diff options
Diffstat (limited to 'roms/edk2/OvmfPkg/CpuHotplugSmm/Smbase.c')
| -rw-r--r-- | roms/edk2/OvmfPkg/CpuHotplugSmm/Smbase.c | 290 |
1 files changed, 290 insertions, 0 deletions
diff --git a/roms/edk2/OvmfPkg/CpuHotplugSmm/Smbase.c b/roms/edk2/OvmfPkg/CpuHotplugSmm/Smbase.c new file mode 100644 index 000000000..d8f45c431 --- /dev/null +++ b/roms/edk2/OvmfPkg/CpuHotplugSmm/Smbase.c @@ -0,0 +1,290 @@ +/** @file
+ SMBASE relocation for hot-plugged CPUs.
+
+ Copyright (c) 2020, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include <Base.h> // BASE_1MB
+#include <Library/BaseLib.h> // CpuPause()
+#include <Library/BaseMemoryLib.h> // CopyMem()
+#include <Library/DebugLib.h> // DEBUG()
+#include <Library/LocalApicLib.h> // SendInitSipiSipi()
+#include <Library/SynchronizationLib.h> // InterlockedCompareExchange64()
+#include <Register/Intel/SmramSaveStateMap.h> // SMM_DEFAULT_SMBASE
+
+#include "FirstSmiHandlerContext.h" // FIRST_SMI_HANDLER_CONTEXT
+
+#include "Smbase.h"
+
+extern CONST UINT8 mPostSmmPen[];
+extern CONST UINT16 mPostSmmPenSize;
+extern CONST UINT8 mFirstSmiHandler[];
+extern CONST UINT16 mFirstSmiHandlerSize;
+
+/**
+ Allocate a non-SMRAM reserved memory page for the Post-SMM Pen for hot-added
+ CPUs.
+
+ This function may only be called from the entry point function of the driver.
+
+ @param[out] PenAddress The address of the allocated (normal RAM) reserved
+ page.
+
+ @param[in] BootServices Pointer to the UEFI boot services table. Used for
+ allocating the normal RAM (not SMRAM) reserved page.
+
+ @retval EFI_SUCCESS Allocation successful.
+
+ @retval EFI_BAD_BUFFER_SIZE The Post-SMM Pen template is not smaller than
+ EFI_PAGE_SIZE.
+
+ @return Error codes propagated from underlying services.
+ DEBUG_ERROR messages have been logged. No
+ resources have been allocated.
+**/
+EFI_STATUS
+SmbaseAllocatePostSmmPen (
+ OUT UINT32 *PenAddress,
+ IN CONST EFI_BOOT_SERVICES *BootServices
+ )
+{
+ EFI_STATUS Status;
+ EFI_PHYSICAL_ADDRESS Address;
+
+ //
+ // The pen code must fit in one page, and the last byte must remain free for
+ // signaling the SMM Monarch.
+ //
+ if (mPostSmmPenSize >= EFI_PAGE_SIZE) {
+ Status = EFI_BAD_BUFFER_SIZE;
+ DEBUG ((DEBUG_ERROR, "%a: mPostSmmPenSize=%u: %r\n", __FUNCTION__,
+ mPostSmmPenSize, Status));
+ return Status;
+ }
+
+ Address = BASE_1MB - 1;
+ Status = BootServices->AllocatePages (AllocateMaxAddress,
+ EfiReservedMemoryType, 1, &Address);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a: AllocatePages(): %r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ DEBUG ((DEBUG_INFO, "%a: Post-SMM Pen at 0x%Lx\n", __FUNCTION__, Address));
+ *PenAddress = (UINT32)Address;
+ return EFI_SUCCESS;
+}
+
+/**
+ Copy the Post-SMM Pen template code into the reserved page allocated with
+ SmbaseAllocatePostSmmPen().
+
+ Note that this effects an "SMRAM to normal RAM" copy.
+
+ The SMM Monarch is supposed to call this function from the root MMI handler.
+
+ @param[in] PenAddress The allocation address returned by
+ SmbaseAllocatePostSmmPen().
