Re: [DistroKit] [PATCH 11/11] v7a: barebox: enable HWRNG drivers and allow fallback to PRNG

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hello Roland,

On 5/26/25 12:39, Roland Hieber wrote:
> On Mon, May 26, 2025 at 12:20:36PM +0200, Ahmad Fatoum wrote:
>> Hi Roland,
>>
>> On 5/26/25 12:11, Roland Hieber wrote:
>>> Without ALLOW_PRNG_FALLBACK, barebox prints an unsightly error message
>>> on boot:
>>>
>>>     ERROR: no HWRNG available!
>>
>> Is this because of the stack protector? Which platforms lack the RNG?
> 
> No, it's directly from get_crypto_bytes() in lib/random.c:
> 
>     137         if (!IS_ENABLED(CONFIG_ALLOW_PRNG_FALLBACK)) {
>     138                 pr_err("no HWRNG available!\n");
>     139                 return err;
>     140         }
> 
> That's why I enabled CONFIG_ALLOW_PRNG_FALLBACK.

Yes, but why is get_crypto_bytes called in your case? Things like
MAC address generation don't use a non-secure PRNG anyways.

> In menuconfig there is:
> 
>     --- HWRNG Support
>     [ ]   Timer IOMEM HW Random Number Generator support
>     [*]   STM32 Random Number Generator
>     [*]   OP-TEE based Random Number Generator support
>     [*]   Broadcom BCM2835/BCM63xx Random Number Generator support
>     [ ]   Broadcom iProc/STB RNG200 support
>     [*]   OMAP Random Number Generator support

There is also the CAAM driver for i.MX, which is found separately in
a crypto submenu.

> I'm not sure whether we want CONFIG_HW_RANDOM_TIMERIOMEM, its help text sounds
> more like a workaround than a solution:
> 
>     This driver provides barebox support for a generic Random                                                                  │   
>     Number Generator used by reading a 'dumb' iomem address that                                                               │   
>     is to be read no faster than, for example, once a second. 

I don't think we have hardware in DistroKit that this is useful on.

Cheers,
Ahmad

> 
>  - Roland
> 
>> Cheers,
>> Ahmad
>>
>>>
>>> Since we don't have HWRNG drivers for all available platforms, enable
>>> those that we have (RPi and AM33xx). For the other platforms allow
>>> fallback to the PRNG, which will at least only print a warning on boot
>>> on platforms without HWRNG:
>>>
>>>     WARNING: falling back to Pseudo RNG source!
>>>
>>> … but in this case, this is expected.
>>>
>>> Signed-off-by: Roland Hieber <rhi@pengutronix.de>
>>> ---
>>>  configs/platform-v7a/barebox.config | 6 +++---
>>>  1 file changed, 3 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/configs/platform-v7a/barebox.config b/configs/platform-v7a/barebox.config
>>> index 4780b6493a7a..86cb40acbf17 100644
>>> --- a/configs/platform-v7a/barebox.config
>>> +++ b/configs/platform-v7a/barebox.config
>>> @@ -1106,9 +1106,9 @@ CONFIG_HWRNG=y
>>>  # CONFIG_HW_RANDOM_TIMERIOMEM is not set
>>>  CONFIG_HWRNG_STM32=y
>>>  CONFIG_HW_RANDOM_OPTEE=y
>>> -# CONFIG_HW_RANDOM_BCM2835 is not set
>>> +CONFIG_HW_RANDOM_BCM2835=y
>>>  # CONFIG_HW_RANDOM_IPROC_RNG200 is not set
>>> -# CONFIG_HW_RANDOM_OMAP is not set
>>> +CONFIG_HW_RANDOM_OMAP=y
>>>  
>>>  #
>>>  # DMA support
>>> @@ -1380,7 +1380,7 @@ CONFIG_IMAGE_SPARSE=y
>>>  CONFIG_STMP_DEVICE=y
>>>  CONFIG_LIBFDT=y
>>>  # CONFIG_RATP is not set
>>> -# CONFIG_ALLOW_PRNG_FALLBACK is not set
>>> +CONFIG_ALLOW_PRNG_FALLBACK=y
>>>  # CONFIG_CRC_CCITT is not set
>>>  CONFIG_CRC8=y
>>>  
>>
>> -- 
>> Pengutronix e.K.                  |                             |
>> Steuerwalder Str. 21              | http://www.pengutronix.de/  |
>> 31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
>> Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |
>>
>>
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |