SMI nested inside a NMI handler

[vishwa_m]

I have a question on the treatment of NMI after RSM if the SMI originates while in an NMI handler:

From Intel PRM vol 3b Section 24.8:

"A special case can occur when a SMI nests inside an NMI handler and then another NMI occurs. When the processor enters SMM while executing the NMI handler, it does not save the attribute to block NMI. Potentially an NMI can be latched and can be serviced upon SMM exit even though the previous NMI handler has not completed".

I tried to re-create this scenario (on Conroe) and so far I have been unsuccessful. In a nutshell, I do not see the CPU entering the NMI handler twice.

Here is a quick snaphot of what I am trying to do:
1) Inject an NMI
2) Now inside NMI handler
3) Inject SMI
4) Enter SMM
5) Inject NMI
6) Execute RSM.
7) Out-of-SMM in the NMI handler again.

Note that the second NMI injected in step 5 is not recognized. Of course, if I execute IRET that might cause the second NMI to be recognized (but I do not want to use IRET in SMM handler).

So, here is my theory and I want someone from the Intel Engineering team to confirm this:

I think going into SMM, Conroe saves the NMI blocking attribute (either internally or in some reserved area in the SMM map). Upon a RSM, the NMI blocking attribute is restored which causes it to not re-enter the NMI handler.

If this is true, my suggestion would be to atleast remove the above section from the PRM. If my theory is incorrect, feel free to correct me and offer an explanation for why the second NMI is not taken.

Please note: It does not matter where i inject the second NMI. I have tried to inject the NMI in step 2 (while in the NMI handler) and the result is the same. Thanks!

[crazysaguaro]

You might find this website useful:
http://my.opera.com/reversing/blog/show.dml/430045?show=login

[Intel_Software_Netw1]

Hello,

Thank you for contacting Intel Software Network Support.

Please refer to section 5.7 and 5.7.1 of the Intel 64 and IA-32 Software Developer's Manual, volume 3A, System Programming GuidePart 1. This discusses the multiple NMI issue. It explicitly states that nesting of NMI is not possible. A pended NMI will not be handled until execution of the IRET instruction.

http://support.intel.com/design/processor/manuals/253668.pdf

Regards,

Gina B.
Intel Software Network Support
http://www.intel.com/software
email: ISN.support@intel.com

Intel is a registered trademark of Intel Corporation or its subsidiaries in the United States and other countries.

*Other names and brands may be claimed as the property of others.