Paul Meyer
d76ce200a6
confidential-virt: treat an unreadable SEV MSR as confidential
...
msr() returned 0 on failure, indistinguishable from a real MSR value of
0. With /dev/cpu/0/msr unavailable (e.g. the msr module not loaded in the
initrd), detect_sev() read 0 and reported a genuine SEV/-ES/-SNP guest as
CONFIDENTIAL_VIRTUALIZATION_NONE.
That inverts the firmware-credential trust gate: import_credentials_*()
skip fw_cfg/SMBIOS credentials only when detect_confidential_virtualization()
is > 0 ("don't trust firmware in confidential VMs"). A false NONE makes a
confidential guest trust and import credentials injected by the untrusted
hypervisor.
msr() now returns a negative errno, and detect_sev() assumes plain SEV when
the MSR is unreadable but CPUID already advertised SEV under a hypervisor,
so the gate still trips.
The conservative branch only fires when CPUID already advertised SEV, i.e.
for a guest the hypervisor marked SEV-capable. QEMU gates that CPUID leaf on
the SEV launch object and does not expose it to ordinary guests even under
-cpu host, so it does not misfire for non-confidential guests. Were a
hypervisor to expose the bit anyway the outcome is fail-safe (we only
decline to trust firmware-supplied data); nothing in-tree branches on the
specific SEV tier.
Signed-off-by: Paul Meyer <katexochen0@gmail.com >
2026-06-23 11:55:00 +02:00
..
2025-10-16 17:00:29 +02:00
2026-03-31 18:30:40 +02:00
2026-06-12 11:21:58 +02:00
2026-03-18 12:03:38 +01:00
2026-04-24 11:04:37 +02:00
2026-05-21 09:55:04 +00:00
2026-05-25 12:37:36 +02:00
2026-05-15 10:49:37 +02:00
2025-10-16 17:00:29 +02:00
2025-10-22 10:10:24 +02:00
2026-05-21 10:33:03 +09:00
2025-10-16 17:00:29 +02:00
2026-05-21 16:21:13 +02:00
2025-10-16 17:00:29 +02:00
2026-05-28 13:33:08 +01:00
2026-05-21 10:33:03 +09:00
2026-04-12 15:27:15 +02:00
2026-01-06 10:34:02 +01:00
2025-10-16 17:00:29 +02:00
2025-10-16 17:00:29 +02:00
2025-10-23 23:46:49 +09:00
2025-10-23 23:46:49 +09:00
2025-07-11 18:33:43 +09:00
2025-11-12 14:17:44 +08:00
2025-10-24 01:52:59 +09:00
2025-10-16 17:00:29 +02:00
2026-05-28 20:55:01 +01:00
2026-05-28 20:55:01 +01:00
2026-05-28 13:33:08 +01:00
2026-04-20 23:35:31 +02:00
2025-12-15 08:50:13 +09:00
2025-10-16 17:00:29 +02:00
2026-05-21 10:33:03 +09:00
2026-05-19 19:22:06 +00:00
2026-04-22 17:41:42 +02:00
2026-05-28 13:33:08 +01:00
2026-04-10 15:08:02 +02:00
2026-06-23 11:55:00 +02:00
2026-05-21 10:33:03 +09:00
2026-02-09 02:05:57 +01:00
2026-04-13 13:20:43 +02:00
2025-11-19 13:14:15 +01:00
2026-03-31 18:30:40 +02:00
2025-10-16 17:00:29 +02:00
2026-03-03 08:49:23 +01:00
2025-11-22 10:19:41 +01:00
2026-04-22 17:41:42 +02:00
