Re: Standardizing an MSR or other hypercall to get an RNG seed?

H. Peter Anvin
2014-09-19T23:29:53Z

On 09/19/2014 04:12 PM, Andy Lutomirski wrote:
>
> To force deterministic execution.
>
> I incorrectly thought that the kernel could switch RDRAND on and off.
> It turns out that a hypervisor can do this, but not the kernel. Also,
> determinism is lost anyway because of TSX, which *also* can't be
> turned on and off.
>

Actually, a much bigger reason is because it lets rogue guest *user
space*, even will a well-behaved guest OS, do something potentially
harmful to the host.

-hpa