1 /* 2 * Non-physical true random number generator based on timing jitter -- 3 * Jitter RNG standalone code. 4 * 5 * Copyright Stephan Mueller <smueller@chronox.de>, 2015 - 2023 6 * 7 * Design 8 * ====== 9 * 10 * See https://www.chronox.de/jent.html 11 * 12 * License 13 * ======= 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, and the entire permission notice in its entirety, 20 * including the disclaimer of warranties. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 3. The name of the author may not be used to endorse or promote 25 * products derived from this software without specific prior 26 * written permission. 27 * 28 * ALTERNATIVELY, this product may be distributed under the terms of 29 * the GNU General Public License, in which case the provisions of the GPL2 are 30 * required INSTEAD OF the above restrictions. (This clause is 31 * necessary due to a potential bad interaction between the GPL and 32 * the restrictions contained in a BSD-style copyright.) 33 * 34 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 35 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 36 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF 37 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE 38 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 39 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 40 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 41 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 42 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 43 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 44 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH 45 * DAMAGE. 46 */ 47 48 /* 49 * This Jitterentropy RNG is based on the jitterentropy library 50 * version 3.4.0 provided at https://www.chronox.de/jent.html 51 */ 52 53 #ifdef __OPTIMIZE__ 54 #error "The CPU Jitter random number generator must not be compiled with optimizations. See documentation. Use the compiler switch -O0 for compiling jitterentropy.c." 55 #endif 56 57 typedef unsigned long long __u64; 58 typedef long long __s64; 59 typedef unsigned int __u32; 60 typedef unsigned char u8; 61 #define NULL ((void *) 0) 62 63 /* The entropy pool */ 64 struct rand_data { 65 /* SHA3-256 is used as conditioner */ 66 #define DATA_SIZE_BITS 256 67 /* all data values that are vital to maintain the security 68 * of the RNG are marked as SENSITIVE. A user must not 69 * access that information while the RNG executes its loops to 70 * calculate the next random value. */ 71 void *hash_state; /* SENSITIVE hash state entropy pool */ 72 __u64 prev_time; /* SENSITIVE Previous time stamp */ 73 __u64 last_delta; /* SENSITIVE stuck test */ 74 __s64 last_delta2; /* SENSITIVE stuck test */ 75 unsigned int osr; /* Oversample rate */ 76 #define JENT_MEMORY_BLOCKS 64 77 #define JENT_MEMORY_BLOCKSIZE 32 78 #define JENT_MEMORY_ACCESSLOOPS 128 79 #define JENT_MEMORY_SIZE (JENT_MEMORY_BLOCKS*JENT_MEMORY_BLOCKSIZE) 80 unsigned char *mem; /* Memory access location with size of 81 * memblocks * memblocksize */ 82 unsigned int memlocation; /* Pointer to byte in *mem */ 83 unsigned int memblocks; /* Number of memory blocks in *mem */ 84 unsigned int memblocksize; /* Size of one memory block in bytes */ 85 unsigned int memaccessloops; /* Number of memory accesses per random 86 * bit generation */ 87 88 /* Repetition Count Test */ 89 unsigned int rct_count; /* Number of stuck values */ 90 91 /* Intermittent health test failure threshold of 2^-30 */ 92 /* From an SP800-90B perspective, this RCT cutoff value is equal to 31. */ 93 /* However, our RCT implementation starts at 1, so we subtract 1 here. */ 94 #define JENT_RCT_CUTOFF (31 - 1) /* Taken from SP800-90B sec 4.4.1 */ 95 #define JENT_APT_CUTOFF 325 /* Taken from SP800-90B sec 4.4.2 */ 96 /* Permanent health test failure threshold of 2^-60 */ 97 /* From an SP800-90B perspective, this RCT cutoff value is equal to 61. */ 98 /* However, our RCT implementation starts at 1, so we subtract 1 here. */ 99 #define JENT_RCT_CUTOFF_PERMANENT (61 - 1) 100 #define JENT_APT_CUTOFF_PERMANENT 355 101 #define JENT_APT_WINDOW_SIZE 512 /* Data window size */ 102 /* LSB of time stamp to process */ 103 #define JENT_APT_LSB 16 104 #define JENT_APT_WORD_MASK (JENT_APT_LSB - 1) 105 unsigned int apt_observations; /* Number of collected observations */ 106 unsigned int apt_count; /* APT counter */ 107 unsigned int apt_base; /* APT base reference */ 108 unsigned int apt_base_set:1; /* APT base reference set? */ 109 }; 110 111 /* Flags that can be used to initialize the RNG */ 112 #define JENT_DISABLE_MEMORY_ACCESS (1<<2) /* Disable memory access for more 113 * entropy, saves MEMORY_SIZE RAM for 114 * entropy collector */ 115 116 /* -- error codes for init function -- */ 117 #define JENT_ENOTIME 1 /* Timer service not available */ 118 #define JENT_ECOARSETIME 2 /* Timer too coarse for RNG */ 119 #define JENT_ENOMONOTONIC 3 /* Timer is not monotonic increasing */ 120 #define JENT_EVARVAR 5 /* Timer does not produce variations of 121 * variations (2nd derivation of time is 122 * zero). */ 123 #define JENT_ESTUCK 8 /* Too many stuck results during init. */ 124 #define JENT_EHEALTH 9 /* Health test failed during initialization */ 125 126 /* 127 * The output n bits can receive more than n bits of min entropy, of course, 128 * but the fixed output of the conditioning function can only asymptotically 129 * approach the output size bits of min entropy, not attain that bound. Random 130 * maps will tend to have output collisions, which reduces the creditable 131 * output entropy (that is what SP 800-90B Section 3.1.5.1.2 attempts to bound). 132 * 133 * The value "64" is justified in Appendix A.4 of the current 90C draft, 134 * and aligns with NIST's in "epsilon" definition in this document, which is 135 * that a string can be considered "full entropy" if you can bound the min 136 * entropy in each bit of output to at least 1-epsilon, where epsilon is 137 * required to be <= 2^(-32). 138 */ 139 #define JENT_ENTROPY_SAFETY_FACTOR 64 140 141 #include <linux/fips.h> 142 #include "jitterentropy.h" 143 144 /*************************************************************************** 145 * Adaptive Proportion Test 146 * 147 * This test complies with SP800-90B section 4.4.2. 148 ***************************************************************************/ 149 150 /* 151 * Reset the APT counter 152 * 153 * @ec [in] Reference to entropy collector 154 */ 155 static void jent_apt_reset(struct rand_data *ec, unsigned int delta_masked) 156 { 157 /* Reset APT counter */ 158 ec->apt_count = 0; 159 ec->apt_base = delta_masked; 160 ec->apt_observations = 0; 161 } 162 163 /* 164 * Insert a new entropy event into APT 165 * 166 * @ec [in] Reference to entropy collector 167 * @delta_masked [in] Masked time delta to process 168 */ 169 static void jent_apt_insert(struct rand_data *ec, unsigned int delta_masked) 170 { 171 /* Initialize the base reference */ 172 if (!ec->apt_base_set) { 173 ec->apt_base = delta_masked; 174 ec->apt_base_set = 1; 175 return; 176 } 177 178 if (delta_masked == ec->apt_base) 179 ec->apt_count++; 180 181 ec->apt_observations++; 182 183 if (ec->apt_observations >= JENT_APT_WINDOW_SIZE) 184 jent_apt_reset(ec, delta_masked); 185 } 186 187 /* APT health test failure detection */ 188 static int jent_apt_permanent_failure(struct rand_data *ec) 189 { 190 return (ec->apt_count >= JENT_APT_CUTOFF_PERMANENT) ? 