the JR0 reserved, but upstream ATF does
> > > release *all* JRs to NS World.
> > >
> > > If this reservation is taken like the patch proposes and U-Boot is
> > > built with upstream ATF - this would eventually lead to the situation
> > > where the HW configuration is not aligned with what DTB indicates.
> >
> > I agree with you, we will address this in the upstream ATF code base as well.

That would be really great! I would personally consider this as a first
step before at least this reservation is performed. This would ensure the
consistency of HW description that DT provides.

> > >
> > > Please note, that recent OP-TEE release has also re-mapped the JR it
> > > uses from
> > > JR0 to JR2, which can also lead to usage of the JR which is already
> > > taken by OP- TEE. There is an ongoing PR in OP-TEE to disable JR nodes
> > > via DT overlay for Linux [1], but I'm not sure if the same applies to U-Boot
> as
> > well.
> >
> > Yes, Sahil would be addressing this issue in the next version of  his patch
> set.

Michael had a share of comments regarding the approach chosen for LS family,
and I think once that is solved - same solution can be applied to imx8 family.

> >
> > Regards
> > Gaurav Jain
> > >

Link: [1]: https://lore.kernel.org/lkml/AM6PR06MB4691D4FCA4D82284E70A9F53A64E9@AM6PR06MB4691.eurprd06.prod.outlook.com/

-- andrey


  reply	other threads:[~2022-02-11 16:26 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-01-12 13:31 [PATCH v10 00/14] Add CAAM driver model support Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 01/14] crypto/fsl: Add support for CAAM Job ring driver model Gaurav Jain
2022-01-12 20:03   ` Simon Glass
2022-01-12 13:31 ` [PATCH v10 02/14] i.MX8M: crypto: updated device tree for supporting DM in SPL Gaurav Jain
2022-01-31 21:45   ` ZHIZHIKIN Andrey
2022-01-31 22:02     ` Michael Walle
2022-02-03  5:27     ` [EXT] " Gaurav Jain
2022-02-11  9:48       ` Gaurav Jain
2022-02-11 16:26         ` ZHIZHIKIN Andrey [this message]
2022-01-12 13:31 ` [PATCH v10 03/14] crypto/fsl: i.MX8M: Enable Job ring driver model Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 04/14] mx6sabre: Remove unnecessary SPL configs Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 05/14] i.MX6: Enable Job ring driver model Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 06/14] i.MX7: " Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 07/14] i.MX7ULP: " Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 08/14] i.MX8: Add crypto node in device tree Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 09/14] crypto/fsl: i.MX8: Enable Job ring driver model Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 10/14] Layerscape: Add crypto node in device tree Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 11/14] Layerscape: Enable Job ring driver model Gaurav Jain
2022-01-12 15:50   ` Michael Walle
2022-01-12 13:31 ` [PATCH v10 12/14] PPC: Add crypto node in device tree Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 13/14] PPC: Enable Job ring driver model Gaurav Jain
2022-01-12 13:31 ` [PATCH v10 14/14] update CAAM MAINTAINER Gaurav Jain
2022-01-31  6:01 ` [PATCH v10 00/14] Add CAAM driver model support Gaurav Jain

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=AM6PR06MB4691178347827CB77F44F537A6309@AM6PR06MB4691.eurprd06.prod.outlook.com \
    --to=andrey.zhizhikin@leica-geosystems.com \
    --cc=V.Sethi@nxp.com \
    --cc=adrian.alonso@nxp.com \
    --cc=alison.wang@nxp.com \
    --cc=andy.tang@nxp.com \
    --cc=festevam@gmail.com \
    --cc=franck.lenormand@nxp.com \
    --cc=gaurav.jain@nxp.com \
    --cc=horia.geanta@nxp.com \
    --cc=ji.luo@nxp.com \
    --cc=meenakshi.aggarwal@nxp.com \
    --cc=michael@walle.cc \
    --cc=mingkai.hu@nxp.com \
    --cc=olteanv@gmail.com \
    --cc=pankaj.gupta@nxp.com \
    --cc=peng.fan@nxp.com \
    --cc=pramod.kumar_1@nxp.com \
    --cc=priyanka.jain@nxp.com \
    --cc=r.czerwinski@pengutronix.de \
    --cc=rajesh.bhagat@nxp.com \
    --cc=sahil.malhotra@nxp.com \
    --cc=sbabic@denx.de \
    --cc=shengzhou.liu@nxp.com \
    --cc=silvano.dininno@nxp.com \
    --cc=sjg@chromium.org \
    --cc=u-boot@lists.denx.de \
    --cc=uboot-imx@nxp.com \
    --cc=wasim.khan@nxp.com \
    --cc=ye.li@nxp.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).