]>
Commit | Line | Data |
---|---|---|
bb5530e4 | 1 | /* |
dfc9fa91 SM |
2 | * Non-physical true random number generator based on timing jitter -- |
3 | * Jitter RNG standalone code. | |
bb5530e4 | 4 | * |
764428fe | 5 | * Copyright Stephan Mueller <smueller@chronox.de>, 2015 - 2020 |
bb5530e4 SM |
6 | * |
7 | * Design | |
8 | * ====== | |
9 | * | |
9332a9e7 | 10 | * See https://www.chronox.de/jent.html |
bb5530e4 SM |
11 | * |
12 | * License | |
13 | * ======= | |
14 | * | |
15 | * Redistribution and use in source and binary forms, with or without | |
16 | * modification, are permitted provided that the following conditions | |
17 | * are met: | |
18 | * 1. Redistributions of source code must retain the above copyright | |
19 | * notice, and the entire permission notice in its entirety, | |
20 | * including the disclaimer of warranties. | |
21 | * 2. Redistributions in binary form must reproduce the above copyright | |
22 | * notice, this list of conditions and the following disclaimer in the | |
23 | * documentation and/or other materials provided with the distribution. | |
24 | * 3. The name of the author may not be used to endorse or promote | |
25 | * products derived from this software without specific prior | |
26 | * written permission. | |
27 | * | |
28 | * ALTERNATIVELY, this product may be distributed under the terms of | |
29 | * the GNU General Public License, in which case the provisions of the GPL2 are | |
30 | * required INSTEAD OF the above restrictions. (This clause is | |
31 | * necessary due to a potential bad interaction between the GPL and | |
32 | * the restrictions contained in a BSD-style copyright.) | |
33 | * | |
34 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED | |
35 | * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | |
36 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF | |
37 | * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE | |
38 | * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR | |
39 | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT | |
40 | * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR | |
41 | * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF | |
42 | * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
43 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE | |
44 | * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH | |
45 | * DAMAGE. | |
46 | */ | |
47 | ||
48 | /* | |
49 | * This Jitterentropy RNG is based on the jitterentropy library | |
9332a9e7 | 50 | * version 2.2.0 provided at https://www.chronox.de/jent.html |
bb5530e4 SM |
51 | */ |
52 | ||
dfc9fa91 SM |
53 | #ifdef __OPTIMIZE__ |
54 | #error "The CPU Jitter random number generator must not be compiled with optimizations. See documentation. Use the compiler switch -O0 for compiling jitterentropy.c." | |
55 | #endif | |
56 | ||
57 | typedef unsigned long long __u64; | |
58 | typedef long long __s64; | |
59 | typedef unsigned int __u32; | |
60 | #define NULL ((void *) 0) | |
bb5530e4 | 61 | |
bb5530e4 SM |
62 | /* The entropy pool */ |
63 | struct rand_data { | |
64 | /* all data values that are vital to maintain the security | |
65 | * of the RNG are marked as SENSITIVE. A user must not | |
66 | * access that information while the RNG executes its loops to | |
67 | * calculate the next random value. */ | |
68 | __u64 data; /* SENSITIVE Actual random number */ | |
69 | __u64 old_data; /* SENSITIVE Previous random number */ | |
70 | __u64 prev_time; /* SENSITIVE Previous time stamp */ | |
71 | #define DATA_SIZE_BITS ((sizeof(__u64)) * 8) | |
72 | __u64 last_delta; /* SENSITIVE stuck test */ | |
73 | __s64 last_delta2; /* SENSITIVE stuck test */ | |
bb5530e4 | 74 | unsigned int osr; /* Oversample rate */ |
bb5530e4 SM |
75 | #define JENT_MEMORY_BLOCKS 64 |
76 | #define JENT_MEMORY_BLOCKSIZE 32 | |
77 | #define JENT_MEMORY_ACCESSLOOPS 128 | |
78 | #define JENT_MEMORY_SIZE (JENT_MEMORY_BLOCKS*JENT_MEMORY_BLOCKSIZE) | |
79 | unsigned char *mem; /* Memory access location with size of | |
80 | * memblocks * memblocksize */ | |
81 | unsigned int memlocation; /* Pointer to byte in *mem */ | |
82 | unsigned int memblocks; /* Number of memory blocks in *mem */ | |
83 | unsigned int memblocksize; /* Size of one memory block in bytes */ | |
84 | unsigned int memaccessloops; /* Number of memory accesses per random | |
85 | * bit generation */ | |
764428fe SM |
86 | |
87 | /* Repetition Count Test */ | |
88 | int rct_count; /* Number of stuck values */ | |
