xref: /openbmc/qemu/hw/i386/acpi-build.c (revision 5aa8136020f47fbd38c458b9834c783cb7063db8)
1 /* Support for generating ACPI tables and passing them to Guests
2  *
3  * Copyright (C) 2008-2010  Kevin O'Connor <kevin@koconnor.net>
4  * Copyright (C) 2006 Fabrice Bellard
5  * Copyright (C) 2013 Red Hat Inc
6  *
7  * Author: Michael S. Tsirkin <mst@redhat.com>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License as published by
11  * the Free Software Foundation; either version 2 of the License, or
12  * (at your option) any later version.
13 
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU General Public License for more details.
18 
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, see <http://www.gnu.org/licenses/>.
21  */
22 
23 #include "acpi-build.h"
24 #include <stddef.h>
25 #include <glib.h>
26 #include "qemu-common.h"
27 #include "qemu/bitmap.h"
28 #include "qemu/osdep.h"
29 #include "qemu/range.h"
30 #include "qemu/error-report.h"
31 #include "hw/pci/pci.h"
32 #include "qom/cpu.h"
33 #include "hw/i386/pc.h"
34 #include "target-i386/cpu.h"
35 #include "hw/timer/hpet.h"
36 #include "hw/i386/acpi-defs.h"
37 #include "hw/acpi/acpi.h"
38 #include "hw/nvram/fw_cfg.h"
39 #include "bios-linker-loader.h"
40 #include "hw/loader.h"
41 #include "hw/isa/isa.h"
42 #include "hw/acpi/memory_hotplug.h"
43 #include "sysemu/tpm.h"
44 #include "hw/acpi/tpm.h"
45 
46 /* Supported chipsets: */
47 #include "hw/acpi/piix4.h"
48 #include "hw/acpi/pcihp.h"
49 #include "hw/i386/ich9.h"
50 #include "hw/pci/pci_bus.h"
51 #include "hw/pci-host/q35.h"
52 #include "hw/i386/intel_iommu.h"
53 
54 #include "hw/i386/q35-acpi-dsdt.hex"
55 #include "hw/i386/acpi-dsdt.hex"
56 
57 #include "qapi/qmp/qint.h"
58 #include "qom/qom-qobject.h"
59 #include "exec/ram_addr.h"
60 
61 /* These are used to size the ACPI tables for -M pc-i440fx-1.7 and
62  * -M pc-i440fx-2.0.  Even if the actual amount of AML generated grows
63  * a little bit, there should be plenty of free space since the DSDT
64  * shrunk by ~1.5k between QEMU 2.0 and QEMU 2.1.
65  */
66 #define ACPI_BUILD_LEGACY_CPU_AML_SIZE    97
67 #define ACPI_BUILD_ALIGN_SIZE             0x1000
68 
69 #define ACPI_BUILD_TABLE_SIZE             0x20000
70 
71 /* #define DEBUG_ACPI_BUILD */
72 #ifdef DEBUG_ACPI_BUILD
73 #define ACPI_BUILD_DPRINTF(fmt, ...)        \
74     do {printf("ACPI_BUILD: " fmt, ## __VA_ARGS__); } while (0)
75 #else
76 #define ACPI_BUILD_DPRINTF(fmt, ...)
77 #endif
78 
79 typedef struct AcpiCpuInfo {
80     DECLARE_BITMAP(found_cpus, ACPI_CPU_HOTPLUG_ID_LIMIT);
81 } AcpiCpuInfo;
82 
83 typedef struct AcpiMcfgInfo {
84     uint64_t mcfg_base;
85     uint32_t mcfg_size;
86 } AcpiMcfgInfo;
87 
88 typedef struct AcpiPmInfo {
89     bool s3_disabled;
90     bool s4_disabled;
91     bool pcihp_bridge_en;
92     uint8_t s4_val;
93     uint16_t sci_int;
94     uint8_t acpi_enable_cmd;
95     uint8_t acpi_disable_cmd;
96     uint32_t gpe0_blk;
97     uint32_t gpe0_blk_len;
98     uint32_t io_base;
99 } AcpiPmInfo;
100 
101 typedef struct AcpiMiscInfo {
102     bool has_hpet;
103     bool has_tpm;
104     DECLARE_BITMAP(slot_hotplug_enable, PCI_SLOT_MAX);
105     const unsigned char *dsdt_code;
106     unsigned dsdt_size;
107     uint16_t pvpanic_port;
108 } AcpiMiscInfo;
109 
110 typedef struct AcpiBuildPciBusHotplugState {
111     GArray *device_table;
112     GArray *notify_table;
113     struct AcpiBuildPciBusHotplugState *parent;
114     bool pcihp_bridge_en;
115 } AcpiBuildPciBusHotplugState;
116 
117 static void acpi_get_dsdt(AcpiMiscInfo *info)
118 {
119     uint16_t *applesmc_sta;
120     Object *piix = piix4_pm_find();
121     Object *lpc = ich9_lpc_find();
122     assert(!!piix != !!lpc);
123 
124     if (piix) {
125         info->dsdt_code = AcpiDsdtAmlCode;
126         info->dsdt_size = sizeof AcpiDsdtAmlCode;
127         applesmc_sta = piix_dsdt_applesmc_sta;
128     }
129     if (lpc) {
130         info->dsdt_code = Q35AcpiDsdtAmlCode;
131         info->dsdt_size = sizeof Q35AcpiDsdtAmlCode;
132         applesmc_sta = q35_dsdt_applesmc_sta;
133     }
134 
135     /* Patch in appropriate value for AppleSMC _STA */
136     *(uint8_t *)(info->dsdt_code + *applesmc_sta) =
137         applesmc_find() ? 0x0b : 0x00;
138 }
139 
140 static
141 int acpi_add_cpu_info(Object *o, void *opaque)
142 {
143     AcpiCpuInfo *cpu = opaque;
144     uint64_t apic_id;
145 
146     if (object_dynamic_cast(o, TYPE_CPU)) {
147         apic_id = object_property_get_int(o, "apic-id", NULL);
148         assert(apic_id < ACPI_CPU_HOTPLUG_ID_LIMIT);
149 
150         set_bit(apic_id, cpu->found_cpus);
151     }
152 
153     object_child_foreach(o, acpi_add_cpu_info, opaque);
154     return 0;
155 }
156 
157 static void acpi_get_cpu_info(AcpiCpuInfo *cpu)
158 {
159     Object *root = object_get_root();
160 
161     memset(cpu->found_cpus, 0, sizeof cpu->found_cpus);
162     object_child_foreach(root, acpi_add_cpu_info, cpu);
163 }
164 
165 static void acpi_get_pm_info(AcpiPmInfo *pm)
166 {
167     Object *piix = piix4_pm_find();
168     Object *lpc = ich9_lpc_find();
169     Object *obj = NULL;
170     QObject *o;
171 
172     if (piix) {
173         obj = piix;
174     }
175     if (lpc) {
176         obj = lpc;
177     }
178     assert(obj);
179 
180     /* Fill in optional s3/s4 related properties */
181     o = object_property_get_qobject(obj, ACPI_PM_PROP_S3_DISABLED, NULL);
182     if (o) {
183         pm->s3_disabled = qint_get_int(qobject_to_qint(o));
184     } else {
185         pm->s3_disabled = false;
186     }
187     qobject_decref(o);
188     o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_DISABLED, NULL);
189     if (o) {
190         pm->s4_disabled = qint_get_int(qobject_to_qint(o));
191     } else {
192         pm->s4_disabled = false;
193     }
194     qobject_decref(o);
195     o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_VAL, NULL);
196     if (o) {
197         pm->s4_val = qint_get_int(qobject_to_qint(o));
198     } else {
199         pm->s4_val = false;
200     }
201     qobject_decref(o);
202 
203     /* Fill in mandatory properties */
204     pm->sci_int = object_property_get_int(obj, ACPI_PM_PROP_SCI_INT, NULL);
205 
206     pm->acpi_enable_cmd = object_property_get_int(obj,
207                                                   ACPI_PM_PROP_ACPI_ENABLE_CMD,
208                                                   NULL);
209     pm->acpi_disable_cmd = object_property_get_int(obj,
210                                                   ACPI_PM_PROP_ACPI_DISABLE_CMD,
211                                                   NULL);
212     pm->io_base = object_property_get_int(obj, ACPI_PM_PROP_PM_IO_BASE,
213                                           NULL);
214     pm->gpe0_blk = object_property_get_int(obj, ACPI_PM_PROP_GPE0_BLK,
215                                            NULL);
216     pm->gpe0_blk_len = object_property_get_int(obj, ACPI_PM_PROP_GPE0_BLK_LEN,
217                                                NULL);
218     pm->pcihp_bridge_en =
219         object_property_get_bool(obj, "acpi-pci-hotplug-with-bridge-support",
220                                  NULL);
221 }
222 
223 static void acpi_get_misc_info(AcpiMiscInfo *info)
224 {
225     info->has_hpet = hpet_find();
226     info->has_tpm = tpm_find();
227     info->pvpanic_port = pvpanic_port();
228 }
229 
230 static void acpi_get_pci_info(PcPciInfo *info)
231 {
232     Object *pci_host;
233     bool ambiguous;
234 
235     pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
236     g_assert(!ambiguous);
237     g_assert(pci_host);
238 
239     info->w32.begin = object_property_get_int(pci_host,
240                                               PCI_HOST_PROP_PCI_HOLE_START,
241                                               NULL);
242     info->w32.end = object_property_get_int(pci_host,
243                                             PCI_HOST_PROP_PCI_HOLE_END,
244                                             NULL);
245     info->w64.begin = object_property_get_int(pci_host,
246                                               PCI_HOST_PROP_PCI_HOLE64_START,
247                                               NULL);
248     info->w64.end = object_property_get_int(pci_host,
249                                             PCI_HOST_PROP_PCI_HOLE64_END,
250                                             NULL);
251 }
252 
253 #define ACPI_BUILD_APPNAME  "Bochs"
254 #define ACPI_BUILD_APPNAME6 "BOCHS "
255 #define ACPI_BUILD_APPNAME4 "BXPC"
256 
257 #define ACPI_BUILD_TABLE_FILE "etc/acpi/tables"
258 #define ACPI_BUILD_RSDP_FILE "etc/acpi/rsdp"
259 #define ACPI_BUILD_TPMLOG_FILE "etc/tpm/log"
260 
261 static void
262 build_header(GArray *linker, GArray *table_data,
263              AcpiTableHeader *h, const char *sig, int len, uint8_t rev)
264 {
265     memcpy(&h->signature, sig, 4);
266     h->length = cpu_to_le32(len);
267     h->revision = rev;
268     memcpy(h->oem_id, ACPI_BUILD_APPNAME6, 6);
269     memcpy(h->oem_table_id, ACPI_BUILD_APPNAME4, 4);
270     memcpy(h->oem_table_id + 4, sig, 4);
271     h->oem_revision = cpu_to_le32(1);
272     memcpy(h->asl_compiler_id, ACPI_BUILD_APPNAME4, 4);
273     h->asl_compiler_revision = cpu_to_le32(1);
274     h->checksum = 0;
275     /* Checksum to be filled in by Guest linker */
276     bios_linker_loader_add_checksum(linker, ACPI_BUILD_TABLE_FILE,
277                                     table_data->data, h, len, &h->checksum);
278 }
279 
280 static inline GArray *build_alloc_array(void)
281 {
282     return g_array_new(false, true /* clear */, 1);
283 }
284 
285 static inline void build_free_array(GArray *array)
286 {
287     g_array_free(array, true);
288 }
289 
290 static inline void build_prepend_byte(GArray *array, uint8_t val)
291 {
292     g_array_prepend_val(array, val);
293 }
294 
295 static inline void build_append_byte(GArray *array, uint8_t val)
296 {
297     g_array_append_val(array, val);
298 }
299 
300 static inline void build_append_array(GArray *array, GArray *val)
301 {
302     g_array_append_vals(array, val->data, val->len);
303 }
304 
305 static void GCC_FMT_ATTR(2, 3)
306 build_append_nameseg(GArray *array, const char *format, ...)
307 {
308     /* It would be nicer to use g_string_vprintf but it's only there in 2.22 */
309     char s[] = "XXXX";
310     int len;
311     va_list args;
312 
313     va_start(args, format);
314     len = vsnprintf(s, sizeof s, format, args);
315     va_end(args);
316 
317     assert(len == 4);
318     g_array_append_vals(array, s, len);
319 }
320 
321 /* 5.4 Definition Block Encoding */
322 enum {
323     PACKAGE_LENGTH_1BYTE_SHIFT = 6, /* Up to 63 - use extra 2 bits. */
324     PACKAGE_LENGTH_2BYTE_SHIFT = 4,
325     PACKAGE_LENGTH_3BYTE_SHIFT = 12,
326     PACKAGE_LENGTH_4BYTE_SHIFT = 20,
327 };
328 
329 static void build_prepend_package_length(GArray *package, unsigned min_bytes)
330 {
331     uint8_t byte;
332     unsigned length = package->len;
333     unsigned length_bytes;
334 
335     if (length + 1 < (1 << PACKAGE_LENGTH_1BYTE_SHIFT)) {
336         length_bytes = 1;
337     } else if (length + 2 < (1 << PACKAGE_LENGTH_3BYTE_SHIFT)) {
338         length_bytes = 2;
339     } else if (length + 3 < (1 << PACKAGE_LENGTH_4BYTE_SHIFT)) {
340         length_bytes = 3;
341     } else {
342         length_bytes = 4;
343     }
344 
345     /* Force length to at least min_bytes.
346      * This wastes memory but that's how bios did it.
347      */
348     length_bytes = MAX(length_bytes, min_bytes);
349 
350     /* PkgLength is the length of the inclusive length of the data. */
351     length += length_bytes;
352 
353     switch (length_bytes) {
354     case 1:
355         byte = length;
356         build_prepend_byte(package, byte);
357         return;
358     case 4:
359         byte = length >> PACKAGE_LENGTH_4BYTE_SHIFT;
360         build_prepend_byte(package, byte);
361         length &= (1 << PACKAGE_LENGTH_4BYTE_SHIFT) - 1;
362         /* fall through */
363     case 3:
364         byte = length >> PACKAGE_LENGTH_3BYTE_SHIFT;
365         build_prepend_byte(package, byte);
366         length &= (1 << PACKAGE_LENGTH_3BYTE_SHIFT) - 1;
367         /* fall through */
368     case 2:
369         byte = length >> PACKAGE_LENGTH_2BYTE_SHIFT;
370         build_prepend_byte(package, byte);
371         length &= (1 << PACKAGE_LENGTH_2BYTE_SHIFT) - 1;
372         /* fall through */
373     }
374     /*
375      * Most significant two bits of byte zero indicate how many following bytes
376      * are in PkgLength encoding.
377      */
378     byte = ((length_bytes - 1) << PACKAGE_LENGTH_1BYTE_SHIFT) | length;
379     build_prepend_byte(package, byte);
380 }
381 
382 static void build_package(GArray *package, uint8_t op, unsigned min_bytes)
383 {
384     build_prepend_package_length(package, min_bytes);
385     build_prepend_byte(package, op);
386 }
387 
388 static void build_extop_package(GArray *package, uint8_t op)
389 {
390     build_package(package, op, 1);
391     build_prepend_byte(package, 0x5B); /* ExtOpPrefix */
392 }
393 
394 static void build_append_value(GArray *table, uint32_t value, int size)
395 {
396     uint8_t prefix;
397     int i;
398 
399     switch (size) {
400     case 1:
401         prefix = 0x0A; /* BytePrefix */
402         break;
403     case 2:
404         prefix = 0x0B; /* WordPrefix */
405         break;
406     case 4:
407         prefix = 0x0C; /* DWordPrefix */
408         break;
409     default:
410         assert(0);
411         return;
412     }
413     build_append_byte(table, prefix);
414     for (i = 0; i < size; ++i) {
415         build_append_byte(table, value & 0xFF);
416         value = value >> 8;
417     }
418 }
419 
420 static void build_append_int(GArray *table, uint32_t value)
421 {
422     if (value == 0x00) {
423         build_append_byte(table, 0x00); /* ZeroOp */
424     } else if (value == 0x01) {
425         build_append_byte(table, 0x01); /* OneOp */
426     } else if (value <= 0xFF) {
427         build_append_value(table, value, 1);
428     } else if (value <= 0xFFFF) {
429         build_append_value(table, value, 2);
430     } else {
431         build_append_value(table, value, 4);
432     }
433 }
434 
435 static GArray *build_alloc_method(const char *name, uint8_t arg_count)
436 {
437     GArray *method = build_alloc_array();
438 
439     build_append_nameseg(method, "%s", name);
440     build_append_byte(method, arg_count); /* MethodFlags: ArgCount */
441 
442     return method;
443 }
444 
445 static void build_append_and_cleanup_method(GArray *device, GArray *method)
446 {
447     uint8_t op = 0x14; /* MethodOp */
448 
449     build_package(method, op, 0);
450 
451     build_append_array(device, method);
452     build_free_array(method);
453 }
454 
455 static void build_append_notify_target_ifequal(GArray *method,
456                                                GArray *target_name,
457                                                uint32_t value, int size)
458 {
459     GArray *notify = build_alloc_array();
460     uint8_t op = 0xA0; /* IfOp */
461 
462     build_append_byte(notify, 0x93); /* LEqualOp */
463     build_append_byte(notify, 0x68); /* Arg0Op */
464     build_append_value(notify, value, size);
465     build_append_byte(notify, 0x86); /* NotifyOp */
466     build_append_array(notify, target_name);
467     build_append_byte(notify, 0x69); /* Arg1Op */
468 
469     /* Pack it up */
470     build_package(notify, op, 1);
471 
472     build_append_array(method, notify);
473 
474     build_free_array(notify);
475 }
476 
477 /* End here */
478 #define ACPI_PORT_SMI_CMD           0x00b2 /* TODO: this is APM_CNT_IOPORT */
479 
480 static inline void *acpi_data_push(GArray *table_data, unsigned size)
481 {
482     unsigned off = table_data->len;
483     g_array_set_size(table_data, off + size);
484     return table_data->data + off;
485 }
486 
487 static unsigned acpi_data_len(GArray *table)
488 {
489 #if GLIB_CHECK_VERSION(2, 22, 0)
490     assert(g_array_get_element_size(table) == 1);
491 #endif
492     return table->len;
493 }
494 
495 static void acpi_align_size(GArray *blob, unsigned align)
496 {
497     /* Align size to multiple of given size. This reduces the chance
498      * we need to change size in the future (breaking cross version migration).
