2 * Copyright (C) 2010 Red Hat, Inc.
4 * written by Yaniv Kamay, Izik Eidus, Gerd Hoffmann
5 * maintained by Gerd Hoffmann <kraxel@redhat.com>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu-common.h"
22 #include "qemu-timer.h"
23 #include "qemu-queue.h"
29 #undef SPICE_RING_PROD_ITEM
30 #define SPICE_RING_PROD_ITEM(r, ret) { \
31 typeof(r) start = r; \
32 typeof(r) end = r + 1; \
33 uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r); \
34 typeof(&(r)->items[prod]) m_item = &(r)->items[prod]; \
35 if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
41 #undef SPICE_RING_CONS_ITEM
42 #define SPICE_RING_CONS_ITEM(r, ret) { \
43 typeof(r) start = r; \
44 typeof(r) end = r + 1; \
45 uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r); \
46 typeof(&(r)->items[cons]) m_item = &(r)->items[cons]; \
47 if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
54 #define ALIGN(a, b) (((a) + ((b) - 1)) & ~((b) - 1))
56 #define PIXEL_SIZE 0.2936875 //1280x1024 is 14.8" x 11.9"
58 #define QXL_MODE(_x, _y, _b, _o) \
62 .stride = (_x) * (_b) / 8, \
63 .x_mili = PIXEL_SIZE * (_x), \
64 .y_mili = PIXEL_SIZE * (_y), \
68 #define QXL_MODE_16_32(x_res, y_res, orientation) \
69 QXL_MODE(x_res, y_res, 16, orientation), \
70 QXL_MODE(x_res, y_res, 32, orientation)
72 #define QXL_MODE_EX(x_res, y_res) \
73 QXL_MODE_16_32(x_res, y_res, 0), \
74 QXL_MODE_16_32(y_res, x_res, 1), \
75 QXL_MODE_16_32(x_res, y_res, 2), \
76 QXL_MODE_16_32(y_res, x_res, 3)
78 static QXLMode qxl_modes
[] = {
79 QXL_MODE_EX(640, 480),
80 QXL_MODE_EX(800, 480),
81 QXL_MODE_EX(800, 600),
82 QXL_MODE_EX(832, 624),
83 QXL_MODE_EX(960, 640),
84 QXL_MODE_EX(1024, 600),
85 QXL_MODE_EX(1024, 768),
86 QXL_MODE_EX(1152, 864),
87 QXL_MODE_EX(1152, 870),
88 QXL_MODE_EX(1280, 720),
89 QXL_MODE_EX(1280, 760),
90 QXL_MODE_EX(1280, 768),
91 QXL_MODE_EX(1280, 800),
92 QXL_MODE_EX(1280, 960),
93 QXL_MODE_EX(1280, 1024),
94 QXL_MODE_EX(1360, 768),
95 QXL_MODE_EX(1366, 768),
96 QXL_MODE_EX(1400, 1050),
97 QXL_MODE_EX(1440, 900),
98 QXL_MODE_EX(1600, 900),
99 QXL_MODE_EX(1600, 1200),
100 QXL_MODE_EX(1680, 1050),
101 QXL_MODE_EX(1920, 1080),
102 #if VGA_RAM_SIZE >= (16 * 1024 * 1024)
103 /* these modes need more than 8 MB video memory */
104 QXL_MODE_EX(1920, 1200),
105 QXL_MODE_EX(1920, 1440),
106 QXL_MODE_EX(2048, 1536),
107 QXL_MODE_EX(2560, 1440),
108 QXL_MODE_EX(2560, 1600),
110 #if VGA_RAM_SIZE >= (32 * 1024 * 1024)
111 /* these modes need more than 16 MB video memory */
112 QXL_MODE_EX(2560, 2048),
113 QXL_MODE_EX(2800, 2100),
114 QXL_MODE_EX(3200, 2400),
118 static PCIQXLDevice
*qxl0
;
120 static void qxl_send_events(PCIQXLDevice
*d
, uint32_t events
);
121 static int qxl_destroy_primary(PCIQXLDevice
*d
, qxl_async_io async
);
122 static void qxl_reset_memslots(PCIQXLDevice
*d
);
123 static void qxl_reset_surfaces(PCIQXLDevice
*d
);
124 static void qxl_ring_set_dirty(PCIQXLDevice
*qxl
);
126 void qxl_guest_bug(PCIQXLDevice
*qxl
, const char *msg
, ...)
128 #if SPICE_INTERFACE_QXL_MINOR >= 1
129 qxl_send_events(qxl
, QXL_INTERRUPT_ERROR
);
131 if (qxl
->guestdebug
) {
134 fprintf(stderr
, "qxl-%d: guest bug: ", qxl
->id
);
135 vfprintf(stderr
, msg
, ap
);
136 fprintf(stderr
, "\n");
142 void qxl_spice_update_area(PCIQXLDevice
*qxl
, uint32_t surface_id
,
143 struct QXLRect
*area
, struct QXLRect
*dirty_rects
,
144 uint32_t num_dirty_rects
,
145 uint32_t clear_dirty_region
,
148 if (async
== QXL_SYNC
) {
149 qxl
->ssd
.worker
->update_area(qxl
->ssd
.worker
, surface_id
, area
,
150 dirty_rects
, num_dirty_rects
, clear_dirty_region
);
152 #if SPICE_INTERFACE_QXL_MINOR >= 1
153 spice_qxl_update_area_async(&qxl
->ssd
.qxl
, surface_id
, area
,
154 clear_dirty_region
, 0);
161 static void qxl_spice_destroy_surface_wait_complete(PCIQXLDevice
*qxl
,
164 qemu_mutex_lock(&qxl
->track_lock
);
165 qxl
->guest_surfaces
.cmds
[id
] = 0;
166 qxl
->guest_surfaces
.count
--;
167 qemu_mutex_unlock(&qxl
->track_lock
);
170 static void qxl_spice_destroy_surface_wait(PCIQXLDevice
*qxl
, uint32_t id
,
174 #if SPICE_INTERFACE_QXL_MINOR < 1
177 spice_qxl_destroy_surface_async(&qxl
->ssd
.qxl
, id
,
181 qxl
->ssd
.worker
->destroy_surface_wait(qxl
->ssd
.worker
, id
);
182 qxl_spice_destroy_surface_wait_complete(qxl
, id
);
186 #if SPICE_INTERFACE_QXL_MINOR >= 1
187 static void qxl_spice_flush_surfaces_async(PCIQXLDevice
*qxl
)
189 spice_qxl_flush_surfaces_async(&qxl
->ssd
.qxl
, 0);
193 void qxl_spice_loadvm_commands(PCIQXLDevice
*qxl
, struct QXLCommandExt
*ext
,
196 qxl
->ssd
.worker
->loadvm_commands(qxl
->ssd
.worker
, ext
, count
);
199 void qxl_spice_oom(PCIQXLDevice
*qxl
)
201 qxl
->ssd
.worker
->oom(qxl
->ssd
.worker
);
204 void qxl_spice_reset_memslots(PCIQXLDevice
*qxl
)
206 qxl
->ssd
.worker
->reset_memslots(qxl
->ssd
.worker
);
209 static void qxl_spice_destroy_surfaces_complete(PCIQXLDevice
*qxl
)
211 qemu_mutex_lock(&qxl
->track_lock
);
212 memset(&qxl
->guest_surfaces
.cmds
, 0, sizeof(qxl
->guest_surfaces
.cmds
));
213 qxl
->guest_surfaces
.count
= 0;
214 qemu_mutex_unlock(&qxl
->track_lock
);
217 static void qxl_spice_destroy_surfaces(PCIQXLDevice
*qxl
, qxl_async_io async
)
220 #if SPICE_INTERFACE_QXL_MINOR < 1
223 spice_qxl_destroy_surfaces_async(&qxl
->ssd
.qxl
, 0);
226 qxl
->ssd
.worker
->destroy_surfaces(qxl
->ssd
.worker
);
227 qxl_spice_destroy_surfaces_complete(qxl
);
231 void qxl_spice_reset_image_cache(PCIQXLDevice
*qxl
)
233 qxl
->ssd
.worker
->reset_image_cache(qxl
->ssd
.worker
);
236 void qxl_spice_reset_cursor(PCIQXLDevice
*qxl
)
238 qxl
->ssd
.worker
->reset_cursor(qxl
->ssd
.worker
);
239 qemu_mutex_lock(&qxl
->track_lock
);
240 qxl
->guest_cursor
= 0;
241 qemu_mutex_unlock(&qxl
->track_lock
);
245 static inline uint32_t msb_mask(uint32_t val
)
250 mask
= ~(val
- 1) & val
;
252 } while (mask
< val
);
257 static ram_addr_t
qxl_rom_size(void)
259 uint32_t rom_size
= sizeof(QXLRom
) + sizeof(QXLModes
) + sizeof(qxl_modes
);
260 rom_size
= MAX(rom_size
, TARGET_PAGE_SIZE
);
261 rom_size
= msb_mask(rom_size
* 2 - 1);
265 static void init_qxl_rom(PCIQXLDevice
*d
)
267 QXLRom
*rom
= memory_region_get_ram_ptr(&d
