* [PATCH v1 0/3] crypto/fsl: allow accessing Job Ring from non-TrustZone
@ 2024-03-25 11:46 Emanuele Ghidoli
2024-03-25 11:46 ` [PATCH v1 1/3] " Emanuele Ghidoli
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Emanuele Ghidoli @ 2024-03-25 11:46 UTC (permalink / raw
To: u-boot, NXP i . MX U-Boot Team, Gaurav Jain, Fabio Estevam,
Breno Matheus Lima, Peng Fan, Marcel Ziswiler
Cc: Emanuele Ghidoli
From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
This series allows using Freescale CAAM Job Ring from Linux without having OP-TEE,
this is needed for example on Toradex Colibri iMX7 where we just have U-Boot + Linux kernel.
To achieve this add a new config option to allow the non-secure world to access job rings.
The functionality has been broken since U-Boot v2019.07, with commit 51f1357f3428
("Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"")
Link: https://lore.kernel.org/all/4b64a9de-a840-4065-a530-f81155b4b9f2@toradex.com/
Regards,
Emanuele Ghidoli
Emanuele Ghidoli (3):
crypto/fsl: allow accessing Job Ring from non-TrustZone
configs: colibri-imx7: set non-secure boot mode as default
configs: colibri-imx7: allow accessing job-rings from non-TrustZone
configs/colibri_imx7_defconfig | 1 +
configs/colibri_imx7_emmc_defconfig | 2 +-
drivers/crypto/fsl/Kconfig | 7 +++++++
drivers/crypto/fsl/jr.c | 19 +++++++++++++++++++
drivers/crypto/fsl/jr.h | 2 ++
5 files changed, 30 insertions(+), 1 deletion(-)
--
2.34.1
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v1 1/3] crypto/fsl: allow accessing Job Ring from non-TrustZone
2024-03-25 11:46 [PATCH v1 0/3] crypto/fsl: allow accessing Job Ring from non-TrustZone Emanuele Ghidoli
@ 2024-03-25 11:46 ` Emanuele Ghidoli
2024-03-25 12:17 ` Fabio Estevam
2024-03-25 11:46 ` [PATCH v1 2/3] configs: colibri-imx7: set non-secure boot mode as default Emanuele Ghidoli
2024-03-25 11:46 ` [PATCH v1 3/3] configs: colibri-imx7: allow accessing job-rings from non-TrustZone Emanuele Ghidoli
2 siblings, 1 reply; 5+ messages in thread
From: Emanuele Ghidoli @ 2024-03-25 11:46 UTC (permalink / raw
To: u-boot, NXP i . MX U-Boot Team, Gaurav Jain, Fabio Estevam,
Breno Matheus Lima, Peng Fan, Marcel Ziswiler
Cc: Emanuele Ghidoli
From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Add a new kconfig option to allow non-secure world access
to the CAAM Job Ring.
This is needed, for example, when running linux without
OP-TEE services, as it's done on Colibri iMX7.
Fixes: 51f1357f3428 ("Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"")
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
---
drivers/crypto/fsl/Kconfig | 7 +++++++
drivers/crypto/fsl/jr.c | 19 +++++++++++++++++++
drivers/crypto/fsl/jr.h | 2 ++
3 files changed, 28 insertions(+)
diff --git a/drivers/crypto/fsl/Kconfig b/drivers/crypto/fsl/Kconfig
index eaad19633f1d..e95675ee3e8e 100644
--- a/drivers/crypto/fsl/Kconfig
+++ b/drivers/crypto/fsl/Kconfig
@@ -62,6 +62,13 @@ config SYS_FSL_SEC_LE
if FSL_CAAM
+config FSL_CAAM_JR_NTZ_ACCESS
+ bool "Give caam Job Ring access to non-secure world"
+ default n
+ help
+ It is needed when OP-TEE is not used and Freescale CAAM Job Ring linux
+ driver is used.
