Hi Breno, On Mon, Jun 3, 2019 at 11:55 PM Breno Matheus Lima <breno.l...@nxp.com> wrote: > > Commit 22191ac35344 ("drivers/crypto/fsl: assign job-rings to > non-TrustZone") breaks HABv4 encrypted boot support in the > following i.MX devices: > > - i.MX6UL > - i.MX7S > - i.MX7D > - i.MX7ULP > > For preparing a HABv4 encrypted boot image it's necessary to > encapsulate the generated DEK in a blob. In devices listed > above the blob generation function takes into consideration > the Job Ring TrustZone ownership configuration (JROWN_NS) > and can be only decapsulated by the same configuration. > > The ROM code expects DEK blobs encapsulated by the Secure World > environments which commonly have JROWN_NS = 0. > > As U-Boot is running in Secure World we must have JROWN_NS = 0 > so the blobs generated by dek_blob tool can be decapsulated > by the ROM code. > > Job-rings assignment is now handled in OP-TEE OS, this commit can > be safely reverted. > https://github.com/OP-TEE/optee_os/pull/2986 > > This reverts commit 22191ac353445ad8fafc5a78aefcd94e78963041. > > Signed-off-by: Breno Lima <breno.l...@nxp.com>
Thanks for the fix: Reviewed-by: Fabio Estevam <feste...@gmail.com> _______________________________________________ U-Boot mailing list U-Boot@lists.denx.de https://lists.denx.de/listinfo/u-boot