virtcontainers: Do not add a virtio-rng-ccw device
On s390x, skip adding a virtio-rng device. The on-chip CPACF provides
entropy instead. For Confidential Containers, when using Secure
Execution, entropy attacks on virtio-rng are mitigated.
Fixes:
@@ -619,6 +619,8 @@ func (q *qemu) CreateVM(ctx context.Context, id string, networkNS NetworkNamespa
qemuConfig.IOThreads = []govmmQemu.IOThread{*ioThread}
}
// Add RNG device to hypervisor
+ // Skip for s390x as CPACF is used
+ if machine.Type != QemuCCWVirtio {
rngDev := config.RNGDev{
ID: rngID,
Filename: q.config.EntropySource,
@@ -627,6 +629,7 @@ func (q *qemu) CreateVM(ctx context.Context, id string, networkNS NetworkNamespa
if err != nil {
return err
}
+ }
// Add PCIe Root Port devices to hypervisor
// The pcie.0 bus do not support hot-plug, but PCIe device can be hot-plugged into PCIe Root Port.
