[PATCH 1/3] OvmfPkg/SmmControl2Dxe: select broadcast SMI

[Laszlo Ersek <lersek@redhat.com>]

When writing to IO port 0xB2 (ICH9_APM_CNT), QEMU by default injects an
SMI only on the VCPU that is writing the port. This has exposed corner
cases and strange behavior with edk2 code, which generally expects a
software SMI to affect all CPUs at once.

The QEMU patch

  hw/isa/lpc_ich9: inject SMI on all VCPUs if APM_STS == 'Q'

adds a side-channel / backdoor to QEMU that enables the firmware to
request a broadcast SMI; namely, by setting IO port 0xB3 (ICH9_APM_STS) to
value 0x51 ('Q') first. (The default behavior cannot be changed because
SeaBIOS depends on it.) Utilize this feature in OVMF's
EFI_SMM_CONTROL2_PROTOCOL.Trigger() method.

The change has no effect on QEMUs that lack the above patch.

Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=230
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
---
 OvmfPkg/Include/IndustryStandard/Q35MchIch9.h |  6 ++++--
 OvmfPkg/SmmControl2Dxe/SmmControl2Dxe.c       | 18 +++++++++++++++++-
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/OvmfPkg/Include/IndustryStandard/Q35MchIch9.h b/OvmfPkg/Include/IndustryStandard/Q35MchIch9.h
index 4dc2c39901c1..acc05f84b18c 100644
--- a/OvmfPkg/Include/IndustryStandard/Q35MchIch9.h
+++ b/OvmfPkg/Include/IndustryStandard/Q35MchIch9.h
@@ -91,8 +91,10 @@
 //
 // IO ports
 //
-#define ICH9_APM_CNT 0xB2
-#define ICH9_APM_STS 0xB3
+#define ICH9_APM_CNT                    0xB2
+
+#define ICH9_APM_STS                    0xB3
+#define QEMU_ICH9_APM_STS_BROADCAST_SMI   'Q'
 
 //
 // IO ports relative to PMBASE
diff --git a/OvmfPkg/SmmControl2Dxe/SmmControl2Dxe.c b/OvmfPkg/SmmControl2Dxe/SmmControl2Dxe.c
index 82549b0a7e35..2c987c0cc558 100644
--- a/OvmfPkg/SmmControl2Dxe/SmmControl2Dxe.c
+++ b/OvmfPkg/SmmControl2Dxe/SmmControl2Dxe.c
@@ -107,10 +107,26 @@ SmmControl2DxeTrigger (
   // report about hardware status, while this register is fully governed by
   // software.
   //
+  // On the QEMU platform, we use the status register to request a "broadcast"
+  // SMI; i.e., to bring all VCPUs into SMM at once. Edk2 handles the case when
+  // the SMI is raised only on the processor that calls Trigger(), but
+  //
+  // - if the processor executing Trigger() is an AP, then the resultant AP-BSP
+  //   synchronization is time consuming and computation-hungry,
+  //
+  // - edk2 modules that deal with SMIs generally expect / prefer a software
+  //   SMI to affect all CPUs at once; unicast SMIs have exposed obscure corner
+  //   cases.
+  //
+  // Note that we exploit the fact that the SMM_CORE never passes a non-NULL
+  // DataPort pointer (that is, we exploit that it doesn't care about the
+  // status register value).
+  //
   // Write to the status register first, as this won't trigger the SMI just
   // yet. Then write to the control register.
   //
-  IoWrite8 (ICH9_APM_STS, DataPort    == NULL ? 0 : *DataPort);
+  ASSERT (DataPort == NULL);
+  IoWrite8 (ICH9_APM_STS, QEMU_ICH9_APM_STS_BROADCAST_SMI);
   IoWrite8 (ICH9_APM_CNT, CommandPort == NULL ? 0 : *CommandPort);
   return EFI_SUCCESS;
 }
-- 
2.9.2