LKML Archive on lore.kernel.org
 help / color / Atom feed
From: "Stephan Müller" <smueller@chronox.de>
To: "Alexander E. Patrakov" <patrakov@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	linux-crypto@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
	linux-api@vger.kernel.org,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	"Ahmed S. Darwish" <darwish.07@gmail.com>,
	"Theodore Y. Ts'o" <tytso@mit.edu>, Willy Tarreau <w@1wt.eu>,
	Matthew Garrett <mjg59@srcf.ucam.org>,
	Vito Caputo <vcaputo@pengaru.com>,
	Andreas Dilger <adilger.kernel@dilger.ca>,
	Jan Kara <jack@suse.cz>, Ray Strode <rstrode@redhat.com>,
	William Jon McCann <mccann@jhu.edu>,
	zhangjs <zachary@baishancloud.com>,
	Andy Lutomirski <luto@kernel.org>,
	Florian Weimer <fweimer@redhat.com>,
	Lennart Poettering <mzxreary@0pointer.de>,
	Nicolai Stange <nstange@suse.de>,
	"Peter, Matthias" <matthias.peter@bsi.bund.de>,
	Marcelo Henrique Cerri <marcelo.cerri@canonical.com>,
	Roman Drahtmueller <draht@schaltsekun.de>,
	Neil Horman <nhorman@redhat.com>
Subject: Re: [PATCH v24 11/12] LRNG - add SP800-90B compliant health tests
Date: Wed, 13 Nov 2019 00:11:19 +0100
Message-ID: <27134768.kErlRdRglt@positron.chronox.de> (raw)
In-Reply-To: <556c89ae-4272-970d-1644-cb77dc3c7946@gmail.com>

Am Dienstag, 12. November 2019, 20:58:32 CET schrieb Alexander E. Patrakov:

Hi Alexander,

> 11.11.2019 23:26, Stephan Müller пишет:
> > Implement health tests for LRNG's slow noise sources as mandated by
> > SP-800-90B The file contains the following health tests:
> > 
> > - stuck test: The stuck test calculates the first, second and third
> > 
> >    discrete derivative of the time stamp to be processed by the LFSR.
> >    Only if all three values are zero, the received time delta is
> >    considered to be non-stuck.
> 
> The other way round?

Opps, yes, of course. If all three a non-zero...

Fixed.
> 
> > - SP800-90B Repetition Count Test (RCT): The LRNG uses an enhanced
> > 
> >    version of the RCT specified in SP800-90B section 4.4.1. Instead of
> >    counting identical back-to-back values, the input to the RCT is the
> >    counting of the stuck values during the processing of received
> >    interrupt events. The RCT is applied with alpha=2^-30 compliant to
> >    the recommendation of FIPS 140-2 IG 9.8. During the counting operation,
> >    the LRNG always calculates the RCT cut-off value of C. If that value
> >    exceeds the allowed cut-off value, the LRNG will trigger the health
> >    test failure discussed below. An error is logged to the kernel log
> >    that such RCT failure occurred. This test is only applied and
> >    enforced in FIPS mode, i.e. when the kernel compiled with
> >    CONFIG_CONFIG_FIPS is started with fips=1.
> > 
> > - SP800-90B Adaptive Proportion Test (APT): The LRNG implements the
> > 
> >    APT as defined in SP800-90B section 4.4.2. The assumed
> 
> The sentence ends in the middle.

Fixed:

"""
SP800-90B Adaptive Proportion Test (APT): The LRNG implements the
  APT as defined in SP800-90B section 4.4.2. The applied significance
  level again is alpha=2^-30 compliant to the recommendation of FIPS 
  140-2 IG 9.8.
"""

> 
> > The aforementioned health tests are applied to the first 1,024 time stamps
> > obtained from interrupt events. In case one error is identified for either
> > the RCT, or the APT, the collected entropy is invalidated and the
> > SP800-90B startup health test is restarted.
> > 
> > As long as the SP800-90B startup health test is not completed, all LRNG
> > random number output interfaces that may block will block and not generate
> > any data. This implies that only those potentially blocking interfaces are
> > defined to provide random numbers that are seeded with the interrupt noise
> > source being SP800-90B compliant. All other output interfaces will not be
> > affected by the SP800-90B startup test and thus are not considered
> > SP800-90B compliant.
> > 
> > At runtime, the SP800-90B APT and RCT are applied to each time stamp
> > generated for a received interrupt. When either the APT and RCT indicates
> > a noise source failure, the LRNG is reset to a state it has immediately
> > after boot:
> > 
> > - all entropy counters are set to zero
> > 
> > - the SP800-90B startup tests are re-performed which implies that
> > getrandom(2) would block again until new entropy was collected
> > 
> > To summarize, the following rules apply:
> > 
> > • SP800-90B compliant output interfaces
> > 
> >    - /dev/random
> >    
> >    - getrandom(2) system call
> >    
> >    -  get_random_bytes kernel-internal interface when being triggered by
> >    
> >       the callback registered with add_random_ready_callback
> > 
> > • SP800-90B non-compliant output interfaces
> > 
> >    - /dev/urandom
> >    
> >    - get_random_bytes kernel-internal interface called directly
> >    
> >    - randomize_page kernel-internal interface
> >    
> >    - get_random_u32 and get_random_u64 kernel-internal interfaces
> >    
> >    - get_random_u32_wait, get_random_u64_wait, get_random_int_wait, and
> >    
> >      get_random_long_wait kernel-internal interfaces
> > 
> > If either the RCT, or the APT health test fails irrespective whether
> > 
> > during initialization or runtime, the following actions occur:
> >    1. The entropy of the entire entropy pool is invalidated.
> >    
> >    2. The primary and all secondary DRNGs are reset which imply that they
> >    
> >       are treated as being not seeded and require a reseed during next
> >       invocation.
> >    
> >    3. The SP800-90B startup health test are initiated with all
> >    
> >       implications of the startup tests. That implies that from that point
> >       on, new events must be observed and its entropy must be inserted
> >       into
> >       the entropy pool before random numbers are calculated from the
> >       entropy pool.
> > 
> > Further details on the SP800-90B compliance and the availability of all
> > test tools required to perform all tests mandated by SP800-90B are
> > provided at [1].
> > 
> > The entire health testing code is compile-time configurable.
> > 
> > CC: "Eric W. Biederman" <ebiederm@xmission.com>
> > CC: "Alexander E. Patrakov" <patrakov@gmail.com>
> > CC: "Ahmed S. Darwish" <darwish.07@gmail.com>
> > CC: "Theodore Y. Ts'o" <tytso@mit.edu>
> > CC: Willy Tarreau <w@1wt.eu>
> > CC: Matthew Garrett <mjg59@srcf.ucam.org>
> > CC: Vito Caputo <vcaputo@pengaru.com>
> > CC: Andreas Dilger <adilger.kernel@dilger.ca>
> > CC: Jan Kara <jack@suse.cz>
> > CC: Ray Strode <rstrode@redhat.com>
> > CC: William Jon McCann <mccann@jhu.edu>
> > CC: zhangjs <zachary@baishancloud.com>
> > CC: Andy Lutomirski <luto@kernel.org>
> > CC: Florian Weimer <fweimer@redhat.com>
> > CC: Lennart Poettering <mzxreary@0pointer.de>
> > CC: Nicolai Stange <nstange@suse.de>
> > Reviewed-by: Roman Drahtmueller <draht@schaltsekun.de>
> > Tested-by: Roman Drahtmüller <draht@schaltsekun.de>
> > Tested-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
> > Tested-by: Neil Horman <nhorman@redhat.com>
> > Signed-off-by: Stephan Mueller <smueller@chronox.de>
> > ---
> > 
> >   drivers/char/lrng/Kconfig       |  13 +
> >   drivers/char/lrng/Makefile      |   1 +
> >   drivers/char/lrng/lrng_health.c | 424 ++++++++++++++++++++++++++++++++
> >   3 files changed, 438 insertions(+)
> >   create mode 100644 drivers/char/lrng/lrng_health.c
> > 
> > diff --git a/drivers/char/lrng/Kconfig b/drivers/char/lrng/Kconfig
> > index efc5f9aaa2a3..4373a1a19538 100644
> > --- a/drivers/char/lrng/Kconfig
> > +++ b/drivers/char/lrng/Kconfig
> > @@ -113,4 +113,17 @@ config LRNG_TRNG_SUPPORT
> > 
> >   	  With the TRNG support the /dev/random device will block
> >   	  if insufficient entropy is available.
> > 
> > +config LRNG_HEALTH_TESTS
> > +	bool "Enable noise source online health tests"
> > +	help
> > +	  The online health tests validate the noise source at
> > +	  runtime for fatal errors. These tests include SP800-90B
> > +	  compliant tests which are invoked if the system is booted
> > +	  with fips=1. In case of fatal errors during active
> > +	  SP800-90B tests, the issue is logged and the noise
> > +	  data is discarded. These tests are required for full
> > +	  compliance with SP800-90B.
> 
> How have you tested that these tests work at runtime? Maybe add some
> code under a new CONFIG item that depends on CONFIG_BROKEN that
> deliberately botches the RNG and triggers failures?

I manually broke it for testing as follows: I set the LRNG_APT_CUTOFF to 1 to 
trigger the APT failure and I changed the line 

if (rct_count >= 30) {

to 

if (rct_count >= 1) {

which effectively sets the RCT cutoff value to 1.

Allow me to check how CONFIG_BROKEN really works to see how I can roll this 
test into CONFIG_BROKEN.

Thank you very much for your review.


> 
> > +
> > +	  If unsure, say Y.
> > +
> > 
> >   endif # LRNG
> > 
> > diff --git a/drivers/char/lrng/Makefile b/drivers/char/lrng/Makefile
> > index 1c72bc060bce..0713e9c0aa6e 100644
> > --- a/drivers/char/lrng/Makefile
> > +++ b/drivers/char/lrng/Makefile
> > @@ -15,3 +15,4 @@ obj-$(CONFIG_LRNG_DRBG)		+= lrng_drbg.o
> > 
> >   obj-$(CONFIG_LRNG_KCAPI)	+= lrng_kcapi.o
> >   obj-$(CONFIG_LRNG_JENT)		+= lrng_jent.o
> >   obj-$(CONFIG_LRNG_TRNG_SUPPORT)	+= lrng_trng.o
> > 
> > +obj-$(CONFIG_LRNG_HEALTH_TESTS)	+= lrng_health.o
> > diff --git a/drivers/char/lrng/lrng_health.c
> > b/drivers/char/lrng/lrng_health.c new file mode 100644
> > index 000000000000..b8d96cec1f71
> > --- /dev/null
> > +++ b/drivers/char/lrng/lrng_health.c
> > @@ -0,0 +1,424 @@
> > +// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
> > +/*
> > + * Linux Random Number Generator (LRNG) Health Testing
> > + *
> > + * Copyright (C) 2019, Stephan Mueller <smueller@chronox.de>
> > + *
> > + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
> > + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
> > + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
> > + * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
> > + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
> > + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
> > + * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
> > + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
> > + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
> > + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
> > + * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
> > + * DAMAGE.
> > + */
> > +
> > +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
> > +
> > +#include <linux/fips.h>
> > +#include <linux/module.h>
> > +
> > +#include "lrng_internal.h"
> > +
> > +/* Stuck Test */
> > +struct lrng_stuck_test {
> > +	u32 last_time;		/* Stuck test: time of previous IRQ */
> > +	u32 last_delta;		/* Stuck test: delta of previous IRQ */
> > +	u32 last_delta2;	/* Stuck test: 2. time derivation of prev IRQ */
> > +};
> > +
> > +/* Repetition Count Test */
> > +struct lrng_rct {
> > +	atomic_t rct_count;	/* Number of stuck values */
> > +};
> > +
> > +/* Adaptive Proportion Test */
> > +struct lrng_apt {
> > +	/* Taken from SP800-90B sec 4.4.2 - significance level 2^-30 */
> > +#define LRNG_APT_CUTOFF		325
> > +	/* Data window size */
> > +#define LRNG_APT_WINDOW_SIZE	512
> > +	/* LSB of time stamp to process */
> > +#define LRNG_APT_LSB		16
> > +#define LRNG_APT_WORD_MASK	(LRNG_APT_LSB - 1)
> > +	atomic_t apt_count;		/* APT counter */
> > +	atomic_t apt_base;		/* APT base reference */
> > +
> > +	atomic_t apt_trigger;
> > +	bool apt_base_set;	/* Is APT base set? */
> > +};
> > +
> > +/* The health test code must operate lock-less */
> > +struct lrng_health {
> > +	struct lrng_rct rct;
> > +	struct lrng_apt apt;
> > +
> > +	bool health_test_enabled;
> > +
> > +	/* SP800-90B startup health tests */
> > +#define LRNG_SP80090B_STARTUP_SAMPLES  1024
> > +#define LRNG_SP80090B_STARTUP_BLOCKS   ((LRNG_SP80090B_STARTUP_SAMPLES +
> > \
> > +					 LRNG_APT_WINDOW_SIZE - 1) /    \
> > +					LRNG_APT_WINDOW_SIZE)
> > +	bool sp80090b_startup_done;
> > +	atomic_t sp80090b_startup_blocks;
> > +};
> > +
> > +static struct lrng_health lrng_health = {
> > +	.rct.rct_count = ATOMIC_INIT(0),
> > +
> > +	.apt.apt_count = ATOMIC_INIT(0),
> > +	.apt.apt_base = ATOMIC_INIT(-1),
> > +	.apt.apt_trigger = ATOMIC_INIT(LRNG_APT_WINDOW_SIZE),
> > +	.apt.apt_base_set = false,
> > +
> > +	.health_test_enabled = true,
> > +
> > +	.sp80090b_startup_blocks = ATOMIC_INIT(LRNG_SP80090B_STARTUP_BLOCKS),
> > +	.sp80090b_startup_done = false,
> > +};
> > +
> > +static DEFINE_PER_CPU(struct lrng_stuck_test, lrng_stuck_test);
> > +
> > +static inline bool lrng_sp80090b_health_requested(void)
> > +{
> > +	/* Health tests are only requested in FIPS mode */
> > +	return fips_enabled;
> > +}
> > +
> > +static inline bool lrng_sp80090b_health_enabled(void)
> > +{
> > +	struct lrng_health *health = &lrng_health;
> > +
> > +	return lrng_sp80090b_health_requested() && health->health_test_enabled;
> > +}
> > +
> > +/************************************************************************
> > *** + * SP800-90B Compliance
> > + *
> > + * If the Linux-RNG is booted into FIPS mode, the following interfaces
> > + * provide an SP800-90B compliant noise source:
> > + *
> > + * * /dev/random
> > + * * getrandom(2)
> > + * * get_random_bytes when using it in conjunction with
> > + *   add_random_ready_callback
> > + *
> > + * All other interfaces, including /dev/urandom or get_random_bytes
> > without + * the add_random_ready_callback cannot claim to use an
> > SP800-90B compliant + * noise source.
> > +
> > *************************************************************************
> > **/ +
> > +/**
> > + * Perform SP800-90B startup testing
> > + */
> > +static inline void lrng_sp80090b_startup(struct lrng_health *health)
> > +{
> > +	if (!health->sp80090b_startup_done &&
> > +	    atomic_dec_and_test(&health->sp80090b_startup_blocks)) {
> > +		health->sp80090b_startup_done = true;
> > +		pr_info("SP800-90B startup health tests completed\n");
> > +		lrng_init_ops(0);
> > +
> > +		/*
> > +		 * Force a reseed of secondary DRNGs to ensure they are
> > +		 * seeded with entropy that passed the SP800-90B health tests.
> > +		 * As the primary DRNG always will reseed before generating
> > +		 * random numbers, it does not need a reseed trigger.
> > +		 */
> > +		lrng_sdrng_force_reseed();
> > +	}
> > +}
> > +
> > +/**
> > + * Handle failure of SP800-90B startup testing
> > + */
> > +static inline void lrng_sp80090b_startup_failure(struct lrng_health
> > *health) +{
> > +	/* Reset of LRNG and its entropy - NOTE: we are in atomic context */
> > +	lrng_reset();
> > +
> > +	/*
> > +	 * Reset the SP800-90B startup test.
> > +	 *
> > +	 * NOTE SP800-90B section 4.3 bullet 4 does not specify what
> > +	 * exactly is to be done in case of failure! Thus, we do what
> > +	 * makes sense, i.e. restarting the health test and thus gating
> > +	 * the output function of /dev/random and getrandom(2).
> > +	 */
> > +	atomic_set(&health->sp80090b_startup_blocks,
> > +		   LRNG_SP80090B_STARTUP_BLOCKS);
> > +}
> > +
> > +/**
> > + * Handle failure of SP800-90B runtime testing
> > + */
> > +static inline void lrng_sp80090b_runtime_failure(struct lrng_health
> > *health) +{
> > +	lrng_sp80090b_startup_failure(health);
> > +	health->sp80090b_startup_done = false;
> > +}
> > +
> > +static inline void lrng_sp80090b_failure(struct lrng_health *health)
> > +{
> > +	if (health->sp80090b_startup_done) {
> > +		pr_err("SP800-90B runtime health test failure - invalidating "
> > +		       "all existing entropy and initiate SP800-90B startup\n");
> > +		lrng_sp80090b_runtime_failure(health);
> > +	} else {
> > +		pr_err("SP800-90B startup test failure - resetting\n");
> > +		lrng_sp80090b_startup_failure(health);
> > +	}
> > +}
> > +
> > +/**
> > + * Is the SP800-90B startup testing complete?
> > + *
> > + * This function is called by the LRNG to determine whether to unblock
> > + * a certain user interface. Therefore, only the potentially blocking
> > + * user interfaces are considered SP800-90B compliant.
> > + */
> > +bool lrng_sp80090b_startup_complete(void)
> > +{
> > +	struct lrng_health *health = &lrng_health;
> > +
> > +	return (lrng_sp80090b_health_enabled()) ? health->sp80090b_startup_done:
> > +						  true;
> > +}
> > +
> > +bool lrng_sp80090b_compliant(void)
> > +{
> > +	struct lrng_health *health = &lrng_health;
> > +
> > +	return lrng_sp80090b_health_enabled() && health->sp80090b_startup_done;
> > +}
> > +
> > +/************************************************************************
> > *** + * Adaptive Proportion Test
> > + *
> > + * This test complies with SP800-90B section 4.4.2.
> > +
> > *************************************************************************
> > **/ +
> > +/**
> > + * Reset the APT counter
> > + *
> > + * @health [in] Reference to health state
> > + */
> > +static inline void lrng_apt_reset(struct lrng_health *health,
> > +				  unsigned int time_masked)
> > +{
> > +	struct lrng_apt *apt = &health->apt;
> > +
> > +	pr_debug("APT value %d for base %d\n",
> > +		 atomic_read(&apt->apt_count), atomic_read(&apt->apt_base));
> > +
> > +	/* Reset APT */
> > +	atomic_set(&apt->apt_count, 0);
> > +	atomic_set(&apt->apt_base, time_masked);
> > +}
> > +
> > +static inline void lrng_apt_restart(struct lrng_health *health)
> > +{
> > +	struct lrng_apt *apt = &health->apt;
> > +
> > +	atomic_set(&apt->apt_trigger, LRNG_APT_WINDOW_SIZE);
> > +}
> > +
> > +/**
> > + * Insert a new entropy event into APT
> > + *
> > + * This function does is void as it does not decide about the fate of a
> > time + * stamp. An APT failure can only happen at the same time of a
> > stuck test + * failure. Thus, the stuck failure will already decide how
> > the time stamp + * is handled.
> > + *
> > + * @health [in] Reference to health state
> > + * @now_time [in] Time stamp to process
> > + */
> > +static inline void lrng_apt_insert(struct lrng_health *health,
> > +				   unsigned int now_time)
> > +{
> > +	struct lrng_apt *apt = &health->apt;
> > +
> > +	if (!lrng_sp80090b_health_requested())
> > +		return;
> > +
> > +	now_time &= LRNG_APT_WORD_MASK;
> > +
> > +	/* Initialization of APT */
> > +	if (!apt->apt_base_set) {
> > +		atomic_set(&apt->apt_base, now_time);
> > +		apt->apt_base_set = true;
> > +		return;
> > +	}
> > +
> > +	if (now_time == (unsigned int)atomic_read(&apt->apt_base)) {
> > +		u32 apt_val = (u32)atomic_inc_return_relaxed(&apt->apt_count);
> > +
> > +		if (apt_val >= LRNG_APT_CUTOFF)
> > +			lrng_sp80090b_failure(health);
> > +	}
> > +
> > +	if (atomic_dec_and_test(&apt->apt_trigger)) {
> > +		lrng_apt_restart(health);
> > +		lrng_apt_reset(health, now_time);
> > +		lrng_sp80090b_startup(health);
> > +	}
> > +}
> > +
> > +/************************************************************************
> > *** + * Repetition Count Test
> > + *
> > + * The LRNG uses an enhanced version of the Repetition Count Test
> > + * (RCT) specified in SP800-90B section 4.4.1. Instead of counting
> > identical + * back-to-back values, the input to the RCT is the counting
> > of the stuck + * values while filling the entropy pool.
> > + *
> > + * The RCT is applied with an alpha of 2^-30 compliant to FIPS 140-2 IG
> > 9.8. + *
> > + * During the counting operation, the LRNG always calculates the RCT
> > + * cut-off value of C. If that value exceeds the allowed cut-off value,
> > + * the LRNG will invalidate all entropy for the entropy pool which
> > implies
> > + * that no data can be extracted from the entropy pool unless new entropy
> > + * is received.
> > +
> > *************************************************************************
> > **/ +
> > +/**
> > + * Hot code path - Insert data for Repetition Count Test
> > + *
> > + * @health: Reference to health information
> > + * @stuck: Decision of stuck test
> > + */
> > +static inline void lrng_rct(struct lrng_health *health, int stuck)
> > +{
> > +	struct lrng_rct *rct = &health->rct;
> > +
> > +	if (!lrng_sp80090b_health_requested())
> > +		return;
> > +
> > +	if (stuck) {
> > +		u32 rct_count = atomic_add_return_relaxed(1, &rct->rct_count);
> > +
> > +		pr_debug("RCT count: %u\n", rct_count);
> > +
> > +		/*
> > +		 * The cutoff value is based on the following consideration:
> > +		 * alpha = 2^-30 as recommended in FIPS 140-2 IG 9.8.
> > +		 * In addition, we imply an entropy value H of 1 bit as this
> > +		 * is the minimum entropy required to provide full entropy.
> > +		 *
> > +		 * Note, rct_count (which equals to value B in the
> > +		 * pseudo code of SP800-90B section 4.4.1) starts with zero.
> > +		 * Hence we need to subtract one from the cutoff value as
> > +		 * calculated following SP800-90B.
> > +		 */
> > +		if (rct_count >= 30) {
> > +			atomic_set(&rct->rct_count, 0);
> > +
> > +			/*
> > +			 * APT must start anew as we consider all previously
> > +			 * recorded data to contain no entropy.
> > +			 */
> > +			lrng_apt_restart(health);
> > +
> > +			lrng_sp80090b_failure(health);
> > +		}
> > +	} else {
> > +		atomic_set(&rct->rct_count, 0);
> > +	}
> > +}
> > +
> > +/************************************************************************
> > *** + * Stuck Test
> > + *
> > + * Checking the:
> > + *      1st derivative of the event occurrence (time delta)
> > + *      2nd derivative of the event occurrence (delta of time deltas)
> > + *      3rd derivative of the event occurrence (delta of delta of time
> > deltas) + *
> > + * All values must always be non-zero. The stuck test is only valid
> > disabled if + * high-resolution time stamps are identified after
> > initialization. +
> > *************************************************************************
> > **/ +
> > +static inline u32 lrng_delta(u32 prev, u32 next)
> > +{
> > +	/*
> > +	 * Note that this (unsigned) subtraction does yield the correct value
> > +	 * in the wraparound-case, i.e. when next < prev.
> > +	 */
> > +	return (next - prev);
> > +}
> > +
> > +/**
> > + * Hot code path
> > + *
> > + * @health: Reference to health information
> > + * @now: Event time
> > + * @return: 0 event occurrence not stuck (good time stamp)
> > + *	    != 0 event occurrence stuck (reject time stamp)
> > + */
> > +static inline int lrng_irq_stuck(struct lrng_stuck_test *stuck, u32
> > now_time) +{
> > +	u32 delta = lrng_delta(stuck->last_time, now_time);
> > +	u32 delta2 = lrng_delta(stuck->last_delta, delta);
> > +	u32 delta3 = lrng_delta(stuck->last_delta2, delta2);
> > +
> > +	stuck->last_time = now_time;
> > +	stuck->last_delta = delta;
> > +	stuck->last_delta2 = delta2;
> > +
> > +	if (!delta || !delta2 || !delta3)
> > +		return 1;
> > +
> > +	return 0;
> > +}
> > +
> > +/************************************************************************
> > *** + * Health test interfaces
> > +
> > *************************************************************************
> > **/ +
> > +/**
> > + * Disable all health tests
> > + */
> > +void lrng_health_disable(void)
> > +{
> > +	struct lrng_health *health = &lrng_health;
> > +
> > +	health->health_test_enabled = false;
> > +
> > +	if (lrng_sp80090b_health_requested())
> > +		pr_warn("SP800-90B compliance requested but the Linux RNG is "
> > +			"NOT SP800-90B compliant\n");
> > +}
> > +
> > +/**
> > + * Hot code path - Perform health test on time stamp received from an
> > event + *
> > + * @now_time Time stap
> > + */
> > +enum lrng_health_res lrng_health_test(u32 now_time)
> > +{
> > +	struct lrng_health *health = &lrng_health;
> > +	struct lrng_stuck_test *stuck_test = this_cpu_ptr(&lrng_stuck_test);
> > +	int stuck;
> > +
> > +	if (!health->health_test_enabled)
> > +		return lrng_health_pass;
> > +
> > +	lrng_apt_insert(health, now_time);
> > +
> > +	stuck = lrng_irq_stuck(stuck_test, now_time);
> > +	lrng_rct(health, stuck);
> > +	if (stuck) {
> > +		/* SP800-90B disallows using a failing health test time stamp */
> > +		return lrng_sp80090b_health_requested() ?
> > +			lrng_health_fail_drop : lrng_health_fail_use;
> > +	}
> > +
> > +	return lrng_health_pass;
> > +}


