From: "PierreGondois" <pierre.gondois@arm.com>
To: devel@edk2.groups.io
Cc: Sami Mujawar <sami.mujawar@arm.com>,
Leif Lindholm <quic_llindhol@quicinc.com>,
Ard Biesheuvel <ardb+tianocore@kernel.org>,
Rebecca Cran <rebecca@bsdio.com>,
Michael D Kinney <michael.d.kinney@intel.com>,
Liming Gao <gaoliming@byosoft.com.cn>,
Jiewen Yao <jiewen.yao@intel.com>,
Jian J Wang <jian.j.wang@intel.com>
Subject: [PATCH v7 15/19] SecurityPkg/RngDxe: Add AArch64 RawAlgorithm support through TrngLib
Date: Mon, 3 Oct 2022 09:34:59 +0200 [thread overview]
Message-ID: <20221003073503.2937059-16-Pierre.Gondois@arm.com> (raw)
In-Reply-To: <20221003073503.2937059-1-Pierre.Gondois@arm.com>
From: Sami Mujawar <sami.mujawar@arm.com>
Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668)
RawAlgorithm is used to provide access to entropy that is suitable
for cryptographic applications. Therefore, add RawAlgorithm support
that provides access to entropy using the TrngLib.
Also remove unused UefiBootServicesTableLib library inclusion
and Status variable.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
---
Notes:
v4:
- Use TrngLib from MdePkg instead of ArmPkg. This also
allows to not build ArmMonitorLib, ArmSmcLib and
ArmHvcLib. [Jiewen, Pierre]
.../RngDxe/AArch64/RngDxe.c | 28 ++++++--
.../RandomNumberGenerator/RngDxe/ArmTrng.c | 71 +++++++++++++++++++
.../RandomNumberGenerator/RngDxe/RngDxe.inf | 5 ++
SecurityPkg/SecurityPkg.dsc | 3 +
4 files changed, 103 insertions(+), 4 deletions(-)
create mode 100644 SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
index 09a5924a699b..f5910e3b999f 100644
--- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
@@ -1,11 +1,13 @@
/** @file
RNG Driver to produce the UEFI Random Number Generator protocol.
- The driver will use the RNDR instruction to produce random numbers.
+ The driver can use RNDR instruction (through the RngLib and if FEAT_RNG is
+ present) to produce random numbers. It also uses the Arm FW-TRNG interface
+ to implement EFI_RNG_ALGORITHM_RAW.
RNG Algorithms defined in UEFI 2.4:
- EFI_RNG_ALGORITHM_SP800_90_CTR_256_GUID
- - EFI_RNG_ALGORITHM_RAW - Unsupported
+ - EFI_RNG_ALGORITHM_RAW
- EFI_RNG_ALGORITHM_SP800_90_HMAC_256_GUID
- EFI_RNG_ALGORITHM_SP800_90_HASH_256_GUID
- EFI_RNG_ALGORITHM_X9_31_3DES_GUID - Unsupported
@@ -26,12 +28,14 @@
#include <Library/MemoryAllocationLib.h>
#include <Library/UefiBootServicesTableLib.h>
#include <Library/RngLib.h>
+#include <Library/DebugLib.h>
+#include <Library/TrngLib.h>
#include <Protocol/Rng.h>
#include "RngDxeInternals.h"
// Maximum number of Rng algorithms.
-#define RNG_AVAILABLE_ALGO_MAX 1
+#define RNG_AVAILABLE_ALGO_MAX 2
/** Allocate and initialize mAvailableAlgoArray with the available
Rng algorithms. Also update mAvailableAlgoArrayCount.
