| Message ID | 1559616836-66-1-git-send-email-breno.lima@nxp.com |
|---|---|
| State | Accepted |
| Commit | 51f1357f3428819eeb254ab3f496c2803b36bbb3 |
| Delegated to: | Stefano Babic |
| Headers | show |
| Series | [U-Boot] Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone" | expand |
Hi Breno, On Mon, Jun 3, 2019 at 11:55 PM Breno Matheus Lima <breno.lima@nxp.com> wrote: > > Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to > non-TrustZone") breaks HABv4 encrypted boot support in the > following i.MX devices: > > - i.MX6UL > - i.MX7S > - i.MX7D > - i.MX7ULP > > For preparing a HABv4 encrypted boot image it's necessary to > encapsulate the generated DEK in a blob. In devices listed > above the blob generation function takes into consideration > the Job Ring TrustZone ownership configuration (JROWN_NS) > and can be only decapsulated by the same configuration. > > The ROM code expects DEK blobs encapsulated by the Secure World > environments which commonly have JROWN_NS = 0. > > As U-Boot is running in Secure World we must have JROWN_NS = 0 > so the blobs generated by dek_blob tool can be decapsulated > by the ROM code. > > Job-rings assignment is now handled in OP-TEE OS, this commit can > be safely reverted. > https://github.com/OP-TEE/optee_os/pull/2986 > > This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041. > > Signed-off-by: Breno Lima <breno.lima@nxp.com> Thanks for the fix: Reviewed-by: Fabio Estevam <festevam@gmail.com>
On 04/06/2019 03:54, Breno Matheus Lima wrote: > Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to > non-TrustZone") breaks HABv4 encrypted boot support in the > following i.MX devices: > > - i.MX6UL > - i.MX7S > - i.MX7D > - i.MX7ULP > > For preparing a HABv4 encrypted boot image it's necessary to > encapsulate the generated DEK in a blob. In devices listed > above the blob generation function takes into consideration > the Job Ring TrustZone ownership configuration (JROWN_NS) > and can be only decapsulated by the same configuration. > > The ROM code expects DEK blobs encapsulated by the Secure World > environments which commonly have JROWN_NS = 0. > > As U-Boot is running in Secure World we must have JROWN_NS = 0 > so the blobs generated by dek_blob tool can be decapsulated > by the ROM code. > > Job-rings assignment is now handled in OP-TEE OS, this commit can > be safely reverted. > https://github.com/OP-TEE/optee_os/pull/2986 > > This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041. > > Signed-off-by: Breno Lima <breno.lima@nxp.com> Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> as this change has been applied https://github.com/OP-TEE/optee_os/pull/2986 --- bod
diff --git a/drivers/crypto/fsl/jr.c b/drivers/crypto/fsl/jr.c index cc8d3b02a5..3121762364 100644 --- a/drivers/crypto/fsl/jr.c +++ b/drivers/crypto/fsl/jr.c @@ -578,8 +578,6 @@ int sec_init_idx(uint8_t sec_idx) { ccsr_sec_t *sec = (void *)SEC_ADDR(sec_idx); uint32_t mcr = sec_in32(&sec->mcfgr); - uint32_t jrown_ns; - int i; int ret = 0; #ifdef CONFIG_FSL_CORENET @@ -635,13 +633,6 @@ int sec_init_idx(uint8_t sec_idx) #endif #endif - /* Set ownership of job rings to non-TrustZone mode by default */ - for (i = 0; i < ARRAY_SIZE(sec->jrliodnr); i++) { - jrown_ns = sec_in32(&sec->jrliodnr[i].ms); - jrown_ns |= JROWN_NS | JRMID_NS; - sec_out32(&sec->jrliodnr[i].ms, jrown_ns); - } - ret = jr_init(sec_idx); if (ret < 0) { printf("SEC initialization failed\n"); diff --git a/drivers/crypto/fsl/jr.h b/drivers/crypto/fsl/jr.h index f6fbb44383..ffd3a19273 100644 --- a/drivers/crypto/fsl/jr.h +++ b/drivers/crypto/fsl/jr.h @@ -33,8 +33,6 @@ #define JRNSLIODN_MASK 0x0fff0000 #define JRSLIODN_SHIFT 0 #define JRSLIODN_MASK 0x00000fff -#define JROWN_NS 0x00000008 -#define JRMID_NS 0x00000001 #define JQ_DEQ_ERR -1 #define JQ_DEQ_TO_ERR -2
Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to non-TrustZone") breaks HABv4 encrypted boot support in the following i.MX devices: - i.MX6UL - i.MX7S - i.MX7D - i.MX7ULP For preparing a HABv4 encrypted boot image it's necessary to encapsulate the generated DEK in a blob. In devices listed above the blob generation function takes into consideration the Job Ring TrustZone ownership configuration (JROWN_NS) and can be only decapsulated by the same configuration. The ROM code expects DEK blobs encapsulated by the Secure World environments which commonly have JROWN_NS = 0. As U-Boot is running in Secure World we must have JROWN_NS = 0 so the blobs generated by dek_blob tool can be decapsulated by the ROM code. Job-rings assignment is now handled in OP-TEE OS, this commit can be safely reverted. https://github.com/OP-TEE/optee_os/pull/2986 This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041. Signed-off-by: Breno Lima <breno.lima@nxp.com> --- drivers/crypto/fsl/jr.c | 9 --------- drivers/crypto/fsl/jr.h | 2 -- 2 files changed, 11 deletions(-)