On 04/06/2019 03:54, Breno Matheus Lima wrote:
Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to non-TrustZone") breaks HABv4 encrypted boot support in the following i.MX devices:
- i.MX6UL
- i.MX7S
- i.MX7D
- i.MX7ULP
For preparing a HABv4 encrypted boot image it's necessary to encapsulate the generated DEK in a blob. In devices listed above the blob generation function takes into consideration the Job Ring TrustZone ownership configuration (JROWN_NS) and can be only decapsulated by the same configuration.
The ROM code expects DEK blobs encapsulated by the Secure World environments which commonly have JROWN_NS = 0.
As U-Boot is running in Secure World we must have JROWN_NS = 0 so the blobs generated by dek_blob tool can be decapsulated by the ROM code.
Job-rings assignment is now handled in OP-TEE OS, this commit can be safely reverted. https://github.com/OP-TEE/optee_os/pull/2986
This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041.
Signed-off-by: Breno Lima breno.lima@nxp.com
Acked-by: Bryan O'Donoghue bryan.odonoghue@linaro.org
as this change has been applied https://github.com/OP-TEE/optee_os/pull/2986
--- bod