From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:33287) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SUeY1-0003rH-Ps for qemu-devel@nongnu.org; Wed, 16 May 2012 09:45:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SUeXu-0006ab-EK for qemu-devel@nongnu.org; Wed, 16 May 2012 09:45:49 -0400 Received: from mx1.redhat.com ([209.132.183.28]:9506) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SUeXu-0006Zp-5Z for qemu-devel@nongnu.org; Wed, 16 May 2012 09:45:42 -0400 Date: Wed, 16 May 2012 14:45:34 +0100 From: "Daniel P. Berrange" Message-ID: <20120516134534.GK22979@redhat.com> References: <4FB3AA86.3080507@codemonkey.ws> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <4FB3AA86.3080507@codemonkey.ws> Subject: Re: [Qemu-devel] [PATCH 1/1] virtio-rng: device to send host entropy to guest Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: Amit Shah , qemu list On Wed, May 16, 2012 at 08:24:22AM -0500, Anthony Liguori wrote: > On 05/16/2012 06:30 AM, Amit Shah wrote: > >The Linux kernel already has a virtio-rng driver, this is the device > >implementation. > > > >When Linux needs more entropy, it puts a buffer in the vq. We then put > >entropy into that buffer, and push it back to the guest. > > > >Feeding randomness from host's /dev/urandom into the guest is > >sufficient, so this is a simple implementation that opens /dev/urandom > >and reads from it whenever required. > > > >Invocation is simple: > > > > qemu ... -device virtio-rng-pci > > > >In the guest, we see > > > > $ cat /sys/devices/virtual/misc/hw_random/rng_available > > virtio > > > > $ cat /sys/devices/virtual/misc/hw_random/rng_current > > virtio > > > >There are ways to extend the device to be more generic and collect > >entropy from other sources, but this is simple enough and works for now. > > > >Signed-off-by: Amit Shah > > It's not this simple unfortunately. > > If you did this with libvirt, one guest could exhaust the available > entropy for the remaining guests. This could be used as a mechanism > for one guest to attack another (reducing the available entropy for > key generation). > > You need to rate limit the amount of entropy that a guest can obtain > to allow management tools to mitigate this attack. Ultimately I think you need to have a push mechanism, where an external process feeds entropy to QEMU, rather than a pull mechanism where QEMU grabs entropy itself. I tend to think that virtio-rng should have a chardev backend associated with it. The driver should just read from this chardev to get its entropy. Either libvirtd, or better yet a separate virt-entropyd daemonm would connect to each guest & feed the entropy into each guest according to some desired metrics. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|