2 * Copyright (C) 2010 Red Hat, Inc.
4 * written by Yaniv Kamay, Izik Eidus, Gerd Hoffmann
5 * maintained by Gerd Hoffmann <kraxel@redhat.com>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu-common.h"
22 #include "qemu-timer.h"
23 #include "qemu-queue.h"
30 #ifndef CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC
31 /* spice-protocol is too old, add missing definitions */
32 #define QXL_IO_MONITORS_CONFIG_ASYNC (QXL_IO_FLUSH_RELEASE + 1)
36 * NOTE: SPICE_RING_PROD_ITEM accesses memory on the pci bar and as
37 * such can be changed by the guest, so to avoid a guest trigerrable
38 * abort we just qxl_set_guest_bug and set the return to NULL. Still
39 * it may happen as a result of emulator bug as well.
41 #undef SPICE_RING_PROD_ITEM
42 #define SPICE_RING_PROD_ITEM(qxl, r, ret) { \
43 typeof(r) start = r; \
44 typeof(r) end = r + 1; \
45 uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r); \
46 typeof(&(r)->items[prod]) m_item = &(r)->items[prod]; \
47 if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
48 qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch " \
49 "! %p <= %p < %p", (uint8_t *)start, \
50 (uint8_t *)m_item, (uint8_t *)end); \
57 #undef SPICE_RING_CONS_ITEM
58 #define SPICE_RING_CONS_ITEM(qxl, r, ret) { \
59 typeof(r) start = r; \
60 typeof(r) end = r + 1; \
61 uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r); \
62 typeof(&(r)->items[cons]) m_item = &(r)->items[cons]; \
63 if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
64 qxl_set_guest_bug(qxl, "SPICE_RING_CONS_ITEM indices mismatch " \
65 "! %p <= %p < %p", (uint8_t *)start, \
66 (uint8_t *)m_item, (uint8_t *)end); \
74 #define ALIGN(a, b) (((a) + ((b) - 1)) & ~((b) - 1))
76 #define PIXEL_SIZE 0.2936875 //1280x1024 is 14.8" x 11.9"
78 #define QXL_MODE(_x, _y, _b, _o) \
82 .stride = (_x) * (_b) / 8, \
83 .x_mili = PIXEL_SIZE * (_x), \
84 .y_mili = PIXEL_SIZE * (_y), \
88 #define QXL_MODE_16_32(x_res, y_res, orientation) \
89 QXL_MODE(x_res, y_res, 16, orientation), \
90 QXL_MODE(x_res, y_res, 32, orientation)
92 #define QXL_MODE_EX(x_res, y_res) \
93 QXL_MODE_16_32(x_res, y_res, 0), \
94 QXL_MODE_16_32(y_res, x_res, 1), \
95 QXL_MODE_16_32(x_res, y_res, 2), \
96 QXL_MODE_16_32(y_res, x_res, 3)
98 static QXLMode qxl_modes
[] = {
99 QXL_MODE_EX(640, 480),
100 QXL_MODE_EX(800, 480),
101 QXL_MODE_EX(800, 600),
102 QXL_MODE_EX(832, 624),
103 QXL_MODE_EX(960, 640),
104 QXL_MODE_EX(1024, 600),
105 QXL_MODE_EX(1024, 768),
106 QXL_MODE_EX(1152, 864),
107 QXL_MODE_EX(1152, 870),
108 QXL_MODE_EX(1280, 720),
109 QXL_MODE_EX(1280, 760),
110 QXL_MODE_EX(1280, 768),
111 QXL_MODE_EX(1280, 800),
112 QXL_MODE_EX(1280, 960),
113 QXL_MODE_EX(1280, 1024),
114 QXL_MODE_EX(1360, 768),
115 QXL_MODE_EX(1366, 768),
116 QXL_MODE_EX(1400, 1050),
117 QXL_MODE_EX(1440, 900),
118 QXL_MODE_EX(1600, 900),
119 QXL_MODE_EX(1600, 1200),
120 QXL_MODE_EX(1680, 1050),
121 QXL_MODE_EX(1920, 1080),
122 /* these modes need more than 8 MB video memory */
123 QXL_MODE_EX(1920, 1200),
124 QXL_MODE_EX(1920, 1440),
125 QXL_MODE_EX(2048, 1536),
126 QXL_MODE_EX(2560, 1440),
127 QXL_MODE_EX(2560, 1600),
128 /* these modes need more than 16 MB video memory */
129 QXL_MODE_EX(2560, 2048),
130 QXL_MODE_EX(2800, 2100),
131 QXL_MODE_EX(3200, 2400),
134 static PCIQXLDevice
*qxl0
;
136 static void qxl_send_events(PCIQXLDevice
*d
, uint32_t events
);
137 static int qxl_destroy_primary(PCIQXLDevice
*d
, qxl_async_io async
);
138 static void qxl_reset_memslots(PCIQXLDevice
*d
);
139 static void qxl_reset_surfaces(PCIQXLDevice
*d
);
140 static void qxl_ring_set_dirty(PCIQXLDevice
*qxl
);
142 void qxl_set_guest_bug(PCIQXLDevice
*qxl
, const char *msg
, ...)
144 qxl_send_events(qxl
, QXL_INTERRUPT_ERROR
);
146 if (qxl
->guestdebug
) {
149 fprintf(stderr
, "qxl-%d: guest bug: ", qxl
->id
);
150 vfprintf(stderr
, msg
, ap
);
151 fprintf(stderr
, "\n");
156 static void qxl_clear_guest_bug(PCIQXLDevice
*qxl
)
161 void qxl_spice_update_area(PCIQXLDevice
*qxl
, uint32_t surface_id
,
162 struct QXLRect
*area
, struct QXLRect
*dirty_rects
,
163 uint32_t num_dirty_rects
,
164 uint32_t clear_dirty_region
,
165 qxl_async_io async
, struct QXLCookie
*cookie
)
167 trace_qxl_spice_update_area(qxl
->id
, surface_id
, area
->left
, area
->right
,
168 area
->top
, area
->bottom
);
169 trace_qxl_spice_update_area_rest(qxl
->id
, num_dirty_rects
,
171 if (async
== QXL_SYNC
) {
172 qxl
->ssd
.worker
->update_area(qxl
->ssd
.worker
, surface_id
, area
,
173 dirty_rects
, num_dirty_rects
, clear_dirty_region
);
175 assert(cookie
!= NULL
);
176 spice_qxl_update_area_async(&qxl
->ssd
.qxl
, surface_id
, area
,
177 clear_dirty_region
, (uintptr_t)cookie
);
181 static void qxl_spice_destroy_surface_wait_complete(PCIQXLDevice
*qxl
,
184 trace_qxl_spice_destroy_surface_wait_complete(qxl
->id
, id
);
185 qemu_mutex_lock(&qxl
->track_lock
);
186 qxl
->guest_surfaces
.cmds
[id
] = 0;
187 qxl
->guest_surfaces
.count
--;
188 qemu_mutex_unlock(&qxl
->track_lock
);
191 static void qxl_spice_destroy_surface_wait(PCIQXLDevice
*qxl
, uint32_t id
,
196 trace_qxl_spice_destroy_surface_wait(qxl
->id
, id
, async
);
198 cookie
= qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
199 QXL_IO_DESTROY_SURFACE_ASYNC
);
200 cookie
->u
.surface_id
= id
;
201 spice_qxl_destroy_surface_async(&qxl
->ssd
.qxl
, id
, (uintptr_t)cookie
);
203 qxl
->ssd
.worker
->destroy_surface_wait(qxl
->ssd
.worker
, id
);
204 qxl_spice_destroy_surface_wait_complete(qxl
, id
);
208 static void qxl_spice_flush_surfaces_async(PCIQXLDevice
*qxl
)
210 trace_qxl_spice_flush_surfaces_async(qxl
->id
, qxl
->guest_surfaces
.count
,
212 spice_qxl_flush_surfaces_async(&qxl
->ssd
.qxl
,
213 (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
214 QXL_IO_FLUSH_SURFACES_ASYNC
));
217 void qxl_spice_loadvm_commands(PCIQXLDevice
*qxl
, struct QXLCommandExt
*ext
,
220 trace_qxl_spice_loadvm_commands(qxl
->id
, ext
, count
);
221 qxl
->ssd
.worker
->loadvm_commands(qxl
->ssd
.worker
, ext
, count
);
224 void qxl_spice_oom(PCIQXLDevice
*qxl
)
226 trace_qxl_spice_oom(qxl
->id
);
227 qxl
->ssd
.worker
->oom(qxl
->ssd
.worker
);
230 void qxl_spice_reset_memslots(PCIQXLDevice
*qxl
)
232 trace_qxl_spice_reset_memslots(qxl
->id
);
233 qxl
->ssd
.worker
->reset_memslots(qxl
->ssd
.worker
);
236 static void qxl_spice_destroy_surfaces_complete(PCIQXLDevice
*qxl
)
238 trace_qxl_spice_destroy_surfaces_complete(qxl
->id
);
239 qemu_mutex_lock(&qxl
->track_lock
);
240 memset(&qxl
->guest_surfaces
.cmds
, 0, sizeof(qxl
->guest_surfaces
.cmds
));
241 qxl
->guest_surfaces
.count
= 0;
242 qemu_mutex_unlock(&qxl
->track_lock
);
245 static void qxl_spice_destroy_surfaces(PCIQXLDevice
*qxl
, qxl_async_io async
)
247 trace_qxl_spice_destroy_surfaces(qxl
->id
, async
);
249 spice_qxl_destroy_surfaces_async(&qxl
->ssd
.qxl
,
250 (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
251 QXL_IO_DESTROY_ALL_SURFACES_ASYNC
));
253 qxl
->ssd
.worker
->destroy_surfaces(qxl
->ssd
.worker
);
254 qxl_spice_destroy_surfaces_complete(qxl
);
258 static void qxl_spice_monitors_config_async(PCIQXLDevice
*qxl
, int replay
)
260 trace_qxl_spice_monitors_config(qxl
->id
);
261 /* 0x000b01 == 0.11.1 */
262 #if SPICE_SERVER_VERSION >= 0x000b01 && \
263 defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
266 * don't use QXL_COOKIE_TYPE_IO:
267 * - we are not running yet (post_load), we will assert
269 * - this is not a guest io, but a reply, so async_io isn't set.
