OvmfPkg/CpuHotplugSmm: do actual CPU hot-eject

Add logic in EjectCpu() to do the actual the CPU ejection.

On the BSP, ejection happens by first selecting the CPU via
its QemuSelector and then sending the QEMU "eject" command.
QEMU in-turn signals the remote VCPU thread which context-switches
the CPU out of the SMI handler.

Meanwhile the CPU being ejected, waits around in its holding
area until it is context-switched out. Note that it is possible
that a slow CPU gets ejected before it reaches the wait loop.
However, this would never happen before it has executed the
"AllCpusInSync" loop in SmiRendezvous().
It can mean that an ejected CPU does not execute code after
that point but given that the CPU state will be destroyed by
QEMU, the missed cleanup is no great loss.

Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Aaron Young <aaron.young@oracle.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3132
Signed-off-by: Ankur Arora <ankur.a.arora@oracle.com>
Message-Id: <20210312062656.2477515-10-ankur.a.arora@oracle.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
[lersek@redhat.com: unneeded inner QemuSelector declaration in EjectCpu()
 triggers VS warning #4456 (local variable shadowed); remove it]

2 files changed, 106 insertions, 6 deletions

diff --git a/OvmfPkg/CpuHotplugSmm/CpuHotplug.c b/OvmfPkg/CpuHotplugSmm/CpuHotplug.c
index 2eeb4567a2..2c768f89f1 100644
--- a/OvmfPkg/CpuHotplugSmm/CpuHotplug.c
+++ b/OvmfPkg/CpuHotplugSmm/CpuHotplug.c
@@ -18,6 +18,7 @@
 #include <Pcd/CpuHotEjectData.h>             // CPU_HOT_EJECT_DATA

 #include <Protocol/MmCpuIo.h>                // EFI_MM_CPU_IO_PROTOCOL

 #include <Protocol/SmmCpuService.h>          // EFI_SMM_CPU_SERVICE_PROTOCOL

+#include <Register/Intel/ArchitecturalMsr.h> // MSR_IA32_APIC_BASE_REGISTER

 #include <Uefi/UefiBaseType.h>               // EFI_STATUS

 

 #include "ApicId.h"                          // APIC_ID

@@ -193,12 +194,40 @@ RevokeNewSlot:
 }

 

 /**

+  EjectCpu needs to know the BSP at SMI exit at a point when

+  some of the EFI_SMM_CPU_SERVICE_PROTOCOL state has been torn

+  down.

+  Reuse the logic from OvmfPkg::PlatformSmmBspElection() to

+  do that.

+

+  @retval TRUE   If the CPU executing this function is the BSP.

+

+  @retval FALSE  If the CPU executing this function is an AP.

+**/

+STATIC

+BOOLEAN

+CheckIfBsp (

+  VOID

+  )

+{

+  MSR_IA32_APIC_BASE_REGISTER ApicBaseMsr;

+  BOOLEAN                     IsBsp;

+

+  ApicBaseMsr.Uint64 = AsmReadMsr64 (MSR_IA32_APIC_BASE);

+  IsBsp = (BOOLEAN)(ApicBaseMsr.Bits.BSP == 1);

+  return IsBsp;

+}

+

+/**

   CPU Hot-eject handler, called from SmmCpuFeaturesRendezvousExit()

   on each CPU at exit from SMM.

 

-  If, the executing CPU is not being ejected, nothing to be done.

+  If, the executing CPU is neither the BSP, nor being ejected, nothing

+  to be done.

   If, the executing CPU is being ejected, wait in a halted loop

   until ejected.

+  If, the executing CPU is the BSP, set QEMU CPU status to eject

+  for CPUs being ejected.

 

   @param[in] ProcessorNum      ProcessorNum denotes the CPU exiting SMM,

                                and will be used as an index into

@@ -214,6 +243,81 @@ EjectCpu (
 {

   UINT64 QemuSelector;

 

+  if (CheckIfBsp ()) {

+    UINT32 Idx;

+

+    for (Idx = 0; Idx < mCpuHotEjectData->ArrayLength; Idx++) {

+      QemuSelector = mCpuHotEjectData->QemuSelectorMap[Idx];

+

+      if (QemuSelector != CPU_EJECT_QEMU_SELECTOR_INVALID) {

+        //

+        // This to-be-ejected-CPU has already received the BSP's SMI exit

+        // signal and will execute SmmCpuFeaturesRendezvousExit()

+        // followed by this callback or is already penned in the

+        // CpuSleep() loop below.

