1/* 2 * Non-physical true random number generator based on timing jitter -- 3 * Jitter RNG standalone code. 4 * 5 * Copyright Stephan Mueller <smueller@chronox.de>, 2015 - 2020 6 * 7 * Design 8 * ====== 9 * 10 * See https://www.chronox.de/jent.html 11 * 12 * License 13 * ======= 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, and the entire permission notice in its entirety, 20 * including the disclaimer of warranties. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 3. The name of the author may not be used to endorse or promote 25 * products derived from this software without specific prior 26 * written permission. 27 * 28 * ALTERNATIVELY, this product may be distributed under the terms of 29 * the GNU General Public License, in which case the provisions of the GPL2 are 30 * required INSTEAD OF the above restrictions. (This clause is 31 * necessary due to a potential bad interaction between the GPL and 32 * the restrictions contained in a BSD-style copyright.) 33 * 34 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 35 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 36 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF 37 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE 38 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 39 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 40 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 41 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 42 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 43 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 44 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH 45 * DAMAGE. 46 */ 47 48/* 49 * This Jitterentropy RNG is based on the jitterentropy library 50 * version 2.2.0 provided at https://www.chronox.de/jent.html 51 */ 52 53#ifdef __OPTIMIZE__ 54 #error "The CPU Jitter random number generator must not be compiled with optimizations. See documentation. Use the compiler switch -O0 for compiling jitterentropy.c." 55#endif 56 57typedef unsigned long long __u64; 58typedef long long __s64; 59typedef unsigned int __u32; 60#define NULL ((void *) 0) 61 62/* The entropy pool */ 63struct rand_data { 64 /* all data values that are vital to maintain the security 65 * of the RNG are marked as SENSITIVE. A user must not 66 * access that information while the RNG executes its loops to 67 * calculate the next random value. */ 68 __u64 data; /* SENSITIVE Actual random number */ 69 __u64 old_data; /* SENSITIVE Previous random number */ 70 __u64 prev_time; /* SENSITIVE Previous time stamp */ 71#define DATA_SIZE_BITS ((sizeof(__u64)) * 8) 72 __u64 last_delta; /* SENSITIVE stuck test */ 73 __s64 last_delta2; /* SENSITIVE stuck test */ 74 unsigned int osr; /* Oversample rate */ 75#define JENT_MEMORY_BLOCKS 64 76#define JENT_MEMORY_BLOCKSIZE 32 77#define JENT_MEMORY_ACCESSLOOPS 128 78#define JENT_MEMORY_SIZE (JENT_MEMORY_BLOCKS*JENT_MEMORY_BLOCKSIZE) 79 unsigned char *mem; /* Memory access location with size of 80 * memblocks * memblocksize */ 81 unsigned int memlocation; /* Pointer to byte in *mem */ 82 unsigned int memblocks; /* Number of memory blocks in *mem */ 83 unsigned int memblocksize; /* Size of one memory block in bytes */ 84 unsigned int memaccessloops; /* Number of memory accesses per random 85 * bit generation */ 86 87 /* Repetition Count Test */ 88 int rct_count; /* Number of stuck values */ 89 90 /* Adaptive Proportion Test for a significance level of 2^-30 */ 91#define JENT_APT_CUTOFF 325 /* Taken from SP800-90B sec 4.4.2 */ 92#define JENT_APT_WINDOW_SIZE 512 /* Data window size */ 93 /* LSB of time stamp to process */ 94#define JENT_APT_LSB 16 95#define JENT_APT_WORD_MASK (JENT_APT_LSB - 1) 96 unsigned int apt_observations; /* Number of collected observations */ 97 unsigned int apt_count; /* APT counter */ 98 unsigned int apt_base; /* APT base reference */ 99 unsigned