Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Stephan Mueller <smueller@chronox.de>
To:     Herbert Xu <herbert@gondor.apana.org.au>
Cc:     linux-crypto@vger.kernel.org
Subject: Re: [PATCH] crypto: Jitter RNG - Permanent and Intermittent health errors
Date:   Fri, 24 Mar 2023 13:01:16 +0100
Message-ID: <19310206.9zqlukQJUG@tauon.chronox.de>
In-Reply-To: <ZB1tCY3ruqvtWfHS@gondor.apana.org.au>
References: <12194787.O9o76ZdvQC@positron.chronox.de>
 <ZB1tCY3ruqvtWfHS@gondor.apana.org.au>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="iso-8859-1"
Precedence: bulk

Am Freitag, 24. M=E4rz 2023, 10:27:37 CET schrieb Herbert Xu:

Hi Herbert,

> On Thu, Mar 23, 2023 at 08:17:14AM +0100, Stephan M=FCller wrote:
> > @@ -138,29 +139,35 @@ static int jent_kcapi_random(struct crypto_rng *t=
fm,
> >=20
> >  	spin_lock(&rng->jent_lock);
> >=20
> > -	/* Return a permanent error in case we had too many resets in a row. =
*/
> > -	if (rng->reset_cnt > (1<<10)) {
> > +	/* Enforce a disabled entropy source. */
> > +	if (rng->disabled) {
> >=20
> >  		ret =3D -EFAULT;
> >  		goto out;
> >  =09
> >  	}
>=20
> Can we please get rid of this completely when we're not in FIPS
> mode? Remember that jent is now used by all kernel users through
> drbg.  Having it fail permanently in this fashion is unacceptable.
>=20
> If we're not in FIPS mode it should simply carry on or at least
> seek another source of entropy, perhaps from the kernel RNG.

I will remove that from this patch. I plan to release another patch where t=
he=20
oversampling rate will be increased in case of such health errors. This=20
increase in the oversampling rate would handle this issue much more=20
gracefully.

Thanks

Ciao
Stephan