The dtb-randomness feature, which adds random seeds to the DTB, isn't
really compatible with confidential VMs since it randomizes the Realm
Initial Measurement. Enabling it is not an error, but it prevents
attestation. It also isn't useful to a Realm, which doesn't trust host
input.
Currently the feature is automatically enabled, unless the user disables
it on the command-line. Change it to OnOffAuto, and automatically
disable it for confidential VMs, unless the user explicitly enables it.
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
---
docs/system/arm/virt.rst | 9 +++++----
include/hw/arm/virt.h | 2 +-
hw/arm/virt.c | 41 +++++++++++++++++++++++++---------------
3 files changed, 32 insertions(+), 20 deletions(-)