From 3bfe4fadffbf3339986d9876d89c28bc0542baac Mon Sep 17 00:00:00 2001 From: Oliver Smith-Denny Date: Thu, 26 Feb 2026 13:12:37 -0800 Subject: [PATCH] OvmfPkg: SEC/SMM: Use 256 IDT Descriptors This follows the update in UefiCpuPkg to use 256 IDT descriptors in SEC and SMM. This is done to: - Have a defined action when exceptions are taken (use the common exception handler) - Allow processing the stack cookie exception gracefully instead of generating a #GP fault. Signed-off-by: Oliver Smith-Denny --- OvmfPkg/Library/SmmRelocationLib/SmmRelocationLib.c | 6 +++--- OvmfPkg/Sec/SecMain.c | 9 ++++----- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/OvmfPkg/Library/SmmRelocationLib/SmmRelocationLib.c b/OvmfPkg/Library/SmmRelocationLib/SmmRelocationLib.c index 4f6b513c72..9a11b44e2f 100644 --- a/OvmfPkg/Library/SmmRelocationLib/SmmRelocationLib.c +++ b/OvmfPkg/Library/SmmRelocationLib/SmmRelocationLib.c @@ -274,10 +274,10 @@ InitSmmIdt ( CONST EFI_PEI_SERVICES **PeiServices; // - // There are 32 (not 255) entries in it since only processor - // generated exceptions will be handled. + // Populate 256 entries to ensure that a known state occurs + // for all possible exception vectors. // - gcSmmInitIdtr.Limit = (sizeof (IA32_IDT_GATE_DESCRIPTOR) * 32) - 1; + gcSmmInitIdtr.Limit = (sizeof (IA32_IDT_GATE_DESCRIPTOR) * X86_CPU_INTERRUPT_NUM) - 1; // // Allocate for IDT. diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c index d13a948509..60a00ce531 100644 --- a/OvmfPkg/Sec/SecMain.c +++ b/OvmfPkg/Sec/SecMain.c @@ -33,11 +33,9 @@ #include #include "AmdSev.h" -#define SEC_IDT_ENTRY_COUNT 34 - typedef struct _SEC_IDT_TABLE { EFI_PEI_SERVICES *PeiService; - IA32_IDT_GATE_DESCRIPTOR IdtTable[SEC_IDT_ENTRY_COUNT]; + IA32_IDT_GATE_DESCRIPTOR IdtTable[X86_CPU_INTERRUPT_NUM]; } SEC_IDT_TABLE; VOID @@ -844,7 +842,7 @@ SecCoreStartupWithStack ( // IdtTableInStack.PeiService = NULL; - for (Index = 0; Index < SEC_IDT_ENTRY_COUNT; Index++) { + for (Index = 0; Index < X86_CPU_INTERRUPT_NUM; Index++) { // // Declare the local variables that actually move the data elements as // volatile to prevent the optimizer from replacing this function with @@ -889,9 +887,10 @@ SecCoreStartupWithStack ( if (!SevEsIsEnabled ()) { // - // For non SEV-ES guests, just load the IDTR. + // For non SEV-ES guests, now load the IDTR and initialize the exception handlers. // AsmWriteIdtr (&IdtDescriptor); + InitializeCpuExceptionHandlers (NULL); } else { // // Under SEV-ES, the hypervisor can't modify CR0 and so can't enable