[PATCH 0/1] This patch adds support for the entropy generator present in

[PATCH 0/1] This patch adds support for the entropy generator present in

[Max Resch]

the Armada3700 Secure Processor. This rng is onlt accessible
to the rWTM firmware. Currently the CZ.NIC Turris Mox firmware
exposes this.

For the Linux kernel a driver called turris-mox-rwtm exists that
makes use of this feature. This RNG driver for U-Boot tries to do the
same.

For efficiency I chose to cache 4k of enthropy in a ringbuffer.


Max Resch (1):
  add turris-rwtm-rng from CZ.NIC rWTM Firmware

 drivers/rng/Kconfig           |   8 ++
 drivers/rng/Makefile          |   1 +
 drivers/rng/turris_rwtm_rng.c | 143 ++++++++++++++++++++++++++++++++++
 3 files changed, 152 insertions(+)
 create mode 100644 drivers/rng/turris_rwtm_rng.c

-- 
2.43.0

[PATCH 1/1] add turris-rwtm-rng from CZ.NIC rWTM Firmware

[Max Resch]

usable on all armada3700 devices with CZ.NIC firmware
compatible with devices with default firmware (does nothing)
based on Linux turris-mox-rwtm module

Signed-off-by: Max Resch <resch.max@gmail.com>
---

 drivers/rng/Kconfig           |   8 ++
 drivers/rng/Makefile          |   1 +
 drivers/rng/turris_rwtm_rng.c | 143 ++++++++++++++++++++++++++++++++++
 3 files changed, 152 insertions(+)
 create mode 100644 drivers/rng/turris_rwtm_rng.c

diff --git a/drivers/rng/Kconfig b/drivers/rng/Kconfig
index a89c899568..f5984a9ca0 100644
--- a/drivers/rng/Kconfig
+++ b/drivers/rng/Kconfig
@@ -105,4 +105,12 @@ config RNG_JH7110
 	help
 	  Enable True Random Number Generator in StarFive JH7110 SoCs.
 
