From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f50.google.com (mail-ed1-f50.google.com [209.85.208.50]) by mx.groups.io with SMTP id smtpd.web10.6598.1682512394292755077 for ; Wed, 26 Apr 2023 05:33:15 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="signature has expired" header.i=@starlabs-systems.20221208.gappssmtp.com header.s=20221208 header.b=sfPfVzgi; spf=pass (domain: starlabs.systems, ip: 209.85.208.50, mailfrom: sean@starlabs.systems) Received: by mail-ed1-f50.google.com with SMTP id 4fb4d7f45d1cf-506b8c6bc07so11874544a12.2 for ; Wed, 26 Apr 2023 05:33:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=starlabs-systems.20221208.gappssmtp.com; s=20221208; t=1682512392; x=1685104392; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=qg6IqlKWhlN7xYKjSyUiPBuiNW3M36VwkW+Ypq79f2s=; b=sfPfVzgi44msMvB/WMBxjf7ujN5rMIEDqD4sBMHxKi/tDU+Cwq+FcKnscxVADKqiW2 r3rHF5KOqP3+zv4cPfn4RZvrWwpm9QTFzJihcyDOhXu46/XgJIqvLRUtXd8jw9oLZGRE 8LWY4d6N++yODe+h0E1jHGn+UUeKj05i3GxQwfbQymvT3rbyaQduzIPlPCgMsN/EiF6R QvgNMxJYb/SQpSBQ1LaQ6VTGIdKjrYIP/lpud3qYzRkTWPdOythEYLFGegN0FrC/jyPd zgs6wdmv+6yKSTGjW+cuQxMZYEs7EBQZBelSm43pfewrDJ+5Xolk+KWI7CvXDllt8WIu zzKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682512392; x=1685104392; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=qg6IqlKWhlN7xYKjSyUiPBuiNW3M36VwkW+Ypq79f2s=; b=E9bmprJ0z4V82n79R5ptAWScrRkgaPJIQ6hMXPZWU/wlS1OgphNBSJwau0PihIgVM/ VxrslwHdAytek58OftZHg2QPG3HVL+wyOl1SIZ8aGOT6y/U6KzurfyOMVxTz54W481br nKZOWuaSp6D2G/Vp3r5tqQFv4s1O1jHi6y6DuidGEdxH3xXeH05XrF9FRuf5LsB+tW/u Rte5heby7Pc/vUvVOB4MWL3uOReRP1XNkoDCIBY9Tcgh3yc0Rg/ri0VmRPB6uRjSm/pw Fp2vY+NoAoNForzMNr7v1CcE9HDAss8hCsUKEz3EaL6ZhEiFUETlEIhf1i2h2daikv46 kQxA== X-Gm-Message-State: AAQBX9f1c7Mwe+cWVCAqGd3FIPnuFpJtPbBajOvpd1SMKmcRr9rIv0ju 8hrHmYAa8+JeyNcaAzcCqEJzNW+xNnbJOocW4C5A X-Google-Smtp-Source: AKy350bClpi1hIg//B7WAsliAEhGuyeKdegOkuDab6PCYbHvlradi5fQwnEjQsncgiUHiTAoMcyZ4VONE2njQBGuAio= X-Received: by 2002:a50:ed90:0:b0:502:9a5b:206e with SMTP id h16-20020a50ed90000000b005029a5b206emr15059245edr.9.1682512392256; Wed, 26 Apr 2023 05:33:12 -0700 (PDT) MIME-Version: 1.0 References: <7edb8c7baae2fc58034a62f50f5f4000fb5bd102.1682442501.git.benjamin.doron00@gmail.com> In-Reply-To: <7edb8c7baae2fc58034a62f50f5f4000fb5bd102.1682442501.git.benjamin.doron00@gmail.com> From: "Sean Rhodes" Date: Wed, 26 Apr 2023 13:33:01 +0100 Message-ID: Subject: Re: [edk2-devel][PATCH v1 1/2] UefiPayloadPkg: Define RngLibTimerLib for systems without RDRAND To: Benjamin Doron Cc: devel@edk2.groups.io, Guo Dong , Ray Ni , James Lu , Gua Guo Content-Type: multipart/alternative; boundary="00000000000078937805fa3c71f5" --00000000000078937805fa3c71f5 Content-Type: text/plain; charset="UTF-8" Reviewed-by: Sean Rhodes On Tue, 25 Apr 2023 at 18:09, Benjamin Doron wrote: > From: Benjamin Doron > > Presently, `ArchIsRngSupported()` always returns TRUE, per > > https://github.com/tianocore/edk2/blob/1eeca0750af5af2f0e78437bf791ac2de74bde74/MdePkg/Library/BaseRngLib/Rand/RdRand.c#L124-L125 > . > Therefore, `BaseRngLibConstructor()` should continue to assert RDRAND > support. > > However, older platforms do not support RDRAND, such as QEMU in some > configurations. Therefore, define an RngLib library class for such > systems, using a new flag. Maintain current behaviour by default. > > Note that this is less secure behaviour, and should be avoided in > production. > > Cc: Guo Dong > Cc: Ray Ni > Cc: Sean Rhodes > Cc: James Lu > Cc: Gua Guo > Signed-off-by: Benjamin Doron > --- > UefiPayloadPkg/UefiPayloadPkg.dsc | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/UefiPayloadPkg/UefiPayloadPkg.dsc > b/UefiPayloadPkg/UefiPayloadPkg.dsc > index 9847f189fff5..1e803ba01567 100644 > --- a/UefiPayloadPkg/UefiPayloadPkg.dsc > +++ b/UefiPayloadPkg/UefiPayloadPkg.dsc > @@ -130,6 +130,7 @@ > # This is how BaseCpuTimerLib works, and a recommended way to get > Frequence, so set the default value as TRUE. > # Note: for emulation platform such as QEMU, this may not work and > should set it as FALSE > DEFINE CPU_TIMER_LIB_ENABLE = TRUE > + DEFINE CPU_RNG_ENABLE = TRUE > > DEFINE MULTIPLE_DEBUG_PORT_SUPPORT = FALSE > > @@ -204,7 +205,11 @@ > !endif > IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf > OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf > +!if $(CPU_RNG_ENABLE) == TRUE > RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf > +!else > + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf > +!endif > HobLib|UefiPayloadPkg/Library/DxeHobLib/DxeHobLib.inf > > # > -- > 2.39.2 > > --00000000000078937805fa3c71f5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Reviewed-by: Sean Rhodes <sean@starlabs.systems>