1 : 0; 191 } 192 193 static int jent_apt_failure(struct rand_data *ec) 194 { 195 return (ec->apt_count >= JENT_APT_CUTOFF) ? 1 : 0; 196 } 197 198 /*************************************************************************** 199 * Stuck Test and its use as Repetition Count Test 200 * 201 * The Jitter RNG uses an enhanced version of the Repetition Count Test 202 * (RCT) specified in SP800-90B section 4.4.1. Instead of counting identical 203 * back-to-back values, the input to the RCT is the counting of the stuck 204 * values during the generation of one Jitter RNG output block. 205 * 206 * The RCT is applied with an alpha of 2^{-30} compliant to FIPS 140-2 IG 9.8. 207 * 208 * During the counting operation, the Jitter RNG always calculates the RCT 209 * cut-off value of C. If that value exceeds the allowed cut-off value, 210 * the Jitter RNG output block will be calculated completely but discarded at 211 * the end. The caller of the Jitter RNG is informed with an error code. 212 ***************************************************************************/ 213 214 /* 215 * Repetition Count Test as defined in SP800-90B section 4.4.1 216 * 217 * @ec [in] Reference to entropy collector 218 * @stuck [in] Indicator whether the value is stuck 219 */ 220 static void jent_rct_insert(struct rand_data *ec, int stuck) 221 { 222 if (stuck) { 223 ec->rct_count++; 224 } else { 225 /* Reset RCT */ 226 ec->rct_count = 0; 227 } 228 } 229 230 static inline __u64 jent_delta(__u64 prev, __u64 next) 231 { 232 #define JENT_UINT64_MAX (__u64)(~((__u64) 0)) 233 return (prev < next) ? (next - prev) : 234 (JENT_UINT64_MAX - prev + 1 + next); 235 } 236 237 /* 238 * Stuck test by checking the: 239 * 1st derivative of the jitter measurement (time delta) 240 * 2nd derivative of the jitter measurement (delta of time deltas) 241 * 3rd derivative of the jitter measurement (delta of delta of time deltas) 242 * 243 * All values must always be non-zero. 244 * 245 * @ec [in] Reference to entropy collector 246 * @current_delta [in] Jitter time delta 247 * 248 * @return 249 * 0 jitter measurement not stuck (good bit) 250 * 1 jitter measurement stuck (reject bit) 251 */ 252 static int jent_stuck(struct rand_data *ec, __u64 current_delta) 253 { 254 __u64 delta2 = jent_delta(ec->last_delta, current_delta); 255 __u64 delta3 = jent_delta(ec->last_delta2, delta2); 256 257 ec->last_delta = current_delta; 258 ec->last_delta2 = delta2; 259 260 /* 261 * Insert the result of the comparison of two back-to-back time 262 * deltas. 263 */ 264 jent_apt_insert(ec, current_delta); 265 266 if (!current_delta || !delta2 || !delta3) { 267 /* RCT with a stuck bit */ 268 jent_rct_insert(ec, 1); 269 return 1; 270 } 271 272 /* RCT with a non-stuck bit */ 273 jent_rct_insert(ec, 0); 274 275 return 0; 276 } 277 278 /* RCT health test failure detection */ 279 static int jent_rct_permanent_failure(struct rand_data *ec) 280 { 281 return (ec->rct_count >= JENT_RCT_CUTOFF_PERMANENT) ? 1 : 0; 282 } 283 284 static int jent_rct_failure(struct rand_data *ec) 285 { 286 return (ec->rct_count >= JENT_RCT_CUTOFF) ? 1 : 0; 287 } 288 289 /* Report of health test failures */ 290 static int jent_health_failure(struct rand_data *ec) 291 { 292 return jent_rct_failure(ec) | jent_apt_failure(ec); 293 } 294 295 static int jent_permanent_health_failure(struct rand_data *ec) 296 { 297 return jent_rct_permanent_failure(ec) | jent_apt_permanent_failure(ec); 298 } 299 300 /*************************************************************************** 301 * Noise sources 302 ***************************************************************************/ 303 304 /* 305 * Update of the loop count used for the next round of 306 * an entropy collection. 