developer | a4b9bff | 2023-12-25 22:38:12 +0800 | [diff] [blame^] | 1 | diff --git a/crypto/Makefile b/crypto/Makefile |
| 2 | index 4e7a0a8f7..2b5a2a9c8 100644 |
| 3 | --- a/crypto/Makefile |
| 4 | +++ b/crypto/Makefile |
| 5 | @@ -156,6 +156,7 @@ CFLAGS_jitterentropy.o = -O0 |
| 6 | KASAN_SANITIZE_jitterentropy.o = n |
| 7 | UBSAN_SANITIZE_jitterentropy.o = n |
| 8 | jitterentropy_rng-y := jitterentropy.o jitterentropy-kcapi.o |
| 9 | +jitterentropy_rng-$(CONFIG_CRYPTO_CPU_JITTERENTROPY_DEBUG) += jitterentropy-dbg.o |
| 10 | obj-$(CONFIG_CRYPTO_TEST) += tcrypt.o |
| 11 | obj-$(CONFIG_CRYPTO_GHASH) += ghash-generic.o |
| 12 | obj-$(CONFIG_CRYPTO_USER_API) += af_alg.o |
| 13 | diff --git a/crypto/jitterentropy-dbg.c b/crypto/jitterentropy-dbg.c |
| 14 | new file mode 100644 |
| 15 | index 000000000..2e7e98b9a |
| 16 | --- /dev/null |
| 17 | +++ b/crypto/jitterentropy-dbg.c |
| 18 | @@ -0,0 +1,242 @@ |
| 19 | +/* |
| 20 | + * Non-physical true random number generator based on timing jitter - DebugFS |
| 21 | + * |
| 22 | + * Copyright Stephan Mueller <smueller@chronox.de>, 2013 |
| 23 | + * |
| 24 | + * License |
| 25 | + * ======= |
| 26 | + * |
| 27 | + * Redistribution and use in source and binary forms, with or without |
| 28 | + * modification, are permitted provided that the following conditions |
| 29 | + * are met: |
| 30 | + * 1. Redistributions of source code must retain the above copyright |
| 31 | + * notice, and the entire permission notice in its entirety, |
| 32 | + * including the disclaimer of warranties. |
| 33 | + * 2. Redistributions in binary form must reproduce the above copyright |
| 34 | + * notice, this list of conditions and the following disclaimer in the |
| 35 | + * documentation and/or other materials provided with the distribution. |
| 36 | + * 3. The name of the author may not be used to endorse or promote |
| 37 | + * products derived from this software without specific prior |
| 38 | + * written permission. |
| 39 | + * |
| 40 | + * ALTERNATIVELY, this product may be distributed under the terms of |
| 41 | + * the GNU General Public License, in which case the provisions of the GPL are |
| 42 | + * required INSTEAD OF the above restrictions. (This clause is |
| 43 | + * necessary due to a potential bad interaction between the GPL and |
| 44 | + * the restrictions contained in a BSD-style copyright.) |
| 45 | + * |
| 46 | + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED |
| 47 | + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
| 48 | + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF |
| 49 | + * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE |
| 50 | + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| 51 | + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT |
| 52 | + * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR |
| 53 | + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
| 54 | + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 55 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE |
| 56 | + * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH |
| 57 | + * DAMAGE. |
| 58 | + */ |
| 59 | + |
| 60 | +#include <linux/module.h> |
| 61 | +#include <linux/kernel.h> |
| 62 | +#include <linux/init.h> |
| 63 | +#include <linux/slab.h> |
| 64 | +#include <asm/uaccess.h> |
| 65 | +#include <linux/string.h> |
| 66 | +#include <linux/compat.h> |
| 67 | +#include <linux/export.h> |
| 68 | +#include <linux/file.h> |
| 69 | +#include <linux/debugfs.h> |
| 70 | + |
| 71 | +#include "jitterentropy.h" |
| 72 | +#include "jitterentropy-dbg.h" |
| 73 | + |
| 74 | +struct jent_debugfs { |
| 75 | + struct dentry *jent_debugfs_root; |
| 76 | + struct dentry *jent_debugfs_entropy; |
| 77 | + struct dentry *jent_debugfs_noise; |
| 78 | +}; |
| 79 | + |
| 80 | +struct jent_raw |
| 81 | +{ |
| 82 | + spinlock_t raw_lock; |
| 83 | + struct rand_data *entropy_collector; |
| 84 | +}; |
| 85 | + |
| 86 | +static struct jent_debugfs jent_debugfs; |
| 87 | +static struct jent_raw raw_entropy; |
| 88 | + |
| 89 | +void jent_drng_cleanup_raw(struct jent_raw *raw) |
| 90 | +{ |
| 91 | + spin_lock_bh(&raw->raw_lock); |
| 92 | + if (NULL != raw->entropy_collector) |
| 93 | + jent_entropy_collector_free(raw->entropy_collector); |
| 94 | + raw->entropy_collector = NULL; |
| 95 | + spin_unlock_bh(&raw->raw_lock); |
| 96 | +} |
| 97 | + |
| 98 | +int jent_drng_get_bytes_raw(struct jent_raw *raw, char *data, size_t len) |
| 99 | +{ |
| 100 | + int ret = 0; |
| 101 | + |
| 102 | + spin_lock_bh(&raw->raw_lock); |
| 103 | + ret = jent_read_entropy(raw->entropy_collector, data, len); |
| 104 | + if (0 > ret) { |
| 105 | + printk(DRIVER_NAME": Unable to obtain %zu bytes of entropy\n", len); |
| 106 | + ret = -EAGAIN; |
| 107 | + } |
| 108 | + |
| 109 | + spin_unlock_bh(&raw->raw_lock); |
| 110 | + return ret; |
| 111 | +} |
| 112 | + |
| 113 | + |
| 114 | +static inline int jent_dbg_raw_bytes(char *data, size_t len) |
| 115 | +{ |
| 116 | + return jent_drng_get_bytes_raw(&raw_entropy, data, len); |
| 117 | +} |
| 118 | + |
| 119 | +static ssize_t jent_debugfs_read_func(struct file *file, |
| 120 | + char __user *buf, size_t nbytes, |
| 121 | + loff_t *ppos, size_t chunk, |
| 122 | + int (*source)(char *out, size_t len)) |
| 123 | +{ |
| 124 | + ssize_t total = 0; |
| 125 | + int ret = 0; |
| 126 | + loff_t pos = *ppos; |
| 127 | + char *out; |
| 128 | + |
| 129 | + if (!nbytes) |
| 130 | + return -EINVAL; |
| 131 | + |
| 132 | + out = kzalloc(chunk, GFP_KERNEL); |
| 133 | + if (!out) |
| 134 | + return -ENOMEM; |
| 135 | + |
| 136 | + while (nbytes > 0) { |
| 137 | + int copy = min_t(int, chunk, nbytes); |
| 138 | + ret = source(out, copy); |
| 139 | + if (0 > ret) { |
| 140 | + printk(DRIVER_NAME": could not obtain random data: %d\n", ret); |
| 141 | + ret = -EAGAIN; |
| 142 | + break; |
| 143 | + } |
