Message ID | 20150918110552.6487a506@bahia.local |
---|---|
State | Not Applicable |
Headers | show |
On Fri, Sep 18, 2015 at 11:05:52AM +0200, Greg Kurz wrote: > On Thu, 17 Sep 2015 10:49:41 +0200 > Thomas Huth <thuth@redhat.com> wrote: > > > The PAPR interface defines a hypercall to pass high-quality > > hardware generated random numbers to guests. Recent kernels can > > already provide this hypercall to the guest if the right hardware > > random number generator is available. But in case the user wants > > to use another source like EGD, or QEMU is running with an older > > kernel, we should also have this call in QEMU, so that guests that > > do not support virtio-rng yet can get good random numbers, too. > > > > This patch now adds a new pseudo-device to QEMU that either > > directly provides this hypercall to the guest or is able to > > enable the in-kernel hypercall if available. The in-kernel > > hypercall can be enabled with the use-kvm property, e.g.: > > > > qemu-system-ppc64 -device spapr-rng,use-kvm=true > > > > For handling the hypercall in QEMU instead, a "RngBackend" is > > required since the hypercall should provide "good" random data > > instead of pseudo-random (like from a "simple" library function > > like rand() or g_random_int()). Since there are multiple RngBackends > > available, the user must select an appropriate back-end via the > > "rng" property of the device, e.g.: > > > > qemu-system-ppc64 -object rng-random,filename=/dev/hwrng,id=gid0 \ > > -device spapr-rng,rng=gid0 ... > > > > See http://wiki.qemu-project.org/Features-Done/VirtIORNG for > > other example of specifying RngBackends. > > > > Signed-off-by: Thomas Huth <thuth@redhat.com> > > --- > > It is a good thing that the user can choose between in-kernel and backend, > and this patch does the work. > > This being said, I am not sure about the use case where a user has a hwrng > capable platform and wants to run guests without any hwrng support at all is > an appropriate default behavior... I guess we will find more users that want > in-kernel being the default if it is available. > > The patch below modifies yours to do just this: the pseudo-device is only > created if hwrng is present and not already created. I have mixed feelings about this. On the one hand, I agree that it would be nice to allow H_RANDOM support by default. On the other hand the patch below leaves no way to turn it off for testing purposes. It also adds another place where the guest hardware depends on the host configuration, which adds to the already substantial mess of ensuring that source and destination hardware configuration matches for migration.
On 21/09/15 04:10, David Gibson wrote: > On Fri, Sep 18, 2015 at 11:05:52AM +0200, Greg Kurz wrote: >> On Thu, 17 Sep 2015 10:49:41 +0200 >> Thomas Huth <thuth@redhat.com> wrote: >> >>> The PAPR interface defines a hypercall to pass high-quality >>> hardware generated random numbers to guests. Recent kernels can >>> already provide this hypercall to the guest if the right hardware >>> random number generator is available. But in case the user wants >>> to use another source like EGD, or QEMU is running with an older >>> kernel, we should also have this call in QEMU, so that guests that >>> do not support virtio-rng yet can get good random numbers, too. >>> >>> This patch now adds a new pseudo-device to QEMU that either >>> directly provides this hypercall to the guest or is able to >>> enable the in-kernel hypercall if available. The in-kernel >>> hypercall can be enabled with the use-kvm property, e.g.: >>> >>> qemu-system-ppc64 -device spapr-rng,use-kvm=true >>> >>> For handling the hypercall in QEMU instead, a "RngBackend" is >>> required since the hypercall should provide "good" random data >>> instead of pseudo-random (like from a "simple" library function >>> like rand() or g_random_int()). Since there are multiple RngBackends >>> available, the user must select an appropriate back-end via the >>> "rng" property of the device, e.g.: >>> >>> qemu-system-ppc64 -object rng-random,filename=/dev/hwrng,id=gid0 \ >>> -device spapr-rng,rng=gid0 ... >>> >>> See http://wiki.qemu-project.org/Features-Done/VirtIORNG for >>> other example of specifying RngBackends. >>> >>> Signed-off-by: Thomas Huth <thuth@redhat.com> >>> --- >> >> It is a good thing that the user can choose between in-kernel and backend, >> and this patch does the work. >> >> This being said, I am not sure about the use case where a user has a hwrng >> capable platform and wants to run guests without any hwrng support at all is >> an appropriate default behavior... I guess we will find more users that want >> in-kernel being the default if it is available. >> >> The patch below modifies yours to do just this: the pseudo-device is only >> created if hwrng is present and not already created. > > I have mixed feelings about this. On the one hand, I agree that it > would be nice to allow H_RANDOM support by default. On the other hand > the patch below leaves no way to turn it off for testing purposes. It > also adds another place where the guest hardware depends on the host > configuration, which adds to the already substantial mess of ensuring > that source and destination hardware configuration matches for > migration. I thought about this question on the weekend and came to the same conclusion. I think if we want to enable this by default, it likely should rather be done at the libvirt level instead? Thomas
On Mon, 21 Sep 2015 12:10:00 +1000 David Gibson <david@gibson.dropbear.id.au> wrote: > On Fri, Sep 18, 2015 at 11:05:52AM +0200, Greg Kurz wrote: > > On Thu, 17 Sep 2015 10:49:41 +0200 > > Thomas Huth <thuth@redhat.com> wrote: > > > > > The PAPR interface defines a hypercall to pass high-quality > > > hardware generated random numbers to guests. Recent kernels can > > > already provide this hypercall to the guest if the right hardware > > > random number generator is available. But in case the user wants > > > to use another source like EGD, or QEMU is running with an older > > > kernel, we should also have this call in QEMU, so that guests that > > > do not support virtio-rng yet can get good random numbers, too. > > > > > > This patch now adds a new pseudo-device to QEMU that either > > > directly provides this hypercall to the guest or is able to > > > enable the in-kernel hypercall if available. The in-kernel > > > hypercall can be enabled with the use-kvm property, e.g.: > > > > > > qemu-system-ppc64 -device spapr-rng,use-kvm=true > > > > > > For handling the hypercall in QEMU instead, a "RngBackend" is > > > required since the hypercall should provide "good" random data > > > instead of pseudo-random (like from a "simple" library function > > > like rand() or g_random_int()). Since there are multiple RngBackends > > > available, the user must select an appropriate back-end via the > > > "rng" property of the device, e.g.: > > > > > > qemu-system-ppc64 -object rng-random,filename=/dev/hwrng,id=gid0 \ > > > -device spapr-rng,rng=gid0 ... > > > > > > See http://wiki.qemu-project.org/Features-Done/VirtIORNG for > > > other example of specifying RngBackends. > > > > > > Signed-off-by: Thomas Huth <thuth@redhat.com> > > > --- > > > > It is a good thing that the user can choose between in-kernel and backend, > > and this patch does the work. > > > > This being said, I am not sure about the use case where a user has a hwrng > > capable platform and wants to run guests without any hwrng support at all is > > an appropriate default behavior... I guess we will find more users that want > > in-kernel being the default if it is available. > > > > The patch below modifies yours to do just this: the pseudo-device is only > > created if hwrng is present and not already created. > > I have mixed feelings about this. On the one hand, I agree that it > would be nice to allow H_RANDOM support by default. On the other hand > the patch below leaves no way to turn it off for testing purposes. It This could be handled with a new spapr property, say 'use-hwrng', defaulting to true. > also adds another place where the guest hardware depends on the host > configuration, which adds to the already substantial mess of ensuring > that source and destination hardware configuration matches for > migration. > Yeah, describing the guest hw is really essential for migration... this is best addressed at the libvirt level with a full XML description of the machine... but FWIW if we are talking about running pseries on a POWER8 or newer host, I am not aware about "hwrng-less" boards... but I am probably missing something :) Back to Thomas' patch, it does the job and brings H_RANDOM, which is currently missing. Acked-by: Greg Kurz <gkurz@linux.vnet.ibm.com> I could test both use-kvm and backend flavors (including migration). Tested-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Thanks. -- Greg
On 21/09/15 10:01, Greg Kurz wrote: > On Mon, 21 Sep 2015 12:10:00 +1000 > David Gibson <david@gibson.dropbear.id.au> wrote: > >> On Fri, Sep 18, 2015 at 11:05:52AM +0200, Greg Kurz wrote: >>> On Thu, 17 Sep 2015 10:49:41 +0200 >>> Thomas Huth <thuth@redhat.com> wrote: >>> >>>> The PAPR interface defines a hypercall to pass high-quality >>>> hardware generated random numbers to guests. Recent kernels can >>>> already provide this hypercall to the guest if the right hardware >>>> random number generator is available. But in case the user wants >>>> to use another source like EGD, or QEMU is running with an older >>>> kernel, we should also have this call in QEMU, so that guests that >>>> do not support virtio-rng yet can get good random numbers, too. >>>> >>>> This patch now adds a new pseudo-device to QEMU that either >>>> directly provides this hypercall to the guest or is able to >>>> enable the in-kernel hypercall if available. ... >>> It is a good thing that the user can choose between in-kernel and backend, >>> and this patch does the work. >>> >>> This being said, I am not sure about the use case where a user has a hwrng >>> capable platform and wants to run guests without any hwrng support at all is >>> an appropriate default behavior... I guess we will find more users that want >>> in-kernel being the default if it is available. >>> >>> The patch below modifies yours to do just this: the pseudo-device is only >>> created if hwrng is present and not already created. >> >> I have mixed feelings about this. On the one hand, I agree that it >> would be nice to allow H_RANDOM support by default. On the other hand >> the patch below leaves no way to turn it off for testing purposes. It >> also adds another place where the guest hardware depends on the host >> configuration, which adds to the already substantial mess of ensuring >> that source and destination hardware configuration matches for >> migration. > > Yeah, describing the guest hw is really essential for migration... this > is best addressed at the libvirt level with a full XML description of > the machine... but FWIW if we are talking about running pseries on a > POWER8 or newer host, I am not aware about "hwrng-less" boards... but > I am probably missing something :) Maybe it would be at least ok to enable it by default as long as "-nodefaults" has not been specified as command line option? > Back to Thomas' patch, it does the job and brings H_RANDOM, which is > currently missing. > > Acked-by: Greg Kurz <gkurz@linux.vnet.ibm.com> > > I could test both use-kvm and backend flavors (including migration). > > Tested-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Thanks! Thomas
On Mon, 21 Sep 2015 10:26:52 +0200 Thomas Huth <thuth@redhat.com> wrote: > On 21/09/15 10:01, Greg Kurz wrote: > > On Mon, 21 Sep 2015 12:10:00 +1000 > > David Gibson <david@gibson.dropbear.id.au> wrote: > > > >> On Fri, Sep 18, 2015 at 11:05:52AM +0200, Greg Kurz wrote: > >>> On Thu, 17 Sep 2015 10:49:41 +0200 > >>> Thomas Huth <thuth@redhat.com> wrote: > >>> > >>>> The PAPR interface defines a hypercall to pass high-quality > >>>> hardware generated random numbers to guests. Recent kernels can > >>>> already provide this hypercall to the guest if the right hardware > >>>> random number generator is available. But in case the user wants > >>>> to use another source like EGD, or QEMU is running with an older > >>>> kernel, we should also have this call in QEMU, so that guests that > >>>> do not support virtio-rng yet can get good random numbers, too. > >>>> > >>>> This patch now adds a new pseudo-device to QEMU that either > >>>> directly provides this hypercall to the guest or is able to > >>>> enable the in-kernel hypercall if available. > ... > >>> It is a good thing that the user can choose between in-kernel and backend, > >>> and this patch does the work. > >>> > >>> This being said, I am not sure about the use case where a user has a hwrng > >>> capable platform and wants to run guests without any hwrng support at all is > >>> an appropriate default behavior... I guess we will find more users that want > >>> in-kernel being the default if it is available. > >>> > >>> The patch below modifies yours to do just this: the pseudo-device is only > >>> created if hwrng is present and not already created. > >> > >> I have mixed feelings about this. On the one hand, I agree that it > >> would be nice to allow H_RANDOM support by default. On the other hand > >> the patch below leaves no way to turn it off for testing purposes. It > >> also adds another place where the guest hardware depends on the host > >> configuration, which adds to the already substantial mess of ensuring > >> that source and destination hardware configuration matches for > >> migration. > > > > Yeah, describing the guest hw is really essential for migration... this > > is best addressed at the libvirt level with a full XML description of > > the machine... but FWIW if we are talking about running pseries on a > > POWER8 or newer host, I am not aware about "hwrng-less" boards... but > > I am probably missing something :) > > Maybe it would be at least ok to enable it by default as long as > "-nodefaults" has not been specified as command line option? > It makes a lot of sense indeed. I guess David should take your patch as it is now and the default behavior could be a follow up. > > Back to Thomas' patch, it does the job and brings H_RANDOM, which is > > currently missing. > > > > Acked-by: Greg Kurz <gkurz@linux.vnet.ibm.com> > > > > I could test both use-kvm and backend flavors (including migration). > > > > Tested-by: Greg Kurz <gkurz@linux.vnet.ibm.com> > > Thanks! > > Thomas > >
