Re: [edk2-devel] [PATCH v2 03/13] OvmfPkg:PlatformCI: Support virtio-rng-pci

["Ard Biesheuvel" <ardb@kernel.org>]

So this patch is necessary as otherwise, QEMU fails to boot due to a
missing source of randomness in the network drivers, right?

Does this imply that all QEMU deployments that rely on the bundled
firmware images (e.g., for micro-VMs and container use cases) will now
fail to boot if the pre-existing QEMU launch script happens to omit
the virtio-rng device?

If so, we absolutely need a fallback here - RngDxe based on TRNG (for
KVM use cases) as well as RNDR (for TCG with CPU max). This may still
break some deployments, but the vast majority should be covered.

RNDR raises another interesting problem, by the way - the ARM arch
spec requires RNDR to be backed by an appropriate DRBG that complies
with the NIST spec but it does not specify which one. IOW, it is
backed by a DRBG not by a raw entropy source, but specifying which
DRBG (by GUID) is not generally feasible, as the guest VM firmware
cannot interrogate the host about which DRBG is behind RNDR.

TL;DR there are a couple of loose ends here, and so rushing it through
doesn't seem wise imho. I'd rather leave ARM behind with these CVE
fixes than break many different use cases in different ways.



On Thu, 9 May 2024 at 07:56, Doug Flick <doug.edk2@gmail.com> wrote:
>
> This patch adds "virtio-rng-pci" to the PlatformBuildLib.py
> This adds Rng services to the guest VM
>
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
>
> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
> ---
>  OvmfPkg/PlatformCI/PlatformBuildLib.py | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/OvmfPkg/PlatformCI/PlatformBuildLib.py b/OvmfPkg/PlatformCI/PlatformBuildLib.py
> index 00d454954bff..3fe80f5c1caa 100644
> --- a/OvmfPkg/PlatformCI/PlatformBuildLib.py
> +++ b/OvmfPkg/PlatformCI/PlatformBuildLib.py
> @@ -208,6 +208,8 @@ class PlatformBuilder( UefiBuilder, BuildSettingsManager):
>          args += " -net none"                                                # turn off network
>          args += " -smp 4"
>          args += f" -drive file=fat:rw:{VirtualDrive},format=raw,media=disk" # Mount disk with startup.nsh
> +        # Provides Rng services to the Guest VM
> +        args += " -device virtio-rng-pci"
>
>          if (self.env.GetValue("QEMU_HEADLESS").upper() == "TRUE"):
>              args += " -display none"  # no graphics
> --
> 2.34.1
>


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118753): https://edk2.groups.io/g/devel/message/118753
Mute This Topic: https://groups.io/mt/105996580/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-