Re: [PATCH] crypto: Jitter RNG - Permanent and Intermittent health errors

From: Herbert Xu <herbert@gondor.apana.org.au>
To: "Stephan Müller" <smueller@chronox.de>
Cc: linux-crypto@vger.kernel.org
Subject: Re: [PATCH] crypto: Jitter RNG - Permanent and Intermittent health errors
Date: Fri, 24 Mar 2023 17:27:37 +0800	[thread overview]
Message-ID: <ZB1tCY3ruqvtWfHS@gondor.apana.org.au> (raw)
In-Reply-To: <12194787.O9o76ZdvQC@positron.chronox.de>

On Thu, Mar 23, 2023 at 08:17:14AM +0100, Stephan Müller wrote:
>
> @@ -138,29 +139,35 @@ static int jent_kcapi_random(struct crypto_rng *tfm,
>  
>  	spin_lock(&rng->jent_lock);
>  
> -	/* Return a permanent error in case we had too many resets in a row. */
> -	if (rng->reset_cnt > (1<<10)) {
> +	/* Enforce a disabled entropy source. */
> +	if (rng->disabled) {
>  		ret = -EFAULT;
>  		goto out;
>  	}

Can we please get rid of this completely when we're not in FIPS 
mode? Remember that jent is now used by all kernel users through
drbg.  Having it fail permanently in this fashion is unacceptable.

If we're not in FIPS mode it should simply carry on or at least
seek another source of entropy, perhaps from the kernel RNG.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt