From 7ffe9e519837a0503b1cb42ee6f2f189371ce6dd Mon Sep 17 00:00:00 2001 From: Jakob Naucke Date: Wed, 2 Feb 2022 17:06:20 +0100 Subject: [PATCH] virtcontainers: Do not add a virtio-rng-ccw device On s390x, skip adding a virtio-rng device. The on-chip CPACF provides entropy instead. For Confidential Containers, when using Secure Execution, entropy attacks on virtio-rng are mitigated. Fixes: #3598 Signed-off-by: Jakob Naucke --- src/runtime/virtcontainers/qemu.go | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/src/runtime/virtcontainers/qemu.go b/src/runtime/virtcontainers/qemu.go index b522928a73..6e584628fb 100644 --- a/src/runtime/virtcontainers/qemu.go +++ b/src/runtime/virtcontainers/qemu.go @@ -619,13 +619,16 @@ func (q *qemu) CreateVM(ctx context.Context, id string, networkNS NetworkNamespa qemuConfig.IOThreads = []govmmQemu.IOThread{*ioThread} } // Add RNG device to hypervisor - rngDev := config.RNGDev{ - ID: rngID, - Filename: q.config.EntropySource, - } - qemuConfig.Devices, err = q.arch.appendRNGDevice(ctx, qemuConfig.Devices, rngDev) - if err != nil { - return err + // Skip for s390x as CPACF is used + if machine.Type != QemuCCWVirtio { + rngDev := config.RNGDev{ + ID: rngID, + Filename: q.config.EntropySource, + } + qemuConfig.Devices, err = q.arch.appendRNGDevice(ctx, qemuConfig.Devices, rngDev) + if err != nil { + return err + } } // Add PCIe Root Port devices to hypervisor