| 144 | + if (copy_to_user(buf+pos+total, out, copy)) { |
| 145 | + ret = -EFAULT; |
| 146 | + break; |
| 147 | + } |
| 148 | + nbytes -= copy; |
| 149 | + total += copy; |
| 150 | + } |
| 151 | + kzfree(out); |
| 152 | + |
| 153 | + return ((0 > ret) ? ret : total); |
| 154 | +} |
| 155 | + |
| 156 | +static ssize_t jent_debugfs_noise_read(struct file *file, char __user *buf, |
| 157 | + size_t nbytes, loff_t *ppos) |
| 158 | +{ |
| 159 | + struct rand_data *ec = raw_entropy.entropy_collector; |
| 160 | + int total = 0; |
| 161 | + loff_t pos = *ppos; |
| 162 | + char *out; |
| 163 | + |
| 164 | + out = kzalloc(8, GFP_KERNEL); |
| 165 | + |
| 166 | + while (nbytes > 0) { |
| 167 | + int len = min_t(int, 8, nbytes); |
| 168 | + jent_lfsr_time(ec, 0, 0, 0); |
| 169 | + memcpy(out, &ec->data, len); |
| 170 | + if (copy_to_user(buf+pos+total, out, len)) { |
| 171 | + break; |
| 172 | + } |
| 173 | + nbytes -= len; |
| 174 | + total += len; |
| 175 | + } |
| 176 | + kzfree(out); |
| 177 | + return total; |
| 178 | + |
| 179 | +} |
| 180 | +static ssize_t jent_debugfs_seed_read(struct file *file, char __user *buf, |
| 181 | + size_t nbytes, loff_t *ppos) |
| 182 | +{ |
| 183 | + int ret = jent_debugfs_read_func(file, buf, nbytes, ppos, 8, |
| 184 | + jent_dbg_raw_bytes); |
| 185 | + return ret; |
| 186 | +} |
| 187 | + |
| 188 | +int jent_drng_init_raw(struct jent_raw *raw, unsigned int flags) |
| 189 | +{ |
| 190 | + int ret = 0; |
| 191 | + |
| 192 | + raw->entropy_collector = jent_entropy_collector_alloc(1, flags); |
| 193 | + if (!raw->entropy_collector) |
| 194 | + ret = -ENOMEM; |
| 195 | + |
| 196 | + spin_lock_init(&raw->raw_lock); |
| 197 | + return ret; |
| 198 | +} |
| 199 | + |
| 200 | +static struct file_operations jent_seed_fops = { |
| 201 | + .owner = THIS_MODULE, |
| 202 | + .read = jent_debugfs_seed_read, |
| 203 | +}; |
| 204 | + |
| 205 | +static struct file_operations jent_noise_fops = { |
| 206 | + .owner = THIS_MODULE, |
| 207 | + .read = jent_debugfs_noise_read, |
| 208 | +}; |
| 209 | + |
| 210 | + |
| 211 | +int __init jent_dbg_init(void) |
| 212 | +{ |
| 213 | + int ret = -EINVAL; |
| 214 | + jent_debugfs.jent_debugfs_root = NULL; |
| 215 | + jent_debugfs.jent_debugfs_noise = NULL; |
| 216 | + jent_debugfs.jent_debugfs_entropy = NULL; |
| 217 | + |
| 218 | + ret = jent_drng_init_raw(&raw_entropy, JENT_DISABLE_STIR); |
| 219 | + if (ret) { |
| 220 | + printk(DRIVER_NAME": Raw entropy collector instantiation failed\n"); |
| 221 | + return ret; |
| 222 | + } |
| 223 | + jent_debugfs.jent_debugfs_root = |
| 224 | + debugfs_create_dir(DRIVER_NAME, NULL); |
| 225 | + if (IS_ERR(jent_debugfs.jent_debugfs_root)) { |
| 226 | + printk(DRIVER_NAME": initialization of debugfs directory failed\n"); |
| 227 | + goto cleandir; |
| 228 | + } |
| 229 | + |
| 230 | + jent_debugfs.jent_debugfs_entropy = |
| 231 | + debugfs_create_file("entropy", S_IRUGO, |
| 232 | + jent_debugfs.jent_debugfs_root, |
| 233 | + NULL, &jent_seed_fops); |
| 234 | + if (IS_ERR(jent_debugfs.jent_debugfs_entropy)) { |
| 235 | + printk(DRIVER_NAME": initialization of entropy file failed\n"); |
| 236 | + goto cleandir; |
| 237 | + } |
| 238 | + |
| 239 | + jent_debugfs.jent_debugfs_noise = |
| 240 | + debugfs_create_file("noise", S_IRUGO, |
| 241 | + jent_debugfs.jent_debugfs_root, |
| 242 | + NULL, &jent_noise_fops); |
| 243 | + if (IS_ERR(jent_debugfs.jent_debugfs_noise)) { |
| 244 | + printk(DRIVER_NAME": initialization of noise file failed\n"); |
| 245 | + goto cleandir; |
| 246 | + } |
| 247 | + return 0; |
| 248 | + |
| 249 | +cleandir: |
| 250 | + debugfs_remove_recursive(jent_debugfs.jent_debugfs_root); |
| 251 | + jent_drng_cleanup_raw(&raw_entropy); |
| 252 | + |
| 253 | + return ret; |
| 254 | +} |
| 255 | + |
| 256 | +void jent_dbg_exit(void) |
| 257 | +{ |
| 258 | + debugfs_remove_recursive(jent_debugfs.jent_debugfs_root); |
| 259 | + jent_drng_cleanup_raw(&raw_entropy); |
| 260 | +} |
| 261 | diff --git a/crypto/jitterentropy-dbg.h b/crypto/jitterentropy-dbg.h |
| 262 | new file mode 100644 |
| 263 | index 000000000..921bd65dc |
| 264 | --- /dev/null |
| 265 | +++ b/crypto/jitterentropy-dbg.h |
| 266 | @@ -0,0 +1,49 @@ |
| 267 | +/* |
| 268 | + * Non-physical true random number generator based on timing jitter. |
| 269 | + * |
| 270 | + * Copyright Stephan Mueller <smueller@chronox.de>, 2013 |
| 271 | + * |
| 272 | + * License |
| 273 | + * ======= |
| 274 | + * |
| 275 | + * Redistribution and use in source and binary forms, with or without |
| 276 | + * modification, are permitted provided that the following conditions |
| 277 | + * are met: |
| 278 | + * 1. Redistributions of source code must retain the above copyright |
| 279 | + * notice, and the entire permission notice in its entirety, |
| 280 | + * including the disclaimer of warranties. |
| 281 | + * 2. Redistributions in binary form must reproduce the above copyright |
| 282 | + * notice, this list of conditions and the following disclaimer in the |
| 283 | + * documentation and/or other materials provided with the distribution. |
| 284 | + * 3. The name of the author may not be used to endorse or promote |
| 285 | + * products derived from this software without specific prior |
| 286 | + * written permission. |
| 287 | + * |
| 288 | + * ALTERNATIVELY, this product may be distributed under the terms of |
| 289 | + * the GNU General Public License, in which case the provisions of the GPL are |
| 290 | + * required INSTEAD OF the above restrictions. (This clause is |
| 291 | + * necessary due to a potential bad interaction between the GPL and |
| 292 | + * the restrictions contained in a BSD-style copyright.) |
| 293 | + * |
| 294 | + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED |
| 295 | + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
| 296 | + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF |
| 297 | + * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE |
| 298 | + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| 299 | + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT |
| 300 | + * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR |
| 301 | + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
| 302 | + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 303 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE |
| 304 | + * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH |
| 305 | + * DAMAGE. |
| 306 | + */ |
| 307 | + |
| 308 | +#ifndef _JITTERENTROPY_DBG_KERNEL_H |
| 309 | +#define _JITTERENTROPY_DBG_KERNEL_H |
| 310 | + |
| 311 | +int __init jent_dbg_init(void); |
| 312 | +void jent_dbg_exit(void); |
| 313 | + |
| 314 | + |
| 315 | +#endif /* _JITTERENTROPY_DBG_KERNEL_H */ |
| 316 | diff --git a/crypto/jitterentropy-kcapi.c b/crypto/jitterentropy-kcapi.c |
| 317 | index 701b8d86a..7a3691fab 100644 |
| 318 | --- a/crypto/jitterentropy-kcapi.c |
| 319 | +++ b/crypto/jitterentropy-kcapi.c |
| 320 | @@ -44,13 +44,11 @@ |
| 321 | #include <linux/crypto.h> |
| 322 | #include <crypto/internal/rng.h> |
| 323 | |
| 324 | -struct rand_data; |
| 325 | -int jent_read_entropy(struct rand_data *ec, unsigned char *data, |
| 326 | - unsigned int len); |
| 327 | -int jent_entropy_init(void); |
| 328 | -struct rand_data *jent_entropy_collector_alloc(unsigned int osr, |
| 329 | - unsigned int flags); |
| 330 | -void jent_entropy_collector_free(struct rand_data *entropy_collector); |
| 331 | +#include "jitterentropy.h" |
| 332 | + |
| 333 | +#ifdef CONFIG_CRYPTO_CPU_JITTERENTROPY_DEBUG |
| 334 | +#include "jitterentropy-dbg.h" |
| 335 | +#endif |
| 336 | |
| 337 | /*************************************************************************** |
| 338 | * Helper function |
| 339 | @@ -148,7 +146,31 @@ static int jent_kcapi_random(struct crypto_rng *tfm, |
| 340 | int ret = 0; |
| 341 | |
| 342 | spin_lock(&rng->jent_lock); |
| 343 | + |
| 344 | ret = jent_read_entropy(rng->entropy_collector, rdata, dlen); |
| 345 | + |
| 346 | + if (ret == -3) { |
| 347 | + /* Handle permanent health test error */ |
| 348 | + /* |
| 349 | + * If the kernel was booted with fips=1, it implies that |
| 350 | + * the entire kernel acts as a FIPS 140 module. In this case |
| 351 | + * an SP800-90B permanent health test error is treated as |
| 352 | + * a FIPS module error. |
| 353 | + */ |
| 354 | + if (fips_enabled) |
| 355 | + panic("Jitter RNG permanent health test failure\n"); |
| 356 | + |
| 357 | + pr_err("Jitter RNG permanent health test failure\n"); |
| 358 | + ret = -EFAULT; |
| 359 | + } else if (ret == -2) { |
| 360 | + /* Handle intermittent health test error */ |
| 361 | + pr_warn_ratelimited("Reset Jitter RNG due to intermittent health test failure\n"); |
| 362 | + ret = -EAGAIN; |
| 363 | + } else if (ret == -1) { |
| 364 | + /* Handle other errors */ |
| 365 | + ret = -EINVAL; |
| 366 | + } |
| 367 | + |
| 368 | spin_unlock(&rng->jent_lock); |
| 369 | |
| 370 | return ret; |
| 371 | @@ -182,15 +204,31 @@ static int __init jent_mod_init(void) |
| 372 | |
| 373 | ret = jent_entropy_init(); |
| 374 | if (ret) { |
| 375 | + /* Handle permanent health test error */ |
| 376 | + if (fips_enabled) |
| 377 | + panic("jitterentropy: Initialization failed with host not compliant with requirements: %d\n", ret); |
| 378 | + |
| 379 | pr_info("jitterentropy: Initialization failed with host not compliant with requirements: %d\n", ret); |
| 380 | return -EFAULT; |
| 381 | } |
| 382 | + |
| 383 | +#ifdef CONFIG_CRYPTO_CPU_JITTERENTROPY_DEBUG |
| 384 | + ret = jent_dbg_init(); |
| 385 | +#endif |
| 386 | + if(ret) |
| 387 | + return ret; |
| 388 | + printk("Debug interface error\n"); |
| 389 | return crypto_register_rng(&jent_alg); |
| 390 | + |
| 391 | } |
| 392 | |
| 393 | static void __exit jent_mod_exit(void) |
| 394 | { |
| 395 | crypto_unregister_rng(&jent_alg); |
| 396 | + |
| 397 | +#ifdef CONFIG_CRYPTO_CPU_JITTERENTROPY_DEBUG |
| 398 | + jent_dbg_exit(); |
| 399 | +#endif |
| 400 | } |
| 401 | |
| 402 | module_init(jent_mod_init); |
| 403 | diff --git a/crypto/jitterentropy.c b/crypto/jitterentropy.c |
| 404 | index 77fa2120f..fea7a6d42 100644 |
| 405 | --- a/crypto/jitterentropy.c |
| 406 | +++ b/crypto/jitterentropy.c |
| 407 | @@ -2,12 +2,12 @@ |
| 408 | * Non-physical true random number generator based on timing jitter -- |
| 409 | * Jitter RNG standalone code. |
| 410 | * |
| 411 | - * Copyright Stephan Mueller <smueller@chronox.de>, 2015 - 2019 |
| 412 | + * Copyright Stephan Mueller <smueller@chronox.de>, 2015 - 2020 |
| 413 | * |
| 414 | * Design |
| 415 | * ====== |
| 416 | * |
| 417 | - * See http://www.chronox.de/jent.html |
| 418 | + * See https://www.chronox.de/jent.html |
| 419 | * |
| 420 | * License |
| 421 | * ======= |
| 422 | @@ -47,7 +47,7 @@ |
| 423 | |
| 424 | /* |
| 425 | * This Jitterentropy RNG is based on the jitterentropy library |
| 426 | - * version 2.1.2 provided at http://www.chronox.de/jent.html |
| 427 | + * version 2.2.0 provided at https://www.chronox.de/jent.html |
| 428 | */ |
| 429 | |
| 430 | #ifdef __OPTIMIZE__ |
| 431 | @@ -58,32 +58,8 @@ typedef unsigned long long __u64; |
| 432 | typedef long long __s64; |
| 433 | typedef unsigned int __u32; |
| 434 | #define NULL ((void *) 0) |
| 435 | +#include "jitterentropy.h" |
| 436 | |
| 437 | -/* The entropy pool */ |
| 438 | -struct rand_data { |
| 439 | - /* all data values that are vital to maintain the security |
| 440 | - * of the RNG are marked as SENSITIVE. A user must not |
| 441 | - * access that information while the RNG executes its loops to |
| 442 | - * calculate the next random value. */ |
| 443 | - __u64 data; /* SENSITIVE Actual random number */ |
| 444 | - __u64 old_data; /* SENSITIVE Previous random number */ |
| 445 | - __u64 prev_time; /* SENSITIVE Previous time stamp */ |
| 446 | -#define DATA_SIZE_BITS ((sizeof(__u64)) * 8) |
| 447 | - __u64 last_delta; /* SENSITIVE stuck test */ |
| 448 | - __s64 last_delta2; /* SENSITIVE stuck test */ |
| 449 | - unsigned int osr; /* Oversample rate */ |
| 450 | -#define JENT_MEMORY_BLOCKS 64 |
| 451 | -#define JENT_MEMORY_BLOCKSIZE 32 |
| 452 | -#define JENT_MEMORY_ACCESSLOOPS 128 |
| 453 | -#define JENT_MEMORY_SIZE (JENT_MEMORY_BLOCKS*JENT_MEMORY_BLOCKSIZE) |
| 454 | - unsigned char *mem; /* Memory access location with size of |
| 455 | - * memblocks * memblocksize */ |
| 456 | - unsigned int memlocation; /* Pointer to byte in *mem */ |
| 457 | - unsigned int memblocks; /* Number of memory blocks in *mem */ |
| 458 | - unsigned int memblocksize; /* Size of one memory block in bytes */ |
| 459 | - unsigned int memaccessloops; /* Number of memory accesses per random |
| 460 | - * bit generation */ |
| 461 | -}; |
| 462 | |
| 463 | /* Flags that can be used to initialize the RNG */ |
| 464 | #define JENT_DISABLE_MEMORY_ACCESS (1<<2) /* Disable memory access for more |
| 465 | @@ -98,19 +74,187 @@ struct rand_data { |
| 466 | * variations (2nd derivation of time is |
| 467 | * zero). */ |
| 468 | #define JENT_ESTUCK 8 /* Too many stuck results during init. */ |
| 469 | +#define JENT_EHEALTH 9 /* Health test failed during initialization */ |
| 470 | + |
| 471 | +/* |
| 472 | + * The output n bits can receive more than n bits of min entropy, of course, |
| 473 | + * but the fixed output of the conditioning function can only asymptotically |
| 474 | + * approach the output size bits of min entropy, not attain that bound. Random |
| 475 | + * maps will tend to have output collisions, which reduces the creditable |
| 476 | + * output entropy (that is what SP 800-90B Section 3.1.5.1.2 attempts to bound). |
| 477 | + * |
| 478 | + * The value "64" is justified in Appendix A.4 of the current 90C draft, |
| 479 | + * and aligns with NIST's in "epsilon" definition in this document, which is |
| 480 | + * that a string can be considered "full entropy" if you can bound the min |
| 481 | + * entropy in each bit of output to at least 1-epsilon, where epsilon is |
| 482 | + * required to be <= 2^(-32). |
| 483 | + */ |
| 484 | +#define JENT_ENTROPY_SAFETY_FACTOR 64 |
| 485 | + |
| 486 | +#include <linux/fips.h> |
| 487 | +#include <linux/printk.h> |
| 488 | + |
| 489 | +/*************************************************************************** |
| 490 | + * Adaptive Proportion Test |
| 491 | + * |
| 492 | + * This test complies with SP800-90B section 4.4.2. |
| 493 | + ***************************************************************************/ |
| 494 | + |
| 495 | +/* |
| 496 | + * Reset the APT counter |
| 497 | + * |
| 498 | + * @ec [in] Reference to entropy collector |
| 499 | + */ |
| 500 | +static void jent_apt_reset(struct rand_data *ec, unsigned int delta_masked) |
| 501 | +{ |
| 502 | + /* Reset APT counter */ |
| 503 | + ec->apt_count = 0; |
| 504 | + ec->apt_base = delta_masked; |
| 505 | + ec->apt_observations = 0; |
| 506 | +} |
| 507 | + |
| 508 | +/* |
| 509 | + * Insert a new entropy event into APT |
| 510 | + * |
| 511 | + * @ec [in] Reference to entropy collector |
| 512 | + * @delta_masked [in] Masked time delta to process |
| 513 | + */ |
| 514 | +static void jent_apt_insert(struct rand_data *ec, unsigned int delta_masked) |
| 515 | +{ |
| 516 | + /* Initialize the base reference */ |
| 517 | + if (!ec->apt_base_set) { |
| 518 | + ec->apt_base = delta_masked; |
| 519 | + ec->apt_base_set = 1; |
| 520 | + return; |
| 521 | + } |
| 522 | + |
| 523 | + if (delta_masked == ec->apt_base) |
| 524 | + ec->apt_count++; |
| 525 | + |
| 526 | + ec->apt_observations++; |
| 527 | + |
| 528 | + if (ec->apt_observations >= JENT_APT_WINDOW_SIZE) |
| 529 | + jent_apt_reset(ec, delta_masked); |
| 530 | +} |
| 531 | + |
| 532 | +/* APT health test failure detection */ |
| 533 | +static int jent_apt_permanent_failure(struct rand_data *ec) |
| 534 | +{ |
| 535 | + return (ec->apt_count >= JENT_APT_CUTOFF_PERMANENT) ? 1 : 0; |
| 536 | +} |
| 537 | + |
| 538 | +static int jent_apt_failure(struct rand_data *ec) |
| 539 | +{ |
| 540 | + return (ec->apt_count >= JENT_APT_CUTOFF) ? 1 : 0; |
| 541 | +} |
| 542 | |
| 543 | /*************************************************************************** |
| 544 | - * Helper functions |
| 545 | + * Stuck Test and its use as Repetition Count Test |
| 546 | + * |
| 547 | + * The Jitter RNG uses an enhanced version of the Repetition Count Test |
| 548 | + * (RCT) specified in SP800-90B section 4.4.1. Instead of counting identical |
| 549 | + * back-to-back values, the input to the RCT is the counting of the stuck |
| 550 | + * values during the generation of one Jitter RNG output block. |
| 551 | + * |
| 552 | + * The RCT is applied with an alpha of 2^{-30} compliant to FIPS 140-2 IG 9.8. |
| 553 | + * |
| 554 | + * During the counting operation, the Jitter RNG always calculates the RCT |
| 555 | + * cut-off value of C. If that value exceeds the allowed cut-off value, |
| 556 | + * the Jitter RNG output block will be calculated completely but discarded at |
| 557 | + * the end. The caller of the Jitter RNG is informed with an error code. |
| 558 | ***************************************************************************/ |
| 559 | |
| 560 | -void jent_get_nstime(__u64 *out); |
| 561 | -void *jent_zalloc(unsigned int len); |
| 562 | -void jent_zfree(void *ptr); |
| 563 | -int jent_fips_enabled(void); |
| 564 | -void jent_panic(char *s); |
| 565 | -void jent_memcpy(void *dest, const void *src, unsigned int n); |
| 566 | +/* |
| 567 | + * Repetition Count Test as defined in SP800-90B section 4.4.1 |
| 568 | + * |
| 569 | + * @ec [in] Reference to entropy collector |