+config RNG_TURRIS_RWTM
+	bool "Turris Mox TRNG in Secure Processor"
+	depends on DM_RNG && ARCH_MVEBU
+	help
+	  Use TRNG in Turris Mox Secure Processor Firmware. Can be used
+	  on other Armada-3700 devices (like EspressoBin) if Secure
+	  Firmware from CZ.NIC is used.
+
 endif
diff --git a/drivers/rng/Makefile b/drivers/rng/Makefile
index 7e64c4cdfc..ecae1a3da3 100644
--- a/drivers/rng/Makefile
+++ b/drivers/rng/Makefile
@@ -17,3 +17,4 @@ obj-$(CONFIG_RNG_SMCCC_TRNG) += smccc_trng.o
 obj-$(CONFIG_RNG_ARM_RNDR) += arm_rndr.o
 obj-$(CONFIG_TPM_RNG) += tpm_rng.o
 obj-$(CONFIG_RNG_JH7110) += jh7110_rng.o
+obj-$(CONFIG_RNG_TURRIS_RWTM) += turris_rwtm_rng.o
diff --git a/drivers/rng/turris_rwtm_rng.c b/drivers/rng/turris_rwtm_rng.c
new file mode 100644
index 0000000000..03e4fdfcaf
--- /dev/null
+++ b/drivers/rng/turris_rwtm_rng.c
@@ -0,0 +1,143 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR BSD-3-Clause
+/*
+ * Copyright (c) 2024, Max Resch
+ */
+
+#include <dm.h>
+#include <malloc.h>
+#include <rng.h>
+#include <asm/dma-mapping.h>
+#include <asm/types.h>
+#include <mach/mbox.h>
+
+#define DRIVER_NAME	"turris-rwtm-rng"
+
+/* size of enthropy ring buffer */
+#define RNG_BUFFER_SIZE	4096U
+
+struct turris_rwtm_rng_priv {
+	phys_addr_t buffer;
+	u16 pos;
+};
+
+static int turris_rwtm_rng_fill_enthropy(phys_addr_t enthropy, size_t size)
+{
+	int ret;
+	u32 args[] = { 1, (u32)enthropy, size };
+
+	/* flush data cache */
+	flush_dcache_range(enthropy, enthropy + size);
+
+	/*
+	 * get enthropy
+	 * args[0] = 1 copies BYTES array in args[1] of length args[2]
+	 */
+	ret = mbox_do_cmd(MBOX_CMD_GET_RANDOM, args, 3, NULL, 0);
+	if (ret < 0)
+		return ret;
+
+	/* invalidate data cache */
+	invalidate_dcache_range(enthropy, enthropy + size);
+
+	return 0;
+}
+
+static int turris_rwtm_rng_random_read(struct udevice *dev, void *data, size_t count)
+{
+	int ret;
+	struct turris_rwtm_rng_priv *priv;
+	phys_addr_t p;
+	size_t size, copied;
+
+	priv = (struct turris_rwtm_rng_priv *)dev_get_priv(dev);
+	p = priv->buffer;
+
+	/* copy to ring buffer, optimize RWTM access */
+	size = min_t(size_t, RNG_BUFFER_SIZE - priv->pos, count);
+	copied = 0;
+
+	while (count) {
+		memcpy(((u8 *)data) + copied, (void *)(p + priv->pos), size);
+		count -= size;
+		copied += size;
+		priv->pos += size;
+
+		if (priv->pos == RNG_BUFFER_SIZE) {
+			ret = turris_rwtm_rng_fill_enthropy(p, RNG_BUFFER_SIZE);
+			if (ret < 0)
+				return ret;
+			priv->pos = 0;
+		}
+	}
+
+	return 0;
+}
+
+static int turris_rwtm_rng_probe(struct udevice *dev)
+{
+	int ret;
+	struct turris_rwtm_rng_priv *priv;
+	u32 args[] = { 0 };
+
+	/*
+	 * check if the random command is supported
+	 * args[0] = 0 would copy 16 DWORDS to out but we ignore them
+	 */
+	ret = mbox_do_cmd(MBOX_CMD_GET_RANDOM, args, 1, NULL, 0);
+
+	if (ret < 0)
+		return ret;
+
+	/* allocate ring buffer */
+	priv = dev_get_priv(dev);
+	priv->buffer = 0;
+
+	/* address need to be aligned */
+	dma_alloc_coherent(RNG_BUFFER_SIZE, (unsigned long *)&priv->buffer);
+	if (!priv->buffer)
+		return -ENOMEM;
+
+	priv->pos = 0;
+	memset((void *)priv->buffer, 0, RNG_BUFFER_SIZE);
+
+	/* fill ring buffer with enthroy */
+	return turris_rwtm_rng_fill_enthropy(priv->buffer, RNG_BUFFER_SIZE);
+}
+
+static int turris_rwtm_rng_remove(struct udevice *dev)
+{
+	struct turris_rwtm_rng_priv *priv;
+
+	priv = dev_get_priv(dev);
+	if (!priv->buffer)
+		return 0;
+
+	dma_free_coherent((void *)priv->buffer);
+	priv->buffer = 0;
+
+	return 0;
+}
+
+static const struct dm_rng_ops turris_rwtm_rng_ops = {
+	.read = turris_rwtm_rng_random_read,
+};
+
+/*
+ * only Turris MOX firmware has the RNG but allow all probable devices to be
+ * probed the default firmware will just reject the probe
+ */
+static const struct udevice_id turris_rwtm_rng_match[] = {
+	{ .compatible = "cznic,turris-mox-rwtm" },
+	{ .compatible = "marvell,armada-3700-rwtm-firmware" },
+	{},
+};
+
+U_BOOT_DRIVER(turris_rwtm_rng) = {
+	.name	= DRIVER_NAME,
+	.id	= UCLASS_RNG,
+	.of_match = turris_rwtm_rng_match,
+	.ops	= &turris_rwtm_rng_ops,
+	.probe	= turris_rwtm_rng_probe,
+	.remove = turris_rwtm_rng_remove,
+	.priv_auto = sizeof(struct turris_rwtm_rng_priv),
+};
-- 
2.43.0

Re: [PATCH 1/1] add turris-rwtm-rng from CZ.NIC rWTM Firmware

[Marek Behún]

On Sat, 20 Jan 2024 14:27:23 +0100
Max Resch <resch.max@gmail.com> wrote:

Hello Max,

please follow the conventions for commit titles and messages. Look for
example at
  git log drivers/rng
The commit title should be something like
  rng: Add Turris Mox rWTM RNG driver

> usable on all armada3700 devices with CZ.NIC firmware
> compatible with devices with default firmware (does nothing)
> based on Linux turris-mox-rwtm module

Please use capital letters and punctuation in commmit messages as in
standard english text. The commit message should be something like

  Add RNG driver for Armada 3720 boards running the Turris Mox rWTM
  firmware in the secure coprocessor.

