On 10/05/2015 08:35 PM, Andy Smith wrote: > So, I've been keeping (PV) domUs topped up with entropy by giving > them access to hardware RNGs (initially Entropy Keys, but since the > company making them failed I've switched to OneRNGs).
This is not a satisfactory solution for us because even if we were willing to do USB passthrough, the number of hardware devices needed would be expensive and difficult to manage. A TPM and presumably VTPM can provide entropy http://www.berthon.eu/2015/using-tpm-as-a-source-of-randomness-entropy/ but again it would be difficult for us to implement globally in the conceivable future as we don't have TPM modules in all of our servers. The VTPM might work for you though. I guess another solution might be to have a VTPM backend in the dom0 that only provides entropy and not any of the other functionality, but I don't know enough about TPMs to know if that would be practical. _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel
