LX2160A get MP key failed

[Jeffrey_Lai]

Hi NXP,

We are building LX2160A secure boot system based on LLDP and verifying MP key function.

Install and start up the secure boot system on our LX2160A board are OK and so we think ITS bit value is 1, but get "Device is not initiated" error after execute "mp_app -p" command.

Do you have any advice to check this issue ?

Thank you,

Jeffrey 

[yipingwang]

Did customer follow LLDP document section 6.4.4?

Such as

3. Run tee-supplicant & command from the Linux prompt.
4. Depending on the Linux kernel version used insmod securekeydev.ko from right folder

Please also let customer enable kernel printk when run 'mp_app', and share their log.

echo 8 > /proc/sys/kernel/printk

dmesg

[Jeffrey_Lai]

Hi yipingwang,

Yes, we start tee-supplicant and load securekeydev.ko before execute mp_app command.

The following is dmesg information.

Jeffrey

[yipingwang]

Please refer to the following update from the AE team.

From customer's feedback, I can see "error: caam_submit_mp_get_pub_key_op: submit_job", it indicates send job to SEC failed.

Please ask customer do below test in their Linux system,
1. run xtest, to see any error report?
2. please run "modprobe caam" to install caam module for LX2160, if install module failed, please update modules compatible with your kernel version.
3. If also report error, apply below patch to check SEC return result to identify the error type, and share their full log.

diff --git a/securekeydev/securekey_caam.c b/securekeydev/securekey_caam.c
index b82acd3..d657742 100644
--- a/securekeydev/securekey_caam.c
+++ b/securekeydev/securekey_caam.c
@@ -59,12 +59,14 @@ static int submit_job(struct device *jrdev, uint32_t *desc)

        /* Call caam_jr_enqueue function for Enqueue a job descriptor head. */
        ret = caam_jr_enqueue(jrdev, desc, caam_op_done, NULL);
+       pr_err("caam_jr_enqueue ret (%d)\n", ret);
        if (!ret)
                wait_for_completion_interruptible(&comp);
        else
                return ret;

        ret = job_comp_status;
+       pr_err("job_comp_status ret (%d)\n", ret);
        return ret;
 }

Regards,

[Jeffrey_Lai]

About your comments,

1. run xtest, to see any error report?

Please refer to attached xtest log.

2. please run "modprobe caam" to install caam module for LX2160, if install module failed, please update modules compatible with your kernel version.

We built caam module in kernel already.

3. If also report error, apply below patch to check SEC return result to identify the error type, and share their full log.

The dmesg about caam and mp_app return as below.

Thank you.

[yipingwang]

1. Please make sure caam job ring work well in Linux kernel, please run below command to check caam jr interrupt increase or not

root@localhost:~# cat /proc/interrupts | grep jr
378:         41          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 172 Level     8010000.jr
379:          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 173 Level     8020000.jr
380:          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 174 Level     fsl-jr0
root@localhost:~#
root@localhost:~#
root@localhost:~# dd if=/dev/hwrng of=/tmp/random.dat bs=1 count=16
16+0 records in
16+0 records out
16 bytes copied, 0.000420759 s, 38.0 kB/s
root@localhost:~#
root@localhost:~#
root@localhost:~# cat /proc/interrupts | grep jr
378:         42          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 172 Level     8010000.jr
379:          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 173 Level     8020000.jr
380:          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 174 Level     fsl-jr0
root@localhost:~#

2. In submit_job() the called function caam_jr_enqueue() return (-EINPROGRESS = -115) on success. Please try apply below patch to check caam enqueue return result.
https://github.com/nxp-qoriq/linux/commit/4d370a1036958d7df9f1492c345b4984a4eba7f6#diff-8acc41c53445...

diff --git a/securekeydev/securekey_caam.c b/securekeydev/securekey_caam.c
index b82acd3..808e8da 100644
--- a/securekeydev/securekey_caam.c
+++ b/securekeydev/securekey_caam.c
@@ -59,12 +59,14 @@ static int submit_job(struct device *jrdev, uint32_t *desc)

        /* Call caam_jr_enqueue function for Enqueue a job descriptor head. */
        ret = caam_jr_enqueue(jrdev, desc, caam_op_done, NULL);
-       if (!ret)
+       pr_err("caam_jr_enqueue ret (%d)\n", ret);
+       if (ret == -EINPROGRESS)
                wait_for_completion_interruptible(&comp);
        else
                return ret;

        ret = job_comp_status;
+       pr_err("job_comp_status ret (%d)\n", ret);
        return ret;
 }

[Jeffrey_Lai]

1. Please make sure caam job ring work well in Linux kernel, please run below command to check caam jr interrupt increase or not

Ans: Yes

2. In submit_job() the called function caam_jr_enqueue() return (-EINPROGRESS = -115) on success. Please try apply below patch to check caam enqueue return result.

Ans: Our system uses Linux kernel v5.15.71-rt51 and it seems need not do any additional patches.

3. In addition, after run mp_app -p command, the process stops at wait_for_completion_interruptible() and it is waiting the return so far.

 

 

[yipingwang]

Please double check your kernel source code.
caam_jr_enqueue() has update return value in this brach.
https://github.com/nxp-qoriq/linux/blob/95448dd0dc9b621ae027cbefedaaa7c3d0d3ad2d/drivers/crypto/caam...

[Jeffrey_Lai]

We checked all drivers/crypto/caam source files and they are the same.

We enable ITS by uboot scripts as below

mw.l 0x1e80200 0x4

mw.l 0x1e80020 0x2

Do you think the ITS activation process is incomplete ?

[yipingwang]

Please refer to the following update from the AE team.

Customer can check whether ITS bit enabled by u-boot 'md' command.
md 0x1e80200

Can customer share caam_jr_enqueue() function source code? The source code path is "linux/drivers/crypto/caam/jr.c".
Or they can share us their source code link.

[Jeffrey_Lai]

Register value please see below and jr.c source code please see attached file .

[yipingwang]

ITS bit has been blown.
Check your jr.c source code, you need to apply the patch for submit_job.

diff --git a/securekeydev/securekey_caam.c b/securekeydev/securekey_caam.c
index b82acd3..808e8da 100644
--- a/securekeydev/securekey_caam.c
+++ b/securekeydev/securekey_caam.c
@@ -59,12 +59,14 @@ static int submit_job(struct device *jrdev, uint32_t *desc)

        /* Call caam_jr_enqueue function for Enqueue a job descriptor head. */
        ret = caam_jr_enqueue(jrdev, desc, caam_op_done, NULL);
-       if (!ret)
+       pr_err("caam_jr_enqueue ret (%d)\n", ret);
+       if (ret == -EINPROGRESS)
                wait_for_completion_interruptible(&comp);
        else
                return ret;

        ret = job_comp_status;
+       pr_err("job_comp_status ret (%d)\n", ret);
        return ret;
 }

[Jeffrey_Lai]

We have patched submit_job() as you mentioned before and the result is stops at  "wait_for_completion_interruptible" after run "mp_app -p".

According to the description from LSDK and LLDP user manual, security applications are fully validated and verified on LS1046ARDB platform, we verify this issue on our LS1046 board with LSDK and it's working.

Verify our another LX2160 product with LSDK and it also stops at "wait_for_completion_interruptible".

Whether use LSDK or LLDP, we get the some issue on LX2160A platform.

Did NXP do security applications validation on LX2160A platform ?

[yipingwang]

Please refer to the following update from the AE team.

1. Team confirms that this feature just be performed on LS1046A board as LSDK document mentioned.
2. From customer running log for LX2160 and LS1046, both run with LSDK20.04, kernel version 4.19, caam_jr_enqueue() return 0 in this version, not need apply my patch.
https://github.com/nxp-qoriq/linux/blob/94e0473db2feed7ed6b84848c8d227faf72297c2/drivers/crypto/caam...
3. I need further test on my side.

Will update when get findings.