On 3/14/25 6:14 AM, Borislav Petkov wrote:
On Fri, Feb 28, 2025 at 08:43:55AM +0000, Brendan Jackman wrote:
(otherwise if we get an NMI between asi_enter() and
asi_start_critical(), and that causes a #PF, we will start the
critical section in the wrong address space and ASI won't do its job).
So, we are somewhat forced to mix up a. and b. from above.
I don't understand: asi_enter() can be interrupted by an NMI at any random
point. How is the current, imbalanced interface not vulnerable to this
scenario?
The reason this isn't a problem with the current asi_enter() is because there
the equivalent of asi_start_critical() happens _before_ the address space
switch. That ensures that even if an NMI arrives in the middle of asi_enter(),
the NMI epilog will switch to the restricted address space and there is no
window where an NMI (or any other interrupt/exception for that matter) would
result in going into vmenter with an unrestricted address space.
So
asi_enter();
asi_start_critical();
vmenter();
asi_end_critical();
is broken as there is a problematic window between asi_enter() and
asi_start_critical() as Brendan pointed out.
However,
asi_start_critical();
asi_enter();
vmenter();
asi_end_critical();
would work perfectly fine.
Perhaps that might be the way to refactor the API?
Thanks,
Junaid