499      */
500     g_array_set_size(blob, ROUND_UP(acpi_data_len(blob), align));
501 }
502 
503 /* Set a value within table in a safe manner */
504 #define ACPI_BUILD_SET_LE(table, size, off, bits, val) \
505     do { \
506         uint64_t ACPI_BUILD_SET_LE_val = cpu_to_le64(val); \
507         memcpy(acpi_data_get_ptr(table, size, off, \
508                                  (bits) / BITS_PER_BYTE), \
509                &ACPI_BUILD_SET_LE_val, \
510                (bits) / BITS_PER_BYTE); \
511     } while (0)
512 
513 static inline void *acpi_data_get_ptr(uint8_t *table_data, unsigned table_size,
514                                       unsigned off, unsigned size)
515 {
516     assert(off + size > off);
517     assert(off + size <= table_size);
518     return table_data + off;
519 }
520 
521 static inline void acpi_add_table(GArray *table_offsets, GArray *table_data)
522 {
523     uint32_t offset = cpu_to_le32(table_data->len);
524     g_array_append_val(table_offsets, offset);
525 }
526 
527 /* FACS */
528 static void
529 build_facs(GArray *table_data, GArray *linker, PcGuestInfo *guest_info)
530 {
531     AcpiFacsDescriptorRev1 *facs = acpi_data_push(table_data, sizeof *facs);
532     memcpy(&facs->signature, "FACS", 4);
533     facs->length = cpu_to_le32(sizeof(*facs));
534 }
535 
536 /* Load chipset information in FADT */
537 static void fadt_setup(AcpiFadtDescriptorRev1 *fadt, AcpiPmInfo *pm)
538 {
539     fadt->model = 1;
540     fadt->reserved1 = 0;
541     fadt->sci_int = cpu_to_le16(pm->sci_int);
542     fadt->smi_cmd = cpu_to_le32(ACPI_PORT_SMI_CMD);
543     fadt->acpi_enable = pm->acpi_enable_cmd;
544     fadt->acpi_disable = pm->acpi_disable_cmd;
545     /* EVT, CNT, TMR offset matches hw/acpi/core.c */
546     fadt->pm1a_evt_blk = cpu_to_le32(pm->io_base);
547     fadt->pm1a_cnt_blk = cpu_to_le32(pm->io_base + 0x04);
548     fadt->pm_tmr_blk = cpu_to_le32(pm->io_base + 0x08);
549     fadt->gpe0_blk = cpu_to_le32(pm->gpe0_blk);
550     /* EVT, CNT, TMR length matches hw/acpi/core.c */
551     fadt->pm1_evt_len = 4;
552     fadt->pm1_cnt_len = 2;
553     fadt->pm_tmr_len = 4;
554     fadt->gpe0_blk_len = pm->gpe0_blk_len;
555     fadt->plvl2_lat = cpu_to_le16(0xfff); /* C2 state not supported */
556     fadt->plvl3_lat = cpu_to_le16(0xfff); /* C3 state not supported */
557     fadt->flags = cpu_to_le32((1 << ACPI_FADT_F_WBINVD) |
558                               (1 << ACPI_FADT_F_PROC_C1) |
559                               (1 << ACPI_FADT_F_SLP_BUTTON) |
560                               (1 << ACPI_FADT_F_RTC_S4));
561     fadt->flags |= cpu_to_le32(1 << ACPI_FADT_F_USE_PLATFORM_CLOCK);
562     /* APIC destination mode ("Flat Logical") has an upper limit of 8 CPUs
563      * For more than 8 CPUs, "Clustered Logical" mode has to be used
564      */
565     if (max_cpus > 8) {
566         fadt->flags |= cpu_to_le32(1 << ACPI_FADT_F_FORCE_APIC_CLUSTER_MODEL);
567     }
568 }
569 
570 
571 /* FADT */
572 static void
573 build_fadt(GArray *table_data, GArray *linker, AcpiPmInfo *pm,
574            unsigned facs, unsigned dsdt)
575 {
576     AcpiFadtDescriptorRev1 *fadt = acpi_data_push(table_data, sizeof(*fadt));
577 
578     fadt->firmware_ctrl = cpu_to_le32(facs);
579     /* FACS address to be filled by Guest linker */
580     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
581                                    ACPI_BUILD_TABLE_FILE,
582                                    table_data, &fadt->firmware_ctrl,
583                                    sizeof fadt->firmware_ctrl);
584 
585     fadt->dsdt = cpu_to_le32(dsdt);
586     /* DSDT address to be filled by Guest linker */
587     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
588                                    ACPI_BUILD_TABLE_FILE,
589                                    table_data, &fadt->dsdt,
590                                    sizeof fadt->dsdt);
591 
592     fadt_setup(fadt, pm);
593 
594     build_header(linker, table_data,
595                  (void *)fadt, "FACP", sizeof(*fadt), 1);
596 }
597 
598 static void
599 build_madt(GArray *table_data, GArray *linker, AcpiCpuInfo *cpu,
600            PcGuestInfo *guest_info)
601 {
602     int madt_start = table_data->len;
603 
604     AcpiMultipleApicTable *madt;
605     AcpiMadtIoApic *io_apic;
606     AcpiMadtIntsrcovr *intsrcovr;
607     AcpiMadtLocalNmi *local_nmi;
608     int i;
609 
610     madt = acpi_data_push(table_data, sizeof *madt);
611     madt->local_apic_address = cpu_to_le32(APIC_DEFAULT_ADDRESS);
612     madt->flags = cpu_to_le32(1);
613 
614     for (i = 0; i < guest_info->apic_id_limit; i++) {
615         AcpiMadtProcessorApic *apic = acpi_data_push(table_data, sizeof *apic);
616         apic->type = ACPI_APIC_PROCESSOR;
617         apic->length = sizeof(*apic);
618         apic->processor_id = i;
619         apic->local_apic_id = i;
620         if (test_bit(i, cpu->found_cpus)) {
621             apic->flags = cpu_to_le32(1);
622         } else {
623             apic->flags = cpu_to_le32(0);
624         }
625     }
626     io_apic = acpi_data_push(table_data, sizeof *io_apic);
627     io_apic->type = ACPI_APIC_IO;
628     io_apic->length = sizeof(*io_apic);
629 #define ACPI_BUILD_IOAPIC_ID 0x0
630     io_apic->io_apic_id = ACPI_BUILD_IOAPIC_ID;
631     io_apic->address = cpu_to_le32(IO_APIC_DEFAULT_ADDRESS);
632     io_apic->interrupt = cpu_to_le32(0);
633 
634     if (guest_info->apic_xrupt_override) {
635         intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr);
636         intsrcovr->type   = ACPI_APIC_XRUPT_OVERRIDE;
637         intsrcovr->length = sizeof(*intsrcovr);
638         intsrcovr->source = 0;
639         intsrcovr->gsi    = cpu_to_le32(2);
640         intsrcovr->flags  = cpu_to_le16(0); /* conforms to bus specifications */
641     }
642     for (i = 1; i < 16; i++) {
643 #define ACPI_BUILD_PCI_IRQS ((1<<5) | (1<<9) | (1<<10) | (1<<11))
644         if (!(ACPI_BUILD_PCI_IRQS & (1 << i))) {
645             /* No need for a INT source override structure. */
646             continue;
647         }
648         intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr);
649         intsrcovr->type   = ACPI_APIC_XRUPT_OVERRIDE;
650         intsrcovr->length = sizeof(*intsrcovr);
651         intsrcovr->source = i;
652         intsrcovr->gsi    = cpu_to_le32(i);
653         intsrcovr->flags  = cpu_to_le16(0xd); /* active high, level triggered */
654     }
655 
656     local_nmi = acpi_data_push(table_data, sizeof *local_nmi);
657     local_nmi->type         = ACPI_APIC_LOCAL_NMI;
658     local_nmi->length       = sizeof(*local_nmi);
659     local_nmi->processor_id = 0xff; /* all processors */
660     local_nmi->flags        = cpu_to_le16(0);
661     local_nmi->lint         = 1; /* ACPI_LINT1 */
662 
663     build_header(linker, table_data,
664                  (void *)(table_data->data + madt_start), "APIC",
665                  table_data->len - madt_start, 1);
666 }
667 
668 /* Encode a hex value */
669 static inline char acpi_get_hex(uint32_t val)
670 {
671     val &= 0x0f;
672     return (val <= 9) ? ('0' + val) : ('A' + val - 10);
673 }
674 
675 #include "hw/i386/ssdt-proc.hex"
676 
677 /* 0x5B 0x83 ProcessorOp PkgLength NameString ProcID */
678 #define ACPI_PROC_OFFSET_CPUHEX (*ssdt_proc_name - *ssdt_proc_start + 2)
679 #define ACPI_PROC_OFFSET_CPUID1 (*ssdt_proc_name - *ssdt_proc_start + 4)
680 #define ACPI_PROC_OFFSET_CPUID2 (*ssdt_proc_id - *ssdt_proc_start)
681 #define ACPI_PROC_SIZEOF (*ssdt_proc_end - *ssdt_proc_start)
682 #define ACPI_PROC_AML (ssdp_proc_aml + *ssdt_proc_start)
683 
684 /* 0x5B 0x82 DeviceOp PkgLength NameString */
685 #define ACPI_PCIHP_OFFSET_HEX (*ssdt_pcihp_name - *ssdt_pcihp_start + 1)
686 #define ACPI_PCIHP_OFFSET_ID (*ssdt_pcihp_id - *ssdt_pcihp_start)
687 #define ACPI_PCIHP_OFFSET_ADR (*ssdt_pcihp_adr - *ssdt_pcihp_start)
688 #define ACPI_PCIHP_OFFSET_EJ0 (*ssdt_pcihp_ej0 - *ssdt_pcihp_start)
689 #define ACPI_PCIHP_SIZEOF (*ssdt_pcihp_end - *ssdt_pcihp_start)
690 #define ACPI_PCIHP_AML (ssdp_pcihp_aml + *ssdt_pcihp_start)
691 
692 #define ACPI_PCINOHP_OFFSET_HEX (*ssdt_pcinohp_name - *ssdt_pcinohp_start + 1)
693 #define ACPI_PCINOHP_OFFSET_ADR (*ssdt_pcinohp_adr - *ssdt_pcinohp_start)