+**/
+VOID
+SmbaseReinstallPostSmmPen (
+ IN UINT32 PenAddress
+ )
+{
+ CopyMem ((VOID *)(UINTN)PenAddress, mPostSmmPen, mPostSmmPenSize);
+}
+
+/**
+ Release the reserved page allocated with SmbaseAllocatePostSmmPen().
+
+ This function may only be called from the entry point function of the driver,
+ on the error path.
+
+ @param[in] PenAddress The allocation address returned by
+ SmbaseAllocatePostSmmPen().
+
+ @param[in] BootServices Pointer to the UEFI boot services table. Used for
+ releasing the normal RAM (not SMRAM) reserved page.
+**/
+VOID
+SmbaseReleasePostSmmPen (
+ IN UINT32 PenAddress,
+ IN CONST EFI_BOOT_SERVICES *BootServices
+ )
+{
+ BootServices->FreePages (PenAddress, 1);
+}
+
+/**
+ Place the handler routine for the first SMIs of hot-added CPUs at
+ (SMM_DEFAULT_SMBASE + SMM_HANDLER_OFFSET).
+
+ Note that this effects an "SMRAM to SMRAM" copy.
+
+ Additionally, shut the APIC ID gate in FIRST_SMI_HANDLER_CONTEXT.
+
+ This function may only be called from the entry point function of the driver,
+ and only after PcdQ35SmramAtDefaultSmbase has been determined to be TRUE.
+**/
+VOID
+SmbaseInstallFirstSmiHandler (
+ VOID
+ )
+{
+ FIRST_SMI_HANDLER_CONTEXT *Context;
+
+ CopyMem ((VOID *)(UINTN)(SMM_DEFAULT_SMBASE + SMM_HANDLER_OFFSET),
+ mFirstSmiHandler, mFirstSmiHandlerSize);
+
+ Context = (VOID *)(UINTN)SMM_DEFAULT_SMBASE;
+ Context->ApicIdGate = MAX_UINT64;
+}
+
+/**
+ Relocate the SMBASE on a hot-added CPU. Then pen the hot-added CPU in the
+ normal RAM reserved memory page, set up earlier with
+ SmbaseAllocatePostSmmPen() and SmbaseReinstallPostSmmPen().
+
+ The SMM Monarch is supposed to call this function from the root MMI handler.
+
+ The SMM Monarch is responsible for calling SmbaseInstallFirstSmiHandler(),
+ SmbaseAllocatePostSmmPen(), and SmbaseReinstallPostSmmPen() before calling
+ this function.
+
+ If the OS maliciously boots the hot-added CPU ahead of letting the ACPI CPU
+ hotplug event handler broadcast the CPU hotplug MMI, then the hot-added CPU
+ returns to the OS rather than to the pen, upon RSM. In that case, this
+ function will hang forever (unless the OS happens to signal back through the
+ last byte of the pen page).
+
+ @param[in] ApicId The APIC ID of the hot-added CPU whose SMBASE should
+ be relocated.
+
+ @param[in] Smbase The new SMBASE address. The root MMI handler is
+ responsible for passing in a free ("unoccupied")
+ SMBASE address that was pre-configured by
+ PiSmmCpuDxeSmm in CPU_HOT_PLUG_DATA.
+
+ @param[in] PenAddress The address of the Post-SMM Pen for hot-added CPUs, as
+ returned by SmbaseAllocatePostSmmPen(), and installed
+ by SmbaseReinstallPostSmmPen().
+
+ @retval EFI_SUCCESS The SMBASE of the hot-added CPU with APIC ID
+ ApicId has been relocated to Smbase. The
+ hot-added CPU has reported back about leaving
+ SMM.
+
+ @retval EFI_PROTOCOL_ERROR Synchronization bug encountered around
+ FIRST_SMI_HANDLER_CONTEXT.ApicIdGate.
+
+ @retval EFI_INVALID_PARAMETER Smbase does not fit in 32 bits. No relocation
+ has been attempted.