307 * 308 * Input: 309 * @bits is the number of low bits of the timer to consider 310 * @min is the number of bits we shift the timer value to the right at 311 * the end to make sure we have a guaranteed minimum value 312 * 313 * @return Newly calculated loop counter 314 */ 315 static __u64 jent_loop_shuffle(unsigned int bits, unsigned int min) 316 { 317 __u64 time = 0; 318 __u64 shuffle = 0; 319 unsigned int i = 0; 320 unsigned int mask = (1<<bits) - 1; 321 322 jent_get_nstime(&time); 323 324 /* 325 * We fold the time value as much as possible to ensure that as many 326 * bits of the time stamp are included as possible. 327 */ 328 for (i = 0; ((DATA_SIZE_BITS + bits - 1) / bits) > i; i++) { 329 shuffle ^= time & mask; 330 time = time >> bits; 331 } 332 333 /* 334 * We add a lower boundary value to ensure we have a minimum 335 * RNG loop count. 336 */ 337 return (shuffle + (1<<min)); 338 } 339 340 /* 341 * CPU Jitter noise source -- this is the noise source based on the CPU 342 * execution time jitter 343 * 344 * This function injects the individual bits of the time value into the 345 * entropy pool using a hash. 346 * 347 * ec [in] entropy collector 348 * time [in] time stamp to be injected 349 * stuck [in] Is the time stamp identified as stuck? 350 * 351 * Output: 352 * updated hash context in the entropy collector or error code 353 */ 354 static int jent_condition_data(struct rand_data *ec, __u64 time, int stuck) 355 { 356 #define SHA3_HASH_LOOP (1<<3) 357 struct { 358 int rct_count; 359 unsigned int apt_observations; 360 unsigned int apt_count; 361 unsigned int apt_base; 362 } addtl = { 363 ec->rct_count, 364 ec->apt_observations, 365 ec->apt_count, 366 ec->apt_base 367 }; 368 369 return jent_hash_time(ec->hash_state, time, (u8 *)&addtl, sizeof(addtl), 370 SHA3_HASH_LOOP, stuck); 371 } 372 373 /* 374 * Memory Access noise source -- this is a noise source based on variations in 375 * memory access times 376 * 377 * This function performs memory accesses which will add to the timing 378 * variations due to an unknown amount of CPU wait states that need to be 379 * added when accessing memory. The memory size should be larger than the L1 380 * caches as outlined in the documentation and the associated testing. 381 * 382 * The L1 cache has a very high bandwidth, albeit its access rate is usually 383 * slower than accessing CPU registers. Therefore, L1 accesses only add minimal 384 * variations as the CPU has hardly to wait. Starting with L2, significant 385 * variations are added because L2 typically does not belong to the CPU any more 386 * and therefore a wider range of CPU wait states is necessary for accesses. 387 * L3 and real memory accesses have even a wider range of wait states. However, 388 * to reliably access either L3 or memory, the ec->mem memory must be quite 389 * large which is usually not desirable. 390 * 391 * @ec [in] Reference to the entropy collector with the memory access data -- if 392 * the reference to the memory block to be accessed is NULL, this noise 393 * source is disabled 394 * @loop_cnt [in] if a value not equal to 0 is set, use the given value 395 * number of loops to perform the LFSR 396 */ 397 static void jent_memaccess(struct rand_data *ec, __u64 loop_cnt) 398 { 399 unsigned int wrap = 0; 400 __u64 i = 0; 401 #define MAX_ACC_LOOP_BIT 7 402 #define MIN_ACC_LOOP_BIT 0 403 __u64 acc_loop_cnt = 404 jent_loop_shuffle(MAX_ACC_LOOP_BIT, MIN_ACC_LOOP_BIT); 405 406 if (NULL == ec || NULL == ec->mem) 407 return; 