89 | ||
90 | /* Adaptive Proportion Test for a significance level of 2^-30 */ | |
91 | #define JENT_APT_CUTOFF 325 /* Taken from SP800-90B sec 4.4.2 */ | |
92 | #define JENT_APT_WINDOW_SIZE 512 /* Data window size */ | |
93 | /* LSB of time stamp to process */ | |
94 | #define JENT_APT_LSB 16 | |
95 | #define JENT_APT_WORD_MASK (JENT_APT_LSB - 1) | |
96 | unsigned int apt_observations; /* Number of collected observations */ | |
97 | unsigned int apt_count; /* APT counter */ | |
98 | unsigned int apt_base; /* APT base reference */ | |
99 | unsigned int apt_base_set:1; /* APT base reference set? */ | |
100 | ||
101 | unsigned int health_failure:1; /* Permanent health failure */ | |
bb5530e4 SM |
102 | }; |
103 | ||
104 | /* Flags that can be used to initialize the RNG */ | |
bb5530e4 SM |
105 | #define JENT_DISABLE_MEMORY_ACCESS (1<<2) /* Disable memory access for more |
106 | * entropy, saves MEMORY_SIZE RAM for | |
107 | * entropy collector */ | |
108 | ||
bb5530e4 SM |
109 | /* -- error codes for init function -- */ |
110 | #define JENT_ENOTIME 1 /* Timer service not available */ | |
111 | #define JENT_ECOARSETIME 2 /* Timer too coarse for RNG */ | |
112 | #define JENT_ENOMONOTONIC 3 /* Timer is not monotonic increasing */ | |
bb5530e4 SM |
113 | #define JENT_EVARVAR 5 /* Timer does not produce variations of |
114 | * variations (2nd derivation of time is | |
115 | * zero). */ | |
d9d67c87 | 116 | #define JENT_ESTUCK 8 /* Too many stuck results during init. */ |
764428fe SM |
117 | #define JENT_EHEALTH 9 /* Health test failed during initialization */ |
118 | #define JENT_ERCT 10 /* RCT failed during initialization */ | |
119 | ||
908dffaf SM |
120 | /* |
121 | * The output n bits can receive more than n bits of min entropy, of course, | |
122 | * but the fixed output of the conditioning function can only asymptotically | |
123 | * approach the output size bits of min entropy, not attain that bound. Random | |
124 | * maps will tend to have output collisions, which reduces the creditable | |
125 | * output entropy (that is what SP 800-90B Section 3.1.5.1.2 attempts to bound). | |
126 | * | |
127 | * The value "64" is justified in Appendix A.4 of the current 90C draft, | |
128 | * and aligns with NIST's in "epsilon" definition in this document, which is | |
129 | * that a string can be considered "full entropy" if you can bound the min | |
130 | * entropy in each bit of output to at least 1-epsilon, where epsilon is | |
131 | * required to be <= 2^(-32). | |
132 | */ | |
133 | #define JENT_ENTROPY_SAFETY_FACTOR 64 | |
134 | ||
135 | #include <linux/fips.h> | |
764428fe | 136 | #include "jitterentropy.h" |
bb5530e4 SM |
137 | |
138 | /*************************************************************************** | |
764428fe SM |
139 | * Adaptive Proportion Test |
140 | * | |
141 | * This test complies with SP800-90B section 4.4.2. | |
bb5530e4 SM |
142 | ***************************************************************************/ |
143 | ||
04cb788e | 144 | /* |
764428fe SM |
145 | * Reset the APT counter |
146 | * | |
147 | * @ec [in] Reference to entropy collector | |
148 | */ | |
149 | static void jent_apt_reset(struct rand_data *ec, unsigned int delta_masked) | |
150 | { | |
151 | /* Reset APT counter */ | |
152 | ec->apt_count = 0; | |
153 | ec->apt_base = delta_masked; | |
154 | ec->apt_observations = 0; | |
155 | } | |
156 | ||
04cb788e | 157 | /* |
764428fe SM |
158 | * Insert a new entropy event into APT |
159 | * | |
160 | * @ec [in] Reference to entropy collector | |
161 | * @delta_masked [in] Masked time delta to process | |
162 | */ | |
163 | static void jent_apt_insert(struct rand_data *ec, unsigned int delta_masked) | |
164 | { | |
165 | /* Initialize the base reference */ | |
166 | if (!ec->apt_base_set) { | |
167 | ec->apt_base = delta_masked; | |
168 | ec->apt_base_set = 1; | |
169 | return; | |
170 | } | |
171 | ||
172 | if (delta_masked == ec->apt_base) { | |
173 | ec->apt_count++; | |
174 | ||
175 | if (ec->apt_count >= JENT_APT_CUTOFF) | |
176 | ec->health_failure = 1; | |
177 | } | |
178 | ||
179 | ec->apt_observations++; | |
180 | ||
181 | if (ec->apt_observations >= JENT_APT_WINDOW_SIZE) | |
182 | jent_apt_reset(ec, delta_masked); | |
183 | } | |
184 | ||
185 | /*************************************************************************** | |
186 | * Stuck Test and its use as Repetition Count Test | |
187 | * | |
188 | * The Jitter RNG uses an enhanced version of the Repetition Count Test | |
189 | * (RCT) specified in SP800-90B section 4.4.1. Instead of counting identical | |
190 | * back-to-back values, the input to the RCT is the counting of the stuck | |
191 | * values during the generation of one Jitter RNG output block. | |
192 | * | |
193 | * The RCT is applied with an alpha of 2^{-30} compliant to FIPS 140-2 IG 9.8. | |
194 | * | |
195 | * During the counting operation, the Jitter RNG always calculates the RCT | |
196 | * cut-off value of C. If that value exceeds the allowed cut-off value, | |
197 | * the Jitter RNG output block will be calculated completely but discarded at | |
198 | * the end. The caller of the Jitter RNG is informed with an error code. | |
199 | ***************************************************************************/ | |
200 | ||
04cb788e | 201 | /* |
764428fe SM |
202 | * Repetition Count Test as defined in SP800-90B section 4.4.1 |
203 | * | |
204 | * @ec [in] Reference to entropy collector | |
205 | * @stuck [in] Indicator whether the value is stuck | |
206 | */ | |
207 | static void jent_rct_insert(struct rand_data *ec, int stuck) | |
208 | { | |
209 | /* | |
210 | * If we have a count less than zero, a previous RCT round identified | |
211 | * a failure. We will not overwrite it. | |
212 | */ | |
213 | if (ec->rct_count < 0) | |
214 | return; | |
215 | ||
216 | if (stuck) { | |
217 | ec->rct_count++; | |
218 | ||
219 | /* | |
220 | * The cutoff value is based on the following consideration: | |
221 | * alpha = 2^-30 as recommended in FIPS 140-2 IG 9.8. | |
222 | * In addition, we require an entropy value H of 1/OSR as this | |
223 | * is the minimum entropy required to provide full entropy. | |
224 | * Note, we collect 64 * OSR deltas for inserting them into | |
225 | * the entropy pool which should then have (close to) 64 bits | |
226 | * of entropy. | |
227 | * | |
228 | * Note, ec->rct_count (which equals to value B in the pseudo | |
229 | * code of SP800-90B section 4.4.1) starts with zero. Hence | |
230 | * we need to subtract one from the cutoff value as calculated | |
231 | * following SP800-90B. | |
232 | */ | |
233 | if ((unsigned int)ec->rct_count >= (31 * ec->osr)) { | |
234 | ec->rct_count = -1; | |
235 | ec->health_failure = 1; | |
236 | } | |
237 | } else { | |
238 | ec->rct_count = 0; | |
239 | } | |
240 | } | |
241 | ||
04cb788e | 242 | /* |
764428fe SM |
243 | * Is there an RCT health test failure? |
244 | * | |
245 | * @ec [in] Reference to entropy collector | |
246 | * | |
247 | * @return | |
248 | * 0 No health test failure | |
249 | * 1 Permanent health test failure | |
250 | */ | |
251 | static int jent_rct_failure(struct rand_data *ec) | |
252 | { | |
253 | if (ec->rct_count < 0) | |
254 | return 1; | |
255 | return 0; | |
256 | } | |
257 | ||
258 | static inline __u64 jent_delta(__u64 prev, __u64 next) | |
259 | { | |
260 | #define JENT_UINT64_MAX (__u64)(~((__u64) 0)) | |
261 | return (prev < next) ? (next - prev) : | |
262 | (JENT_UINT64_MAX - prev + 1 + next); | |
263 | } | |
264 | ||
04cb788e | 265 | /* |
764428fe SM |
266 | * Stuck test by checking the: |
267 | * 1st derivative of the jitter measurement (time delta) | |
268 | * 2nd derivative of the jitter measurement (delta of time deltas) | |
269 | * 3rd derivative of the jitter measurement (delta of delta of time deltas) | |
270 | * | |
271 | * All values must always be non-zero. | |
272 | * | |
273 | * @ec [in] Reference to entropy collector | |
274 | * @current_delta [in] Jitter time delta | |
275 | * | |
276 | * @return | |
277 | * 0 jitter measurement not stuck (good bit) | |
278 | * 1 jitter measurement stuck (reject bit) | |
279 | */ | |
280 | static int jent_stuck(struct rand_data *ec, __u64 current_delta) | |
281 | { | |
282 | __u64 delta2 = jent_delta(ec->last_delta, current_delta); | |
283 | __u64 delta3 = jent_delta(ec->last_delta2, delta2); | |
764428fe SM |
284 | |
285 | ec->last_delta = current_delta; | |
286 | ec->last_delta2 = delta2; | |
287 | ||
288 | /* | |
289 | * Insert the result of the comparison of two back-to-back time | |
290 | * deltas. | |
291 | */ | |
552d03a2 | 292 | jent_apt_insert(ec, current_delta); |
764428fe SM |
293 | |
294 | if (!current_delta || !delta2 || !delta3) { | |
295 | /* RCT with a stuck bit */ | |
296 | jent_rct_insert(ec, 1); | |
297 | return 1; | |
298 | } | |
299 | ||
300 | /* RCT with a non-stuck bit */ | |
301 | jent_rct_insert(ec, 0); | |
