xref: /openbmc/qemu/hw/i386/acpi-build.c (revision 407ba084)
1 /* Support for generating ACPI tables and passing them to Guests
2  *
3  * Copyright (C) 2008-2010  Kevin O'Connor <kevin@koconnor.net>
4  * Copyright (C) 2006 Fabrice Bellard
5  * Copyright (C) 2013 Red Hat Inc
6  *
7  * Author: Michael S. Tsirkin <mst@redhat.com>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License as published by
11  * the Free Software Foundation; either version 2 of the License, or
12  * (at your option) any later version.
13 
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU General Public License for more details.
18 
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, see <http://www.gnu.org/licenses/>.
21  */
22 
23 #include "acpi-build.h"
24 #include <stddef.h>
25 #include <glib.h>
26 #include "qemu-common.h"
27 #include "qemu/bitmap.h"
28 #include "qemu/osdep.h"
29 #include "qemu/range.h"
30 #include "qemu/error-report.h"
31 #include "hw/pci/pci.h"
32 #include "qom/cpu.h"
33 #include "hw/i386/pc.h"
34 #include "target-i386/cpu.h"
35 #include "hw/timer/hpet.h"
36 #include "hw/i386/acpi-defs.h"
37 #include "hw/acpi/acpi.h"
38 #include "hw/nvram/fw_cfg.h"
39 #include "bios-linker-loader.h"
40 #include "hw/loader.h"
41 #include "hw/isa/isa.h"
42 #include "hw/acpi/memory_hotplug.h"
43 #include "sysemu/tpm.h"
44 #include "hw/acpi/tpm.h"
45 
46 /* Supported chipsets: */
47 #include "hw/acpi/piix4.h"
48 #include "hw/acpi/pcihp.h"
49 #include "hw/i386/ich9.h"
50 #include "hw/pci/pci_bus.h"
51 #include "hw/pci-host/q35.h"
52 #include "hw/i386/intel_iommu.h"
53 
54 #include "hw/i386/q35-acpi-dsdt.hex"
55 #include "hw/i386/acpi-dsdt.hex"
56 
57 #include "qapi/qmp/qint.h"
58 #include "qom/qom-qobject.h"
59 
60 /* These are used to size the ACPI tables for -M pc-i440fx-1.7 and
61  * -M pc-i440fx-2.0.  Even if the actual amount of AML generated grows
62  * a little bit, there should be plenty of free space since the DSDT
63  * shrunk by ~1.5k between QEMU 2.0 and QEMU 2.1.
64  */
65 #define ACPI_BUILD_LEGACY_CPU_AML_SIZE    97
66 #define ACPI_BUILD_ALIGN_SIZE             0x1000
67 
68 #define ACPI_BUILD_TABLE_SIZE             0x20000
69 
70 typedef struct AcpiCpuInfo {
71     DECLARE_BITMAP(found_cpus, ACPI_CPU_HOTPLUG_ID_LIMIT);
72 } AcpiCpuInfo;
73 
74 typedef struct AcpiMcfgInfo {
75     uint64_t mcfg_base;
76     uint32_t mcfg_size;
77 } AcpiMcfgInfo;
78 
79 typedef struct AcpiPmInfo {
80     bool s3_disabled;
81     bool s4_disabled;
82     bool pcihp_bridge_en;
83     uint8_t s4_val;
84     uint16_t sci_int;
85     uint8_t acpi_enable_cmd;
86     uint8_t acpi_disable_cmd;
87     uint32_t gpe0_blk;
88     uint32_t gpe0_blk_len;
89     uint32_t io_base;
90 } AcpiPmInfo;
91 
92 typedef struct AcpiMiscInfo {
93     bool has_hpet;
94     bool has_tpm;
95     DECLARE_BITMAP(slot_hotplug_enable, PCI_SLOT_MAX);
96     const unsigned char *dsdt_code;
97     unsigned dsdt_size;
98     uint16_t pvpanic_port;
99 } AcpiMiscInfo;
100 
101 typedef struct AcpiBuildPciBusHotplugState {
102     GArray *device_table;
103     GArray *notify_table;
104     struct AcpiBuildPciBusHotplugState *parent;
105     bool pcihp_bridge_en;
106 } AcpiBuildPciBusHotplugState;
107 
108 static void acpi_get_dsdt(AcpiMiscInfo *info)
109 {
110     uint16_t *applesmc_sta;
111     Object *piix = piix4_pm_find();
112     Object *lpc = ich9_lpc_find();
113     assert(!!piix != !!lpc);
114 
115     if (piix) {
116         info->dsdt_code = AcpiDsdtAmlCode;
117         info->dsdt_size = sizeof AcpiDsdtAmlCode;
118         applesmc_sta = piix_dsdt_applesmc_sta;
119     }
120     if (lpc) {
121         info->dsdt_code = Q35AcpiDsdtAmlCode;
122         info->dsdt_size = sizeof Q35AcpiDsdtAmlCode;
123         applesmc_sta = q35_dsdt_applesmc_sta;
124     }
125 
126     /* Patch in appropriate value for AppleSMC _STA */
127     *(uint8_t *)(info->dsdt_code + *applesmc_sta) =
128         applesmc_find() ? 0x0b : 0x00;
129 }
130 
131 static
132 int acpi_add_cpu_info(Object *o, void *opaque)
133 {
134     AcpiCpuInfo *cpu = opaque;
135     uint64_t apic_id;
136 
137     if (object_dynamic_cast(o, TYPE_CPU)) {
138         apic_id = object_property_get_int(o, "apic-id", NULL);
139         assert(apic_id < ACPI_CPU_HOTPLUG_ID_LIMIT);
140 
141         set_bit(apic_id, cpu->found_cpus);
142     }
143 
144     object_child_foreach(o, acpi_add_cpu_info, opaque);
145     return 0;
146 }
147 
148 static void acpi_get_cpu_info(AcpiCpuInfo *cpu)
149 {
150     Object *root = object_get_root();
151 
152     memset(cpu->found_cpus, 0, sizeof cpu->found_cpus);
153     object_child_foreach(root, acpi_add_cpu_info, cpu);
154 }
155 
156 static void acpi_get_pm_info(AcpiPmInfo *pm)
157 {
158     Object *piix = piix4_pm_find();
159     Object *lpc = ich9_lpc_find();
160     Object *obj = NULL;
161     QObject *o;
162 
163     if (piix) {
164         obj = piix;
165     }
166     if (lpc) {
167         obj = lpc;
168     }
169     assert(obj);
170 
171     /* Fill in optional s3/s4 related properties */
172     o = object_property_get_qobject(obj, ACPI_PM_PROP_S3_DISABLED, NULL);
173     if (o) {
174         pm->s3_disabled = qint_get_int(qobject_to_qint(o));
175     } else {
176         pm->s3_disabled = false;
177     }
178     qobject_decref(o);
179     o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_DISABLED, NULL);
180     if (o) {
181         pm->s4_disabled = qint_get_int(qobject_to_qint(o));
182     } else {
183         pm->s4_disabled = false;
184     }
185     qobject_decref(o);
186     o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_VAL, NULL);
187     if (o) {
188         pm->s4_val = qint_get_int(qobject_to_qint(o));
189     } else {
190         pm->s4_val = false;
191     }
192     qobject_decref(o);
193 
194     /* Fill in mandatory properties */
195     pm->sci_int = object_property_get_int(obj, ACPI_PM_PROP_SCI_INT, NULL);
196 
197     pm->acpi_enable_cmd = object_property_get_int(obj,
198                                                   ACPI_PM_PROP_ACPI_ENABLE_CMD,
199                                                   NULL);
200     pm->acpi_disable_cmd = object_property_get_int(obj,
201                                                   ACPI_PM_PROP_ACPI_DISABLE_CMD,
202                                                   NULL);
203     pm->io_base = object_property_get_int(obj, ACPI_PM_PROP_PM_IO_BASE,
204                                           NULL);
205     pm->gpe0_blk = object_property_get_int(obj, ACPI_PM_PROP_GPE0_BLK,
206                                            NULL);
207     pm->gpe0_blk_len = object_property_get_int(obj, ACPI_PM_PROP_GPE0_BLK_LEN,
208                                                NULL);
209     pm->pcihp_bridge_en =
210         object_property_get_bool(obj, "acpi-pci-hotplug-with-bridge-support",
211                                  NULL);
212 }
213 
214 static void acpi_get_misc_info(AcpiMiscInfo *info)
215 {
216     info->has_hpet = hpet_find();
217     info->has_tpm = tpm_find();
218     info->pvpanic_port = pvpanic_port();
219 }
220 
221 static void acpi_get_pci_info(PcPciInfo *info)
222 {
223     Object *pci_host;
224     bool ambiguous;
225 
226     pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
227     g_assert(!ambiguous);
228     g_assert(pci_host);
229 
230     info->w32.begin = object_property_get_int(pci_host,
231                                               PCI_HOST_PROP_PCI_HOLE_START,
232                                               NULL);
233     info->w32.end = object_property_get_int(pci_host,
234                                             PCI_HOST_PROP_PCI_HOLE_END,
235                                             NULL);
236     info->w64.begin = object_property_get_int(pci_host,
237                                               PCI_HOST_PROP_PCI_HOLE64_START,
238                                               NULL);
239     info->w64.end = object_property_get_int(pci_host,
240                                             PCI_HOST_PROP_PCI_HOLE64_END,
241                                             NULL);
242 }
243 
244 #define ACPI_BUILD_APPNAME  "Bochs"
245 #define ACPI_BUILD_APPNAME6 "BOCHS "
246 #define ACPI_BUILD_APPNAME4 "BXPC"
247 
248 #define ACPI_BUILD_DPRINTF(level, fmt, ...) do {} while (0)
249 
250 #define ACPI_BUILD_TABLE_FILE "etc/acpi/tables"
251 #define ACPI_BUILD_RSDP_FILE "etc/acpi/rsdp"
252 
253 static void
254 build_header(GArray *linker, GArray *table_data,
255              AcpiTableHeader *h, const char *sig, int len, uint8_t rev)
256 {
257     memcpy(&h->signature, sig, 4);
258     h->length = cpu_to_le32(len);
259     h->revision = rev;
260     memcpy(h->oem_id, ACPI_BUILD_APPNAME6, 6);
261     memcpy(h->oem_table_id, ACPI_BUILD_APPNAME4, 4);
262     memcpy(h->oem_table_id + 4, sig, 4);
263     h->oem_revision = cpu_to_le32(1);
264     memcpy(h->asl_compiler_id, ACPI_BUILD_APPNAME4, 4);
265     h->asl_compiler_revision = cpu_to_le32(1);
266     h->checksum = 0;
267     /* Checksum to be filled in by Guest linker */
268     bios_linker_loader_add_checksum(linker, ACPI_BUILD_TABLE_FILE,
269                                     table_data->data, h, len, &h->checksum);
270 }
271 
272 static inline GArray *build_alloc_array(void)
273 {
274         return g_array_new(false, true /* clear */, 1);
275 }
276 
277 static inline void build_free_array(GArray *array)
278 {
279         g_array_free(array, true);
280 }
281 
282 static inline void build_prepend_byte(GArray *array, uint8_t val)
283 {
284     g_array_prepend_val(array, val);
285 }
286 
287 static inline void build_append_byte(GArray *array, uint8_t val)
288 {
289     g_array_append_val(array, val);
290 }
291 
292 static inline void build_append_array(GArray *array, GArray *val)
293 {
294     g_array_append_vals(array, val->data, val->len);
295 }
296 
297 static void GCC_FMT_ATTR(2, 3)
298 build_append_nameseg(GArray *array, const char *format, ...)