On 09/21/2015 12:00 AM, Thomas Huth wrote: >>> This being said, I am not sure about the use case where a user has a hwrng >>> capable platform and wants to run guests without any hwrng support at all is >>> an appropriate default behavior... I guess we will find more users that want >>> in-kernel being the default if it is available. >>> >>> The patch below modifies yours to do just this: the pseudo-device is only >>> created if hwrng is present and not already created. >> >> I have mixed feelings about this. On the one hand, I agree that it >> would be nice to allow H_RANDOM support by default. On the other hand >> the patch below leaves no way to turn it off for testing purposes. It >> also adds another place where the guest hardware depends on the host >> configuration, which adds to the already substantial mess of ensuring >> that source and destination hardware configuration matches for >> migration. > > I thought about this question on the weekend and came to the same > conclusion. I think if we want to enable this by default, it likely > should rather be done at the libvirt level instead? > Adding hardware by default to existing machine types has been a bane to libvirt usage in the past. If upgrading from an old qemu to a new one suddenly turns on new guest-visible hardware with no change to the command line, then libvirt has a much harder time migrating that guest. It's okay to have a new machine type turn on a feature by default, and to have knobs so that the feature can be turned on even for older machine types, but experience has shown that any new feature MUST come with knobs and a way to learn if the feature can be turned on/off, rather than just blindly assuming that turning it on is the right thing.
On Mon, Sep 21, 2015 at 10:37:28AM +0200, Greg Kurz wrote: > On Mon, 21 Sep 2015 10:26:52 +0200 > Thomas Huth <thuth@redhat.com> wrote: > > > On 21/09/15 10:01, Greg Kurz wrote: > > > On Mon, 21 Sep 2015 12:10:00 +1000 > > > David Gibson <david@gibson.dropbear.id.au> wrote: > > > > > >> On Fri, Sep 18, 2015 at 11:05:52AM +0200, Greg Kurz wrote: > > >>> On Thu, 17 Sep 2015 10:49:41 +0200 > > >>> Thomas Huth <thuth@redhat.com> wrote: > > >>> > > >>>> The PAPR interface defines a hypercall to pass high-quality > > >>>> hardware generated random numbers to guests. Recent kernels can > > >>>> already provide this hypercall to the guest if the right hardware > > >>>> random number generator is available. But in case the user wants > > >>>> to use another source like EGD, or QEMU is running with an older > > >>>> kernel, we should also have this call in QEMU, so that guests that > > >>>> do not support virtio-rng yet can get good random numbers, too. > > >>>> > > >>>> This patch now adds a new pseudo-device to QEMU that either > > >>>> directly provides this hypercall to the guest or is able to > > >>>> enable the in-kernel hypercall if available. > > ... > > >>> It is a good thing that the user can choose between in-kernel and backend, > > >>> and this patch does the work. > > >>> > > >>> This being said, I am not sure about the use case where a user has a hwrng > > >>> capable platform and wants to run guests without any hwrng support at all is > > >>> an appropriate default behavior... I guess we will find more users that want > > >>> in-kernel being the default if it is available. > > >>> > > >>> The patch below modifies yours to do just this: the pseudo-device is only > > >>> created if hwrng is present and not already created. > > >> > > >> I have mixed feelings about this. On the one hand, I agree that it > > >> would be nice to allow H_RANDOM support by default. On the other hand > > >> the patch below leaves no way to turn it off for testing purposes. It > > >> also adds another place where the guest hardware depends on the host > > >> configuration, which adds to the already substantial mess of ensuring > > >> that source and destination hardware configuration matches for > > >> migration. > > > > > > Yeah, describing the guest hw is really essential for migration... this > > > is best addressed at the libvirt level with a full XML description of > > > the machine... but FWIW if we are talking about running pseries on a > > > POWER8 or newer host, I am not aware about "hwrng-less" boards... but > > > I am probably missing something :) > > > > Maybe it would be at least ok to enable it by default as long as > > "-nodefaults" has not been specified as command line option? I like that in principle, but the -nodefaults option isn't exposed outside vl.c > It makes a lot of sense indeed. I guess David should take your patch > as it is now and the default behavior could be a follow up. That's the plan. I've already taken the base patch.