271 spice_qxl_monitors_config_async(&qxl
->ssd
.qxl
,
272 qxl
->guest_monitors_config
,
274 (uintptr_t)qxl_cookie_new(
275 QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG
,
278 qxl
->guest_monitors_config
= qxl
->ram
->monitors_config
;
279 spice_qxl_monitors_config_async(&qxl
->ssd
.qxl
,
280 qxl
->ram
->monitors_config
,
282 (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
283 QXL_IO_MONITORS_CONFIG_ASYNC
));
286 fprintf(stderr
, "qxl: too old spice-protocol/spice-server for "
287 "QXL_IO_MONITORS_CONFIG_ASYNC\n");
291 void qxl_spice_reset_image_cache(PCIQXLDevice
*qxl
)
293 trace_qxl_spice_reset_image_cache(qxl
->id
);
294 qxl
->ssd
.worker
->reset_image_cache(qxl
->ssd
.worker
);
297 void qxl_spice_reset_cursor(PCIQXLDevice
*qxl
)
299 trace_qxl_spice_reset_cursor(qxl
->id
);
300 qxl
->ssd
.worker
->reset_cursor(qxl
->ssd
.worker
);
301 qemu_mutex_lock(&qxl
->track_lock
);
302 qxl
->guest_cursor
= 0;
303 qemu_mutex_unlock(&qxl
->track_lock
);
307 static inline uint32_t msb_mask(uint32_t val
)
312 mask
= ~(val
- 1) & val
;
314 } while (mask
< val
);
319 static ram_addr_t
qxl_rom_size(void)
321 uint32_t rom_size
= sizeof(QXLRom
) + sizeof(QXLModes
) + sizeof(qxl_modes
);
323 rom_size
= MAX(rom_size
, TARGET_PAGE_SIZE
);
324 rom_size
= msb_mask(rom_size
* 2 - 1);
328 static void init_qxl_rom(PCIQXLDevice
*d
)
330 QXLRom
*rom
= memory_region_get_ram_ptr(&d
->rom_bar
);
331 QXLModes
*modes
= (QXLModes
*)(rom
+ 1);
332 uint32_t ram_header_size
;
333 uint32_t surface0_area_size
;
338 memset(rom
, 0, d
->rom_size
);
340 rom
->magic
= cpu_to_le32(QXL_ROM_MAGIC
);
341 rom
->id
= cpu_to_le32(d
->id
);
342 rom
->log_level
= cpu_to_le32(d
->guestdebug
);
343 rom
->modes_offset
= cpu_to_le32(sizeof(QXLRom
));
345 rom
->slot_gen_bits
= MEMSLOT_GENERATION_BITS
;
346 rom
->slot_id_bits
= MEMSLOT_SLOT_BITS
;
347 rom
->slots_start
= 1;
348 rom
->slots_end
= NUM_MEMSLOTS
- 1;
349 rom
->n_surfaces
= cpu_to_le32(NUM_SURFACES
);
351 for (i
= 0, n
= 0; i
< ARRAY_SIZE(qxl_modes
); i
++) {
352 fb
= qxl_modes
[i
].y_res
* qxl_modes
[i
].stride
;
353 if (fb
> d
->vgamem_size
) {
356 modes
->modes
[n
].id
= cpu_to_le32(i
);
357 modes
->modes
[n
].x_res
= cpu_to_le32(qxl_modes
[i
].x_res
);
358 modes
->modes
[n
].y_res
= cpu_to_le32(qxl_modes
[i
].y_res
);
359 modes
->modes
[n
].bits
= cpu_to_le32(qxl_modes
[i
].bits
);
360 modes
->modes
[n
].stride
= cpu_to_le32(qxl_modes
[i
].stride
);
361 modes
->modes
[n
].x_mili
= cpu_to_le32(qxl_modes
[i
].x_mili
);
362 modes
->modes
[n
].y_mili
= cpu_to_le32(qxl_modes
[i
].y_mili
);
363 modes
->modes
[n
].orientation
= cpu_to_le32(qxl_modes
[i
].orientation
);
366 modes
->n_modes
= cpu_to_le32(n
);
368 ram_header_size
= ALIGN(sizeof(QXLRam
), 4096);
369 surface0_area_size
= ALIGN(d
->vgamem_size
, 4096);
370 num_pages
= d
->vga
.vram_size
;
371 num_pages
-= ram_header_size
;
372 num_pages
-= surface0_area_size
;
373 num_pages
= num_pages
/ TARGET_PAGE_SIZE
;
375 rom
->draw_area_offset
= cpu_to_le32(0);
376 rom
->surface0_area_size
= cpu_to_le32(surface0_area_size
);
377 rom
->pages_offset
= cpu_to_le32(surface0_area_size
);
378 rom
->num_pages
= cpu_to_le32(num_pages
);
379 rom
->ram_header_offset
= cpu_to_le32(d
->vga
.vram_size
- ram_header_size
);
381 d
->shadow_rom
= *rom
;
386 static void init_qxl_ram(PCIQXLDevice
*d
)
391 buf
= d
->vga
.vram_ptr
;
392 d
->ram
= (QXLRam
*)(buf
+ le32_to_cpu(d
->shadow_rom
.ram_header_offset
));
393 d
->ram
->magic
= cpu_to_le32(QXL_RAM_MAGIC
);
394 d
->ram
->int_pending
= cpu_to_le32(0);
395 d
->ram
->int_mask
= cpu_to_le32(0);
396 d
->ram
->update_surface
= 0;
397 SPICE_RING_INIT(&d
->ram
->cmd_ring
);
398 SPICE_RING_INIT(&d
->ram
->cursor_ring
);
399 SPICE_RING_INIT(&d
->ram
->release_ring
);
400 SPICE_RING_PROD_ITEM(d
, &d
->ram
->release_ring
, item
);
403 qxl_ring_set_dirty(d
);
406 /* can be called from spice server thread context */
407 static void qxl_set_dirty(MemoryRegion
*mr
, ram_addr_t addr
, ram_addr_t end
)
409 memory_region_set_dirty(mr
, addr
, end
- addr
);
412 static void qxl_rom_set_dirty(PCIQXLDevice
*qxl
)
414 qxl_set_dirty(&qxl
->rom_bar
, 0, qxl
->rom_size
);
417 /* called from spice server thread context only */
418 static void qxl_ram_set_dirty(PCIQXLDevice
*qxl
, void *ptr
)
420 void *base
= qxl
->vga
.vram_ptr
;
424 offset
&= ~(TARGET_PAGE_SIZE
-1);
425 assert(offset
< qxl
->vga
.vram_size
);
426 qxl_set_dirty(&qxl
->vga
.vram
, offset
, offset
+ TARGET_PAGE_SIZE
);
429 /* can be called from spice server thread context */
430 static void qxl_ring_set_dirty(PCIQXLDevice
*qxl
)
432 ram_addr_t addr
= qxl
->shadow_rom
.ram_header_offset
;
433 ram_addr_t end
= qxl
->vga
.vram_size
;
434 qxl_set_dirty(&qxl
->vga
.vram
, addr
, end
);
438 * keep track of some command state, for savevm/loadvm.
439 * called from spice server thread context only
441 static int qxl_track_command(PCIQXLDevice
*qxl
, struct QXLCommandExt
*ext
)
443 switch (le32_to_cpu(ext
->cmd
.type
)) {
444 case QXL_CMD_SURFACE
:
446 QXLSurfaceCmd
*cmd
= qxl_phys2virt(qxl
, ext
->cmd
.data
, ext
->group_id
);
451 uint32_t id
= le32_to_cpu(cmd
->surface_id
);
453 if (id
>= NUM_SURFACES
) {
454 qxl_set_guest_bug(qxl
, "QXL_CMD_SURFACE id %d >= %d", id
,
458 qemu_mutex_lock(&qxl
->track_lock
);
459 if (cmd
->type
== QXL_SURFACE_CMD_CREATE
) {
460 qxl
->guest_surfaces
.cmds
[id
] = ext
->cmd
.data
;
461 qxl
->guest_surfaces
.count
++;
462 if (qxl
->guest_surfaces
.max
< qxl
->guest_surfaces
.count
)
463 qxl
->guest_surfaces
.max
= qxl
->guest_surfaces
.count
;
465 if (cmd
->type
== QXL_SURFACE_CMD_DESTROY
) {
466 qxl
->guest_surfaces
.cmds
[id
] = 0;
467 qxl
->guest_surfaces
.count
--;
469 qemu_mutex_unlock(&qxl
->track_lock
);
474 QXLCursorCmd
*cmd
= qxl_phys2virt(qxl
, ext
->cmd
.data
, ext
->group_id
);
479 if (cmd
->type
== QXL_CURSOR_SET
) {
480 qemu_mutex_lock(&qxl
->track_lock
);
481 qxl
->guest_cursor
= ext
->cmd
.data
;
482 qemu_mutex_unlock(&qxl
->track_lock
);
490 /* spice display interface callbacks */
492 static void interface_attach_worker(QXLInstance
*sin
, QXLWorker
*qxl_worker
)
494 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
496 trace_qxl_interface_attach_worker(qxl
->id
);
497 qxl
->ssd
.worker
= qxl_worker
;
500 static void interface_set_compression_level(QXLInstance
*sin
, int level
)
502 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
504 trace_qxl_interface_set_compression_level(qxl
->id
, level
);
505 qxl
->shadow_rom
.compression_level
= cpu_to_le32(level
);
506 qxl
->rom
->compression_level
= cpu_to_le32(level
);
507 qxl_rom_set_dirty(qxl
);
510 static void interface_set_mm_time(QXLInstance
*sin
, uint32_t mm_time
)
512 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
514 trace_qxl_interface_set_mm_time(qxl
->id
, mm_time
);
515 qxl
->shadow_rom
.mm_clock
= cpu_to_le32(mm_time
);
516 qxl
->rom
->mm_clock
= cpu_to_le32(mm_time
);
517 qxl_rom_set_dirty(qxl
);
520 static void interface_get_init_info(QXLInstance
*sin
, QXLDevInitInfo
*info
)
522 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
524 trace_qxl_interface_get_init_info(qxl
->id
);
525 info
->memslot_gen_bits
= MEMSLOT_GENERATION_BITS
;
526 info
->memslot_id_bits
= MEMSLOT_SLOT_BITS
;
527 info
->num_memslots
= NUM_MEMSLOTS
;
528 info
->num_memslots_groups
= NUM_MEMSLOTS_GROUPS
;
529 info
->internal_groupslot_id
= 0;
530 info
->qxl_ram_size
= le32_to_cpu(qxl
->shadow_rom
.num_pages
) << TARGET_PAGE_BITS
;
531 info
->n_surfaces
= NUM_SURFACES
;
534 static const char *qxl_mode_to_string(int mode
)
537 case QXL_MODE_COMPAT
:
539 case QXL_MODE_NATIVE
:
541 case QXL_MODE_UNDEFINED
:
549 static const char *io_port_to_string(uint32_t io_port
)
551 if (io_port
>= QXL_IO_RANGE_SIZE
) {
552 return "out of range";
554 static const char *io_port_to_string
[QXL_IO_RANGE_SIZE
+ 1] = {
555 [QXL_IO_NOTIFY_CMD
] = "QXL_IO_NOTIFY_CMD",
556 [QXL_IO_NOTIFY_CURSOR
] = "QXL_IO_NOTIFY_CURSOR",
557 [QXL_IO_UPDATE_AREA
] = "QXL_IO_UPDATE_AREA",
558 [QXL_IO_UPDATE_IRQ
] = "QXL_IO_UPDATE_IRQ",
559 [QXL_IO_NOTIFY_OOM
] = "QXL_IO_NOTIFY_OOM",
560 [QXL_IO_RESET
] = "QXL_IO_RESET",
561 [QXL_IO_SET_MODE
] = "QXL_IO_SET_MODE",
562 [QXL_IO_LOG
] = "QXL_IO_LOG",
563 [QXL_IO_MEMSLOT_ADD
] = "QXL_IO_MEMSLOT_ADD",
564 [QXL_IO_MEMSLOT_DEL
] = "QXL_IO_MEMSLOT_DEL",
565 [QXL_IO_DETACH_PRIMARY
] = "QXL_IO_DETACH_PRIMARY",
566 [QXL_IO_ATTACH_PRIMARY
] = "QXL_IO_ATTACH_PRIMARY",
567 [QXL_IO_CREATE_PRIMARY
] = "QXL_IO_CREATE_PRIMARY",
568 [QXL_IO_DESTROY_PRIMARY
] = "QXL_IO_DESTROY_PRIMARY",
569 [QXL_IO_DESTROY_SURFACE_WAIT
] = "QXL_IO_DESTROY_SURFACE_WAIT",
