royzah opened a new pull request, #20191: URL: https://github.com/apache/nuttx/pull/20191
## Summary The i.MX9 has a true random number generator behind the EdgeLock Enclave, and `imx9_ele_get_random()` to reach it, but no driver registers a character device for it. The entropy pool is therefore never seeded from hardware on this chip. `stm32h7`, `nrf52`, `lpc54xx` and `rp23xx` all provide such a driver; `imx9` does not. This adds `arch/arm64/src/imx9/imx9_rng.c`, following `arch/arm/src/stm32h7/stm32_rng.c`. Two things are worth review beyond the driver itself. **`imx9_ele.c` moves behind a new `CONFIG_IMX9_ELE`.** It was built only for `CONFIG_IMX9_BOOTLOADER`, which puts the enclave out of reach of the application core. `IMX9_BOOTLOADER` now selects the new symbol, so existing configurations build exactly as before. **The ELE writes its result by DMA to a physical address.** A caller whose virtual address is not its physical one gets a buffer that was never written, and no error. Two checks make that failure loud instead of silent: an all-zero block is refused, which covers the first block, and the FIPS 140-2 continuous test refuses a repeat, which covers the rest. `up_addrenv_va_to_pa()` would be the real answer, but it is declared in `include/nuttx/arch.h` and implemented by no arm, arm64 or risc-v port. ## Impact - **Users**: new `CONFIG_IMX9_RNG`, off by default. Enabling it registers `/dev/random` and `/dev/urandom` and selects `ARCH_HAVE_RNG`. - **Build**: `CONFIG_IMX9_ELE` is new and selected by `IMX9_BOOTLOADER`. No existing defconfig changes behaviour. - **Hardware**: i.MX9 only. No register access outside the existing ELE interface. - **Security**: this is the difference between a seeded entropy pool and an unseeded one on this chip. - **Compatibility**: no existing API changes. ## Testing **Not yet run on hardware, so this is a draft.** Logs will follow before it is marked ready. Verified so far, on Ubuntu 24.04 with `aarch64-linux-gnu-gcc`: - `tools/nxstyle arch/arm64/src/imx9/imx9_rng.c`: clean. - Compiles clean under `-Wall` against the real NuttX headers with an `imx93-evk` config. Still owed, on an i.MX93 board: - `imx93-evk:nsh` build log with `CONFIG_IMX9_RNG=y`. - Runtime log showing `/dev/random` present and returning data. - Two boots producing different output, which is the behaviour this exists for. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