@@ -46,8 +50,9 @@ GetAvailableAlgorithms (
)
{
UINT64 DummyRand;
+ UINT16 MajorRevision;
+ UINT16 MinorRevision;
- // Allocate RNG_AVAILABLE_ALGO_MAX entries to avoid evaluating
// Rng algorithms 2 times, one for the allocation, one to populate.
mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
if (mAvailableAlgoArray == NULL) {
@@ -64,6 +69,16 @@ GetAvailableAlgorithms (
mAvailableAlgoArrayCount++;
}
+ // Raw algorithm (Trng)
+ if (!EFI_ERROR (GetTrngVersion (&MajorRevision, &MinorRevision))) {
+ CopyMem (
+ &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+ &gEfiRngAlgorithmRaw,
+ sizeof (EFI_RNG_ALGORITHM)
+ );
+ mAvailableAlgoArrayCount++;
+ }
+
return EFI_SUCCESS;
}
@@ -141,6 +156,11 @@ FoundAlgo:
return Status;
}
+ // Raw algorithm (Trng)
+ if (CompareGuid (RNGAlgorithm, &gEfiRngAlgorithmRaw)) {
+ return GenerateEntropy (RNGValueLength, RNGValue);
+ }
+
//
// Other algorithms are unsupported by this driver.
//
diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
new file mode 100644
index 000000000000..6100e02b32b0
--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
@@ -0,0 +1,71 @@
+/** @file
+ RNG Driver to produce the UEFI Random Number Generator protocol.
+
+ The driver implements the EFI_RNG_ALGORITHM_RAW using the FW-TRNG
+ interface to provide entropy.
+
+ Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/TrngLib.h>
+#include <Protocol/Rng.h>
+
+#include "RngDxeInternals.h"
+
+/**
+ Generate high-quality entropy source using a TRNG or through RDRAND.
+
+ @param[in] Length Size of the buffer, in bytes, to fill with.
+ @param[out] Entropy Pointer to the buffer to store the entropy data.
+
+ @retval RETURN_SUCCESS The function completed successfully.
+ @retval RETURN_INVALID_PARAMETER Invalid parameter.
+ @retval RETURN_UNSUPPORTED Function not implemented.
+ @retval RETURN_BAD_BUFFER_SIZE Buffer size is too small.
+ @retval RETURN_NOT_READY No Entropy available.
+**/
+EFI_STATUS
+EFIAPI
+GenerateEntropy (
+ IN UINTN Length,
+ OUT UINT8 *Entropy
+ )
+{
+ EFI_STATUS Status;
+ UINTN CollectedEntropyBits;
+ UINTN RequiredEntropyBits;
+ UINTN EntropyBits;
+ UINTN Index;
+ UINTN MaxBits;
+
+ ZeroMem (Entropy, Length);
+
+ RequiredEntropyBits = (Length << 3);
+ Index = 0;
+ CollectedEntropyBits = 0;
+ MaxBits = GetTrngMaxSupportedEntropyBits ();
+ while (CollectedEntropyBits < RequiredEntropyBits) {
+ EntropyBits = MIN ((RequiredEntropyBits - CollectedEntropyBits), MaxBits);
+ Status = GetTrngEntropy (
+ EntropyBits,
+ (Length - Index),
+ &Entropy[Index]
+ );
+ if (EFI_ERROR (Status)) {
+ // Discard the collected bits.