570 [QXL_IO_DESTROY_ALL_SURFACES
] = "QXL_IO_DESTROY_ALL_SURFACES",
571 [QXL_IO_UPDATE_AREA_ASYNC
] = "QXL_IO_UPDATE_AREA_ASYNC",
572 [QXL_IO_MEMSLOT_ADD_ASYNC
] = "QXL_IO_MEMSLOT_ADD_ASYNC",
573 [QXL_IO_CREATE_PRIMARY_ASYNC
] = "QXL_IO_CREATE_PRIMARY_ASYNC",
574 [QXL_IO_DESTROY_PRIMARY_ASYNC
] = "QXL_IO_DESTROY_PRIMARY_ASYNC",
575 [QXL_IO_DESTROY_SURFACE_ASYNC
] = "QXL_IO_DESTROY_SURFACE_ASYNC",
576 [QXL_IO_DESTROY_ALL_SURFACES_ASYNC
]
577 = "QXL_IO_DESTROY_ALL_SURFACES_ASYNC",
578 [QXL_IO_FLUSH_SURFACES_ASYNC
] = "QXL_IO_FLUSH_SURFACES_ASYNC",
579 [QXL_IO_FLUSH_RELEASE
] = "QXL_IO_FLUSH_RELEASE",
580 [QXL_IO_MONITORS_CONFIG_ASYNC
] = "QXL_IO_MONITORS_CONFIG_ASYNC",
582 return io_port_to_string
[io_port
];
585 /* called from spice server thread context only */
586 static int interface_get_command(QXLInstance
*sin
, struct QXLCommandExt
*ext
)
588 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
589 SimpleSpiceUpdate
*update
;
590 QXLCommandRing
*ring
;
594 trace_qxl_ring_command_check(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
599 qemu_mutex_lock(&qxl
->ssd
.lock
);
600 if (qxl
->ssd
.update
!= NULL
) {
601 update
= qxl
->ssd
.update
;
602 qxl
->ssd
.update
= NULL
;
606 qemu_mutex_unlock(&qxl
->ssd
.lock
);
608 trace_qxl_ring_command_get(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
609 qxl_log_command(qxl
, "vga", ext
);
612 case QXL_MODE_COMPAT
:
613 case QXL_MODE_NATIVE
:
614 case QXL_MODE_UNDEFINED
:
615 ring
= &qxl
->ram
->cmd_ring
;
616 if (qxl
->guest_bug
|| SPICE_RING_IS_EMPTY(ring
)) {
619 SPICE_RING_CONS_ITEM(qxl
, ring
, cmd
);
624 ext
->group_id
= MEMSLOT_GROUP_GUEST
;
625 ext
->flags
= qxl
->cmdflags
;
626 SPICE_RING_POP(ring
, notify
);
627 qxl_ring_set_dirty(qxl
);
629 qxl_send_events(qxl
, QXL_INTERRUPT_DISPLAY
);
631 qxl
->guest_primary
.commands
++;
632 qxl_track_command(qxl
, ext
);
633 qxl_log_command(qxl
, "cmd", ext
);
634 trace_qxl_ring_command_get(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
641 /* called from spice server thread context only */
642 static int interface_req_cmd_notification(QXLInstance
*sin
)
644 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
647 trace_qxl_ring_command_req_notification(qxl
->id
);
649 case QXL_MODE_COMPAT
:
650 case QXL_MODE_NATIVE
:
651 case QXL_MODE_UNDEFINED
:
652 SPICE_RING_CONS_WAIT(&qxl
->ram
->cmd_ring
, wait
);
653 qxl_ring_set_dirty(qxl
);
662 /* called from spice server thread context only */
663 static inline void qxl_push_free_res(PCIQXLDevice
*d
, int flush
)
665 QXLReleaseRing
*ring
= &d
->ram
->release_ring
;
669 #define QXL_FREE_BUNCH_SIZE 32
671 if (ring
->prod
- ring
->cons
+ 1 == ring
->num_items
) {
672 /* ring full -- can't push */
675 if (!flush
&& d
->oom_running
) {
676 /* collect everything from oom handler before pushing */
679 if (!flush
&& d
->num_free_res
< QXL_FREE_BUNCH_SIZE
) {
680 /* collect a bit more before pushing */
684 SPICE_RING_PUSH(ring
, notify
);
685 trace_qxl_ring_res_push(d
->id
, qxl_mode_to_string(d
->mode
),
686 d
->guest_surfaces
.count
, d
->num_free_res
,
687 d
->last_release
, notify
? "yes" : "no");
688 trace_qxl_ring_res_push_rest(d
->id
, ring
->prod
- ring
->cons
,
689 ring
->num_items
, ring
->prod
, ring
->cons
);
691 qxl_send_events(d
, QXL_INTERRUPT_DISPLAY
);
693 SPICE_RING_PROD_ITEM(d
, ring
, item
);
699 d
->last_release
= NULL
;
700 qxl_ring_set_dirty(d
);
703 /* called from spice server thread context only */
704 static void interface_release_resource(QXLInstance
*sin
,
705 struct QXLReleaseInfoExt ext
)
707 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
708 QXLReleaseRing
*ring
;
711 if (ext
.group_id
== MEMSLOT_GROUP_HOST
) {
712 /* host group -> vga mode update request */
713 qemu_spice_destroy_update(&qxl
->ssd
, (void *)(intptr_t)ext
.info
->id
);
718 * ext->info points into guest-visible memory
719 * pci bar 0, $command.release_info
721 ring
= &qxl
->ram
->release_ring
;
722 SPICE_RING_PROD_ITEM(qxl
, ring
, item
);
727 /* stick head into the ring */
730 qxl_ram_set_dirty(qxl
, &ext
.info
->next
);
732 qxl_ring_set_dirty(qxl
);
734 /* append item to the list */
735 qxl
->last_release
->next
= ext
.info
->id
;
736 qxl_ram_set_dirty(qxl
, &qxl
->last_release
->next
);
738 qxl_ram_set_dirty(qxl
, &ext
.info
->next
);
740 qxl
->last_release
= ext
.info
;
742 trace_qxl_ring_res_put(qxl
->id
, qxl
->num_free_res
);
743 qxl_push_free_res(qxl
, 0);
746 /* called from spice server thread context only */
747 static int interface_get_cursor_command(QXLInstance
*sin
, struct QXLCommandExt
*ext
)
749 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
754 trace_qxl_ring_cursor_check(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
757 case QXL_MODE_COMPAT
:
758 case QXL_MODE_NATIVE
:
759 case QXL_MODE_UNDEFINED
:
760 ring
= &qxl
->ram
->cursor_ring
;
761 if (SPICE_RING_IS_EMPTY(ring
)) {
764 SPICE_RING_CONS_ITEM(qxl
, ring
, cmd
);
769 ext
->group_id
= MEMSLOT_GROUP_GUEST
;
770 ext
->flags
= qxl
->cmdflags
;
771 SPICE_RING_POP(ring
, notify
);
772 qxl_ring_set_dirty(qxl
);
774 qxl_send_events(qxl
, QXL_INTERRUPT_CURSOR
);
776 qxl
->guest_primary
.commands
++;
777 qxl_track_command(qxl
, ext
);
778 qxl_log_command(qxl
, "csr", ext
);
780 qxl_render_cursor(qxl
, ext
);
782 trace_qxl_ring_cursor_get(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
789 /* called from spice server thread context only */
790 static int interface_req_cursor_notification(QXLInstance
*sin
)
792 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
795 trace_qxl_ring_cursor_req_notification(qxl
->id
);
797 case QXL_MODE_COMPAT
:
798 case QXL_MODE_NATIVE
:
799 case QXL_MODE_UNDEFINED
:
800 SPICE_RING_CONS_WAIT(&qxl
->ram
->cursor_ring
, wait
);
801 qxl_ring_set_dirty(qxl
);
810 /* called from spice server thread context */
811 static void interface_notify_update(QXLInstance
*sin
, uint32_t update_id
)
814 * Called by spice-server as a result of a QXL_CMD_UPDATE which is not in
815 * use by xf86-video-qxl and is defined out in the qxl windows driver.
816 * Probably was at some earlier version that is prior to git start (2009),
817 * and is still guest trigerrable.
819 fprintf(stderr
, "%s: deprecated\n", __func__
);
822 /* called from spice server thread context only */
823 static int interface_flush_resources(QXLInstance
*sin
)
825 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
828 ret
= qxl
->num_free_res
;
830 qxl_push_free_res(qxl
, 1);
835 static void qxl_create_guest_primary_complete(PCIQXLDevice
*d
);
837 /* called from spice server thread context only */
838 static void interface_async_complete_io(PCIQXLDevice
*qxl
, QXLCookie
*cookie
)
840 uint32_t current_async
;
842 qemu_mutex_lock(&qxl
->async_lock
);
843 current_async
= qxl
->current_async
;
844 qxl
->current_async
= QXL_UNDEFINED_IO
;
845 qemu_mutex_unlock(&qxl
->async_lock
);
847 trace_qxl_interface_async_complete_io(qxl
->id
, current_async
, cookie
);
849 fprintf(stderr
, "qxl: %s: error, cookie is NULL\n", __func__
);
852 if (cookie
&& current_async
!= cookie
->io
) {
854 "qxl: %s: error: current_async = %d != %"
855 PRId64
" = cookie->io\n", __func__
, current_async
, cookie
->io
);
857 switch (current_async
) {
858 case QXL_IO_MEMSLOT_ADD_ASYNC
:
859 case QXL_IO_DESTROY_PRIMARY_ASYNC
:
860 case QXL_IO_UPDATE_AREA_ASYNC
:
861 case QXL_IO_FLUSH_SURFACES_ASYNC
:
862 case QXL_IO_MONITORS_CONFIG_ASYNC
:
864 case QXL_IO_CREATE_PRIMARY_ASYNC
:
865 qxl_create_guest_primary_complete(qxl
);
867 case QXL_IO_DESTROY_ALL_SURFACES_ASYNC
:
868 qxl_spice_destroy_surfaces_complete(qxl
);
870 case QXL_IO_DESTROY_SURFACE_ASYNC
:
871 qxl_spice_destroy_surface_wait_complete(qxl
, cookie
->u
.surface_id
);
874 fprintf(stderr
, "qxl: %s: unexpected current_async %d\n", __func__
,
877 qxl_send_events(qxl
, QXL_INTERRUPT_IO_CMD
);
880 /* called from spice server thread context only */
881 static void interface_update_area_complete(QXLInstance
*sin
,
883 QXLRect
*dirty
, uint32_t num_updated_rects
)
885 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
889 qemu_mutex_lock(&qxl
->ssd
.lock
);
890 if (surface_id
!= 0 || !qxl
->render_update_cookie_num
) {
891 qemu_mutex_unlock(&qxl
->ssd
.lock
);
894 trace_qxl_interface_update_area_complete(qxl
->id
, surface_id
, dirty
->left
,
895 dirty
->right
, dirty
->top
, dirty
->bottom
);
896 trace_qxl_interface_update_area_complete_rest(qxl
->id
, num_updated_rects
);
897 if (qxl
->num_dirty_rects
+ num_updated_rects
> QXL_NUM_DIRTY_RECTS
) {
899 * overflow - treat this as a full update. Not expected to be common.
