[PATCH 0/8] MPFS: add hardware RNG support and fix RNG consumers

[PATCH 0/8] MPFS: add hardware RNG support and fix RNG consumers

[Jamie Gibbons]

Hi all,

This series adds support for the hardware random number generator (RNG) on
the Microchip PolarFire SoC (MPFS) and fixes several related issues
uncovered during integration and testing.

The MPFS hardware RNG is accessed indirectly via the MPFS system
controller using the mailbox interface. Unlike typical memory-mapped RNGs,
the system controller mailbox is shared and non‑reentrant, which
introduces a number of integration challenges in U‑Boot, particularly
during autoboot when multiple system controller services are active.

This series addresses those challenges in various ways.
1. Fixes generic RNG command handling to correctly interpret dm_rng_read()
return values.
2. Adds missing infrastructure in the MPFS system controller driver to
explicitly receive mailbox responses.
3. Binds the MPFS RNG as a sub‑device of the system controller, mirroring
Linux behaviour and avoiding the need for a device tree node.
4. Introduces a new MPFS RNG driver implementing UCLASS_RNG.
5. Enables RNG support in the Microchip PolarFire SoC generic defconfig.
6. Replaces unbounded polling loops with regmap_read_poll_timeout().
7. Replaces an immediate -EBUSY return with a bounded wait for BUSY to clear,
preserving Linux‑equivalent semantics while avoiding spurious early‑boot
failures in U‑Boot.
8. Fixes boot-time KASLR seed generation to treat RNG as a best‑effort
entropy source, only causing a warning when entropy is temporarily
unavailable.

The resulting behaviour matches Linux semantics where possible, while
respecting U‑Boot’s single‑threaded, non‑blocking execution model. RNG
consumers receive entropy when available, and gracefully fall back when it
is not, without breaking autoboot.

All changes have been tested on the PolarFire SoC Icicle Kit ES.

Regards,
Jamie.

Jamie Gibbons (8):
  cmd: rng: fix error handling for dm_rng_read()
  misc: mpfs_syscontroller: add mailbox RX helper for service responses
  misc: mpfs_syscontroller: bind RNG sub-device
  rng: add Microchip PolarFire SoC hardware RNG driver
  configs: microchip_mpfs_generic: enable MPFS RNG support
  mailbox: mpfs-mbox: replace unbounded BUSY polling with bounded waits
  mailbox: mpfs: add bounded wait for BUSY to clear before sending
    request
  boot: fdt: downgrade KASLR RNG failure to warning

 boot/fdt_support.c                       |  13 ++-
 cmd/rng.c                                |   2 +-
 configs/microchip_mpfs_generic_defconfig |   3 +
 drivers/mailbox/mpfs-mbox.c              |  27 ++++--
 drivers/misc/mpfs_syscontroller.c        |  34 +++++++-
 drivers/rng/Kconfig                      |   7 ++
 drivers/rng/Makefile                     |   1 +
 drivers/rng/mpfs_rng.c                   | 106 +++++++++++++++++++++++
 include/mpfs-mailbox.h                   |   1 +
 9 files changed, 178 insertions(+), 16 deletions(-)
 create mode 100644 drivers/rng/mpfs_rng.c

-- 
2.43.0

[PATCH 1/8] cmd: rng: fix error handling for dm_rng_read()

[Jamie Gibbons]

The rng command treated any non-zero return value from dm_rng_read() as
an error, even though the API returns the number of bytes read on
success.

Update the error handling to only report a failure when dm_rng_read()
returns a negative error code, or when a short read occurs.

This fixes false "Reading RNG failed" messages when RNG drivers
successfully return data.

Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
---
 cmd/rng.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/rng.c b/cmd/rng.c
index 4d91094a8ec..18c0b6c9ca1 100644
--- a/cmd/rng.c
+++ b/cmd/rng.c
@@ -62,7 +62,7 @@ static int do_rng(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[])
 	n = min(n, sizeof(buf));
 
 	err = dm_rng_read(dev, buf, n);
-	if (err) {
+	if (err < 0 || err != n) {
 		puts(err == -EINTR ? "Abort\n" : "Reading RNG failed\n");
 		ret = CMD_RET_FAILURE;
 	} else {
-- 
2.43.0

[PATCH 2/8] misc: mpfs_syscontroller: add mailbox RX helper for service responses

[Jamie Gibbons]

The MPFS system controller run_service() helper only submits the mailbox
request but does not read back the response data. However, the caller
must explicitly receive the response.

Add a public system controller helper to receive mailbox service
responses to populate the response buffer after issuing a system
controller request.

Without this, the drivers copy uninitialised stack data instead of
mailbox response data, resulting in deterministic output.

Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
---
 drivers/misc/mpfs_syscontroller.c | 28 ++++++++++++++++++++++++----
 include/mpfs-mailbox.h            |  1 +
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/drivers/misc/mpfs_syscontroller.c b/drivers/misc/mpfs_syscontroller.c
index f608d5518b0..61d6780f0b9 100644
--- a/drivers/misc/mpfs_syscontroller.c
+++ b/drivers/misc/mpfs_syscontroller.c
@@ -85,6 +85,28 @@ int mpfs_syscontroller_run_service(struct mpfs_syscontroller_priv *sys_controlle
 }
 EXPORT_SYMBOL_GPL(mpfs_syscontroller_run_service);
 
+/**
+ * mpfs_syscontroller_recv_response() - Receive the MPFS system service response
+ * @sys_controller:	MPFS system controller instance
+ * @msg:			System service message
+ * @timeout_ms:		Timeout in milliseconds
+ * 
+ * Receive the mailbox response for a previously issued MPFS system
+ * controller service request and populate the response buffer.
+ * 
+ * Return: 0 if all goes good, else appropriate error message.
+ */
+int mpfs_syscontroller_recv_response(struct mpfs_syscontroller_priv *sys_controller, struct mpfs_mss_msg *msg, unsigned long timeout_ms)
+{
+	int ret;
+
+	ret = mbox_recv(&sys_controller->chan, msg, timeout_ms);
+	if (ret)
+		dev_err(sys_controller->chan.dev, "Service failed: %d, abort. Failure: %u\n", ret, msg->response->resp_status);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mpfs_syscontroller_recv_response);
+
 /**
  * mpfs_syscontroller_read_sernum() - Use system service to read the device serial number
  * @sys_serv_priv:	system service private data
@@ -116,11 +138,9 @@ int mpfs_syscontroller_read_sernum(struct mpfs_sys_serv *sys_serv_priv, u8 *devi
 	}
 
 	/* Receive the response */
-	ret = mbox_recv(&sys_serv_priv->sys_controller->chan, &msg, timeoutsecs);
-	if (ret) {
-		dev_err(sys_serv_priv->sys_controller->chan.dev, "Service failed: %d, abort. Failure: %u\n", ret, msg.response->resp_status);
+	ret = mpfs_syscontroller_recv_response(sys_serv_priv->sys_controller, &msg, timeoutsecs);
+	if (ret)
 		return ret;
-	}
 
 	debug("%s: Read successful %s\n",
 	      __func__, sys_serv_priv->sys_controller->chan.dev->name);
diff --git a/include/mpfs-mailbox.h b/include/mpfs-mailbox.h
index c0ff327a4ce..3922e8d1019 100644
--- a/include/mpfs-mailbox.h
+++ b/include/mpfs-mailbox.h
@@ -58,6 +58,7 @@ struct mpfs_sys_serv {
 };
 
 int mpfs_syscontroller_run_service(struct mpfs_syscontroller_priv *sys_controller, struct mpfs_mss_msg *msg);
+int mpfs_syscontroller_recv_response(struct mpfs_syscontroller_priv* sys_controller, struct mpfs_mss_msg* msg, unsigned long timeout_ms);
 int mpfs_syscontroller_read_sernum(struct mpfs_sys_serv *sys_serv_priv, u8 *device_serial_number);
 void mpfs_syscontroller_process_dtbo(struct mpfs_sys_serv *sys_serv_priv);
 struct mpfs_syscontroller_priv *mpfs_syscontroller_get(struct udevice *dev);
-- 
2.43.0

[PATCH 3/8] misc: mpfs_syscontroller: bind RNG sub-device

[Jamie Gibbons]

The MPFS RNG driver is not described by the device tree and is instead
registered dynamically by the system controller. Explicitly bind the
MPFS RNG driver as a child device during system controller probe.

This ensures the RNG device is instantiated and available via UCLASS_RNG
without requiring a device tree node.

Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
---
 drivers/misc/mpfs_syscontroller.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/misc/mpfs_syscontroller.c b/drivers/misc/mpfs_syscontroller.c
index 61d6780f0b9..79dc43f085f 100644
--- a/drivers/misc/mpfs_syscontroller.c
+++ b/drivers/misc/mpfs_syscontroller.c
@@ -11,6 +11,7 @@
 #include <asm/system.h>
 #include <dm.h>
 #include <dm/device_compat.h>
+#include <dm/lists.h>
 #include <env.h>
 #include <errno.h>
 #include <linux/compat.h>
@@ -332,6 +333,7 @@ EXPORT_SYMBOL(mpfs_syscontroller_process_dtbo);
 static int mpfs_syscontroller_probe(struct udevice *dev)
 {
 	struct mpfs_syscontroller_priv *sys_controller = dev_get_priv(dev);
+	struct udevice *rng_dev;
 	int ret;
 
 	ret = mbox_get_by_index(dev, 0, &sys_controller->chan);
@@ -341,6 +343,10 @@ static int mpfs_syscontroller_probe(struct udevice *dev)
 		return ret;
 	}
 
+	ret = device_bind_driver(dev, "mpfs_rng", "mpfs-rng", &rng_dev);
+	if (ret)
+		dev_err(dev, "Failed to bind mpfs_rng: %d\n", ret);
+
 	init_completion(&sys_controller->c);
 	dev_info(dev, "Registered MPFS system controller\n");
 
-- 
2.43.0

[PATCH 4/8] rng: add Microchip PolarFire SoC hardware RNG driver

[Jamie Gibbons]

Add a U-Boot RNG driver for Microchip's PolarFire SoC (MPFS). The
hardware RNG is accessed indirectly via the MPFS system controller using
the mailbox interface.

