Re: [RFC v2 18/24] hw/arm/virt: Disable DTB randomness for confidential VMs

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Jul 28, 2026 at 01:26:24PM -0600, Mathieu Poirier wrote:
> From: Jean-Philippe Brucker <jean-philippe@linaro.org>
> 
> The dtb-randomness feature, which adds random seeds to the DTB, isn't
> really compatible with confidential VMs since it randomizes the Realm
> Initial Measurement. Enabling it is not an error, but it prevents
> attestation. It also isn't useful to a Realm, which doesn't trust host
> input.
> 
> Currently the feature is automatically enabled, unless the user disables
> it on the command-line. Change it to OnOffAuto, and automatically
> disable it for confidential VMs, unless the user explicitly enables it.
> 
> Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
> Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
> ---
>  docs/system/arm/virt.rst |  9 +++++----
>  hw/arm/virt.c            | 41 +++++++++++++++++++++++++---------------
>  include/hw/arm/virt.h    |  2 +-
>  3 files changed, 32 insertions(+), 20 deletions(-)
> 
> diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
> index 5f6dd1797862..9882b842ddd5 100644
> --- a/docs/system/arm/virt.rst
> +++ b/docs/system/arm/virt.rst
> @@ -238,10 +238,11 @@ dtb-randomness
>    rng-seed and kaslr-seed nodes (in both "/chosen" and
>    "/secure-chosen") to use for features like the random number
>    generator and address space randomisation. The default is
> -  ``on``. You will want to disable it if your trusted boot chain
> -  will verify the DTB it is passed, since this option causes the
> -  DTB to be non-deterministic. It would be the responsibility of
> -  the firmware to come up with a seed and pass it on if it wants to.
> +  ``off`` for confidential VMs, and ``on`` otherwise. You will want
> +  to disable it if your trusted boot chain will verify the DTB it is
> +  passed, since this option causes the DTB to be non-deterministic.
> +  It would be the responsibility of the firmware to come up with a
> +  seed and pass it on if it wants to.
>  
>  dtb-kaslr-seed
>    A deprecated synonym for dtb-randomness.
> diff --git a/hw/arm/virt.c b/hw/arm/virt.c
> index fa6cd62a335c..65ed8573f8b1 100644
> --- a/hw/arm/virt.c
> +++ b/hw/arm/virt.c
> @@ -401,6 +401,7 @@ static int gic_fdt_irq_type_spi(const VirtMachineState *vms)
>  
>  static void create_fdt(VirtMachineState *vms)
>  {
> +    bool dtb_randomness = true;
>      MachineState *ms = MACHINE(vms);
>      int nb_numa_nodes = ms->numa_state->num_nodes;
>      void *fdt = create_device_tree(&vms->fdt_size);
> @@ -410,6 +411,16 @@ static void create_fdt(VirtMachineState *vms)
>          exit(1);
>      }
>  
> +    /*
> +     * Including random data in the DTB causes random intial measurement on CCA,
> +     * so disable it for confidential VMs.
> +     */
> +    if (vms->dtb_randomness == ON_OFF_AUTO_OFF ||
> +        (vms->dtb_randomness == ON_OFF_AUTO_AUTO &&
> +         virt_machine_is_confidential(vms))) {
> +        dtb_randomness = false;
> +    }

Is there any valid use case for ON_OFF_AUTO_ON with RME ?

It feels like a miscnofiguration that ought to result in a fatal
error message, rather than booting with a VM config that cannot
be verified due to random measurement

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|