cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

cpu.c (26639B)


      1#include "qemu/osdep.h"
      2#include "migration/vmstate.h"
      3#include "hw/acpi/cpu.h"
      4#include "qapi/error.h"
      5#include "qapi/qapi-events-acpi.h"
      6#include "trace.h"
      7#include "sysemu/numa.h"
      8
      9#define ACPI_CPU_HOTPLUG_REG_LEN 12
     10#define ACPI_CPU_SELECTOR_OFFSET_WR 0
     11#define ACPI_CPU_FLAGS_OFFSET_RW 4
     12#define ACPI_CPU_CMD_OFFSET_WR 5
     13#define ACPI_CPU_CMD_DATA_OFFSET_RW 8
     14#define ACPI_CPU_CMD_DATA2_OFFSET_R 0
     15
     16#define OVMF_CPUHP_SMI_CMD 4
     17
     18enum {
     19    CPHP_GET_NEXT_CPU_WITH_EVENT_CMD = 0,
     20    CPHP_OST_EVENT_CMD = 1,
     21    CPHP_OST_STATUS_CMD = 2,
     22    CPHP_GET_CPU_ID_CMD = 3,
     23    CPHP_CMD_MAX
     24};
     25
     26static ACPIOSTInfo *acpi_cpu_device_status(int idx, AcpiCpuStatus *cdev)
     27{
     28    ACPIOSTInfo *info = g_new0(ACPIOSTInfo, 1);
     29
     30    info->slot_type = ACPI_SLOT_TYPE_CPU;
     31    info->slot = g_strdup_printf("%d", idx);
     32    info->source = cdev->ost_event;
     33    info->status = cdev->ost_status;
     34    if (cdev->cpu) {
     35        DeviceState *dev = DEVICE(cdev->cpu);
     36        if (dev->id) {
     37            info->device = g_strdup(dev->id);
     38            info->has_device = true;
     39        }
     40    }
     41    return info;
     42}
     43
     44void acpi_cpu_ospm_status(CPUHotplugState *cpu_st, ACPIOSTInfoList ***list)
     45{
     46    ACPIOSTInfoList ***tail = list;
     47    int i;
     48
     49    for (i = 0; i < cpu_st->dev_count; i++) {
     50        QAPI_LIST_APPEND(*tail, acpi_cpu_device_status(i, &cpu_st->devs[i]));
     51    }
     52}
     53
     54static uint64_t cpu_hotplug_rd(void *opaque, hwaddr addr, unsigned size)
     55{
     56    uint64_t val = 0;
     57    CPUHotplugState *cpu_st = opaque;
     58    AcpiCpuStatus *cdev;
     59
     60    if (cpu_st->selector >= cpu_st->dev_count) {
     61        return val;
     62    }
     63
     64    cdev = &cpu_st->devs[cpu_st->selector];
     65    switch (addr) {
     66    case ACPI_CPU_FLAGS_OFFSET_RW: /* pack and return is_* fields */
     67        val |= cdev->cpu ? 1 : 0;
     68        val |= cdev->is_inserting ? 2 : 0;
     69        val |= cdev->is_removing  ? 4 : 0;
     70        val |= cdev->fw_remove  ? 16 : 0;
     71        trace_cpuhp_acpi_read_flags(cpu_st->selector, val);
     72        break;
     73    case ACPI_CPU_CMD_DATA_OFFSET_RW:
     74        switch (cpu_st->command) {
     75        case CPHP_GET_NEXT_CPU_WITH_EVENT_CMD:
     76           val = cpu_st->selector;
     77           break;
     78        case CPHP_GET_CPU_ID_CMD:
     79           val = cdev->arch_id & 0xFFFFFFFF;
     80           break;
     81        default:
     82           break;
     83        }
     84        trace_cpuhp_acpi_read_cmd_data(cpu_st->selector, val);
     85        break;
     86    case ACPI_CPU_CMD_DATA2_OFFSET_R:
     87        switch (cpu_st->command) {
     88        case CPHP_GET_NEXT_CPU_WITH_EVENT_CMD:
     89           val = 0;
     90           break;
     91        case CPHP_GET_CPU_ID_CMD:
     92           val = cdev->arch_id >> 32;
     93           break;
     94        default:
     95           break;
     96        }
     97        trace_cpuhp_acpi_read_cmd_data2(cpu_st->selector, val);
     98        break;
     99    default:
    100        break;
    101    }
    102    return val;
    103}
    104
    105static void cpu_hotplug_wr(void *opaque, hwaddr addr, uint64_t data,
    106                           unsigned int size)
    107{
    108    CPUHotplugState *cpu_st = opaque;
    109    AcpiCpuStatus *cdev;
    110    ACPIOSTInfo *info;
    111
    112    assert(cpu_st->dev_count);
    113
    114    if (addr) {
    115        if (cpu_st->selector >= cpu_st->dev_count) {
    116            trace_cpuhp_acpi_invalid_idx_selected(cpu_st->selector);
    117            return;
    118        }
    119    }
    120
    121    switch (addr) {
    122    case ACPI_CPU_SELECTOR_OFFSET_WR: /* current CPU selector */
    123        cpu_st->selector = data;
    124        trace_cpuhp_acpi_write_idx(cpu_st->selector);
    125        break;
    126    case ACPI_CPU_FLAGS_OFFSET_RW: /* set is_* fields  */
    127        cdev = &cpu_st->devs[cpu_st->selector];
    128        if (data & 2) { /* clear insert event */
    129            cdev->is_inserting = false;
    130            trace_cpuhp_acpi_clear_inserting_evt(cpu_st->selector);
    131        } else if (data & 4) { /* clear remove event */
    132            cdev->is_removing = false;
    133            trace_cpuhp_acpi_clear_remove_evt(cpu_st->selector);
    134        } else if (data & 8) {
    135            DeviceState *dev = NULL;
    136            HotplugHandler *hotplug_ctrl = NULL;
    137
    138            if (!cdev->cpu || cdev->cpu == first_cpu) {
    139                trace_cpuhp_acpi_ejecting_invalid_cpu(cpu_st->selector);
    140                break;
    141            }
    142
    143            trace_cpuhp_acpi_ejecting_cpu(cpu_st->selector);
    144            dev = DEVICE(cdev->cpu);
    145            hotplug_ctrl = qdev_get_hotplug_handler(dev);
    146            hotplug_handler_unplug(hotplug_ctrl, dev, NULL);
    147            object_unparent(OBJECT(dev));
    148            cdev->fw_remove = false;
    149        } else if (data & 16) {
    150            if (!cdev->cpu || cdev->cpu == first_cpu) {
    151                trace_cpuhp_acpi_fw_remove_invalid_cpu(cpu_st->selector);
    152                break;
    153            }
    154            trace_cpuhp_acpi_fw_remove_cpu(cpu_st->selector);
    155            cdev->fw_remove = true;
    156        }
    157        break;
    158    case ACPI_CPU_CMD_OFFSET_WR:
    159        trace_cpuhp_acpi_write_cmd(cpu_st->selector, data);
    160        if (data < CPHP_CMD_MAX) {
    161            cpu_st->command = data;
    162            if (cpu_st->command == CPHP_GET_NEXT_CPU_WITH_EVENT_CMD) {
    163                uint32_t iter = cpu_st->selector;
    164
    165                do {
    166                    cdev = &cpu_st->devs[iter];
    167                    if (cdev->is_inserting || cdev->is_removing ||
    168                        cdev->fw_remove) {
    169                        cpu_st->selector = iter;
    170                        trace_cpuhp_acpi_cpu_has_events(cpu_st->selector,
    171                            cdev->is_inserting, cdev->is_removing);
    172                        break;
    173                    }
    174                    iter = iter + 1 < cpu_st->dev_count ? iter + 1 : 0;
    175                } while (iter != cpu_st->selector);
    176            }
    177        }
    178        break;
    179    case ACPI_CPU_CMD_DATA_OFFSET_RW:
    180        switch (cpu_st->command) {
    181        case CPHP_OST_EVENT_CMD: {
    182           cdev = &cpu_st->devs[cpu_st->selector];
    183           cdev->ost_event = data;
    184           trace_cpuhp_acpi_write_ost_ev(cpu_st->selector, cdev->ost_event);
    185           break;
    186        }
    187        case CPHP_OST_STATUS_CMD: {
    188           cdev = &cpu_st->devs[cpu_st->selector];
    189           cdev->ost_status = data;
    190           info = acpi_cpu_device_status(cpu_st->selector, cdev);
    191           qapi_event_send_acpi_device_ost(info);
    192           qapi_free_ACPIOSTInfo(info);
    193           trace_cpuhp_acpi_write_ost_status(cpu_st->selector,
    194                                             cdev->ost_status);
    195           break;