The driver implements the UCLASS_RNG interface, requesting random data
from the system controller and returning it to the caller.

This allows use of the PolarFire SoC hardware RNG via the
standard 'rng' command and DM RNG API.

Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
---
 configs/microchip_mpfs_generic_defconfig |   1 +
 drivers/rng/Kconfig                      |   7 ++
 drivers/rng/Makefile                     |   1 +
 drivers/rng/mpfs_rng.c                   | 106 +++++++++++++++++++++++
 4 files changed, 115 insertions(+)
 create mode 100644 drivers/rng/mpfs_rng.c

diff --git a/configs/microchip_mpfs_generic_defconfig b/configs/microchip_mpfs_generic_defconfig
index 973ed09fa87..66acaad7e9b 100644
--- a/configs/microchip_mpfs_generic_defconfig
+++ b/configs/microchip_mpfs_generic_defconfig
@@ -30,3 +30,4 @@ CONFIG_ENV_RELOC_GD_ENV_ADDR=y
 CONFIG_BOOTP_SEND_HOSTNAME=y
 CONFIG_DM_MTD=y
 CONFIG_SYSRESET=y
+CONFIG_DM_RNG=y
diff --git a/drivers/rng/Kconfig b/drivers/rng/Kconfig
index 19b2b707677..856ffda2f5e 100644
--- a/drivers/rng/Kconfig
+++ b/drivers/rng/Kconfig
@@ -23,6 +23,13 @@ config RNG_MESON
 	  Enable support for hardware random number generator
 	  of Amlogic Meson SoCs.
 
+config RNG_MPFS
+	tristate "Microchip PolarFire SoC Random Number Generator support"
+	depends on DM_RNG && MPFS_SYSCONTROLLER
+	help
+	  Enable support for hardware random number generator
+	  of Microchip's PolarFire SoCs.
+
 config RNG_SANDBOX
 	bool "Sandbox random number generator"
 	depends on SANDBOX
diff --git a/drivers/rng/Makefile b/drivers/rng/Makefile
index 30c58272d41..50622d4705f 100644
--- a/drivers/rng/Makefile
+++ b/drivers/rng/Makefile
@@ -5,6 +5,7 @@
 
 obj-$(CONFIG_$(PHASE_)DM_RNG) += rng-uclass.o
 obj-$(CONFIG_RNG_MESON) += meson-rng.o
+obj-$(CONFIG_RNG_MPFS) += mpfs_rng.o
 obj-$(CONFIG_RNG_SANDBOX) += sandbox_rng.o
 obj-$(CONFIG_RNG_MSM) += msm_rng.o
 obj-$(CONFIG_RNG_NPCM) += npcm_rng.o
diff --git a/drivers/rng/mpfs_rng.c b/drivers/rng/mpfs_rng.c
new file mode 100644
index 00000000000..61bd520d8a2
--- /dev/null
+++ b/drivers/rng/mpfs_rng.c
@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Microchip's PolarFire SoC (MPFS) System Controller Driver
+ *
+ * Copyright (C) 2026 Microchip Technology Inc. All rights reserved.
+ *
+ * Author: Jamie Gibbons <jamie.gibbons@microchip.com>
+ *
+ */
+
+#include <dm.h>
+#include <dm/device.h>
+#include <dm/device_compat.h>
+#include <dm/devres.h>
+#include <linux/err.h>
+#include <linux/errno.h>
+#include <linux/io.h>
+#include <linux/printk.h>
+#include <mailbox.h>
+#include <malloc.h>
+#include <mpfs-mailbox.h>
+#include <rng.h>
+#include <string.h>
+
+#define CMD_OPCODE						0x21
+#define CMD_DATA_SIZE					0U
+#define CMD_DATA						NULL
+#define MBOX_OFFSET						0U
+#define RESP_OFFSET						0U
+#define RNG_RESP_BYTES					32U
+
+/**
+ * struct mpfs_rng_priv - Structure representing System Controller data.
+ * @mpfs_syscontroller_priv:	System Controller
+ */
+struct mpfs_rng_priv {
+	struct mpfs_syscontroller_priv *sys_controller;
+};
+
+static int mpfs_rng_read(struct udevice *dev, void *data, size_t len)
+{
+	struct mpfs_rng_priv *rng_priv = dev_get_priv(dev);
+	u32 response_msg[RNG_RESP_BYTES / sizeof(u32)];
+	size_t count = 0, copy_size;
+	int ret;
+
+	struct mpfs_mss_response response = {
+		.resp_status = 0U,
+		.resp_msg = (u32*)response_msg,
+		.resp_size = RNG_RESP_BYTES,
+	};
+	struct mpfs_mss_msg msg = {
+		.cmd_opcode = CMD_OPCODE,
+		.cmd_data_size = CMD_DATA_SIZE,
+		.response = &response,
+		.cmd_data = CMD_DATA,
+		.mbox_offset = MBOX_OFFSET,
+		.resp_offset = RESP_OFFSET,
+	};
+
+	while (count < len) {
+		ret = mpfs_syscontroller_run_service(rng_priv->sys_controller, &msg);
+		if (ret == -EBUSY)
+			return 0;
+		if (ret)
+			return ret;
+
+		ret = mpfs_syscontroller_recv_response(rng_priv->sys_controller, &msg, 1000);
+		if (ret == -EBUSY)
+			return 0;
+		if (ret)
+			return ret;
+
+		copy_size = (len - count > RNG_RESP_BYTES) ? RNG_RESP_BYTES : (len - count);
+		memcpy((u8 *)data + count, response_msg, copy_size);
+		count += copy_size;
+	}
+
+	return len;
+}
+
+static int mpfs_rng_probe(struct udevice *dev)
+{
+	struct mpfs_rng_priv *rng_priv = dev_get_priv(dev);
+
+	rng_priv->sys_controller = mpfs_syscontroller_get(dev->parent);
+	if (IS_ERR(rng_priv->sys_controller)) {
+		dev_err(dev, "Failed to get system controller\n");
+		return PTR_ERR(rng_priv->sys_controller);
+	}
+
+	dev_info(dev, "Registered MPFS hwrng\n");
+	return 0;
+}
+
+static const struct dm_rng_ops mpfs_rng_ops = {
+	.read = mpfs_rng_read,
+};
+
+U_BOOT_DRIVER(mpfs_rng) = {
+	.name           = "mpfs_rng",
+	.id             = UCLASS_RNG,
+	.probe          = mpfs_rng_probe,
+	.priv_auto	    = sizeof(struct mpfs_rng_priv),
+	.ops            = &mpfs_rng_ops,
+};
-- 
2.43.0

[PATCH 5/8] configs: microchip_mpfs_generic: enable MPFS RNG support

[Jamie Gibbons]

Enable the MPFS hardware RNG and associated infrastructure in
the Microchip PolarFire SoC generic defconfig.

Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
---
 configs/microchip_mpfs_generic_defconfig | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/configs/microchip_mpfs_generic_defconfig b/configs/microchip_mpfs_generic_defconfig
index 66acaad7e9b..e3d794f08b9 100644
--- a/configs/microchip_mpfs_generic_defconfig
+++ b/configs/microchip_mpfs_generic_defconfig
@@ -21,6 +21,7 @@ CONFIG_SYS_PBSIZE=282
 CONFIG_DISPLAY_CPUINFO=y
 CONFIG_DISPLAY_BOARDINFO=y
 CONFIG_SYS_PROMPT="RISC-V # "
+CONFIG_CMD_RNG=y
 CONFIG_OF_UPSTREAM=y
 CONFIG_OF_BOARD=y
 CONFIG_OF_LIST="microchip/mpfs-icicle-kit microchip/mpfs-sev-kit"
@@ -29,5 +30,6 @@ CONFIG_ENV_OVERWRITE_ETHADDR_ONCE=y
 CONFIG_ENV_RELOC_GD_ENV_ADDR=y
 CONFIG_BOOTP_SEND_HOSTNAME=y
 CONFIG_DM_MTD=y
-CONFIG_SYSRESET=y
 CONFIG_DM_RNG=y
+CONFIG_RNG_MPFS=y
+CONFIG_SYSRESET=y
-- 
2.43.0

[PATCH 6/8] mailbox: mpfs-mbox: replace unbounded BUSY polling with bounded waits

[Jamie Gibbons]

The MPFS mailbox driver used unbounded polling loops and treated the
BUSY bit as a fatal condition in several paths. On MPFS, BUSY may be
transiently reasserted even after response data is written, which is
observable in U-Boot’s synchronous, polled execution model.

Replace the unbounded loops with a bounded
regmap_read_poll_timeout()-based helper that waits for the controller to
become idle.

This preserves existing behaviour while preventing infinite stalls.

Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
---
 drivers/mailbox/mpfs-mbox.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/mailbox/mpfs-mbox.c b/drivers/mailbox/mpfs-mbox.c
index b1ce377525e..165d9d89630 100644
--- a/drivers/mailbox/mpfs-mbox.c
+++ b/drivers/mailbox/mpfs-mbox.c
@@ -18,6 +18,7 @@
 #include <linux/compat.h>
 #include <linux/err.h>
 #include <linux/errno.h>
+#include <linux/iopoll.h>
 #include <log.h>
 #include <mailbox-uclass.h>
 #include <mpfs-mailbox.h>
@@ -60,6 +61,7 @@ static int mpfs_mbox_send(struct mbox_chan *chan, const void *data)
 	u32 mailbox_val, cmd_shifted, value;
 	u8 *byte_buf;
 	u8 idx, byte_idx, byte_offset;
+	int ret;
 
 	u32 *word_buf = (u32 *)msg->cmd_data;
 
@@ -86,13 +88,19 @@ static int mpfs_mbox_send(struct mbox_chan *chan, const void *data)
 
 	regmap_write(mbox->control_scb, SERVICES_CR_OFFSET, cmd_shifted);
 
-	do {
-		regmap_read(mbox->control_scb, SERVICES_CR_OFFSET, &value);
-	} while (SERVICE_CR_REQ_MASK == (value & SERVICE_CR_REQ_MASK));
+	ret = regmap_read_poll_timeout(mbox->control_scb, SERVICES_CR_OFFSET,
+				       value, !(value & SERVICE_CR_REQ_MASK),
+				       1, /* poll every 1 µs */
+				       20); /* timeout 20 ms */
+	if (ret)
+		return ret;
 
-	do {
-		regmap_read(mbox->control_scb, SERVICES_SR_OFFSET, &value);
-	} while (SERVICE_SR_BUSY_MASK == (value & SERVICE_SR_BUSY_MASK));
+	ret = regmap_read_poll_timeout(mbox->control_scb, SERVICES_SR_OFFSET,
+				       value, !(value & SERVICE_SR_BUSY_MASK),
+				       1,
+				       20);
+	if (ret)
+		return ret;
 
 	msg->response->resp_status = (value >> SERVICE_SR_STATUS_SHIFT);
 	if (msg->response->resp_status)
-- 
2.43.0

[PATCH 7/8] mailbox: mpfs: add bounded wait for BUSY to clear before sending request

[Jamie Gibbons]

The MPFS mailbox driver currently checks the BUSY bit at the start of
mpfs_mbox_send() and immediately returns -EBUSY if the controller is
busy.

On MPFS, BUSY may be transiently asserted during early boot even though
no other U-Boot service is actively executing. In Linux, returning
-EBUSY here is retryable via the mailbox framework and scheduler, but in
U-Boot this results in a hard failure.

Replace the immediate BUSY check with a bounded wait using
regmap_read_poll_timeout(), waiting for the controller to become idle
before issuing a new request. This preserves the intent of the BUSY
check while avoiding spurious early-boot failures in U-Boot’s
synchronous, polled execution model.

The timeout is conservative and based on observed MPFS behaviour, where
BUSY clears within a few milliseconds.

Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
---
 drivers/mailbox/mpfs-mbox.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/mailbox/mpfs-mbox.c b/drivers/mailbox/mpfs-mbox.c
index 165d9d89630..8b7a2719330 100644
--- a/drivers/mailbox/mpfs-mbox.c
+++ b/drivers/mailbox/mpfs-mbox.c
@@ -65,8 +65,11 @@ static int mpfs_mbox_send(struct mbox_chan *chan, const void *data)
 
 	u32 *word_buf = (u32 *)msg->cmd_data;
 
-	if (mpfs_mbox_busy(chan))
-		return -EBUSY;
+	ret = regmap_read_poll_timeout(mbox->control_scb, SERVICES_SR_OFFSET,
+				       value, !(value & SERVICE_SR_BUSY_MASK),
+				       1, 20);
+	if (ret)
+		return ret;
 
 	for (idx = 0; idx < (msg->cmd_data_size / BYTES_4); idx++)
 		writel(word_buf[idx], mbox->mbox_base + msg->mbox_offset + idx * BYTES_4);
-- 
2.43.0

[PATCH 8/8] boot: fdt: downgrade KASLR RNG failure to warning

[Jamie Gibbons]

During early boot, dm_rng_read() may fail if the underlying RNG
is temporarily unavailable. This causes KASLR seeding to fail,
but does not affect boot correctness.

Currently, fdt_kaslrseed() treats this condition as a hard error
and logs an error message, even though the system continues to
boot normally.

Downgrade the failure to a warning and continue booting without
KASLR, making the behaviour explicit without implying a fatal
error.

Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
---
 boot/fdt_support.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/boot/fdt_support.c b/boot/fdt_support.c
index 1c215e548db..aba1841a9f5 100644
--- a/boot/fdt_support.c
+++ b/boot/fdt_support.c
@@ -308,9 +308,16 @@ int fdt_kaslrseed(void *fdt, bool overwrite)
 		return err;
 	}
 	err = dm_rng_read(dev, &data, sizeof(data));
-	if (err) {
-		dev_err(dev, "dm_rng_read failed: %d\n", err);
-		return err;
+	if (err < 0) {
+		/*
+		* RNG may be unavailable during early boot.
+		* KASLR is best-effort in this case; warn and continue.
+		*/
+		dev_warn(dev, "KASLR seed unavailable (RNG error %d), continuing without KASLR\n", err);
+		return 0;
+	} else if (err != sizeof(data)) {
+		dev_warn(dev, "KASLR seed unavailable (no entropy), continuing without KASLR\n");
+		return 0;
 	}
 	err = fdt_setprop(fdt, nodeoffset, "kaslr-seed", &data, sizeof(data));
 	if (err < 0)
-- 
2.43.0

Re: [PATCH 1/8] cmd: rng: fix error handling for dm_rng_read()

[Simon Glass]

Hi Jamie,

On 2026-06-25T12:23:17, Jamie Gibbons <jamie.gibbons@microchip.com> wrote:
> cmd: rng: fix error handling for dm_rng_read()
>
> The rng command treated any non-zero return value from dm_rng_read() as
> an error, even though the API returns the number of bytes read on
> success.
>
> Update the error handling to only report a failure when dm_rng_read()
> returns a negative error code, or when a short read occurs.
>
> This fixes false "Reading RNG failed" messages when RNG drivers
> successfully return data.
>
> Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
>
> cmd/rng.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

> diff --git a/cmd/rng.c b/cmd/rng.c
> @@ -62,7 +62,7 @@ static int do_rng(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[])
>       n = min(n, sizeof(buf));
>
>       err = dm_rng_read(dev, buf, n);
> -     if (err) {
> +     if (err < 0 || err != n) {
>               puts(err == -EINTR ? 'Abort\n' : "Reading RNG failed\n");
>               ret = CMD_RET_FAILURE;
>       } else {

Not quite. The contract in include/rng.h is:

    Return:     0 if OK, -ve on error

and every existing driver (arm_rndr, sandbox_rng, stm32_rng, etc.)
returns 0 on success, not the byte count. With this change those
drivers will hit err != n and the command will print 'Reading RNG
failed' for every successful read.

The real problem is that the new mpfs_rng driver in patch 4 returns
len on success instead of 0. Fix it there - make mpfs_rng_read()
return 0 on success like the rest of the uclass.

If you want to change the uclass contract to "returns bytes read"
(matching Linux hwrng semantics), that is a much bigger change: update
dm_rng_read()'s kerneldoc, convert every in-tree driver, and update
all callers (cmd/rng.c, boot/fdt_support.c, lib/uuid.c, efi_loader,
etc.). It should not be slipped in via a one-line cmd/rng.c tweak.

Also, n is size_t and err is int, so err != n is a signed/unsigned comparison.

Regards,
Simon

Re: [PATCH 8/8] boot: fdt: downgrade KASLR RNG failure to warning

[Simon Glass]

Hi Jamie,

On 2026-06-25T12:23:17, Jamie Gibbons <jamie.gibbons@microchip.com> wrote:
> boot: fdt: downgrade KASLR RNG failure to warning
>
> During early boot, dm_rng_read() may fail if the underlying RNG
> is temporarily unavailable. This causes KASLR seeding to fail,
> but does not affect boot correctness.
>
> Currently, fdt_kaslrseed() treats this condition as a hard error
> and logs an error message, even though the system continues to
> boot normally.
>
> Downgrade the failure to a warning and continue booting without
> KASLR, making the behaviour explicit without implying a fatal
> error.
>
> Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
>
> boot/fdt_support.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)

> diff --git a/boot/fdt_support.c b/boot/fdt_support.c
> @@ -314,9 +314,16 @@ int fdt_kaslrseed(void *fdt, bool overwrite)
>       err = dm_rng_read(dev, &data, sizeof(data));
> -     if (err) {
> -             dev_err(dev, "dm_rng_read failed: %d\n", err);
> -             return err;
> +     if (err < 0) {
> +             /*
> +             * RNG may be unavailable during early boot.
> +             * KASLR is best-effort in this case; warn and continue.
> +             */

The continuation '*' should be aligned with the '*' of '/*':

checkpatch should catch this.

> diff --git a/boot/fdt_support.c b/boot/fdt_support.c
> @@ -314,9 +314,16 @@ int fdt_kaslrseed(void *fdt, bool overwrite)
> +     } else if (err != sizeof(data)) {
> +             dev_warn(dev, "KASLR seed unavailable (no entropy), continuing without KASLR\n");
> +             return 0;
>       }

Please drop this branch - see comments on patch 1 about the
dm_rng_read() contract.

> diff --git a/boot/fdt_support.c b/boot/fdt_support.c
> @@ -314,9 +314,16 @@ int fdt_kaslrseed(void *fdt, bool overwrite)
> -     if (err) {
> -             dev_err(dev, "dm_rng_read failed: %d\n", err);
> -             return err;
> +     if (err < 0) {
> +             /*
> +             * RNG may be unavailable during early boot.
> +             * KASLR is best-effort in this case; warn and continue.
> +             */
> +             dev_warn(dev, "KASLR seed unavailable (RNG error %d), continuing without KASLR\n", err);
> +             return 0;

This is a behavioural change for every platform that uses
fdt_kaslrseed(), not just MPFS - the commit message frames it as
MPFS-specific but the effect is global. cmd/kaslrseed.c does 'if
(fdt_kaslrseed(working_fdt, true) < 0)' to decide CMD_RET_FAILURE, so
the user-invoked kaslrseed command will now silently succeed even when
no seed was written. Please mention the cross-platform impact in the
commit message, and consider whether the explicit command should still
propagate the error (e.g. keep the propagation in the caller, or add a
best_effort flag).

> diff --git a/boot/fdt_support.c b/boot/fdt_support.c
> @@ -314,9 +314,16 @@ int fdt_kaslrseed(void *fdt, bool overwrite)
> +             dev_warn(dev, "KASLR seed unavailable (RNG error %d), continuing without KASLR\n", err);

Just to check - have you considered log_warning() at a lower
verbosity, or only warning once? Repeated boot messages tend to
attract bug reports.

Regards,
Simon

Re: [PATCH 2/8] misc: mpfs_syscontroller: add mailbox RX helper for service responses

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 52 bytes --]

Acked-by: Conor Dooley <conor.dooley@microchip.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 3/8] misc: mpfs_syscontroller: bind RNG sub-device

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 52 bytes --]

Acked-by: Conor Dooley <conor.dooley@microchip.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 4/8] rng: add Microchip PolarFire SoC hardware RNG driver

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 5891 bytes --]

On Thu, Jun 25, 2026 at 01:23:21PM +0100, Jamie Gibbons wrote:
> Add a U-Boot RNG driver for Microchip's PolarFire SoC (MPFS). The
> hardware RNG is accessed indirectly via the MPFS system controller using
> the mailbox interface.
> 
> The driver implements the UCLASS_RNG interface, requesting random data
> from the system controller and returning it to the caller.
> 
> This allows use of the PolarFire SoC hardware RNG via the
> standard 'rng' command and DM RNG API.
> 
> Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
> ---
>  configs/microchip_mpfs_generic_defconfig |   1 +
>  drivers/rng/Kconfig                      |   7 ++
>  drivers/rng/Makefile                     |   1 +
>  drivers/rng/mpfs_rng.c                   | 106 +++++++++++++++++++++++
>  4 files changed, 115 insertions(+)
>  create mode 100644 drivers/rng/mpfs_rng.c
> 
> diff --git a/configs/microchip_mpfs_generic_defconfig b/configs/microchip_mpfs_generic_defconfig
> index 973ed09fa87..66acaad7e9b 100644
> --- a/configs/microchip_mpfs_generic_defconfig
> +++ b/configs/microchip_mpfs_generic_defconfig
> @@ -30,3 +30,4 @@ CONFIG_ENV_RELOC_GD_ENV_ADDR=y
>  CONFIG_BOOTP_SEND_HOSTNAME=y
>  CONFIG_DM_MTD=y
>  CONFIG_SYSRESET=y
> +CONFIG_DM_RNG=y

Not entirely sure if this change should be in this patch, but turning on
RNG_MPFS seems like a good idea to me, not just DM_RNG?

> diff --git a/drivers/rng/Kconfig b/drivers/rng/Kconfig
> index 19b2b707677..856ffda2f5e 100644
> --- a/drivers/rng/Kconfig
> +++ b/drivers/rng/Kconfig
> @@ -23,6 +23,13 @@ config RNG_MESON
>  	  Enable support for hardware random number generator
>  	  of Amlogic Meson SoCs.
>  
> +config RNG_MPFS
> +	tristate "Microchip PolarFire SoC Random Number Generator support"
> +	depends on DM_RNG && MPFS_SYSCONTROLLER
> +	help
> +	  Enable support for hardware random number generator
> +	  of Microchip's PolarFire SoCs.
> +
>  config RNG_SANDBOX
>  	bool "Sandbox random number generator"
>  	depends on SANDBOX
> diff --git a/drivers/rng/Makefile b/drivers/rng/Makefile
> index 30c58272d41..50622d4705f 100644
> --- a/drivers/rng/Makefile
> +++ b/drivers/rng/Makefile
> @@ -5,6 +5,7 @@
>  
>  obj-$(CONFIG_$(PHASE_)DM_RNG) += rng-uclass.o
>  obj-$(CONFIG_RNG_MESON) += meson-rng.o
> +obj-$(CONFIG_RNG_MPFS) += mpfs_rng.o
>  obj-$(CONFIG_RNG_SANDBOX) += sandbox_rng.o
>  obj-$(CONFIG_RNG_MSM) += msm_rng.o
>  obj-$(CONFIG_RNG_NPCM) += npcm_rng.o
> diff --git a/drivers/rng/mpfs_rng.c b/drivers/rng/mpfs_rng.c
> new file mode 100644
> index 00000000000..61bd520d8a2
> --- /dev/null
> +++ b/drivers/rng/mpfs_rng.c
> @@ -0,0 +1,106 @@
> +// SPDX-License-Identifier: GPL-2.0+
> +/*
> + * Microchip's PolarFire SoC (MPFS) System Controller Driver
> + *
> + * Copyright (C) 2026 Microchip Technology Inc. All rights reserved.
> + *
> + * Author: Jamie Gibbons <jamie.gibbons@microchip.com>
> + *
> + */
> +
> +#include <dm.h>
> +#include <dm/device.h>
> +#include <dm/device_compat.h>
> +#include <dm/devres.h>
> +#include <linux/err.h>
> +#include <linux/errno.h>
> +#include <linux/io.h>
> +#include <linux/printk.h>
> +#include <mailbox.h>
> +#include <malloc.h>
> +#include <mpfs-mailbox.h>
> +#include <rng.h>
> +#include <string.h>
> +
> +#define CMD_OPCODE						0x21
> +#define CMD_DATA_SIZE					0U
> +#define CMD_DATA						NULL
> +#define MBOX_OFFSET						0U
> +#define RESP_OFFSET						0U
> +#define RNG_RESP_BYTES					32U
> +
> +/**
> + * struct mpfs_rng_priv - Structure representing System Controller data.
> + * @mpfs_syscontroller_priv:	System Controller
> + */
> +struct mpfs_rng_priv {
> +	struct mpfs_syscontroller_priv *sys_controller;
> +};
> +
> +static int mpfs_rng_read(struct udevice *dev, void *data, size_t len)
> +{
> +	struct mpfs_rng_priv *rng_priv = dev_get_priv(dev);
> +	u32 response_msg[RNG_RESP_BYTES / sizeof(u32)];
> +	size_t count = 0, copy_size;
> +	int ret;
> +
> +	struct mpfs_mss_response response = {
> +		.resp_status = 0U,
> +		.resp_msg = (u32*)response_msg,
> +		.resp_size = RNG_RESP_BYTES,
> +	};
> +	struct mpfs_mss_msg msg = {
> +		.cmd_opcode = CMD_OPCODE,
> +		.cmd_data_size = CMD_DATA_SIZE,
> +		.response = &response,
> +		.cmd_data = CMD_DATA,
> +		.mbox_offset = MBOX_OFFSET,
> +		.resp_offset = RESP_OFFSET,
> +	};
> +
> +	while (count < len) {
> +		ret = mpfs_syscontroller_run_service(rng_priv->sys_controller, &msg);
> +		if (ret == -EBUSY)
> +			return 0;
> +		if (ret)
> +			return ret;