694 #define ACPI_PCINOHP_SIZEOF (*ssdt_pcinohp_end - *ssdt_pcinohp_start)
695 #define ACPI_PCINOHP_AML (ssdp_pcihp_aml + *ssdt_pcinohp_start)
696 
697 #define ACPI_PCIVGA_OFFSET_HEX (*ssdt_pcivga_name - *ssdt_pcivga_start + 1)
698 #define ACPI_PCIVGA_OFFSET_ADR (*ssdt_pcivga_adr - *ssdt_pcivga_start)
699 #define ACPI_PCIVGA_SIZEOF (*ssdt_pcivga_end - *ssdt_pcivga_start)
700 #define ACPI_PCIVGA_AML (ssdp_pcihp_aml + *ssdt_pcivga_start)
701 
702 #define ACPI_PCIQXL_OFFSET_HEX (*ssdt_pciqxl_name - *ssdt_pciqxl_start + 1)
703 #define ACPI_PCIQXL_OFFSET_ADR (*ssdt_pciqxl_adr - *ssdt_pciqxl_start)
704 #define ACPI_PCIQXL_SIZEOF (*ssdt_pciqxl_end - *ssdt_pciqxl_start)
705 #define ACPI_PCIQXL_AML (ssdp_pcihp_aml + *ssdt_pciqxl_start)
706 
707 #include "hw/i386/ssdt-mem.hex"
708 
709 /* 0x5B 0x82 DeviceOp PkgLength NameString DimmID */
710 #define ACPI_MEM_OFFSET_HEX (*ssdt_mem_name - *ssdt_mem_start + 2)
711 #define ACPI_MEM_OFFSET_ID (*ssdt_mem_id - *ssdt_mem_start + 7)
712 #define ACPI_MEM_SIZEOF (*ssdt_mem_end - *ssdt_mem_start)
713 #define ACPI_MEM_AML (ssdm_mem_aml + *ssdt_mem_start)
714 
715 #define ACPI_SSDT_SIGNATURE 0x54445353 /* SSDT */
716 #define ACPI_SSDT_HEADER_LENGTH 36
717 
718 #include "hw/i386/ssdt-misc.hex"
719 #include "hw/i386/ssdt-pcihp.hex"
720 #include "hw/i386/ssdt-tpm.hex"
721 
722 static void
723 build_append_notify_method(GArray *device, const char *name,
724                            const char *format, int count)
725 {
726     int i;
727     GArray *method = build_alloc_method(name, 2);
728 
729     for (i = 0; i < count; i++) {
730         GArray *target = build_alloc_array();
731         build_append_nameseg(target, format, i);
732         assert(i < 256); /* Fits in 1 byte */
733         build_append_notify_target_ifequal(method, target, i, 1);
734         build_free_array(target);
735     }
736 
737     build_append_and_cleanup_method(device, method);
738 }
739 
740 static void patch_pcihp(int slot, uint8_t *ssdt_ptr)
741 {
742     unsigned devfn = PCI_DEVFN(slot, 0);
743 
744     ssdt_ptr[ACPI_PCIHP_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
745     ssdt_ptr[ACPI_PCIHP_OFFSET_HEX + 1] = acpi_get_hex(devfn);
746     ssdt_ptr[ACPI_PCIHP_OFFSET_ID] = slot;
747     ssdt_ptr[ACPI_PCIHP_OFFSET_ADR + 2] = slot;
748 }
749 
750 static void patch_pcinohp(int slot, uint8_t *ssdt_ptr)
751 {
752     unsigned devfn = PCI_DEVFN(slot, 0);
753 
754     ssdt_ptr[ACPI_PCINOHP_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
755     ssdt_ptr[ACPI_PCINOHP_OFFSET_HEX + 1] = acpi_get_hex(devfn);
756     ssdt_ptr[ACPI_PCINOHP_OFFSET_ADR + 2] = slot;
757 }
758 
759 static void patch_pcivga(int slot, uint8_t *ssdt_ptr)
760 {
761     unsigned devfn = PCI_DEVFN(slot, 0);
762 
763     ssdt_ptr[ACPI_PCIVGA_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
764     ssdt_ptr[ACPI_PCIVGA_OFFSET_HEX + 1] = acpi_get_hex(devfn);
765     ssdt_ptr[ACPI_PCIVGA_OFFSET_ADR + 2] = slot;
766 }
767 
768 static void patch_pciqxl(int slot, uint8_t *ssdt_ptr)
769 {
770     unsigned devfn = PCI_DEVFN(slot, 0);
771 
772     ssdt_ptr[ACPI_PCIQXL_OFFSET_HEX] = acpi_get_hex(devfn >> 4);
773     ssdt_ptr[ACPI_PCIQXL_OFFSET_HEX + 1] = acpi_get_hex(devfn);
774     ssdt_ptr[ACPI_PCIQXL_OFFSET_ADR + 2] = slot;
775 }
776 
777 /* Assign BSEL property to all buses.  In the future, this can be changed
778  * to only assign to buses that support hotplug.
779  */
780 static void *acpi_set_bsel(PCIBus *bus, void *opaque)
781 {
782     unsigned *bsel_alloc = opaque;
783     unsigned *bus_bsel;
784 
785     if (qbus_is_hotpluggable(BUS(bus))) {
786         bus_bsel = g_malloc(sizeof *bus_bsel);
787 
788         *bus_bsel = (*bsel_alloc)++;
789         object_property_add_uint32_ptr(OBJECT(bus), ACPI_PCIHP_PROP_BSEL,
790                                        bus_bsel, NULL);
791     }
792 
793     return bsel_alloc;
794 }
795 
796 static void acpi_set_pci_info(void)
797 {
798     PCIBus *bus = find_i440fx(); /* TODO: Q35 support */
799     unsigned bsel_alloc = 0;
800 
801     if (bus) {
802         /* Scan all PCI buses. Set property to enable acpi based hotplug. */
803         pci_for_each_bus_depth_first(bus, acpi_set_bsel, NULL, &bsel_alloc);
804     }
805 }
806 
807 static void build_pci_bus_state_init(AcpiBuildPciBusHotplugState *state,
808                                      AcpiBuildPciBusHotplugState *parent,
809                                      bool pcihp_bridge_en)
810 {
811     state->parent = parent;
812     state->device_table = build_alloc_array();
813     state->notify_table = build_alloc_array();
814     state->pcihp_bridge_en = pcihp_bridge_en;
815 }
816 
817 static void build_pci_bus_state_cleanup(AcpiBuildPciBusHotplugState *state)
818 {
819     build_free_array(state->device_table);
820     build_free_array(state->notify_table);
821 }
822 
823 static void *build_pci_bus_begin(PCIBus *bus, void *parent_state)
824 {
825     AcpiBuildPciBusHotplugState *parent = parent_state;
826     AcpiBuildPciBusHotplugState *child = g_malloc(sizeof *child);
827 
828     build_pci_bus_state_init(child, parent, parent->pcihp_bridge_en);
829 
830     return child;
831 }
832 
833 static void build_pci_bus_end(PCIBus *bus, void *bus_state)
834 {
835     AcpiBuildPciBusHotplugState *child = bus_state;
836     AcpiBuildPciBusHotplugState *parent = child->parent;
837     GArray *bus_table = build_alloc_array();
838     DECLARE_BITMAP(slot_hotplug_enable, PCI_SLOT_MAX);
839     DECLARE_BITMAP(slot_device_present, PCI_SLOT_MAX);
840     DECLARE_BITMAP(slot_device_system, PCI_SLOT_MAX);
841     DECLARE_BITMAP(slot_device_vga, PCI_SLOT_MAX);
842     DECLARE_BITMAP(slot_device_qxl, PCI_SLOT_MAX);
843     uint8_t op;
844     int i;
845     QObject *bsel;
846     GArray *method;
847     bool bus_hotplug_support = false;
848 
849     /*
850      * Skip bridge subtree creation if bridge hotplug is disabled
851      * to make acpi tables compatible with legacy machine types.
852      */
853     if (!child->pcihp_bridge_en && bus->parent_dev) {
854         return;
855     }
856 
857     if (bus->parent_dev) {
858         op = 0x82; /* DeviceOp */
859         build_append_nameseg(bus_table, "S%.02X_",
860                              bus->parent_dev->devfn);
861         build_append_byte(bus_table, 0x08); /* NameOp */
862         build_append_nameseg(bus_table, "_SUN");
863         build_append_value(bus_table, PCI_SLOT(bus->parent_dev->devfn), 1);
864         build_append_byte(bus_table, 0x08); /* NameOp */
865         build_append_nameseg(bus_table, "_ADR");
866         build_append_value(bus_table, (PCI_SLOT(bus->parent_dev->devfn) << 16) |
867                            PCI_FUNC(bus->parent_dev->devfn), 4);
868     } else {
869         op = 0x10; /* ScopeOp */;
870         build_append_nameseg(bus_table, "PCI0");
871     }
872 
873     bsel = object_property_get_qobject(OBJECT(bus), ACPI_PCIHP_PROP_BSEL, NULL);
874     if (bsel) {
875         build_append_byte(bus_table, 0x08); /* NameOp */
876         build_append_nameseg(bus_table, "BSEL");
877         build_append_int(bus_table, qint_get_int(qobject_to_qint(bsel)));
878         memset(slot_hotplug_enable, 0xff, sizeof slot_hotplug_enable);
879     } else {
880         /* No bsel - no slots are hot-pluggable */
881         memset(slot_hotplug_enable, 0x00, sizeof slot_hotplug_enable);
882     }
883 
884     memset(slot_device_present, 0x00, sizeof slot_device_present);
885     memset(slot_device_system, 0x00, sizeof slot_device_present);
886     memset(slot_device_vga, 0x00, sizeof slot_device_vga);
887     memset(slot_device_qxl, 0x00, sizeof slot_device_qxl);
888 
889     for (i = 0; i < ARRAY_SIZE(bus->devices); i += PCI_FUNC_MAX) {
890         DeviceClass *dc;
891         PCIDeviceClass *pc;
892         PCIDevice *pdev = bus->devices[i];
893         int slot = PCI_SLOT(i);
894         bool bridge_in_acpi;
895 
896         if (!pdev) {
897             continue;
898         }
899 
900         set_bit(slot, slot_device_present);
901         pc = PCI_DEVICE_GET_CLASS(pdev);
902         dc = DEVICE_GET_CLASS(pdev);
903 
904         /* When hotplug for bridges is enabled, bridges are
905          * described in ACPI separately (see build_pci_bus_end).
906          * In this case they aren't themselves hot-pluggable.