302 | ||
303 | return 0; | |
304 | } | |
305 | ||
04cb788e | 306 | /* |
764428fe SM |
307 | * Report any health test failures |
308 | * | |
309 | * @ec [in] Reference to entropy collector | |
310 | * | |
311 | * @return | |
312 | * 0 No health test failure | |
313 | * 1 Permanent health test failure | |
314 | */ | |
315 | static int jent_health_failure(struct rand_data *ec) | |
316 | { | |
764428fe SM |
317 | return ec->health_failure; |
318 | } | |
319 | ||
320 | /*************************************************************************** | |
321 | * Noise sources | |
322 | ***************************************************************************/ | |
bb5530e4 | 323 | |
04cb788e | 324 | /* |
bb5530e4 SM |
325 | * Update of the loop count used for the next round of |
326 | * an entropy collection. | |
327 | * | |
328 | * Input: | |
329 | * @ec entropy collector struct -- may be NULL | |
330 | * @bits is the number of low bits of the timer to consider | |
331 | * @min is the number of bits we shift the timer value to the right at | |
332 | * the end to make sure we have a guaranteed minimum value | |
333 | * | |
334 | * @return Newly calculated loop counter | |
335 | */ | |
336 | static __u64 jent_loop_shuffle(struct rand_data *ec, | |
337 | unsigned int bits, unsigned int min) | |
338 | { | |
339 | __u64 time = 0; | |
340 | __u64 shuffle = 0; | |
341 | unsigned int i = 0; | |
342 | unsigned int mask = (1<<bits) - 1; | |
343 | ||
344 | jent_get_nstime(&time); | |
345 | /* | |
d9d67c87 SM |
346 | * Mix the current state of the random number into the shuffle |
347 | * calculation to balance that shuffle a bit more. | |
bb5530e4 SM |
348 | */ |
349 | if (ec) | |
350 | time ^= ec->data; | |
351 | /* | |
d9d67c87 SM |
352 | * We fold the time value as much as possible to ensure that as many |
353 | * bits of the time stamp are included as possible. | |
bb5530e4 | 354 | */ |
d9d67c87 | 355 | for (i = 0; ((DATA_SIZE_BITS + bits - 1) / bits) > i; i++) { |
bb5530e4 SM |
356 | shuffle ^= time & mask; |
357 | time = time >> bits; | |
358 | } | |
359 | ||
360 | /* | |
361 | * We add a lower boundary value to ensure we have a minimum | |
362 | * RNG loop count. | |
363 | */ | |
364 | return (shuffle + (1<<min)); | |
365 | } | |
366 | ||
04cb788e | 367 | /* |
bb5530e4 SM |
368 | * CPU Jitter noise source -- this is the noise source based on the CPU |
369 | * execution time jitter | |
370 | * | |
d9d67c87 SM |
371 | * This function injects the individual bits of the time value into the |
372 | * entropy pool using an LFSR. | |
bb5530e4 | 373 | * |
d9d67c87 SM |
374 | * The code is deliberately inefficient with respect to the bit shifting |
375 | * and shall stay that way. This function is the root cause why the code | |
376 | * shall be compiled without optimization. This function not only acts as | |
377 | * folding operation, but this function's execution is used to measure | |
378 | * the CPU execution time jitter. Any change to the loop in this function | |
379 | * implies that careful retesting must be done. | |
bb5530e4 | 380 | * |
764428fe SM |
381 | * @ec [in] entropy collector struct |
382 | * @time [in] time stamp to be injected | |
383 | * @loop_cnt [in] if a value not equal to 0 is set, use the given value as | |
384 | * number of loops to perform the folding | |
385 | * @stuck [in] Is the time stamp identified as stuck? | |
bb5530e4 SM |
386 | * |
387 | * Output: | |
d9d67c87 | 388 | * updated ec->data |
bb5530e4 SM |
389 | * |
390 | * @return Number of loops the folding operation is performed | |
391 | */ | |
764428fe SM |
392 | static void jent_lfsr_time(struct rand_data *ec, __u64 time, __u64 loop_cnt, |
393 | int stuck) | |
bb5530e4 SM |
394 | { |
395 | unsigned int i; | |
396 | __u64 j = 0; | |
397 | __u64 new = 0; | |
398 | #define MAX_FOLD_LOOP_BIT 4 | |
399 | #define MIN_FOLD_LOOP_BIT 0 | |
400 | __u64 fold_loop_cnt = | |
401 | jent_loop_shuffle(ec, MAX_FOLD_LOOP_BIT, MIN_FOLD_LOOP_BIT); | |
402 | ||
403 | /* | |
404 | * testing purposes -- allow test app to set the counter, not | |
405 | * needed during runtime | |
406 | */ | |
407 | if (loop_cnt) | |
408 | fold_loop_cnt = loop_cnt; | |
409 | for (j = 0; j < fold_loop_cnt; j++) { | |
d9d67c87 | 410 | new = ec->data; |
bb5530e4 SM |
411 | for (i = 1; (DATA_SIZE_BITS) >= i; i++) { |
412 | __u64 tmp = time << (DATA_SIZE_BITS - i); | |
413 | ||
414 | tmp = tmp >> (DATA_SIZE_BITS - 1); | |
d9d67c87 SM |
415 | |
416 | /* | |
417 | * Fibonacci LSFR with polynomial of | |
418 | * x^64 + x^61 + x^56 + x^31 + x^28 + x^23 + 1 which is | |
419 | * primitive according to | |
420 | * http://poincare.matf.bg.ac.rs/~ezivkovm/publications/primpol1.pdf | |
421 | * (the shift values are the polynomial values minus one | |
422 | * due to counting bits from 0 to 63). As the current | |
423 | * position is always the LSB, the polynomial only needs | |
424 | * to shift data in from the left without wrap. | |
425 | */ | |
426 | tmp ^= ((new >> 63) & 1); | |
427 | tmp ^= ((new >> 60) & 1); | |
428 | tmp ^= ((new >> 55) & 1); | |
429 | tmp ^= ((new >> 30) & 1); | |
430 | tmp ^= ((new >> 27) & 1); | |
431 | tmp ^= ((new >> 22) & 1); | |
432 | new <<= 1; | |
bb5530e4 SM |
433 | new ^= tmp; |
434 | } | |
435 | } | |
d9d67c87 | 436 | |
764428fe SM |
437 | /* |
438 | * If the time stamp is stuck, do not finally insert the value into | |
439 | * the entropy pool. Although this operation should not do any harm | |
440 | * even when the time stamp has no entropy, SP800-90B requires that | |
441 | * any conditioning operation (SP800-90B considers the LFSR to be a | |
442 | * conditioning operation) to have an identical amount of input | |
443 | * data according to section 3.1.5. | |
444 | */ | |
445 | if (!stuck) | |
446 | ec->data = new; | |
bb5530e4 SM |
447 | } |
448 | ||
04cb788e | 449 | /* |
bb5530e4 SM |
450 | * Memory Access noise source -- this is a noise source based on variations in |
451 | * memory access times | |
452 | * | |
453 | * This function performs memory accesses which will add to the timing | |
454 | * variations due to an unknown amount of CPU wait states that need to be | |
455 | * added when accessing memory. The memory size should be larger than the L1 | |
456 | * caches as outlined in the documentation and the associated testing. | |
457 | * | |
458 | * The L1 cache has a very high bandwidth, albeit its access rate is usually | |
459 | * slower than accessing CPU registers. Therefore, L1 accesses only add minimal | |
460 | * variations as the CPU has hardly to wait. Starting with L2, significant | |
461 | * variations are added because L2 typically does not belong to the CPU any more | |
462 | * and therefore a wider range of CPU wait states is necessary for accesses. | |
463 | * L3 and real memory accesses have even a wider range of wait states. However, | |
464 | * to reliably access either L3 or memory, the ec->mem memory must be quite | |
465 | * large which is usually not desirable. | |
466 | * | |
764428fe SM |
467 | * @ec [in] Reference to the entropy collector with the memory access data -- if |
468 | * the reference to the memory block to be accessed is NULL, this noise | |
469 | * source is disabled | |
470 | * @loop_cnt [in] if a value not equal to 0 is set, use the given value | |
471 | * number of loops to perform the LFSR | |
bb5530e4 | 472 | */ |
764428fe | 473 | static void jent_memaccess(struct rand_data *ec, __u64 loop_cnt) |
bb5530e4 | 474 | { |
bb5530e4 SM |
475 | unsigned int wrap = 0; |
476 | __u64 i = 0; | |
477 | #define MAX_ACC_LOOP_BIT 7 | |
478 | #define MIN_ACC_LOOP_BIT 0 | |
479 | __u64 acc_loop_cnt = | |
480 | jent_loop_shuffle(ec, MAX_ACC_LOOP_BIT, MIN_ACC_LOOP_BIT); | |
481 | ||
482 | if (NULL == ec || NULL == ec->mem) | |
764428fe | 483 | return; |
bb5530e4 SM |
484 | wrap = ec->memblocksize * ec->memblocks; |
485 | ||
486 | /* | |
487 | * testing purposes -- allow test app to set the counter, not | |
488 | * needed during runtime | |
489 | */ | |
490 | if (loop_cnt) | |
491 | acc_loop_cnt = loop_cnt; | |
492 | ||
493 | for (i = 0; i < (ec->memaccessloops + acc_loop_cnt); i++) { | |
d9d67c87 | 494 | unsigned char *tmpval = ec->mem + ec->memlocation; |
bb5530e4 SM |
495 | /* |
496 | * memory access: just add 1 to one byte, | |
497 | * wrap at 255 -- memory access implies read | |
498 | * from and write to memory location | |
499 | */ | |
500 | *tmpval = (*tmpval + 1) & 0xff; | |
501 | /* | |
502 | * Addition of memblocksize - 1 to pointer | |
503 | * with wrap around logic to ensure that every | |
504 | * memory location is hit evenly | |
505 | */ | |
506 | ec->memlocation = ec->memlocation + ec->memblocksize - 1; | |
507 | ec->memlocation = ec->memlocation % wrap; | |
508 | } | |
bb5530e4 SM |
509 | } |
510 | ||
511 | /*************************************************************************** | |
512 | * Start of entropy processing logic | |