int apt_base_set:1; /* APT base reference set? */ 100 101 unsigned int health_failure:1; /* Permanent health failure */ 102}; 103 104/* Flags that can be used to initialize the RNG */ 105#define JENT_DISABLE_MEMORY_ACCESS (1<<2) /* Disable memory access for more 106 * entropy, saves MEMORY_SIZE RAM for 107 * entropy collector */ 108 109/* -- error codes for init function -- */ 110#define JENT_ENOTIME 1 /* Timer service not available */ 111#define JENT_ECOARSETIME 2 /* Timer too coarse for RNG */ 112#define JENT_ENOMONOTONIC 3 /* Timer is not monotonic increasing */ 113#define JENT_EVARVAR 5 /* Timer does not produce variations of 114 * variations (2nd derivation of time is 115 * zero). */ 116#define JENT_ESTUCK 8 /* Too many stuck results during init. */ 117#define JENT_EHEALTH 9 /* Health test failed during initialization */ 118#define JENT_ERCT 10 /* RCT failed during initialization */ 119 120#include "jitterentropy.h" 121 122/*************************************************************************** 123 * Adaptive Proportion Test 124 * 125 * This test complies with SP800-90B section 4.4.2. 126 ***************************************************************************/ 127 128/** 129 * Reset the APT counter 130 * 131 * @ec [in] Reference to entropy collector 132 */ 133static void jent_apt_reset(struct rand_data *ec, unsigned int delta_masked) 134{ 135 /* Reset APT counter */ 136 ec->apt_count = 0; 137 ec->apt_base = delta_masked; 138 ec->apt_observations = 0; 139} 140 141/** 142 * Insert a new entropy event into APT 143 * 144 * @ec [in] Reference to entropy collector 145 * @delta_masked [in] Masked time delta to process 146 */ 147static void jent_apt_insert(struct rand_data *ec, unsigned int delta_masked) 148{ 149 /* Initialize the base reference */ 150 if (!ec->apt_base_set) { 151 ec->apt_base = delta_masked; 152 ec->apt_base_set = 1; 153 return; 154 } 155 156 if (delta_masked == ec->apt_base) { 157 ec->apt_count++; 158 159 if (ec->apt_count >= JENT_APT_CUTOFF) 160 ec->health_failure = 1; 161 } 162 163 ec->apt_observations++; 164 165 if (ec->apt_observations >= JENT_APT_WINDOW_SIZE) 166 jent_apt_reset(ec, delta_masked); 167} 168 169/*************************************************************************** 170 * Stuck Test and its use as Repetition Count Test 171 * 172 * The Jitter RNG uses an enhanced version of the Repetition Count Test 173 * (RCT) specified in SP800-90B section 4.4.1. Instead of counting identical 174 * back-to-back values, the input to the RCT is the counting of the stuck 175 * values during the generation of one Jitter RNG output block. 176 * 177 * The RCT is applied with an alpha of 2^{-30} compliant to FIPS 140-2 IG 9.8. 178 * 179 * During the counting operation, the Jitter RNG always calculates the RCT 180 * cut-off value of C. If that value exceeds the allowed cut-off value, 181 * the Jitter RNG output block will be calculated completely but discarded at 182 * the end. The caller of the Jitter RNG is informed with an error code. 183 ***************************************************************************/ 184 185/** 186 * Repetition Count Test as defined in SP800-90B section 4.4.1 187 * 188 * @ec [in] Reference to entropy collector 189 * @stuck [in] Indicator whether the value is stuck 190 */ 191static void jent_rct_insert(struct rand_data *ec, int stuck) 192{ 193 /* 194 * If we have a count less than zero, a previous RCT round identified 195 * a failure. We will not overwrite it. 196 */ 197 if (ec->rct_count < 0) 198 return; 199 200 if (stuck) { 201 ec->rct_count++; 202 203 /* 204 * The cutoff value is based on the following consideration: 205 * alpha = 2^-30 as recommended in FIPS 140-2 IG 9.8. 206 * In addition, we require an entropy value H of 1/OSR as this 207 * is the minimum entropy required to provide full entropy. 