Linux Virtualization - Aug 2014 - GET_RNG_SEED hypercall ABI? (Re: [PATCH v5 0/5] random,x86,kvm: Rework arch RNG seeds and get some from kvm)

On Aug 28, 2014 7:17 AM, "Gleb Natapov" <gleb at kernel.org>
wrote:
>
> On Tue, Aug 26, 2014 at 04:58:34PM -0700, Andy Lutomirski wrote:
> > hpa pointed out that the ABI that I chose (an MSR from the KVM range
> > and a KVM cpuid bit) is unnecessarily KVM-specific.  It would be nice
> > to allocate an MSR that everyone involved can agree on and, rather
> > than relying on a cpuid bit, just have the guest probe for the MSR.
> >
> CPUID part allows feature to be disabled for machine compatibility purpose
> during migration. Of course interface can explicitly state that one
successful
> use of the MSR does not mean that next use will not result in a #GP, but
that
> doesn't sound very elegant and is different from any other MSR out
there.
>
Is there a non-cpuid interface between QEMU and KVM for this?

AFAICT, even turning off cpuid bits for things like async pf doesn't
actually disable the MSRs (which is arguably an attack surface issue).

--Andy
> --
>                         Gleb.

Il 28/08/2014 18:22, Andy Lutomirski ha scritto:
> Is there a non-cpuid interface between QEMU and KVM for this?
No.
> AFAICT, even turning off cpuid bits for things like async pf doesn't
> actually disable the MSRs (which is arguably an attack surface issue).
No, it doesn't.  You cannot disable instructions even if you hide CPUID
bits, so KVM just extends this to MSRs (both native and paravirtual). It
sometimes helps too, for example with a particular guest OS that does
not necessary check CPUID for bits that are always present on Apple
hardware...

Paolo

On Thu, Aug 28, 2014 at 12:46 PM, Paolo Bonzini <pbonzini at redhat.com>
wrote:
> Il 28/08/2014 18:22, Andy Lutomirski ha scritto:
>> Is there a non-cpuid interface between QEMU and KVM for this?
>
> No.
Hmm.  Then, assuming that someone manages to allocate a
cross-hypervisor MSR number for this, what am I supposed to do in the
KVM code?  Just make it available unconditionally?  I don't see why
that wouldn't work reliably, but it seems like an odd design.
>
>> AFAICT, even turning off cpuid bits for things like async pf
doesn't
>> actually disable the MSRs (which is arguably an attack surface issue).
>
> No, it doesn't.  You cannot disable instructions even if you hide CPUID
> bits, so KVM just extends this to MSRs (both native and paravirtual). It
> sometimes helps too, for example with a particular guest OS that does
> not necessary check CPUID for bits that are always present on Apple
> hardware...
But I bet that no one assumes that KVM paravirt MSRs are available
even if the feature bit isn't set.

Also, the one and only native feature flag I tested (rdtscp) actually
does work: RDTSCP seems to send #UD if QEMU is passed -cpu
host,-rdtscp.

--Andy