diff options
| author | Breno Lima <breno.lima@nxp.com> | 2019-04-03 23:51:51 -0300 |
|---|---|---|
| committer | Ye Li <ye.li@nxp.com> | 2019-04-08 22:28:15 -0700 |
| commit | 3eebc76f5571f7ce74d385235019e8eb4a6718f6 (patch) | |
| tree | f19c37b4bafd3fb1f687176689f4c65aca07a9e2 /drivers | |
| parent | 0224af21ce9129722f9f2761c92f8f374f8a14a2 (diff) | |
MLK-21386 Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"
Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to
non-TrustZone") breaks HABv4 encrypted boot support in the
following i.MX devices:
- i.MX6UL
- i.MX7S
- i.MX7D
- i.MX7ULP
For preparing a HABv4 encrypted boot image it's necessary to
encapsulated the generated DEK in a blob. The blob generation
function takes into consideration the Job Ring TrustZone
ownership configuration (JROWN_NS) and can be only decapsulated
by the same configuration.
The ROM code expects DEK blobs encapsulated by the Secure World
environments which commonly have JROWN_NS = 0.
As U-Boot is running in Secure World we must have JROWN_NS=0
so the blobs generated by dek_blob tool can be decapsulated
by the ROM code.
As NXP BSP does not requires all job-rings assigned to
non-Secure world this commit can be safely reverted.
This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041.
Reviewed-by: Silvano Di Ninno <silvano.dininno@nxp.com>
Signed-off-by: Breno Lima <breno.lima@nxp.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/crypto/fsl/jr.c | 9 | ||||
| -rw-r--r-- | drivers/crypto/fsl/jr.h | 2 |
2 files changed, 0 insertions, 11 deletions
diff --git a/drivers/crypto/fsl/jr.c b/drivers/crypto/fsl/jr.c index 76dc2aa0af..d6d0b3f21e 100644 --- a/drivers/crypto/fsl/jr.c +++ b/drivers/crypto/fsl/jr.c @@ -581,8 +581,6 @@ int sec_init_idx(uint8_t sec_idx) { ccsr_sec_t *sec = (void *)SEC_ADDR(sec_idx); uint32_t mcr = sec_in32(&sec->mcfgr); - uint32_t jrown_ns; - int i; int ret = 0; #ifdef CONFIG_FSL_CORENET @@ -638,13 +636,6 @@ int sec_init_idx(uint8_t sec_idx) #endif #endif - /* Set ownership of job rings to non-TrustZone mode by default */ - for (i = 0; i < ARRAY_SIZE(sec->jrliodnr); i++) { - jrown_ns = sec_in32(&sec->jrliodnr[i].ms); - jrown_ns |= JROWN_NS | JRMID_NS; - sec_out32(&sec->jrliodnr[i].ms, jrown_ns); - } - ret = jr_init(sec_idx); if (ret < 0) { printf("SEC initialization failed\n"); diff --git a/drivers/crypto/fsl/jr.h b/drivers/crypto/fsl/jr.h index 38e72511e9..b522506471 100644 --- a/drivers/crypto/fsl/jr.h +++ b/drivers/crypto/fsl/jr.h @@ -35,8 +35,6 @@ #define JRNSLIODN_MASK 0x0fff0000 #define JRSLIODN_SHIFT 0 #define JRSLIODN_MASK 0x00000fff -#define JROWN_NS 0x00000008 -#define JRMID_NS 0x00000001 #define JQ_DEQ_ERR -1 #define JQ_DEQ_TO_ERR -2 |