hw/acpi.c

   1 /*
   2  * ACPI implementation
   3  *
   4  * Copyright (c) 2006 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License version 2 as published by the Free Software Foundation.
   9  *
  10  * This library is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13  * Lesser General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU Lesser General Public
  16  * License along with this library; if not, see <http://www.gnu.org/licenses/>
  17  */
  18 #include "hw.h"
  19 #include "pc.h"
  20 #include "pci.h"
  21 #include "qemu-timer.h"
  22 #include "sysemu.h"
  23 #include "i2c.h"
  24 #include "smbus.h"
  25
  26 //#define DEBUG
  27
  28 /* i82731AB (PIIX4) compatible power management function */
  29 #define PM_FREQ 3579545
  30
  31 #define ACPI_DBG_IO_ADDR  0xb044
  32
  33 typedef struct PIIX4PMState {
  34     PCIDevice dev;
  35     uint16_t pmsts;
  36     uint16_t pmen;
  37     uint16_t pmcntrl;
  38     uint8_t apmc;
  39     uint8_t apms;
  40     QEMUTimer *tmr_timer;
  41     int64_t tmr_overflow_time;
  42     i2c_bus *smbus;
  43     uint8_t smb_stat;
  44     uint8_t smb_ctl;
  45     uint8_t smb_cmd;
  46     uint8_t smb_addr;
  47     uint8_t smb_data0;
  48     uint8_t smb_data1;
  49     uint8_t smb_data[32];
  50     uint8_t smb_index;
  51     qemu_irq irq;
  52     qemu_irq cmos_s3;
  53     qemu_irq smi_irq;
  54     int kvm_enabled;
  55 } PIIX4PMState;
  56
  57 #define RSM_STS (1 << 15)
  58 #define PWRBTN_STS (1 << 8)
  59 #define RTC_EN (1 << 10)
  60 #define PWRBTN_EN (1 << 8)
  61 #define GBL_EN (1 << 5)
  62 #define TMROF_EN (1 << 0)
  63
  64 #define SCI_EN (1 << 0)
  65
  66 #define SUS_EN (1 << 13)
  67
  68 #define ACPI_ENABLE 0xf1
  69 #define ACPI_DISABLE 0xf0
  70
  71 #define SMBHSTSTS 0x00
  72 #define SMBHSTCNT 0x02
  73 #define SMBHSTCMD 0x03
  74 #define SMBHSTADD 0x04
  75 #define SMBHSTDAT0 0x05
  76 #define SMBHSTDAT1 0x06
  77 #define SMBBLKDAT 0x07
  78
  79 static PIIX4PMState *pm_state;
  80
  81 static uint32_t get_pmtmr(PIIX4PMState *s)
  82 {
  83     uint32_t d;
  84     d = muldiv64(qemu_get_clock(vm_clock), PM_FREQ, get_ticks_per_sec());
  85     return d & 0xffffff;
  86 }
  87
  88 static int get_pmsts(PIIX4PMState *s)
  89 {
  90     int64_t d;
  91
  92     d = muldiv64(qemu_get_clock(vm_clock), PM_FREQ, get_ticks_per_sec());
  93     if (d >= s->tmr_overflow_time)
  94         s->pmsts |= TMROF_EN;
  95     return s->pmsts;
  96 }
  97
  98 static void pm_update_sci(PIIX4PMState *s)
  99 {
 100     int sci_level, pmsts;
 101     int64_t expire_time;
 102
 103     pmsts = get_pmsts(s);
 104     sci_level = (((pmsts & s->pmen) &
 105                   (RTC_EN | PWRBTN_EN | GBL_EN | TMROF_EN)) != 0);
 106     qemu_set_irq(s->irq, sci_level);
 107     /* schedule a timer interruption if needed */
 108     if ((s->pmen & TMROF_EN) && !(pmsts & TMROF_EN)) {
 109         expire_time = muldiv64(s->tmr_overflow_time, get_ticks_per_sec(), PM_FREQ);
 110         qemu_mod_timer(s->tmr_timer, expire_time);
 111     } else {
 112         qemu_del_timer(s->tmr_timer);
 113     }
 114 }
 115
 116 static void pm_tmr_timer(void *opaque)
 117 {
 118     PIIX4PMState *s = opaque;
 119     pm_update_sci(s);
 120 }
 121
 122 static void pm_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
 123 {
 124     PIIX4PMState *s = opaque;
 125     addr &= 0x3f;
 126     switch(addr) {
 127     case 0x00:
 128         {
