1bb5530e4SStephan Mueller /*
2dfc9fa91SStephan Mueller * Non-physical true random number generator based on timing jitter --
3dfc9fa91SStephan Mueller * Jitter RNG standalone code.
4bb5530e4SStephan Mueller *
5bb897c55SStephan Müller * Copyright Stephan Mueller <smueller@chronox.de>, 2015 - 2023
6bb5530e4SStephan Mueller *
7bb5530e4SStephan Mueller * Design
8bb5530e4SStephan Mueller * ======
9bb5530e4SStephan Mueller *
109332a9e7SAlexander A. Klimov * See https://www.chronox.de/jent.html
11bb5530e4SStephan Mueller *
12bb5530e4SStephan Mueller * License
13bb5530e4SStephan Mueller * =======
14bb5530e4SStephan Mueller *
15bb5530e4SStephan Mueller * Redistribution and use in source and binary forms, with or without
16bb5530e4SStephan Mueller * modification, are permitted provided that the following conditions
17bb5530e4SStephan Mueller * are met:
18bb5530e4SStephan Mueller * 1. Redistributions of source code must retain the above copyright
19bb5530e4SStephan Mueller * notice, and the entire permission notice in its entirety,
20bb5530e4SStephan Mueller * including the disclaimer of warranties.
21bb5530e4SStephan Mueller * 2. Redistributions in binary form must reproduce the above copyright
22bb5530e4SStephan Mueller * notice, this list of conditions and the following disclaimer in the
23bb5530e4SStephan Mueller * documentation and/or other materials provided with the distribution.
24bb5530e4SStephan Mueller * 3. The name of the author may not be used to endorse or promote
25bb5530e4SStephan Mueller * products derived from this software without specific prior
26bb5530e4SStephan Mueller * written permission.
27bb5530e4SStephan Mueller *
28bb5530e4SStephan Mueller * ALTERNATIVELY, this product may be distributed under the terms of
29bb5530e4SStephan Mueller * the GNU General Public License, in which case the provisions of the GPL2 are
30bb5530e4SStephan Mueller * required INSTEAD OF the above restrictions. (This clause is
31bb5530e4SStephan Mueller * necessary due to a potential bad interaction between the GPL and
32bb5530e4SStephan Mueller * the restrictions contained in a BSD-style copyright.)
33bb5530e4SStephan Mueller *
34bb5530e4SStephan Mueller * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
35bb5530e4SStephan Mueller * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
36bb5530e4SStephan Mueller * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
37bb5530e4SStephan Mueller * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
38bb5530e4SStephan Mueller * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
39bb5530e4SStephan Mueller * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
40bb5530e4SStephan Mueller * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
41bb5530e4SStephan Mueller * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
42bb5530e4SStephan Mueller * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
43bb5530e4SStephan Mueller * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
44bb5530e4SStephan Mueller * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
45bb5530e4SStephan Mueller * DAMAGE.
46bb5530e4SStephan Mueller */
47bb5530e4SStephan Mueller
48bb5530e4SStephan Mueller /*
49bb5530e4SStephan Mueller * This Jitterentropy RNG is based on the jitterentropy library
50bb897c55SStephan Müller * version 3.4.0 provided at https://www.chronox.de/jent.html
51bb5530e4SStephan Mueller */
52bb5530e4SStephan Mueller
53dfc9fa91SStephan Mueller #ifdef __OPTIMIZE__
54dfc9fa91SStephan Mueller #error "The CPU Jitter random number generator must not be compiled with optimizations. See documentation. Use the compiler switch -O0 for compiling jitterentropy.c."
55dfc9fa91SStephan Mueller #endif
56dfc9fa91SStephan Mueller
57dfc9fa91SStephan Mueller typedef unsigned long long __u64;
58dfc9fa91SStephan Mueller typedef long long __s64;
59dfc9fa91SStephan Mueller typedef unsigned int __u32;
60bb897c55SStephan Müller typedef unsigned char u8;
61dfc9fa91SStephan Mueller #define NULL ((void *) 0)
62bb5530e4SStephan Mueller
63bb5530e4SStephan Mueller /* The entropy pool */
64bb5530e4SStephan Mueller struct rand_data {
65bb897c55SStephan Müller /* SHA3-256 is used as conditioner */
66bb897c55SStephan Müller #define DATA_SIZE_BITS 256
67bb5530e4SStephan Mueller /* all data values that are vital to maintain the security
68bb5530e4SStephan Mueller * of the RNG are marked as SENSITIVE. A user must not
69bb5530e4SStephan Mueller * access that information while the RNG executes its loops to
70bb5530e4SStephan Mueller * calculate the next random value. */
71bb897c55SStephan Müller void *hash_state; /* SENSITIVE hash state entropy pool */
72bb5530e4SStephan Mueller __u64 prev_time; /* SENSITIVE Previous time stamp */
73bb5530e4SStephan Mueller __u64 last_delta; /* SENSITIVE stuck test */
74bb5530e4SStephan Mueller __s64 last_delta2; /* SENSITIVE stuck test */
75bb5530e4SStephan Mueller unsigned int osr; /* Oversample rate */
76bb5530e4SStephan Mueller #define JENT_MEMORY_BLOCKS 64
77bb5530e4SStephan Mueller #define JENT_MEMORY_BLOCKSIZE 32
78bb5530e4SStephan Mueller #define JENT_MEMORY_ACCESSLOOPS 128
79bb5530e4SStephan Mueller #define JENT_MEMORY_SIZE (JENT_MEMORY_BLOCKS*JENT_MEMORY_BLOCKSIZE)
80bb5530e4SStephan Mueller unsigned char *mem; /* Memory access location with size of
81bb5530e4SStephan Mueller * memblocks * memblocksize */
82bb5530e4SStephan Mueller unsigned int memlocation; /* Pointer to byte in *mem */
83bb5530e4SStephan Mueller unsigned int memblocks; /* Number of memory blocks in *mem */
84bb5530e4SStephan Mueller unsigned int memblocksize; /* Size of one memory block in bytes */
85bb5530e4SStephan Mueller unsigned int memaccessloops; /* Number of memory accesses per random
86bb5530e4SStephan Mueller * bit generation */
87764428feSStephan Müller
88764428feSStephan Müller /* Repetition Count Test */
893fde2fe9SStephan Müller unsigned int rct_count; /* Number of stuck values */
90764428feSStephan Müller
913fde2fe9SStephan Müller /* Intermittent health test failure threshold of 2^-30 */
92*91cb1e14SJoachim Vandersmissen /* From an SP800-90B perspective, this RCT cutoff value is equal to 31. */
93*91cb1e14SJoachim Vandersmissen /* However, our RCT implementation starts at 1, so we subtract 1 here. */
94*91cb1e14SJoachim Vandersmissen #define JENT_RCT_CUTOFF (31 - 1) /* Taken from SP800-90B sec 4.4.1 */
95764428feSStephan Müller #define JENT_APT_CUTOFF 325 /* Taken from SP800-90B sec 4.4.2 */
963fde2fe9SStephan Müller /* Permanent health test failure threshold of 2^-60 */
97*91cb1e14SJoachim Vandersmissen /* From an SP800-90B perspective, this RCT cutoff value is equal to 61. */
98*91cb1e14SJoachim Vandersmissen /* However, our RCT implementation starts at 1, so we subtract 1 here. */