907          */
908         bridge_in_acpi = pc->is_bridge && child->pcihp_bridge_en;
909 
910         if (pc->class_id == PCI_CLASS_BRIDGE_ISA || bridge_in_acpi) {
911             set_bit(slot, slot_device_system);
912         }
913 
914         if (pc->class_id == PCI_CLASS_DISPLAY_VGA) {
915             set_bit(slot, slot_device_vga);
916 
917             if (object_dynamic_cast(OBJECT(pdev), "qxl-vga")) {
918                 set_bit(slot, slot_device_qxl);
919             }
920         }
921 
922         if (!dc->hotpluggable || bridge_in_acpi) {
923             clear_bit(slot, slot_hotplug_enable);
924         }
925     }
926 
927     /* Append Device object for each slot */
928     for (i = 0; i < PCI_SLOT_MAX; i++) {
929         bool can_eject = test_bit(i, slot_hotplug_enable);
930         bool present = test_bit(i, slot_device_present);
931         bool vga = test_bit(i, slot_device_vga);
932         bool qxl = test_bit(i, slot_device_qxl);
933         bool system = test_bit(i, slot_device_system);
934         if (can_eject) {
935             void *pcihp = acpi_data_push(bus_table,
936                                          ACPI_PCIHP_SIZEOF);
937             memcpy(pcihp, ACPI_PCIHP_AML, ACPI_PCIHP_SIZEOF);
938             patch_pcihp(i, pcihp);
939             bus_hotplug_support = true;
940         } else if (qxl) {
941             void *pcihp = acpi_data_push(bus_table,
942                                          ACPI_PCIQXL_SIZEOF);
943             memcpy(pcihp, ACPI_PCIQXL_AML, ACPI_PCIQXL_SIZEOF);
944             patch_pciqxl(i, pcihp);
945         } else if (vga) {
946             void *pcihp = acpi_data_push(bus_table,
947                                          ACPI_PCIVGA_SIZEOF);
948             memcpy(pcihp, ACPI_PCIVGA_AML, ACPI_PCIVGA_SIZEOF);
949             patch_pcivga(i, pcihp);
950         } else if (system) {
951             /* Nothing to do: system devices are in DSDT or in SSDT above. */
952         } else if (present) {
953             void *pcihp = acpi_data_push(bus_table,
954                                          ACPI_PCINOHP_SIZEOF);
955             memcpy(pcihp, ACPI_PCINOHP_AML, ACPI_PCINOHP_SIZEOF);
956             patch_pcinohp(i, pcihp);
957         }
958     }
959 
960     if (bsel) {
961         method = build_alloc_method("DVNT", 2);
962 
963         for (i = 0; i < PCI_SLOT_MAX; i++) {
964             GArray *notify;
965             uint8_t op;
966 
967             if (!test_bit(i, slot_hotplug_enable)) {
968                 continue;
969             }
970 
971             notify = build_alloc_array();
972             op = 0xA0; /* IfOp */
973 
974             build_append_byte(notify, 0x7B); /* AndOp */
975             build_append_byte(notify, 0x68); /* Arg0Op */
976             build_append_int(notify, 0x1U << i);
977             build_append_byte(notify, 0x00); /* NullName */
978             build_append_byte(notify, 0x86); /* NotifyOp */
979             build_append_nameseg(notify, "S%.02X_", PCI_DEVFN(i, 0));
980             build_append_byte(notify, 0x69); /* Arg1Op */
981 
982             /* Pack it up */
983             build_package(notify, op, 0);
984 
985             build_append_array(method, notify);
986 
987             build_free_array(notify);
988         }
989 
990         build_append_and_cleanup_method(bus_table, method);
991     }
992 
993     /* Append PCNT method to notify about events on local and child buses.
994      * Add unconditionally for root since DSDT expects it.
995      */
996     if (bus_hotplug_support || child->notify_table->len || !bus->parent_dev) {
997         method = build_alloc_method("PCNT", 0);
998 
999         /* If bus supports hotplug select it and notify about local events */
1000         if (bsel) {
1001             build_append_byte(method, 0x70); /* StoreOp */
1002             build_append_int(method, qint_get_int(qobject_to_qint(bsel)));
1003             build_append_nameseg(method, "BNUM");
1004             build_append_nameseg(method, "DVNT");
1005             build_append_nameseg(method, "PCIU");
1006             build_append_int(method, 1); /* Device Check */
1007             build_append_nameseg(method, "DVNT");
1008             build_append_nameseg(method, "PCID");
1009             build_append_int(method, 3); /* Eject Request */
1010         }
1011 
1012         /* Notify about child bus events in any case */
1013         build_append_array(method, child->notify_table);
1014 
1015         build_append_and_cleanup_method(bus_table, method);
1016 
1017         /* Append description of child buses */
1018         build_append_array(bus_table, child->device_table);
1019 
1020         /* Pack it up */
1021         if (bus->parent_dev) {
1022             build_extop_package(bus_table, op);
1023         } else {
1024             build_package(bus_table, op, 0);
1025         }
1026 
1027         /* Append our bus description to parent table */
1028         build_append_array(parent->device_table, bus_table);
1029 
1030         /* Also tell parent how to notify us, invoking PCNT method.
1031          * At the moment this is not needed for root as we have a single root.
1032          */
1033         if (bus->parent_dev) {
1034             build_append_byte(parent->notify_table, '^'); /* ParentPrefixChar */
1035             build_append_byte(parent->notify_table, 0x2E); /* DualNamePrefix */
1036             build_append_nameseg(parent->notify_table, "S%.02X_",
1037                                  bus->parent_dev->devfn);
1038             build_append_nameseg(parent->notify_table, "PCNT");
1039         }
1040     }
1041 
1042     qobject_decref(bsel);
1043     build_free_array(bus_table);
1044     build_pci_bus_state_cleanup(child);
1045     g_free(child);
1046 }
1047 
1048 static void patch_pci_windows(PcPciInfo *pci, uint8_t *start, unsigned size)
1049 {
1050     ACPI_BUILD_SET_LE(start, size, acpi_pci32_start[0], 32, pci->w32.begin);
1051 
1052     ACPI_BUILD_SET_LE(start, size, acpi_pci32_end[0], 32, pci->w32.end - 1);
1053 
1054     if (pci->w64.end || pci->w64.begin) {
1055         ACPI_BUILD_SET_LE(start, size, acpi_pci64_valid[0], 8, 1);
1056         ACPI_BUILD_SET_LE(start, size, acpi_pci64_start[0], 64, pci->w64.begin);
1057         ACPI_BUILD_SET_LE(start, size, acpi_pci64_end[0], 64, pci->w64.end - 1);
1058         ACPI_BUILD_SET_LE(start, size, acpi_pci64_length[0], 64, pci->w64.end - pci->w64.begin);
1059     } else {
1060         ACPI_BUILD_SET_LE(start, size, acpi_pci64_valid[0], 8, 0);
1061     }
1062 }
1063 
1064 static void
1065 build_ssdt(GArray *table_data, GArray *linker,
1066            AcpiCpuInfo *cpu, AcpiPmInfo *pm, AcpiMiscInfo *misc,
1067            PcPciInfo *pci, PcGuestInfo *guest_info)
1068 {
1069     MachineState *machine = MACHINE(qdev_get_machine());
1070     uint32_t nr_mem = machine->ram_slots;
1071     unsigned acpi_cpus = guest_info->apic_id_limit;
1072     int ssdt_start = table_data->len;
1073     uint8_t *ssdt_ptr;
1074     int i;
1075 
1076     /* The current AML generator can cover the APIC ID range [0..255],
1077      * inclusive, for VCPU hotplug. */
1078     QEMU_BUILD_BUG_ON(ACPI_CPU_HOTPLUG_ID_LIMIT > 256);
1079     g_assert(acpi_cpus <= ACPI_CPU_HOTPLUG_ID_LIMIT);
1080 
1081     /* Copy header and patch values in the S3_ / S4_ / S5_ packages */
1082     ssdt_ptr = acpi_data_push(table_data, sizeof(ssdp_misc_aml));
1083     memcpy(ssdt_ptr, ssdp_misc_aml, sizeof(ssdp_misc_aml));
1084     if (pm->s3_disabled) {
1085         ssdt_ptr[acpi_s3_name[0]] = 'X';
1086     }
1087     if (pm->s4_disabled) {
1088         ssdt_ptr[acpi_s4_name[0]] = 'X';
1089     } else {
1090         ssdt_ptr[acpi_s4_pkg[0] + 1] = ssdt_ptr[acpi_s4_pkg[0] + 3] =
1091             pm->s4_val;
1092     }
1093 
1094     patch_pci_windows(pci, ssdt_ptr, sizeof(ssdp_misc_aml));
1095 
1096     ACPI_BUILD_SET_LE(ssdt_ptr, sizeof(ssdp_misc_aml),
1097                       ssdt_isa_pest[0], 16, misc->pvpanic_port);
1098 
1099     ACPI_BUILD_SET_LE(ssdt_ptr, sizeof(ssdp_misc_aml),
1100                       ssdt_mctrl_nr_slots[0], 32, nr_mem);
1101 
1102     {
1103         GArray *sb_scope = build_alloc_array();
1104         uint8_t op = 0x10; /* ScopeOp */
1105 
1106         build_append_nameseg(sb_scope, "_SB_");
1107 
1108         /* build Processor object for each processor */
1109         for (i = 0; i < acpi_cpus; i++) {
1110             uint8_t *proc = acpi_data_push(sb_scope, ACPI_PROC_SIZEOF);
1111             memcpy(proc, ACPI_PROC_AML, ACPI_PROC_SIZEOF);
1112             proc[ACPI_PROC_OFFSET_CPUHEX] = acpi_get_hex(i >> 4);
1113             proc[ACPI_PROC_OFFSET_CPUHEX+1] = acpi_get_hex(i);
1114             proc[ACPI_PROC_OFFSET_CPUID1] = i;
1115             proc[ACPI_PROC_OFFSET_CPUID2] = i;
1116         }
1117 
1118         /* build this code:
1119          *   Method(NTFY, 2) {If (LEqual(Arg0, 0x00)) {Notify(CP00, Arg1)} ...}
1120          */
1121         /* Arg0 = Processor ID = APIC ID */
1122         build_append_notify_method(sb_scope, "NTFY", "CP%0.02X", acpi_cpus);
1123 
1124         /* build "Name(CPON, Package() { One, One, ..., Zero, Zero, ... })" */
1125         build_append_byte(sb_scope, 0x08); /* NameOp */
1126         build_append_nameseg(sb_scope, "CPON");
1127 
1128         {
1129             GArray *package = build_alloc_array();
1130             uint8_t op;
1131 
1132             /*
1133              * Note: The ability to create variable-sized packages was first introduced in ACPI 2.0. ACPI 1.0 only
1134              * allowed fixed-size packages with up to 255 elements.