901 trace_qxl_interface_update_area_complete_overflow(qxl
->id
,
902 QXL_NUM_DIRTY_RECTS
);
903 qxl
->guest_primary
.resized
= 1;
905 if (qxl
->guest_primary
.resized
) {
907 * Don't bother copying or scheduling the bh since we will flip
908 * the whole area anyway on completion of the update_area async call
910 qemu_mutex_unlock(&qxl
->ssd
.lock
);
913 qxl_i
= qxl
->num_dirty_rects
;
914 for (i
= 0; i
< num_updated_rects
; i
++) {
915 qxl
->dirty
[qxl_i
++] = dirty
[i
];
917 qxl
->num_dirty_rects
+= num_updated_rects
;
918 trace_qxl_interface_update_area_complete_schedule_bh(qxl
->id
,
919 qxl
->num_dirty_rects
);
920 qemu_bh_schedule(qxl
->update_area_bh
);
921 qemu_mutex_unlock(&qxl
->ssd
.lock
);
924 /* called from spice server thread context only */
925 static void interface_async_complete(QXLInstance
*sin
, uint64_t cookie_token
)
927 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
928 QXLCookie
*cookie
= (QXLCookie
*)(uintptr_t)cookie_token
;
930 switch (cookie
->type
) {
931 case QXL_COOKIE_TYPE_IO
:
932 interface_async_complete_io(qxl
, cookie
);
935 case QXL_COOKIE_TYPE_RENDER_UPDATE_AREA
:
936 qxl_render_update_area_done(qxl
, cookie
);
938 case QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG
:
941 fprintf(stderr
, "qxl: %s: unexpected cookie type %d\n",
942 __func__
, cookie
->type
);
947 static const QXLInterface qxl_interface
= {
948 .base
.type
= SPICE_INTERFACE_QXL
,
949 .base
.description
= "qxl gpu",
950 .base
.major_version
= SPICE_INTERFACE_QXL_MAJOR
,
951 .base
.minor_version
= SPICE_INTERFACE_QXL_MINOR
,
953 .attache_worker
= interface_attach_worker
,
954 .set_compression_level
= interface_set_compression_level
,
955 .set_mm_time
= interface_set_mm_time
,
956 .get_init_info
= interface_get_init_info
,
958 /* the callbacks below are called from spice server thread context */
959 .get_command
= interface_get_command
,
960 .req_cmd_notification
= interface_req_cmd_notification
,
961 .release_resource
= interface_release_resource
,
962 .get_cursor_command
= interface_get_cursor_command
,
963 .req_cursor_notification
= interface_req_cursor_notification
,
964 .notify_update
= interface_notify_update
,
965 .flush_resources
= interface_flush_resources
,
966 .async_complete
= interface_async_complete
,
967 .update_area_complete
= interface_update_area_complete
,
970 static void qxl_enter_vga_mode(PCIQXLDevice
*d
)
972 if (d
->mode
== QXL_MODE_VGA
) {
975 trace_qxl_enter_vga_mode(d
->id
);
976 qemu_spice_create_host_primary(&d
->ssd
);
977 d
->mode
= QXL_MODE_VGA
;
978 memset(&d
->ssd
.dirty
, 0, sizeof(d
->ssd
.dirty
));
979 vga_dirty_log_start(&d
->vga
);
982 static void qxl_exit_vga_mode(PCIQXLDevice
*d
)
984 if (d
->mode
!= QXL_MODE_VGA
) {
987 trace_qxl_exit_vga_mode(d
->id
);
988 vga_dirty_log_stop(&d
->vga
);
989 qxl_destroy_primary(d
, QXL_SYNC
);
992 static void qxl_update_irq(PCIQXLDevice
*d
)
994 uint32_t pending
= le32_to_cpu(d
->ram
->int_pending
);
995 uint32_t mask
= le32_to_cpu(d
->ram
->int_mask
);
996 int level
= !!(pending
& mask
);
997 qemu_set_irq(d
->pci
.irq
[0], level
);
998 qxl_ring_set_dirty(d
);
1001 static void qxl_check_state(PCIQXLDevice
*d
)
1003 QXLRam
*ram
= d
->ram
;
1004 int spice_display_running
= qemu_spice_display_is_running(&d
->ssd
);
1006 assert(!spice_display_running
|| SPICE_RING_IS_EMPTY(&ram
->cmd_ring
));
1007 assert(!spice_display_running
|| SPICE_RING_IS_EMPTY(&ram
->cursor_ring
));
1010 static void qxl_reset_state(PCIQXLDevice
*d
)
1012 QXLRom
*rom
= d
->rom
;
1015 d
->shadow_rom
.update_id
= cpu_to_le32(0);
1016 *rom
= d
->shadow_rom
;
1017 qxl_rom_set_dirty(d
);
1019 d
->num_free_res
= 0;
1020 d
->last_release
= NULL
;
1021 memset(&d
->ssd
.dirty
, 0, sizeof(d
->ssd
.dirty
));
1024 static void qxl_soft_reset(PCIQXLDevice
*d
)
1026 trace_qxl_soft_reset(d
->id
);
1028 qxl_clear_guest_bug(d
);
1029 d
->current_async
= QXL_UNDEFINED_IO
;
1032 qxl_enter_vga_mode(d
);
1034 d
->mode
= QXL_MODE_UNDEFINED
;
1038 static void qxl_hard_reset(PCIQXLDevice
*d
, int loadvm
)
1040 trace_qxl_hard_reset(d
->id
, loadvm
);
1042 qxl_spice_reset_cursor(d
);
1043 qxl_spice_reset_image_cache(d
);
1044 qxl_reset_surfaces(d
);
1045 qxl_reset_memslots(d
);
1047 /* pre loadvm reset must not touch QXLRam. This lives in
1048 * device memory, is migrated together with RAM and thus
1049 * already loaded at this point */
1053 qemu_spice_create_host_memslot(&d
->ssd
);
1057 static void qxl_reset_handler(DeviceState
*dev
)
1059 PCIQXLDevice
*d
= DO_UPCAST(PCIQXLDevice
, pci
.qdev
, dev
);
1061 qxl_hard_reset(d
, 0);
1064 static void qxl_vga_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
1066 VGACommonState
*vga
= opaque
;
1067 PCIQXLDevice
*qxl
= container_of(vga
, PCIQXLDevice
, vga
);
1069 trace_qxl_io_write_vga(qxl
->id
, qxl_mode_to_string(qxl
->mode
), addr
, val
);
1070 if (qxl
->mode
!= QXL_MODE_VGA
) {
1071 qxl_destroy_primary(qxl
, QXL_SYNC
);
1072 qxl_soft_reset(qxl
);
1074 vga_ioport_write(opaque
, addr
, val
);
1077 static const MemoryRegionPortio qxl_vga_portio_list
[] = {
1078 { 0x04, 2, 1, .read
= vga_ioport_read
,
1079 .write
= qxl_vga_ioport_write
}, /* 3b4 */
1080 { 0x0a, 1, 1, .read
= vga_ioport_read
,
1081 .write
= qxl_vga_ioport_write
}, /* 3ba */
1082 { 0x10, 16, 1, .read
= vga_ioport_read
,
1083 .write
= qxl_vga_ioport_write
}, /* 3c0 */
1084 { 0x24, 2, 1, .read
= vga_ioport_read
,
1085 .write
= qxl_vga_ioport_write
}, /* 3d4 */
1086 { 0x2a, 1, 1, .read
= vga_ioport_read
,
1087 .write
= qxl_vga_ioport_write
}, /* 3da */
1088 PORTIO_END_OF_LIST(),
1091 static int qxl_add_memslot(PCIQXLDevice
*d
, uint32_t slot_id
, uint64_t delta
,
1094 static const int regions
[] = {
1095 QXL_RAM_RANGE_INDEX
,
1096 QXL_VRAM_RANGE_INDEX
,
1097 QXL_VRAM64_RANGE_INDEX
,
1099 uint64_t guest_start
;
1104 intptr_t virt_start
;
1105 QXLDevMemSlot memslot
;
1108 guest_start
= le64_to_cpu(d
->guest_slots
[slot_id
].slot
.mem_start
);
1109 guest_end
= le64_to_cpu(d
->guest_slots
[slot_id
].slot
.mem_end
);
1111 trace_qxl_memslot_add_guest(d
->id
, slot_id
, guest_start
, guest_end
);
1113 if (slot_id
>= NUM_MEMSLOTS
) {
1114 qxl_set_guest_bug(d
, "%s: slot_id >= NUM_MEMSLOTS %d >= %d", __func__
,
1115 slot_id
, NUM_MEMSLOTS
);
1118 if (guest_start
> guest_end
) {
1119 qxl_set_guest_bug(d
, "%s: guest_start > guest_end 0x%" PRIx64
1120 " > 0x%" PRIx64
, __func__
, guest_start
, guest_end
);
1124 for (i
= 0; i
< ARRAY_SIZE(regions
); i
++) {
1125 pci_region
= regions
[i
];
1126 pci_start
= d
->pci
.io_regions
[pci_region
].addr
;
1127 pci_end
= pci_start
+ d
->pci
.io_regions
[pci_region
].size
;
1129 if (pci_start
== -1) {
1132 /* start address in range ? */
1133 if (guest_start
< pci_start
|| guest_start
> pci_end
) {
1136 /* end address in range ? */
1137 if (guest_end
> pci_end
) {
1143 if (i
== ARRAY_SIZE(regions
)) {
1144 qxl_set_guest_bug(d
, "%s: finished loop without match", __func__
);
1148 switch (pci_region
) {
1149 case QXL_RAM_RANGE_INDEX
:
1150 virt_start
= (intptr_t)memory_region_get_ram_ptr(&d
->vga
.vram
);
1152 case QXL_VRAM_RANGE_INDEX
:
1153 case 4 /* vram 64bit */:
1154 virt_start
= (intptr_t)memory_region_get_ram_ptr(&d
->vram_bar
);
1157 /* should not happen */
1158 qxl_set_guest_bug(d
, "%s: pci_region = %d", __func__
, pci_region
);
1162 memslot
.slot_id
= slot_id
;
1163 memslot
.slot_group_id
= MEMSLOT_GROUP_GUEST
; /* guest group */