408 wrap = ec->memblocksize * ec->memblocks; 409 410 /* 411 * testing purposes -- allow test app to set the counter, not 412 * needed during runtime 413 */ 414 if (loop_cnt) 415 acc_loop_cnt = loop_cnt; 416 417 for (i = 0; i < (ec->memaccessloops + acc_loop_cnt); i++) { 418 unsigned char *tmpval = ec->mem + ec->memlocation; 419 /* 420 * memory access: just add 1 to one byte, 421 * wrap at 255 -- memory access implies read 422 * from and write to memory location 423 */ 424 *tmpval = (*tmpval + 1) & 0xff; 425 /* 426 * Addition of memblocksize - 1 to pointer 427 * with wrap around logic to ensure that every 428 * memory location is hit evenly 429 */ 430 ec->memlocation = ec->memlocation + ec->memblocksize - 1; 431 ec->memlocation = ec->memlocation % wrap; 432 } 433 } 434 435 /*************************************************************************** 436 * Start of entropy processing logic 437 ***************************************************************************/ 438 /* 439 * This is the heart of the entropy generation: calculate time deltas and 440 * use the CPU jitter in the time deltas. The jitter is injected into the 441 * entropy pool. 442 * 443 * WARNING: ensure that ->prev_time is primed before using the output 444 * of this function! This can be done by calling this function 445 * and not using its result. 446 * 447 * @ec [in] Reference to entropy collector 448 * 449 * @return result of stuck test 450 */ 451 static int jent_measure_jitter(struct rand_data *ec) 452 { 453 __u64 time = 0; 454 __u64 current_delta = 0; 455 int stuck; 456 457 /* Invoke one noise source before time measurement to add variations */ 458 jent_memaccess(ec, 0); 459 460 /* 461 * Get time stamp and calculate time delta to previous 462 * invocation to measure the timing variations 463 */ 464 jent_get_nstime(&time); 465 current_delta = jent_delta(ec->prev_time, time); 466 ec->prev_time = time; 467 468 /* Check whether we have a stuck measurement. */ 469 stuck = jent_stuck(ec, current_delta); 470 471 /* Now call the next noise sources which also injects the data */ 472 if (jent_condition_data(ec, current_delta, stuck)) 473 stuck = 1; 474 475 return stuck; 476 } 477 478 /* 479 * Generator of one 64 bit random number 480 * Function fills rand_data->hash_state 481 * 482 * @ec [in] Reference to entropy collector 483 */ 484 static void jent_gen_entropy(struct rand_data *ec) 485 { 486 unsigned int k = 0, safety_factor = 0; 487 488 if (fips_enabled) 489 safety_factor = JENT_ENTROPY_SAFETY_FACTOR; 490 491 /* priming of the ->prev_time value */ 492 jent_measure_jitter(ec); 493 494 while (!jent_health_failure(ec)) { 495 /* If a stuck measurement is received, repeat measurement */ 496 if (jent_measure_jitter(ec)) 497 continue; 498 499 /* 500 * We multiply the loop value with ->osr to obtain the 501 * oversampling rate requested by the caller 502 */ 503 if (++k >= ((DATA_SIZE_BITS + safety_factor) * ec->osr)) 504 break; 505 } 506 } 507 508 /* 509 * Entry function: Obtain entropy for the caller. 510 * 511 * This function invokes the entropy gathering logic as often to generate 512 * as many bytes as requested by the caller. The entropy gathering logic 513 * creates 64 bit per invocation. 514 * 515 * This function truncates the last 64 bit entropy value output to the exact 516 * size specified by the caller. 