+**/
+EFI_STATUS
+SmbaseRelocate (
+ IN APIC_ID ApicId,
+ IN UINTN Smbase,
+ IN UINT32 PenAddress
+ )
+{
+ EFI_STATUS Status;
+ volatile UINT8 *SmmVacated;
+ volatile FIRST_SMI_HANDLER_CONTEXT *Context;
+ UINT64 ExchangeResult;
+
+ if (Smbase > MAX_UINT32) {
+ Status = EFI_INVALID_PARAMETER;
+ DEBUG ((DEBUG_ERROR, "%a: ApicId=" FMT_APIC_ID " Smbase=0x%Lx: %r\n",
+ __FUNCTION__, ApicId, (UINT64)Smbase, Status));
+ return Status;
+ }
+
+ SmmVacated = (UINT8 *)(UINTN)PenAddress + (EFI_PAGE_SIZE - 1);
+ Context = (VOID *)(UINTN)SMM_DEFAULT_SMBASE;
+
+ //
+ // Clear AboutToLeaveSmm, so we notice when the hot-added CPU is just about
+ // to reach RSM, and we can proceed to polling the last byte of the reserved
+ // page (which could be attacked by the OS).
+ //
+ Context->AboutToLeaveSmm = 0;
+
+ //
+ // Clear the last byte of the reserved page, so we notice when the hot-added
+ // CPU checks back in from the pen.
+ //
+ *SmmVacated = 0;
+
+ //
+ // Boot the hot-added CPU.
+ //
+ // There are 2*2 cases to consider:
+ //
+ // (1) The CPU was hot-added before the SMI was broadcast.
+ //
+ // (1.1) The OS is benign.
+ //
+ // The hot-added CPU is in RESET state, with the broadcast SMI pending
+ // for it. The directed SMI below will be ignored (it's idempotent),
+ // and the INIT-SIPI-SIPI will launch the CPU directly into SMM.
+ //
+ // (1.2) The OS is malicious.
+ //
+ // The hot-added CPU has been booted, by the OS. Thus, the hot-added
+ // CPU is spinning on the APIC ID gate. In that case, both the SMI and
+ // the INIT-SIPI-SIPI below will be ignored.
+ //
+ // (2) The CPU was hot-added after the SMI was broadcast.
+ //
+ // (2.1) The OS is benign.
+ //
+ // The hot-added CPU is in RESET state, with no SMI pending for it. The
+ // directed SMI will latch the SMI for the CPU. Then the INIT-SIPI-SIPI
+ // will launch the CPU into SMM.
+ //
+ // (2.2) The OS is malicious.
+ //
+ // The hot-added CPU is executing OS code. The directed SMI will pull
+ // the hot-added CPU into SMM, where it will start spinning on the APIC
+ // ID gate. The INIT-SIPI-SIPI will be ignored.
+ //
+ SendSmiIpi (ApicId);
+ SendInitSipiSipi (ApicId, PenAddress);
+
+ //
+ // Expose the desired new SMBASE value to the hot-added CPU.
+ //
+ Context->NewSmbase = (UINT32)Smbase;
+
+ //
+ // Un-gate SMBASE relocation for the hot-added CPU whose APIC ID is ApicId.
+ //
+ ExchangeResult = InterlockedCompareExchange64 (&Context->ApicIdGate,
+ MAX_UINT64, ApicId);
+ if (ExchangeResult != MAX_UINT64) {
+ Status = EFI_PROTOCOL_ERROR;
+ DEBUG ((DEBUG_ERROR, "%a: ApicId=" FMT_APIC_ID " ApicIdGate=0x%Lx: %r\n",
+ __FUNCTION__, ApicId, ExchangeResult, Status));
+ return Status;
+ }
+
+ //
+ // Wait until the hot-added CPU is just about to execute RSM.
+ //
+ while (Context->AboutToLeaveSmm == 0) {
+ CpuPause ();
+ }
+
+ //
+ // Now wait until the hot-added CPU reports back from the pen (or the OS
+ // attacks the last byte of the reserved page).
+ //
+ while (*SmmVacated == 0) {
+ CpuPause ();
+ }
+
+ Status = EFI_SUCCESS;
+ return Status;
+}
|