513 | ***************************************************************************/ | |
04cb788e | 514 | /* |
bb5530e4 | 515 | * This is the heart of the entropy generation: calculate time deltas and |
d9d67c87 SM |
516 | * use the CPU jitter in the time deltas. The jitter is injected into the |
517 | * entropy pool. | |
bb5530e4 SM |
518 | * |
519 | * WARNING: ensure that ->prev_time is primed before using the output | |
520 | * of this function! This can be done by calling this function | |
521 | * and not using its result. | |
522 | * | |
764428fe | 523 | * @ec [in] Reference to entropy collector |
bb5530e4 | 524 | * |
d9d67c87 | 525 | * @return result of stuck test |
bb5530e4 | 526 | */ |
d9d67c87 | 527 | static int jent_measure_jitter(struct rand_data *ec) |
bb5530e4 SM |
528 | { |
529 | __u64 time = 0; | |
bb5530e4 | 530 | __u64 current_delta = 0; |
764428fe | 531 | int stuck; |
bb5530e4 SM |
532 | |
533 | /* Invoke one noise source before time measurement to add variations */ | |
534 | jent_memaccess(ec, 0); | |
535 | ||
536 | /* | |
537 | * Get time stamp and calculate time delta to previous | |
538 | * invocation to measure the timing variations | |
539 | */ | |
540 | jent_get_nstime(&time); | |
764428fe | 541 | current_delta = jent_delta(ec->prev_time, time); |
bb5530e4 SM |
542 | ec->prev_time = time; |
543 | ||
764428fe SM |
544 | /* Check whether we have a stuck measurement. */ |
545 | stuck = jent_stuck(ec, current_delta); | |
546 | ||
d9d67c87 | 547 | /* Now call the next noise sources which also injects the data */ |
764428fe | 548 | jent_lfsr_time(ec, current_delta, 0, stuck); |
bb5530e4 | 549 | |
764428fe | 550 | return stuck; |
bb5530e4 SM |
551 | } |
552 | ||
04cb788e | 553 | /* |
bb5530e4 SM |
554 | * Generator of one 64 bit random number |
555 | * Function fills rand_data->data | |
556 | * | |
764428fe | 557 | * @ec [in] Reference to entropy collector |
bb5530e4 SM |
558 | */ |
559 | static void jent_gen_entropy(struct rand_data *ec) | |
560 | { | |
908dffaf SM |
561 | unsigned int k = 0, safety_factor = 0; |
562 | ||
563 | if (fips_enabled) | |
564 | safety_factor = JENT_ENTROPY_SAFETY_FACTOR; | |
bb5530e4 SM |
565 | |
566 | /* priming of the ->prev_time value */ | |
567 | jent_measure_jitter(ec); | |
568 | ||
710ce4b8 | 569 | while (!jent_health_failure(ec)) { |
d9d67c87 SM |
570 | /* If a stuck measurement is received, repeat measurement */ |
571 | if (jent_measure_jitter(ec)) | |
bb5530e4 | 572 | continue; |
bb5530e4 SM |
573 | |
574 | /* | |
575 | * We multiply the loop value with ->osr to obtain the | |
576 | * oversampling rate requested by the caller | |
577 | */ | |
908dffaf | 578 | if (++k >= ((DATA_SIZE_BITS + safety_factor) * ec->osr)) |
bb5530e4 SM |
579 | break; |
580 | } | |
bb5530e4 SM |
581 | } |
582 | ||
04cb788e | 583 | /* |
bb5530e4 SM |
584 | * Entry function: Obtain entropy for the caller. |
585 | * | |
586 | * This function invokes the entropy gathering logic as often to generate | |
587 | * as many bytes as requested by the caller. The entropy gathering logic | |
588 | * creates 64 bit per invocation. | |
589 | * | |
590 | * This function truncates the last 64 bit entropy value output to the exact | |
591 | * size specified by the caller. | |
592 | * | |
764428fe SM |
593 | * @ec [in] Reference to entropy collector |
594 | * @data [in] pointer to buffer for storing random data -- buffer must already | |
595 | * exist | |
596 | * @len [in] size of the buffer, specifying also the requested number of random | |
597 | * in bytes | |
bb5530e4 SM |
598 | * |
599 | * @return 0 when request is fulfilled or an error | |
600 | * | |
601 | * The following error codes can occur: | |
602 | * -1 entropy_collector is NULL | |
764428fe SM |
603 | * -2 RCT failed |
604 | * -3 APT test failed | |
bb5530e4 | 605 | */ |
dfc9fa91 SM |
606 | int jent_read_entropy(struct rand_data *ec, unsigned char *data, |
607 | unsigned int len) | |
bb5530e4 | 608 | { |
dfc9fa91 | 609 | unsigned char *p = data; |
bb5530e4 SM |
610 | |
611 | if (!ec) | |
dfc9fa91 | 612 | return -1; |
bb5530e4 | 613 | |
36c25011 | 614 | while (len > 0) { |
dfc9fa91 | 615 | unsigned int tocopy; |
bb5530e4 SM |
616 | |
617 | jent_gen_entropy(ec); | |
764428fe SM |
618 | |
619 | if (jent_health_failure(ec)) { | |
620 | int ret; | |
621 | ||
622 | if (jent_rct_failure(ec)) | |
623 | ret = -2; | |
624 | else | |
625 | ret = -3; | |
626 | ||
627 | /* | |
628 | * Re-initialize the noise source | |
629 | * | |
