From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from a7-10.smtp-out.eu-west-1.amazonses.com (a7-10.smtp-out.eu-west-1.amazonses.com [54.240.7.10]) by mx.groups.io with SMTP id smtpd.web11.3360.1683581485388975400 for ; Mon, 08 May 2023 14:31:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ipxe.org header.s=cphpx6z2rfcgehlykjjh3gknqe3hsoe2 header.b=Vq6nxhAp; spf=pass (domain: eu-west-1.amazonses.com, ip: 54.240.7.10, mailfrom: 01020187fd46b80f-a69b4ae5-545f-45ae-ab0d-a48f725c7a40-000000@eu-west-1.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=cphpx6z2rfcgehlykjjh3gknqe3hsoe2; d=ipxe.org; t=1683581483; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=pWx9NsMIWttYzvmDPGcs7tl1YBFU2CtlNgajniTvARw=; b=Vq6nxhApaHWoq/dtOV+vOSmgoGgFAwWVKYziyH9+n7CtDMVGg/XivUGHB132Wq7m xBCQwxwIt1aBFdiRHykg32yw/cEDnWEpr5CPjUnN6mvqzlQsjTD4BTmQKR0r1Vitosh Y8kVo4ndyj3DaMRTrLuEyG+7Zf47JBYNwNzPH3MkKfv0YvEEL/4DZ94duBFBXLin2+p dbjCpGnfTAE2q8hfOZOw825e+HbmyhJ+HiGUNri/zHuwn5bWaCc/inSGVedZRJt4mFM dugzvOTAiIXHGimTaguVVf+g3t8Octt9e3H2E8yb66VKWAkFztJqE53XzFm92VRJy5b mTeXctKQnQ== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1683581483; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Feedback-ID; bh=pWx9NsMIWttYzvmDPGcs7tl1YBFU2CtlNgajniTvARw=; b=tgVJrcH/JdX/KAR02nR1VqWuE8sZfuYwDPtz+hK4BoWut9HysCU+NTAV8qkvoHj2 UrpmyjFWULwZNqK3wZrwMwNTkx+xuK0U/GEVKKbVsag3GyjAi+Ych/GL1i69tbqzDY2 sBhixJ2MHeAsUbxEjEWrcxmg5e9ztIsEH+BKZVaU= From: "Michael Brown" To: devel@edk2.groups.io Cc: Michael Brown , Laszlo Ersek , Gerd Hoffmann , Oliver Steffen , Pawel Polawski , Jiewen Yao , Ard Biesheuvel , Jordan Justen Subject: [PATCH 0/2] OvmfPkg: Relax assertion that interrupts do not occur at TPL_HIGH_LEVEL Date: Mon, 8 May 2023 21:31:23 +0000 Message-ID: <01020187fd46b80f-a69b4ae5-545f-45ae-ab0d-a48f725c7a40-000000@eu-west-1.amazonses.com> X-Mailer: git-send-email 2.39.0 In-Reply-To: <476bbc17-6484-9afd-9be9-08de14d1d72e@redhat.com> References: <476bbc17-6484-9afd-9be9-08de14d1d72e@redhat.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00, URIBL_DBL_BLOCKED_OPENDNS,URIBL_ZEN_BLOCKED_OPENDNS autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on blyat.fensystems.co.uk Feedback-ID: 1.eu-west-1.fspj4M/5bzJ9NLRzJP0PaxRwxrpZqiDQJ1IF94CF2TA=:AmazonSES X-SES-Outgoing: 2023.05.08-54.240.7.10 Content-Transfer-Encoding: 8bit At TPL_HIGH_LEVEL, CPU interrupts are disabled (as per the UEFI specification) and so we should never encounter a situation in which an interrupt occurs at TPL_HIGH_LEVEL. The specification also restricts usage of TPL_HIGH_LEVEL to the firmware itself. However, nothing prevents a rogue UEFI application from illegally calling gBS->RaiseTPL(TPL_HIGH_LEVEL) and then deliberately violating the invariant by enabling interrupts via the STI or equivalent instruction. Some versions of the Microsoft Windows bootloader are known to do this. NestedInterruptTplLib maintains the invariant that interrupts are disabled at TPL_HIGH_LEVEL (even when performing the dark art of deliberately manipulating the stack so that IRET will return with interrupts still disabled), but does not itself rely on external code maintaining this invariant. Relax the assertion that the interrupted TPL is below TPL_HIGH_LEVEL to an error message, to allow rogue UEFI applications such as the Microsoft Windows bootloader to continue to function. Ref: https://bugzilla.redhat.com/show_bug.cgi?id=2189136 Cc: Laszlo Ersek Cc: Gerd Hoffmann Cc: Oliver Steffen Cc: Pawel Polawski Cc: Jiewen Yao Cc: Ard Biesheuvel Cc: Jordan Justen Michael Brown (2): OvmfPkg: Clarify invariants for NestedInterruptTplLib OvmfPkg: Relax assertion that interrupts do not occur at TPL_HIGH_LEVEL OvmfPkg/Library/NestedInterruptTplLib/Tpl.c | 31 +++++++++++++++++---- 1 file changed, 26 insertions(+), 5 deletions(-) -- 2.39.0