1 /*
2  * Copyright (c) 2022 Google Inc. All rights reserved
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining
5  * a copy of this software and associated documentation files
6  * (the "Software"), to deal in the Software without restriction,
7  * including without limitation the rights to use, copy, modify, merge,
8  * publish, distribute, sublicense, and/or sell copies of the Software,
9  * and to permit persons to whom the Software is furnished to do so,
10  * subject to the following conditions:
11  *
12  * The above copyright notice and this permission notice shall be
13  * included in all copies or substantial portions of the Software.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
18  * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
19  * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
20  * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
21  * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
22  */
23 
24 #define LOCAL_TRACE 0
25 
26 #include <arch/arch_ops.h>
27 #include <assert.h>
28 #include <kernel/thread.h>
29 #include <lib/smc/smc.h>
30 #include <lk/init.h>
31 #include <lk/macros.h>
32 #include <lk/trace.h>
33 #include <platform.h>
34 #include <platform/random.h>
35 #include <string.h>
36 
37 #include "arm_trng.h"
38 
39 #define US2NS(us) ((us) * (1000ULL))
40 #define MS2NS(ms) (US2NS(ms) * 1000ULL)
41 
42 #if ARCH_ARM64
43 #define ARM_TRNG_RND_SMC SMC_FC64_TRNG_RND
44 #else
45 #define ARM_TRNG_RND_SMC SMC_FC_TRNG_RND
46 #endif
47 
48 static atomic_bool checked_for_support;
49 
arm_trng_check_for_support(void)50 static void arm_trng_check_for_support(void) {
51     if (atomic_load_explicit(&checked_for_support, memory_order_acquire)) {
52         return;
53     }
54 
55     struct smc_ret8 smc_ret;
56     smc_ret = smc8(SMC_FC_TRNG_VERSION, 0, 0, 0, 0, 0, 0, 0);
57     if ((long)smc_ret.r0 < 0) {
58         panic("ARM TRNG version SMC error: %lx\n", smc_ret.r0);
59     }
60 
61     long trng_major_version = (long)smc_ret.r0 >> 16;
62     if (trng_major_version != SMC_TRNG_CURRENT_MAJOR_VERSION) {
63         panic("ARM TRNG unexpected version, got %ld expected %ld\n",
64               trng_major_version, (long)SMC_TRNG_CURRENT_MAJOR_VERSION);
65     }
66 
67     smc_ret = smc8(SMC_FC_TRNG_FEATURES, ARM_TRNG_RND_SMC, 0, 0, 0, 0, 0, 0);
68     if ((long)smc_ret.r0 < 0) {
69         panic("ARM TRNG features SMC error: %lx\n", smc_ret.r0);
70     }
71 
72     atomic_store_explicit(&checked_for_support, true, memory_order_release);
73 }
74 
arm_trng_copy_register(uint8_t ** buf_ptr,ulong * reg,size_t * len_ptr)75 static void arm_trng_copy_register(uint8_t** buf_ptr,
76                                    ulong* reg,
77                                    size_t* len_ptr) {
78     size_t count = MIN(*len_ptr, sizeof(*reg));
79     if (!count) {
80         return;
81     }
82 
83     memcpy(*buf_ptr, reg, count);
84     *buf_ptr += count;
85     *len_ptr -= count;
86 }
87 
platform_random_get_bytes(uint8_t * buf,size_t len)88 void platform_random_get_bytes(uint8_t* buf, size_t len) {
89     arm_trng_check_for_support();
90 
91     struct smc_ret8 smc_ret;
92     size_t initial_len = len;
93     lk_time_ns_t initial_start_time = current_time_ns();
94     while (len > 0) {
95         size_t count = MIN(len, 3 * sizeof(ulong));
96         bool printed_long_wait = false;
97         lk_time_ns_t wait_start_time = current_time_ns();
98         for (;;) {
99             LTRACEF("asking for %zu bytes\n", count);
100             smc_ret = smc8(ARM_TRNG_RND_SMC, count * 8, 0, 0, 0, 0, 0, 0);
101             if ((long)smc_ret.r0 != TRNG_ERROR_NO_ENTROPY) {
102                 break;
103             }
104 
105             if (!arch_ints_disabled()) {
106                 /*
107                  * Sleep when called from thread context. The kernel enables
108                  * interrupts about when it starts the scheduler, so checking
109                  * if interrupts are enabled is a good approximation for whether
110                  * it's safe to sleep.
111                  */
112                 thread_sleep_ns(ARM_TRNG_ENTROPY_SLEEP_NS);
113             }
114 
115             if (!printed_long_wait) {
116                 lk_time_ns_t time_waited = current_time_ns() - wait_start_time;
117                 if (time_waited >= MS2NS(ARM_TRNG_LONG_WAIT_MS)) {
118                     dprintf(ALWAYS,
119                             "ARM TRNG waited for a long time: %llu ns\n",
120                             time_waited);
121                     printed_long_wait = true;
122                 }
123             }
124         }
125         if ((long)smc_ret.r0 < 0) {
126             panic("ARM TRNG RND SMC error: %lx\n", smc_ret.r0);
127         }
128 
129         arm_trng_copy_register(&buf, &smc_ret.r3, &len);
130         arm_trng_copy_register(&buf, &smc_ret.r2, &len);
131         arm_trng_copy_register(&buf, &smc_ret.r1, &len);
132     }
133 
134     lk_time_ns_t total_time = current_time_ns() - initial_start_time;
135     if (total_time >= MS2NS(ARM_TRNG_PRINT_MS)) {
136         dprintf(INFO, "ARM TRNG total time for %zu bytes: %llu ns\n",
137                 initial_len, total_time);
138     }
139 }
140