> > > But what about NMIs, afaict this is all horribly broken for NMIs. > > > > > > So the whole VMX thing latches the NMI (which stops NMI recursion), > right? > > > > > > But then you drop out of noinstr code, which means any random > > > exception can happen (kprobes #BP, hw_breakpoint #DB, or even #PF > > > due to random nonsense like *SAN). This exception will do IRET and > > > clear the NMI latch, all before you get to run any of the NMI code. > > > > What you said here implies that we have this problem in the existing code. > > Because a fake iret stack is created to call the NMI handler in the > > IDT NMI descriptor, which lastly executes the IRET instruction. > > I can't follow; of course the IDT handler terminates with IRET, it has to no? With FRED, ERETS/ERETU replace IRET, and use bit 28 of the popped CS field to control whether to unblock NMI. If bit 28 of the field (above the selector) is 1, ERETS/ERETU unblocks NMIs. > > And yes, the current code appears to suffer the same defect.
