public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "PierreGondois" <pierre.gondois@arm.com>
To: devel@edk2.groups.io
Cc: Sami Mujawar <sami.mujawar@arm.com>,
	Leif Lindholm <quic_llindhol@quicinc.com>,
	Ard Biesheuvel <ardb+tianocore@kernel.org>,
	Rebecca Cran <rebecca@bsdio.com>,
	Michael D Kinney <michael.d.kinney@intel.com>,
	Liming Gao <gaoliming@byosoft.com.cn>,
	Jiewen Yao <jiewen.yao@intel.com>,
	Jian J Wang <jian.j.wang@intel.com>
Subject: [PATCH v3 17/21] SecurityPkg/RngDxe: Add AArch64 RawAlgorithm support through TrngLib
Date: Wed, 29 Jun 2022 17:02:31 +0200	[thread overview]
Message-ID: <20220629150241.2597898-23-Pierre.Gondois@arm.com> (raw)
In-Reply-To: <20220629150241.2597898-1-Pierre.Gondois@arm.com>

From: Sami Mujawar <sami.mujawar@arm.com>

Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668)

RawAlgorithm is used to provide access to entropy that is suitable
for cryptographic applications. Therefore, add RawAlgorithm support
that provides access to entropy using the TrngLib.

Also remove unused UefiBootServicesTableLib library inclusion
and Status variable.

Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
---
 .../RngDxe/AArch64/RngDxe.c                   | 28 +++++++-
 .../RandomNumberGenerator/RngDxe/ArmTrng.c    | 71 +++++++++++++++++++
 .../RandomNumberGenerator/RngDxe/RngDxe.inf   |  5 ++
 SecurityPkg/SecurityPkg.dsc                   |  7 ++
 4 files changed, 108 insertions(+), 3 deletions(-)
 create mode 100644 SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c

diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
index d8b696bbea5f..ee3f1ee78434 100644
--- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
@@ -1,11 +1,13 @@
 /** @file
   RNG Driver to produce the UEFI Random Number Generator protocol.
 
-  The driver will use the RNDR instruction to produce random numbers.
+  The driver can use RNDR instruction (through the RngLib and if FEAT_RNG is
+  present) to produce random numbers. It also uses the Arm FW-TRNG interface
+  to implement EFI_RNG_ALGORITHM_RAW.
 
   RNG Algorithms defined in UEFI 2.4:
    - EFI_RNG_ALGORITHM_SP800_90_CTR_256_GUID
-   - EFI_RNG_ALGORITHM_RAW                    - Unsupported
+   - EFI_RNG_ALGORITHM_RAW
    - EFI_RNG_ALGORITHM_SP800_90_HMAC_256_GUID
    - EFI_RNG_ALGORITHM_SP800_90_HASH_256_GUID
    - EFI_RNG_ALGORITHM_X9_31_3DES_GUID        - Unsupported
@@ -24,6 +26,8 @@
 #include <Library/BaseMemoryLib.h>
 #include <Library/UefiBootServicesTableLib.h>
 #include <Library/RngLib.h>
+#include <Library/DebugLib.h>
+#include <Library/TrngLib.h>
 #include <Protocol/Rng.h>
 
 #include "RngDxeInternals.h"
@@ -34,7 +38,7 @@
 // populated only once.
 // The valid entry with the lowest index will be the default algorithm.
 //
-#define RNG_AVAILABLE_ALGO_MAX  1
+#define RNG_AVAILABLE_ALGO_MAX  2
 STATIC BOOLEAN            mAvailableAlgoArrayInit = FALSE;
 STATIC UINTN              mAvailableAlgoArrayCount;
 STATIC EFI_RNG_ALGORITHM  mAvailableAlgoArray[RNG_AVAILABLE_ALGO_MAX];
@@ -48,6 +52,9 @@ RngInitAvailableAlgoArray (
   VOID
   )
 {
+  UINT16  MajorRevision;
+  UINT16  MinorRevision;
+
   // Check RngGetBytes() before advertising PcdCpuRngSupportedAlgorithm.
   if (!EFI_ERROR (RngGetBytes (sizeof (Rand), (UINT8 *)&Rand))) {
     CopyMem (
@@ -58,6 +65,16 @@ RngInitAvailableAlgoArray (
     mAvailableAlgoArrayCount++;
   }
 
+  // Raw algorithm (Trng)
+  if (!EFI_ERROR (GetTrngVersion (&MajorRevision, &MinorRevision))) {
+    CopyMem (
+      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+      &gEfiRngAlgorithmRaw,
+      sizeof (EFI_RNG_ALGORITHM)
+      );
+    mAvailableAlgoArrayCount++;
+  }
+
   mAvailableAlgoArrayInit = TRUE;
 }
 
@@ -127,6 +144,11 @@ FoundAlgo:
     return Status;
   }
 
+  // Raw algorithm (Trng)
+  if (CompareGuid (RNGAlgorithm, &gEfiRngAlgorithmRaw)) {
+    return GenerateEntropy (RNGValueLength, RNGValue);
+  }
+
   //
   // Other algorithms are unsupported by this driver.
   //
diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
new file mode 100644
index 000000000000..6100e02b32b0
--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
@@ -0,0 +1,71 @@
+/** @file
+  RNG Driver to produce the UEFI Random Number Generator protocol.
+
+  The driver implements the EFI_RNG_ALGORITHM_RAW using the FW-TRNG
+  interface to provide entropy.
+
+  Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
+
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/TrngLib.h>
+#include <Protocol/Rng.h>
+
+#include "RngDxeInternals.h"
+
+/**
+  Generate high-quality entropy source using a TRNG or through RDRAND.
+
+  @param[in]   Length        Size of the buffer, in bytes, to fill with.
+  @param[out]  Entropy       Pointer to the buffer to store the entropy data.
+
+  @retval  RETURN_SUCCESS            The function completed successfully.
+  @retval  RETURN_INVALID_PARAMETER  Invalid parameter.
+  @retval  RETURN_UNSUPPORTED        Function not implemented.
+  @retval  RETURN_BAD_BUFFER_SIZE    Buffer size is too small.
+  @retval  RETURN_NOT_READY          No Entropy available.
+**/
+EFI_STATUS
+EFIAPI
+GenerateEntropy (
+  IN  UINTN  Length,
+  OUT UINT8  *Entropy
+  )
+{
+  EFI_STATUS  Status;
+  UINTN       CollectedEntropyBits;
+  UINTN       RequiredEntropyBits;
+  UINTN       EntropyBits;
+  UINTN       Index;
+  UINTN       MaxBits;
+
+  ZeroMem (Entropy, Length);
+
+  RequiredEntropyBits  = (Length << 3);
+  Index                = 0;
+  CollectedEntropyBits = 0;
+  MaxBits              = GetTrngMaxSupportedEntropyBits ();
+  while (CollectedEntropyBits < RequiredEntropyBits) {
+    EntropyBits = MIN ((RequiredEntropyBits - CollectedEntropyBits), MaxBits);
+    Status      = GetTrngEntropy (
+                    EntropyBits,
+                    (Length - Index),
+                    &Entropy[Index]
+                    );
+    if (EFI_ERROR (Status)) {
+      // Discard the collected bits.
+      ZeroMem (Entropy, Length);
+      return Status;
+    }
+
+    CollectedEntropyBits += EntropyBits;
+    Index                += (EntropyBits >> 3);
+  } // while
+
+  return Status;
+}
diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
index 60efb5562ee0..6c3d42066804 100644
--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
@@ -42,8 +42,10 @@ [Sources.IA32, Sources.X64]
 
 [Sources.AARCH64]
   AArch64/RngDxe.c
+  ArmTrng.c
 
 [Packages]
+  MdeModulePkg/MdeModulePkg.dec
   MdePkg/MdePkg.dec
   SecurityPkg/SecurityPkg.dec
 
@@ -56,6 +58,9 @@ [LibraryClasses]
   TimerLib
   RngLib
 
+[LibraryClasses.AARCH64]
+  TrngLib
+
 [Guids]
   gEfiRngAlgorithmSp80090Hash256Guid  ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
   gEfiRngAlgorithmSp80090Hmac256Guid  ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index d883747474e4..490076542a33 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -3,6 +3,7 @@
 #
 # Copyright (c) 2009 - 2021, Intel Corporation. All rights reserved.<BR>
 # (C) Copyright 2015-2020 Hewlett Packard Enterprise Development LP<BR>
+# Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
 # SPDX-License-Identifier: BSD-2-Clause-Patent
 #
 ##
@@ -87,6 +88,12 @@ [LibraryClasses.ARM, LibraryClasses.AARCH64]
 
   ArmSoftFloatLib|ArmPkg/Library/ArmSoftFloatLib/ArmSoftFloatLib.inf
 
+  # Arm FW-TRNG interface library.
+  TrngLib|ArmPkg/Library/ArmFwTrngLib/ArmFwTrngLib.inf
+  ArmMonitorLib|ArmPkg/Library/ArmMonitorLib/ArmMonitorLib.inf
+  ArmSmcLib|ArmPkg/Library/ArmSmcLib/ArmSmcLib.inf
+  ArmHvcLib|ArmPkg/Library/ArmHvcLib/ArmHvcLib.inf
+
 [LibraryClasses.ARM]
   RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
 
