imx8ulp caam encryption suspend state error

[GiacomoE]

Platform: iMX8ULP
We are using caam module to encrypt the home partition of our device ad described in [AN12714](https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/imx-processors/172311/1/AN12714_iMX%20En...). We create an encryption key the first time we encrypt the partition and we store the black key blob. On each reboot we extract the black key and we load it the kernel. The key we load in the kernel is a black key, that is a session key becoming invalid between power cycles.
When we put the system in suspend state and we resume it, we get errors from dm-crypt.
I think power to the caam module is disable in suspend state, so the encryption black key becomes invalid.
This seems a common scenario. What is the suggested way to overcome this issue ?

/home/root# ls /home/
/home/root# [ 120.036770] Aborting journal on device dm-3-8.
[ 120.041402] Buffer I/O error on dev dm-3, logical block 65536, lost sync page write
[ 120.049250] JBD2: I/O error when updating journal superblock for dm-3-8.
l
[ 123.246075] EXT4-fs error (device dm-3): ext4_journal_check_start:84: comm sh: Detected aborted journal
[ 123.255851] Buffer I/O error on dev dm-3, logical block 0, lost sync page write
[ 123.263340] EXT4-fs (dm-3): I/O error while writing superblock
[ 123.269292] EXT4-fs (dm-3): Remounting filesystem read-only

[luca_cornacchia]

Hello @joanxie ,

thank you for your answer. What's the bsp /kernel version that fixes the issue?

We are currently using kernel 6.6.23 from Scarthgap release.

thank you,

Gianluca

[joanxie]

YES, this is exist issue on the old bsp, so what bsp version do you use? if could, pls upgrade it

[luca_cornacchia]

Hello @joanxie

thank you for your answer. What's the bsp or kernel version that fix the issue?
We are currently using kernel 6.6.23 from Scarthgap release.

thank you,
Gianluca

[joanxie]

as I known, 6.6.23 has already fixed this, but let me remind, when you test according to the AN, the step5 of chapter 3.2 usage, the command like

dmsetup -v create encrypted --table "0
$(blockdev --getsz /dev/loop0) crypt capi:tk(cbc(aes))-plain :32:caam_tk:seckey 0 /dev/loop0
0 1 sector_size:512

you need change the capi:tk to the capti:tb

[GiacomoE]

Hi Joanxie, thank you.
What is the purpose of using capi:tb instead of capi:tk ?
About the BSP update. Can you point out which patch is fixing the issue, so maybe we can pull only that change ?

[joanxie]

for these security information, I have mailed to you, pls check