[PATCH v2] Introduce KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC

[PATCH v2] Introduce KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC

[Jim Mattson]

Add KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC to allow L1 to set FREEZE_IN_SMM
in vmcs12's GUEST_IA32_DEBUGCTL field, as permitted prior to
commit 6b1dd26544d0 ("KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM
while running the guest").  The quirk is enabled by default for backwards
compatibility; userspace can disable it via KVM_CAP_DISABLE_QUIRKS2 for
consistency with the constraints on WRMSR(IA32_DEBUGCTL).

Note that the quirk only bypasses the consistency check. The vmcs02 bit is
still owned by the host, and PMCs are not frozen during virtualized SMM.
In particular, if a host administrator decides that PMCs should not be
frozen during physical SMM, then L1 has no say in the matter.

Fixes: 095686e6fcb4 ("KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter")
Signed-off-by: Jim Mattson <jmattson@google.com>
---
 Documentation/virt/kvm/api.rst  | 10 ++++++++++
 arch/x86/include/asm/kvm_host.h |  3 ++-
 arch/x86/include/uapi/asm/kvm.h |  1 +
 arch/x86/kvm/vmx/nested.c       | 23 +++++++++++++++++++----
 4 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
index d04b4bdd60c1..325e565ff99e 100644
--- a/Documentation/virt/kvm/api.rst
+++ b/Documentation/virt/kvm/api.rst
@@ -8482,6 +8482,16 @@ KVM_X86_QUIRK_IGNORE_GUEST_PAT      By default, on Intel platforms, KVM ignores
                                     guest software, for example if it does not
                                     expose a bochs graphics device (which is
                                     known to have had a buggy driver).
+
+KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC
+				    By default, KVM relaxes the consistency
+				    check for GUEST_IA32_DEBUGCTL in vmcb12
+				    to allow FREEZE_IN_SMM to be set.  When
+				    this quirk is disabled, KVM requires
+				    this bit to be cleared.  Note that the
+				    vmcs02 bit is still completely
+				    controlled by the host, regardless of
+				    the quirk setting.
 =================================== ============================================
 
 7.32 KVM_CAP_MAX_VCPU_ID
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index ff07c45e3c73..1669d4797f0b 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -2485,7 +2485,8 @@ int memslot_rmap_alloc(struct kvm_memory_slot *slot, unsigned long npages);
 	 KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS |	\
 	 KVM_X86_QUIRK_SLOT_ZAP_ALL |		\
 	 KVM_X86_QUIRK_STUFF_FEATURE_MSRS |	\
-	 KVM_X86_QUIRK_IGNORE_GUEST_PAT)
+	 KVM_X86_QUIRK_IGNORE_GUEST_PAT |	\
+	 KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC)
 
 #define KVM_X86_CONDITIONAL_QUIRKS		\
 	(KVM_X86_QUIRK_CD_NW_CLEARED |		\
diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
index 846a63215ce1..76128958bbca 100644
--- a/arch/x86/include/uapi/asm/kvm.h
+++ b/arch/x86/include/uapi/asm/kvm.h
@@ -476,6 +476,7 @@ struct kvm_sync_regs {
 #define KVM_X86_QUIRK_SLOT_ZAP_ALL		(1 << 7)
 #define KVM_X86_QUIRK_STUFF_FEATURE_MSRS	(1 << 8)
 #define KVM_X86_QUIRK_IGNORE_GUEST_PAT		(1 << 9)
+#define KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC	(1 << 10)
 
 #define KVM_STATE_NESTED_FORMAT_VMX	0
 #define KVM_STATE_NESTED_FORMAT_SVM	1
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 248635da6766..9bd29b9375fb 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3300,10 +3300,25 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
 	if (CC(vmcs12->guest_cr4 & X86_CR4_CET && !(vmcs12->guest_cr0 & X86_CR0_WP)))
 		return -EINVAL;
 
-	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
-	    (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
-	     CC(!vmx_is_valid_debugctl(vcpu, vmcs12->guest_ia32_debugctl, false))))
-		return -EINVAL;
+	if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) {
+		u64 debugctl = vmcs12->guest_ia32_debugctl;
+
+		/*
+		 * FREEZE_IN_SMM is not virtualized, but allow L1 to set it
+		 * in VMCB12's DEBUGCTL under a quirk for backwards
+		 * compatibility.  Note that the quirk only relaxes the
+		 * consistency check. The vmcb02 bit is still under the
+		 * control of the host. In particular, if a host
+		 * administrator decides to clear the bit, then L1 has no
+		 * say in the matter.
+		 */
+		if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC))
+			debugctl &= ~DEBUGCTLMSR_FREEZE_IN_SMM;
+
+		if (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
+		    CC(!vmx_is_valid_debugctl(vcpu, debugctl, false)))
+			return -EINVAL;
+	}
 
