From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web10.2218.1573706339952424499 for ; Wed, 13 Nov 2019 20:39:00 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.115, mailfrom: jian.j.wang@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 Nov 2019 20:38:59 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,302,1569308400"; d="scan'208";a="257344537" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by FMSMGA003.fm.intel.com with ESMTP; 13 Nov 2019 20:38:59 -0800 Received: from shsmsx104.ccr.corp.intel.com (10.239.4.70) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 13 Nov 2019 20:38:59 -0800 Received: from shsmsx107.ccr.corp.intel.com ([169.254.9.63]) by SHSMSX104.ccr.corp.intel.com ([169.254.5.127]) with mapi id 14.03.0439.000; Thu, 14 Nov 2019 12:38:57 +0800 From: "Wang, Jian J" To: "Kinney, Michael D" , "devel@edk2.groups.io" CC: "Yao, Jiewen" , "Zhang, Chao B" , "Gao, Liming" , "Ni, Ray" Subject: Re: [edk2-devel] [PATCH 05/11] SecurityPkg/RngLibRdSeed: add an instance of RngLib to make use rdseed Thread-Topic: [edk2-devel] [PATCH 05/11] SecurityPkg/RngLibRdSeed: add an instance of RngLib to make use rdseed Thread-Index: AQHVmpHEJ0tPiqvRO0a1mPBTgII9rqeKET0QgAACvwA= Date: Thu, 14 Nov 2019 04:38:57 +0000 Message-ID: References: <20191114021743.3876-1-jian.j.wang@intel.com> <20191114021743.3876-6-jian.j.wang@intel.com> In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNmU5ODI2NGItMWVhOS00MjBmLWFiZTctN2Y0ZGMyYWM3OTQ0IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoicmZPTmZpTjEwSUdjVjNsZjI5SldhTXBQdlwvOFdFTTJVN0VITFBrZmhMUnFVcEt2a2dlNnFWR3REY1dpT0pQazAifQ== x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jian.j.wang@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Mike, I figured that rdseed is only needed in cases demanding highest entropy, like seeding other pseudo-RNG. It's not for general purpose randomness. Then I put it in SecurityPkg. But I'm ok to put it into MdePkg. I have no strong opinion for this. Regards, Jian > -----Original Message----- > From: Kinney, Michael D > Sent: Thursday, November 14, 2019 12:25 PM > To: devel@edk2.groups.io; Wang, Jian J ; Kinney, > Michael D > Cc: Yao, Jiewen ; Zhang, Chao B > ; Gao, Liming ; Ni, Ray > > Subject: RE: [edk2-devel] [PATCH 05/11] SecurityPkg/RngLibRdSeed: add an > instance of RngLib to make use rdseed >=20 > Jian, >=20 > Why is this lib instance in the SecurityPkg? It only depends > on the MdePkg. Can't non security feature related modules > that want to a random number use this lib without using the > SecurityPkg? Could this lib instance be added to MdePkg? >=20 > Thanks, >=20 > Mike >=20 > > -----Original Message----- > > From: devel@edk2.groups.io On > > Behalf Of Wang, Jian J > > Sent: Wednesday, November 13, 2019 6:18 PM > > To: devel@edk2.groups.io > > Cc: Yao, Jiewen ; Zhang, Chao B > > ; Kinney, Michael D > > ; Gao, Liming > > ; Ni, Ray > > Subject: [edk2-devel] [PATCH 05/11] > > SecurityPkg/RngLibRdSeed: add an instance of RngLib to > > make use rdseed > > > > This version of RngLib makes use of AsmRdSeed to get > > non-deterministic random number, which can be used for > > seeding other software DRNG like rand interface in > > openssl. It can be used only on IA32/X64 processors > > which supports rdseed instruction. > > > > Ref: > > https://bugzilla.tianocore.org/show_bug.cgi?id=3D1871 > > Cc: Jiewen Yao > > Cc: Chao Zhang > > Cc: Michael D Kinney > > Cc: Liming Gao > > Cc: Ray Ni > > Signed-off-by: Jian J Wang > > --- > > .../RngLibRdSeed/RngLibRdSeed.inf | 37 > > ++++ > > .../RngLibRdSeed/RngLibRdSeed.uni | 18 ++ > > .../RngLibRdSeed/RngRdSeed.c | 189 > > ++++++++++++++++++ > > 3 files changed, 244 insertions(+) > > create mode 100644 > > SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRd > > Seed.inf > > create mode 100644 > > SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRd > > Seed.uni > > create mode 100644 > > SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSee > > d.c > > > > diff --git > > a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > > RdSeed.inf > > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > > RdSeed.inf > > new file mode 100644 > > index 0000000000..8162408775 > > --- /dev/null > > +++ > > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > > RdSeed.inf > > @@ -0,0 +1,37 @@ > > +## @file > > +# Instance of RNG (Random Number Generator) Library. > > +# > > +# Rng RdSeed Library that uses CPU RdSeed instruction > > access to > > +provide # non-deterministic random number which can > > be used as seed > > +for other # software deterministic RNGs. > > +# > > +# Copyright (c) 2019, Intel Corporation. All rights > > reserved.