->rom_bar
);
268 QXLModes
*modes
= (QXLModes
*)(rom
+ 1);
269 uint32_t ram_header_size
;
270 uint32_t surface0_area_size
;
272 uint32_t fb
, maxfb
= 0;
275 memset(rom
, 0, d
->rom_size
);
277 rom
->magic
= cpu_to_le32(QXL_ROM_MAGIC
);
278 rom
->id
= cpu_to_le32(d
->id
);
279 rom
->log_level
= cpu_to_le32(d
->guestdebug
);
280 rom
->modes_offset
= cpu_to_le32(sizeof(QXLRom
));
282 rom
->slot_gen_bits
= MEMSLOT_GENERATION_BITS
;
283 rom
->slot_id_bits
= MEMSLOT_SLOT_BITS
;
284 rom
->slots_start
= 1;
285 rom
->slots_end
= NUM_MEMSLOTS
- 1;
286 rom
->n_surfaces
= cpu_to_le32(NUM_SURFACES
);
288 modes
->n_modes
= cpu_to_le32(ARRAY_SIZE(qxl_modes
));
289 for (i
= 0; i
< modes
->n_modes
; i
++) {
290 fb
= qxl_modes
[i
].y_res
* qxl_modes
[i
].stride
;
294 modes
->modes
[i
].id
= cpu_to_le32(i
);
295 modes
->modes
[i
].x_res
= cpu_to_le32(qxl_modes
[i
].x_res
);
296 modes
->modes
[i
].y_res
= cpu_to_le32(qxl_modes
[i
].y_res
);
297 modes
->modes
[i
].bits
= cpu_to_le32(qxl_modes
[i
].bits
);
298 modes
->modes
[i
].stride
= cpu_to_le32(qxl_modes
[i
].stride
);
299 modes
->modes
[i
].x_mili
= cpu_to_le32(qxl_modes
[i
].x_mili
);
300 modes
->modes
[i
].y_mili
= cpu_to_le32(qxl_modes
[i
].y_mili
);
301 modes
->modes
[i
].orientation
= cpu_to_le32(qxl_modes
[i
].orientation
);
303 if (maxfb
< VGA_RAM_SIZE
&& d
->id
== 0)
304 maxfb
= VGA_RAM_SIZE
;
306 ram_header_size
= ALIGN(sizeof(QXLRam
), 4096);
307 surface0_area_size
= ALIGN(maxfb
, 4096);
308 num_pages
= d
->vga
.vram_size
;
309 num_pages
-= ram_header_size
;
310 num_pages
-= surface0_area_size
;
311 num_pages
= num_pages
/ TARGET_PAGE_SIZE
;
313 rom
->draw_area_offset
= cpu_to_le32(0);
314 rom
->surface0_area_size
= cpu_to_le32(surface0_area_size
);
315 rom
->pages_offset
= cpu_to_le32(surface0_area_size
);
316 rom
->num_pages
= cpu_to_le32(num_pages
);
317 rom
->ram_header_offset
= cpu_to_le32(d
->vga
.vram_size
- ram_header_size
);
319 d
->shadow_rom
= *rom
;
324 static void init_qxl_ram(PCIQXLDevice
*d
)
329 buf
= d
->vga
.vram_ptr
;
330 d
->ram
= (QXLRam
*)(buf
+ le32_to_cpu(d
->shadow_rom
.ram_header_offset
));
331 d
->ram
->magic
= cpu_to_le32(QXL_RAM_MAGIC
);
332 d
->ram
->int_pending
= cpu_to_le32(0);
333 d
->ram
->int_mask
= cpu_to_le32(0);
334 d
->ram
->update_surface
= 0;
335 SPICE_RING_INIT(&d
->ram
->cmd_ring
);
336 SPICE_RING_INIT(&d
->ram
->cursor_ring
);
337 SPICE_RING_INIT(&d
->ram
->release_ring
);
338 SPICE_RING_PROD_ITEM(&d
->ram
->release_ring
, item
);
340 qxl_ring_set_dirty(d
);
343 /* can be called from spice server thread context */
344 static void qxl_set_dirty(MemoryRegion
*mr
, ram_addr_t addr
, ram_addr_t end
)
347 memory_region_set_dirty(mr
, addr
);
348 addr
+= TARGET_PAGE_SIZE
;
352 static void qxl_rom_set_dirty(PCIQXLDevice
*qxl
)
354 qxl_set_dirty(&qxl
->rom_bar
, 0, qxl
->rom_size
);
357 /* called from spice server thread context only */
358 static void qxl_ram_set_dirty(PCIQXLDevice
*qxl
, void *ptr
)
360 void *base
= qxl
->vga
.vram_ptr
;
364 offset
&= ~(TARGET_PAGE_SIZE
-1);
365 assert(offset
< qxl
->vga
.vram_size
);
366 qxl_set_dirty(&qxl
->vga
.vram
, offset
, offset
+ TARGET_PAGE_SIZE
);
369 /* can be called from spice server thread context */
370 static void qxl_ring_set_dirty(PCIQXLDevice
*qxl
)
372 ram_addr_t addr
= qxl
->shadow_rom
.ram_header_offset
;
373 ram_addr_t end
= qxl
->vga
.vram_size
;
374 qxl_set_dirty(&qxl
->vga
.vram
, addr
, end
);
378 * keep track of some command state, for savevm/loadvm.
379 * called from spice server thread context only
381 static void qxl_track_command(PCIQXLDevice
*qxl
, struct QXLCommandExt
*ext
)
383 switch (le32_to_cpu(ext
->cmd
.type
)) {
384 case QXL_CMD_SURFACE
:
386 QXLSurfaceCmd
*cmd
= qxl_phys2virt(qxl
, ext
->cmd
.data
, ext
->group_id
);
387 uint32_t id
= le32_to_cpu(cmd
->surface_id
);
388 PANIC_ON(id
>= NUM_SURFACES
);
389 qemu_mutex_lock(&qxl
->track_lock
);
390 if (cmd
->type
== QXL_SURFACE_CMD_CREATE
) {
391 qxl
->guest_surfaces
.cmds
[id
] = ext
->cmd
.data
;
392 qxl
->guest_surfaces
.count
++;
393 if (qxl
->guest_surfaces
.max
< qxl
->guest_surfaces
.count
)
394 qxl
->guest_surfaces
.max
= qxl
->guest_surfaces
.count
;
396 if (cmd
->type
== QXL_SURFACE_CMD_DESTROY
) {
397 qxl
->guest_surfaces
.cmds
[id
] = 0;
398 qxl
->guest_surfaces
.count
--;
400 qemu_mutex_unlock(&qxl
->track_lock
);
405 QXLCursorCmd
*cmd
= qxl_phys2virt(qxl
, ext
->cmd
.data
, ext
->group_id
);
406 if (cmd
->type
== QXL_CURSOR_SET
) {
407 qemu_mutex_lock(&qxl
->track_lock
);
408 qxl
->guest_cursor
= ext
->cmd
.data
;
409 qemu_mutex_unlock(&qxl
->track_lock
);
416 /* spice display interface callbacks */
418 static void interface_attach_worker(QXLInstance
*sin
, QXLWorker
*qxl_worker
)
420 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
422 dprint(qxl
, 1, "%s:\n", __FUNCTION__
);
423 qxl
->ssd
.worker
= qxl_worker
;
426 static void interface_set_compression_level(QXLInstance
*sin
, int level
)
428 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
430 dprint(qxl
, 1, "%s: %d\n", __FUNCTION__
, level
);
431 qxl
->shadow_rom
.compression_level
= cpu_to_le32(level
);
432 qxl
->rom
->compression_level
= cpu_to_le32(level
);
433 qxl_rom_set_dirty(qxl
);
436 static void interface_set_mm_time(QXLInstance
*sin
, uint32_t mm_time
)
438 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
440 qxl
->shadow_rom
.mm_clock
= cpu_to_le32(mm_time
);
441 qxl
->rom
->mm_clock
= cpu_to_le32(mm_time
);
442 qxl_rom_set_dirty(qxl
);
445 static void interface_get_init_info(QXLInstance
*sin
, QXLDevInitInfo
*info
)
447 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
449 dprint(qxl
, 1, "%s:\n", __FUNCTION__
);
450 info
->memslot_gen_bits
= MEMSLOT_GENERATION_BITS
;
451 info
->memslot_id_bits
= MEMSLOT_SLOT_BITS
;
452 info
->num_memslots
= NUM_MEMSLOTS
;
453 info
->num_memslots_groups
= NUM_MEMSLOTS_GROUPS
;
454 info
->internal_groupslot_id
= 0;
455 info
->qxl_ram_size
= le32_to_cpu(qxl
->shadow_rom
.num_pages
) << TARGET_PAGE_BITS
;
456 info
->n_surfaces
= NUM_SURFACES
;
459 static const char *qxl_mode_to_string(int mode
)
462 case QXL_MODE_COMPAT