1164 memslot
.virt_start
= virt_start
+ (guest_start
- pci_start
);
1165 memslot
.virt_end
= virt_start
+ (guest_end
- pci_start
);
1166 memslot
.addr_delta
= memslot
.virt_start
- delta
;
1167 memslot
.generation
= d
->rom
->slot_generation
= 0;
1168 qxl_rom_set_dirty(d
);
1170 qemu_spice_add_memslot(&d
->ssd
, &memslot
, async
);
1171 d
->guest_slots
[slot_id
].ptr
= (void*)memslot
.virt_start
;
1172 d
->guest_slots
[slot_id
].size
= memslot
.virt_end
- memslot
.virt_start
;
1173 d
->guest_slots
[slot_id
].delta
= delta
;
1174 d
->guest_slots
[slot_id
].active
= 1;
1178 static void qxl_del_memslot(PCIQXLDevice
*d
, uint32_t slot_id
)
1180 qemu_spice_del_memslot(&d
->ssd
, MEMSLOT_GROUP_HOST
, slot_id
);
1181 d
->guest_slots
[slot_id
].active
= 0;
1184 static void qxl_reset_memslots(PCIQXLDevice
*d
)
1186 qxl_spice_reset_memslots(d
);
1187 memset(&d
->guest_slots
, 0, sizeof(d
->guest_slots
));
1190 static void qxl_reset_surfaces(PCIQXLDevice
*d
)
1192 trace_qxl_reset_surfaces(d
->id
);
1193 d
->mode
= QXL_MODE_UNDEFINED
;
1194 qxl_spice_destroy_surfaces(d
, QXL_SYNC
);
1197 /* can be also called from spice server thread context */
1198 void *qxl_phys2virt(PCIQXLDevice
*qxl
, QXLPHYSICAL pqxl
, int group_id
)
1200 uint64_t phys
= le64_to_cpu(pqxl
);
1201 uint32_t slot
= (phys
>> (64 - 8)) & 0xff;
1202 uint64_t offset
= phys
& 0xffffffffffff;
1205 case MEMSLOT_GROUP_HOST
:
1206 return (void *)(intptr_t)offset
;
1207 case MEMSLOT_GROUP_GUEST
:
1208 if (slot
>= NUM_MEMSLOTS
) {
1209 qxl_set_guest_bug(qxl
, "slot too large %d >= %d", slot
,
1213 if (!qxl
->guest_slots
[slot
].active
) {
1214 qxl_set_guest_bug(qxl
, "inactive slot %d\n", slot
);
1217 if (offset
< qxl
->guest_slots
[slot
].delta
) {
1218 qxl_set_guest_bug(qxl
,
1219 "slot %d offset %"PRIu64
" < delta %"PRIu64
"\n",
1220 slot
, offset
, qxl
->guest_slots
[slot
].delta
);
1223 offset
-= qxl
->guest_slots
[slot
].delta
;
1224 if (offset
> qxl
->guest_slots
[slot
].size
) {
1225 qxl_set_guest_bug(qxl
,
1226 "slot %d offset %"PRIu64
" > size %"PRIu64
"\n",
1227 slot
, offset
, qxl
->guest_slots
[slot
].size
);
1230 return qxl
->guest_slots
[slot
].ptr
+ offset
;
1235 static void qxl_create_guest_primary_complete(PCIQXLDevice
*qxl
)
1237 /* for local rendering */
1238 qxl_render_resize(qxl
);
1241 static void qxl_create_guest_primary(PCIQXLDevice
*qxl
, int loadvm
,
1244 QXLDevSurfaceCreate surface
;
1245 QXLSurfaceCreate
*sc
= &qxl
->guest_primary
.surface
;
1247 int requested_height
= le32_to_cpu(sc
->height
);
1248 int requested_stride
= le32_to_cpu(sc
->stride
);
1250 size
= abs(requested_stride
) * requested_height
;
1251 if (size
> qxl
->vgamem_size
) {
1252 qxl_set_guest_bug(qxl
, "%s: requested primary larger then framebuffer"
1257 if (qxl
->mode
== QXL_MODE_NATIVE
) {
1258 qxl_set_guest_bug(qxl
, "%s: nop since already in QXL_MODE_NATIVE",
1261 qxl_exit_vga_mode(qxl
);
1263 surface
.format
= le32_to_cpu(sc
->format
);
1264 surface
.height
= le32_to_cpu(sc
->height
);
1265 surface
.mem
= le64_to_cpu(sc
->mem
);
1266 surface
.position
= le32_to_cpu(sc
->position
);
1267 surface
.stride
= le32_to_cpu(sc
->stride
);
1268 surface
.width
= le32_to_cpu(sc
->width
);
1269 surface
.type
= le32_to_cpu(sc
->type
);
1270 surface
.flags
= le32_to_cpu(sc
->flags
);
1271 trace_qxl_create_guest_primary(qxl
->id
, sc
->width
, sc
->height
, sc
->mem
,
1272 sc
->format
, sc
->position
);
1273 trace_qxl_create_guest_primary_rest(qxl
->id
, sc
->stride
, sc
->type
,
1276 surface
.mouse_mode
= true;
1277 surface
.group_id
= MEMSLOT_GROUP_GUEST
;
1279 surface
.flags
|= QXL_SURF_FLAG_KEEP_DATA
;
1282 qxl
->mode
= QXL_MODE_NATIVE
;
1284 qemu_spice_create_primary_surface(&qxl
->ssd
, 0, &surface
, async
);
1286 if (async
== QXL_SYNC
) {
1287 qxl_create_guest_primary_complete(qxl
);
1291 /* return 1 if surface destoy was initiated (in QXL_ASYNC case) or
1292 * done (in QXL_SYNC case), 0 otherwise. */
1293 static int qxl_destroy_primary(PCIQXLDevice
*d
, qxl_async_io async
)
1295 if (d
->mode
== QXL_MODE_UNDEFINED
) {
1298 trace_qxl_destroy_primary(d
->id
);
1299 d
->mode
= QXL_MODE_UNDEFINED
;
1300 qemu_spice_destroy_primary_surface(&d
->ssd
, 0, async
);
1301 qxl_spice_reset_cursor(d
);
1305 static void qxl_set_mode(PCIQXLDevice
*d
, int modenr
, int loadvm
)
1307 pcibus_t start
= d
->pci
.io_regions
[QXL_RAM_RANGE_INDEX
].addr
;
1308 pcibus_t end
= d
->pci
.io_regions
[QXL_RAM_RANGE_INDEX
].size
+ start
;
1309 QXLMode
*mode
= d
->modes
->modes
+ modenr
;
1310 uint64_t devmem
= d
->pci
.io_regions
[QXL_RAM_RANGE_INDEX
].addr
;
1315 QXLSurfaceCreate surface
= {
1316 .width
= mode
->x_res
,
1317 .height
= mode
->y_res
,
1318 .stride
= -mode
->x_res
* 4,
1319 .format
= SPICE_SURFACE_FMT_32_xRGB
,
1320 .flags
= loadvm
? QXL_SURF_FLAG_KEEP_DATA
: 0,
1322 .mem
= devmem
+ d
->shadow_rom
.draw_area_offset
,
1325 trace_qxl_set_mode(d
->id
, modenr
, mode
->x_res
, mode
->y_res
, mode
->bits
,
1328 qxl_hard_reset(d
, 0);
1331 d
->guest_slots
[0].slot
= slot
;
1332 assert(qxl_add_memslot(d
, 0, devmem
, QXL_SYNC
) == 0);
1334 d
->guest_primary
.surface
= surface
;
1335 qxl_create_guest_primary(d
, 0, QXL_SYNC
);
1337 d
->mode
= QXL_MODE_COMPAT
;
1338 d
->cmdflags
= QXL_COMMAND_FLAG_COMPAT
;
1339 #ifdef QXL_COMMAND_FLAG_COMPAT_16BPP /* new in spice 0.6.1 */
1340 if (mode
->bits
== 16) {
1341 d
->cmdflags
|= QXL_COMMAND_FLAG_COMPAT_16BPP
;
1344 d
->shadow_rom
.mode
= cpu_to_le32(modenr
);
1345 d
->rom
->mode
= cpu_to_le32(modenr
);
1346 qxl_rom_set_dirty(d
);
1349 static void ioport_write(void *opaque
, target_phys_addr_t addr
,
1350 uint64_t val
, unsigned size
)
1352 PCIQXLDevice
*d
= opaque
;
1353 uint32_t io_port
= addr
;
1354 qxl_async_io async
= QXL_SYNC
;
1355 uint32_t orig_io_port
= io_port
;
1357 if (d
->guest_bug
&& !io_port
== QXL_IO_RESET
) {
1361 if (d
->revision
<= QXL_REVISION_STABLE_V10
&&
1362 io_port
>= QXL_IO_FLUSH_SURFACES_ASYNC
) {
1363 qxl_set_guest_bug(d
, "unsupported io %d for revision %d\n",
1364 io_port
, d
->revision
);
1370 case QXL_IO_SET_MODE
:
1371 case QXL_IO_MEMSLOT_ADD
:
1372 case QXL_IO_MEMSLOT_DEL
:
1373 case QXL_IO_CREATE_PRIMARY
:
1374 case QXL_IO_UPDATE_IRQ
:
1376 case QXL_IO_MEMSLOT_ADD_ASYNC
:
1377 case QXL_IO_CREATE_PRIMARY_ASYNC
:
1380 if (d
->mode
!= QXL_MODE_VGA
) {
1383 trace_qxl_io_unexpected_vga_mode(d
->id
,
1384 io_port
, io_port_to_string(io_port
));
1385 /* be nice to buggy guest drivers */
1386 if (io_port
>= QXL_IO_UPDATE_AREA_ASYNC
&&
1387 io_port
< QXL_IO_RANGE_SIZE
) {
1388 qxl_send_events(d
, QXL_INTERRUPT_IO_CMD
);
1393 /* we change the io_port to avoid ifdeffery in the main switch */
1394 orig_io_port
= io_port
;
1396 case QXL_IO_UPDATE_AREA_ASYNC
:
1397 io_port
= QXL_IO_UPDATE_AREA
;
1399 case QXL_IO_MEMSLOT_ADD_ASYNC
:
1400 io_port
= QXL_IO_MEMSLOT_ADD
;
1402 case QXL_IO_CREATE_PRIMARY_ASYNC
:
1403 io_port
= QXL_IO_CREATE_PRIMARY
;
1405 case QXL_IO_DESTROY_PRIMARY_ASYNC
:
1406 io_port
= QXL_IO_DESTROY_PRIMARY
;
1408 case QXL_IO_DESTROY_SURFACE_ASYNC
:
1409 io_port
= QXL_IO_DESTROY_SURFACE_WAIT
;
1411 case QXL_IO_DESTROY_ALL_SURFACES_ASYNC
:
1412 io_port
= QXL_IO_DESTROY_ALL_SURFACES
;
1414 case QXL_IO_FLUSH_SURFACES_ASYNC
:
1415 case QXL_IO_MONITORS_CONFIG_ASYNC
:
1418 qemu_mutex_lock(&d
->async_lock
);
1419 if (d
->current_async
!= QXL_UNDEFINED_IO
) {
1420 qxl_set_guest_bug(d
, "%d async started before last (%d) complete",
