vendor/getrandom/src/rdrand.rs

   1 // Copyright 2018 Developers of the Rand project.
   2 //
   3 // Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
   4 // https://www.apache.org/licenses/LICENSE-2.0> or the MIT license
   5 // <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your
   6 // option. This file may not be copied, modified, or distributed
   7 // except according to those terms.
   8
   9 //! Implementation for SGX using RDRAND instruction
  10 use crate::Error;
  11 use core::arch::x86_64::_rdrand64_step;
  12 use core::mem;
  13 use core::num::NonZeroU32;
  14
  15 // Recommendation from "Intel® Digital Random Number Generator (DRNG) Software
  16 // Implementation Guide" - Section 5.2.1 and "Intel® 64 and IA-32 Architectures
  17 // Software Developer’s Manual" - Volume 1 - Section 7.3.17.1.
  18 const RETRY_LIMIT: usize = 10;
  19 const WORD_SIZE: usize = mem::size_of::<u64>();
  20
  21 #[target_feature(enable = "rdrand")]
  22 unsafe fn rdrand() -> Result<[u8; WORD_SIZE], Error> {
  23     for _ in 0..RETRY_LIMIT {
  24         let mut el = mem::uninitialized();
  25         if _rdrand64_step(&mut el) == 1 {
  26             // AMD CPUs from families 14h to 16h (pre Ryzen) sometimes fail to
  27             // set CF on bogus random data, so we check these values explictly.
  28             // See https://github.com/systemd/systemd/issues/11810#issuecomment-489727505
  29             // We perform this check regardless of target to guard against
  30             // any implementation that incorrectly fails to set CF.
  31             if el != 0 && el != !0 {
  32                 return Ok(el.to_ne_bytes());
  33             }
  34             error!("RDRAND returned {:X}, CPU RNG may be broken", el);
  35             // Keep looping in case this was a false positive.
  36         }
  37     }
  38     error!("RDRAND failed, CPU issue likely");
  39     Err(Error::UNKNOWN)
  40 }
  41
  42 // "rdrand" target feature requires "+rdrnd" flag, see https://github.com/rust-lang/rust/issues/49653.
  43 #[cfg(all(target_env = "sgx", not(target_feature = "rdrand")))]
  44 compile_error!(
  45     "SGX targets require 'rdrand' target feature. Enable by using -C target-feature=+rdrnd."
  46 );
  47
  48 #[cfg(target_feature = "rdrand")]
  49 fn is_rdrand_supported() -> bool {
  50     true
  51 }
  52
  53 // TODO use is_x86_feature_detected!("rdrand") when that works in core. See:
  54 // https://github.com/rust-lang-nursery/stdsimd/issues/464
  55 #[cfg(not(target_feature = "rdrand"))]
  56 fn is_rdrand_supported() -> bool {
  57     use core::arch::x86_64::__cpuid;
  58     use lazy_static::lazy_static;
  59     // SAFETY: All x86_64 CPUs support CPUID leaf 1
  60     const FLAG: u32 = 1 << 30;
  61     lazy_static! {
  62         static ref HAS_RDRAND: bool = unsafe { __cpuid(1).ecx & FLAG != 0 };
  63     }
  64     *HAS_RDRAND
  65 }
  66
  67 pub fn getrandom_inner(dest: &mut [u8]) -> Result<(), Error> {
  68     if !is_rdrand_supported() {
  69         return Err(Error::UNAVAILABLE);
  70     }
  71
  72     // SAFETY: After this point, rdrand is supported, so calling the rdrand
  73     // functions is not undefined behavior.
  74     unsafe { rdrand_exact(dest) }
  75 }
  76
  77 #[target_feature(enable = "rdrand")]
  78 unsafe fn rdrand_exact(dest: &mut [u8]) -> Result<(), Error> {
  79     // We use chunks_exact_mut instead of chunks_mut as it allows almost all
  80     // calls to memcpy to be elided by the compiler.
  81     let mut chunks = dest.chunks_exact_mut(WORD_SIZE);
  82     for chunk in chunks.by_ref() {
  83         chunk.copy_from_slice(&rdrand()?);
  84     }
  85
  86     let tail = chunks.into_remainder();
  87     let n = tail.len();
  88     if n > 0 {
  89         tail.copy_from_slice(&rdrand()?[..n]);
  90     }
  91     Ok(())
  92 }
  93
  94 #[inline(always)]
  95 pub fn error_msg_inner(_: NonZeroU32) -> Option<&'static str> {
  96     None
  97 }