+        //

+        // Tell QEMU to context-switch it out.

+        //

+        QemuCpuhpWriteCpuSelector (mMmCpuIo, (UINT32) QemuSelector);

+        QemuCpuhpWriteCpuStatus (mMmCpuIo, QEMU_CPUHP_STAT_EJECT);

+

+        //

+        // Now that we've ejected the CPU corresponding to QemuSelectorMap[Idx],

+        // clear its eject status to ensure that an invalid future SMI does

+        // not end up trying a spurious eject or a newly hotplugged CPU does

+        // not get penned in the CpuSleep() loop.

+        //

+        // Note that the QemuCpuhpWriteCpuStatus() command above is a write to

+        // a different address space and uses the EFI_MM_CPU_IO_PROTOCOL.

+        //

+        // This means that we are guaranteed that the following assignment

+        // will not be reordered before the eject. And, so we can safely

+        // do this write here.

+        //

+        mCpuHotEjectData->QemuSelectorMap[Idx] =

+          CPU_EJECT_QEMU_SELECTOR_INVALID;

+

+        DEBUG ((DEBUG_INFO, "%a: Unplugged ProcessorNum %u, "

+          "QemuSelector %Lu\n", __FUNCTION__, Idx, QemuSelector));

+      }

+    }

+

+    //

+    // We are done until the next hot-unplug; clear the handler.

+    //

+    // mCpuHotEjectData->Handler is a NOP for any CPU not under ejection.

+    // So, once we are done with all the ejections, we can safely reset it

+    // here since any CPU dereferencing it would only see either the old

+    // or the new value (since it is aligned at a natural boundary.)

+    //

+    mCpuHotEjectData->Handler = NULL;

+    return;

+  }

+

+  //

+  // Reached only on APs

+  //

+

+  //

+  // mCpuHotEjectData->QemuSelectorMap[ProcessorNum] is updated

+  // on the BSP in the ongoing SMI at two places:

+  //

+  // - UnplugCpus() where the BSP determines if a CPU is under ejection

+  //   or not. As a comment in UnplugCpus() at set-up, and in

+  //   SmmCpuFeaturesRendezvousExit() where it is dereferenced describe,

+  //   any such updates are guaranteed to be ordered-before the

+  //   dereference below.

+  //

+  // - EjectCpu() on the BSP (above) updates QemuSelectorMap[ProcessorNum]

+  //   for a CPU once it's ejected.

+  //

+  //   The CPU under ejection: might be executing anywhere between the

+  //   AllCpusInSync loop in SmiRendezvous(), to about to dereference

+  //   QemuSelectorMap[ProcessorNum].

+  //   As described in the comment above where we do the reset, this

+  //   is not a problem since the ejected CPU never sees the after value.

+  //   CPUs not-under ejection: never see any changes so they are fine.

+  //

   QemuSelector = mCpuHotEjectData->QemuSelectorMap[ProcessorNum];

   if (QemuSelector == CPU_EJECT_QEMU_SELECTOR_INVALID) {

     return;

@@ -495,11 +599,6 @@ CpuHotplugMmi (
   if (EFI_ERROR (Status)) {

     goto Fatal;

   }

-  if (ToUnplugCount > 0) {

-    DEBUG ((DEBUG_ERROR, "%a: hot-unplug is not supported yet\n",

-      __FUNCTION__));

-    goto Fatal;

-  }

 

   if (PluggedCount > 0) {

     Status = ProcessHotAddedCpus (mPluggedApicIds, PluggedCount);

diff --git a/OvmfPkg/Include/IndustryStandard/QemuCpuHotplug.h b/OvmfPkg/Include/IndustryStandard/QemuCpuHotplug.h
index 2ec7a107a6..d0e83102c1 100644
--- a/OvmfPkg/Include/IndustryStandard/QemuCpuHotplug.h
+++ b/OvmfPkg/Include/IndustryStandard/QemuCpuHotplug.h
@@ -34,6 +34,7 @@
 #define QEMU_CPUHP_STAT_ENABLED                BIT0

 #define QEMU_CPUHP_STAT_INSERT                 BIT1

 #define QEMU_CPUHP_STAT_REMOVE                 BIT2

+#define QEMU_CPUHP_STAT_EJECT                  BIT3

 #define QEMU_CPUHP_STAT_FW_REMOVE              BIT4

 

 #define QEMU_CPUHP_RW_CMD_DATA               0x8