1. 08 2月, 2018 14 次提交
  2. 07 2月, 2018 2 次提交
  3. 06 2月, 2018 14 次提交
  4. 05 2月, 2018 6 次提交
  5. 04 2月, 2018 4 次提交
    • T
      Merge git://git.denx.de/u-boot-dm · 211a3a23
      Tom Rini 提交于
      211a3a23
    • T
      Merge git://git.denx.de/u-boot-imx · ab1af910
      Tom Rini 提交于
      ab1af910
    • B
      imx: mx7: run sec_init for CAAM RNG · d1ceb0c4
      Bryan O'Donoghue 提交于
      This patch adds a sec_init call into arch_misc_init(). Doing so in
      conjunction with the patch "drivers/crypto/fsl: assign job-rings to
      non-TrustZone" enables use of the CAAM in Linux when OPTEE/TrustZone is
      active.
      
      u-boot will initialise the RNG and assign ownership of the job-ring
      registers to a non-TrustZone context. With recent changes by Lukas Auer to
      fully initialize the RNG in sec_init() this means that u-boot will hand-off
      the CAAM in a state that Linux then can use the CAAM without touching the
      reserved DECO registers.
      
      This change is safe both for the OPTEE/TrustZone boot path and the regular
      non-OPTEE/TrustZone boot path.
      Signed-off-by: NBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Cc: Fabio Estevam <fabio.estevam@nxp.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      Cc: Marco Franchi <marco.franchi@nxp.com>
      Cc: Vanessa Maegima <vanessa.maegima@nxp.com>
      Cc: Stefano Babic <sbabic@denx.de>
      Cc: Lukas Auer <lukas.auer@aisec.fraunhofer.de>
      Tested-by: NLukas Auer <lukas.auer@aisec.fraunhofer.de>
      Reviewed-by: NFabio Estevam <fabio.estevam@nxp.com>
      d1ceb0c4
    • B
      drivers/crypto/fsl: assign job-rings to non-TrustZone · 22191ac3
      Bryan O'Donoghue 提交于
      After enabling TrustZone various parts of the CAAM silicon become
      inaccessible to non TrustZone contexts. The job-ring registers are designed
      to allow non TrustZone contexts like Linux to still submit jobs to CAAM
      even after TrustZone has been enabled.
      
      The default job-ring permissions after the BootROM look like this for
      job-ring zero.
      
      ms=0x00008001 ls=0x00008001
      
      The MS field is JRaMIDR_MS (job ring MID most significant).
      
      Referring to "Security Reference Manual for i.MX 7Dual and 7Solo
      Applications Processors, Rev. 0, 03/2017" section 8.10.4 we see that
      JROWN_NS controls whether or not a job-ring is accessible from non
      TrustZone.
      
      Bit 15 (TrustZone) is the logical inverse of bit 3 hence the above value of
      0x8001 shows that JROWN_NS=0 and TrustZone=1.
      
      Clearly then as soon as TrustZone becomes active the job-ring registers are
      no longer accessible from Linux, which is not what we want.
      
      This patch explicitly sets all job-ring registers to JROWN_NS=1 (non
      TrustZone) by default and to the Non-Secure MID 001. Both settings are
      required to successfully assign a job-ring to non-secure mode. If a piece
      of TrustZone firmware requires ownership of job-ring registers it can unset
      the JROWN_NS bit itself.
      
      This patch in conjunction with a modification of the Linux kernel to skip
      HWRNG initialisation makes CAAM usable to Linux with TrustZone enabled.
      Signed-off-by: NBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Cc: Fabio Estevam <fabio.estevam@nxp.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      Cc: Alex Porosanu <alexandru.porosanu@nxp.com>
      Cc: Ruchika Gupta <ruchika.gupta@nxp.com>
      Cc: Aneesh Bansal <aneesh.bansal@nxp.com>
      Link: https://github.com/OP-TEE/optee_os/issues/1408
      Link: https://tinyurl.com/yam5gv9aTested-by: NLukas Auer <lukas.auer@aisec.fraunhofer.de>
      22191ac3