99*91cb1e14SJoachim Vandersmissen #define JENT_RCT_CUTOFF_PERMANENT (61 - 1)
1003fde2fe9SStephan Müller #define JENT_APT_CUTOFF_PERMANENT 355
101764428feSStephan Müller #define JENT_APT_WINDOW_SIZE 512 /* Data window size */
102764428feSStephan Müller /* LSB of time stamp to process */
103764428feSStephan Müller #define JENT_APT_LSB 16
104764428feSStephan Müller #define JENT_APT_WORD_MASK (JENT_APT_LSB - 1)
105764428feSStephan Müller unsigned int apt_observations; /* Number of collected observations */
106764428feSStephan Müller unsigned int apt_count; /* APT counter */
107764428feSStephan Müller unsigned int apt_base; /* APT base reference */
108764428feSStephan Müller unsigned int apt_base_set:1; /* APT base reference set? */
109bb5530e4SStephan Mueller };
110bb5530e4SStephan Mueller
111bb5530e4SStephan Mueller /* Flags that can be used to initialize the RNG */
112bb5530e4SStephan Mueller #define JENT_DISABLE_MEMORY_ACCESS (1<<2) /* Disable memory access for more
113bb5530e4SStephan Mueller * entropy, saves MEMORY_SIZE RAM for
114bb5530e4SStephan Mueller * entropy collector */
115bb5530e4SStephan Mueller
116bb5530e4SStephan Mueller /* -- error codes for init function -- */
117bb5530e4SStephan Mueller #define JENT_ENOTIME 1 /* Timer service not available */
118bb5530e4SStephan Mueller #define JENT_ECOARSETIME 2 /* Timer too coarse for RNG */
119bb5530e4SStephan Mueller #define JENT_ENOMONOTONIC 3 /* Timer is not monotonic increasing */
120bb5530e4SStephan Mueller #define JENT_EVARVAR 5 /* Timer does not produce variations of
121bb5530e4SStephan Mueller * variations (2nd derivation of time is
122bb5530e4SStephan Mueller * zero). */
123d9d67c87SStephan Müller #define JENT_ESTUCK 8 /* Too many stuck results during init. */
124764428feSStephan Müller #define JENT_EHEALTH 9 /* Health test failed during initialization */
125bb5530e4SStephan Mueller
126908dffafSStephan Müller /*
127908dffafSStephan Müller * The output n bits can receive more than n bits of min entropy, of course,
128908dffafSStephan Müller * but the fixed output of the conditioning function can only asymptotically
129908dffafSStephan Müller * approach the output size bits of min entropy, not attain that bound. Random
130908dffafSStephan Müller * maps will tend to have output collisions, which reduces the creditable
131908dffafSStephan Müller * output entropy (that is what SP 800-90B Section 3.1.5.1.2 attempts to bound).
132908dffafSStephan Müller *
133908dffafSStephan Müller * The value "64" is justified in Appendix A.4 of the current 90C draft,
134908dffafSStephan Müller * and aligns with NIST's in "epsilon" definition in this document, which is
135908dffafSStephan Müller * that a string can be considered "full entropy" if you can bound the min
136908dffafSStephan Müller * entropy in each bit of output to at least 1-epsilon, where epsilon is
137908dffafSStephan Müller * required to be <= 2^(-32).
138908dffafSStephan Müller */
139908dffafSStephan Müller #define JENT_ENTROPY_SAFETY_FACTOR 64
140908dffafSStephan Müller
141908dffafSStephan Müller #include <linux/fips.h>
142965d7286SBen Dooks #include "jitterentropy.h"
143bb5530e4SStephan Mueller
144764428feSStephan Müller /***************************************************************************
145764428feSStephan Müller * Adaptive Proportion Test
146764428feSStephan Müller *
147764428feSStephan Müller * This test complies with SP800-90B section 4.4.2.
148764428feSStephan Müller ***************************************************************************/
149764428feSStephan Müller
15004cb788eSRandy Dunlap /*
151764428feSStephan Müller * Reset the APT counter
152764428feSStephan Müller *
153764428feSStephan Müller * @ec [in] Reference to entropy collector
154764428feSStephan Müller */
jent_apt_reset(struct rand_data * ec,unsigned int delta_masked)155764428feSStephan Müller static void jent_apt_reset(struct rand_data *ec, unsigned int delta_masked)
156764428feSStephan Müller {
157764428feSStephan Müller /* Reset APT counter */
158764428feSStephan Müller ec->apt_count = 0;
159764428feSStephan Müller ec->apt_base = delta_masked;
160764428feSStephan Müller ec->apt_observations = 0;
161764428feSStephan Müller }
162764428feSStephan Müller
16304cb788eSRandy Dunlap /*
164764428feSStephan Müller * Insert a new entropy event into APT
165764428feSStephan Müller *
166764428feSStephan Müller * @ec [in] Reference to entropy collector
167764428feSStephan Müller * @delta_masked [in] Masked time delta to process
168764428feSStephan Müller */
jent_apt_insert(struct rand_data * ec,unsigned int delta_masked)169764428feSStephan Müller static void jent_apt_insert(struct rand_data *ec, unsigned int delta_masked)
170764428feSStephan Müller {
171764428feSStephan Müller /* Initialize the base reference */
172764428feSStephan Müller if (!ec->apt_base_set) {
173764428feSStephan Müller ec->apt_base = delta_masked;
174764428feSStephan Müller ec->apt_base_set = 1;
175764428feSStephan Müller return;
176764428feSStephan Müller }
177764428feSStephan Müller
1783fde2fe9SStephan Müller if (delta_masked == ec->apt_base)
179764428feSStephan Müller ec->apt_count++;
180764428feSStephan Müller
181764428feSStephan Müller ec->apt_observations++;
182764428feSStephan Müller
183764428feSStephan Müller if (ec->apt_observations >= JENT_APT_WINDOW_SIZE)
184764428feSStephan Müller jent_apt_reset(ec, delta_masked);
185764428feSStephan Müller }
186764428feSStephan Müller
1873fde2fe9SStephan Müller /* APT health test failure detection */
jent_apt_permanent_failure(struct rand_data * ec)1883fde2fe9SStephan Müller static int jent_apt_permanent_failure(struct rand_data *ec)
1893fde2fe9SStephan Müller {
1903fde2fe9SStephan Müller return (ec->apt_count >= JENT_APT_CUTOFF_PERMANENT) ? 1 : 0;
1913fde2fe9SStephan Müller }
1923fde2fe9SStephan Müller
jent_apt_failure(struct rand_data * ec)1933fde2fe9SStephan Müller static int jent_apt_failure(struct rand_data *ec)
1943fde2fe9SStephan Müller {
1953fde2fe9SStephan Müller return (ec->apt_count >= JENT_APT_CUTOFF) ? 1 : 0;
1963fde2fe9SStephan Müller }
1973fde2fe9SStephan Müller
198764428feSStephan Müller /***************************************************************************
199764428feSStephan Müller * Stuck Test and its use as Repetition Count Test
200764428feSStephan Müller *
201764428feSStephan Müller * The Jitter RNG uses an enhanced version of the Repetition Count Test
202764428feSStephan Müller * (RCT) specified in SP800-90B section 4.4.1. Instead of counting identical
203764428feSStephan Müller * back-to-back values, the input to the RCT is the counting of the stuck
204764428feSStephan Müller * values during the generation of one Jitter RNG output block.
205764428feSStephan Müller *
206764428feSStephan Müller * The RCT is applied with an alpha of 2^{-30} compliant to FIPS 140-2 IG 9.8.
207764428feSStephan Müller *
208764428feSStephan Müller * During the counting operation, the Jitter RNG always calculates the RCT
209764428feSStephan Müller * cut-off value of C. If that value exceeds the allowed cut-off value,
210764428feSStephan Müller * the Jitter RNG output block will be calculated completely but discarded at
211764428feSStephan Müller * the end. The caller of the Jitter RNG is informed with an error code.
212764428feSStephan Müller ***************************************************************************/
213764428feSStephan Müller
21404cb788eSRandy Dunlap /*
215764428feSStephan Müller * Repetition Count Test as defined in SP800-90B section 4.4.1
216764428feSStephan Müller *
217764428feSStephan Müller * @ec [in] Reference to entropy collector
218764428feSStephan Müller * @stuck [in] Indicator whether the value is stuck
219764428feSStephan Müller */
jent_rct_insert(struct rand_data * ec,int stuck)220764428feSStephan Müller static void jent_rct_insert(struct rand_data *ec, int stuck)
221764428feSStephan Müller {
222764428feSStephan Müller if (stuck) {
223764428feSStephan Müller ec->rct_count++;
224764428feSStephan Müller } else {
2253fde2fe9SStephan Müller /* Reset RCT */
226764428feSStephan Müller ec->rct_count = 0;
227764428feSStephan Müller }
228764428feSStephan Müller }
229764428feSStephan Müller
jent_delta(__u64 prev,__u64 next)230764428feSStephan Müller static inline __u64 jent_delta(__u64 prev, __u64 next)
231764428feSStephan Müller {
232764428feSStephan Müller #define JENT_UINT64_MAX (__u64)(~((__u64) 0))
233764428feSStephan Müller return (prev < next) ? (next - prev) :
234764428feSStephan Müller (JENT_UINT64_MAX - prev + 1 + next);
235764428feSStephan Müller }
236764428feSStephan Müller
23704cb788eSRandy Dunlap /*
238764428feSStephan Müller * Stuck test by checking the:
239764428feSStephan Müller * 1st derivative of the jitter measurement (time delta)
240764428feSStephan Müller * 2nd derivative of the jitter measurement (delta of time deltas)
241764428feSStephan Müller * 3rd derivative of the jitter measurement (delta of delta of time deltas)
242764428feSStephan Müller *
243764428feSStephan Müller * All values must always be non-zero.
244764428feSStephan Müller *
245764428feSStephan Müller * @ec [in] Reference to entropy collector
246764428feSStephan Müller * @current_delta [in] Jitter time delta
247764428feSStephan Müller *
248764428feSStephan Müller * @return
249764428feSStephan Müller * 0 jitter measurement not stuck (good bit)
250764428feSStephan Müller * 1 jitter measurement stuck (reject bit)
251764428feSStephan Müller */
jent_stuck(struct rand_data * ec,__u64 current_delta)252764428feSStephan Müller static int jent_stuck(struct rand_data *ec, __u64 current_delta)
253764428feSStephan Müller {
254764428feSStephan Müller __u64 delta2 = jent_delta(ec->last_delta, current_delta);
255764428feSStephan Müller __u64 delta3 = jent_delta(ec->last_delta2, delta2);
256764428feSStephan Müller
257764428feSStephan Müller ec->last_delta = current_delta;
258764428feSStephan Müller ec->last_delta2 = delta2;
259764428feSStephan Müller
260764428feSStephan Müller /*
261764428feSStephan Müller * Insert the result of the comparison of two back-to-back time
262764428feSStephan Müller * deltas.
