2 * Copyright (C) 2010 Red Hat, Inc.
4 * written by Yaniv Kamay, Izik Eidus, Gerd Hoffmann
5 * maintained by Gerd Hoffmann <kraxel@redhat.com>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "qemu-common.h"
25 #include "qemu/timer.h"
26 #include "qemu/queue.h"
27 #include "qemu/atomic.h"
28 #include "monitor/monitor.h"
29 #include "sysemu/sysemu.h"
35 * NOTE: SPICE_RING_PROD_ITEM accesses memory on the pci bar and as
36 * such can be changed by the guest, so to avoid a guest trigerrable
37 * abort we just qxl_set_guest_bug and set the return to NULL. Still
38 * it may happen as a result of emulator bug as well.
40 #undef SPICE_RING_PROD_ITEM
41 #define SPICE_RING_PROD_ITEM(qxl, r, ret) { \
42 uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r); \
43 if (prod >= ARRAY_SIZE((r)->items)) { \
44 qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch " \
45 "%u >= %zu", prod, ARRAY_SIZE((r)->items)); \
48 ret = &(r)->items[prod].el; \
52 #undef SPICE_RING_CONS_ITEM
53 #define SPICE_RING_CONS_ITEM(qxl, r, ret) { \
54 uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r); \
55 if (cons >= ARRAY_SIZE((r)->items)) { \
56 qxl_set_guest_bug(qxl, "SPICE_RING_CONS_ITEM indices mismatch " \
57 "%u >= %zu", cons, ARRAY_SIZE((r)->items)); \
60 ret = &(r)->items[cons].el; \
65 #define ALIGN(a, b) (((a) + ((b) - 1)) & ~((b) - 1))
67 #define PIXEL_SIZE 0.2936875 //1280x1024 is 14.8" x 11.9"
69 #define QXL_MODE(_x, _y, _b, _o) \
73 .stride = (_x) * (_b) / 8, \
74 .x_mili = PIXEL_SIZE * (_x), \
75 .y_mili = PIXEL_SIZE * (_y), \
79 #define QXL_MODE_16_32(x_res, y_res, orientation) \
80 QXL_MODE(x_res, y_res, 16, orientation), \
81 QXL_MODE(x_res, y_res, 32, orientation)
83 #define QXL_MODE_EX(x_res, y_res) \
84 QXL_MODE_16_32(x_res, y_res, 0), \
85 QXL_MODE_16_32(x_res, y_res, 1)
87 static QXLMode qxl_modes
[] = {
88 QXL_MODE_EX(640, 480),
89 QXL_MODE_EX(800, 480),
90 QXL_MODE_EX(800, 600),
91 QXL_MODE_EX(832, 624),
92 QXL_MODE_EX(960, 640),
93 QXL_MODE_EX(1024, 600),
94 QXL_MODE_EX(1024, 768),
95 QXL_MODE_EX(1152, 864),
96 QXL_MODE_EX(1152, 870),
97 QXL_MODE_EX(1280, 720),
98 QXL_MODE_EX(1280, 760),
99 QXL_MODE_EX(1280, 768),
100 QXL_MODE_EX(1280, 800),
101 QXL_MODE_EX(1280, 960),
102 QXL_MODE_EX(1280, 1024),
103 QXL_MODE_EX(1360, 768),
104 QXL_MODE_EX(1366, 768),
105 QXL_MODE_EX(1400, 1050),
106 QXL_MODE_EX(1440, 900),
107 QXL_MODE_EX(1600, 900),
108 QXL_MODE_EX(1600, 1200),
109 QXL_MODE_EX(1680, 1050),
110 QXL_MODE_EX(1920, 1080),
111 /* these modes need more than 8 MB video memory */
112 QXL_MODE_EX(1920, 1200),
113 QXL_MODE_EX(1920, 1440),
114 QXL_MODE_EX(2000, 2000),
115 QXL_MODE_EX(2048, 1536),
116 QXL_MODE_EX(2048, 2048),
117 QXL_MODE_EX(2560, 1440),
118 QXL_MODE_EX(2560, 1600),
119 /* these modes need more than 16 MB video memory */
120 QXL_MODE_EX(2560, 2048),
121 QXL_MODE_EX(2800, 2100),
122 QXL_MODE_EX(3200, 2400),
123 /* these modes need more than 32 MB video memory */
124 QXL_MODE_EX(3840, 2160), /* 4k mainstream */
125 QXL_MODE_EX(4096, 2160), /* 4k */
126 /* these modes need more than 64 MB video memory */
127 QXL_MODE_EX(7680, 4320), /* 8k mainstream */
128 /* these modes need more than 128 MB video memory */
129 QXL_MODE_EX(8192, 4320), /* 8k */
132 static void qxl_send_events(PCIQXLDevice
*d
, uint32_t events
);
133 static int qxl_destroy_primary(PCIQXLDevice
*d
, qxl_async_io async
);
134 static void qxl_reset_memslots(PCIQXLDevice
*d
);
135 static void qxl_reset_surfaces(PCIQXLDevice
*d
);
136 static void qxl_ring_set_dirty(PCIQXLDevice
*qxl
);
138 static void qxl_hw_update(void *opaque
);
140 void qxl_set_guest_bug(PCIQXLDevice
*qxl
, const char *msg
, ...)
142 trace_qxl_set_guest_bug(qxl
->id
);
143 qxl_send_events(qxl
, QXL_INTERRUPT_ERROR
);
145 if (qxl
->guestdebug
) {
148 fprintf(stderr
, "qxl-%d: guest bug: ", qxl
->id
);
149 vfprintf(stderr
, msg
, ap
);
150 fprintf(stderr
, "\n");
155 static void qxl_clear_guest_bug(PCIQXLDevice
*qxl
)
160 void qxl_spice_update_area(PCIQXLDevice
*qxl
, uint32_t surface_id
,
161 struct QXLRect
*area
, struct QXLRect
*dirty_rects
,
162 uint32_t num_dirty_rects
,
163 uint32_t clear_dirty_region
,
164 qxl_async_io async
, struct QXLCookie
*cookie
)
166 trace_qxl_spice_update_area(qxl
->id
, surface_id
, area
->left
, area
->right
,
167 area
->top
, area
->bottom
);
168 trace_qxl_spice_update_area_rest(qxl
->id
, num_dirty_rects
,
170 if (async
== QXL_SYNC
) {
171 spice_qxl_update_area(&qxl
->ssd
.qxl
, surface_id
, area
,
172 dirty_rects
, num_dirty_rects
, clear_dirty_region
);
174 assert(cookie
!= NULL
);
175 spice_qxl_update_area_async(&qxl
->ssd
.qxl
, surface_id
, area
,
176 clear_dirty_region
, (uintptr_t)cookie
);
180 static void qxl_spice_destroy_surface_wait_complete(PCIQXLDevice
*qxl
,
183 trace_qxl_spice_destroy_surface_wait_complete(qxl
->id
, id
);
184 qemu_mutex_lock(&qxl
->track_lock
);
185 qxl
->guest_surfaces
.cmds
[id
] = 0;
186 qxl
->guest_surfaces
.count
--;
187 qemu_mutex_unlock(&qxl
->track_lock
);
190 static void qxl_spice_destroy_surface_wait(PCIQXLDevice
*qxl
, uint32_t id
,
195 trace_qxl_spice_destroy_surface_wait(qxl
->id
, id
, async
);
197 cookie
= qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
198 QXL_IO_DESTROY_SURFACE_ASYNC
);
199 cookie
->u
.surface_id
= id
;
200 spice_qxl_destroy_surface_async(&qxl
->ssd
.qxl
, id
, (uintptr_t)cookie
);
202 spice_qxl_destroy_surface_wait(&qxl
->ssd
.qxl
, id
);
203 qxl_spice_destroy_surface_wait_complete(qxl
, id
);
207 static void qxl_spice_flush_surfaces_async(PCIQXLDevice
*qxl
)
209 trace_qxl_spice_flush_surfaces_async(qxl
->id
, qxl
->guest_surfaces
.count
,
211 spice_qxl_flush_surfaces_async(&qxl
->ssd
.qxl
,
212 (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
213 QXL_IO_FLUSH_SURFACES_ASYNC
));
216 void qxl_spice_loadvm_commands(PCIQXLDevice
*qxl
, struct QXLCommandExt
*ext
,
219 trace_qxl_spice_loadvm_commands(qxl
->id
, ext
, count
);
220 spice_qxl_loadvm_commands(&qxl
->ssd
.qxl
, ext
, count
);
223 void qxl_spice_oom(PCIQXLDevice
*qxl
)
225 trace_qxl_spice_oom(qxl
->id
);
226 spice_qxl_oom(&qxl
->ssd
.qxl
);
229 void qxl_spice_reset_memslots(PCIQXLDevice
*qxl
)
231 trace_qxl_spice_reset_memslots(qxl
->id
);
232 spice_qxl_reset_memslots(&qxl
->ssd
.qxl
);
235 static void qxl_spice_destroy_surfaces_complete(PCIQXLDevice
*qxl
)
237 trace_qxl_spice_destroy_surfaces_complete(qxl
->id
);
238 qemu_mutex_lock(&qxl
->track_lock
);
239 memset(qxl
->guest_surfaces
.cmds
, 0,
240 sizeof(qxl
->guest_surfaces
.cmds
[0]) * qxl
->ssd
.num_surfaces
);
241 qxl
->guest_surfaces
.count
= 0;
242 qemu_mutex_unlock(&qxl
->track_lock
);
245 static void qxl_spice_destroy_surfaces(PCIQXLDevice
*qxl
, qxl_async_io async
)
247 trace_qxl_spice_destroy_surfaces(qxl
->id
, async
);
249 spice_qxl_destroy_surfaces_async(&qxl
->ssd
.qxl
,
250 (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
251 QXL_IO_DESTROY_ALL_SURFACES_ASYNC
));
253 spice_qxl_destroy_surfaces(&qxl
->ssd
.qxl
);
254 qxl_spice_destroy_surfaces_complete(qxl
);
258 static void qxl_spice_monitors_config_async(PCIQXLDevice
*qxl
, int replay
)
260 trace_qxl_spice_monitors_config(qxl
->id
);
263 * don't use QXL_COOKIE_TYPE_IO:
264 * - we are not running yet (post_load), we will assert
266 * - this is not a guest io, but a reply, so async_io isn't set.
268 spice_qxl_monitors_config_async(&qxl
->ssd
.qxl
,
269 qxl
->guest_monitors_config
,
271 (uintptr_t)qxl_cookie_new(
272 QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG
,
275 qxl
->guest_monitors_config
= qxl
->ram
->monitors_config
;
276 spice_qxl_monitors_config_async(&qxl
->ssd
.qxl
,
277 qxl
->ram
->monitors_config
,
279 (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
280 QXL_IO_MONITORS_CONFIG_ASYNC
));
284 void qxl_spice_reset_image_cache(PCIQXLDevice
*qxl
)
286 trace_qxl_spice_reset_image_cache(qxl
->id
);
287 spice_qxl_reset_image_cache(&qxl
->ssd
.qxl
);
290 void qxl_spice_reset_cursor(PCIQXLDevice
*qxl
)
292 trace_qxl_spice_reset_cursor(qxl
->id
);
293 spice_qxl_reset_cursor(&qxl
->ssd
.qxl
);
294 qemu_mutex_lock(&qxl
->track_lock
);
295 qxl
->guest_cursor
= 0;
296 qemu_mutex_unlock(&qxl
->track_lock
);
297 if (qxl
->ssd
.cursor
) {
298 cursor_put(qxl
->ssd
.cursor
);
300 qxl
->ssd
.cursor
= cursor_builtin_hidden();
304 static inline uint32_t msb_mask(uint32_t val
)
309 mask
= ~(val
- 1) & val
;
311 } while (mask
< val
);
316 static ram_addr_t
qxl_rom_size(void)
318 uint32_t required_rom_size
= sizeof(QXLRom
) + sizeof(QXLModes
) +
320 uint32_t rom_size
= 8192; /* two pages */
322 QEMU_BUILD_BUG_ON(required_rom_size
> rom_size
);
326 static void init_qxl_rom(PCIQXLDevice
*d
)
328 QXLRom
*rom
= memory_region_get_ram_ptr(&d
->rom_bar
);
329 QXLModes
*modes
= (QXLModes
*)(rom
+ 1);
330 uint32_t ram_header_size
;
331 uint32_t surface0_area_size
;
336 memset(rom
, 0, d
->rom_size
);
338 rom
->magic
= cpu_to_le32(QXL_ROM_MAGIC
);
339 rom
->id
= cpu_to_le32(d
->id
);
340 rom
->log_level
= cpu_to_le32(d
->guestdebug
);
341 rom
->modes_offset
= cpu_to_le32(sizeof(QXLRom
));
343 rom
->slot_gen_bits
= MEMSLOT_GENERATION_BITS
;
344 rom
->slot_id_bits
= MEMSLOT_SLOT_BITS
;
345 rom
->slots_start
= 1;
346 rom
->slots_end
= NUM_MEMSLOTS
- 1;
347 rom
->n_surfaces
= cpu_to_le32(d
->ssd
.num_surfaces
);
349 for (i
= 0, n
= 0; i
< ARRAY_SIZE(qxl_modes
); i
++) {
350 fb
= qxl_modes
[i
].y_res
* qxl_modes
[i
].stride
;
351 if (fb
> d
->vgamem_size
) {
354 modes
->modes
[n
].id
= cpu_to_le32(i
);
355 modes
->modes
[n
].x_res
= cpu_to_le32(qxl_modes
[i
].x_res
);
356 modes
->modes
[n
].y_res
= cpu_to_le32(qxl_modes
[i
].y_res
);
357 modes
->modes
[n
].bits
= cpu_to_le32(qxl_modes
[i
].bits
);
358 modes
->modes
[n
].stride
= cpu_to_le32(qxl_modes
[i
].stride
);
359 modes
->modes
[n
].x_mili
= cpu_to_le32(qxl_modes
[i
].x_mili
);
360 modes
->modes
[n
].y_mili
= cpu_to_le32(qxl_modes
[i
].y_mili
);
361 modes
->modes
[n
].orientation
= cpu_to_le32(qxl_modes
[i
].orientation
);
364 modes
->n_modes
= cpu_to_le32(n
);
366 ram_header_size
= ALIGN(sizeof(QXLRam
), 4096);
367 surface0_area_size
= ALIGN(d
->vgamem_size
, 4096);
368 num_pages
= d
->vga
.vram_size
;
369 num_pages
-= ram_header_size
;
370 num_pages
-= surface0_area_size
;
371 num_pages
= num_pages
/ QXL_PAGE_SIZE
;
373 assert(ram_header_size
+ surface0_area_size
<= d
->vga
.vram_size
);
375 rom
->draw_area_offset
= cpu_to_le32(0);
376 rom
->surface0_area_size
= cpu_to_le32(surface0_area_size
);
377 rom
->pages_offset
= cpu_to_le32(surface0_area_size
);
378 rom
->num_pages
= cpu_to_le32(num_pages
);
379 rom
->ram_header_offset
= cpu_to_le32(d
->vga
.vram_size
- ram_header_size
);
381 d
->shadow_rom
= *rom
;
386 static void init_qxl_ram(PCIQXLDevice
*d
)
391 buf
= d
->vga
.vram_ptr
;
392 d
->ram
= (QXLRam
*)(buf
+ le32_to_cpu(d
->shadow_rom
.ram_header_offset
));
393 d
->ram
->magic
= cpu_to_le32(QXL_RAM_MAGIC
);
394 d
->ram
->int_pending
= cpu_to_le32(0);
395 d
->ram
->int_mask
= cpu_to_le32(0);
396 d
->ram
->update_surface
= 0;
397 d
->ram
->monitors_config
= 0;
398 SPICE_RING_INIT(&d
->ram
->cmd_ring
);
399 SPICE_RING_INIT(&d
->ram
->cursor_ring
);
400 SPICE_RING_INIT(&d
->ram
->release_ring
);
401 SPICE_RING_PROD_ITEM(d
, &d
->ram
->release_ring
, item
);
404 qxl_ring_set_dirty(d
);
407 /* can be called from spice server thread context */
408 static void qxl_set_dirty(MemoryRegion
*mr
, ram_addr_t addr
, ram_addr_t end
)
410 memory_region_set_dirty(mr
, addr
, end
- addr
);
413 static void qxl_rom_set_dirty(PCIQXLDevice
*qxl
)
415 qxl_set_dirty(&qxl
->rom_bar
, 0, qxl
->rom_size
);
418 /* called from spice server thread context only */
419 static void qxl_ram_set_dirty(PCIQXLDevice
*qxl
, void *ptr
)
421 void *base
= qxl
->vga
.vram_ptr
;
425 assert(offset
< qxl
->vga
.vram_size
);
426 qxl_set_dirty(&qxl
->vga
.vram
, offset
, offset
+ 3);
429 /* can be called from spice server thread context */
430 static void qxl_ring_set_dirty(PCIQXLDevice
*qxl
)
432 ram_addr_t addr
= qxl
->shadow_rom
.ram_header_offset
;
433 ram_addr_t end
= qxl
->vga
.vram_size
;
434 qxl_set_dirty(&qxl
->vga
.vram
, addr
, end
);
438 * keep track of some command state, for savevm/loadvm.
439 * called from spice server thread context only
441 static int qxl_track_command(PCIQXLDevice
*qxl
, struct QXLCommandExt
*ext
)
443 switch (le32_to_cpu(ext
->cmd
.type
)) {
444 case QXL_CMD_SURFACE
:
446 QXLSurfaceCmd
*cmd
= qxl_phys2virt(qxl
, ext
->cmd
.data
, ext
->group_id
);
451 uint32_t id
= le32_to_cpu(cmd
->surface_id
);
453 if (id
>= qxl
->ssd
.num_surfaces
) {
454 qxl_set_guest_bug(qxl
, "QXL_CMD_SURFACE id %d >= %d", id
,
455 qxl
->ssd
.num_surfaces
);
458 if (cmd
->type
== QXL_SURFACE_CMD_CREATE
&&
459 (cmd
->u
.surface_create
.stride
& 0x03) != 0) {
460 qxl_set_guest_bug(qxl
, "QXL_CMD_SURFACE stride = %d %% 4 != 0\n",
461 cmd
->u
.surface_create
.stride
);
464 qemu_mutex_lock(&qxl
->track_lock
);
465 if (cmd
->type
== QXL_SURFACE_CMD_CREATE
) {
466 qxl
->guest_surfaces
.cmds
[id
] = ext
->cmd
.data
;
467 qxl
->guest_surfaces
.count
++;
468 if (qxl
->guest_surfaces
.max
< qxl
->guest_surfaces
.count
)
469 qxl
->guest_surfaces
.max
= qxl
->guest_surfaces
.count
;
471 if (cmd
->type
== QXL_SURFACE_CMD_DESTROY
) {
472 qxl
->guest_surfaces
.cmds
[id
] = 0;
473 qxl
->guest_surfaces
.count
--;
475 qemu_mutex_unlock(&qxl
->track_lock
);
480 QXLCursorCmd
*cmd
= qxl_phys2virt(qxl
, ext
->cmd
.data
, ext
->group_id
);
485 if (cmd
->type
== QXL_CURSOR_SET
) {
486 qemu_mutex_lock(&qxl
->track_lock
);
487 qxl
->guest_cursor
= ext
->cmd
.data
;
488 qemu_mutex_unlock(&qxl
->track_lock
);
496 /* spice display interface callbacks */
498 static void interface_attach_worker(QXLInstance
*sin
, QXLWorker
*qxl_worker
)
500 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
502 trace_qxl_interface_attach_worker(qxl
->id
);
503 qxl
->ssd
.worker
= qxl_worker
;
506 static void interface_set_compression_level(QXLInstance
*sin
, int level
)
508 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
510 trace_qxl_interface_set_compression_level(qxl
->id
, level
);
511 qxl
->shadow_rom
.compression_level
= cpu_to_le32(level
);
512 qxl
->rom
->compression_level
= cpu_to_le32(level
);
513 qxl_rom_set_dirty(qxl
);
516 static void interface_set_mm_time(QXLInstance
*sin
, uint32_t mm_time
)
518 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
520 trace_qxl_interface_set_mm_time(qxl
->id
, mm_time
);
521 qxl
->shadow_rom
.mm_clock
= cpu_to_le32(mm_time
);
522 qxl
->rom
->mm_clock
= cpu_to_le32(mm_time
);
523 qxl_rom_set_dirty(qxl
);
526 static void interface_get_init_info(QXLInstance
*sin
, QXLDevInitInfo
*info
)
528 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
530 trace_qxl_interface_get_init_info(qxl
->id
);
531 info
->memslot_gen_bits
= MEMSLOT_GENERATION_BITS
;
532 info
->memslot_id_bits
= MEMSLOT_SLOT_BITS
;
533 info
->num_memslots
= NUM_MEMSLOTS
;
534 info
->num_memslots_groups
= NUM_MEMSLOTS_GROUPS
;
535 info
->internal_groupslot_id
= 0;
537 le32_to_cpu(qxl
->shadow_rom
.num_pages
) << QXL_PAGE_BITS
;
538 info
->n_surfaces
= qxl
->ssd
.num_surfaces
;
541 static const char *qxl_mode_to_string(int mode
)
544 case QXL_MODE_COMPAT
:
546 case QXL_MODE_NATIVE
:
548 case QXL_MODE_UNDEFINED
:
556 static const char *io_port_to_string(uint32_t io_port
)
558 if (io_port
>= QXL_IO_RANGE_SIZE
) {
559 return "out of range";
561 static const char *io_port_to_string
[QXL_IO_RANGE_SIZE
+ 1] = {
562 [QXL_IO_NOTIFY_CMD
] = "QXL_IO_NOTIFY_CMD",
563 [QXL_IO_NOTIFY_CURSOR
] = "QXL_IO_NOTIFY_CURSOR",
564 [QXL_IO_UPDATE_AREA
] = "QXL_IO_UPDATE_AREA",
565 [QXL_IO_UPDATE_IRQ
] = "QXL_IO_UPDATE_IRQ",
566 [QXL_IO_NOTIFY_OOM
] = "QXL_IO_NOTIFY_OOM",
567 [QXL_IO_RESET
] = "QXL_IO_RESET",
568 [QXL_IO_SET_MODE
] = "QXL_IO_SET_MODE",
569 [QXL_IO_LOG
] = "QXL_IO_LOG",
570 [QXL_IO_MEMSLOT_ADD
] = "QXL_IO_MEMSLOT_ADD",
571 [QXL_IO_MEMSLOT_DEL
] = "QXL_IO_MEMSLOT_DEL",
572 [QXL_IO_DETACH_PRIMARY
] = "QXL_IO_DETACH_PRIMARY",
573 [QXL_IO_ATTACH_PRIMARY
] = "QXL_IO_ATTACH_PRIMARY",
574 [QXL_IO_CREATE_PRIMARY
] = "QXL_IO_CREATE_PRIMARY",
575 [QXL_IO_DESTROY_PRIMARY
] = "QXL_IO_DESTROY_PRIMARY",
576 [QXL_IO_DESTROY_SURFACE_WAIT
] = "QXL_IO_DESTROY_SURFACE_WAIT",
577 [QXL_IO_DESTROY_ALL_SURFACES
] = "QXL_IO_DESTROY_ALL_SURFACES",
578 [QXL_IO_UPDATE_AREA_ASYNC
] = "QXL_IO_UPDATE_AREA_ASYNC",
579 [QXL_IO_MEMSLOT_ADD_ASYNC
] = "QXL_IO_MEMSLOT_ADD_ASYNC",
580 [QXL_IO_CREATE_PRIMARY_ASYNC
] = "QXL_IO_CREATE_PRIMARY_ASYNC",
581 [QXL_IO_DESTROY_PRIMARY_ASYNC
] = "QXL_IO_DESTROY_PRIMARY_ASYNC",
582 [QXL_IO_DESTROY_SURFACE_ASYNC
] = "QXL_IO_DESTROY_SURFACE_ASYNC",
583 [QXL_IO_DESTROY_ALL_SURFACES_ASYNC
]
584 = "QXL_IO_DESTROY_ALL_SURFACES_ASYNC",
585 [QXL_IO_FLUSH_SURFACES_ASYNC
] = "QXL_IO_FLUSH_SURFACES_ASYNC",
586 [QXL_IO_FLUSH_RELEASE
] = "QXL_IO_FLUSH_RELEASE",
587 [QXL_IO_MONITORS_CONFIG_ASYNC
] = "QXL_IO_MONITORS_CONFIG_ASYNC",
589 return io_port_to_string
[io_port
];
592 /* called from spice server thread context only */
593 static int interface_get_command(QXLInstance
*sin
, struct QXLCommandExt
*ext
)
595 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
596 SimpleSpiceUpdate
*update
;
597 QXLCommandRing
*ring
;
601 trace_qxl_ring_command_check(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
606 qemu_mutex_lock(&qxl
->ssd
.lock
);
607 update
= QTAILQ_FIRST(&qxl
->ssd
.updates
);
608 if (update
!= NULL
) {
609 QTAILQ_REMOVE(&qxl
->ssd
.updates
, update
, next
);
613 qemu_mutex_unlock(&qxl
->ssd
.lock
);
615 trace_qxl_ring_command_get(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
616 qxl_log_command(qxl
, "vga", ext
);
619 case QXL_MODE_COMPAT
:
620 case QXL_MODE_NATIVE
:
621 case QXL_MODE_UNDEFINED
:
622 ring
= &qxl
->ram
->cmd_ring
;
623 if (qxl
->guest_bug
|| SPICE_RING_IS_EMPTY(ring
)) {
626 SPICE_RING_CONS_ITEM(qxl
, ring
, cmd
);
631 ext
->group_id
= MEMSLOT_GROUP_GUEST
;
632 ext
->flags
= qxl
->cmdflags
;
633 SPICE_RING_POP(ring
, notify
);
634 qxl_ring_set_dirty(qxl
);
636 qxl_send_events(qxl
, QXL_INTERRUPT_DISPLAY
);
638 qxl
->guest_primary
.commands
++;
639 qxl_track_command(qxl
, ext
);
640 qxl_log_command(qxl
, "cmd", ext
);
641 trace_qxl_ring_command_get(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
648 /* called from spice server thread context only */
649 static int interface_req_cmd_notification(QXLInstance
*sin
)
651 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
654 trace_qxl_ring_command_req_notification(qxl
->id
);
656 case QXL_MODE_COMPAT
:
657 case QXL_MODE_NATIVE
:
658 case QXL_MODE_UNDEFINED
:
659 SPICE_RING_CONS_WAIT(&qxl
->ram
->cmd_ring
, wait
);
660 qxl_ring_set_dirty(qxl
);
669 /* called from spice server thread context only */
670 static inline void qxl_push_free_res(PCIQXLDevice
*d
, int flush
)
672 QXLReleaseRing
*ring
= &d
->ram
->release_ring
;
676 #define QXL_FREE_BUNCH_SIZE 32
678 if (ring
->prod
- ring
->cons
+ 1 == ring
->num_items
) {
679 /* ring full -- can't push */
682 if (!flush
&& d
->oom_running
) {
683 /* collect everything from oom handler before pushing */
686 if (!flush
&& d
->num_free_res
< QXL_FREE_BUNCH_SIZE
) {
687 /* collect a bit more before pushing */
691 SPICE_RING_PUSH(ring
, notify
);
692 trace_qxl_ring_res_push(d
->id
, qxl_mode_to_string(d
->mode
),
693 d
->guest_surfaces
.count
, d
->num_free_res
,
694 d
->last_release
, notify
? "yes" : "no");
695 trace_qxl_ring_res_push_rest(d
->id
, ring
->prod
- ring
->cons
,
696 ring
->num_items
, ring
->prod
, ring
->cons
);
698 qxl_send_events(d
, QXL_INTERRUPT_DISPLAY
);
700 SPICE_RING_PROD_ITEM(d
, ring
, item
);
706 d
->last_release
= NULL
;
707 qxl_ring_set_dirty(d
);
710 /* called from spice server thread context only */
711 static void interface_release_resource(QXLInstance
*sin
,
712 struct QXLReleaseInfoExt ext
)
714 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
715 QXLReleaseRing
*ring
;
718 if (ext
.group_id
== MEMSLOT_GROUP_HOST
) {
719 /* host group -> vga mode update request */
720 QXLCommandExt
*cmdext
= (void *)(intptr_t)(ext
.info
->id
);
721 SimpleSpiceUpdate
*update
;
722 g_assert(cmdext
->cmd
.type
== QXL_CMD_DRAW
);
723 update
= container_of(cmdext
, SimpleSpiceUpdate
, ext
);
724 qemu_spice_destroy_update(&qxl
->ssd
, update
);
729 * ext->info points into guest-visible memory
730 * pci bar 0, $command.release_info
732 ring
= &qxl
->ram
->release_ring
;
733 SPICE_RING_PROD_ITEM(qxl
, ring
, item
);
738 /* stick head into the ring */
741 qxl_ram_set_dirty(qxl
, &ext
.info
->next
);
743 qxl_ring_set_dirty(qxl
);
745 /* append item to the list */
746 qxl
->last_release
->next
= ext
.info
->id
;
747 qxl_ram_set_dirty(qxl
, &qxl
->last_release
->next
);
749 qxl_ram_set_dirty(qxl
, &ext
.info
->next
);
751 qxl
->last_release
= ext
.info
;
753 trace_qxl_ring_res_put(qxl
->id
, qxl
->num_free_res
);
754 qxl_push_free_res(qxl
, 0);
757 /* called from spice server thread context only */
758 static int interface_get_cursor_command(QXLInstance
*sin
, struct QXLCommandExt
*ext
)
760 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
765 trace_qxl_ring_cursor_check(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
768 case QXL_MODE_COMPAT
:
769 case QXL_MODE_NATIVE
:
770 case QXL_MODE_UNDEFINED
:
771 ring
= &qxl
->ram
->cursor_ring
;
772 if (SPICE_RING_IS_EMPTY(ring
)) {
775 SPICE_RING_CONS_ITEM(qxl
, ring
, cmd
);
780 ext
->group_id
= MEMSLOT_GROUP_GUEST
;
781 ext
->flags
= qxl
->cmdflags
;
782 SPICE_RING_POP(ring
, notify
);
783 qxl_ring_set_dirty(qxl
);
785 qxl_send_events(qxl
, QXL_INTERRUPT_CURSOR
);
787 qxl
->guest_primary
.commands
++;
788 qxl_track_command(qxl
, ext
);
789 qxl_log_command(qxl
, "csr", ext
);
791 qxl_render_cursor(qxl
, ext
);
793 trace_qxl_ring_cursor_get(qxl
->id
, qxl_mode_to_string(qxl
->mode
));
800 /* called from spice server thread context only */
801 static int interface_req_cursor_notification(QXLInstance
*sin
)
803 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
806 trace_qxl_ring_cursor_req_notification(qxl
->id
);
808 case QXL_MODE_COMPAT
:
809 case QXL_MODE_NATIVE
:
810 case QXL_MODE_UNDEFINED
:
811 SPICE_RING_CONS_WAIT(&qxl
->ram
->cursor_ring
, wait
);
812 qxl_ring_set_dirty(qxl
);
821 /* called from spice server thread context */
822 static void interface_notify_update(QXLInstance
*sin
, uint32_t update_id
)
825 * Called by spice-server as a result of a QXL_CMD_UPDATE which is not in
826 * use by xf86-video-qxl and is defined out in the qxl windows driver.
827 * Probably was at some earlier version that is prior to git start (2009),
828 * and is still guest trigerrable.
830 fprintf(stderr
, "%s: deprecated\n", __func__
);
833 /* called from spice server thread context only */
834 static int interface_flush_resources(QXLInstance
*sin
)
836 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
839 ret
= qxl
->num_free_res
;
841 qxl_push_free_res(qxl
, 1);
846 static void qxl_create_guest_primary_complete(PCIQXLDevice
*d
);
848 /* called from spice server thread context only */
849 static void interface_async_complete_io(PCIQXLDevice
*qxl
, QXLCookie
*cookie
)
851 uint32_t current_async
;
853 qemu_mutex_lock(&qxl
->async_lock
);
854 current_async
= qxl
->current_async
;
855 qxl
->current_async
= QXL_UNDEFINED_IO
;
856 qemu_mutex_unlock(&qxl
->async_lock
);
858 trace_qxl_interface_async_complete_io(qxl
->id
, current_async
, cookie
);
860 fprintf(stderr
, "qxl: %s: error, cookie is NULL\n", __func__
);
863 if (cookie
&& current_async
!= cookie
->io
) {
865 "qxl: %s: error: current_async = %d != %"
866 PRId64
" = cookie->io\n", __func__
, current_async
, cookie
->io
);
868 switch (current_async
) {
869 case QXL_IO_MEMSLOT_ADD_ASYNC
:
870 case QXL_IO_DESTROY_PRIMARY_ASYNC
:
871 case QXL_IO_UPDATE_AREA_ASYNC
:
872 case QXL_IO_FLUSH_SURFACES_ASYNC
:
873 case QXL_IO_MONITORS_CONFIG_ASYNC
:
875 case QXL_IO_CREATE_PRIMARY_ASYNC
:
876 qxl_create_guest_primary_complete(qxl
);
878 case QXL_IO_DESTROY_ALL_SURFACES_ASYNC
:
879 qxl_spice_destroy_surfaces_complete(qxl
);
881 case QXL_IO_DESTROY_SURFACE_ASYNC
:
882 qxl_spice_destroy_surface_wait_complete(qxl
, cookie
->u
.surface_id
);
885 fprintf(stderr
, "qxl: %s: unexpected current_async %d\n", __func__
,
888 qxl_send_events(qxl
, QXL_INTERRUPT_IO_CMD
);
891 /* called from spice server thread context only */
892 static void interface_update_area_complete(QXLInstance
*sin
,
894 QXLRect
*dirty
, uint32_t num_updated_rects
)
896 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
900 qemu_mutex_lock(&qxl
->ssd
.lock
);
901 if (surface_id
!= 0 || !qxl
->render_update_cookie_num
) {
902 qemu_mutex_unlock(&qxl
->ssd
.lock
);
905 trace_qxl_interface_update_area_complete(qxl
->id
, surface_id
, dirty
->left
,
906 dirty
->right
, dirty
->top
, dirty
->bottom
);
907 trace_qxl_interface_update_area_complete_rest(qxl
->id
, num_updated_rects
);
908 if (qxl
->num_dirty_rects
+ num_updated_rects
> QXL_NUM_DIRTY_RECTS
) {
910 * overflow - treat this as a full update. Not expected to be common.