+
config FSL_CAAM_RNG
bool "Enable Random Number Generator support"
depends on DM_RNG
diff --git a/drivers/crypto/fsl/jr.c b/drivers/crypto/fsl/jr.c
index ceb66dd6270d..203f16252159 100644
--- a/drivers/crypto/fsl/jr.c
+++ b/drivers/crypto/fsl/jr.c
@@ -673,6 +673,21 @@ static int rng_init(uint8_t sec_idx, ccsr_sec_t *sec)
return ret;
}
+#if CONFIG_IS_ENABLED(FSL_CAAM_JR_NTZ_ACCESS)
+static void jr_setown_non_trusted(ccsr_sec_t *sec)
+{
+ u32 jrown_ns;
+ int i;
+
+ /* Set ownership of job rings to non-TrustZone mode */
+ for (i = 0; i < ARRAY_SIZE(sec->jrliodnr); i++) {
+ jrown_ns = sec_in32(&sec->jrliodnr[i].ms);
+ jrown_ns |= JROWN_NS | JRMID_NS;
+ sec_out32(&sec->jrliodnr[i].ms, jrown_ns);
+ }
+}
+#endif
+
int sec_init_idx(uint8_t sec_idx)
{
int ret = 0;
@@ -761,6 +776,10 @@ int sec_init_idx(uint8_t sec_idx)
#if CONFIG_IS_ENABLED(OF_CONTROL)
init:
#endif
+#if CONFIG_IS_ENABLED(FSL_CAAM_JR_NTZ_ACCESS)
+ jr_setown_non_trusted(sec);
+#endif
+
ret = jr_init(sec_idx, caam);
if (ret < 0) {
printf("SEC%u: initialization failed\n", sec_idx);
diff --git a/drivers/crypto/fsl/jr.h b/drivers/crypto/fsl/jr.h
index 4e4c4af5805f..b136cd8d05a9 100644
--- a/drivers/crypto/fsl/jr.h
+++ b/drivers/crypto/fsl/jr.h
@@ -37,6 +37,8 @@
#define JRNSLIODN_MASK 0x0fff0000
#define JRSLIODN_SHIFT 0
#define JRSLIODN_MASK 0x00000fff
+#define JROWN_NS 0x00000008
+#define JRMID_NS 0x00000001
#define JRDID_MS_PRIM_DID BIT(0)
#define JRDID_MS_PRIM_TZ BIT(4)
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v1 2/3] configs: colibri-imx7: set non-secure boot mode as default
2024-03-25 11:46 [PATCH v1 0/3] crypto/fsl: allow accessing Job Ring from non-TrustZone Emanuele Ghidoli
2024-03-25 11:46 ` [PATCH v1 1/3] " Emanuele Ghidoli
@ 2024-03-25 11:46 ` Emanuele Ghidoli
2024-03-25 11:46 ` [PATCH v1 3/3] configs: colibri-imx7: allow accessing job-rings from non-TrustZone Emanuele Ghidoli
2 siblings, 0 replies; 5+ messages in thread
From: Emanuele Ghidoli @ 2024-03-25 11:46 UTC (permalink / raw
To: u-boot, NXP i . MX U-Boot Team, Gaurav Jain, Fabio Estevam,
Breno Matheus Lima, Peng Fan, Marcel Ziswiler
Cc: Emanuele Ghidoli
From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Linux kernel is supposed to run in non-secure world,
fix the defconfig accordingly.