    196        }
    197        default:
    198           break;
    199        }
    200        break;
    201    default:
    202        break;
    203    }
    204}
    205
    206static const MemoryRegionOps cpu_hotplug_ops = {
    207    .read = cpu_hotplug_rd,
    208    .write = cpu_hotplug_wr,
    209    .endianness = DEVICE_LITTLE_ENDIAN,
    210    .valid = {
    211        .min_access_size = 1,
    212        .max_access_size = 4,
    213    },
    214};
    215
    216void cpu_hotplug_hw_init(MemoryRegion *as, Object *owner,
    217                         CPUHotplugState *state, hwaddr base_addr)
    218{
    219    MachineState *machine = MACHINE(qdev_get_machine());
    220    MachineClass *mc = MACHINE_GET_CLASS(machine);
    221    const CPUArchIdList *id_list;
    222    int i;
    223
    224    assert(mc->possible_cpu_arch_ids);
    225    id_list = mc->possible_cpu_arch_ids(machine);
    226    state->dev_count = id_list->len;
    227    state->devs = g_new0(typeof(*state->devs), state->dev_count);
    228    for (i = 0; i < id_list->len; i++) {
    229        state->devs[i].cpu =  CPU(id_list->cpus[i].cpu);
    230        state->devs[i].arch_id = id_list->cpus[i].arch_id;
    231    }
    232    memory_region_init_io(&state->ctrl_reg, owner, &cpu_hotplug_ops, state,
    233                          "acpi-cpu-hotplug", ACPI_CPU_HOTPLUG_REG_LEN);
    234    memory_region_add_subregion(as, base_addr, &state->ctrl_reg);
    235}
    236
    237static AcpiCpuStatus *get_cpu_status(CPUHotplugState *cpu_st, DeviceState *dev)
    238{
    239    CPUClass *k = CPU_GET_CLASS(dev);
    240    uint64_t cpu_arch_id = k->get_arch_id(CPU(dev));
    241    int i;
    242
    243    for (i = 0; i < cpu_st->dev_count; i++) {
    244        if (cpu_arch_id == cpu_st->devs[i].arch_id) {
    245            return &cpu_st->devs[i];
    246        }
    247    }
    248    return NULL;
    249}
    250
    251void acpi_cpu_plug_cb(HotplugHandler *hotplug_dev,
    252                      CPUHotplugState *cpu_st, DeviceState *dev, Error **errp)
    253{
    254    AcpiCpuStatus *cdev;
    255
    256    cdev = get_cpu_status(cpu_st, dev);
    257    if (!cdev) {
    258        return;
    259    }
    260
    261    cdev->cpu = CPU(dev);
    262    if (dev->hotplugged) {
    263        cdev->is_inserting = true;
    264        acpi_send_event(DEVICE(hotplug_dev), ACPI_CPU_HOTPLUG_STATUS);
    265    }
    266}
    267
    268void acpi_cpu_unplug_request_cb(HotplugHandler *hotplug_dev,
    269                                CPUHotplugState *cpu_st,
    270                                DeviceState *dev, Error **errp)
    271{
    272    AcpiCpuStatus *cdev;
    273
    274    cdev = get_cpu_status(cpu_st, dev);
    275    if (!cdev) {
    276        return;
    277    }
    278
    279    cdev->is_removing = true;
    280    acpi_send_event(DEVICE(hotplug_dev), ACPI_CPU_HOTPLUG_STATUS);
    281}
    282
    283void acpi_cpu_unplug_cb(CPUHotplugState *cpu_st,
    284                        DeviceState *dev, Error **errp)
    285{
    286    AcpiCpuStatus *cdev;
    287
    288    cdev = get_cpu_status(cpu_st, dev);
    289    if (!cdev) {
    290        return;
    291    }
    292
    293    cdev->cpu = NULL;
    294}
    295
    296static const VMStateDescription vmstate_cpuhp_sts = {
    297    .name = "CPU hotplug device state",
    298    .version_id = 1,
    299    .minimum_version_id = 1,
    300    .minimum_version_id_old = 1,
    301    .fields      = (VMStateField[]) {
    302        VMSTATE_BOOL(is_inserting, AcpiCpuStatus),
    303        VMSTATE_BOOL(is_removing, AcpiCpuStatus),
    304        VMSTATE_UINT32(ost_event, AcpiCpuStatus),
    305        VMSTATE_UINT32(ost_status, AcpiCpuStatus),
    306        VMSTATE_END_OF_LIST()
    307    }
    308};
    309
    310const VMStateDescription vmstate_cpu_hotplug = {
    311    .name = "CPU hotplug state",
    312    .version_id = 1,
    313    .minimum_version_id = 1,
    314    .minimum_version_id_old = 1,
    315    .fields      = (VMStateField[]) {
    316        VMSTATE_UINT32(selector, CPUHotplugState),
    317        VMSTATE_UINT8(command, CPUHotplugState),
    318        VMSTATE_STRUCT_VARRAY_POINTER_UINT32(devs, CPUHotplugState, dev_count,
    319                                             vmstate_cpuhp_sts, AcpiCpuStatus),
    320        VMSTATE_END_OF_LIST()
    321    }
    322};
    323
    324#define CPU_NAME_FMT      "C%.03X"
    325#define CPUHP_RES_DEVICE  "PRES"
    326#define CPU_LOCK          "CPLK"
    327#define CPU_STS_METHOD    "CSTA"
    328#define CPU_SCAN_METHOD   "CSCN"
    329#define CPU_NOTIFY_METHOD "CTFY"
    330#define CPU_EJECT_METHOD  "CEJ0"
    331#define CPU_OST_METHOD    "COST"
    332#define CPU_ADDED_LIST    "CNEW"
    333
    334#define CPU_ENABLED       "CPEN"
    335#define CPU_SELECTOR      "CSEL"
    336#define CPU_COMMAND       "CCMD"
    337#define CPU_DATA          "CDAT"
    338#define CPU_INSERT_EVENT  "CINS"
    339#define CPU_REMOVE_EVENT  "CRMV"
    340#define CPU_EJECT_EVENT   "CEJ0"
    341#define CPU_FW_EJECT_EVENT "CEJF"
    342
    343void build_cpus_aml(Aml *table, MachineState *machine, CPUHotplugFeatures opts,
    344                    hwaddr io_base,
    345                    const char *res_root,
    346                    const char *event_handler_method)
    347{
    348    Aml *ifctx;
    349    Aml *field;
    350    Aml *method;
    351    Aml *cpu_ctrl_dev;
    352    Aml *cpus_dev;
    353    Aml *zero = aml_int(0);
    354    Aml *one = aml_int(1);
    355    Aml *sb_scope = aml_scope("_SB");
    356    MachineClass *mc = MACHINE_GET_CLASS(machine);
    357    const CPUArchIdList *arch_ids = mc->possible_cpu_arch_ids(machine);
    358    char *cphp_res_path = g_strdup_printf("%s." CPUHP_RES_DEVICE, res_root);
    359    Object *obj = object_resolve_path_type("", TYPE_ACPI_DEVICE_IF, NULL);
    360    AcpiDeviceIfClass *adevc = ACPI_DEVICE_IF_GET_CLASS(obj);
    361    AcpiDeviceIf *adev = ACPI_DEVICE_IF(obj);
    362
    363    cpu_ctrl_dev = aml_device("%s", cphp_res_path);
    364    {
    365        Aml *crs;
    366
    367        aml_append(cpu_ctrl_dev,
    368            aml_name_decl("_HID", aml_eisaid("PNP0A06")));
    369        aml_append(cpu_ctrl_dev,
    370            aml_name_decl("_UID", aml_string("CPU Hotplug resources")));
    371        aml_append(cpu_ctrl_dev, aml_mutex(CPU_LOCK, 0));
    372
    373        crs = aml_resource_template();
    374        aml_append(crs, aml_io(AML_DECODE16, io_base, io_base, 1,
    375                               ACPI_CPU_HOTPLUG_REG_LEN));
    376        aml_append(cpu_ctrl_dev, aml_name_decl("_CRS", crs));
    377
    378        /* declare CPU hotplug MMIO region with related access fields */
    379        aml_append(cpu_ctrl_dev,
    380            aml_operation_region("PRST", AML_SYSTEM_IO, aml_int(io_base),
    381                                 ACPI_CPU_HOTPLUG_REG_LEN));
    382
    383        field = aml_field("PRST", AML_BYTE_ACC, AML_NOLOCK,
    384                          AML_WRITE_AS_ZEROS);
    385        aml_append(field, aml_reserved_field(ACPI_CPU_FLAGS_OFFSET_RW * 8));
    386        /* 1 if enabled, read only */
    387        aml_append(field, aml_named_field(CPU_ENABLED, 1));
    388        /* (read) 1 if has a insert event. (write) 1 to clear event */
    389        aml_append(field, aml_named_field(CPU_INSERT_EVENT, 1));
    390        /* (read) 1 if has a remove event. (write) 1 to clear event */
    391        aml_append(field, aml_named_field(CPU_REMOVE_EVENT, 1));
    392        /* initiates device eject, write only */
    393        aml_append(field, aml_named_field(CPU_EJECT_EVENT, 1));
    394        /* tell firmware to do device eject, write only */
    395        aml_append(field, aml_named_field(CPU_FW_EJECT_EVENT, 1));
    396        aml_append(field, aml_reserved_field(3));
    397        aml_append(field, aml_named_field(CPU_COMMAND, 8));
    398        aml_append(cpu_ctrl_dev, field);
    399
    400        field = aml_field("PRST", AML_DWORD_ACC, AML_NOLOCK, AML_PRESERVE);
    401        /* CPU selector, write only */
    402        aml_append(field, aml_named_field(CPU_SELECTOR, 32));
    403        /* flags + cmd + 2byte align */
    404        aml_append(field, aml_reserved_field(4 * 8));
    405        aml_append(field, aml_named_field(CPU_DATA, 32));
    406        aml_append(cpu_ctrl_dev, field);
    407
    408        if (opts.has_legacy_cphp) {
    409            method = aml_method("_INI", 0, AML_SERIALIZED);
    410            /* switch off legacy CPU hotplug HW and use new one,
    411             * on reboot system is in new mode and writing 0
    412             * in CPU_SELECTOR selects BSP, which is NOP at
    413             * the time _INI is called */
    414            aml_append(method, aml_store(zero, aml_name(CPU_SELECTOR)));
    415            aml_append(cpu_ctrl_dev, method);
    416        }
    417    }
    418    aml_append(sb_scope, cpu_ctrl_dev);
    419
    420    cpus_dev = aml_device("\\_SB.CPUS");
    421    {
    422        int i;
    423        Aml *ctrl_lock = aml_name("%s.%s", cphp_res_path, CPU_LOCK);
    424        Aml *cpu_selector = aml_name("%s.%s", cphp_res_path, CPU_SELECTOR);
    425        Aml *is_enabled = aml_name("%s.%s", cphp_res_path, CPU_ENABLED);
    426        Aml *cpu_cmd = aml_name("%s.%s", cphp_res_path, CPU_COMMAND);
    427        Aml *cpu_data = aml_name("%s.%s", cphp_res_path, CPU_DATA);
    428        Aml *ins_evt = aml_name("%s.%s", cphp_res_path, CPU_INSERT_EVENT);
    429        Aml *rm_evt = aml_name("%s.%s", cphp_res_path, CPU_REMOVE_EVENT);
    430        Aml *ej_evt = aml_name("%s.%s", cphp_res_path, CPU_EJECT_EVENT);
    431        Aml *fw_ej_evt = aml_name("%s.%s", cphp_res_path, CPU_FW_EJECT_EVENT);
    432
    433        aml_append(cpus_dev, aml_name_decl("_HID", aml_string("ACPI0010")));
    434        aml_append(cpus_dev, aml_name_decl("_CID", aml_eisaid("PNP0A05")));
    435
    436        method = aml_method(CPU_NOTIFY_METHOD, 2, AML_NOTSERIALIZED);
    437        for (i = 0; i < arch_ids->len; i++) {
    438            Aml *cpu = aml_name(CPU_NAME_FMT, i);
    439            Aml *uid = aml_arg(0);
    440            Aml *event = aml_arg(1);
    441
    442            ifctx = aml_if(aml_equal(uid, aml_int(i)));
    443            {
    444                aml_append(ifctx, aml_notify(cpu, event));
    445            }
    446            aml_append(method, ifctx);
    447        }
    448        aml_append(cpus_dev, method);
    449
    450        method = aml_method(CPU_STS_METHOD, 1, AML_SERIALIZED);
    451        {
    452            Aml *idx = aml_arg(0);
    453            Aml *sta = aml_local(0);
    454
    455            aml_append(method, aml_acquire(ctrl_lock, 0xFFFF));
    456            aml_append(method, aml_store(idx, cpu_selector));
    457            aml_append(method, aml_store(zero, sta));
    458            ifctx = aml_if(aml_equal(is_enabled, one));
    459            {
    460                aml_append(ifctx, aml_store(aml_int(0xF), sta));
    461            }
    462            aml_append(method, ifctx);
    463            aml_append(method, aml_release(ctrl_lock));
    464            aml_append(method, aml_return(sta));
    465        }
    466        aml_append(cpus_dev, method);
    467
    468        method = aml_method(CPU_EJECT_METHOD, 1, AML_SERIALIZED);
    469        {
    470            Aml *idx = aml_arg(0);
    471
    472            aml_append(method, aml_acquire(ctrl_lock, 0xFFFF));
    473            aml_append(method, aml_store(idx, cpu_selector));
    474            if (opts.fw_unplugs_cpu) {
    475                aml_append(method, aml_store(one, fw_ej_evt));
    476                aml_append(method, aml_store(aml_int(OVMF_CPUHP_SMI_CMD),
    477                           aml_name("%s", opts.smi_path)));
    478            } else {
    479                aml_append(method, aml_store(one, ej_evt));
    480            }
    481            aml_append(method, aml_release(ctrl_lock));
    482        }
    483        aml_append(cpus_dev, method);
    484
    485        method = aml_method(CPU_SCAN_METHOD, 0, AML_SERIALIZED);
    486        {
    487            const uint8_t max_cpus_per_pass = 255;
    488            Aml *else_ctx;
    489            Aml *while_ctx, *while_ctx2;
    490            Aml *has_event = aml_local(0);
    491            Aml *dev_chk = aml_int(1);
    492            Aml *eject_req = aml_int(3);
    493            Aml *next_cpu_cmd = aml_int(CPHP_GET_NEXT_CPU_WITH_EVENT_CMD);
    494            Aml *num_added_cpus = aml_local(1);
    495            Aml *cpu_idx = aml_local(2);
    496            Aml *uid = aml_local(3);
    497            Aml *has_job = aml_local(4);
    498            Aml *new_cpus = aml_name(CPU_ADDED_LIST);
    499
    500            aml_append(method, aml_acquire(ctrl_lock, 0xFFFF));
    501
    502            /*
    503             * Windows versions newer than XP (including Windows 10/Windows
    504             * Server 2019), do support* VarPackageOp but, it is cripled to hold
    505             * the same elements number as old PackageOp.
    506             * For compatibility with Windows XP (so it won't crash) use ACPI1.0
    507             * PackageOp which can hold max 255 elements.
    508             *
    509             * use named package as old Windows don't support it in local var
    510             */
    511            aml_append(method, aml_name_decl(CPU_ADDED_LIST,
    512                                             aml_package(max_cpus_per_pass)));
    513
    514            aml_append(method, aml_store(zero, uid));
    515            aml_append(method, aml_store(one, has_job));
    516            /*
    517             * CPU_ADDED_LIST can hold limited number of elements, outer loop
    518             * allows to process CPUs in batches which let us to handle more
    519             * CPUs than CPU_ADDED_LIST can hold.
    520             */
    521            while_ctx2 = aml_while(aml_equal(has_job, one));
    522            {
    523                aml_append(while_ctx2, aml_store(zero, has_job));
    524
    525                aml_append(while_ctx2, aml_store(one, has_event));
    526                aml_append(while_ctx2, aml_store(zero, num_added_cpus));
    527
    528                /*
    529                 * Scan CPUs, till there are CPUs with events or
    530                 * CPU_ADDED_LIST capacity is exhausted
    531                 */
    532                while_ctx = aml_while(aml_land(aml_equal(has_event, one),
    533                                      aml_lless(uid, aml_int(arch_ids->len))));
    534                {
    535                     /*
    536                      * clear loop exit condition, ins_evt/rm_evt checks will
    537                      * set it to 1 while next_cpu_cmd returns a CPU with events
    538                      */
    539                     aml_append(while_ctx, aml_store(zero, has_event));
    540
    541                     aml_append(while_ctx, aml_store(uid, cpu_selector));
    542                     aml_append(while_ctx, aml_store(next_cpu_cmd, cpu_cmd));
    543
    544                     /*
    545                      * wrap around case, scan is complete, exit loop.
    546                      * It happens since events are not cleared in scan loop,
    547                      * so next_cpu_cmd continues to find already processed CPUs
    548                      */
    549                     ifctx = aml_if(aml_lless(cpu_data, uid));
    550                     {
    551                         aml_append(ifctx, aml_break());
    552                     }
    553                     aml_append(while_ctx, ifctx);
    554
    555                     /*
    556                      * if CPU_ADDED_LIST is full, exit inner loop and process
    557                      * collected CPUs
    558                      */
    559                     ifctx = aml_if(
    560                         aml_equal(num_added_cpus, aml_int(max_cpus_per_pass)));
    561                     {
    562                         aml_append(ifctx, aml_store(one, has_job));
    563                         aml_append(ifctx, aml_break());
    564                     }
    565                     aml_append(while_ctx, ifctx);
    566
    567                     aml_append(while_ctx, aml_store(cpu_data, uid));
    568                     ifctx = aml_if(aml_equal(ins_evt, one));
    569                     {
    570                         /* cache added CPUs to Notify/Wakeup later */
    571                         aml_append(ifctx, aml_store(uid,
    572                             aml_index(new_cpus, num_added_cpus)));
    573                         aml_append(ifctx, aml_increment(num_added_cpus));
    574                         aml_append(ifctx, aml_store(one, has_event));
    575                     }
    576                     aml_append(while_ctx, ifctx);
    577                     else_ctx = aml_else();
    578                     ifctx = aml_if(aml_equal(rm_evt, one));
    579                     {
    580                         aml_append(ifctx,
    581                             aml_call2(CPU_NOTIFY_METHOD, uid, eject_req));
    582                         aml_append(ifctx, aml_store(one, rm_evt));
    583                         aml_append(ifctx, aml_store(one, has_event));
    584                     }
    585                     aml_append(else_ctx, ifctx);
    586                     aml_append(while_ctx, else_ctx);
    587                     aml_append(while_ctx, aml_increment(uid));
    588                }
    589                aml_append(while_ctx2, while_ctx);
    590
    591                /*
    592                 * in case FW negotiated ICH9_LPC_SMI_F_CPU_HOTPLUG_BIT,
    593                 * make upcall to FW, so it can pull in new CPUs before
    594                 * OS is notified and wakes them up
    595                 */
    596                if (opts.smi_path) {
    597                    ifctx = aml_if(aml_lgreater(num_added_cpus, zero));
    598                    {
    599                        aml_append(ifctx, aml_store(aml_int(OVMF_CPUHP_SMI_CMD),
    600                            aml_name("%s", opts.smi_path)));
    601                    }
    602                    aml_append(while_ctx2, ifctx);
    603                }
    604
    605                /* Notify OSPM about new CPUs and clear insert events */
    606                aml_append(while_ctx2, aml_store(zero, cpu_idx));
    607                while_ctx = aml_while(aml_lless(cpu_idx, num_added_cpus));
    608                {
    609                    aml_append(while_ctx,
    610                        aml_store(aml_derefof(aml_index(new_cpus, cpu_idx)),
    611                                  uid));
    612                    aml_append(while_ctx,
    613                        aml_call2(CPU_NOTIFY_METHOD, uid, dev_chk));
    614                    aml_append(while_ctx, aml_store(uid, aml_debug()));
    615                    aml_append(while_ctx, aml_store(uid, cpu_selector));
    616                    aml_append(while_ctx, aml_store(one, ins_evt));
    617                    aml_append(while_ctx, aml_increment(cpu_idx));
    618                }
    619                aml_append(while_ctx2, while_ctx);
    620                /*
    621                 * If another batch is needed, then it will resume scanning
    622                 * exactly at -- and not after -- the last CPU that's currently
    623                 * in CPU_ADDED_LIST. In other words, the last CPU in
    624                 * CPU_ADDED_LIST is going to be re-checked. That's OK: we've
    625                 * just cleared the insert event for *all* CPUs in
    626                 * CPU_ADDED_LIST, including the last one. So the scan will
    627                 * simply seek past it.
    628                 */
    629            }
    630            aml_append(method, while_ctx2);
    631            aml_append(method, aml_release(ctrl_lock));
    632        }
    633        aml_append(cpus_dev, method);
    634
    635        method = aml_method(CPU_OST_METHOD, 4, AML_SERIALIZED);
    636        {
    637            Aml *uid = aml_arg(0);
    638            Aml *ev_cmd = aml_int(CPHP_OST_EVENT_CMD);
    639            Aml *st_cmd = aml_int(CPHP_OST_STATUS_CMD);
    640
    641            aml_append(method, aml_acquire(ctrl_lock, 0xFFFF));
    642            aml_append(method, aml_store(uid, cpu_selector));
    643            aml_append(method, aml_store(ev_cmd, cpu_cmd));
    644            aml_append(method, aml_store(aml_arg(1), cpu_data));
    645            aml_append(method, aml_store(st_cmd, cpu_cmd));
    646            aml_append(method, aml_store(aml_arg(2), cpu_data));
    647            aml_append(method, aml_release(ctrl_lock));
    648        }
    649        aml_append(cpus_dev, method);
    650
    651        /* build Processor object for each processor */
    652        for (i = 0; i < arch_ids->len; i++) {
    653            Aml *dev;
    654            Aml *uid = aml_int(i);
    655            GArray *madt_buf = g_array_new(0, 1, 1);
    656            int arch_id = arch_ids->cpus[i].arch_id;
    657
    658            if (opts.acpi_1_compatible && arch_id < 255) {
    659                dev = aml_processor(i, 0, 0, CPU_NAME_FMT, i);
    660            } else {
    661                dev = aml_device(CPU_NAME_FMT, i);
    662                aml_append(dev, aml_name_decl("_HID", aml_string("ACPI0007")));
    663                aml_append(dev, aml_name_decl("_UID", uid));
    664            }
    665
    666            method = aml_method("_STA", 0, AML_SERIALIZED);
    667            aml_append(method, aml_return(aml_call1(CPU_STS_METHOD, uid)));
    668            aml_append(dev, method);
    669
    670            /* build _MAT object */
    671            assert(adevc && adevc->madt_cpu);
    672            adevc->madt_cpu(adev, i, arch_ids, madt_buf,
    673                            true); /* set enabled flag */
    674            aml_append(dev, aml_name_decl("_MAT",
    675                aml_buffer(madt_buf->len, (uint8_t *)madt_buf->data)));
    676            g_array_free(madt_buf, true);
    677
    678            if (CPU(arch_ids->cpus[i].cpu) != first_cpu) {
    679                method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
    680                aml_append(method, aml_call1(CPU_EJECT_METHOD, uid));
    681                aml_append(dev, method);
    682            }
    683
    684            method = aml_method("_OST", 3, AML_SERIALIZED);
    685            aml_append(method,
    686                aml_call4(CPU_OST_METHOD, uid, aml_arg(0),
    687                          aml_arg(1), aml_arg(2))
    688            );
    689            aml_append(dev, method);
    690
    691            /* Linux guests discard SRAT info for non-present CPUs
    692             * as a result _PXM is required for all CPUs which might
    693             * be hot-plugged. For simplicity, add it for all CPUs.
    694             */
    695            if (arch_ids->cpus[i].props.has_node_id) {
    696                aml_append(dev, aml_name_decl("_PXM",
    697                           aml_int(arch_ids->cpus[i].props.node_id)));
    698            }
    699
    700            aml_append(cpus_dev, dev);
    701        }
    702    }
    703    aml_append(sb_scope, cpus_dev);
    704    aml_append(table, sb_scope);
    705
    706    method = aml_method(event_handler_method, 0, AML_NOTSERIALIZED);
    707    aml_append(method, aml_call0("\\_SB.CPUS." CPU_SCAN_METHOD));
    708    aml_append(table, method);
    709
    710    g_free(cphp_res_path);
    711}