912 trace_qxl_interface_update_area_complete_overflow(qxl
->id
,
913 QXL_NUM_DIRTY_RECTS
);
914 qxl
->guest_primary
.resized
= 1;
916 if (qxl
->guest_primary
.resized
) {
918 * Don't bother copying or scheduling the bh since we will flip
919 * the whole area anyway on completion of the update_area async call
921 qemu_mutex_unlock(&qxl
->ssd
.lock
);
924 qxl_i
= qxl
->num_dirty_rects
;
925 for (i
= 0; i
< num_updated_rects
; i
++) {
926 qxl
->dirty
[qxl_i
++] = dirty
[i
];
928 qxl
->num_dirty_rects
+= num_updated_rects
;
929 trace_qxl_interface_update_area_complete_schedule_bh(qxl
->id
,
930 qxl
->num_dirty_rects
);
931 qemu_bh_schedule(qxl
->update_area_bh
);
932 qemu_mutex_unlock(&qxl
->ssd
.lock
);
935 /* called from spice server thread context only */
936 static void interface_async_complete(QXLInstance
*sin
, uint64_t cookie_token
)
938 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
939 QXLCookie
*cookie
= (QXLCookie
*)(uintptr_t)cookie_token
;
941 switch (cookie
->type
) {
942 case QXL_COOKIE_TYPE_IO
:
943 interface_async_complete_io(qxl
, cookie
);
946 case QXL_COOKIE_TYPE_RENDER_UPDATE_AREA
:
947 qxl_render_update_area_done(qxl
, cookie
);
949 case QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG
:
952 fprintf(stderr
, "qxl: %s: unexpected cookie type %d\n",
953 __func__
, cookie
->type
);
958 /* called from spice server thread context only */
959 static void interface_set_client_capabilities(QXLInstance
*sin
,
960 uint8_t client_present
,
963 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
965 if (qxl
->revision
< 4) {
966 trace_qxl_set_client_capabilities_unsupported_by_revision(qxl
->id
,
971 if (runstate_check(RUN_STATE_INMIGRATE
) ||
972 runstate_check(RUN_STATE_POSTMIGRATE
)) {
976 qxl
->shadow_rom
.client_present
= client_present
;
977 memcpy(qxl
->shadow_rom
.client_capabilities
, caps
,
978 sizeof(qxl
->shadow_rom
.client_capabilities
));
979 qxl
->rom
->client_present
= client_present
;
980 memcpy(qxl
->rom
->client_capabilities
, caps
,
981 sizeof(qxl
->rom
->client_capabilities
));
982 qxl_rom_set_dirty(qxl
);
984 qxl_send_events(qxl
, QXL_INTERRUPT_CLIENT
);
987 static uint32_t qxl_crc32(const uint8_t *p
, unsigned len
)
990 * zlib xors the seed with 0xffffffff, and xors the result
991 * again with 0xffffffff; Both are not done with linux's crc32,
992 * which we want to be compatible with, so undo that.
994 return crc32(0xffffffff, p
, len
) ^ 0xffffffff;
997 /* called from main context only */
998 static int interface_client_monitors_config(QXLInstance
*sin
,
999 VDAgentMonitorsConfig
*monitors_config
)
1001 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
1002 QXLRom
*rom
= memory_region_get_ram_ptr(&qxl
->rom_bar
);
1005 if (qxl
->revision
< 4) {
1006 trace_qxl_client_monitors_config_unsupported_by_device(qxl
->id
,
1011 * Older windows drivers set int_mask to 0 when their ISR is called,
1012 * then later set it to ~0. So it doesn't relate to the actual interrupts
1013 * handled. However, they are old, so clearly they don't support this
1016 if (qxl
->ram
->int_mask
== 0 || qxl
->ram
->int_mask
== ~0 ||
1017 !(qxl
->ram
->int_mask
& QXL_INTERRUPT_CLIENT_MONITORS_CONFIG
)) {
1018 trace_qxl_client_monitors_config_unsupported_by_guest(qxl
->id
,
1023 if (!monitors_config
) {
1026 memset(&rom
->client_monitors_config
, 0,
1027 sizeof(rom
->client_monitors_config
));
1028 rom
->client_monitors_config
.count
= monitors_config
->num_of_monitors
;
1029 /* monitors_config->flags ignored */
1030 if (rom
->client_monitors_config
.count
>=
1031 ARRAY_SIZE(rom
->client_monitors_config
.heads
)) {
1032 trace_qxl_client_monitors_config_capped(qxl
->id
,
1033 monitors_config
->num_of_monitors
,
1034 ARRAY_SIZE(rom
->client_monitors_config
.heads
));
1035 rom
->client_monitors_config
.count
=
1036 ARRAY_SIZE(rom
->client_monitors_config
.heads
);
1038 for (i
= 0 ; i
< rom
->client_monitors_config
.count
; ++i
) {
1039 VDAgentMonConfig
*monitor
= &monitors_config
->monitors
[i
];
1040 QXLURect
*rect
= &rom
->client_monitors_config
.heads
[i
];
1041 /* monitor->depth ignored */
1042 rect
->left
= monitor
->x
;
1043 rect
->top
= monitor
->y
;
1044 rect
->right
= monitor
->x
+ monitor
->width
;
1045 rect
->bottom
= monitor
->y
+ monitor
->height
;
1047 rom
->client_monitors_config_crc
= qxl_crc32(
1048 (const uint8_t *)&rom
->client_monitors_config
,
1049 sizeof(rom
->client_monitors_config
));
1050 trace_qxl_client_monitors_config_crc(qxl
->id
,
1051 sizeof(rom
->client_monitors_config
),
1052 rom
->client_monitors_config_crc
);
1054 trace_qxl_interrupt_client_monitors_config(qxl
->id
,
1055 rom
->client_monitors_config
.count
,
1056 rom
->client_monitors_config
.heads
);
1057 qxl_send_events(qxl
, QXL_INTERRUPT_CLIENT_MONITORS_CONFIG
);
1061 static const QXLInterface qxl_interface
= {
1062 .base
.type
= SPICE_INTERFACE_QXL
,
1063 .base
.description
= "qxl gpu",
1064 .base
.major_version
= SPICE_INTERFACE_QXL_MAJOR
,
1065 .base
.minor_version
= SPICE_INTERFACE_QXL_MINOR
,
1067 .attache_worker
= interface_attach_worker
,
1068 .set_compression_level
= interface_set_compression_level
,
1069 .set_mm_time
= interface_set_mm_time
,
1070 .get_init_info
= interface_get_init_info
,
1072 /* the callbacks below are called from spice server thread context */
1073 .get_command
= interface_get_command
,
1074 .req_cmd_notification
= interface_req_cmd_notification
,
1075 .release_resource
= interface_release_resource
,
1076 .get_cursor_command
= interface_get_cursor_command
,
1077 .req_cursor_notification
= interface_req_cursor_notification
,
1078 .notify_update
= interface_notify_update
,
1079 .flush_resources
= interface_flush_resources
,
1080 .async_complete
= interface_async_complete
,
1081 .update_area_complete
= interface_update_area_complete
,
1082 .set_client_capabilities
= interface_set_client_capabilities
,
1083 .client_monitors_config
= interface_client_monitors_config
,
1086 static const GraphicHwOps qxl_ops
= {
1087 .gfx_update
= qxl_hw_update
,
1090 static void qxl_enter_vga_mode(PCIQXLDevice
*d
)
1092 if (d
->mode
== QXL_MODE_VGA
) {
1095 trace_qxl_enter_vga_mode(d
->id
);
1096 #if SPICE_SERVER_VERSION >= 0x000c03 /* release 0.12.3 */
1097 spice_qxl_driver_unload(&d
->ssd
.qxl
);
1099 graphic_console_set_hwops(d
->ssd
.dcl
.con
, d
->vga
.hw_ops
, &d
->vga
);
1100 update_displaychangelistener(&d
->ssd
.dcl
, GUI_REFRESH_INTERVAL_DEFAULT
);
1101 qemu_spice_create_host_primary(&d
->ssd
);
1102 d
->mode
= QXL_MODE_VGA
;
1103 vga_dirty_log_start(&d
->vga
);
1104 graphic_hw_update(d
->vga
.con
);
1107 static void qxl_exit_vga_mode(PCIQXLDevice
*d
)
1109 if (d
->mode
!= QXL_MODE_VGA
) {
1112 trace_qxl_exit_vga_mode(d
->id
);
1113 graphic_console_set_hwops(d
->ssd
.dcl
.con
, &qxl_ops
, d
);
1114 update_displaychangelistener(&d
->ssd
.dcl
, GUI_REFRESH_INTERVAL_IDLE
);
1115 vga_dirty_log_stop(&d
->vga
);
1116 qxl_destroy_primary(d
, QXL_SYNC
);
1119 static void qxl_update_irq(PCIQXLDevice
*d
)
1121 uint32_t pending
= le32_to_cpu(d
->ram
->int_pending
);
1122 uint32_t mask
= le32_to_cpu(d
->ram
->int_mask
);
1123 int level
= !!(pending
& mask
);
1124 pci_set_irq(&d
->pci
, level
);
1125 qxl_ring_set_dirty(d
);
1128 static void qxl_check_state(PCIQXLDevice
*d
)
1130 QXLRam
*ram
= d
->ram
;
1131 int spice_display_running
= qemu_spice_display_is_running(&d
->ssd
);
1133 assert(!spice_display_running
|| SPICE_RING_IS_EMPTY(&ram
->cmd_ring
));
1134 assert(!spice_display_running
|| SPICE_RING_IS_EMPTY(&ram
->cursor_ring
));
1137 static void qxl_reset_state(PCIQXLDevice
*d
)
1139 QXLRom
*rom
= d
->rom
;
1142 d
->shadow_rom
.update_id
= cpu_to_le32(0);
1143 *rom
= d
->shadow_rom
;
1144 qxl_rom_set_dirty(d
);
1146 d
->num_free_res
= 0;
1147 d
->last_release
= NULL
;
1148 memset(&d
->ssd
.dirty
, 0, sizeof(d
->ssd
.dirty
));
1152 static void qxl_soft_reset(PCIQXLDevice
*d
)
1154 trace_qxl_soft_reset(d
->id
);
1156 qxl_clear_guest_bug(d
);
1157 d
->current_async
= QXL_UNDEFINED_IO
;
1160 qxl_enter_vga_mode(d
);
1162 d
->mode
= QXL_MODE_UNDEFINED
;
1163 update_displaychangelistener(&d
->ssd
.dcl
, GUI_REFRESH_INTERVAL_IDLE
);
1167 static void qxl_hard_reset(PCIQXLDevice
*d
, int loadvm
)
1169 bool startstop
= qemu_spice_display_is_running(&d
->ssd
);
1171 trace_qxl_hard_reset(d
->id
, loadvm
);
1174 qemu_spice_display_stop();
1177 qxl_spice_reset_cursor(d
);
1178 qxl_spice_reset_image_cache(d
);
1179 qxl_reset_surfaces(d
);
1180 qxl_reset_memslots(d
);
1182 /* pre loadvm reset must not touch QXLRam. This lives in
1183 * device memory, is migrated together with RAM and thus
1184 * already loaded at this point */
1188 qemu_spice_create_host_memslot(&d
->ssd
);
1192 qemu_spice_display_start();
1196 static void qxl_reset_handler(DeviceState
*dev
)
1198 PCIQXLDevice
*d
= DO_UPCAST(PCIQXLDevice
, pci
.qdev
, dev
);
1200 qxl_hard_reset(d
, 0);
1203 static void qxl_vga_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
1205 VGACommonState
*vga
= opaque
;
1206 PCIQXLDevice
*qxl
= container_of(vga
, PCIQXLDevice
, vga
);
1208 trace_qxl_io_write_vga(qxl
->id
, qxl_mode_to_string(qxl