 129             int64_t d;
 130             int pmsts;
 131             pmsts = get_pmsts(s);
 132             if (pmsts & val & TMROF_EN) {
 133                 /* if TMRSTS is reset, then compute the new overflow time */
 134                 d = muldiv64(qemu_get_clock(vm_clock), PM_FREQ,
 135                              get_ticks_per_sec());
 136                 s->tmr_overflow_time = (d + 0x800000LL) & ~0x7fffffLL;
 137             }
 138             s->pmsts &= ~val;
 139             pm_update_sci(s);
 140         }
 141         break;
 142     case 0x02:
 143         s->pmen = val;
 144         pm_update_sci(s);
 145         break;
 146     case 0x04:
 147         {
 148             int sus_typ;
 149             s->pmcntrl = val & ~(SUS_EN);
 150             if (val & SUS_EN) {
 151                 /* change suspend type */
 152                 sus_typ = (val >> 10) & 7;
 153                 switch(sus_typ) {
 154                 case 0: /* soft power off */
 155                     qemu_system_shutdown_request();
 156                     break;
 157                 case 1:
 158                     /* RSM_STS should be set on resume. Pretend that resume
 159                        was caused by power button */
 160                     s->pmsts |= (RSM_STS | PWRBTN_STS);
 161                     qemu_system_reset_request();
 162                     if (s->cmos_s3) {
 163                         qemu_irq_raise(s->cmos_s3);
 164                     }
 165                 default:
 166                     break;
 167                 }
 168             }
 169         }
 170         break;
 171     default:
 172         break;
 173     }
 174 #ifdef DEBUG
 175     printf("PM writew port=0x%04x val=0x%04x\n", addr, val);
 176 #endif
 177 }
 178
 179 static uint32_t pm_ioport_readw(void *opaque, uint32_t addr)
 180 {
 181     PIIX4PMState *s = opaque;
 182     uint32_t val;
 183
 184     addr &= 0x3f;
 185     switch(addr) {
 186     case 0x00:
 187         val = get_pmsts(s);
 188         break;
 189     case 0x02:
 190         val = s->pmen;
 191         break;
 192     case 0x04:
 193         val = s->pmcntrl;
 194         break;
 195     default:
 196         val = 0;
 197         break;
 198     }
 199 #ifdef DEBUG
 200     printf("PM readw port=0x%04x val=0x%04x\n", addr, val);
 201 #endif
 202     return val;
 203 }
 204
 205 static void pm_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
 206 {
 207     //    PIIX4PMState *s = opaque;
 208 #ifdef DEBUG
 209     addr &= 0x3f;
 210     printf("PM writel port=0x%04x val=0x%08x\n", addr, val);
 211 #endif
 212 }
 213
 214 static uint32_t pm_ioport_readl(void *opaque, uint32_t addr)
 215 {
 216     PIIX4PMState *s = opaque;
 217     uint32_t val;
 218
 219     addr &= 0x3f;
 220     switch(addr) {
 221     case 0x08:
 222         val = get_pmtmr(s);
 223         break;
 224     default:
 225         val = 0;
 226         break;
 227     }
 228 #ifdef DEBUG
 229     printf("PM readl port=0x%04x val=0x%08x\n", addr, val);
 230 #endif
 231     return val;
 232 }
 233
 234 static void pm_smi_writeb(void *opaque, uint32_t addr, uint32_t val)
 235 {
 236     PIIX4PMState *s = opaque;
 237     addr &= 1;
 238 #ifdef DEBUG
 239     printf("pm_smi_writeb addr=0x%x val=0x%02x\n", addr, val);
 240 #endif
 241     if (addr == 0) {
 242         s->apmc = val;
 243
 244         /* ACPI specs 3.0, 4.7.2.5 */
 245         if (val == ACPI_ENABLE) {
 246             s->pmcntrl |= SCI_EN;
 247         } else if (val == ACPI_DISABLE) {
 248             s->pmcntrl &= ~SCI_EN;
 249         }
 250
 251         if (s->dev.config[0x5b] & (1 << 1)) {
 252             if (s->smi_irq) {
 253                 qemu_irq_raise(s->smi_irq);
 254             }
 255         }
 256     } else {
 257         s->apms = val;
 258     }
 259 }
 260
 261 static uint32_t pm_smi_readb(void *opaque, uint32_t addr)
 262 {
 263     PIIX4PMState *s = opaque;
 264     uint32_t val;
 265
 266     addr &= 1;
 267     if (addr == 0) {
 268         val = s->apmc;
 269     } else {
 270         val = s->apms;
 271     }
 272 #ifdef DEBUG
 273     printf("pm_smi_readb addr=0x%x val=0x%02x\n", addr, val);
 274 #endif
 275     return val;
 276 }
 277
 278 static void acpi_dbg_writel(void *opaque, uint32_t addr, uint32_t val)
 279 {
 280 #if defined(DEBUG)
 281     printf("ACPI: DBG: 0x%08x\n", val);
 282 #endif
 283 }
 284
 285 static void smb_transaction(PIIX4PMState *s)
 286 {
 287     uint8_t prot = (s->smb_ctl >> 2) & 0x07;
 288     uint8_t read = s->smb_addr & 0x01;
 289     uint8_t cmd = s->smb_cmd;
 290     uint8_t addr = s->smb_addr >> 1;
 291     i2c_bus *bus = s->smbus;
 292
 293 #ifdef DEBUG
 294     printf("SMBus trans addr=0x%02x prot=0x%02x\n", addr, prot);
 295 #endif
 296     switch(prot) {
 297     case 0x0:
 298         smbus_quick_command(bus, addr, read);
 299         break;
 300     case 0x1:
 301         if (read) {
 302             s->smb_data0 = smbus_receive_byte(bus, addr);
 303         } else {
 304             smbus_send_byte(bus, addr, cmd);
 305         }
 306         break;
 307     case 0x2:
 308         if (read) {
 309             s->smb_data0 = smbus_read_byte(bus, addr, cmd);
 310         } else {
 311             smbus_write_byte(bus, addr, cmd, s->smb_data0);
 312         }
 313         break;
 314     case 0x3:
 315         if (read) {
 316             uint16_t val;
 317             val = smbus_read_word(bus, addr, cmd);
 318             s->smb_data0 = val;
 319             s->smb_data1 = val >> 8;
 320         } else {
 321             smbus_write_word(bus, addr, cmd, (s->smb_data1 << 8) | s->smb_data0);
 322         }
 323         break;
 324     case 0x5:
 325         if (read) {
 326             s->smb_data0 = smbus_read_block(bus, addr, cmd, s->smb_data);
 327         } else {
 328             smbus_write_block(bus, addr, cmd, s->smb_data, s->smb_data0);
 329         }
 330         break;
 331     default:
 332         goto error;
 333     }
 334     return;
 335
 336   error:
 337     s->smb_stat |= 0x04;
 338 }
 339
 340 static void smb_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
 341 {
 342     PIIX4PMState *s = opaque;
 343     addr &= 0x3f;
 344 #ifdef DEBUG
 345     printf("SMB writeb port=0x%04x val=0x%02x\n", addr, val);
 346 #endif
 347     switch(addr) {
 348     case SMBHSTSTS:
 349         s->smb_stat = 0;
 350         s->smb_index = 0;
 351         break;
 352     case SMBHSTCNT:
 353         s->smb_ctl = val;
 354         if (val & 0x40)
 355             smb_transaction(s);
 356         break;
 357     case SMBHSTCMD:
 358         s->smb_cmd = val;
 359         break;
 360     case SMBHSTADD:
 361         s->smb_addr = val;
 362         break;
 363     case SMBHSTDAT0:
 364         s->smb_data0 = val;
 365         break;
 366     case SMBHSTDAT1:
 367         s->smb_data1 = val;
 368         break;
