2  * Non-physical true random number generator based on timing jitter --
5  * Copyright Stephan Mueller <smueller@chronox.de>, 2015 - 2020
21  * 2. Redistributions in binary form must reproduce the above copyright
32  * the restrictions contained in a BSD-style copyright.)
54 … be compiled with optimizations. See documentation. Use the compiler switch -O0 for compiling jitt…
90 	/* Adaptive Proportion Test for a significance level of 2^-30 */
91 #define JENT_APT_CUTOFF		325	/* Taken from SP800-90B sec 4.4.2 */
95 #define JENT_APT_WORD_MASK	(JENT_APT_LSB - 1)
105 #define JENT_DISABLE_MEMORY_ACCESS (1<<2) /* Disable memory access for more
109 /* -- error codes for init function -- */
111 #define JENT_ECOARSETIME	2 /* Timer too coarse for RNG */
114 				   * variations (2nd derivation of time is
125  * This test complies with SP800-90B section 4.4.2.
136 	ec->apt_count = 0;  in jent_apt_reset()
137 	ec->apt_base = delta_masked;  in jent_apt_reset()
138 	ec->apt_observations = 0;  in jent_apt_reset()
150 	if (!ec->apt_base_set) {  in jent_apt_insert()
151 		ec->apt_base = delta_masked;  in jent_apt_insert()
152 		ec->apt_base_set = 1;  in jent_apt_insert()
156 	if (delta_masked == ec->apt_base) {  in jent_apt_insert()
157 		ec->apt_count++;  in jent_apt_insert()
159 		if (ec->apt_count >= JENT_APT_CUTOFF)  in jent_apt_insert()
160 			ec->health_failure = 1;  in jent_apt_insert()
163 	ec->apt_observations++;  in jent_apt_insert()
165 	if (ec->apt_observations >= JENT_APT_WINDOW_SIZE)  in jent_apt_insert()
173  * (RCT) specified in SP800-90B section 4.4.1. Instead of counting identical
174  * back-to-back values, the input to the RCT is the counting of the stuck
177  * The RCT is applied with an alpha of 2^{-30} compliant to FIPS 140-2 IG 9.8.
180  * cut-off value of C. If that value exceeds the allowed cut-off value,
186  * Repetition Count Test as defined in SP800-90B section 4.4.1
197 	if (ec->rct_count < 0)  in jent_rct_insert()
201 		ec->rct_count++;  in jent_rct_insert()
205 		 * alpha = 2^-30 as recommended in FIPS 140-2 IG 9.8.  in jent_rct_insert()
212 		 * Note, ec->rct_count (which equals to value B in the pseudo  in jent_rct_insert()
213 		 * code of SP800-90B section 4.4.1) starts with zero. Hence  in jent_rct_insert()
215 		 * following SP800-90B.  in jent_rct_insert()
217 		if ((unsigned int)ec->rct_count >= (31 * ec->osr)) {  in jent_rct_insert()
218 			ec->rct_count = -1;  in jent_rct_insert()
219 			ec->health_failure = 1;  in jent_rct_insert()
222 		ec->rct_count = 0;  in jent_rct_insert()
237 	if (ec->rct_count < 0)  in jent_rct_failure()
245 	return (prev < next) ? (next - prev) :  in jent_delta()
246 			       (JENT_UINT64_MAX - prev + 1 + next);  in jent_delta()
252  * 	2nd derivative of the jitter measurement (delta of time deltas)
255  * All values must always be non-zero.
266 	__u64 delta2 = jent_delta(ec->last_delta, current_delta);  in jent_stuck()
267 	__u64 delta3 = jent_delta(ec->last_delta2, delta2);  in jent_stuck()
270 	ec->last_delta = current_delta;  in jent_stuck()
271 	ec->last_delta2 = delta2;  in jent_stuck()
274 	 * Insert the result of the comparison of two back-to-back time  in jent_stuck()
285 	/* RCT with a non-stuck bit */  in jent_stuck()
302 	/* Test is only enabled in FIPS mode */  in jent_health_failure()
306 	return ec->health_failure;  in jent_health_failure()
318  * @ec entropy collector struct -- may be NULL
331 	unsigned int mask = (1<<bits) - 1;  in jent_loop_shuffle()
339 		time ^= ec->data;  in jent_loop_shuffle()
344 	for (i = 0; ((DATA_SIZE_BITS + bits - 1) / bits) > i; i++) {  in jent_loop_shuffle()
357  * CPU Jitter noise source -- this is the noise source based on the CPU
377  * updated ec->data
393 	 * testing purposes -- allow test app to set the counter, not  in jent_lfsr_time()
399 		new = ec->data;  in jent_lfsr_time()
401 			__u64 tmp = time << (DATA_SIZE_BITS - i);  in jent_lfsr_time()
403 			tmp = tmp >> (DATA_SIZE_BITS - 1);  in jent_lfsr_time()
429 	 * even when the time stamp has no entropy, SP800-90B requires that  in jent_lfsr_time()
430 	 * any conditioning operation (SP800-90B considers the LFSR to be a  in jent_lfsr_time()
435 		ec->data = new;  in jent_lfsr_time()
439  * Memory Access noise source -- this is a noise source based on variations in
453  * to reliably access either L3 or memory, the ec->mem memory must be quite
456  * @ec [in] Reference to the entropy collector with the memory access data -- if
471 	if (NULL == ec || NULL == ec->mem)  in jent_memaccess()
473 	wrap = ec->memblocksize * ec->memblocks;  in jent_memaccess()
476 	 * testing purposes -- allow test app to set the counter, not  in jent_memaccess()
482 	for (i = 0; i < (ec->memaccessloops + acc_loop_cnt); i++) {  in jent_memaccess()
483 		unsigned char *tmpval = ec->mem + ec->memlocation;  in jent_memaccess()
486 		 * wrap at 255 -- memory access implies read  in jent_memaccess()
491 		 * Addition of memblocksize - 1 to pointer  in jent_memaccess()
495 		ec->memlocation = ec->memlocation + ec->memblocksize - 1;  in jent_memaccess()
496 		ec->memlocation = ec->memlocation % wrap;  in jent_memaccess()
508  * WARNING: ensure that ->prev_time is primed before using the output
530 	current_delta = jent_delta(ec->prev_time, time);  in jent_measure_jitter()
531 	ec->prev_time = time;  in jent_measure_jitter()
544  * Function fills rand_data->data
552 	/* priming of the ->prev_time value */  in jent_gen_entropy()
561 		 * We multiply the loop value with ->osr to obtain the  in jent_gen_entropy()
564 		if (++k >= (DATA_SIZE_BITS * ec->osr))  in jent_gen_entropy()
580  * @data [in] pointer to buffer for storing random data -- buffer must already
588  *	-1	entropy_collector is NULL
589  *	-2	RCT failed
590  *	-3	APT test failed
598 		return -1;  in jent_read_entropy()
609 				ret = -2;  in jent_read_entropy()
611 				ret = -3;  in jent_read_entropy()
614 			 * Re-initialize the noise source  in jent_read_entropy()
625 			ec->apt_base_set = 0;  in jent_read_entropy()
628 			ec->rct_count = 0;  in jent_read_entropy()
630 			/* Re-enable Jitter RNG */  in jent_read_entropy()
631 			ec->health_failure = 0;  in jent_read_entropy()
644 		jent_memcpy(p, &ec->data, tocopy);  in jent_read_entropy()
646 		len -= tocopy;  in jent_read_entropy()
670 		entropy_collector->mem = jent_zalloc(JENT_MEMORY_SIZE);  in jent_entropy_collector_alloc()
671 		if (!entropy_collector->mem) {  in jent_entropy_collector_alloc()
675 		entropy_collector->memblocksize = JENT_MEMORY_BLOCKSIZE;  in jent_entropy_collector_alloc()
676 		entropy_collector->memblocks = JENT_MEMORY_BLOCKS;  in jent_entropy_collector_alloc()
677 		entropy_collector->memaccessloops = JENT_MEMORY_ACCESSLOOPS;  in jent_entropy_collector_alloc()
683 	entropy_collector->osr = osr;  in jent_entropy_collector_alloc()
685 	/* fill the data pad with non-zero values */  in jent_entropy_collector_alloc()
693 	jent_zfree(entropy_collector->mem);  in jent_entropy_collector_free()
694 	entropy_collector->mem = NULL;  in jent_entropy_collector_free()
727 	 * following sanity checks verify that we have a high-resolution  in jent_entropy_init()
734 	 * SP800-90B requires at least 1024 initial test cycles.  in jent_entropy_init()
757 		 * delta even when called shortly after each other -- this  in jent_entropy_init()
805 		lowdelta = time2 - time;  in jent_entropy_init()
811 		 * for the calculation of entropy -- perform this check  in jent_entropy_init()
816 			delta_sum += (delta - old_delta);  in jent_entropy_init()
818 			delta_sum += (old_delta - delta);  in jent_entropy_init()
842 	 * least 10% of all checks -- on some platforms, the counter increments  in jent_entropy_init()