LX2160A get MP key failed Hi NXP, We are building LX2160A secure boot system based on LLDP and verifying MP key function. Install and start up the secure boot system on our LX2160A board are OK and so we think ITS bit value is 1, but get "Device is not initiated" error after execute "mp_app -p" command. Do you have any advice to check this issue ? Thank you, Jeffrey Re: LX2160A get MP key failed Did customer follow LLDP document section 6.4.4?
Such as
Run tee-supplicant & command from the Linux prompt.
Depending on the Linux kernel version used insmod securekeydev.ko from right folder
Please also let customer enable kernel printk when run 'mp_app', and share their log.
echo 8 > /proc/sys/kernel/printk
dmesg Re: LX2160A get MP key failed Hi yipingwang, Yes, we start tee-supplicant and load securekeydev.ko before execute mp_app command. The following is dmesg information. Jeffrey Re: LX2160A get MP key failed Please refer to the following update from the AE team.
From customer's feedback, I can see "error: caam_submit_mp_get_pub_key_op: submit_job", it indicates send job to SEC failed.
Please ask customer do below test in their Linux system, 1. run xtest, to see any error report? 2. please run "modprobe caam" to install caam module for LX2160, if install module failed, please update modules compatible with your kernel version. 3. If also report error, apply below patch to check SEC return result to identify the error type, and share their full log.
diff --git a/securekeydev/securekey_caam.c b/securekeydev/securekey_caam.c
index b82acd3..d657742 100644
--- a/securekeydev/securekey_caam.c
+++ b/securekeydev/securekey_caam.c
@@ -59,12 +59,14 @@ static int submit_job(struct device *jrdev, uint32_t *desc)
/* Call caam_jr_enqueue function for Enqueue a job descriptor head. */
ret = caam_jr_enqueue(jrdev, desc, caam_op_done, NULL);
+ pr_err("caam_jr_enqueue ret (%d)\n", ret);
if (!ret)
wait_for_completion_interruptible(&comp);
else
return ret;
ret = job_comp_status;
+ pr_err("job_comp_status ret (%d)\n", ret);
return ret;
}
Regards, Re: LX2160A get MP key failed About your comments, 1. run xtest, to see any error report? Please refer to attached xtest log. 2. please run "modprobe caam" to install caam module for LX2160, if install module failed, please update modules compatible with your kernel version. We built caam module in kernel already. 3. If also report error, apply below patch to check SEC return result to identify the error type, and share their full log. The dmesg about caam and mp_app return as below. Thank you. Re: LX2160A get MP key failed 1. Please make sure caam job ring work well in Linux kernel, please run below command to check caam jr interrupt increase or not
root@localhost:~# cat /proc/interrupts | grep jr
378: 41 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 GICv3 172 Level 8010000.jr
379: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 GICv3 173 Level 8020000.jr
380: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 GICv3 174 Level fsl-jr0
root@localhost:~#
root@localhost:~#
root@localhost:~# dd if=/dev/hwrng of=/tmp/random.dat bs=1 count=16
16+0 records in
16+0 records out
16 bytes copied, 0.000420759 s, 38.0 kB/s
root@localhost:~#
root@localhost:~#
root@localhost:~# cat /proc/interrupts | grep jr
378: 42 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 GICv3 172 Level 8010000.jr
379: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 GICv3 173 Level 8020000.jr
380: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 GICv3 174 Level fsl-jr0
root@localhost:~#
2. In submit_job() the called function caam_jr_enqueue() return (-EINPROGRESS = -115) on success. Please try apply below patch to check caam enqueue return result. https://github.com/nxp-qoriq/linux/commit/4d370a1036958d7df9f1492c345b4984a4eba7f6#diff-8acc41c534456288daba59a125ddb3f779635dc493ff4888545adbf1dd0a17c1R327
diff --git a/securekeydev/securekey_caam.c b/securekeydev/securekey_caam.c