->mode
), addr
, val
);
1209 if (qxl
->mode
!= QXL_MODE_VGA
) {
1210 qxl_destroy_primary(qxl
, QXL_SYNC
);
1211 qxl_soft_reset(qxl
);
1213 vga_ioport_write(opaque
, addr
, val
);
1216 static const MemoryRegionPortio qxl_vga_portio_list
[] = {
1217 { 0x04, 2, 1, .read
= vga_ioport_read
,
1218 .write
= qxl_vga_ioport_write
}, /* 3b4 */
1219 { 0x0a, 1, 1, .read
= vga_ioport_read
,
1220 .write
= qxl_vga_ioport_write
}, /* 3ba */
1221 { 0x10, 16, 1, .read
= vga_ioport_read
,
1222 .write
= qxl_vga_ioport_write
}, /* 3c0 */
1223 { 0x24, 2, 1, .read
= vga_ioport_read
,
1224 .write
= qxl_vga_ioport_write
}, /* 3d4 */
1225 { 0x2a, 1, 1, .read
= vga_ioport_read
,
1226 .write
= qxl_vga_ioport_write
}, /* 3da */
1227 PORTIO_END_OF_LIST(),
1230 static int qxl_add_memslot(PCIQXLDevice
*d
, uint32_t slot_id
, uint64_t delta
,
1233 static const int regions
[] = {
1234 QXL_RAM_RANGE_INDEX
,
1235 QXL_VRAM_RANGE_INDEX
,
1236 QXL_VRAM64_RANGE_INDEX
,
1238 uint64_t guest_start
;
1243 intptr_t virt_start
;
1244 QXLDevMemSlot memslot
;
1247 guest_start
= le64_to_cpu(d
->guest_slots
[slot_id
].slot
.mem_start
);
1248 guest_end
= le64_to_cpu(d
->guest_slots
[slot_id
].slot
.mem_end
);
1250 trace_qxl_memslot_add_guest(d
->id
, slot_id
, guest_start
, guest_end
);
1252 if (slot_id
>= NUM_MEMSLOTS
) {
1253 qxl_set_guest_bug(d
, "%s: slot_id >= NUM_MEMSLOTS %d >= %d", __func__
,
1254 slot_id
, NUM_MEMSLOTS
);
1257 if (guest_start
> guest_end
) {
1258 qxl_set_guest_bug(d
, "%s: guest_start > guest_end 0x%" PRIx64
1259 " > 0x%" PRIx64
, __func__
, guest_start
, guest_end
);
1263 for (i
= 0; i
< ARRAY_SIZE(regions
); i
++) {
1264 pci_region
= regions
[i
];
1265 pci_start
= d
->pci
.io_regions
[pci_region
].addr
;
1266 pci_end
= pci_start
+ d
->pci
.io_regions
[pci_region
].size
;
1268 if (pci_start
== -1) {
1271 /* start address in range ? */
1272 if (guest_start
< pci_start
|| guest_start
> pci_end
) {
1275 /* end address in range ? */
1276 if (guest_end
> pci_end
) {
1282 if (i
== ARRAY_SIZE(regions
)) {
1283 qxl_set_guest_bug(d
, "%s: finished loop without match", __func__
);
1287 switch (pci_region
) {
1288 case QXL_RAM_RANGE_INDEX
:
1289 virt_start
= (intptr_t)memory_region_get_ram_ptr(&d
->vga
.vram
);
1291 case QXL_VRAM_RANGE_INDEX
:
1292 case 4 /* vram 64bit */:
1293 virt_start
= (intptr_t)memory_region_get_ram_ptr(&d
->vram_bar
);
1296 /* should not happen */
1297 qxl_set_guest_bug(d
, "%s: pci_region = %d", __func__
, pci_region
);
1301 memslot
.slot_id
= slot_id
;
1302 memslot
.slot_group_id
= MEMSLOT_GROUP_GUEST
; /* guest group */
1303 memslot
.virt_start
= virt_start
+ (guest_start
- pci_start
);
1304 memslot
.virt_end
= virt_start
+ (guest_end
- pci_start
);
1305 memslot
.addr_delta
= memslot
.virt_start
- delta
;
1306 memslot
.generation
= d
->rom
->slot_generation
= 0;
1307 qxl_rom_set_dirty(d
);
1309 qemu_spice_add_memslot(&d
->ssd
, &memslot
, async
);
1310 d
->guest_slots
[slot_id
].ptr
= (void*)memslot
.virt_start
;
1311 d
->guest_slots
[slot_id
].size
= memslot
.virt_end
- memslot
.virt_start
;
1312 d
->guest_slots
[slot_id
].delta
= delta
;
1313 d
->guest_slots
[slot_id
].active
= 1;
1317 static void qxl_del_memslot(PCIQXLDevice
*d
, uint32_t slot_id
)
1319 qemu_spice_del_memslot(&d
->ssd
, MEMSLOT_GROUP_HOST
, slot_id
);
1320 d
->guest_slots
[slot_id
].active
= 0;
1323 static void qxl_reset_memslots(PCIQXLDevice
*d
)
1325 qxl_spice_reset_memslots(d
);
1326 memset(&d
->guest_slots
, 0, sizeof(d
->guest_slots
));
1329 static void qxl_reset_surfaces(PCIQXLDevice
*d
)
1331 trace_qxl_reset_surfaces(d
->id
);
1332 d
->mode
= QXL_MODE_UNDEFINED
;
1333 qxl_spice_destroy_surfaces(d
, QXL_SYNC
);
1336 /* can be also called from spice server thread context */
1337 void *qxl_phys2virt(PCIQXLDevice
*qxl
, QXLPHYSICAL pqxl
, int group_id
)
1339 uint64_t phys
= le64_to_cpu(pqxl
);
1340 uint32_t slot
= (phys
>> (64 - 8)) & 0xff;
1341 uint64_t offset
= phys
& 0xffffffffffff;
1344 case MEMSLOT_GROUP_HOST
:
1345 return (void *)(intptr_t)offset
;
1346 case MEMSLOT_GROUP_GUEST
:
1347 if (slot
>= NUM_MEMSLOTS
) {
1348 qxl_set_guest_bug(qxl
, "slot too large %d >= %d", slot
,
1352 if (!qxl
->guest_slots
[slot
].active
) {
1353 qxl_set_guest_bug(qxl
, "inactive slot %d\n", slot
);
1356 if (offset
< qxl
->guest_slots
[slot
].delta
) {
1357 qxl_set_guest_bug(qxl
,
1358 "slot %d offset %"PRIu64
" < delta %"PRIu64
"\n",
1359 slot
, offset
, qxl
->guest_slots
[slot
].delta
);
1362 offset
-= qxl
->guest_slots
[slot
].delta
;
1363 if (offset
> qxl
->guest_slots
[slot
].size
) {
1364 qxl_set_guest_bug(qxl
,
1365 "slot %d offset %"PRIu64
" > size %"PRIu64
"\n",
1366 slot
, offset
, qxl
->guest_slots
[slot
].size
);
1369 return qxl
->guest_slots
[slot
].ptr
+ offset
;
1374 static void qxl_create_guest_primary_complete(PCIQXLDevice
*qxl
)
1376 /* for local rendering */
1377 qxl_render_resize(qxl
);
1380 static void qxl_create_guest_primary(PCIQXLDevice
*qxl
, int loadvm
,
1383 QXLDevSurfaceCreate surface
;
1384 QXLSurfaceCreate
*sc
= &qxl
->guest_primary
.surface
;
1385 uint32_t requested_height
= le32_to_cpu(sc
->height
);
1386 int requested_stride
= le32_to_cpu(sc
->stride
);
1388 if (requested_stride
== INT32_MIN
||
1389 abs(requested_stride
) * (uint64_t)requested_height
1390 > qxl
->vgamem_size
) {
1391 qxl_set_guest_bug(qxl
, "%s: requested primary larger than framebuffer"
1392 " stride %d x height %" PRIu32
" > %" PRIu32
,
1393 __func__
, requested_stride
, requested_height
,
1398 if (qxl
->mode
== QXL_MODE_NATIVE
) {
1399 qxl_set_guest_bug(qxl
, "%s: nop since already in QXL_MODE_NATIVE",
1402 qxl_exit_vga_mode(qxl
);
1404 surface
.format
= le32_to_cpu(sc
->format
);
1405 surface
.height
= le32_to_cpu(sc
->height
);
1406 surface
.mem
= le64_to_cpu(sc
->mem
);
1407 surface
.position
= le32_to_cpu(sc
->position
);
1408 surface
.stride
= le32_to_cpu(sc
->stride
);
1409 surface
.width
= le32_to_cpu(sc
->width
);
1410 surface
.type
= le32_to_cpu(sc
->type
);
1411 surface
.flags
= le32_to_cpu(sc
->flags
);
1412 trace_qxl_create_guest_primary(qxl
->id
, sc
->width
, sc
->height
, sc
->mem
,
1413 sc
->format
, sc
->position
);
1414 trace_qxl_create_guest_primary_rest(qxl
->id
, sc
->stride
, sc
->type
,
1417 if ((surface
.stride
& 0x3) != 0) {
1418 qxl_set_guest_bug(qxl
, "primary surface stride = %d %% 4 != 0",
1423 surface
.mouse_mode
= true;
1424 surface
.group_id
= MEMSLOT_GROUP_GUEST
;
1426 surface
.flags
|= QXL_SURF_FLAG_KEEP_DATA
;
1429 qxl
->mode
= QXL_MODE_NATIVE
;
1431 qemu_spice_create_primary_surface(&qxl
->ssd
, 0, &surface
, async
);
1433 if (async
== QXL_SYNC
) {
1434 qxl_create_guest_primary_complete(qxl
);
1438 /* return 1 if surface destoy was initiated (in QXL_ASYNC case) or
1439 * done (in QXL_SYNC case), 0 otherwise. */
1440 static int qxl_destroy_primary(PCIQXLDevice
*d
, qxl_async_io async
)
1442 if (d
->mode
== QXL_MODE_UNDEFINED
) {
1445 trace_qxl_destroy_primary(d
->id
);
1446 d
->mode
= QXL_MODE_UNDEFINED
;
1447 qemu_spice_destroy_primary_surface(&d
->ssd
, 0, async
);
1448 qxl_spice_reset_cursor(d
);
1452 static void qxl_set_mode(PCIQXLDevice
*d
, unsigned int modenr
, int loadvm
)
1454 pcibus_t start
= d
->pci
.io_regions
[QXL_RAM_RANGE_INDEX
].addr
;
1455 pcibus_t end
= d
->pci
.io_regions
[QXL_RAM_RANGE_INDEX
].size
+ start
;
1456 QXLMode
*mode
= d
->modes
->modes
+ modenr
;
1457 uint64_t devmem
= d
->pci
.io_regions
[QXL_RAM_RANGE_INDEX
].addr
;
1463 if (modenr
>= d
->modes
->n_modes
) {
1464 qxl_set_guest_bug(d
, "mode number out of range");
1468 QXLSurfaceCreate surface
= {
1469 .width
= mode
->x_res
,
1470 .height
= mode
->y_res
,
1471 .stride
= -mode
->x_res
* 4,
1472 .format
= SPICE_SURFACE_FMT_32_xRGB
,
1473 .flags
= loadvm
? QXL_SURF_FLAG_KEEP_DATA
: 0,
1475 .mem
= devmem
+ d
->shadow_rom
.draw_area_offset
,
1478 trace_qxl_set_mode(d
->id
, modenr
, mode
->x_res
, mode
->y_res
, mode
->bits
,
1481 qxl_hard_reset(d
, 0);
1484 d
->guest_slots
[0].slot
= slot
;
1485 assert(qxl_add_memslot(d
, 0, devmem
, QXL_SYNC
) == 0);
1487 d
->guest_primary
.surface
= surface
;
1488 qxl_create_guest_primary(d
, 0, QXL_SYNC
);
1490 d
->mode
= QXL_MODE_COMPAT
;
1491 d
->cmdflags
= QXL_COMMAND_FLAG_COMPAT
;
1492 if (mode
->bits
== 16) {
1493 d
->cmdflags
|= QXL_COMMAND_FLAG_COMPAT_16BPP
;
1495 d
->shadow_rom
.mode
= cpu_to_le32(modenr
);
1496 d
->rom
->mode
= cpu_to_le32(modenr
);
1497 qxl_rom_set_dirty(d
);
1500 static void ioport_write(void *opaque
, hwaddr addr
,
1501 uint64_t val
, unsigned size
)
1503 PCIQXLDevice
*d
= opaque
;
1504 uint32_t io_port
= addr
;
1505 qxl_async_io async
= QXL_SYNC
;
1506 uint32_t orig_io_port
= io_port
;
1508 if (d
->guest_bug
&& io_port
!= QXL_IO_RESET
) {
1512 if (d
->revision
<= QXL_REVISION_STABLE_V10
&&
1513 io_port
> QXL_IO_FLUSH_RELEASE
) {
1514 qxl_set_guest_bug(d
, "unsupported io %d for revision %d\n",
1515 io_port
, d
->revision
);
1521 case QXL_IO_SET_MODE
:
1522 case QXL_IO_MEMSLOT_ADD
:
1523 case QXL_IO_MEMSLOT_DEL
:
1524 case QXL_IO_CREATE_PRIMARY
:
1525 case QXL_IO_UPDATE_IRQ
:
1527 case QXL_IO_MEMSLOT_ADD_ASYNC
:
1528 case QXL_IO_CREATE_PRIMARY_ASYNC
:
1531 if (d