263764428feSStephan Müller */
264552d03a2SStephan Müller jent_apt_insert(ec, current_delta);
265764428feSStephan Müller
266764428feSStephan Müller if (!current_delta || !delta2 || !delta3) {
267764428feSStephan Müller /* RCT with a stuck bit */
268764428feSStephan Müller jent_rct_insert(ec, 1);
269764428feSStephan Müller return 1;
270764428feSStephan Müller }
271764428feSStephan Müller
272764428feSStephan Müller /* RCT with a non-stuck bit */
273764428feSStephan Müller jent_rct_insert(ec, 0);
274764428feSStephan Müller
275764428feSStephan Müller return 0;
276764428feSStephan Müller }
277764428feSStephan Müller
2783fde2fe9SStephan Müller /* RCT health test failure detection */
jent_rct_permanent_failure(struct rand_data * ec)2793fde2fe9SStephan Müller static int jent_rct_permanent_failure(struct rand_data *ec)
2803fde2fe9SStephan Müller {
2813fde2fe9SStephan Müller return (ec->rct_count >= JENT_RCT_CUTOFF_PERMANENT) ? 1 : 0;
2823fde2fe9SStephan Müller }
2833fde2fe9SStephan Müller
jent_rct_failure(struct rand_data * ec)2843fde2fe9SStephan Müller static int jent_rct_failure(struct rand_data *ec)
2853fde2fe9SStephan Müller {
2863fde2fe9SStephan Müller return (ec->rct_count >= JENT_RCT_CUTOFF) ? 1 : 0;
2873fde2fe9SStephan Müller }
2883fde2fe9SStephan Müller
2893fde2fe9SStephan Müller /* Report of health test failures */
jent_health_failure(struct rand_data * ec)290764428feSStephan Müller static int jent_health_failure(struct rand_data *ec)
291764428feSStephan Müller {
2923fde2fe9SStephan Müller return jent_rct_failure(ec) | jent_apt_failure(ec);
2933fde2fe9SStephan Müller }
2943fde2fe9SStephan Müller
jent_permanent_health_failure(struct rand_data * ec)2953fde2fe9SStephan Müller static int jent_permanent_health_failure(struct rand_data *ec)
2963fde2fe9SStephan Müller {
2973fde2fe9SStephan Müller return jent_rct_permanent_failure(ec) | jent_apt_permanent_failure(ec);
298764428feSStephan Müller }
299764428feSStephan Müller
300764428feSStephan Müller /***************************************************************************
301764428feSStephan Müller * Noise sources
302764428feSStephan Müller ***************************************************************************/
303764428feSStephan Müller
30404cb788eSRandy Dunlap /*
305bb5530e4SStephan Mueller * Update of the loop count used for the next round of
306bb5530e4SStephan Mueller * an entropy collection.
307bb5530e4SStephan Mueller *
308bb5530e4SStephan Mueller * Input:
309bb5530e4SStephan Mueller * @bits is the number of low bits of the timer to consider
310bb5530e4SStephan Mueller * @min is the number of bits we shift the timer value to the right at
311bb5530e4SStephan Mueller * the end to make sure we have a guaranteed minimum value
312bb5530e4SStephan Mueller *
313bb5530e4SStephan Mueller * @return Newly calculated loop counter
314bb5530e4SStephan Mueller */
jent_loop_shuffle(unsigned int bits,unsigned int min)315bb897c55SStephan Müller static __u64 jent_loop_shuffle(unsigned int bits, unsigned int min)
316bb5530e4SStephan Mueller {
317bb5530e4SStephan Mueller __u64 time = 0;
318bb5530e4SStephan Mueller __u64 shuffle = 0;
319bb5530e4SStephan Mueller unsigned int i = 0;
320bb5530e4SStephan Mueller unsigned int mask = (1<<bits) - 1;
321bb5530e4SStephan Mueller
322bb5530e4SStephan Mueller jent_get_nstime(&time);
323bb897c55SStephan Müller
324bb5530e4SStephan Mueller /*
325d9d67c87SStephan Müller * We fold the time value as much as possible to ensure that as many
326d9d67c87SStephan Müller * bits of the time stamp are included as possible.
327bb5530e4SStephan Mueller */
328d9d67c87SStephan Müller for (i = 0; ((DATA_SIZE_BITS + bits - 1) / bits) > i; i++) {
329bb5530e4SStephan Mueller shuffle ^= time & mask;
330bb5530e4SStephan Mueller time = time >> bits;
331bb5530e4SStephan Mueller }
332bb5530e4SStephan Mueller
333bb5530e4SStephan Mueller /*
334bb5530e4SStephan Mueller * We add a lower boundary value to ensure we have a minimum
335bb5530e4SStephan Mueller * RNG loop count.
336bb5530e4SStephan Mueller */
337bb5530e4SStephan Mueller return (shuffle + (1<<min));
338bb5530e4SStephan Mueller }
339bb5530e4SStephan Mueller
34004cb788eSRandy Dunlap /*
341bb5530e4SStephan Mueller * CPU Jitter noise source -- this is the noise source based on the CPU
342bb5530e4SStephan Mueller * execution time jitter
343bb5530e4SStephan Mueller *
344d9d67c87SStephan Müller * This function injects the individual bits of the time value into the
345bb897c55SStephan Müller * entropy pool using a hash.
346bb5530e4SStephan Mueller *
347bb897c55SStephan Müller * ec [in] entropy collector
348bb897c55SStephan Müller * time [in] time stamp to be injected
349bb897c55SStephan Müller * stuck [in] Is the time stamp identified as stuck?
350bb5530e4SStephan Mueller *
351bb5530e4SStephan Mueller * Output:
352bb897c55SStephan Müller * updated hash context in the entropy collector or error code
353bb5530e4SStephan Mueller */
jent_condition_data(struct rand_data * ec,__u64 time,int stuck)354bb897c55SStephan Müller static int jent_condition_data(struct rand_data *ec, __u64 time, int stuck)
355bb5530e4SStephan Mueller {
356bb897c55SStephan Müller #define SHA3_HASH_LOOP (1<<3)
357bb897c55SStephan Müller struct {
358bb897c55SStephan Müller int rct_count;
359bb897c55SStephan Müller unsigned int apt_observations;
360bb897c55SStephan Müller unsigned int apt_count;
361bb897c55SStephan Müller unsigned int apt_base;
362bb897c55SStephan Müller } addtl = {
363bb897c55SStephan Müller ec->rct_count,
364bb897c55SStephan Müller ec->apt_observations,
365bb897c55SStephan Müller ec->apt_count,
366bb897c55SStephan Müller ec->apt_base
367bb897c55SStephan Müller };
368bb5530e4SStephan Mueller
369bb897c55SStephan Müller return jent_hash_time(ec->hash_state, time, (u8 *)&addtl, sizeof(addtl),
370bb897c55SStephan Müller SHA3_HASH_LOOP, stuck);
371bb5530e4SStephan Mueller }
372bb5530e4SStephan Mueller
37304cb788eSRandy Dunlap /*
374bb5530e4SStephan Mueller * Memory Access noise source -- this is a noise source based on variations in
375bb5530e4SStephan Mueller * memory access times
376bb5530e4SStephan Mueller *
377bb5530e4SStephan Mueller * This function performs memory accesses which will add to the timing
378bb5530e4SStephan Mueller * variations due to an unknown amount of CPU wait states that need to be
379bb5530e4SStephan Mueller * added when accessing memory. The memory size should be larger than the L1
380bb5530e4SStephan Mueller * caches as outlined in the documentation and the associated testing.
381bb5530e4SStephan Mueller *
382bb5530e4SStephan Mueller * The L1 cache has a very high bandwidth, albeit its access rate is usually
383bb5530e4SStephan Mueller * slower than accessing CPU registers. Therefore, L1 accesses only add minimal
384bb5530e4SStephan Mueller * variations as the CPU has hardly to wait. Starting with L2, significant
385bb5530e4SStephan Mueller * variations are added because L2 typically does not belong to the CPU any more
386bb5530e4SStephan Mueller * and therefore a wider range of CPU wait states is necessary for accesses.
387bb5530e4SStephan Mueller * L3 and real memory accesses have even a wider range of wait states. However,
388bb5530e4SStephan Mueller * to reliably access either L3 or memory, the ec->mem memory must be quite
389bb5530e4SStephan Mueller * large which is usually not desirable.
390bb5530e4SStephan Mueller *
391764428feSStephan Müller * @ec [in] Reference to the entropy collector with the memory access data -- if
392bb5530e4SStephan Mueller * the reference to the memory block to be accessed is NULL, this noise
393bb5530e4SStephan Mueller * source is disabled
394764428feSStephan Müller * @loop_cnt [in] if a value not equal to 0 is set, use the given value
395764428feSStephan Müller * number of loops to perform the LFSR
396bb5530e4SStephan Mueller */
jent_memaccess(struct rand_data * ec,__u64 loop_cnt)397764428feSStephan Müller static void jent_memaccess(struct rand_data *ec, __u64 loop_cnt)
398bb5530e4SStephan Mueller {
399bb5530e4SStephan Mueller unsigned int wrap = 0;
400bb5530e4SStephan Mueller __u64 i = 0;
401bb5530e4SStephan Mueller #define MAX_ACC_LOOP_BIT 7
402bb5530e4SStephan Mueller #define MIN_ACC_LOOP_BIT 0
403bb5530e4SStephan Mueller __u64 acc_loop_cnt =
404bb897c55SStephan Müller jent_loop_shuffle(MAX_ACC_LOOP_BIT, MIN_ACC_LOOP_BIT);
405bb5530e4SStephan Mueller
406bb5530e4SStephan Mueller if (NULL == ec || NULL == ec->mem)
407764428feSStephan Müller return;
408bb5530e4SStephan Mueller wrap = ec->memblocksize * ec->memblocks;
409bb5530e4SStephan Mueller
410bb5530e4SStephan Mueller /*
411bb5530e4SStephan Mueller * testing purposes -- allow test app to set the counter, not
412bb5530e4SStephan Mueller * needed during runtime
413bb5530e4SStephan Mueller */
414bb5530e4SStephan Mueller if (loop_cnt)
415bb5530e4SStephan Mueller acc_loop_cnt = loop_cnt;
416bb5530e4SStephan Mueller
417bb5530e4SStephan Mueller for (i = 0; i < (ec->memaccessloops + acc_loop_cnt); i++) {
418d9d67c87SStephan Müller unsigned char *tmpval = ec->mem + ec->memlocation;
419bb5530e4SStephan Mueller /*
420bb5530e4SStephan Mueller * memory access: just add 1 to one byte,
421bb5530e4SStephan Mueller * wrap at 255 -- memory access implies read
422bb5530e4SStephan Mueller * from and write to memory location
423bb5530e4SStephan Mueller */
424bb5530e4SStephan Mueller *tmpval = (*tmpval + 1) & 0xff;
425bb5530e4SStephan Mueller /*
426bb5530e4SStephan Mueller * Addition of memblocksize - 1 to pointer
427bb5530e4SStephan Mueller * with wrap around logic to ensure that every
428bb5530e4SStephan Mueller * memory location is hit evenly
429bb5530e4SStephan Mueller */
430bb5530e4SStephan Mueller ec->memlocation = ec->memlocation + ec->memblocksize - 1;
431bb5530e4SStephan Mueller ec->memlocation = ec->memlocation % wrap;
432bb5530e4SStephan Mueller }
433bb5530e4SStephan Mueller }
434bb5530e4SStephan Mueller
435bb5530e4SStephan Mueller /***************************************************************************
436bb5530e4SStephan Mueller * Start of entropy processing logic
437bb5530e4SStephan Mueller ***************************************************************************/
43804cb788eSRandy Dunlap /*
439bb5530e4SStephan Mueller * This is the heart of the entropy generation: calculate time deltas and
440d9d67c87SStephan Müller * use the CPU jitter in the time deltas. The jitter is injected into the
441d9d67c87SStephan Müller * entropy pool.
442bb5530e4SStephan Mueller *
443bb5530e4SStephan Mueller * WARNING: ensure that ->prev_time is primed before using the output
444bb5530e4SStephan Mueller * of this function! This can be done by calling this function
445bb5530e4SStephan Mueller * and not using its result.
