xref: /openbmc/qemu/hw/i386/acpi-build.c (revision 4a66d3bf)
1 /* Support for generating ACPI tables and passing them to Guests
2  *
3  * Copyright (C) 2008-2010  Kevin O'Connor <kevin@koconnor.net>
4  * Copyright (C) 2006 Fabrice Bellard
5  * Copyright (C) 2013 Red Hat Inc
6  *
7  * Author: Michael S. Tsirkin <mst@redhat.com>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License as published by
11  * the Free Software Foundation; either version 2 of the License, or
12  * (at your option) any later version.
13 
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU General Public License for more details.
18 
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, see <http://www.gnu.org/licenses/>.
21  */
22 
23 #include "acpi-build.h"
24 #include <stddef.h>
25 #include <glib.h>
26 #include "qemu-common.h"
27 #include "qemu/bitmap.h"
28 #include "qemu/range.h"
29 #include "hw/pci/pci.h"
30 #include "qom/cpu.h"
31 #include "hw/i386/pc.h"
32 #include "target-i386/cpu.h"
33 #include "hw/timer/hpet.h"
34 #include "hw/i386/acpi-defs.h"
35 #include "hw/acpi/acpi.h"
36 #include "hw/nvram/fw_cfg.h"
37 #include "bios-linker-loader.h"
38 #include "hw/loader.h"
39 #include "hw/isa/isa.h"
40 
41 /* Supported chipsets: */
42 #include "hw/acpi/piix4.h"
43 #include "hw/acpi/pcihp.h"
44 #include "hw/i386/ich9.h"
45 #include "hw/pci/pci_bus.h"
46 #include "hw/pci-host/q35.h"
47 
48 #include "hw/i386/q35-acpi-dsdt.hex"
49 #include "hw/i386/acpi-dsdt.hex"
50 
51 #include "qapi/qmp/qint.h"
52 #include "qom/qom-qobject.h"
53 
54 typedef struct AcpiCpuInfo {
55     DECLARE_BITMAP(found_cpus, ACPI_CPU_HOTPLUG_ID_LIMIT);
56 } AcpiCpuInfo;
57 
58 typedef struct AcpiMcfgInfo {
59     uint64_t mcfg_base;
60     uint32_t mcfg_size;
61 } AcpiMcfgInfo;
62 
63 typedef struct AcpiPmInfo {
64     bool s3_disabled;
65     bool s4_disabled;
66     uint8_t s4_val;
67     uint16_t sci_int;
68     uint8_t acpi_enable_cmd;
69     uint8_t acpi_disable_cmd;
70     uint32_t gpe0_blk;
71     uint32_t gpe0_blk_len;
72     uint32_t io_base;
73 } AcpiPmInfo;
74 
75 typedef struct AcpiMiscInfo {
76     bool has_hpet;
77     DECLARE_BITMAP(slot_hotplug_enable, PCI_SLOT_MAX);
78     const unsigned char *dsdt_code;
79     unsigned dsdt_size;
80     uint16_t pvpanic_port;
81 } AcpiMiscInfo;
82 
83 typedef struct AcpiBuildPciBusHotplugState {
84     GArray *device_table;
85     GArray *notify_table;
86     struct AcpiBuildPciBusHotplugState *parent;
87 } AcpiBuildPciBusHotplugState;
88 
89 static void acpi_get_dsdt(AcpiMiscInfo *info)
90 {
91     uint16_t *applesmc_sta;
92     Object *piix = piix4_pm_find();
93     Object *lpc = ich9_lpc_find();
94     assert(!!piix != !!lpc);
95 
96     if (piix) {
97         info->dsdt_code = AcpiDsdtAmlCode;
98         info->dsdt_size = sizeof AcpiDsdtAmlCode;
99         applesmc_sta = piix_dsdt_applesmc_sta;
100     }
101     if (lpc) {
102         info->dsdt_code = Q35AcpiDsdtAmlCode;
103         info->dsdt_size = sizeof Q35AcpiDsdtAmlCode;
104         applesmc_sta = q35_dsdt_applesmc_sta;
105     }
106 
107     /* Patch in appropriate value for AppleSMC _STA */
108     *(uint8_t *)(info->dsdt_code + *applesmc_sta) =
109         applesmc_find() ? 0x0b : 0x00;
110 }
111 
112 static
113 int acpi_add_cpu_info(Object *o, void *opaque)
114 {
115     AcpiCpuInfo *cpu = opaque;
116     uint64_t apic_id;
117 
118     if (object_dynamic_cast(o, TYPE_CPU)) {
119         apic_id = object_property_get_int(o, "apic-id", NULL);
120         assert(apic_id < ACPI_CPU_HOTPLUG_ID_LIMIT);
121 
122         set_bit(apic_id, cpu->found_cpus);
123     }
124 
125     object_child_foreach(o, acpi_add_cpu_info, opaque);
126     return 0;
127 }
128 
129 static void acpi_get_cpu_info(AcpiCpuInfo *cpu)
130 {
131     Object *root = object_get_root();
132 
133     memset(cpu->found_cpus, 0, sizeof cpu->found_cpus);
134     object_child_foreach(root, acpi_add_cpu_info, cpu);
135 }
136 
137 static void acpi_get_pm_info(AcpiPmInfo *pm)
138 {
139     Object *piix = piix4_pm_find();
140     Object *lpc = ich9_lpc_find();
141     Object *obj = NULL;
142     QObject *o;
143 
144     if (piix) {
145         obj = piix;
146     }
147     if (lpc) {
148         obj = lpc;
149     }
150     assert(obj);
151 
152     /* Fill in optional s3/s4 related properties */
153     o = object_property_get_qobject(obj, ACPI_PM_PROP_S3_DISABLED, NULL);
154     if (o) {
155         pm->s3_disabled = qint_get_int(qobject_to_qint(o));
156     } else {
157         pm->s3_disabled = false;
158     }
159     o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_DISABLED, NULL);
160     if (o) {
161         pm->s4_disabled = qint_get_int(qobject_to_qint(o));
162     } else {
163         pm->s4_disabled = false;
164     }
165     o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_VAL, NULL);
166     if (o) {
167         pm->s4_val = qint_get_int(qobject_to_qint(o));
168     } else {
169         pm->s4_val = false;
170     }
171 
172     /* Fill in mandatory properties */
173     pm->sci_int = object_property_get_int(obj, ACPI_PM_PROP_SCI_INT, NULL);
174 
175     pm->acpi_enable_cmd = object_property_get_int(obj,
176                                                   ACPI_PM_PROP_ACPI_ENABLE_CMD,
177                                                   NULL);
178     pm->acpi_disable_cmd = object_property_get_int(obj,
179                                                   ACPI_PM_PROP_ACPI_DISABLE_CMD,
180                                                   NULL);
181     pm->io_base = object_property_get_int(obj, ACPI_PM_PROP_PM_IO_BASE,
182                                           NULL);
183     pm->gpe0_blk = object_property_get_int(obj, ACPI_PM_PROP_GPE0_BLK,
184                                            NULL);
185     pm->gpe0_blk_len = object_property_get_int(obj, ACPI_PM_PROP_GPE0_BLK_LEN,
186                                                NULL);
187 }
188 
189 static void acpi_get_misc_info(AcpiMiscInfo *info)
190 {
191     info->has_hpet = hpet_find();
192     info->pvpanic_port = pvpanic_port();
193 }
194 
195 static void acpi_get_pci_info(PcPciInfo *info)
196 {
197     Object *pci_host;
198     bool ambiguous;
199 
200     pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
201     g_assert(!ambiguous);
202     g_assert(pci_host);
203 
204     info->w32.begin = object_property_get_int(pci_host,
205                                               PCI_HOST_PROP_PCI_HOLE_START,
206                                               NULL);
207     info->w32.end = object_property_get_int(pci_host,
208                                             PCI_HOST_PROP_PCI_HOLE_END,
209                                             NULL);
210     info->w64.begin = object_property_get_int(pci_host,
211                                               PCI_HOST_PROP_PCI_HOLE64_START,
212                                               NULL);
213     info->w64.end = object_property_get_int(pci_host,
214                                             PCI_HOST_PROP_PCI_HOLE64_END,
215                                             NULL);
216 }
217 
218 #define ACPI_BUILD_APPNAME  "Bochs"
219 #define ACPI_BUILD_APPNAME6 "BOCHS "
220 #define ACPI_BUILD_APPNAME4 "BXPC"
221 
222 #define ACPI_BUILD_DPRINTF(level, fmt, ...) do {} while (0)
223 
224 #define ACPI_BUILD_TABLE_FILE "etc/acpi/tables"
225 #define ACPI_BUILD_RSDP_FILE "etc/acpi/rsdp"
226 
227 static void
228 build_header(GArray *linker, GArray *table_data,
229              AcpiTableHeader *h, const char *sig, int len, uint8_t rev)
230 {
231     memcpy(&h->signature, sig, 4);
232     h->length = cpu_to_le32(len);
233     h->revision = rev;
234     memcpy(h->oem_id, ACPI_BUILD_APPNAME6, 6);
235     memcpy(h->oem_table_id, ACPI_BUILD_APPNAME4, 4);
236     memcpy(h->oem_table_id + 4, sig, 4);
237     h->oem_revision = cpu_to_le32(1);
238     memcpy(h->asl_compiler_id, ACPI_BUILD_APPNAME4, 4);
239     h->asl_compiler_revision = cpu_to_le32(1);
240     h->checksum = 0;
241     /* Checksum to be filled in by Guest linker */
242     bios_linker_loader_add_checksum(linker, ACPI_BUILD_TABLE_FILE,
243                                     table_data->data, h, len, &h->checksum);
244 }
245 
246 static inline GArray *build_alloc_array(void)
247 {
248         return g_array_new(false, true /* clear */, 1);
249 }
250 
251 static inline void build_free_array(GArray *array)
252 {
253         g_array_free(array, true);
254 }
255 
256 static inline void build_prepend_byte(GArray *array, uint8_t val)
257 {
258     g_array_prepend_val(array, val);
259 }
260 
261 static inline void build_append_byte(GArray *array, uint8_t val)
262 {
263     g_array_append_val(array, val);
264 }
265 
266 static inline void build_append_array(GArray *array, GArray *val)
267 {
268     g_array_append_vals(array, val->data, val->len);
269 }
270 
271 static void GCC_FMT_ATTR(2, 3)
272 build_append_nameseg(GArray *array, const char *format, ...)
273 {
274     /* It would be nicer to use g_string_vprintf but it's only there in 2.22 */
275     char s[] = "XXXX";
276     int len;
277     va_list args;
278 
279     va_start(args, format);
280     len = vsnprintf(s, sizeof s, format, args);
281     va_end(args);
282 
283     assert(len == 4);
284     g_array_append_vals(array, s, len);
285 }
286 
287 /* 5.4 Definition Block Encoding */
288 enum {
289     PACKAGE_LENGTH_1BYTE_SHIFT = 6, /* Up to 63 - use extra 2 bits. */
290     PACKAGE_LENGTH_2BYTE_SHIFT = 4,
291     PACKAGE_LENGTH_3BYTE_SHIFT = 12,
292     PACKAGE_LENGTH_4BYTE_SHIFT = 20,
293 };
294 
295 static void build_prepend_package_length(GArray *package, unsigned min_bytes)
296 {
297     uint8_t byte;
298     unsigned length = package->len;
299     unsigned length_bytes;
300 
301     if (length + 1 < (1 << PACKAGE_LENGTH_1BYTE_SHIFT)) {
302         length_bytes = 1;
303     } else if (length + 2 < (1 << PACKAGE_LENGTH_3BYTE_SHIFT)) {
304         length_bytes = 2;
305     } else if (length + 3 < (1 << PACKAGE_LENGTH_4BYTE_SHIFT)) {
306         length_bytes = 3;
307     } else {
308         length_bytes = 4;
309     }
310 
311     /* Force length to at least min_bytes.
312      * This wastes memory but that's how bios did it.
313      */
314     length_bytes = MAX(length_bytes, min_bytes);
315 
316     /* PkgLength is the length of the inclusive length of the data. */
317     length += length_bytes;
318 
319     switch (length_bytes) {
320     case 1:
321         byte = length;
322         build_prepend_byte(package, byte);
323         return;
324     case 4:
325         byte = length >> PACKAGE_LENGTH_4BYTE_SHIFT;
326         build_prepend_byte(package, byte);
327         length &= (1 << PACKAGE_LENGTH_4BYTE_SHIFT) - 1;
328         /* fall through */
329     case 3:
330         byte = length >> PACKAGE_LENGTH_3BYTE_SHIFT;
331         build_prepend_byte(package, byte);
332         length &= (1 << PACKAGE_LENGTH_3BYTE_SHIFT) - 1;
333         /* fall through */
334     case 2:
335         byte = length >> PACKAGE_LENGTH_2BYTE_SHIFT;
336         build_prepend_byte(package, byte);
337         length &= (1 << PACKAGE_LENGTH_2BYTE_SHIFT) - 1;
338         /* fall through */
339     }
340     /*
341      * Most significant two bits of byte zero indicate how many following bytes
342      * are in PkgLength encoding.
343      */
344     byte = ((length_bytes - 1) << PACKAGE_LENGTH_1BYTE_SHIFT) | length;
345     build_prepend_byte(package, byte);
346 }
347 
348 static void build_package(GArray *package, uint8_t op, unsigned min_bytes)
349 {
350     build_prepend_package_length(package, min_bytes);
351     build_prepend_byte(package, op);
352 }
353 
354 static void build_extop_package(GArray *package, uint8_t op)
355 {
356     build_package(package, op, 1);
357     build_prepend_byte(package, 0x5B); /* ExtOpPrefix */
358 }
359 
360 static void build_append_value(GArray *table, uint32_t value, int size)
361 {
362     uint8_t prefix;
363     int i;
364 
365     switch (size) {
366     case 1:
367         prefix = 0x0A; /* BytePrefix */
368         break;
369     case 2:
370         prefix = 0x0B; /* WordPrefix */
371         break;
372     case 4:
373         prefix = 0x0C; /* DWordPrefix */
374         break;
375     default:
376         assert(0);
377         return;
378     }
379     build_append_byte(table, prefix);
380     for (i = 0; i < size; ++i) {
381         build_append_byte(table, value & 0xFF);
382         value = value >> 8;
383     }
384 }
385 
386 static void build_append_int(GArray *table, uint32_t value)
387 {
388     if (value == 0x00) {
389         build_append_byte(table, 0x00); /* ZeroOp */
390     } else if (value == 0x01) {
391         build_append_byte(table, 0x01); /* OneOp */
392     } else if (value <= 0xFF) {
393         build_append_value(table, value, 1);
394     } else if (value <= 0xFFFF) {
395         build_append_value(table, value, 2);
396     } else {
397         build_append_value(table, value, 4);
398     }
399 }
400 
401 static GArray *build_alloc_method(const char *name, uint8_t arg_count)
402 {
403     GArray *method = build_alloc_array();
404 
405     build_append_nameseg(method, "%s", name);
406     build_append_byte(method, arg_count); /* MethodFlags: ArgCount */
407 
408     return method;
409 }
410 
411 static void build_append_and_cleanup_method(GArray *device, GArray *method)
412 {
413     uint8_t op = 0x14; /* MethodOp */
414 
415     build_package(method, op, 0);
416 
417     build_append_array(device, method);
418     build_free_array(method);
419 }
420 
421 static void build_append_notify_target_ifequal(GArray *method,
422                                                GArray *target_name,
423                                                uint32_t value, int size)
424 {
425     GArray *notify = build_alloc_array();
426     uint8_t op = 0xA0; /* IfOp */
427 
428     build_append_byte(notify, 0x93); /* LEqualOp */
429     build_append_byte(notify, 0x68); /* Arg0Op */
430     build_append_value(notify, value, size);
431     build_append_byte(notify, 0x86); /* NotifyOp */
432     build_append_array(notify, target_name);
433     build_append_byte(notify, 0x69); /* Arg1Op */
434 
435     /* Pack it up */
436     build_package(notify, op, 1);
437 
438     build_append_array(method, notify);
439 
440     build_free_array(notify);
441 }
442 
443 /* End here */
444 #define ACPI_PORT_SMI_CMD           0x00b2 /* TODO: this is APM_CNT_IOPORT */
445 
446 static inline void *acpi_data_push(GArray *table_data, unsigned size)
447 {
448     unsigned off = table_data->len;
449     g_array_set_size(table_data, off + size);
450     return table_data->data + off;
451 }
452 
453 static unsigned acpi_data_len(GArray *table)
454 {
455 #if GLIB_CHECK_VERSION(2, 22, 0)
456     assert(g_array_get_element_size(table) == 1);
457 #endif
458     return table->len;
459 }
460 
461 static void acpi_align_size(GArray *blob, unsigned align)
462 {
463     /* Align size to multiple of given size. This reduces the chance
464      * we need to change size in the future (breaking cross version migration).
