| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <cjmbfd5uexxzqzfzzwpgbehpyv7iqz6du4wfvwqnrenwlaaujs@42fhftddlgyx>
Date: Tue, 10 Feb 2026 21:14:15 +0000
From: Yosry Ahmed <yosry.ahmed@...ux.dev>
To: Jim Mattson <jmattson@...gle.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>, Jonathan Corbet <corbet@....net>,
Sean Christopherson <seanjc@...gle.com>, Thomas Gleixner <tglx@...nel.org>,
Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
kvm@...r.kernel.org, linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
Josh Hilke <jrhilke@...gle.com>
Subject: Re: [PATCH v2] Introduce KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC
On Thu, Feb 05, 2026 at 03:15:26PM -0800, Jim Mattson wrote:
> Add KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC to allow L1 to set FREEZE_IN_SMM
> in vmcs12's GUEST_IA32_DEBUGCTL field, as permitted prior to
> commit 6b1dd26544d0 ("KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM
> while running the guest"). The quirk is enabled by default for backwards
> compatibility; userspace can disable it via KVM_CAP_DISABLE_QUIRKS2 for
> consistency with the constraints on WRMSR(IA32_DEBUGCTL).
>
> Note that the quirk only bypasses the consistency check. The vmcs02 bit is
> still owned by the host, and PMCs are not frozen during virtualized SMM.
> In particular, if a host administrator decides that PMCs should not be
> frozen during physical SMM, then L1 has no say in the matter.
>
> Fixes: 095686e6fcb4 ("KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter")
> Signed-off-by: Jim Mattson <jmattson@...gle.com>
> ---
> Documentation/virt/kvm/api.rst | 10 ++++++++++
> arch/x86/include/asm/kvm_host.h | 3 ++-
> arch/x86/include/uapi/asm/kvm.h | 1 +
> arch/x86/kvm/vmx/nested.c | 23 +++++++++++++++++++----
> 4 files changed, 32 insertions(+), 5 deletions(-)
>
> diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
> index d04b4bdd60c1..325e565ff99e 100644
> --- a/Documentation/virt/kvm/api.rst
> +++ b/Documentation/virt/kvm/api.rst
> @@ -8482,6 +8482,16 @@ KVM_X86_QUIRK_IGNORE_GUEST_PAT By default, on Intel platforms, KVM ignores
> guest software, for example if it does not
> expose a bochs graphics device (which is
> known to have had a buggy driver).
> +
> +KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC
> + By default, KVM relaxes the consistency
> + check for GUEST_IA32_DEBUGCTL in vmcb12
vmcs12*
> + to allow FREEZE_IN_SMM to be set. When
> + this quirk is disabled, KVM requires
> + this bit to be cleared. Note that the
> + vmcs02 bit is still completely
> + controlled by the host, regardless of
> + the quirk setting.
> =================================== ============================================
>
> 7.32 KVM_CAP_MAX_VCPU_ID
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index ff07c45e3c73..1669d4797f0b 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -2485,7 +2485,8 @@ int memslot_rmap_alloc(struct kvm_memory_slot *slot, unsigned long npages);
> KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS | \
> KVM_X86_QUIRK_SLOT_ZAP_ALL | \
> KVM_X86_QUIRK_STUFF_FEATURE_MSRS | \
> - KVM_X86_QUIRK_IGNORE_GUEST_PAT)
> + KVM_X86_QUIRK_IGNORE_GUEST_PAT | \
> + KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC)
>
> #define KVM_X86_CONDITIONAL_QUIRKS \
> (KVM_X86_QUIRK_CD_NW_CLEARED | \
> diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
> index 846a63215ce1..76128958bbca 100644
> --- a/arch/x86/include/uapi/asm/kvm.h
> +++ b/arch/x86/include/uapi/asm/kvm.h
> @@ -476,6 +476,7 @@ struct kvm_sync_regs {
> #define KVM_X86_QUIRK_SLOT_ZAP_ALL (1 << 7)
> #define KVM_X86_QUIRK_STUFF_FEATURE_MSRS (1 << 8)
> #define KVM_X86_QUIRK_IGNORE_GUEST_PAT (1 << 9)
> +#define KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC (1 << 10)
>
> #define KVM_STATE_NESTED_FORMAT_VMX 0
> #define KVM_STATE_NESTED_FORMAT_SVM 1
> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index 248635da6766..9bd29b9375fb 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -3300,10 +3300,25 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> if (CC(vmcs12->guest_cr4 & X86_CR4_CET && !(vmcs12->guest_cr0 & X86_CR0_WP)))
> return -EINVAL;
>
> - if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
> - (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
> - CC(!vmx_is_valid_debugctl(vcpu, vmcs12->guest_ia32_debugctl, false))))
> - return -EINVAL;
> + if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) {
> + u64 debugctl = vmcs12->guest_ia32_debugctl;
> +
> + /*
> + * FREEZE_IN_SMM is not virtualized, but allow L1 to set it
> + * in VMCB12's DEBUGCTL under a quirk for backwards
VMCS12's
> + * compatibility. Note that the quirk only relaxes the
> + * consistency check. The vmcb02 bit is still under the
vmcs02
> + * control of the host. In particular, if a host
> + * administrator decides to clear the bit, then L1 has no
> + * say in the matter.
> + */
> + if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC))
> + debugctl &= ~DEBUGCTLMSR_FREEZE_IN_SMM;
> +
> + if (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
> + CC(!vmx_is_valid_debugctl(vcpu, debugctl, false)))
> + return -EINVAL;
> + }
>
> if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&
> CC(!kvm_pat_valid(vmcs12->guest_ia32_pat)))
>
> base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a
> --
> 2.53.0.rc2.204.g2597b5adb4-goog
>
Powered by blists - more mailing lists