208 * Note, we collect 64 * OSR deltas for inserting them into 209 * the entropy pool which should then have (close to) 64 bits 210 * of entropy. 211 * 212 * Note, ec->rct_count (which equals to value B in the pseudo 213 * code of SP800-90B section 4.4.1) starts with zero. Hence 214 * we need to subtract one from the cutoff value as calculated 215 * following SP800-90B. 216 */ 217 if ((unsigned int)ec->rct_count >= (31 * ec->osr)) { 218 ec->rct_count = -1; 219 ec->health_failure = 1; 220 } 221 } else { 222 ec->rct_count = 0; 223 } 224} 225 226/** 227 * Is there an RCT health test failure? 228 * 229 * @ec [in] Reference to entropy collector 230 * 231 * @return 232 * 0 No health test failure 233 * 1 Permanent health test failure 234 */ 235static int jent_rct_failure(struct rand_data *ec) 236{ 237 if (ec->rct_count < 0) 238 return 1; 239 return 0; 240} 241 242static inline __u64 jent_delta(__u64 prev, __u64 next) 243{ 244#define JENT_UINT64_MAX (__u64)(~((__u64) 0)) 245 return (prev < next) ? (next - prev) : 246 (JENT_UINT64_MAX - prev + 1 + next); 247} 248 249/** 250 * Stuck test by checking the: 251 * 1st derivative of the jitter measurement (time delta) 252 * 2nd derivative of the jitter measurement (delta of time deltas) 253 * 3rd derivative of the jitter measurement (delta of delta of time deltas) 254 * 255 * All values must always be non-zero. 256 * 257 * @ec [in] Reference to entropy collector 258 * @current_delta [in] Jitter time delta 259 * 260 * @return 261 * 0 jitter measurement not stuck (good bit) 262 * 1 jitter measurement stuck (reject bit) 263 */ 264static int jent_stuck(struct rand_data *ec, __u64 current_delta) 265{ 266 __u64 delta2 = jent_delta(ec->last_delta, current_delta); 267 __u64 delta3 = jent_delta(ec->last_delta2, delta2); 268 269 ec->last_delta = current_delta; 270 ec->last_delta2 = delta2; 271 272 /* 273 * Insert the result of the comparison of two back-to-back time 274 * deltas. 275 */ 276 jent_apt_insert(ec, current_delta); 277 278 if (!current_delta || !delta2 || !delta3) { 279 /* RCT with a stuck bit */ 280 jent_rct_insert(ec, 1); 281 return 1; 282 } 283 284 /* RCT with a non-stuck bit */ 285 jent_rct_insert(ec, 0); 286 287 return 0; 288} 289 290/** 291 * Report any health test failures 292 * 293 * @ec [in] Reference to entropy collector 294 * 295 * @return 296 * 0 No health test failure 297 * 1 Permanent health test failure 298 */ 299static int jent_health_failure(struct rand_data *ec) 300{ 301 /* Test is only enabled in FIPS mode */ 302 if (!jent_fips_enabled()) 303 return 0; 304 305 return ec->health_failure; 306} 307 308/*************************************************************************** 309 * Noise sources 310 ***************************************************************************/ 311 312/** 313 * Update of the loop count used for the next round of 314 * an entropy collection. 315 * 316 * Input: 317 * @ec entropy collector struct -- may be NULL 318 * @bits is the number of low bits of the timer to consider 319 * @min is the number of bits we shift the timer value to the right at 320 * the end to make sure we have a guaranteed minimum value 321 * 322 * @return Newly calculated loop counter 323 */ 324static __u64 jent_loop_shuffle(struct rand_data *ec, 325 unsigned int bits, unsigned int min) 326{ 327 __u64 time = 0; 328 __u64 shuffle = 0; 329 unsigned int i = 0; 330 unsigned int mask = (1<<bits) - 1; 331 332 jent_get_nstime(&time); 333 /* 334 * Mix the current state of the random number into the shuffle 335 * calculation to balance that shuffle a bit more. 336 */ 337 if (ec) 338 time ^= ec->data; 339 /* 340 * We fold the time value as much as possible to ensure that as many 341 * bits of the time stamp are included as possible. 342 */ 343 for (i = 0; ((DATA_SIZE_BITS + bits - 1) / bits) > i; i++) { 344 shuffle ^= time & mask; 345 time = time >> bits; 346 } 347 348 /* 349 * We add a lower boundary value to ensure we have a minimum 350 * RNG loop count. 