517 * 518 * @ec [in] Reference to entropy collector 519 * @data [in] pointer to buffer for storing random data -- buffer must already 520 * exist 521 * @len [in] size of the buffer, specifying also the requested number of random 522 * in bytes 523 * 524 * @return 0 when request is fulfilled or an error 525 * 526 * The following error codes can occur: 527 * -1 entropy_collector is NULL or the generation failed 528 * -2 Intermittent health failure 529 * -3 Permanent health failure 530 */ 531 int jent_read_entropy(struct rand_data *ec, unsigned char *data, 532 unsigned int len) 533 { 534 unsigned char *p = data; 535 536 if (!ec) 537 return -1; 538 539 while (len > 0) { 540 unsigned int tocopy; 541 542 jent_gen_entropy(ec); 543 544 if (jent_permanent_health_failure(ec)) { 545 /* 546 * At this point, the Jitter RNG instance is considered 547 * as a failed instance. There is no rerun of the 548 * startup test any more, because the caller 549 * is assumed to not further use this instance. 550 */ 551 return -3; 552 } else if (jent_health_failure(ec)) { 553 /* 554 * Perform startup health tests and return permanent 555 * error if it fails. 556 */ 557 if (jent_entropy_init(ec->hash_state)) 558 return -3; 559 560 return -2; 561 } 562 563 if ((DATA_SIZE_BITS / 8) < len) 564 tocopy = (DATA_SIZE_BITS / 8); 565 else 566 tocopy = len; 567 if (jent_read_random_block(ec->hash_state, p, tocopy)) 568 return -1; 569 570 len -= tocopy; 571 p += tocopy; 572 } 573 574 return 0; 575 } 576 577 /*************************************************************************** 578 * Initialization logic 579 ***************************************************************************/ 580 581 struct rand_data *jent_entropy_collector_alloc(unsigned int osr, 582 unsigned int flags, 583 void *hash_state) 584 { 585 struct rand_data *entropy_collector; 586 587 entropy_collector = jent_zalloc(sizeof(struct rand_data)); 588 if (!entropy_collector) 589 return NULL; 590 591 if (!(flags & JENT_DISABLE_MEMORY_ACCESS)) { 592 /* Allocate memory for adding variations based on memory 593 * access 594 */ 595 entropy_collector->mem = jent_zalloc(JENT_MEMORY_SIZE); 596 if (!entropy_collector->mem) { 597 jent_zfree(entropy_collector); 598 return NULL; 599 } 600 entropy_collector->memblocksize = JENT_MEMORY_BLOCKSIZE; 601 entropy_collector->memblocks = JENT_MEMORY_BLOCKS; 602 entropy_collector->memaccessloops = JENT_MEMORY_ACCESSLOOPS; 603 } 604 605 /* verify and set the oversampling rate */ 606 if (osr == 0) 607 osr = 1; /* minimum sampling rate is 1 */ 608 entropy_collector->osr = osr; 609 610 entropy_collector->hash_state = hash_state; 611 612 /* fill the data pad with non-zero values */ 613 jent_gen_entropy(entropy_collector); 614 615 return entropy_collector; 616 } 617 618 void jent_entropy_collector_free(struct rand_data *entropy_collector) 619 { 620 jent_zfree(entropy_collector->mem); 621 entropy_collector->mem = NULL; 622 jent_zfree(entropy_collector); 623 } 624 625 int jent_entropy_init(void *hash_state) 626 { 627 int i; 628 __u64 delta_sum = 0; 629 __u64 old_delta = 0; 630 unsigned int nonstuck = 0; 631 int time_backwards = 0; 632 int count_mod = 0; 633 int count_stuck = 0; 634 struct rand_data ec = { 0 }; 635 636 /* Required for RCT */ 637 ec.osr = 1; 638 ec.hash_state = hash_state; 639 640 /* We could perform statistical tests here, but the problem is 641 * that we only have a few loop counts to do testing. These 642 * loop counts may show some slight skew and we produce 643 * false positives. 644 * 645 * Moreover, only old systems show potentially problematic 646 * jitter entropy that could potentially be caught here. But 647 * the RNG is intended for hardware that is available or widely 648 * used, but not old systems that are long out of favor. Thus, 649 * no statistical tests. 650 */ 651 652 /* 653 * We could add a check for system capabilities such as clock_getres or 654 * check for CONFIG_X86_TSC, but it does not make much sense as the 655 * following sanity checks verify that we have a high-resolution 656 * timer. 