# # > > +SPDX-License-Identifier: BSD-2-Clause-Patent # # ## > > + > > +[Defines] > > + INF_VERSION =3D 0x00010029 > > + BASE_NAME =3D RngLibRdSeed > > + MODULE_UNI_FILE =3D RngLibRdSeed.uni > > + FILE_GUID =3D 8B613B2E-B944-40F9- > > B979-1B60D7CAA73C > > + MODULE_TYPE =3D BASE > > + VERSION_STRING =3D 1.0 > > + LIBRARY_CLASS =3D RngLib > > + CONSTRUCTOR =3D > > RngLibRdSeedConstructor > > + > > +# > > +# VALID_ARCHITECTURES =3D IA32 X64 > > +# > > + > > +[Sources.Ia32, Sources.X64] > > + RngRdSeed.c > > + > > +[Packages] > > + MdePkg/MdePkg.dec > > + > > +[LibraryClasses] > > + BaseLib > > + DebugLib > > diff --git > > a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > > RdSeed.uni > > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > > RdSeed.uni > > new file mode 100644 > > index 0000000000..051a3019bc > > --- /dev/null > > +++ > > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > > RdSeed.uni > > @@ -0,0 +1,18 @@ > > +// /** @file > > +// Instance of RNG (Random Number Generator) Library. > > +// > > +// Rng RdSeed Library that uses CPU RdSeed instruction > > access to > > +provide // non-deterministic random number which can > > be used as seed > > +for other // software deterministic RNGs. > > +// > > +// Copyright (c) 2019, Intel Corporation. All rights > > reserved.
// > > +// SPDX-License-Identifier: BSD-2-Clause-Patent // // > > **/ > > + > > + > > +#string STR_MODULE_ABSTRACT #language en- > > US "Instance of RNG Library" > > + > > +#string STR_MODULE_DESCRIPTION #language en- > > US "RngRdSeed Library that uses CPU RdSeed instruction > > access to provide non-deterministic random numbers." > > + > > diff --git > > a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdS > > eed.c > > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdS > > eed.c > > new file mode 100644 > > index 0000000000..0036faa050 > > --- /dev/null > > +++ > > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdS > > eed.c > > @@ -0,0 +1,189 @@ > > +/** @file > > + Random number generator services that uses RdSeed > > instruction access > > + to provide non-deterministic random numbers, which > > are usually used > > + for seeding other pseudo-random number generators. > > + > > +Copyright (c) 2019, Intel Corporation. All rights > > reserved.