1135              * Windows guests up to win2k8 fail when VarPackageOp is used.
1136              */
1137             if (acpi_cpus <= 255) {
1138                 op = 0x12; /* PackageOp */
1139                 build_append_byte(package, acpi_cpus); /* NumElements */
1140             } else {
1141                 op = 0x13; /* VarPackageOp */
1142                 build_append_int(package, acpi_cpus); /* VarNumElements */
1143             }
1144 
1145             for (i = 0; i < acpi_cpus; i++) {
1146                 uint8_t b = test_bit(i, cpu->found_cpus) ? 0x01 : 0x00;
1147                 build_append_byte(package, b);
1148             }
1149 
1150             build_package(package, op, 2);
1151             build_append_array(sb_scope, package);
1152             build_free_array(package);
1153         }
1154 
1155         if (nr_mem) {
1156             assert(nr_mem <= ACPI_MAX_RAM_SLOTS);
1157             /* build memory devices */
1158             for (i = 0; i < nr_mem; i++) {
1159                 char id[3];
1160                 uint8_t *mem = acpi_data_push(sb_scope, ACPI_MEM_SIZEOF);
1161 
1162                 snprintf(id, sizeof(id), "%02X", i);
1163                 memcpy(mem, ACPI_MEM_AML, ACPI_MEM_SIZEOF);
1164                 memcpy(mem + ACPI_MEM_OFFSET_HEX, id, 2);
1165                 memcpy(mem + ACPI_MEM_OFFSET_ID, id, 2);
1166             }
1167 
1168             /* build Method(MEMORY_SLOT_NOTIFY_METHOD, 2) {
1169              *     If (LEqual(Arg0, 0x00)) {Notify(MP00, Arg1)} ...
1170              */
1171             build_append_notify_method(sb_scope,
1172                                        stringify(MEMORY_SLOT_NOTIFY_METHOD),
1173                                        "MP%0.02X", nr_mem);
1174         }
1175 
1176         {
1177             AcpiBuildPciBusHotplugState hotplug_state;
1178             Object *pci_host;
1179             PCIBus *bus = NULL;
1180             bool ambiguous;
1181 
1182             pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
1183             if (!ambiguous && pci_host) {
1184                 bus = PCI_HOST_BRIDGE(pci_host)->bus;
1185             }
1186 
1187             build_pci_bus_state_init(&hotplug_state, NULL, pm->pcihp_bridge_en);
1188 
1189             if (bus) {
1190                 /* Scan all PCI buses. Generate tables to support hotplug. */
1191                 pci_for_each_bus_depth_first(bus, build_pci_bus_begin,
1192                                              build_pci_bus_end, &hotplug_state);
1193             }
1194 
1195             build_append_array(sb_scope, hotplug_state.device_table);
1196             build_pci_bus_state_cleanup(&hotplug_state);
1197         }
1198 
1199         build_package(sb_scope, op, 3);
1200         build_append_array(table_data, sb_scope);
1201         build_free_array(sb_scope);
1202     }
1203 
1204     build_header(linker, table_data,
1205                  (void *)(table_data->data + ssdt_start),
1206                  "SSDT", table_data->len - ssdt_start, 1);
1207 }
1208 
1209 static void
1210 build_hpet(GArray *table_data, GArray *linker)
1211 {
1212     Acpi20Hpet *hpet;
1213 
1214     hpet = acpi_data_push(table_data, sizeof(*hpet));
1215     /* Note timer_block_id value must be kept in sync with value advertised by
1216      * emulated hpet
1217      */
1218     hpet->timer_block_id = cpu_to_le32(0x8086a201);
1219     hpet->addr.address = cpu_to_le64(HPET_BASE);
1220     build_header(linker, table_data,
1221                  (void *)hpet, "HPET", sizeof(*hpet), 1);
1222 }
1223 
1224 static void
1225 build_tpm_tcpa(GArray *table_data, GArray *linker, GArray *tcpalog)
1226 {
1227     Acpi20Tcpa *tcpa = acpi_data_push(table_data, sizeof *tcpa);
1228     uint64_t log_area_start_address = acpi_data_len(tcpalog);
1229 
1230     tcpa->platform_class = cpu_to_le16(TPM_TCPA_ACPI_CLASS_CLIENT);
1231     tcpa->log_area_minimum_length = cpu_to_le32(TPM_LOG_AREA_MINIMUM_SIZE);
1232     tcpa->log_area_start_address = cpu_to_le64(log_area_start_address);
1233 
1234     bios_linker_loader_alloc(linker, ACPI_BUILD_TPMLOG_FILE, 1,
1235                              false /* high memory */);
1236 
1237     /* log area start address to be filled by Guest linker */
1238     bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
1239                                    ACPI_BUILD_TPMLOG_FILE,
1240                                    table_data, &tcpa->log_area_start_address,
1241                                    sizeof(tcpa->log_area_start_address));
1242 
1243     build_header(linker, table_data,
1244                  (void *)tcpa, "TCPA", sizeof(*tcpa), 2);
1245 
1246     acpi_data_push(tcpalog, TPM_LOG_AREA_MINIMUM_SIZE);
1247 }
1248 
1249 static void
1250 build_tpm_ssdt(GArray *table_data, GArray *linker)
1251 {
1252     void *tpm_ptr;
1253 
1254     tpm_ptr = acpi_data_push(table_data, sizeof(ssdt_tpm_aml));
1255     memcpy(tpm_ptr, ssdt_tpm_aml, sizeof(ssdt_tpm_aml));
1256 }
1257 
1258 typedef enum {
1259     MEM_AFFINITY_NOFLAGS      = 0,
1260     MEM_AFFINITY_ENABLED      = (1 << 0),
1261     MEM_AFFINITY_HOTPLUGGABLE = (1 << 1),
1262     MEM_AFFINITY_NON_VOLATILE = (1 << 2),
1263 } MemoryAffinityFlags;
1264 
1265 static void
1266 acpi_build_srat_memory(AcpiSratMemoryAffinity *numamem, uint64_t base,
1267                        uint64_t len, int node, MemoryAffinityFlags flags)
1268 {
1269     numamem->type = ACPI_SRAT_MEMORY;
1270     numamem->length = sizeof(*numamem);
1271     memset(numamem->proximity, 0, 4);
1272     numamem->proximity[0] = node;
1273     numamem->flags = cpu_to_le32(flags);
1274     numamem->base_addr = cpu_to_le64(base);
1275     numamem->range_length = cpu_to_le64(len);
1276 }
1277 
1278 static void
1279 build_srat(GArray *table_data, GArray *linker, PcGuestInfo *guest_info)
1280 {
1281     AcpiSystemResourceAffinityTable *srat;
1282     AcpiSratProcessorAffinity *core;
1283     AcpiSratMemoryAffinity *numamem;
1284 
1285     int i;
1286     uint64_t curnode;
1287     int srat_start, numa_start, slots;
1288     uint64_t mem_len, mem_base, next_base;
1289     PCMachineState *pcms = PC_MACHINE(qdev_get_machine());
1290     ram_addr_t hotplugabble_address_space_size =
1291         object_property_get_int(OBJECT(pcms), PC_MACHINE_MEMHP_REGION_SIZE,
1292                                 NULL);
1293 
1294     srat_start = table_data->len;
1295 
1296     srat = acpi_data_push(table_data, sizeof *srat);
1297     srat->reserved1 = cpu_to_le32(1);
1298     core = (void *)(srat + 1);
1299 
1300     for (i = 0; i < guest_info->apic_id_limit; ++i) {
1301         core = acpi_data_push(table_data, sizeof *core);
1302         core->type = ACPI_SRAT_PROCESSOR;
1303         core->length = sizeof(*core);
1304         core->local_apic_id = i;
1305         curnode = guest_info->node_cpu[i];
1306         core->proximity_lo = curnode;
1307         memset(core->proximity_hi, 0, 3);
1308         core->local_sapic_eid = 0;
1309         core->flags = cpu_to_le32(1);
1310     }
1311 
1312 
1313     /* the memory map is a bit tricky, it contains at least one hole
1314      * from 640k-1M and possibly another one from 3.5G-4G.
1315      */
1316     next_base = 0;
1317     numa_start = table_data->len;
1318 
1319     numamem = acpi_data_push(table_data, sizeof *numamem);
1320     acpi_build_srat_memory(numamem, 0, 640*1024, 0, MEM_AFFINITY_ENABLED);
1321     next_base = 1024 * 1024;
1322     for (i = 1; i < guest_info->numa_nodes + 1; ++i) {
1323         mem_base = next_base;
1324         mem_len = guest_info->node_mem[i - 1];
1325         if (i == 1) {
1326             mem_len -= 1024 * 1024;
1327         }
1328         next_base = mem_base + mem_len;
1329 
1330         /* Cut out the ACPI_PCI hole */
1331         if (mem_base <= guest_info->ram_size_below_4g &&
1332             next_base > guest_info->ram_size_below_4g) {
1333             mem_len -= next_base - guest_info->ram_size_below_4g;
1334             if (mem_len > 0) {
1335                 numamem = acpi_data_push(table_data, sizeof *numamem);
1336                 acpi_build_srat_memory(numamem, mem_base, mem_len, i - 1,
1337                                        MEM_AFFINITY_ENABLED);
1338             }
1339             mem_base = 1ULL << 32;
1340             mem_len = next_base - guest_info->ram_size_below_4g;
1341             next_base += (1ULL << 32) - guest_info->ram_size_below_4g;
1342         }
1343         numamem = acpi_data_push(table_data, sizeof *numamem);
1344         acpi_build_srat_memory(numamem, mem_base, mem_len, i - 1,
1345                                MEM_AFFINITY_ENABLED);
1346     }
1347     slots = (table_data->len - numa_start) / sizeof *numamem;
1348     for (; slots < guest_info->numa_nodes + 2; slots++) {
1349         numamem = acpi_data_push(table_data, sizeof *numamem);
1350         acpi_build_srat_memory(numamem, 0, 0, 0, MEM_AFFINITY_NOFLAGS);
1351     }
1352 
1353     /*
1354      * Entry is required for Windows to enable memory hotplug in OS.
