On 9/1/2026 9:09 PM, Wei Liu wrote:
> On Tue, Sep 01, 2026 at 09:55:18AM -0700, Thara Gopinath wrote:
>> Set bit 0 of the Hyper-V private OsLoaderIndications EFI variable
>> during exit_boot() so the bootloader/firmware knows the OS intends
>> to enable VTL1. Without this, VTL1 cannot be brought up from the
>> Linux kernel.
>>
>> The support bit is first checked in OsLoaderIndicationsSupported,
>> and the variable is only written when the VSM bit is not already
>> set.
>>
>> Signed-off-by: Thara Gopinath <[email protected]>
>> ---
>> drivers/firmware/efi/libstub/x86-stub.c | 57 +++++++++++++++++++++++++
>> 1 file changed, 57 insertions(+)
>>
> [...]
>> +#ifdef CONFIG_HYPERV_VSM
>> +static void efi_set_hv_os_indications(void)
>> +{
>> + efi_guid_t guid = HYPERV_PRIVATE_EFI_NAMESPACE_GUID;
>> + efi_status_t status;
>> + unsigned long size;
>> + u32 attr, val;
>> +
>> + size = sizeof(val);
>> + status = get_efi_var(efi_HvPrivOsloaderIndicationsSupported_name,
>> + &guid, &attr, &size, &val);
>> + if (status != EFI_SUCCESS) {
>> + efi_err("Could not read Hyper-V
>> OsloaderIndicationsSupported\n");
>> + return;
>> + }
>> +
>> + if (!(val & HV_OSLOADER_INDICATION_VSM)) {
>> + efi_info("Hyper-V does not support VSM in
>> OsloaderIndicationsSupported\n");
>> + return;
>> + }
>> +
>> + size = sizeof(val);
>> + status = get_efi_var(efi_HvPrivOsloaderIndications_name, &guid, &attr,
>> &size, &val);
>> + if (status != EFI_SUCCESS) {
>> + efi_err("Could not read Hyper-V OsLoaderIndications\n");
>> + return;
>> + }
>> +
>> + if (val & HV_OSLOADER_INDICATION_VSM) {
>> + efi_info("VSM is already supported in OsLoaderIndications.");
>> + return;
>> + }
>> +
>> + val |= HV_OSLOADER_INDICATION_VSM;
>> + size = sizeof(val);
>> + status = set_efi_var(efi_HvPrivOsloaderIndications_name, &guid, attr,
>> size, &val);
>
> I'm not familiar with the security model, so bear with me.
>
> What happens if the VTL0 kernel doesn't use VTL1 at all? Does that
> become a security issue, that malware can use the VTL1 to hide itself?
>
> Asking this because I think you will want to enable this in the generic
> kernel(s). Not all users have or want to package a secure kernel.
Yes you are right. If we do this and a secure kernel is not loaded, it is a
security hole. Which is why this is bound by the same config option
CONFIG_HYPERV_VSM
that does the secure kernel boot and in that path any error / inability to load
and establish VTL1 is treated as a serious error and we panic. Generic kernels
should not enable this option at all. The CONFIG_HYPERV_VSM should be enabled
only if it is known that VTL1 environment can be established. Otherwise the
system
will not boot and will panic.
Warm Regards
Thara
>
> Wei
>
>> + if (status != EFI_SUCCESS)
>> + efi_err("Could not set Hyper-V OsLoaderIndications to indicate
>> VSM support\n");
>> +}
>> +#endif
>> +
>> static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
>> {
>> struct setup_data *e820ext = NULL;
>> @@ -768,6 +820,11 @@ static efi_status_t exit_boot(struct boot_params
>> *boot_params, void *handle)
>> if (status != EFI_SUCCESS)
>> return status;
>>
>> +#ifdef CONFIG_HYPERV_VSM
>> + /* Indicate to bootloader that we will be enabling VTL1 before exiting
>> boot services */
>> + efi_set_hv_os_indications();
>> +#endif
>> +
>> /* Might as well exit boot services now */
>> status = efi_exit_boot_services(handle, &priv, exit_boot_func);
>> if (status != EFI_SUCCESS)
>> --
>> 2.34.1
>>