->mode
!= QXL_MODE_VGA
) {
1534 trace_qxl_io_unexpected_vga_mode(d
->id
,
1535 addr
, val
, io_port_to_string(io_port
));
1536 /* be nice to buggy guest drivers */
1537 if (io_port
>= QXL_IO_UPDATE_AREA_ASYNC
&&
1538 io_port
< QXL_IO_RANGE_SIZE
) {
1539 qxl_send_events(d
, QXL_INTERRUPT_IO_CMD
);
1544 /* we change the io_port to avoid ifdeffery in the main switch */
1545 orig_io_port
= io_port
;
1547 case QXL_IO_UPDATE_AREA_ASYNC
:
1548 io_port
= QXL_IO_UPDATE_AREA
;
1550 case QXL_IO_MEMSLOT_ADD_ASYNC
:
1551 io_port
= QXL_IO_MEMSLOT_ADD
;
1553 case QXL_IO_CREATE_PRIMARY_ASYNC
:
1554 io_port
= QXL_IO_CREATE_PRIMARY
;
1556 case QXL_IO_DESTROY_PRIMARY_ASYNC
:
1557 io_port
= QXL_IO_DESTROY_PRIMARY
;
1559 case QXL_IO_DESTROY_SURFACE_ASYNC
:
1560 io_port
= QXL_IO_DESTROY_SURFACE_WAIT
;
1562 case QXL_IO_DESTROY_ALL_SURFACES_ASYNC
:
1563 io_port
= QXL_IO_DESTROY_ALL_SURFACES
;
1565 case QXL_IO_FLUSH_SURFACES_ASYNC
:
1566 case QXL_IO_MONITORS_CONFIG_ASYNC
:
1569 qemu_mutex_lock(&d
->async_lock
);
1570 if (d
->current_async
!= QXL_UNDEFINED_IO
) {
1571 qxl_set_guest_bug(d
, "%d async started before last (%d) complete",
1572 io_port
, d
->current_async
);
1573 qemu_mutex_unlock(&d
->async_lock
);
1576 d
->current_async
= orig_io_port
;
1577 qemu_mutex_unlock(&d
->async_lock
);
1582 trace_qxl_io_write(d
->id
, qxl_mode_to_string(d
->mode
),
1583 addr
, io_port_to_string(addr
),
1587 case QXL_IO_UPDATE_AREA
:
1589 QXLCookie
*cookie
= NULL
;
1590 QXLRect update
= d
->ram
->update_area
;
1592 if (d
->ram
->update_surface
> d
->ssd
.num_surfaces
) {
1593 qxl_set_guest_bug(d
, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
1594 d
->ram
->update_surface
);
1597 if (update
.left
>= update
.right
|| update
.top
>= update
.bottom
||
1598 update
.left
< 0 || update
.top
< 0) {
1599 qxl_set_guest_bug(d
,
1600 "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
1601 update
.left
, update
.top
, update
.right
, update
.bottom
);
1602 if (update
.left
== update
.right
|| update
.top
== update
.bottom
) {
1603 /* old drivers may provide empty area, keep going */
1604 qxl_clear_guest_bug(d
);
1609 if (async
== QXL_ASYNC
) {
1610 cookie
= qxl_cookie_new(QXL_COOKIE_TYPE_IO
,
1611 QXL_IO_UPDATE_AREA_ASYNC
);
1612 cookie
->u
.area
= update
;
1614 qxl_spice_update_area(d
, d
->ram
->update_surface
,
1615 cookie
? &cookie
->u
.area
: &update
,
1616 NULL
, 0, 0, async
, cookie
);
1619 case QXL_IO_NOTIFY_CMD
:
1620 qemu_spice_wakeup(&d
->ssd
);
1622 case QXL_IO_NOTIFY_CURSOR
:
1623 qemu_spice_wakeup(&d
->ssd
);
1625 case QXL_IO_UPDATE_IRQ
:
1628 case QXL_IO_NOTIFY_OOM
:
1629 if (!SPICE_RING_IS_EMPTY(&d
->ram
->release_ring
)) {
1636 case QXL_IO_SET_MODE
:
1637 qxl_set_mode(d
, val
, 0);
1640 trace_qxl_io_log(d
->id
, d
->ram
->log_buf
);
1641 if (d
->guestdebug
) {
1642 fprintf(stderr
, "qxl/guest-%d: %" PRId64
": %s", d
->id
,
1643 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
), d
->ram
->log_buf
);
1647 qxl_hard_reset(d
, 0);
1649 case QXL_IO_MEMSLOT_ADD
:
1650 if (val
>= NUM_MEMSLOTS
) {
1651 qxl_set_guest_bug(d
, "QXL_IO_MEMSLOT_ADD: val out of range");
1654 if (d
->guest_slots
[val
].active
) {
1655 qxl_set_guest_bug(d
,
1656 "QXL_IO_MEMSLOT_ADD: memory slot already active");
1659 d
->guest_slots
[val
].slot
= d
->ram
->mem_slot
;
1660 qxl_add_memslot(d
, val
, 0, async
);
1662 case QXL_IO_MEMSLOT_DEL
:
1663 if (val
>= NUM_MEMSLOTS
) {
1664 qxl_set_guest_bug(d
, "QXL_IO_MEMSLOT_DEL: val out of range");
1667 qxl_del_memslot(d
, val
);
1669 case QXL_IO_CREATE_PRIMARY
:
1671 qxl_set_guest_bug(d
, "QXL_IO_CREATE_PRIMARY (async=%d): val != 0",
1675 d
->guest_primary
.surface
= d
->ram
->create_surface
;
1676 qxl_create_guest_primary(d
, 0, async
);
1678 case QXL_IO_DESTROY_PRIMARY
:
1680 qxl_set_guest_bug(d
, "QXL_IO_DESTROY_PRIMARY (async=%d): val != 0",
1684 if (!qxl_destroy_primary(d
, async
)) {
1685 trace_qxl_io_destroy_primary_ignored(d
->id
,
1686 qxl_mode_to_string(d
->mode
));
1690 case QXL_IO_DESTROY_SURFACE_WAIT
:
1691 if (val
>= d
->ssd
.num_surfaces
) {
1692 qxl_set_guest_bug(d
, "QXL_IO_DESTROY_SURFACE (async=%d):"
1693 "%" PRIu64
" >= NUM_SURFACES", async
, val
);
1696 qxl_spice_destroy_surface_wait(d
, val
, async
);
1698 case QXL_IO_FLUSH_RELEASE
: {
1699 QXLReleaseRing
*ring
= &d
->ram
->release_ring
;
1700 if (ring
->prod
- ring
->cons
+ 1 == ring
->num_items
) {
1702 "ERROR: no flush, full release ring [p%d,%dc]\n",
1703 ring
->prod
, ring
->cons
);
1705 qxl_push_free_res(d
, 1 /* flush */);
1708 case QXL_IO_FLUSH_SURFACES_ASYNC
:
1709 qxl_spice_flush_surfaces_async(d
);
1711 case QXL_IO_DESTROY_ALL_SURFACES
:
1712 d
->mode
= QXL_MODE_UNDEFINED
;
1713 qxl_spice_destroy_surfaces(d
, async
);
1715 case QXL_IO_MONITORS_CONFIG_ASYNC
:
1716 qxl_spice_monitors_config_async(d
, 0);
1719 qxl_set_guest_bug(d
, "%s: unexpected ioport=0x%x\n", __func__
, io_port
);
1724 qxl_send_events(d
, QXL_INTERRUPT_IO_CMD
);
1725 qemu_mutex_lock(&d
->async_lock
);
1726 d
->current_async
= QXL_UNDEFINED_IO
;
1727 qemu_mutex_unlock(&d
->async_lock
);
1731 static uint64_t ioport_read(void *opaque
, hwaddr addr
,
1734 PCIQXLDevice
*qxl
= opaque
;
1736 trace_qxl_io_read_unexpected(qxl
->id
);
1740 static const MemoryRegionOps qxl_io_ops
= {
1741 .read
= ioport_read
,
1742 .write
= ioport_write
,
1744 .min_access_size
= 1,
1745 .max_access_size
= 1,
1749 static void qxl_update_irq_bh(void *opaque
)
1751 PCIQXLDevice
*d
= opaque
;
1755 static void qxl_send_events(PCIQXLDevice
*d
, uint32_t events
)
1757 uint32_t old_pending
;
1758 uint32_t le_events
= cpu_to_le32(events
);
1760 trace_qxl_send_events(d
->id
, events
);
1761 if (!qemu_spice_display_is_running(&d
->ssd
)) {
1762 /* spice-server tracks guest running state and should not do this */
1763 fprintf(stderr
, "%s: spice-server bug: guest stopped, ignoring\n",
1765 trace_qxl_send_events_vm_stopped(d
->id
, events
);
1768 old_pending
= atomic_fetch_or(&d
->ram
->int_pending
, le_events
);
1769 if ((old_pending
& le_events
) == le_events
) {
1772 qemu_bh_schedule(d
->update_irq
);
1775 /* graphics console */
1777 static void qxl_hw_update(void *opaque
)
1779 PCIQXLDevice
*qxl
= opaque
;
1781 qxl_render_update(qxl
);
1784 static void qxl_dirty_surfaces(PCIQXLDevice
*qxl
)
1786 uintptr_t vram_start
;
1789 if (qxl
->mode
!= QXL_MODE_NATIVE
&& qxl
->mode
!= QXL_MODE_COMPAT
) {
1793 /* dirty the primary surface */
1794 qxl_set_dirty(&qxl
->vga
.vram
, qxl
->shadow_rom
.draw_area_offset
,
1795 qxl
->shadow_rom
.surface0_area_size
);
1797 vram_start
= (uintptr_t)memory_region_get_ram_ptr(&qxl
->vram_bar
);
1799 /* dirty the off-screen surfaces */
1800 for (i
= 0; i
< qxl
->ssd
.num_surfaces
; i
++) {
1802 intptr_t surface_offset
;
1805 if (qxl
->guest_surfaces
.cmds
[i
] == 0) {
1809 cmd
= qxl_phys2virt(qxl
, qxl
->guest_surfaces
.cmds
[i
],
1810 MEMSLOT_GROUP_GUEST
);
1812 assert(cmd
->type
== QXL_SURFACE_CMD_CREATE
);
1813 surface_offset
= (intptr_t)qxl_phys2virt(qxl
,
1814 cmd
->u
.surface_create
.data
,
1815 MEMSLOT_GROUP_GUEST
);
1816 assert(surface_offset
);
1817 surface_offset
-= vram_start
;
1818 surface_size
= cmd
->u
.surface_create
.height
*
1819 abs(cmd
->u
.surface_create
.stride
);
1820 trace_qxl_surfaces_dirty(qxl
->id
, i
, (int)surface_offset
, surface_size
);
1821 qxl_set_dirty(&qxl
->vram_bar
, surface_offset
, surface_size
);
1825 static void qxl_vm_change_state_handler(void *opaque
, int running
,
1828 PCIQXLDevice
*qxl
= opaque
;
1832 * if qxl_send_events was called from spice server context before
1833 * migration ended, qxl_update_irq for these events might not have been
1836 qxl_update_irq(qxl
);
1838 /* make sure surfaces are saved before migration */
1839 qxl_dirty_surfaces(qxl
);
1843 /* display change listener */
1845 static void display_update(DisplayChangeListener
*dcl
,
1846 int x
, int y
, int w
, int h
)
1848 PCIQXLDevice
*qxl
= container_of(dcl
, PCIQXLDevice
, ssd
.dcl
);
1850 if (qxl
->mode
== QXL_MODE_VGA
) {
1851 qemu_spice_display_update(&qxl
->ssd
, x
, y
, w
, h
);
1855 static void display_switch(DisplayChangeListener
*dcl
,
1856 struct DisplaySurface
*surface
)
1858 PCIQXLDevice
*qxl
= container_of(dcl
, PCIQXLDevice
, ssd
.dcl
);
1860 qxl
->ssd
.ds
= surface
;
1861 if (qxl
->mode
== QXL_MODE_VGA
) {
1862 qemu_spice_display_switch(&qxl
->ssd
, surface
);
1866 static void display_refresh(DisplayChangeListener
*dcl
)
1868 PCIQXLDevice
*qxl
= container_of(dcl
, PCIQXLDevice
, ssd
.dcl
);
1870 if (qxl
->mode
== QXL_MODE_VGA
) {
1871 qemu_spice_display_refresh(&qxl
->ssd
);
1875 static DisplayChangeListenerOps display_listener_ops
= {
1876 .dpy_name
= "spice/qxl",
1877 .dpy_gfx_update
= display_update
,
1878 .dpy_gfx_switch
= display_switch
,
1879 .dpy_refresh
= display_refresh
,
1882 static void qxl_init_ramsize(PCIQXLDevice
*qxl
)
1884 /* vga mode framebuffer / primary surface (bar 0, first part) */
1885 if (qxl
->vgamem_size_mb
< 8) {
1886 qxl
->vgamem_size_mb
= 8;
1888 /* XXX: we round vgamem_size_mb up to a nearest power of two and it must be
1889 * less than vga_common_init()'s maximum on qxl->vga.vram_size (512 now).
