Provide initial randomness for aarch64 - #5906
Merged
ShadowCurse merged 2 commits intoMay 22, 2026
Merged
Conversation
ShadowCurse
added
Status: Awaiting review
ShadowCurse
force-pushed
the
provide_initial_randomness
branch
from
May 21, 2026 15:47
f8d7544 to
8948f8a
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5906 +/- ##
=======================================
Coverage 82.89% 82.89%
=======================================
Files 277 277
Lines 30072 30075 +3
=======================================
+ Hits 24927 24930 +3
Misses 5145 5145
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
deRemo
self-requested a review
May 21, 2026 16:03
ShadowCurse
force-pushed
the
provide_initial_randomness
branch
from
May 21, 2026 16:37
8948f8a to
46d8347
Compare
deRemo
previously approved these changes
May 21, 2026
Older aarch64 machines may not have hardware random generators. Because of this it takes a lot of time for the entropy to built up naturally in VMs booted on such hosts. To mitigate this add `rng-seed` FDT node which will contain 64 bytes of the initial seed guest can use. Note about x86_64: Since we only support FDT on aarch64, this is aarch64 only solution. On x86_64 the only option we have is to use `SETUP_RNG_SEED` setup_data section in the Linux boot protocol. The problem with it is that it only works with Linux boot which is less preferable than PVH boot (which does not support setup_data and thus `SETUP_RNG_SEED`). Additionally there is no ACPI support for providing initial seed as well. The only proper way to do this on x86_64 is to use EFI, which we don't do right now. Signed-off-by: Egor Lazarchuk <yegorlz@amazon.co.uk>
Mention addition of new FDT node with initial random seed for the guest. Signed-off-by: Egor Lazarchuk <yegorlz@amazon.co.uk>
ShadowCurse
force-pushed
the
provide_initial_randomness
branch
from
May 22, 2026 13:16
46d8347 to
d73dca8
Compare
Manciukic
approved these changes
May 22, 2026
deRemo
approved these changes
May 22, 2026
11 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Add
rng-seednode to the FDT on aarch64 to help VMs booted on the older hosts which do not have hardware rng device to get initial randomness.Reason
Help older instances to run VMs with good initial entropy.
License Acceptance
By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following Developer
Certificate of Origin and signing off your commits, please check
CONTRIBUTING.md.PR Checklist
tools/devtool checkbuild --allto verify that the PR passesbuild checks on all supported architectures.
tools/devtool checkstyleto verify that the PR passes theautomated style checks.
how they are solving the problem in a clear and encompassing way.
in the PR.
CHANGELOG.md.Runbook for Firecracker API changes.
integration tests.
TODO.rust-vmm.