Sunday, 20 November 2011

NMI revisited

After researching and reminding myself how it works, we can have
probe points from an NMI, but first, we need to fix the interrupt

An NMI interrupt can interrupt a normal interrupt routine. A normal
interrupt cannot interrupt the NMI. *But* an NMI can take a trap, e.g.
a breakpoint trap.

So, now the fun starts. When an interrupt terminates, the handler
executes an IRET instruction. An IRET is very similar to a POPF/RET
instruction sequence except for one very subtle point.

The subtle point is that the IRET will dismiss an NMI. If we
execute an IRET from a breakpoint trap which trapped inside an NMI interrupt,
then chances are that the NMI will be immediately reasserted - from
inside the NMI interrupt handler.

This blows up and the CPU will hit a double or triple fault and reboot.

So, to restate, no interrupt can execute an IRET if we are nested inside
an NMI. Therefore we need to keep some state.

Heres the hint at what can happen:


which details the tricks the kernel is doing to handle the nested
interrupt structure.

Now, I need to figure out how to do the same thing without damaging
the kernel. (I have some prototype code but need to fix one issue).

Post created by CRiSP v10.0.17a-b6112

No comments:

Post a Comment