| 570 | + * @stuck [in] Indicator whether the value is stuck |
| 571 | + */ |
| 572 | +static void jent_rct_insert(struct rand_data *ec, int stuck) |
| 573 | +{ |
| 574 | + if (stuck) { |
| 575 | + ec->rct_count++; |
| 576 | + } else { |
| 577 | + /* Reset RCT */ |
| 578 | + ec->rct_count = 0; |
| 579 | + } |
| 580 | +} |
| 581 | + |
| 582 | +static inline __u64 jent_delta(__u64 prev, __u64 next) |
| 583 | +{ |
| 584 | +#define JENT_UINT64_MAX (__u64)(~((__u64) 0)) |
| 585 | + return (prev < next) ? (next - prev) : |
| 586 | + (JENT_UINT64_MAX - prev + 1 + next); |
| 587 | +} |
| 588 | + |
| 589 | +/* |
| 590 | + * Stuck test by checking the: |
| 591 | + * 1st derivative of the jitter measurement (time delta) |
| 592 | + * 2nd derivative of the jitter measurement (delta of time deltas) |
| 593 | + * 3rd derivative of the jitter measurement (delta of delta of time deltas) |
| 594 | + * |
| 595 | + * All values must always be non-zero. |
| 596 | + * |
| 597 | + * @ec [in] Reference to entropy collector |
| 598 | + * @current_delta [in] Jitter time delta |
| 599 | + * |
| 600 | + * @return |
| 601 | + * 0 jitter measurement not stuck (good bit) |
| 602 | + * 1 jitter measurement stuck (reject bit) |
| 603 | + */ |
| 604 | +static int jent_stuck(struct rand_data *ec, __u64 current_delta) |
| 605 | +{ |
| 606 | + __u64 delta2 = jent_delta(ec->last_delta, current_delta); |
| 607 | + __u64 delta3 = jent_delta(ec->last_delta2, delta2); |
| 608 | + |
| 609 | + ec->last_delta = current_delta; |
| 610 | + ec->last_delta2 = delta2; |
| 611 | + |
| 612 | + /* |
| 613 | + * Insert the result of the comparison of two back-to-back time |
| 614 | + * deltas. |
| 615 | + */ |
| 616 | + jent_apt_insert(ec, current_delta); |
| 617 | + |
| 618 | + if (!current_delta || !delta2 || !delta3) { |
| 619 | + /* RCT with a stuck bit */ |
| 620 | + jent_rct_insert(ec, 1); |
| 621 | + return 1; |
| 622 | + } |
| 623 | + |
| 624 | + /* RCT with a non-stuck bit */ |
| 625 | + jent_rct_insert(ec, 0); |
| 626 | + |
| 627 | + return 0; |
| 628 | +} |
| 629 | + |
| 630 | +/* RCT health test failure detection */ |
| 631 | +static int jent_rct_permanent_failure(struct rand_data *ec) |
| 632 | +{ |
| 633 | + return (ec->rct_count >= JENT_RCT_CUTOFF_PERMANENT) ? 1 : 0; |
| 634 | +} |
| 635 | + |
| 636 | +static int jent_rct_failure(struct rand_data *ec) |
| 637 | +{ |
| 638 | + return (ec->rct_count >= JENT_RCT_CUTOFF) ? 1 : 0; |
| 639 | +} |
| 640 | + |
| 641 | +/* Report of health test failures */ |
| 642 | +static int jent_health_failure(struct rand_data *ec) |
| 643 | +{ |
| 644 | + return jent_rct_failure(ec) | jent_apt_failure(ec); |
| 645 | +} |
| 646 | + |
| 647 | +static int jent_permanent_health_failure(struct rand_data *ec) |
| 648 | +{ |
| 649 | + return jent_rct_permanent_failure(ec) | jent_apt_permanent_failure(ec); |
| 650 | +} |
| 651 | + |
| 652 | +/*************************************************************************** |
| 653 | + * Noise sources |
| 654 | + ***************************************************************************/ |
| 655 | |
| 656 | -/** |
| 657 | +/* |
| 658 | * Update of the loop count used for the next round of |
| 659 | * an entropy collection. |
| 660 | * |
| 661 | @@ -153,11 +297,7 @@ static __u64 jent_loop_shuffle(struct rand_data *ec, |
| 662 | return (shuffle + (1<<min)); |
| 663 | } |
| 664 | |
| 665 | -/*************************************************************************** |
| 666 | - * Noise sources |
| 667 | - ***************************************************************************/ |
| 668 | - |
| 669 | -/** |
| 670 | +/* |
| 671 | * CPU Jitter noise source -- this is the noise source based on the CPU |
| 672 | * execution time jitter |
| 673 | * |
| 674 | @@ -171,18 +311,19 @@ static __u64 jent_loop_shuffle(struct rand_data *ec, |
| 675 | * the CPU execution time jitter. Any change to the loop in this function |
| 676 | * implies that careful retesting must be done. |
| 677 | * |
| 678 | - * Input: |
| 679 | - * @ec entropy collector struct -- may be NULL |
| 680 | - * @time time stamp to be injected |
| 681 | - * @loop_cnt if a value not equal to 0 is set, use the given value as number of |
| 682 | - * loops to perform the folding |
| 683 | + * @ec [in] entropy collector struct |
| 684 | + * @time [in] time stamp to be injected |
| 685 | + * @loop_cnt [in] if a value not equal to 0 is set, use the given value as |
| 686 | + * number of loops to perform the folding |
| 687 | + * @stuck [in] Is the time stamp identified as stuck? |
| 688 | * |
| 689 | * Output: |
| 690 | * updated ec->data |
| 691 | * |
| 692 | * @return Number of loops the folding operation is performed |
| 693 | */ |
| 694 | -static __u64 jent_lfsr_time(struct rand_data *ec, __u64 time, __u64 loop_cnt) |
| 695 | +void jent_lfsr_time(struct rand_data *ec, __u64 time, __u64 loop_cnt, |
| 696 | + int stuck) |
| 697 | { |
| 698 | unsigned int i; |
| 699 | __u64 j = 0; |
| 700 | @@ -225,12 +366,20 @@ static __u64 jent_lfsr_time(struct rand_data *ec, __u64 time, __u64 loop_cnt) |
| 701 | new ^= tmp; |
| 702 | } |
| 703 | } |
| 704 | - ec->data = new; |
| 705 | |
| 706 | - return fold_loop_cnt; |
| 707 | + /* |
| 708 | + * If the time stamp is stuck, do not finally insert the value into |
| 709 | + * the entropy pool. Although this operation should not do any harm |
| 710 | + * even when the time stamp has no entropy, SP800-90B requires that |
| 711 | + * any conditioning operation (SP800-90B considers the LFSR to be a |
| 712 | + * conditioning operation) to have an identical amount of input |
| 713 | + * data according to section 3.1.5. |
| 714 | + */ |
| 715 | + if (!stuck) |
| 716 | + ec->data = new; |
| 717 | } |
| 718 | |
| 719 | -/** |
| 720 | +/* |
| 721 | * Memory Access noise source -- this is a noise source based on variations in |
| 722 | * memory access times |
| 723 | * |
