jcs.org
qemu with hax to log dma reads & writes
jcs.org/2018/11/12/vfio
1QEMU<->ACPI BIOS CPU hotplug interface
2--------------------------------------
3
4QEMU supports CPU hotplug via ACPI. This document
5describes the interface between QEMU and the ACPI BIOS.
6
7ACPI BIOS GPE.2 handler is dedicated for notifying OS about CPU hot-add
8and hot-remove events.
9
10============================================
11Legacy ACPI CPU hotplug interface registers:
12--------------------------------------------
13CPU present bitmap for:
14 ICH9-LPC (IO port 0x0cd8-0xcf7, 1-byte access)
15 PIIX-PM (IO port 0xaf00-0xaf1f, 1-byte access)
16 One bit per CPU. Bit position reflects corresponding CPU APIC ID. Read-only.
17 The first DWORD in bitmap is used in write mode to switch from legacy
18 to modern CPU hotplug interface, write 0 into it to do switch.
19---------------------------------------------------------------
20QEMU sets corresponding CPU bit on hot-add event and issues SCI
21with GPE.2 event set. CPU present map is read by ACPI BIOS GPE.2 handler
22to notify OS about CPU hot-add events. CPU hot-remove isn't supported.
23
24=====================================
25Modern ACPI CPU hotplug interface registers:
26-------------------------------------
27Register block base address:
28 ICH9-LPC IO port 0x0cd8
29 PIIX-PM IO port 0xaf00
30Register block size:
31 ACPI_CPU_HOTPLUG_REG_LEN = 12
32
33All accesses to registers described below, imply little-endian byte order.
34
35Reserved resisters behavior:
36 - write accesses are ignored
37 - read accesses return all bits set to 0.
38
39The last stored value in 'CPU selector' must refer to a possible CPU, otherwise
40 - reads from any register return 0
41 - writes to any other register are ignored until valid value is stored into it
42On QEMU start, 'CPU selector' is initialized to a valid value, on reset it
43keeps the current value.
44
45read access:
46 offset:
47 [0x0-0x3] Command data 2: (DWORD access)
48 if value last stored in 'Command field':
49 0: reads as 0x0
50 3: upper 32 bits of architecture specific CPU ID value
51 other values: reserved
52 [0x4] CPU device status fields: (1 byte access)
53 bits:
54 0: Device is enabled and may be used by guest
55 1: Device insert event, used to distinguish device for which
56 no device check event to OSPM was issued.
57 It's valid only when bit 0 is set.
58 2: Device remove event, used to distinguish device for which
59 no device eject request to OSPM was issued.
60 3-7: reserved and should be ignored by OSPM
61 [0x5-0x7] reserved
62 [0x8] Command data: (DWORD access)
63 contains 0 unless value last stored in 'Command field' is one of:
64 0: contains 'CPU selector' value of a CPU with pending event[s]
65 3: lower 32 bits of architecture specific CPU ID value
66 (in x86 case: APIC ID)
67
68write access:
69 offset:
70 [0x0-0x3] CPU selector: (DWORD access)
71 selects active CPU device. All following accesses to other
72 registers will read/store data from/to selected CPU.
73 Valid values: [0 .. max_cpus)
74 [0x4] CPU device control fields: (1 byte access)
75 bits:
76 0: reserved, OSPM must clear it before writing to register.
77 1: if set to 1 clears device insert event, set by OSPM
78 after it has emitted device check event for the
79 selected CPU device
80 2: if set to 1 clears device remove event, set by OSPM
81 after it has emitted device eject request for the
82 selected CPU device
83 3: if set to 1 initiates device eject, set by OSPM when it
84 triggers CPU device removal and calls _EJ0 method
85 4-7: reserved, OSPM must clear them before writing to register
86 [0x5] Command field: (1 byte access)
87 value:
88 0: selects a CPU device with inserting/removing events and
89 following reads from 'Command data' register return
90 selected CPU ('CPU selector' value).
91 If no CPU with events found, the current 'CPU selector' doesn't
92 change and corresponding insert/remove event flags are not modified.
93 1: following writes to 'Command data' register set OST event
94 register in QEMU
95 2: following writes to 'Command data' register set OST status
96 register in QEMU
97 3: following reads from 'Command data' and 'Command data 2' return
98 architecture specific CPU ID value for currently selected CPU.
99 other values: reserved
100 [0x6-0x7] reserved
101 [0x8] Command data: (DWORD access)
102 if last stored 'Command field' value:
103 1: stores value into OST event register
104 2: stores value into OST status register, triggers
105 ACPI_DEVICE_OST QMP event from QEMU to external applications
106 with current values of OST event and status registers.
107 other values: reserved
108
109Typical usecases:
110 - (x86) Detecting and enabling modern CPU hotplug interface.
111 QEMU starts with legacy CPU hotplug interface enabled. Detecting and
112 switching to modern interface is based on the 2 legacy CPU hotplug features:
113 1. Writes into CPU bitmap are ignored.
114 2. CPU bitmap always has bit#0 set, corresponding to boot CPU.
115
116 Use following steps to detect and enable modern CPU hotplug interface:
117 1. Store 0x0 to the 'CPU selector' register,
118 attempting to switch to modern mode
119 2. Store 0x0 to the 'CPU selector' register,
120 to ensure valid selector value
121 3. Store 0x0 to the 'Command field' register,
122 4. Read the 'Command data 2' register.
123 If read value is 0x0, the modern interface is enabled.
124 Otherwise legacy or no CPU hotplug interface available
125
126 - Get a cpu with pending event
127 1. Store 0x0 to the 'CPU selector' register.
128 2. Store 0x0 to the 'Command field' register.
129 3. Read the 'CPU device status fields' register.
130 4. If both bit#1 and bit#2 are clear in the value read, there is no CPU
131 with a pending event and selected CPU remains unchanged.
132 5. Otherwise, read the 'Command data' register. The value read is the
133 selector of the CPU with the pending event (which is already
134 selected).
135
136 - Enumerate CPUs present/non present CPUs
137 01. Set the present CPU count to 0.
138 02. Set the iterator to 0.
139 03. Store 0x0 to the 'CPU selector' register, to ensure that it's in
140 a valid state and that access to other registers won't be ignored.
141 04. Store 0x0 to the 'Command field' register to make 'Command data'
142 register return 'CPU selector' value of selected CPU
143 05. Read the 'CPU device status fields' register.
144 06. If bit#0 is set, increment the present CPU count.
145 07. Increment the iterator.
146 08. Store the iterator to the 'CPU selector' register.
147 09. Read the 'Command data' register.
148 10. If the value read is not zero, goto 05.
149 11. Otherwise store 0x0 to the 'CPU selector' register, to put it
150 into a valid state and exit.
151 The iterator at this point equals "max_cpus".