From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by mx.groups.io with SMTP id smtpd.web10.2095.1573705488468404308 for ; Wed, 13 Nov 2019 20:24:48 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.120, mailfrom: michael.d.kinney@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 Nov 2019 20:24:48 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,302,1569308400"; d="scan'208";a="235527697" Received: from orsmsx105.amr.corp.intel.com ([10.22.225.132]) by fmsmga002.fm.intel.com with ESMTP; 13 Nov 2019 20:24:48 -0800 Received: from orsmsx159.amr.corp.intel.com (10.22.240.24) by ORSMSX105.amr.corp.intel.com (10.22.225.132) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 13 Nov 2019 20:24:47 -0800 Received: from orsmsx113.amr.corp.intel.com ([169.254.9.200]) by ORSMSX159.amr.corp.intel.com ([169.254.11.187]) with mapi id 14.03.0439.000; Wed, 13 Nov 2019 20:24:47 -0800 From: "Michael D Kinney" To: "devel@edk2.groups.io" , "Wang, Jian J" , "Kinney, Michael D" CC: "Yao, Jiewen" , "Zhang, Chao B" , "Gao, Liming" , "Ni, Ray" Subject: Re: [edk2-devel] [PATCH 05/11] SecurityPkg/RngLibRdSeed: add an instance of RngLib to make use rdseed Thread-Topic: [edk2-devel] [PATCH 05/11] SecurityPkg/RngLibRdSeed: add an instance of RngLib to make use rdseed Thread-Index: AQHVmpHE5JqzCEV5U0OXDdrNrON6KKeKET0Q Date: Thu, 14 Nov 2019 04:24:47 +0000 Message-ID: References: <20191114021743.3876-1-jian.j.wang@intel.com> <20191114021743.3876-6-jian.j.wang@intel.com> In-Reply-To: <20191114021743.3876-6-jian.j.wang@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.22.254.139] MIME-Version: 1.0 Return-Path: michael.d.kinney@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Jian, Why is this lib instance in the SecurityPkg? It only depends on the MdePkg. Can't non security feature related modules that want to a random number use this lib without using the SecurityPkg? Could this lib instance be added to MdePkg? Thanks, Mike > -----Original Message----- > From: devel@edk2.groups.io On > Behalf Of Wang, Jian J > Sent: Wednesday, November 13, 2019 6:18 PM > To: devel@edk2.groups.io > Cc: Yao, Jiewen ; Zhang, Chao B > ; Kinney, Michael D > ; Gao, Liming > ; Ni, Ray > Subject: [edk2-devel] [PATCH 05/11] > SecurityPkg/RngLibRdSeed: add an instance of RngLib to > make use rdseed >=20 > This version of RngLib makes use of AsmRdSeed to get > non-deterministic random number, which can be used for > seeding other software DRNG like rand interface in > openssl. It can be used only on IA32/X64 processors > which supports rdseed instruction. >=20 > Ref: > https://bugzilla.tianocore.org/show_bug.cgi?id=3D1871 > Cc: Jiewen Yao > Cc: Chao Zhang > Cc: Michael D Kinney > Cc: Liming Gao > Cc: Ray Ni > Signed-off-by: Jian J Wang > --- > .../RngLibRdSeed/RngLibRdSeed.inf | 37 > ++++ > .../RngLibRdSeed/RngLibRdSeed.uni | 18 ++ > .../RngLibRdSeed/RngRdSeed.c | 189 > ++++++++++++++++++ > 3 files changed, 244 insertions(+) > create mode 100644 > SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRd > Seed.inf > create mode 100644 > SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLibRd > Seed.uni > create mode 100644 > SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdSee > d.c >=20 > diff --git > a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > RdSeed.inf > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > RdSeed.inf > new file mode 100644 > index 0000000000..8162408775 > --- /dev/null > +++ > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > RdSeed.inf > @@ -0,0 +1,37 @@ > +## @file > +# Instance of RNG (Random Number Generator) Library. > +# > +# Rng RdSeed Library that uses CPU RdSeed instruction > access to > +provide # non-deterministic random number which can > be used as seed > +for other # software deterministic RNGs. > +# > +# Copyright (c) 2019, Intel Corporation. All rights > reserved.
# # > +SPDX-License-Identifier: BSD-2-Clause-Patent # # ## > + > +[Defines] > + INF_VERSION =3D 0x00010029 > + BASE_NAME =3D RngLibRdSeed > + MODULE_UNI_FILE =3D RngLibRdSeed.uni > + FILE_GUID =3D 8B613B2E-B944-40F9- > B979-1B60D7CAA73C > + MODULE_TYPE =3D BASE > + VERSION_STRING =3D 1.0 > + LIBRARY_CLASS =3D RngLib > + CONSTRUCTOR =3D > RngLibRdSeedConstructor > + > +# > +# VALID_ARCHITECTURES =3D IA32 X64 > +# > + > +[Sources.Ia32, Sources.X64] > + RngRdSeed.c > + > +[Packages] > + MdePkg/MdePkg.dec > + > +[LibraryClasses] > + BaseLib > + DebugLib > diff --git > a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > RdSeed.uni > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > RdSeed.uni > new file mode 100644 > index 0000000000..051a3019bc > --- /dev/null > +++ > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngLib > RdSeed.uni > @@ -0,0 +1,18 @@ > +// /** @file > +// Instance of RNG (Random Number Generator) Library. > +// > +// Rng RdSeed Library that uses CPU RdSeed instruction > access to > +provide // non-deterministic random number which can > be used as seed > +for other // software deterministic RNGs. > +// > +// Copyright (c) 2019, Intel Corporation. All rights > reserved.