| 724 | @@ -248,16 +397,13 @@ static __u64 jent_lfsr_time(struct rand_data *ec, __u64 time, __u64 loop_cnt) |
| 725 | * to reliably access either L3 or memory, the ec->mem memory must be quite |
| 726 | * large which is usually not desirable. |
| 727 | * |
| 728 | - * Input: |
| 729 | - * @ec Reference to the entropy collector with the memory access data -- if |
| 730 | - * the reference to the memory block to be accessed is NULL, this noise |
| 731 | - * source is disabled |
| 732 | - * @loop_cnt if a value not equal to 0 is set, use the given value as number of |
| 733 | - * loops to perform the folding |
| 734 | - * |
| 735 | - * @return Number of memory access operations |
| 736 | + * @ec [in] Reference to the entropy collector with the memory access data -- if |
| 737 | + * the reference to the memory block to be accessed is NULL, this noise |
| 738 | + * source is disabled |
| 739 | + * @loop_cnt [in] if a value not equal to 0 is set, use the given value |
| 740 | + * number of loops to perform the LFSR |
| 741 | */ |
| 742 | -static unsigned int jent_memaccess(struct rand_data *ec, __u64 loop_cnt) |
| 743 | +static void jent_memaccess(struct rand_data *ec, __u64 loop_cnt) |
| 744 | { |
| 745 | unsigned int wrap = 0; |
| 746 | __u64 i = 0; |
| 747 | @@ -267,7 +413,7 @@ static unsigned int jent_memaccess(struct rand_data *ec, __u64 loop_cnt) |
| 748 | jent_loop_shuffle(ec, MAX_ACC_LOOP_BIT, MIN_ACC_LOOP_BIT); |
| 749 | |
| 750 | if (NULL == ec || NULL == ec->mem) |
| 751 | - return 0; |
| 752 | + return; |
| 753 | wrap = ec->memblocksize * ec->memblocks; |
| 754 | |
| 755 | /* |
| 756 | @@ -293,44 +439,12 @@ static unsigned int jent_memaccess(struct rand_data *ec, __u64 loop_cnt) |
| 757 | ec->memlocation = ec->memlocation + ec->memblocksize - 1; |
| 758 | ec->memlocation = ec->memlocation % wrap; |
| 759 | } |
| 760 | - return i; |
| 761 | } |
| 762 | |
| 763 | /*************************************************************************** |
| 764 | * Start of entropy processing logic |
| 765 | ***************************************************************************/ |
| 766 | - |
| 767 | -/** |
| 768 | - * Stuck test by checking the: |
| 769 | - * 1st derivation of the jitter measurement (time delta) |
| 770 | - * 2nd derivation of the jitter measurement (delta of time deltas) |
| 771 | - * 3rd derivation of the jitter measurement (delta of delta of time deltas) |
| 772 | - * |
| 773 | - * All values must always be non-zero. |
| 774 | - * |
| 775 | - * Input: |
| 776 | - * @ec Reference to entropy collector |
| 777 | - * @current_delta Jitter time delta |
| 778 | - * |
| 779 | - * @return |
| 780 | - * 0 jitter measurement not stuck (good bit) |
| 781 | - * 1 jitter measurement stuck (reject bit) |
| 782 | - */ |
| 783 | -static int jent_stuck(struct rand_data *ec, __u64 current_delta) |
| 784 | -{ |
| 785 | - __s64 delta2 = ec->last_delta - current_delta; |
| 786 | - __s64 delta3 = delta2 - ec->last_delta2; |
| 787 | - |
| 788 | - ec->last_delta = current_delta; |
| 789 | - ec->last_delta2 = delta2; |
| 790 | - |
| 791 | - if (!current_delta || !delta2 || !delta3) |
| 792 | - return 1; |
| 793 | - |
| 794 | - return 0; |
| 795 | -} |
| 796 | - |
| 797 | -/** |
| 798 | +/* |
| 799 | * This is the heart of the entropy generation: calculate time deltas and |
| 800 | * use the CPU jitter in the time deltas. The jitter is injected into the |
| 801 | * entropy pool. |
| 802 | @@ -339,15 +453,15 @@ static int jent_stuck(struct rand_data *ec, __u64 current_delta) |
| 803 | * of this function! This can be done by calling this function |
| 804 | * and not using its result. |
| 805 | * |
| 806 | - * Input: |
| 807 | - * @entropy_collector Reference to entropy collector |
| 808 | + * @ec [in] Reference to entropy collector |
| 809 | * |
| 810 | * @return result of stuck test |
| 811 | */ |
| 812 | -static int jent_measure_jitter(struct rand_data *ec) |
| 813 | +int jent_measure_jitter(struct rand_data *ec) |
| 814 | { |
| 815 | __u64 time = 0; |
| 816 | __u64 current_delta = 0; |
| 817 | + int stuck; |
| 818 | |
| 819 | /* Invoke one noise source before time measurement to add variations */ |
| 820 | jent_memaccess(ec, 0); |
| 821 | @@ -357,31 +471,33 @@ static int jent_measure_jitter(struct rand_data *ec) |
| 822 | * invocation to measure the timing variations |
| 823 | */ |
| 824 | jent_get_nstime(&time); |
| 825 | - current_delta = time - ec->prev_time; |
| 826 | + current_delta = jent_delta(ec->prev_time, time); |
| 827 | ec->prev_time = time; |
| 828 | + /* Check whether we have a stuck measurement. */ |
| 829 | + stuck = jent_stuck(ec, current_delta); |
| 830 | |
| 831 | /* Now call the next noise sources which also injects the data */ |
| 832 | - jent_lfsr_time(ec, current_delta, 0); |
| 833 | - |
| 834 | - /* Check whether we have a stuck measurement. */ |
| 835 | - return jent_stuck(ec, current_delta); |
| 836 | + jent_lfsr_time(ec, current_delta, 0, stuck); |
| 837 | + return stuck; |
| 838 | } |
| 839 | |
| 840 | -/** |
| 841 | +/* |
| 842 | * Generator of one 64 bit random number |
| 843 | * Function fills rand_data->data |
| 844 | * |
| 845 | - * Input: |
| 846 | - * @ec Reference to entropy collector |
| 847 | + * @ec [in] Reference to entropy collector |
| 848 | */ |
| 849 | static void jent_gen_entropy(struct rand_data *ec) |
| 850 | { |
| 851 | - unsigned int k = 0; |
| 852 | + unsigned int k = 0, safety_factor = 0; |
| 853 | + |
| 854 | + if (fips_enabled) |
| 855 | + safety_factor = JENT_ENTROPY_SAFETY_FACTOR; |
| 856 | |
| 857 | /* priming of the ->prev_time value */ |
| 858 | jent_measure_jitter(ec); |
| 859 | |
| 860 | - while (1) { |
| 861 | + while (!jent_health_failure(ec)) { |
| 862 | /* If a stuck measurement is received, repeat measurement */ |
| 863 | if (jent_measure_jitter(ec)) |
| 864 | continue; |
