diff options
| author | Breno Matheus Lima <breno.lima@nxp.com> | 2019-06-04 05:54:44 +0300 |
|---|---|---|
| committer | Stefano Babic <sbabic@denx.de> | 2019-06-11 11:42:48 +0300 |
| commit | 51f1357f3428819eeb254ab3f496c2803b36bbb3 (patch) | |
| tree | 69cb0d1db21d94f009b9a010cdc219f06aa69a67 /drivers/crypto/fsl/jr.h | |
| parent | 5f6d63adb948178483eb501514994a33e9e200ac (diff) | |
| download | u-boot-51f1357f3428819eeb254ab3f496c2803b36bbb3.tar.xz | |
Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"
Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to
non-TrustZone") breaks HABv4 encrypted boot support in the
following i.MX devices:
- i.MX6UL
- i.MX7S
- i.MX7D
- i.MX7ULP
For preparing a HABv4 encrypted boot image it's necessary to
encapsulate the generated DEK in a blob. In devices listed
above the blob generation function takes into consideration
the Job Ring TrustZone ownership configuration (JROWN_NS)
and can be only decapsulated by the same configuration.
The ROM code expects DEK blobs encapsulated by the Secure World
environments which commonly have JROWN_NS = 0.
As U-Boot is running in Secure World we must have JROWN_NS = 0
so the blobs generated by dek_blob tool can be decapsulated
by the ROM code.
Job-rings assignment is now handled in OP-TEE OS, this commit can
be safely reverted.
https://github.com/OP-TEE/optee_os/pull/2986
This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041.
Signed-off-by: Breno Lima <breno.lima@nxp.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Diffstat (limited to 'drivers/crypto/fsl/jr.h')
| -rw-r--r-- | drivers/crypto/fsl/jr.h | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/crypto/fsl/jr.h b/drivers/crypto/fsl/jr.h index f6fbb44383..ffd3a19273 100644 --- a/drivers/crypto/fsl/jr.h +++ b/drivers/crypto/fsl/jr.h @@ -33,8 +33,6 @@ #define JRNSLIODN_MASK 0x0fff0000 #define JRSLIODN_SHIFT 0 #define JRSLIODN_MASK 0x00000fff -#define JROWN_NS 0x00000008 -#define JRMID_NS 0x00000001 #define JQ_DEQ_ERR -1 #define JQ_DEQ_TO_ERR -2 |