 	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&
 	    CC(!kvm_pat_valid(vmcs12->guest_ia32_pat)))

base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a
-- 
2.53.0.rc2.204.g2597b5adb4-goog

Re: [PATCH v2] Introduce KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC

[Sean Christopherson]

On Thu, Feb 05, 2026, Jim Mattson wrote:
> Add KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC to allow L1 to set FREEZE_IN_SMM
> in vmcs12's GUEST_IA32_DEBUGCTL field, as permitted prior to
> commit 6b1dd26544d0 ("KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM
> while running the guest").  The quirk is enabled by default for backwards
> compatibility; userspace can disable it via KVM_CAP_DISABLE_QUIRKS2 for
> consistency with the constraints on WRMSR(IA32_DEBUGCTL).
> 
> Note that the quirk only bypasses the consistency check. The vmcs02 bit is
> still owned by the host, and PMCs are not frozen during virtualized SMM.
> In particular, if a host administrator decides that PMCs should not be
> frozen during physical SMM, then L1 has no say in the matter.
> 
> Fixes: 095686e6fcb4 ("KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter")
> Signed-off-by: Jim Mattson <jmattson@google.com>

I'll tag for stable, but otherwise LGTM.  It's too late for 6.19, but I'll get
it queued up for 6.20 after giving others a chance to react.  It'll miss the
initial batch of pull requests, but I'll try to send a fixes for the second half
of the merge window (I just realized I need to create+send the pull requests...)

Re: [PATCH v2] Introduce KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC

[Yosry Ahmed]

On Thu, Feb 05, 2026 at 03:15:26PM -0800, Jim Mattson wrote:
> Add KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC to allow L1 to set FREEZE_IN_SMM
> in vmcs12's GUEST_IA32_DEBUGCTL field, as permitted prior to
> commit 6b1dd26544d0 ("KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM
> while running the guest").  The quirk is enabled by default for backwards
> compatibility; userspace can disable it via KVM_CAP_DISABLE_QUIRKS2 for
> consistency with the constraints on WRMSR(IA32_DEBUGCTL).
> 
> Note that the quirk only bypasses the consistency check. The vmcs02 bit is
> still owned by the host, and PMCs are not frozen during virtualized SMM.
> In particular, if a host administrator decides that PMCs should not be
> frozen during physical SMM, then L1 has no say in the matter.
> 
> Fixes: 095686e6fcb4 ("KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter")
> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>  Documentation/virt/kvm/api.rst  | 10 ++++++++++
>  arch/x86/include/asm/kvm_host.h |  3 ++-
>  arch/x86/include/uapi/asm/kvm.h |  1 +
>  arch/x86/kvm/vmx/nested.c       | 23 +++++++++++++++++++----
>  4 files changed, 32 insertions(+), 5 deletions(-)
> 
> diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
> index d04b4bdd60c1..325e565ff99e 100644
> --- a/Documentation/virt/kvm/api.rst
> +++ b/Documentation/virt/kvm/api.rst
> @@ -8482,6 +8482,16 @@ KVM_X86_QUIRK_IGNORE_GUEST_PAT      By default, on Intel platforms, KVM ignores
>                                      guest software, for example if it does not
>                                      expose a bochs graphics device (which is
>                                      known to have had a buggy driver).
> +
> +KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC
> +				    By default, KVM relaxes the consistency
> +				    check for GUEST_IA32_DEBUGCTL in vmcb12