1891 if (qxl
->vgamem_size_mb
> 256) {
1892 qxl
->vgamem_size_mb
= 256;
1894 qxl
->vgamem_size
= qxl
->vgamem_size_mb
* 1024 * 1024;
1896 /* vga ram (bar 0, total) */
1897 if (qxl
->ram_size_mb
!= -1) {
1898 qxl
->vga
.vram_size
= qxl
->ram_size_mb
* 1024 * 1024;
1900 if (qxl
->vga
.vram_size
< qxl
->vgamem_size
* 2) {
1901 qxl
->vga
.vram_size
= qxl
->vgamem_size
* 2;
1904 /* vram32 (surfaces, 32bit, bar 1) */
1905 if (qxl
->vram32_size_mb
!= -1) {
1906 qxl
->vram32_size
= qxl
->vram32_size_mb
* 1024 * 1024;
1908 if (qxl
->vram32_size
< 4096) {
1909 qxl
->vram32_size
= 4096;
1912 /* vram (surfaces, 64bit, bar 4+5) */
1913 if (qxl
->vram_size_mb
!= -1) {
1914 qxl
->vram_size
= qxl
->vram_size_mb
* 1024 * 1024;
1916 if (qxl
->vram_size
< qxl
->vram32_size
) {
1917 qxl
->vram_size
= qxl
->vram32_size
;
1920 if (qxl
->revision
== 1) {
1921 qxl
->vram32_size
= 4096;
1922 qxl
->vram_size
= 4096;
1924 qxl
->vgamem_size
= msb_mask(qxl
->vgamem_size
* 2 - 1);
1925 qxl
->vga
.vram_size
= msb_mask(qxl
->vga
.vram_size
* 2 - 1);
1926 qxl
->vram32_size
= msb_mask(qxl
->vram32_size
* 2 - 1);
1927 qxl
->vram_size
= msb_mask(qxl
->vram_size
* 2 - 1);
1930 static int qxl_init_common(PCIQXLDevice
*qxl
)
1932 uint8_t* config
= qxl
->pci
.config
;
1933 uint32_t pci_device_rev
;
1936 qxl
->mode
= QXL_MODE_UNDEFINED
;
1937 qxl
->generation
= 1;
1938 qxl
->num_memslots
= NUM_MEMSLOTS
;
1939 qemu_mutex_init(&qxl
->track_lock
);
1940 qemu_mutex_init(&qxl
->async_lock
);
1941 qxl
->current_async
= QXL_UNDEFINED_IO
;
1944 switch (qxl
->revision
) {
1945 case 1: /* spice 0.4 -- qxl-1 */
1946 pci_device_rev
= QXL_REVISION_STABLE_V04
;
1949 case 2: /* spice 0.6 -- qxl-2 */
1950 pci_device_rev
= QXL_REVISION_STABLE_V06
;
1954 pci_device_rev
= QXL_REVISION_STABLE_V10
;
1955 io_size
= 32; /* PCI region size must be pow2 */
1958 pci_device_rev
= QXL_REVISION_STABLE_V12
;
1959 io_size
= msb_mask(QXL_IO_RANGE_SIZE
* 2 - 1);
1962 error_report("Invalid revision %d for qxl device (max %d)",
1963 qxl
->revision
, QXL_DEFAULT_REVISION
);
1967 pci_set_byte(&config
[PCI_REVISION_ID
], pci_device_rev
);
1968 pci_set_byte(&config
[PCI_INTERRUPT_PIN
], 1);
1970 qxl
->rom_size
= qxl_rom_size();
1971 memory_region_init_ram(&qxl
->rom_bar
, OBJECT(qxl
), "qxl.vrom",
1972 qxl
->rom_size
, &error_abort
);
1973 vmstate_register_ram(&qxl
->rom_bar
, &qxl
->pci
.qdev
);
1977 qxl
->guest_surfaces
.cmds
= g_new0(QXLPHYSICAL
, qxl
->ssd
.num_surfaces
);
1978 memory_region_init_ram(&qxl
->vram_bar
, OBJECT(qxl
), "qxl.vram",
1979 qxl
->vram_size
, &error_abort
);
1980 vmstate_register_ram(&qxl
->vram_bar
, &qxl
->pci
.qdev
);
1981 memory_region_init_alias(&qxl
->vram32_bar
, OBJECT(qxl
), "qxl.vram32",
1982 &qxl
->vram_bar
, 0, qxl
->vram32_size
);
1984 memory_region_init_io(&qxl
->io_bar
, OBJECT(qxl
), &qxl_io_ops
, qxl
,
1985 "qxl-ioports", io_size
);
1987 vga_dirty_log_start(&qxl
->vga
);
1989 memory_region_set_flush_coalesced(&qxl
->io_bar
);
1992 pci_register_bar(&qxl
->pci
, QXL_IO_RANGE_INDEX
,
1993 PCI_BASE_ADDRESS_SPACE_IO
, &qxl
->io_bar
);
1995 pci_register_bar(&qxl
->pci
, QXL_ROM_RANGE_INDEX
,
1996 PCI_BASE_ADDRESS_SPACE_MEMORY
, &qxl
->rom_bar
);
1998 pci_register_bar(&qxl
->pci
, QXL_RAM_RANGE_INDEX
,
1999 PCI_BASE_ADDRESS_SPACE_MEMORY
, &qxl
->vga
.vram
);
2001 pci_register_bar(&qxl
->pci
, QXL_VRAM_RANGE_INDEX
,
2002 PCI_BASE_ADDRESS_SPACE_MEMORY
, &qxl
->vram32_bar
);
2004 if (qxl
->vram32_size
< qxl
->vram_size
) {
2006 * Make the 64bit vram bar show up only in case it is
2007 * configured to be larger than the 32bit vram bar.
2009 pci_register_bar(&qxl
->pci
, QXL_VRAM64_RANGE_INDEX
,
2010 PCI_BASE_ADDRESS_SPACE_MEMORY
|
2011 PCI_BASE_ADDRESS_MEM_TYPE_64
|
2012 PCI_BASE_ADDRESS_MEM_PREFETCH
,
2016 /* print pci bar details */
2017 dprint(qxl
, 1, "ram/%s: %d MB [region 0]\n",
2018 qxl
->id
== 0 ? "pri" : "sec",
2019 qxl
->vga
.vram_size
/ (1024*1024));
2020 dprint(qxl
, 1, "vram/32: %d MB [region 1]\n",
2021 qxl
->vram32_size
/ (1024*1024));
2022 dprint(qxl
, 1, "vram/64: %d MB %s\n",
2023 qxl
->vram_size
/ (1024*1024),
2024 qxl
->vram32_size
< qxl
->vram_size
? "[region 4]" : "[unmapped]");
2026 qxl
->ssd
.qxl
.base
.sif
= &qxl_interface
.base
;
2027 if (qemu_spice_add_display_interface(&qxl
->ssd
.qxl
, qxl
->vga
.con
) != 0) {
2028 error_report("qxl interface %d.%d not supported by spice-server",
2029 SPICE_INTERFACE_QXL_MAJOR
, SPICE_INTERFACE_QXL_MINOR
);
2032 qemu_add_vm_change_state_handler(qxl_vm_change_state_handler
, qxl
);
2034 qxl
->update_irq
= qemu_bh_new(qxl_update_irq_bh
, qxl
);
2035 qxl_reset_state(qxl
);
2037 qxl
->update_area_bh
= qemu_bh_new(qxl_render_update_area_bh
, qxl
);
2038 qxl
->ssd
.cursor_bh
= qemu_bh_new(qemu_spice_cursor_refresh_bh
, &qxl
->ssd
);
2043 static int qxl_init_primary(PCIDevice
*dev
)
2045 PCIQXLDevice
*qxl
= DO_UPCAST(PCIQXLDevice
, pci
, dev
);
2046 VGACommonState
*vga
= &qxl
->vga
;
2050 qxl_init_ramsize(qxl
);
2051 vga
->vbe_size
= qxl
->vgamem_size
;
2052 vga
->vram_size_mb
= qxl
->vga
.vram_size
>> 20;
2053 vga_common_init(vga
, OBJECT(dev
), true);
2054 vga_init(vga
, OBJECT(dev
),
2055 pci_address_space(dev
), pci_address_space_io(dev
), false);
2056 portio_list_init(&qxl
->vga_port_list
, OBJECT(dev
), qxl_vga_portio_list
,
2058 portio_list_set_flush_coalesced(&qxl
->vga_port_list
);
2059 portio_list_add(&qxl
->vga_port_list
, pci_address_space_io(dev
), 0x3b0);
2061 vga
->con
= graphic_console_init(DEVICE(dev
), 0, &qxl_ops
, qxl
);
2062 qemu_spice_display_init_common(&qxl
->ssd
);
2064 rc
= qxl_init_common(qxl
);
2069 qxl
->ssd
.dcl
.ops
= &display_listener_ops
;
2070 qxl
->ssd
.dcl
.con
= vga
->con
;
2071 register_displaychangelistener(&qxl
->ssd
.dcl
);
2075 static int qxl_init_secondary(PCIDevice
*dev
)
2077 static int device_id
= 1;
2078 PCIQXLDevice
*qxl
= DO_UPCAST(PCIQXLDevice
, pci
, dev
);
2080 qxl
->id
= device_id
++;
2081 qxl_init_ramsize(qxl
);
2082 memory_region_init_ram(&qxl
->vga
.vram
, OBJECT(dev
), "qxl.vgavram",
2083 qxl
->vga
.vram_size
, &error_abort
);
2084 vmstate_register_ram(&qxl
->vga
.vram
, &qxl
->pci
.qdev
);
2085 qxl
->vga
.vram_ptr
= memory_region_get_ram_ptr(&qxl
->vga
.vram
);
2086 qxl
->vga
.con
= graphic_console_init(DEVICE(dev
), 0, &qxl_ops
, qxl
);
2088 return qxl_init_common(qxl
);
2091 static void qxl_pre_save(void *opaque
)
2093 PCIQXLDevice
* d
= opaque
;
2094 uint8_t *ram_start
= d
->vga
.vram_ptr
;
2096 trace_qxl_pre_save(d
->id
);
2097 if (d
->last_release
== NULL
) {
2098 d
->last_release_offset
= 0;
2100 d
->last_release_offset
= (uint8_t *)d
->last_release
- ram_start
;
2102 assert(d
->last_release_offset
< d
->vga
.vram_size
);
2105 static int qxl_pre_load(void *opaque
)
2107 PCIQXLDevice
* d
= opaque
;
2109 trace_qxl_pre_load(d
->id
);
2110 qxl_hard_reset(d
, 1);
2111 qxl_exit_vga_mode(d
);
2115 static void qxl_create_memslots(PCIQXLDevice
*d
)
2119 for (i
= 0; i
< NUM_MEMSLOTS
; i
++) {
2120 if (!d
->guest_slots
[i
].active
) {
2123 qxl_add_memslot(d
, i
, 0, QXL_SYNC
);
2127 static int qxl_post_load(void *opaque
, int version
)