index b82acd3..808e8da 100644
--- a/securekeydev/securekey_caam.c
+++ b/securekeydev/securekey_caam.c
@@ -59,12 +59,14 @@ static int submit_job(struct device *jrdev, uint32_t *desc)
/* Call caam_jr_enqueue function for Enqueue a job descriptor head. */
ret = caam_jr_enqueue(jrdev, desc, caam_op_done, NULL);
- if (!ret)
+ pr_err("caam_jr_enqueue ret (%d)\n", ret);
+ if (ret == -EINPROGRESS)
wait_for_completion_interruptible(&comp);
else
return ret;
ret = job_comp_status;
+ pr_err("job_comp_status ret (%d)\n", ret);
return ret;
}
Re: LX2160A get MP key failed 1. Please make sure caam job ring work well in Linux kernel, please run below command to check caam jr interrupt increase or not Ans: Yes 2. In submit_job() the called function caam_jr_enqueue() return (-EINPROGRESS = -115) on success. Please try apply below patch to check caam enqueue return result. Ans: Our system uses Linux kernel v5.15.71-rt51 and it seems need not do any additional patches. 3. In addition, after run mp_app -p command, the process stops at wait_for_completion_interruptible() and it is waiting the return so far. Re: LX2160A get MP key failed Please double check your kernel source code. caam_jr_enqueue() has update return value in this brach. https://github.com/nxp-qoriq/linux/blob/95448dd0dc9b621ae027cbefedaaa7c3d0d3ad2d/drivers/crypto/caam/jr.c#L565 Re: LX2160A get MP key failed Please refer to the following update from the AE team.
Customer can check whether ITS bit enabled by u-boot 'md' command. md 0x1e80200
Can customer share caam_jr_enqueue() function source code? The source code path is "linux/drivers/crypto/caam/jr.c". Or they can share us their source code link. Re: LX2160A get MP key failed We checked all drivers/crypto/caam source files and they are the same. We enable ITS by uboot scripts as below mw.l 0x1e80200 0x4 mw.l 0x1e80020 0x2 Do you think the ITS activation process is incomplete ? Re: LX2160A get MP key failed Register value please see below and jr.c source code please see attached file . Re: LX2160A get MP key failed We have patched submit_job() as you mentioned before and the result is stops at "wait_for_completion_interruptible" after run "mp_app -p". According to the description from LSDK and LLDP user manual, security applications are fully validated and verified on LS1046ARDB platform, we verify this issue on our LS1046 board with LSDK and it's working. Verify our another LX2160 product with LSDK and it also stops at "wait_for_completion_interruptible". Whether use LSDK or LLDP, we get the some issue on LX2160A platform. Did NXP do security applications validation on LX2160A platform ? Re: LX2160A get MP key failed ITS bit has been blown. Check your jr.c source code, you need to apply the patch for submit_job.
diff --git a/securekeydev/securekey_caam.c b/securekeydev/securekey_caam.c
index b82acd3..808e8da 100644
--- a/securekeydev/securekey_caam.c
+++ b/securekeydev/securekey_caam.c
@@ -59,12 +59,14 @@ static int submit_job(struct device *jrdev, uint32_t *desc)
/* Call caam_jr_enqueue function for Enqueue a job descriptor head. */
ret = caam_jr_enqueue(jrdev, desc, caam_op_done, NULL);
- if (!ret)
+ pr_err("caam_jr_enqueue ret (%d)\n", ret);
+ if (ret == -EINPROGRESS)
wait_for_completion_interruptible(&comp);
else
return ret;
ret = job_comp_status;
+ pr_err("job_comp_status ret (%d)\n", ret);
return ret;
}
Re: LX2160A get MP key failed Please refer to the following update from the AE team.
1. Team confirms that this feature just be performed on LS1046A board as LSDK document mentioned. 2. From customer running log for LX2160 and LS1046, both run with LSDK20.04, kernel version 4.19, caam_jr_enqueue() return 0 in this version, not need apply my patch. https://github.com/nxp-qoriq/linux/blob/94e0473db2feed7ed6b84848c8d227faf72297c2/drivers/crypto/caam/jr.c#L408 3. I need further test on my side.
Will update when get findings.
查看全文