299 {
300     /* It would be nicer to use g_string_vprintf but it's only there in 2.22 */
301     char s[] = "XXXX";
302     int len;
303     va_list args;
304 
305     va_start(args, format);
306     len = vsnprintf(s, sizeof s, format, args);
307     va_end(args);
308 
309     assert(len == 4);
310     g_array_append_vals(array, s, len);
311 }
312 
313 /* 5.4 Definition Block Encoding */
314 enum {
315     PACKAGE_LENGTH_1BYTE_SHIFT = 6, /* Up to 63 - use extra 2 bits. */
316     PACKAGE_LENGTH_2BYTE_SHIFT = 4,
317     PACKAGE_LENGTH_3BYTE_SHIFT = 12,
318     PACKAGE_LENGTH_4BYTE_SHIFT = 20,
319 };
320 
321 static void build_prepend_package_length(GArray *package, unsigned min_bytes)
322 {
323     uint8_t byte;
324     unsigned length = package->len;
325     unsigned length_bytes;
326 
327     if (length + 1 < (1 << PACKAGE_LENGTH_1BYTE_SHIFT)) {
328         length_bytes = 1;
329     } else if (length + 2 < (1 << PACKAGE_LENGTH_3BYTE_SHIFT)) {
330         length_bytes = 2;
331     } else if (length + 3 < (1 << PACKAGE_LENGTH_4BYTE_SHIFT)) {
332         length_bytes = 3;
333     } else {
334         length_bytes = 4;
335     }
336 
337     /* Force length to at least min_bytes.
338      * This wastes memory but that's how bios did it.
339      */
340     length_bytes = MAX(length_bytes, min_bytes);
341 
342     /* PkgLength is the length of the inclusive length of the data. */
343     length += length_bytes;
344 
345     switch (length_bytes) {
346     case 1:
347         byte = length;
348         build_prepend_byte(package, byte);
349         return;
350     case 4:
351         byte = length >> PACKAGE_LENGTH_4BYTE_SHIFT;
352         build_prepend_byte(package, byte);
353         length &= (1 << PACKAGE_LENGTH_4BYTE_SHIFT) - 1;
354         /* fall through */
355     case 3:
356         byte = length >> PACKAGE_LENGTH_3BYTE_SHIFT;
357         build_prepend_byte(package, byte);
358         length &= (1 << PACKAGE_LENGTH_3BYTE_SHIFT) - 1;
359         /* fall through */
360     case 2:
361         byte = length >> PACKAGE_LENGTH_2BYTE_SHIFT;
362         build_prepend_byte(package, byte);
363         length &= (1 << PACKAGE_LENGTH_2BYTE_SHIFT) - 1;
364         /* fall through */
365     }
366     /*
367      * Most significant two bits of byte zero indicate how many following bytes
368      * are in PkgLength encoding.
369      */
370     byte = ((length_bytes - 1) << PACKAGE_LENGTH_1BYTE_SHIFT) | length;
371     build_prepend_byte(package, byte);
372 }
373 
374 static void build_package(GArray *package, uint8_t op, unsigned min_bytes)
375 {
376     build_prepend_package_length(package, min_bytes);
377     build_prepend_byte(package, op);
378 }
379 
380 static void build_extop_package(GArray *package, uint8_t op)
381 {
382     build_package(package, op, 1);
383     build_prepend_byte(package, 0x5B); /* ExtOpPrefix */
384 }
385 
386 static void build_append_value(GArray *table, uint32_t value, int size)
387 {
388     uint8_t prefix;
389     int i;
390 
391     switch (size) {
392     case 1:
393         prefix = 0x0A; /* BytePrefix */
394         break;
395     case 2:
396         prefix = 0x0B; /* WordPrefix */
397         break;
398     case 4:
399         prefix = 0x0C; /* DWordPrefix */
400         break;
401     default:
402         assert(0);
403         return;
404     }
405     build_append_byte(table, prefix);
406     for (i = 0; i < size; ++i) {
407         build_append_byte(table, value & 0xFF);
408         value = value >> 8;
409     }
410 }
411 
412 static void build_append_int(GArray *table, uint32_t value)
413 {
414     if (value == 0x00) {
415         build_append_byte(table, 0x00); /* ZeroOp */
416     } else if (value == 0x01) {
417         build_append_byte(table, 0x01); /* OneOp */
418     } else if (value <= 0xFF) {
419         build_append_value(table, value, 1);
420     } else if (value <= 0xFFFF) {
421         build_append_value(table, value, 2);
422     } else {
423         build_append_value(table, value, 4);
424     }
425 }
426 
427 static GArray *build_alloc_method(const char *name, uint8_t arg_count)
428 {
429     GArray *method = build_alloc_array();
430 
431     build_append_nameseg(method, "%s", name);
432     build_append_byte(method, arg_count); /* MethodFlags: ArgCount */
433 
434     return method;
435 }
436 
437 static void build_append_and_cleanup_method(GArray *device, GArray *method)
438 {
439     uint8_t op = 0x14; /* MethodOp */
440 
441     build_package(method, op, 0);
442 
443     build_append_array(device, method);
444     build_free_array(method);
445 }
446 
447 static void build_append_notify_target_ifequal(GArray *method,
448                                                GArray *target_name,
449                                                uint32_t value, int size)
450 {
451     GArray *notify = build_alloc_array();
452     uint8_t op = 0xA0; /* IfOp */
453 
454     build_append_byte(notify, 0x93); /* LEqualOp */
455     build_append_byte(notify, 0x68); /* Arg0Op */
456     build_append_value(notify, value, size);
457     build_append_byte(notify, 0x86); /* NotifyOp */
458     build_append_array(notify, target_name);
459     build_append_byte(notify, 0x69); /* Arg1Op */
460 
461     /* Pack it up */
462     build_package(notify, op, 1);
463 
464     build_append_array(method, notify);
465 
466     build_free_array(notify);
467 }
468 
469 /* End here */
470 #define ACPI_PORT_SMI_CMD           0x00b2 /* TODO: this is APM_CNT_IOPORT */
471 
472 static inline void *acpi_data_push(GArray *table_data, unsigned size)
473 {
474     unsigned off = table_data->len;
475     g_array_set_size(table_data, off + size);
476     return table_data->data + off;
477 }
478 
479 static unsigned acpi_data_len(GArray *table)
480 {
481 #if GLIB_CHECK_VERSION(2, 22, 0)
482     assert(g_array_get_element_size(table) == 1);
483 #endif
484     return table->len;
485 }
486 
487 static void acpi_align_size(GArray *blob, unsigned align)
488 {
489     /* Align size to multiple of given size. This reduces the chance
490      * we need to change size in the future (breaking cross version migration).