657 */ 658 /* 659 * TESTLOOPCOUNT needs some loops to identify edge systems. 100 is 660 * definitely too little. 661 * 662 * SP800-90B requires at least 1024 initial test cycles. 663 */ 664 #define TESTLOOPCOUNT 1024 665 #define CLEARCACHE 100 666 for (i = 0; (TESTLOOPCOUNT + CLEARCACHE) > i; i++) { 667 __u64 time = 0; 668 __u64 time2 = 0; 669 __u64 delta = 0; 670 unsigned int lowdelta = 0; 671 int stuck; 672 673 /* Invoke core entropy collection logic */ 674 jent_get_nstime(&time); 675 ec.prev_time = time; 676 jent_condition_data(&ec, time, 0); 677 jent_get_nstime(&time2); 678 679 /* test whether timer works */ 680 if (!time || !time2) 681 return JENT_ENOTIME; 682 delta = jent_delta(time, time2); 683 /* 684 * test whether timer is fine grained enough to provide 685 * delta even when called shortly after each other -- this 686 * implies that we also have a high resolution timer 687 */ 688 if (!delta) 689 return JENT_ECOARSETIME; 690 691 stuck = jent_stuck(&ec, delta); 692 693 /* 694 * up to here we did not modify any variable that will be 695 * evaluated later, but we already performed some work. Thus we 696 * already have had an impact on the caches, branch prediction, 697 * etc. with the goal to clear it to get the worst case 698 * measurements. 699 */ 700 if (i < CLEARCACHE) 701 continue; 702 703 if (stuck) 704 count_stuck++; 705 else { 706 nonstuck++; 707 708 /* 709 * Ensure that the APT succeeded. 710 * 711 * With the check below that count_stuck must be less 712 * than 10% of the overall generated raw entropy values 713 * it is guaranteed that the APT is invoked at 714 * floor((TESTLOOPCOUNT * 0.9) / 64) == 14 times. 715 */ 716 if ((nonstuck % JENT_APT_WINDOW_SIZE) == 0) { 717 jent_apt_reset(&ec, 718 delta & JENT_APT_WORD_MASK); 719 } 720 } 721 722 /* Validate health test result */ 723 if (jent_health_failure(&ec)) 724 return JENT_EHEALTH; 725 726 /* test whether we have an increasing timer */ 727 if (!(time2 > time)) 728 time_backwards++; 729 730 /* use 32 bit value to ensure compilation on 32 bit arches */ 731 lowdelta = time2 - time; 732 if (!(lowdelta % 100)) 733 count_mod++; 734 735 /* 736 * ensure that we have a varying delta timer which is necessary 737 * for the calculation of entropy -- perform this check 738 * only after the first loop is executed as we need to prime 739 * the old_data value 740 */ 741 if (delta > old_delta) 742 delta_sum += (delta - old_delta); 743 else 744 delta_sum += (old_delta - delta); 745 old_delta = delta; 746 } 747 748 /* 749 * we allow up to three times the time running backwards. 750 * CLOCK_REALTIME is affected by adjtime and NTP operations. Thus, 751 * if such an operation just happens to interfere with our test, it 752 * should not fail. The value of 3 should cover the NTP case being 753 * performed during our test run. 754 */ 755 if (time_backwards > 3) 756 return JENT_ENOMONOTONIC; 757 758 /* 759 * Variations of deltas of time must on average be larger 760 * than 1 to ensure the entropy estimation 761 * implied with 1 is preserved 762 */ 763 if ((delta_sum) <= 1) 764 return JENT_EVARVAR; 765 766 /* 767 * Ensure that we have variations in the time stamp below 10 for at 768 * least 10% of all checks -- on some platforms, the counter increments 769 * in multiples of 100, but not always 770 */ 771 if ((TESTLOOPCOUNT/10 * 9) < count_mod) 772 return JENT_ECOARSETIME; 773 774 /* 775 * If we have more than 90% stuck results, then this Jitter RNG is 776 * likely to not work well. 777 */ 778 if ((TESTLOOPCOUNT/10 * 9) < count_stuck) 779 return JENT_ESTUCK; 780 781 return 0; 782 } 783