465      */
466     g_array_set_size(blob, ROUND_UP(acpi_data_len(blob), align));
467 }
468 
469 /* Set a value within table in a safe manner */
470 #define ACPI_BUILD_SET_LE(table, size, off, bits, val) \
471     do { \
472         uint64_t ACPI_BUILD_SET_LE_val = cpu_to_le64(val); \
473         memcpy(acpi_data_get_ptr(table, size, off, \
474                                  (bits) / BITS_PER_BYTE), \
475                &ACPI_BUILD_SET_LE_val, \
476                (bits) / BITS_PER_BYTE); \
477     } while (0)
478 
479 static inline void *acpi_data_get_ptr(uint8_t *table_data, unsigned table_size,
480                                       unsigned off, unsigned size)
481 {
482     assert(off + size > off);
483     assert(off + size <= table_size);
484     return table_data + off;
485 }
486 
487 static inline void acpi_add_table(GArray *table_offsets, GArray *table_data)
488 {
489     uint32_t offset = cpu_to_le32(table_data->len);
490     g_array_append_val(table_offsets, offset);
491 }
492 
493 /* FACS */
494 static void
495 build_facs(GArray *table_data, GArray *linker, PcGuestInfo *guest_info)
496 {
497     AcpiFacsDescriptorRev1 *facs = acpi_data_push(table_data, sizeof *facs);
498     memcpy(&facs->signature, "FACS", 4);
499     facs->length = cpu_to_le32(sizeof(*facs));
500 }
501 
502 /* Load chipset information in FADT */
503 static void fadt_setup(AcpiFadtDescriptorRev1 *fadt, AcpiPmInfo *pm)
504 {
505     fadt->model = 1;
506     fadt->reserved1 = 0;
507     fadt->sci_int = cpu_to_le16(pm->sci_int);
508     fadt->smi_cmd = cpu_to_le32(ACPI_PORT_SMI_CMD);
509     fadt->acpi_enable = pm->acpi_enable_cmd;
510     fadt->acpi_disable = pm->acpi_disable_cmd;
511     /* EVT, CNT, TMR offset matches hw/acpi/core.c */
512     fadt->pm1a_evt_blk = cpu_to_le32(pm->io_base);
513     fadt->pm1a_cnt_blk = cpu_to_le32(pm->io_base + 0x04);
514     fadt->pm_tmr_blk = cpu_to_le32(pm->io_base + 0x08);
515     fadt->gpe0_blk = cpu_to_le32(pm->gpe0_blk);
516     /* EVT, CNT, TMR length matches hw/acpi/core.c */
517     fadt->pm1_evt_len = 4;
518     fadt->pm1_cnt_len = 2;
519     fadt->pm_tmr_len = 4;
520     fadt->gpe0_blk_len = pm->gpe0_blk_len;
521     fadt->plvl2_lat = cpu_to_le16(0xfff); /* C2 state not supported */
522     fadt->plvl3_lat = cpu_to_le16(0xfff); /* C3 state not supported */
523     fadt->flags = cpu_to_le32((1 << ACPI_FADT_F_WBINVD) |
524                               (1 << ACPI_FADT_F_PROC_C1) |
525                               (1 << ACPI_FADT_F_SLP_BUTTON) |
526                               (1 << ACPI_FADT_F_RTC_S4));
527     fadt->flags |= cpu_to_le32(1 << ACPI_FADT_F_USE_PLATFORM_CLOCK);
528 }
529 
530 
531 /* FADT */
532 static void
533 build_fadt(GArray *table_data, GArray *linker, AcpiPmInfo *pm,
534            unsigned facs, unsigned dsdt)
535 {
536     AcpiFadtDescriptorRev1 *fadt = acpi_data_push(table_data, sizeof(*fadt));
537 
538     fadt->firmware_ctrl = cpu_to_le32(facs);
539     /* FACS address to be filled by Guest linker */
540     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
541                                    ACPI_BUILD_TABLE_FILE,
542                                    table_data, &fadt->firmware_ctrl,
543                                    sizeof fadt->firmware_ctrl);
544 
545     fadt->dsdt = cpu_to_le32(dsdt);
546     /* DSDT address to be filled by Guest linker */
547     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
548                                    ACPI_BUILD_TABLE_FILE,
549                                    table_data, &fadt->dsdt,
550                                    sizeof fadt->dsdt);
551 
552     fadt_setup(fadt, pm);
553 
554     build_header(linker, table_data,
555                  (void *)fadt, "FACP", sizeof(*fadt), 1);
556 }
557 
558 static void
559 build_madt(GArray *table_data, GArray *linker, AcpiCpuInfo *cpu,
560            PcGuestInfo *guest_info)
561 {
562     int madt_start = table_data->len;
563 
564     AcpiMultipleApicTable *madt;
565     AcpiMadtIoApic *io_apic;
566     AcpiMadtIntsrcovr *intsrcovr;
567     AcpiMadtLocalNmi *local_nmi;
568     int i;
569 
570     madt = acpi_data_push(table_data, sizeof *madt);
571     madt->local_apic_address = cpu_to_le32(APIC_DEFAULT_ADDRESS);
572     madt->flags = cpu_to_le32(1);
573 
574     for (i = 0; i < guest_info->apic_id_limit; i++) {
575         AcpiMadtProcessorApic *apic = acpi_data_push(table_data, sizeof *apic);
576         apic->type = ACPI_APIC_PROCESSOR;
577         apic->length = sizeof(*apic);
578         apic->processor_id = i;
579         apic->local_apic_id = i;
580         if (test_bit(i, cpu->found_cpus)) {
581             apic->flags = cpu_to_le32(1);
582         } else {
583             apic->flags = cpu_to_le32(0);
584         }
585     }
586     io_apic = acpi_data_push(table_data, sizeof *io_apic);
587     io_apic->type = ACPI_APIC_IO;
588     io_apic->length = sizeof(*io_apic);
589 #define ACPI_BUILD_IOAPIC_ID 0x0
590     io_apic->io_apic_id = ACPI_BUILD_IOAPIC_ID;
591     io_apic->address = cpu_to_le32(IO_APIC_DEFAULT_ADDRESS);
592     io_apic->interrupt = cpu_to_le32(0);
593 
594     if (guest_info->apic_xrupt_override) {
595         intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr);
596         intsrcovr->type   = ACPI_APIC_XRUPT_OVERRIDE;
597         intsrcovr->length = sizeof(*intsrcovr);
598         intsrcovr->source = 0;
599         intsrcovr->gsi    = cpu_to_le32(2);
600         intsrcovr->flags  = cpu_to_le16(0); /* conforms to bus specifications */