491      */
492     g_array_set_size(blob, ROUND_UP(acpi_data_len(blob), align));
493 }
494 
495 /* Set a value within table in a safe manner */
496 #define ACPI_BUILD_SET_LE(table, size, off, bits, val) \
497     do { \
498         uint64_t ACPI_BUILD_SET_LE_val = cpu_to_le64(val); \
499         memcpy(acpi_data_get_ptr(table, size, off, \
500                                  (bits) / BITS_PER_BYTE), \
501                &ACPI_BUILD_SET_LE_val, \
502                (bits) / BITS_PER_BYTE); \
503     } while (0)
504 
505 static inline void *acpi_data_get_ptr(uint8_t *table_data, unsigned table_size,
506                                       unsigned off, unsigned size)
507 {
508     assert(off + size > off);
509     assert(off + size <= table_size);
510     return table_data + off;
511 }
512 
513 static inline void acpi_add_table(GArray *table_offsets, GArray *table_data)
514 {
515     uint32_t offset = cpu_to_le32(table_data->len);
516     g_array_append_val(table_offsets, offset);
517 }
518 
519 /* FACS */
520 static void
521 build_facs(GArray *table_data, GArray *linker, PcGuestInfo *guest_info)
522 {
523     AcpiFacsDescriptorRev1 *facs = acpi_data_push(table_data, sizeof *facs);
524     memcpy(&facs->signature, "FACS", 4);
525     facs->length = cpu_to_le32(sizeof(*facs));
526 }
527 
528 /* Load chipset information in FADT */
529 static void fadt_setup(AcpiFadtDescriptorRev1 *fadt, AcpiPmInfo *pm)
530 {
531     fadt->model = 1;
532     fadt->reserved1 = 0;
533     fadt->sci_int = cpu_to_le16(pm->sci_int);
534     fadt->smi_cmd = cpu_to_le32(ACPI_PORT_SMI_CMD);
535     fadt->acpi_enable = pm->acpi_enable_cmd;
536     fadt->acpi_disable = pm->acpi_disable_cmd;
537     /* EVT, CNT, TMR offset matches hw/acpi/core.c */
538     fadt->pm1a_evt_blk = cpu_to_le32(pm->io_base);
539     fadt->pm1a_cnt_blk = cpu_to_le32(pm->io_base + 0x04);
540     fadt->pm_tmr_blk = cpu_to_le32(pm->io_base + 0x08);
541     fadt->gpe0_blk = cpu_to_le32(pm->gpe0_blk);
542     /* EVT, CNT, TMR length matches hw/acpi/core.c */
543     fadt->pm1_evt_len = 4;
544     fadt->pm1_cnt_len = 2;
545     fadt->pm_tmr_len = 4;
546     fadt->gpe0_blk_len = pm->gpe0_blk_len;
547     fadt->plvl2_lat = cpu_to_le16(0xfff); /* C2 state not supported */
548     fadt->plvl3_lat = cpu_to_le16(0xfff); /* C3 state not supported */
549     fadt->flags = cpu_to_le32((1 << ACPI_FADT_F_WBINVD) |
550                               (1 << ACPI_FADT_F_PROC_C1) |
551                               (1 << ACPI_FADT_F_SLP_BUTTON) |
552                               (1 << ACPI_FADT_F_RTC_S4));
553     fadt->flags |= cpu_to_le32(1 << ACPI_FADT_F_USE_PLATFORM_CLOCK);
554     /* APIC destination mode ("Flat Logical") has an upper limit of 8 CPUs
555      * For more than 8 CPUs, "Clustered Logical" mode has to be used
556      */
557     if (max_cpus > 8) {
558         fadt->flags |= cpu_to_le32(1 << ACPI_FADT_F_FORCE_APIC_CLUSTER_MODEL);
559     }
560 }
561 
562 
563 /* FADT */
564 static void
565 build_fadt(GArray *table_data, GArray *linker, AcpiPmInfo *pm,
566            unsigned facs, unsigned dsdt)
567 {
568     AcpiFadtDescriptorRev1 *fadt = acpi_data_push(table_data, sizeof(*fadt));
569 
570     fadt->firmware_ctrl = cpu_to_le32(facs);
571     /* FACS address to be filled by Guest linker */
572     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
573                                    ACPI_BUILD_TABLE_FILE,
574                                    table_data, &fadt->firmware_ctrl,
575                                    sizeof fadt->firmware_ctrl);
576 
577     fadt->dsdt = cpu_to_le32(dsdt);
578     /* DSDT address to be filled by Guest linker */
579     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
580                                    ACPI_BUILD_TABLE_FILE,
581                                    table_data, &fadt->dsdt,
582                                    sizeof fadt->dsdt);
583 
584     fadt_setup(fadt, pm);
585 
586     build_header(linker, table_data,
587                  (void *)fadt, "FACP", sizeof(*fadt), 1);
588 }
589 
590 static void
591 build_madt(GArray *table_data, GArray *linker, AcpiCpuInfo *cpu,
592            PcGuestInfo *guest_info)
593 {
594     int madt_start = table_data->len;
595 
596     AcpiMultipleApicTable *madt;
597     AcpiMadtIoApic *io_apic;
598     AcpiMadtIntsrcovr *intsrcovr;
599     AcpiMadtLocalNmi *local_nmi;
600     int i;
601 
602     madt = acpi_data_push(table_data, sizeof *madt);
603     madt->local_apic_address = cpu_to_le32(APIC_DEFAULT_ADDRESS);
604     madt->flags = cpu_to_le32(1);
605 
606     for (i = 0; i < guest_info->apic_id_limit; i++) {
607         AcpiMadtProcessorApic *apic = acpi_data_push(table_data, sizeof *apic);
608         apic->type = ACPI_APIC_PROCESSOR;
609         apic->length = sizeof(*apic);
610         apic->processor_id = i;
611         apic->local_apic_id = i;
612         if (test_bit(i, cpu->found_cpus)) {
613             apic->flags = cpu_to_le32(1);
614         } else {
615             apic->flags = cpu_to_le32(0);
616         }
617     }
618     io_apic = acpi_data_push(table_data, sizeof *io_apic);
619     io_apic->type = ACPI_APIC_IO;
620     io_apic->length = sizeof(*io_apic);
621 #define ACPI_BUILD_IOAPIC_ID 0x0
622     io_apic->io_apic_id = ACPI_BUILD_IOAPIC_ID;
623     io_apic->address = cpu_to_le32(IO_APIC_DEFAULT_ADDRESS);
624     io_apic->interrupt = cpu_to_le32(0);
625 
626     if (guest_info->apic_xrupt_override) {
627         intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr);
628         intsrcovr->type   = ACPI_APIC_XRUPT_OVERRIDE;
629         intsrcovr->length = sizeof(*intsrcovr);
630         intsrcovr->source = 0;
631         intsrcovr->gsi    = cpu_to_le32(2);
632         intsrcovr->flags  = cpu_to_le16(0); /* conforms to bus specifications */
633     }
634     for (i = 1; i < 16; i++) {
635 #define ACPI_BUILD_PCI_IRQS ((1<<5) | (1<<9) | (1<<10) | (1<<11))
636         if (!(ACPI_BUILD_PCI_IRQS & (1 << i))) {
637             /* No need for a INT source override structure. */
638             continue;
639         }
640         intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr);
641         intsrcovr->type   = ACPI_APIC_XRUPT_OVERRIDE;
642         intsrcovr->length = sizeof(*intsrcovr);
643         intsrcovr->source = i;
644         intsrcovr->gsi    = cpu_to_le32(i);
645         intsrcovr->flags  = cpu_to_le16(0xd); /* active high, level triggered */
646     }
647 
648     local_nmi = acpi_data_push(table_data, sizeof *local_nmi);
649     local_nmi->type         = ACPI_APIC_LOCAL_NMI;
650     local_nmi->length       = sizeof(*local_nmi);
651     local_nmi->processor_id = 0xff; /* all processors */
652     local_nmi->flags        = cpu_to_le16(0);
653     local_nmi->lint         = 1; /* ACPI_LINT1 */
654 
655     build_header(linker, table_data,
656                  (void *)(table_data->data + madt_start), "APIC",
657                  table_data->len - madt_start, 1);
658 }
659 
660 /* Encode a hex value */
661 static inline char acpi_get_hex(uint32_t val)
662 {
663     val &= 0x0f;
664     return (val <= 9) ? ('0' + val) : ('A' + val - 10);
665 }
666 
667 #include "hw/i386/ssdt-proc.hex"
668 
669 /* 0x5B 0x83 ProcessorOp PkgLength NameString ProcID */
670 #define ACPI_PROC_OFFSET_CPUHEX (*ssdt_proc_name - *ssdt_proc_start + 2)
671 #define ACPI_PROC_OFFSET_CPUID1 (*ssdt_proc_name - *ssdt_proc_start + 4)
672 #define ACPI_PROC_OFFSET_CPUID2 (*ssdt_proc_id - *ssdt_proc_start)
673 #define ACPI_PROC_SIZEOF (*ssdt_proc_end - *ssdt_proc_start)
674 #define ACPI_PROC_AML (ssdp_proc_aml + *ssdt_proc_start)
675 
676 /* 0x5B 0x82 DeviceOp PkgLength NameString */
677 #define ACPI_PCIHP_OFFSET_HEX (*ssdt_pcihp_name - *ssdt_pcihp_start + 1)
678 #define ACPI_PCIHP_OFFSET_ID (*ssdt_pcihp_id - *ssdt_pcihp_start)
679 #define ACPI_PCIHP_OFFSET_ADR (*ssdt_pcihp_adr - *ssdt_pcihp_start)
680 #define ACPI_PCIHP_OFFSET_EJ0 (*ssdt_pcihp_ej0 - *ssdt_pcihp_start)
681 #define ACPI_PCIHP_SIZEOF (*ssdt_pcihp_end - *ssdt_pcihp_start)
682 #define ACPI_PCIHP_AML (ssdp_pcihp_aml + *ssdt_pcihp_start)
683 
684 #define ACPI_PCINOHP_OFFSET_HEX (*ssdt_pcinohp_name - *ssdt_pcinohp_start + 1)
685 #define ACPI_PCINOHP_OFFSET_ADR (*ssdt_pcinohp_adr - *ssdt_pcinohp_start)
686 #define ACPI_PCINOHP_SIZEOF (*ssdt_pcinohp_end - *ssdt_pcinohp_start)
687 #define ACPI_PCINOHP_AML (ssdp_pcihp_aml + *ssdt_pcinohp_start)
688 
689 #define ACPI_PCIVGA_OFFSET_HEX (*ssdt_pcivga_name - *ssdt_pcivga_start + 1)
690 #define ACPI_PCIVGA_OFFSET_ADR (*ssdt_pcivga_adr - *ssdt_pcivga_start)
691 #define ACPI_PCIVGA_SIZEOF (*ssdt_pcivga_end - *ssdt_pcivga_start)
692 #define ACPI_PCIVGA_AML (ssdp_pcihp_aml + *ssdt_pcivga_start)
693 
694 #define ACPI_PCIQXL_OFFSET_HEX (*ssdt_pciqxl_name - *ssdt_pciqxl_start + 1)
695 #define ACPI_PCIQXL_OFFSET_ADR (*ssdt_pciqxl_adr - *ssdt_pciqxl_start)
696 #define ACPI_PCIQXL_SIZEOF (*ssdt_pciqxl_end - *ssdt_pciqxl_start)
697 #define ACPI_PCIQXL_AML (ssdp_pcihp_aml + *ssdt_pciqxl_start)
698 
699 #include "hw/i386/ssdt-mem.hex"
700 
701 /* 0x5B 0x82 DeviceOp PkgLength NameString DimmID */
702 #define ACPI_MEM_OFFSET_HEX (*ssdt_mem_name - *ssdt_mem_start + 2)
703 #define ACPI_MEM_OFFSET_ID (*ssdt_mem_id - *ssdt_mem_start + 7)
704 #define ACPI_MEM_SIZEOF (*ssdt_mem_end - *ssdt_mem_start)
705 #define ACPI_MEM_AML (ssdm_mem_aml + *ssdt_mem_start)
706 
707 #define ACPI_SSDT_SIGNATURE 0x54445353 /* SSDT */
708 #define ACPI_SSDT_HEADER_LENGTH 36
709 
710 #include "hw/i386/ssdt-misc.hex"
711 #include "hw/i386/ssdt-pcihp.hex"
712 #include "hw/i386/ssdt-tpm.hex"
713 
714 static void
715 build_append_notify_method(GArray *device, const char *name,
716                            const char *format, int count)
717 {
718     int i;
719     GArray *method = build_alloc_method(name, 2);
720 
721     for (i = 0; i < count; i++) {
722         GArray *target = build_alloc_array();
723         build_append_nameseg(target, format, i);
724         assert(i < 256); /* Fits in 1 byte */
725         build_append_notify_target_ifequal(method, target, i, 1);
726         build_free_array(target);
727     }
728 
729     build_append_and_cleanup_method(device, method);
730 }
731 
732 static void patch_pcihp(int slot, uint8_t *ssdt_ptr)
733 {
734     unsigned devfn = PCI_DEVFN(slot, 0);
735 
736     ssdt_ptr[ACPI_PCIHP_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
737     ssdt_ptr[ACPI_PCIHP_OFFSET_HEX + 1] = acpi_get_hex(devfn);
738     ssdt_ptr[ACPI_PCIHP_OFFSET_ID] = slot;
739     ssdt_ptr[ACPI_PCIHP_OFFSET_ADR + 2] = slot;
740 }
741 
742 static void patch_pcinohp(int slot, uint8_t *ssdt_ptr)
743 {
744     unsigned devfn = PCI_DEVFN(slot, 0);
745 
746     ssdt_ptr[ACPI_PCINOHP_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
747     ssdt_ptr[ACPI_PCINOHP_OFFSET_HEX + 1] = acpi_get_hex(devfn);
748     ssdt_ptr[ACPI_PCINOHP_OFFSET_ADR + 2] = slot;
749 }
750 
751 static void patch_pcivga(int slot, uint8_t *ssdt_ptr)
752 {
753     unsigned devfn = PCI_DEVFN(slot, 0);
754 
755     ssdt_ptr[ACPI_PCIVGA_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
756     ssdt_ptr[ACPI_PCIVGA_OFFSET_HEX + 1] = acpi_get_hex(devfn);
757     ssdt_ptr[ACPI_PCIVGA_OFFSET_ADR + 2] = slot;
758 }
759 
760 static void patch_pciqxl(int slot, uint8_t *ssdt_ptr)
761 {
762     unsigned devfn = PCI_DEVFN(slot, 0);
763 
764     ssdt_ptr[ACPI_PCIQXL_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
765     ssdt_ptr[ACPI_PCIQXL_OFFSET_HEX + 1] = acpi_get_hex(devfn);
766     ssdt_ptr[ACPI_PCIQXL_OFFSET_ADR + 2] = slot;
767 }
768 
769 /* Assign BSEL property to all buses.  In the future, this can be changed
770  * to only assign to buses that support hotplug.
771  */
772 static void *acpi_set_bsel(PCIBus *bus, void *opaque)
773 {
774     unsigned *bsel_alloc = opaque;
775     unsigned *bus_bsel;
776 
777     if (bus->qbus.allow_hotplug) {
778         bus_bsel = g_malloc(sizeof *bus_bsel);
779 
780         *bus_bsel = (*bsel_alloc)++;
781         object_property_add_uint32_ptr(OBJECT(bus), ACPI_PCIHP_PROP_BSEL,
782                                        bus_bsel, NULL);
783     }
784 
785     return bsel_alloc;
786 }
787 
788 static void acpi_set_pci_info(void)
789 {
790     PCIBus *bus = find_i440fx(); /* TODO: Q35 support */
791     unsigned bsel_alloc = 0;
792 
793     if (bus) {
794         /* Scan all PCI buses. Set property to enable acpi based hotplug. */
795         pci_for_each_bus_depth_first(bus, acpi_set_bsel, NULL, &bsel_alloc);
796     }
797 }
798 
799 static void build_pci_bus_state_init(AcpiBuildPciBusHotplugState *state,
800                                      AcpiBuildPciBusHotplugState *parent,
801                                      bool pcihp_bridge_en)
802 {
803     state->parent = parent;
804     state->device_table = build_alloc_array();
805     state->notify_table = build_alloc_array();
806     state->pcihp_bridge_en = pcihp_bridge_en;
807 }
808 
809 static void build_pci_bus_state_cleanup(AcpiBuildPciBusHotplugState *state)
810 {
811     build_free_array(state->device_table);
812     build_free_array(state->notify_table);
813 }
814 
815 static void *build_pci_bus_begin(PCIBus *bus, void *parent_state)
816 {
817     AcpiBuildPciBusHotplugState *parent = parent_state;
818     AcpiBuildPciBusHotplugState *child = g_malloc(sizeof *child);
819 
820     build_pci_bus_state_init(child, parent, parent->pcihp_bridge_en);
821 
822     return child;
823 }
824 
825 static void build_pci_bus_end(PCIBus *bus, void *bus_state)
826 {
827     AcpiBuildPciBusHotplugState *child = bus_state;
828     AcpiBuildPciBusHotplugState *parent = child->parent;
829     GArray *bus_table = build_alloc_array();
830     DECLARE_BITMAP(slot_hotplug_enable, PCI_SLOT_MAX);
831     DECLARE_BITMAP(slot_device_present, PCI_SLOT_MAX);
832     DECLARE_BITMAP(slot_device_system, PCI_SLOT_MAX);
833     DECLARE_BITMAP(slot_device_vga, PCI_SLOT_MAX);
834     DECLARE_BITMAP(slot_device_qxl, PCI_SLOT_MAX);
835     uint8_t op;
836     int i;
837     QObject *bsel;
838     GArray *method;
839     bool bus_hotplug_support = false;
840 
841     /*
842      * Skip bridge subtree creation if bridge hotplug is disabled
843      * to make acpi tables compatible with legacy machine types.
844      */
845     if (!child->pcihp_bridge_en && bus->parent_dev) {
846         return;
847     }
848 
849     if (bus->parent_dev) {
850         op = 0x82; /* DeviceOp */
851         build_append_nameseg(bus_table, "S%.02X_",
852                              bus->parent_dev->devfn);
853         build_append_byte(bus_table, 0x08); /* NameOp */
854         build_append_nameseg(bus_table, "_SUN");
855         build_append_value(bus_table, PCI_SLOT(bus->parent_dev->devfn), 1);
856         build_append_byte(bus_table, 0x08); /* NameOp */
857         build_append_nameseg(bus_table, "_ADR");
858         build_append_value(bus_table, (PCI_SLOT(bus->parent_dev->devfn) << 16) |
859                            PCI_FUNC(bus->parent_dev->devfn), 4);
860     } else {
861         op = 0x10; /* ScopeOp */;
862         build_append_nameseg(bus_table, "PCI0");
863     }
864 
865     bsel = object_property_get_qobject(OBJECT(bus), ACPI_PCIHP_PROP_BSEL, NULL);
866     if (bsel) {
867         build_append_byte(bus_table, 0x08); /* NameOp */
868         build_append_nameseg(bus_table, "BSEL");
869         build_append_int(bus_table, qint_get_int(qobject_to_qint(bsel)));
870         memset(slot_hotplug_enable, 0xff, sizeof slot_hotplug_enable);
871     } else {
872         /* No bsel - no slots are hot-pluggable */
873         memset(slot_hotplug_enable, 0x00, sizeof slot_hotplug_enable);
874     }
875 
876     memset(slot_device_present, 0x00, sizeof slot_device_present);
877     memset(slot_device_system, 0x00, sizeof slot_device_present);
878     memset(slot_device_vga, 0x00, sizeof slot_device_vga);
879     memset(slot_device_qxl, 0x00, sizeof slot_device_qxl);
880 
881     for (i = 0; i < ARRAY_SIZE(bus->devices); i += PCI_FUNC_MAX) {
882         DeviceClass *dc;
883         PCIDeviceClass *pc;
884         PCIDevice *pdev = bus->devices[i];
885         int slot = PCI_SLOT(i);
886         bool bridge_in_acpi;
887 
888         if (!pdev) {
889             continue;
890         }
891 
892         set_bit(slot, slot_device_present);
893         pc = PCI_DEVICE_GET_CLASS(pdev);
894         dc = DEVICE_GET_CLASS(pdev);
895 
896         /* When hotplug for bridges is enabled, bridges are
897          * described in ACPI separately (see build_pci_bus_end).
898          * In this case they aren't themselves hot-pluggable.