> Signed-off-by: Max Resch <resch.max@gmail.com>
> ---
> 
>  drivers/rng/Kconfig           |   8 ++
>  drivers/rng/Makefile          |   1 +
>  drivers/rng/turris_rwtm_rng.c | 143 ++++++++++++++++++++++++++++++++++
>  3 files changed, 152 insertions(+)
>  create mode 100644 drivers/rng/turris_rwtm_rng.c
> 
> diff --git a/drivers/rng/Kconfig b/drivers/rng/Kconfig
> index a89c899568..f5984a9ca0 100644
> --- a/drivers/rng/Kconfig
> +++ b/drivers/rng/Kconfig
> @@ -105,4 +105,12 @@ config RNG_JH7110
>  	help
>  	  Enable True Random Number Generator in StarFive JH7110 SoCs.
>  
> +config RNG_TURRIS_RWTM
> +	bool "Turris Mox TRNG in Secure Processor"
> +	depends on DM_RNG && ARCH_MVEBU
This should depend on ARMADA_3700 instead of ARCH_MVEBU, otherwise the
mbox_do_cmd function won't be defined and link error will occur.

> +	help
> +	  Use TRNG in Turris Mox Secure Processor Firmware. Can be used
> +	  on other Armada-3700 devices (like EspressoBin) if Secure
> +	  Firmware from CZ.NIC is used.
> +
>  endif
> diff --git a/drivers/rng/Makefile b/drivers/rng/Makefile
> index 7e64c4cdfc..ecae1a3da3 100644
> --- a/drivers/rng/Makefile
> +++ b/drivers/rng/Makefile
> @@ -17,3 +17,4 @@ obj-$(CONFIG_RNG_SMCCC_TRNG) += smccc_trng.o
>  obj-$(CONFIG_RNG_ARM_RNDR) += arm_rndr.o
>  obj-$(CONFIG_TPM_RNG) += tpm_rng.o
>  obj-$(CONFIG_RNG_JH7110) += jh7110_rng.o
> +obj-$(CONFIG_RNG_TURRIS_RWTM) += turris_rwtm_rng.o
> diff --git a/drivers/rng/turris_rwtm_rng.c b/drivers/rng/turris_rwtm_rng.c
> new file mode 100644
> index 0000000000..03e4fdfcaf
> --- /dev/null
> +++ b/drivers/rng/turris_rwtm_rng.c
> @@ -0,0 +1,143 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later OR BSD-3-Clause
> +/*
> + * Copyright (c) 2024, Max Resch
> + */
> +
> +#include <dm.h>
> +#include <malloc.h>
> +#include <rng.h>
> +#include <asm/dma-mapping.h>
> +#include <asm/types.h>
> +#include <mach/mbox.h>
> +
> +#define DRIVER_NAME	"turris-rwtm-rng"

No need to declare macro for driver name, just use the string literal
in the U_BOOT_DRIVER call at the end.

> +/* size of enthropy ring buffer */

Entropy is spelled without 'h'.

> +#define RNG_BUFFER_SIZE	4096U
> +
> +struct turris_rwtm_rng_priv {
> +	phys_addr_t buffer;
> +	u16 pos;

I suggest to throw away the ring implementation (no need for pos), just
do the read of sufficient bytes in the rng_read method.

No need to do ring buffering in U-Boot for performance, it just
overcomplicates it.


> +};
> +
> +static int turris_rwtm_rng_fill_enthropy(phys_addr_t enthropy, size_t size)
> +{
> +	int ret;
> +	u32 args[] = { 1, (u32)enthropy, size };

Please explicitly define array size here:
	u32 args[3] = ....