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
---
configs/colibri_imx7_emmc_defconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/configs/colibri_imx7_emmc_defconfig b/configs/colibri_imx7_emmc_defconfig
index 9d4423cd0d6a..8dd9fe6e6a38 100644
--- a/configs/colibri_imx7_emmc_defconfig
+++ b/configs/colibri_imx7_emmc_defconfig
@@ -8,7 +8,6 @@ CONFIG_DEFAULT_DEVICE_TREE="imx7d-colibri-emmc-eval-v3"
CONFIG_TARGET_COLIBRI_IMX7=y
CONFIG_TARGET_COLIBRI_IMX7_EMMC=y
CONFIG_OF_LIBFDT_OVERLAY=y
-CONFIG_ARMV7_BOOT_SEC_DEFAULT=y
CONFIG_IMX_RDC=y
CONFIG_IMX_BOOTAUX=y
CONFIG_IMX_HAB=y
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v1 3/3] configs: colibri-imx7: allow accessing job-rings from non-TrustZone
2024-03-25 11:46 [PATCH v1 0/3] crypto/fsl: allow accessing Job Ring from non-TrustZone Emanuele Ghidoli
2024-03-25 11:46 ` [PATCH v1 1/3] " Emanuele Ghidoli
2024-03-25 11:46 ` [PATCH v1 2/3] configs: colibri-imx7: set non-secure boot mode as default Emanuele Ghidoli
@ 2024-03-25 11:46 ` Emanuele Ghidoli
2 siblings, 0 replies; 5+ messages in thread
From: Emanuele Ghidoli @ 2024-03-25 11:46 UTC (permalink / raw
To: u-boot, NXP i . MX U-Boot Team, Gaurav Jain, Fabio Estevam,
Breno Matheus Lima, Peng Fan, Marcel Ziswiler
Cc: Emanuele Ghidoli
From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Set FSL_CAAM_JR_NTZ_ACCESS configuration since colibri-imx7
uses Freescale CAAM Job Ring linux driver
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
---
configs/colibri_imx7_defconfig | 1 +
configs/colibri_imx7_emmc_defconfig | 1 +
2 files changed, 2 insertions(+)
diff --git a/configs/colibri_imx7_defconfig b/configs/colibri_imx7_defconfig
index 0c6a272ddfc6..16f923b07c22 100644
--- a/configs/colibri_imx7_defconfig
+++ b/configs/colibri_imx7_defconfig
@@ -72,6 +72,7 @@ CONFIG_SERVERIP="192.168.10.1"
CONFIG_BOUNCE_BUFFER=y
CONFIG_BOOTCOUNT_LIMIT=y
CONFIG_BOOTCOUNT_ENV=y
+CONFIG_FSL_CAAM_JR_NTZ_ACCESS=y
CONFIG_DFU_NAND=y
CONFIG_USB_FUNCTION_FASTBOOT=y
CONFIG_FASTBOOT_BUF_ADDR=0x81100000
diff --git a/configs/colibri_imx7_emmc_defconfig b/configs/colibri_imx7_emmc_defconfig
index 8dd9fe6e6a38..7c6a725ea9a2 100644
--- a/configs/colibri_imx7_emmc_defconfig
+++ b/configs/colibri_imx7_emmc_defconfig
@@ -61,6 +61,7 @@ CONFIG_USE_SERVERIP=y
CONFIG_SERVERIP="192.168.10.1"
CONFIG_BOOTCOUNT_LIMIT=y
CONFIG_BOOTCOUNT_ENV=y
+CONFIG_FSL_CAAM_JR_NTZ_ACCESS=y
CONFIG_USB_FUNCTION_FASTBOOT=y
CONFIG_FASTBOOT_BUF_ADDR=0x81100000
CONFIG_FASTBOOT_FLASH=y
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v1 1/3] crypto/fsl: allow accessing Job Ring from non-TrustZone
2024-03-25 11:46 ` [PATCH v1 1/3] " Emanuele Ghidoli
@ 2024-03-25 12:17 ` Fabio Estevam
0 siblings, 0 replies; 5+ messages in thread
From: Fabio Estevam @ 2024-03-25 12:17 UTC (permalink / raw
To: Emanuele Ghidoli
Cc: u-boot, NXP i . MX U-Boot Team, Gaurav Jain, Breno Matheus Lima,
Peng Fan, Marcel Ziswiler, Emanuele Ghidoli
Hi Emanuele,
On Mon, Mar 25, 2024 at 8:47 AM Emanuele Ghidoli
<ghidoliemanuele@gmail.com> wrote:
> +config FSL_CAAM_JR_NTZ_ACCESS
> + bool "Give caam Job Ring access to non-secure world"
Please spell CAAM instead.
> + default n
'default n' is already the default, please drop this line.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-03-25 12:17 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-03-25 11:46 [PATCH v1 0/3] crypto/fsl: allow accessing Job Ring from non-TrustZone Emanuele Ghidoli
2024-03-25 11:46 ` [PATCH v1 1/3] " Emanuele Ghidoli
2024-03-25 12:17 ` Fabio Estevam
2024-03-25 11:46 ` [PATCH v1 2/3] configs: colibri-imx7: set non-secure boot mode as default Emanuele Ghidoli
2024-03-25 11:46 ` [PATCH v1 3/3] configs: colibri-imx7: allow accessing job-rings from non-TrustZone Emanuele Ghidoli
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.