vmcs12*

> +				    to allow FREEZE_IN_SMM to be set.  When
> +				    this quirk is disabled, KVM requires
> +				    this bit to be cleared.  Note that the
> +				    vmcs02 bit is still completely
> +				    controlled by the host, regardless of
> +				    the quirk setting.
>  =================================== ============================================
>  
>  7.32 KVM_CAP_MAX_VCPU_ID
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index ff07c45e3c73..1669d4797f0b 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -2485,7 +2485,8 @@ int memslot_rmap_alloc(struct kvm_memory_slot *slot, unsigned long npages);
>  	 KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS |	\
>  	 KVM_X86_QUIRK_SLOT_ZAP_ALL |		\
>  	 KVM_X86_QUIRK_STUFF_FEATURE_MSRS |	\
> -	 KVM_X86_QUIRK_IGNORE_GUEST_PAT)
> +	 KVM_X86_QUIRK_IGNORE_GUEST_PAT |	\
> +	 KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC)
>  
>  #define KVM_X86_CONDITIONAL_QUIRKS		\
>  	(KVM_X86_QUIRK_CD_NW_CLEARED |		\
> diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
> index 846a63215ce1..76128958bbca 100644
> --- a/arch/x86/include/uapi/asm/kvm.h
> +++ b/arch/x86/include/uapi/asm/kvm.h
> @@ -476,6 +476,7 @@ struct kvm_sync_regs {
>  #define KVM_X86_QUIRK_SLOT_ZAP_ALL		(1 << 7)
>  #define KVM_X86_QUIRK_STUFF_FEATURE_MSRS	(1 << 8)
>  #define KVM_X86_QUIRK_IGNORE_GUEST_PAT		(1 << 9)
> +#define KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC	(1 << 10)
>  
>  #define KVM_STATE_NESTED_FORMAT_VMX	0
>  #define KVM_STATE_NESTED_FORMAT_SVM	1
> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index 248635da6766..9bd29b9375fb 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -3300,10 +3300,25 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
>  	if (CC(vmcs12->guest_cr4 & X86_CR4_CET && !(vmcs12->guest_cr0 & X86_CR0_WP)))
>  		return -EINVAL;
>  
> -	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
> -	    (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
> -	     CC(!vmx_is_valid_debugctl(vcpu, vmcs12->guest_ia32_debugctl, false))))
> -		return -EINVAL;
> +	if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) {
> +		u64 debugctl = vmcs12->guest_ia32_debugctl;
> +
> +		/*
> +		 * FREEZE_IN_SMM is not virtualized, but allow L1 to set it
> +		 * in VMCB12's DEBUGCTL under a quirk for backwards

VMCS12's

> +		 * compatibility.  Note that the quirk only relaxes the
> +		 * consistency check. The vmcb02 bit is still under the

vmcs02

> +		 * control of the host. In particular, if a host
> +		 * administrator decides to clear the bit, then L1 has no
> +		 * say in the matter.
> +		 */
> +		if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC))
> +			debugctl &= ~DEBUGCTLMSR_FREEZE_IN_SMM;
> +
> +		if (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
> +		    CC(!vmx_is_valid_debugctl(vcpu, debugctl, false)))
> +			return -EINVAL;
> +	}
>  
>  	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&
>  	    CC(!kvm_pat_valid(vmcs12->guest_ia32_pat)))
> 
> base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a
> -- 
> 2.53.0.rc2.204.g2597b5adb4-goog
> 

Re: [PATCH v2] Introduce KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC

[Jim Mattson]

