Statistics
| Branch: | Revision:

root / hw / qxl.c @ 265db734

History | View | Annotate | Download (72 kB)

1
/*
2
 * Copyright (C) 2010 Red Hat, Inc.
3
 *
4
 * written by Yaniv Kamay, Izik Eidus, Gerd Hoffmann
5
 * maintained by Gerd Hoffmann <kraxel@redhat.com>
6
 *
7
 * This program is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU General Public License as
9
 * published by the Free Software Foundation; either version 2 or
10
 * (at your option) version 3 of the License.
11
 *
12
 * This program is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15
 * GNU General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU General Public License
18
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19
 */
20

    
21
#include "qemu-common.h"
22
#include "qemu-timer.h"
23
#include "qemu-queue.h"
24
#include "monitor.h"
25
#include "sysemu.h"
26
#include "trace.h"
27

    
28
#include "qxl.h"
29

    
30
#ifndef CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC
31
/* spice-protocol is too old, add missing definitions */
32
#define QXL_IO_MONITORS_CONFIG_ASYNC (QXL_IO_FLUSH_RELEASE + 1)
33
#endif
34

    
35
/*
36
 * NOTE: SPICE_RING_PROD_ITEM accesses memory on the pci bar and as
37
 * such can be changed by the guest, so to avoid a guest trigerrable
38
 * abort we just qxl_set_guest_bug and set the return to NULL. Still
39
 * it may happen as a result of emulator bug as well.
40
 */
41
#undef SPICE_RING_PROD_ITEM
42
#define SPICE_RING_PROD_ITEM(qxl, r, ret) {                             \
43
        typeof(r) start = r;                                            \
44
        typeof(r) end = r + 1;                                          \
45
        uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r);           \
46
        typeof(&(r)->items[prod]) m_item = &(r)->items[prod];           \
47
        if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
48
            qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch " \
49
                          "! %p <= %p < %p", (uint8_t *)start,          \
50
                          (uint8_t *)m_item, (uint8_t *)end);           \
51
            ret = NULL;                                                 \
52
        } else {                                                        \
53
            ret = &m_item->el;                                          \
54
        }                                                               \
55
    }
56

    
57
#undef SPICE_RING_CONS_ITEM
58
#define SPICE_RING_CONS_ITEM(qxl, r, ret) {                             \
59
        typeof(r) start = r;                                            \
60
        typeof(r) end = r + 1;                                          \
61
        uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r);           \
62
        typeof(&(r)->items[cons]) m_item = &(r)->items[cons];           \
63
        if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
64
            qxl_set_guest_bug(qxl, "SPICE_RING_CONS_ITEM indices mismatch " \
65
                          "! %p <= %p < %p", (uint8_t *)start,          \
66
                          (uint8_t *)m_item, (uint8_t *)end);           \
67
            ret = NULL;                                                 \
68
        } else {                                                        \
69
            ret = &m_item->el;                                          \
70
        }                                                               \
71
    }
72

    
73
#undef ALIGN
74
#define ALIGN(a, b) (((a) + ((b) - 1)) & ~((b) - 1))
75

    
76
#define PIXEL_SIZE 0.2936875 //1280x1024 is 14.8" x 11.9" 
77

    
78
#define QXL_MODE(_x, _y, _b, _o)                  \
79
    {   .x_res = _x,                              \
80
        .y_res = _y,                              \
81
        .bits  = _b,                              \
82
        .stride = (_x) * (_b) / 8,                \
83
        .x_mili = PIXEL_SIZE * (_x),              \
84
        .y_mili = PIXEL_SIZE * (_y),              \
85
        .orientation = _o,                        \
86
    }
87

    
88
#define QXL_MODE_16_32(x_res, y_res, orientation) \
89
    QXL_MODE(x_res, y_res, 16, orientation),      \
90
    QXL_MODE(x_res, y_res, 32, orientation)
91

    
92
#define QXL_MODE_EX(x_res, y_res)                 \
93
    QXL_MODE_16_32(x_res, y_res, 0),              \
94
    QXL_MODE_16_32(y_res, x_res, 1),              \
95
    QXL_MODE_16_32(x_res, y_res, 2),              \
96
    QXL_MODE_16_32(y_res, x_res, 3)
97