// > +// SPDX-License-Identifier: BSD-2-Clause-Patent // // > **/ > + > + > +#string STR_MODULE_ABSTRACT #language en- > US "Instance of RNG Library" > + > +#string STR_MODULE_DESCRIPTION #language en- > US "RngRdSeed Library that uses CPU RdSeed instruction > access to provide non-deterministic random numbers." > + > diff --git > a/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdS > eed.c > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdS > eed.c > new file mode 100644 > index 0000000000..0036faa050 > --- /dev/null > +++ > b/SecurityPkg/RandomNumberGenerator/RngLibRdSeed/RngRdS > eed.c > @@ -0,0 +1,189 @@ > +/** @file > + Random number generator services that uses RdSeed > instruction access > + to provide non-deterministic random numbers, which > are usually used > + for seeding other pseudo-random number generators. > + > +Copyright (c) 2019, Intel Corporation. All rights > reserved.
> +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#include > +#include > +#include > + > +// > +// Bit mask used to determine if RdSeed instruction is > supported. > +// > +#define RDSEED_MASK BIT18 > + > +// > +// Limited retry number when valid random data is > returned. > +// It varies between 1 and 100 according to "Intel(R) > DRGN Software > +Implementation // Guide". Let's use the same value as > RDRAND in BaseRngLib. > +// > +#define RDSEED_RETRY_LIMIT 10 > + > +/** > + The constructor function checks whether or not > RDSEED instruction is > +supported > + by the host hardware. > + > + The constructor function checks whether or not > RDSEED instruction is supported. > + It will ASSERT() if RDSEED instruction is not > supported. > + > + @retval RETURN_SUCCESS The processor supports > RDSEED instruction. > + @retval RETURN_UNSUPPORTED RDSEED instruction is > not supported. > + > +**/ > +RETURN_STATUS > +EFIAPI > +RngLibRdSeedConstructor ( > + VOID > + ) > +{ > + UINT32 RegEbx; > + > + // > + // Determine RDSEED support by examining bit 18 of > the EBX register > + returned by // CPUID(EAX=3D7, ECX=3D0). BIT18 of EBX > indicates that > + processor support RDSEED // instruction. > + // > + AsmCpuidEx (7, 0, NULL, &RegEbx, NULL, NULL); if > ((RegEbx & > + RDSEED_MASK) !=3D RDSEED_MASK) { > + ASSERT ((RegEbx & RDSEED_MASK) =3D=3D RDSEED_MASK); > + return RETURN_UNSUPPORTED; > + } > + > + return RETURN_SUCCESS; > +} > + > +/** > + Generates a 16-bit random number. > + > + if Rand is NULL, then ASSERT(). > + > + @param[out] Rand Buffer pointer to store the 16- > bit random value. > + > + @retval TRUE Random number generated > successfully. > + @retval FALSE Failed to generate the random > number. > + > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNumber16 ( > + OUT UINT16 *Rand > + ) > +{ > + UINT32 Index; > + > + ASSERT (Rand !=3D NULL); > + > + // > + // A loop to fetch a 16 bit random value with a > retry count limit. > + // > + for (Index =3D 0; Index < RDSEED_RETRY_LIMIT; Index++) > { > + if (AsmRdSeed16 (Rand)) { > + return TRUE; > + } > + } > + > + return FALSE; > +} > + > +/** > + Generates a 32-bit random number. > + > + if Rand is NULL, then ASSERT(). > + > + @param[out] Rand Buffer pointer to store the 32- > bit random value. > + > + @retval TRUE Random number generated > successfully. > + @retval FALSE Failed to generate the random > number. > + > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNumber32 ( > + OUT UINT32 *Rand > + ) > +{ > + UINT32 Index; > + > + ASSERT (Rand !=3D NULL); > + > + // > + // A loop to fetch a 32 bit random value with a > retry count limit. > + // > + for (Index =3D 0; Index < RDSEED_RETRY_LIMIT; Index++) > { > + if (AsmRdSeed32 (Rand)) { > + return TRUE; > + } > + } > + > + return FALSE; > +} > + > +/** > + Generates a 64-bit random number. > + > + if Rand is NULL, then ASSERT(). > + > + @param[out] Rand Buffer pointer to store the 64- > bit random value. > + > + @retval TRUE Random number generated > successfully. > + @retval FALSE Failed to generate the random > number. > + > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNumber64 ( > + OUT UINT64 *Rand > + ) > +{ > + UINT32 Index; > + > + ASSERT (Rand !=3D NULL); > + > + // > + // A loop to fetch a 64 bit random value with a > retry count limit. > + // > + for (Index =3D 0; Index < RDSEED_RETRY_LIMIT; Index++) > { > + if (AsmRdSeed64 (Rand)) { > + return TRUE; > + } > + } > + > + return FALSE; > +} > + > +/** > + Generates a 128-bit random number. > + > + if Rand is NULL, then ASSERT(). > + > + @param[out] Rand Buffer pointer to store the > 128-bit random value. > + > + @retval TRUE Random number generated > successfully. > + @retval FALSE Failed to generate the random > number. > + > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNumber128 ( > + OUT UINT64 *Rand > + ) > +{ > + ASSERT (Rand !=3D NULL); > + > + // > + // Read first 64 bits > + // > + if (!GetRandomNumber64 (Rand)) { > + return FALSE; > + } > + > + // > + // Read second 64 bits > + // > + return GetRandomNumber64 (++Rand); > +} > -- > 2.17.1.windows.2 >=20 >=20 >=20