All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Alex Bennée" <alex.bennee@linaro.org>
To: "Daniel P. Berrangé" <berrange@redhat.com>
Cc: "Paolo Bonzini" <pbonzini@redhat.com>,
	"Jason A. Donenfeld" <Jason@zx2c4.com>,
	"Marcel Apfelbaum" <marcel.apfelbaum@gmail.com>,
	"Richard Henderson" <richard.henderson@linaro.org>,
	"Eduardo Habkost" <eduardo@habkost.net>,
	"Peter Maydell" <peter.maydell@linaro.org>,
	"Philippe Mathieu-Daudé" <f4bug@amsat.org>,
	"Laurent Vivier" <laurent@vivier.eu>,
	"Michael S . Tsirkin" <mst@redhat.com>,
	qemu-devel@nongnu.org
Subject: Re: [PULL 9/9] hw/i386: pass RNG seed via setup_data entry
Date: Thu, 04 Aug 2022 17:56:09 +0100	[thread overview]
Message-ID: <87bkt0nduu.fsf@linaro.org> (raw)
In-Reply-To: <Yuu1Eod8rwKY3pIS@redhat.com>


Daniel P. Berrangé <berrange@redhat.com> writes:

> On Thu, Jul 21, 2022 at 06:36:21PM +0200, Paolo Bonzini wrote:
>> From: "Jason A. Donenfeld" <Jason@zx2c4.com>
>> 
>> Tiny machines optimized for fast boot time generally don't use EFI,
>> which means a random seed has to be supplied some other way. For this
>> purpose, Linux (≥5.20) supports passing a seed in the setup_data table
>> with SETUP_RNG_SEED, specially intended for hypervisors, kexec, and
>> specialized bootloaders. The linked commit shows the upstream kernel
>> implementation.
>> 
>> At Paolo's request, we don't pass these to versioned machine types ≤7.0.
>
>
> This change has also broken direct kernel measured boot with AMD SEV
> confidential virtualization.

FWIW this is why we had to introduce the dtb-randomness control knob for
ARM -M virt machines. Although we have deprecated the old dtb-kaslr-seed
knob and it has always enabled by default because the measured boot was
sufficiently new the few people working with it could just add it to
their command lines.

-- 
Alex Bennée


      parent reply	other threads:[~2022-08-04 17:05 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-21 16:36 [PULL 0/9] More fixes + random seed patches for QEMU 7.1 Paolo Bonzini
2022-07-21 16:36 ` [PULL 1/9] docs: Add caveats for Windows as the build platform Paolo Bonzini
2022-07-21 16:36 ` [PULL 2/9] accel/kvm: Avoid Coverity warning in query_stats() Paolo Bonzini
2022-07-21 16:36 ` [PULL 3/9] oss-fuzz: remove binaries from qemu-bundle tree Paolo Bonzini
2022-07-21 16:36 ` [PULL 4/9] oss-fuzz: ensure base_copy is a generic-fuzzer Paolo Bonzini
2022-07-21 16:36 ` [PULL 5/9] hw/nios2: virt: pass random seed to fdt Paolo Bonzini
2022-07-21 16:36 ` [PULL 6/9] hw/mips: boston: " Paolo Bonzini
2022-07-21 16:36 ` [PULL 7/9] hw/guest-loader: " Paolo Bonzini
2022-07-21 19:36   ` Alex Bennée
2022-07-21 20:20     ` Jason A. Donenfeld
2022-07-22  9:45       ` Alex Bennée
2022-07-22 11:26         ` Jason A. Donenfeld
2022-07-22 14:27           ` Alex Bennée
2022-07-22 16:32             ` Paolo Bonzini
2022-07-22 19:07             ` Jason A. Donenfeld
2022-07-22 12:04       ` Paolo Bonzini
2022-07-22 12:21         ` Jason A. Donenfeld
2022-07-21 16:36 ` [PULL 8/9] hw/rx: " Paolo Bonzini
2022-07-21 16:36 ` [PULL 9/9] hw/i386: pass RNG seed via setup_data entry Paolo Bonzini
2022-08-02  3:28   ` Xiaoyao Li
2022-08-02 13:21     ` Jason A. Donenfeld
2022-08-02 14:53       ` Xiaoyao Li
2022-08-02 15:06         ` Jason A. Donenfeld
2022-08-02 15:13           ` Jason A. Donenfeld
2022-08-03  1:34             ` Xiaoyao Li
2022-08-03 10:52             ` Daniel P. Berrangé
2022-08-03 13:11               ` Jason A. Donenfeld
2022-08-03 13:34                 ` Jason A. Donenfeld
2022-08-03 17:07                   ` Jason A. Donenfeld
2022-08-03 22:03                     ` Michael S. Tsirkin
2022-08-03 22:08                       ` Jason A. Donenfeld
2022-08-03 22:23                         ` Michael S. Tsirkin
2022-08-04  5:40                           ` Laszlo Ersek
2022-08-04 12:01   ` Daniel P. Berrangé
2022-08-04 12:13     ` Jason A. Donenfeld
2022-08-04 12:48       ` Daniel P. Berrangé
2022-08-04 16:56     ` Alex Bennée [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87bkt0nduu.fsf@linaro.org \
    --to=alex.bennee@linaro.org \
    --cc=Jason@zx2c4.com \
    --cc=berrange@redhat.com \
    --cc=eduardo@habkost.net \
    --cc=f4bug@amsat.org \
    --cc=laurent@vivier.eu \
    --cc=marcel.apfelbaum@gmail.com \
    --cc=mst@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=peter.maydell@linaro.org \
    --cc=qemu-devel@nongnu.org \
    --cc=richard.henderson@linaro.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.