Changeset 108794 in vbox for trunk/src/VBox/Devices/EFI/FirmwareNew/MdePkg/Library/BaseRngLib/Rand/RdRand.c

Timestamp:

Mar 31, 2025 11:31:09 AM (2 weeks ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

168237

Message:

Devices/EFI/FirmwareNew: Merge edk2-stable202502 from the vendor branch and make it build for the important platforms, bugref:4643

Location:

trunk/src/VBox/Devices/EFI/FirmwareNew

Files:

• . (modified) (1 prop)
• MdePkg/Library/BaseRngLib/Rand/RdRand.c (modified) (4 diffs)

trunk/src/VBox/Devices/EFI/FirmwareNew/MdePkg/Library/BaseRngLib/Rand/RdRand.c

@@ -3 +3 @@
   to provide high-quality random numbers.
 
+Copyright (C) 2024 Advanced Micro Devices, Inc. All rights reserved.<BR>
 Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
+Copyright (c) 2022, Pedro Falcato. All rights reserved.<BR>
 Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
 Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
@@ -23 +25 @@
 #define RDRAND_MASK  BIT30
 
-STATIC BOOLEAN  mRdRandSupported;
+//
+// Intel SDM says 10 tries is good enough for reliable RDRAND usage.
+//
+#define RDRAND_RETRIES  10
+
+#define RDRAND_TEST_SAMPLES  8
+
+#define RDRAND_MIN_CHANGE  5
+
+//
+// Add a define for native-word RDRAND, just for the test.
+//
+#ifdef MDE_CPU_X64
+#define ASM_RDRAND  AsmRdRand64
+#else
+#define ASM_RDRAND  AsmRdRand32
+#endif
+
+/**
+  Tests RDRAND for broken implementations.
+
+  @retval TRUE         RDRAND is reliable (and hopefully safe).
+  @retval FALSE        RDRAND is unreliable and should be disabled, despite CPUID.
+
+**/
+STATIC
+BOOLEAN
+TestRdRand (
+  VOID
+  )
+{
+  //
+  // Test for notoriously broken rdrand implementations that always return the same
+  // value, like the Zen 3 uarch (all-1s) or other several AMD families on suspend/resume (also all-1s).
+  // Note that this should be expanded to extensively test for other sorts of possible errata.
+  //
+
+  //
+  // Our algorithm samples rdrand $RDRAND_TEST_SAMPLES times and expects
+  // a different result $RDRAND_MIN_CHANGE times for reliable RDRAND usage.
+  //
+  UINTN   Prev;
+  UINT8   Idx;
+  UINT8   TestIteration;
+  UINT32  Changed;
+
+  Changed = 0;
+
+  for (TestIteration = 0; TestIteration < RDRAND_TEST_SAMPLES; TestIteration++) {
+    UINTN  Sample;
+    //
+    // Note: We use a retry loop for rdrand. Normal users get this in BaseRng.c
+    // Any failure to get a random number will assume RDRAND does not work.
+    //
+    for (Idx = 0; Idx < RDRAND_RETRIES; Idx++) {
+      if (ASM_RDRAND (&Sample)) {
+        break;
+      }
+    }
+
+    if (Idx == RDRAND_RETRIES) {
+      DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: Failed to get an RDRAND random number - disabling\n"));
+      return FALSE;
+    }
+
+    if (TestIteration != 0) {
+      Changed += Sample != Prev;
+    }
+
+    Prev = Sample;
+  }
+
+  if (Changed < RDRAND_MIN_CHANGE) {
+    DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: RDRAND not reliable - disabling\n"));
+    return FALSE;
+  }
+
+  return TRUE;
+}
+
+#undef ASM_RDRAND
 
 /**
@@ -42 +124 @@
   )
 {
-  UINT32  RegEcx;
+  return EFI_SUCCESS;
+}
+
+/**
+  Generates a 16-bit random number.
+
+  @param[out] Rand     Buffer pointer to store the 16-bit random value.
+
+  @retval TRUE         Random number generated successfully.
+  @retval FALSE        Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+ArchGetRandomNumber16 (
+  OUT     UINT16  *Rand
+  )
+{
+  return AsmRdRand16 (Rand);
+}
+
+/**
+  Generates a 32-bit random number.
+
+  @param[out] Rand     Buffer pointer to store the 32-bit random value.
+
+  @retval TRUE         Random number generated successfully.
+  @retval FALSE        Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+ArchGetRandomNumber32 (
+  OUT     UINT32  *Rand
+  )
+{
+  return AsmRdRand32 (Rand);
+}
+
+/**
+  Generates a 64-bit random number.
+
+  @param[out] Rand     Buffer pointer to store the 64-bit random value.
+
+  @retval TRUE         Random number generated successfully.
+  @retval FALSE        Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+ArchGetRandomNumber64 (
+  OUT     UINT64  *Rand
+  )
+{
+  return AsmRdRand64 (Rand);
+}
+
+/**
+  Checks whether RDRAND is supported.
+
+  @retval TRUE         RDRAND is supported.
+  @retval FALSE        RDRAND is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+ArchIsRngSupported (
+  VOID
+  )
+{
+  BOOLEAN  RdRandSupported;
+  UINT32   RegEcx;
 
   //
@@ -49 +202 @@
   //
   AsmCpuid (1, 0, 0, &RegEcx, 0);
-  ASSERT ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
-
-  mRdRandSupported = ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
-
-  return EFI_SUCCESS;
-}
-
-/**
-  Generates a 16-bit random number.
-
-  @param[out] Rand     Buffer pointer to store the 16-bit random value.
-
-  @retval TRUE         Random number generated successfully.
-  @retval FALSE        Failed to generate the random number.
-
-**/
-BOOLEAN
-EFIAPI
-ArchGetRandomNumber16 (
-  OUT     UINT16  *Rand
-  )
-{
-  return AsmRdRand16 (Rand);
-}
-
-/**
-  Generates a 32-bit random number.
-
-  @param[out] Rand     Buffer pointer to store the 32-bit random value.
-
-  @retval TRUE         Random number generated successfully.
-  @retval FALSE        Failed to generate the random number.
-
-**/
-BOOLEAN
-EFIAPI
-ArchGetRandomNumber32 (
-  OUT     UINT32  *Rand
-  )
-{
-  return AsmRdRand32 (Rand);
-}
-
-/**
-  Generates a 64-bit random number.
-
-  @param[out] Rand     Buffer pointer to store the 64-bit random value.
-
-  @retval TRUE         Random number generated successfully.
-  @retval FALSE        Failed to generate the random number.
-
-**/
-BOOLEAN
-EFIAPI
-ArchGetRandomNumber64 (
-  OUT     UINT64  *Rand
-  )
-{
-  return AsmRdRand64 (Rand);
-}
-
-/**
-  Checks whether RDRAND is supported.
-
-  @retval TRUE         RDRAND is supported.
-  @retval FALSE        RDRAND is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-ArchIsRngSupported (
-  VOID
-  )
-{
-  /*
-     Existing software depends on this always returning TRUE, so for
-     now hard-code it.
-
-     return mRdRandSupported;
-  */
-  return TRUE;
+
+  RdRandSupported = ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
+
+  if (RdRandSupported) {
+    RdRandSupported = TestRdRand ();
+  }
+
+  return RdRandSupported;
 }