Re: random: Providing a seed value to VM guests

2014-05-01 Thread H. Peter Anvin
On 05/01/2014 03:56 PM, Andy Lutomirski wrote: > > I think we're comparing: > > a) cpuid to detect rdrand *or* emulated rdrand followed by rdrand > > to > > b) cpuid to detect rdrand or the paravirt seed msr/cpuid call, > followed by rdrand or the msr or cpuid read > > this seems like it barel

Re: random: Providing a seed value to VM guests

2014-05-01 Thread Andy Lutomirski
On Thu, May 1, 2014 at 3:46 PM, H. Peter Anvin wrote: > On 05/01/2014 03:32 PM, Andy Lutomirski wrote: >> On Thu, May 1, 2014 at 3:28 PM, wrote: >>> On Thu, May 01, 2014 at 02:06:13PM -0700, Andy Lutomirski wrote: I still don't see the point. What does this do better than virtio-rng?

Re: random: Providing a seed value to VM guests

2014-05-01 Thread H. Peter Anvin
On 05/01/2014 03:32 PM, Andy Lutomirski wrote: > On Thu, May 1, 2014 at 3:28 PM, wrote: >> On Thu, May 01, 2014 at 02:06:13PM -0700, Andy Lutomirski wrote: >>> >>> I still don't see the point. What does this do better than virtio-rng? >> >> I believe you had been complaining about how complicate

Re: random: Providing a seed value to VM guests

2014-05-01 Thread Andy Lutomirski
On Thu, May 1, 2014 at 3:28 PM, wrote: > On Thu, May 01, 2014 at 02:06:13PM -0700, Andy Lutomirski wrote: >> >> I still don't see the point. What does this do better than virtio-rng? > > I believe you had been complaining about how complicated it was to set > up virtio? And this complexity is a

Re: random: Providing a seed value to VM guests

2014-05-01 Thread tytso
On Thu, May 01, 2014 at 02:06:13PM -0700, Andy Lutomirski wrote: > > I still don't see the point. What does this do better than virtio-rng? I believe you had been complaining about how complicated it was to set up virtio? And this complexity is also an issue if we want to use it to initialize t

Re: random: Providing a seed value to VM guests

2014-05-01 Thread Andy Lutomirski
On Thu, May 1, 2014 at 2:01 PM, H. Peter Anvin wrote: > On 05/01/2014 01:56 PM, Andy Lutomirski wrote: >> >> Even if we could emulate RDSEED effectively**, I don't really >> understand what the guest is expected to do with it. And I generally >> dislike defining an interface with no known sensibl

Re: random: Providing a seed value to VM guests

2014-05-01 Thread H. Peter Anvin
On 05/01/2014 01:56 PM, Andy Lutomirski wrote: > > Even if we could emulate RDSEED effectively**, I don't really > understand what the guest is expected to do with it. And I generally > dislike defining an interface with no known sensible users, because it > means that there's a good chance that

Re: random: Providing a seed value to VM guests

2014-05-01 Thread Andy Lutomirski
On Thu, May 1, 2014 at 1:39 PM, wrote: > On Thu, May 01, 2014 at 01:32:55PM -0700, Andy Lutomirski wrote: >> On Thu, May 1, 2014 at 1:30 PM, H. Peter Anvin wrote: >> > RDSEED is not synchronous. It is, however, nonblocking. >> >> What I mean is: IIUC it's reasonable to call RDSEED a few times i

Re: random: Providing a seed value to VM guests

2014-05-01 Thread tytso
On Thu, May 01, 2014 at 01:32:55PM -0700, Andy Lutomirski wrote: > On Thu, May 1, 2014 at 1:30 PM, H. Peter Anvin wrote: > > RDSEED is not synchronous. It is, however, nonblocking. > > What I mean is: IIUC it's reasonable to call RDSEED a few times in a > loop and hope it works. It makes no sen

Re: random: Providing a seed value to VM guests

2014-05-01 Thread Andy Lutomirski
On Thu, May 1, 2014 at 1:30 PM, H. Peter Anvin wrote: > RDSEED is not synchronous. It is, however, nonblocking. What I mean is: IIUC it's reasonable to call RDSEED a few times in a loop and hope it works. It makes no sense to do that with /dev/random. > > On May 1, 2014 1:16:40 PM PDT, Andy Lu

Re: random: Providing a seed value to VM guests

2014-05-01 Thread H. Peter Anvin
RDSEED is not synchronous. It is, however, nonblocking. On May 1, 2014 1:16:40 PM PDT, Andy Lutomirski wrote: >On May 1, 2014 12:26 PM, wrote: >> >> On Thu, May 01, 2014 at 12:02:49PM -0700, Andy Lutomirski wrote: >> > >> > Is RDSEED really reasonable here? Won't it slow down by several >> > o

Re: random: Providing a seed value to VM guests

2014-05-01 Thread Andy Lutomirski
On May 1, 2014 12:26 PM, wrote: > > On Thu, May 01, 2014 at 12:02:49PM -0700, Andy Lutomirski wrote: > > > > Is RDSEED really reasonable here? Won't it slow down by several > > orders of magnitude? > > That is I think the biggest problem; RDRAND and RDSEED are fast if > they are native, but they

Re: random: Providing a seed value to VM guests

2014-05-01 Thread H. Peter Anvin
The normal CPUID bit is unset I believe. On May 1, 2014 12:02:49 PM PDT, Andy Lutomirski wrote: >On Thu, May 1, 2014 at 11:59 AM, H. Peter Anvin wrote: >> On 05/01/2014 11:53 AM, Andy Lutomirski wrote: >>> >>> A CPUID leaf or an MSR advertised by a CPUID leaf has another >>> advantage: it's easy

Re: random: Providing a seed value to VM guests

2014-05-01 Thread H. Peter Anvin
As I said... I think KVM has already added an emulated instructions enumeration API. On May 1, 2014 12:26:18 PM PDT, ty...@mit.edu wrote: >On Thu, May 01, 2014 at 12:02:49PM -0700, Andy Lutomirski wrote: >> >> Is RDSEED really reasonable here? Won't it slow down by several >> orders of magnitud

Re: random: Providing a seed value to VM guests

2014-05-01 Thread tytso
On Thu, May 01, 2014 at 12:02:49PM -0700, Andy Lutomirski wrote: > > Is RDSEED really reasonable here? Won't it slow down by several > orders of magnitude? That is I think the biggest problem; RDRAND and RDSEED are fast if they are native, but they will involve a VM exit if they need to be emula

Re: random: Providing a seed value to VM guests

2014-05-01 Thread Andy Lutomirski
On Thu, May 1, 2014 at 11:59 AM, H. Peter Anvin wrote: > On 05/01/2014 11:53 AM, Andy Lutomirski wrote: >> >> A CPUID leaf or an MSR advertised by a CPUID leaf has another >> advantage: it's easy to use in the ASLR code -- I don't think there's >> a real IDT, so there's nothing like rdmsr_safe ava