[PATCH 05/11] SecurityPkg/RngLibRdSeed: add an instance of RngLib to make use rdseed

["Wang, Jian J" <jian.j.wang@intel.com>]

This version of RngLib makes use of AsmRdSeed to get non-deterministic
random number, which can be used for seeding other software DRNG like
rand interface in openssl. It can be used only on IA32/X64 processors
which supports rdseed instruction.

Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
---
 .../RngLibRdSeed/RngLibRdSeed.inf             |  37 ++++
 .../RngLibRdSeed/RngLibRdSeed.uni             |  18 ++
 .../RngLibRdSeed/RngRdSeed.c                  | 189 ++++++++++++++++++
 3 files changed, 244 insertions(+)
 create mode 100644 SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.inf
 create mode 100644 SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.uni
 create mode 100644 SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSeed.c

diff --git a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.inf b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.inf
new file mode 100644
index 0000000000..8162408775
--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.inf
@@ -0,0 +1,37 @@
+## @file
+#  Instance of RNG (Random Number Generator) Library.
+#
+#  Rng RdSeed Library that uses CPU RdSeed instruction access to provide
+#  non-deterministic random number which can be used as seed for other
+#  software deterministic RNGs.
+#
+#  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+#
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010029
+  BASE_NAME                      = RngLibRdSeed
+  MODULE_UNI_FILE                = RngLibRdSeed.uni
+  FILE_GUID                      = 8B613B2E-B944-40F9-B979-1B60D7CAA73C
+  MODULE_TYPE                    = BASE
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = RngLib
+  CONSTRUCTOR                    = RngLibRdSeedConstructor
+
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources.Ia32, Sources.X64]
+  RngRdSeed.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+
+[LibraryClasses]
+  BaseLib
+  DebugLib
diff --git a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.uni b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.uni
new file mode 100644
index 0000000000..051a3019bc
--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.uni
@@ -0,0 +1,18 @@
+// /** @file
+// Instance of RNG (Random Number Generator) Library.
+//
+// Rng RdSeed Library that uses CPU RdSeed instruction access to provide
+// non-deterministic random number which can be used as seed for other
+// software deterministic RNGs.
+//
+// Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "Instance of RNG Library"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "RngRdSeed Library that uses CPU RdSeed instruction access to provide non-deterministic random numbers."
+
diff --git a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSeed.c b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSeed.c
new file mode 100644
index 0000000000..0036faa050
--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSeed.c
@@ -0,0 +1,189 @@
+/** @file
+  Random number generator services that uses RdSeed instruction access
+  to provide non-deterministic random numbers, which are usually used
+  for seeding other pseudo-random number generators.
+
+Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/DebugLib.h>
+#include <Library/RngLib.h>
+
+//
+// Bit mask used to determine if RdSeed instruction is supported.
+//
+#define RDSEED_MASK                  BIT18
+
+//
+// Limited retry number when valid random data is returned.
+// It varies between 1 and 100 according to "Intel(R) DRGN Software Implementation
+// Guide". Let's use the same value as RDRAND in BaseRngLib.
+//
+#define RDSEED_RETRY_LIMIT           10
+
+/**
+  The constructor function checks whether or not RDSEED instruction is supported
+  by the host hardware.
+
+  The constructor function checks whether or not RDSEED instruction is supported.
+  It will ASSERT() if RDSEED instruction is not supported.
+
+  @retval RETURN_SUCCESS      The processor supports RDSEED instruction.
+  @retval RETURN_UNSUPPORTED  RDSEED instruction is not supported.
+
+**/
+RETURN_STATUS
+EFIAPI
+RngLibRdSeedConstructor (
+  VOID
+  )
+{
+  UINT32  RegEbx;
+
+  //
+  // Determine RDSEED support by examining bit 18 of the EBX register returned by
+  // CPUID(EAX=7, ECX=0). BIT18 of EBX indicates that processor support RDSEED
+  // instruction.
+  //
+  AsmCpuidEx (7, 0, NULL, &RegEbx, NULL, NULL);
+  if ((RegEbx & RDSEED_MASK) != RDSEED_MASK) {
+    ASSERT ((RegEbx & RDSEED_MASK) == RDSEED_MASK);
+    return RETURN_UNSUPPORTED;
+  }
+
+  return RETURN_SUCCESS;
+}
+
+/**
+  Generates a 16-bit random number.
+
+  if Rand is NULL, then ASSERT().
+
+  @param[out] Rand     Buffer pointer to store the 16-bit random value.
+
+  @retval TRUE         Random number generated successfully.
+  @retval FALSE        Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+  OUT     UINT16                    *Rand
+  )
+{
+  UINT32  Index;
+
+  ASSERT (Rand != NULL);
+
+  //
+  // A loop to fetch a 16 bit random value with a retry count limit.
+  //
+  for (Index = 0; Index < RDSEED_RETRY_LIMIT; Index++) {
+    if (AsmRdSeed16 (Rand)) {
+      return TRUE;
+    }
+  }
+
+  return FALSE;
+}
+
+/**
+  Generates a 32-bit random number.
+
+  if Rand is NULL, then ASSERT().
+
+  @param[out] Rand     Buffer pointer to store the 32-bit random value.
+
+  @retval TRUE         Random number generated successfully.
+  @retval FALSE        Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+  OUT     UINT32                    *Rand
+  )
+{
+  UINT32  Index;
+
+  ASSERT (Rand != NULL);
+
+  //
+  // A loop to fetch a 32 bit random value with a retry count limit.
+  //
+  for (Index = 0; Index < RDSEED_RETRY_LIMIT; Index++) {
+    if (AsmRdSeed32 (Rand)) {
+      return TRUE;
+    }
+  }
+
+  return FALSE;
+}
+
+/**
+  Generates a 64-bit random number.
+
+  if Rand is NULL, then ASSERT().
+
+  @param[out] Rand     Buffer pointer to store the 64-bit random value.
+
+  @retval TRUE         Random number generated successfully.
+  @retval FALSE        Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+  OUT     UINT64                    *Rand
+  )
+{
+  UINT32  Index;
+
+  ASSERT (Rand != NULL);
+
+  //
+  // A loop to fetch a 64 bit random value with a retry count limit.
+  //
+  for (Index = 0; Index < RDSEED_RETRY_LIMIT; Index++) {
+    if (AsmRdSeed64 (Rand)) {
+      return TRUE;
+    }
+  }
+
+  return FALSE;
+}
+
+/**
+  Generates a 128-bit random number.
+
+  if Rand is NULL, then ASSERT().
+
+  @param[out] Rand     Buffer pointer to store the 128-bit random value.
+
+  @retval TRUE         Random number generated successfully.
+  @retval FALSE        Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber128 (
+  OUT     UINT64                    *Rand
+  )
+{
+  ASSERT (Rand != NULL);
+
+  //
+  // Read first 64 bits
+  //
+  if (!GetRandomNumber64 (Rand)) {
+    return FALSE;
+  }
+
+  //
+  // Read second 64 bits
+  //
+  return GetRandomNumber64 (++Rand);
+}
-- 
2.17.1.windows.2