From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) by mx.groups.io with SMTP id smtpd.web10.22101.1669131139798328502 for ; Tue, 22 Nov 2022 07:32:20 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20210112 header.b=lumvOgRA; spf=pass (domain: gmail.com, ip: 209.85.221.52, mailfrom: pedro.falcato@gmail.com) Received: by mail-wr1-f52.google.com with SMTP id v1so25230946wrt.11 for ; Tue, 22 Nov 2022 07:32:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=9hqQ/EGM8d4mcAlqTJ1KkQ3MWgNlQJX7DzsU+aDgcXQ=; b=lumvOgRASI93LJakMXbv1pwrWkb7EnPN6KYguFtBy70xhlX06M0bwlLkWCiguBFfPH ULVc9zXPOEqntSZTaPFJeGyNiCJ8gqkgzsOVebEZPNf9URK7Mhb3apYECXrAKiTo9Ji3 8Jbki/9B6g5EnQfsmVOAxOT61PKXrzYBLh1kIQ6MXYzotJLidP/9VbRLT0wJbi4EXGVg JcCJvuf/s4dUXTYd3fZJoT30XvPPcwLVhQ0iNO+1LLsfoMGJEoRAjb4lvaRkZnXsb/R8 U2l19F/JevKqxpD7hLG0e+eAYqSLLOFIDNOnar5yBiFx3qtxbgYsEKs0ugwITPhPUE1T jvMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=9hqQ/EGM8d4mcAlqTJ1KkQ3MWgNlQJX7DzsU+aDgcXQ=; b=j2VzoU0XtWURv88LPGYdKm8+onGi7llxlvSr6WE8Sx5OfNeFlIsCqwbJ6z5Fzl0MXJ YHZvxkLW/Xp/zX4n4AJN3oEP2uTD/a8IFT8qOcKZ5wwjP9jANgfxfTejZ+0QKt+6Zmss 5S0q474Spm6L28EwhCzGHMiLpH1zCsIsWVlEd5nlylpTCOt+IO6vd85PCsk1prwNoDi4 tzCtkTz5vKVkHedqHUBx0N6xUR5UbdtbIwCLDf7kZtGdkDpmkBD+txxeLsI/kuSZbi2V XmZ5WLb8esupwyNuEFWDwq2aNlsDNw265GsERtPkRtWsPwZjHdurlGkGWZ7khahMWnnf Q9DQ== X-Gm-Message-State: ANoB5pnWY6Hm+dLtj2jremiacSUSM7ptIbBJdvE6GkuWpUWsySttidId izbz/wG/lKYJtl9w+Cm8zoh6P5PqodRATXQB X-Google-Smtp-Source: AA0mqf4SSWAa/ALUrEMAwqlWTXh9huHJScV6hSbWeheB1OhgIv+v963ymvI7mtJWrsT+fF6OM2tA6w== X-Received: by 2002:a05:6000:137b:b0:241:d94c:9841 with SMTP id q27-20020a056000137b00b00241d94c9841mr5436602wrz.206.1669131137856; Tue, 22 Nov 2022 07:32:17 -0800 (PST) Return-Path: Received: from PC-PEDRO-ARCH.lan ([2001:8a0:7280:5801:9441:3dce:686c:bfc7]) by smtp.gmail.com with ESMTPSA id n3-20020a05600c4f8300b003d01b84e9b2sm9051480wmq.27.2022.11.22.07.32.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Nov 2022 07:32:17 -0800 (PST) From: "Pedro Falcato" To: devel@edk2.groups.io Cc: Pedro Falcato , Michael D Kinney , Liming Gao , Zhiguang Liu , "Jason A . Donenfeld" Subject: [PATCH v2 1/1] MdePkg/BaseRngLib: Add a smoketest for RDRAND and check CPUID Date: Tue, 22 Nov 2022 15:32:12 +0000 Message-Id: <20221122153212.570984-1-pedro.falcato@gmail.com> X-Mailer: git-send-email 2.38.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit RDRAND has notoriously been broken many times over its lifespan. Add a smoketest to RDRAND, in order to better sniff out potential security concerns. Also add a proper CPUID test in order to support older CPUs which may not have it; it was previously being tested but then promptly ignored. Many thanks to Jason Donenfeld for relicensing his linux RDRAND detection code to MIT and the public domain. >On Tue, Nov 22, 2022 at 2:21 PM Jason A. Donenfeld wrote: <..> > I (re)wrote that function in Linux. I hereby relicense it as MIT, and > also place it into public domain. Do with it what you will now. > > Jason Signed-off-by: Pedro Falcato Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jason A. Donenfeld --- MdePkg/Library/BaseRngLib/Rand/RdRand.c | 83 ++++++++++++++++++++++--- 1 file changed, 75 insertions(+), 8 deletions(-) diff --git a/MdePkg/Library/BaseRngLib/Rand/RdRand.c b/MdePkg/Library/BaseRngLib/Rand/RdRand.c index 070d41e2555f..c8f837c315f1 100644 --- a/MdePkg/Library/BaseRngLib/Rand/RdRand.c +++ b/MdePkg/Library/BaseRngLib/Rand/RdRand.c @@ -2,6 +2,7 @@ Random number generator services that uses RdRand instruction access to provide high-quality random numbers. +Copyright (c) 2022, Pedro Falcato. All rights reserved.
Copyright (c) 2021, NUVIA Inc. All rights reserved.
Copyright (c) 2015, Intel Corporation. All rights reserved.
@@ -22,6 +23,72 @@ SPDX-License-Identifier: BSD-2-Clause-Patent STATIC BOOLEAN mRdRandSupported; +// +// Intel SDM says 10 tries is good enough for reliable RDRAND usage. +// +#define RDRAND_RETRIES 10 + +#define RDRAND_TEST_SAMPLES 8 + +#define RDRAND_MIN_CHANGE 5 + +STATIC +BOOLEAN +TestRdRand ( + VOID + ) +{ + // + // Test for notoriously broken rdrand implementations that always return the same + // value, like the Zen 3 uarch (all-1s) or other several AMD families on suspend/resume (also all-1s). + // Note that this should be expanded to extensively test for other sorts of possible errata. + // + + // + // Testing algorithm inspired by linux's arch/x86/kernel/cpu/rdrand.c:x86_init_rdrand + // as relicensed by the author, Jason Donenfeld, in the EDK2 mailing list. + // As is, the algorithm samples rdrand $RDRAND_TEST_SAMPLES times and expects + // a different result $RDRAND_MIN_CHANGE times for reliable RDRAND usage. + // + UINT32 Prev; + UINT8 Idx; + UINT8 TestIteration; + UINT32 Changed; + + Changed = 0; + + for (TestIteration = 0; TestIteration < RDRAND_TEST_SAMPLES; TestIteration++) { + UINT32 Sample; + // + // Note: We use a retry loop for rdrand. Normal users get this in BaseRng.c + // Any failure to get a random number will assume RDRAND does not work. + // + for (Idx = 0; Idx < RDRAND_RETRIES; Idx++) { + if (AsmRdRand32 (&Sample)) { + break; + } + } + + if (Idx == RDRAND_RETRIES) { + DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: Failed to get an RDRAND random number - disabling\n")); + return FALSE; + } + + if (TestIteration != 0) { + Changed += Sample != Prev; + } + + Prev = Sample; + } + + if (Changed < RDRAND_MIN_CHANGE) { + DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: RDRAND not reliable - disabling\n")); + return FALSE; + } + + return TRUE; +} + /** The constructor function checks whether or not RDRAND instruction is supported by the host hardware. @@ -46,10 +113,13 @@ BaseRngLibConstructor ( // CPUID. A value of 1 indicates that processor support RDRAND instruction. // AsmCpuid (1, 0, 0, &RegEcx, 0); - ASSERT ((RegEcx & RDRAND_MASK) == RDRAND_MASK); mRdRandSupported = ((RegEcx & RDRAND_MASK) == RDRAND_MASK); + if (mRdRandSupported) { + mRdRandSupported = TestRdRand (); + } + return EFI_SUCCESS; } @@ -68,6 +138,7 @@ ArchGetRandomNumber16 ( OUT UINT16 *Rand ) { + ASSERT (mRdRandSupported); return AsmRdRand16 (Rand); } @@ -86,6 +157,7 @@ ArchGetRandomNumber32 ( OUT UINT32 *Rand ) { + ASSERT (mRdRandSupported); return AsmRdRand32 (Rand); } @@ -104,6 +176,7 @@ ArchGetRandomNumber64 ( OUT UINT64 *Rand ) { + ASSERT (mRdRandSupported); return AsmRdRand64 (Rand); } @@ -120,11 +193,5 @@ ArchIsRngSupported ( VOID ) { - /* - Existing software depends on this always returning TRUE, so for - now hard-code it. - - return mRdRandSupported; - */ - return TRUE; + return mRdRandSupported; } -- 2.38.1