From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id BEBDD1FF143 for ; Mon, 19 Jan 2026 17:02:02 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 8770F23A57; Mon, 19 Jan 2026 17:01:59 +0100 (CET) From: Fiona Ebner To: pve-devel@lists.proxmox.com Date: Mon, 19 Jan 2026 17:01:04 +0100 Message-ID: <20260119160122.177390-3-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260119160122.177390-1-f.ebner@proxmox.com> References: <20260119160122.177390-1-f.ebner@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1768838431687 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.017 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH qemu-server 2/2] vm start: catch outdated Zen 5 firmware X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" With the 6.17.9 kernel, the 'rdseed' feature is not available for some Zen 5 host CPUs anymore unless the firmware is new enough. QEMU will complain about the missing feature bit upon VM start. Add some context to the QEMU error message if the host is Zen 5 (or 6, same CPU family number, but the warning message already states 'Zen 5' explicitly and probably the feature bit won't be missing in the first place). Signed-off-by: Fiona Ebner --- src/PVE/QemuServer.pm | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm index bad3527c..84c6b79b 100644 --- a/src/PVE/QemuServer.pm +++ b/src/PVE/QemuServer.pm @@ -5413,6 +5413,17 @@ my sub check_efi_vars { return; } +my $log_filter_catch_outdated_zen5_firmware = sub { + my ($line) = @_; + print "$line\n"; + if ($line =~ m/host doesn't support requested feature:.*rdseed\s*\[bit 18\]/) { + log_warn("On Zen 5 systems, the rdseed CPU flag might not be available when the CPU" + . " firmware is outdated. See:\n" + . "https://security-tracker.debian.org/tracker/CVE-2025-62626\n" + . "https://pve.proxmox.com/pve-docs/chapter-sysadmin.html#sysadmin_firmware_cpu"); + } +}; + # see vm_start_nolock for parameters, additionally: # migrate_opts: # storagemap = parsed storage map for allocating NBD disks @@ -5687,6 +5698,8 @@ sub vm_start_nolock { if ($migratedfrom) { $run_params{quiet} = 1; $run_params{logfunc} = sub { print "QEMU: $_[0]\n" }; + } elsif ($cpuinfo->{vendor} eq 'AuthenticAMD' && $cpuinfo->{family} == 26) { + $run_params{logfunc} = $log_filter_catch_outdated_zen5_firmware; } my %systemd_properties = ( -- 2.47.3 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel