linux-kernel - Re: [PATCH v4] virt: vmgenid: introduce driver for reinitializing RNG on VM fork

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9ac68552-c1fc-22c8-13e6-4f344f85a4fb@amazon.com>
Date:   Fri, 25 Feb 2022 16:11:34 +0100
From:   Alexander Graf <graf@...zon.com>
To:     "Jason A. Donenfeld" <Jason@...c4.com>
CC:     <kvm@...r.kernel.org>, <linux-crypto@...r.kernel.org>,
        <linux-hyperv@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <adrian@...ity.io>, <ardb@...nel.org>, <ben@...portsystems.com>,
        <berrange@...hat.com>, <colmmacc@...zon.com>,
        <decui@...rosoft.com>, <dwmw@...zon.co.uk>, <ebiggers@...nel.org>,
        <ehabkost@...hat.com>, <gregkh@...uxfoundation.org>,
        <haiyangz@...rosoft.com>, <imammedo@...hat.com>,
        <jannh@...gle.com>, <kys@...rosoft.com>, <lersek@...hat.com>,
        <linux@...inikbrodowski.net>, <mst@...hat.com>,
        <qemu-devel@...gnu.org>, <raduweis@...zon.com>,
        <sthemmin@...rosoft.com>, <tytso@....edu>, <wei.liu@...nel.org>
Subject: Re: [PATCH v4] virt: vmgenid: introduce driver for reinitializing RNG
 on VM fork


On 25.02.22 15:33, Jason A. Donenfeld wrote:
> On Fri, Feb 25, 2022 at 03:18:43PM +0100, Alexander Graf wrote:
>>> I recall this part of the old thread. From what I understood, using
>>> "VMGENID" + "QEMUVGID" worked /well enough/, even if that wasn't
>>> technically in-spec. Ard noted that relying on _CID like that is
>>> technically an ACPI spec notification. So we're between one spec and
>>> another, basically, and doing "VMGENID" + "QEMUVGID" requires fewer
>>> changes, as mentioned, appears to work fine in my testing.
>>>
>>> However, with that said, I think supporting this via "VM_Gen_Counter"
>>> would be a better eventual thing to do, but will require acks and
>>> changes from the ACPI maintainers. Do you think you could prepare your
>>> patch proposal above as something on-top of my tree [1]? And if you can
>>> convince the ACPI maintainers that that's okay, then I'll happily take
>>> the patch.
>>
>> Sure, let me send the ACPI patch stand alone. No need to include the
>> VMGenID change in there.
> That's fine. If the ACPI people take it for 5.18, then we can count on
> it being there and adjust the vmgenid driver accordingly also for 5.18.
>
> I just booted up a Windows VM, and it looks like Hyper-V uses
> "Hyper_V_Gen_Counter_V1", which is also quite long, so we can't really
> HID match on that either.


Yes, due to the same problem. I'd really prefer we sort out the ACPI 
matching before this goes mainline. Matching on _HID is explicitly 
discouraged in the VMGenID spec.


Alex





Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879