:
464 case QXL_MODE_NATIVE
:
466 case QXL_MODE_UNDEFINED
:
474 static const char *io_port_to_string(uint32_t io_port
)
476 if (io_port
>= QXL_IO_RANGE_SIZE
) {
477 return "out of range";
479 static const char *io_port_to_string
[QXL_IO_RANGE_SIZE
+ 1] = {
480 [QXL_IO_NOTIFY_CMD
] = "QXL_IO_NOTIFY_CMD",
481 [QXL_IO_NOTIFY_CURSOR
] = "QXL_IO_NOTIFY_CURSOR",
482 [QXL_IO_UPDATE_AREA
] = "QXL_IO_UPDATE_AREA",
483 [QXL_IO_UPDATE_IRQ
] = "QXL_IO_UPDATE_IRQ",
484 [QXL_IO_NOTIFY_OOM
] = "QXL_IO_NOTIFY_OOM",
485 [QXL_IO_RESET
] = "QXL_IO_RESET",
486 [QXL_IO_SET_MODE
] = "QXL_IO_SET_MODE",
487 [QXL_IO_LOG
] = "QXL_IO_LOG",
488 [QXL_IO_MEMSLOT_ADD
] = "QXL_IO_MEMSLOT_ADD",
489 [QXL_IO_MEMSLOT_DEL
] = "QXL_IO_MEMSLOT_DEL",
490 [QXL_IO_DETACH_PRIMARY
] = "QXL_IO_DETACH_PRIMARY",
491 [QXL_IO_ATTACH_PRIMARY
] = "QXL_IO_ATTACH_PRIMARY",
492 [QXL_IO_CREATE_PRIMARY
] = "QXL_IO_CREATE_PRIMARY",
493 [QXL_IO_DESTROY_PRIMARY
] = "QXL_IO_DESTROY_PRIMARY",
494 [QXL_IO_DESTROY_SURFACE_WAIT
] = "QXL_IO_DESTROY_SURFACE_WAIT",
495 [QXL_IO_DESTROY_ALL_SURFACES
] = "QXL_IO_DESTROY_ALL_SURFACES",
496 #if SPICE_INTERFACE_QXL_MINOR >= 1
497 [QXL_IO_UPDATE_AREA_ASYNC
] = "QXL_IO_UPDATE_AREA_ASYNC",
498 [QXL_IO_MEMSLOT_ADD_ASYNC
] = "QXL_IO_MEMSLOT_ADD_ASYNC",
499 [QXL_IO_CREATE_PRIMARY_ASYNC
] = "QXL_IO_CREATE_PRIMARY_ASYNC",
500 [QXL_IO_DESTROY_PRIMARY_ASYNC
] = "QXL_IO_DESTROY_PRIMARY_ASYNC",
501 [QXL_IO_DESTROY_SURFACE_ASYNC
] = "QXL_IO_DESTROY_SURFACE_ASYNC",
502 [QXL_IO_DESTROY_ALL_SURFACES_ASYNC
]
503 = "QXL_IO_DESTROY_ALL_SURFACES_ASYNC",
504 [QXL_IO_FLUSH_SURFACES_ASYNC
] = "QXL_IO_FLUSH_SURFACES_ASYNC",
505 [QXL_IO_FLUSH_RELEASE
] = "QXL_IO_FLUSH_RELEASE",
508 return io_port_to_string
[io_port
];
511 /* called from spice server thread context only */
512 static int interface_get_command(QXLInstance
*sin
, struct QXLCommandExt
*ext
)
514 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
515 SimpleSpiceUpdate
*update
;
516 QXLCommandRing
*ring
;
522 dprint(qxl
, 2, "%s: vga\n", __FUNCTION__
);
524 qemu_mutex_lock(&qxl
->ssd
.lock
);
525 if (qxl
->ssd
.update
!= NULL
) {
526 update
= qxl
->ssd
.update
;
527 qxl
->ssd
.update
= NULL
;
531 qemu_mutex_unlock(&qxl
->ssd
.lock
);
533 dprint(qxl
, 2, "%s %s\n", __FUNCTION__
, qxl_mode_to_string(qxl
->mode
));
534 qxl_log_command(qxl
, "vga", ext
);
537 case QXL_MODE_COMPAT
:
538 case QXL_MODE_NATIVE
:
539 case QXL_MODE_UNDEFINED
:
540 dprint(qxl
, 4, "%s: %s\n", __FUNCTION__
, qxl_mode_to_string(qxl
->mode
));
541 ring
= &qxl
->ram
->cmd_ring
;
542 if (SPICE_RING_IS_EMPTY(ring
)) {
545 dprint(qxl
, 2, "%s: %s\n", __FUNCTION__
, qxl_mode_to_string(qxl
->mode
));
546 SPICE_RING_CONS_ITEM(ring
, cmd
);
548 ext
->group_id
= MEMSLOT_GROUP_GUEST
;
549 ext
->flags
= qxl
->cmdflags
;
550 SPICE_RING_POP(ring
, notify
);
551 qxl_ring_set_dirty(qxl
);
553 qxl_send_events(qxl
, QXL_INTERRUPT_DISPLAY
);
555 qxl
->guest_primary
.commands
++;
556 qxl_track_command(qxl
, ext
);
557 qxl_log_command(qxl
, "cmd", ext
);
564 /* called from spice server thread context only */
565 static int interface_req_cmd_notification(QXLInstance
*sin
)
567 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
571 case QXL_MODE_COMPAT
:
572 case QXL_MODE_NATIVE
:
573 case QXL_MODE_UNDEFINED
:
574 SPICE_RING_CONS_WAIT(&qxl
->ram
->cmd_ring
, wait
);
575 qxl_ring_set_dirty(qxl
);
584 /* called from spice server thread context only */
585 static inline void qxl_push_free_res(PCIQXLDevice
*d
, int flush
)
587 QXLReleaseRing
*ring
= &d
->ram
->release_ring
;
591 #define QXL_FREE_BUNCH_SIZE 32
593 if (ring
->prod
- ring
->cons
+ 1 == ring
->num_items
) {
594 /* ring full -- can't push */
597 if (!flush
&& d
->oom_running
) {
598 /* collect everything from oom handler before pushing */
601 if (!flush
&& d
->num_free_res
< QXL_FREE_BUNCH_SIZE
) {
602 /* collect a bit more before pushing */
606 SPICE_RING_PUSH(ring
, notify
);
607 dprint(d
, 2, "free: push %d items, notify %s, ring %d/%d [%d,%d]\n",
608 d
->num_free_res
, notify
? "yes" : "no",
609 ring
->prod
- ring
->cons
, ring
->num_items
,
610 ring
->prod
, ring
->cons
);
612 qxl_send_events(d
, QXL_INTERRUPT_DISPLAY
);
614 SPICE_RING_PROD_ITEM(ring
, item
);
617 d
->last_release
= NULL
;
618 qxl_ring_set_dirty(d
);
621 /* called from spice server thread context only */
622 static void interface_release_resource(QXLInstance
*sin
,
623 struct QXLReleaseInfoExt ext
)
625 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
626 QXLReleaseRing
*ring
;
629 if (ext
.group_id
== MEMSLOT_GROUP_HOST
) {
630 /* host group -> vga mode update request */
631 qemu_spice_destroy_update(&qxl
->ssd
, (void*)ext
.info
->id
);
636 * ext->info points into guest-visible memory
637 * pci bar 0, $command.release_info
639 ring
= &qxl
->ram
->release_ring
;
640 SPICE_RING_PROD_ITEM(ring
, item
);
642 /* stick head into the ring */
645 qxl_ram_set_dirty(qxl
, &ext
.info
->next
);
647 qxl_ring_set_dirty(qxl
);
649 /* append item to the list */
650 qxl
->last_release
->next
= ext
.info
->id
;
651 qxl_ram_set_dirty(qxl
, &qxl
->last_release
->next
);
653 qxl_ram_set_dirty(qxl
, &ext
.info
->next
);
655 qxl
->last_release
= ext
.info
;
657 dprint(qxl
, 3, "%4d\r", qxl
->num_free_res
);
658 qxl_push_free_res(qxl
, 0);
661 /* called from spice server thread context only */
662 static int interface_get_cursor_command(QXLInstance
*sin
, struct QXLCommandExt
*ext
)
664 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
670 case QXL_MODE_COMPAT
:
671 case QXL_MODE_NATIVE
:
672 case QXL_MODE_UNDEFINED
:
673 ring
= &qxl
->ram
->cursor_ring
;
674 if (SPICE_RING_IS_EMPTY(ring
)) {
677 SPICE_RING_CONS_ITEM(ring
, cmd
);
679 ext
->group_id
= MEMSLOT_GROUP_GUEST
;
680 ext
->flags
= qxl
->cmdflags
;
681 SPICE_RING_POP(ring
, notify
);
682 qxl_ring_set_dirty(qxl
);
684 qxl_send_events(qxl
, QXL_INTERRUPT_CURSOR
);
686 qxl
->guest_primary
.commands
++;
687 qxl_track_command(qxl
, ext
);
688 qxl_log_command(qxl
, "csr", ext
);
690 qxl_render_cursor(qxl
, ext
);
698 /* called from spice server thread context only */
699 static int interface_req_cursor_notification(QXLInstance