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c index 240fab72e7af..4b92efed2ef3 100644 --- a/hw/ppc/spapr.c +++ b/hw/ppc/spapr.c @@ -939,6 +939,14 @@ static int spapr_check_htab_fd(sPAPRMachineState *spapr) return rc; } +static void spapr_rng_create(void) +{ + Object *rng = object_new(TYPE_SPAPR_RNG); + + object_property_set_bool(rng, true, "use-kvm", &error_abort); + object_property_set_bool(rng, true, "realized", &error_abort); +} + static void ppc_spapr_reset(void) { sPAPRMachineState *spapr = SPAPR_MACHINE(qdev_get_machine()); @@ -962,6 +970,14 @@ static void ppc_spapr_reset(void) spapr->rtas_addr = rtas_limit - RTAS_MAX_SIZE; spapr->fdt_addr = spapr->rtas_addr - FDT_MAX_SIZE; + /* Create a rng device if the user did not provide it already and + * KVM has hwrng support. + */ + if (kvmppc_hwrng_present() && + !object_resolve_path_type("", TYPE_SPAPR_RNG, NULL)) { + spapr_rng_create(); + } + /* Load the fdt */ spapr_finalize_fdt(spapr, spapr->fdt_addr, spapr->rtas_addr, spapr->rtas_size); diff --git a/hw/ppc/spapr_rng.c b/hw/ppc/spapr_rng.c index ed43d5e04221..ee5af302bd4d 100644 --- a/hw/ppc/spapr_rng.c +++ b/hw/ppc/spapr_rng.c @@ -114,7 +114,7 @@ static void spapr_rng_realize(DeviceState *dev, Error **errp) sPAPRRngState *rngstate = SPAPR_RNG(dev); if (rngstate->use_kvm) { - if (kvmppc_enable_hwrng() == 0) { + if (kvmppc_hwrng_present() && kvmppc_enable_hwrng() == 0) { return; } /* diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c index 42f66fea23e9..008f8a26ab17 100644 --- a/target-ppc/kvm.c +++ b/target-ppc/kvm.c @@ -2485,11 +2485,12 @@ int kvm_arch_msi_data_to_gsi(uint32_t data) return data & 0xffff; } -int kvmppc_enable_hwrng(void) +bool kvmppc_hwrng_present(void) { - if (!kvm_enabled() || !kvm_check_extension(kvm_state, KVM_CAP_PPC_HWRNG)) { - return -1; - } + return kvm_enabled() && kvm_check_extension(kvm_state, KVM_CAP_PPC_HWRNG); +} +int kvmppc_enable_hwrng(void) +{ return kvmppc_enable_hcall(kvm_state, H_RANDOM); } diff --git a/target-ppc/kvm_ppc.h b/target-ppc/kvm_ppc.h index 68836b401105..4b78bfe5224a 100644 --- a/target-ppc/kvm_ppc.h +++ b/target-ppc/kvm_ppc.h @@ -55,6 +55,7 @@ void kvmppc_hash64_free_pteg(uint64_t token); void kvmppc_hash64_write_pte(CPUPPCState *env, target_ulong pte_index, target_ulong pte0, target_ulong pte1); bool kvmppc_has_cap_fixup_hcalls(void); +bool kvmppc_hwrng_present(void); int kvmppc_enable_hwrng(void); #else @@ -249,6 +250,11 @@ static inline bool kvmppc_has_cap_fixup_hcalls(void) abort(); } +static inline bool kvmppc_hwrng_present(void) +{ + return false; +} + static inline int kvmppc_enable_hwrng(void) { return -1;