Re: [Xen-devel] [Xen Hackathon] new PV drivers

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Mon, 2014-06-09 at 10:55 -0400, Boris Ostrovsky wrote:
> On 06/09/2014 10:43 AM, Ian Campbell wrote:
> > On Mon, 2014-06-09 at 10:39 -0400, Boris Ostrovsky wrote:
> >> On 06/09/2014 10:33 AM, Ian Campbell wrote:
> >>> On Mon, 2014-06-09 at 10:30 -0400, Boris Ostrovsky wrote:
> >>>> On 06/09/2014 05:42 AM, Stefano Stabellini wrote:
> >>>>> On Mon, 9 Jun 2014, Ian Campbell wrote:
> >>>>>> On Fri, 2014-06-06 at 14:56 +0100, Anil Madhavapeddy wrote:
> >>>>>>> On 3 Jun 2014, at 12:47, Stefano Stabellini 
> >>>>>>> <stefano.stabellini@xxxxxxxxxxxxx> wrote:
> >>>>>>>
> >>>>>>>> Present (by memory):
> >>>>>>>> - Julien Grall,
> >>>>>>>> - Stefano Stabellini,
> >>>>>>>> - Ian Campbell,
> >>>>>>>> - Roger Pau Monne,
> >>>>>>>> - Dario Faggioli,
> >>>>>>>> - Andrii Tseglytskyi,
> >>>>>>>> - David Vrabel,
> >>>>>>>> - Konrad Wilk.
> >>>>>>>>
> >>>>>>>> * What new PV devices do we need? What has been done already?
> >>>>>>> I missed this session, but was wondering about an entropy driver.
> >>>>>>> We're integrating an OCaml SSL/TLS into MirageOS, and it's not clear
> >>>>>>> how PV guests should go about getting a strong source of entropy from
> >>>>>>> the outside world in a reasonably portable way.
> >>>> Is entropy provided by drivers/char/random.c not sufficient?
> >>> This is about providing entropy for that driver to consume.
> >>>
> >>> VMs typically don't have much hardware and therefore don't have much
> >>> entropy to seed the pool with.
> >> So this is about seeding, not feeding? (sorry, did not mean to start
> >> rhyming ;-)).
> > TBH I'm not sure, I think it could be either or both...
> 
> Feeding is done by interrupt timing and block device access latency, 
> both of which are happening in a guest. I don't know whether there is 
> enough of that but perhaps before embarking on new PV driver it may be 
> worth investigating quality of existing entropy source. Or maybe it's 
> already been looked at.

I've not done the numbers/investigated it myself but it's a quite widely
held belief that those things are not sufficient in a virtual machine. 

Ian.


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel