1 // Copyright 2018 Developers of the Rand project.
3 // Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
4 // https://www.apache.org/licenses/LICENSE-2.0> or the MIT license
5 // <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your
6 // option. This file may not be copied, modified, or distributed
7 // except according to those terms.
9 //! Implementation for SGX using RDRAND instruction
10 use crate::error
::{FAILED_RDRAND, NO_RDRAND}
;
11 #[cfg(not(target_feature = "rdrand"))]
12 use crate::util
::LazyBool
;
14 use core
::arch
::x86_64
::_rdrand64_step
;
17 // Recommendation from "Intel® Digital Random Number Generator (DRNG) Software
18 // Implementation Guide" - Section 5.2.1 and "Intel® 64 and IA-32 Architectures
19 // Software Developer’s Manual" - Volume 1 - Section 7.3.17.1.
20 const RETRY_LIMIT
: usize = 10;
21 const WORD_SIZE
: usize = mem
::size_of
::<u64>();
23 #[target_feature(enable = "rdrand")]
24 unsafe fn rdrand() -> Result
<[u8; WORD_SIZE
], Error
> {
25 for _
in 0..RETRY_LIMIT
{
26 let mut el
= mem
::zeroed();
27 if _rdrand64_step(&mut el
) == 1 {
28 // AMD CPUs from families 14h to 16h (pre Ryzen) sometimes fail to
29 // set CF on bogus random data, so we check these values explicitly.
30 // See https://github.com/systemd/systemd/issues/11810#issuecomment-489727505
31 // We perform this check regardless of target to guard against
32 // any implementation that incorrectly fails to set CF.
33 if el
!= 0 && el
!= !0 {
34 return Ok(el
.to_ne_bytes());
36 error
!("RDRAND returned {:X}, CPU RNG may be broken", el
);
37 // Keep looping in case this was a false positive.
43 // "rdrand" target feature requires "+rdrnd" flag, see https://github.com/rust-lang/rust/issues/49653.
44 #[cfg(all(target_env = "sgx", not(target_feature = "rdrand")))]
46 "SGX targets require 'rdrand' target feature. Enable by using -C target-feature=+rdrnd."
49 #[cfg(target_feature = "rdrand")]
50 fn is_rdrand_supported() -> bool
{
54 // TODO use is_x86_feature_detected!("rdrand") when that works in core. See:
55 // https://github.com/rust-lang-nursery/stdsimd/issues/464
56 #[cfg(not(target_feature = "rdrand"))]
57 fn is_rdrand_supported() -> bool
{
58 use core
::arch
::x86_64
::__cpuid
;
59 // SAFETY: All x86_64 CPUs support CPUID leaf 1
60 const FLAG
: u32 = 1 << 30;
61 static HAS_RDRAND
: LazyBool
= LazyBool
::new();
62 HAS_RDRAND
.unsync_init(|| unsafe { (__cpuid(1).ecx & FLAG) != 0 }
)
65 pub fn getrandom_inner(dest
: &mut [u8]) -> Result
<(), Error
> {
66 if !is_rdrand_supported() {
67 return Err(NO_RDRAND
);
70 // SAFETY: After this point, rdrand is supported, so calling the rdrand
71 // functions is not undefined behavior.
72 unsafe { rdrand_exact(dest) }
75 #[target_feature(enable = "rdrand")]
76 unsafe fn rdrand_exact(dest
: &mut [u8]) -> Result
<(), Error
> {
77 // We use chunks_exact_mut instead of chunks_mut as it allows almost all
78 // calls to memcpy to be elided by the compiler.
79 let mut chunks
= dest
.chunks_exact_mut(WORD_SIZE
);
80 for chunk
in chunks
.by_ref() {
81 chunk
.copy_from_slice(&rdrand()?
);
84 let tail
= chunks
.into_remainder();
87 tail
.copy_from_slice(&rdrand()?
[..n
]);