mmc-utils writing RPMB key fails with general error

[bluemonkeysrock]

Hello, 

I'm trying to program an RPMB key on iMX6DLSABRESD.

$mmc rpmb write-key /dev/mmcblk3rpmb rpmbkey
RPMB operation failed, retcode 0x0001

I added extra logs on the mmc driver to track the commands/responses.

mmc rpmb write-key /dev/mmcblk3rpmb rpmbkey
[  110.970140] mmc_blk_ioctl_copy_from_user
[  110.974125] mmc_blk_ioctl_copy_from_user
[  110.978056] mmc_blk_ioctl_copy_from_user
[  110.982113] __mmc_blk_ioctl_cmd : cmd.opcode = 25
[  110.986905] sdhci_finish_command: MMC_RSP_PRESENT
[  110.991618] sdhci_finish_command: cmd->resp[0]=0x00000900
[  110.998109] sdhci_finish_command: MMC_RSP_PRESENT
[  111.002823] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.008282] __mmc_blk_ioctl_cmd : mmc_blk_part_switch ret 0
[  111.013902] __mmc_blk_ioctl_cmd : copy the 'Reliable Write' bit
[  111.019866] sdhci_finish_command: MMC_RSP_PRESENT
[  111.024576] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.030056] __mmc_blk_ioctl_cmd : cmd.resp[0] = 00000900
[  111.035420] sdhci_finish_command: MMC_RSP_PRESENT
[  111.040131] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.045580] __mmc_blk_ioctl_cmd : return 0x0
[  111.049857] mmc_blk_issue_drv_op : (0) __mmc_blk_ioctl_cmd ret 0x0
[  111.056069] __mmc_blk_ioctl_cmd : cmd.opcode = 25
[  111.056076] __mmc_blk_ioctl_cmd : mmc_blk_part_switch ret 0
[  111.056082] __mmc_blk_ioctl_cmd : copy the 'Reliable Write' bit
[  111.072331] sdhci_finish_command: MMC_RSP_PRESENT
[  111.077039] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.082514] __mmc_blk_ioctl_cmd : cmd.resp[0] = 00000900
[  111.087880] sdhci_finish_command: MMC_RSP_PRESENT
[  111.092591] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.098264] __mmc_blk_ioctl_cmd : return 0x0
[  111.102545] mmc_blk_issue_drv_op : (1) __mmc_blk_ioctl_cmd ret 0x0
[  111.108764] __mmc_blk_ioctl_cmd : cmd.opcode = 18
[  111.108770] __mmc_blk_ioctl_cmd : mmc_blk_part_switch ret 0
[  111.108774] __mmc_blk_ioctl_cmd : copy the 'Reliable Write' bit
[  111.108831] sdhci_finish_command: MMC_RSP_PRESENT
[  111.129687] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.135180] __mmc_blk_ioctl_cmd : cmd.resp[0] = 00000900
[  111.140526] sdhci_finish_command: MMC_RSP_PRESENT
[  111.145233] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.150671] __mmc_blk_ioctl_cmd : return 0x0
[  111.154964] mmc_blk_issue_drv_op : (2) __mmc_blk_ioctl_cmd ret 0x0
[  111.154991] sdhci_finish_command: MMC_RSP_PRESENT
[  111.165859] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.172312] sdhci_finish_command: MMC_RSP_PRESENT
[  111.177021] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.182457] mmc_blk_issue_drv_op : mq_rq->drv_op_result ret 0x0
[  111.188422] mmc_blk_ioctl_copy_to_user
[  111.188672] sdhci_finish_command: MMC_RSP_PRESENT
[  111.192183] mmc_blk_ioctl_copy_to_user
[  111.196883] sdhci_finish_command: cmd->resp[0]=0x00000900
[  111.196941] sdhci_finish_command: MMC_RSP_PRESENT
[  111.200670] mmc_blk_ioctl_copy_to_user

Here's the uSDHC configuration from device tree. I'm running linux 5.4

usdhc4: usdhc@219c000 {
                compatible = "fsl,imx6q-usdhc";
                reg = <0x0219c000 0x4000>;
                interrupts = <0 25 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clks IMX6QDL_CLK_USDHC4>,
                     <&clks IMX6QDL_CLK_USDHC4>,
                     <&clks IMX6QDL_CLK_USDHC4>;
                clock-names = "ipg", "ahb", "per";
                bus-width = <4>;
                status = "disabled";
            };

        pinctrl_usdhc4: usdhc4grp {
            fsl,pins = <
                MX6QDL_PAD_SD4_CMD__SD4_CMD     0x17059
                MX6QDL_PAD_SD4_CLK__SD4_CLK     0x10059
                MX6QDL_PAD_SD4_DAT0__SD4_DATA0      0x17059
                MX6QDL_PAD_SD4_DAT1__SD4_DATA1      0x17059
                MX6QDL_PAD_SD4_DAT2__SD4_DATA2      0x17059
                MX6QDL_PAD_SD4_DAT3__SD4_DATA3      0x17059
                MX6QDL_PAD_SD4_DAT4__SD4_DATA4      0x17059
                MX6QDL_PAD_SD4_DAT5__SD4_DATA5      0x17059
                MX6QDL_PAD_SD4_DAT6__SD4_DATA6      0x17059
                MX6QDL_PAD_SD4_DAT7__SD4_DATA7      0x17059
            >;
        };
 
&usdhc4 {
    pinctrl-names = "default";
    pinctrl-0 = <&pinctrl_usdhc4>;
    bus-width = <8>;
    non-removable;
    no-1-8-v;
    auto-cmd23-broken;
    status = "okay";
};

What am I missing?
Thanks for any insight on the matter.

Regards, 

[bluemonkeysrock]

The key is 32byte long and I have read the emmc spec.
For writing RPMB key it said :  "If some other error occurs during Authentication Key programming then returned result is 0x01 (General Failure)."

That same error occurs when trying to rewrite the key. 

$ mmc rpmb write-key /dev/mmcblk0rpmb real_rpmbkey => no error
$ mmc rpmb write-key /dev/mmcblk0rpmb fake_rpmbkey
RPMB operation failed, retcode 0x0001

Is there a way to verify whether the key is written or some other issue with the emmc?

Thanks,

[bluemonkeysrock]

For that eMMC, I can use the key to write/read with no issues.
On another one :

$ mmc rpmb read-counter /dev/mmcblk3rpmb
RPMB operation failed, retcode 0x0007 => RPMB_ERR_NO_KEY
$ mmc rpmb write-key /dev/mmcblk3rpmb rpmbkey
RPMB operation failed, retcode 0x0001 => RPMB_ERR_GENERAL

I cannot read the counter value because no key is written and general error when I try to write one.

Thanks you, 

[BiyongSUN]

do you have the problem with  read-block/write-block? 

Finish the write-block, then try read-counter, how's the result?

[BiyongSUN]

The  RPMB key is OTP.  

I believe you can use the key now. 

And please read the document I wrote from page 4. 

[BiyongSUN]

How long is the RPMB key length you are using? 

Have you read the jedec spec? 

The key/MAC must be 32Byte long.

Your question is about emmc chip, not the usdhc controller  of i.MX. 

JEDEC Standard No. 84-B51

 eMMC RPMB Enhance and GP
https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/eMMC-RPMB-Enhance-and-GP/ta-p/1099818