iMX6UL CAAM

[danielberhe]

Hi All,

I'm having some issues getting the CAAM to work on my custom board based on iMX6UL. The probe is failing during Linux (imx_5.4.70_2.3.0) boot with the following error:
# dmesg | grep caam
[ 9.162387] caam 2140000.caam: device ID = 0x0000000000000000 (Era -524)
[ 9.169252] caam 2140000.caam: job rings = 3, qi = 0
[ 9.191095] caam_jr 2141000.jr0: failed to flush job ring 0
[ 9.202037] caam_jr: probe of 2141000.jr0 failed with error -5
[ 9.210238] caam_jr 2142000.jr1: failed to flush job ring 1
[ 9.217164] caam_jr: probe of 2142000.jr1 failed with error -5
[ 9.225181] caam_jr 2143000.jr2: failed to flush job ring 2
[ 9.232880] caam_jr: probe of 2143000.jr2 failed with error -5
[ 9.241476] caam-snvs 20cc000.caam-snvs: violation handlers armed - non-secure state

I also tried running rng_self_test() in uboot but that fails as well. I got rng_self_test from here (my silicon version is 1.2). My uboot already has the patches mentioned in the troubleshoot section in the link.
Error while running RNG self-test descriptor: -2

Has the CAAM module worked for anyone on the iMX6UL?

Best wishes,
Daniel

[igorpadykov]

Hi danielberhe

one can try to test it on i.MX6UL EVK with Demo Image

​i.MX 6UltraLite, i.MX 6ULL, i.MX 7Dual Boards​

simple caam test:

https://source.codeaurora.org/external/imx/imx-test/tree/test/caam?h=imx_5.4.70_2.3.0

Best regards
igor

[danielberhe]

Thanks for the response @igorpadykov.

Unfortunately I don't have access an EVK at the moment so I can't test it immediately and I'm not sure if I will be able to find an EVK with the exact part number as my custom board.

Can you please confirm that my part number MCIMX6G0DVM05AB supports HAB and booting signed uboot?

Regards,

Daniel

[igorpadykov · Accepted solution]

Hi Daniel

you are right, MCIMX6G0 does not support secure boot (HAB).

Best regards
igor

[danielberhe]

Thank you for confirming this @igorpadykov.

Could you please tell me which document contains the information specifying which security features are supported on which part? I have signed the NXP NDA but would like to know which document to request from my NXP representative.

I am aware of the datasheet and that it specifies that no standard or enhanced security features are available for the part I'm using, but I couldn't find anywhere exactly what constitutes as standard or enhanced. I already have the security reference manual for the iMX6UL, but it doesn't mention any variation between different parts. I am keen to know the difference between 'no security', 'standard security', and 'enhanced security'.

Looking forward to your reply.

Daniel

[igorpadykov]

Hi Daniel

I am afraid such document is not available, sorry.

Previous answer was provided from internal team.

Best regards
igor

[danielberhe]

Thank you so much for all your help @igorpadykov.

I am changing the part on my board to MCIMX6G2CVM05AB. Could you please confirm that this part is capable of high assurance boot (signed uboot) and that I can use the CAAM module?

Regards,
Daniel

[igorpadykov]

yes this part supports secure boot (HAB).

Best regards
igor