rdrand

Read Random Number

RDRAND r32

Retrieves a hardware-generated random number.

Details

Retrieves a cryptographically secure random number from the CPU's hardware random number generator and stores it in the destination register. The CF flag is set to 1 if a random number was successfully generated within the timeout period, or cleared to 0 if the generator failed to produce a value. No other flags are affected. This instruction is available only on processors with the RDRAND extension and cannot be used in real mode.

Pseudocode Operation

temp ← hardware_RNG();
if (RNG_success) {
  dest ← temp;
  CF ← 1;
} else {
  CF ← 0;
}

Example

RDRAND eax

Encoding

Binary Layout
0F
+0
C7
+1
ModRM
+2
 
Format Legacy
Opcode NFx 0F C7 /6
Extension RDRAND

Operands

  • dest
    32-bit general-purpose register (e.g. EAX)

Reference (Intel® SDM)

Instruction Forms

Opcode Instruction Op/En 64/32-bit Mode CPUID Description
NFx 0F C7 /6 RDRAND M V/V Read a 16-bit random number and store in the destination RDRAND r16 register.
NFx 0F C7 /6 RDRAND M V/V Read a 32-bit random number and store in the destination RDRAND r32 register.
NFx REX.W + 0F C7 /6 RDRAND M V/I Read a 64-bit random number and store in the destination RDRAND r64 register.

Description

Loads a hardware generated random value and store it in the destination register. The size of the random value is determined by the destination register size and operating mode. The Carry Flag indicates whether a random value is available at the time the instruction is executed. CF=1 indicates that the data in the destination is valid. Otherwise CF=0 and the data in the destination operand will be returned as zeros for the specified width. All other flags are forced to 0 in either situation. Software must check the state of CF=1 for determining if a valid random value has been returned, otherwise it is expected to loop and retry execution of RDRAND (see Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, Section 7.3.17, “Random Number Generator Instructions”). This instruction is available at all privilege levels. In 64-bit mode, the instruction's default operand size is 32 bits. Using a REX prefix in the form of REX.B permits access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bit operands. See the summary chart at the beginning of this section for encoding data and limits.

Operation

IF HW_RND_GEN.ready = 1
THEN
CASE of
operand size is 64: DEST[63:0] := HW_RND_GEN.data;
operand size is 32: DEST[31:0] := HW_RND_GEN.data;
operand size is 16: DEST[15:0] := HW_RND_GEN.data;
ESAC
CF := 1;
ELSE
CASE of
operand size is 64: DEST[63:0] := 0;
operand size is 32: DEST[31:0] := 0;
operand size is 16: DEST[15:0] := 0;
ESAC
CF := 0;
FI
OF, SF, ZF, AF, PF := 0;

Intel C/C++ Compiler Intrinsic Equivalent

RDRAND int _rdrand16_step( unsigned short * );
RDRAND int _rdrand32_step( unsigned int * );
RDRAND int _rdrand64_step( unsigned __int64 *);

Flags Affected

The CF flag is set according to the result (see the “Operation” section above). The OF, SF, ZF, AF, and PF flags are set to 0. RDRAND—Read Random Number Vol. 2B 4-554

Exceptions

Protected Mode Exceptions

#UD If the LOCK prefix is used. If CPUID.01H:ECX.RDRAND[30] = 0.

Real-Address Mode Exceptions

Same exceptions as in protected mode.

Virtual-8086 Mode Exceptions

Same exceptions as in protected mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

Same exceptions as in protected mode. RDRAND—Read Random Number Vol. 2B 4-555