]> Git Repo - qemu.git/blame - hw/qxl.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
usb-redir: Get rid of local shadow copy of packet headers
[qemu.git] / hw / qxl.c
CommitLineData
a19cbfb3
GH		 1/*
2 * Copyright (C) 2010 Red Hat, Inc.
3 *
4 * written by Yaniv Kamay, Izik Eidus, Gerd Hoffmann
5 * maintained by Gerd Hoffmann <[email protected]>
6 *
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
a19cbfb3
GH		 21#include "qemu-common.h"
22#include "qemu-timer.h"
23#include "qemu-queue.h"
24#include "monitor.h"
25#include "sysemu.h"
c480bb7d 26#include "trace.h"
a19cbfb3
GH		 27
28#include "qxl.h"
29
020af1c4
AL		 30#ifndef CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC
31/* spice-protocol is too old, add missing definitions */
32#define QXL_IO_MONITORS_CONFIG_ASYNC (QXL_IO_FLUSH_RELEASE + 1)
33#endif
34
0b81c478
AL		 35/*
36 * NOTE: SPICE_RING_PROD_ITEM accesses memory on the pci bar and as
37 * such can be changed by the guest, so to avoid a guest trigerrable
0a530548 38 * abort we just qxl_set_guest_bug and set the return to NULL. Still
0b81c478
AL		 39 * it may happen as a result of emulator bug as well.
40 */
a19cbfb3 41#undef SPICE_RING_PROD_ITEM
0b81c478 42#define SPICE_RING_PROD_ITEM(qxl, r, ret) { \
a19cbfb3
GH		 43 typeof(r) start = r; \
44 typeof(r) end = r + 1; \
45 uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r); \
46 typeof(&(r)->items[prod]) m_item = &(r)->items[prod]; \
47 if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
0a530548 48 qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch " \
0b81c478
AL		 49 "! %p <= %p < %p", (uint8_t *)start, \
50 (uint8_t *)m_item, (uint8_t *)end); \
51 ret = NULL; \
52 } else { \
53 ret = &m_item->el; \
a19cbfb3 54 } \
a19cbfb3
GH		 55 }
56
57#undef SPICE_RING_CONS_ITEM
0b81c478 58#define SPICE_RING_CONS_ITEM(qxl, r, ret) { \
a19cbfb3
GH		 59 typeof(r) start = r; \
60 typeof(r) end = r + 1; \
61 uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r); \
62 typeof(&(r)->items[cons]) m_item = &(r)->items[cons]; \
63 if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
0a530548 64 qxl_set_guest_bug(qxl, "SPICE_RING_CONS_ITEM indices mismatch " \
0b81c478
AL		 65 "! %p <= %p < %p", (uint8_t *)start, \
66 (uint8_t *)m_item, (uint8_t *)end); \
67 ret = NULL; \
68 } else { \
69 ret = &m_item->el; \
a19cbfb3 70 } \
a19cbfb3
GH		 71 }
72
73#undef ALIGN
74#define ALIGN(a, b) (((a) + ((b) - 1)) & ~((b) - 1))
75
76#define PIXEL_SIZE 0.2936875 //1280x1024 is 14.8" x 11.9"
77
78#define QXL_MODE(_x, _y, _b, _o) \
79 { .x_res = _x, \
80 .y_res = _y, \
81 .bits = _b, \
82 .stride = (_x) * (_b) / 8, \
83 .x_mili = PIXEL_SIZE * (_x), \
84 .y_mili = PIXEL_SIZE * (_y), \
85 .orientation = _o, \
86 }
87
88#define QXL_MODE_16_32(x_res, y_res, orientation) \
89 QXL_MODE(x_res, y_res, 16, orientation), \
90 QXL_MODE(x_res, y_res, 32, orientation)
91
92#define QXL_MODE_EX(x_res, y_res) \
93 QXL_MODE_16_32(x_res, y_res, 0), \
94 QXL_MODE_16_32(y_res, x_res, 1), \
95 QXL_MODE_16_32(x_res, y_res, 2), \
96 QXL_MODE_16_32(y_res, x_res, 3)
97
98static QXLMode qxl_modes[] = {
99 QXL_MODE_EX(640, 480),
100 QXL_MODE_EX(800, 480),
101 QXL_MODE_EX(800, 600),
102 QXL_MODE_EX(832, 624),
103 QXL_MODE_EX(960, 640),
104 QXL_MODE_EX(1024, 600),
105 QXL_MODE_EX(1024, 768),
106 QXL_MODE_EX(1152, 864),
107 QXL_MODE_EX(1152, 870),
108 QXL_MODE_EX(1280, 720),
109 QXL_MODE_EX(1280, 760),
110 QXL_MODE_EX(1280, 768),
111 QXL_MODE_EX(1280, 800),
112 QXL_MODE_EX(1280, 960),
113 QXL_MODE_EX(1280, 1024),
114 QXL_MODE_EX(1360, 768),
115 QXL_MODE_EX(1366, 768),
116 QXL_MODE_EX(1400, 1050),
117 QXL_MODE_EX(1440, 900),
118 QXL_MODE_EX(1600, 900),
119 QXL_MODE_EX(1600, 1200),
120 QXL_MODE_EX(1680, 1050),
121 QXL_MODE_EX(1920, 1080),
a19cbfb3
GH		 122 /* these modes need more than 8 MB video memory */
123 QXL_MODE_EX(1920, 1200),
124 QXL_MODE_EX(1920, 1440),
125 QXL_MODE_EX(2048, 1536),
126 QXL_MODE_EX(2560, 1440),
127 QXL_MODE_EX(2560, 1600),
a19cbfb3
GH		 128 /* these modes need more than 16 MB video memory */
129 QXL_MODE_EX(2560, 2048),
130 QXL_MODE_EX(2800, 2100),
131 QXL_MODE_EX(3200, 2400),
a19cbfb3
GH		 132};
133
134static PCIQXLDevice *qxl0;
135
136static void qxl_send_events(PCIQXLDevice *d, uint32_t events);
5ff4e36c 137static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async);
a19cbfb3
GH		 138static void qxl_reset_memslots(PCIQXLDevice *d);
139static void qxl_reset_surfaces(PCIQXLDevice *d);
140static void qxl_ring_set_dirty(PCIQXLDevice *qxl);
141
0a530548 142void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...)
2bce0400 143{
2bce0400 144 qxl_send_events(qxl, QXL_INTERRUPT_ERROR);
087e6a42 145 qxl->guest_bug = 1;
2bce0400 146 if (qxl->guestdebug) {
7635392c
AL		 147 va_list ap;
148 va_start(ap, msg);
149 fprintf(stderr, "qxl-%d: guest bug: ", qxl->id);
150 vfprintf(stderr, msg, ap);
151 fprintf(stderr, "\n");
152 va_end(ap);
2bce0400
GH		 153 }
154}
155
087e6a42
AL		 156static void qxl_clear_guest_bug(PCIQXLDevice *qxl)
157{
158 qxl->guest_bug = 0;
159}
aee32bf3
GH		 160
161void qxl_spice_update_area(PCIQXLDevice *qxl, uint32_t surface_id,
162 struct QXLRect *area, struct QXLRect *dirty_rects,
163 uint32_t num_dirty_rects,
5ff4e36c 164 uint32_t clear_dirty_region,
2e1a98c9 165 qxl_async_io async, struct QXLCookie *cookie)
aee32bf3 166{
c480bb7d
AL		 167 trace_qxl_spice_update_area(qxl->id, surface_id, area->left, area->right,
168 area->top, area->bottom);
169 trace_qxl_spice_update_area_rest(qxl->id, num_dirty_rects,
170 clear_dirty_region);
5ff4e36c
AL		 171 if (async == QXL_SYNC) {
172 qxl->ssd.worker->update_area(qxl->ssd.worker, surface_id, area,
173 dirty_rects, num_dirty_rects, clear_dirty_region);
174 } else {
2e1a98c9 175 assert(cookie != NULL);
5ff4e36c 176 spice_qxl_update_area_async(&qxl->ssd.qxl, surface_id, area,
5dba0d45 177 clear_dirty_region, (uintptr_t)cookie);
5ff4e36c 178 }
aee32bf3
GH		 179}
180
5ff4e36c
AL		 181static void qxl_spice_destroy_surface_wait_complete(PCIQXLDevice *qxl,
182 uint32_t id)
aee32bf3 183{
c480bb7d 184 trace_qxl_spice_destroy_surface_wait_complete(qxl->id, id);
14898cf6 185 qemu_mutex_lock(&qxl->track_lock);
14898cf6
GH		 186 qxl->guest_surfaces.cmds[id] = 0;
187 qxl->guest_surfaces.count--;
188 qemu_mutex_unlock(&qxl->track_lock);
aee32bf3
GH		 189}
190
5ff4e36c
AL		 191static void qxl_spice_destroy_surface_wait(PCIQXLDevice *qxl, uint32_t id,
192 qxl_async_io async)
193{
2e1a98c9
AL		 194 QXLCookie *cookie;
195
c480bb7d 196 trace_qxl_spice_destroy_surface_wait(qxl->id, id, async);
5ff4e36c 197 if (async) {
2e1a98c9
AL		 198 cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
199 QXL_IO_DESTROY_SURFACE_ASYNC);
200 cookie->u.surface_id = id;
5dba0d45 201 spice_qxl_destroy_surface_async(&qxl->ssd.qxl, id, (uintptr_t)cookie);
5ff4e36c
AL		 202 } else {
203 qxl->ssd.worker->destroy_surface_wait(qxl->ssd.worker, id);
5ff4e36c
AL		 204 }
205}
206
3e16b9c5
AL		 207static void qxl_spice_flush_surfaces_async(PCIQXLDevice *qxl)
208{
c480bb7d
AL		 209 trace_qxl_spice_flush_surfaces_async(qxl->id, qxl->guest_surfaces.count,
210 qxl->num_free_res);
2e1a98c9 211 spice_qxl_flush_surfaces_async(&qxl->ssd.qxl,
5dba0d45
PM		 212 (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
213 QXL_IO_FLUSH_SURFACES_ASYNC));
3e16b9c5 214}
3e16b9c5 215
aee32bf3
GH		 216void qxl_spice_loadvm_commands(PCIQXLDevice *qxl, struct QXLCommandExt *ext,
217 uint32_t count)
218{
c480bb7d 219 trace_qxl_spice_loadvm_commands(qxl->id, ext, count);
aee32bf3
GH		 220 qxl->ssd.worker->loadvm_commands(qxl->ssd.worker, ext, count);
221}
222
223void qxl_spice_oom(PCIQXLDevice *qxl)
224{
c480bb7d 225 trace_qxl_spice_oom(qxl->id);
aee32bf3
GH		 226 qxl->ssd.worker->oom(qxl->ssd.worker);
227}
228
229void qxl_spice_reset_memslots(PCIQXLDevice *qxl)
230{
c480bb7d 231 trace_qxl_spice_reset_memslots(qxl->id);
aee32bf3
GH		 232 qxl->ssd.worker->reset_memslots(qxl->ssd.worker);
233}
234
5ff4e36c 235static void qxl_spice_destroy_surfaces_complete(PCIQXLDevice *qxl)
aee32bf3 236{
c480bb7d 237 trace_qxl_spice_destroy_surfaces_complete(qxl->id);
14898cf6 238 qemu_mutex_lock(&qxl->track_lock);
ddd8fdc7
GH		 239 memset(qxl->guest_surfaces.cmds, 0,
240 sizeof(qxl->guest_surfaces.cmds) * qxl->ssd.num_surfaces);
14898cf6
GH		 241 qxl->guest_surfaces.count = 0;
242 qemu_mutex_unlock(&qxl->track_lock);
aee32bf3
GH		 243}
244
5ff4e36c
AL		 245static void qxl_spice_destroy_surfaces(PCIQXLDevice *qxl, qxl_async_io async)
246{
c480bb7d 247 trace_qxl_spice_destroy_surfaces(qxl->id, async);
5ff4e36c 248 if (async) {
2e1a98c9 249 spice_qxl_destroy_surfaces_async(&qxl->ssd.qxl,
5dba0d45
PM		 250 (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
251 QXL_IO_DESTROY_ALL_SURFACES_ASYNC));
5ff4e36c
AL		 252 } else {
253 qxl->ssd.worker->destroy_surfaces(qxl->ssd.worker);
254 qxl_spice_destroy_surfaces_complete(qxl);
255 }
256}
257
020af1c4
AL		 258static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay)
259{
260 trace_qxl_spice_monitors_config(qxl->id);
261/* 0x000b01 == 0.11.1 */
262#if SPICE_SERVER_VERSION >= 0x000b01 && \
263 defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
264 if (replay) {
265 /*
266 * don't use QXL_COOKIE_TYPE_IO:
267 * - we are not running yet (post_load), we will assert
268 * in send_events
269 * - this is not a guest io, but a reply, so async_io isn't set.
270 */
271 spice_qxl_monitors_config_async(&qxl->ssd.qxl,
272 qxl->guest_monitors_config,
273 MEMSLOT_GROUP_GUEST,
274 (uintptr_t)qxl_cookie_new(
275 QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG,
276 0));
277 } else {
278 qxl->guest_monitors_config = qxl->ram->monitors_config;
279 spice_qxl_monitors_config_async(&qxl->ssd.qxl,
280 qxl->ram->monitors_config,
281 MEMSLOT_GROUP_GUEST,
282 (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
283 QXL_IO_MONITORS_CONFIG_ASYNC));
284 }
285#else
286 fprintf(stderr, "qxl: too old spice-protocol/spice-server for "
287 "QXL_IO_MONITORS_CONFIG_ASYNC\n");
288#endif
289}
290
aee32bf3
GH		 291void qxl_spice_reset_image_cache(PCIQXLDevice *qxl)
292{
c480bb7d 293 trace_qxl_spice_reset_image_cache(qxl->id);
aee32bf3
GH		 294 qxl->ssd.worker->reset_image_cache(qxl->ssd.worker);
295}
296
297void qxl_spice_reset_cursor(PCIQXLDevice *qxl)
298{
c480bb7d 299 trace_qxl_spice_reset_cursor(qxl->id);
aee32bf3 300 qxl->ssd.worker->reset_cursor(qxl->ssd.worker);
30f6da66
YH		 301 qemu_mutex_lock(&qxl->track_lock);
302 qxl->guest_cursor = 0;
303 qemu_mutex_unlock(&qxl->track_lock);
aee32bf3
GH		 304}
305
306
a19cbfb3
GH		 307static inline uint32_t msb_mask(uint32_t val)
308{
309 uint32_t mask;
310
311 do {
312 mask = ~(val - 1) & val;
313 val &= ~mask;
314 } while (mask < val);
315
316 return mask;
317}
318
319static ram_addr_t qxl_rom_size(void)
320{
321 uint32_t rom_size = sizeof(QXLRom) + sizeof(QXLModes) + sizeof(qxl_modes);
13d1fd44 322
a19cbfb3
GH		 323 rom_size = MAX(rom_size, TARGET_PAGE_SIZE);
324 rom_size = msb_mask(rom_size * 2 - 1);
325 return rom_size;
326}
327
328static void init_qxl_rom(PCIQXLDevice *d)
329{
b1950430 330 QXLRom *rom = memory_region_get_ram_ptr(&d->rom_bar);
a19cbfb3
GH		 331 QXLModes *modes = (QXLModes *)(rom + 1);
332 uint32_t ram_header_size;
333 uint32_t surface0_area_size;
334 uint32_t num_pages;
13d1fd44
AL		 335 uint32_t fb;
336 int i, n;
a19cbfb3
GH		 337
338 memset(rom, 0, d->rom_size);
339
340 rom->magic = cpu_to_le32(QXL_ROM_MAGIC);
341 rom->id = cpu_to_le32(d->id);
342 rom->log_level = cpu_to_le32(d->guestdebug);
343 rom->modes_offset = cpu_to_le32(sizeof(QXLRom));
344
345 rom->slot_gen_bits = MEMSLOT_GENERATION_BITS;
346 rom->slot_id_bits = MEMSLOT_SLOT_BITS;
347 rom->slots_start = 1;
348 rom->slots_end = NUM_MEMSLOTS - 1;
ddd8fdc7 349 rom->n_surfaces = cpu_to_le32(d->ssd.num_surfaces);
a19cbfb3 350
13d1fd44 351 for (i = 0, n = 0; i < ARRAY_SIZE(qxl_modes); i++) {
a19cbfb3 352 fb = qxl_modes[i].y_res * qxl_modes[i].stride;
13d1fd44
AL		 353 if (fb > d->vgamem_size) {
354 continue;
a19cbfb3 355 }
13d1fd44
AL		 356 modes->modes[n].id = cpu_to_le32(i);
357 modes->modes[n].x_res = cpu_to_le32(qxl_modes[i].x_res);
358 modes->modes[n].y_res = cpu_to_le32(qxl_modes[i].y_res);
359 modes->modes[n].bits = cpu_to_le32(qxl_modes[i].bits);
360 modes->modes[n].stride = cpu_to_le32(qxl_modes[i].stride);
361 modes->modes[n].x_mili = cpu_to_le32(qxl_modes[i].x_mili);
362 modes->modes[n].y_mili = cpu_to_le32(qxl_modes[i].y_mili);
363 modes->modes[n].orientation = cpu_to_le32(qxl_modes[i].orientation);
364 n++;
365 }
366 modes->n_modes = cpu_to_le32(n);
a19cbfb3
GH		 367
368 ram_header_size = ALIGN(sizeof(QXLRam), 4096);
13d1fd44 369 surface0_area_size = ALIGN(d->vgamem_size, 4096);
a19cbfb3
GH		 370 num_pages = d->vga.vram_size;
371 num_pages -= ram_header_size;
372 num_pages -= surface0_area_size;
373 num_pages = num_pages / TARGET_PAGE_SIZE;
374
375 rom->draw_area_offset = cpu_to_le32(0);
376 rom->surface0_area_size = cpu_to_le32(surface0_area_size);
377 rom->pages_offset = cpu_to_le32(surface0_area_size);
378 rom->num_pages = cpu_to_le32(num_pages);
379 rom->ram_header_offset = cpu_to_le32(d->vga.vram_size - ram_header_size);
380
381 d->shadow_rom = *rom;
382 d->rom = rom;
383 d->modes = modes;
384}
385
386static void init_qxl_ram(PCIQXLDevice *d)
387{
388 uint8_t *buf;
389 uint64_t *item;
390
391 buf = d->vga.vram_ptr;
392 d->ram = (QXLRam *)(buf + le32_to_cpu(d->shadow_rom.ram_header_offset));
393 d->ram->magic = cpu_to_le32(QXL_RAM_MAGIC);
394 d->ram->int_pending = cpu_to_le32(0);
395 d->ram->int_mask = cpu_to_le32(0);
9f0f352d 396 d->ram->update_surface = 0;
a19cbfb3
GH		 397 SPICE_RING_INIT(&d->ram->cmd_ring);
398 SPICE_RING_INIT(&d->ram->cursor_ring);
399 SPICE_RING_INIT(&d->ram->release_ring);
0b81c478
AL		 400 SPICE_RING_PROD_ITEM(d, &d->ram->release_ring, item);
401 assert(item);
a19cbfb3
GH		 402 *item = 0;
403 qxl_ring_set_dirty(d);
404}
405
406/* can be called from spice server thread context */
b1950430 407static void qxl_set_dirty(MemoryRegion *mr, ram_addr_t addr, ram_addr_t end)
a19cbfb3 408{
fd4aa979 409 memory_region_set_dirty(mr, addr, end - addr);
a19cbfb3
GH		 410}
411
412static void qxl_rom_set_dirty(PCIQXLDevice *qxl)
413{
b1950430 414 qxl_set_dirty(&qxl->rom_bar, 0, qxl->rom_size);
a19cbfb3
GH		 415}
416
417/* called from spice server thread context only */
418static void qxl_ram_set_dirty(PCIQXLDevice *qxl, void *ptr)
419{
a19cbfb3
GH		 420 void *base = qxl->vga.vram_ptr;
421 intptr_t offset;
422
423 offset = ptr - base;
424 offset &= ~(TARGET_PAGE_SIZE-1);
425 assert(offset < qxl->vga.vram_size);
b1950430 426 qxl_set_dirty(&qxl->vga.vram, offset, offset + TARGET_PAGE_SIZE);
a19cbfb3
GH		 427}
428
429/* can be called from spice server thread context */
430static void qxl_ring_set_dirty(PCIQXLDevice *qxl)
431{
b1950430
AK		 432 ram_addr_t addr = qxl->shadow_rom.ram_header_offset;
433 ram_addr_t end = qxl->vga.vram_size;
434 qxl_set_dirty(&qxl->vga.vram, addr, end);
a19cbfb3
GH		 435}
436
437/*
438 * keep track of some command state, for savevm/loadvm.
439 * called from spice server thread context only
440 */
fae2afb1 441static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext)
a19cbfb3
GH		 442{
443 switch (le32_to_cpu(ext->cmd.type)) {
444 case QXL_CMD_SURFACE:
445 {
446 QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id);
fae2afb1
AL		 447
448 if (!cmd) {
449 return 1;
450 }
a19cbfb3 451 uint32_t id = le32_to_cpu(cmd->surface_id);
47eddfbf 452
ddd8fdc7 453 if (id >= qxl->ssd.num_surfaces) {
0a530548 454 qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE id %d >= %d", id,
ddd8fdc7 455 qxl->ssd.num_surfaces);
47eddfbf
AL		 456 return 1;
457 }
14898cf6 458 qemu_mutex_lock(&qxl->track_lock);
a19cbfb3
GH		 459 if (cmd->type == QXL_SURFACE_CMD_CREATE) {
460 qxl->guest_surfaces.cmds[id] = ext->cmd.data;
461 qxl->guest_surfaces.count++;
462 if (qxl->guest_surfaces.max < qxl->guest_surfaces.count)
463 qxl->guest_surfaces.max = qxl->guest_surfaces.count;
464 }
465 if (cmd->type == QXL_SURFACE_CMD_DESTROY) {
466 qxl->guest_surfaces.cmds[id] = 0;
467 qxl->guest_surfaces.count--;
468 }
14898cf6 469 qemu_mutex_unlock(&qxl->track_lock);
a19cbfb3
GH		 470 break;
471 }
472 case QXL_CMD_CURSOR:
473 {
474 QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id);
fae2afb1
AL		 475
476 if (!cmd) {
477 return 1;
478 }
a19cbfb3 479 if (cmd->type == QXL_CURSOR_SET) {
30f6da66 480 qemu_mutex_lock(&qxl->track_lock);
a19cbfb3 481 qxl->guest_cursor = ext->cmd.data;
30f6da66 482 qemu_mutex_unlock(&qxl->track_lock);
a19cbfb3
GH		 483 }
484 break;
485 }
486 }
fae2afb1 487 return 0;
a19cbfb3
GH		 488}
489
490/* spice display interface callbacks */
491
492static void interface_attach_worker(QXLInstance *sin, QXLWorker *qxl_worker)
493{
494 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
495
c480bb7d 496 trace_qxl_interface_attach_worker(qxl->id);
a19cbfb3
GH		 497 qxl->ssd.worker = qxl_worker;
498}
499
500static void interface_set_compression_level(QXLInstance *sin, int level)
501{
502 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
503
c480bb7d 504 trace_qxl_interface_set_compression_level(qxl->id, level);
a19cbfb3
GH		 505 qxl->shadow_rom.compression_level = cpu_to_le32(level);
506 qxl->rom->compression_level = cpu_to_le32(level);
507 qxl_rom_set_dirty(qxl);
508}
509
510static void interface_set_mm_time(QXLInstance *sin, uint32_t mm_time)
511{
512 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
513
c480bb7d 514 trace_qxl_interface_set_mm_time(qxl->id, mm_time);
a19cbfb3
GH		 515 qxl->shadow_rom.mm_clock = cpu_to_le32(mm_time);
516 qxl->rom->mm_clock = cpu_to_le32(mm_time);
517 qxl_rom_set_dirty(qxl);
518}
519
520static void interface_get_init_info(QXLInstance *sin, QXLDevInitInfo *info)
521{
522 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
523
c480bb7d 524 trace_qxl_interface_get_init_info(qxl->id);
a19cbfb3
GH		 525 info->memslot_gen_bits = MEMSLOT_GENERATION_BITS;
526 info->memslot_id_bits = MEMSLOT_SLOT_BITS;
527 info->num_memslots = NUM_MEMSLOTS;
528 info->num_memslots_groups = NUM_MEMSLOTS_GROUPS;
529 info->internal_groupslot_id = 0;
530 info->qxl_ram_size = le32_to_cpu(qxl->shadow_rom.num_pages) << TARGET_PAGE_BITS;
ddd8fdc7 531 info->n_surfaces = qxl->ssd.num_surfaces;
a19cbfb3
GH		 532}
533
5b77870c
AL		 534static const char *qxl_mode_to_string(int mode)
535{
536 switch (mode) {
537 case QXL_MODE_COMPAT:
538 return "compat";
539 case QXL_MODE_NATIVE:
540 return "native";
541 case QXL_MODE_UNDEFINED:
542 return "undefined";
543 case QXL_MODE_VGA:
544 return "vga";
545 }
546 return "INVALID";
547}
548
8b92e298
AL		 549static const char *io_port_to_string(uint32_t io_port)
550{
551 if (io_port >= QXL_IO_RANGE_SIZE) {
552 return "out of range";
553 }
554 static const char *io_port_to_string[QXL_IO_RANGE_SIZE + 1] = {
555 [QXL_IO_NOTIFY_CMD] = "QXL_IO_NOTIFY_CMD",
556 [QXL_IO_NOTIFY_CURSOR] = "QXL_IO_NOTIFY_CURSOR",
557 [QXL_IO_UPDATE_AREA] = "QXL_IO_UPDATE_AREA",
558 [QXL_IO_UPDATE_IRQ] = "QXL_IO_UPDATE_IRQ",
559 [QXL_IO_NOTIFY_OOM] = "QXL_IO_NOTIFY_OOM",
560 [QXL_IO_RESET] = "QXL_IO_RESET",
561 [QXL_IO_SET_MODE] = "QXL_IO_SET_MODE",
562 [QXL_IO_LOG] = "QXL_IO_LOG",
563 [QXL_IO_MEMSLOT_ADD] = "QXL_IO_MEMSLOT_ADD",
564 [QXL_IO_MEMSLOT_DEL] = "QXL_IO_MEMSLOT_DEL",
565 [QXL_IO_DETACH_PRIMARY] = "QXL_IO_DETACH_PRIMARY",
566 [QXL_IO_ATTACH_PRIMARY] = "QXL_IO_ATTACH_PRIMARY",
567 [QXL_IO_CREATE_PRIMARY] = "QXL_IO_CREATE_PRIMARY",
568 [QXL_IO_DESTROY_PRIMARY] = "QXL_IO_DESTROY_PRIMARY",
569 [QXL_IO_DESTROY_SURFACE_WAIT] = "QXL_IO_DESTROY_SURFACE_WAIT",
570 [QXL_IO_DESTROY_ALL_SURFACES] = "QXL_IO_DESTROY_ALL_SURFACES",
8b92e298
AL		 571 [QXL_IO_UPDATE_AREA_ASYNC] = "QXL_IO_UPDATE_AREA_ASYNC",
572 [QXL_IO_MEMSLOT_ADD_ASYNC] = "QXL_IO_MEMSLOT_ADD_ASYNC",
573 [QXL_IO_CREATE_PRIMARY_ASYNC] = "QXL_IO_CREATE_PRIMARY_ASYNC",
574 [QXL_IO_DESTROY_PRIMARY_ASYNC] = "QXL_IO_DESTROY_PRIMARY_ASYNC",
575 [QXL_IO_DESTROY_SURFACE_ASYNC] = "QXL_IO_DESTROY_SURFACE_ASYNC",
576 [QXL_IO_DESTROY_ALL_SURFACES_ASYNC]
577 = "QXL_IO_DESTROY_ALL_SURFACES_ASYNC",
578 [QXL_IO_FLUSH_SURFACES_ASYNC] = "QXL_IO_FLUSH_SURFACES_ASYNC",
579 [QXL_IO_FLUSH_RELEASE] = "QXL_IO_FLUSH_RELEASE",
020af1c4 580 [QXL_IO_MONITORS_CONFIG_ASYNC] = "QXL_IO_MONITORS_CONFIG_ASYNC",
8b92e298
AL		 581 };
582 return io_port_to_string[io_port];
583}
584
a19cbfb3
GH		 585/* called from spice server thread context only */
586static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext)
587{
588 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
589 SimpleSpiceUpdate *update;
590 QXLCommandRing *ring;
591 QXLCommand *cmd;
e0c64d08 592 int notify, ret;
a19cbfb3 593
c480bb7d
AL		 594 trace_qxl_ring_command_check(qxl->id, qxl_mode_to_string(qxl->mode));
595
a19cbfb3
GH		 596 switch (qxl->mode) {
597 case QXL_MODE_VGA:
e0c64d08
GH		 598 ret = false;
599 qemu_mutex_lock(&qxl->ssd.lock);
600 if (qxl->ssd.update != NULL) {
601 update = qxl->ssd.update;
602 qxl->ssd.update = NULL;
603 *ext = update->ext;
604 ret = true;
a19cbfb3 605 }
e0c64d08 606 qemu_mutex_unlock(&qxl->ssd.lock);
212496c9 607 if (ret) {
c480bb7d 608 trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode));
212496c9
AL		 609 qxl_log_command(qxl, "vga", ext);
610 }
e0c64d08 611 return ret;
a19cbfb3
GH		 612 case QXL_MODE_COMPAT:
613 case QXL_MODE_NATIVE:
614 case QXL_MODE_UNDEFINED:
a19cbfb3 615 ring = &qxl->ram->cmd_ring;
087e6a42 616 if (qxl->guest_bug || SPICE_RING_IS_EMPTY(ring)) {
a19cbfb3
GH		 617 return false;
618 }
0b81c478
AL		 619 SPICE_RING_CONS_ITEM(qxl, ring, cmd);
620 if (!cmd) {
621 return false;
622 }
a19cbfb3
GH		 623 ext->cmd = *cmd;
624 ext->group_id = MEMSLOT_GROUP_GUEST;
625 ext->flags = qxl->cmdflags;
626 SPICE_RING_POP(ring, notify);
627 qxl_ring_set_dirty(qxl);
628 if (notify) {
629 qxl_send_events(qxl, QXL_INTERRUPT_DISPLAY);
630 }
631 qxl->guest_primary.commands++;
632 qxl_track_command(qxl, ext);
633 qxl_log_command(qxl, "cmd", ext);
0b81c478 634 trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode));
a19cbfb3
GH		 635 return true;
636 default:
637 return false;
638 }
639}
640
641/* called from spice server thread context only */
642static int interface_req_cmd_notification(QXLInstance *sin)
643{
644 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
645 int wait = 1;
646
c480bb7d 647 trace_qxl_ring_command_req_notification(qxl->id);
a19cbfb3
GH		 648 switch (qxl->mode) {
649 case QXL_MODE_COMPAT:
650 case QXL_MODE_NATIVE:
651 case QXL_MODE_UNDEFINED:
652 SPICE_RING_CONS_WAIT(&qxl->ram->cmd_ring, wait);
653 qxl_ring_set_dirty(qxl);
654 break;
655 default:
656 /* nothing */
657 break;
658 }
659 return wait;
660}
661
662/* called from spice server thread context only */
663static inline void qxl_push_free_res(PCIQXLDevice *d, int flush)
664{
665 QXLReleaseRing *ring = &d->ram->release_ring;
666 uint64_t *item;
667 int notify;
668
669#define QXL_FREE_BUNCH_SIZE 32
670
671 if (ring->prod - ring->cons + 1 == ring->num_items) {
672 /* ring full -- can't push */
673 return;
674 }
675 if (!flush && d->oom_running) {
676 /* collect everything from oom handler before pushing */
677 return;
678 }
679 if (!flush && d->num_free_res < QXL_FREE_BUNCH_SIZE) {
680 /* collect a bit more before pushing */
681 return;
682 }
683
684 SPICE_RING_PUSH(ring, notify);
c480bb7d
AL		 685 trace_qxl_ring_res_push(d->id, qxl_mode_to_string(d->mode),
686 d->guest_surfaces.count, d->num_free_res,
687 d->last_release, notify ? "yes" : "no");
688 trace_qxl_ring_res_push_rest(d->id, ring->prod - ring->cons,
689 ring->num_items, ring->prod, ring->cons);
a19cbfb3
GH		 690 if (notify) {
691 qxl_send_events(d, QXL_INTERRUPT_DISPLAY);
692 }
0b81c478
AL		 693 SPICE_RING_PROD_ITEM(d, ring, item);
694 if (!item) {
695 return;
696 }
a19cbfb3
GH		 697 *item = 0;
698 d->num_free_res = 0;
699 d->last_release = NULL;
700 qxl_ring_set_dirty(d);
701}
702
703/* called from spice server thread context only */
704static void interface_release_resource(QXLInstance *sin,
705 struct QXLReleaseInfoExt ext)
706{
707 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
708 QXLReleaseRing *ring;
709 uint64_t *item, id;
710
711 if (ext.group_id == MEMSLOT_GROUP_HOST) {
712 /* host group -> vga mode update request */
f4a8a424 713 qemu_spice_destroy_update(&qxl->ssd, (void *)(intptr_t)ext.info->id);
a19cbfb3
GH		 714 return;
715 }
716
717 /*
718 * ext->info points into guest-visible memory
719 * pci bar 0, $command.release_info
720 */
721 ring = &qxl->ram->release_ring;
0b81c478
AL		 722 SPICE_RING_PROD_ITEM(qxl, ring, item);
723 if (!item) {
724 return;
725 }
a19cbfb3
GH		 726 if (*item == 0) {
727 /* stick head into the ring */
728 id = ext.info->id;
729 ext.info->next = 0;
730 qxl_ram_set_dirty(qxl, &ext.info->next);
731 *item = id;
732 qxl_ring_set_dirty(qxl);
733 } else {
734 /* append item to the list */
735 qxl->last_release->next = ext.info->id;
736 qxl_ram_set_dirty(qxl, &qxl->last_release->next);
737 ext.info->next = 0;
738 qxl_ram_set_dirty(qxl, &ext.info->next);
739 }
740 qxl->last_release = ext.info;
741 qxl->num_free_res++;
c480bb7d 742 trace_qxl_ring_res_put(qxl->id, qxl->num_free_res);
a19cbfb3
GH		 743 qxl_push_free_res(qxl, 0);
744}
745
746/* called from spice server thread context only */
747static int interface_get_cursor_command(QXLInstance *sin, struct QXLCommandExt *ext)
748{
749 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
750 QXLCursorRing *ring;
751 QXLCommand *cmd;
752 int notify;
753
c480bb7d
AL		 754 trace_qxl_ring_cursor_check(qxl->id, qxl_mode_to_string(qxl->mode));
755
a19cbfb3
GH		 756 switch (qxl->mode) {
757 case QXL_MODE_COMPAT:
758 case QXL_MODE_NATIVE:
759 case QXL_MODE_UNDEFINED:
760 ring = &qxl->ram->cursor_ring;
761 if (SPICE_RING_IS_EMPTY(ring)) {
762 return false;
763 }
0b81c478
AL		 764 SPICE_RING_CONS_ITEM(qxl, ring, cmd);
765 if (!cmd) {
766 return false;
767 }
a19cbfb3
GH		 768 ext->cmd = *cmd;
769 ext->group_id = MEMSLOT_GROUP_GUEST;
770 ext->flags = qxl->cmdflags;
771 SPICE_RING_POP(ring, notify);
772 qxl_ring_set_dirty(qxl);
773 if (notify) {
774 qxl_send_events(qxl, QXL_INTERRUPT_CURSOR);
775 }
776 qxl->guest_primary.commands++;
777 qxl_track_command(qxl, ext);
778 qxl_log_command(qxl, "csr", ext);
779 if (qxl->id == 0) {
780 qxl_render_cursor(qxl, ext);
781 }
c480bb7d 782 trace_qxl_ring_cursor_get(qxl->id, qxl_mode_to_string(qxl->mode));
a19cbfb3
GH		 783 return true;
784 default:
785 return false;
786 }
787}
788
789/* called from spice server thread context only */
790static int interface_req_cursor_notification(QXLInstance *sin)
791{
792 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
793 int wait = 1;
794
c480bb7d 795 trace_qxl_ring_cursor_req_notification(qxl->id);
a19cbfb3
GH		 796 switch (qxl->mode) {
797 case QXL_MODE_COMPAT:
798 case QXL_MODE_NATIVE:
799 case QXL_MODE_UNDEFINED:
800 SPICE_RING_CONS_WAIT(&qxl->ram->cursor_ring, wait);
801 qxl_ring_set_dirty(qxl);
802 break;
803 default:
804 /* nothing */
805 break;
806 }
807 return wait;
808}
809
810/* called from spice server thread context */
811static void interface_notify_update(QXLInstance *sin, uint32_t update_id)
812{
baeae407
AL		 813 /*
814 * Called by spice-server as a result of a QXL_CMD_UPDATE which is not in
815 * use by xf86-video-qxl and is defined out in the qxl windows driver.
816 * Probably was at some earlier version that is prior to git start (2009),
817 * and is still guest trigerrable.
818 */
819 fprintf(stderr, "%s: deprecated\n", __func__);
a19cbfb3
GH		 820}
821
822/* called from spice server thread context only */
823static int interface_flush_resources(QXLInstance *sin)
824{
825 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
826 int ret;
827
a19cbfb3
GH		 828 ret = qxl->num_free_res;
829 if (ret) {
830 qxl_push_free_res(qxl, 1);
831 }
832 return ret;
833}
834
5ff4e36c
AL		 835static void qxl_create_guest_primary_complete(PCIQXLDevice *d);
836
5ff4e36c 837/* called from spice server thread context only */
2e1a98c9 838static void interface_async_complete_io(PCIQXLDevice *qxl, QXLCookie *cookie)
5ff4e36c 839{
5ff4e36c
AL		 840 uint32_t current_async;
841
842 qemu_mutex_lock(&qxl->async_lock);
843 current_async = qxl->current_async;
844 qxl->current_async = QXL_UNDEFINED_IO;
845 qemu_mutex_unlock(&qxl->async_lock);
846
c480bb7d 847 trace_qxl_interface_async_complete_io(qxl->id, current_async, cookie);
2e1a98c9
AL		 848 if (!cookie) {
849 fprintf(stderr, "qxl: %s: error, cookie is NULL\n", __func__);
850 return;
851 }
852 if (cookie && current_async != cookie->io) {
853 fprintf(stderr,
2fce7edf
AL		 854 "qxl: %s: error: current_async = %d != %"
855 PRId64 " = cookie->io\n", __func__, current_async, cookie->io);
2e1a98c9 856 }
5ff4e36c 857 switch (current_async) {
81fb6f15
AL		 858 case QXL_IO_MEMSLOT_ADD_ASYNC:
859 case QXL_IO_DESTROY_PRIMARY_ASYNC:
860 case QXL_IO_UPDATE_AREA_ASYNC:
861 case QXL_IO_FLUSH_SURFACES_ASYNC:
020af1c4 862 case QXL_IO_MONITORS_CONFIG_ASYNC:
81fb6f15 863 break;
5ff4e36c
AL		 864 case QXL_IO_CREATE_PRIMARY_ASYNC:
865 qxl_create_guest_primary_complete(qxl);
866 break;
867 case QXL_IO_DESTROY_ALL_SURFACES_ASYNC:
868 qxl_spice_destroy_surfaces_complete(qxl);
869 break;
870 case QXL_IO_DESTROY_SURFACE_ASYNC:
2e1a98c9 871 qxl_spice_destroy_surface_wait_complete(qxl, cookie->u.surface_id);
5ff4e36c 872 break;
81fb6f15
AL		 873 default:
874 fprintf(stderr, "qxl: %s: unexpected current_async %d\n", __func__,
875 current_async);
5ff4e36c
AL		 876 }
877 qxl_send_events(qxl, QXL_INTERRUPT_IO_CMD);
878}
879
81fb6f15
AL		 880/* called from spice server thread context only */
881static void interface_update_area_complete(QXLInstance *sin,
882 uint32_t surface_id,
883 QXLRect *dirty, uint32_t num_updated_rects)
884{
885 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
886 int i;
887 int qxl_i;
888
889 qemu_mutex_lock(&qxl->ssd.lock);
890 if (surface_id != 0 || !qxl->render_update_cookie_num) {
891 qemu_mutex_unlock(&qxl->ssd.lock);
892 return;
893 }
c480bb7d
AL		 894 trace_qxl_interface_update_area_complete(qxl->id, surface_id, dirty->left,
895 dirty->right, dirty->top, dirty->bottom);
896 trace_qxl_interface_update_area_complete_rest(qxl->id, num_updated_rects);
81fb6f15
AL		 897 if (qxl->num_dirty_rects + num_updated_rects > QXL_NUM_DIRTY_RECTS) {
898 /*
899 * overflow - treat this as a full update. Not expected to be common.
900 */
c480bb7d
AL		 901 trace_qxl_interface_update_area_complete_overflow(qxl->id,
902 QXL_NUM_DIRTY_RECTS);
81fb6f15
AL		 903 qxl->guest_primary.resized = 1;
904 }
905 if (qxl->guest_primary.resized) {
906 /*
907 * Don't bother copying or scheduling the bh since we will flip
908 * the whole area anyway on completion of the update_area async call
909 */
910 qemu_mutex_unlock(&qxl->ssd.lock);
911 return;
912 }
913 qxl_i = qxl->num_dirty_rects;
914 for (i = 0; i < num_updated_rects; i++) {
915 qxl->dirty[qxl_i++] = dirty[i];
916 }
917 qxl->num_dirty_rects += num_updated_rects;
c480bb7d
AL		 918 trace_qxl_interface_update_area_complete_schedule_bh(qxl->id,
919 qxl->num_dirty_rects);
81fb6f15
AL		 920 qemu_bh_schedule(qxl->update_area_bh);
921 qemu_mutex_unlock(&qxl->ssd.lock);
922}
923
2e1a98c9
AL		 924/* called from spice server thread context only */
925static void interface_async_complete(QXLInstance *sin, uint64_t cookie_token)
926{
927 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
5dba0d45 928 QXLCookie *cookie = (QXLCookie *)(uintptr_t)cookie_token;
2e1a98c9
AL		 929
930 switch (cookie->type) {
931 case QXL_COOKIE_TYPE_IO:
932 interface_async_complete_io(qxl, cookie);
81fb6f15
AL		 933 g_free(cookie);
934 break;
935 case QXL_COOKIE_TYPE_RENDER_UPDATE_AREA:
936 qxl_render_update_area_done(qxl, cookie);
2e1a98c9 937 break;
020af1c4
AL		 938 case QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG:
939 break;
2e1a98c9
AL		 940 default:
941 fprintf(stderr, "qxl: %s: unexpected cookie type %d\n",
942 __func__, cookie->type);
81fb6f15 943 g_free(cookie);
2e1a98c9 944 }
2e1a98c9
AL		 945}
946
c10018d6
SSP		 947#if SPICE_SERVER_VERSION >= 0x000b04
948
949/* called from spice server thread context only */
950static void interface_set_client_capabilities(QXLInstance *sin,
951 uint8_t client_present,
952 uint8_t caps[58])
953{
954 PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
955
956 qxl->shadow_rom.client_present = client_present;
957 memcpy(qxl->shadow_rom.client_capabilities, caps, sizeof(caps));
958 qxl->rom->client_present = client_present;
959 memcpy(qxl->rom->client_capabilities, caps, sizeof(caps));
960 qxl_rom_set_dirty(qxl);
961
962 qxl_send_events(qxl, QXL_INTERRUPT_CLIENT);
963}
964
965#endif
966
a19cbfb3
GH		 967static const QXLInterface qxl_interface = {
968 .base.type = SPICE_INTERFACE_QXL,
969 .base.description = "qxl gpu",
970 .base.major_version = SPICE_INTERFACE_QXL_MAJOR,
971 .base.minor_version = SPICE_INTERFACE_QXL_MINOR,
972
973 .attache_worker = interface_attach_worker,
974 .set_compression_level = interface_set_compression_level,
975 .set_mm_time = interface_set_mm_time,
976 .get_init_info = interface_get_init_info,
977
978 /* the callbacks below are called from spice server thread context */
979 .get_command = interface_get_command,
980 .req_cmd_notification = interface_req_cmd_notification,
981 .release_resource = interface_release_resource,
982 .get_cursor_command = interface_get_cursor_command,
983 .req_cursor_notification = interface_req_cursor_notification,
984 .notify_update = interface_notify_update,
985 .flush_resources = interface_flush_resources,
5ff4e36c 986 .async_complete = interface_async_complete,
81fb6f15 987 .update_area_complete = interface_update_area_complete,
c10018d6
SSP		 988#if SPICE_SERVER_VERSION >= 0x000b04
989 .set_client_capabilities = interface_set_client_capabilities,
990#endif
a19cbfb3
GH		 991};
992
993static void qxl_enter_vga_mode(PCIQXLDevice *d)
994{
995 if (d->mode == QXL_MODE_VGA) {
996 return;
997 }
c480bb7d 998 trace_qxl_enter_vga_mode(d->id);
a19cbfb3
GH		 999 qemu_spice_create_host_primary(&d->ssd);
1000 d->mode = QXL_MODE_VGA;
1001 memset(&d->ssd.dirty, 0, sizeof(d->ssd.dirty));
0f7bfd81 1002 vga_dirty_log_start(&d->vga);
a19cbfb3
GH		 1003}
1004
1005static void qxl_exit_vga_mode(PCIQXLDevice *d)
1006{
1007 if (d->mode != QXL_MODE_VGA) {
1008 return;
1009 }
c480bb7d 1010 trace_qxl_exit_vga_mode(d->id);
0f7bfd81 1011 vga_dirty_log_stop(&d->vga);
5ff4e36c 1012 qxl_destroy_primary(d, QXL_SYNC);
a19cbfb3
GH		 1013}
1014
40010aea 1015static void qxl_update_irq(PCIQXLDevice *d)
a19cbfb3
GH		 1016{
1017 uint32_t pending = le32_to_cpu(d->ram->int_pending);
1018 uint32_t mask = le32_to_cpu(d->ram->int_mask);
1019 int level = !!(pending & mask);
1020 qemu_set_irq(d->pci.irq[0], level);
1021 qxl_ring_set_dirty(d);
1022}
1023
a19cbfb3
GH		 1024static void qxl_check_state(PCIQXLDevice *d)
1025{
1026 QXLRam *ram = d->ram;
71d388d4 1027 int spice_display_running = qemu_spice_display_is_running(&d->ssd);
a19cbfb3 1028
71d388d4
YH		 1029 assert(!spice_display_running || SPICE_RING_IS_EMPTY(&ram->cmd_ring));
1030 assert(!spice_display_running || SPICE_RING_IS_EMPTY(&ram->cursor_ring));
a19cbfb3
GH		 1031}
1032
1033static void qxl_reset_state(PCIQXLDevice *d)
1034{
a19cbfb3
GH		 1035 QXLRom *rom = d->rom;
1036
be48e995 1037 qxl_check_state(d);
a19cbfb3
GH		 1038 d->shadow_rom.update_id = cpu_to_le32(0);
1039 *rom = d->shadow_rom;
1040 qxl_rom_set_dirty(d);
1041 init_qxl_ram(d);
1042 d->num_free_res = 0;
1043 d->last_release = NULL;
1044 memset(&d->ssd.dirty, 0, sizeof(d->ssd.dirty));
1045}
1046
1047static void qxl_soft_reset(PCIQXLDevice *d)
1048{
c480bb7d 1049 trace_qxl_soft_reset(d->id);
a19cbfb3 1050 qxl_check_state(d);
087e6a42 1051 qxl_clear_guest_bug(d);
a5f68c22 1052 d->current_async = QXL_UNDEFINED_IO;
a19cbfb3
GH		 1053
1054 if (d->id == 0) {
1055 qxl_enter_vga_mode(d);
1056 } else {
1057 d->mode = QXL_MODE_UNDEFINED;
1058 }
1059}
1060
1061static void qxl_hard_reset(PCIQXLDevice *d, int loadvm)
1062{
c480bb7d 1063 trace_qxl_hard_reset(d->id, loadvm);
a19cbfb3 1064
aee32bf3
GH		 1065 qxl_spice_reset_cursor(d);
1066 qxl_spice_reset_image_cache(d);
a19cbfb3
GH		 1067 qxl_reset_surfaces(d);
1068 qxl_reset_memslots(d);
1069
1070 /* pre loadvm reset must not touch QXLRam. This lives in
1071 * device memory, is migrated together with RAM and thus
1072 * already loaded at this point */
1073 if (!loadvm) {
1074 qxl_reset_state(d);
1075 }
1076 qemu_spice_create_host_memslot(&d->ssd);
1077 qxl_soft_reset(d);
a19cbfb3
GH		 1078}
1079
1080static void qxl_reset_handler(DeviceState *dev)
1081{
1082 PCIQXLDevice *d = DO_UPCAST(PCIQXLDevice, pci.qdev, dev);
c480bb7d 1083
a19cbfb3
GH		 1084 qxl_hard_reset(d, 0);
1085}
1086
1087static void qxl_vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
1088{
1089 VGACommonState *vga = opaque;
1090 PCIQXLDevice *qxl = container_of(vga, PCIQXLDevice, vga);
1091
c480bb7d 1092 trace_qxl_io_write_vga(qxl->id, qxl_mode_to_string(qxl->mode), addr, val);
a19cbfb3 1093 if (qxl->mode != QXL_MODE_VGA) {
5ff4e36c 1094 qxl_destroy_primary(qxl, QXL_SYNC);
a19cbfb3
GH		 1095 qxl_soft_reset(qxl);
1096 }
1097 vga_ioport_write(opaque, addr, val);
1098}
1099
f67ab77a
GH		 1100static const MemoryRegionPortio qxl_vga_portio_list[] = {
1101 { 0x04, 2, 1, .read = vga_ioport_read,
1102 .write = qxl_vga_ioport_write }, /* 3b4 */
1103 { 0x0a, 1, 1, .read = vga_ioport_read,
1104 .write = qxl_vga_ioport_write }, /* 3ba */
1105 { 0x10, 16, 1, .read = vga_ioport_read,
1106 .write = qxl_vga_ioport_write }, /* 3c0 */
1107 { 0x24, 2, 1, .read = vga_ioport_read,
1108 .write = qxl_vga_ioport_write }, /* 3d4 */
1109 { 0x2a, 1, 1, .read = vga_ioport_read,
1110 .write = qxl_vga_ioport_write }, /* 3da */
1111 PORTIO_END_OF_LIST(),
1112};
1113
e954ea28
AL		 1114static int qxl_add_memslot(PCIQXLDevice *d, uint32_t slot_id, uint64_t delta,
1115 qxl_async_io async)
a19cbfb3
GH		 1116{
1117 static const int regions[] = {
1118 QXL_RAM_RANGE_INDEX,
1119 QXL_VRAM_RANGE_INDEX,
6f2b175a 1120 QXL_VRAM64_RANGE_INDEX,
a19cbfb3
GH		 1121 };
1122 uint64_t guest_start;
1123 uint64_t guest_end;
1124 int pci_region;
1125 pcibus_t pci_start;
1126 pcibus_t pci_end;
1127 intptr_t virt_start;
1128 QXLDevMemSlot memslot;
1129 int i;
1130
1131 guest_start = le64_to_cpu(d->guest_slots[slot_id].slot.mem_start);
1132 guest_end = le64_to_cpu(d->guest_slots[slot_id].slot.mem_end);
1133
c480bb7d 1134 trace_qxl_memslot_add_guest(d->id, slot_id, guest_start, guest_end);
a19cbfb3 1135
e954ea28 1136 if (slot_id >= NUM_MEMSLOTS) {
0a530548 1137 qxl_set_guest_bug(d, "%s: slot_id >= NUM_MEMSLOTS %d >= %d", __func__,
e954ea28
AL		 1138 slot_id, NUM_MEMSLOTS);
1139 return 1;
1140 }
1141 if (guest_start > guest_end) {
0a530548 1142 qxl_set_guest_bug(d, "%s: guest_start > guest_end 0x%" PRIx64
e954ea28
AL		 1143 " > 0x%" PRIx64, __func__, guest_start, guest_end);
1144 return 1;
1145 }
a19cbfb3
GH		 1146
1147 for (i = 0; i < ARRAY_SIZE(regions); i++) {
1148 pci_region = regions[i];
1149 pci_start = d->pci.io_regions[pci_region].addr;
1150 pci_end = pci_start + d->pci.io_regions[pci_region].size;
1151 /* mapped? */
1152 if (pci_start == -1) {
1153 continue;
1154 }
1155 /* start address in range ? */
1156 if (guest_start < pci_start || guest_start > pci_end) {
1157 continue;
1158 }
1159 /* end address in range ? */
1160 if (guest_end > pci_end) {
1161 continue;
1162 }
1163 /* passed */
1164 break;
1165 }
e954ea28 1166 if (i == ARRAY_SIZE(regions)) {
0a530548 1167 qxl_set_guest_bug(d, "%s: finished loop without match", __func__);
e954ea28
AL		 1168 return 1;
1169 }
a19cbfb3
GH		 1170
1171 switch (pci_region) {
1172 case QXL_RAM_RANGE_INDEX:
b1950430 1173 virt_start = (intptr_t)memory_region_get_ram_ptr(&d->vga.vram);
a19cbfb3
GH		 1174 break;
1175 case QXL_VRAM_RANGE_INDEX:
6f2b175a 1176 case 4 /* vram 64bit */:
b1950430 1177 virt_start = (intptr_t)memory_region_get_ram_ptr(&d->vram_bar);
a19cbfb3
GH		 1178 break;
1179 default:
1180 /* should not happen */
0a530548 1181 qxl_set_guest_bug(d, "%s: pci_region = %d", __func__, pci_region);
e954ea28 1182 return 1;
a19cbfb3
GH		 1183 }
1184
1185 memslot.slot_id = slot_id;
1186 memslot.slot_group_id = MEMSLOT_GROUP_GUEST; /* guest group */
1187 memslot.virt_start = virt_start + (guest_start - pci_start);
1188 memslot.virt_end = virt_start + (guest_end - pci_start);
1189 memslot.addr_delta = memslot.virt_start - delta;
1190 memslot.generation = d->rom->slot_generation = 0;
1191 qxl_rom_set_dirty(d);
1192
5ff4e36c 1193 qemu_spice_add_memslot(&d->ssd, &memslot, async);
a19cbfb3
GH		 1194 d->guest_slots[slot_id].ptr = (void*)memslot.virt_start;
1195 d->guest_slots[slot_id].size = memslot.virt_end - memslot.virt_start;
1196 d->guest_slots[slot_id].delta = delta;
1197 d->guest_slots[slot_id].active = 1;
e954ea28 1198 return 0;
a19cbfb3
GH		 1199}
1200
1201static void qxl_del_memslot(PCIQXLDevice *d, uint32_t slot_id)
1202{
5c59d118 1203 qemu_spice_del_memslot(&d->ssd, MEMSLOT_GROUP_HOST, slot_id);
a19cbfb3
GH		 1204 d->guest_slots[slot_id].active = 0;
1205}
1206
1207static void qxl_reset_memslots(PCIQXLDevice *d)
1208{
aee32bf3 1209 qxl_spice_reset_memslots(d);
a19cbfb3
GH		 1210 memset(&d->guest_slots, 0, sizeof(d->guest_slots));
1211}
1212
1213static void qxl_reset_surfaces(PCIQXLDevice *d)
1214{
c480bb7d 1215 trace_qxl_reset_surfaces(d->id);
a19cbfb3 1216 d->mode = QXL_MODE_UNDEFINED;
5ff4e36c 1217 qxl_spice_destroy_surfaces(d, QXL_SYNC);
a19cbfb3
GH		 1218}
1219
e25139b3 1220/* can be also called from spice server thread context */
a19cbfb3
GH		 1221void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
1222{
1223 uint64_t phys = le64_to_cpu(pqxl);
1224 uint32_t slot = (phys >> (64 - 8)) & 0xff;
1225 uint64_t offset = phys & 0xffffffffffff;
1226
1227 switch (group_id) {
1228 case MEMSLOT_GROUP_HOST:
f4a8a424 1229 return (void *)(intptr_t)offset;
a19cbfb3 1230 case MEMSLOT_GROUP_GUEST:
4b635c59 1231 if (slot >= NUM_MEMSLOTS) {
0a530548
AL		 1232 qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot,
1233 NUM_MEMSLOTS);
4b635c59
AL		 1234 return NULL;
1235 }
1236 if (!qxl->guest_slots[slot].active) {
0a530548 1237 qxl_set_guest_bug(qxl, "inactive slot %d\n", slot);
4b635c59
AL		 1238 return NULL;
1239 }
1240 if (offset < qxl->guest_slots[slot].delta) {
0a530548
AL		 1241 qxl_set_guest_bug(qxl,
1242 "slot %d offset %"PRIu64" < delta %"PRIu64"\n",
4b635c59
AL		 1243 slot, offset, qxl->guest_slots[slot].delta);
1244 return NULL;
1245 }
a19cbfb3 1246 offset -= qxl->guest_slots[slot].delta;
4b635c59 1247 if (offset > qxl->guest_slots[slot].size) {
0a530548
AL		 1248 qxl_set_guest_bug(qxl,
1249 "slot %d offset %"PRIu64" > size %"PRIu64"\n",
4b635c59
AL		 1250 slot, offset, qxl->guest_slots[slot].size);
1251 return NULL;
1252 }
a19cbfb3 1253 return qxl->guest_slots[slot].ptr + offset;
a19cbfb3 1254 }
4b635c59 1255 return NULL;
a19cbfb3
GH		 1256}
1257
5ff4e36c
AL		 1258static void qxl_create_guest_primary_complete(PCIQXLDevice *qxl)
1259{
1260 /* for local rendering */
1261 qxl_render_resize(qxl);
1262}
1263
1264static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
1265 qxl_async_io async)
a19cbfb3
GH		 1266{
1267 QXLDevSurfaceCreate surface;
1268 QXLSurfaceCreate *sc = &qxl->guest_primary.surface;
13d1fd44
AL		 1269 int size;
1270 int requested_height = le32_to_cpu(sc->height);
1271 int requested_stride = le32_to_cpu(sc->stride);
1272
1273 size = abs(requested_stride) * requested_height;
1274 if (size > qxl->vgamem_size) {
1275 qxl_set_guest_bug(qxl, "%s: requested primary larger then framebuffer"
1276 " size", __func__);
1277 return;
1278 }
a19cbfb3 1279
ddf9f4b7 1280 if (qxl->mode == QXL_MODE_NATIVE) {
0a530548 1281 qxl_set_guest_bug(qxl, "%s: nop since already in QXL_MODE_NATIVE",
ddf9f4b7
AL		 1282 __func__);
1283 }
a19cbfb3
GH		 1284 qxl_exit_vga_mode(qxl);
1285
a19cbfb3
GH		 1286 surface.format = le32_to_cpu(sc->format);
1287 surface.height = le32_to_cpu(sc->height);
1288 surface.mem = le64_to_cpu(sc->mem);
1289 surface.position = le32_to_cpu(sc->position);
1290 surface.stride = le32_to_cpu(sc->stride);
1291 surface.width = le32_to_cpu(sc->width);
1292 surface.type = le32_to_cpu(sc->type);
1293 surface.flags = le32_to_cpu(sc->flags);
c480bb7d
AL		 1294 trace_qxl_create_guest_primary(qxl->id, sc->width, sc->height, sc->mem,
1295 sc->format, sc->position);
1296 trace_qxl_create_guest_primary_rest(qxl->id, sc->stride, sc->type,
1297 sc->flags);
a19cbfb3
GH		 1298
1299 surface.mouse_mode = true;
1300 surface.group_id = MEMSLOT_GROUP_GUEST;
1301 if (loadvm) {
1302 surface.flags |= QXL_SURF_FLAG_KEEP_DATA;
1303 }
1304
1305 qxl->mode = QXL_MODE_NATIVE;
1306 qxl->cmdflags = 0;
5ff4e36c 1307 qemu_spice_create_primary_surface(&qxl->ssd, 0, &surface, async);
a19cbfb3 1308
5ff4e36c
AL		 1309 if (async == QXL_SYNC) {
1310 qxl_create_guest_primary_complete(qxl);
1311 }
a19cbfb3
GH		 1312}
1313
5ff4e36c
AL		 1314/* return 1 if surface destoy was initiated (in QXL_ASYNC case) or
1315 * done (in QXL_SYNC case), 0 otherwise. */
1316static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async)
a19cbfb3
GH		 1317{
1318 if (d->mode == QXL_MODE_UNDEFINED) {
5ff4e36c 1319 return 0;
a19cbfb3 1320 }
c480bb7d 1321 trace_qxl_destroy_primary(d->id);
a19cbfb3 1322 d->mode = QXL_MODE_UNDEFINED;
5ff4e36c 1323 qemu_spice_destroy_primary_surface(&d->ssd, 0, async);
30f6da66 1324 qxl_spice_reset_cursor(d);
5ff4e36c 1325 return 1;
a19cbfb3
GH		 1326}
1327
1328static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
1329{
1330 pcibus_t start = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr;
1331 pcibus_t end = d->pci.io_regions[QXL_RAM_RANGE_INDEX].size + start;
1332 QXLMode *mode = d->modes->modes + modenr;
1333 uint64_t devmem = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr;
1334 QXLMemSlot slot = {
1335 .mem_start = start,
1336 .mem_end = end
1337 };
1338 QXLSurfaceCreate surface = {
1339 .width = mode->x_res,
1340 .height = mode->y_res,
1341 .stride = -mode->x_res * 4,
1342 .format = SPICE_SURFACE_FMT_32_xRGB,
1343 .flags = loadvm ? QXL_SURF_FLAG_KEEP_DATA : 0,
1344 .mouse_mode = true,
1345 .mem = devmem + d->shadow_rom.draw_area_offset,
1346 };
1347
c480bb7d
AL		 1348 trace_qxl_set_mode(d->id, modenr, mode->x_res, mode->y_res, mode->bits,
1349 devmem);
a19cbfb3
GH		 1350 if (!loadvm) {
1351 qxl_hard_reset(d, 0);
1352 }
1353
1354 d->guest_slots[0].slot = slot;
e954ea28 1355 assert(qxl_add_memslot(d, 0, devmem, QXL_SYNC) == 0);
a19cbfb3
GH		 1356
1357 d->guest_primary.surface = surface;
5ff4e36c 1358 qxl_create_guest_primary(d, 0, QXL_SYNC);
a19cbfb3
GH		 1359
1360 d->mode = QXL_MODE_COMPAT;
1361 d->cmdflags = QXL_COMMAND_FLAG_COMPAT;
a19cbfb3
GH		 1362 if (mode->bits == 16) {
1363 d->cmdflags |= QXL_COMMAND_FLAG_COMPAT_16BPP;
1364 }
a19cbfb3
GH		 1365 d->shadow_rom.mode = cpu_to_le32(modenr);
1366 d->rom->mode = cpu_to_le32(modenr);
1367 qxl_rom_set_dirty(d);
1368}
1369
b1950430
AK		 1370static void ioport_write(void *opaque, target_phys_addr_t addr,
1371 uint64_t val, unsigned size)
a19cbfb3
GH		 1372{
1373 PCIQXLDevice *d = opaque;
b1950430 1374 uint32_t io_port = addr;
5ff4e36c 1375 qxl_async_io async = QXL_SYNC;
5ff4e36c 1376 uint32_t orig_io_port = io_port;
a19cbfb3 1377
087e6a42
AL		 1378 if (d->guest_bug && !io_port == QXL_IO_RESET) {
1379 return;
1380 }
1381
020af1c4
AL		 1382 if (d->revision <= QXL_REVISION_STABLE_V10 &&
1383 io_port >= QXL_IO_FLUSH_SURFACES_ASYNC) {
1384 qxl_set_guest_bug(d, "unsupported io %d for revision %d\n",
1385 io_port, d->revision);
1386 return;
1387 }
1388
a19cbfb3
GH		 1389 switch (io_port) {
1390 case QXL_IO_RESET:
1391 case QXL_IO_SET_MODE:
1392 case QXL_IO_MEMSLOT_ADD:
1393 case QXL_IO_MEMSLOT_DEL:
1394 case QXL_IO_CREATE_PRIMARY:
81144d1a 1395 case QXL_IO_UPDATE_IRQ:
a3d14054 1396 case QXL_IO_LOG:
5ff4e36c
AL		 1397 case QXL_IO_MEMSLOT_ADD_ASYNC:
1398 case QXL_IO_CREATE_PRIMARY_ASYNC:
a19cbfb3
GH		 1399 break;
1400 default:
e21a298a 1401 if (d->mode != QXL_MODE_VGA) {