1421 io_port
, d
->current_async
);
1422 qemu_mutex_unlock(&d
->async_lock
);
1425 d
->current_async
= orig_io_port
;
1426 qemu_mutex_unlock(&d
->async_lock
);
1431 trace_qxl_io_write(d
->id
, qxl_mode_to_string(d
->mode
), addr
, val
, size
,
1435 case QXL_IO_UPDATE_AREA
:
1437 QXLCookie
*cookie
= NULL
;
1438 QXLRect update
= d
->ram
->update_area
;
1440 if (d
->ram
->update_surface
> NUM_SURFACES
) {
1441 qxl_set_guest_bug(d
, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
1442 d
->ram
->update_surface
);
1445 if (update
.left
>= update
.right
|| update
.top
>= update
.bottom
) {
1446 qxl_set_guest_bug(d
,
1447 "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
1448 update
.left
, update
.top
, update
.right
, update
.bottom
);
1452 if (update
.left
< 0 || update
.top
< 0 || update
.left
>= update
.right
||
1453 update
.top
>= update
.bottom
) {
1454 qxl_set_guest_bug(d
, "QXL_IO_UPDATE_AREA: "
1455 "invalid area(%d,%d,%d,%d)\n", update
.left
,
1456 update
.right
, update
.top
, update
.bottom
);
1459 if (async
== QXL_ASYNC
) {
1460 cookie
= qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
1461 QXL_IO_UPDATE_AREA_ASYNC
);
1462 cookie
->u
.area
= update
;
1464 qxl_spice_update_area(d
, d
->ram
->update_surface
,
1465 cookie
? &cookie
->u
.area
: &update
,
1466 NULL
, 0, 0, async
, cookie
);
1469 case QXL_IO_NOTIFY_CMD
:
1470 qemu_spice_wakeup(&d
->ssd
);
1472 case QXL_IO_NOTIFY_CURSOR
:
1473 qemu_spice_wakeup(&d
->ssd
);
1475 case QXL_IO_UPDATE_IRQ
:
1478 case QXL_IO_NOTIFY_OOM
:
1479 if (!SPICE_RING_IS_EMPTY(&d
->ram
->release_ring
)) {
1486 case QXL_IO_SET_MODE
:
1487 qxl_set_mode(d
, val
, 0);
1490 if (d
->guestdebug
) {
1491 fprintf(stderr
, "qxl/guest-%d: %" PRId64
": %s", d
->id
,
1492 qemu_get_clock_ns(vm_clock
), d
->ram
->log_buf
);
1496 qxl_hard_reset(d
, 0);
1498 case QXL_IO_MEMSLOT_ADD
:
1499 if (val
>= NUM_MEMSLOTS
) {
1500 qxl_set_guest_bug(d
, "QXL_IO_MEMSLOT_ADD: val out of range");
1503 if (d
->guest_slots
[val
].active
) {
1504 qxl_set_guest_bug(d
,
1505 "QXL_IO_MEMSLOT_ADD: memory slot already active");
1508 d
->guest_slots
[val
].slot
= d
->ram
->mem_slot
;
1509 qxl_add_memslot(d
, val
, 0, async
);
1511 case QXL_IO_MEMSLOT_DEL
:
1512 if (val
>= NUM_MEMSLOTS
) {
1513 qxl_set_guest_bug(d
, "QXL_IO_MEMSLOT_DEL: val out of range");
1516 qxl_del_memslot(d
, val
);
1518 case QXL_IO_CREATE_PRIMARY
:
1520 qxl_set_guest_bug(d
, "QXL_IO_CREATE_PRIMARY (async=%d): val != 0",
1524 d
->guest_primary
.surface
= d
->ram
->create_surface
;
1525 qxl_create_guest_primary(d
, 0, async
);
1527 case QXL_IO_DESTROY_PRIMARY
:
1529 qxl_set_guest_bug(d
, "QXL_IO_DESTROY_PRIMARY (async=%d): val != 0",
1533 if (!qxl_destroy_primary(d
, async
)) {
1534 trace_qxl_io_destroy_primary_ignored(d
->id
,
1535 qxl_mode_to_string(d
->mode
));
1539 case QXL_IO_DESTROY_SURFACE_WAIT
:
1540 if (val
>= NUM_SURFACES
) {
1541 qxl_set_guest_bug(d
, "QXL_IO_DESTROY_SURFACE (async=%d):"
1542 "%" PRIu64
" >= NUM_SURFACES", async
, val
);
1545 qxl_spice_destroy_surface_wait(d
, val
, async
);
1547 case QXL_IO_FLUSH_RELEASE
: {
1548 QXLReleaseRing
*ring
= &d
->ram
->release_ring
;
1549 if (ring
->prod
- ring
->cons
+ 1 == ring
->num_items
) {
1551 "ERROR: no flush, full release ring [p%d,%dc]\n",
1552 ring
->prod
, ring
->cons
);
1554 qxl_push_free_res(d
, 1 /* flush */);
1557 case QXL_IO_FLUSH_SURFACES_ASYNC
:
1558 qxl_spice_flush_surfaces_async(d
);
1560 case QXL_IO_DESTROY_ALL_SURFACES
:
1561 d
->mode
= QXL_MODE_UNDEFINED
;
1562 qxl_spice_destroy_surfaces(d
, async
);
1564 case QXL_IO_MONITORS_CONFIG_ASYNC
:
1565 qxl_spice_monitors_config_async(d
, 0);
1568 qxl_set_guest_bug(d
, "%s: unexpected ioport=0x%x\n", __func__
, io_port
);
1573 qxl_send_events(d
, QXL_INTERRUPT_IO_CMD
);
1574 qemu_mutex_lock(&d
->async_lock
);
1575 d
->current_async
= QXL_UNDEFINED_IO
;
1576 qemu_mutex_unlock(&d
->async_lock
);
1580 static uint64_t ioport_read(void *opaque
, target_phys_addr_t addr
,
1583 PCIQXLDevice
*d
= opaque
;
1585 trace_qxl_io_read_unexpected(d
->id
);
1589 static const MemoryRegionOps qxl_io_ops
= {
1590 .read
= ioport_read
,
1591 .write
= ioport_write
,
1593 .min_access_size
= 1,
1594 .max_access_size
= 1,
1598 static void pipe_read(void *opaque
)
1600 PCIQXLDevice
*d
= opaque
;
1605 len
= read(d
->pipe
[0], &dummy
, sizeof(dummy
));
1606 } while (len
== sizeof(dummy
));
1610 static void qxl_send_events(PCIQXLDevice
*d
, uint32_t events
)
1612 uint32_t old_pending
;
1613 uint32_t le_events
= cpu_to_le32(events
);
1615 assert(qemu_spice_display_is_running(&d
->ssd
));
1616 old_pending
= __sync_fetch_and_or(&d
->ram
->int_pending
, le_events
);
1617 if ((old_pending
& le_events
) == le_events
) {
1620 if (qemu_thread_is_self(&d
->main
)) {
1623 if (write(d
->pipe
[1], d
, 1) != 1) {
1624 dprint(d
, 1, "%s: write to pipe failed\n", __func__
);
1629 static void init_pipe_signaling(PCIQXLDevice
*d
)
1631 if (pipe(d
->pipe
) < 0) {
1632 fprintf(stderr
, "%s:%s: qxl pipe creation failed\n",
1633 __FILE__
, __func__
);
1636 fcntl(d
->pipe
[0], F_SETFL
, O_NONBLOCK
);
1637 fcntl(d
->pipe
[1], F_SETFL
, O_NONBLOCK
);
1638 fcntl(d
->pipe
[0], F_SETOWN
, getpid());
1640 qemu_thread_get_self(&d
->main
);
1641 qemu_set_fd_handler(d
->pipe
[0], pipe_read
, NULL
, d
);
1644 /* graphics console */
1646 static void qxl_hw_update(void *opaque
)
1648 PCIQXLDevice
*qxl
= opaque
;
1649 VGACommonState
*vga
= &qxl
->vga
;
1651 switch (qxl
->mode
) {
1655 case QXL_MODE_COMPAT
:
1656 case QXL_MODE_NATIVE
:
1657 qxl_render_update(qxl
);
1664 static void qxl_hw_invalidate(void *opaque
)
1666 PCIQXLDevice
*qxl
= opaque
;
1667 VGACommonState
*vga
= &qxl
->vga
;
1669 vga
->invalidate(vga
);
1672 static void qxl_hw_screen_dump(void *opaque
, const char *filename
, bool cswitch
)
1674 PCIQXLDevice
*qxl
= opaque
;
1675 VGACommonState
*vga
= &qxl
->vga
;
1677 switch (qxl
->mode
) {
1678 case QXL_MODE_COMPAT
:
1679 case QXL_MODE_NATIVE
:
1680 qxl_render_update(qxl
);
1681 ppm_save(filename
, qxl
->ssd
.ds
->surface
);
1684 vga
->screen_dump(vga
, filename
, cswitch
);
1691 static void qxl_hw_text_update(void *opaque
, console_ch_t
*chardata
)
1693 PCIQXLDevice
*qxl
= opaque
;
1694 VGACommonState
*vga
= &qxl
->vga
;
1696 if (qxl
->mode
== QXL_MODE_VGA
) {
1697 vga
->text_update(vga
, chardata
);
1702 static void qxl_dirty_surfaces(PCIQXLDevice
*qxl
)
1704 intptr_t vram_start
;
1707 if (qxl
->mode
!= QXL_MODE_NATIVE
&& qxl
->mode
!= QXL_MODE_COMPAT
) {
1711 /* dirty the primary surface */
1712 qxl_set_dirty(&qxl
->vga
.vram
, qxl
->shadow_rom
.draw_area_offset
,
1713 qxl
->shadow_rom
.surface0_area_size
);
1715 vram_start
= (intptr_t)memory_region_get_ram_ptr(&qxl
->vram_bar
);
1717 /* dirty the off-screen surfaces */
1718 for (i
= 0; i
< NUM_SURFACES
; i
++) {
1720 intptr_t surface_offset
;
1723 if (qxl
->guest_surfaces
.cmds
[i
] == 0) {
1727 cmd
= qxl_phys2virt(qxl
, qxl
->guest_surfaces
.cmds
[i
],
1728 MEMSLOT_GROUP_GUEST
);
1730 assert(cmd
->type
== QXL_SURFACE_CMD_CREATE
);
1731 surface_offset
= (intptr_t)qxl_phys2virt(qxl
,
1732 cmd
->u
.surface_create
.data
,
1733 MEMSLOT_GROUP_GUEST
);
1734 assert(surface_offset
);
1735 surface_offset
-= vram_start
;
1736 surface_size
= cmd
->u
.surface_create
.height
*
1737 abs(cmd
->u
.surface_create
.stride
);
1738 trace_qxl_surfaces_dirty(qxl
->id
, i
, (int)surface_offset
, surface_size
);
1739 qxl_set_dirty(&qxl
