Hello all,
-----Original Message----- From: U-Boot u-boot-bounces@lists.denx.de On Behalf Of Rasmus Villemoes Sent: Friday, October 14, 2022 7:50 PM To: Peng Fan peng.fan@oss.nxp.com; ZHIZHIKIN Andrey <andrey.zhizhikin@leica- geosystems.com>; Gaurav Jain gaurav.jain@nxp.com Cc: u-boot@lists.denx.de; festevam@denx.de; sbabic@denx.de; Michael Walle michael@walle.cc; Tommaso Merciai tommaso.merciai@amarulasolutions.com; Michael Trimarchi michael@amarulasolutions.com; Marek Vasut marex@denx.de; Simon Glass sjg@chromium.org; Patrick Delaunay patrick.delaunay@foss.st.com; Stefan Roese sr@denx.de; Horia Geanta horia.geanta@nxp.com; Pankaj Gupta pankaj.gupta@nxp.com; Varun Sethi V.Sethi@nxp.com; Ye Li ye.li@nxp.com; dl- uboot-imx uboot-imx@nxp.com; trini trini@konsulko.com Subject: Re: [EXT] [REGRESSION]: v2022.07: SHA256 hash is broken on imx8m series with CAAM enabled
On 14/10/2022 03.00, Peng Fan wrote:
Right now I am not sure what could cause the issue. As per our previous discussions, JR0 can not be used in uboot, so you need to mark it as disabled until kernel device tree is not sync.
Actually, I've given this a try by setting `status = "disabled"` in sec_jr0 node, and then the hash calculation was working again!
Did you enable optee? If disabling sec_jr0 to make it work, i think there is issue somewhere.
With optee enabled, optee will take JR0. If optee not enabled, JR0 could be used by U-Boot.
I can't speak for Andrey, but no, I don't enable/use optee on my imx8mp.
I also do not have an OP-TEE in my setup, but since upstream TF-A commit 77850c96f23b ("feat(plat/imx8m): do not release JR0 to NS if HAB is using it") [1] this makes no difference, as JR0 would be permanently held in S-World.
Downstream fork has the same implementation done in commit 961f90418874 ("TEE-639 plat: imx8m: Do not release JR0 to NS if HAB is using it"), so it is now consistent behavior across upstream and downstream.
This means that JR0 has to be permanently disabled in the DTB, with Kernel being the first followed by the U-Boot sync.
This work has been already accomplished by Fabio in Kernel via commit dc9c1ceb555f ("arm64: dts: imx8m: Disable job ring 0 nodes") [3], and sync'd in for `imx8mm.dtsi` in commit 05996f350d48 ("imx8mm: Sync device tree with linux-next 20220711") [4].
`imx8mp.dtsi` however was not sync'd in, so the JR0 disabling is left out. :( This does explain why the SHA calculation are not operable for that SoC.
Rasmus
-- andrey
Link: [1]: http://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=77850c... Link: [2]: https://source.codeaurora.org/external/imx/imx-atf/commit/plat/imx/imx8m/imx... Link: [3]: https://github.com/torvalds/linux/commit/dc9c1ceb555ff661e6fc1081434600771f2... Link: [4]: https://source.denx.de/u-boot/u-boot/-/commit/05996f350d482d2a450173ce3340ee...