Linux Virtualization - Sep 2014 - Standardizing an MSR or other hypercall to get an RNG seed?

On Fri, Sep 19, 2014 at 09:40:07AM -0700, H. Peter Anvin
wrote:
> On 09/19/2014 09:37 AM, Gleb Natapov wrote:
> >
> > Linux detects what hypervior it runs on very early
> 
> Not anywhere close to early enough.  We're talking for uses like kASLR.
> 
Still to early to do:

   h = cpuid(HYPERVIOR_SIGNATURE)
   if (h == KVMKVMKVM) {
      if (cpuid(kvm_features) & kvm_rnd)
         rdmsr(kvm_rnd)
   else (h == HyperV) {
      if (cpuid(hv_features) & hv_rnd)
        rdmsr(hv_rnd) 
   else (h == XenXenXen) {
      if (cpuid(xen_features) & xen_rnd)
        rdmsr(xen_rnd)
  }

?

--
			Gleb.

On 09/19/2014 09:53 AM, Gleb Natapov wrote:
> On Fri, Sep 19, 2014 at 09:40:07AM -0700, H. Peter Anvin wrote:
>> On 09/19/2014 09:37 AM, Gleb Natapov wrote:
>>>
>>> Linux detects what hypervior it runs on very early
>>
>> Not anywhere close to early enough.  We're talking for uses like
kASLR.
>>
> Still to early to do:
> 
>    h = cpuid(HYPERVIOR_SIGNATURE)
>    if (h == KVMKVMKVM) {
>       if (cpuid(kvm_features) & kvm_rnd)
>          rdmsr(kvm_rnd)
>    else (h == HyperV) {
>       if (cpuid(hv_features) & hv_rnd)
>         rdmsr(hv_rnd) 
>    else (h == XenXenXen) {
>       if (cpuid(xen_features) & xen_rnd)
>         rdmsr(xen_rnd)
>   }
> 
If we need to do chase loops, especially not so...

	-hpa

On Fri, Sep 19, 2014 at 10:08:20AM -0700, H. Peter Anvin
wrote:
> On 09/19/2014 09:53 AM, Gleb Natapov wrote:
> > On Fri, Sep 19, 2014 at 09:40:07AM -0700, H. Peter Anvin wrote:
> >> On 09/19/2014 09:37 AM, Gleb Natapov wrote:
> >>>
> >>> Linux detects what hypervior it runs on very early
> >>
> >> Not anywhere close to early enough.  We're talking for uses
like kASLR.
> >>
> > Still to early to do:
> > 
> >    h = cpuid(HYPERVIOR_SIGNATURE)
> >    if (h == KVMKVMKVM) {
> >       if (cpuid(kvm_features) & kvm_rnd)
> >          rdmsr(kvm_rnd)
> >    else (h == HyperV) {
> >       if (cpuid(hv_features) & hv_rnd)
> >         rdmsr(hv_rnd) 
> >    else (h == XenXenXen) {
> >       if (cpuid(xen_features) & xen_rnd)
> >         rdmsr(xen_rnd)
> >   }
> > 
> 
> If we need to do chase loops, especially not so...
> 
What loops exactly? As a non native English speaker I fail to understand
if your answer is "yes" or "no" ;)

--
			Gleb.

On Sep 19, 2014 9:53 AM, "Gleb Natapov" <gleb at kernel.org>
wrote:
>
> On Fri, Sep 19, 2014 at 09:40:07AM -0700, H. Peter Anvin wrote:
> > On 09/19/2014 09:37 AM, Gleb Natapov wrote:
> > >
> > > Linux detects what hypervior it runs on very early
> >
> > Not anywhere close to early enough.  We're talking for uses like
kASLR.
> >
> Still to early to do:
>
>    h = cpuid(HYPERVIOR_SIGNATURE)
>    if (h == KVMKVMKVM) {
>       if (cpuid(kvm_features) & kvm_rnd)
>          rdmsr(kvm_rnd)
>    else (h == HyperV) {
>       if (cpuid(hv_features) & hv_rnd)
>         rdmsr(hv_rnd)
>    else (h == XenXenXen) {
>       if (cpuid(xen_features) & xen_rnd)
>         rdmsr(xen_rnd)
>   }
>
I think that there's a lot of value in having each guest
implementation be automatically compatible with all hypervisors.  For
example, you forgot VMware, and VMware might be less excited about
implementing this feature if all the guests won't immediately start
using it.
> ?
>
> --
>                         Gleb.

On Fri, Sep 19, 2014 at 10:21:27AM -0700, Andy Lutomirski
wrote:
> On Sep 19, 2014 9:53 AM, "Gleb Natapov" <gleb at
kernel.org> wrote:
> >
> > On Fri, Sep 19, 2014 at 09:40:07AM -0700, H. Peter Anvin wrote:
> > > On 09/19/2014 09:37 AM, Gleb Natapov wrote:
> > > >
> > > > Linux detects what hypervior it runs on very early
> > >
> > > Not anywhere close to early enough.  We're talking for uses
like kASLR.
> > >
> > Still to early to do:
> >
> >    h = cpuid(HYPERVIOR_SIGNATURE)
> >    if (h == KVMKVMKVM) {
> >       if (cpuid(kvm_features) & kvm_rnd)
> >          rdmsr(kvm_rnd)
> >    else (h == HyperV) {
> >       if (cpuid(hv_features) & hv_rnd)
> >         rdmsr(hv_rnd)
> >    else (h == XenXenXen) {
> >       if (cpuid(xen_features) & xen_rnd)
> >         rdmsr(xen_rnd)
> >   }
> >
> 
> I think that there's a lot of value in having each guest
> implementation be automatically compatible with all hypervisors.  For
> example, you forgot VMware, and VMware might be less excited about
> implementing this feature if all the guests won't immediately start
> using it.
> 
I "forgot" VMware because I do not see VMware people to be CCed. They
may
be even less excited about them being told _how_ this feature need to be
implemented (e.g implement HyperV leafs for the feature detection). I
do not want to and cannot speak for VMware, but my guess is that for
them it would be much easier to add an else clause for VMware in above
"if" then to coordinate with all hypervisor developers about MSR/cpuid
details. And since this is security feature implementing it for Linux
is in their best interest.

--
			Gleb.