446bb5530e4SStephan Mueller *
447764428feSStephan Müller * @ec [in] Reference to entropy collector
448bb5530e4SStephan Mueller *
449d9d67c87SStephan Müller * @return result of stuck test
450bb5530e4SStephan Mueller */
jent_measure_jitter(struct rand_data * ec)451d9d67c87SStephan Müller static int jent_measure_jitter(struct rand_data *ec)
452bb5530e4SStephan Mueller {
453bb5530e4SStephan Mueller __u64 time = 0;
454bb5530e4SStephan Mueller __u64 current_delta = 0;
455764428feSStephan Müller int stuck;
456bb5530e4SStephan Mueller
457bb5530e4SStephan Mueller /* Invoke one noise source before time measurement to add variations */
458bb5530e4SStephan Mueller jent_memaccess(ec, 0);
459bb5530e4SStephan Mueller
460bb5530e4SStephan Mueller /*
461bb5530e4SStephan Mueller * Get time stamp and calculate time delta to previous
462bb5530e4SStephan Mueller * invocation to measure the timing variations
463bb5530e4SStephan Mueller */
464bb5530e4SStephan Mueller jent_get_nstime(&time);
465764428feSStephan Müller current_delta = jent_delta(ec->prev_time, time);
466bb5530e4SStephan Mueller ec->prev_time = time;
467bb5530e4SStephan Mueller
468d9d67c87SStephan Müller /* Check whether we have a stuck measurement. */
469764428feSStephan Müller stuck = jent_stuck(ec, current_delta);
470764428feSStephan Müller
471764428feSStephan Müller /* Now call the next noise sources which also injects the data */
472bb897c55SStephan Müller if (jent_condition_data(ec, current_delta, stuck))
473bb897c55SStephan Müller stuck = 1;
474764428feSStephan Müller
475764428feSStephan Müller return stuck;
476bb5530e4SStephan Mueller }
477bb5530e4SStephan Mueller
47804cb788eSRandy Dunlap /*
479bb5530e4SStephan Mueller * Generator of one 64 bit random number
480bb897c55SStephan Müller * Function fills rand_data->hash_state
481bb5530e4SStephan Mueller *
482764428feSStephan Müller * @ec [in] Reference to entropy collector
483bb5530e4SStephan Mueller */
jent_gen_entropy(struct rand_data * ec)484bb5530e4SStephan Mueller static void jent_gen_entropy(struct rand_data *ec)
485bb5530e4SStephan Mueller {
486908dffafSStephan Müller unsigned int k = 0, safety_factor = 0;
487908dffafSStephan Müller
488908dffafSStephan Müller if (fips_enabled)
489908dffafSStephan Müller safety_factor = JENT_ENTROPY_SAFETY_FACTOR;
490bb5530e4SStephan Mueller
491bb5530e4SStephan Mueller /* priming of the ->prev_time value */
492bb5530e4SStephan Mueller jent_measure_jitter(ec);
493bb5530e4SStephan Mueller
494710ce4b8SNicolai Stange while (!jent_health_failure(ec)) {
495d9d67c87SStephan Müller /* If a stuck measurement is received, repeat measurement */
496d9d67c87SStephan Müller if (jent_measure_jitter(ec))
497bb5530e4SStephan Mueller continue;
498bb5530e4SStephan Mueller
499bb5530e4SStephan Mueller /*
500bb5530e4SStephan Mueller * We multiply the loop value with ->osr to obtain the
501bb5530e4SStephan Mueller * oversampling rate requested by the caller
502bb5530e4SStephan Mueller */
503908dffafSStephan Müller if (++k >= ((DATA_SIZE_BITS + safety_factor) * ec->osr))
504bb5530e4SStephan Mueller break;
505bb5530e4SStephan Mueller }
506bb5530e4SStephan Mueller }
507bb5530e4SStephan Mueller
50804cb788eSRandy Dunlap /*
509bb5530e4SStephan Mueller * Entry function: Obtain entropy for the caller.
510bb5530e4SStephan Mueller *
511bb5530e4SStephan Mueller * This function invokes the entropy gathering logic as often to generate
512bb5530e4SStephan Mueller * as many bytes as requested by the caller. The entropy gathering logic
513bb5530e4SStephan Mueller * creates 64 bit per invocation.
514bb5530e4SStephan Mueller *
515bb5530e4SStephan Mueller * This function truncates the last 64 bit entropy value output to the exact
516bb5530e4SStephan Mueller * size specified by the caller.
517bb5530e4SStephan Mueller *
518764428feSStephan Müller * @ec [in] Reference to entropy collector
519764428feSStephan Müller * @data [in] pointer to buffer for storing random data -- buffer must already
520bb5530e4SStephan Mueller * exist
521764428feSStephan Müller * @len [in] size of the buffer, specifying also the requested number of random
522bb5530e4SStephan Mueller * in bytes
523bb5530e4SStephan Mueller *
524bb5530e4SStephan Mueller * @return 0 when request is fulfilled or an error
525bb5530e4SStephan Mueller *
526bb5530e4SStephan Mueller * The following error codes can occur:
527bb897c55SStephan Müller * -1 entropy_collector is NULL or the generation failed
5283fde2fe9SStephan Müller * -2 Intermittent health failure
5293fde2fe9SStephan Müller * -3 Permanent health failure
530bb5530e4SStephan Mueller */
jent_read_entropy(struct rand_data * ec,unsigned char * data,unsigned int len)531dfc9fa91SStephan Mueller int jent_read_entropy(struct rand_data *ec, unsigned char *data,
532dfc9fa91SStephan Mueller unsigned int len)
533bb5530e4SStephan Mueller {
534dfc9fa91SStephan Mueller unsigned char *p = data;
535bb5530e4SStephan Mueller
536bb5530e4SStephan Mueller if (!ec)
537dfc9fa91SStephan Mueller return -1;
538bb5530e4SStephan Mueller
53936c25011SMilan Djurovic while (len > 0) {
540dfc9fa91SStephan Mueller unsigned int tocopy;
541bb5530e4SStephan Mueller
542bb5530e4SStephan Mueller jent_gen_entropy(ec);
543764428feSStephan Müller
5443fde2fe9SStephan Müller if (jent_permanent_health_failure(ec)) {
545764428feSStephan Müller /*
5463fde2fe9SStephan Müller * At this point, the Jitter RNG instance is considered
5473fde2fe9SStephan Müller * as a failed instance. There is no rerun of the
5483fde2fe9SStephan Müller * startup test any more, because the caller
5493fde2fe9SStephan Müller * is assumed to not further use this instance.
5503fde2fe9SStephan Müller */
5513fde2fe9SStephan Müller return -3;
5523fde2fe9SStephan Müller } else if (jent_health_failure(ec)) {
5533fde2fe9SStephan Müller /*
5543fde2fe9SStephan Müller * Perform startup health tests and return permanent
5553fde2fe9SStephan Müller * error if it fails.