899          */
900         bridge_in_acpi = pc->is_bridge && child->pcihp_bridge_en;
901 
902         if (pc->class_id == PCI_CLASS_BRIDGE_ISA || bridge_in_acpi) {
903             set_bit(slot, slot_device_system);
904         }
905 
906         if (pc->class_id == PCI_CLASS_DISPLAY_VGA) {
907             set_bit(slot, slot_device_vga);
908 
909             if (object_dynamic_cast(OBJECT(pdev), "qxl-vga")) {
910                 set_bit(slot, slot_device_qxl);
911             }
912         }
913 
914         if (!dc->hotpluggable || bridge_in_acpi) {
915             clear_bit(slot, slot_hotplug_enable);
916         }
917     }
918 
919     /* Append Device object for each slot */
920     for (i = 0; i < PCI_SLOT_MAX; i++) {
921         bool can_eject = test_bit(i, slot_hotplug_enable);
922         bool present = test_bit(i, slot_device_present);
923         bool vga = test_bit(i, slot_device_vga);
924         bool qxl = test_bit(i, slot_device_qxl);
925         bool system = test_bit(i, slot_device_system);
926         if (can_eject) {
927             void *pcihp = acpi_data_push(bus_table,
928                                          ACPI_PCIHP_SIZEOF);
929             memcpy(pcihp, ACPI_PCIHP_AML, ACPI_PCIHP_SIZEOF);
930             patch_pcihp(i, pcihp);
931             bus_hotplug_support = true;
932         } else if (qxl) {
933             void *pcihp = acpi_data_push(bus_table,
934                                          ACPI_PCIQXL_SIZEOF);
935             memcpy(pcihp, ACPI_PCIQXL_AML, ACPI_PCIQXL_SIZEOF);
936             patch_pciqxl(i, pcihp);
937         } else if (vga) {
938             void *pcihp = acpi_data_push(bus_table,
939                                          ACPI_PCIVGA_SIZEOF);
940             memcpy(pcihp, ACPI_PCIVGA_AML, ACPI_PCIVGA_SIZEOF);
941             patch_pcivga(i, pcihp);
942         } else if (system) {
943             /* Nothing to do: system devices are in DSDT or in SSDT above. */
944         } else if (present) {
945             void *pcihp = acpi_data_push(bus_table,
946                                          ACPI_PCINOHP_SIZEOF);
947             memcpy(pcihp, ACPI_PCINOHP_AML, ACPI_PCINOHP_SIZEOF);
948             patch_pcinohp(i, pcihp);
949         }
950     }
951 
952     if (bsel) {
953         method = build_alloc_method("DVNT", 2);
954 
955         for (i = 0; i < PCI_SLOT_MAX; i++) {
956             GArray *notify;
957             uint8_t op;
958 
959             if (!test_bit(i, slot_hotplug_enable)) {
960                 continue;
961             }
962 
963             notify = build_alloc_array();
964             op = 0xA0; /* IfOp */
965 
966             build_append_byte(notify, 0x7B); /* AndOp */
967             build_append_byte(notify, 0x68); /* Arg0Op */
968             build_append_int(notify, 0x1U << i);
969             build_append_byte(notify, 0x00); /* NullName */
970             build_append_byte(notify, 0x86); /* NotifyOp */
971             build_append_nameseg(notify, "S%.02X_", PCI_DEVFN(i, 0));
972             build_append_byte(notify, 0x69); /* Arg1Op */
973 
974             /* Pack it up */
975             build_package(notify, op, 0);
976 
977             build_append_array(method, notify);
978 
979             build_free_array(notify);
980         }
981 
982         build_append_and_cleanup_method(bus_table, method);
983     }
984 
985     /* Append PCNT method to notify about events on local and child buses.
986      * Add unconditionally for root since DSDT expects it.
987      */
988     if (bus_hotplug_support || child->notify_table->len || !bus->parent_dev) {
989         method = build_alloc_method("PCNT", 0);
990 
991         /* If bus supports hotplug select it and notify about local events */
992         if (bsel) {
993             build_append_byte(method, 0x70); /* StoreOp */
994             build_append_int(method, qint_get_int(qobject_to_qint(bsel)));
995             build_append_nameseg(method, "BNUM");
996             build_append_nameseg(method, "DVNT");
997             build_append_nameseg(method, "PCIU");
998             build_append_int(method, 1); /* Device Check */
999             build_append_nameseg(method, "DVNT");
1000             build_append_nameseg(method, "PCID");
1001             build_append_int(method, 3); /* Eject Request */
1002         }
1003 
1004         /* Notify about child bus events in any case */
1005         build_append_array(method, child->notify_table);
1006 
1007         build_append_and_cleanup_method(bus_table, method);
1008 
1009         /* Append description of child buses */
1010         build_append_array(bus_table, child->device_table);
1011 
1012         /* Pack it up */
1013         if (bus->parent_dev) {
1014             build_extop_package(bus_table, op);
1015         } else {
1016             build_package(bus_table, op, 0);
1017         }
1018 
1019         /* Append our bus description to parent table */
1020         build_append_array(parent->device_table, bus_table);
1021 
1022         /* Also tell parent how to notify us, invoking PCNT method.
1023          * At the moment this is not needed for root as we have a single root.
1024          */
1025         if (bus->parent_dev) {
1026             build_append_byte(parent->notify_table, '^'); /* ParentPrefixChar */
1027             build_append_byte(parent->notify_table, 0x2E); /* DualNamePrefix */
1028             build_append_nameseg(parent->notify_table, "S%.02X_",
1029                                  bus->parent_dev->devfn);
1030             build_append_nameseg(parent->notify_table, "PCNT");
1031         }
1032     }
1033 
1034     qobject_decref(bsel);
1035     build_free_array(bus_table);
1036     build_pci_bus_state_cleanup(child);
1037     g_free(child);
1038 }
1039 
1040 static void patch_pci_windows(PcPciInfo *pci, uint8_t *start, unsigned size)
1041 {
1042     ACPI_BUILD_SET_LE(start, size, acpi_pci32_start[0], 32, pci->w32.begin);
1043 
1044     ACPI_BUILD_SET_LE(start, size, acpi_pci32_end[0], 32, pci->w32.end - 1);
1045 
1046     if (pci->w64.end || pci->w64.begin) {
1047         ACPI_BUILD_SET_LE(start, size, acpi_pci64_valid[0], 8, 1);
1048         ACPI_BUILD_SET_LE(start, size, acpi_pci64_start[0], 64, pci->w64.begin);
1049         ACPI_BUILD_SET_LE(start, size, acpi_pci64_end[0], 64, pci->w64.end - 1);
1050         ACPI_BUILD_SET_LE(start, size, acpi_pci64_length[0], 64, pci->w64.end - pci->w64.begin);
1051     } else {
1052         ACPI_BUILD_SET_LE(start, size, acpi_pci64_valid[0], 8, 0);
1053     }
1054 }
1055 
1056 static void
1057 build_ssdt(GArray *table_data, GArray *linker,
1058            AcpiCpuInfo *cpu, AcpiPmInfo *pm, AcpiMiscInfo *misc,
1059            PcPciInfo *pci, PcGuestInfo *guest_info)
1060 {
1061     MachineState *machine = MACHINE(qdev_get_machine());
1062     uint32_t nr_mem = machine->ram_slots;
1063     unsigned acpi_cpus = guest_info->apic_id_limit;
1064     int ssdt_start = table_data->len;
1065     uint8_t *ssdt_ptr;
1066     int i;
1067 
1068     /* The current AML generator can cover the APIC ID range [0..255],
1069      * inclusive, for VCPU hotplug. */
1070     QEMU_BUILD_BUG_ON(ACPI_CPU_HOTPLUG_ID_LIMIT > 256);
1071     g_assert(acpi_cpus <= ACPI_CPU_HOTPLUG_ID_LIMIT);
1072 
1073     /* Copy header and patch values in the S3_ / S4_ / S5_ packages */
1074     ssdt_ptr = acpi_data_push(table_data, sizeof(ssdp_misc_aml));
1075     memcpy(ssdt_ptr, ssdp_misc_aml, sizeof(ssdp_misc_aml));
1076     if (pm->s3_disabled) {
1077         ssdt_ptr[acpi_s3_name[0]] = 'X';
1078     }
1079     if (pm->s4_disabled) {
1080         ssdt_ptr[acpi_s4_name[0]] = 'X';
1081     } else {
1082         ssdt_ptr[acpi_s4_pkg[0] + 1] = ssdt_ptr[acpi_s4_pkg[0] + 3] =
1083             pm->s4_val;
1084     }
1085 
1086     patch_pci_windows(pci, ssdt_ptr, sizeof(ssdp_misc_aml));
1087 
1088     ACPI_BUILD_SET_LE(ssdt_ptr, sizeof(ssdp_misc_aml),
1089                       ssdt_isa_pest[0], 16, misc->pvpanic_port);
1090 
1091     ACPI_BUILD_SET_LE(ssdt_ptr, sizeof(ssdp_misc_aml),
1092                       ssdt_mctrl_nr_slots[0], 32, nr_mem);
1093 
1094     {
1095         GArray *sb_scope = build_alloc_array();
1096         uint8_t op = 0x10; /* ScopeOp */
1097 
1098         build_append_nameseg(sb_scope, "_SB_");
1099 
1100         /* build Processor object for each processor */
1101         for (i = 0; i < acpi_cpus; i++) {
1102             uint8_t *proc = acpi_data_push(sb_scope, ACPI_PROC_SIZEOF);
1103             memcpy(proc, ACPI_PROC_AML, ACPI_PROC_SIZEOF);
1104             proc[ACPI_PROC_OFFSET_CPUHEX] = acpi_get_hex(i >> 4);
1105             proc[ACPI_PROC_OFFSET_CPUHEX+1] = acpi_get_hex(i);
1106             proc[ACPI_PROC_OFFSET_CPUID1] = i;
1107             proc[ACPI_PROC_OFFSET_CPUID2] = i;
1108         }
1109 
1110         /* build this code:
1111          *   Method(NTFY, 2) {If (LEqual(Arg0, 0x00)) {Notify(CP00, Arg1)} ...}
1112          */
1113         /* Arg0 = Processor ID = APIC ID */
1114         build_append_notify_method(sb_scope, "NTFY", "CP%0.02X", acpi_cpus);
1115 
1116         /* build "Name(CPON, Package() { One, One, ..., Zero, Zero, ... })" */
1117         build_append_byte(sb_scope, 0x08); /* NameOp */
1118         build_append_nameseg(sb_scope, "CPON");
1119 
1120         {
1121             GArray *package = build_alloc_array();
1122             uint8_t op;
1123 
1124             /*
1125              * Note: The ability to create variable-sized packages was first introduced in ACPI 2.0. ACPI 1.0 only
1126              * allowed fixed-size packages with up to 255 elements.
1127              * Windows guests up to win2k8 fail when VarPackageOp is used.
1128              */
1129             if (acpi_cpus <= 255) {
1130                 op = 0x12; /* PackageOp */
1131                 build_append_byte(package, acpi_cpus); /* NumElements */
1132             } else {
1133                 op = 0x13; /* VarPackageOp */
1134                 build_append_int(package, acpi_cpus); /* VarNumElements */
1135             }
1136 
1137             for (i = 0; i < acpi_cpus; i++) {
1138                 uint8_t b = test_bit(i, cpu->found_cpus) ? 0x01 : 0x00;
1139                 build_append_byte(package, b);
1140             }
1141 
1142             build_package(package, op, 2);
1143             build_append_array(sb_scope, package);
1144             build_free_array(package);
1145         }
1146 
1147         if (nr_mem) {
1148             assert(nr_mem <= ACPI_MAX_RAM_SLOTS);
1149             /* build memory devices */
1150             for (i = 0; i < nr_mem; i++) {
1151                 char id[3];
1152                 uint8_t *mem = acpi_data_push(sb_scope, ACPI_MEM_SIZEOF);
1153 
1154                 snprintf(id, sizeof(id), "%02X", i);
1155                 memcpy(mem, ACPI_MEM_AML, ACPI_MEM_SIZEOF);
1156                 memcpy(mem + ACPI_MEM_OFFSET_HEX, id, 2);
1157                 memcpy(mem + ACPI_MEM_OFFSET_ID, id, 2);
1158             }
1159 
1160             /* build Method(MEMORY_SLOT_NOTIFY_METHOD, 2) {
1161              *     If (LEqual(Arg0, 0x00)) {Notify(MP00, Arg1)} ...
1162              */
1163             build_append_notify_method(sb_scope,
1164                                        stringify(MEMORY_SLOT_NOTIFY_METHOD),
1165                                        "MP%0.02X", nr_mem);
1166         }
1167 
1168         {
1169             AcpiBuildPciBusHotplugState hotplug_state;
1170             Object *pci_host;
1171             PCIBus *bus = NULL;
1172             bool ambiguous;
1173 
1174             pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
1175             if (!ambiguous && pci_host) {
1176                 bus = PCI_HOST_BRIDGE(pci_host)->bus;
1177             }
1178 
1179             build_pci_bus_state_init(&hotplug_state, NULL, pm->pcihp_bridge_en);
1180 
1181             if (bus) {
1182                 /* Scan all PCI buses. Generate tables to support hotplug. */
1183                 pci_for_each_bus_depth_first(bus, build_pci_bus_begin,
1184                                              build_pci_bus_end, &hotplug_state);
1185             }
1186 
1187             build_append_array(sb_scope, hotplug_state.device_table);
1188             build_pci_bus_state_cleanup(&hotplug_state);
1189         }
1190 
1191         build_package(sb_scope, op, 3);
1192         build_append_array(table_data, sb_scope);
1193         build_free_array(sb_scope);
1194     }
1195 
1196     build_header(linker, table_data,
1197                  (void *)(table_data->data + ssdt_start),
1198                  "SSDT", table_data->len - ssdt_start, 1);
1199 }
1200 
1201 static void
1202 build_hpet(GArray *table_data, GArray *linker)
1203 {
1204     Acpi20Hpet *hpet;
1205 
1206     hpet = acpi_data_push(table_data, sizeof(*hpet));
1207     /* Note timer_block_id value must be kept in sync with value advertised by
1208      * emulated hpet
1209      */
1210     hpet->timer_block_id = cpu_to_le32(0x8086a201);
1211     hpet->addr.address = cpu_to_le64(HPET_BASE);
1212     build_header(linker, table_data,
1213                  (void *)hpet, "HPET", sizeof(*hpet), 1);
1214 }
1215 
1216 static void
1217 build_tpm_tcpa(GArray *table_data, GArray *linker)
1218 {
1219     Acpi20Tcpa *tcpa = acpi_data_push(table_data, sizeof *tcpa);
1220     /* the log area will come right after the TCPA table */
1221     uint64_t log_area_start_address = acpi_data_len(table_data);
1222 
1223     tcpa->platform_class = cpu_to_le16(TPM_TCPA_ACPI_CLASS_CLIENT);
1224     tcpa->log_area_minimum_length = cpu_to_le32(TPM_LOG_AREA_MINIMUM_SIZE);
1225     tcpa->log_area_start_address = cpu_to_le64(log_area_start_address);
1226 
1227     /* log area start address to be filled by Guest linker */
1228     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
1229                                    ACPI_BUILD_TABLE_FILE,
1230                                    table_data, &tcpa->log_area_start_address,
1231                                    sizeof(tcpa->log_area_start_address));
1232 
1233     build_header(linker, table_data,
1234                  (void *)tcpa, "TCPA", sizeof(*tcpa), 2);
1235 
1236     /* now only get the log area and with that modify table_data */
1237     acpi_data_push(table_data, TPM_LOG_AREA_MINIMUM_SIZE);
1238 }
1239 
1240 static void
1241 build_tpm_ssdt(GArray *table_data, GArray *linker)
1242 {
1243     void *tpm_ptr;
1244 
1245     tpm_ptr = acpi_data_push(table_data, sizeof(ssdt_tpm_aml));
1246     memcpy(tpm_ptr, ssdt_tpm_aml, sizeof(ssdt_tpm_aml));
1247 }
1248 
1249 typedef enum {
1250     MEM_AFFINITY_NOFLAGS      = 0,
1251     MEM_AFFINITY_ENABLED      = (1 << 0),
1252     MEM_AFFINITY_HOTPLUGGABLE = (1 << 1),
1253     MEM_AFFINITY_NON_VOLATILE = (1 << 2),
1254 } MemoryAffinityFlags;
1255 
1256 static void
1257 acpi_build_srat_memory(AcpiSratMemoryAffinity *numamem, uint64_t base,
1258                        uint64_t len, int node, MemoryAffinityFlags flags)
1259 {
1260     numamem->type = ACPI_SRAT_MEMORY;
1261     numamem->length = sizeof(*numamem);
1262     memset(numamem->proximity, 0, 4);
1263     numamem->proximity[0] = node;
1264     numamem->flags = cpu_to_le32(flags);
1265     numamem->base_addr = cpu_to_le64(base);
1266     numamem->range_length = cpu_to_le64(len);
1267 }
1268 
1269 static void
1270 build_srat(GArray *table_data, GArray *linker,
1271            AcpiCpuInfo *cpu, PcGuestInfo *guest_info)
1272 {
1273     AcpiSystemResourceAffinityTable *srat;
1274     AcpiSratProcessorAffinity *core;
1275     AcpiSratMemoryAffinity *numamem;
1276 
1277     int i;
1278     uint64_t curnode;
1279     int srat_start, numa_start, slots;
1280     uint64_t mem_len, mem_base, next_base;
1281     PCMachineState *pcms = PC_MACHINE(qdev_get_machine());
1282     ram_addr_t hotplugabble_address_space_size =
1283         object_property_get_int(OBJECT(pcms), PC_MACHINE_MEMHP_REGION_SIZE,
1284                                 NULL);
1285 
1286     srat_start = table_data->len;
1287 
1288     srat = acpi_data_push(table_data, sizeof *srat);
1289     srat->reserved1 = cpu_to_le32(1);
1290     core = (void *)(srat + 1);
1291 
1292     for (i = 0; i < guest_info->apic_id_limit; ++i) {
1293         core = acpi_data_push(table_data, sizeof *core);
1294         core->type = ACPI_SRAT_PROCESSOR;
1295         core->length = sizeof(*core);
1296         core->local_apic_id = i;
1297         curnode = guest_info->node_cpu[i];
1298         core->proximity_lo = curnode;
1299         memset(core->proximity_hi, 0, 3);
1300         core->local_sapic_eid = 0;
1301         if (test_bit(i, cpu->found_cpus)) {
1302             core->flags = cpu_to_le32(1);
1303         } else {
1304             core->flags = cpu_to_le32(0);
1305         }
1306     }
1307 
1308 
1309     /* the memory map is a bit tricky, it contains at least one hole
1310      * from 640k-1M and possibly another one from 3.5G-4G.
1311      */
1312     next_base = 0;
1313     numa_start = table_data->len;
1314 
1315     numamem = acpi_data_push(table_data, sizeof *numamem);
1316     acpi_build_srat_memory(numamem, 0, 640*1024, 0, MEM_AFFINITY_ENABLED);
1317     next_base = 1024 * 1024;
1318     for (i = 1; i < guest_info->numa_nodes + 1; ++i) {
1319         mem_base = next_base;
1320         mem_len = guest_info->node_mem[i - 1];
1321         if (i == 1) {
1322             mem_len -= 1024 * 1024;
1323         }
1324         next_base = mem_base + mem_len;
1325 
1326         /* Cut out the ACPI_PCI hole */
1327         if (mem_base <= guest_info->ram_size_below_4g &&
1328             next_base > guest_info->ram_size_below_4g) {
1329             mem_len -= next_base - guest_info->ram_size_below_4g;
1330             if (mem_len > 0) {
1331                 numamem = acpi_data_push(table_data, sizeof *numamem);
1332                 acpi_build_srat_memory(numamem, mem_base, mem_len, i - 1,
1333                                        MEM_AFFINITY_ENABLED);
1334             }
1335             mem_base = 1ULL << 32;
1336             mem_len = next_base - guest_info->ram_size_below_4g;
1337             next_base += (1ULL << 32) - guest_info->ram_size_below_4g;
1338         }
1339         numamem = acpi_data_push(table_data, sizeof *numamem);
1340         acpi_build_srat_memory(numamem, mem_base, mem_len, i - 1,
1341                                MEM_AFFINITY_ENABLED);
1342     }
1343     slots = (table_data->len - numa_start) / sizeof *numamem;
1344     for (; slots < guest_info->numa_nodes + 2; slots++) {
1345         numamem = acpi_data_push(table_data, sizeof *numamem);
1346         acpi_build_srat_memory(numamem, 0, 0, 0, MEM_AFFINITY_NOFLAGS);
1347     }
1348 
1349     /*
1350      * Entry is required for Windows to enable memory hotplug in OS.