Ciao
Stephan



  reply index

Thread overview: 162+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-11 18:17 [PATCH v24 00/12] /dev/random - a new approach with full SP800-90B compliance Stephan Müller
2019-11-11 18:18 ` [PATCH v24 01/12] Linux Random Number Generator Stephan Müller
2019-11-11 23:54   ` Thomas Gleixner
2019-11-12  2:25     ` Stephan Müller
2019-11-12 10:16       ` Thomas Gleixner
2019-11-12 22:30   ` kbuild test robot
2019-11-12 23:15     ` Stephan Müller
2019-11-13  0:14   ` kbuild test robot
2019-11-13  0:25     ` Stephan Müller
2019-11-24  4:51   ` Sandy Harris
2019-11-24  9:02     ` Stephan Mueller
2019-11-11 18:19 ` [PATCH v24 02/12] LRNG - allocate one SDRNG instance per NUMA node Stephan Müller
2019-11-11 18:20 ` [PATCH v24 03/12] LRNG - /proc interface Stephan Müller
2019-11-11 18:20 ` [PATCH v24 04/12] LRNG - add switchable DRNG support Stephan Müller
2019-11-11 18:21 ` [PATCH v24 05/12] crypto: DRBG - externalize DRBG functions for LRNG Stephan Müller
2019-11-11 18:21 ` [PATCH v24 06/12] LRNG - add SP800-90A DRBG extension Stephan Müller
2019-11-11 18:22 ` [PATCH v24 07/12] LRNG - add kernel crypto API PRNG extension Stephan Müller
2019-11-11 18:23 ` [PATCH v24 08/12] crypto: provide access to a static Jitter RNG state Stephan Müller
2019-11-11 18:23 ` [PATCH v24 09/12] LRNG - add Jitter RNG fast noise source Stephan Müller
2019-11-11 18:24 ` [PATCH v24 10/12] LRNG - add TRNG support Stephan Müller
2019-11-11 18:26 ` [PATCH v24 11/12] LRNG - add SP800-90B compliant health tests Stephan Müller
2019-11-12 19:58   ` Alexander E. Patrakov
2019-11-12 23:11     ` Stephan Müller [this message]
2019-11-13  0:36     ` Stephan Müller
2019-11-13  6:02       ` Alexander E. Patrakov
2019-11-14  1:46         ` Stephan Müller
2019-11-11 18:26 ` [PATCH v24 12/12] LRNG - add interface for gathering of raw entropy Stephan Müller
2019-11-12 20:55   ` kbuild test robot
2019-11-12 23:13     ` Stephan Müller
2019-11-12 13:23 ` [PATCH v24 00/12] /dev/random - a new approach with full SP800-90B compliance Florian Weimer
2019-11-12 22:43   ` Stephan Müller
2019-11-12 15:33 ` Andy Lutomirski
2019-11-12 23:03   ` Stephan Müller
2019-11-12 23:26     ` Stephan Müller
2019-11-13  4:24   ` Stephan Müller
2019-11-13  4:48     ` Andy Lutomirski
2019-11-13 12:16       ` Stephan Müller
2019-11-16  9:32 ` [PATCH v25 00/12] /dev/random - a new approach with full SP800-90B Stephan Müller
2019-11-16  9:33   ` [PATCH v25 01/12] Linux Random Number Generator Stephan Müller
2019-11-16 11:25     ` Thomas Gleixner
2019-11-17 10:30       ` Stephan Müller
2019-11-16 18:13     ` Nicolai Stange
2019-11-17 11:01       ` Stephan Müller
2019-11-16  9:33   ` [PATCH v25 02/12] LRNG - allocate one SDRNG instance per NUMA node Stephan Müller
2019-11-16  9:34   ` [PATCH v25 03/12] LRNG - /proc interface Stephan Müller
2019-11-16 16:39     ` Andy Lutomirski
2019-11-17 12:16       ` Stephan Müller
2019-11-19 10:06         ` Andy Lutomirski
2019-11-19 10:55           ` Stephan Mueller
2019-11-19 17:40             ` Andy Lutomirski
2019-11-16 23:36     ` ebiederm
2019-11-17 11:37       ` Stephan Müller
2019-11-16  9:34   ` [PATCH v25 04/12] LRNG - add switchable DRNG support Stephan Müller
2019-11-16  9:35   ` [PATCH v25 05/12] crypto: DRBG - externalize DRBG functions for LRNG Stephan Müller
2019-11-16  9:35   ` [PATCH v25 06/12] LRNG - add SP800-90A DRBG extension Stephan Müller
2019-11-16  9:35   ` [PATCH v25 07/12] LRNG - add kernel crypto API PRNG extension Stephan Müller
2019-11-16  9:36   ` [PATCH v25 08/12] crypto: provide access to a static Jitter RNG state Stephan Müller
2019-11-16  9:36   ` [PATCH v25 09/12] LRNG - add Jitter RNG fast noise source Stephan Müller
2019-11-20 13:33     ` Neil Horman
2019-11-20 20:07       ` Stephan Müller
2019-11-21 14:19         ` Neil Horman
2019-11-21 14:33           ` Stephan Mueller
2019-11-16  9:37   ` [PATCH v25 10/12] LRNG - add TRNG support Stephan Müller
2019-11-16 16:09     ` Andy Lutomirski
2019-11-17 11:10       ` Stephan Müller
2019-11-19 10:07         ` Andy Lutomirski
2019-11-19 10:46           ` Stephan Mueller
2019-11-19 12:41           ` Greg Kroah-Hartman
2019-11-20  8:58             ` Stephan Müller
2019-11-20  9:55               ` Alexander E. Patrakov
2019-11-20 13:29               ` Greg Kroah-Hartman
2019-11-20 19:51                 ` Stephan Müller
2019-11-20 19:57                   ` Alexander E. Patrakov
2019-11-20 20:32                   ` Greg Kroah-Hartman
2019-11-21 13:06                     ` Stephan Müller
2019-11-16  9:37   ` [PATCH v25 11/12] LRNG - add SP800-90B compliant health tests Stephan Müller
2019-11-16  9:38   ` [PATCH v25 12/12] LRNG - add interface for gathering of raw entropy Stephan Müller
2019-11-16 16:51     ` Andy Lutomirski
2019-11-17 22:55       ` Stephan Müller
2019-11-19 10:04         ` Andy Lutomirski
2019-11-19 17:17     ` Randy Dunlap
2019-11-20  9:01       ` Stephan Müller
2019-11-21 12:18     ` Nicolai Stange
2019-11-21 15:18       ` Stephan Müller
2019-11-23 20:08   ` [PATCH v26 00/12] /dev/random - a new approach with full SP800-90B Stephan Müller
2019-11-23 20:10     ` [PATCH v26 01/12] Linux Random Number Generator Stephan Müller
2019-11-24 22:44       ` kbuild test robot
2019-11-25  6:29         ` Stephan Mueller
2019-11-23 20:10     ` [PATCH v26 02/12] LRNG - allocate one SDRNG instance per NUMA node Stephan Müller
2019-11-23 20:11     ` [PATCH v26 03/12] LRNG - sysctls and /proc interface Stephan Müller
2019-11-23 20:11     ` [PATCH v26 04/12] LRNG - add switchable DRNG support Stephan Müller
2019-11-23 20:31     ` [PATCH v26 05/12] crypto: DRBG - externalize DRBG functions for LRNG Stephan Müller
2019-11-23 20:32     ` [PATCH v26 06/12] LRNG - add SP800-90A DRBG extension Stephan Müller
2019-11-23 20:32     ` [PATCH v26 07/12] LRNG - add kernel crypto API PRNG extension Stephan Müller
2019-11-23 20:33     ` [PATCH v26 08/12] crypto: provide access to a static Jitter RNG state Stephan Müller
2019-11-23 20:34     ` [PATCH v26 09/12] LRNG - add Jitter RNG fast noise source Stephan Müller
2019-11-23 20:34     ` [PATCH v26 10/12] LRNG - add TRNG support Stephan Müller
2019-11-23 20:34     ` [PATCH v26 11/12] LRNG - add SP800-90B compliant health tests Stephan Müller
2019-11-23 20:35     ` [PATCH v26 12/12] LRNG - add interface for gathering of raw entropy Stephan Müller
2020-01-09  8:29     ` [PATCH v27 00/12] /dev/random - a new approach with full SP800-90B Stephan Müller
2020-01-09  8:30       ` [PATCH v27 01/12] Linux Random Number Generator Stephan Müller
2020-01-16  6:09         ` kbuild test robot
2020-01-16  6:41           ` Stephan Mueller
2020-01-09  8:31       ` [PATCH v27 02/12] LRNG - allocate one DRNG instance per NUMA node Stephan Müller
2020-01-09  8:31       ` [PATCH v27 03/12] LRNG - sysctls and /proc interface Stephan Müller
2020-01-09  8:32       ` [PATCH v27 04/12] LRNG - add switchable DRNG support Stephan Müller
2020-01-11  7:09         ` kbuild test robot
2020-01-12 10:12           ` Stephan Müller
2020-01-09  8:32       ` [PATCH v27 05/12] crypto: DRBG - externalize DRBG functions for LRNG Stephan Müller
2020-01-09  8:32       ` [PATCH v27 06/12] LRNG - add SP800-90A DRBG extension Stephan Müller
2020-01-09  8:33       ` [PATCH v27 07/12] LRNG - add kernel crypto API PRNG extension Stephan Müller
2020-01-09  8:33       ` [PATCH v27 08/12] crypto: provide access to a static Jitter RNG state Stephan Müller
2020-01-09  8:34       ` [PATCH v27 09/12] LRNG - add Jitter RNG fast noise source Stephan Müller
2020-01-10  0:24         ` Randy Dunlap
2020-01-10  7:45           ` Stephan Mueller
2020-01-09  8:34       ` [PATCH v27 10/12] LRNG - add SP800-90B compliant health tests Stephan Müller
2020-01-10  0:20         ` Randy Dunlap
2020-01-10  8:27           ` Stephan Mueller
2020-01-09  8:35       ` [PATCH v27 11/12] LRNG - add interface for gathering of raw entropy Stephan Müller
2020-01-09  8:35       ` [PATCH v27 12/12] LRNG - add power-on and runtime self-tests Stephan Müller
2020-01-10  0:22         ` Randy Dunlap
2020-01-10  7:48           ` Stephan Mueller
2020-01-13 10:39         ` Dan Carpenter
2020-01-13 10:46           ` Stephan Mueller
2020-01-15 10:31       ` [PATCH v28 00/12] /dev/random - a new approach with full SP800-90B Stephan Müller
2020-01-15 10:31         ` [PATCH v28 01/12] Linux Random Number Generator Stephan Müller
2020-01-16  0:11           ` Randy Dunlap
2020-01-16  7:22             ` Stephan Mueller
2020-01-15 10:32         ` [PATCH v28 02/12] LRNG - allocate one DRNG instance per NUMA node Stephan Müller
2020-01-15 10:32         ` [PATCH v28 03/12] LRNG - sysctls and /proc interface Stephan Müller
2020-01-15 10:32         ` [PATCH v28 04/12] LRNG - add switchable DRNG support Stephan Müller
2020-01-15 10:33         ` [PATCH v28 05/12] crypto: DRBG - externalize DRBG functions for LRNG Stephan Müller
2020-01-15 10:33         ` [PATCH v28 06/12] LRNG - add SP800-90A DRBG extension Stephan Müller
2020-01-16  0:14           ` Randy Dunlap
2020-01-16  6:55             ` Stephan Mueller
2020-01-15 10:34         ` [PATCH v28 07/12] LRNG - add kernel crypto API PRNG extension Stephan Müller
2020-01-16  0:15           ` Randy Dunlap
2020-01-16  6:54             ` Stephan Mueller
2020-01-15 10:34         ` [PATCH v28 08/12] crypto: provide access to a static Jitter RNG state Stephan Müller
2020-01-15 10:34         ` [PATCH v28 09/12] LRNG - add Jitter RNG fast noise source Stephan Müller
2020-01-16  0:17           ` Randy Dunlap
2020-01-16  6:51             ` Stephan Mueller
2020-01-15 10:35         ` [PATCH v28 10/12] LRNG - add SP800-90B compliant health tests Stephan Müller
2020-01-15 10:35         ` [PATCH v28 11/12] LRNG - add interface for gathering of raw entropy Stephan Müller
2020-01-16  0:18           ` Randy Dunlap
2020-01-16  6:43             ` Stephan Mueller
2020-01-16  6:48               ` Randy Dunlap
2020-01-16  6:52                 ` Stephan Mueller
2020-01-15 10:36         ` [PATCH v28 12/12] LRNG - add power-on and runtime self-tests Stephan Müller
2020-01-19 21:12         ` [PATCH v29 00/12] /dev/random - a new approach with full SP800-90B Stephan Müller
2020-01-19 21:13           ` [PATCH v29 01/12] Linux Random Number Generator Stephan Müller
2020-01-19 21:13           ` [PATCH v29 02/12] LRNG - allocate one DRNG instance per NUMA node Stephan Müller
2020-01-19 21:14           ` [PATCH v29 03/12] LRNG - sysctls and /proc interface Stephan Müller
2020-01-19 21:14           ` [PATCH v29 04/12] LRNG - add switchable DRNG support Stephan Müller
2020-01-19 21:15           ` [PATCH v29 05/12] crypto: DRBG - externalize DRBG functions for LRNG Stephan Müller
2020-01-19 21:16           ` [PATCH v29 06/12] LRNG - add SP800-90A DRBG extension Stephan Müller
2020-01-19 21:16           ` [PATCH v29 07/12] LRNG - add kernel crypto API PRNG extension Stephan Müller
2020-01-19 21:17           ` [PATCH v29 08/12] crypto: provide access to a static Jitter RNG state Stephan Müller
2020-01-19 21:18           ` [PATCH v29 09/12] LRNG - add Jitter RNG fast noise source Stephan Müller
2020-01-19 21:18           ` [PATCH v29 10/12] LRNG - add SP800-90B compliant health tests Stephan Müller
2020-01-19 21:19           ` [PATCH v29 11/12] LRNG - add interface for gathering of raw entropy Stephan Müller
2020-01-19 21:20           ` [PATCH v29 12/12] LRNG - add power-on and runtime self-tests Stephan Müller

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=27134768.kErlRdRglt@positron.chronox.de \
    --to=smueller@chronox.de \
    --cc=adilger.kernel@dilger.ca \
    --cc=arnd@arndb.de \
    --cc=darwish.07@gmail.com \
    --cc=draht@schaltsekun.de \
    --cc=ebiederm@xmission.com \
    --cc=fweimer@redhat.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=jack@suse.cz \
    --cc=linux-api@vger.kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=marcelo.cerri@canonical.com \
    --cc=matthias.peter@bsi.bund.de \
    --cc=mccann@jhu.edu \
    --cc=mjg59@srcf.ucam.org \
    --cc=mzxreary@0pointer.de \
    --cc=nhorman@redhat.com \
    --cc=nstange@suse.de \
    --cc=patrakov@gmail.com \
    --cc=rstrode@redhat.com \
    --cc=tytso@mit.edu \
    --cc=vcaputo@pengaru.com \
    --cc=w@1wt.eu \
    --cc=zachary@baishancloud.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git