Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to non-TrustZone") breaks HABv4 encrypted boot support in the following i.MX devices:
- i.MX6UL
- i.MX7S
- i.MX7D
- i.MX7ULP
For preparing a HABv4 encrypted boot image it's necessary to encapsulate the generated DEK in a blob. In devices listed above the blob generation function takes into consideration the Job Ring TrustZone ownership configuration (JROWN_NS) and can be only decapsulated by the same configuration. The ROM code expects DEK blobs encapsulated by the Secure World environments which commonly have JROWN_NS = 0. As U-Boot is running in Secure World we must have JROWN_NS = 0 so the blobs generated by dek_blob tool can be decapsulated by the ROM code. Job-rings assignment is now handled in OP-TEE OS, this commit can be safely reverted. https://github.com/OP-TEE/optee_os/pull/2986 This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041. Signed-off-by: Breno Lima breno.lima@nxp.com Reviewed-by: Fabio Estevam festevam@gmail.com Acked-by: Bryan O'Donoghue bryan.odonoghue@linaro.org
Applied to u-boot-imx, master, thanks !
Best regards, Stefano Babic