    
98
static QXLMode qxl_modes[] = {
99
    QXL_MODE_EX(640, 480),
100
    QXL_MODE_EX(800, 480),
101
    QXL_MODE_EX(800, 600),
102
    QXL_MODE_EX(832, 624),
103
    QXL_MODE_EX(960, 640),
104
    QXL_MODE_EX(1024, 600),
105
    QXL_MODE_EX(1024, 768),
106
    QXL_MODE_EX(1152, 864),
107
    QXL_MODE_EX(1152, 870),
108
    QXL_MODE_EX(1280, 720),
109
    QXL_MODE_EX(1280, 760),
110
    QXL_MODE_EX(1280, 768),
111
    QXL_MODE_EX(1280, 800),
112
    QXL_MODE_EX(1280, 960),
113
    QXL_MODE_EX(1280, 1024),
114
    QXL_MODE_EX(1360, 768),
115
    QXL_MODE_EX(1366, 768),
116
    QXL_MODE_EX(1400, 1050),
117
    QXL_MODE_EX(1440, 900),
118
    QXL_MODE_EX(1600, 900),
119
    QXL_MODE_EX(1600, 1200),
120
    QXL_MODE_EX(1680, 1050),
121
    QXL_MODE_EX(1920, 1080),
122
    /* these modes need more than 8 MB video memory */
123
    QXL_MODE_EX(1920, 1200),
124
    QXL_MODE_EX(1920, 1440),
125
    QXL_MODE_EX(2048, 1536),
126
    QXL_MODE_EX(2560, 1440),
127
    QXL_MODE_EX(2560, 1600),
128
    /* these modes need more than 16 MB video memory */
129
    QXL_MODE_EX(2560, 2048),
130
    QXL_MODE_EX(2800, 2100),
131
    QXL_MODE_EX(3200, 2400),
132
};
133

    
134
static PCIQXLDevice *qxl0;
135

    
136
static void qxl_send_events(PCIQXLDevice *d, uint32_t events);
137
static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async);
138
static void qxl_reset_memslots(PCIQXLDevice *d);
139
static void qxl_reset_surfaces(PCIQXLDevice *d);
140
static void qxl_ring_set_dirty(PCIQXLDevice *qxl);
141

    
142
void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...)
143
{
144
    qxl_send_events(qxl, QXL_INTERRUPT_ERROR);
145
    qxl->guest_bug = 1;
146
    if (qxl->guestdebug) {
147
        va_list ap;
148
        va_start(ap, msg);
149
        fprintf(stderr, "qxl-%d: guest bug: ", qxl->id);
150
        vfprintf(stderr, msg, ap);
151
        fprintf(stderr, "\n");
152
        va_end(ap);
153
    }
154
}
155

    
156
static void qxl_clear_guest_bug(PCIQXLDevice *qxl)
157
{
158
    qxl->guest_bug = 0;
159
}
160

    
161
void qxl_spice_update_area(PCIQXLDevice *qxl, uint32_t surface_id,
162
                           struct QXLRect *area, struct QXLRect *dirty_rects,
163
                           uint32_t num_dirty_rects,
164
                           uint32_t clear_dirty_region,
165
                           qxl_async_io async, struct QXLCookie *cookie)
166
{
167
    trace_qxl_spice_update_area(qxl->id, surface_id, area->left, area->right,
168
                                area->top, area->bottom);
169
    trace_qxl_spice_update_area_rest(qxl->id, num_dirty_rects,
170
                                     clear_dirty_region);
171
    if (async == QXL_SYNC) {
172
        qxl->ssd.worker->update_area(qxl->ssd.worker, surface_id, area,
173
                        dirty_rects, num_dirty_rects, clear_dirty_region);
174
    } else {
175
        assert(cookie != NULL);
176
        spice_qxl_update_area_async(&qxl->ssd.qxl, surface_id, area,
177
                                    clear_dirty_region, (uintptr_t)cookie);
178
    }
179
}
180

    
181
static void qxl_spice_destroy_surface_wait_complete(PCIQXLDevice *qxl,
182
                                                    uint32_t id)
183
{
184
    trace_qxl_spice_destroy_surface_wait_complete(qxl->id, id);
185
    qemu_mutex_lock(&qxl->track_lock);
186
    qxl->guest_surfaces.cmds[id] = 0;
187
    qxl->guest_surfaces.count--;
188
    qemu_mutex_unlock(&qxl->track_lock);
189
}
190

    
191
static void qxl_spice_destroy_surface_wait(PCIQXLDevice *qxl, uint32_t id,
192
                                           qxl_async_io async)
193
{
194
    QXLCookie *cookie;
195

    
196
    trace_qxl_spice_destroy_surface_wait(qxl->id, id, async);
197
    if (async) {
198
        cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
199
                                QXL_IO_DESTROY_SURFACE_ASYNC);
200
        cookie->u.surface_id = id;
201
        spice_qxl_destroy_surface_async(&qxl->ssd.qxl, id, (uintptr_t)cookie);
202
    } else {
203
        qxl->ssd.worker->destroy_surface_wait(qxl->ssd.worker, id);
204
    }
205
}
206

    
207
static void qxl_spice_flush_surfaces_async(PCIQXLDevice *qxl)
208
{
209
    trace_qxl_spice_flush_surfaces_async(qxl->id, qxl->guest_surfaces.count,
210
                                         qxl->num_free_res);
211
    spice_qxl_flush_surfaces_async(&qxl->ssd.qxl,
212
        (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
213
                                  QXL_IO_FLUSH_SURFACES_ASYNC));
214
}
215

    
216
void qxl_spice_loadvm_commands(PCIQXLDevice *qxl, struct QXLCommandExt *ext,
217
                               uint32_t count)
218
{
219
    trace_qxl_spice_loadvm_commands(qxl->id, ext, count);
220
    qxl->ssd.worker->loadvm_commands(qxl->ssd.worker, ext, count);
221
}
222

    
223
void qxl_spice_oom(PCIQXLDevice *qxl)
224
{
225
    trace_qxl_spice_oom(qxl->id);
226
    qxl->ssd.worker->oom(qxl->ssd.worker);
227
}
228

    
229
void qxl_spice_reset_memslots(PCIQXLDevice *qxl)
230
{
231
    trace_qxl_spice_reset_memslots(qxl->id);
232
    qxl->ssd.worker->reset_memslots(qxl->ssd.worker);
233
}
234

    
235
static void qxl_spice_destroy_surfaces_complete(PCIQXLDevice *qxl)
236
{
237
    trace_qxl_spice_destroy_surfaces_complete(qxl->id);
238
    qemu_mutex_lock(&qxl->track_lock);
239
    memset(qxl->guest_surfaces.cmds, 0,
240
           sizeof(qxl->guest_surfaces.cmds) * qxl->ssd.num_surfaces);
241
    qxl->guest_surfaces.count = 0;
242
    qemu_mutex_unlock(&qxl->track_lock);
243
}
244

    
245
static void qxl_spice_destroy_surfaces(PCIQXLDevice *qxl, qxl_async_io async)
246
{
247
    trace_qxl_spice_destroy_surfaces(qxl->id, async);
248
    if (async) {
249
        spice_qxl_destroy_surfaces_async(&qxl->ssd.qxl,
250
                (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
251
                                          QXL_IO_DESTROY_ALL_SURFACES_ASYNC));
252
    } else {
253
        qxl->ssd.worker->destroy_surfaces(qxl->ssd.worker);
254
        qxl_spice_destroy_surfaces_complete(qxl);
255
    }
256
}
257

    
258
static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay)
259
{
260
    trace_qxl_spice_monitors_config(qxl->id);
261
/* 0x000b01 == 0.11.1 */
262
#if SPICE_SERVER_VERSION >= 0x000b01 && \
263
    defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
264
    if (replay) {
265
        /*
266
         * don't use QXL_COOKIE_TYPE_IO:
267
         *  - we are not running yet (post_load), we will assert
268
         *    in send_events
269
         *  - this is not a guest io, but a reply, so async_io isn't set.
270
         */
271
        spice_qxl_monitors_config_async(&qxl->ssd.qxl,
272
                qxl->guest_monitors_config,
273
                MEMSLOT_GROUP_GUEST,
274
                (uintptr_t)qxl_cookie_new(
275
                    QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG,
276
                    0));
277
    } else {
278
        qxl->guest_monitors_config = qxl->ram->monitors_config;
279
        spice_qxl_monitors_config_async(&qxl->ssd.qxl,
280
                qxl->ram->monitors_config,
281
                MEMSLOT_GROUP_GUEST,
282
                (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
283
                                          QXL_IO_MONITORS_CONFIG_ASYNC));
284
    }
285
#else
286
    fprintf(stderr, "qxl: too old spice-protocol/spice-server for "
287
            "QXL_IO_MONITORS_CONFIG_ASYNC\n");
288
#endif
289
}
290

    
291
void qxl_spice_reset_image_cache(PCIQXLDevice *qxl)
292
{
293
    trace_qxl_spice_reset_image_cache(qxl->id);
294
    qxl->ssd.worker->reset_image_cache(qxl->ssd.worker);
295
}
296

    
297
void qxl_spice_reset_cursor(PCIQXLDevice *qxl)
298
{
299
    trace_qxl_spice_reset_cursor(qxl->id);
300
    qxl->ssd.worker->reset_cursor(qxl->ssd.worker);
301
    qemu_mutex_lock(&qxl->track_lock);
302
    qxl->guest_cursor = 0;
303
    qemu_mutex_unlock(&qxl->track_lock);
304
}
305

    
306

    
307
static inline uint32_t msb_mask(uint32_t val)
308
{
309
    uint32_t mask;
310

    
311
    do {
312
        mask = ~(val - 1) & val;
313
        val &= ~mask;
314
    } while (mask < val);
315

    
316
    return mask;
317
}
318

    
319
static ram_addr_t qxl_rom_size(void)
320
{
321
    uint32_t rom_size = sizeof(QXLRom) + sizeof(QXLModes) + sizeof(qxl_modes);
322

    
323
    rom_size = MAX(rom_size, TARGET_PAGE_SIZE);
324
    rom_size = msb_mask(rom_size * 2 - 1);
325
    return rom_size;
326
}
327

    
328
static void init_qxl_rom(PCIQXLDevice *d)
329
{
330
    QXLRom *rom = memory_region_get_ram_ptr(&d->rom_bar);
331
    QXLModes *modes = (QXLModes *)(rom + 1);
332
    uint32_t ram_header_size;
333
    uint32_t surface0_area_size;
334
    uint32_t num_pages;
335
    uint32_t fb;
336
    int i, n;
337

    
338
    memset(rom, 0, d->rom_size);
339

    
340
    rom->magic         = cpu_to_le32(QXL_ROM_MAGIC);
341
    rom->id            = cpu_to_le32(d->id);
342
    rom->log_level     = cpu_to_le32(d->guestdebug);
343
    rom->modes_offset  = cpu_to_le32(sizeof(QXLRom));
344

    
345
    rom->slot_gen_bits = MEMSLOT_GENERATION_BITS;
346
    rom->slot_id_bits  = MEMSLOT_SLOT_BITS;
347
    rom->slots_start   = 1;
348
    rom->slots_end     = NUM_MEMSLOTS - 1;
349
    rom->n_surfaces    = cpu_to_le32(d->ssd.num_surfaces);
350

    
351
    for (i = 0, n = 0; i < ARRAY_SIZE(qxl_modes); i++) {
352
        fb = qxl_modes[i].y_res * qxl_modes[i].stride;
353
        if (fb > d->vgamem_size) {
354
            continue;
355
        }
356
        modes->modes[n].id          = cpu_to_le32(i);
357
        modes->modes[n].x_res       = cpu_to_le32(qxl_modes[i].x_res);
358
        modes->modes[n].y_res       = cpu_to_le32(qxl_modes[i].y_res);
359
        modes->modes[n].bits        = cpu_to_le32(qxl_modes[i].bits);
360
        modes->modes[n].stride      = cpu_to_le32(qxl_modes[i].stride);
361
        modes->modes[n].x_mili      = cpu_to_le32(qxl_modes[i].x_mili);
362
        modes->modes[n].y_mili      = cpu_to_le32(qxl_modes[i].y_mili);
363
        modes->modes[n].orientation = cpu_to_le32(qxl_modes[i].orientation);
364
        n++;
365
    }
366
    modes->n_modes     = cpu_to_le32(n);
367

    
368
    ram_header_size    = ALIGN(sizeof(QXLRam), 4096);
369
    surface0_area_size = ALIGN(d->vgamem_size, 4096);
370
    num_pages          = d->vga.vram_size;
371
    num_pages         -= ram_header_size;
372
    num_pages         -= surface0_area_size;
373
    num_pages          = num_pages / TARGET_PAGE_SIZE;
374

    
375
    rom->draw_area_offset   = cpu_to_le32(0);
376
    rom->surface0_area_size = cpu_to_le32(surface0_area_size);
377
    rom->pages_offset       = cpu_to_le32(surface0_area_size);
378
    rom->num_pages          = cpu_to_le32(num_pages);
379
    rom->ram_header_offset  = cpu_to_le32(d->vga.vram_size - ram_header_size);
380

    
381
    d->shadow_rom = *rom;
382
    d->rom        = rom;
383
    d->modes      = modes;
384
}
385

    
386
static void init_qxl_ram(PCIQXLDevice *d)
387
{
388
    uint8_t *buf;
389
    uint64_t *item;
390

    
391
    buf = d->vga.vram_ptr;
392
    d->ram = (QXLRam *)(buf + le32_to_cpu(d->shadow_rom.ram_header_offset));
393
    d->ram->magic       = cpu_to_le32(QXL_RAM_MAGIC);
394
    d->ram->int_pending = cpu_to_le32(0);
395
    d->ram->int_mask    = cpu_to_le32(0);
396
    d->ram->update_surface = 0;
397
    SPICE_RING_INIT(&d->ram->cmd_ring);
398
    SPICE_RING_INIT(&d->ram->cursor_ring);
399
    SPICE_RING_INIT(&d->ram->release_ring);
400
    SPICE_RING_PROD_ITEM(d, &d->ram->release_ring, item);
401
    assert(item);
402
    *item = 0;
403
    qxl_ring_set_dirty(d);
404
}
405

    
406
/* can be called from spice server thread context */
407
static void qxl_set_dirty(MemoryRegion *mr, ram_addr_t addr, ram_addr_t end)
408
{
409
    memory_region_set_dirty(mr, addr, end - addr);
410
}
411

    
412
static void qxl_rom_set_dirty(PCIQXLDevice *qxl)
413
{
414
    qxl_set_dirty(&qxl->rom_bar, 0, qxl->rom_size);
415
}
416

    
417
/* called from spice server thread context only */
418
static void qxl_ram_set_dirty(PCIQXLDevice *qxl, void *ptr)
419
{
420
    void *base = qxl->vga.vram_ptr;
421
    intptr_t offset;
422

    
423
    offset = ptr - base;
424
    offset &= ~(TARGET_PAGE_SIZE-1);
425
    assert(offset < qxl->vga.vram_size);
426
    qxl_set_dirty(&qxl->vga.vram, offset, offset + TARGET_PAGE_SIZE);
427
}
428

    
429
/* can be called from spice server thread context */
430
static void qxl_ring_set_dirty(PCIQXLDevice *qxl)
431
{
432
    ram_addr_t addr = qxl->shadow_rom.ram_header_offset;
433
    ram_addr_t end  = qxl->vga.vram_size;
434
    qxl_set_dirty(&qxl->vga.vram, addr, end);
435
}
436

    
437
/*
438
 * keep track of some command state, for savevm/loadvm.
439
 * called from spice server thread context only
440
 */
441
static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext)
442
{
443
    switch (le32_to_cpu(ext->cmd.type)) {
444
    case QXL_CMD_SURFACE:
445
    {
446
        QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id);
447

    
448
        if (!cmd) {
449
            return 1;
450
        }
451
        uint32_t id = le32_to_cpu(cmd->surface_id);
452

    
453
        if (id >= qxl->ssd.num_surfaces) {
454
            qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE id %d >= %d", id,
455
                              qxl->ssd.num_surfaces);
456
            return 1;
457
        }
458
        qemu_mutex_lock(&qxl->track_lock);
459
        if (cmd->type == QXL_SURFACE_CMD_CREATE) {
460
            qxl->guest_surfaces.cmds[id] = ext->cmd.data;
461
            qxl->guest_surfaces.count++;
462
            if (qxl->guest_surfaces.max < qxl->guest_surfaces.count)
463
                qxl->guest_surfaces.max = qxl->guest_surfaces.count;
464
        }
465
        if (cmd->type == QXL_SURFACE_CMD_DESTROY) {
466
            qxl->guest_surfaces.cmds[id] = 0;
467
            qxl->guest_surfaces.count--;
468
        }
469
        qemu_mutex_unlock(&qxl->track_lock);
470
        break;
471
    }
472
    case QXL_CMD_CURSOR:
473
    {
474
        QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id);
475

    
476
        if (!cmd) {
477
            return 1;
478
        }
479
        if (cmd->type == QXL_CURSOR_SET) {
480
            qemu_mutex_lock(&qxl->track_lock);
481
            qxl->guest_cursor = ext->cmd.data;
482
            qemu_mutex_unlock(&qxl->track_lock);
483
        }
484
        break;
485
    }
486
    }
487
    return 0;
488
}
489

    
490
/* spice display interface callbacks */
491

    
492
static void interface_attach_worker(QXLInstance *sin, QXLWorker *qxl_worker)
493
{
494
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
495

    
496
    trace_qxl_interface_attach_worker(qxl->id);
497
    qxl->ssd.worker = qxl_worker;
498
}
499

    
500
static void interface_set_compression_level(QXLInstance *sin, int level)
501
{
502
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
503

    
504
    trace_qxl_interface_set_compression_level(qxl->id, level);
505
    qxl->shadow_rom.compression_level = cpu_to_le32(level);
506
    qxl->rom->compression_level = cpu_to_le32(level);
507
    qxl_rom_set_dirty(qxl);
508
}
509