a19cbfb3 1402 break;
e21a298a 1403 }
c480bb7d
AL		 1404 trace_qxl_io_unexpected_vga_mode(d->id,
1405 io_port, io_port_to_string(io_port));
5ff4e36c
AL		 1406 /* be nice to buggy guest drivers */
1407 if (io_port >= QXL_IO_UPDATE_AREA_ASYNC &&
020af1c4 1408 io_port < QXL_IO_RANGE_SIZE) {
5ff4e36c
AL		 1409 qxl_send_events(d, QXL_INTERRUPT_IO_CMD);
1410 }
a19cbfb3
GH		 1411 return;
1412 }
1413
5ff4e36c
AL		 1414 /* we change the io_port to avoid ifdeffery in the main switch */
1415 orig_io_port = io_port;
1416 switch (io_port) {
1417 case QXL_IO_UPDATE_AREA_ASYNC:
1418 io_port = QXL_IO_UPDATE_AREA;
1419 goto async_common;
1420 case QXL_IO_MEMSLOT_ADD_ASYNC:
1421 io_port = QXL_IO_MEMSLOT_ADD;
1422 goto async_common;
1423 case QXL_IO_CREATE_PRIMARY_ASYNC:
1424 io_port = QXL_IO_CREATE_PRIMARY;
1425 goto async_common;
1426 case QXL_IO_DESTROY_PRIMARY_ASYNC:
1427 io_port = QXL_IO_DESTROY_PRIMARY;
1428 goto async_common;
1429 case QXL_IO_DESTROY_SURFACE_ASYNC:
1430 io_port = QXL_IO_DESTROY_SURFACE_WAIT;
1431 goto async_common;
1432 case QXL_IO_DESTROY_ALL_SURFACES_ASYNC:
1433 io_port = QXL_IO_DESTROY_ALL_SURFACES;
3e16b9c5
AL		 1434 goto async_common;
1435 case QXL_IO_FLUSH_SURFACES_ASYNC:
020af1c4 1436 case QXL_IO_MONITORS_CONFIG_ASYNC:
5ff4e36c
AL		 1437async_common:
1438 async = QXL_ASYNC;
1439 qemu_mutex_lock(&d->async_lock);
1440 if (d->current_async != QXL_UNDEFINED_IO) {
0a530548 1441 qxl_set_guest_bug(d, "%d async started before last (%d) complete",
5ff4e36c
AL		 1442 io_port, d->current_async);
1443 qemu_mutex_unlock(&d->async_lock);
1444 return;
1445 }
1446 d->current_async = orig_io_port;
1447 qemu_mutex_unlock(&d->async_lock);
5ff4e36c
AL		 1448 break;
1449 default:
1450 break;
1451 }
c480bb7d
AL		 1452 trace_qxl_io_write(d->id, qxl_mode_to_string(d->mode), addr, val, size,
1453 async);
5ff4e36c 1454
a19cbfb3
GH		 1455 switch (io_port) {
1456 case QXL_IO_UPDATE_AREA:
1457 {
81fb6f15 1458 QXLCookie *cookie = NULL;
a19cbfb3 1459 QXLRect update = d->ram->update_area;
81fb6f15 1460
ddd8fdc7 1461 if (d->ram->update_surface > d->ssd.num_surfaces) {
511b13e2
AL		 1462 qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
1463 d->ram->update_surface);
1464 return;
1465 }
1466 if (update.left >= update.right || update.top >= update.bottom) {
1467 qxl_set_guest_bug(d,
1468 "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
1469 update.left, update.top, update.right, update.bottom);
1470 return;
1471 }
1472
81fb6f15
AL		 1473 if (async == QXL_ASYNC) {
1474 cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
1475 QXL_IO_UPDATE_AREA_ASYNC);
1476 cookie->u.area = update;
1477 }
aee32bf3 1478 qxl_spice_update_area(d, d->ram->update_surface,
81fb6f15
AL		 1479 cookie ? &cookie->u.area : &update,
1480 NULL, 0, 0, async, cookie);
a19cbfb3
GH		 1481 break;
1482 }
1483 case QXL_IO_NOTIFY_CMD:
5c59d118 1484 qemu_spice_wakeup(&d->ssd);
a19cbfb3
GH		 1485 break;
1486 case QXL_IO_NOTIFY_CURSOR:
5c59d118 1487 qemu_spice_wakeup(&d->ssd);
a19cbfb3
GH		 1488 break;
1489 case QXL_IO_UPDATE_IRQ:
40010aea 1490 qxl_update_irq(d);
a19cbfb3
GH		 1491 break;
1492 case QXL_IO_NOTIFY_OOM:
a19cbfb3
GH		 1493 if (!SPICE_RING_IS_EMPTY(&d->ram->release_ring)) {
1494 break;
1495 }
1496 d->oom_running = 1;
aee32bf3 1497 qxl_spice_oom(d);
a19cbfb3
GH		 1498 d->oom_running = 0;
1499 break;
1500 case QXL_IO_SET_MODE:
a19cbfb3
GH		 1501 qxl_set_mode(d, val, 0);
1502 break;
1503 case QXL_IO_LOG:
1504 if (d->guestdebug) {
a680f7e7 1505 fprintf(stderr, "qxl/guest-%d: %" PRId64 ": %s", d->id,
6ebebb55 1506 qemu_get_clock_ns(vm_clock), d->ram->log_buf);
a19cbfb3
GH		 1507 }
1508 break;
1509 case QXL_IO_RESET:
a19cbfb3
GH		 1510 qxl_hard_reset(d, 0);
1511 break;
1512 case QXL_IO_MEMSLOT_ADD:
2bce0400 1513 if (val >= NUM_MEMSLOTS) {
0a530548 1514 qxl_set_guest_bug(d, "QXL_IO_MEMSLOT_ADD: val out of range");
2bce0400
GH		 1515 break;
1516 }
1517 if (d->guest_slots[val].active) {
0a530548
AL		 1518 qxl_set_guest_bug(d,
1519 "QXL_IO_MEMSLOT_ADD: memory slot already active");
2bce0400
GH		 1520 break;
1521 }
a19cbfb3 1522 d->guest_slots[val].slot = d->ram->mem_slot;
5ff4e36c 1523 qxl_add_memslot(d, val, 0, async);
a19cbfb3
GH		 1524 break;
1525 case QXL_IO_MEMSLOT_DEL:
2bce0400 1526 if (val >= NUM_MEMSLOTS) {
0a530548 1527 qxl_set_guest_bug(d, "QXL_IO_MEMSLOT_DEL: val out of range");
2bce0400
GH		 1528 break;
1529 }
a19cbfb3
GH		 1530 qxl_del_memslot(d, val);
1531 break;
1532 case QXL_IO_CREATE_PRIMARY:
2bce0400 1533 if (val != 0) {
0a530548 1534 qxl_set_guest_bug(d, "QXL_IO_CREATE_PRIMARY (async=%d): val != 0",
5ff4e36c
AL		 1535 async);
1536 goto cancel_async;
2bce0400 1537 }
a19cbfb3 1538 d->guest_primary.surface = d->ram->create_surface;
5ff4e36c 1539 qxl_create_guest_primary(d, 0, async);
a19cbfb3
GH		 1540 break;
1541 case QXL_IO_DESTROY_PRIMARY:
2bce0400 1542 if (val != 0) {
0a530548 1543 qxl_set_guest_bug(d, "QXL_IO_DESTROY_PRIMARY (async=%d): val != 0",
5ff4e36c
AL		 1544 async);
1545 goto cancel_async;
1546 }
5ff4e36c 1547 if (!qxl_destroy_primary(d, async)) {
c480bb7d
AL		 1548 trace_qxl_io_destroy_primary_ignored(d->id,
1549 qxl_mode_to_string(d->mode));
5ff4e36c 1550 goto cancel_async;
2bce0400 1551 }
a19cbfb3
GH		 1552 break;
1553 case QXL_IO_DESTROY_SURFACE_WAIT:
ddd8fdc7 1554 if (val >= d->ssd.num_surfaces) {
0a530548 1555 qxl_set_guest_bug(d, "QXL_IO_DESTROY_SURFACE (async=%d):"
5f8daf2e 1556 "%" PRIu64 " >= NUM_SURFACES", async, val);
5ff4e36c
AL		 1557 goto cancel_async;
1558 }
1559 qxl_spice_destroy_surface_wait(d, val, async);
a19cbfb3 1560 break;
3e16b9c5
AL		 1561 case QXL_IO_FLUSH_RELEASE: {
1562 QXLReleaseRing *ring = &d->ram->release_ring;
1563 if (ring->prod - ring->cons + 1 == ring->num_items) {
1564 fprintf(stderr,
1565 "ERROR: no flush, full release ring [p%d,%dc]\n",
1566 ring->prod, ring->cons);
1567 }
1568 qxl_push_free_res(d, 1 /* flush */);
3e16b9c5
AL		 1569 break;
1570 }
1571 case QXL_IO_FLUSH_SURFACES_ASYNC:
3e16b9c5
AL		 1572 qxl_spice_flush_surfaces_async(d);
1573 break;
a19cbfb3 1574 case QXL_IO_DESTROY_ALL_SURFACES:
5ff4e36c
AL		 1575 d->mode = QXL_MODE_UNDEFINED;
1576 qxl_spice_destroy_surfaces(d, async);
a19cbfb3 1577 break;
020af1c4
AL		 1578 case QXL_IO_MONITORS_CONFIG_ASYNC:
1579 qxl_spice_monitors_config_async(d, 0);
1580 break;
a19cbfb3 1581 default:
0a530548 1582 qxl_set_guest_bug(d, "%s: unexpected ioport=0x%x\n", __func__, io_port);
a19cbfb3 1583 }
5ff4e36c
AL		 1584 return;
1585cancel_async:
5ff4e36c
AL		 1586 if (async) {
1587 qxl_send_events(d, QXL_INTERRUPT_IO_CMD);
1588 qemu_mutex_lock(&d->async_lock);
1589 d->current_async = QXL_UNDEFINED_IO;
1590 qemu_mutex_unlock(&d->async_lock);
1591 }
a19cbfb3
GH		 1592}
1593
b1950430
AK		 1594static uint64_t ioport_read(void *opaque, target_phys_addr_t addr,
1595 unsigned size)
a19cbfb3
GH		 1596{
1597 PCIQXLDevice *d = opaque;
1598
c480bb7d 1599 trace_qxl_io_read_unexpected(d->id);
a19cbfb3
GH		 1600 return 0xff;
1601}
1602
b1950430
AK		 1603static const MemoryRegionOps qxl_io_ops = {
1604 .read = ioport_read,
1605 .write = ioport_write,
1606 .valid = {
1607 .min_access_size = 1,
1608 .max_access_size = 1,
1609 },
1610};
a19cbfb3
GH		 1611
1612static void pipe_read(void *opaque)
1613{
1614 PCIQXLDevice *d = opaque;
1615 char dummy;
1616 int len;
1617
1618 do {
1619 len = read(d->pipe[0], &dummy, sizeof(dummy));
1620 } while (len == sizeof(dummy));
40010aea 1621 qxl_update_irq(d);
a19cbfb3
GH		 1622}
1623
a19cbfb3
GH		 1624static void qxl_send_events(PCIQXLDevice *d, uint32_t events)
1625{
1626 uint32_t old_pending;
1627 uint32_t le_events = cpu_to_le32(events);
1628
71d388d4 1629 assert(qemu_spice_display_is_running(&d->ssd));
a19cbfb3
GH		 1630 old_pending = __sync_fetch_and_or(&d->ram->int_pending, le_events);
1631 if ((old_pending & le_events) == le_events) {
1632 return;
1633 }
691f5c7b 1634 if (qemu_thread_is_self(&d->main)) {
40010aea 1635 qxl_update_irq(d);
a19cbfb3
GH		 1636 } else {
1637 if (write(d->pipe[1], d, 1) != 1) {
75fe0d7b 1638 dprint(d, 1, "%s: write to pipe failed\n", __func__);
a19cbfb3
GH		 1639 }
1640 }
1641}
1642
1643static void init_pipe_signaling(PCIQXLDevice *d)
1644{
aa3db423
AL		 1645 if (pipe(d->pipe) < 0) {
1646 fprintf(stderr, "%s:%s: qxl pipe creation failed\n",
1647 __FILE__, __func__);
1648 exit(1);
1649 }
1650 fcntl(d->pipe[0], F_SETFL, O_NONBLOCK);
1651 fcntl(d->pipe[1], F_SETFL, O_NONBLOCK);
1652 fcntl(d->pipe[0], F_SETOWN, getpid());
1653
1654 qemu_thread_get_self(&d->main);
1655 qemu_set_fd_handler(d->pipe[0], pipe_read, NULL, d);
a19cbfb3
GH		 1656}
1657
1658/* graphics console */
1659
1660static void qxl_hw_update(void *opaque)
1661{
1662 PCIQXLDevice *qxl = opaque;
1663 VGACommonState *vga = &qxl->vga;
1664
1665 switch (qxl->mode) {
1666 case QXL_MODE_VGA:
1667 vga->update(vga);
1668 break;
1669 case QXL_MODE_COMPAT:
1670 case QXL_MODE_NATIVE:
1671 qxl_render_update(qxl);
1672 break;
1673 default:
1674 break;
1675 }
1676}
1677
1678static void qxl_hw_invalidate(void *opaque)
1679{
1680 PCIQXLDevice *qxl = opaque;
1681 VGACommonState *vga = &qxl->vga;
1682
1683 vga->invalidate(vga);
1684}
1685
d7098135
LC		 1686static void qxl_hw_screen_dump(void *opaque, const char *filename, bool cswitch,
1687 Error **errp)
a19cbfb3
GH		 1688{
1689 PCIQXLDevice *qxl = opaque;
1690 VGACommonState *vga = &qxl->vga;
1691
1692 switch (qxl->mode) {
1693 case QXL_MODE_COMPAT:
1694 case QXL_MODE_NATIVE:
1695 qxl_render_update(qxl);
d663174d 1696 ppm_save(filename, qxl->ssd.ds->surface, errp);
a19cbfb3
GH		 1697 break;
1698 case QXL_MODE_VGA:
d7098135 1699 vga->screen_dump(vga, filename, cswitch, errp);
a19cbfb3
GH		 1700 break;
1701 default:
1702 break;
1703 }
1704}
1705
1706static void qxl_hw_text_update(void *opaque, console_ch_t *chardata)
1707{
1708 PCIQXLDevice *qxl = opaque;
1709 VGACommonState *vga = &qxl->vga;
1710
1711 if (qxl->mode == QXL_MODE_VGA) {
1712 vga->text_update(vga, chardata);
1713 return;
1714 }
1715}
1716
e25139b3
YH		 1717static void qxl_dirty_surfaces(PCIQXLDevice *qxl)
1718{
1719 intptr_t vram_start;
1720 int i;
1721
2aa9e85c 1722 if (qxl->mode != QXL_MODE_NATIVE && qxl->mode != QXL_MODE_COMPAT) {
e25139b3
YH		 1723 return;
1724 }
1725
1726 /* dirty the primary surface */
1727 qxl_set_dirty(&qxl->vga.vram, qxl->shadow_rom.draw_area_offset,
1728 qxl->shadow_rom.surface0_area_size);
1729
1730 vram_start = (intptr_t)memory_region_get_ram_ptr(&qxl->vram_bar);
1731
1732 /* dirty the off-screen surfaces */
ddd8fdc7 1733 for (i = 0; i < qxl->ssd.num_surfaces; i++) {
e25139b3
YH		 1734 QXLSurfaceCmd *cmd;
1735 intptr_t surface_offset;
1736 int surface_size;
1737
1738 if (qxl->guest_surfaces.cmds[i] == 0) {
1739 continue;
1740 }
1741
1742 cmd = qxl_phys2virt(qxl, qxl->guest_surfaces.cmds[i],
1743 MEMSLOT_GROUP_GUEST);
fae2afb1 1744 assert(cmd);
e25139b3
YH		 1745 assert(cmd->type == QXL_SURFACE_CMD_CREATE);
1746 surface_offset = (intptr_t)qxl_phys2virt(qxl,
1747 cmd->u.surface_create.data,
1748 MEMSLOT_GROUP_GUEST);
fae2afb1 1749 assert(surface_offset);
e25139b3
YH		 1750 surface_offset -= vram_start;
1751 surface_size = cmd->u.surface_create.height *
1752 abs(cmd->u.surface_create.stride);
c480bb7d 1753 trace_qxl_surfaces_dirty(qxl->id, i, (int)surface_offset, surface_size);
e25139b3
YH		 1754 qxl_set_dirty(&qxl->vram_bar, surface_offset, surface_size);
1755 }
1756}
1757
1dfb4dd9
LC		 1758static void qxl_vm_change_state_handler(void *opaque, int running,
1759 RunState state)
a19cbfb3
GH		 1760{
1761 PCIQXLDevice *qxl = opaque;
1dfb4dd9 1762 qemu_spice_vm_change_state_handler(&qxl->ssd, running, state);
a19cbfb3 1763
efbf2950
YH		 1764 if (running) {
1765 /*
1766 * if qxl_send_events was called from spice server context before
40010aea 1767 * migration ended, qxl_update_irq for these events might not have been
efbf2950
YH		 1768 * called
1769 */
40010aea 1770 qxl_update_irq(qxl);
e25139b3
YH		 1771 } else {
1772 /* make sure surfaces are saved before migration */
1773 qxl_dirty_surfaces(qxl);
a19cbfb3
GH		 1774 }
1775}
1776
1777/* display change listener */
1778
1779static void display_update(struct DisplayState *ds, int x, int y, int w, int h)
1780{
1781 if (qxl0->mode == QXL_MODE_VGA) {
1782 qemu_spice_display_update(&qxl0->ssd, x, y, w, h);
1783 }
1784}
1785
1786static void display_resize(struct DisplayState *ds)
1787{
1788 if (qxl0->mode == QXL_MODE_VGA) {
1789 qemu_spice_display_resize(&qxl0->ssd);
1790 }
1791}
1792
1793static void display_refresh(struct DisplayState *ds)
1794{
1795 if (qxl0->mode == QXL_MODE_VGA) {
1796 qemu_spice_display_refresh(&qxl0->ssd);
bb5a8cd5
AL		 1797 } else {
1798 qemu_mutex_lock(&qxl0->ssd.lock);
1799 qemu_spice_cursor_refresh_unlocked(&qxl0->ssd);
1800 qemu_mutex_unlock(&qxl0->ssd.lock);
a19cbfb3
GH		 1801 }
1802}
1803
1804static DisplayChangeListener display_listener = {
1805 .dpy_update = display_update,
1806 .dpy_resize = display_resize,
1807 .dpy_refresh = display_refresh,
1808};
1809
13d1fd44 1810static void qxl_init_ramsize(PCIQXLDevice *qxl)
a974192c 1811{
13d1fd44
AL		 1812 /* vga mode framebuffer / primary surface (bar 0, first part) */
1813 if (qxl->vgamem_size_mb < 8) {
1814 qxl->vgamem_size_mb = 8;
1815 }
1816 qxl->vgamem_size = qxl->vgamem_size_mb * 1024 * 1024;
1817
1818 /* vga ram (bar 0, total) */
017438ee
GH		 1819 if (qxl->ram_size_mb != -1) {
1820 qxl->vga.vram_size = qxl->ram_size_mb * 1024 * 1024;
1821 }
13d1fd44
AL		 1822 if (qxl->vga.vram_size < qxl->vgamem_size * 2) {
1823 qxl->vga.vram_size = qxl->vgamem_size * 2;
a974192c
GH		 1824 }
1825
6f2b175a
GH		 1826 /* vram32 (surfaces, 32bit, bar 1) */
1827 if (qxl->vram32_size_mb != -1) {
1828 qxl->vram32_size = qxl->vram32_size_mb * 1024 * 1024;
1829 }
1830 if (qxl->vram32_size < 4096) {
1831 qxl->vram32_size = 4096;
1832 }
1833
1834 /* vram (surfaces, 64bit, bar 4+5) */
017438ee
GH		 1835 if (qxl->vram_size_mb != -1) {
1836 qxl->vram_size = qxl->vram_size_mb * 1024 * 1024;
1837 }
6f2b175a
GH		 1838 if (qxl->vram_size < qxl->vram32_size) {
1839 qxl->vram_size = qxl->vram32_size;
a974192c 1840 }
6f2b175a 1841
a974192c 1842 if (qxl->revision == 1) {
6f2b175a 1843 qxl->vram32_size = 4096;
a974192c
GH		 1844 qxl->vram_size = 4096;
1845 }
13d1fd44 1846 qxl->vgamem_size = msb_mask(qxl->vgamem_size * 2 - 1);
a974192c 1847 qxl->vga.vram_size = msb_mask(qxl->vga.vram_size * 2 - 1);
6f2b175a 1848 qxl->vram32_size = msb_mask(qxl->vram32_size * 2 - 1);
a974192c
GH		 1849 qxl->vram_size = msb_mask(qxl->vram_size * 2 - 1);
1850}
1851
a19cbfb3
GH		 1852static int qxl_init_common(PCIQXLDevice *qxl)
1853{
1854 uint8_t* config = qxl->pci.config;
a19cbfb3
GH		 1855 uint32_t pci_device_rev;
1856 uint32_t io_size;
1857
1858 qxl->mode = QXL_MODE_UNDEFINED;
1859 qxl->generation = 1;
1860 qxl->num_memslots = NUM_MEMSLOTS;
14898cf6 1861 qemu_mutex_init(&qxl->track_lock);
5ff4e36c
AL		 1862 qemu_mutex_init(&qxl->async_lock);
1863 qxl->current_async = QXL_UNDEFINED_IO;
087e6a42 1864 qxl->guest_bug = 0;
a19cbfb3
GH		 1865
1866 switch (qxl->revision) {
1867 case 1: /* spice 0.4 -- qxl-1 */
a19cbfb3 1868 pci_device_rev = QXL_REVISION_STABLE_V04;
3f6297b9 1869 io_size = 8;
a19cbfb3
GH		 1870 break;
1871 case 2: /* spice 0.6 -- qxl-2 */
a19cbfb3 1872 pci_device_rev = QXL_REVISION_STABLE_V06;
3f6297b9 1873 io_size = 16;
a19cbfb3 1874 break;
9197a7c8 1875 case 3: /* qxl-3 */
020af1c4
AL		 1876 pci_device_rev = QXL_REVISION_STABLE_V10;
1877 io_size = 32; /* PCI region size must be pow2 */
1878 break;
1879/* 0x000b01 == 0.11.1 */
1880#if SPICE_SERVER_VERSION >= 0x000b01 && \
1881 defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
1882 case 4: /* qxl-4 */
1883 pci_device_rev = QXL_REVISION_STABLE_V12;
3f6297b9 1884 io_size = msb_mask(QXL_IO_RANGE_SIZE * 2 - 1);
9197a7c8 1885 break;
020af1c4 1886#endif
36839d35
AL		 1887 default:
1888 error_report("Invalid revision %d for qxl device (max %d)",
1889 qxl->revision, QXL_DEFAULT_REVISION);
1890 return -1;
a19cbfb3
GH		 1891 }
1892
a19cbfb3
GH		 1893 pci_set_byte(&config[PCI_REVISION_ID], pci_device_rev);
1894 pci_set_byte(&config[PCI_INTERRUPT_PIN], 1);
1895
1896 qxl->rom_size = qxl_rom_size();
c5705a77
AK		 1897 memory_region_init_ram(&qxl->rom_bar, "qxl.vrom", qxl->rom_size);
1898 vmstate_register_ram(&qxl->rom_bar, &qxl->pci.qdev);
a19cbfb3
GH		 1899 init_qxl_rom(qxl);
1900 init_qxl_ram(qxl);
1901
ddd8fdc7 1902 qxl->guest_surfaces.cmds = g_new0(QXLPHYSICAL, qxl->ssd.num_surfaces);
c5705a77
AK		 1903 memory_region_init_ram(&qxl->vram_bar, "qxl.vram", qxl->vram_size);
1904 vmstate_register_ram(&qxl->vram_bar, &qxl->pci.qdev);
6f2b175a
GH		 1905 memory_region_init_alias(&qxl->vram32_bar, "qxl.vram32", &qxl->vram_bar,
1906 0, qxl->vram32_size);
a19cbfb3 1907
b1950430
AK		 1908 memory_region_init_io(&qxl->io_bar, &qxl_io_ops, qxl,
1909 "qxl-ioports", io_size);
1910 if (qxl->id == 0) {
1911 vga_dirty_log_start(&qxl->vga);
1912 }
1913
1914
e824b2cc
AK		 1915 pci_register_bar(&qxl->pci, QXL_IO_RANGE_INDEX,
1916 PCI_BASE_ADDRESS_SPACE_IO, &qxl->io_bar);
a19cbfb3 1917
e824b2cc
AK		 1918 pci_register_bar(&qxl->pci, QXL_ROM_RANGE_INDEX,
1919 PCI_BASE_ADDRESS_SPACE_MEMORY, &qxl->rom_bar);
a19cbfb3 1920
e824b2cc
AK		 1921 pci_register_bar(&qxl->pci, QXL_RAM_RANGE_INDEX,
1922 PCI_BASE_ADDRESS_SPACE_MEMORY, &qxl->vga.vram);
a19cbfb3 1923
e824b2cc 1924 pci_register_bar(&qxl->pci, QXL_VRAM_RANGE_INDEX,
6f2b175a
GH		 1925 PCI_BASE_ADDRESS_SPACE_MEMORY, &qxl->vram32_bar);
1926
1927 if (qxl->vram32_size < qxl->vram_size) {
1928 /*
1929 * Make the 64bit vram bar show up only in case it is
1930 * configured to be larger than the 32bit vram bar.