Please use reverse christmas tree for declarations whenever possible.
The longest line first. In this case

	u32 args[3] = { 1, (u32)enthropy, size };
	int ret;

> +	/* flush data cache */
> +	flush_dcache_range(enthropy, enthropy + size);
> +
> +	/*
> +	 * get enthropy
> +	 * args[0] = 1 copies BYTES array in args[1] of length args[2]
> +	 */
> +	ret = mbox_do_cmd(MBOX_CMD_GET_RANDOM, args, 3, NULL, 0);

	ret = mbox_do_cmd(MBOX_CMD_GET_RANDOM, args, ARRAY_SIZE(args),
			  NULL, 0);

> +	if (ret < 0)
> +		return ret;
> +
> +	/* invalidate data cache */
> +	invalidate_dcache_range(enthropy, enthropy + size);
> +
> +	return 0;
> +}
> +
> +static int turris_rwtm_rng_random_read(struct udevice *dev, void *data, size_t count)
> +{
> +	int ret;
> +	struct turris_rwtm_rng_priv *priv;
> +	phys_addr_t p;
> +	size_t size, copied;

reverse christmas tree

> +
> +	priv = (struct turris_rwtm_rng_priv *)dev_get_priv(dev);
> +	p = priv->buffer;
> +
> +	/* copy to ring buffer, optimize RWTM access */
> +	size = min_t(size_t, RNG_BUFFER_SIZE - priv->pos, count);
> +	copied = 0;
> +
> +	while (count) {
> +		memcpy(((u8 *)data) + copied, (void *)(p + priv->pos), size);
> +		count -= size;
> +		copied += size;
> +		priv->pos += size;
> +
> +		if (priv->pos == RNG_BUFFER_SIZE) {
> +			ret = turris_rwtm_rng_fill_enthropy(p, RNG_BUFFER_SIZE);
> +			if (ret < 0)
> +				return ret;
> +			priv->pos = 0;
> +		}
> +	}
> +
> +	return 0;
> +}
> +
> +static int turris_rwtm_rng_probe(struct udevice *dev)
> +{
> +	int ret;
> +	struct turris_rwtm_rng_priv *priv;
> +	u32 args[] = { 0 };

reverse christmas tree, and explicit size of args array.
Alternatively if only one arg is used, you can just set
	u32 arg = 0;
and use &arg in the call to mbox_do_cmd()

> +	/*
> +	 * check if the random command is supported
> +	 * args[0] = 0 would copy 16 DWORDS to out but we ignore them
> +	 */
> +	ret = mbox_do_cmd(MBOX_CMD_GET_RANDOM, args, 1, NULL, 0);
> +
> +	if (ret < 0)
> +		return ret;
> +
> +	/* allocate ring buffer */
> +	priv = dev_get_priv(dev);
> +	priv->buffer = 0;
> +
> +	/* address need to be aligned */
> +	dma_alloc_coherent(RNG_BUFFER_SIZE, (unsigned long *)&priv->buffer);
> +	if (!priv->buffer)
> +		return -ENOMEM;
> +
> +	priv->pos = 0;
> +	memset((void *)priv->buffer, 0, RNG_BUFFER_SIZE);
> +
> +	/* fill ring buffer with enthroy */
> +	return turris_rwtm_rng_fill_enthropy(priv->buffer, RNG_BUFFER_SIZE);
> +}
> +
> +static int turris_rwtm_rng_remove(struct udevice *dev)
> +{
> +	struct turris_rwtm_rng_priv *priv;
	struct turris_rwtm_rng_priv *priv = dev_get_priv(dev);
> +
> +	priv = dev_get_priv(dev);
> +	if (!priv->buffer)

No need to check this here, this cannot happen. Remove won't be called
because if priv->buffer is zero, probe would have failed with -ENOMEM.

> +		return 0;
> +
> +	dma_free_coherent((void *)priv->buffer);
> +	priv->buffer = 0;
No need to clear priv->buffer.

> +
> +	return 0;
> +}
> +
> +static const struct dm_rng_ops turris_rwtm_rng_ops = {
> +	.read = turris_rwtm_rng_random_read,
> +};
> +
> +/*
> + * only Turris MOX firmware has the RNG but allow all probable devices to be
> + * probed the default firmware will just reject the probe
> + */
> +static const struct udevice_id turris_rwtm_rng_match[] = {
> +	{ .compatible = "cznic,turris-mox-rwtm" },
> +	{ .compatible = "marvell,armada-3700-rwtm-firmware" },
> +	{},
> +};
> +
> +U_BOOT_DRIVER(turris_rwtm_rng) = {
> +	.name	= DRIVER_NAME,
> +	.id	= UCLASS_RNG,
> +	.of_match = turris_rwtm_rng_match,
> +	.ops	= &turris_rwtm_rng_ops,
> +	.probe	= turris_rwtm_rng_probe,
> +	.remove = turris_rwtm_rng_remove,
> +	.priv_auto = sizeof(struct turris_rwtm_rng_priv),
> +};