linux-kernel - Re: [PATCH] x86, nmi: workaround sti; hlt race vs nmi; intr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 27 Sep 2010 11:15:23 +0200
From:	Alexander Graf <agraf@...e.de>
To:	Alexander Graf <agraf@...e.de>
Cc:	Avi Kivity <avi@...hat.com>, x86@...nel.org,
	linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Subject: Re: [PATCH] x86, nmi: workaround sti; hlt race vs nmi; intr


On 27.09.2010, at 11:13, Alexander Graf wrote:

> 
> On 27.09.2010, at 10:38, Avi Kivity wrote:
> 
>> On 09/19/2010 06:28 PM, Avi Kivity wrote:
>>> On machines without monitor/mwait we use an sti; hlt sequence to atomically
>>> enable interrupts and put the cpu to sleep.  The sequence uses the "interrupt
>>> shadow" property of the sti instruction: interrupts are enabled only after
>>> the instruction following sti has been executed.  This means an interrupt
>>> cannot happen in the middle of the sequence, which would leave us with
>>> the interrupt processed but the cpu halted.
>>> 
>>> The interrupt shadow, however, can be broken by an nmi; the following
>>> sequence
>>> 
>>>   sti
>>>     nmi ... iret
>>>     # interrupt shadow disabled
>>>     intr ... iret
>>>   hlt
>>> 
>>> puts the cpu to sleep, even though the interrupt may need additional processing
>>> after the hlt (like scheduling a task).
>>> 
>>> sti is explicitly documented not to force an interrupt shadow; though many
>>> processors do inhibit nmi immediately after sti.
>>> 
>>> Avoid the race by checking, during an nmi, if we hit the safe halt sequence.
>>> If we did, increment the instruction pointer past the hlt instruction; this
>>> allows an immediately following interrupt to return to a safe place.
>>> 
>>> Signed-off-by: Avi Kivity<avi@...hat.com>
>> 
>> Ping.
> 
> Wow, this is incredibly ugly :). Can't we just mask NMIs when the interrupt shadow is active?

Yeah, that's me writing without thinking. So this means that the race can also happen on real hardware?


Alex

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/