+ ZeroMem (Entropy, Length);
+ return Status;
+ }
+
+ CollectedEntropyBits += EntropyBits;
+ Index += (EntropyBits >> 3);
+ } // while
+
+ return Status;
+}
diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
index 1985dfbb4619..f6e08da96140 100644
--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
@@ -43,8 +43,10 @@ [Sources.IA32, Sources.X64]
[Sources.AARCH64]
AArch64/RngDxe.c
+ ArmTrng.c
[Packages]
+ MdeModulePkg/MdeModulePkg.dec
MdePkg/MdePkg.dec
SecurityPkg/SecurityPkg.dec
@@ -57,6 +59,9 @@ [LibraryClasses]
TimerLib
RngLib
+[LibraryClasses.AARCH64]
+ TrngLib
+
[Guids]
gEfiRngAlgorithmSp80090Hash256Guid ## SOMETIMES_PRODUCES ## GUID # Unique ID of the algorithm for RNG
gEfiRngAlgorithmSp80090Hmac256Guid ## SOMETIMES_PRODUCES ## GUID # Unique ID of the algorithm for RNG
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index f48187650f2f..690a45e89728 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -3,6 +3,7 @@
#
# Copyright (c) 2009 - 2021, Intel Corporation. All rights reserved.<BR>
# (C) Copyright 2015-2020 Hewlett Packard Enterprise Development LP<BR>
+# Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
##
@@ -88,6 +89,8 @@ [LibraryClasses.ARM, LibraryClasses.AARCH64]
ArmSoftFloatLib|ArmPkg/Library/ArmSoftFloatLib/ArmSoftFloatLib.inf
+ TrngLib|MdePkg/Library/BaseTrngLibNull/BaseTrngLibNull.inf
+
[LibraryClasses.ARM]
RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
--
2.25.1
next prev parent reply other threads:[~2022-10-03 7:35 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-03 7:34 [PATCH v7 00/19] Add Raw algorithm support using Arm FW-TRNG interface PierreGondois
2022-10-03 7:34 ` [PATCH v7 01/19] ArmPkg: PCD to select conduit for monitor calls PierreGondois
2022-10-03 7:34 ` [PATCH v7 02/19] ArmPkg/ArmMonitorLib: Definition for ArmMonitorLib library class PierreGondois
2022-10-03 7:34 ` [PATCH v7 03/19] ArmPkg/ArmMonitorLib: Add ArmMonitorLib PierreGondois
2022-10-03 7:34 ` [PATCH v7 04/19] ArmPkg: Sort HVC/SMC section alphbetically in ArmPkg.dsc PierreGondois
2022-10-03 7:34 ` [PATCH v7 05/19] ArmPkg/ArmHvcLibNull: Add NULL instance of ArmHvcLib PierreGondois
2022-10-05 11:34 ` Leif Lindholm
2022-10-03 7:34 ` [PATCH v7 06/19] MdePkg/TrngLib: Definition for TRNG library class interface PierreGondois
2022-10-03 7:34 ` [PATCH v7 07/19] MdePkg/TrngLib: Add NULL instance of TRNG Library PierreGondois
2022-10-03 7:34 ` [PATCH v7 08/19] ArmPkg: Add FID definitions for Firmware TRNG PierreGondois
2022-10-05 11:39 ` Leif Lindholm
2022-10-03 7:34 ` [PATCH v7 09/19] ArmPkg/TrngLib: Add Arm Firmware TRNG library PierreGondois
2022-10-05 11:43 ` [edk2-devel] " Leif Lindholm
2022-10-03 7:34 ` [PATCH v7 10/19] SecurityPkg/RngDxe: Rename RdRandGenerateEntropy to generic name PierreGondois
2022-10-03 7:34 ` [PATCH v7 11/19] SecurityPkg/RngDxe: Replace Pcd with Sp80090Ctr256Guid PierreGondois
2022-10-03 7:34 ` [PATCH v7 12/19] SecurityPkg/RngDxe: Remove ArchGetSupportedRngAlgorithms() PierreGondois
2022-10-03 7:34 ` [PATCH v7 13/19] SecurityPkg/RngDxe: Documentation/include/parameter cleanup PierreGondois
2022-10-03 7:34 ` [PATCH v7 14/19] SecurityPkg/RngDxe: Check before advertising Cpu Rng algo PierreGondois
2022-10-03 7:34 ` PierreGondois [this message]
2022-10-03 7:35 ` [PATCH v7 16/19] SecurityPkg/RngDxe: Add debug warning for NULL PcdCpuRngSupportedAlgorithm PierreGondois
2022-10-03 7:35 ` [PATCH v7 17/19] SecurityPkg/RngDxe: Rename AArch64/RngDxe.c PierreGondois
2022-10-05 11:44 ` Leif Lindholm
2022-10-03 7:35 ` [PATCH v7 18/19] SecurityPkg/RngDxe: Add Arm support of RngDxe PierreGondois
2022-10-03 7:35 ` [PATCH v7 19/19] ArmVirtPkg: Kvmtool: Add RNG support using FW-TRNG interface PierreGondois
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221003073503.2937059-16-Pierre.Gondois@arm.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox