> Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to
> non-TrustZone") breaks HABv4 encrypted boot support in the
> following i.MX devices:
> - i.MX6UL
> - i.MX7S
> - i.MX7D
> - i.MX7ULP
> For preparing a HABv4 encrypted boot image it's necessary to
> encapsulate the generated DEK in a blob. In devices listed
> above the blob generation function takes into consideration
> the Job Ring TrustZone ownership configuration (JROWN_NS)
> and can be only decapsulated by the same configuration.
> The ROM code expects DEK blobs encapsulated by the Secure World
> environments which commonly have JROWN_NS = 0.
> As U-Boot is running in Secure World we must have JROWN_NS = 0
> so the blobs generated by dek_blob tool can be decapsulated
> by the ROM code.
> Job-rings assignment is now handled in OP-TEE OS, this commit can
> be safely reverted.
> https://github.com/OP-TEE/optee_os/pull/2986
> This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041.
> Signed-off-by: Breno Lima <[email protected]>
> Reviewed-by: Fabio Estevam <[email protected]>
> Acked-by: Bryan O'Donoghue <[email protected]>
Applied to u-boot-imx, master, thanks !
Best regards,
Stefano Babic
--
=====================================================================
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: [email protected]
=====================================================================
_______________________________________________
U-Boot mailing list
[email protected]
https://lists.denx.de/listinfo/u-boot