2026-05-13 10:29:50 +02:00
2025-10-16 17:00:29 +02:00
2026-02-13 16:08:23 +09:00
2026-05-21 10:33:03 +09:00
2026-05-21 10:33:03 +09:00
2026-03-20 16:34:58 +01:00
2026-03-04 07:36:10 +09:00
2026-05-01 20:11:53 +02:00
2026-01-28 10:56:53 +09:00
2025-10-16 17:00:29 +02:00
2025-11-20 09:04:35 +09:00
2026-05-19 01:45:54 +09:00
2026-06-17 08:53:55 +02:00
2026-04-02 16:03:29 +02:00
2026-05-13 07:47:53 +09:00
2026-05-16 22:33:40 +09:00
2026-03-31 18:30:40 +02:00
2025-10-16 17:00:29 +02:00
2026-05-28 13:33:08 +01:00
2026-05-28 13:33:08 +01:00
2026-05-21 09:55:04 +00:00
2026-05-21 09:55:04 +00:00
2026-05-28 13:33:08 +01:00
2026-05-11 12:04:02 +02:00
2026-05-18 02:44:46 +09:00
2025-09-19 14:46:55 +02:00
2026-01-02 09:22:59 +01:00
2025-09-19 16:46:07 +02:00
2025-11-22 10:19:41 +01:00
2026-05-28 13:33:08 +01:00
2026-04-26 21:21:49 +02:00
2026-06-19 15:22:02 +09:00
2026-06-19 15:22:02 +09:00
2025-07-11 13:05:42 +09:00
2025-07-11 13:05:42 +09:00
2025-07-11 18:33:43 +09:00
2026-02-24 12:58:09 +00:00
2026-02-05 14:14:39 +01:00
2026-02-05 14:14:39 +01:00
2026-03-31 18:30:40 +02:00
2025-10-16 17:00:29 +02:00
2025-11-25 17:15:30 +01:00
2025-11-25 17:15:30 +01:00
2026-03-31 18:30:40 +02:00
2025-10-16 17:00:29 +02:00
2026-03-31 18:30:40 +02:00
2025-10-16 17:00:29 +02:00
2026-04-12 15:27:15 +02:00
2025-11-26 19:02:31 +09:00
2026-03-03 22:18:26 +01:00
2025-11-26 19:02:31 +09:00
2026-04-01 15:12:46 +02:00
2025-10-16 17:00:29 +02:00
2026-06-22 14:47:20 +01:00
2026-06-20 14:26:41 +02:00
2026-03-31 18:30:40 +02:00
2025-10-16 17:00:29 +02:00
2025-10-16 17:00:29 +02:00
2025-10-16 17:00:29 +02:00
2026-05-24 20:36:43 +02:00
2026-05-24 20:36:43 +02:00
2026-05-03 10:18:38 +01:00
2026-05-21 10:33:03 +09:00
2026-05-12 15:33:21 +09:00
2026-05-12 15:33:21 +09:00
2025-10-16 17:00:29 +02:00
2025-07-11 13:05:46 +09:00
2025-10-16 17:00:29 +02:00
2026-05-21 10:33:03 +09:00
2026-05-21 10:33:03 +09:00
2026-04-08 01:28:51 +01:00
2025-10-16 17:00:29 +02:00
2025-10-16 17:00:29 +02:00
2026-06-01 18:24:15 +01:00
2026-06-01 18:24:15 +01:00
2026-05-18 21:17:38 +00:00
2025-10-16 17:00:29 +02:00
2026-05-21 09:55:04 +00:00
2026-05-21 09:55:04 +00:00
2026-05-21 09:55:04 +00:00
2026-06-22 10:54:49 +01:00
2026-03-04 07:36:10 +09:00
2025-10-16 17:00:29 +02:00
2026-05-21 10:33:03 +09:00
2026-05-20 11:03:27 +02:00
2026-05-21 11:53:32 +01:00
2025-07-01 12:29:15 +09:00
2025-10-16 17:00:29 +02:00
2026-03-25 14:50:19 +01:00
2026-05-21 10:33:03 +09:00
2025-10-22 10:06:07 +02:00
2026-02-18 00:47:25 +09:00
2025-10-16 17:00:29 +02:00
2026-05-21 16:21:13 +02:00
2025-07-13 12:41:14 +02:00
2025-07-13 12:41:14 +02:00
2026-05-21 10:33:03 +09:00
2025-11-02 17:13:31 +09:00
2026-06-03 20:22:48 +01:00