-- 
2.25.1


  parent reply	other threads:[~2022-06-29 15:04 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-29 15:02 [PATCH v3 00/22] Add Raw algorithm support using Arm FW-TRNG interface PierreGondois
2022-06-29 15:02 ` [PATCH v3 01/22] ArmPkg: PCD to select conduit for monitor calls PierreGondois
2022-06-29 15:02 ` [PATCH v3 02/22] ArmPkg/ArmMonitorLib: Definition for ArmMonitorLib library class PierreGondois
2022-06-29 15:02 ` [PATCH v3 03/22] ArmPkg/ArmMonitorLib: Add ArmMonitorLib PierreGondois
2022-06-29 15:02 ` [PATCH v3 04/22] ArmPkg/ArmHvcNullLib: Add NULL instance of ArmHvcLib PierreGondois
2022-06-29 15:02 ` [PATCH v3 05/22] MdePkg/TrngLib: Definition for TRNG library class interface PierreGondois
2022-06-29 15:02 ` [PATCH v3 06/22] MdePkg/TrngLib: Add NULL instance of TRNG Library PierreGondois
2022-06-29 15:02 ` [PATCH v3 07/22] ArmPkg: Add FID definitions for Firmware TRNG PierreGondois
2022-06-29 15:02 ` [PATCH v3 08/22] ArmPkg/TrngLib: Add Arm Firmware TRNG library PierreGondois
2022-06-29 15:02 ` [PATCH v3 09/22] MdePkg/BaseRngLib: Rename ArmReadIdIsar0() to ArmGetFeatRng() PierreGondois
2022-06-29 15:02 ` [PATCH v3 10/22] ArmPkg/ArmLib: Add ArmReadIdIsar0() helper PierreGondois
2022-06-29 15:02 ` [PATCH v3 11/22] ArmPkg/ArmLib: Add ArmHasRngExt() PierreGondois
2022-06-29 15:02 ` [PATCH v3 12/21] SecurityPkg/RngDxe: Rename RdRandGenerateEntropy to generic name PierreGondois
2022-06-29 15:02 ` [PATCH v3 12/22] SecurityPkg: Update Securitypkg.ci.yaml PierreGondois
2022-06-29 15:02 ` [PATCH v3 13/22] SecurityPkg/RngDxe: Rename RdRandGenerateEntropy to generic name PierreGondois
2022-06-29 15:02 ` [PATCH v3 13/21] SecurityPkg/RngDxe: Replace Pcd with Sp80090Ctr256Guid PierreGondois
2022-06-29 15:02 ` [PATCH v3 14/21] SecurityPkg/RngDxe: Remove ArchGetSupportedRngAlgorithms() PierreGondois
2022-06-29 15:02 ` [PATCH v3 14/22] SecurityPkg/RngDxe: Replace Pcd with Sp80090Ctr256Guid PierreGondois
2022-07-21 10:51   ` Yao, Jiewen
2022-06-29 15:02 ` [PATCH v3 15/21] SecurityPkg/RngDxe: Documentation/include/parameter cleanup PierreGondois
2022-06-29 15:02 ` [PATCH v3 15/22] SecurityPkg/RngDxe: Remove ArchGetSupportedRngAlgorithms() PierreGondois
2022-06-29 15:02 ` [PATCH v3 16/21] SecurityPkg/RngDxe: Check before advertising Cpu Rng algo PierreGondois
2022-06-29 15:02 ` [PATCH v3 16/22] SecurityPkg/RngDxe: Documentation/include/parameter cleanup PierreGondois
2022-06-29 15:02 ` PierreGondois [this message]
2022-06-29 15:02 ` [PATCH v3 17/22] SecurityPkg/RngDxe: Check before advertising Cpu Rng algo PierreGondois
2022-06-29 15:02 ` [PATCH v3 18/22] SecurityPkg/RngDxe: Add AArch64 RawAlgorithm support through TrngLib PierreGondois
2022-06-29 15:02 ` [PATCH v3 18/21] SecurityPkg/RngDxe: Add debug warning for NULL PcdCpuRngSupportedAlgorithm PierreGondois
2022-06-29 15:02 ` [PATCH v3 19/22] " PierreGondois
2022-06-29 15:02 ` [PATCH v3 19/21] SecurityPkg/RngDxe: Rename AArch64/RngDxe.c PierreGondois
2022-06-29 15:02 ` [PATCH v3 20/21] SecurityPkg/RngDxe: Add Arm support of RngDxe PierreGondois
2022-07-21 10:47   ` Yao, Jiewen
2022-06-29 15:02 ` [PATCH v3 20/22] SecurityPkg/RngDxe: Rename AArch64/RngDxe.c PierreGondois
2022-06-29 15:02 ` [PATCH v3 21/21] ArmVirtPkg: Kvmtool: Add RNG support using FW-TRNG interface PierreGondois
2022-06-29 15:02 ` [PATCH v3 21/22] SecurityPkg/RngDxe: Add Arm support of RngDxe PierreGondois
2022-06-29 15:02 ` [PATCH v3 22/22] ArmVirtPkg: Kvmtool: Add RNG support using FW-TRNG interface PierreGondois

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220629150241.2597898-23-Pierre.Gondois@arm.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox