Linux Virtualization - Jul 2014 - [PATCH 1/2 v2] hwrng: Allow drivers to disable reading during probe

Commit d9e7972619334 "hwrng: add randomness to system from rng
sources"
added a call to rng_get_data() from the hwrng_register() function.
However, some rng devices need initialization before data can be read
from them.

Also, the virtio-rng device does not behave properly when this call is
made in its probe() routine - the virtio core sets the DRIVER_OK status
bit only on a successful probe, which means the host ignores all
communication from the guest, and the guest insmod or boot process just
sits there doing nothing.

[ jac: Modify the API to allow drivers to disable reading at probe, new
patch, copied Amit's commit message. ]

CC: Kees Cook <keescook at chromium.org>
CC: Jason Cooper <jason at lakedaemon.net>
CC: Herbert Xu <herbert at gondor.apana.org.au>
CC: <stable at vger.kernel.org> # v3.15+
Signed-off-by: Amit Shah <amit.shah at redhat.com>
Signed-off-by: Jason Cooper <jason at lakedaemon.net>
---
 drivers/char/hw_random/core.c | 8 +++++---
 include/linux/hw_random.h     | 4 ++++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 334601cc81cf..b7b6c48ca682 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -347,9 +347,11 @@ int hwrng_register(struct hwrng *rng)
 	INIT_LIST_HEAD(&rng->list);
 	list_add_tail(&rng->list, &rng_list);
 
-	bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
-	if (bytes_read > 0)
-		add_device_randomness(bytes, bytes_read);
+	if (!(rng->flags & HWRNG_NO_READ_AT_PROBE)) {
+		bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
+		if (bytes_read > 0)
+			add_device_randomness(bytes, bytes_read);
+	}
 out_unlock:
 	mutex_unlock(&rng_mutex);
 out:
diff --git a/include/linux/hw_random.h b/include/linux/hw_random.h
index b4b0eef5fddf..5e358c7f3aae 100644
--- a/include/linux/hw_random.h
+++ b/include/linux/hw_random.h
@@ -15,6 +15,8 @@
 #include <linux/types.h>
 #include <linux/list.h>
 
+#define HWRNG_NO_READ_AT_PROBE	BIT(0)
+
 /**
  * struct hwrng - Hardware Random Number Generator driver
  * @name:		Unique RNG name.
@@ -28,6 +30,7 @@
  *			Must not be NULL.    *OBSOLETE*
  * @read:		New API. drivers can fill up to max bytes of data
  *			into the buffer. The buffer is aligned for any type.
+ * @flags:              per-device properties
  * @priv:		Private data, for use by the RNG driver.
  */
 struct hwrng {
@@ -37,6 +40,7 @@ struct hwrng {
 	int (*data_present)(struct hwrng *rng, int wait);
 	int (*data_read)(struct hwrng *rng, u32 *data);
 	int (*read)(struct hwrng *rng, void *data, size_t max, bool wait);
+	unsigned long flags;
 	unsigned long priv;
 
 	/* internal. */
-- 
2.0.0

On Wed, Jul 02, 2014 at 06:56:35PM +0530, Amit Shah
wrote:
> Hi Jason,
> 
> On (Wed) 02 Jul 2014 [13:00:19], Jason Cooper wrote:
> > Commit d9e7972619334 "hwrng: add randomness to system from rng
sources"
> > added a call to rng_get_data() from the hwrng_register() function.
> > However, some rng devices need initialization before data can be read
> > from them.
> > 
> > Also, the virtio-rng device does not behave properly when this call is
> > made in its probe() routine - the virtio core sets the DRIVER_OK
status
> > bit only on a successful probe, which means the host ignores all
> > communication from the guest, and the guest insmod or boot process
just
> > sits there doing nothing.
> > 
> > [ jac: Modify the API to allow drivers to disable reading at probe,
new
> > patch, copied Amit's commit message. ]
> > 
> > CC: Kees Cook <keescook at chromium.org>
> > CC: Jason Cooper <jason at lakedaemon.net>
> > CC: Herbert Xu <herbert at gondor.apana.org.au>
> > CC: <stable at vger.kernel.org> # v3.15+
> > Signed-off-by: Amit Shah <amit.shah at redhat.com>
> > Signed-off-by: Jason Cooper <jason at lakedaemon.net>
> > ---
> >  drivers/char/hw_random/core.c | 8 +++++---
> >  include/linux/hw_random.h     | 4 ++++
> >  2 files changed, 9 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/char/hw_random/core.c
b/drivers/char/hw_random/core.c
> > index 334601cc81cf..b7b6c48ca682 100644
> > --- a/drivers/char/hw_random/core.c
> > +++ b/drivers/char/hw_random/core.c
> > @@ -347,9 +347,11 @@ int hwrng_register(struct hwrng *rng)
> >  	INIT_LIST_HEAD(&rng->list);
> >  	list_add_tail(&rng->list, &rng_list);
> >  
> > -	bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
> > -	if (bytes_read > 0)
> > -		add_device_randomness(bytes, bytes_read);
> > +	if (!(rng->flags & HWRNG_NO_READ_AT_PROBE)) {
> > +		bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
> > +		if (bytes_read > 0)
> > +			add_device_randomness(bytes, bytes_read);
> > +	}
> 
> But this has the inverse problem: if there are two hwrngs in the
> system, one will be initialized and probed.  The other will not be
> initialized, but still be probed.
That's a problem outside the scope of this patch.  You're basically
saying the ->init() should be called unconditionally for each hwrng.  If
that's what driver authors assumed, that's not what is happening if
there is more than one driver in the system.

I think you should be changing the code a few lines up to make sure
hwrng_init() is called once for each driver.
> My version was more conservative while this one keeps the bug from the
> current kernels.
Huh?  What do you mean by "keeps the bug from the current kernels." ?

Besides, you're second patch isn't actually doing any ->init to get
the
hwrng ready for reading...  If you had a real ->init function, and it
was always called, would rng_get_data() work at probe time for your
driver?

confused,

Jason.