Re: [PATCH v24 11/12] LRNG - add SP800-90B compliant health tests

ср, 13 нояб. 2019 г. в 05:38, Stephan Müller [off-list ref]:

Am Dienstag, 12. November 2019, 20:58:32 CET schrieb Alexander E. Patrakov:

Hi Alexander,

quoted

quoted

+config LRNG_HEALTH_TESTS
+   bool "Enable noise source online health tests"
+   help
+     The online health tests validate the noise source at
+     runtime for fatal errors. These tests include SP800-90B
+     compliant tests which are invoked if the system is booted
+     with fips=1. In case of fatal errors during active
+     SP800-90B tests, the issue is logged and the noise
+     data is discarded. These tests are required for full
+     compliance with SP800-90B.

How have you tested that these tests work at runtime? Maybe add some
code under a new CONFIG item that depends on CONFIG_BROKEN that
deliberately botches the RNG and triggers failures?

I am unable to find sensible information about CONFIG_BROKEN in the recent
kernel tree.

Do you happen to have a pointer on how that option is to be used?

This option is not used on its own. You create a new option,
CONFIG_TEST_LRNG_FAILURE_MODE or something like that, and put your
code under the ifdef guarded by that option. And then, to prevent
ordinary users and allyesconfig from selecting it, in Kconfig you say:
"depends on BROKEN". This way, the option becomes unselectable in
menuconfig but still works as intended when added manually to .config
(obviously, with the BROKEN dependency removed locally).

Definition: https://github.com/torvalds/linux/blob/9c7db5004280767566e91a33445bf93aa479ef02/init/Kconfig#L68
Example usage: https://github.com/torvalds/linux/blob/c87237110f2553b4200a8b3401a01198edfcf0d9/drivers/gpu/drm/i915/Kconfig.debug#L166

--
Alexander E. Patrakov