    
510
static void interface_set_mm_time(QXLInstance *sin, uint32_t mm_time)
511
{
512
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
513

    
514
    trace_qxl_interface_set_mm_time(qxl->id, mm_time);
515
    qxl->shadow_rom.mm_clock = cpu_to_le32(mm_time);
516
    qxl->rom->mm_clock = cpu_to_le32(mm_time);
517
    qxl_rom_set_dirty(qxl);
518
}
519

    
520
static void interface_get_init_info(QXLInstance *sin, QXLDevInitInfo *info)
521
{
522
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
523

    
524
    trace_qxl_interface_get_init_info(qxl->id);
525
    info->memslot_gen_bits = MEMSLOT_GENERATION_BITS;
526
    info->memslot_id_bits = MEMSLOT_SLOT_BITS;
527
    info->num_memslots = NUM_MEMSLOTS;
528
    info->num_memslots_groups = NUM_MEMSLOTS_GROUPS;
529
    info->internal_groupslot_id = 0;
530
    info->qxl_ram_size = le32_to_cpu(qxl->shadow_rom.num_pages) << TARGET_PAGE_BITS;
531
    info->n_surfaces = qxl->ssd.num_surfaces;
532
}
533

    
534
static const char *qxl_mode_to_string(int mode)
535
{
536
    switch (mode) {
537
    case QXL_MODE_COMPAT:
538
        return "compat";
539
    case QXL_MODE_NATIVE:
540
        return "native";
541
    case QXL_MODE_UNDEFINED:
542
        return "undefined";
543
    case QXL_MODE_VGA:
544
        return "vga";
545
    }
546
    return "INVALID";
547
}
548

    
549
static const char *io_port_to_string(uint32_t io_port)
550
{
551
    if (io_port >= QXL_IO_RANGE_SIZE) {
552
        return "out of range";
553
    }
554
    static const char *io_port_to_string[QXL_IO_RANGE_SIZE + 1] = {
555
        [QXL_IO_NOTIFY_CMD]             = "QXL_IO_NOTIFY_CMD",
556
        [QXL_IO_NOTIFY_CURSOR]          = "QXL_IO_NOTIFY_CURSOR",
557
        [QXL_IO_UPDATE_AREA]            = "QXL_IO_UPDATE_AREA",
558
        [QXL_IO_UPDATE_IRQ]             = "QXL_IO_UPDATE_IRQ",
559
        [QXL_IO_NOTIFY_OOM]             = "QXL_IO_NOTIFY_OOM",
560
        [QXL_IO_RESET]                  = "QXL_IO_RESET",
561
        [QXL_IO_SET_MODE]               = "QXL_IO_SET_MODE",
562
        [QXL_IO_LOG]                    = "QXL_IO_LOG",
563
        [QXL_IO_MEMSLOT_ADD]            = "QXL_IO_MEMSLOT_ADD",
564
        [QXL_IO_MEMSLOT_DEL]            = "QXL_IO_MEMSLOT_DEL",
565
        [QXL_IO_DETACH_PRIMARY]         = "QXL_IO_DETACH_PRIMARY",
566
        [QXL_IO_ATTACH_PRIMARY]         = "QXL_IO_ATTACH_PRIMARY",
567
        [QXL_IO_CREATE_PRIMARY]         = "QXL_IO_CREATE_PRIMARY",
568
        [QXL_IO_DESTROY_PRIMARY]        = "QXL_IO_DESTROY_PRIMARY",
569
        [QXL_IO_DESTROY_SURFACE_WAIT]   = "QXL_IO_DESTROY_SURFACE_WAIT",
570
        [QXL_IO_DESTROY_ALL_SURFACES]   = "QXL_IO_DESTROY_ALL_SURFACES",
571
        [QXL_IO_UPDATE_AREA_ASYNC]      = "QXL_IO_UPDATE_AREA_ASYNC",
572
        [QXL_IO_MEMSLOT_ADD_ASYNC]      = "QXL_IO_MEMSLOT_ADD_ASYNC",
573
        [QXL_IO_CREATE_PRIMARY_ASYNC]   = "QXL_IO_CREATE_PRIMARY_ASYNC",
574
        [QXL_IO_DESTROY_PRIMARY_ASYNC]  = "QXL_IO_DESTROY_PRIMARY_ASYNC",
575
        [QXL_IO_DESTROY_SURFACE_ASYNC]  = "QXL_IO_DESTROY_SURFACE_ASYNC",
576
        [QXL_IO_DESTROY_ALL_SURFACES_ASYNC]
577
                                        = "QXL_IO_DESTROY_ALL_SURFACES_ASYNC",
578
        [QXL_IO_FLUSH_SURFACES_ASYNC]   = "QXL_IO_FLUSH_SURFACES_ASYNC",
579
        [QXL_IO_FLUSH_RELEASE]          = "QXL_IO_FLUSH_RELEASE",
580
        [QXL_IO_MONITORS_CONFIG_ASYNC]  = "QXL_IO_MONITORS_CONFIG_ASYNC",
581
    };
582
    return io_port_to_string[io_port];
583
}
584

    
585
/* called from spice server thread context only */
586
static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext)
587
{
588
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
589
    SimpleSpiceUpdate *update;
590
    QXLCommandRing *ring;
591
    QXLCommand *cmd;
592
    int notify, ret;
593

    
594
    trace_qxl_ring_command_check(qxl->id, qxl_mode_to_string(qxl->mode));
595

    
596
    switch (qxl->mode) {
597
    case QXL_MODE_VGA:
598
        ret = false;
599
        qemu_mutex_lock(&qxl->ssd.lock);
600
        if (qxl->ssd.update != NULL) {
601
            update = qxl->ssd.update;
602
            qxl->ssd.update = NULL;
603
            *ext = update->ext;
604
            ret = true;
605
        }
606
        qemu_mutex_unlock(&qxl->ssd.lock);
607
        if (ret) {
608
            trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode));
609
            qxl_log_command(qxl, "vga", ext);
610
        }
611
        return ret;
612
    case QXL_MODE_COMPAT:
613
    case QXL_MODE_NATIVE:
614
    case QXL_MODE_UNDEFINED:
615
        ring = &qxl->ram->cmd_ring;
616
        if (qxl->guest_bug || SPICE_RING_IS_EMPTY(ring)) {
617
            return false;
618
        }
619
        SPICE_RING_CONS_ITEM(qxl, ring, cmd);
620
        if (!cmd) {
621
            return false;
622
        }
623
        ext->cmd      = *cmd;
624
        ext->group_id = MEMSLOT_GROUP_GUEST;
625
        ext->flags    = qxl->cmdflags;
626
        SPICE_RING_POP(ring, notify);
627
        qxl_ring_set_dirty(qxl);
628
        if (notify) {
629
            qxl_send_events(qxl, QXL_INTERRUPT_DISPLAY);
630
        }
631
        qxl->guest_primary.commands++;
632
        qxl_track_command(qxl, ext);
633
        qxl_log_command(qxl, "cmd", ext);
634
        trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode));
635
        return true;
636
    default:
637
        return false;
638
    }
639
}
640

    
641
/* called from spice server thread context only */
642
static int interface_req_cmd_notification(QXLInstance *sin)
643
{
644
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
645
    int wait = 1;
646

    
647
    trace_qxl_ring_command_req_notification(qxl->id);
648
    switch (qxl->mode) {
649
    case QXL_MODE_COMPAT:
650
    case QXL_MODE_NATIVE:
651
    case QXL_MODE_UNDEFINED:
652
        SPICE_RING_CONS_WAIT(&qxl->ram->cmd_ring, wait);
653
        qxl_ring_set_dirty(qxl);
654
        break;
655
    default:
656
        /* nothing */
657
        break;
658
    }
659
    return wait;
660
}
661

    
662
/* called from spice server thread context only */
663
static inline void qxl_push_free_res(PCIQXLDevice *d, int flush)
664
{
665
    QXLReleaseRing *ring = &d->ram->release_ring;
666
    uint64_t *item;
667
    int notify;
668

    
669
#define QXL_FREE_BUNCH_SIZE 32
670

    
671
    if (ring->prod - ring->cons + 1 == ring->num_items) {
672
        /* ring full -- can't push */
673
        return;
674
    }
675
    if (!flush && d->oom_running) {
676
        /* collect everything from oom handler before pushing */
677
        return;
678
    }
679
    if (!flush && d->num_free_res < QXL_FREE_BUNCH_SIZE) {
680
        /* collect a bit more before pushing */
681
        return;
682
    }
683

