From mboxrd@z Thu Jan 1 00:00:00 1970 From: "H. Peter Anvin" Subject: random: Providing a seed value to VM guests Date: Thu, 01 May 2014 11:59:25 -0700 Message-ID: <5362998D.3030102@zytor.com> References: <20140428195913.E0A0143994596@oldenburg.str.redhat.com> <20140428214112.GC7857@thunk.org> <535FE68C.8060002@redhat.com> <20140429182610.GA19325@thunk.org> <53616293.3080308@mit.edu> <20140501020627.GA25248@thunk.org> <1be5350d-89f9-44b9-8d1b-e3e591741940@email.android.com> <20140501150549.GA24388@thunk.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit To: Andy Lutomirski , "Theodore Ts'o" , Florian Weimer , "linux-kernel@vger.kernel.org" , Kees Cook , kvm list Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org On 05/01/2014 11:53 AM, Andy Lutomirski wrote: > > A CPUID leaf or an MSR advertised by a CPUID leaf has another > advantage: it's easy to use in the ASLR code -- I don't think there's > a real IDT, so there's nothing like rdmsr_safe available. It also > avoids doing anything complicated with the boot process to allow the > same seed to be used for ASLR and random.c; it can just be invoked > twice on boot. > At that point we are talking an x86-specific interface, and so we might as well simply emulate RDRAND (urandom) and RDSEED (random) if the CPU doesn't support them. I believe KVM already has a way to report CPUID features that are "emulated but supported anyway", i.e. they work but are slow. > What's the right forum for this? This thread is probably not it. Change the subject line? -hpa