->vram_bar
, surface_offset
, surface_size
);
1743 static void qxl_vm_change_state_handler(void *opaque
, int running
,
1746 PCIQXLDevice
*qxl
= opaque
;
1747 qemu_spice_vm_change_state_handler(&qxl
->ssd
, running
, state
);
1751 * if qxl_send_events was called from spice server context before
1752 * migration ended, qxl_update_irq for these events might not have been
1755 qxl_update_irq(qxl
);
1757 /* make sure surfaces are saved before migration */
1758 qxl_dirty_surfaces(qxl
);
1762 /* display change listener */
1764 static void display_update(struct DisplayState
*ds
, int x
, int y
, int w
, int h
)
1766 if (qxl0
->mode
== QXL_MODE_VGA
) {
1767 qemu_spice_display_update(&qxl0
->ssd
, x
, y
, w
, h
);
1771 static void display_resize(struct DisplayState
*ds
)
1773 if (qxl0
->mode
== QXL_MODE_VGA
) {
1774 qemu_spice_display_resize(&qxl0
->ssd
);
1778 static void display_refresh(struct DisplayState
*ds
)
1780 if (qxl0
->mode
== QXL_MODE_VGA
) {
1781 qemu_spice_display_refresh(&qxl0
->ssd
);
1783 qemu_mutex_lock(&qxl0
->ssd
.lock
);
1784 qemu_spice_cursor_refresh_unlocked(&qxl0
->ssd
);
1785 qemu_mutex_unlock(&qxl0
->ssd
.lock
);
1789 static DisplayChangeListener display_listener
= {
1790 .dpy_update
= display_update
,
1791 .dpy_resize
= display_resize
,
1792 .dpy_refresh
= display_refresh
,
1795 static void qxl_init_ramsize(PCIQXLDevice
*qxl
)
1797 /* vga mode framebuffer / primary surface (bar 0, first part) */
1798 if (qxl
->vgamem_size_mb
< 8) {
1799 qxl
->vgamem_size_mb
= 8;
1801 qxl
->vgamem_size
= qxl
->vgamem_size_mb
* 1024 * 1024;
1803 /* vga ram (bar 0, total) */
1804 if (qxl
->ram_size_mb
!= -1) {
1805 qxl
->vga
.vram_size
= qxl
->ram_size_mb
* 1024 * 1024;
1807 if (qxl
->vga
.vram_size
< qxl
->vgamem_size
* 2) {
1808 qxl
->vga
.vram_size
= qxl
->vgamem_size
* 2;
1811 /* vram32 (surfaces, 32bit, bar 1) */
1812 if (qxl
->vram32_size_mb
!= -1) {
1813 qxl
->vram32_size
= qxl
->vram32_size_mb
* 1024 * 1024;
1815 if (qxl
->vram32_size
< 4096) {
1816 qxl
->vram32_size
= 4096;
1819 /* vram (surfaces, 64bit, bar 4+5) */
1820 if (qxl
->vram_size_mb
!= -1) {
1821 qxl
->vram_size
= qxl
->vram_size_mb
* 1024 * 1024;
1823 if (qxl
->vram_size
< qxl
->vram32_size
) {
1824 qxl
->vram_size
= qxl
->vram32_size
;
1827 if (qxl
->revision
== 1) {
1828 qxl
->vram32_size
= 4096;
1829 qxl
->vram_size
= 4096;
1831 qxl
->vgamem_size
= msb_mask(qxl
->vgamem_size
* 2 - 1);
1832 qxl
->vga
.vram_size
= msb_mask(qxl
->vga
.vram_size
* 2 - 1);
1833 qxl
->vram32_size
= msb_mask(qxl
->vram32_size
* 2 - 1);
1834 qxl
->vram_size
= msb_mask(qxl
->vram_size
* 2 - 1);
1837 static int qxl_init_common(PCIQXLDevice
*qxl
)
1839 uint8_t* config
= qxl
->pci
.config
;
1840 uint32_t pci_device_rev
;
1843 qxl
->mode
= QXL_MODE_UNDEFINED
;
1844 qxl
->generation
= 1;
1845 qxl
->num_memslots
= NUM_MEMSLOTS
;
1846 qxl
->num_surfaces
= NUM_SURFACES
;
1847 qemu_mutex_init(&qxl
->track_lock
);
1848 qemu_mutex_init(&qxl
->async_lock
);
1849 qxl
->current_async
= QXL_UNDEFINED_IO
;
1852 switch (qxl
->revision
) {
1853 case 1: /* spice 0.4 -- qxl-1 */
1854 pci_device_rev
= QXL_REVISION_STABLE_V04
;
1857 case 2: /* spice 0.6 -- qxl-2 */
1858 pci_device_rev
= QXL_REVISION_STABLE_V06
;
1862 pci_device_rev
= QXL_REVISION_STABLE_V10
;
1863 io_size
= 32; /* PCI region size must be pow2 */
1865 /* 0x000b01 == 0.11.1 */
1866 #if SPICE_SERVER_VERSION >= 0x000b01 && \
1867 defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
1869 pci_device_rev
= QXL_REVISION_STABLE_V12
;
1870 io_size
= msb_mask(QXL_IO_RANGE_SIZE
* 2 - 1);
1874 pci_device_rev
= QXL_DEFAULT_REVISION
;
1875 io_size
= msb_mask(QXL_IO_RANGE_SIZE
* 2 - 1);
1879 pci_set_byte(&config
[PCI_REVISION_ID
], pci_device_rev
);
1880 pci_set_byte(&config
[PCI_INTERRUPT_PIN
], 1);
1882 qxl
->rom_size
= qxl_rom_size();
1883 memory_region_init_ram(&qxl
->rom_bar
, "qxl.vrom", qxl
->rom_size
);
1884 vmstate_register_ram(&qxl
->rom_bar
, &qxl
->pci
.qdev
);
1888 memory_region_init_ram(&qxl
->vram_bar
, "qxl.vram", qxl
->vram_size
);
1889 vmstate_register_ram(&qxl
->vram_bar
, &qxl
->pci
.qdev
);
1890 memory_region_init_alias(&qxl
->vram32_bar
, "qxl.vram32", &qxl
->vram_bar
,
1891 0, qxl
->vram32_size
);
1893 memory_region_init_io(&qxl
->io_bar
, &qxl_io_ops
, qxl
,
1894 "qxl-ioports", io_size
);
1896 vga_dirty_log_start(&qxl
->vga
);
1900 pci_register_bar(&qxl
->pci
, QXL_IO_RANGE_INDEX
,
1901 PCI_BASE_ADDRESS_SPACE_IO
, &qxl
->io_bar
);
1903 pci_register_bar(&qxl
->pci
, QXL_ROM_RANGE_INDEX
,
1904 PCI_BASE_ADDRESS_SPACE_MEMORY
, &qxl
->rom_bar
);
1906 pci_register_bar(&qxl
->pci
, QXL_RAM_RANGE_INDEX
,
1907 PCI_BASE_ADDRESS_SPACE_MEMORY
, &qxl
->vga
.vram
);
1909 pci_register_bar(&qxl
->pci
, QXL_VRAM_RANGE_INDEX
,
1910 PCI_BASE_ADDRESS_SPACE_MEMORY
, &qxl
->vram32_bar
);
1912 if (qxl
->vram32_size
< qxl
->vram_size
) {
1914 * Make the 64bit vram bar show up only in case it is
1915 * configured to be larger than the 32bit vram bar.
1917 pci_register_bar(&qxl
->pci
, QXL_VRAM64_RANGE_INDEX
,
1918 PCI_BASE_ADDRESS_SPACE_MEMORY
|
1919 PCI_BASE_ADDRESS_MEM_TYPE_64
|
1920 PCI_BASE_ADDRESS_MEM_PREFETCH
,
1924 /* print pci bar details */
1925 dprint(qxl
, 1, "ram/%s: %d MB [region 0]\n",
1926 qxl
->id
== 0 ? "pri" : "sec",
1927 qxl
->vga
.vram_size
/ (1024*1024));
1928 dprint(qxl
, 1, "vram/32: %d MB [region 1]\n",
1929 qxl
->vram32_size
/ (1024*1024));
1930 dprint(qxl
, 1, "vram/64: %d MB %s\n",
1931 qxl
->vram_size
/ (1024*1024),
1932 qxl
->vram32_size
< qxl
->vram_size
? "[region 4]" : "[unmapped]");
1934 qxl
->ssd
.qxl
.base
.sif
= &qxl_interface
.base
;
1935 qxl
->ssd
.qxl
.id
= qxl
->id
;
1936 qemu_spice_add_interface(&qxl
->ssd
.qxl
.base
);
1937 qemu_add_vm_change_state_handler(qxl_vm_change_state_handler
, qxl
);
1939 init_pipe_signaling(qxl
);
1940 qxl_reset_state(qxl
);
1942 qxl
->update_area_bh
= qemu_bh_new(qxl_render_update_area_bh
, qxl
);
1947 static int qxl_init_primary(PCIDevice
*dev
)
1949 PCIQXLDevice
*qxl
= DO_UPCAST(PCIQXLDevice
, pci
, dev
);
1950 VGACommonState
*vga
= &qxl
->vga
;
1951 PortioList
*qxl_vga_port_list
= g_new(PortioList
, 1);
1954 qxl_init_ramsize(qxl
);
1955 vga
->vram_size_mb
= qxl
->vga
.vram_size
>> 20;
1956 vga_common_init(vga
);
1957 vga_init(vga
, pci_address_space(dev
), pci_address_space_io(dev
), false);
1958 portio_list_init(qxl_vga_port_list
, qxl_vga_portio_list
, vga
, "vga");
1959 portio_list_add(qxl_vga_port_list
, pci_address_space_io(dev
), 0x3b0);
1961 vga
->ds
= graphic_console_init(qxl_hw_update
, qxl_hw_invalidate
,
1962 qxl_hw_screen_dump
, qxl_hw_text_update
, qxl
);
1963 qemu_spice_display_init_common(&qxl
->ssd
, vga
->ds
);
1966 register_displaychangelistener(vga
->ds
, &display_listener
);
1968 return qxl_init_common(qxl
);
1971 static int qxl_init_secondary(PCIDevice
*dev
)
1973 static int device_id
= 1;
1974 PCIQXLDevice
*qxl
= DO_UPCAST(PCIQXLDevice
, pci
, dev
);
1976 qxl
->id
= device_id
++;
1977 qxl_init_ramsize(qxl
);
1978 memory_region_init_ram(&qxl
->vga
.vram
, "qxl.vgavram", qxl
->vga
.vram_size
);
1979 vmstate_register_ram(&qxl
->vga
.vram
, &qxl
->pci
.qdev
);
1980 qxl
->vga
.vram_ptr
= memory_region_get_ram_ptr(&qxl
->vga
.vram
);
1982 return qxl_init_common(qxl
);
1985 static void qxl_pre_save(void *opaque
)
1987 PCIQXLDevice
* d
= opaque
;
1988 uint8_t *ram_start
= d
->vga
.vram_ptr
;
1990 trace_qxl_pre_save(d
->id
);
1991 if (d
