Messages in this thread | | | Date | Thu, 12 Sep 2013 13:37:53 -0700 | From | "H. Peter Anvin" <> | Subject | Re: [Resend PATCH 2/2] s390: provide hardware randomness from zcrypt card to /dev/random |
| |
On 09/12/2013 02:41 AM, Torsten Duwe wrote: > > Running completely virtualised, system Z severely lacks good true random sources. > Gathering entropy in a virtual environment is difficult. To compensate, there is > specialised crypto hardware which includes a source for hardware randomness; > the zcrypt driver is able to access this random source. This patch adds a kernel > thread that feeds the random bits via the interface created with the previous patch. > > Signed-off-by: Torsten Duwe <duwe@lst.de>
From what I can gather from the patch this is too heavyweight (need locks and so on) to use as arch_get_random*(). There has been a lot of discussion about the pros and cons of allowing the kernel to bypass rngd, but I would think that any such plumbing -- once it gets past the fully synchronous low latency properties of arch_get_random*() -- really should be implemented as an option in the existing hwrng device infrastructure.
In other words, start by implementing a hwrng device. That will work right now with rngd running. Then we can consider if we want to allow bypass of rngd for certain hwrng devices -- which may include zcrypt, virtio_rng and so on.
-hpa
| |