From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752781AbaEAWqp (ORCPT ); Thu, 1 May 2014 18:46:45 -0400 Received: from terminus.zytor.com ([198.137.202.10]:41526 "EHLO mail.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752512AbaEAWqn (ORCPT ); Thu, 1 May 2014 18:46:43 -0400 Message-ID: <5362CEBC.9090705@zytor.com> Date: Thu, 01 May 2014 15:46:20 -0700 From: "H. Peter Anvin" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: Andy Lutomirski , "Theodore Ts'o" , "linux-kernel@vger.kernel.org" , kvm list , Florian Weimer , Kees Cook Subject: Re: random: Providing a seed value to VM guests References: <20140501192618.GA25829@thunk.org> <900441a0-24e8-4976-ad35-3971805b9f34@email.android.com> <20140501203910.GB25829@thunk.org> <5362B618.50602@zytor.com> <20140501222832.GD25829@thunk.org> In-Reply-To: X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 05/01/2014 03:32 PM, Andy Lutomirski wrote: > On Thu, May 1, 2014 at 3:28 PM, wrote: >> On Thu, May 01, 2014 at 02:06:13PM -0700, Andy Lutomirski wrote: >>> >>> I still don't see the point. What does this do better than virtio-rng? >> >> I believe you had been complaining about how complicated it was to set >> up virtio? And this complexity is also an issue if we want to use it >> to initialize the RNG used for the kernel text ASLR --- which has to >> be done very early in the boot process, and where making something as >> simple as possible is a Good Thing. > > It's complicated, so it won't be up until much later in the boot > process. This is completely fine for /dev/random, but it's a problem > for /dev/urandom, ASLR, and such. > >> >> And since we would want to use RDRAND/RDSEED if it is available >> *anyway*, perhaps in combination with other things, why not use the >> RDRAND/RDSEED interface? > > Because it's awkward. I don't think it simplifies anything. > It greatly simplifies discovery, which is a Big Deal[TM] in early code. -hpa