On Tue, Feb 10, 2026 at 1:14 PM Yosry Ahmed <yosry.ahmed@linux.dev> wrote:
>
> On Thu, Feb 05, 2026 at 03:15:26PM -0800, Jim Mattson wrote:
> > Add KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC to allow L1 to set FREEZE_IN_SMM
> > in vmcs12's GUEST_IA32_DEBUGCTL field, as permitted prior to
> > commit 6b1dd26544d0 ("KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM
> > while running the guest").  The quirk is enabled by default for backwards
> > compatibility; userspace can disable it via KVM_CAP_DISABLE_QUIRKS2 for
> > consistency with the constraints on WRMSR(IA32_DEBUGCTL).
> >
> > Note that the quirk only bypasses the consistency check. The vmcs02 bit is
> > still owned by the host, and PMCs are not frozen during virtualized SMM.
> > In particular, if a host administrator decides that PMCs should not be
> > frozen during physical SMM, then L1 has no say in the matter.
> >
> > Fixes: 095686e6fcb4 ("KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter")
> > Signed-off-by: Jim Mattson <jmattson@google.com>
> > ---
> >  Documentation/virt/kvm/api.rst  | 10 ++++++++++
> >  arch/x86/include/asm/kvm_host.h |  3 ++-
> >  arch/x86/include/uapi/asm/kvm.h |  1 +
> >  arch/x86/kvm/vmx/nested.c       | 23 +++++++++++++++++++----
> >  4 files changed, 32 insertions(+), 5 deletions(-)
> >
> > diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
> > index d04b4bdd60c1..325e565ff99e 100644
> > --- a/Documentation/virt/kvm/api.rst
> > +++ b/Documentation/virt/kvm/api.rst
> > @@ -8482,6 +8482,16 @@ KVM_X86_QUIRK_IGNORE_GUEST_PAT      By default, on Intel platforms, KVM ignores
> >                                      guest software, for example if it does not
> >                                      expose a bochs graphics device (which is
> >                                      known to have had a buggy driver).
> > +
> > +KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC
> > +                                 By default, KVM relaxes the consistency
> > +                                 check for GUEST_IA32_DEBUGCTL in vmcb12
>
> vmcs12*
>
> > +                                 to allow FREEZE_IN_SMM to be set.  When
> > +                                 this quirk is disabled, KVM requires
> > +                                 this bit to be cleared.  Note that the
> > +                                 vmcs02 bit is still completely
> > +                                 controlled by the host, regardless of
> > +                                 the quirk setting.
> >  =================================== ============================================
> >
> >  7.32 KVM_CAP_MAX_VCPU_ID
> > diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> > index ff07c45e3c73..1669d4797f0b 100644
> > --- a/arch/x86/include/asm/kvm_host.h
> > +++ b/arch/x86/include/asm/kvm_host.h
> > @@ -2485,7 +2485,8 @@ int memslot_rmap_alloc(struct kvm_memory_slot *slot, unsigned long npages);
> >        KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS |  \
> >        KVM_X86_QUIRK_SLOT_ZAP_ALL |           \
> >        KVM_X86_QUIRK_STUFF_FEATURE_MSRS |     \
> > -      KVM_X86_QUIRK_IGNORE_GUEST_PAT)
> > +      KVM_X86_QUIRK_IGNORE_GUEST_PAT |       \
> > +      KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC)
> >
> >  #define KVM_X86_CONDITIONAL_QUIRKS           \
> >       (KVM_X86_QUIRK_CD_NW_CLEARED |          \
> > diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
> > index 846a63215ce1..76128958bbca 100644
> > --- a/arch/x86/include/uapi/asm/kvm.h
> > +++ b/arch/x86/include/uapi/asm/kvm.h
> > @@ -476,6 +476,7 @@ struct kvm_sync_regs {
> >  #define KVM_X86_QUIRK_SLOT_ZAP_ALL           (1 << 7)
> >  #define KVM_X86_QUIRK_STUFF_FEATURE_MSRS     (1 << 8)
> >  #define KVM_X86_QUIRK_IGNORE_GUEST_PAT               (1 << 9)
> > +#define KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC        (1 << 10)
> >
> >  #define KVM_STATE_NESTED_FORMAT_VMX  0
> >  #define KVM_STATE_NESTED_FORMAT_SVM  1
> > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> > index 248635da6766..9bd29b9375fb 100644
> > --- a/arch/x86/kvm/vmx/nested.c
> > +++ b/arch/x86/kvm/vmx/nested.c
> > @@ -3300,10 +3300,25 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> >       if (CC(vmcs12->guest_cr4 & X86_CR4_CET && !(vmcs12->guest_cr0 & X86_CR0_WP)))
> >               return -EINVAL;
> >
> > -     if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
> > -         (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
> > -          CC(!vmx_is_valid_debugctl(vcpu, vmcs12->guest_ia32_debugctl, false))))
> > -             return -EINVAL;
> > +     if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) {
> > +             u64 debugctl = vmcs12->guest_ia32_debugctl;
> > +
> > +             /*
> > +              * FREEZE_IN_SMM is not virtualized, but allow L1 to set it
> > +              * in VMCB12's DEBUGCTL under a quirk for backwards
>
> VMCS12's
>
> > +              * compatibility.  Note that the quirk only relaxes the
> > +              * consistency check. The vmcb02 bit is still under the
>
> vmcs02
>

/facepalm

> > +              * control of the host. In particular, if a host
> > +              * administrator decides to clear the bit, then L1 has no
> > +              * say in the matter.
> > +              */
> > +             if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC))
> > +                     debugctl &= ~DEBUGCTLMSR_FREEZE_IN_SMM;
> > +
> > +             if (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) ||
> > +                 CC(!vmx_is_valid_debugctl(vcpu, debugctl, false)))
> > +                     return -EINVAL;
> > +     }
> >
> >       if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&
> >           CC(!kvm_pat_valid(vmcs12->guest_ia32_pat)))
> >
> > base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a
> > --
> > 2.53.0.rc2.204.g2597b5adb4-goog
> >
>

Re: [PATCH v2] Introduce KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC

[Sean Christopherson]

On Thu, 05 Feb 2026 15:15:26 -0800, Jim Mattson wrote:
> Add KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC to allow L1 to set FREEZE_IN_SMM
> in vmcs12's GUEST_IA32_DEBUGCTL field, as permitted prior to
> commit 6b1dd26544d0 ("KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM
> while running the guest").  The quirk is enabled by default for backwards
> compatibility; userspace can disable it via KVM_CAP_DISABLE_QUIRKS2 for
> consistency with the constraints on WRMSR(IA32_DEBUGCTL).
> 
> [...]

Applied to kvm-x86 fixes, thanks!

[1/1] Introduce KVM_X86_QUIRK_VMCS12_FREEZE_IN_SMM_CC
      https://github.com/kvm-x86/linux/commit/0f70db0758be

--
https://github.com/kvm-x86/linux/tree/next