Re: [PATCH 07/17] hvmloader: add basic Q35 support

[Alexey G <x1917x@gmail.com>]

On Tue, 28 Apr 2026 15:15:36 +0200
Roger Pau Monné <roger.pau@citrix.com> wrote:
>
>> +        pci_writel(devfn, 0x40, ACPI_PM1A_EVT_BLK_ADDRESS_V1 | 1);
>> +        pci_writeb(devfn, 0x44, 0x80); /* enable PM io space */
>> +        outl(SCI_EN_IOPORT, inl(SCI_EN_IOPORT) | GBL_SMI_EN | APMC_EN);
>
>Most of the above looks like black magic.  It's not like the context
>of this function is great, most of the existing stuff is poorly
>documented.  Can we get a bit more comments about what's this supposed
>to do, and maybe a reference to the Intel specification that lists
>where those PCI config space registers are coming from?

This is a precondition for the (later) switch to ACPI.

First, we set the ACPI I/O registers base - it can be absolutely
arbitrary but we choose the same value that was used before for PIIX4 -
ACPI_PM1A_EVT_BLK_ADDRESS_V1. The "| 1" part is likely NOT necessary
and should be removed unless QEMU has a bug with its handling -
according to Intel datasheet, bit0 is "Hardwired to 1 to indicate I/O
space", no need to set it explicitly.

At this point we can use ACPI I/O register block at
ACPI_PM1A_EVT_BLK_ADDRESS_V1. We are only interested in one register
from this range - at offset +30h. SCI_EN_IOPORT is a wrong name
actually, it should be renamed to SMI_EN_IOPORT.

Finally, the line
"outl(SCI_EN_IOPORT, inl(SCI_EN_IOPORT) | GBL_SMI_EN | APMC_EN)"
enables SMI generation - we will use it later to perform a classic
APM -> ACPI switch via a write to the APM_CNT (0B2h) register to
trigger an SW SMI, followed by validating SCI_EN=1 to confirm the
successful switch.

Basically, all this setup is just a preparation for the step done in
the next patch - "hvmloader: add ACPI enabling for Q35".

What I don't remember is who was actually responsible for actual ACPI
enabling - either QEMU or firmware.
On real systems it is a bit more complicated - the APM -> ACPI switch
is done by an ACPI-aware OS itself (OSPM, how they call it). The OS
extracts information from ACPI tables and use it to find out what and
where to write in order to switch to ACPI. Under the hood it's still a
special value written to the SW SMI register, triggering a SMI handler
in the firmware. The actual hand-off to ACPI was done by the SMI
handler, including switching the PM interrupt from SMI to ACPI's SCI.

I'm not sure why hvmloader does this switch early instead. But at least
this APM -> ACPI switch flow matches the older (PIIX4) one. Perhaps
this is how it was handled by QEMU.