630 | * If the health test fails, the Jitter RNG remains | |
631 | * in failure state and will return a health failure | |
632 | * during next invocation. | |
633 | */ | |
634 | if (jent_entropy_init()) | |
635 | return ret; | |
636 | ||
637 | /* Set APT to initial state */ | |
638 | jent_apt_reset(ec, 0); | |
639 | ec->apt_base_set = 0; | |
640 | ||
641 | /* Set RCT to initial state */ | |
642 | ec->rct_count = 0; | |
643 | ||
644 | /* Re-enable Jitter RNG */ | |
645 | ec->health_failure = 0; | |
646 | ||
647 | /* | |
648 | * Return the health test failure status to the | |
649 | * caller as the generated value is not appropriate. | |
650 | */ | |
651 | return ret; | |
652 | } | |
653 | ||
bb5530e4 SM |
654 | if ((DATA_SIZE_BITS / 8) < len) |
655 | tocopy = (DATA_SIZE_BITS / 8); | |
656 | else | |
657 | tocopy = len; | |
dfc9fa91 | 658 | jent_memcpy(p, &ec->data, tocopy); |
bb5530e4 SM |
659 | |
660 | len -= tocopy; | |
661 | p += tocopy; | |
662 | } | |
663 | ||
664 | return 0; | |
665 | } | |
666 | ||
667 | /*************************************************************************** | |
668 | * Initialization logic | |
669 | ***************************************************************************/ | |
670 | ||
dfc9fa91 SM |
671 | struct rand_data *jent_entropy_collector_alloc(unsigned int osr, |
672 | unsigned int flags) | |
bb5530e4 SM |
673 | { |
674 | struct rand_data *entropy_collector; | |
675 | ||
dfc9fa91 | 676 | entropy_collector = jent_zalloc(sizeof(struct rand_data)); |
bb5530e4 SM |
677 | if (!entropy_collector) |
678 | return NULL; | |
679 | ||
680 | if (!(flags & JENT_DISABLE_MEMORY_ACCESS)) { | |
681 | /* Allocate memory for adding variations based on memory | |
682 | * access | |
683 | */ | |
dfc9fa91 | 684 | entropy_collector->mem = jent_zalloc(JENT_MEMORY_SIZE); |
bb5530e4 | 685 | if (!entropy_collector->mem) { |
dfc9fa91 | 686 | jent_zfree(entropy_collector); |
bb5530e4 SM |
687 | return NULL; |
688 | } | |
689 | entropy_collector->memblocksize = JENT_MEMORY_BLOCKSIZE; | |
690 | entropy_collector->memblocks = JENT_MEMORY_BLOCKS; | |
691 | entropy_collector->memaccessloops = JENT_MEMORY_ACCESSLOOPS; | |
692 | } | |
693 | ||
694 | /* verify and set the oversampling rate */ | |
36c25011 | 695 | if (osr == 0) |
bb5530e4 SM |
696 | osr = 1; /* minimum sampling rate is 1 */ |
697 | entropy_collector->osr = osr; | |
698 | ||
bb5530e4 SM |
699 | /* fill the data pad with non-zero values */ |
700 | jent_gen_entropy(entropy_collector); | |
701 | ||
702 | return entropy_collector; | |
703 | } | |
704 | ||
dfc9fa91 | 705 | void jent_entropy_collector_free(struct rand_data *entropy_collector) |
bb5530e4 | 706 | { |
cea0a3c3 | 707 | jent_zfree(entropy_collector->mem); |
bb5530e4 | 708 | entropy_collector->mem = NULL; |
cea0a3c3 | 709 | jent_zfree(entropy_collector); |
bb5530e4 SM |
710 | } |
711 | ||
dfc9fa91 | 712 | int jent_entropy_init(void) |
bb5530e4 SM |
713 | { |
714 | int i; | |
715 | __u64 delta_sum = 0; | |
716 | __u64 old_delta = 0; | |
764428fe | 717 | unsigned int nonstuck = 0; |
bb5530e4 | 718 | int time_backwards = 0; |
bb5530e4 | 719 | int count_mod = 0; |
d9d67c87 SM |
720 | int count_stuck = 0; |
721 | struct rand_data ec = { 0 }; | |
bb5530e4 | 722 | |
764428fe SM |
723 | /* Required for RCT */ |
724 | ec.osr = 1; | |
725 | ||
bb5530e4 SM |
726 | /* We could perform statistical tests here, but the problem is |
727 | * that we only have a few loop counts to do testing. These | |
728 | * loop counts may show some slight skew and we produce | |
729 | * false positives. | |
730 | * | |
731 | * Moreover, only old systems show potentially problematic | |
732 | * jitter entropy that could potentially be caught here. But | |
733 | * the RNG is intended for hardware that is available or widely | |
734 | * used, but not old systems that are long out of favor. Thus, | |
735 | * no statistical tests. | |
736 | */ | |
737 | ||
738 | /* | |
739 | * We could add a check for system capabilities such as clock_getres or | |
740 | * check for CONFIG_X86_TSC, but it does not make much sense as the | |
741 | * following sanity checks verify that we have a high-resolution | |
742 | * timer. | |
743 | */ | |
744 | /* | |
745 | * TESTLOOPCOUNT needs some loops to identify edge systems. 100 is | |
746 | * definitely too little. | |
764428fe SM |
747 | * |
748 | * SP800-90B requires at least 1024 initial test cycles. | |
bb5530e4 | 749 | */ |
764428fe | 750 | #define TESTLOOPCOUNT 1024 |