*sin
)
701 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
705 case QXL_MODE_COMPAT
:
706 case QXL_MODE_NATIVE
:
707 case QXL_MODE_UNDEFINED
:
708 SPICE_RING_CONS_WAIT(&qxl
->ram
->cursor_ring
, wait
);
709 qxl_ring_set_dirty(qxl
);
718 /* called from spice server thread context */
719 static void interface_notify_update(QXLInstance
*sin
, uint32_t update_id
)
721 fprintf(stderr
, "%s: abort()\n", __FUNCTION__
);
725 /* called from spice server thread context only */
726 static int interface_flush_resources(QXLInstance
*sin
)
728 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
731 dprint(qxl
, 1, "free: guest flush (have %d)\n", qxl
->num_free_res
);
732 ret
= qxl
->num_free_res
;
734 qxl_push_free_res(qxl
, 1);
739 static void qxl_create_guest_primary_complete(PCIQXLDevice
*d
);
741 #if SPICE_INTERFACE_QXL_MINOR >= 1
743 /* called from spice server thread context only */
744 static void interface_async_complete(QXLInstance
*sin
, uint64_t cookie
)
746 PCIQXLDevice
*qxl
= container_of(sin
, PCIQXLDevice
, ssd
.qxl
);
747 uint32_t current_async
;
749 qemu_mutex_lock(&qxl
->async_lock
);
750 current_async
= qxl
->current_async
;
751 qxl
->current_async
= QXL_UNDEFINED_IO
;
752 qemu_mutex_unlock(&qxl
->async_lock
);
754 dprint(qxl
, 2, "async_complete: %d (%ld) done\n", current_async
, cookie
);
755 switch (current_async
) {
756 case QXL_IO_CREATE_PRIMARY_ASYNC
:
757 qxl_create_guest_primary_complete(qxl
);
759 case QXL_IO_DESTROY_ALL_SURFACES_ASYNC
:
760 qxl_spice_destroy_surfaces_complete(qxl
);
762 case QXL_IO_DESTROY_SURFACE_ASYNC
:
763 qxl_spice_destroy_surface_wait_complete(qxl
, (uint32_t)cookie
);
766 qxl_send_events(qxl
, QXL_INTERRUPT_IO_CMD
);
771 static const QXLInterface qxl_interface
= {
772 .base
.type
= SPICE_INTERFACE_QXL
,
773 .base
.description
= "qxl gpu",
774 .base
.major_version
= SPICE_INTERFACE_QXL_MAJOR
,
775 .base
.minor_version
= SPICE_INTERFACE_QXL_MINOR
,
777 .attache_worker
= interface_attach_worker
,
778 .set_compression_level
= interface_set_compression_level
,
779 .set_mm_time
= interface_set_mm_time
,
780 .get_init_info
= interface_get_init_info
,
782 /* the callbacks below are called from spice server thread context */
783 .get_command
= interface_get_command
,
784 .req_cmd_notification
= interface_req_cmd_notification
,
785 .release_resource
= interface_release_resource
,
786 .get_cursor_command
= interface_get_cursor_command
,
787 .req_cursor_notification
= interface_req_cursor_notification
,
788 .notify_update
= interface_notify_update
,
789 .flush_resources
= interface_flush_resources
,
790 #if SPICE_INTERFACE_QXL_MINOR >= 1
791 .async_complete
= interface_async_complete
,
795 static void qxl_enter_vga_mode(PCIQXLDevice
*d
)
797 if (d
->mode
== QXL_MODE_VGA
) {
800 dprint(d
, 1, "%s\n", __FUNCTION__
);
801 qemu_spice_create_host_primary(&d
->ssd
);
802 d
->mode
= QXL_MODE_VGA
;
803 memset(&d
->ssd
.dirty
, 0, sizeof(d
->ssd
.dirty
));
806 static void qxl_exit_vga_mode(PCIQXLDevice
*d
)
808 if (d
->mode
!= QXL_MODE_VGA
) {
811 dprint(d
, 1, "%s\n", __FUNCTION__
);
812 qxl_destroy_primary(d
, QXL_SYNC
);
815 static void qxl_update_irq(PCIQXLDevice
*d
)
817 uint32_t pending
= le32_to_cpu(d
->ram
->int_pending
);
818 uint32_t mask
= le32_to_cpu(d
->ram
->int_mask
);
819 int level
= !!(pending
& mask
);
820 qemu_set_irq(d
->pci
.irq
[0], level
);
821 qxl_ring_set_dirty(d
);
824 static void qxl_check_state(PCIQXLDevice
*d
)
826 QXLRam
*ram
= d
->ram
;
828 assert(!d
->ssd
.running
|| SPICE_RING_IS_EMPTY(&ram
->cmd_ring
));
829 assert(!d
->ssd
.running
|| SPICE_RING_IS_EMPTY(&ram
->cursor_ring
));
832 static void qxl_reset_state(PCIQXLDevice
*d
)
834 QXLRom
*rom
= d
->rom
;
837 d
->shadow_rom
.update_id
= cpu_to_le32(0);
838 *rom
= d
->shadow_rom
;
839 qxl_rom_set_dirty(d
);
842 d
->last_release
= NULL
;
843 memset(&d
->ssd
.dirty
, 0, sizeof(d
->ssd
.dirty
));
846 static void qxl_soft_reset(PCIQXLDevice
*d
)
848 dprint(d
, 1, "%s:\n", __FUNCTION__
);
852 qxl_enter_vga_mode(d
);
854 d
->mode
= QXL_MODE_UNDEFINED
;
858 static void qxl_hard_reset(PCIQXLDevice
*d
, int loadvm
)
860 dprint(d
, 1, "%s: start%s\n", __FUNCTION__
,
861 loadvm
? " (loadvm)" : "");
863 qxl_spice_reset_cursor(d
);
864 qxl_spice_reset_image_cache(d
);
865 qxl_reset_surfaces(d
);
866 qxl_reset_memslots(d
);
868 /* pre loadvm reset must not touch QXLRam. This lives in
869 * device memory, is migrated together with RAM and thus
870 * already loaded at this point */
874 qemu_spice_create_host_memslot(&d
->ssd
);
877 dprint(d
, 1, "%s: done\n", __FUNCTION__
);
880 static void qxl_reset_handler(DeviceState
*dev
)
882 PCIQXLDevice
*d
= DO_UPCAST(PCIQXLDevice
, pci
.qdev
, dev
);
883 qxl_hard_reset(d
, 0);
886 static void qxl_vga_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
888 VGACommonState
*vga
= opaque
;
889 PCIQXLDevice
*qxl
= container_of(vga
, PCIQXLDevice
, vga
);
891 if (qxl
->mode
!= QXL_MODE_VGA
) {
892 dprint(qxl
, 1, "%s\n", __FUNCTION__
);
893 qxl_destroy_primary(qxl
, QXL_SYNC
);
896 vga_ioport_write(opaque
, addr
, val
);
899 static void qxl_add_memslot(PCIQXLDevice
*d
, uint32_t slot_id
, uint64_t delta
,
902 static const int regions
[] = {
904 QXL_VRAM_RANGE_INDEX
,
906 uint64_t guest_start
;
912 QXLDevMemSlot memslot
;
915 guest_start
= le64_to_cpu(d
->guest_slots
[slot_id
].slot
.mem_start
);
916 guest_end
= le64_to_cpu(d
->guest_slots
[slot_id
].slot
.mem_end
);
918 dprint(d
, 1, "%s: slot %d: guest phys 0x%" PRIx64
" - 0x%" PRIx64
"\n",
919 __FUNCTION__
, slot_id
,
920 guest_start
, guest_end
);
922 PANIC_ON(slot_id
>= NUM_MEMSLOTS
);
923 PANIC_ON(guest_start
> guest_end
);
925 for (i
= 0; i
< ARRAY_SIZE(regions
); i
++) {
926 pci_region
= regions
[i
];
927 pci_start
= d
->pci
.io_regions
[pci_region
].addr
;
928 pci_end
= pci_start
+ d
->pci
.io_regions
[pci_region
].size
;
930 if (pci_start
== -1) {
933 /* start address in range ? */
934 if (guest_start
< pci_start
|| guest_start
> pci_end
) {
937 /* end address in range ? */
938 if (guest_end
> pci_end
) {
944 PANIC_ON(i
== ARRAY_SIZE(regions
)); /* finished loop without match */