556764428feSStephan Müller */
557bb897c55SStephan Müller if (jent_entropy_init(ec->hash_state))
5583fde2fe9SStephan Müller return -3;
559764428feSStephan Müller
5603fde2fe9SStephan Müller return -2;
561764428feSStephan Müller }
562764428feSStephan Müller
563bb5530e4SStephan Mueller if ((DATA_SIZE_BITS / 8) < len)
564bb5530e4SStephan Mueller tocopy = (DATA_SIZE_BITS / 8);
565bb5530e4SStephan Mueller else
566bb5530e4SStephan Mueller tocopy = len;
567bb897c55SStephan Müller if (jent_read_random_block(ec->hash_state, p, tocopy))
568bb897c55SStephan Müller return -1;
569bb5530e4SStephan Mueller
570bb5530e4SStephan Mueller len -= tocopy;
571bb5530e4SStephan Mueller p += tocopy;
572bb5530e4SStephan Mueller }
573bb5530e4SStephan Mueller
574bb5530e4SStephan Mueller return 0;
575bb5530e4SStephan Mueller }
576bb5530e4SStephan Mueller
577bb5530e4SStephan Mueller /***************************************************************************
578bb5530e4SStephan Mueller * Initialization logic
579bb5530e4SStephan Mueller ***************************************************************************/
580bb5530e4SStephan Mueller
jent_entropy_collector_alloc(unsigned int osr,unsigned int flags,void * hash_state)581dfc9fa91SStephan Mueller struct rand_data *jent_entropy_collector_alloc(unsigned int osr,
582bb897c55SStephan Müller unsigned int flags,
583bb897c55SStephan Müller void *hash_state)
584bb5530e4SStephan Mueller {
585bb5530e4SStephan Mueller struct rand_data *entropy_collector;
586bb5530e4SStephan Mueller
587dfc9fa91SStephan Mueller entropy_collector = jent_zalloc(sizeof(struct rand_data));
588bb5530e4SStephan Mueller if (!entropy_collector)
589bb5530e4SStephan Mueller return NULL;
590bb5530e4SStephan Mueller
591bb5530e4SStephan Mueller if (!(flags & JENT_DISABLE_MEMORY_ACCESS)) {
592bb5530e4SStephan Mueller /* Allocate memory for adding variations based on memory
593bb5530e4SStephan Mueller * access
594bb5530e4SStephan Mueller */
595dfc9fa91SStephan Mueller entropy_collector->mem = jent_zalloc(JENT_MEMORY_SIZE);
596bb5530e4SStephan Mueller if (!entropy_collector->mem) {
597dfc9fa91SStephan Mueller jent_zfree(entropy_collector);
598bb5530e4SStephan Mueller return NULL;
599bb5530e4SStephan Mueller }
600bb5530e4SStephan Mueller entropy_collector->memblocksize = JENT_MEMORY_BLOCKSIZE;
601bb5530e4SStephan Mueller entropy_collector->memblocks = JENT_MEMORY_BLOCKS;
602bb5530e4SStephan Mueller entropy_collector->memaccessloops = JENT_MEMORY_ACCESSLOOPS;
603bb5530e4SStephan Mueller }
604bb5530e4SStephan Mueller
605bb5530e4SStephan Mueller /* verify and set the oversampling rate */
60636c25011SMilan Djurovic if (osr == 0)
607bb5530e4SStephan Mueller osr = 1; /* minimum sampling rate is 1 */
608bb5530e4SStephan Mueller entropy_collector->osr = osr;
609bb5530e4SStephan Mueller
610bb897c55SStephan Müller entropy_collector->hash_state = hash_state;
611bb897c55SStephan Müller
612bb5530e4SStephan Mueller /* fill the data pad with non-zero values */
613bb5530e4SStephan Mueller jent_gen_entropy(entropy_collector);
614bb5530e4SStephan Mueller
615bb5530e4SStephan Mueller return entropy_collector;
616bb5530e4SStephan Mueller }
617bb5530e4SStephan Mueller
jent_entropy_collector_free(struct rand_data * entropy_collector)618dfc9fa91SStephan Mueller void jent_entropy_collector_free(struct rand_data *entropy_collector)
619bb5530e4SStephan Mueller {
620dfc9fa91SStephan Mueller jent_zfree(entropy_collector->mem);
621bb5530e4SStephan Mueller entropy_collector->mem = NULL;
622dfc9fa91SStephan Mueller jent_zfree(entropy_collector);
623bb5530e4SStephan Mueller }
624bb5530e4SStephan Mueller
jent_entropy_init(void * hash_state)625bb897c55SStephan Müller int jent_entropy_init(void *hash_state)
626bb5530e4SStephan Mueller {
627bb5530e4SStephan Mueller int i;
628bb5530e4SStephan Mueller __u64 delta_sum = 0;
629bb5530e4SStephan Mueller __u64 old_delta = 0;
630764428feSStephan Müller unsigned int nonstuck = 0;
631bb5530e4SStephan Mueller int time_backwards = 0;
632bb5530e4SStephan Mueller int count_mod = 0;
633d9d67c87SStephan Müller int count_stuck = 0;
634d9d67c87SStephan Müller struct rand_data ec = { 0 };
635bb5530e4SStephan Mueller
636764428feSStephan Müller /* Required for RCT */
637764428feSStephan Müller ec.osr = 1;
638bb897c55SStephan Müller ec.hash_state = hash_state;
639764428feSStephan Müller
640bb5530e4SStephan Mueller /* We could perform statistical tests here, but the problem is
641bb5530e4SStephan Mueller * that we only have a few loop counts to do testing. These
642bb5530e4SStephan Mueller * loop counts may show some slight skew and we produce
643bb5530e4SStephan Mueller * false positives.
644bb5530e4SStephan Mueller *
645bb5530e4SStephan Mueller * Moreover, only old systems show potentially problematic
646bb5530e4SStephan Mueller * jitter entropy that could potentially be caught here. But
647bb5530e4SStephan Mueller * the RNG is intended for hardware that is available or widely
648bb5530e4SStephan Mueller * used, but not old systems that are long out of favor. Thus,
649bb5530e4SStephan Mueller * no statistical tests.
650bb5530e4SStephan Mueller */
651bb5530e4SStephan Mueller
652bb5530e4SStephan Mueller /*
653bb5530e4SStephan Mueller * We could add a check for system capabilities such as clock_getres or
654bb5530e4SStephan Mueller * check for CONFIG_X86_TSC, but it does not make much sense as the
655bb5530e4SStephan Mueller * following sanity checks verify that we have a high-resolution
656bb5530e4SStephan Mueller * timer.
657bb5530e4SStephan Mueller */
658bb5530e4SStephan Mueller /*
659bb5530e4SStephan Mueller * TESTLOOPCOUNT needs some loops to identify edge systems. 100 is
660bb5530e4SStephan Mueller * definitely too little.
661764428feSStephan Müller *
662764428feSStephan Müller * SP800-90B requires at least 1024 initial test cycles.
