UefiCpuPkg/PiSmmCpuDxeSmm: Put AP into safe hlt-loop code on S3 path

On S3 path, we will wake up APs to restore CPU context in PiSmmCpuDxeSmm
driver. However, we place AP in hlt-loop under 1MB space borrowed after CPU
restoring CPU contexts.
In case, one NMI or SMI happens, APs may exit from hlt state and execute the
instruction after HLT instruction. But the code under 1MB is no longer safe at
that time.

This fix is to allocate one ACPI NVS range to place the AP hlt-loop code. When
CPU finished restoration CPU contexts, AP will execute in this ACPI NVS range.

https://bugzilla.tianocore.org/show_bug.cgi?id=216

v2:
  1. Make stack alignment per Laszlo's comment.
  2. Trim whitespace at end of end.
  3. Update year mark in file header.

Reported-by: Laszlo Ersek <lersek@redhat.com>
Analyzed-by: Paolo Bonzini <pbonzini@redhat.com>
Analyzed-by: Laszlo Ersek <lersek@redhat.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jeff Fan <jeff.fan@intel.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c b/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c
index 6a798ef899ad3c737a52c757464ceaf4ae14cab1..ad7dc412fb40af19881d58485fedf5f481888028 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c
@@ -77,6 +77,13 @@ SMM_S3_RESUME_STATE          *mSmmS3ResumeState = NULL;
 \r
 BOOLEAN                      mAcpiS3Enable = TRUE;\r
 \r
+UINT8                        *mApHltLoopCode = NULL;\r
+UINT8                        mApHltLoopCodeTemplate[] = {\r
+                               0xFA,        // cli\r
+                               0xF4,        // hlt\r
+                               0xEB, 0xFC   // jmp $-2\r
+                               };\r
+\r
 /**\r
   Get MSR spin lock by MSR index.\r
 \r
@@ -376,6 +383,8 @@ MPRendezvousProcedure (
   CPU_REGISTER_TABLE         *RegisterTableList;\r
   UINT32                     InitApicId;\r
   UINTN                      Index;\r
+  UINT32                     TopOfStack;\r
+  UINT8                      Stack[128];\r
 \r
   ProgramVirtualWireMode ();\r
   DisableLvtInterrupts ();\r
@@ -393,6 +402,14 @@ MPRendezvousProcedure (
   // Count down the number with lock mechanism.\r
   //\r
   InterlockedDecrement (&mNumberToFinish);\r
+\r
+  //\r
+  // Place AP into the safe code\r
+  //\r
+  TopOfStack  = (UINT32) (UINTN) Stack + sizeof (Stack);\r
+  TopOfStack &= ~(UINT32) (CPU_STACK_ALIGNMENT - 1);\r
+  CopyMem ((VOID *) (UINTN) mApHltLoopCode, mApHltLoopCodeTemplate, sizeof (mApHltLoopCodeTemplate));\r
+  TransferApToSafeState ((UINT32) (UINTN) mApHltLoopCode, TopOfStack);\r
 }\r
 \r
 /**\r
@@ -731,6 +748,8 @@ InitSmmS3ResumeState (
   VOID                       *GuidHob;\r
   EFI_SMRAM_DESCRIPTOR       *SmramDescriptor;\r
   SMM_S3_RESUME_STATE        *SmmS3ResumeState;\r
+  EFI_PHYSICAL_ADDRESS       Address;\r
+  EFI_STATUS                 Status;\r
 \r
   if (!mAcpiS3Enable) {\r
     return;\r
@@ -773,6 +792,20 @@ InitSmmS3ResumeState (
   // Patch SmmS3ResumeState->SmmS3Cr3\r
   //\r
   InitSmmS3Cr3 ();\r
+\r
+  //\r
+  // Allocate safe memory in ACPI NVS for AP to execute hlt loop in\r
+  // protected mode on S3 path\r
+  //\r
+  Address = BASE_4GB - 1;\r
+  Status  = gBS->AllocatePages (\r
+                   AllocateMaxAddress,\r
+                   EfiACPIMemoryNVS,\r
+                   EFI_SIZE_TO_PAGES (sizeof (mApHltLoopCodeTemplate)),\r
+                   &Address\r
+                   );\r
+  ASSERT_EFI_ERROR (Status);\r
+  mApHltLoopCode = (UINT8 *) (UINTN) Address;\r
 }\r
 \r
 /**\r

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c
index 545b534f27960855cec9f461cafa787ba9a2b7d8..8b880d6ab76368b5c6df856fde3745818ee77f73 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c
@@ -1,7 +1,7 @@
 /** @file\r
   SMM CPU misc functions for Ia32 arch specific.\r
   \r
-Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -94,3 +94,28 @@ InitGdt (
   *GdtStepSize = GdtTableStepSize;\r
   return GdtTssTables;\r
 }\r
+\r
+/**\r
+  Transfer AP to safe hlt-loop after it finished restore CPU features on S3 patch.\r
+\r
+  @param[in] ApHltLoopCode    The 32-bit address of the safe hlt-loop function.\r
+  @param[in] TopOfStack       A pointer to the new stack to use for the ApHltLoopCode.\r
+\r
+**/\r
+VOID\r
+TransferApToSafeState (\r
+  IN UINT32             ApHltLoopCode,\r
+  IN UINT32             TopOfStack\r
+  )\r
+{\r
+  SwitchStack (\r
+    (SWITCH_STACK_ENTRY_POINT) (UINTN) ApHltLoopCode,\r
+    NULL,\r
+    NULL,\r
+    (VOID *) (UINTN) TopOfStack\r
+    );\r
+  //\r
+  // It should never reach here\r
+  //\r
+  ASSERT (FALSE);\r
+}\r

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h
index 9b119c8412c529a08844025787acaf5bd58e8564..6c98659389ec8da8beebd7bec46cbb7b57ed3e3c 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h
@@ -825,4 +825,17 @@ GetAcpiS3EnableFlag (
   VOID\r
   );\r
 \r
+/**\r
+  Transfer AP to safe hlt-loop after it finished restore CPU features on S3 patch.\r
+\r
+  @param[in] ApHltLoopCode    The 32-bit address of the safe hlt-loop function.\r
+  @param[in] TopOfStack       A pointer to the new stack to use for the ApHltLoopCode.\r
+\r
+**/\r
+VOID\r
+TransferApToSafeState (\r
+  IN UINT32             ApHltLoopCode,\r
+  IN UINT32             TopOfStack\r
+  );\r
+\r
 #endif\r

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index b53aa45c2149d5319bd00febfaeb9b2fbf6ae18a..bd465c7a067b6414865b4f7334351bdd544b9231 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -1,7 +1,7 @@
 /** @file\r
   SMM CPU misc functions for x64 arch specific.\r
   \r
-Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -68,3 +68,30 @@ InitGdt (
   *GdtStepSize = GdtTableStepSize;\r
   return GdtTssTables;\r
 }\r
+\r
+/**\r
+  Transfer AP to safe hlt-loop after it finished restore CPU features on S3 patch.\r
+\r
+  @param[in] ApHltLoopCode    The 32-bit address of the safe hlt-loop function.\r
+  @param[in] TopOfStack       A pointer to the new stack to use for the ApHltLoopCode.\r
+\r
+**/\r
+VOID\r
+TransferApToSafeState (\r
+  IN UINT32             ApHltLoopCode,\r
+  IN UINT32             TopOfStack\r
+  )\r
+{\r
+  SwitchStack (\r
+    (SWITCH_STACK_ENTRY_POINT) (UINTN) ApHltLoopCode,\r
+    NULL,\r
+    NULL,\r
+    (VOID *) (UINTN) TopOfStack\r
+    );\r
+  //\r
+  // It should never reach here\r
+  //\r
+  ASSERT (FALSE);\r
+}\r
+\r
+\r