->last_release
== NULL
) {
1992 d
->last_release_offset
= 0;
1994 d
->last_release_offset
= (uint8_t *)d
->last_release
- ram_start
;
1996 assert(d
->last_release_offset
< d
->vga
.vram_size
);
1999 static int qxl_pre_load(void *opaque
)
2001 PCIQXLDevice
* d
= opaque
;
2003 trace_qxl_pre_load(d
->id
);
2004 qxl_hard_reset(d
, 1);
2005 qxl_exit_vga_mode(d
);
2009 static void qxl_create_memslots(PCIQXLDevice
*d
)
2013 for (i
= 0; i
< NUM_MEMSLOTS
; i
++) {
2014 if (!d
->guest_slots
[i
].active
) {
2017 qxl_add_memslot(d
, i
, 0, QXL_SYNC
);
2021 static int qxl_post_load(void *opaque
, int version
)
2023 PCIQXLDevice
* d
= opaque
;
2024 uint8_t *ram_start
= d
->vga
.vram_ptr
;
2025 QXLCommandExt
*cmds
;
2026 int in
, out
, newmode
;
2028 assert(d
->last_release_offset
< d
->vga
.vram_size
);
2029 if (d
->last_release_offset
== 0) {
2030 d
->last_release
= NULL
;
2032 d
->last_release
= (QXLReleaseInfo
*)(ram_start
+ d
->last_release_offset
);
2035 d
->modes
= (QXLModes
*)((uint8_t*)d
->rom
+ d
->rom
->modes_offset
);
2037 trace_qxl_post_load(d
->id
, qxl_mode_to_string(d
->mode
));
2039 d
->mode
= QXL_MODE_UNDEFINED
;
2042 case QXL_MODE_UNDEFINED
:
2045 qxl_create_memslots(d
);
2046 qxl_enter_vga_mode(d
);
2048 case QXL_MODE_NATIVE
:
2049 qxl_create_memslots(d
);
2050 qxl_create_guest_primary(d
, 1, QXL_SYNC
);
2052 /* replay surface-create and cursor-set commands */
2053 cmds
= g_malloc0(sizeof(QXLCommandExt
) * (NUM_SURFACES
+ 1));
2054 for (in
= 0, out
= 0; in
< NUM_SURFACES
; in
++) {
2055 if (d
->guest_surfaces
.cmds
[in
] == 0) {
2058 cmds
[out
].cmd
.data
= d
->guest_surfaces
.cmds
[in
];
2059 cmds
[out
].cmd
.type
= QXL_CMD_SURFACE
;
2060 cmds
[out
].group_id
= MEMSLOT_GROUP_GUEST
;
2063 if (d
->guest_cursor
) {
2064 cmds
[out
].cmd
.data
= d
->guest_cursor
;
2065 cmds
[out
].cmd
.type
= QXL_CMD_CURSOR
;
2066 cmds
[out
].group_id
= MEMSLOT_GROUP_GUEST
;
2069 qxl_spice_loadvm_commands(d
, cmds
, out
);
2071 if (d
->guest_monitors_config
) {
2072 qxl_spice_monitors_config_async(d
, 1);
2075 case QXL_MODE_COMPAT
:
2076 /* note: no need to call qxl_create_memslots, qxl_set_mode
2077 * creates the mem slot. */
2078 qxl_set_mode(d
, d
->shadow_rom
.mode
, 1);
2084 #define QXL_SAVE_VERSION 21
2086 static bool qxl_monitors_config_needed(void *opaque
)
2088 PCIQXLDevice
*qxl
= opaque
;
2090 return qxl
->guest_monitors_config
!= 0;
2094 static VMStateDescription qxl_memslot
= {
2095 .name
= "qxl-memslot",
2096 .version_id
= QXL_SAVE_VERSION
,
2097 .minimum_version_id
= QXL_SAVE_VERSION
,
2098 .fields
= (VMStateField
[]) {
2099 VMSTATE_UINT64(slot
.mem_start
, struct guest_slots
),
2100 VMSTATE_UINT64(slot
.mem_end
, struct guest_slots
),
2101 VMSTATE_UINT32(active
, struct guest_slots
),
2102 VMSTATE_END_OF_LIST()
2106 static VMStateDescription qxl_surface
= {
2107 .name
= "qxl-surface",
2108 .version_id
= QXL_SAVE_VERSION
,
2109 .minimum_version_id
= QXL_SAVE_VERSION
,
2110 .fields
= (VMStateField
[]) {
2111 VMSTATE_UINT32(width
, QXLSurfaceCreate
),
2112 VMSTATE_UINT32(height
, QXLSurfaceCreate
),
2113 VMSTATE_INT32(stride
, QXLSurfaceCreate
),
2114 VMSTATE_UINT32(format
, QXLSurfaceCreate
),
2115 VMSTATE_UINT32(position
, QXLSurfaceCreate
),
2116 VMSTATE_UINT32(mouse_mode
, QXLSurfaceCreate
),
2117 VMSTATE_UINT32(flags
, QXLSurfaceCreate
),
2118 VMSTATE_UINT32(type
, QXLSurfaceCreate
),
2119 VMSTATE_UINT64(mem
, QXLSurfaceCreate
),
2120 VMSTATE_END_OF_LIST()
2124 static VMStateDescription qxl_vmstate_monitors_config
= {
2125 .name
= "qxl/monitors-config",
2127 .minimum_version_id
= 1,
2128 .fields
= (VMStateField
[]) {
2129 VMSTATE_UINT64(guest_monitors_config
, PCIQXLDevice
),
2130 VMSTATE_END_OF_LIST()
2134 static VMStateDescription qxl_vmstate
= {
2136 .version_id
= QXL_SAVE_VERSION
,
2137 .minimum_version_id
= QXL_SAVE_VERSION
,
2138 .pre_save
= qxl_pre_save
,
2139 .pre_load
= qxl_pre_load
,
2140 .post_load
= qxl_post_load
,
2141 .fields
= (VMStateField
[]) {
2142 VMSTATE_PCI_DEVICE(pci
, PCIQXLDevice
),
2143 VMSTATE_STRUCT(vga
, PCIQXLDevice
, 0, vmstate_vga_common
, VGACommonState
),
2144 VMSTATE_UINT32(shadow_rom
.mode
, PCIQXLDevice
),
2145 VMSTATE_UINT32(num_free_res
, PCIQXLDevice
),
2146 VMSTATE_UINT32(last_release_offset
, PCIQXLDevice
),
2147 VMSTATE_UINT32(mode
, PCIQXLDevice
),
2148 VMSTATE_UINT32(ssd
.unique
, PCIQXLDevice
),
2149 VMSTATE_INT32_EQUAL(num_memslots
, PCIQXLDevice
),
2150 VMSTATE_STRUCT_ARRAY(guest_slots
, PCIQXLDevice
, NUM_MEMSLOTS
, 0,
2151 qxl_memslot
, struct guest_slots
),
2152 VMSTATE_STRUCT(guest_primary
.surface
, PCIQXLDevice
, 0,
2153 qxl_surface
, QXLSurfaceCreate
),
2154 VMSTATE_INT32_EQUAL(num_surfaces
, PCIQXLDevice
),
2155 VMSTATE_ARRAY(guest_surfaces
.cmds
, PCIQXLDevice
, NUM_SURFACES
, 0,
2156 vmstate_info_uint64
, uint64_t),
2157 VMSTATE_UINT64(guest_cursor
, PCIQXLDevice
),
2158 VMSTATE_END_OF_LIST()
2160 .subsections
= (VMStateSubsection
[]) {
2162 .vmsd
= &qxl_vmstate_monitors_config
,
2163 .needed
= qxl_monitors_config_needed
,
2170 static Property qxl_properties
[] = {
2171 DEFINE_PROP_UINT32("ram_size", PCIQXLDevice
, vga
.vram_size
,
2173 DEFINE_PROP_UINT32("vram_size", PCIQXLDevice
, vram32_size
,
2175 DEFINE_PROP_UINT32("revision", PCIQXLDevice
, revision
,
2176 QXL_DEFAULT_REVISION
),
2177 DEFINE_PROP_UINT32("debug", PCIQXLDevice
, debug
, 0),
2178 DEFINE_PROP_UINT32("guestdebug", PCIQXLDevice
, guestdebug
, 0),
2179 DEFINE_PROP_UINT32("cmdlog", PCIQXLDevice
, cmdlog
, 0),
2180 DEFINE_PROP_UINT32("ram_size_mb", PCIQXLDevice
, ram_size_mb
, -1),
2181 DEFINE_PROP_UINT32("vram_size_mb", PCIQXLDevice
, vram32_size_mb
, -1),
2182 DEFINE_PROP_UINT32("vram64_size_mb", PCIQXLDevice
, vram_size_mb
, -1),
2183 DEFINE_PROP_UINT32("vgamem_mb", PCIQXLDevice
, vgamem_size_mb
, 16),
2184 DEFINE_PROP_END_OF_LIST(),
2187 static void qxl_primary_class_init(ObjectClass
*klass
, void *data
)
2189 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2190 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
2193 k
->init
= qxl_init_primary
;
2194 k
->romfile
= "vgabios-qxl.bin";
2195 k
->vendor_id
= REDHAT_PCI_VENDOR_ID
;
2196 k
->device_id
= QXL_DEVICE_ID_STABLE
;
2197 k
->class_id
= PCI_CLASS_DISPLAY_VGA
;
2198 dc
->desc
= "Spice QXL GPU (primary, vga compatible)";
2199 dc
->reset
= qxl_reset_handler
;
2200 dc
->vmsd
= &qxl_vmstate
;
2201 dc
->props
= qxl_properties
;
2204 static TypeInfo qxl_primary_info
= {
2206 .parent
= TYPE_PCI_DEVICE
,
2207 .instance_size
= sizeof(PCIQXLDevice
),
2208 .class_init
= qxl_primary_class_init
,
2211 static void qxl_secondary_class_init(ObjectClass
*klass
, void *data
)
2213 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2214 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
2216 k
->init
= qxl_init_secondary
;
2217 k
->vendor_id
= REDHAT_PCI_VENDOR_ID
;
2218 k
->device_id
= QXL_DEVICE_ID_STABLE
;
2219 k
->class_id
= PCI_CLASS_DISPLAY_OTHER
;
2220 dc
->desc
= "Spice QXL GPU (secondary)";
2221 dc
->reset
= qxl_reset_handler
;
2222 dc
->vmsd
= &qxl_vmstate
;
2223 dc
->props
= qxl_properties
;
2226 static TypeInfo qxl_secondary_info
= {
2228 .parent
= TYPE_PCI_DEVICE
,
2229 .instance_size
= sizeof(PCIQXLDevice
),
2230 .class_init
= qxl_secondary_class_init
,
2233 static void qxl_register_types(void)
2235 type_register_static(&qxl_primary_info
);
2236 type_register_static(&qxl_secondary_info
);
2239 type_init(qxl_register_types
)