| 865 | @@ -390,37 +506,12 @@ static void jent_gen_entropy(struct rand_data *ec) |
| 866 | * We multiply the loop value with ->osr to obtain the |
| 867 | * oversampling rate requested by the caller |
| 868 | */ |
| 869 | - if (++k >= (DATA_SIZE_BITS * ec->osr)) |
| 870 | + if (++k >= ((DATA_SIZE_BITS + safety_factor) * ec->osr)) |
| 871 | break; |
| 872 | } |
| 873 | } |
| 874 | |
| 875 | -/** |
| 876 | - * The continuous test required by FIPS 140-2 -- the function automatically |
| 877 | - * primes the test if needed. |
| 878 | - * |
| 879 | - * Return: |
| 880 | - * 0 if FIPS test passed |
| 881 | - * < 0 if FIPS test failed |
| 882 | - */ |
| 883 | -static void jent_fips_test(struct rand_data *ec) |
| 884 | -{ |
| 885 | - if (!jent_fips_enabled()) |
| 886 | - return; |
| 887 | - |
| 888 | - /* prime the FIPS test */ |
| 889 | - if (!ec->old_data) { |
| 890 | - ec->old_data = ec->data; |
| 891 | - jent_gen_entropy(ec); |
| 892 | - } |
| 893 | - |
| 894 | - if (ec->data == ec->old_data) |
| 895 | - jent_panic("jitterentropy: Duplicate output detected\n"); |
| 896 | - |
| 897 | - ec->old_data = ec->data; |
| 898 | -} |
| 899 | - |
| 900 | -/** |
| 901 | +/* |
| 902 | * Entry function: Obtain entropy for the caller. |
| 903 | * |
| 904 | * This function invokes the entropy gathering logic as often to generate |
| 905 | @@ -430,42 +521,62 @@ static void jent_fips_test(struct rand_data *ec) |
| 906 | * This function truncates the last 64 bit entropy value output to the exact |
| 907 | * size specified by the caller. |
| 908 | * |
| 909 | - * Input: |
| 910 | - * @ec Reference to entropy collector |
| 911 | - * @data pointer to buffer for storing random data -- buffer must already |
| 912 | - * exist |
| 913 | - * @len size of the buffer, specifying also the requested number of random |
| 914 | - * in bytes |
| 915 | + * @ec [in] Reference to entropy collector |
| 916 | + * @data [in] pointer to buffer for storing random data -- buffer must already |
| 917 | + * exist |
| 918 | + * @len [in] size of the buffer, specifying also the requested number of random |
| 919 | + * in bytes |
| 920 | * |
| 921 | * @return 0 when request is fulfilled or an error |
| 922 | * |
| 923 | * The following error codes can occur: |
| 924 | * -1 entropy_collector is NULL |
| 925 | + * -2 Intermittent health failure |
| 926 | + * -3 Permanent health failure |
| 927 | */ |
| 928 | int jent_read_entropy(struct rand_data *ec, unsigned char *data, |
| 929 | unsigned int len) |
| 930 | { |
| 931 | unsigned char *p = data; |
| 932 | |
| 933 | if (!ec) |
| 934 | return -1; |
| 935 | |
| 936 | - while (0 < len) { |
| 937 | + while (len > 0) { |
| 938 | unsigned int tocopy; |
| 939 | |
| 940 | jent_gen_entropy(ec); |
| 941 | - jent_fips_test(ec); |
| 942 | + |
| 943 | + if (jent_permanent_health_failure(ec)) { |
| 944 | + /* |
| 945 | + * At this point, the Jitter RNG instance is considered |
| 946 | + * as a failed instance. There is no rerun of the |
| 947 | + * startup test any more, because the caller |
| 948 | + * is assumed to not further use this instance. |
| 949 | + */ |
| 950 | + return -3; |
| 951 | + } else if (jent_health_failure(ec)) { |
| 952 | + /* |
| 953 | + * Perform startup health tests and return permanent |
| 954 | + * error if it fails. |
| 955 | + */ |
| 956 | + if (jent_entropy_init()) |
| 957 | + return -3; |
| 958 | + |
| 959 | + return -2; |
| 960 | + } |
| 961 | + |
| 962 | if ((DATA_SIZE_BITS / 8) < len) |
| 963 | tocopy = (DATA_SIZE_BITS / 8); |
| 964 | else |
| 965 | tocopy = len; |
| 966 | jent_memcpy(p, &ec->data, tocopy); |
| 967 | |
| 968 | len -= tocopy; |
| 969 | p += tocopy; |
| 970 | } |
| 971 | |
| 972 | return 0; |
| 973 | } |
| 974 | |
| 975 | /*************************************************************************** |
| 976 | @@ -496,7 +609,7 @@ struct rand_data *jent_entropy_collector_alloc(unsigned int osr, |
| 977 | } |
| 978 | |
| 979 | /* verify and set the oversampling rate */ |
| 980 | - if (0 == osr) |
| 981 | + if (osr == 0) |
| 982 | osr = 1; /* minimum sampling rate is 1 */ |
| 983 | entropy_collector->osr = osr; |
| 984 | |
| 985 | @@ -518,11 +631,15 @@ int jent_entropy_init(void) |
| 986 | int i; |
| 987 | __u64 delta_sum = 0; |
| 988 | __u64 old_delta = 0; |
| 989 | + unsigned int nonstuck = 0; |
| 990 | int time_backwards = 0; |
| 991 | int count_mod = 0; |
| 992 | int count_stuck = 0; |
| 993 | struct rand_data ec = { 0 }; |
| 994 | |
| 995 | + /* Required for RCT */ |
| 996 | + ec.osr = 1; |
| 997 | + |
| 998 | /* We could perform statistical tests here, but the problem is |
| 999 | * that we only have a few loop counts to do testing. These |
| 1000 | * loop counts may show some slight skew and we produce |
| 1001 | @@ -544,8 +661,10 @@ int jent_entropy_init(void) |
| 1002 | /* |
| 1003 | * TESTLOOPCOUNT needs some loops to identify edge systems. 100 is |
| 1004 | * definitely too little. |
| 1005 | + * |
| 1006 | + * SP800-90B requires at least 1024 initial test cycles. |
| 1007 | */ |
| 1008 | -#define TESTLOOPCOUNT 300 |
| 1009 | +#define TESTLOOPCOUNT 1024 |
| 1010 | #define CLEARCACHE 100 |
| 1011 | for (i = 0; (TESTLOOPCOUNT + CLEARCACHE) > i; i++) { |
| 1012 | __u64 time = 0; |
| 1013 | @@ -557,13 +676,13 @@ int jent_entropy_init(void) |
| 1014 | /* Invoke core entropy collection logic */ |
| 1015 | jent_get_nstime(&time); |
| 1016 | ec.prev_time = time; |
| 1017 | - jent_lfsr_time(&ec, time, 0); |
| 1018 | + jent_lfsr_time(&ec, time, 0, 0); |
| 1019 | jent_get_nstime(&time2); |
| 1020 | |
| 1021 | /* test whether timer works */ |
| 1022 | if (!time || !time2) |
| 1023 | return JENT_ENOTIME; |
| 1024 | - delta = time2 - time; |
| 1025 | + delta = jent_delta(time, time2); |
| 1026 | /* |
| 1027 | * test whether timer is fine grained enough to provide |
| 1028 | * delta even when called shortly after each other -- this |
