3 ms·
It's worth noting that KVM doesn't allow remapping the APIC base address at all: https://github.com/torvalds/linux/blob/49d7c6559bf2ab4f1d56be131ab9571a51fc71bd
by nathan7 11y ago
It's worth noting that KVM doesn't allow remapping the APIC base address at all: https://github.com/torvalds/linux/blob/49d7c6559bf2ab4f1d56be131ab9571a51fc71bd/arch/x86/kvm/lapic.c#L1567-L1569 https://github.com/torvalds/linux/blob/49d7c6559bf2ab4f1d56b...
- amluto 11y agoI don't think it would matter. KVM wouldn't move the real APIC -- it would just move the fake APIC it exposes to the guest. SMM doesn't run in guest mode, so SMM code wouldn't see the fake APIC. (If KVM allowed moving the APIC, then you could use this to escalate privileges from guest kernel mode to /guest/ SMM, and KVM is adding guest SMM soon, but that's a much less interesting attack IMO.)