On Tue, 25 Apr 2023 at 18:09, Benjamin Doron <benjamin.doron00@gmail.com> wrote:
From: Benjamin Doron <benjamin.do= ron@9elements.com>

Presently, `ArchIsRngSupported()` always returns TRUE, per
https://github.com/tianocore/edk2/blob/1eeca07= 50af5af2f0e78437bf791ac2de74bde74/MdePkg/Library/BaseRngLib/Rand/RdRand.c#L= 124-L125.
Therefore, `BaseRngLibConstructor()` should continue to assert RDRAND
support.

However, older platforms do not support RDRAND, such as QEMU in some
configurations. Therefore, define an RngLib library class for such
systems, using a new flag. Maintain current behaviour by default.

Note that this is less secure behaviour, and should be avoided in
production.

Cc: Guo Dong <gu= o.dong@intel.com>
Cc: Ray Ni <ray.ni= @intel.com>
Cc: Sean Rhodes <sean@starlabs.systems>
Cc: James Lu <ja= mes.lu@intel.com>
Cc: Gua Guo <gua.= guo@intel.com>
Signed-off-by: Benjamin Doron <benjamin.doron@9elements.com>
---
=C2=A0UefiPayloadPkg/UefiPayloadPkg.dsc | 5 +++++
=C2=A01 file changed, 5 insertions(+)

diff --git a/UefiPayloadPkg/UefiPayloadPkg.dsc b/UefiPayloadPkg/UefiPayload= Pkg.dsc
index 9847f189fff5..1e803ba01567 100644
--- a/UefiPayloadPkg/UefiPayloadPkg.dsc
+++ b/UefiPayloadPkg/UefiPayloadPkg.dsc
@@ -130,6 +130,7 @@
=C2=A0 =C2=A0# This is how BaseCpuTimerLib works, and a recommended way to = get Frequence, so set the default value as TRUE.
=C2=A0 =C2=A0# Note: for emulation platform such as QEMU, this may not work= and should set it as FALSE
=C2=A0 =C2=A0DEFINE CPU_TIMER_LIB_ENABLE=C2=A0 =3D TRUE
+=C2=A0 DEFINE CPU_RNG_ENABLE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D TRUE

=C2=A0 =C2=A0DEFINE MULTIPLE_DEBUG_PORT_SUPPORT =3D FALSE

@@ -204,7 +205,11 @@
=C2=A0!endif
=C2=A0 =C2=A0IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf =C2=A0 =C2=A0OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
+!if $(CPU_RNG_ENABLE) =3D=3D TRUE
=C2=A0 =C2=A0RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
+!else
+=C2=A0 RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+!endif
=C2=A0 =C2=A0HobLib|UefiPayloadPkg/Library/DxeHobLib/DxeHobLib.inf

=C2=A0 =C2=A0#
--
2.39.2

--00000000000078937805fa3c71f5--