946 switch (pci_region
) {
947 case QXL_RAM_RANGE_INDEX
:
948 virt_start
= (intptr_t)memory_region_get_ram_ptr(&d
->vga
.vram
);
950 case QXL_VRAM_RANGE_INDEX
:
951 virt_start
= (intptr_t)memory_region_get_ram_ptr(&d
->vram_bar
);
954 /* should not happen */
958 memslot
.slot_id
= slot_id
;
959 memslot
.slot_group_id
= MEMSLOT_GROUP_GUEST
; /* guest group */
960 memslot
.virt_start
= virt_start
+ (guest_start
- pci_start
);
961 memslot
.virt_end
= virt_start
+ (guest_end
- pci_start
);
962 memslot
.addr_delta
= memslot
.virt_start
- delta
;
963 memslot
.generation
= d
->rom
->slot_generation
= 0;
964 qxl_rom_set_dirty(d
);
966 dprint(d
, 1, "%s: slot %d: host virt 0x%lx - 0x%lx\n",
967 __FUNCTION__
, memslot
.slot_id
,
968 memslot
.virt_start
, memslot
.virt_end
);
970 qemu_spice_add_memslot(&d
->ssd
, &memslot
, async
);
971 d
->guest_slots
[slot_id
].ptr
= (void*)memslot
.virt_start
;
972 d
->guest_slots
[slot_id
].size
= memslot
.virt_end
- memslot
.virt_start
;
973 d
->guest_slots
[slot_id
].delta
= delta
;
974 d
->guest_slots
[slot_id
].active
= 1;
977 static void qxl_del_memslot(PCIQXLDevice
*d
, uint32_t slot_id
)
979 dprint(d
, 1, "%s: slot %d\n", __FUNCTION__
, slot_id
);
980 qemu_spice_del_memslot(&d
->ssd
, MEMSLOT_GROUP_HOST
, slot_id
);
981 d
->guest_slots
[slot_id
].active
= 0;
984 static void qxl_reset_memslots(PCIQXLDevice
*d
)
986 dprint(d
, 1, "%s:\n", __FUNCTION__
);
987 qxl_spice_reset_memslots(d
);
988 memset(&d
->guest_slots
, 0, sizeof(d
->guest_slots
));
991 static void qxl_reset_surfaces(PCIQXLDevice
*d
)
993 dprint(d
, 1, "%s:\n", __FUNCTION__
);
994 d
->mode
= QXL_MODE_UNDEFINED
;
995 qxl_spice_destroy_surfaces(d
, QXL_SYNC
);
998 /* called from spice server thread context only */
999 void *qxl_phys2virt(PCIQXLDevice
*qxl
, QXLPHYSICAL pqxl
, int group_id
)
1001 uint64_t phys
= le64_to_cpu(pqxl
);
1002 uint32_t slot
= (phys
>> (64 - 8)) & 0xff;
1003 uint64_t offset
= phys
& 0xffffffffffff;
1006 case MEMSLOT_GROUP_HOST
:
1007 return (void*)offset
;
1008 case MEMSLOT_GROUP_GUEST
:
1009 PANIC_ON(slot
> NUM_MEMSLOTS
);
1010 PANIC_ON(!qxl
->guest_slots
[slot
].active
);
1011 PANIC_ON(offset
< qxl
->guest_slots
[slot
].delta
);
1012 offset
-= qxl
->guest_slots
[slot
].delta
;
1013 PANIC_ON(offset
> qxl
->guest_slots
[slot
].size
)
1014 return qxl
->guest_slots
[slot
].ptr
+ offset
;
1020 static void qxl_create_guest_primary_complete(PCIQXLDevice
*qxl
)
1022 /* for local rendering */
1023 qxl_render_resize(qxl
);
1026 static void qxl_create_guest_primary(PCIQXLDevice
*qxl
, int loadvm
,
1029 QXLDevSurfaceCreate surface
;
1030 QXLSurfaceCreate
*sc
= &qxl
->guest_primary
.surface
;
1032 assert(qxl
->mode
!= QXL_MODE_NATIVE
);
1033 qxl_exit_vga_mode(qxl
);
1035 dprint(qxl
, 1, "%s: %dx%d\n", __FUNCTION__
,
1036 le32_to_cpu(sc
->width
), le32_to_cpu(sc
->height
));
1038 surface
.format
= le32_to_cpu(sc
->format
);
1039 surface
.height
= le32_to_cpu(sc
->height
);
1040 surface
.mem
= le64_to_cpu(sc
->mem
);
1041 surface
.position
= le32_to_cpu(sc
->position
);
1042 surface
.stride
= le32_to_cpu(sc
->stride
);
1043 surface
.width
= le32_to_cpu(sc
->width
);
1044 surface
.type
= le32_to_cpu(sc
->type
);
1045 surface
.flags
= le32_to_cpu(sc
->flags
);
1047 surface
.mouse_mode
= true;
1048 surface
.group_id
= MEMSLOT_GROUP_GUEST
;
1050 surface
.flags
|= QXL_SURF_FLAG_KEEP_DATA
;
1053 qxl
->mode
= QXL_MODE_NATIVE
;
1055 qemu_spice_create_primary_surface(&qxl
->ssd
, 0, &surface
, async
);
1057 if (async
== QXL_SYNC
) {
1058 qxl_create_guest_primary_complete(qxl
);
1062 /* return 1 if surface destoy was initiated (in QXL_ASYNC case) or
1063 * done (in QXL_SYNC case), 0 otherwise. */
1064 static int qxl_destroy_primary(PCIQXLDevice
*d
, qxl_async_io async
)
1066 if (d
->mode
== QXL_MODE_UNDEFINED
) {
1070 dprint(d
, 1, "%s\n", __FUNCTION__
);
1072 d
->mode
= QXL_MODE_UNDEFINED
;
1073 qemu_spice_destroy_primary_surface(&d
->ssd
, 0, async
);
1074 qxl_spice_reset_cursor(d
);
1078 static void qxl_set_mode(PCIQXLDevice
*d
, int modenr
, int loadvm
)
1080 pcibus_t start
= d
->pci
.io_regions
[QXL_RAM_RANGE_INDEX
].addr
;
1081 pcibus_t end
= d
->pci
.io_regions
[QXL_RAM_RANGE_INDEX
].size
+ start
;
1082 QXLMode
*mode
= d
->modes
->modes
+ modenr
;
1083 uint64_t devmem
= d
->pci
.io_regions
[QXL_RAM_RANGE_INDEX
].addr
;
1088 QXLSurfaceCreate surface
= {
1089 .width
= mode
->x_res
,
1090 .height
= mode
->y_res
,
1091 .stride
= -mode
->x_res
* 4,
1092 .format
= SPICE_SURFACE_FMT_32_xRGB
,
1093 .flags
= loadvm
? QXL_SURF_FLAG_KEEP_DATA
: 0,
1095 .mem
= devmem
+ d
->shadow_rom
.draw_area_offset
,
1098 dprint(d
, 1, "%s: mode %d [ %d x %d @ %d bpp devmem 0x%" PRIx64
" ]\n",
1099 __func__
, modenr
, mode
->x_res
, mode
->y_res
, mode
->bits
, devmem
);
1101 qxl_hard_reset(d
, 0);
1104 d
->guest_slots
[0].slot
= slot
;
1105 qxl_add_memslot(d
, 0, devmem
, QXL_SYNC
);
1107 d
->guest_primary
.surface
= surface
;
1108 qxl_create_guest_primary(d
, 0, QXL_SYNC
);
1110 d
->mode
= QXL_MODE_COMPAT
;
1111 d
->cmdflags
= QXL_COMMAND_FLAG_COMPAT
;
1112 #ifdef QXL_COMMAND_FLAG_COMPAT_16BPP /* new in spice 0.6.1 */
1113 if (mode
->bits
== 16) {
1114 d
->cmdflags
|= QXL_COMMAND_FLAG_COMPAT_16BPP
;
1117 d
->shadow_rom
.mode
= cpu_to_le32(modenr
);
1118 d
->rom
->mode
= cpu_to_le32(modenr
);
1119 qxl_rom_set_dirty(d
);
1122 static void ioport_write(void *opaque
, target_phys_addr_t addr
,
1123 uint64_t val
, unsigned size
)
1125 PCIQXLDevice
*d
= opaque
;
1126 uint32_t io_port
= addr
;
1127 qxl_async_io async
= QXL_SYNC
;
1128 #if SPICE_INTERFACE_QXL_MINOR >= 1
1129 uint32_t orig_io_port
= io_port
;
1134 case QXL_IO_SET_MODE
:
1135 case QXL_IO_MEMSLOT_ADD
:
1136 case QXL_IO_MEMSLOT_DEL
:
1137 case QXL_IO_CREATE_PRIMARY
:
1138 case QXL_IO_UPDATE_IRQ
:
1140 #if SPICE_INTERFACE_QXL_MINOR >= 1
1141 case QXL_IO_MEMSLOT_ADD_ASYNC
:
1142 case QXL_IO_CREATE_PRIMARY_ASYNC
:
1146 if (d
->mode
!= QXL_MODE_VGA
) {
1149 dprint(d
, 1, "%s: unexpected port 0x%x (%s) in vga mode\n",
1150 __func__
, io_port
, io_port_to_string(io_port
));
1151 #if SPICE_INTERFACE_QXL_MINOR >= 1