| 1029 | @@ -581,11 +700,31 @@ int jent_entropy_init(void) |
| 1030 | * etc. with the goal to clear it to get the worst case |
| 1031 | * measurements. |
| 1032 | */ |
| 1033 | - if (CLEARCACHE > i) |
| 1034 | + if (i < CLEARCACHE) |
| 1035 | continue; |
| 1036 | |
| 1037 | if (stuck) |
| 1038 | count_stuck++; |
| 1039 | + else { |
| 1040 | + nonstuck++; |
| 1041 | + |
| 1042 | + /* |
| 1043 | + * Ensure that the APT succeeded. |
| 1044 | + * |
| 1045 | + * With the check below that count_stuck must be less |
| 1046 | + * than 10% of the overall generated raw entropy values |
| 1047 | + * it is guaranteed that the APT is invoked at |
| 1048 | + * floor((TESTLOOPCOUNT * 0.9) / 64) == 14 times. |
| 1049 | + */ |
| 1050 | + if ((nonstuck % JENT_APT_WINDOW_SIZE) == 0) { |
| 1051 | + jent_apt_reset(&ec, |
| 1052 | + delta & JENT_APT_WORD_MASK); |
| 1053 | + } |
| 1054 | + } |
| 1055 | + |
| 1056 | + /* Validate health test result */ |
| 1057 | + if (jent_health_failure(&ec)) |
| 1058 | + return JENT_EHEALTH; |
| 1059 | |
| 1060 | /* test whether we have an increasing timer */ |
| 1061 | if (!(time2 > time)) |
| 1062 | @@ -616,7 +755,7 @@ int jent_entropy_init(void) |
| 1063 | * should not fail. The value of 3 should cover the NTP case being |
| 1064 | * performed during our test run. |
| 1065 | */ |
| 1066 | - if (3 < time_backwards) |
| 1067 | + if (time_backwards > 3) |
| 1068 | return JENT_ENOMONOTONIC; |
| 1069 | |
| 1070 | /* |
| 1071 | diff --git a/crypto/jitterentropy.h b/crypto/jitterentropy.h |
| 1072 | new file mode 100644 |
| 1073 | index 000000000..ee555f642 |
| 1074 | --- /dev/null |
| 1075 | +++ b/crypto/jitterentropy.h |
| 1076 | @@ -0,0 +1,79 @@ |
| 1077 | +// SPDX-License-Identifier: GPL-2.0-or-later |
| 1078 | + |
| 1079 | +#ifndef _JITTERENTROPY_H |
| 1080 | +#define _JITTERENTROPY_H |
| 1081 | +#include <linux/types.h> |
| 1082 | + |
| 1083 | +/* Flags that can be used to initialize the RNG */ |
| 1084 | +#define JENT_DISABLE_STIR (1<<0) /* Disable stirring the entropy pool */ |
| 1085 | +#define JENT_DISABLE_UNBIAS (1<<1) /* Disable the Von-Neuman Unbiaser */ |
| 1086 | +#define JENT_DISABLE_MEMORY_ACCESS (1<<2) /* Disable memory access for more |
| 1087 | + entropy, saves MEMORY_SIZE RAM for |
| 1088 | + entropy collector */ |
| 1089 | +#define DRIVER_NAME "jitterentropy" |
| 1090 | + |
| 1091 | +struct rand_data { |
| 1092 | + /* all data values that are vital to maintain the security |
| 1093 | + * of the RNG are marked as SENSITIVE. A user must not |
| 1094 | + * access that information while the RNG executes its loops to |
| 1095 | + * calculate the next random value. */ |
| 1096 | + __u64 data; /* SENSITIVE Actual random number */ |
| 1097 | + __u64 old_data; /* SENSITIVE Previous random number */ |
| 1098 | + __u64 prev_time; /* SENSITIVE Previous time stamp */ |
| 1099 | +#define DATA_SIZE_BITS ((sizeof(__u64)) * 8) |
| 1100 | + __u64 last_delta; /* SENSITIVE stuck test */ |
| 1101 | + __s64 last_delta2; /* SENSITIVE stuck test */ |
| 1102 | + unsigned int osr; /* Oversample rate */ |
| 1103 | +#define JENT_MEMORY_BLOCKS 64 |
| 1104 | +#define JENT_MEMORY_BLOCKSIZE 32 |
| 1105 | +#define JENT_MEMORY_ACCESSLOOPS 128 |
| 1106 | +#define JENT_MEMORY_SIZE (JENT_MEMORY_BLOCKS*JENT_MEMORY_BLOCKSIZE) |
| 1107 | + unsigned char *mem; /* Memory access location with size of |
| 1108 | + * memblocks * memblocksize */ |
| 1109 | + unsigned int memlocation; /* Pointer to byte in *mem */ |
| 1110 | + unsigned int memblocks; /* Number of memory blocks in *mem */ |
| 1111 | + unsigned int memblocksize; /* Size of one memory block in bytes */ |
| 1112 | + unsigned int memaccessloops; /* Number of memory accesses per random |
| 1113 | + * bit generation */ |
| 1114 | + |
| 1115 | + /* Repetition Count Test */ |
| 1116 | + unsigned int rct_count; /* Number of stuck values */ |
| 1117 | + |
| 1118 | + /* Intermittent health test failure threshold of 2^-30 */ |
| 1119 | +#define JENT_RCT_CUTOFF 30 /* Taken from SP800-90B sec 4.4.1 */ |
| 1120 | +#define JENT_APT_CUTOFF 325 /* Taken from SP800-90B sec 4.4.2 */ |
| 1121 | + /* Permanent health test failure threshold of 2^-60 */ |
| 1122 | +#define JENT_RCT_CUTOFF_PERMANENT 60 |
| 1123 | +#define JENT_APT_CUTOFF_PERMANENT 355 |
| 1124 | +#define JENT_APT_WINDOW_SIZE 512 /* Data window size */ |
| 1125 | + /* LSB of time stamp to process */ |
| 1126 | +#define JENT_APT_LSB 16 |
| 1127 | +#define JENT_APT_WORD_MASK (JENT_APT_LSB - 1) |
| 1128 | + unsigned int apt_observations; /* Number of collected observations */ |
| 1129 | + unsigned int apt_count; /* APT counter */ |
| 1130 | + unsigned int apt_base; /* APT base reference */ |
| 1131 | + unsigned int apt_base_set:1; /* APT base reference set? */ |
| 1132 | + unsigned int stir:1; /* Post-processing stirring */ |
| 1133 | + unsigned int disable_unbias:1; /* Deactivate Von-Neuman unbias */ |
| 1134 | +}; |
| 1135 | +extern void *jent_zalloc(unsigned int len); |
| 1136 | +extern void jent_zfree(void *ptr); |
| 1137 | +extern void jent_memcpy(void *dest, const void *src, unsigned int n); |
| 1138 | +extern void jent_get_nstime(__u64 *out); |
| 1139 | + |
| 1140 | +struct rand_data; |
| 1141 | +extern int jent_entropy_init(void); |
| 1142 | +extern int jent_read_entropy(struct rand_data *ec, unsigned char *data, |
| 1143 | + unsigned int len); |
| 1144 | + |
| 1145 | +extern struct rand_data *jent_entropy_collector_alloc(unsigned int osr, |
| 1146 | + unsigned int flags); |
| 1147 | +extern void jent_entropy_collector_free(struct rand_data *entropy_collector); |
| 1148 | + |
| 1149 | +unsigned int jent_version(void); |
| 1150 | + |
| 1151 | +void jent_lfsr_time(struct rand_data *ec, __u64 time, __u64 loop_cnt, int stuck); |
| 1152 | + |
| 1153 | +int jent_measure_jitter(struct rand_data *ec); |
| 1154 | + |
| 1155 | +#endif /* _JITTERENTROPY_H */ |