1355      * Memory devices may override proximity set by this entry,
1356      * providing _PXM method if necessary.
1357      */
1358     if (hotplugabble_address_space_size) {
1359         numamem = acpi_data_push(table_data, sizeof *numamem);
1360         acpi_build_srat_memory(numamem, pcms->hotplug_memory_base,
1361                                hotplugabble_address_space_size, 0,
1362                                MEM_AFFINITY_HOTPLUGGABLE |
1363                                MEM_AFFINITY_ENABLED);
1364     }
1365 
1366     build_header(linker, table_data,
1367                  (void *)(table_data->data + srat_start),
1368                  "SRAT",
1369                  table_data->len - srat_start, 1);
1370 }
1371 
1372 static void
1373 build_mcfg_q35(GArray *table_data, GArray *linker, AcpiMcfgInfo *info)
1374 {
1375     AcpiTableMcfg *mcfg;
1376     const char *sig;
1377     int len = sizeof(*mcfg) + 1 * sizeof(mcfg->allocation[0]);
1378 
1379     mcfg = acpi_data_push(table_data, len);
1380     mcfg->allocation[0].address = cpu_to_le64(info->mcfg_base);
1381     /* Only a single allocation so no need to play with segments */
1382     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
1383     mcfg->allocation[0].start_bus_number = 0;
1384     mcfg->allocation[0].end_bus_number = PCIE_MMCFG_BUS(info->mcfg_size - 1);
1385 
1386     /* MCFG is used for ECAM which can be enabled or disabled by guest.
1387      * To avoid table size changes (which create migration issues),
1388      * always create the table even if there are no allocations,
1389      * but set the signature to a reserved value in this case.
1390      * ACPI spec requires OSPMs to ignore such tables.
1391      */
1392     if (info->mcfg_base == PCIE_BASE_ADDR_UNMAPPED) {
1393         /* Reserved signature: ignored by OSPM */
1394         sig = "QEMU";
1395     } else {
1396         sig = "MCFG";
1397     }
1398     build_header(linker, table_data, (void *)mcfg, sig, len, 1);
1399 }
1400 
1401 static void
1402 build_dmar_q35(GArray *table_data, GArray *linker)
1403 {
1404     int dmar_start = table_data->len;
1405 
1406     AcpiTableDmar *dmar;
1407     AcpiDmarHardwareUnit *drhd;
1408 
1409     dmar = acpi_data_push(table_data, sizeof(*dmar));
1410     dmar->host_address_width = VTD_HOST_ADDRESS_WIDTH - 1;
1411     dmar->flags = 0;    /* No intr_remap for now */
1412 
1413     /* DMAR Remapping Hardware Unit Definition structure */
1414     drhd = acpi_data_push(table_data, sizeof(*drhd));
1415     drhd->type = cpu_to_le16(ACPI_DMAR_TYPE_HARDWARE_UNIT);
1416     drhd->length = cpu_to_le16(sizeof(*drhd));   /* No device scope now */
1417     drhd->flags = ACPI_DMAR_INCLUDE_PCI_ALL;
1418     drhd->pci_segment = cpu_to_le16(0);
1419     drhd->address = cpu_to_le64(Q35_HOST_BRIDGE_IOMMU_ADDR);
1420 
1421     build_header(linker, table_data, (void *)(table_data->data + dmar_start),
1422                  "DMAR", table_data->len - dmar_start, 1);
1423 }
1424 
1425 static void
1426 build_dsdt(GArray *table_data, GArray *linker, AcpiMiscInfo *misc)
1427 {
1428     AcpiTableHeader *dsdt;
1429 
1430     assert(misc->dsdt_code && misc->dsdt_size);
1431 
1432     dsdt = acpi_data_push(table_data, misc->dsdt_size);
1433     memcpy(dsdt, misc->dsdt_code, misc->dsdt_size);
1434 
1435     memset(dsdt, 0, sizeof *dsdt);
1436     build_header(linker, table_data, dsdt, "DSDT",
1437                  misc->dsdt_size, 1);
1438 }
1439 
1440 /* Build final rsdt table */
1441 static void
1442 build_rsdt(GArray *table_data, GArray *linker, GArray *table_offsets)
1443 {
1444     AcpiRsdtDescriptorRev1 *rsdt;
1445     size_t rsdt_len;
1446     int i;
1447 
1448     rsdt_len = sizeof(*rsdt) + sizeof(uint32_t) * table_offsets->len;
1449     rsdt = acpi_data_push(table_data, rsdt_len);
1450     memcpy(rsdt->table_offset_entry, table_offsets->data,
1451            sizeof(uint32_t) * table_offsets->len);
1452     for (i = 0; i < table_offsets->len; ++i) {
1453         /* rsdt->table_offset_entry to be filled by Guest linker */
1454         bios_linker_loader_add_pointer(linker,
1455                                        ACPI_BUILD_TABLE_FILE,
1456                                        ACPI_BUILD_TABLE_FILE,
1457                                        table_data, &rsdt->table_offset_entry[i],
1458                                        sizeof(uint32_t));
1459     }
1460     build_header(linker, table_data,
1461                  (void *)rsdt, "RSDT", rsdt_len, 1);
1462 }
1463 
1464 static GArray *
1465 build_rsdp(GArray *rsdp_table, GArray *linker, unsigned rsdt)
1466 {
1467     AcpiRsdpDescriptor *rsdp = acpi_data_push(rsdp_table, sizeof *rsdp);
1468 
1469     bios_linker_loader_alloc(linker, ACPI_BUILD_RSDP_FILE, 16,
1470                              true /* fseg memory */);
1471 
1472     memcpy(&rsdp->signature, "RSD PTR ", 8);
1473     memcpy(rsdp->oem_id, ACPI_BUILD_APPNAME6, 6);
1474     rsdp->rsdt_physical_address = cpu_to_le32(rsdt);
1475     /* Address to be filled by Guest linker */
1476     bios_linker_loader_add_pointer(linker, ACPI_BUILD_RSDP_FILE,
1477                                    ACPI_BUILD_TABLE_FILE,
1478                                    rsdp_table, &rsdp->rsdt_physical_address,
1479                                    sizeof rsdp->rsdt_physical_address);
1480     rsdp->checksum = 0;
1481     /* Checksum to be filled by Guest linker */
1482     bios_linker_loader_add_checksum(linker, ACPI_BUILD_RSDP_FILE,
1483                                     rsdp, rsdp, sizeof *rsdp, &rsdp->checksum);
1484 
1485     return rsdp_table;
1486 }
1487 
1488 typedef
1489 struct AcpiBuildTables {
1490     GArray *table_data;
1491     GArray *rsdp;
1492     GArray *tcpalog;
1493     GArray *linker;
1494 } AcpiBuildTables;
1495 
1496 static inline void acpi_build_tables_init(AcpiBuildTables *tables)
1497 {
1498     tables->rsdp = g_array_new(false, true /* clear */, 1);
1499     tables->table_data = g_array_new(false, true /* clear */, 1);
1500     tables->tcpalog = g_array_new(false, true /* clear */, 1);
1501     tables->linker = bios_linker_loader_init();
1502 }
1503 
1504 static inline void acpi_build_tables_cleanup(AcpiBuildTables *tables, bool mfre)
1505 {
1506     void *linker_data = bios_linker_loader_cleanup(tables->linker);
1507     g_free(linker_data);
1508     g_array_free(tables->rsdp, mfre);
1509     g_array_free(tables->table_data, true);
1510     g_array_free(tables->tcpalog, mfre);
1511 }
1512 
1513 typedef
1514 struct AcpiBuildState {
1515     /* Copy of table in RAM (for patching). */
1516     ram_addr_t table_ram;
1517     uint32_t table_size;
1518     /* Is table patched? */
1519     uint8_t patched;
1520     PcGuestInfo *guest_info;
1521 } AcpiBuildState;
1522 
1523 static bool acpi_get_mcfg(AcpiMcfgInfo *mcfg)
1524 {
1525     Object *pci_host;
1526     QObject *o;
1527     bool ambiguous;
1528 
1529     pci_host = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
1530     g_assert(!ambiguous);
1531     g_assert(pci_host);
1532 
1533     o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_BASE, NULL);
1534     if (!o) {
1535         return false;
1536     }
1537     mcfg->mcfg_base = qint_get_int(qobject_to_qint(o));
1538     qobject_decref(o);
1539 
1540     o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_SIZE, NULL);
1541     assert(o);
1542     mcfg->mcfg_size = qint_get_int(qobject_to_qint(o));
1543     qobject_decref(o);
1544     return true;
1545 }
1546 
1547 static bool acpi_has_iommu(void)
1548 {
1549     bool ambiguous;
1550     Object *intel_iommu;
1551 
1552     intel_iommu = object_resolve_path_type("", TYPE_INTEL_IOMMU_DEVICE,
1553                                            &ambiguous);
1554     return intel_iommu && !ambiguous;
1555 }
1556 
1557 static
1558 void acpi_build(PcGuestInfo *guest_info, AcpiBuildTables *tables)
1559 {
1560     GArray *table_offsets;
1561     unsigned facs, ssdt, dsdt, rsdt;
1562     AcpiCpuInfo cpu;
1563     AcpiPmInfo pm;
1564     AcpiMiscInfo misc;
1565     AcpiMcfgInfo mcfg;
1566     PcPciInfo pci;
1567     uint8_t *u;
1568     size_t aml_len = 0;
1569 
1570     acpi_get_cpu_info(&cpu);
1571     acpi_get_pm_info(&pm);
1572     acpi_get_dsdt(&misc);
1573     acpi_get_misc_info(&misc);
1574     acpi_get_pci_info(&pci);
1575 
1576     table_offsets = g_array_new(false, true /* clear */,
1577                                         sizeof(uint32_t));
1578     ACPI_BUILD_DPRINTF("init ACPI tables\n");
1579 
1580     bios_linker_loader_alloc(tables->linker, ACPI_BUILD_TABLE_FILE,
1581                              64 /* Ensure FACS is aligned */,
1582                              false /* high memory */);
1583 
1584     /*
1585      * FACS is pointed to by FADT.