2129 PCIQXLDevice
* d
= opaque
;
2130 uint8_t *ram_start
= d
->vga
.vram_ptr
;
2131 QXLCommandExt
*cmds
;
2132 int in
, out
, newmode
;
2134 assert(d
->last_release_offset
< d
->vga
.vram_size
);
2135 if (d
->last_release_offset
== 0) {
2136 d
->last_release
= NULL
;
2138 d
->last_release
= (QXLReleaseInfo
*)(ram_start
+ d
->last_release_offset
);
2141 d
->modes
= (QXLModes
*)((uint8_t*)d
->rom
+ d
->rom
->modes_offset
);
2143 trace_qxl_post_load(d
->id
, qxl_mode_to_string(d
->mode
));
2145 d
->mode
= QXL_MODE_UNDEFINED
;
2148 case QXL_MODE_UNDEFINED
:
2149 qxl_create_memslots(d
);
2152 qxl_create_memslots(d
);
2153 qxl_enter_vga_mode(d
);
2155 case QXL_MODE_NATIVE
:
2156 qxl_create_memslots(d
);
2157 qxl_create_guest_primary(d
, 1, QXL_SYNC
);
2159 /* replay surface-create and cursor-set commands */
2160 cmds
= g_malloc0(sizeof(QXLCommandExt
) * (d
->ssd
.num_surfaces
+ 1));
2161 for (in
= 0, out
= 0; in
< d
->ssd
.num_surfaces
; in
++) {
2162 if (d
->guest_surfaces
.cmds
[in
] == 0) {
2165 cmds
[out
].cmd
.data
= d
->guest_surfaces
.cmds
[in
];
2166 cmds
[out
].cmd
.type
= QXL_CMD_SURFACE
;
2167 cmds
[out
].group_id
= MEMSLOT_GROUP_GUEST
;
2170 if (d
->guest_cursor
) {
2171 cmds
[out
].cmd
.data
= d
->guest_cursor
;
2172 cmds
[out
].cmd
.type
= QXL_CMD_CURSOR
;
2173 cmds
[out
].group_id
= MEMSLOT_GROUP_GUEST
;
2176 qxl_spice_loadvm_commands(d
, cmds
, out
);
2178 if (d
->guest_monitors_config
) {
2179 qxl_spice_monitors_config_async(d
, 1);
2182 case QXL_MODE_COMPAT
:
2183 /* note: no need to call qxl_create_memslots, qxl_set_mode
2184 * creates the mem slot. */
2185 qxl_set_mode(d
, d
->shadow_rom
.mode
, 1);
2191 #define QXL_SAVE_VERSION 21
2193 static bool qxl_monitors_config_needed(void *opaque
)
2195 PCIQXLDevice
*qxl
= opaque
;
2197 return qxl
->guest_monitors_config
!= 0;
2201 static VMStateDescription qxl_memslot
= {
2202 .name
= "qxl-memslot",
2203 .version_id
= QXL_SAVE_VERSION
,
2204 .minimum_version_id
= QXL_SAVE_VERSION
,
2205 .fields
= (VMStateField
[]) {
2206 VMSTATE_UINT64(slot
.mem_start
, struct guest_slots
),
2207 VMSTATE_UINT64(slot
.mem_end
, struct guest_slots
),
2208 VMSTATE_UINT32(active
, struct guest_slots
),
2209 VMSTATE_END_OF_LIST()
2213 static VMStateDescription qxl_surface
= {
2214 .name
= "qxl-surface",
2215 .version_id
= QXL_SAVE_VERSION
,
2216 .minimum_version_id
= QXL_SAVE_VERSION
,
2217 .fields
= (VMStateField
[]) {
2218 VMSTATE_UINT32(width
, QXLSurfaceCreate
),
2219 VMSTATE_UINT32(height
, QXLSurfaceCreate
),
2220 VMSTATE_INT32(stride
, QXLSurfaceCreate
),
2221 VMSTATE_UINT32(format
, QXLSurfaceCreate
),
2222 VMSTATE_UINT32(position
, QXLSurfaceCreate
),
2223 VMSTATE_UINT32(mouse_mode
, QXLSurfaceCreate
),
2224 VMSTATE_UINT32(flags
, QXLSurfaceCreate
),
2225 VMSTATE_UINT32(type
, QXLSurfaceCreate
),
2226 VMSTATE_UINT64(mem
, QXLSurfaceCreate
),
2227 VMSTATE_END_OF_LIST()
2231 static VMStateDescription qxl_vmstate_monitors_config
= {
2232 .name
= "qxl/monitors-config",
2234 .minimum_version_id
= 1,
2235 .fields
= (VMStateField
[]) {
2236 VMSTATE_UINT64(guest_monitors_config
, PCIQXLDevice
),
2237 VMSTATE_END_OF_LIST()
2241 static VMStateDescription qxl_vmstate
= {
2243 .version_id
= QXL_SAVE_VERSION
,
2244 .minimum_version_id
= QXL_SAVE_VERSION
,
2245 .pre_save
= qxl_pre_save
,
2246 .pre_load
= qxl_pre_load
,
2247 .post_load
= qxl_post_load
,
2248 .fields
= (VMStateField
[]) {
2249 VMSTATE_PCI_DEVICE(pci
, PCIQXLDevice
),
2250 VMSTATE_STRUCT(vga
, PCIQXLDevice
, 0, vmstate_vga_common
, VGACommonState
),
2251 VMSTATE_UINT32(shadow_rom
.mode
, PCIQXLDevice
),
2252 VMSTATE_UINT32(num_free_res
, PCIQXLDevice
),
2253 VMSTATE_UINT32(last_release_offset
, PCIQXLDevice
),
2254 VMSTATE_UINT32(mode
, PCIQXLDevice
),
2255 VMSTATE_UINT32(ssd
.unique
, PCIQXLDevice
),
2256 VMSTATE_INT32_EQUAL(num_memslots
, PCIQXLDevice
),
2257 VMSTATE_STRUCT_ARRAY(guest_slots
, PCIQXLDevice
, NUM_MEMSLOTS
, 0,
2258 qxl_memslot
, struct guest_slots
),
2259 VMSTATE_STRUCT(guest_primary
.surface
, PCIQXLDevice
, 0,
2260 qxl_surface
, QXLSurfaceCreate
),
2261 VMSTATE_INT32_EQUAL(ssd
.num_surfaces
, PCIQXLDevice
),
2262 VMSTATE_VARRAY_INT32(guest_surfaces
.cmds
, PCIQXLDevice
,
2263 ssd
.num_surfaces
, 0,
2264 vmstate_info_uint64
, uint64_t),
2265 VMSTATE_UINT64(guest_cursor
, PCIQXLDevice
),
2266 VMSTATE_END_OF_LIST()
2268 .subsections
= (VMStateSubsection
[]) {
2270 .vmsd
= &qxl_vmstate_monitors_config
,
2271 .needed
= qxl_monitors_config_needed
,
2278 static Property qxl_properties
[] = {
2279 DEFINE_PROP_UINT32("ram_size", PCIQXLDevice
, vga
.vram_size
,
2281 DEFINE_PROP_UINT32("vram_size", PCIQXLDevice
, vram32_size
,
2283 DEFINE_PROP_UINT32("revision", PCIQXLDevice
, revision
,
2284 QXL_DEFAULT_REVISION
),
2285 DEFINE_PROP_UINT32("debug", PCIQXLDevice
, debug
, 0),
2286 DEFINE_PROP_UINT32("guestdebug", PCIQXLDevice
, guestdebug
, 0),
2287 DEFINE_PROP_UINT32("cmdlog", PCIQXLDevice
, cmdlog
, 0),
2288 DEFINE_PROP_UINT32("ram_size_mb", PCIQXLDevice
, ram_size_mb
, -1),
2289 DEFINE_PROP_UINT32("vram_size_mb", PCIQXLDevice
, vram32_size_mb
, -1),
2290 DEFINE_PROP_UINT32("vram64_size_mb", PCIQXLDevice
, vram_size_mb
, -1),
2291 DEFINE_PROP_UINT32("vgamem_mb", PCIQXLDevice
, vgamem_size_mb
, 16),
2292 DEFINE_PROP_INT32("surfaces", PCIQXLDevice
, ssd
.num_surfaces
, 1024),
2293 DEFINE_PROP_END_OF_LIST(),
2296 static void qxl_primary_class_init(ObjectClass
*klass
, void *data
)
2298 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2299 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
2301 k
->init
= qxl_init_primary
;
2302 k
->romfile
= "vgabios-qxl.bin";
2303 k
->vendor_id
= REDHAT_PCI_VENDOR_ID
;
2304 k
->device_id
= QXL_DEVICE_ID_STABLE
;
2305 k
->class_id
= PCI_CLASS_DISPLAY_VGA
;
2306 set_bit(DEVICE_CATEGORY_DISPLAY
, dc
->categories
);
2307 dc
->desc
= "Spice QXL GPU (primary, vga compatible)";
2308 dc
->reset
= qxl_reset_handler
;
2309 dc
->vmsd
= &qxl_vmstate
;
2310 dc
->props
= qxl_properties
;
2311 dc
->hotpluggable
= false;
2314 static const TypeInfo qxl_primary_info
= {
2316 .parent
= TYPE_PCI_DEVICE
,
2317 .instance_size
= sizeof(PCIQXLDevice
),
2318 .class_init
= qxl_primary_class_init
,
2321 static void qxl_secondary_class_init(ObjectClass
*klass
, void *data
)
2323 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2324 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
2326 k
->init
= qxl_init_secondary
;
2327 k
->vendor_id
= REDHAT_PCI_VENDOR_ID
;
2328 k
->device_id
= QXL_DEVICE_ID_STABLE
;
2329 k
->class_id
= PCI_CLASS_DISPLAY_OTHER
;
2330 set_bit(DEVICE_CATEGORY_DISPLAY
, dc
->categories
);
2331 dc
->desc
= "Spice QXL GPU (secondary)";
2332 dc
->reset
= qxl_reset_handler
;
2333 dc
->vmsd
= &qxl_vmstate
;
2334 dc
->props
= qxl_properties
;
2337 static const TypeInfo qxl_secondary_info
= {
2339 .parent
= TYPE_PCI_DEVICE
,
2340 .instance_size
= sizeof(PCIQXLDevice
),
2341 .class_init
= qxl_secondary_class_init
,
2344 static void qxl_register_types(void)
2346 type_register_static(&qxl_primary_info
);
2347 type_register_static(&qxl_secondary_info
);
2350 type_init(qxl_register_types
)