| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALMp9eT3NzQyeC4vgwF=82hUFGx6Zgp3NYWwAvMS5J7KCLFPcg@mail.gmail.com>
Date: Wed, 11 Feb 2026 10:03:46 -0800
From: Jim Mattson <jmattson@...gle.com>
To: Yosry Ahmed <yosry.ahmed@...ux.dev>
Cc: Paolo Bonzini <pbonzini@...hat.com>, Jonathan Corbet <corbet@....net>,
Sean Christopherson <seanjc@...gle.com>, Thomas Gleixner <tglx@...nel.org>, Ingo Molnar <mingo@...hat.com>,
Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
"H. Peter Anvin" <hpa@...or.com>, kvm@...r.kernel.org, linux-doc@...r.kernel.org,
linux-kernel@...r.kernel.org, Josh Hilke <jrhilke@...gle.com>
Subject: Re: [PATCH v2] Introduce KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC
On Tue, Feb 10, 2026 at 1:14 PM Yosry Ahmed <yosry.ahmed@...ux.dev> wrote:
>
> On Thu, Feb 05, 2026 at 03:15:26PM -0800, Jim Mattson wrote:
> > Add KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC to allow L1 to set FREEZE_IN_SMM
> > in vmcs12's GUEST_IA32_DEBUGCTL field, as permitted prior to
> > commit 6b1dd26544d0 ("KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM
> > while running the guest"). The quirk is enabled by default for backwards
> > compatibility; userspace can disable it via KVM_CAP_DISABLE_QUIRKS2 for
> > consistency with the constraints on WRMSR(IA32_DEBUGCTL).
> >
> > Note that the quirk only bypasses the consistency check. The vmcs02 bit is
> > still owned by the host, and PMCs are not frozen during virtualized SMM.
> > In particular, if a host administrator decides that PMCs should not be
> > frozen during physical SMM, then L1 has no say in the matter.
> >
> > Fixes: 095686e6fcb4 ("KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter")
> > Signed-off-by: Jim Mattson <jmattson@...gle.com>
> > ---
> > Documentation/virt/kvm/api.rst | 10 ++++++++++
> > arch/x86/include/asm/kvm_host.h | 3 ++-
> > arch/x86/include/uapi/asm/kvm.h | 1 +
> > arch/x86/kvm/vmx/nested.c | 23 +++++++++++++++++++----
> > 4 files changed, 32 insertions(+), 5 deletions(-)
> >
> > diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
> > index d04b4bdd60c1..325e565ff99e 100644
> > --- a/Documentation/virt/kvm/api.rst
> > +++ b/Documentation/virt/kvm/api.rst
> > @@ -8482,6 +8482,16 @@ KVM_X86_QUIRK_IGNORE_GUEST_PAT By default, on Intel platforms, KVM ignores
> > guest software, for example if it does not
> > expose a bochs graphics device (which is
> > known to have had a buggy driver).
> > +
> > +KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC
> > + By default, KVM relaxes the consistency
> > + check for GUEST_IA32_DEBUGCTL in vmcb12
>
> vmcs12*
>
> > + to allow FREEZE_IN_SMM to be set. When
> > + this quirk is disabled, KVM requires
> > + this bit to be cleared. Note that the
> > + vmcs02 bit is still completely
> > + controlled by the host, regardless of
> > + the quirk setting.
> > =================================== ============================================
> >
> > 7.32 KVM_CAP_MAX_VCPU_ID
> > diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> > index ff07c45e3c73..1669d4797f0b 100644
> > --- a/arch/x86/include/asm/kvm_host.h
> > +++ b/arch/x86/include/asm/kvm_host.h
> > @@ -2485,7 +2485,8 @@ int memslot_rmap_alloc(struct kvm_memory_slot *slot, unsigned long npages);
> > KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS | \
> > KVM_X86_QUIRK_SLOT_ZAP_ALL | \
> > KVM_X86_QUIRK_STUFF_FEATURE_MSRS | \
> > - KVM_X86_QUIRK_IGNORE_GUEST_PAT)
> > + KVM_X86_QUIRK_IGNORE_GUEST_PAT | \
> > + KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC)
> >
> > #define KVM_X86_CONDITIONAL_QUIRKS \
> > (KVM_X86_QUIRK_CD_NW_CLEARED | \
> > diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
> > index 846a63215ce1..76128958bbca 100644
> > --- a/arch/x86/include/uapi/asm/kvm.h
> > +++ b/arch/x86/include/uapi/asm/kvm.h
> > @@ -476,6 +476,7 @@ struct kvm_sync_regs {
> > #define KVM_X86_QUIRK_SLOT_ZAP_ALL (1 << 7)
> > #define KVM_X86_QUIRK_STUFF_FEATURE_MSRS (1 << 8)
> > #define KVM_X86_QUIRK_IGNORE_GUEST_PAT (1 << 9)
> > +#define KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC (1 << 10)
> >
> > #define KVM_STATE_NESTED_FORMAT_VMX 0
> > #define KVM_STATE_NESTED_FORMAT_SVM 1
> > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> > index 248635da6766..9bd29b9375fb 100644
> > --- a/arch/x86/kvm/vmx/nested.c
> > +++ b/arch/x86/kvm/vmx/nested.c
> > @@ -3300,10 +3300,25 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> > if (CC(vmcs12->guest_cr4 & X86_CR4_CET && !(vmcs12->guest_cr0 & X86_CR0_WP)))
> > return -EINVAL;
> >
> > - if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
> > - (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
> > - CC(!vmx_is_valid_debugctl(vcpu, vmcs12->guest_ia32_debugctl, false))))
> > - return -EINVAL;
> > + if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) {
> > + u64 debugctl = vmcs12->guest_ia32_debugctl;
> > +
> > + /*
> > + * FREEZE_IN_SMM is not virtualized, but allow L1 to set it
> > + * in VMCB12's DEBUGCTL under a quirk for backwards
>
> VMCS12's
>
> > + * compatibility. Note that the quirk only relaxes the
> > + * consistency check. The vmcb02 bit is still under the
>
> vmcs02
>
/facepalm
> > + * control of the host. In particular, if a host
> > + * administrator decides to clear the bit, then L1 has no
> > + * say in the matter.
> > + */
> > + if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC))
> > + debugctl &= ~DEBUGCTLMSR_FREEZE_IN_SMM;
> > +
> > + if (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
> > + CC(!vmx_is_valid_debugctl(vcpu, debugctl, false)))
> > + return -EINVAL;
> > + }
> >
> > if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&
> > CC(!kvm_pat_valid(vmcs12->guest_ia32_pat)))
> >
> > base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a
> > --
> > 2.53.0.rc2.204.g2597b5adb4-goog
> >
>
Powered by blists - more mailing lists