2419783_zh-CN

[#1]

Linux CAAM 驱动程序编译为 =y 而不是 =m

在Linux 6.18.2_1.0.0 及更早版本中，以 CONFIG =y 模式编译 CAAM 驱动程序没有问题。但在较新的 Linux 6.18.20_2.0.0 和 Linux 6.18.37_2.1.0 版本中，这样做会导致内核内置证书错误。

我尝试更改 CAAM 设置，例如 CRYPTO_DEV_FSL_CAAM_PKC、安全密钥和受信任密钥的开启/关闭，这些设置应该使证书部分独立于 CAAM，但证书仍然无法正常工作，直到我将 CAAM 驱动程序切换到 =m 模式。

是否可以使用 CAAM 驱动程序作为 =y？我正在使用 i.MX7。谢谢

Re: LInux CAAM driver compiled =y instead of =m

请禁用“ CONFIG_TRUSTED_KEYS_CAAM”并将其配置为“n”，以检查是否存在此问题。

在 SDK 默认版本配置中，我发现了以下内容。

# CONFIG_TRUSTED_KEYS_CAAM 未设置

Re: LInux CAAM driver compiled =y instead of =m

或许在 6.18.2 版本中就已经存在这个问题了。我不知道。我确定它在 6.12.x 版本中可以正常工作。

启用 CAAM_DEBUG 和

zcat /proc/config.gz | grep CAAM
# CONFIG_CRYPTO_DEV_FSL_CAAM_DMA 未设置
CONFIG_TRUSTED_KEYS_CAAM=y
CONFIG_CRYPTO_DEV_FSL_CAAM_COMMON=y
CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC=y
CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API_DESC=y
CONFIG_CRYPTO_DEV_FSL_CAAM_KEYBLOB_API_DESC=y
CONFIG_CRYPTO_DEV_FSL_CAAM_SECVIO=y
CONFIG_CRYPTO_DEV_FSL_CAAM=y
CONFIG_CRYPTO_DEV_FSL_CAAM_DEBUG=y
CONFIG_CRYPTO_DEV_FSL_CAAM_JR=y
CONFIG_CRYPTO_DEV_FSL_CAAM_RINGSIZE=9
# CONFIG_CRYPTO_DEV_FSL_CAAM_INTC 未设置
CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API=y
CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API=y
CONFIG_CRYPTO_DEV_FSL_CAAM_PKC_API=y
CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_API=y
CONFIG_CRYPTO_DEV_FSL_CAAM_PRNG_API=y
CONFIG_CRYPTO_DEV_FSL_CAAM_BLOB_GEN=y
CONFIG_CRYPTO_DEV_FSL_CAAM_TK_API=y
# CONFIG_CRYPTO_DEV_FSL_CAAM_TK_API_TEST 未设置
# CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_TEST 未设置
CONFIG_CRYPTO_DEV_FSL_CAAM_SM=y
CONFIG_CRYPTO_DEV_FSL_CAAM_SM_SLOTSIZE=7
CONFIG_CRYPTO_DEV_FSL_CAAM_SM_TEST=m

我在 dmesg 中看到了这个

[    0.600724] caam 30900000.crypto: entropy-delay property missing in DT
[    0.600757] caam 30900000.crypto: device ID = 0x0a16030000000000 (Era 8)
[    0.600776] caam 30900000.crypto: job rings = 3, qi = 0
[    0.609580] sdhci-esdhc-imx 30b40000.mmc: Got CD GPIO
[    0.614915] caam algorithms registered in /proc/crypto
[    0.615107] caam 30900000.crypto: caam pkc algorithms registered in /proc/crypto
[    0.615138] caam 30900000.crypto: rng crypto API alg registered prng-caam
[    0.615157] caam 30900000.crypto: registering rng-caam
[    0.615184] 01: operation
[    0.615198] 02: fifo_store
[    0.615217] rng job desc@: (ptrval): b0800004 82500002 60340010 81cf2500  ......P...4`.%..
[    0.615405] 01: operation
[    0.615423] 02: fifo_store
[    0.615440] rng job desc@: (ptrval): b0800004 82500002 60340010 8126fac0  ......P...4`..&.
[    0.616325] Device caam-keygen registered
[    0.620411] caam-snvs 30370000.caam-snvs: ipid matched - 0x3e
[    0.620477] caam-snvs 30370000.caam-snvs: violation handlers armed - non-secure state
[    0.621041] hid: raw HID events driver (C) Jiri Kosina
[    0.621217] usbcore: registered new interface driver usbhid
[    0.621230] usbhid: USB HID core driver
[    0.624128] hw perfevents: enabled with armv7_cortex_a7 PMU driver, 5 (8000000f) counters available
[    0.627983] NET: Registered PF_INET6 protocol family
[    0.629380] Segment Routing with IPv6
[    0.629471] In-situ OAM (IOAM) with IPv6
[    0.629630] NET: Registered PF_PACKET protocol family
[    0.629705] Bridge firewalling registered
[    0.629717] can: controller area network core
[    0.629795] NET: Registered PF_CAN protocol family
[    0.629810] can: raw protocol
[    0.630378] Key type dns_resolver registered
[    0.637395] imx-cpufreq-dt imx-cpufreq-dt: cpu speed grade 2 mkt segment 1 supported-hw 0x4 0x2
[    0.638671] Registering SWP/SWPB emulation handler
[    0.649825] Loading compiled-in X.509 certificates
[    0.650591] 07: operation
[    0.651164] mmc0: SDHCI controller on 30b40000.mmc [30b40000.mmc] using ADMA
[    0.674771] 01: operation
[    0.674791] 02: fifo_store
[    0.674811] rng job desc@: (ptrval): b0800004 82500002 60340010 8126fac0  ......P...4`..&.
[    0.679492] Problem loading in-kernel X.509 certificate (-22)

Re: LInux CAAM driver compiled =y instead of =m

是的，CAAM 原则上可以在 i.MX7 上实现。我会将 =m 解决方法视为依赖项/版本回归的证据，而不是 i.MX7 CAAM 的要求。

如果您能粘贴 LF6.18.20_2.0.0 版本中的第一个证书错误，我可以追踪是哪个 Kconfig/Makefile 依赖项导致了这个问题，并确定是否有需要向后移植的特定 NXP/上游补丁。