From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from a7-17.smtp-out.eu-west-1.amazonses.com (a7-17.smtp-out.eu-west-1.amazonses.com [54.240.7.17]) by mx.groups.io with SMTP id smtpd.web11.30247.1683634175648176251 for ; Tue, 09 May 2023 05:09:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ipxe.org header.s=cphpx6z2rfcgehlykjjh3gknqe3hsoe2 header.b=iLP4gM+A; spf=pass (domain: eu-west-1.amazonses.com, ip: 54.240.7.17, mailfrom: 01020188006ab6ea-3f147530-8cff-4ea6-bd70-3b4906d23798-000000@eu-west-1.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=cphpx6z2rfcgehlykjjh3gknqe3hsoe2; d=ipxe.org; t=1683634173; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=DSi0ygs9ScS4viruIIFAErvrJ1UzFbuR8w//7dCqfqs=; b=iLP4gM+Aytly/lSMiK8yiuPYr6lB14a6hMl0HAwUc15grmLMUFVqLBlkBeNPwvP4 uzO8H78807cNSLXr/YTpTXIdExGvTvbMkensSC/DvJqRNM7XYOH1YxinUk21zvYScJ/ bf1ur1r9WUi8A+4k5uYlm19M5Lr5ShY14z9tcE2ux6GRUDjZr8ClxoSyBL2fExgiGLv NWf8NyH75+2FWVFBXZ553sZtViTH6KgJDwX/Ey42mS+aBWp7/OzLIFbdoJC/SPWMQ0J 08rOWWgQBLcv1heawfpWOoD/4ciOS+4Ltc9W+zTEpGQxHZXpPtL4DUt53+clMFpah0n Qtx14nXb9g== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1683634173; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Feedback-ID; bh=DSi0ygs9ScS4viruIIFAErvrJ1UzFbuR8w//7dCqfqs=; b=t6IEf1Thi0kKjL4onJdD2UQtQcAN27sGgsvOk10HwSiPX528r/66klJcoIObAk4C 1ciye7jtte7jLCGiGzhb3ver+7IpD/w+TyM74Xc9vNEWMrFHHJX5x61xkVR0Q0R2OCe RSk22NuzB+HkgQdA3NRhU0dive0ZEFN+u2d1VXLQ= From: "Michael Brown" To: devel@edk2.groups.io Cc: lersek@redhat.com, Michael Brown , Gerd Hoffmann Subject: [PATCH v2 2/2] OvmfPkg: Relax assertion that interrupts do not occur at TPL_HIGH_LEVEL Date: Tue, 9 May 2023 12:09:33 +0000 Message-ID: <01020188006ab6ea-3f147530-8cff-4ea6-bd70-3b4906d23798-000000@eu-west-1.amazonses.com> X-Mailer: git-send-email 2.39.0 In-Reply-To: <20230509120909.3970177-1-mcb30@ipxe.org> References: <175D7813A02A6FCA.31428@groups.io> <20230509120909.3970177-1-mcb30@ipxe.org> MIME-Version: 1.0 X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00, URIBL_BLOCKED,URIBL_DBL_BLOCKED_OPENDNS,URIBL_ZEN_BLOCKED_OPENDNS autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on blyat.fensystems.co.uk Feedback-ID: 1.eu-west-1.fspj4M/5bzJ9NLRzJP0PaxRwxrpZqiDQJ1IF94CF2TA=:AmazonSES X-SES-Outgoing: 2023.05.09-54.240.7.17 Content-Transfer-Encoding: 8bit At TPL_HIGH_LEVEL, CPU interrupts are disabled (as per the UEFI specification) and so we should never encounter a situation in which an interrupt occurs at TPL_HIGH_LEVEL. The specification also restricts usage of TPL_HIGH_LEVEL to the firmware itself. However, nothing actually prevents a UEFI application from calling gBS->RaiseTPL(TPL_HIGH_LEVEL) and then violating the invariant by enabling interrupts via the STI or equivalent instruction. Some versions of the Microsoft Windows bootloader are known to do this. NestedInterruptTplLib maintains the invariant that interrupts are disabled at TPL_HIGH_LEVEL (even when performing the dark art of deliberately manipulating the stack so that IRET will return with interrupts still disabled), but does not itself rely on external code maintaining this invariant. Relax the assertion that the interrupted TPL is below TPL_HIGH_LEVEL to an error message, to allow UEFI applications such as these versions of the Microsoft Windows bootloader to continue to function. Debugged-by: Gerd Hoffmann Debugged-by: Laszlo Ersek Ref: https://bugzilla.redhat.com/show_bug.cgi?id=2189136 Signed-off-by: Michael Brown --- OvmfPkg/Library/NestedInterruptTplLib/Tpl.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c b/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c index e921a09c5599..d56c12a44529 100644 --- a/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c +++ b/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c @@ -34,12 +34,27 @@ NestedInterruptRaiseTPL ( // // Raise TPL and assert that we were called from within an interrupt - // handler (i.e. with TPL below TPL_HIGH_LEVEL but with interrupts - // disabled). + // handler (i.e. with interrupts already disabled before raising the + // TPL). // ASSERT (GetInterruptState () == FALSE); InterruptedTPL = gBS->RaiseTPL (TPL_HIGH_LEVEL); - ASSERT (InterruptedTPL < TPL_HIGH_LEVEL); + + // + // At TPL_HIGH_LEVEL, CPU interrupts are disabled (as per the UEFI + // specification) and so we should never encounter a situation in + // which InterruptedTPL==TPL_HIGH_LEVEL. The specification also + // restricts usage of TPL_HIGH_LEVEL to the firmware itself. + // + // However, nothing actually prevents a UEFI application from + // invalidly calling gBS->RaiseTPL(TPL_HIGH_LEVEL) and then + // violating the invariant by enabling interrupts via the STI or + // equivalent instruction. Some versions of the Microsoft Windows + // bootloader are known to do this. + // + if (InterruptedTPL >= TPL_HIGH_LEVEL) { + DEBUG ((DEBUG_ERROR, "ERROR: Interrupts enabled at TPL_HIGH_LEVEL!\n")); + } return InterruptedTPL; } -- 2.39.0