1351      * Memory devices may override proximity set by this entry,
1352      * providing _PXM method if necessary.
1353      */
1354     if (hotplugabble_address_space_size) {
1355         numamem = acpi_data_push(table_data, sizeof *numamem);
1356         acpi_build_srat_memory(numamem, pcms->hotplug_memory_base,
1357                                hotplugabble_address_space_size, 0,
1358                                MEM_AFFINITY_HOTPLUGGABLE |
1359                                MEM_AFFINITY_ENABLED);
1360     }
1361 
1362     build_header(linker, table_data,
1363                  (void *)(table_data->data + srat_start),
1364                  "SRAT",
1365                  table_data->len - srat_start, 1);
1366 }
1367 
1368 static void
1369 build_mcfg_q35(GArray *table_data, GArray *linker, AcpiMcfgInfo *info)
1370 {
1371     AcpiTableMcfg *mcfg;
1372     const char *sig;
1373     int len = sizeof(*mcfg) + 1 * sizeof(mcfg->allocation[0]);
1374 
1375     mcfg = acpi_data_push(table_data, len);
1376     mcfg->allocation[0].address = cpu_to_le64(info->mcfg_base);
1377     /* Only a single allocation so no need to play with segments */
1378     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
1379     mcfg->allocation[0].start_bus_number = 0;
1380     mcfg->allocation[0].end_bus_number = PCIE_MMCFG_BUS(info->mcfg_size - 1);
1381 
1382     /* MCFG is used for ECAM which can be enabled or disabled by guest.
1383      * To avoid table size changes (which create migration issues),
1384      * always create the table even if there are no allocations,
1385      * but set the signature to a reserved value in this case.
1386      * ACPI spec requires OSPMs to ignore such tables.
1387      */
1388     if (info->mcfg_base == PCIE_BASE_ADDR_UNMAPPED) {
1389         /* Reserved signature: ignored by OSPM */
1390         sig = "QEMU";
1391     } else {
1392         sig = "MCFG";
1393     }
1394     build_header(linker, table_data, (void *)mcfg, sig, len, 1);
1395 }
1396 
1397 static void
1398 build_dmar_q35(GArray *table_data, GArray *linker)
1399 {
1400     int dmar_start = table_data->len;
1401 
1402     AcpiTableDmar *dmar;
1403     AcpiDmarHardwareUnit *drhd;
1404 
1405     dmar = acpi_data_push(table_data, sizeof(*dmar));
1406     dmar->host_address_width = VTD_HOST_ADDRESS_WIDTH - 1;
1407     dmar->flags = 0;    /* No intr_remap for now */
1408 
1409     /* DMAR Remapping Hardware Unit Definition structure */
1410     drhd = acpi_data_push(table_data, sizeof(*drhd));
1411     drhd->type = cpu_to_le16(ACPI_DMAR_TYPE_HARDWARE_UNIT);
1412     drhd->length = cpu_to_le16(sizeof(*drhd));   /* No device scope now */
1413     drhd->flags = ACPI_DMAR_INCLUDE_PCI_ALL;
1414     drhd->pci_segment = cpu_to_le16(0);
1415     drhd->address = cpu_to_le64(Q35_HOST_BRIDGE_IOMMU_ADDR);
1416 
1417     build_header(linker, table_data, (void *)(table_data->data + dmar_start),
1418                  "DMAR", table_data->len - dmar_start, 1);
1419 }
1420 
1421 static void
1422 build_dsdt(GArray *table_data, GArray *linker, AcpiMiscInfo *misc)
1423 {
1424     AcpiTableHeader *dsdt;
1425 
1426     assert(misc->dsdt_code && misc->dsdt_size);
1427 
1428     dsdt = acpi_data_push(table_data, misc->dsdt_size);
1429     memcpy(dsdt, misc->dsdt_code, misc->dsdt_size);
1430 
1431     memset(dsdt, 0, sizeof *dsdt);
1432     build_header(linker, table_data, dsdt, "DSDT",
1433                  misc->dsdt_size, 1);
1434 }
1435 
1436 /* Build final rsdt table */
1437 static void
1438 build_rsdt(GArray *table_data, GArray *linker, GArray *table_offsets)
1439 {
1440     AcpiRsdtDescriptorRev1 *rsdt;
1441     size_t rsdt_len;
1442     int i;
1443 
1444     rsdt_len = sizeof(*rsdt) + sizeof(uint32_t) * table_offsets->len;
1445     rsdt = acpi_data_push(table_data, rsdt_len);
1446     memcpy(rsdt->table_offset_entry, table_offsets->data,
1447            sizeof(uint32_t) * table_offsets->len);
1448     for (i = 0; i < table_offsets->len; ++i) {
1449         /* rsdt->table_offset_entry to be filled by Guest linker */
1450         bios_linker_loader_add_pointer(linker,
1451                                        ACPI_BUILD_TABLE_FILE,
1452                                        ACPI_BUILD_TABLE_FILE,
1453                                        table_data, &rsdt->table_offset_entry[i],
1454                                        sizeof(uint32_t));
1455     }
1456     build_header(linker, table_data,
1457                  (void *)rsdt, "RSDT", rsdt_len, 1);
1458 }
1459 
1460 static GArray *
1461 build_rsdp(GArray *rsdp_table, GArray *linker, unsigned rsdt)
1462 {
1463     AcpiRsdpDescriptor *rsdp = acpi_data_push(rsdp_table, sizeof *rsdp);
1464 
1465     bios_linker_loader_alloc(linker, ACPI_BUILD_RSDP_FILE, 16,
1466                              true /* fseg memory */);
1467 
1468     memcpy(&rsdp->signature, "RSD PTR ", 8);
1469     memcpy(rsdp->oem_id, ACPI_BUILD_APPNAME6, 6);
1470     rsdp->rsdt_physical_address = cpu_to_le32(rsdt);
1471     /* Address to be filled by Guest linker */
1472     bios_linker_loader_add_pointer(linker, ACPI_BUILD_RSDP_FILE,
1473                                    ACPI_BUILD_TABLE_FILE,
1474                                    rsdp_table, &rsdp->rsdt_physical_address,
1475                                    sizeof rsdp->rsdt_physical_address);
1476     rsdp->checksum = 0;
1477     /* Checksum to be filled by Guest linker */
1478     bios_linker_loader_add_checksum(linker, ACPI_BUILD_RSDP_FILE,
1479                                     rsdp, rsdp, sizeof *rsdp, &rsdp->checksum);
1480 
1481     return rsdp_table;
1482 }
1483 
1484 typedef
1485 struct AcpiBuildTables {
1486     GArray *table_data;
1487     GArray *rsdp;
1488     GArray *linker;
1489 } AcpiBuildTables;
1490 
1491 static inline void acpi_build_tables_init(AcpiBuildTables *tables)
1492 {
1493     tables->rsdp = g_array_new(false, true /* clear */, 1);
1494     tables->table_data = g_array_new(false, true /* clear */, 1);
1495     tables->linker = bios_linker_loader_init();
1496 }
1497 
1498 static inline void acpi_build_tables_cleanup(AcpiBuildTables *tables, bool mfre)
1499 {
1500     void *linker_data = bios_linker_loader_cleanup(tables->linker);
1501     if (mfre) {
1502         g_free(linker_data);
1503     }
1504     g_array_free(tables->rsdp, mfre);
1505     g_array_free(tables->table_data, mfre);
1506 }
1507 
1508 typedef
1509 struct AcpiBuildState {
1510     /* Copy of table in RAM (for patching). */
1511     uint8_t *table_ram;
1512     uint32_t table_size;
1513     /* Is table patched? */
1514     uint8_t patched;
1515     PcGuestInfo *guest_info;
1516 } AcpiBuildState;
1517 
1518 static bool acpi_get_mcfg(AcpiMcfgInfo *mcfg)
1519 {
1520     Object *pci_host;
1521     QObject *o;
1522     bool ambiguous;
1523 
1524     pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
1525     g_assert(!ambiguous);
1526     g_assert(pci_host);
1527 
1528     o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_BASE, NULL);
1529     if (!o) {
1530         return false;
1531     }
1532     mcfg->mcfg_base = qint_get_int(qobject_to_qint(o));
1533     qobject_decref(o);
1534 
1535     o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_SIZE, NULL);
1536     assert(o);
1537     mcfg->mcfg_size = qint_get_int(qobject_to_qint(o));
1538     qobject_decref(o);
1539     return true;
1540 }
1541 
1542 static bool acpi_has_iommu(void)
1543 {
1544     bool ambiguous;
1545     Object *intel_iommu;
1546 
1547     intel_iommu = object_resolve_path_type("", TYPE_INTEL_IOMMU_DEVICE,
1548                                            &ambiguous);
1549     return intel_iommu && !ambiguous;
1550 }
1551 
1552 static
1553 void acpi_build(PcGuestInfo *guest_info, AcpiBuildTables *tables)
1554 {
1555     GArray *table_offsets;
1556     unsigned facs, ssdt, dsdt, rsdt;
1557     AcpiCpuInfo cpu;
1558     AcpiPmInfo pm;
1559     AcpiMiscInfo misc;
1560     AcpiMcfgInfo mcfg;
1561     PcPciInfo pci;
1562     uint8_t *u;
1563     size_t aml_len = 0;
1564 
1565     acpi_get_cpu_info(&cpu);
1566     acpi_get_pm_info(&pm);
1567     acpi_get_dsdt(&misc);
1568     acpi_get_misc_info(&misc);
1569     acpi_get_pci_info(&pci);
1570 
1571     table_offsets = g_array_new(false, true /* clear */,
1572                                         sizeof(uint32_t));
1573     ACPI_BUILD_DPRINTF(3, "init ACPI tables\n");
1574 
1575     bios_linker_loader_alloc(tables->linker, ACPI_BUILD_TABLE_FILE,
1576                              64 /* Ensure FACS is aligned */,
1577                              false /* high memory */);
1578 
1579     /*
1580      * FACS is pointed to by FADT.
