RDRAND

RDRAND fills a 16-, 32- or 64-bit register with a random number from the processor’s generator and sets CF to say whether it got one. On Intel’s processors the numbers come from a deterministic generator built to NIST SP 800-90A that an on-chip entropy source reseeds often; RDSEED reads closer to that entropy source, for seeding a generator of one’s own. AMD’s manual says only that the value is generated by hardware.

Always test CF#

CF = 0 means no number was ready: the generator’s self-tests rejected its output, or many cores asked faster than it could supply. Both manuals tell software to try again a limited number of times, and Intel’s suggests ten; a program that loops forever on CF = 0 hangs on a failed generator. Every run clears OF, SF, ZF, AF and PF. Zen 5 set CF on each recorded run, with the other flags cleared.

The manuals differ on the failed value. Intel’s makes the destination 0; AMD’s only calls it invalid. Compiled code relies on Intel’s rule: for _rdrand32_step(&x), GCC 14 at -O2 emits rdrand eax and a CMOVC that puts 1 in EAX when CF is set, so when CF is clear the function returns the register itself, counting on it being 0; Clang 23 does the same with CMOVAE. Both store the register to x either way. Both need -mrdrnd or an -march that has it, such as ivybridge or znver1; x86-64-v3 and v4 do not.

Sizes#

As with other general-purpose writes, the 32-bit form clears bits 63:32 and the 16-bit form leaves bits 63:16 alone: on Zen 5, rdrand r9w replaced only the low 16 bits of R9.

Cost and virtual machines#

AMD’s Zen 5 guide lists RDRAND and RDSEED as microcoded, with no latency given. Under Intel’s VMX a hypervisor can make every RDRAND exit to it (“RDRAND exiting”, Intel’s manual, volume 3) and answer in its place. The CPUID bit is leaf 1, ECX bit 30.

In the optimization guide

What the optimization guide says about RDRAND, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Sandy Bridge and Ivy Bridge

• What Ivy Bridge changed: Ivy Bridge adds three features: RDRAND, a hardware random number generator meeting NIST SP 800-90A; VCVTPH2PS and VCVTPS2PH, converting half-precision floats; and reading or writing the FS and GS base registers from any ring.

Silvermont to Goldmont Plus

• Instruction set and counters: Silvermont is the first Atom core with SSE4.2 and POPCNT; Goldmont Plus adds RDPID and PTWRITE.

Vulnerability mitigations

Mitigations of these processor vulnerabilities use RDRAND:

• CVE-2022-21127: Special Register Buffer Data Sampling (Special Register Buffer Data Sampling update)
• CVE-2020-0543: Special Register Buffer Data Sampling

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

ok = random_ready()              # the generator's: 1 when it has a
                                 # number for RDRAND, a random one
dest.write(random(OSIZE) if ok else 0)
cf = ok                          # 16 bits: bits 63:16 kept; 32 bits:
of = sf = zf = af = pf = 0       # bits 63:32 cleared
# with none ready, a program tries again, a few times. Intel's
# manual says that the destination is then 0, AMD's only that it is
# not valid. Intel's RDRAND draws from a deterministic generator that
# an entropy source on the chip reseeds

Operands

Flags

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.