Re: [edk2-devel] [PATCH 1/5] UefiCpuPkg: Add PcdCpuSmmRestrictedMemoryAccess

["Laszlo Ersek" <lersek@redhat.com>]

On 08/26/19 00:45, Ni, Ray wrote:
> The patch adds a new X64 only PCD PcdCpuSmmRestrictedMemoryAccess.
> The PCD indicates access to non-SMRAM memory is restricted to
> reserved, runtime and ACPI NVS type after SmmReadyToLock.
> MMIO access is always allowed regardless of the value of this PCD.
> Loose of such restriction is only required by RAS components in X64
> platforms.
> The PCD value is considered as constantly TRUE in IA32 platforms.
> When the PCD value is TRUE, page table is initialized to cover all
> memory spaces and the memory occupied by page table is protected by
> page table itself as read-only.
> 
> Signed-off-by: Ray Ni <ray.ni@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> ---
>  UefiCpuPkg/UefiCpuPkg.dec | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/UefiCpuPkg/UefiCpuPkg.dec b/UefiCpuPkg/UefiCpuPkg.dec
> index 86ad61f64b..83acd33612 100644
> --- a/UefiCpuPkg/UefiCpuPkg.dec
> +++ b/UefiCpuPkg/UefiCpuPkg.dec
> @@ -278,6 +278,18 @@ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
>    # @Prompt Current boot is a power-on reset.
>    gUefiCpuPkgTokenSpaceGuid.PcdIsPowerOnReset|FALSE|BOOLEAN|0x0000001B
>  
> +[PcdsFixedAtBuild.X64, PcdsPatchableInModule.X64, PcdsDynamic.X64, PcdsDynamicEx.X64]
> +  ## Indicate access to non-SMRAM memory is restricted to reserved, runtime and ACPI NVS type after SmmReadyToLock.
> +  #  MMIO access is always allowed regardless of the value of this PCD.
> +  #  Loose of such restriction is only required by RAS components in X64 platforms.
> +  #  The PCD value is considered as constantly TRUE in IA32 platforms.
> +  #  When the PCD value is TRUE, page table is initialized to cover all memory spaces
> +  #  and the memory occupied by page table is protected by page table itself as read-only.
> +  #   TRUE  - Access to non-SMRAM memory is restricted to reserved, runtime and ACPI NVS type after SmmReadyToLock.<BR>
> +  #   FALSE - Access to any type of non-SMRAM memory after SmmReadyToLock is allowed.<BR>
> +  # @Prompt Access to non-SMRAM memory is restricted to reserved, runtime and ACPI NVS type after SmmReadyToLock.
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmRestrictedMemoryAccess|TRUE|BOOLEAN|0x3213210F
> +
>  [PcdsDynamic, PcdsDynamicEx]
>    ## Contains the pointer to a CPU S3 data buffer of structure ACPI_CPU_DATA.
>    # @Prompt The pointer to a CPU S3 data buffer.
> 

Please consider updating the UNI file as well.

Reviewed-by: Laszlo Ersek <lersek@redhat.com>