351 */ 352 return (shuffle + (1<<min)); 353} 354 355/** 356 * CPU Jitter noise source -- this is the noise source based on the CPU 357 * execution time jitter 358 * 359 * This function injects the individual bits of the time value into the 360 * entropy pool using an LFSR. 361 * 362 * The code is deliberately inefficient with respect to the bit shifting 363 * and shall stay that way. This function is the root cause why the code 364 * shall be compiled without optimization. This function not only acts as 365 * folding operation, but this function's execution is used to measure 366 * the CPU execution time jitter. Any change to the loop in this function 367 * implies that careful retesting must be done. 368 * 369 * @ec [in] entropy collector struct 370 * @time [in] time stamp to be injected 371 * @loop_cnt [in] if a value not equal to 0 is set, use the given value as 372 * number of loops to perform the folding 373 * @stuck [in] Is the time stamp identified as stuck? 374 * 375 * Output: 376 * updated ec->data 377 * 378 * @return Number of loops the folding operation is performed 379 */ 380static void jent_lfsr_time(struct rand_data *ec, __u64 time, __u64 loop_cnt, 381 int stuck) 382{ 383 unsigned int i; 384 __u64 j = 0; 385 __u64 new = 0; 386#define MAX_FOLD_LOOP_BIT 4 387#define MIN_FOLD_LOOP_BIT 0 388 __u64 fold_loop_cnt = 389 jent_loop_shuffle(ec, MAX_FOLD_LOOP_BIT, MIN_FOLD_LOOP_BIT); 390 391 /* 392 * testing purposes -- allow test app to set the counter, not 393 * needed during runtime 394 */ 395 if (loop_cnt) 396 fold_loop_cnt = loop_cnt; 397 for (j = 0; j < fold_loop_cnt; j++) { 398 new = ec->data; 399 for (i = 1; (DATA_SIZE_BITS) >= i; i++) { 400 __u64 tmp = time << (DATA_SIZE_BITS - i); 401 402 tmp = tmp >> (DATA_SIZE_BITS - 1); 403 404 /* 405 * Fibonacci LSFR with polynomial of 406 * x^64 + x^61 + x^56 + x^31 + x^28 + x^23 + 1 which is 407 * primitive according to 408 * http://poincare.matf.bg.ac.rs/~ezivkovm/publications/primpol1.pdf 409 * (the shift values are the polynomial values minus one 410 * due to counting bits from 0 to 63). As the current 411 * position is always the LSB, the polynomial only needs 412 * to shift data in from the left without wrap. 413 */ 414 tmp ^= ((new >> 63) & 1); 415 tmp ^= ((new >> 60) & 1); 416 tmp ^= ((new >> 55) & 1); 417 tmp ^= ((new >> 30) & 1); 418 tmp ^= ((new >> 27) & 1); 419 tmp ^= ((new >> 22) & 1); 420 new <<= 1; 421 new ^= tmp; 422 } 423 } 424 425 /* 426 * If the time stamp is stuck, do not finally insert the value into 427 * the entropy pool. Although this operation should not do any harm 428 * even when the time stamp has no entropy, SP800-90B requires that 429 * any conditioning operation (SP800-90B considers the LFSR to be a 430 * conditioning operation) to have an identical amount of input 431 * data according to section 3.1.5. 432 */ 433 if (!stuck) 434 ec->data = new; 435} 436 437/** 438 * Memory Access noise source -- this is a noise source based on variations in 439 * memory access times 440 * 441 * This function performs memory accesses which will add to the timing 442 * variations due to an unknown amount of CPU wait states that need to be 443 * added when accessing memory. The memory size should be larger than the L1 444 * caches as outlined in the documentation and the associated testing. 445 * 446 * The L1 cache has a very high bandwidth, albeit its access rate is usually 447 * slower than accessing CPU registers. Therefore, L1 accesses only add minimal 448 * variations as the CPU has hardly to wait. Starting with L2, significant 449 * variations are added because L2 typically does not belong to the CPU any more 450 * and therefore a wider range of CPU wait states is necessary for accesses. 