Re: [RFC PATCH 04/12] firmware: efi: libstub: x86-stub: Enable VSM awareness in efi os indications variable

[Thara Gopinath <tgopinath@linux.microsoft.com>]

On 9/1/2026 9:09 PM, Wei Liu wrote:
> On Tue, Sep 01, 2026 at 09:55:18AM -0700, Thara Gopinath wrote:
>> Set bit 0 of the Hyper-V private OsLoaderIndications EFI variable
>> during exit_boot() so the bootloader/firmware knows the OS intends
>> to enable VTL1. Without this, VTL1 cannot be brought up from the
>> Linux kernel.
>>
>> The support bit is first checked in OsLoaderIndicationsSupported,
>> and the variable is only written when the VSM bit is not already
>> set.
>>
>> Signed-off-by: Thara Gopinath <tgopinath@linux.microsoft.com>
>> ---
>>  drivers/firmware/efi/libstub/x86-stub.c | 57 +++++++++++++++++++++++++
>>  1 file changed, 57 insertions(+)
>>
> [...]
>> +#ifdef CONFIG_HYPERV_VSM
>> +static void efi_set_hv_os_indications(void)
>> +{
>> +	efi_guid_t guid = HYPERV_PRIVATE_EFI_NAMESPACE_GUID;
>> +	efi_status_t status;
>> +	unsigned long size;
>> +	u32 attr, val;
>> +
>> +	size = sizeof(val);
>> +	status = get_efi_var(efi_HvPrivOsloaderIndicationsSupported_name,
>> +			     &guid, &attr, &size, &val);
>> +	if (status != EFI_SUCCESS) {
>> +		efi_err("Could not read Hyper-V OsloaderIndicationsSupported\n");
>> +		return;
>> +	}
>> +
>> +	if (!(val & HV_OSLOADER_INDICATION_VSM)) {
>> +		efi_info("Hyper-V does not support VSM in OsloaderIndicationsSupported\n");
>> +		return;
>> +	}
>> +
>> +	size = sizeof(val);
>> +	status = get_efi_var(efi_HvPrivOsloaderIndications_name, &guid, &attr, &size, &val);
>> +	if (status != EFI_SUCCESS) {
>> +		efi_err("Could not read Hyper-V OsLoaderIndications\n");
>> +		return;
>> +	}
>> +
>> +	if (val & HV_OSLOADER_INDICATION_VSM) {
>> +		efi_info("VSM is already supported in OsLoaderIndications.");
>> +		return;
>> +	}
>> +
>> +	val |= HV_OSLOADER_INDICATION_VSM;
>> +	size = sizeof(val);
>> +	status = set_efi_var(efi_HvPrivOsloaderIndications_name, &guid, attr, size, &val);
> 
> I'm not familiar with the security model, so bear with me.
> 
> What happens if the VTL0 kernel doesn't use VTL1 at all? Does that
> become a security issue, that malware can use the VTL1 to hide itself?
> 
> Asking this because I think you will want to enable this in the generic
> kernel(s). Not all users have or want to package a secure kernel.

Yes you are right. If we do this and a secure kernel is not loaded, it is a
security hole. Which is why this is bound by the same config option CONFIG_HYPERV_VSM
that does the secure kernel boot and in that path any error / inability to load
and establish VTL1 is treated as a serious error and we panic. Generic kernels
should not enable this option at all. The CONFIG_HYPERV_VSM should be enabled
only if it is known that VTL1 environment can be established. Otherwise the system
will not boot and will panic.

Warm Regards
Thara

> 
> Wei
> 
>> +	if (status != EFI_SUCCESS)
>> +		efi_err("Could not set Hyper-V OsLoaderIndications to indicate VSM support\n");
>> +}
>> +#endif
>> +
>>  static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
>>  {
>>  	struct setup_data *e820ext = NULL;
>> @@ -768,6 +820,11 @@ static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
>>  	if (status != EFI_SUCCESS)
>>  		return status;
>>  
>> +#ifdef CONFIG_HYPERV_VSM
>> +	/* Indicate to bootloader that we will be enabling VTL1 before exiting boot services */
>> +	efi_set_hv_os_indications();
>> +#endif
>> +
>>  	/* Might as well exit boot services now */
>>  	status = efi_exit_boot_services(handle, &priv, exit_boot_func);
>>  	if (status != EFI_SUCCESS)
>> -- 
>> 2.34.1
>>