1586      * We place it first since it's the only table that has alignment
1587      * requirements.
1588      */
1589     facs = tables->table_data->len;
1590     build_facs(tables->table_data, tables->linker, guest_info);
1591 
1592     /* DSDT is pointed to by FADT */
1593     dsdt = tables->table_data->len;
1594     build_dsdt(tables->table_data, tables->linker, &misc);
1595 
1596     /* Count the size of the DSDT and SSDT, we will need it for legacy
1597      * sizing of ACPI tables.
1598      */
1599     aml_len += tables->table_data->len - dsdt;
1600 
1601     /* ACPI tables pointed to by RSDT */
1602     acpi_add_table(table_offsets, tables->table_data);
1603     build_fadt(tables->table_data, tables->linker, &pm, facs, dsdt);
1604 
1605     ssdt = tables->table_data->len;
1606     acpi_add_table(table_offsets, tables->table_data);
1607     build_ssdt(tables->table_data, tables->linker, &cpu, &pm, &misc, &pci,
1608                guest_info);
1609     aml_len += tables->table_data->len - ssdt;
1610 
1611     acpi_add_table(table_offsets, tables->table_data);
1612     build_madt(tables->table_data, tables->linker, &cpu, guest_info);
1613 
1614     if (misc.has_hpet) {
1615         acpi_add_table(table_offsets, tables->table_data);
1616         build_hpet(tables->table_data, tables->linker);
1617     }
1618     if (misc.has_tpm) {
1619         acpi_add_table(table_offsets, tables->table_data);
1620         build_tpm_tcpa(tables->table_data, tables->linker, tables->tcpalog);
1621 
1622         acpi_add_table(table_offsets, tables->table_data);
1623         build_tpm_ssdt(tables->table_data, tables->linker);
1624     }
1625     if (guest_info->numa_nodes) {
1626         acpi_add_table(table_offsets, tables->table_data);
1627         build_srat(tables->table_data, tables->linker, guest_info);
1628     }
1629     if (acpi_get_mcfg(&mcfg)) {
1630         acpi_add_table(table_offsets, tables->table_data);
1631         build_mcfg_q35(tables->table_data, tables->linker, &mcfg);
1632     }
1633     if (acpi_has_iommu()) {
1634         acpi_add_table(table_offsets, tables->table_data);
1635         build_dmar_q35(tables->table_data, tables->linker);
1636     }
1637 
1638     /* Add tables supplied by user (if any) */
1639     for (u = acpi_table_first(); u; u = acpi_table_next(u)) {
1640         unsigned len = acpi_table_len(u);
1641 
1642         acpi_add_table(table_offsets, tables->table_data);
1643         g_array_append_vals(tables->table_data, u, len);
1644     }
1645 
1646     /* RSDT is pointed to by RSDP */
1647     rsdt = tables->table_data->len;
1648     build_rsdt(tables->table_data, tables->linker, table_offsets);
1649 
1650     /* RSDP is in FSEG memory, so allocate it separately */
1651     build_rsdp(tables->rsdp, tables->linker, rsdt);
1652 
1653     /* We'll expose it all to Guest so we want to reduce
1654      * chance of size changes.
1655      * RSDP is small so it's easy to keep it immutable, no need to
1656      * bother with alignment.
1657      *
1658      * We used to align the tables to 4k, but of course this would
1659      * too simple to be enough.  4k turned out to be too small an
1660      * alignment very soon, and in fact it is almost impossible to
1661      * keep the table size stable for all (max_cpus, max_memory_slots)
1662      * combinations.  So the table size is always 64k for pc-i440fx-2.1
1663      * and we give an error if the table grows beyond that limit.
1664      *
1665      * We still have the problem of migrating from "-M pc-i440fx-2.0".  For
1666      * that, we exploit the fact that QEMU 2.1 generates _smaller_ tables
1667      * than 2.0 and we can always pad the smaller tables with zeros.  We can
1668      * then use the exact size of the 2.0 tables.
1669      *
1670      * All this is for PIIX4, since QEMU 2.0 didn't support Q35 migration.
1671      */
1672     if (guest_info->legacy_acpi_table_size) {
1673         /* Subtracting aml_len gives the size of fixed tables.  Then add the
1674          * size of the PIIX4 DSDT/SSDT in QEMU 2.0.
1675          */
1676         int legacy_aml_len =
1677             guest_info->legacy_acpi_table_size +
1678             ACPI_BUILD_LEGACY_CPU_AML_SIZE * max_cpus;
1679         int legacy_table_size =
1680             ROUND_UP(tables->table_data->len - aml_len + legacy_aml_len,
1681                      ACPI_BUILD_ALIGN_SIZE);
1682         if (tables->table_data->len > legacy_table_size) {
1683             /* Should happen only with PCI bridges and -M pc-i440fx-2.0.  */
1684             error_report("Warning: migration may not work.");
1685         }
1686         g_array_set_size(tables->table_data, legacy_table_size);
1687     } else {
1688         /* Make sure we have a buffer in case we need to resize the tables. */
1689         if (tables->table_data->len > ACPI_BUILD_TABLE_SIZE / 2) {
1690             /* As of QEMU 2.1, this fires with 160 VCPUs and 255 memory slots.  */
1691             error_report("Warning: ACPI tables are larger than 64k.");
1692             error_report("Warning: migration may not work.");
1693             error_report("Warning: please remove CPUs, NUMA nodes, "
1694                          "memory slots or PCI bridges.");
1695         }
1696         acpi_align_size(tables->table_data, ACPI_BUILD_TABLE_SIZE);
1697     }
1698 
1699     acpi_align_size(tables->linker, ACPI_BUILD_ALIGN_SIZE);
1700 
1701     /* Cleanup memory that's no longer used. */
1702     g_array_free(table_offsets, true);
1703 }
1704 
1705 static void acpi_build_update(void *build_opaque, uint32_t offset)
1706 {
1707     AcpiBuildState *build_state = build_opaque;
1708     AcpiBuildTables tables;
1709 
1710     /* No state to update or already patched? Nothing to do. */
1711     if (!build_state || build_state->patched) {
1712         return;
1713     }
1714     build_state->patched = 1;
1715 
1716     acpi_build_tables_init(&tables);
1717 
1718     acpi_build(build_state->guest_info, &tables);
1719 
1720     assert(acpi_data_len(tables.table_data) == build_state->table_size);
1721     memcpy(qemu_get_ram_ptr(build_state->table_ram), tables.table_data->data,
1722            build_state->table_size);
1723 
1724     cpu_physical_memory_set_dirty_range_nocode(build_state->table_ram,
1725                                                build_state->table_size);
1726 
1727     acpi_build_tables_cleanup(&tables, true);
1728 }
1729 
1730 static void acpi_build_reset(void *build_opaque)
1731 {
1732     AcpiBuildState *build_state = build_opaque;
1733     build_state->patched = 0;
1734 }
1735 
1736 static ram_addr_t acpi_add_rom_blob(AcpiBuildState *build_state, GArray *blob,
1737                                const char *name)
1738 {
1739     return rom_add_blob(name, blob->data, acpi_data_len(blob), -1, name,
1740                         acpi_build_update, build_state);
1741 }
1742 
1743 static const VMStateDescription vmstate_acpi_build = {
1744     .name = "acpi_build",
1745     .version_id = 1,
1746     .minimum_version_id = 1,
1747     .fields = (VMStateField[]) {
1748         VMSTATE_UINT8(patched, AcpiBuildState),
1749         VMSTATE_END_OF_LIST()
1750     },
1751 };
1752 
1753 void acpi_setup(PcGuestInfo *guest_info)
1754 {
1755     AcpiBuildTables tables;
1756     AcpiBuildState *build_state;
1757 
1758     if (!guest_info->fw_cfg) {
1759         ACPI_BUILD_DPRINTF("No fw cfg. Bailing out.\n");
1760         return;
1761     }
1762 
1763     if (!guest_info->has_acpi_build) {
1764         ACPI_BUILD_DPRINTF("ACPI build disabled. Bailing out.\n");
1765         return;
1766     }
1767 
1768     if (!acpi_enabled) {
1769         ACPI_BUILD_DPRINTF("ACPI disabled. Bailing out.\n");
1770         return;
1771     }
1772 
1773     build_state = g_malloc0(sizeof *build_state);
1774 
1775     build_state->guest_info = guest_info;
1776 
1777     acpi_set_pci_info();
1778 
1779     acpi_build_tables_init(&tables);
1780     acpi_build(build_state->guest_info, &tables);
1781 
1782     /* Now expose it all to Guest */
1783     build_state->table_ram = acpi_add_rom_blob(build_state, tables.table_data,
1784                                                ACPI_BUILD_TABLE_FILE);
1785     assert(build_state->table_ram != RAM_ADDR_MAX);
1786     build_state->table_size = acpi_data_len(tables.table_data);
1787 
1788     acpi_add_rom_blob(NULL, tables.linker, "etc/table-loader");
1789 
1790     fw_cfg_add_file(guest_info->fw_cfg, ACPI_BUILD_TPMLOG_FILE,
1791                     tables.tcpalog->data, acpi_data_len(tables.tcpalog));
1792 
1793     /*
1794      * RSDP is small so it's easy to keep it immutable, no need to
1795      * bother with ROM blobs.
1796      */
1797     fw_cfg_add_file(guest_info->fw_cfg, ACPI_BUILD_RSDP_FILE,
1798                     tables.rsdp->data, acpi_data_len(tables.rsdp));
1799 
1800     qemu_register_reset(acpi_build_reset, build_state);
1801     acpi_build_reset(build_state);
1802     vmstate_register(NULL, 0, &vmstate_acpi_build, build_state);
1803 
1804     /* Cleanup tables but don't free the memory: we track it
1805      * in build_state.
1806      */
1807     acpi_build_tables_cleanup(&tables, false);
1808 }
1809