451 * L3 and real memory accesses have even a wider range of wait states. However, 452 * to reliably access either L3 or memory, the ec->mem memory must be quite 453 * large which is usually not desirable. 454 * 455 * @ec [in] Reference to the entropy collector with the memory access data -- if 456 * the reference to the memory block to be accessed is NULL, this noise 457 * source is disabled 458 * @loop_cnt [in] if a value not equal to 0 is set, use the given value 459 * number of loops to perform the LFSR 460 */ 461static void jent_memaccess(struct rand_data *ec, __u64 loop_cnt) 462{ 463 unsigned int wrap = 0; 464 __u64 i = 0; 465#define MAX_ACC_LOOP_BIT 7 466#define MIN_ACC_LOOP_BIT 0 467 __u64 acc_loop_cnt = 468 jent_loop_shuffle(ec, MAX_ACC_LOOP_BIT, MIN_ACC_LOOP_BIT); 469 470 if (NULL == ec || NULL == ec->mem) 471 return; 472 wrap = ec->memblocksize * ec->memblocks; 473 474 /* 475 * testing purposes -- allow test app to set the counter, not 476 * needed during runtime 477 */ 478 if (loop_cnt) 479 acc_loop_cnt = loop_cnt; 480 481 for (i = 0; i < (ec->memaccessloops + acc_loop_cnt); i++) { 482 unsigned char *tmpval = ec->mem + ec->memlocation; 483 /* 484 * memory access: just add 1 to one byte, 485 * wrap at 255 -- memory access implies read 486 * from and write to memory location 487 */ 488 *tmpval = (*tmpval + 1) & 0xff; 489 /* 490 * Addition of memblocksize - 1 to pointer 491 * with wrap around logic to ensure that every 492 * memory location is hit evenly 493 */ 494 ec->memlocation = ec->memlocation + ec->memblocksize - 1; 495 ec->memlocation = ec->memlocation % wrap; 496 } 497} 498 499/*************************************************************************** 500 * Start of entropy processing logic 501 ***************************************************************************/ 502/** 503 * This is the heart of the entropy generation: calculate time deltas and 504 * use the CPU jitter in the time deltas. The jitter is injected into the 505 * entropy pool. 506 * 507 * WARNING: ensure that ->prev_time is primed before using the output 508 * of this function! This can be done by calling this function 509 * and not using its result. 510 * 511 * @ec [in] Reference to entropy collector 512 * 513 * @return result of stuck test 514 */ 515static int jent_measure_jitter(struct rand_data *ec) 516{ 517 __u64 time = 0; 518 __u64 current_delta = 0; 519 int stuck; 520 521 /* Invoke one noise source before time measurement to add variations */ 522 jent_memaccess(ec, 0); 523 524 /* 525 * Get time stamp and calculate time delta to previous 526 * invocation to measure the timing variations 527 */ 528 jent_get_nstime(&time); 529 current_delta = jent_delta(ec->prev_time, time); 530 ec->prev_time = time; 531 532 /* Check whether we have a stuck measurement. */ 533 stuck = jent_stuck(ec, current_delta); 534 535 /* Now call the next noise sources which also injects the data */ 536 jent_lfsr_time(ec, current_delta, 0, stuck); 537 538 return stuck; 539} 540 541/** 542 * Generator of one 64 bit random number 543 * Function fills rand_data->data 544 * 545 * @ec [in] Reference to entropy collector 546 */ 547static void jent_gen_entropy(struct rand_data *ec) 548{ 549 unsigned int k = 0; 550 551 /* priming of the ->prev_time value */ 552 jent_measure_jitter(ec); 553 554 while (1) { 555 /* If a stuck measurement is received, repeat measurement */ 556 if (jent_measure_jitter(ec)) 557 continue; 558 559 /* 560 * We multiply the loop value with ->osr to obtain the 561 * oversampling rate requested by the caller 562 */ 563 if (++k >= (DATA_SIZE_BITS * ec->osr)) 564 break; 565 } 566} 567 568/** 569 * Entry function: Obtain entropy for the caller. 570 * 571 * This function invokes the entropy gathering logic as often to generate 572 * as many bytes as requested by the caller. The entropy gathering logic 573 * creates 64 bit per invocation. 574 * 575 * This function truncates the last 64 bit entropy value output to the exact 576 * size specified by the caller. 577 * 578 * @ec [in] Reference to entropy collector 579 * @data [in] pointer to buffer for storing random data -- buffer must already 580 * exist 581 * @len [in] size of the buffer, specifying also the requested number of random 582 * in bytes 583 * 584 * @return 0 when request is fulfilled or an error 585 * 586 * The following error codes can occur: 587 * -1 entropy_collector is NULL 588 * -2 RCT failed 589 * -3 APT test failed 590 */ 591int jent_read_entropy(struct rand_data *ec, unsigned char *data, 592 unsigned int len) 593{ 594 unsigned char *p = data; 595 596 if (!ec) 597 return -1; 598 599 while (0 < len) { 600 unsigned int tocopy; 601 602 jent_gen_entropy(ec); 603 604 if (jent_health_failure(ec)) { 605 int ret; 606 607 if (jent_rct_failure(ec)) 608 ret = -2; 609 else 610 ret = -3; 611 612 /* 613 * Re-initialize the noise source 614 * 615 * If the health test fails, the Jitter RNG remains 616 * in failure state and will return a health failure 617 * during next invocation. 618 */ 619 if (jent_entropy_init()) 620 return ret; 621 622 /* Set APT to initial state */ 623 jent_apt_reset(ec, 0); 624 ec->apt_base_set = 0; 625 626 /* Set RCT to initial state */ 627 ec->rct_count = 0; 628 629 /* Re-enable Jitter RNG */ 630 ec->health_failure = 0; 631 632 /* 633 * Return the health test failure status to the 634 * caller as the generated value is not appropriate. 635 */ 636 return ret; 637 } 638 639 if ((DATA_SIZE_BITS / 8) < len) 640 tocopy = (DATA_SIZE_BITS / 8); 641 else 642 tocopy = len; 643 jent_memcpy(p, &ec->data, tocopy); 644 645 len -= tocopy; 646 p += tocopy; 647 } 648 649 return 0; 650} 651 652/*************************************************************************** 653 * Initialization logic 654 ***************************************************************************/ 655 656struct rand_data *jent_entropy_collector_alloc(unsigned int osr, 657 unsigned int flags) 658{ 659 struct rand_data *entropy_collector; 660 661 entropy_collector = jent_zalloc(sizeof(struct rand_data)); 662 if (!entropy_collector) 663 return NULL; 664 665 if (!(flags & JENT_DISABLE_MEMORY_ACCESS)) { 666 /* Allocate memory for adding variations based on memory 667 * access 668 */ 669 entropy_collector->mem = jent_zalloc(JENT_MEMORY_SIZE); 670 if (!entropy_collector->mem) { 671 jent_zfree(entropy_collector); 672 return NULL; 673 } 674 entropy_collector->memblocksize = JENT_MEMORY_BLOCKSIZE; 675 entropy_collector->memblocks = JENT_MEMORY_BLOCKS; 676 entropy_collector->memaccessloops = JENT_MEMORY_ACCESSLOOPS; 677 } 678 679 /* verify and set the oversampling rate */ 680 if (0 == osr) 681 osr = 1; /* minimum sampling rate is 1 */ 682 entropy_collector->osr = osr; 683 684 /* fill the data pad with non-zero values */ 685 jent_gen_entropy(entropy_collector); 686 687 return entropy_collector; 688} 689 690void jent_entropy_collector_free(struct rand_data *entropy_collector) 691{ 692 jent_zfree(entropy_collector->mem); 693 entropy_collector->mem = NULL; 694 jent_zfree(entropy_collector); 695} 696 697int jent_entropy_init(void) 698{ 699 int i; 700 __u64 delta_sum = 0; 701 __u64 old_delta = 0; 702 unsigned int nonstuck = 0; 703 int time_backwards = 0; 704 int count_mod = 0; 705 int count_stuck = 0; 706 struct rand_data ec = { 0 }; 707 708 /* Required for RCT */ 709 ec.osr = 1; 710 711 /* We could perform statistical tests here, but the problem is 712 * that we only have a few loop counts to do testing. These 713 * loop counts may show some slight skew and we produce 714 * false positives. 715 * 716 * Moreover, only old systems show potentially problematic 717 * jitter entropy that could potentially be caught here. But 718 * the RNG is intended for hardware that is available or widely 719 * used, but not old systems that are long out of favor. Thus, 720 * no statistical tests. 