3 ms·
It seems hwrng is mandatory otherwise /dev/random will block easily for virtio-rng.
by ausjke 12y ago
It seems hwrng is mandatory otherwise /dev/random will block easily for virtio-rng.
- rwmj 12y agoModern Intel processors have an RDRAND instruction which (cue conspiracy theorists) is a hardware RNG. https://en.wikipedia.org/wiki/RdRand https://en.wikipedia.org/wiki/RdRand
- amitshah 12y agoHowever, it's RDSEED that needs to be used as input if we use the Intel instructions. https://software.intel.com/en-us/blogs/2012/11/17/the-difference-between-rdrand-and-rdseed https://software.intel.com/en-us/blogs/2012/11/17/the-differ... Edit to add: we can obviously pass on the RDRAND instruction directly to the VM, but that's less portable, because not all servers in a server farm may have that instruction available, limiting live migration capabilities. So we can just pass on output from RDSEED into the host's /dev/random, and feed the VM /dev/random by default as described.
- amitshah 12y agoThe host has more sources that contribute to the kernel entropy pool: network and block IO are more than any individual VM. Keep in mind, though, that just accessing /dev/urandom in the guest won't need too much input from the host. However, having a hwrng is obviously the preferred option where there is need for a lot of entropy.
- ausjke 12y agoother than the x86 instruction set there are some SOCs that embeds a hwrng directly, the one I used is Freescale iMX6 that has a FIPS-certified hwrng, which is very handy.