1931 */
1932 pci_register_bar(&qxl->pci, QXL_VRAM64_RANGE_INDEX,
1933 PCI_BASE_ADDRESS_SPACE_MEMORY |
1934 PCI_BASE_ADDRESS_MEM_TYPE_64 |
1935 PCI_BASE_ADDRESS_MEM_PREFETCH,
1936 &qxl->vram_bar);
1937 }
1938
1939 /* print pci bar details */
1940 dprint(qxl, 1, "ram/%s: %d MB [region 0]\n",
1941 qxl->id == 0 ? "pri" : "sec",
1942 qxl->vga.vram_size / (1024*1024));
1943 dprint(qxl, 1, "vram/32: %d MB [region 1]\n",
1944 qxl->vram32_size / (1024*1024));
1945 dprint(qxl, 1, "vram/64: %d MB %s\n",
1946 qxl->vram_size / (1024*1024),
1947 qxl->vram32_size < qxl->vram_size ? "[region 4]" : "[unmapped]");
a19cbfb3
GH		 1948
1949 qxl->ssd.qxl.base.sif = &qxl_interface.base;
1950 qxl->ssd.qxl.id = qxl->id;
1951 qemu_spice_add_interface(&qxl->ssd.qxl.base);
1952 qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl);
1953
1954 init_pipe_signaling(qxl);
1955 qxl_reset_state(qxl);
1956
81fb6f15
AL		 1957 qxl->update_area_bh = qemu_bh_new(qxl_render_update_area_bh, qxl);
1958
a19cbfb3
GH		 1959 return 0;
1960}
1961
1962static int qxl_init_primary(PCIDevice *dev)
1963{
1964 PCIQXLDevice *qxl = DO_UPCAST(PCIQXLDevice, pci, dev);
1965 VGACommonState *vga = &qxl->vga;
f67ab77a 1966 PortioList *qxl_vga_port_list = g_new(PortioList, 1);
a19cbfb3
GH		 1967
1968 qxl->id = 0;
13d1fd44 1969 qxl_init_ramsize(qxl);
4a1e244e
GH		 1970 vga->vram_size_mb = qxl->vga.vram_size >> 20;
1971 vga_common_init(vga);
0a039dc7 1972 vga_init(vga, pci_address_space(dev), pci_address_space_io(dev), false);
f67ab77a
GH		 1973 portio_list_init(qxl_vga_port_list, qxl_vga_portio_list, vga, "vga");
1974 portio_list_add(qxl_vga_port_list, pci_address_space_io(dev), 0x3b0);
a19cbfb3
GH		 1975
1976 vga->ds = graphic_console_init(qxl_hw_update, qxl_hw_invalidate,
1977 qxl_hw_screen_dump, qxl_hw_text_update, qxl);
a963f876 1978 qemu_spice_display_init_common(&qxl->ssd, vga->ds);
a19cbfb3
GH		 1979
1980 qxl0 = qxl;
1981 register_displaychangelistener(vga->ds, &display_listener);
1982
a19cbfb3
GH		 1983 return qxl_init_common(qxl);
1984}
1985
1986static int qxl_init_secondary(PCIDevice *dev)
1987{
1988 static int device_id = 1;
1989 PCIQXLDevice *qxl = DO_UPCAST(PCIQXLDevice, pci, dev);
a19cbfb3
GH		 1990
1991 qxl->id = device_id++;
13d1fd44 1992 qxl_init_ramsize(qxl);
c5705a77
AK		 1993 memory_region_init_ram(&qxl->vga.vram, "qxl.vgavram", qxl->vga.vram_size);
1994 vmstate_register_ram(&qxl->vga.vram, &qxl->pci.qdev);
b1950430 1995 qxl->vga.vram_ptr = memory_region_get_ram_ptr(&qxl->vga.vram);
a19cbfb3 1996
a19cbfb3
GH		 1997 return qxl_init_common(qxl);
1998}
1999
2000static void qxl_pre_save(void *opaque)
2001{
2002 PCIQXLDevice* d = opaque;
2003 uint8_t *ram_start = d->vga.vram_ptr;
2004
c480bb7d 2005 trace_qxl_pre_save(d->id);
a19cbfb3
GH		 2006 if (d->last_release == NULL) {
2007 d->last_release_offset = 0;
2008 } else {
2009 d->last_release_offset = (uint8_t *)d->last_release - ram_start;
2010 }
2011 assert(d->last_release_offset < d->vga.vram_size);
2012}
2013
2014static int qxl_pre_load(void *opaque)
2015{
2016 PCIQXLDevice* d = opaque;
2017
c480bb7d 2018 trace_qxl_pre_load(d->id);
a19cbfb3
GH		 2019 qxl_hard_reset(d, 1);
2020 qxl_exit_vga_mode(d);
a19cbfb3
GH		 2021 return 0;
2022}
2023
54825d2e
AL		 2024static void qxl_create_memslots(PCIQXLDevice *d)
2025{
2026 int i;
2027
2028 for (i = 0; i < NUM_MEMSLOTS; i++) {
2029 if (!d->guest_slots[i].active) {
2030 continue;
2031 }
54825d2e
AL		 2032 qxl_add_memslot(d, i, 0, QXL_SYNC);
2033 }
2034}
2035
a19cbfb3
GH		 2036static int qxl_post_load(void *opaque, int version)
2037{
2038 PCIQXLDevice* d = opaque;
2039 uint8_t *ram_start = d->vga.vram_ptr;
2040 QXLCommandExt *cmds;
54825d2e 2041 int in, out, newmode;
a19cbfb3 2042
a19cbfb3
GH		 2043 assert(d->last_release_offset < d->vga.vram_size);
2044 if (d->last_release_offset == 0) {
2045 d->last_release = NULL;
2046 } else {
2047 d->last_release = (QXLReleaseInfo *)(ram_start + d->last_release_offset);
2048 }
2049
2050 d->modes = (QXLModes*)((uint8_t*)d->rom + d->rom->modes_offset);
2051
c480bb7d 2052 trace_qxl_post_load(d->id, qxl_mode_to_string(d->mode));
a19cbfb3
GH		 2053 newmode = d->mode;
2054 d->mode = QXL_MODE_UNDEFINED;
54825d2e 2055
a19cbfb3
GH		 2056 switch (newmode) {
2057 case QXL_MODE_UNDEFINED:
2058 break;
2059 case QXL_MODE_VGA:
54825d2e 2060 qxl_create_memslots(d);
a19cbfb3
GH		 2061 qxl_enter_vga_mode(d);
2062 break;
2063 case QXL_MODE_NATIVE:
54825d2e 2064 qxl_create_memslots(d);
5ff4e36c 2065 qxl_create_guest_primary(d, 1, QXL_SYNC);
a19cbfb3
GH		 2066
2067 /* replay surface-create and cursor-set commands */
ddd8fdc7
GH		 2068 cmds = g_malloc0(sizeof(QXLCommandExt) * (d->ssd.num_surfaces + 1));
2069 for (in = 0, out = 0; in < d->ssd.num_surfaces; in++) {
a19cbfb3
GH		 2070 if (d->guest_surfaces.cmds[in] == 0) {
2071 continue;
2072 }
2073 cmds[out].cmd.data = d->guest_surfaces.cmds[in];
2074 cmds[out].cmd.type = QXL_CMD_SURFACE;
2075 cmds[out].group_id = MEMSLOT_GROUP_GUEST;
2076 out++;
2077 }
30f6da66
YH		 2078 if (d->guest_cursor) {
2079 cmds[out].cmd.data = d->guest_cursor;
2080 cmds[out].cmd.type = QXL_CMD_CURSOR;
2081 cmds[out].group_id = MEMSLOT_GROUP_GUEST;
2082 out++;
2083 }
aee32bf3 2084 qxl_spice_loadvm_commands(d, cmds, out);
7267c094 2085 g_free(cmds);
020af1c4
AL		 2086 if (d->guest_monitors_config) {
2087 qxl_spice_monitors_config_async(d, 1);
2088 }
a19cbfb3
GH		 2089 break;
2090 case QXL_MODE_COMPAT:
54825d2e
AL		 2091 /* note: no need to call qxl_create_memslots, qxl_set_mode
2092 * creates the mem slot. */
a19cbfb3
GH		 2093 qxl_set_mode(d, d->shadow_rom.mode, 1);
2094 break;
2095 }
a19cbfb3
GH		 2096 return 0;
2097}
2098
b67737a6 2099#define QXL_SAVE_VERSION 21
a19cbfb3 2100
020af1c4
AL		 2101static bool qxl_monitors_config_needed(void *opaque)
2102{
2103 PCIQXLDevice *qxl = opaque;
2104
2105 return qxl->guest_monitors_config != 0;
2106}
2107
2108
a19cbfb3
GH		 2109static VMStateDescription qxl_memslot = {
2110 .name = "qxl-memslot",
2111 .version_id = QXL_SAVE_VERSION,
2112 .minimum_version_id = QXL_SAVE_VERSION,
2113 .fields = (VMStateField[]) {
2114 VMSTATE_UINT64(slot.mem_start, struct guest_slots),
2115 VMSTATE_UINT64(slot.mem_end, struct guest_slots),
2116 VMSTATE_UINT32(active, struct guest_slots),
2117 VMSTATE_END_OF_LIST()
2118 }
2119};
2120
2121static VMStateDescription qxl_surface = {
2122 .name = "qxl-surface",
2123 .version_id = QXL_SAVE_VERSION,
2124 .minimum_version_id = QXL_SAVE_VERSION,
2125 .fields = (VMStateField[]) {
2126 VMSTATE_UINT32(width, QXLSurfaceCreate),
2127 VMSTATE_UINT32(height, QXLSurfaceCreate),
2128 VMSTATE_INT32(stride, QXLSurfaceCreate),
2129 VMSTATE_UINT32(format, QXLSurfaceCreate),
2130 VMSTATE_UINT32(position, QXLSurfaceCreate),
2131 VMSTATE_UINT32(mouse_mode, QXLSurfaceCreate),
2132 VMSTATE_UINT32(flags, QXLSurfaceCreate),
2133 VMSTATE_UINT32(type, QXLSurfaceCreate),
2134 VMSTATE_UINT64(mem, QXLSurfaceCreate),
2135 VMSTATE_END_OF_LIST()
2136 }
2137};
2138
020af1c4
AL		 2139static VMStateDescription qxl_vmstate_monitors_config = {
2140 .name = "qxl/monitors-config",
2141 .version_id = 1,
2142 .minimum_version_id = 1,
2143 .fields = (VMStateField[]) {
2144 VMSTATE_UINT64(guest_monitors_config, PCIQXLDevice),
2145 VMSTATE_END_OF_LIST()
2146 },
2147};
2148
a19cbfb3
GH		 2149static VMStateDescription qxl_vmstate = {
2150 .name = "qxl",
2151 .version_id = QXL_SAVE_VERSION,
2152 .minimum_version_id = QXL_SAVE_VERSION,
2153 .pre_save = qxl_pre_save,
2154 .pre_load = qxl_pre_load,
2155 .post_load = qxl_post_load,
020af1c4 2156 .fields = (VMStateField[]) {
a19cbfb3
GH		 2157 VMSTATE_PCI_DEVICE(pci, PCIQXLDevice),
2158 VMSTATE_STRUCT(vga, PCIQXLDevice, 0, vmstate_vga_common, VGACommonState),
2159 VMSTATE_UINT32(shadow_rom.mode, PCIQXLDevice),
2160 VMSTATE_UINT32(num_free_res, PCIQXLDevice),
2161 VMSTATE_UINT32(last_release_offset, PCIQXLDevice),
2162 VMSTATE_UINT32(mode, PCIQXLDevice),
2163 VMSTATE_UINT32(ssd.unique, PCIQXLDevice),
b67737a6
GH		 2164 VMSTATE_INT32_EQUAL(num_memslots, PCIQXLDevice),
2165 VMSTATE_STRUCT_ARRAY(guest_slots, PCIQXLDevice, NUM_MEMSLOTS, 0,
2166 qxl_memslot, struct guest_slots),
2167 VMSTATE_STRUCT(guest_primary.surface, PCIQXLDevice, 0,
2168 qxl_surface, QXLSurfaceCreate),
ddd8fdc7
GH		 2169 VMSTATE_INT32_EQUAL(ssd.num_surfaces, PCIQXLDevice),
2170 VMSTATE_VARRAY_INT32(guest_surfaces.cmds, PCIQXLDevice,
2171 ssd.num_surfaces, 0,
2172 vmstate_info_uint64, uint64_t),
b67737a6 2173 VMSTATE_UINT64(guest_cursor, PCIQXLDevice),
a19cbfb3
GH		 2174 VMSTATE_END_OF_LIST()
2175 },
020af1c4
AL		 2176 .subsections = (VMStateSubsection[]) {
2177 {
2178 .vmsd = &qxl_vmstate_monitors_config,
2179 .needed = qxl_monitors_config_needed,
2180 }, {
2181 /* empty */
2182 }
2183 }
a19cbfb3
GH		 2184};
2185
78e60ba5
GH		 2186static Property qxl_properties[] = {
2187 DEFINE_PROP_UINT32("ram_size", PCIQXLDevice, vga.vram_size,
2188 64 * 1024 * 1024),
6f2b175a 2189 DEFINE_PROP_UINT32("vram_size", PCIQXLDevice, vram32_size,
78e60ba5
GH		 2190 64 * 1024 * 1024),
2191 DEFINE_PROP_UINT32("revision", PCIQXLDevice, revision,
2192 QXL_DEFAULT_REVISION),
2193 DEFINE_PROP_UINT32("debug", PCIQXLDevice, debug, 0),
2194 DEFINE_PROP_UINT32("guestdebug", PCIQXLDevice, guestdebug, 0),
2195 DEFINE_PROP_UINT32("cmdlog", PCIQXLDevice, cmdlog, 0),
017438ee 2196 DEFINE_PROP_UINT32("ram_size_mb", PCIQXLDevice, ram_size_mb, -1),
79ce3567
AL		 2197 DEFINE_PROP_UINT32("vram_size_mb", PCIQXLDevice, vram32_size_mb, -1),
2198 DEFINE_PROP_UINT32("vram64_size_mb", PCIQXLDevice, vram_size_mb, -1),
9e56edcf 2199 DEFINE_PROP_UINT32("vgamem_mb", PCIQXLDevice, vgamem_size_mb, 16),
ddd8fdc7 2200 DEFINE_PROP_INT32("surfaces", PCIQXLDevice, ssd.num_surfaces, 1024),
78e60ba5
GH		 2201 DEFINE_PROP_END_OF_LIST(),
2202};
2203
40021f08
AL		 2204static void qxl_primary_class_init(ObjectClass *klass, void *data)
2205{
39bffca2 2206 DeviceClass *dc = DEVICE_CLASS(klass);
40021f08
AL		 2207 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2208
2209 k->no_hotplug = 1;
2210 k->init = qxl_init_primary;
2211 k->romfile = "vgabios-qxl.bin";
2212 k->vendor_id = REDHAT_PCI_VENDOR_ID;
2213 k->device_id = QXL_DEVICE_ID_STABLE;
2214 k->class_id = PCI_CLASS_DISPLAY_VGA;
39bffca2
AL		 2215 dc->desc = "Spice QXL GPU (primary, vga compatible)";
2216 dc->reset = qxl_reset_handler;
2217 dc->vmsd = &qxl_vmstate;
2218 dc->props = qxl_properties;
40021f08
AL		 2219}
2220
39bffca2
AL		 2221static TypeInfo qxl_primary_info = {
2222 .name = "qxl-vga",
2223 .parent = TYPE_PCI_DEVICE,
2224 .instance_size = sizeof(PCIQXLDevice),
2225 .class_init = qxl_primary_class_init,
a19cbfb3
GH		 2226};
2227
40021f08
AL		 2228static void qxl_secondary_class_init(ObjectClass *klass, void *data)
2229{
39bffca2 2230 DeviceClass *dc = DEVICE_CLASS(klass);
40021f08
AL		 2231 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2232
2233 k->init = qxl_init_secondary;
2234 k->vendor_id = REDHAT_PCI_VENDOR_ID;
2235 k->device_id = QXL_DEVICE_ID_STABLE;
2236 k->class_id = PCI_CLASS_DISPLAY_OTHER;
39bffca2
AL		 2237 dc->desc = "Spice QXL GPU (secondary)";
2238 dc->reset = qxl_reset_handler;
2239 dc->vmsd = &qxl_vmstate;
2240 dc->props = qxl_properties;
40021f08
AL		 2241}
2242
39bffca2
AL		 2243static TypeInfo qxl_secondary_info = {
2244 .name = "qxl",
2245 .parent = TYPE_PCI_DEVICE,
2246 .instance_size = sizeof(PCIQXLDevice),
2247 .class_init = qxl_secondary_class_init,
a19cbfb3
GH		 2248};
2249
83f7d43a 2250static void qxl_register_types(void)
a19cbfb3 2251{
39bffca2
AL		 2252 type_register_static(&qxl_primary_info);
2253 type_register_static(&qxl_secondary_info);
a19cbfb3
GH		 2254}
2255
83f7d43a 2256type_init(qxl_register_types)
Empty description
This page took 0.615455 seconds and 4 git commands to generate.