663bb5530e4SStephan Mueller */
664764428feSStephan Müller #define TESTLOOPCOUNT 1024
665bb5530e4SStephan Mueller #define CLEARCACHE 100
666bb5530e4SStephan Mueller for (i = 0; (TESTLOOPCOUNT + CLEARCACHE) > i; i++) {
667bb5530e4SStephan Mueller __u64 time = 0;
668bb5530e4SStephan Mueller __u64 time2 = 0;
669bb5530e4SStephan Mueller __u64 delta = 0;
670bb5530e4SStephan Mueller unsigned int lowdelta = 0;
671d9d67c87SStephan Müller int stuck;
672bb5530e4SStephan Mueller
673d9d67c87SStephan Müller /* Invoke core entropy collection logic */
674bb5530e4SStephan Mueller jent_get_nstime(&time);
675d9d67c87SStephan Müller ec.prev_time = time;
676bb897c55SStephan Müller jent_condition_data(&ec, time, 0);
677bb5530e4SStephan Mueller jent_get_nstime(&time2);
678bb5530e4SStephan Mueller
679bb5530e4SStephan Mueller /* test whether timer works */
680bb5530e4SStephan Mueller if (!time || !time2)
681bb5530e4SStephan Mueller return JENT_ENOTIME;
682764428feSStephan Müller delta = jent_delta(time, time2);
683bb5530e4SStephan Mueller /*
684bb5530e4SStephan Mueller * test whether timer is fine grained enough to provide
685bb5530e4SStephan Mueller * delta even when called shortly after each other -- this
686bb5530e4SStephan Mueller * implies that we also have a high resolution timer
687bb5530e4SStephan Mueller */
688bb5530e4SStephan Mueller if (!delta)
689bb5530e4SStephan Mueller return JENT_ECOARSETIME;
690bb5530e4SStephan Mueller
691d9d67c87SStephan Müller stuck = jent_stuck(&ec, delta);
692d9d67c87SStephan Müller
693bb5530e4SStephan Mueller /*
694bb5530e4SStephan Mueller * up to here we did not modify any variable that will be
695bb5530e4SStephan Mueller * evaluated later, but we already performed some work. Thus we
696bb5530e4SStephan Mueller * already have had an impact on the caches, branch prediction,
697bb5530e4SStephan Mueller * etc. with the goal to clear it to get the worst case
698bb5530e4SStephan Mueller * measurements.
699bb5530e4SStephan Mueller */
70036c25011SMilan Djurovic if (i < CLEARCACHE)
701bb5530e4SStephan Mueller continue;
702bb5530e4SStephan Mueller
703d9d67c87SStephan Müller if (stuck)
704d9d67c87SStephan Müller count_stuck++;
705764428feSStephan Müller else {
706764428feSStephan Müller nonstuck++;
707764428feSStephan Müller
708764428feSStephan Müller /*
709764428feSStephan Müller * Ensure that the APT succeeded.
710764428feSStephan Müller *
711764428feSStephan Müller * With the check below that count_stuck must be less
712764428feSStephan Müller * than 10% of the overall generated raw entropy values
713764428feSStephan Müller * it is guaranteed that the APT is invoked at
714764428feSStephan Müller * floor((TESTLOOPCOUNT * 0.9) / 64) == 14 times.
715764428feSStephan Müller */
716764428feSStephan Müller if ((nonstuck % JENT_APT_WINDOW_SIZE) == 0) {
717764428feSStephan Müller jent_apt_reset(&ec,
718764428feSStephan Müller delta & JENT_APT_WORD_MASK);
719764428feSStephan Müller }
720764428feSStephan Müller }
721764428feSStephan Müller
722d2365976SStephan Müller /* Validate health test result */
723d2365976SStephan Müller if (jent_health_failure(&ec))
724d2365976SStephan Müller return JENT_EHEALTH;
725d9d67c87SStephan Müller
726bb5530e4SStephan Mueller /* test whether we have an increasing timer */
727bb5530e4SStephan Mueller if (!(time2 > time))
728bb5530e4SStephan Mueller time_backwards++;
729bb5530e4SStephan Mueller
730d9d67c87SStephan Müller /* use 32 bit value to ensure compilation on 32 bit arches */
731bb5530e4SStephan Mueller lowdelta = time2 - time;
732bb5530e4SStephan Mueller if (!(lowdelta % 100))
733bb5530e4SStephan Mueller count_mod++;
734bb5530e4SStephan Mueller
735bb5530e4SStephan Mueller /*
736bb5530e4SStephan Mueller * ensure that we have a varying delta timer which is necessary
737bb5530e4SStephan Mueller * for the calculation of entropy -- perform this check
738bb5530e4SStephan Mueller * only after the first loop is executed as we need to prime
739bb5530e4SStephan Mueller * the old_data value
740bb5530e4SStephan Mueller */
741bb5530e4SStephan Mueller if (delta > old_delta)
742bb5530e4SStephan Mueller delta_sum += (delta - old_delta);
743bb5530e4SStephan Mueller else
744bb5530e4SStephan Mueller delta_sum += (old_delta - delta);
745bb5530e4SStephan Mueller old_delta = delta;
746bb5530e4SStephan Mueller }
747bb5530e4SStephan Mueller
748bb5530e4SStephan Mueller /*
749bb5530e4SStephan Mueller * we allow up to three times the time running backwards.
750bb5530e4SStephan Mueller * CLOCK_REALTIME is affected by adjtime and NTP operations. Thus,
751bb5530e4SStephan Mueller * if such an operation just happens to interfere with our test, it
752bb5530e4SStephan Mueller * should not fail. The value of 3 should cover the NTP case being
753bb5530e4SStephan Mueller * performed during our test run.
754bb5530e4SStephan Mueller */
75536c25011SMilan Djurovic if (time_backwards > 3)
756bb5530e4SStephan Mueller return JENT_ENOMONOTONIC;
757bb5530e4SStephan Mueller
758bb5530e4SStephan Mueller /*
759bb5530e4SStephan Mueller * Variations of deltas of time must on average be larger
760bb5530e4SStephan Mueller * than 1 to ensure the entropy estimation
761bb5530e4SStephan Mueller * implied with 1 is preserved
762bb5530e4SStephan Mueller */
763d9d67c87SStephan Müller if ((delta_sum) <= 1)
764d9d67c87SStephan Müller return JENT_EVARVAR;
765bb5530e4SStephan Mueller
766bb5530e4SStephan Mueller /*
767bb5530e4SStephan Mueller * Ensure that we have variations in the time stamp below 10 for at
768d9d67c87SStephan Müller * least 10% of all checks -- on some platforms, the counter increments
769d9d67c87SStephan Müller * in multiples of 100, but not always
770bb5530e4SStephan Mueller */
771bb5530e4SStephan Mueller if ((TESTLOOPCOUNT/10 * 9) < count_mod)
772bb5530e4SStephan Mueller return JENT_ECOARSETIME;
773bb5530e4SStephan Mueller
774d9d67c87SStephan Müller /*
775d9d67c87SStephan Müller * If we have more than 90% stuck results, then this Jitter RNG is
776d9d67c87SStephan Müller * likely to not work well.
777d9d67c87SStephan Müller */
778d9d67c87SStephan Müller if ((TESTLOOPCOUNT/10 * 9) < count_stuck)
779d9d67c87SStephan Müller return JENT_ESTUCK;
780d9d67c87SStephan Müller
781bb5530e4SStephan Mueller return 0;
782bb5530e4SStephan Mueller }
783