Files
systemd/src/basic
Paul Meyer d76ce200a6 confidential-virt: treat an unreadable SEV MSR as confidential
msr() returned 0 on failure, indistinguishable from a real MSR value of
0. With /dev/cpu/0/msr unavailable (e.g. the msr module not loaded in the
initrd), detect_sev() read 0 and reported a genuine SEV/-ES/-SNP guest as
CONFIDENTIAL_VIRTUALIZATION_NONE.

That inverts the firmware-credential trust gate: import_credentials_*()
skip fw_cfg/SMBIOS credentials only when detect_confidential_virtualization()
is > 0 ("don't trust firmware in confidential VMs"). A false NONE makes a
confidential guest trust and import credentials injected by the untrusted
hypervisor.

msr() now returns a negative errno, and detect_sev() assumes plain SEV when
the MSR is unreadable but CPUID already advertised SEV under a hypervisor,
so the gate still trips.

The conservative branch only fires when CPUID already advertised SEV, i.e.
for a guest the hypervisor marked SEV-capable. QEMU gates that CPUID leaf on
the SEV launch object and does not expose it to ordinary guests even under
-cpu host, so it does not misfire for non-confidential guests. Were a
hypervisor to expose the bit anyway the outcome is fail-safe (we only
decline to trust firmware-supplied data); nothing in-tree branches on the
specific SEV tier.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
2026-06-23 11:55:00 +02:00
..
…
2026-05-25 12:37:36 +02:00
2026-01-06 10:34:02 +01:00
2025-09-19 16:46:07 +02:00
2026-04-26 21:21:49 +02:00
2026-03-03 22:18:26 +01:00
2026-06-22 10:54:49 +01:00
…
2026-02-05 16:18:35 +01:00
2026-03-31 18:30:40 +02:00
2026-04-09 22:47:10 +02:00
2026-04-09 22:47:10 +02:00
2025-12-15 08:50:13 +09:00
…
…
…
2026-06-01 10:56:15 +02:00
2026-06-01 10:56:15 +02:00
2026-05-05 15:09:47 +02:00
2026-05-05 15:09:47 +02:00
2025-12-15 08:50:13 +09:00