601     }
602     for (i = 1; i < 16; i++) {
603 #define ACPI_BUILD_PCI_IRQS ((1<<5) | (1<<9) | (1<<10) | (1<<11))
604         if (!(ACPI_BUILD_PCI_IRQS & (1 << i))) {
605             /* No need for a INT source override structure. */
606             continue;
607         }
608         intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr);
609         intsrcovr->type   = ACPI_APIC_XRUPT_OVERRIDE;
610         intsrcovr->length = sizeof(*intsrcovr);
611         intsrcovr->source = i;
612         intsrcovr->gsi    = cpu_to_le32(i);
613         intsrcovr->flags  = cpu_to_le16(0xd); /* active high, level triggered */
614     }
615 
616     local_nmi = acpi_data_push(table_data, sizeof *local_nmi);
617     local_nmi->type         = ACPI_APIC_LOCAL_NMI;
618     local_nmi->length       = sizeof(*local_nmi);
619     local_nmi->processor_id = 0xff; /* all processors */
620     local_nmi->flags        = cpu_to_le16(0);
621     local_nmi->lint         = 1; /* ACPI_LINT1 */
622 
623     build_header(linker, table_data,
624                  (void *)(table_data->data + madt_start), "APIC",
625                  table_data->len - madt_start, 1);
626 }
627 
628 /* Encode a hex value */
629 static inline char acpi_get_hex(uint32_t val)
630 {
631     val &= 0x0f;
632     return (val <= 9) ? ('0' + val) : ('A' + val - 10);
633 }
634 
635 #include "hw/i386/ssdt-proc.hex"
636 
637 /* 0x5B 0x83 ProcessorOp PkgLength NameString ProcID */
638 #define ACPI_PROC_OFFSET_CPUHEX (*ssdt_proc_name - *ssdt_proc_start + 2)
639 #define ACPI_PROC_OFFSET_CPUID1 (*ssdt_proc_name - *ssdt_proc_start + 4)
640 #define ACPI_PROC_OFFSET_CPUID2 (*ssdt_proc_id - *ssdt_proc_start)
641 #define ACPI_PROC_SIZEOF (*ssdt_proc_end - *ssdt_proc_start)
642 #define ACPI_PROC_AML (ssdp_proc_aml + *ssdt_proc_start)
643 
644 /* 0x5B 0x82 DeviceOp PkgLength NameString */
645 #define ACPI_PCIHP_OFFSET_HEX (*ssdt_pcihp_name - *ssdt_pcihp_start + 1)
646 #define ACPI_PCIHP_OFFSET_ID (*ssdt_pcihp_id - *ssdt_pcihp_start)
647 #define ACPI_PCIHP_OFFSET_ADR (*ssdt_pcihp_adr - *ssdt_pcihp_start)
648 #define ACPI_PCIHP_OFFSET_EJ0 (*ssdt_pcihp_ej0 - *ssdt_pcihp_start)
649 #define ACPI_PCIHP_SIZEOF (*ssdt_pcihp_end - *ssdt_pcihp_start)
650 #define ACPI_PCIHP_AML (ssdp_pcihp_aml + *ssdt_pcihp_start)
651 
652 #define ACPI_PCINOHP_OFFSET_HEX (*ssdt_pcinohp_name - *ssdt_pcinohp_start + 1)
653 #define ACPI_PCINOHP_OFFSET_ADR (*ssdt_pcinohp_adr - *ssdt_pcinohp_start)
654 #define ACPI_PCINOHP_SIZEOF (*ssdt_pcinohp_end - *ssdt_pcinohp_start)
655 #define ACPI_PCINOHP_AML (ssdp_pcihp_aml + *ssdt_pcinohp_start)
656 
657 #define ACPI_PCIVGA_OFFSET_HEX (*ssdt_pcivga_name - *ssdt_pcivga_start + 1)
658 #define ACPI_PCIVGA_OFFSET_ADR (*ssdt_pcivga_adr - *ssdt_pcivga_start)
659 #define ACPI_PCIVGA_SIZEOF (*ssdt_pcivga_end - *ssdt_pcivga_start)
660 #define ACPI_PCIVGA_AML (ssdp_pcihp_aml + *ssdt_pcivga_start)
661 
662 #define ACPI_PCIQXL_OFFSET_HEX (*ssdt_pciqxl_name - *ssdt_pciqxl_start + 1)
663 #define ACPI_PCIQXL_OFFSET_ADR (*ssdt_pciqxl_adr - *ssdt_pciqxl_start)
664 #define ACPI_PCIQXL_SIZEOF (*ssdt_pciqxl_end - *ssdt_pciqxl_start)
665 #define ACPI_PCIQXL_AML (ssdp_pcihp_aml + *ssdt_pciqxl_start)
666 
667 #define ACPI_SSDT_SIGNATURE 0x54445353 /* SSDT */
668 #define ACPI_SSDT_HEADER_LENGTH 36
669 
670 #include "hw/i386/ssdt-misc.hex"
671 #include "hw/i386/ssdt-pcihp.hex"
672 
673 static void
674 build_append_notify_method(GArray *device, const char *name,
675                            const char *format, int count)
676 {
677     int i;
678     GArray *method = build_alloc_method(name, 2);
679 
680     for (i = 0; i < count; i++) {
681         GArray *target = build_alloc_array();
682         build_append_nameseg(target, format, i);
683         assert(i < 256); /* Fits in 1 byte */
684         build_append_notify_target_ifequal(method, target, i, 1);
685         build_free_array(target);
686     }
687 
688     build_append_and_cleanup_method(device, method);
689 }
690 
691 static void patch_pcihp(int slot, uint8_t *ssdt_ptr)
692 {
693     unsigned devfn = PCI_DEVFN(slot, 0);
694 
695     ssdt_ptr[ACPI_PCIHP_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
696     ssdt_ptr[ACPI_PCIHP_OFFSET_HEX + 1] = acpi_get_hex(devfn);
697     ssdt_ptr[ACPI_PCIHP_OFFSET_ID] = slot;
698     ssdt_ptr[ACPI_PCIHP_OFFSET_ADR + 2] = slot;
699 }
700 
701 static void patch_pcinohp(int slot, uint8_t *ssdt_ptr)
702 {
703     unsigned devfn = PCI_DEVFN(slot, 0);
704 
705     ssdt_ptr[ACPI_PCINOHP_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
706     ssdt_ptr[ACPI_PCINOHP_OFFSET_HEX + 1] = acpi_get_hex(devfn);
707     ssdt_ptr[ACPI_PCINOHP_OFFSET_ADR + 2] = slot;
708 }
709 
710 static void patch_pcivga(int slot, uint8_t *ssdt_ptr)
711 {
712     unsigned devfn = PCI_DEVFN(slot, 0);
713 
714     ssdt_ptr[ACPI_PCIVGA_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
715     ssdt_ptr[ACPI_PCIVGA_OFFSET_HEX + 1] = acpi_get_hex(devfn);
716     ssdt_ptr[ACPI_PCIVGA_OFFSET_ADR + 2] = slot;
717 }
718 
719 static void patch_pciqxl(int slot, uint8_t *ssdt_ptr)
720 {
721     unsigned devfn = PCI_DEVFN(slot, 0);
722 
723     ssdt_ptr[ACPI_PCIQXL_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
724     ssdt_ptr[ACPI_PCIQXL_OFFSET_HEX + 1] = acpi_get_hex(devfn);
725     ssdt_ptr[ACPI_PCIQXL_OFFSET_ADR + 2] = slot;
726 }
727 
728 /* Assign BSEL property to all buses.  In the future, this can be changed
729  * to only assign to buses that support hotplug.
730  */
731 static void *acpi_set_bsel(PCIBus *bus, void *opaque)
732 {
733     unsigned *bsel_alloc = opaque;
734     unsigned *bus_bsel;
735 
736     if (bus->qbus.allow_hotplug) {
737         bus_bsel = g_malloc(sizeof *bus_bsel);
738 
739         *bus_bsel = (*bsel_alloc)++;
740         object_property_add_uint32_ptr(OBJECT(bus), ACPI_PCIHP_PROP_BSEL,
741                                        bus_bsel, NULL);
742     }
743 
744     return bsel_alloc;
745 }
746 
747 static void acpi_set_pci_info(void)
748 {
749     PCIBus *bus = find_i440fx(); /* TODO: Q35 support */
750     unsigned bsel_alloc = 0;
751 
752     if (bus) {
753         /* Scan all PCI buses. Set property to enable acpi based hotplug. */
754         pci_for_each_bus_depth_first(bus, acpi_set_bsel, NULL, &bsel_alloc);
755     }
756 }
757 
758 static void build_pci_bus_state_init(AcpiBuildPciBusHotplugState *state,
759                                      AcpiBuildPciBusHotplugState *parent)
760 {
761     state->parent = parent;
762     state->device_table = build_alloc_array();
763     state->notify_table = build_alloc_array();
764 }
765 
766 static void build_pci_bus_state_cleanup(AcpiBuildPciBusHotplugState *state)
767 {
768     build_free_array(state->device_table);
769     build_free_array(state->notify_table);
770 }
771 
772 static void *build_pci_bus_begin(PCIBus *bus, void *parent_state)
773 {
774     AcpiBuildPciBusHotplugState *parent = parent_state;
775     AcpiBuildPciBusHotplugState *child = g_malloc(sizeof *child);
776 
777     build_pci_bus_state_init(child, parent);
778 
779     return child;
780 }
781 
782 static void build_pci_bus_end(PCIBus *bus, void *bus_state)
783 {
784     AcpiBuildPciBusHotplugState *child = bus_state;
785     AcpiBuildPciBusHotplugState *parent = child->parent;
786     GArray *bus_table = build_alloc_array();
787     DECLARE_BITMAP(slot_hotplug_enable, PCI_SLOT_MAX);
788     DECLARE_BITMAP(slot_device_present, PCI_SLOT_MAX);
789     DECLARE_BITMAP(slot_device_system, PCI_SLOT_MAX);
790     DECLARE_BITMAP(slot_device_vga, PCI_SLOT_MAX);
791     DECLARE_BITMAP(slot_device_qxl, PCI_SLOT_MAX);
792     uint8_t op;
793     int i;
794     QObject *bsel;
795     GArray *method;
796     bool bus_hotplug_support = false;
797 
798     if (bus->parent_dev) {
799         op = 0x82; /* DeviceOp */
800         build_append_nameseg(bus_table, "S%.02X_",
801                              bus->parent_dev->devfn);
802         build_append_byte(bus_table, 0x08); /* NameOp */
803         build_append_nameseg(bus_table, "_SUN");
804         build_append_value(bus_table, PCI_SLOT(bus->parent_dev->devfn), 1);
805         build_append_byte(bus_table, 0x08); /* NameOp */
806         build_append_nameseg(bus_table, "_ADR");
807         build_append_value(bus_table, (PCI_SLOT(bus->parent_dev->devfn) << 16) |
808                            PCI_FUNC(bus->parent_dev->devfn), 4);
809     } else {
810         op = 0x10; /* ScopeOp */;
811         build_append_nameseg(bus_table, "PCI0");
812     }
813 
814     bsel = object_property_get_qobject(OBJECT(bus), ACPI_PCIHP_PROP_BSEL, NULL);
815     if (bsel) {
816         build_append_byte(bus_table, 0x08); /* NameOp */
817         build_append_nameseg(bus_table, "BSEL");
818         build_append_int(bus_table, qint_get_int(qobject_to_qint(bsel)));
819         memset(slot_hotplug_enable, 0xff, sizeof slot_hotplug_enable);
820     } else {
821         /* No bsel - no slots are hot-pluggable */
822         memset(slot_hotplug_enable, 0x00, sizeof slot_hotplug_enable);
823     }
824 
825     memset(slot_device_present, 0x00, sizeof slot_device_present);
826     memset(slot_device_system, 0x00, sizeof slot_device_present);
827     memset(slot_device_vga, 0x00, sizeof slot_device_vga);
828     memset(slot_device_qxl, 0x00, sizeof slot_device_qxl);
829 
830     for (i = 0; i < ARRAY_SIZE(bus->devices); i += PCI_FUNC_MAX) {
831         DeviceClass *dc;
832         PCIDeviceClass *pc;
833         PCIDevice *pdev = bus->devices[i];
834         int slot = PCI_SLOT(i);
835 
836         if (!pdev) {
837             continue;
838         }
839 
840         set_bit(slot, slot_device_present);
841         pc = PCI_DEVICE_GET_CLASS(pdev);
842         dc = DEVICE_GET_CLASS(pdev);
843 
844         if (pc->class_id == PCI_CLASS_BRIDGE_ISA || pc->is_bridge) {
845             set_bit(slot, slot_device_system);
846         }
847 
848         if (pc->class_id == PCI_CLASS_DISPLAY_VGA) {
849             set_bit(slot, slot_device_vga);
850 
851             if (object_dynamic_cast(OBJECT(pdev), "qxl-vga")) {
852                 set_bit(slot, slot_device_qxl);
853             }
854         }
855 
856         if (!dc->hotpluggable || pc->is_bridge) {
857             clear_bit(slot, slot_hotplug_enable);
858         }
859     }
860 
861     /* Append Device object for each slot */
862     for (i = 0; i < PCI_SLOT_MAX; i++) {
863         bool can_eject = test_bit(i, slot_hotplug_enable);
864         bool present = test_bit(i, slot_device_present);
865         bool vga = test_bit(i, slot_device_vga);
866         bool qxl = test_bit(i, slot_device_qxl);
867         bool system = test_bit(i, slot_device_system);
868         if (can_eject) {
869             void *pcihp = acpi_data_push(bus_table,
870                                          ACPI_PCIHP_SIZEOF);
871             memcpy(pcihp, ACPI_PCIHP_AML, ACPI_PCIHP_SIZEOF);
872             patch_pcihp(i, pcihp);
873             bus_hotplug_support = true;
874         } else if (qxl) {
875             void *pcihp = acpi_data_push(bus_table,
876                                          ACPI_PCIQXL_SIZEOF);
877             memcpy(pcihp, ACPI_PCIQXL_AML, ACPI_PCIQXL_SIZEOF);
878             patch_pciqxl(i, pcihp);
879         } else if (vga) {
880             void *pcihp = acpi_data_push(bus_table,
881                                          ACPI_PCIVGA_SIZEOF);
882             memcpy(pcihp, ACPI_PCIVGA_AML, ACPI_PCIVGA_SIZEOF);
883             patch_pcivga(i, pcihp);
884         } else if (system) {
885             /* Nothing to do: system devices are in DSDT or in SSDT above. */
886         } else if (present) {
887             void *pcihp = acpi_data_push(bus_table,
888                                          ACPI_PCINOHP_SIZEOF);
889             memcpy(pcihp, ACPI_PCINOHP_AML, ACPI_PCINOHP_SIZEOF);
890             patch_pcinohp(i, pcihp);
891         }
892     }
893 
894     if (bsel) {
895         method = build_alloc_method("DVNT", 2);
896 
897         for (i = 0; i < PCI_SLOT_MAX; i++) {
898             GArray *notify;
899             uint8_t op;
900 
901             if (!test_bit(i, slot_hotplug_enable)) {
902                 continue;
903             }
904 
905             notify = build_alloc_array();
906             op = 0xA0; /* IfOp */
907 
908             build_append_byte(notify, 0x7B); /* AndOp */
909             build_append_byte(notify, 0x68); /* Arg0Op */
910             build_append_int(notify, 0x1U << i);
911             build_append_byte(notify, 0x00); /* NullName */
912             build_append_byte(notify, 0x86); /* NotifyOp */
913             build_append_nameseg(notify, "S%.02X_", PCI_DEVFN(i, 0));
914             build_append_byte(notify, 0x69); /* Arg1Op */
915 
916             /* Pack it up */
917             build_package(notify, op, 0);
918 
919             build_append_array(method, notify);
920 
921             build_free_array(notify);
922         }
923 
924         build_append_and_cleanup_method(bus_table, method);
925     }
926 
927     /* Append PCNT method to notify about events on local and child buses.
928      * Add unconditionally for root since DSDT expects it.
929      */
930     if (bus_hotplug_support || child->notify_table->len || !bus->parent_dev) {
931         method = build_alloc_method("PCNT", 0);
932 
933         /* If bus supports hotplug select it and notify about local events */
934         if (bsel) {
935             build_append_byte(method, 0x70); /* StoreOp */
936             build_append_int(method, qint_get_int(qobject_to_qint(bsel)));
937             build_append_nameseg(method, "BNUM");
938             build_append_nameseg(method, "DVNT");
939             build_append_nameseg(method, "PCIU");
940             build_append_int(method, 1); /* Device Check */
941             build_append_nameseg(method, "DVNT");
942             build_append_nameseg(method, "PCID");
943             build_append_int(method, 3); /* Eject Request */
944         }
945 
946         /* Notify about child bus events in any case */
947         build_append_array(method, child->notify_table);
948 
949         build_append_and_cleanup_method(bus_table, method);
950 
951         /* Append description of child buses */
952         build_append_array(bus_table, child->device_table);
953 
954         /* Pack it up */
955         if (bus->parent_dev) {
956             build_extop_package(bus_table, op);
957         } else {
958             build_package(bus_table, op, 0);
959         }
960 
961         /* Append our bus description to parent table */
962         build_append_array(parent->device_table, bus_table);
963 
964         /* Also tell parent how to notify us, invoking PCNT method.
965          * At the moment this is not needed for root as we have a single root.
