From: Emanuele Ghidoli emanuele.ghidoli@toradex.com

Add a new kconfig option to allow non-secure world access to the CAAM Job Ring. This is needed, for example, when running linux without OP-TEE services, as it's done on Colibri iMX7.

Fixes: 51f1357f3428 ("Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"") Signed-off-by: Emanuele Ghidoli emanuele.ghidoli@toradex.com --- drivers/crypto/fsl/Kconfig | 7 +++++++ drivers/crypto/fsl/jr.c | 19 +++++++++++++++++++ drivers/crypto/fsl/jr.h | 2 ++ 3 files changed, 28 insertions(+)

diff --git a/drivers/crypto/fsl/Kconfig b/drivers/crypto/fsl/Kconfig index eaad19633f1d..e95675ee3e8e 100644 --- a/drivers/crypto/fsl/Kconfig +++ b/drivers/crypto/fsl/Kconfig @@ -62,6 +62,13 @@ config SYS_FSL_SEC_LE

if FSL_CAAM

+config FSL_CAAM_JR_NTZ_ACCESS + bool "Give caam Job Ring access to non-secure world" + default n + help + It is needed when OP-TEE is not used and Freescale CAAM Job Ring linux + driver is used. + config FSL_CAAM_RNG bool "Enable Random Number Generator support" depends on DM_RNG diff --git a/drivers/crypto/fsl/jr.c b/drivers/crypto/fsl/jr.c index ceb66dd6270d..203f16252159 100644 --- a/drivers/crypto/fsl/jr.c +++ b/drivers/crypto/fsl/jr.c @@ -673,6 +673,21 @@ static int rng_init(uint8_t sec_idx, ccsr_sec_t *sec) return ret; }

+#if CONFIG_IS_ENABLED(FSL_CAAM_JR_NTZ_ACCESS) +static void jr_setown_non_trusted(ccsr_sec_t *sec) +{ + u32 jrown_ns; + int i; + + /* Set ownership of job rings to non-TrustZone mode */ + for (i = 0; i < ARRAY_SIZE(sec->jrliodnr); i++) { + jrown_ns = sec_in32(&sec->jrliodnr[i].ms); + jrown_ns |= JROWN_NS | JRMID_NS; + sec_out32(&sec->jrliodnr[i].ms, jrown_ns); + } +} +#endif + int sec_init_idx(uint8_t sec_idx) { int ret = 0; @@ -761,6 +776,10 @@ int sec_init_idx(uint8_t sec_idx) #if CONFIG_IS_ENABLED(OF_CONTROL) init: #endif +#if CONFIG_IS_ENABLED(FSL_CAAM_JR_NTZ_ACCESS) + jr_setown_non_trusted(sec); +#endif + ret = jr_init(sec_idx, caam); if (ret < 0) { printf("SEC%u: initialization failed\n", sec_idx); diff --git a/drivers/crypto/fsl/jr.h b/drivers/crypto/fsl/jr.h index 4e4c4af5805f..b136cd8d05a9 100644 --- a/drivers/crypto/fsl/jr.h +++ b/drivers/crypto/fsl/jr.h @@ -37,6 +37,8 @@ #define JRNSLIODN_MASK 0x0fff0000 #define JRSLIODN_SHIFT 0 #define JRSLIODN_MASK 0x00000fff +#define JROWN_NS 0x00000008 +#define JRMID_NS 0x00000001

#define JRDID_MS_PRIM_DID BIT(0) #define JRDID_MS_PRIM_TZ BIT(4)

From: Emanuele Ghidoli emanuele.ghidoli@toradex.com

Linux kernel is supposed to run in non-secure world, fix the defconfig accordingly.

Signed-off-by: Emanuele Ghidoli emanuele.ghidoli@toradex.com --- configs/colibri_imx7_emmc_defconfig | 1 - 1 file changed, 1 deletion(-)

diff --git a/configs/colibri_imx7_emmc_defconfig b/configs/colibri_imx7_emmc_defconfig index 9d4423cd0d6a..8dd9fe6e6a38 100644 --- a/configs/colibri_imx7_emmc_defconfig +++ b/configs/colibri_imx7_emmc_defconfig @@ -8,7 +8,6 @@ CONFIG_DEFAULT_DEVICE_TREE="imx7d-colibri-emmc-eval-v3" CONFIG_TARGET_COLIBRI_IMX7=y CONFIG_TARGET_COLIBRI_IMX7_EMMC=y CONFIG_OF_LIBFDT_OVERLAY=y -CONFIG_ARMV7_BOOT_SEC_DEFAULT=y CONFIG_IMX_RDC=y CONFIG_IMX_BOOTAUX=y CONFIG_IMX_HAB=y