2026-06-03 16:02:58 +02:00
2026-06-13 17:11:10 +02:00
2026-05-15 18:05:21 +00:00
2025-11-26 19:02:31 +09:00
2026-03-31 18:30:40 +02:00
2025-10-16 17:00:29 +02:00
2026-05-28 13:33:08 +01:00
2026-05-12 00:07:42 +01:00
2026-03-31 18:30:40 +02:00
2026-04-20 12:02:54 +02:00
2026-05-18 12:28:08 +02:00
2026-03-06 02:39:39 +09:00
2025-11-24 12:45:06 +01:00
2025-10-16 17:00:29 +02:00
2026-02-05 16:18:35 +01:00
2025-10-19 10:01:46 +09:00
2026-05-21 09:55:04 +00:00
2025-12-20 21:41:01 +01:00
2026-03-31 18:30:40 +02:00
2025-10-16 17:00:29 +02:00
2026-05-15 09:26:48 +02:00
2026-03-26 18:53:40 +01:00
2026-05-13 10:29:50 +02:00
2026-02-17 17:52:20 +01:00
2025-12-15 08:50:13 +09:00
2025-11-26 19:02:31 +09:00
2026-04-09 22:47:10 +02:00
2026-04-09 22:47:10 +02:00
2025-10-16 17:00:29 +02:00
2026-04-18 09:56:38 +02:00
2026-04-18 09:56:38 +02:00
2025-12-15 08:50:13 +09:00
2025-11-22 10:19:41 +01:00
2025-10-16 17:00:29 +02:00
2026-06-22 14:40:16 +02:00
2026-06-22 14:40:16 +02:00
2025-10-16 17:00:29 +02:00
2026-03-31 18:30:40 +02:00
2026-01-02 04:05:45 +09:00
2026-01-02 04:05:45 +09:00
2025-10-16 17:00:29 +02:00
2026-06-22 14:39:50 +02:00
2026-06-22 14:39:50 +02:00
2025-10-16 17:00:29 +02:00
2026-05-19 08:14:36 +00:00
2026-05-19 08:14:36 +00:00
2026-05-03 10:20:18 +01:00
2026-05-03 10:20:18 +01:00
2026-06-22 21:57:03 +02:00
2026-06-13 15:54:50 +02:00
2026-05-20 11:39:10 +02:00
2026-05-20 11:39:10 +02:00
2025-10-16 17:00:29 +02:00
2026-05-28 13:33:08 +01:00
2026-04-20 23:33:02 +02:00
2026-05-16 18:32:14 +02:00
2026-05-24 20:36:56 +02:00
2026-02-05 14:14:39 +01:00
2026-02-05 14:14:39 +01:00
2026-03-06 17:46:59 +01:00
2026-03-06 17:46:59 +01:00
2025-10-16 17:00:29 +02:00
2026-03-31 18:30:40 +02:00
2026-01-02 09:22:23 +01:00
2026-06-22 17:19:46 +02:00
2026-06-22 14:41:16 +02:00
2026-06-01 10:56:15 +02:00
2026-06-01 10:56:15 +02:00
2026-04-19 14:06:15 +02:00
2025-10-16 17:00:29 +02:00
2025-10-16 17:00:29 +02:00
2025-11-26 19:02:31 +09:00
2026-04-21 17:07:53 +02:00
2026-01-02 04:05:45 +09:00
2026-05-20 16:34:21 +02:00
2026-05-20 16:34:21 +02:00
2026-05-05 15:09:47 +02:00
2026-05-05 15:09:47 +02:00
2026-03-27 11:55:32 +00:00
2025-10-16 17:00:29 +02:00
2026-04-12 15:27:15 +02:00
2026-02-24 18:29:37 +01:00
2026-04-12 13:24:50 +01:00
2026-02-24 18:29:37 +01:00
2025-10-16 17:00:29 +02:00
2026-05-21 10:33:03 +09:00
2026-04-14 05:37:49 -07:00
2026-04-14 05:37:49 -07:00
2026-04-12 15:27:15 +02:00
2025-11-26 19:02:31 +09:00
2026-05-21 18:02:05 +02:00
2026-05-21 18:02:05 +02:00
2026-06-17 08:53:55 +02:00
2025-10-16 17:00:29 +02:00
2025-12-15 08:50:13 +09:00
2026-01-02 04:05:45 +09:00
2026-04-08 14:48:10 +01:00
2025-10-16 17:00:29 +02:00