bb5530e4 SM |
751 | #define CLEARCACHE 100 |
752 | for (i = 0; (TESTLOOPCOUNT + CLEARCACHE) > i; i++) { | |
753 | __u64 time = 0; | |
754 | __u64 time2 = 0; | |
bb5530e4 SM |
755 | __u64 delta = 0; |
756 | unsigned int lowdelta = 0; | |
d9d67c87 | 757 | int stuck; |
bb5530e4 | 758 | |
d9d67c87 | 759 | /* Invoke core entropy collection logic */ |
bb5530e4 | 760 | jent_get_nstime(&time); |
d9d67c87 | 761 | ec.prev_time = time; |
764428fe | 762 | jent_lfsr_time(&ec, time, 0, 0); |
bb5530e4 SM |
763 | jent_get_nstime(&time2); |
764 | ||
765 | /* test whether timer works */ | |
766 | if (!time || !time2) | |
767 | return JENT_ENOTIME; | |
764428fe | 768 | delta = jent_delta(time, time2); |
bb5530e4 SM |
769 | /* |
770 | * test whether timer is fine grained enough to provide | |
771 | * delta even when called shortly after each other -- this | |
772 | * implies that we also have a high resolution timer | |
773 | */ | |
774 | if (!delta) | |
775 | return JENT_ECOARSETIME; | |
776 | ||
d9d67c87 SM |
777 | stuck = jent_stuck(&ec, delta); |
778 | ||
bb5530e4 SM |
779 | /* |
780 | * up to here we did not modify any variable that will be | |
781 | * evaluated later, but we already performed some work. Thus we | |
782 | * already have had an impact on the caches, branch prediction, | |
783 | * etc. with the goal to clear it to get the worst case | |
784 | * measurements. | |
785 | */ | |
36c25011 | 786 | if (i < CLEARCACHE) |
bb5530e4 SM |
787 | continue; |
788 | ||
d9d67c87 SM |
789 | if (stuck) |
790 | count_stuck++; | |
764428fe SM |
791 | else { |
792 | nonstuck++; | |
793 | ||
794 | /* | |
795 | * Ensure that the APT succeeded. | |
796 | * | |
797 | * With the check below that count_stuck must be less | |
798 | * than 10% of the overall generated raw entropy values | |
799 | * it is guaranteed that the APT is invoked at | |
800 | * floor((TESTLOOPCOUNT * 0.9) / 64) == 14 times. | |
801 | */ | |
802 | if ((nonstuck % JENT_APT_WINDOW_SIZE) == 0) { | |
803 | jent_apt_reset(&ec, | |
804 | delta & JENT_APT_WORD_MASK); | |
805 | if (jent_health_failure(&ec)) | |
806 | return JENT_EHEALTH; | |
807 | } | |
808 | } | |
809 | ||
810 | /* Validate RCT */ | |
811 | if (jent_rct_failure(&ec)) | |
812 | return JENT_ERCT; | |
d9d67c87 | 813 | |
bb5530e4 SM |
814 | /* test whether we have an increasing timer */ |
815 | if (!(time2 > time)) | |
816 | time_backwards++; | |
817 | ||
d9d67c87 | 818 | /* use 32 bit value to ensure compilation on 32 bit arches */ |
bb5530e4 SM |
819 | lowdelta = time2 - time; |
820 | if (!(lowdelta % 100)) | |
821 | count_mod++; | |
822 | ||
823 | /* | |
824 | * ensure that we have a varying delta timer which is necessary | |
825 | * for the calculation of entropy -- perform this check | |
826 | * only after the first loop is executed as we need to prime | |
827 | * the old_data value | |
828 | */ | |
d9d67c87 SM |
829 | if (delta > old_delta) |
830 | delta_sum += (delta - old_delta); | |
831 | else | |
832 | delta_sum += (old_delta - delta); | |
bb5530e4 SM |
833 | old_delta = delta; |
834 | } | |
835 | ||
836 | /* | |
837 | * we allow up to three times the time running backwards. | |
838 | * CLOCK_REALTIME is affected by adjtime and NTP operations. Thus, | |
839 | * if such an operation just happens to interfere with our test, it | |
840 | * should not fail. The value of 3 should cover the NTP case being | |
841 | * performed during our test run. | |
842 | */ | |
36c25011 | 843 | if (time_backwards > 3) |
bb5530e4 | 844 | return JENT_ENOMONOTONIC; |
bb5530e4 SM |
845 | |
846 | /* | |
847 | * Variations of deltas of time must on average be larger | |
848 | * than 1 to ensure the entropy estimation | |
849 | * implied with 1 is preserved | |
850 | */ | |
d9d67c87 SM |
851 | if ((delta_sum) <= 1) |
852 | return JENT_EVARVAR; | |
bb5530e4 SM |
853 | |
854 | /* | |
855 | * Ensure that we have variations in the time stamp below 10 for at | |
d9d67c87 SM |
856 | * least 10% of all checks -- on some platforms, the counter increments |
857 | * in multiples of 100, but not always | |
bb5530e4 SM |
858 | */ |
859 | if ((TESTLOOPCOUNT/10 * 9) < count_mod) | |
860 | return JENT_ECOARSETIME; | |
861 | ||
d9d67c87 SM |
862 | /* |
863 | * If we have more than 90% stuck results, then this Jitter RNG is | |
864 | * likely to not work well. | |
865 | */ | |
866 | if ((TESTLOOPCOUNT/10 * 9) < count_stuck) | |
867 | return JENT_ESTUCK; | |
868 | ||
bb5530e4 SM |
869 | return 0; |
870 | } |