721 */ 722 723 /* 724 * We could add a check for system capabilities such as clock_getres or 725 * check for CONFIG_X86_TSC, but it does not make much sense as the 726 * following sanity checks verify that we have a high-resolution 727 * timer. 728 */ 729 /* 730 * TESTLOOPCOUNT needs some loops to identify edge systems. 100 is 731 * definitely too little. 732 * 733 * SP800-90B requires at least 1024 initial test cycles. 734 */ 735#define TESTLOOPCOUNT 1024 736#define CLEARCACHE 100 737 for (i = 0; (TESTLOOPCOUNT + CLEARCACHE) > i; i++) { 738 __u64 time = 0; 739 __u64 time2 = 0; 740 __u64 delta = 0; 741 unsigned int lowdelta = 0; 742 int stuck; 743 744 /* Invoke core entropy collection logic */ 745 jent_get_nstime(&time); 746 ec.prev_time = time; 747 jent_lfsr_time(&ec, time, 0, 0); 748 jent_get_nstime(&time2); 749 750 /* test whether timer works */ 751 if (!time || !time2) 752 return JENT_ENOTIME; 753 delta = jent_delta(time, time2); 754 /* 755 * test whether timer is fine grained enough to provide 756 * delta even when called shortly after each other -- this 757 * implies that we also have a high resolution timer 758 */ 759 if (!delta) 760 return JENT_ECOARSETIME; 761 762 stuck = jent_stuck(&ec, delta); 763 764 /* 765 * up to here we did not modify any variable that will be 766 * evaluated later, but we already performed some work. Thus we 767 * already have had an impact on the caches, branch prediction, 768 * etc. with the goal to clear it to get the worst case 769 * measurements. 770 */ 771 if (CLEARCACHE > i) 772 continue; 773 774 if (stuck) 775 count_stuck++; 776 else { 777 nonstuck++; 778 779 /* 780 * Ensure that the APT succeeded. 781 * 782 * With the check below that count_stuck must be less 783 * than 10% of the overall generated raw entropy values 784 * it is guaranteed that the APT is invoked at 785 * floor((TESTLOOPCOUNT * 0.9) / 64) == 14 times. 786 */ 787 if ((nonstuck % JENT_APT_WINDOW_SIZE) == 0) { 788 jent_apt_reset(&ec, 789 delta & JENT_APT_WORD_MASK); 790 if (jent_health_failure(&ec)) 791 return JENT_EHEALTH; 792 } 793 } 794 795 /* Validate RCT */ 796 if (jent_rct_failure(&ec)) 797 return JENT_ERCT; 798 799 /* test whether we have an increasing timer */ 800 if (!(time2 > time)) 801 time_backwards++; 802 803 /* use 32 bit value to ensure compilation on 32 bit arches */ 804 lowdelta = time2 - time; 805 if (!(lowdelta % 100)) 806 count_mod++; 807 808 /* 809 * ensure that we have a varying delta timer which is necessary 810 * for the calculation of entropy -- perform this check 811 * only after the first loop is executed as we need to prime 812 * the old_data value 813 */ 814 if (delta > old_delta) 815 delta_sum += (delta - old_delta); 816 else 817 delta_sum += (old_delta - delta); 818 old_delta = delta; 819 } 820 821 /* 822 * we allow up to three times the time running backwards. 823 * CLOCK_REALTIME is affected by adjtime and NTP operations. Thus, 824 * if such an operation just happens to interfere with our test, it 825 * should not fail. The value of 3 should cover the NTP case being 826 * performed during our test run. 827 */ 828 if (3 < time_backwards) 829 return JENT_ENOMONOTONIC; 830 831 /* 832 * Variations of deltas of time must on average be larger 833 * than 1 to ensure the entropy estimation 834 * implied with 1 is preserved 835 */ 836 if ((delta_sum) <= 1) 837 return JENT_EVARVAR; 838 839 /* 840 * Ensure that we have variations in the time stamp below 10 for at 841 * least 10% of all checks -- on some platforms, the counter increments 842 * in multiples of 100, but not always 843 */ 844 if ((TESTLOOPCOUNT/10 * 9) < count_mod) 845 return JENT_ECOARSETIME; 846 847 /* 848 * If we have more than 90% stuck results, then this Jitter RNG is 849 * likely to not work well. 850 */ 851 if ((TESTLOOPCOUNT/10 * 9) < count_stuck) 852 return JENT_ESTUCK; 853 854 return 0; 855} 856