 369     case SMBBLKDAT:
 370         s->smb_data[s->smb_index++] = val;
 371         if (s->smb_index > 31)
 372             s->smb_index = 0;
 373         break;
 374     default:
 375         break;
 376     }
 377 }
 378
 379 static uint32_t smb_ioport_readb(void *opaque, uint32_t addr)
 380 {
 381     PIIX4PMState *s = opaque;
 382     uint32_t val;
 383
 384     addr &= 0x3f;
 385     switch(addr) {
 386     case SMBHSTSTS:
 387         val = s->smb_stat;
 388         break;
 389     case SMBHSTCNT:
 390         s->smb_index = 0;
 391         val = s->smb_ctl & 0x1f;
 392         break;
 393     case SMBHSTCMD:
 394         val = s->smb_cmd;
 395         break;
 396     case SMBHSTADD:
 397         val = s->smb_addr;
 398         break;
 399     case SMBHSTDAT0:
 400         val = s->smb_data0;
 401         break;
 402     case SMBHSTDAT1:
 403         val = s->smb_data1;
 404         break;
 405     case SMBBLKDAT:
 406         val = s->smb_data[s->smb_index++];
 407         if (s->smb_index > 31)
 408             s->smb_index = 0;
 409         break;
 410     default:
 411         val = 0;
 412         break;
 413     }
 414 #ifdef DEBUG
 415     printf("SMB readb port=0x%04x val=0x%02x\n", addr, val);
 416 #endif
 417     return val;
 418 }
 419
 420 static void pm_io_space_update(PIIX4PMState *s)
 421 {
 422     uint32_t pm_io_base;
 423
 424     if (s->dev.config[0x80] & 1) {
 425         pm_io_base = le32_to_cpu(*(uint32_t *)(s->dev.config + 0x40));
 426         pm_io_base &= 0xffc0;
 427
 428         /* XXX: need to improve memory and ioport allocation */
 429 #if defined(DEBUG)
 430         printf("PM: mapping to 0x%x\n", pm_io_base);
 431 #endif
 432         register_ioport_write(pm_io_base, 64, 2, pm_ioport_writew, s);
 433         register_ioport_read(pm_io_base, 64, 2, pm_ioport_readw, s);
 434         register_ioport_write(pm_io_base, 64, 4, pm_ioport_writel, s);
 435         register_ioport_read(pm_io_base, 64, 4, pm_ioport_readl, s);
 436     }
 437 }
 438
 439 static void pm_write_config(PCIDevice *d,
 440                             uint32_t address, uint32_t val, int len)
 441 {
 442     pci_default_write_config(d, address, val, len);
 443     if (range_covers_byte(address, len, 0x80))
 444         pm_io_space_update((PIIX4PMState *)d);
 445 }
 446
 447 static int vmstate_acpi_post_load(void *opaque, int version_id)
 448 {
 449     PIIX4PMState *s = opaque;
 450
 451     pm_io_space_update(s);
 452     return 0;
 453 }
 454
 455 static const VMStateDescription vmstate_acpi = {
 456     .name = "piix4_pm",
 457     .version_id = 1,
 458     .minimum_version_id = 1,
 459     .minimum_version_id_old = 1,
 460     .post_load = vmstate_acpi_post_load,
 461     .fields      = (VMStateField []) {
 462         VMSTATE_PCI_DEVICE(dev, PIIX4PMState),
 463         VMSTATE_UINT16(pmsts, PIIX4PMState),
 464         VMSTATE_UINT16(pmen, PIIX4PMState),
 465         VMSTATE_UINT16(pmcntrl, PIIX4PMState),
 466         VMSTATE_UINT8(apmc, PIIX4PMState),
 467         VMSTATE_UINT8(apms, PIIX4PMState),
 468         VMSTATE_TIMER(tmr_timer, PIIX4PMState),
 469         VMSTATE_INT64(tmr_overflow_time, PIIX4PMState),
 470         VMSTATE_END_OF_LIST()
 471     }
 472 };
 473
 474 static void piix4_reset(void *opaque)
 475 {
 476     PIIX4PMState *s = opaque;
 477     uint8_t *pci_conf = s->dev.config;
 478
 479     pci_conf[0x58] = 0;
 480     pci_conf[0x59] = 0;
 481     pci_conf[0x5a] = 0;
 482     pci_conf[0x5b] = 0;
 483
 484     if (s->kvm_enabled) {
 485         /* Mark SMM as already inited (until KVM supports SMM). */
 486         pci_conf[0x5B] = 0x02;
 487     }
 488 }
 489
 490 static void piix4_powerdown(void *opaque, int irq, int power_failing)
 491 {
 492     PIIX4PMState *s = opaque;
 493
 494     if (!s) {
 495         qemu_system_shutdown_request();
 496     } else if (s->pmen & PWRBTN_EN) {
 497         s->pmsts |= PWRBTN_EN;
 498         pm_update_sci(s);
 499     }
 500 }
 501
 502 i2c_bus *piix4_pm_init(PCIBus *bus, int devfn, uint32_t smb_io_base,
 503                        qemu_irq sci_irq, qemu_irq cmos_s3, qemu_irq smi_irq,
 504                        int kvm_enabled)
 505 {
 506     PIIX4PMState *s;
 507     uint8_t *pci_conf;
 508
 509     s = (PIIX4PMState *)pci_register_device(bus,
 510                                          "PM", sizeof(PIIX4PMState),
 511                                          devfn, NULL, pm_write_config);
 512     pm_state = s;
 513     pci_conf = s->dev.config;
 514     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
 515     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371AB_3);
 516     pci_conf[0x06] = 0x80;
 517     pci_conf[0x07] = 0x02;
 518     pci_conf[0x08] = 0x03; // revision number
 519     pci_conf[0x09] = 0x00;
 520     pci_config_set_class(pci_conf, PCI_CLASS_BRIDGE_OTHER);
 521     pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
 522     pci_conf[0x3d] = 0x01; // interrupt pin 1
 523
 524     pci_conf[0x40] = 0x01; /* PM io base read only bit */
 525
 526     register_ioport_write(0xb2, 2, 1, pm_smi_writeb, s);
 527     register_ioport_read(0xb2, 2, 1, pm_smi_readb, s);
 528
 529     register_ioport_write(ACPI_DBG_IO_ADDR, 4, 4, acpi_dbg_writel, s);
 530
 531     s->kvm_enabled = kvm_enabled;
 532     if (s->kvm_enabled) {
 533         /* Mark SMM as already inited to prevent SMM from running.  KVM does not
 534          * support SMM mode. */
 535         pci_conf[0x5B] = 0x02;
 536     }
 537
 538     /* XXX: which specification is used ? The i82731AB has different
 539        mappings */
 540     pci_conf[0x5f] = (parallel_hds[0] != NULL ? 0x80 : 0) | 0x10;
 541     pci_conf[0x63] = 0x60;
 542     pci_conf[0x67] = (serial_hds[0] != NULL ? 0x08 : 0) |
 543         (serial_hds[1] != NULL ? 0x90 : 0);
 544
 545     pci_conf[0x90] = smb_io_base | 1;
 546     pci_conf[0x91] = smb_io_base >> 8;
 547     pci_conf[0xd2] = 0x09;
 548     register_ioport_write(smb_io_base, 64, 1, smb_ioport_writeb, s);
 549     register_ioport_read(smb_io_base, 64, 1, smb_ioport_readb, s);
 550
 551     s->tmr_timer = qemu_new_timer(vm_clock, pm_tmr_timer, s);
 552
 553     qemu_system_powerdown = *qemu_allocate_irqs(piix4_powerdown, s, 1);
 554
 555     vmstate_register(0, &vmstate_acpi, s);
 556
 557     s->smbus = i2c_init_bus(NULL, "i2c");
 558     s->irq = sci_irq;
 559     s->cmos_s3 = cmos_s3;
 560     s->smi_irq = smi_irq;
 561     qemu_register_reset(piix4_reset, s);
 562
 563     return s->smbus;
 564 }
 565
 566 #define GPE_BASE 0xafe0
 567 #define PCI_BASE 0xae00
 568 #define PCI_EJ_BASE 0xae08
 569
 570 struct gpe_regs {
 571     uint16_t sts; /* status */
 572     uint16_t en;  /* enabled */
 573 };
 574
 575 struct pci_status {
 576     uint32_t up;
 577     uint32_t down;
 578 };
 579
 580 static struct gpe_regs gpe;
 581 static struct pci_status pci0_status;
 582
 583 static uint32_t gpe_read_val(uint16_t val, uint32_t addr)
 584 {
 585     if (addr & 1)
 586         return (val >> 8) & 0xff;
 587     return val & 0xff;
 588 }
 589
 590 static uint32_t gpe_readb(void *opaque, uint32_t addr)
 591 {
 592     uint32_t val = 0;
 593     struct gpe_regs *g = opaque;
 594     switch (addr) {
 595         case GPE_BASE:
 596         case GPE_BASE + 1:
 597             val = gpe_read_val(g->sts, addr);
 598             break;
 599         case GPE_BASE + 2:
 600         case GPE_BASE + 3:
 601             val = gpe_read_val(g->en, addr);
 602             break;
 603         default:
 604             break;
 605     }
 606
 607 #if defined(DEBUG)
 608     printf("gpe read %x == %x\n", addr, val);
 609 #endif
 610     return val;
 611 }
 612
 613 static void gpe_write_val(uint16_t *cur, int addr, uint32_t val)
 614 {
 615     if (addr & 1)
 616         *cur = (*cur & 0xff) | (val << 8);
 617     else
 618         *cur = (*cur & 0xff00) | (val & 0xff);
 619 }
 620
 621 static void gpe_reset_val(uint16_t *cur, int addr, uint32_t val)
 622 {
 623     uint16_t x1, x0 = val & 0xff;
 624     int shift = (addr & 1) ? 8 : 0;
 625
 626     x1 = (*cur >> shift) & 0xff;
 627
 628     x1 = x1 & ~x0;
 629
 630     *cur = (*cur & (0xff << (8 - shift))) | (x1 << shift);
 631 }
 632
 633 static void gpe_writeb(void *opaque, uint32_t addr, uint32_t val)
 634 {
 635     struct gpe_regs *g = opaque;
 636     switch (addr) {
 637         case GPE_BASE:
 638         case GPE_BASE + 1:
 639             gpe_reset_val(&g->sts, addr, val);
 640             break;
 641         case GPE_BASE + 2:
 642         case GPE_BASE + 3:
 643             gpe_write_val(&g->en, addr, val);
 644             break;
 645         default:
 646             break;
 647    }
 648
 649 #if defined(DEBUG)
 650     printf("gpe write %x <== %d\n", addr, val);
 651 #endif
 652 }
 653
 654 static uint32_t pcihotplug_read(void *opaque, uint32_t addr)
 655 {
 656     uint32_t val = 0;
 657     struct pci_status *g = opaque;
 658     switch (addr) {
 659         case PCI_BASE:
 660             val = g->up;
 661             break;
 662         case PCI_BASE + 4:
 663             val = g->down;
 664             break;
 665         default:
 666             break;
 667     }
 668
 669 #if defined(DEBUG)
 670     printf("pcihotplug read %x == %x\n", addr, val);
 671 #endif
 672     return val;
 673 }
 674
 675 static void pcihotplug_write(void *opaque, uint32_t addr, uint32_t val)
 676 {
 677     struct pci_status *g = opaque;
 678     switch (addr) {
 679         case PCI_BASE:
 680             g->up = val;
 681             break;
 682         case PCI_BASE + 4:
 683             g->down = val;
 684             break;
 685    }
 686
 687 #if defined(DEBUG)
 688     printf("pcihotplug write %x <== %d\n", addr, val);
 689 #endif
 690 }
 691
 692 static uint32_t pciej_read(void *opaque, uint32_t addr)
 693 {
 694 #if defined(DEBUG)
 695     printf("pciej read %x\n", addr);
 696 #endif
 697     return 0;
 698 }
 699
 700 static void pciej_write(void *opaque, uint32_t addr, uint32_t val)
 701 {
 702     BusState *bus = opaque;
 703     DeviceState *qdev, *next;
 704     PCIDevice *dev;
 705     int slot = ffs(val) - 1;
 706
 707     QLIST_FOREACH_SAFE(qdev, &bus->children, sibling, next) {
 708         dev = DO_UPCAST(PCIDevice, qdev, qdev);
 709         if (PCI_SLOT(dev->devfn) == slot) {
 710             qdev_free(qdev);
 711         }
