aboutsummaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorBreno Matheus Lima <breno.lima@nxp.com>2019-06-04 02:54:44 +0000
committerStefano Babic <sbabic@denx.de>2019-06-11 10:42:48 +0200
commit51f1357f3428819eeb254ab3f496c2803b36bbb3 (patch)
tree69cb0d1db21d94f009b9a010cdc219f06aa69a67 /drivers
parent5f6d63adb948178483eb501514994a33e9e200ac (diff)
downloadu-boot-51f1357f3428819eeb254ab3f496c2803b36bbb3.zip
u-boot-51f1357f3428819eeb254ab3f496c2803b36bbb3.tar.gz
u-boot-51f1357f3428819eeb254ab3f496c2803b36bbb3.tar.bz2
Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"
Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to non-TrustZone") breaks HABv4 encrypted boot support in the following i.MX devices: - i.MX6UL - i.MX7S - i.MX7D - i.MX7ULP For preparing a HABv4 encrypted boot image it's necessary to encapsulate the generated DEK in a blob. In devices listed above the blob generation function takes into consideration the Job Ring TrustZone ownership configuration (JROWN_NS) and can be only decapsulated by the same configuration. The ROM code expects DEK blobs encapsulated by the Secure World environments which commonly have JROWN_NS = 0. As U-Boot is running in Secure World we must have JROWN_NS = 0 so the blobs generated by dek_blob tool can be decapsulated by the ROM code. Job-rings assignment is now handled in OP-TEE OS, this commit can be safely reverted. https://github.com/OP-TEE/optee_os/pull/2986 This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Fabio Estevam <festevam@gmail.com> Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/crypto/fsl/jr.c9
-rw-r--r--drivers/crypto/fsl/jr.h2
2 files changed, 0 insertions, 11 deletions
diff --git a/drivers/crypto/fsl/jr.c b/drivers/crypto/fsl/jr.c
index cc8d3b0..3121762 100644
--- a/drivers/crypto/fsl/jr.c
+++ b/drivers/crypto/fsl/jr.c
@@ -578,8 +578,6 @@ int sec_init_idx(uint8_t sec_idx)
{
ccsr_sec_t *sec = (void *)SEC_ADDR(sec_idx);
uint32_t mcr = sec_in32(&sec->mcfgr);
- uint32_t jrown_ns;
- int i;
int ret = 0;
#ifdef CONFIG_FSL_CORENET
@@ -635,13 +633,6 @@ int sec_init_idx(uint8_t sec_idx)
#endif
#endif
- /* Set ownership of job rings to non-TrustZone mode by default */
- for (i = 0; i < ARRAY_SIZE(sec->jrliodnr); i++) {
- jrown_ns = sec_in32(&sec->jrliodnr[i].ms);
- jrown_ns |= JROWN_NS | JRMID_NS;
- sec_out32(&sec->jrliodnr[i].ms, jrown_ns);
- }
-
ret = jr_init(sec_idx);
if (ret < 0) {
printf("SEC initialization failed\n");
diff --git a/drivers/crypto/fsl/jr.h b/drivers/crypto/fsl/jr.h
index f6fbb44..ffd3a19 100644
--- a/drivers/crypto/fsl/jr.h
+++ b/drivers/crypto/fsl/jr.h
@@ -33,8 +33,6 @@
#define JRNSLIODN_MASK 0x0fff0000
#define JRSLIODN_SHIFT 0
#define JRSLIODN_MASK 0x00000fff
-#define JROWN_NS 0x00000008
-#define JRMID_NS 0x00000001
#define JQ_DEQ_ERR -1
#define JQ_DEQ_TO_ERR -2