Merge ~paelzer/ubuntu/+source/ipxe:lp-1882671-fix-tpl-on-efi-entry-GROOVY into ubuntu/+source/ipxe:ubuntu/groovy-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4156/+packages

[Rafael David Tinoco (rafaeldtinoco)]

I'm on this now...

[Rafael David Tinoco (rafaeldtinoco)]

Alright, after carefully reading LP: #1882671 and asking questions to @paelzer, I feel better in doing a +1 with better understanding on the issue... The merge is simple (so +1), but implications are terribly complicated due to qemu / ipxe-qemu / edk2 combinations of driver configurations and features being enabled (or disabled) AND the original issue on HTTPS being fixed (which is this patch about).

Good to go

review: Approve

diff --git a/debian/changelog b/debian/changelog
index dc0899c..303357b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ipxe (1.0.0+git-20190125.36a4c85-5ubuntu2) groovy; urgency=medium
+
+  * d/p/lp-1882671-efi-Raise-TPL-during-driver-entry-point.patch: fix the
+    formerly avoided efi TPL issues (LP: #1882671)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 16 Jul 2020 14:36:54 +0200
+
 ipxe (1.0.0+git-20190125.36a4c85-5ubuntu1) groovy; urgency=medium
 
   * Merge with Debian unstable (LP: #1884758). Remaining changes:
diff --git a/debian/patches/lp-1882671-efi-Raise-TPL-during-driver-entry-point.patch b/debian/patches/lp-1882671-efi-Raise-TPL-during-driver-entry-point.patch
new file mode 100644
index 0000000..de507a9
--- /dev/null
+++ b/debian/patches/lp-1882671-efi-Raise-TPL-during-driver-entry-point.patch
@@ -0,0 +1,65 @@
+From 2ae5d4338661b65c63eb5cb1a96e5b803fe7d620 Mon Sep 17 00:00:00 2001
+From: Michael Brown <[e-mail]>
+Date: Tue, 30 Jun 2020 16:32:59 +0100
+Subject: [PATCH] [efi] Raise TPL during driver entry point
+
+As per commit c89a446 ("[efi] Run at TPL_CALLBACK to protect against
+UEFI timers") we expect to run at TPL_CALLBACK almost all of the time.
+Various code paths rely on this assumption.  Code paths that need to
+temporarily lower the TPL (e.g. for entropy gathering) will restore it
+to TPL_CALLBACK.
+
+The entropy gathering code will be run during DRBG initialisation,
+which happens during the call to startup().  In the case of iPXE
+compiled as an EFI application this code will run within the scope of
+efi_snp_claim() and so will execute at TPL_CALLBACK as expected.
+
+In the case of iPXE compiled as an EFI driver the code will
+incorrectly run at TPL_APPLICATION since there is nothing within the
+EFI driver entry point that raises (and restores) the TPL.  The net
+effect is that a build that includes the entropy-gathering code
+(e.g. a build with HTTPS enabled) will return from the driver entry
+point at TPL_CALLBACK, which causes a system lockup.
+
+Fix by raising and restoring the TPL within the EFI driver entry
+point.
+
+Debugged-by: Ignat Korchagin <[e-mail]>
+Signed-off-by: Michael Brown <[e-mail]>
+
+Origin: backport, https://github.com/ipxe/ipxe/commit/2ae5d4338661b65c63eb5cb1a96e5b803fe7d620
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1882671
+Last-Update: 2020-07-16
+
+---
+ src/interface/efi/efidrvprefix.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/src/interface/efi/efidrvprefix.c
++++ b/src/interface/efi/efidrvprefix.c
+@@ -34,16 +34,25 @@ FILE_LICENCE ( GPL2_OR_LATER );
+  */
+ EFI_STATUS EFIAPI _efidrv_start ( EFI_HANDLE image_handle,
+ 				  EFI_SYSTEM_TABLE *systab ) {
++	EFI_BOOT_SERVICES *bs;
++	EFI_TPL saved_tpl;
+ 	EFI_STATUS efirc;
+ 
+ 	/* Initialise EFI environment */
+ 	if ( ( efirc = efi_init ( image_handle, systab ) ) != 0 )
+ 		return efirc;
+ 
++	/* Raise TPL */
++	bs = efi_systab->BootServices;
++	saved_tpl = bs->RaiseTPL ( TPL_CALLBACK );
++
+ 	/* Initialise iPXE environment */
+ 	initialise();
+ 	startup();
+ 
++	/* Restore TPL */
++	bs->RestoreTPL ( saved_tpl );
++
+ 	return 0;
+ }
+ 
diff --git a/debian/patches/series b/debian/patches/series
index f422ac7..d5c97a2 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
 debian-changes
 handle-dhcp-nack.patch
 0005-strip-802.1Q-VLAN-0-priority-tags.patch
+lp-1882671-efi-Raise-TPL-during-driver-entry-point.patch