> > +SPDX-License-Identifier: BSD-2-Clause-Patent > > + > > +**/ > > + > > +#include > > +#include > > +#include > > + > > +// > > +// Bit mask used to determine if RdSeed instruction is > > supported. > > +// > > +#define RDSEED_MASK BIT18 > > + > > +// > > +// Limited retry number when valid random data is > > returned. > > +// It varies between 1 and 100 according to "Intel(R) > > DRGN Software > > +Implementation // Guide". Let's use the same value as > > RDRAND in BaseRngLib. > > +// > > +#define RDSEED_RETRY_LIMIT 10 > > + > > +/** > > + The constructor function checks whether or not > > RDSEED instruction is > > +supported > > + by the host hardware. > > + > > + The constructor function checks whether or not > > RDSEED instruction is supported. > > + It will ASSERT() if RDSEED instruction is not > > supported. > > + > > + @retval RETURN_SUCCESS The processor supports > > RDSEED instruction. > > + @retval RETURN_UNSUPPORTED RDSEED instruction is > > not supported. > > + > > +**/ > > +RETURN_STATUS > > +EFIAPI > > +RngLibRdSeedConstructor ( > > + VOID > > + ) > > +{ > > + UINT32 RegEbx; > > + > > + // > > + // Determine RDSEED support by examining bit 18 of > > the EBX register > > + returned by // CPUID(EAX=3D7, ECX=3D0). BIT18 of EBX > > indicates that > > + processor support RDSEED // instruction. > > + // > > + AsmCpuidEx (7, 0, NULL, &RegEbx, NULL, NULL); if > > ((RegEbx & > > + RDSEED_MASK) !=3D RDSEED_MASK) { > > + ASSERT ((RegEbx & RDSEED_MASK) =3D=3D RDSEED_MASK); > > + return RETURN_UNSUPPORTED; > > + } > > + > > + return RETURN_SUCCESS; > > +} > > + > > +/** > > + Generates a 16-bit random number. > > + > > + if Rand is NULL, then ASSERT(). > > + > > + @param[out] Rand Buffer pointer to store the 16- > > bit random value. > > + > > + @retval TRUE Random number generated > > successfully. > > + @retval FALSE Failed to generate the random > > number. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +GetRandomNumber16 ( > > + OUT UINT16 *Rand > > + ) > > +{ > > + UINT32 Index; > > + > > + ASSERT (Rand !=3D NULL); > > + > > + // > > + // A loop to fetch a 16 bit random value with a > > retry count limit. > > + // > > + for (Index =3D 0; Index < RDSEED_RETRY_LIMIT; Index++) > > { > > + if (AsmRdSeed16 (Rand)) { > > + return TRUE; > > + } > > + } > > + > > + return FALSE; > > +} > > + > > +/** > > + Generates a 32-bit random number. > > + > > + if Rand is NULL, then ASSERT(). > > + > > + @param[out] Rand Buffer pointer to store the 32- > > bit random value. > > + > > + @retval TRUE Random number generated > > successfully. > > + @retval FALSE Failed to generate the random > > number. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +GetRandomNumber32 ( > > + OUT UINT32 *Rand > > + ) > > +{ > > + UINT32 Index; > > + > > + ASSERT (Rand !=3D NULL); > > + > > + // > > + // A loop to fetch a 32 bit random value with a > > retry count limit. > > + // > > + for (Index =3D 0; Index < RDSEED_RETRY_LIMIT; Index++) > > { > > + if (AsmRdSeed32 (Rand)) { > > + return TRUE; > > + } > > + } > > + > > + return FALSE; > > +} > > + > > +/** > > + Generates a 64-bit random number. > > + > > + if Rand is NULL, then ASSERT(). > > + > > + @param[out] Rand Buffer pointer to store the 64- > > bit random value. > > + > > + @retval TRUE Random number generated > > successfully. > > + @retval FALSE Failed to generate the random > > number. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +GetRandomNumber64 ( > > + OUT UINT64 *Rand > > + ) > > +{ > > + UINT32 Index; > > + > > + ASSERT (Rand !=3D NULL); > > + > > + // > > + // A loop to fetch a 64 bit random value with a > > retry count limit. > > + // > > + for (Index =3D 0; Index < RDSEED_RETRY_LIMIT; Index++) > > { > > + if (AsmRdSeed64 (Rand)) { > > + return TRUE; > > + } > > + } > > + > > + return FALSE; > > +} > > + > > +/** > > + Generates a 128-bit random number. > > + > > + if Rand is NULL, then ASSERT(). > > + > > + @param[out] Rand Buffer pointer to store the > > 128-bit random value. > > + > > + @retval TRUE Random number generated > > successfully. > > + @retval FALSE Failed to generate the random > > number. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +GetRandomNumber128 ( > > + OUT UINT64 *Rand > > + ) > > +{ > > + ASSERT (Rand !=3D NULL); > > + > > + // > > + // Read first 64 bits > > + // > > + if (!GetRandomNumber64 (Rand)) { > > + return FALSE; > > + } > > + > > + // > > + // Read second 64 bits > > + // > > + return GetRandomNumber64 (++Rand); > > +} > > -- > > 2.17.1.windows.2 > > > > > >=20