DM-Crypt usage on i.MX Platforms without CAAM hardware IP

wooosaiiii — Mon, 18 May 2026 10:41:03 GMT

Hi,

I am following a "DM-Crypt usage on i.MX Platforms without CAAM hardware IP" guide from NXP on i.MX93 board.

I am using the following steps:

modprobe dm-crypt modprobe tee_crypto modprobe trusted export DEV=/dev/loop0 dd if=/dev/zero of=/data/encrypted.img bs=1M count=512 losetup -P $DEV /data/encrypted.img export KEYNAME=dm_trustedkey export KEY="$(keyctl add trusted $KEYNAME 'new 32' @s)" keyctl pipe $KEY >/data/$KEYNAME.blob keyctl list @s export ALGO="capi:cbc-aes-tee-plain" export BLOCKS=$(blockdev --getsz /dev/loop0) export SECTOR_SIZE=4096 export TABLE="0 $BLOCKS crypt $ALGO :32:trusted:$KEYNAME 0 $DEV 0 1 sector_size:$SECTOR_SIZE" dmsetup -v create encrypted --table "$TABLE"

However, my kernel crashes with the following OOPS:

[ 713.174934] Unable to handle kernel paging request at virtual address ffff8000a1fca858 [ 713.182908] Mem abort info: [ 713.185716] ESR = 0x0000000096000006 [ 713.189477] EC = 0x25: DABT (current EL), IL = 32 bits [ 713.194786] SET = 0, FnV = 0 [ 713.197848] EA = 0, S1PTW = 0 [ 713.200993] FSC = 0x06: level 2 translation fault [ 713.205873] Data abort info: [ 713.208762] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 713.214246] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 713.219296] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 713.224611] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000089bcd000 [ 713.231309] [ffff8000a1fca858] pgd=10000000fffff003, p4d=10000000fffff003, pud=10000000ffffe003, pmd=0000000000000000 [ 713.241943] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ 713.248199] Modules linked in: tee_crypto dm_crypt crct10dif_ce polyval_ce polyval_generic layerscape_edac_mod rtc_rv8803 at24 btnxpuart flexcan can_dev cfg80211 fuse overlay trusted [ 713.264459] CPU: 0 PID: 532 Comm: dmsetup Not tainted 6.6.52-lts-next-07235-gfdd32c7240b4 #1 [ 713.272880] Hardware name: EVVA i.MX93 Gateway (DT) [ 713.277743] pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 713.284694] pc : osq_lock+0x5c/0x134 [ 713.288270] lr : __mutex_lock.constprop.0+0x1f0/0x540 [ 713.293317] sp : ffff800083543750 [ 713.296616] x29: ffff800083543750 x28: ffff000001e3417a x27: 0000000000000001 [ 713.303743] x26: ffff000000a43e00 x25: ffff000005b7dbf0 x24: 00000000ffffffff [ 713.310864] x23: 0000000000000002 x22: fffffc000002e4c0 x21: fffffc000002e884 [ 713.317988] x20: ffff800083543768 x19: fffffc000002e878 x18: 0000000000000001 [ 713.325112] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 713.332239] x14: 0000000000000000 x13: 01485ce3a37a7a58 x12: ed352f5eedb722c0 [ 713.339360] x11: 0101010101010101 x10: fffffffffa67a3b3 x9 : 0000000000000000 [ 713.346484] x8 : ffff800083543920 x7 : 0000000000000000 x6 : 000000000000003f [ 713.353608] x5 : 0000000000000040 x4 : 0000000003fffbff x3 : ffff800081fcc860 [ 713.360732] x2 : ffff800081cf0d00 x1 : ffff00007fb98d00 x0 : fffffc000002e884 [ 713.367859] Call trace: [ 713.370294] osq_lock+0x5c/0x134 [ 713.373518] __mutex_lock.constprop.0+0x1f0/0x540 [ 713.378215] __mutex_lock_slowpath+0x14/0x20 [ 713.382479] mutex_lock+0x48/0x54 [ 713.385787] tee_device_get+0x20/0x6c [ 713.389444] register_shm_helper+0x3c/0x2e8 [ 713.393624] tee_shm_register_kernel_buf+0x18/0x24 [ 713.398408] skcipher_setkey+0xe8/0x21c [tee_crypto] [ 713.403374] cbc_skcipher_setkey+0x38/0x7c [tee_crypto] [ 713.408589] crypto_skcipher_setkey+0x6c/0x124 [ 713.413029] crypt_setkey+0x104/0x22c [dm_crypt] [ 713.417658] crypt_set_key+0x248/0x360 [dm_crypt] [ 713.422354] crypt_ctr+0x634/0xfb8 [dm_crypt] [ 713.426705] dm_table_add_target+0x218/0x380 [ 713.430969] table_load+0x140/0x3f0 [ 713.434453] ctl_ioctl+0x378/0x648 [ 713.437851] dm_ctl_ioctl+0x10/0x20 [ 713.441334] __arm64_sys_ioctl+0xac/0xf0 [ 713.445252] invoke_syscall+0x48/0x114 [ 713.448996] el0_svc_common.constprop.0+0xc0/0xe0 [ 713.453693] do_el0_svc+0x1c/0x28 [ 713.457001] el0_svc+0x40/0xe4 [ 713.460055] el0t_64_sync_handler+0x120/0x12c [ 713.464402] el0t_64_sync+0x190/0x194 [ 713.468066] Code: 340005c4 51000484 d000f723 91218063 (f864d863) [ 713.474147] ---[ end trace 0000000000000000 ]--- [ 713.478800] note: dmsetup[532] exited with preempt_count 1

I am using 6.6.52_2.2.2 scarthgap release.

I think the problematic driver is drivers/tee/crypto/tee_skcipher.c.

Here is the output when loading the kernel module:

[ 665.731673] tee_client_open_session failed, err: ffff0008 [ 665.737206] tee_crypt algorithms registered in /proc/crypto [ 665.742835] driver 1.0 loaded.

The prerequisites from the document have been fulfilled in our BSP:

Prerequisites:
Ensure that a region of OCRAM is reserved to be accessed by Secure World only. This region is used to save cryptographic keys. Current OCRAM reserved regions:

For i.MX 93: 0x20518000 - 0x2051C000
For i.MX 95: 0x204BC000 - 0x204C0000
For i.MX 91: 0x204A0000 - 0x204A4000
For i.MX 943: 0x204BC000 - 0x204C0000

Make sure the following configurations are enabled in the kernel:
CONFIG_TEE_CRYPTO = m
CONFIG_DM_CRYPT = m
CONFIG_TRUSTED_KEYS = m
CONFIG_TRUSTED_KEYS_CAAM = n
CONFIG_TRUSTED_KEYS_TEE = y

In OP-TEE, check whether the following flags in the core/arch/arm/plat-imx/conf.mk platform specific section for which DM-crypt are enabled or not:
CFG_IMX_TRUSTED_ARM_CE = y
CFG_IN_TREE_EARLY_TAS += trusted_keys/f04a0fe7-1f5d-4b9b-abf7-619b85b4ce8c

Any ideas what might be an issue here?

Re: DM-Crypt usage on i.MX Platforms without CAAM hardware IP

wooosaiiii — Mon, 18 May 2026 13:37:50 GMT

Fixed it. I forgot to update optee blob when rebuilding with CFG_IMX_TRUSTED_ARM_CE = y.

Can be closed.

topic DM-Crypt usage on i.MX Platforms without CAAM hardware IP in i.MX Processors

DM-Crypt usage on i.MX Platforms without CAAM hardware IP

Re: DM-Crypt usage on i.MX Platforms without CAAM hardware IP