 712     }
 713
 714
 715 #if defined(DEBUG)
 716     printf("pciej write %x <== %d\n", addr, val);
 717 #endif
 718 }
 719
 720 static int piix4_device_hotplug(PCIDevice *dev, int state);
 721
 722 void piix4_acpi_system_hot_add_init(PCIBus *bus)
 723 {
 724     register_ioport_write(GPE_BASE, 4, 1, gpe_writeb, &gpe);
 725     register_ioport_read(GPE_BASE, 4, 1,  gpe_readb, &gpe);
 726
 727     register_ioport_write(PCI_BASE, 8, 4, pcihotplug_write, &pci0_status);
 728     register_ioport_read(PCI_BASE, 8, 4,  pcihotplug_read, &pci0_status);
 729
 730     register_ioport_write(PCI_EJ_BASE, 4, 4, pciej_write, bus);
 731     register_ioport_read(PCI_EJ_BASE, 4, 4,  pciej_read, bus);
 732
 733     pci_bus_hotplug(bus, piix4_device_hotplug);
 734 }
 735
 736 static void enable_device(struct pci_status *p, struct gpe_regs *g, int slot)
 737 {
 738     g->sts |= 2;
 739     p->up |= (1 << slot);
 740 }
 741
 742 static void disable_device(struct pci_status *p, struct gpe_regs *g, int slot)
 743 {
 744     g->sts |= 2;
 745     p->down |= (1 << slot);
 746 }
 747
 748 static int piix4_device_hotplug(PCIDevice *dev, int state)
 749 {
 750     int slot = PCI_SLOT(dev->devfn);
 751
 752     pci0_status.up = 0;
 753     pci0_status.down = 0;
 754     if (state)
 755         enable_device(&pci0_status, &gpe, slot);
 756     else
 757         disable_device(&pci0_status, &gpe, slot);
 758     if (gpe.en & 2) {
 759         qemu_set_irq(pm_state->irq, 1);
 760         qemu_set_irq(pm_state->irq, 0);
 761     }
 762     return 0;
 763 }
 764
 765 struct acpi_table_header
 766 {
 767     char signature [4];    /* ACPI signature (4 ASCII characters) */
 768     uint32_t length;          /* Length of table, in bytes, including header */
 769     uint8_t revision;         /* ACPI Specification minor version # */
 770     uint8_t checksum;         /* To make sum of entire table == 0 */
 771     char oem_id [6];       /* OEM identification */
 772     char oem_table_id [8]; /* OEM table identification */
 773     uint32_t oem_revision;    /* OEM revision number */
 774     char asl_compiler_id [4]; /* ASL compiler vendor ID */
 775     uint32_t asl_compiler_revision; /* ASL compiler revision number */
 776 } __attribute__((packed));
 777
 778 char *acpi_tables;
 779 size_t acpi_tables_len;
 780
 781 static int acpi_checksum(const uint8_t *data, int len)
 782 {
 783     int sum, i;
 784     sum = 0;
 785     for(i = 0; i < len; i++)
 786         sum += data[i];
 787     return (-sum) & 0xff;
 788 }
 789
 790 int acpi_table_add(const char *t)
 791 {
 792     static const char *dfl_id = "QEMUQEMU";
 793     char buf[1024], *p, *f;
 794     struct acpi_table_header acpi_hdr;
 795     unsigned long val;
 796     size_t off;
 797
 798     memset(&acpi_hdr, 0, sizeof(acpi_hdr));
 799
 800     if (get_param_value(buf, sizeof(buf), "sig", t)) {
 801         strncpy(acpi_hdr.signature, buf, 4);
 802     } else {
 803         strncpy(acpi_hdr.signature, dfl_id, 4);
 804     }
 805     if (get_param_value(buf, sizeof(buf), "rev", t)) {
 806         val = strtoul(buf, &p, 10);
 807         if (val > 255 || *p != '\0')
 808             goto out;
 809     } else {
 810         val = 1;
 811     }
 812     acpi_hdr.revision = (int8_t)val;
 813
 814     if (get_param_value(buf, sizeof(buf), "oem_id", t)) {
 815         strncpy(acpi_hdr.oem_id, buf, 6);
 816     } else {
 817         strncpy(acpi_hdr.oem_id, dfl_id, 6);
