From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga07.intel.com (mga07.intel.com []) by mx.groups.io with SMTP id smtpd.web10.830.1573697867801385708 for ; Wed, 13 Nov 2019 18:17:54 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=fail (domain: intel.com, ip: , mailfrom: jian.j.wang@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga105.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 Nov 2019 18:17:54 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,302,1569308400"; d="scan'208";a="235500512" Received: from shwdeopenpsi777.ccr.corp.intel.com ([10.239.158.59]) by fmsmga002.fm.intel.com with ESMTP; 13 Nov 2019 18:17:53 -0800 From: "Wang, Jian J" To: devel@edk2.groups.io Cc: Jiewen Yao , Chao Zhang , Michael D Kinney , Liming Gao , Ray Ni Subject: [PATCH 05/11] SecurityPkg/RngLibRdSeed: add an instance of RngLib to make use rdseed Date: Thu, 14 Nov 2019 10:17:37 +0800 Message-Id: <20191114021743.3876-6-jian.j.wang@intel.com> X-Mailer: git-send-email 2.17.1.windows.2 In-Reply-To: <20191114021743.3876-1-jian.j.wang@intel.com> References: <20191114021743.3876-1-jian.j.wang@intel.com> This version of RngLib makes use of AsmRdSeed to get non-deterministic random number, which can be used for seeding other software DRNG like rand interface in openssl. It can be used only on IA32/X64 processors which supports rdseed instruction. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Jiewen Yao Cc: Chao Zhang Cc: Michael D Kinney Cc: Liming Gao Cc: Ray Ni Signed-off-by: Jian J Wang --- .../RngLibRdSeed/RngLibRdSeed.inf | 37 ++++ .../RngLibRdSeed/RngLibRdSeed.uni | 18 ++ .../RngLibRdSeed/RngRdSeed.c | 189 ++++++++++++++++++ 3 files changed, 244 insertions(+) create mode 100644 SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.inf create mode 100644 SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.uni create mode 100644 SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSeed.c diff --git a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.inf b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.inf new file mode 100644 index 0000000000..8162408775 --- /dev/null +++ b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.inf @@ -0,0 +1,37 @@ +## @file +# Instance of RNG (Random Number Generator) Library. +# +# Rng RdSeed Library that uses CPU RdSeed instruction access to provide +# non-deterministic random number which can be used as seed for other +# software deterministic RNGs. +# +# Copyright (c) 2019, Intel Corporation. All rights reserved.
+# +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +# +## + +[Defines] + INF_VERSION = 0x00010029 + BASE_NAME = RngLibRdSeed + MODULE_UNI_FILE = RngLibRdSeed.uni + FILE_GUID = 8B613B2E-B944-40F9-B979-1B60D7CAA73C + MODULE_TYPE = BASE + VERSION_STRING = 1.0 + LIBRARY_CLASS = RngLib + CONSTRUCTOR = RngLibRdSeedConstructor + +# +# VALID_ARCHITECTURES = IA32 X64 +# + +[Sources.Ia32, Sources.X64] + RngRdSeed.c + +[Packages] + MdePkg/MdePkg.dec + +[LibraryClasses] + BaseLib + DebugLib diff --git a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.uni b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.uni new file mode 100644 index 0000000000..051a3019bc --- /dev/null +++ b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRdSeed.uni @@ -0,0 +1,18 @@ +// /** @file +// Instance of RNG (Random Number Generator) Library. +// +// Rng RdSeed Library that uses CPU RdSeed instruction access to provide +// non-deterministic random number which can be used as seed for other +// software deterministic RNGs. +// +// Copyright (c) 2019, Intel Corporation. All rights reserved.
+// +// SPDX-License-Identifier: BSD-2-Clause-Patent +// +// **/ + + +#string STR_MODULE_ABSTRACT #language en-US "Instance of RNG Library" + +#string STR_MODULE_DESCRIPTION #language en-US "RngRdSeed Library that uses CPU RdSeed instruction access to provide non-deterministic random numbers." + diff --git a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSeed.c b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSeed.c new file mode 100644 index 0000000000..0036faa050 --- /dev/null +++ b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSeed.c @@ -0,0 +1,189 @@ +/** @file + Random number generator services that uses RdSeed instruction access + to provide non-deterministic random numbers, which are usually used + for seeding other pseudo-random number generators. + +Copyright (c) 2019, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include + +// +// Bit mask used to determine if RdSeed instruction is supported. +// +#define RDSEED_MASK BIT18 + +// +// Limited retry number when valid random data is returned. +// It varies between 1 and 100 according to "Intel(R) DRGN Software Implementation +// Guide". Let's use the same value as RDRAND in BaseRngLib. +// +#define RDSEED_RETRY_LIMIT 10 + +/** + The constructor function checks whether or not RDSEED instruction is supported + by the host hardware. + + The constructor function checks whether or not RDSEED instruction is supported. + It will ASSERT() if RDSEED instruction is not supported. + + @retval RETURN_SUCCESS The processor supports RDSEED instruction. + @retval RETURN_UNSUPPORTED RDSEED instruction is not supported. + +**/ +RETURN_STATUS +EFIAPI +RngLibRdSeedConstructor ( + VOID + ) +{ + UINT32 RegEbx; + + // + // Determine RDSEED support by examining bit 18 of the EBX register returned by + // CPUID(EAX=7, ECX=0). BIT18 of EBX indicates that processor support RDSEED + // instruction. + // + AsmCpuidEx (7, 0, NULL, &RegEbx, NULL, NULL); + if ((RegEbx & RDSEED_MASK) != RDSEED_MASK) { + ASSERT ((RegEbx & RDSEED_MASK) == RDSEED_MASK); + return RETURN_UNSUPPORTED; + } + + return RETURN_SUCCESS; +} + +/** + Generates a 16-bit random number. + + if Rand is NULL, then ASSERT(). + + @param[out] Rand Buffer pointer to store the 16-bit random value. + + @retval TRUE Random number generated successfully. + @retval FALSE Failed to generate the random number. + +**/ +BOOLEAN +EFIAPI +GetRandomNumber16 ( + OUT UINT16 *Rand + ) +{ + UINT32 Index; + + ASSERT (Rand != NULL); + + // + // A loop to fetch a 16 bit random value with a retry count limit. + // + for (Index = 0; Index < RDSEED_RETRY_LIMIT; Index++) { + if (AsmRdSeed16 (Rand)) { + return TRUE; + } + } + + return FALSE; +} + +/** + Generates a 32-bit random number. + + if Rand is NULL, then ASSERT(). + + @param[out] Rand Buffer pointer to store the 32-bit random value. + + @retval TRUE Random number generated successfully. + @retval FALSE Failed to generate the random number. + +**/ +BOOLEAN +EFIAPI +GetRandomNumber32 ( + OUT UINT32 *Rand + ) +{ + UINT32 Index; + + ASSERT (Rand != NULL); + + // + // A loop to fetch a 32 bit random value with a retry count limit. + // + for (Index = 0; Index < RDSEED_RETRY_LIMIT; Index++) { + if (AsmRdSeed32 (Rand)) { + return TRUE; + } + } + + return FALSE; +} + +/** + Generates a 64-bit random number. + + if Rand is NULL, then ASSERT(). + + @param[out] Rand Buffer pointer to store the 64-bit random value. + + @retval TRUE Random number generated successfully. + @retval FALSE Failed to generate the random number. + +**/ +BOOLEAN +EFIAPI +GetRandomNumber64 ( + OUT UINT64 *Rand + ) +{ + UINT32 Index; + + ASSERT (Rand != NULL); + + // + // A loop to fetch a 64 bit random value with a retry count limit. + // + for (Index = 0; Index < RDSEED_RETRY_LIMIT; Index++) { + if (AsmRdSeed64 (Rand)) { + return TRUE; + } + } + + return FALSE; +} + +/** + Generates a 128-bit random number. + + if Rand is NULL, then ASSERT(). + + @param[out] Rand Buffer pointer to store the 128-bit random value. + + @retval TRUE Random number generated successfully. + @retval FALSE Failed to generate the random number. + +**/ +BOOLEAN +EFIAPI +GetRandomNumber128 ( + OUT UINT64 *Rand + ) +{ + ASSERT (Rand != NULL); + + // + // Read first 64 bits + // + if (!GetRandomNumber64 (Rand)) { + return FALSE; + } + + // + // Read second 64 bits + // + return GetRandomNumber64 (++Rand); +} -- 2.17.1.windows.2