LX2160A get MP key failed

[Jeffrey_Lai]

Hi NXP,

We are building LX2160A secure boot system based on LLDP and verifying MP key function.

Install and start up the secure boot system on our LX2160A board are OK and so we think ITS bit value is 1, but get "Device is not initiated" error after execute "mp_app -p" command.

Do you have any advice to check this issue ?

Thank you,

Jeffrey 

[yipingwang]

Did customer follow LLDP document section 6.4.4?

Such as

3. Run tee-supplicant & command from the Linux prompt.
4. Depending on the Linux kernel version used insmod securekeydev.ko from right folder

Please also let customer enable kernel printk when run 'mp_app', and share their log.

echo 8 > /proc/sys/kernel/printk

dmesg

[Jeffrey_Lai]

Hi yipingwang,

Yes, we start tee-supplicant and load securekeydev.ko before execute mp_app command.

The following is dmesg information.

Jeffrey

[yipingwang]

Please refer to the following update from the AE team.

From customer's feedback, I can see "error: caam_submit_mp_get_pub_key_op: submit_job", it indicates send job to SEC failed.

Please ask customer do below test in their Linux system,
1. run xtest, to see any error report?
2. please run "modprobe caam" to install caam module for LX2160, if install module failed, please update modules compatible with your kernel version.
3. If also report error, apply below patch to check SEC return result to identify the error type, and share their full log.

diff --git a/securekeydev/securekey_caam.c b/securekeydev/securekey_caam.c
index b82acd3..d657742 100644
--- a/securekeydev/securekey_caam.c
+++ b/securekeydev/securekey_caam.c
@@ -59,12 +59,14 @@ static int submit_job(struct device *jrdev, uint32_t *desc)

        /* Call caam_jr_enqueue function for Enqueue a job descriptor head. */
        ret = caam_jr_enqueue(jrdev, desc, caam_op_done, NULL);
+       pr_err("caam_jr_enqueue ret (%d)\n", ret);
        if (!ret)
                wait_for_completion_interruptible(&comp);
        else
                return ret;

        ret = job_comp_status;
+       pr_err("job_comp_status ret (%d)\n", ret);
        return ret;
 }

Regards,

[Jeffrey_Lai]

About your comments,

1. run xtest, to see any error report?

Please refer to attached xtest log.

2. please run "modprobe caam" to install caam module for LX2160, if install module failed, please update modules compatible with your kernel version.

We built caam module in kernel already.

3. If also report error, apply below patch to check SEC return result to identify the error type, and share their full log.

The dmesg about caam and mp_app return as below.

Thank you.

[yipingwang]

1. Please make sure caam job ring work well in Linux kernel, please run below command to check caam jr interrupt increase or not

root@localhost:~# cat /proc/interrupts | grep jr
378:         41          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 172 Level     8010000.jr
379:          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 173 Level     8020000.jr
380:          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 174 Level     fsl-jr0
root@localhost:~#
root@localhost:~#
root@localhost:~# dd if=/dev/hwrng of=/tmp/random.dat bs=1 count=16
16+0 records in
16+0 records out
16 bytes copied, 0.000420759 s, 38.0 kB/s
root@localhost:~#
root@localhost:~#
root@localhost:~# cat /proc/interrupts | grep jr
378:         42          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 172 Level     8010000.jr
379:          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 173 Level     8020000.jr
380:          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0          0     GICv3 174 Level     fsl-jr0
root@localhost:~#

2. In submit_job() the called function caam_jr_enqueue() return (-EINPROGRESS = -115) on success. Please try apply below patch to check caam enqueue return result.
https://github.com/nxp-qoriq/linux/commit/4d370a1036958d7df9f1492c345b4984a4eba7f6#diff-8acc41c53445...

diff --git a/securekeydev/securekey_caam.c b/securekeydev/securekey_caam.c
index b82acd3..808e8da 100644
--- a/securekeydev/securekey_caam.c
+++ b/securekeydev/securekey_caam.c
@@ -59,12 +59,14 @@ static int submit_job(struct device *jrdev, uint32_t *desc)

        /* Call caam_jr_enqueue function for Enqueue a job descriptor head. */
        ret = caam_jr_enqueue(jrdev, desc, caam_op_done, NULL);
-       if (!ret)
+       pr_err("caam_jr_enqueue ret (%d)\n", ret);
+       if (ret == -EINPROGRESS)
                wait_for_completion_interruptible(&comp);
        else
                return ret;

        ret = job_comp_status;
+       pr_err("job_comp_status ret (%d)\n", ret);
        return ret;
 }

[Jeffrey_Lai]

1. Please make sure caam job ring work well in Linux kernel, please run below command to check caam jr interrupt increase or not

Ans: Yes

2. In submit_job() the called function caam_jr_enqueue() return (-EINPROGRESS = -115) on success. Please try apply below patch to check caam enqueue return result.

Ans: Our system uses Linux kernel v5.15.71-rt51 and it seems need not do any additional patches.

3. In addition, after run mp_app -p command, the process stops at wait_for_completion_interruptible() and it is waiting the return so far.