 818     }
 819
 820     if (get_param_value(buf, sizeof(buf), "oem_table_id", t)) {
 821         strncpy(acpi_hdr.oem_table_id, buf, 8);
 822     } else {
 823         strncpy(acpi_hdr.oem_table_id, dfl_id, 8);
 824     }
 825
 826     if (get_param_value(buf, sizeof(buf), "oem_rev", t)) {
 827         val = strtol(buf, &p, 10);
 828         if(*p != '\0')
 829             goto out;
 830     } else {
 831         val = 1;
 832     }
 833     acpi_hdr.oem_revision = cpu_to_le32(val);
 834
 835     if (get_param_value(buf, sizeof(buf), "asl_compiler_id", t)) {
 836         strncpy(acpi_hdr.asl_compiler_id, buf, 4);
 837     } else {
 838         strncpy(acpi_hdr.asl_compiler_id, dfl_id, 4);
 839     }
 840
 841     if (get_param_value(buf, sizeof(buf), "asl_compiler_rev", t)) {
 842         val = strtol(buf, &p, 10);
 843         if(*p != '\0')
 844             goto out;
 845     } else {
 846         val = 1;
 847     }
 848     acpi_hdr.asl_compiler_revision = cpu_to_le32(val);
 849
 850     if (!get_param_value(buf, sizeof(buf), "data", t)) {
 851          buf[0] = '\0';
 852     }
 853
 854     acpi_hdr.length = sizeof(acpi_hdr);
 855
 856     f = buf;
 857     while (buf[0]) {
 858         struct stat s;
 859         char *n = strchr(f, ':');
 860         if (n)
 861             *n = '\0';
 862         if(stat(f, &s) < 0) {
 863             fprintf(stderr, "Can't stat file '%s': %s\n", f, strerror(errno));
 864             goto out;
 865         }
 866         acpi_hdr.length += s.st_size;
 867         if (!n)
 868             break;
 869         *n = ':';
 870         f = n + 1;
 871     }
 872
 873     if (!acpi_tables) {
 874         acpi_tables_len = sizeof(uint16_t);
 875         acpi_tables = qemu_mallocz(acpi_tables_len);
 876     }
 877     p = acpi_tables + acpi_tables_len;
 878     acpi_tables_len += sizeof(uint16_t) + acpi_hdr.length;
 879     acpi_tables = qemu_realloc(acpi_tables, acpi_tables_len);
 880
 881     acpi_hdr.length = cpu_to_le32(acpi_hdr.length);
 882     *(uint16_t*)p = acpi_hdr.length;
 883     p += sizeof(uint16_t);
 884     memcpy(p, &acpi_hdr, sizeof(acpi_hdr));
 885     off = sizeof(acpi_hdr);
 886
 887     f = buf;
 888     while (buf[0]) {
 889         struct stat s;
 890         int fd;
 891         char *n = strchr(f, ':');
 892         if (n)
 893             *n = '\0';
 894         fd = open(f, O_RDONLY);
 895
 896         if(fd < 0)
 897             goto out;
 898         if(fstat(fd, &s) < 0) {
 899             close(fd);
 900             goto out;
 901         }
 902
 903         do {
 904             int r;
 905             r = read(fd, p + off, s.st_size);
 906             if (r > 0) {
 907                 off += r;
 908                 s.st_size -= r;
 909             } else if ((r < 0 && errno != EINTR) || r == 0) {
 910                 close(fd);
 911                 goto out;
 912             }
 913         } while(s.st_size);
 914
 915         close(fd);
 916         if (!n)
 917             break;
 918         f = n + 1;
 919     }
 920
 921     ((struct acpi_table_header*)p)->checksum = acpi_checksum((uint8_t*)p, off);
 922     /* increase number of tables */
 923     (*(uint16_t*)acpi_tables) =
 924             cpu_to_le32(le32_to_cpu(*(uint16_t*)acpi_tables) + 1);
 925     return 0;
 926 out:
 927     if (acpi_tables) {
 928         qemu_free(acpi_tables);
 929         acpi_tables = NULL;
 930     }
 931     return -1;
 932 }