Re: [PATCH RFC v2 03/29] mm: asi: Introduce ASI core API

[Junaid Shahid <junaids@google.com>]

On 3/14/25 6:14 AM, Borislav Petkov wrote:
> On Fri, Feb 28, 2025 at 08:43:55AM +0000, Brendan Jackman wrote:
>> (otherwise if we get an NMI between asi_enter() and
>> asi_start_critical(), and that causes a #PF, we will start the
>> critical section in the wrong address space and ASI won't do its job).
>> So, we are somewhat forced to mix up a. and b. from above.
> 
> I don't understand: asi_enter() can be interrupted by an NMI at any random
> point. How is the current, imbalanced interface not vulnerable to this
> scenario?
> 

The reason this isn't a problem with the current asi_enter() is because there 
the equivalent of asi_start_critical() happens _before_ the address space 
switch. That ensures that even if an NMI arrives in the middle of asi_enter(), 
the NMI epilog will switch to the restricted address space and there is no 
window where an NMI (or any other interrupt/exception for that matter) would 
result in going into vmenter with an unrestricted address space.

So
	asi_enter();
	asi_start_critical();
	vmenter();
	asi_end_critical();

is broken as there is a problematic window between asi_enter() and 
asi_start_critical() as Brendan pointed out.

However,
	asi_start_critical();
	asi_enter();
	vmenter();
	asi_end_critical();

would work perfectly fine.

Perhaps that might be the way to refactor the API?

Thanks,
Junaid