1152 /* be nice to buggy guest drivers */
1153 if (io_port
>= QXL_IO_UPDATE_AREA_ASYNC
&&
1154 io_port
<= QXL_IO_DESTROY_ALL_SURFACES_ASYNC
) {
1155 qxl_send_events(d
, QXL_INTERRUPT_IO_CMD
);
1161 #if SPICE_INTERFACE_QXL_MINOR >= 1
1162 /* we change the io_port to avoid ifdeffery in the main switch */
1163 orig_io_port
= io_port
;
1165 case QXL_IO_UPDATE_AREA_ASYNC
:
1166 io_port
= QXL_IO_UPDATE_AREA
;
1168 case QXL_IO_MEMSLOT_ADD_ASYNC
:
1169 io_port
= QXL_IO_MEMSLOT_ADD
;
1171 case QXL_IO_CREATE_PRIMARY_ASYNC
:
1172 io_port
= QXL_IO_CREATE_PRIMARY
;
1174 case QXL_IO_DESTROY_PRIMARY_ASYNC
:
1175 io_port
= QXL_IO_DESTROY_PRIMARY
;
1177 case QXL_IO_DESTROY_SURFACE_ASYNC
:
1178 io_port
= QXL_IO_DESTROY_SURFACE_WAIT
;
1180 case QXL_IO_DESTROY_ALL_SURFACES_ASYNC
:
1181 io_port
= QXL_IO_DESTROY_ALL_SURFACES
;
1183 case QXL_IO_FLUSH_SURFACES_ASYNC
:
1186 qemu_mutex_lock(&d
->async_lock
);
1187 if (d
->current_async
!= QXL_UNDEFINED_IO
) {
1188 qxl_guest_bug(d
, "%d async started before last (%d) complete",
1189 io_port
, d
->current_async
);
1190 qemu_mutex_unlock(&d
->async_lock
);
1193 d
->current_async
= orig_io_port
;
1194 qemu_mutex_unlock(&d
->async_lock
);
1195 dprint(d
, 2, "start async %d (%"PRId64
")\n", io_port
, val
);
1203 case QXL_IO_UPDATE_AREA
:
1205 QXLRect update
= d
->ram
->update_area
;
1206 qxl_spice_update_area(d
, d
->ram
->update_surface
,
1207 &update
, NULL
, 0, 0, async
);
1210 case QXL_IO_NOTIFY_CMD
:
1211 qemu_spice_wakeup(&d
->ssd
);
1213 case QXL_IO_NOTIFY_CURSOR
:
1214 qemu_spice_wakeup(&d
->ssd
);
1216 case QXL_IO_UPDATE_IRQ
:
1219 case QXL_IO_NOTIFY_OOM
:
1220 if (!SPICE_RING_IS_EMPTY(&d
->ram
->release_ring
)) {
1227 case QXL_IO_SET_MODE
:
1228 dprint(d
, 1, "QXL_SET_MODE %d\n", (int)val
);
1229 qxl_set_mode(d
, val
, 0);
1232 if (d
->guestdebug
) {
1233 fprintf(stderr
, "qxl/guest-%d: %" PRId64
": %s", d
->id
,
1234 qemu_get_clock_ns(vm_clock
), d
->ram
->log_buf
);
1238 dprint(d
, 1, "QXL_IO_RESET\n");
1239 qxl_hard_reset(d
, 0);
1241 case QXL_IO_MEMSLOT_ADD
:
1242 if (val
>= NUM_MEMSLOTS
) {
1243 qxl_guest_bug(d
, "QXL_IO_MEMSLOT_ADD: val out of range");
1246 if (d
->guest_slots
[val
].active
) {
1247 qxl_guest_bug(d
, "QXL_IO_MEMSLOT_ADD: memory slot already active");
1250 d
->guest_slots
[val
].slot
= d
->ram
->mem_slot
;
1251 qxl_add_memslot(d
, val
, 0, async
);
1253 case QXL_IO_MEMSLOT_DEL
:
1254 if (val
>= NUM_MEMSLOTS
) {
1255 qxl_guest_bug(d
, "QXL_IO_MEMSLOT_DEL: val out of range");
1258 qxl_del_memslot(d
, val
);
1260 case QXL_IO_CREATE_PRIMARY
:
1262 qxl_guest_bug(d
, "QXL_IO_CREATE_PRIMARY (async=%d): val != 0",
1266 dprint(d
, 1, "QXL_IO_CREATE_PRIMARY async=%d\n", async
);
1267 d
->guest_primary
.surface
= d
->ram
->create_surface
;
1268 qxl_create_guest_primary(d
, 0, async
);
1270 case QXL_IO_DESTROY_PRIMARY
:
1272 qxl_guest_bug(d
, "QXL_IO_DESTROY_PRIMARY (async=%d): val != 0",
1276 dprint(d
, 1, "QXL_IO_DESTROY_PRIMARY (async=%d) (%s)\n", async
,
1277 qxl_mode_to_string(d
->mode
));
1278 if (!qxl_destroy_primary(d
, async
)) {
1279 dprint(d
, 1, "QXL_IO_DESTROY_PRIMARY_ASYNC in %s, ignored\n",
1280 qxl_mode_to_string(d
->mode
));
1284 case QXL_IO_DESTROY_SURFACE_WAIT
:
1285 if (val
>= NUM_SURFACES
) {
1286 qxl_guest_bug(d
, "QXL_IO_DESTROY_SURFACE (async=%d):"
1287 "%d >= NUM_SURFACES", async
, val
);
1290 qxl_spice_destroy_surface_wait(d
, val
, async
);
1292 #if SPICE_INTERFACE_QXL_MINOR >= 1
1293 case QXL_IO_FLUSH_RELEASE
: {
1294 QXLReleaseRing
*ring
= &d
->ram
->release_ring
;
1295 if (ring
->prod
- ring
->cons
+ 1 == ring
->num_items
) {
1297 "ERROR: no flush, full release ring [p%d,%dc]\n",
1298 ring
->prod
, ring
->cons
);
1300 qxl_push_free_res(d
, 1 /* flush */);
1301 dprint(d
, 1, "QXL_IO_FLUSH_RELEASE exit (%s, s#=%d, res#=%d,%p)\n",
1302 qxl_mode_to_string(d
->mode
), d
->guest_surfaces
.count
,
1303 d
->num_free_res
, d
->last_release
);
1306 case QXL_IO_FLUSH_SURFACES_ASYNC
:
1307 dprint(d
, 1, "QXL_IO_FLUSH_SURFACES_ASYNC"
1308 " (%"PRId64
") (%s, s#=%d, res#=%d)\n",
1309 val
, qxl_mode_to_string(d
->mode
), d
->guest_surfaces
.count
,
1311 qxl_spice_flush_surfaces_async(d
);
1314 case QXL_IO_DESTROY_ALL_SURFACES
:
1315 d
->mode
= QXL_MODE_UNDEFINED
;
1316 qxl_spice_destroy_surfaces(d
, async
);
1319 fprintf(stderr
, "%s: ioport=0x%x, abort()\n", __FUNCTION__
, io_port
);
1324 #if SPICE_INTERFACE_QXL_MINOR >= 1
1326 qxl_send_events(d
, QXL_INTERRUPT_IO_CMD
);
1327 qemu_mutex_lock(&d
->async_lock
);
1328 d
->current_async
= QXL_UNDEFINED_IO
;
1329 qemu_mutex_unlock(&d
->async_lock
);
1336 static uint64_t ioport_read(void *opaque
, target_phys_addr_t addr
,
1339 PCIQXLDevice
*d
= opaque
;
1341 dprint(d
, 1, "%s: unexpected\n", __FUNCTION__
);
1345 static const MemoryRegionOps qxl_io_ops
= {
1346 .read
= ioport_read
,
1347 .write
= ioport_write
,
1349 .min_access_size
= 1,
1350 .max_access_size
= 1,
1354 static void pipe_read(void *opaque
)
1356 PCIQXLDevice
*d
= opaque
;
1361 len
= read(d
->pipe
[0], &dummy
, sizeof(dummy
));
1362 } while (len
== sizeof(dummy
));
1366 static void qxl_send_events(PCIQXLDevice
*d
, uint32_t events
)
1368 uint32_t old_pending
;
1369 uint32_t le_events
= cpu_to_le32(events
);
1371 assert(d
->ssd
.running
);
1372 old_pending
= __sync_fetch_and_or(&d
->ram
->int_pending
, le_events
);
1373 if ((old_pending
& le_events
) == le_events
) {
1376 if (qemu_thread_is_self(&d
->main
)) {
1379 if (write(d
->pipe
[1], d
, 1) != 1) {
1380 dprint(d
, 1, "%s: write to pipe failed\n", __FUNCTION__
);
1385 static void init_pipe_signaling(PCIQXLDevice
*d
)
1387 if (pipe(d
->pipe
) < 0) {
1388 dprint(d
, 1, "%s: pipe creation failed\n", __FUNCTION__
);
1391 fcntl(d
->pipe
[0], F_SETFL
, O_NONBLOCK
);
1392 fcntl(d
->pipe
[1], F_SETFL
, O_NONBLOCK
);
1393 fcntl(d
->pipe
[0], F_SETOWN
, getpid());
1395 qemu_thread_get_self(&d
->main
);
1396 qemu_set_fd_handler(d
->pipe
[0], pipe_read
, NULL
, d
);
1399 /* graphics console */
1401 static void qxl_hw_update(void *opaque
)
1403 PCIQXLDevice
*qxl
= opaque
;
1404 VGACommonState
*vga
= &qxl
->vga
;
1406 switch (qxl
->mode
) {
1410 case QXL_MODE_COMPAT
:
1411 case QXL_MODE_NATIVE
:
1412 qxl_render_update(qxl
);
1419 static void qxl_hw_invalidate(void *opaque
)
1421 PCIQXLDevice
*qxl
= opaque
;
1422 VGACommonState
*vga
= &qxl
->vga
;
1424 vga
->invalidate(vga
);
1427 static void qxl_hw_screen_dump(void *opaque
, const char *filename
)
1429 PCIQXLDevice
*qxl
= opaque
;
1430 VGACommonState
*vga
= &qxl
->vga
;
1432 switch (qxl
->mode
) {
1433 case QXL_MODE_COMPAT
:
1434 case QXL_MODE_NATIVE
:
1435 qxl_render_update(qxl
);
1436 ppm_save(filename
, qxl
->ssd
.ds
->surface
);
1439 vga
->screen_dump(vga
, filename
);
1446 static void qxl_hw_text_update(void *opaque
, console_ch_t
*chardata
)
1448 PCIQXLDevice
*qxl
= opaque
;
1449 VGACommonState
*vga
= &qxl
->vga
;
1451 if (qxl
->mode
== QXL_MODE_VGA
) {
1452 vga
->text_update(vga
, chardata
);
1457 static void qxl_vm_change_state_handler(void *opaque
, int running
,
1460 PCIQXLDevice
*qxl
= opaque
;
1461 qemu_spice_vm_change_state_handler(&qxl
->ssd
, running
, state
);
1465 * if qxl_send_events was called from spice server context before
1466 * migration ended, qxl_update_irq for these events might not have been
1469 qxl_update_irq(qxl
);
1470 } else if (qxl
->mode
== QXL_MODE_NATIVE
) {
1471 /* dirty all vram (which holds surfaces) and devram (primary surface)
1472 * to make sure they are saved */
1473 /* FIXME #1: should go out during "live" stage */
1474 /* FIXME #2: we only need to save the areas which are actually used */
1475 qxl_set_dirty(&qxl
->vram_bar
, 0, qxl
->vram_size
);
1476 qxl_set_dirty(&qxl
->vga
.vram
, qxl
->shadow_rom
.draw_area_offset
,
1477 qxl
->shadow_rom
.surface0_area_size
);
1481 /* display change listener */
1483 static void display_update(struct DisplayState
*ds
, int x
, int y
, int w
, int h
)
1485 if (qxl0
->mode
== QXL_MODE_VGA
) {
1486 qemu_spice_display_update(&qxl0
->ssd
, x
, y
, w
, h
);
1490 static void display_resize(struct DisplayState
*ds
)
1492 if (qxl0
->mode
== QXL_MODE_VGA
) {
1493 qemu_spice_display_resize(&qxl0
->ssd
);
1497 static void display_refresh(struct DisplayState
*ds
)
1499 if (qxl0
->mode
== QXL_MODE_VGA
) {
1500 qemu_spice_display_refresh(&qxl0
->ssd
);
1504 static DisplayChangeListener display_listener
= {
1505 .dpy_update
= display_update
,
1506 .dpy_resize
= display_resize
,
1507 .dpy_refresh
= display_refresh
,
1510 static int qxl_init_common(PCIQXLDevice
*qxl
)
1512 uint8_t* config
= qxl
->pci
.config
;
1513 uint32_t pci_device_rev
;
1516 qxl
->mode
= QXL_MODE_UNDEFINED
;
1517 qxl
->generation
= 1;
1518 qxl
->num_memslots
= NUM_MEMSLOTS
;
1519 qxl
->num_surfaces
= NUM_SURFACES
;
1520 qemu_mutex_init(&qxl
->track_lock
);
1521 qemu_mutex_init(&qxl
->async_lock
);
1522 qxl
->current_async
= QXL_UNDEFINED_IO
;
1524 switch (qxl
->revision
) {
1525 case 1: /* spice 0.4 -- qxl-1 */
1526 pci_device_rev
= QXL_REVISION_STABLE_V04
;
1528 case 2: /* spice 0.6 -- qxl-2 */
1529 pci_device_rev
= QXL_REVISION_STABLE_V06
;
1531 #if SPICE_INTERFACE_QXL_MINOR >= 1
1535 pci_device_rev
= QXL_DEFAULT_REVISION
;
1539 pci_set_byte(&config
[PCI_REVISION_ID
], pci_device_rev
);
1540 pci_set_byte(&config
[PCI_INTERRUPT_PIN
], 1);
1542 qxl
->rom_size
= qxl_rom_size();
1543 memory_region_init_ram(&qxl
->rom_bar
, &qxl
->pci
.qdev
, "qxl.vrom",
1548 if (qxl
->vram_size
< 16 * 1024 * 1024) {
1549 qxl
->vram_size
= 16 * 1024 * 1024;
1551 if (qxl
->revision
== 1) {
1552 qxl
->vram_size
= 4096;
1554 qxl
->vram_size
= msb_mask(qxl
->vram_size
* 2 - 1);
1555 memory_region_init_ram(&qxl
->vram_bar
, &qxl
->pci
.qdev
, "qxl.vram",
1558 io_size
= msb_mask(QXL_IO_RANGE_SIZE
* 2 - 1);
1559 if (qxl
->revision
== 1) {
1563 memory_region_init_io(&qxl
->io_bar
, &qxl_io_ops
, qxl
,
1564 "qxl-ioports", io_size
);
1566 vga_dirty_log_start(&qxl
->vga
);
1570 pci_register_bar(&qxl
->pci
, QXL_IO_RANGE_INDEX
,
1571 PCI_BASE_ADDRESS_SPACE_IO
, &qxl
->io_bar
);
1573 pci_register_bar(&qxl
->pci
, QXL_ROM_RANGE_INDEX
,
1574 PCI_BASE_ADDRESS_SPACE_MEMORY
, &qxl
->rom_bar
);
1576 pci_register_bar(&qxl
->pci
, QXL_RAM_RANGE_INDEX
,
1577 PCI_BASE_ADDRESS_SPACE_MEMORY
, &qxl
->vga
.vram
);
1579 pci_register_bar(&qxl
->pci
, QXL_VRAM_RANGE_INDEX
,
1580 PCI_BASE_ADDRESS_SPACE_MEMORY
, &qxl
->vram_bar
);
1582 qxl
->ssd
.qxl
.base
.sif
= &qxl_interface
.base
;
1583 qxl
->ssd
.qxl
.id
= qxl
->id
;
1584 qemu_spice_add_interface(&qxl
->ssd
.qxl
.base
);
1585 qemu_add_vm_change_state_handler(qxl_vm_change_state_handler
, qxl
);
1587 init_pipe_signaling(qxl
);
1588 qxl_reset_state(qxl
);
1593 static int qxl_init_primary(PCIDevice
*dev
)
1595 PCIQXLDevice
*qxl
= DO_UPCAST(PCIQXLDevice
, pci
, dev
);
1596 VGACommonState
*vga
= &qxl
->vga
;
1597 ram_addr_t ram_size
= msb_mask(qxl
->vga
.vram_size
* 2 - 1);
1601 if (ram_size
< 32 * 1024 * 1024) {
1602 ram_size
= 32 * 1024 * 1024;
1604 vga_common_init(vga
, ram_size
);
1605 vga_init(vga
, pci_address_space(dev
), pci_address_space_io(dev
), false);
1606 register_ioport_write(0x3c0, 16, 1, qxl_vga_ioport_write
, vga
);
1607 register_ioport_write(0x3b4, 2, 1, qxl_vga_ioport_write
, vga
);
1608 register_ioport_write(0x3d4, 2, 1, qxl_vga_ioport_write
, vga
);
1609 register_ioport_write(0x3ba, 1, 1, qxl_vga_ioport_write
, vga
);
1610 register_ioport_write(0x3da, 1, 1, qxl_vga_ioport_write
, vga
);
1612 vga
->ds
= graphic_console_init(qxl_hw_update
, qxl_hw_invalidate
,
1613 qxl_hw_screen_dump
, qxl_hw_text_update
, qxl
);
1614 qemu_spice_display_init_common(&qxl
->ssd
, vga
->ds
);
1617 register_displaychangelistener(vga
->ds
, &display_listener
);
1619 return qxl_init_common(qxl
);
1622 static int qxl_init_secondary(PCIDevice
*dev
)
1624 static int device_id
= 1;
1625 PCIQXLDevice
*qxl
= DO_UPCAST(PCIQXLDevice
, pci
, dev
);
1626 ram_addr_t ram_size
= msb_mask(qxl
->vga
.vram_size
* 2 - 1);
1628 qxl
->id
= device_id
++;
1630 if (ram_size
< 16 * 1024 * 1024) {
1631 ram_size
= 16 * 1024 * 1024;
1633 qxl
->vga
.vram_size
= ram_size
;
1634 memory_region_init_ram(&qxl
->vga
.vram
, &qxl
->pci
.qdev
, "qxl.vgavram",
1635 qxl
->vga
.vram_size
);
1636 qxl
->vga
.vram_ptr
= memory_region_get_ram_ptr(&qxl
->vga
.vram
);
1638 return qxl_init_common(qxl
);
1641 static void qxl_pre_save(void *opaque
)
1643 PCIQXLDevice
* d
= opaque
;
1644 uint8_t *ram_start
= d
->vga
.vram_ptr
;
1646 dprint(d
, 1, "%s:\n", __FUNCTION__
);
1647 if (d
->last_release
== NULL
) {
1648 d
->last_release_offset
= 0;
1650 d
->last_release_offset
= (uint8_t *)d
->last_release
- ram_start
;
1652 assert(d
->last_release_offset
< d
->vga
.vram_size
);
1655 static int qxl_pre_load(void *opaque
)
1657 PCIQXLDevice
* d
= opaque
;
1659 dprint(d
, 1, "%s: start\n", __FUNCTION__
);
1660 qxl_hard_reset(d
, 1);
1661 qxl_exit_vga_mode(d
);
1662 dprint(d
, 1, "%s: done\n", __FUNCTION__
);
1666 static int qxl_post_load(void *opaque
, int version
)
1668 PCIQXLDevice
* d
= opaque
;
1669 uint8_t *ram_start
= d
->vga
.vram_ptr
;
1670 QXLCommandExt
*cmds
;
1671 int in
, out
, i
, newmode
;
1673 dprint(d
, 1, "%s: start\n", __FUNCTION__
);
1675 assert(d
->last_release_offset
< d
->vga
.vram_size
);
1676 if (d
->last_release_offset
== 0) {
1677 d
->last_release
= NULL
;
1679 d
->last_release
= (QXLReleaseInfo
*)(ram_start
+ d
->last_release_offset
);
1682 d
->modes
= (QXLModes
*)((uint8_t*)d
->rom
+ d
->rom
->modes_offset
);
1684 dprint(d
, 1, "%s: restore mode (%s)\n", __FUNCTION__
,
1685 qxl_mode_to_string(d
->mode
));
1687 d
->mode
= QXL_MODE_UNDEFINED
;
1689 case QXL_MODE_UNDEFINED
:
1692 qxl_enter_vga_mode(d
);
1694 case QXL_MODE_NATIVE
:
1695 for (i
= 0; i
< NUM_MEMSLOTS
; i
++) {
1696 if (!d
->guest_slots
[i
].active
) {
1699 qxl_add_memslot(d
, i
, 0, QXL_SYNC
);
1701 qxl_create_guest_primary(d
, 1, QXL_SYNC
);
1703 /* replay surface-create and cursor-set commands */
1704 cmds
= g_malloc0(sizeof(QXLCommandExt
) * (NUM_SURFACES
+ 1));
1705 for (in
= 0, out
= 0; in
< NUM_SURFACES
; in
++) {
1706 if (d
->guest_surfaces
.cmds
[in
] == 0) {
1709 cmds
[out
].cmd
.data
= d
->guest_surfaces
.cmds
[in
];
1710 cmds
[out
].cmd
.type
= QXL_CMD_SURFACE
;
1711 cmds
[out
].group_id
= MEMSLOT_GROUP_GUEST
;
1714 if (d
->guest_cursor
) {
1715 cmds
[out
].cmd
.data
= d
->guest_cursor
;
1716 cmds
[out
].cmd
.type
= QXL_CMD_CURSOR
;
1717 cmds
[out
].group_id
= MEMSLOT_GROUP_GUEST
;
1720 qxl_spice_loadvm_commands(d
, cmds
, out
);
1724 case QXL_MODE_COMPAT
:
1725 qxl_set_mode(d
, d
->shadow_rom
.mode
, 1);
1728 dprint(d
, 1, "%s: done\n", __FUNCTION__
);
1733 #define QXL_SAVE_VERSION 21
1735 static VMStateDescription qxl_memslot
= {
1736 .name
= "qxl-memslot",
1737 .version_id
= QXL_SAVE_VERSION
,
1738 .minimum_version_id
= QXL_SAVE_VERSION
,
1739 .fields
= (VMStateField
[]) {
1740 VMSTATE_UINT64(slot
.mem_start
, struct guest_slots
),
1741 VMSTATE_UINT64(slot
.mem_end
, struct guest_slots
),
1742 VMSTATE_UINT32(active
, struct guest_slots
),
1743 VMSTATE_END_OF_LIST()
1747 static VMStateDescription qxl_surface
= {
1748 .name
= "qxl-surface",
1749 .version_id
= QXL_SAVE_VERSION
,
1750 .minimum_version_id
= QXL_SAVE_VERSION
,
1751 .fields
= (VMStateField
[]) {
1752 VMSTATE_UINT32(width
, QXLSurfaceCreate
),
1753 VMSTATE_UINT32(height
, QXLSurfaceCreate
),
1754 VMSTATE_INT32(stride
, QXLSurfaceCreate
),
1755 VMSTATE_UINT32(format
, QXLSurfaceCreate
),
1756 VMSTATE_UINT32(position
, QXLSurfaceCreate
),
1757 VMSTATE_UINT32(mouse_mode
, QXLSurfaceCreate
),
1758 VMSTATE_UINT32(flags
, QXLSurfaceCreate
),
1759 VMSTATE_UINT32(type
, QXLSurfaceCreate
),
1760 VMSTATE_UINT64(mem
, QXLSurfaceCreate
),
1761 VMSTATE_END_OF_LIST()
1765 static VMStateDescription qxl_vmstate
= {
1767 .version_id
= QXL_SAVE_VERSION
,
1768 .minimum_version_id
= QXL_SAVE_VERSION
,
1769 .pre_save
= qxl_pre_save
,
1770 .pre_load
= qxl_pre_load
,
1771 .post_load
= qxl_post_load
,
1772 .fields
= (VMStateField
[]) {
1773 VMSTATE_PCI_DEVICE(pci
, PCIQXLDevice
),
1774 VMSTATE_STRUCT(vga
, PCIQXLDevice
, 0, vmstate_vga_common
, VGACommonState
),
1775 VMSTATE_UINT32(shadow_rom
.mode
, PCIQXLDevice
),
1776 VMSTATE_UINT32(num_free_res
, PCIQXLDevice
),
1777 VMSTATE_UINT32(last_release_offset
, PCIQXLDevice
),
1778 VMSTATE_UINT32(mode
, PCIQXLDevice
),
1779 VMSTATE_UINT32(ssd
.unique
, PCIQXLDevice
),
1780 VMSTATE_INT32_EQUAL(num_memslots
, PCIQXLDevice
),
1781 VMSTATE_STRUCT_ARRAY(guest_slots
, PCIQXLDevice
, NUM_MEMSLOTS
, 0,
1782 qxl_memslot
, struct guest_slots
),
1783 VMSTATE_STRUCT(guest_primary
.surface
, PCIQXLDevice
, 0,
1784 qxl_surface
, QXLSurfaceCreate
),
1785 VMSTATE_INT32_EQUAL(num_surfaces
, PCIQXLDevice
),
1786 VMSTATE_ARRAY(guest_surfaces
.cmds
, PCIQXLDevice
, NUM_SURFACES
, 0,
1787 vmstate_info_uint64
, uint64_t),
1788 VMSTATE_UINT64(guest_cursor
, PCIQXLDevice
),
1789 VMSTATE_END_OF_LIST()
1793 static Property qxl_properties
[] = {
1794 DEFINE_PROP_UINT32("ram_size", PCIQXLDevice
, vga
.vram_size
,
1796 DEFINE_PROP_UINT32("vram_size", PCIQXLDevice
, vram_size
,
1798 DEFINE_PROP_UINT32("revision", PCIQXLDevice
, revision
,
1799 QXL_DEFAULT_REVISION
),
1800 DEFINE_PROP_UINT32("debug", PCIQXLDevice
, debug
, 0),
1801 DEFINE_PROP_UINT32("guestdebug", PCIQXLDevice
, guestdebug
, 0),
1802 DEFINE_PROP_UINT32("cmdlog", PCIQXLDevice
, cmdlog
, 0),
1803 DEFINE_PROP_END_OF_LIST(),
1806 static PCIDeviceInfo qxl_info_primary
= {
1807 .qdev
.name
= "qxl-vga",
1808 .qdev
.desc
= "Spice QXL GPU (primary, vga compatible)",
1809 .qdev
.size
= sizeof(PCIQXLDevice
),
1810 .qdev
.reset
= qxl_reset_handler
,
1811 .qdev
.vmsd
= &qxl_vmstate
,
1813 .init
= qxl_init_primary
,
1814 .romfile
= "vgabios-qxl.bin",
1815 .vendor_id
= REDHAT_PCI_VENDOR_ID
,
1816 .device_id
= QXL_DEVICE_ID_STABLE
,
1817 .class_id
= PCI_CLASS_DISPLAY_VGA
,
1818 .qdev
.props
= qxl_properties
,
1821 static PCIDeviceInfo qxl_info_secondary
= {
1823 .qdev
.desc
= "Spice QXL GPU (secondary)",
1824 .qdev
.size
= sizeof(PCIQXLDevice
),
1825 .qdev
.reset
= qxl_reset_handler
,
1826 .qdev
.vmsd
= &qxl_vmstate
,
1827 .init
= qxl_init_secondary
,
1828 .vendor_id
= REDHAT_PCI_VENDOR_ID
,
1829 .device_id
= QXL_DEVICE_ID_STABLE
,
1830 .class_id
= PCI_CLASS_DISPLAY_OTHER
,
1831 .qdev
.props
= qxl_properties
,
1834 static void qxl_register(void)
1836 pci_qdev_register(&qxl_info_primary
);
1837 pci_qdev_register(&qxl_info_secondary
);
1840 device_init(qxl_register
);