Open Stack

* Whaley, Graham (graham.whaley at intel.com) wrote:
> > From: Marco Vedovati [mailto:mvedovati at suse.com]
> [snip]
> > In my view, given the ephemeral aspect of containers, /dev/urandom
> > should be fine most of the time. As an option, user should be left the
> > possibility to select /dev/random if that is needed for his specific
> > application.
> 
> From a read around, I agree with the sentiment, that /dev/urandom is . I'm not sure how that ties in with QEMU/KVM though - if we direct QEMU to use the host /dev/urandom, does that mean that the guest /dev/random is really using the host /dev/urandom - so any strong /dev/random guarantees inside the guest are now a lie... I don't know how the virtio rng and qemu hang together etc.

virtio-rng in the guest kernel provides queues that qemu services and
provides data from whichever source you specify.
The guest kernel then passes the data from vrtio-rng through the hwrng
code into the main random code where it goes through mix_pool_bytes
so as far as I understand that's mixed in with anything else.

However; my reading of hwrng is that there's only one 'current' hwrng
generator (as opposed to other entropy sources) and that's whichever
one has the highest 'quality'.  virtio-rng proudly claims a quality of
1000 - and doesn't really know what it's been passed from qemu.

Dave

> > 
> > BTW, it may be worth investigating on what is the state of the art
> > solution chosen in virtualization systems with a high VM count.
> 
> +1 I doubt we are the first people to run into this scenario.
> 
> > 
> > Marco
> Graham
> ---------------------------------------------------------------------
> Intel Corporation (UK) Limited
> Registered No. 1134945 (England)
> Registered Office: Pipers Way, Swindon SN3 1RJ
> VAT No: 860 2173 47
> 
> This e-mail and any attachments may contain confidential material for
> the sole use of the intended recipient(s). Any review or distribution
> by others is strictly prohibited. If you are not the intended
> recipient, please contact the sender and delete all copies.
> _______________________________________________
> kata-dev mailing list
> kata-dev at lists.katacontainers.io
> http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev
--
Dr. David Alan Gilbert / dgilbert at redhat.com / Manchester, UK