Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18c3626e authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

KVM: x86: zero IDT limit on entry to SMM 

The recent BlackHat 2015 presentation "The Memory Sinkhole"
mentions that the IDT limit is zeroed on entry to SMM.

This is not documented, and must have changed some time after 2010
(see http://www.ssi.gouv.fr/uploads/IMG/pdf/IT_Defense_2010_final.pdf

).
KVM was not doing it, but the fix is easy.

Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent fc1a8126

arch/x86/kvm/x86.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -6327,6 +6327,7 @@ static void process_smi_save_state_64(struct kvm_vcpu *vcpu, char *buf) 
static void process_smi(struct kvm_vcpu *vcpu)

static void process_smi(struct kvm_vcpu *vcpu)

{

{

	struct kvm_segment cs, ds;

	struct kvm_segment cs, ds;

	struct desc_ptr dt;

	char buf[512];

	char buf[512];

	u32 cr0;

	u32 cr0;
@@ -6359,6 +6360,10 @@ static void process_smi(struct kvm_vcpu *vcpu) 




	kvm_x86_ops->set_cr4(vcpu, 0);

	kvm_x86_ops->set_cr4(vcpu, 0);





	/* Undocumented: IDT limit is set to zero on entry to SMM.  */

	dt.address = dt.size = 0;

	kvm_x86_ops->set_idt(vcpu, &dt);



	__kvm_set_dr(vcpu, 7, DR7_FIXED_1);

	__kvm_set_dr(vcpu, 7, DR7_FIXED_1);





	cs.selector = (vcpu->arch.smbase >> 4) & 0xffff;

	cs.selector = (vcpu->arch.smbase >> 4) & 0xffff;