966          */
967         if (bus->parent_dev) {
968             build_append_byte(parent->notify_table, '^'); /* ParentPrefixChar */
969             build_append_byte(parent->notify_table, 0x2E); /* DualNamePrefix */
970             build_append_nameseg(parent->notify_table, "S%.02X_",
971                                  bus->parent_dev->devfn);
972             build_append_nameseg(parent->notify_table, "PCNT");
973         }
974     }
975 
976     build_free_array(bus_table);
977     build_pci_bus_state_cleanup(child);
978     g_free(child);
979 }
980 
981 static void patch_pci_windows(PcPciInfo *pci, uint8_t *start, unsigned size)
982 {
983     ACPI_BUILD_SET_LE(start, size, acpi_pci32_start[0], 32, pci->w32.begin);
984 
985     ACPI_BUILD_SET_LE(start, size, acpi_pci32_end[0], 32, pci->w32.end - 1);
986 
987     if (pci->w64.end || pci->w64.begin) {
988         ACPI_BUILD_SET_LE(start, size, acpi_pci64_valid[0], 8, 1);
989         ACPI_BUILD_SET_LE(start, size, acpi_pci64_start[0], 64, pci->w64.begin);
990         ACPI_BUILD_SET_LE(start, size, acpi_pci64_end[0], 64, pci->w64.end - 1);
991         ACPI_BUILD_SET_LE(start, size, acpi_pci64_length[0], 64, pci->w64.end - pci->w64.begin);
992     } else {
993         ACPI_BUILD_SET_LE(start, size, acpi_pci64_valid[0], 8, 0);
994     }
995 }
996 
997 static void
998 build_ssdt(GArray *table_data, GArray *linker,
999            AcpiCpuInfo *cpu, AcpiPmInfo *pm, AcpiMiscInfo *misc,
1000            PcPciInfo *pci, PcGuestInfo *guest_info)
1001 {
1002     unsigned acpi_cpus = guest_info->apic_id_limit;
1003     int ssdt_start = table_data->len;
1004     uint8_t *ssdt_ptr;
1005     int i;
1006 
1007     /* The current AML generator can cover the APIC ID range [0..255],
1008      * inclusive, for VCPU hotplug. */
1009     QEMU_BUILD_BUG_ON(ACPI_CPU_HOTPLUG_ID_LIMIT > 256);
1010     g_assert(acpi_cpus <= ACPI_CPU_HOTPLUG_ID_LIMIT);
1011 
1012     /* Copy header and patch values in the S3_ / S4_ / S5_ packages */
1013     ssdt_ptr = acpi_data_push(table_data, sizeof(ssdp_misc_aml));
1014     memcpy(ssdt_ptr, ssdp_misc_aml, sizeof(ssdp_misc_aml));
1015     if (pm->s3_disabled) {
1016         ssdt_ptr[acpi_s3_name[0]] = 'X';
1017     }
1018     if (pm->s4_disabled) {
1019         ssdt_ptr[acpi_s4_name[0]] = 'X';
1020     } else {
1021         ssdt_ptr[acpi_s4_pkg[0] + 1] = ssdt_ptr[acpi_s4_pkg[0] + 3] =
1022             pm->s4_val;
1023     }
1024 
1025     patch_pci_windows(pci, ssdt_ptr, sizeof(ssdp_misc_aml));
1026 
1027     ACPI_BUILD_SET_LE(ssdt_ptr, sizeof(ssdp_misc_aml),
1028                       ssdt_isa_pest[0], 16, misc->pvpanic_port);
1029 
1030     {
1031         GArray *sb_scope = build_alloc_array();
1032         uint8_t op = 0x10; /* ScopeOp */
1033 
1034         build_append_nameseg(sb_scope, "_SB_");
1035 
1036         /* build Processor object for each processor */
1037         for (i = 0; i < acpi_cpus; i++) {
1038             uint8_t *proc = acpi_data_push(sb_scope, ACPI_PROC_SIZEOF);
1039             memcpy(proc, ACPI_PROC_AML, ACPI_PROC_SIZEOF);
1040             proc[ACPI_PROC_OFFSET_CPUHEX] = acpi_get_hex(i >> 4);
1041             proc[ACPI_PROC_OFFSET_CPUHEX+1] = acpi_get_hex(i);
1042             proc[ACPI_PROC_OFFSET_CPUID1] = i;
1043             proc[ACPI_PROC_OFFSET_CPUID2] = i;
1044         }
1045 
1046         /* build this code:
1047          *   Method(NTFY, 2) {If (LEqual(Arg0, 0x00)) {Notify(CP00, Arg1)} ...}
1048          */
1049         /* Arg0 = Processor ID = APIC ID */
1050         build_append_notify_method(sb_scope, "NTFY", "CP%0.02X", acpi_cpus);
1051 
1052         /* build "Name(CPON, Package() { One, One, ..., Zero, Zero, ... })" */
1053         build_append_byte(sb_scope, 0x08); /* NameOp */
1054         build_append_nameseg(sb_scope, "CPON");
1055 
1056         {
1057             GArray *package = build_alloc_array();
1058             uint8_t op;
1059 
1060             /*
1061              * Note: The ability to create variable-sized packages was first introduced in ACPI 2.0. ACPI 1.0 only
1062              * allowed fixed-size packages with up to 255 elements.
1063              * Windows guests up to win2k8 fail when VarPackageOp is used.
1064              */
1065             if (acpi_cpus <= 255) {
1066                 op = 0x12; /* PackageOp */
1067                 build_append_byte(package, acpi_cpus); /* NumElements */
1068             } else {
1069                 op = 0x13; /* VarPackageOp */
1070                 build_append_int(package, acpi_cpus); /* VarNumElements */
1071             }
1072 
1073             for (i = 0; i < acpi_cpus; i++) {
1074                 uint8_t b = test_bit(i, cpu->found_cpus) ? 0x01 : 0x00;
1075                 build_append_byte(package, b);
1076             }
1077 
1078             build_package(package, op, 2);
1079             build_append_array(sb_scope, package);
1080             build_free_array(package);
1081         }
1082 
1083         {
1084             AcpiBuildPciBusHotplugState hotplug_state;
1085             Object *pci_host;
1086             PCIBus *bus = NULL;
1087             bool ambiguous;
1088 
1089             pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
1090             if (!ambiguous && pci_host) {
1091                 bus = PCI_HOST_BRIDGE(pci_host)->bus;
1092             }
1093 
1094             build_pci_bus_state_init(&hotplug_state, NULL);
1095 
1096             if (bus) {
1097                 /* Scan all PCI buses. Generate tables to support hotplug. */
1098                 pci_for_each_bus_depth_first(bus, build_pci_bus_begin,
1099                                              build_pci_bus_end, &hotplug_state);
1100             }
1101 
1102             build_append_array(sb_scope, hotplug_state.device_table);
1103             build_pci_bus_state_cleanup(&hotplug_state);
1104         }
1105 
1106         build_package(sb_scope, op, 3);
1107         build_append_array(table_data, sb_scope);
1108         build_free_array(sb_scope);
1109     }
1110 
1111     build_header(linker, table_data,
1112                  (void *)(table_data->data + ssdt_start),
1113                  "SSDT", table_data->len - ssdt_start, 1);
1114 }
1115 
1116 static void
1117 build_hpet(GArray *table_data, GArray *linker)
1118 {
1119     Acpi20Hpet *hpet;
1120 
1121     hpet = acpi_data_push(table_data, sizeof(*hpet));
1122     /* Note timer_block_id value must be kept in sync with value advertised by
1123      * emulated hpet
1124      */
1125     hpet->timer_block_id = cpu_to_le32(0x8086a201);
1126     hpet->addr.address = cpu_to_le64(HPET_BASE);
1127     build_header(linker, table_data,
1128                  (void *)hpet, "HPET", sizeof(*hpet), 1);
1129 }
1130 
1131 static void
1132 acpi_build_srat_memory(AcpiSratMemoryAffinity *numamem,
1133                        uint64_t base, uint64_t len, int node, int enabled)
1134 {
1135     numamem->type = ACPI_SRAT_MEMORY;
1136     numamem->length = sizeof(*numamem);
1137     memset(numamem->proximity, 0, 4);
1138     numamem->proximity[0] = node;
1139     numamem->flags = cpu_to_le32(!!enabled);
1140     numamem->base_addr = cpu_to_le64(base);
1141     numamem->range_length = cpu_to_le64(len);
1142 }
1143 
1144 static void
1145 build_srat(GArray *table_data, GArray *linker,
1146            AcpiCpuInfo *cpu, PcGuestInfo *guest_info)
1147 {
1148     AcpiSystemResourceAffinityTable *srat;
1149     AcpiSratProcessorAffinity *core;
1150     AcpiSratMemoryAffinity *numamem;
1151 
1152     int i;
1153     uint64_t curnode;
1154     int srat_start, numa_start, slots;
1155     uint64_t mem_len, mem_base, next_base;
1156 
1157     srat_start = table_data->len;
1158 
1159     srat = acpi_data_push(table_data, sizeof *srat);
1160     srat->reserved1 = cpu_to_le32(1);
1161     core = (void *)(srat + 1);
1162 
1163     for (i = 0; i < guest_info->apic_id_limit; ++i) {
1164         core = acpi_data_push(table_data, sizeof *core);
1165         core->type = ACPI_SRAT_PROCESSOR;
1166         core->length = sizeof(*core);
1167         core->local_apic_id = i;
1168         curnode = guest_info->node_cpu[i];
1169         core->proximity_lo = curnode;
1170         memset(core->proximity_hi, 0, 3);
1171         core->local_sapic_eid = 0;
1172         if (test_bit(i, cpu->found_cpus)) {
1173             core->flags = cpu_to_le32(1);
1174         } else {
1175             core->flags = cpu_to_le32(0);
1176         }
1177     }
1178 
1179 
1180     /* the memory map is a bit tricky, it contains at least one hole
1181      * from 640k-1M and possibly another one from 3.5G-4G.
1182      */
1183     next_base = 0;
1184     numa_start = table_data->len;
1185 
1186     numamem = acpi_data_push(table_data, sizeof *numamem);
1187     acpi_build_srat_memory(numamem, 0, 640*1024, 0, 1);
1188     next_base = 1024 * 1024;
1189     for (i = 1; i < guest_info->numa_nodes + 1; ++i) {
1190         mem_base = next_base;
1191         mem_len = guest_info->node_mem[i - 1];
1192         if (i == 1) {
1193             mem_len -= 1024 * 1024;
1194         }
1195         next_base = mem_base + mem_len;
1196 
1197         /* Cut out the ACPI_PCI hole */
1198         if (mem_base <= guest_info->ram_size_below_4g &&
1199             next_base > guest_info->ram_size_below_4g) {
1200             mem_len -= next_base - guest_info->ram_size_below_4g;
1201             if (mem_len > 0) {
1202                 numamem = acpi_data_push(table_data, sizeof *numamem);
1203                 acpi_build_srat_memory(numamem, mem_base, mem_len, i-1, 1);
1204             }
1205             mem_base = 1ULL << 32;
1206             mem_len = next_base - guest_info->ram_size_below_4g;
1207             next_base += (1ULL << 32) - guest_info->ram_size_below_4g;
1208         }
1209         numamem = acpi_data_push(table_data, sizeof *numamem);
1210         acpi_build_srat_memory(numamem, mem_base, mem_len, i - 1, 1);
1211     }
1212     slots = (table_data->len - numa_start) / sizeof *numamem;
1213     for (; slots < guest_info->numa_nodes + 2; slots++) {
1214         numamem = acpi_data_push(table_data, sizeof *numamem);
1215         acpi_build_srat_memory(numamem, 0, 0, 0, 0);
1216     }
1217 
1218     build_header(linker, table_data,
1219                  (void *)(table_data->data + srat_start),
1220                  "SRAT",
1221                  table_data->len - srat_start, 1);
1222 }
1223 
1224 static void
1225 build_mcfg_q35(GArray *table_data, GArray *linker, AcpiMcfgInfo *info)
1226 {
1227     AcpiTableMcfg *mcfg;
1228     const char *sig;
1229     int len = sizeof(*mcfg) + 1 * sizeof(mcfg->allocation[0]);
1230 
1231     mcfg = acpi_data_push(table_data, len);
1232     mcfg->allocation[0].address = cpu_to_le64(info->mcfg_base);
1233     /* Only a single allocation so no need to play with segments */
1234     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
1235     mcfg->allocation[0].start_bus_number = 0;
1236     mcfg->allocation[0].end_bus_number = PCIE_MMCFG_BUS(info->mcfg_size - 1);
1237 
1238     /* MCFG is used for ECAM which can be enabled or disabled by guest.
1239      * To avoid table size changes (which create migration issues),
1240      * always create the table even if there are no allocations,
1241      * but set the signature to a reserved value in this case.
1242      * ACPI spec requires OSPMs to ignore such tables.
1243      */
1244     if (info->mcfg_base == PCIE_BASE_ADDR_UNMAPPED) {
1245         /* Reserved signature: ignored by OSPM */
1246         sig = "QEMU";
1247     } else {
1248         sig = "MCFG";
1249     }
1250     build_header(linker, table_data, (void *)mcfg, sig, len, 1);
1251 }
1252 
1253 static void
1254 build_dsdt(GArray *table_data, GArray *linker, AcpiMiscInfo *misc)
1255 {
1256     AcpiTableHeader *dsdt;
1257 
1258     assert(misc->dsdt_code && misc->dsdt_size);
1259 
1260     dsdt = acpi_data_push(table_data, misc->dsdt_size);
1261     memcpy(dsdt, misc->dsdt_code, misc->dsdt_size);
1262 
1263     memset(dsdt, 0, sizeof *dsdt);
1264     build_header(linker, table_data, dsdt, "DSDT",
1265                  misc->dsdt_size, 1);
1266 }
1267 
1268 /* Build final rsdt table */
1269 static void
1270 build_rsdt(GArray *table_data, GArray *linker, GArray *table_offsets)
1271 {
1272     AcpiRsdtDescriptorRev1 *rsdt;
1273     size_t rsdt_len;
1274     int i;
1275 
1276     rsdt_len = sizeof(*rsdt) + sizeof(uint32_t) * table_offsets->len;
1277     rsdt = acpi_data_push(table_data, rsdt_len);
1278     memcpy(rsdt->table_offset_entry, table_offsets->data,
1279            sizeof(uint32_t) * table_offsets->len);
1280     for (i = 0; i < table_offsets->len; ++i) {
1281         /* rsdt->table_offset_entry to be filled by Guest linker */
1282         bios_linker_loader_add_pointer(linker,
1283                                        ACPI_BUILD_TABLE_FILE,
1284                                        ACPI_BUILD_TABLE_FILE,
1285                                        table_data, &rsdt->table_offset_entry[i],
1286                                        sizeof(uint32_t));
1287     }
1288     build_header(linker, table_data,
1289                  (void *)rsdt, "RSDT", rsdt_len, 1);
1290 }
1291 
1292 static GArray *
1293 build_rsdp(GArray *rsdp_table, GArray *linker, unsigned rsdt)
1294 {
1295     AcpiRsdpDescriptor *rsdp = acpi_data_push(rsdp_table, sizeof *rsdp);
1296 
1297     bios_linker_loader_alloc(linker, ACPI_BUILD_RSDP_FILE, 1,
1298                              true /* fseg memory */);
1299 
1300     memcpy(&rsdp->signature, "RSD PTR ", 8);
1301     memcpy(rsdp->oem_id, ACPI_BUILD_APPNAME6, 6);
1302     rsdp->rsdt_physical_address = cpu_to_le32(rsdt);
1303     /* Address to be filled by Guest linker */
1304     bios_linker_loader_add_pointer(linker, ACPI_BUILD_RSDP_FILE,
1305                                    ACPI_BUILD_TABLE_FILE,
1306                                    rsdp_table, &rsdp->rsdt_physical_address,
1307                                    sizeof rsdp->rsdt_physical_address);
1308     rsdp->checksum = 0;
1309     /* Checksum to be filled by Guest linker */
1310     bios_linker_loader_add_checksum(linker, ACPI_BUILD_RSDP_FILE,
1311                                     rsdp, rsdp, sizeof *rsdp, &rsdp->checksum);
1312 
1313     return rsdp_table;
1314 }
1315 
1316 typedef
1317 struct AcpiBuildTables {
1318     GArray *table_data;
1319     GArray *rsdp;
1320     GArray *linker;
1321 } AcpiBuildTables;
1322 
1323 static inline void acpi_build_tables_init(AcpiBuildTables *tables)
1324 {
1325     tables->rsdp = g_array_new(false, true /* clear */, 1);
1326     tables->table_data = g_array_new(false, true /* clear */, 1);
1327     tables->linker = bios_linker_loader_init();
1328 }
1329 
1330 static inline void acpi_build_tables_cleanup(AcpiBuildTables *tables, bool mfre)
1331 {
1332     void *linker_data = bios_linker_loader_cleanup(tables->linker);
1333     if (mfre) {
1334         g_free(linker_data);
1335     }
1336     g_array_free(tables->rsdp, mfre);
1337     g_array_free(tables->table_data, mfre);
1338 }
1339 
1340 typedef
1341 struct AcpiBuildState {
1342     /* Copy of table in RAM (for patching). */
1343     uint8_t *table_ram;
1344     uint32_t table_size;
1345     /* Is table patched? */
1346     uint8_t patched;
1347     PcGuestInfo *guest_info;
1348 } AcpiBuildState;
1349 
1350 static bool acpi_get_mcfg(AcpiMcfgInfo *mcfg)
1351 {
1352     Object *pci_host;
1353     QObject *o;
1354     bool ambiguous;
1355 
1356     pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
1357     g_assert(!ambiguous);
1358     g_assert(pci_host);
1359 
1360     o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_BASE, NULL);
1361     if (!o) {
1362         return false;
1363     }
1364     mcfg->mcfg_base = qint_get_int(qobject_to_qint(o));
1365 
1366     o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_SIZE, NULL);
1367     assert(o);
1368     mcfg->mcfg_size = qint_get_int(qobject_to_qint(o));
1369     return true;
1370 }
1371 
1372 static
1373 void acpi_build(PcGuestInfo *guest_info, AcpiBuildTables *tables)
1374 {
1375     GArray *table_offsets;
1376     unsigned facs, dsdt, rsdt;
1377     AcpiCpuInfo cpu;
1378     AcpiPmInfo pm;
1379     AcpiMiscInfo misc;
1380     AcpiMcfgInfo mcfg;
1381     PcPciInfo pci;
1382     uint8_t *u;
1383 
1384     acpi_get_cpu_info(&cpu);
1385     acpi_get_pm_info(&pm);
1386     acpi_get_dsdt(&misc);
1387     acpi_get_misc_info(&misc);
1388     acpi_get_pci_info(&pci);
1389 
1390     table_offsets = g_array_new(false, true /* clear */,
1391                                         sizeof(uint32_t));
1392     ACPI_BUILD_DPRINTF(3, "init ACPI tables\n");
1393 
1394     bios_linker_loader_alloc(tables->linker, ACPI_BUILD_TABLE_FILE,
1395                              64 /* Ensure FACS is aligned */,
1396                              false /* high memory */);
1397 
1398     /*
1399      * FACS is pointed to by FADT.
1400      * We place it first since it's the only table that has alignment
1401      * requirements.
1402      */
1403     facs = tables->table_data->len;
1404     build_facs(tables->table_data, tables->linker, guest_info);
1405 
1406     /* DSDT is pointed to by FADT */
1407     dsdt = tables->table_data->len;
1408     build_dsdt(tables->table_data, tables->linker, &misc);
1409 
1410     /* ACPI tables pointed to by RSDT */
1411     acpi_add_table(table_offsets, tables->table_data);
1412     build_fadt(tables->table_data, tables->linker, &pm, facs, dsdt);
1413     acpi_add_table(table_offsets, tables->table_data);
1414 
1415     build_ssdt(tables->table_data, tables->linker, &cpu, &pm, &misc, &pci,
1416                guest_info);
1417     acpi_add_table(table_offsets, tables->table_data);
1418 
1419     build_madt(tables->table_data, tables->linker, &cpu, guest_info);
1420     acpi_add_table(table_offsets, tables->table_data);
1421     if (misc.has_hpet) {
1422         build_hpet(tables->table_data, tables->linker);
1423     }
1424     if (guest_info->numa_nodes) {
1425         acpi_add_table(table_offsets, tables->table_data);
1426         build_srat(tables->table_data, tables->linker, &cpu, guest_info);
1427     }
1428     if (acpi_get_mcfg(&mcfg)) {
1429         acpi_add_table(table_offsets, tables->table_data);
1430         build_mcfg_q35(tables->table_data, tables->linker, &mcfg);
1431     }
1432 
1433     /* Add tables supplied by user (if any) */
1434     for (u = acpi_table_first(); u; u = acpi_table_next(u)) {
1435         unsigned len = acpi_table_len(u);
1436 
1437         acpi_add_table(table_offsets, tables->table_data);
1438         g_array_append_vals(tables->table_data, u, len);
1439     }
1440 
1441     /* RSDT is pointed to by RSDP */
1442     rsdt = tables->table_data->len;
1443     build_rsdt(tables->table_data, tables->linker, table_offsets);
1444 
1445     /* RSDP is in FSEG memory, so allocate it separately */
1446     build_rsdp(tables->rsdp, tables->linker, rsdt);
1447 
1448     /* We'll expose it all to Guest so align size to reduce
1449      * chance of size changes.
1450      * RSDP is small so it's easy to keep it immutable, no need to
1451      * bother with alignment.
1452      */
1453     acpi_align_size(tables->table_data, 0x1000);
1454 
1455     acpi_align_size(tables->linker, 0x1000);
1456 
1457     /* Cleanup memory that's no longer used. */
1458     g_array_free(table_offsets, true);
1459 }
1460 
1461 static void acpi_build_update(void *build_opaque, uint32_t offset)
1462 {
1463     AcpiBuildState *build_state = build_opaque;
1464     AcpiBuildTables tables;
1465 
1466     /* No state to update or already patched? Nothing to do. */
1467     if (!build_state || build_state->patched) {
1468         return;
1469     }
1470     build_state->patched = 1;
1471 
1472     acpi_build_tables_init(&tables);
1473 
1474     acpi_build(build_state->guest_info, &tables);
1475 
1476     assert(acpi_data_len(tables.table_data) == build_state->table_size);
1477     memcpy(build_state->table_ram, tables.table_data->data,
1478            build_state->table_size);
1479 
1480     acpi_build_tables_cleanup(&tables, true);
1481 }
1482 
1483 static void acpi_build_reset(void *build_opaque)
1484 {
1485     AcpiBuildState *build_state = build_opaque;
1486     build_state->patched = 0;
1487 }
1488 
1489 static void *acpi_add_rom_blob(AcpiBuildState *build_state, GArray *blob,
1490                                const char *name)
1491 {
1492     return rom_add_blob(name, blob->data, acpi_data_len(blob), -1, name,
1493                         acpi_build_update, build_state);
1494 }
1495 
1496 static const VMStateDescription vmstate_acpi_build = {
1497     .name = "acpi_build",
1498     .version_id = 1,
1499     .minimum_version_id = 1,
1500     .minimum_version_id_old = 1,
1501     .fields      = (VMStateField[]) {
1502         VMSTATE_UINT8(patched, AcpiBuildState),
1503         VMSTATE_END_OF_LIST()
1504     },
1505 };
1506 
1507 void acpi_setup(PcGuestInfo *guest_info)
1508 {
1509     AcpiBuildTables tables;
1510     AcpiBuildState *build_state;
1511 
1512     if (!guest_info->fw_cfg) {
1513         ACPI_BUILD_DPRINTF(3, "No fw cfg. Bailing out.\n");
1514         return;
1515     }
1516 
1517     if (!guest_info->has_acpi_build) {
1518         ACPI_BUILD_DPRINTF(3, "ACPI build disabled. Bailing out.\n");
1519         return;
1520     }
1521 
1522     if (!acpi_enabled) {
1523         ACPI_BUILD_DPRINTF(3, "ACPI disabled. Bailing out.\n");
1524         return;
1525     }
1526 
1527     build_state = g_malloc0(sizeof *build_state);
1528 
1529     build_state->guest_info = guest_info;
1530 
1531     acpi_set_pci_info();
1532 
1533     acpi_build_tables_init(&tables);
1534     acpi_build(build_state->guest_info, &tables);
1535 
1536     /* Now expose it all to Guest */
1537     build_state->table_ram = acpi_add_rom_blob(build_state, tables.table_data,
1538                                                ACPI_BUILD_TABLE_FILE);
1539     build_state->table_size = acpi_data_len(tables.table_data);
1540 
1541     acpi_add_rom_blob(NULL, tables.linker, "etc/table-loader");
1542 
1543     /*
1544      * RSDP is small so it's easy to keep it immutable, no need to
1545      * bother with ROM blobs.
1546      */
1547     fw_cfg_add_file(guest_info->fw_cfg, ACPI_BUILD_RSDP_FILE,
1548                     tables.rsdp->data, acpi_data_len(tables.rsdp));
1549 
1550     qemu_register_reset(acpi_build_reset, build_state);
1551     acpi_build_reset(build_state);
1552     vmstate_register(NULL, 0, &vmstate_acpi_build, build_state);
1553 
1554     /* Cleanup tables but don't free the memory: we track it
1555      * in build_state.
1556      */
1557     acpi_build_tables_cleanup(&tables, false);
1558 }
1559