From mboxrd@z Thu Jan 1 00:00:00 1970 From: sbabic at denx.de Date: Mon, 10 Jun 2019 09:40:41 +0000 (UTC) Subject: [U-Boot] [PATCH] Revert "drivers/crypto/fsl: assign job-rings to Message-ID: <20190610095256.4FD93C21FDA@lists.denx.de> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de > Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to > non-TrustZone") breaks HABv4 encrypted boot support in the > following i.MX devices: > - i.MX6UL > - i.MX7S > - i.MX7D > - i.MX7ULP > For preparing a HABv4 encrypted boot image it's necessary to > encapsulate the generated DEK in a blob. In devices listed > above the blob generation function takes into consideration > the Job Ring TrustZone ownership configuration (JROWN_NS) > and can be only decapsulated by the same configuration. > The ROM code expects DEK blobs encapsulated by the Secure World > environments which commonly have JROWN_NS = 0. > As U-Boot is running in Secure World we must have JROWN_NS = 0 > so the blobs generated by dek_blob tool can be decapsulated > by the ROM code. > Job-rings assignment is now handled in OP-TEE OS, this commit can > be safely reverted. > https://github.com/OP-TEE/optee_os/pull/2986 > This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041. > Signed-off-by: Breno Lima > Reviewed-by: Fabio Estevam > Acked-by: Bryan O'Donoghue Applied to u-boot-imx, master, thanks ! Best regards, Stefano Babic -- ===================================================================== DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic at denx.de =====================================================================