With patch 7, isn't this redundant because there's no longer any chance
of getting an -EBUSY anymore?

> +
> +		ret = mpfs_syscontroller_recv_response(rng_priv->sys_controller, &msg, 1000);
> +		if (ret == -EBUSY)
> +			return 0;
> +		if (ret)
> +			return ret;
> +
> +		copy_size = (len - count > RNG_RESP_BYTES) ? RNG_RESP_BYTES : (len - count);
> +		memcpy((u8 *)data + count, response_msg, copy_size);
> +		count += copy_size;
> +	}
> +
> +	return len;
> +}
> +
> +static int mpfs_rng_probe(struct udevice *dev)
> +{
> +	struct mpfs_rng_priv *rng_priv = dev_get_priv(dev);
> +
> +	rng_priv->sys_controller = mpfs_syscontroller_get(dev->parent);
> +	if (IS_ERR(rng_priv->sys_controller)) {
> +		dev_err(dev, "Failed to get system controller\n");
> +		return PTR_ERR(rng_priv->sys_controller);
> +	}
> +
> +	dev_info(dev, "Registered MPFS hwrng\n");

This seems like a development printout that can be dropped?

Cheers,
Conor.

> +	return 0;
> +}
> +
> +static const struct dm_rng_ops mpfs_rng_ops = {
> +	.read = mpfs_rng_read,
> +};
> +
> +U_BOOT_DRIVER(mpfs_rng) = {
> +	.name           = "mpfs_rng",
> +	.id             = UCLASS_RNG,
> +	.probe          = mpfs_rng_probe,
> +	.priv_auto	    = sizeof(struct mpfs_rng_priv),
> +	.ops            = &mpfs_rng_ops,
> +};
> -- 
> 2.43.0
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 5/8] configs: microchip_mpfs_generic: enable MPFS RNG support

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 1166 bytes --]

On Thu, Jun 25, 2026 at 01:23:22PM +0100, Jamie Gibbons wrote:
> Enable the MPFS hardware RNG and associated infrastructure in
> the Microchip PolarFire SoC generic defconfig.
> 
> Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
> ---
>  configs/microchip_mpfs_generic_defconfig | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/configs/microchip_mpfs_generic_defconfig b/configs/microchip_mpfs_generic_defconfig
> index 66acaad7e9b..e3d794f08b9 100644
> --- a/configs/microchip_mpfs_generic_defconfig
> +++ b/configs/microchip_mpfs_generic_defconfig
> @@ -21,6 +21,7 @@ CONFIG_SYS_PBSIZE=282
>  CONFIG_DISPLAY_CPUINFO=y
>  CONFIG_DISPLAY_BOARDINFO=y
>  CONFIG_SYS_PROMPT="RISC-V # "
> +CONFIG_CMD_RNG=y
>  CONFIG_OF_UPSTREAM=y
>  CONFIG_OF_BOARD=y
>  CONFIG_OF_LIST="microchip/mpfs-icicle-kit microchip/mpfs-sev-kit"
> @@ -29,5 +30,6 @@ CONFIG_ENV_OVERWRITE_ETHADDR_ONCE=y
>  CONFIG_ENV_RELOC_GD_ENV_ADDR=y
>  CONFIG_BOOTP_SEND_HOSTNAME=y
>  CONFIG_DM_MTD=y
> -CONFIG_SYSRESET=y
>  CONFIG_DM_RNG=y
> +CONFIG_RNG_MPFS=y
> +CONFIG_SYSRESET=y

Ah right, here is is. The DM_RNG bit should move here.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 6/8] mailbox: mpfs-mbox: replace unbounded BUSY polling with bounded waits

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 55 bytes --]

Reviewed-by: Conor Dooley <conor.dooley@microchip.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 7/8] mailbox: mpfs: add bounded wait for BUSY to clear before sending request

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 55 bytes --]

Reviewed-by: Conor Dooley <conor.dooley@microchip.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]