1581      * We place it first since it's the only table that has alignment
1582      * requirements.
1583      */
1584     facs = tables->table_data->len;
1585     build_facs(tables->table_data, tables->linker, guest_info);
1586 
1587     /* DSDT is pointed to by FADT */
1588     dsdt = tables->table_data->len;
1589     build_dsdt(tables->table_data, tables->linker, &misc);
1590 
1591     /* Count the size of the DSDT and SSDT, we will need it for legacy
1592      * sizing of ACPI tables.
1593      */
1594     aml_len += tables->table_data->len - dsdt;
1595 
1596     /* ACPI tables pointed to by RSDT */
1597     acpi_add_table(table_offsets, tables->table_data);
1598     build_fadt(tables->table_data, tables->linker, &pm, facs, dsdt);
1599 
1600     ssdt = tables->table_data->len;
1601     acpi_add_table(table_offsets, tables->table_data);
1602     build_ssdt(tables->table_data, tables->linker, &cpu, &pm, &misc, &pci,
1603                guest_info);
1604     aml_len += tables->table_data->len - ssdt;
1605 
1606     acpi_add_table(table_offsets, tables->table_data);
1607     build_madt(tables->table_data, tables->linker, &cpu, guest_info);
1608 
1609     if (misc.has_hpet) {
1610         acpi_add_table(table_offsets, tables->table_data);
1611         build_hpet(tables->table_data, tables->linker);
1612     }
1613     if (misc.has_tpm) {
1614         acpi_add_table(table_offsets, tables->table_data);
1615         build_tpm_tcpa(tables->table_data, tables->linker);
1616 
1617         acpi_add_table(table_offsets, tables->table_data);
1618         build_tpm_ssdt(tables->table_data, tables->linker);
1619     }
1620     if (guest_info->numa_nodes) {
1621         acpi_add_table(table_offsets, tables->table_data);
1622         build_srat(tables->table_data, tables->linker, &cpu, guest_info);
1623     }
1624     if (acpi_get_mcfg(&mcfg)) {
1625         acpi_add_table(table_offsets, tables->table_data);
1626         build_mcfg_q35(tables->table_data, tables->linker, &mcfg);
1627     }
1628     if (acpi_has_iommu()) {
1629         acpi_add_table(table_offsets, tables->table_data);
1630         build_dmar_q35(tables->table_data, tables->linker);
1631     }
1632 
1633     /* Add tables supplied by user (if any) */
1634     for (u = acpi_table_first(); u; u = acpi_table_next(u)) {
1635         unsigned len = acpi_table_len(u);
1636 
1637         acpi_add_table(table_offsets, tables->table_data);
1638         g_array_append_vals(tables->table_data, u, len);
1639     }
1640 
1641     /* RSDT is pointed to by RSDP */
1642     rsdt = tables->table_data->len;
1643     build_rsdt(tables->table_data, tables->linker, table_offsets);
1644 
1645     /* RSDP is in FSEG memory, so allocate it separately */
1646     build_rsdp(tables->rsdp, tables->linker, rsdt);
1647 
1648     /* We'll expose it all to Guest so we want to reduce
1649      * chance of size changes.
1650      * RSDP is small so it's easy to keep it immutable, no need to
1651      * bother with alignment.
1652      *
1653      * We used to align the tables to 4k, but of course this would
1654      * too simple to be enough.  4k turned out to be too small an
1655      * alignment very soon, and in fact it is almost impossible to
1656      * keep the table size stable for all (max_cpus, max_memory_slots)
1657      * combinations.  So the table size is always 64k for pc-i440fx-2.1
1658      * and we give an error if the table grows beyond that limit.
1659      *
1660      * We still have the problem of migrating from "-M pc-i440fx-2.0".  For
1661      * that, we exploit the fact that QEMU 2.1 generates _smaller_ tables
1662      * than 2.0 and we can always pad the smaller tables with zeros.  We can
1663      * then use the exact size of the 2.0 tables.
1664      *
1665      * All this is for PIIX4, since QEMU 2.0 didn't support Q35 migration.
1666      */
1667     if (guest_info->legacy_acpi_table_size) {
1668         /* Subtracting aml_len gives the size of fixed tables.  Then add the
1669          * size of the PIIX4 DSDT/SSDT in QEMU 2.0.
1670          */
1671         int legacy_aml_len =
1672             guest_info->legacy_acpi_table_size +
1673             ACPI_BUILD_LEGACY_CPU_AML_SIZE * max_cpus;
1674         int legacy_table_size =
1675             ROUND_UP(tables->table_data->len - aml_len + legacy_aml_len,
1676                      ACPI_BUILD_ALIGN_SIZE);
1677         if (tables->table_data->len > legacy_table_size) {
1678             /* Should happen only with PCI bridges and -M pc-i440fx-2.0.  */
1679             error_report("Warning: migration may not work.");
1680         }
1681         g_array_set_size(tables->table_data, legacy_table_size);
1682     } else {
1683         /* Make sure we have a buffer in case we need to resize the tables. */
1684         if (tables->table_data->len > ACPI_BUILD_TABLE_SIZE / 2) {
1685             /* As of QEMU 2.1, this fires with 160 VCPUs and 255 memory slots.  */
1686             error_report("Warning: ACPI tables are larger than 64k.");
1687             error_report("Warning: migration may not work.");
1688             error_report("Warning: please remove CPUs, NUMA nodes, "
1689                          "memory slots or PCI bridges.");
1690         }
1691         acpi_align_size(tables->table_data, ACPI_BUILD_TABLE_SIZE);
1692     }
1693 
1694     acpi_align_size(tables->linker, ACPI_BUILD_ALIGN_SIZE);
1695 
1696     /* Cleanup memory that's no longer used. */
1697     g_array_free(table_offsets, true);
1698 }
1699 
1700 static void acpi_build_update(void *build_opaque, uint32_t offset)
1701 {
1702     AcpiBuildState *build_state = build_opaque;
1703     AcpiBuildTables tables;
1704 
1705     /* No state to update or already patched? Nothing to do. */
1706     if (!build_state || build_state->patched) {
1707         return;
1708     }
1709     build_state->patched = 1;
1710 
1711     acpi_build_tables_init(&tables);
1712 
1713     acpi_build(build_state->guest_info, &tables);
1714 
1715     assert(acpi_data_len(tables.table_data) == build_state->table_size);
1716     memcpy(build_state->table_ram, tables.table_data->data,
1717            build_state->table_size);
1718 
1719     acpi_build_tables_cleanup(&tables, true);
1720 }
1721 
1722 static void acpi_build_reset(void *build_opaque)
1723 {
1724     AcpiBuildState *build_state = build_opaque;
1725     build_state->patched = 0;
1726 }
1727 
1728 static void *acpi_add_rom_blob(AcpiBuildState *build_state, GArray *blob,
1729                                const char *name)
1730 {
1731     return rom_add_blob(name, blob->data, acpi_data_len(blob), -1, name,
1732                         acpi_build_update, build_state);
1733 }
1734 
1735 static const VMStateDescription vmstate_acpi_build = {
1736     .name = "acpi_build",
1737     .version_id = 1,
1738     .minimum_version_id = 1,
1739     .fields = (VMStateField[]) {
1740         VMSTATE_UINT8(patched, AcpiBuildState),
1741         VMSTATE_END_OF_LIST()
1742     },
1743 };
1744 
1745 void acpi_setup(PcGuestInfo *guest_info)
1746 {
1747     AcpiBuildTables tables;
1748     AcpiBuildState *build_state;
1749 
1750     if (!guest_info->fw_cfg) {
1751         ACPI_BUILD_DPRINTF(3, "No fw cfg. Bailing out.\n");
1752         return;
1753     }
1754 
1755     if (!guest_info->has_acpi_build) {
1756         ACPI_BUILD_DPRINTF(3, "ACPI build disabled. Bailing out.\n");
1757         return;
1758     }
1759 
1760     if (!acpi_enabled) {
1761         ACPI_BUILD_DPRINTF(3, "ACPI disabled. Bailing out.\n");
1762         return;
1763     }
1764 
1765     build_state = g_malloc0(sizeof *build_state);
1766 
1767     build_state->guest_info = guest_info;
1768 
1769     acpi_set_pci_info();
1770 
1771     acpi_build_tables_init(&tables);
1772     acpi_build(build_state->guest_info, &tables);
1773 
1774     /* Now expose it all to Guest */
1775     build_state->table_ram = acpi_add_rom_blob(build_state, tables.table_data,
1776                                                ACPI_BUILD_TABLE_FILE);
1777     build_state->table_size = acpi_data_len(tables.table_data);
1778 
1779     acpi_add_rom_blob(NULL, tables.linker, "etc/table-loader");
1780 
1781     /*
1782      * RSDP is small so it's easy to keep it immutable, no need to
1783      * bother with ROM blobs.
1784      */
1785     fw_cfg_add_file(guest_info->fw_cfg, ACPI_BUILD_RSDP_FILE,
1786                     tables.rsdp->data, acpi_data_len(tables.rsdp));
1787 
1788     qemu_register_reset(acpi_build_reset, build_state);
1789     acpi_build_reset(build_state);
1790     vmstate_register(NULL, 0, &vmstate_acpi_build, build_state);
1791 
1792     /* Cleanup tables but don't free the memory: we track it
1793      * in build_state.
1794      */
1795     acpi_build_tables_cleanup(&tables, false);
1796 }
1797