[pve-devel] [PATCH qemu-server 2/2] vm start: catch outdated Zen 5 firmware

[Fiona Ebner]

With the 6.17.9 kernel, the 'rdseed' feature is not available for some
Zen 5 host CPUs anymore unless the firmware is new enough. QEMU will
complain about the missing feature bit upon VM start. Add some context
to the QEMU error message if the host is Zen 5 (or 6, same CPU family
number, but the warning message already states 'Zen 5' explicitly and
probably the feature bit won't be missing in the first place).

Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
---
 src/PVE/QemuServer.pm | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index bad3527c..84c6b79b 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -5413,6 +5413,17 @@ my sub check_efi_vars {
     return;
 }
 
+my $log_filter_catch_outdated_zen5_firmware = sub {
+    my ($line) = @_;
+    print "$line\n";
+    if ($line =~ m/host doesn't support requested feature:.*rdseed\s*\[bit 18\]/) {
+        log_warn("On Zen 5 systems, the rdseed CPU flag might not be available when the CPU"
+            . " firmware is outdated. See:\n"
+            . "https://security-tracker.debian.org/tracker/CVE-2025-62626\n"
+            . "https://pve.proxmox.com/pve-docs/chapter-sysadmin.html#sysadmin_firmware_cpu");
+    }
+};
+
 # see vm_start_nolock for parameters, additionally:
 # migrate_opts:
 #   storagemap = parsed storage map for allocating NBD disks
@@ -5687,6 +5698,8 @@ sub vm_start_nolock {
     if ($migratedfrom) {
         $run_params{quiet} = 1;
         $run_params{logfunc} = sub { print "QEMU: $_[0]\n" };
+    } elsif ($cpuinfo->{vendor} eq 'AuthenticAMD' && $cpuinfo->{family} == 26) {
+        $run_params{logfunc} = $log_filter_catch_outdated_zen5_firmware;
     }
 
     my %systemd_properties = (
-- 
2.47.3