linux-kernel - RE: [PATCH v2 1/1] x86/hyperv: Use Hyper-V entropy to seed guest random number generator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <SN6PR02MB4157E883A8EA7796264D3AA7D42A2@SN6PR02MB4157.namprd02.prod.outlook.com>
Date: Wed, 13 Mar 2024 05:29:08 +0000
From: Michael Kelley <mhklinux@...look.com>
To: Long Li <longli@...rosoft.com>, Haiyang Zhang <haiyangz@...rosoft.com>,
	"wei.liu@...nel.org" <wei.liu@...nel.org>, Dexuan Cui <decui@...rosoft.com>,
	"tglx@...utronix.de" <tglx@...utronix.de>, "mingo@...hat.com"
	<mingo@...hat.com>, "bp@...en8.de" <bp@...en8.de>,
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>, "hpa@...or.com"
	<hpa@...or.com>, "arnd@...db.de" <arnd@...db.de>, "tytso@....edu"
	<tytso@....edu>, jason <jason@...c4.com>, "x86@...nel.org" <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
	"linux-arch@...r.kernel.org" <linux-arch@...r.kernel.org>
Subject: RE: [PATCH v2 1/1] x86/hyperv: Use Hyper-V entropy to seed guest
 random number generator

From: Long Li <longli@...rosoft.com> Sent: Tuesday, March 12, 2024 9:51 PM
> 
> > +void __init ms_hyperv_late_init(void)
> > +{
> > +       struct acpi_table_header *header;
> > +       acpi_status status;
> > +       u8 *randomdata;
> > +       u32 length, i;
> > +
> > +       /*
> > +        * Seed the Linux random number generator with entropy provided by
> > +        * the Hyper-V host in ACPI table OEM0.  It would be nice to do this
> > +        * even earlier in ms_hyperv_init_platform(), but the ACPI subsystem
> > +        * isn't set up at that point. Skip if booted via EFI as generic EFI
> > +        * code has already done some seeding using the EFI RNG protocol.
> > +        */
> > +       if (!IS_ENABLED(CONFIG_ACPI) || efi_enabled(EFI_BOOT))
> > +               return;
> > +
> > +       status = acpi_get_table("OEM0", 0, &header);
> > +       if (ACPI_FAILURE(status) || !header)
> > +               return;
> 
> Should we call acpi_put_table() if header == 0?

No.  acpi_get_table() setting header to NULL is equivalent to
returning a failure status, per a comment in the code for
acpi_get_table().  So checking header for NULL is probably
redundant, but it doesn't hurt.

> It will also be helpful doing a
> pr_info() here so user knows that hyper-v random number is not used.

In v1 of the patch, I had such a pr_info(), but Wei Liu recommended
removing it, and I agreed it wasn't really necessary.  See the brief 
discussion here:

https://lore.kernel.org/linux-hyperv/SN6PR02MB4157B61CA09C0DAF0BB994E1D4212@SN6PR02MB4157.namprd02.prod.outlook.com/

Michael