Re: [PATCH 2/2] OvmfPkg: Relax assertion that interrupts do not occur at TPL_HIGH_LEVEL

["Laszlo Ersek" <lersek@redhat.com>]

On 5/8/23 23:31, Michael Brown wrote:
> At TPL_HIGH_LEVEL, CPU interrupts are disabled (as per the UEFI
> specification) and so we should never encounter a situation in which
> an interrupt occurs at TPL_HIGH_LEVEL.  The specification also
> restricts usage of TPL_HIGH_LEVEL to the firmware itself.

Great introduction!

Regarding the rest of the commit message, I'd like us to tone it down a
little bit.

Here's why: I'd been used to Microsoft *not* cooperating usefully in
Windows-on-QEMU/KVM situations. But this instance was totally different.
In fact I'm still a bit shocked, in the positive sense. We got a fast
and helpful, to-the-point response. It's a first, considering my own
experience, and it has strongly changed my impression of Microsoft's
Windows team. I'd like us to acknowledge that in the commit message, if
possible.

Mind you, I'm not a native English speaker, so I could be seeing things
(and proposing worse language than the original).

With all that said:

> However, nothing prevents a rogue UEFI application from illegally

I request s/rogue/non-conformant/.

I'd also request "invalidly" rather than "illegally"; the latter has
connotations with the law, and seeing such in a commit message makes me
fidget uncomfortably. I do apologize.

> calling gBS->RaiseTPL(TPL_HIGH_LEVEL) and then deliberately violating

You are not wrong about "deliberately", but I'd still like us to remove
that word. :)

> the invariant by enabling interrupts via the STI or equivalent
> instruction.  Some versions of the Microsoft Windows bootloader are
> known to do this.
> 
> NestedInterruptTplLib maintains the invariant that interrupts are
> disabled at TPL_HIGH_LEVEL (even when performing the dark art of
> deliberately manipulating the stack so that IRET will return with
> interrupts still disabled), but does not itself rely on external code
> maintaining this invariant.
> 
> Relax the assertion that the interrupted TPL is below TPL_HIGH_LEVEL
> to an error message, to allow rogue UEFI applications such as the

s/rogue/non-conformant/

> Microsoft Windows bootloader to continue to function.

Can we say "particular version of the Microsoft Windows bootloader"?

> 
> Debugged-by: Gerd Hoffmann <kraxel@redhat.com>
> Debugged-by: Laszlo Ersek <lersek@redhat.com>
> Ref: https://bugzilla.redhat.com/show_bug.cgi?id=2189136
> Signed-off-by: Michael Brown <mcb30@ipxe.org>
> ---
>  OvmfPkg/Library/NestedInterruptTplLib/Tpl.c | 21 ++++++++++++++++++---
>  1 file changed, 18 insertions(+), 3 deletions(-)
> 
> diff --git a/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c b/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c
> index e921a09c5599..a91f2d3cb8c7 100644
> --- a/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c
> +++ b/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c
> @@ -34,12 +34,27 @@ NestedInterruptRaiseTPL (
>  
>    //
>    // Raise TPL and assert that we were called from within an interrupt
> -  // handler (i.e. with TPL below TPL_HIGH_LEVEL but with interrupts
> -  // disabled).
> +  // handler (i.e. with interrupts already disabled before raising the
> +  // TPL).
>    //
>    ASSERT (GetInterruptState () == FALSE);
>    InterruptedTPL = gBS->RaiseTPL (TPL_HIGH_LEVEL);
> -  ASSERT (InterruptedTPL < TPL_HIGH_LEVEL);
> +
> +  //
> +  // At TPL_HIGH_LEVEL, CPU interrupts are disabled (as per the UEFI
> +  // specification) and so we should never encounter a situation in
> +  // which InterruptedTPL==TPL_HIGH_LEVEL.  The specification also
> +  // restricts usage of TPL_HIGH_LEVEL to the firmware itself.
> +  //
> +  // However, nothing prevents a rogue UEFI application from illegally
> +  // calling gBS->RaiseTPL(TPL_HIGH_LEVEL) and then deliberately
> +  // violating the invariant by enabling interrupts via the STI or
> +  // equivalent instruction.  Some versions of the Microsoft Windows
> +  // bootloader are known to do this.
> +  //

Same three requests on the wording: rogue, illegally, deliberately.

(I am happy with "Some versions of"!)

> +  if (InterruptedTPL >= TPL_HIGH_LEVEL) {
> +    DEBUG ((DEBUG_ERROR, "Illegal interrupt at TPL_HIGH_LEVEL!\n"));

s/Illegal/Invalid/ please! :)

> +  }
>  
>    return InterruptedTPL;
>  }

Thank you for the patch; I do apologize about splitting hairs. The
debugging was difficult, and you *are* working around a bug here -- but
I'd really like our tone of voice to be positive here, simply because of
the stunningly positive attitude I've experienced from Microsoft.

Thanks!
Laszlo