    
684
    SPICE_RING_PUSH(ring, notify);
685
    trace_qxl_ring_res_push(d->id, qxl_mode_to_string(d->mode),
686
           d->guest_surfaces.count, d->num_free_res,
687
           d->last_release, notify ? "yes" : "no");
688
    trace_qxl_ring_res_push_rest(d->id, ring->prod - ring->cons,
689
           ring->num_items, ring->prod, ring->cons);
690
    if (notify) {
691
        qxl_send_events(d, QXL_INTERRUPT_DISPLAY);
692
    }
693
    SPICE_RING_PROD_ITEM(d, ring, item);
694
    if (!item) {
695
        return;
696
    }
697
    *item = 0;
698
    d->num_free_res = 0;
699
    d->last_release = NULL;
700
    qxl_ring_set_dirty(d);
701
}
702

    
703
/* called from spice server thread context only */
704
static void interface_release_resource(QXLInstance *sin,
705
                                       struct QXLReleaseInfoExt ext)
706
{
707
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
708
    QXLReleaseRing *ring;
709
    uint64_t *item, id;
710

    
711
    if (ext.group_id == MEMSLOT_GROUP_HOST) {
712
        /* host group -> vga mode update request */
713
        qemu_spice_destroy_update(&qxl->ssd, (void *)(intptr_t)ext.info->id);
714
        return;
715
    }
716

    
717
    /*
718
     * ext->info points into guest-visible memory
719
     * pci bar 0, $command.release_info
720
     */
721
    ring = &qxl->ram->release_ring;
722
    SPICE_RING_PROD_ITEM(qxl, ring, item);
723
    if (!item) {
724
        return;
725
    }
726
    if (*item == 0) {
727
        /* stick head into the ring */
728
        id = ext.info->id;
729
        ext.info->next = 0;
730
        qxl_ram_set_dirty(qxl, &ext.info->next);
731
        *item = id;
732
        qxl_ring_set_dirty(qxl);
733
    } else {
734
        /* append item to the list */
735
        qxl->last_release->next = ext.info->id;
736
        qxl_ram_set_dirty(qxl, &qxl->last_release->next);
737
        ext.info->next = 0;
738
        qxl_ram_set_dirty(qxl, &ext.info->next);
739
    }
740
    qxl->last_release = ext.info;
741
    qxl->num_free_res++;
742
    trace_qxl_ring_res_put(qxl->id, qxl->num_free_res);
743
    qxl_push_free_res(qxl, 0);
744
}
745

    
746
/* called from spice server thread context only */
747
static int interface_get_cursor_command(QXLInstance *sin, struct QXLCommandExt *ext)
748
{
749
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
750
    QXLCursorRing *ring;
751
    QXLCommand *cmd;
752
    int notify;
753

    
754
    trace_qxl_ring_cursor_check(qxl->id, qxl_mode_to_string(qxl->mode));
755

    
756
    switch (qxl->mode) {
757
    case QXL_MODE_COMPAT:
758
    case QXL_MODE_NATIVE:
759
    case QXL_MODE_UNDEFINED:
760
        ring = &qxl->ram->cursor_ring;
761
        if (SPICE_RING_IS_EMPTY(ring)) {
762
            return false;
763
        }
764
        SPICE_RING_CONS_ITEM(qxl, ring, cmd);
765
        if (!cmd) {
766
            return false;
767
        }
768
        ext->cmd      = *cmd;
769
        ext->group_id = MEMSLOT_GROUP_GUEST;
770
        ext->flags    = qxl->cmdflags;
771
        SPICE_RING_POP(ring, notify);
772
        qxl_ring_set_dirty(qxl);
773
        if (notify) {
774
            qxl_send_events(qxl, QXL_INTERRUPT_CURSOR);
775
        }
776
        qxl->guest_primary.commands++;
777
        qxl_track_command(qxl, ext);
778
        qxl_log_command(qxl, "csr", ext);
779
        if (qxl->id == 0) {
780
            qxl_render_cursor(qxl, ext);
781
        }
782
        trace_qxl_ring_cursor_get(qxl->id, qxl_mode_to_string(qxl->mode));
783
        return true;
784
    default:
785
        return false;
786
    }
787
}
788

    
789
/* called from spice server thread context only */
790
static int interface_req_cursor_notification(QXLInstance *sin)
791
{
792
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
793
    int wait = 1;
794

    
795
    trace_qxl_ring_cursor_req_notification(qxl->id);
796
    switch (qxl->mode) {
797
    case QXL_MODE_COMPAT:
798
    case QXL_MODE_NATIVE:
799
    case QXL_MODE_UNDEFINED:
800
        SPICE_RING_CONS_WAIT(&qxl->ram->cursor_ring, wait);
801
        qxl_ring_set_dirty(qxl);
802
        break;
803
    default:
804
        /* nothing */
805
        break;
806
    }
807
    return wait;
808
}
809

    
810
/* called from spice server thread context */
811
static void interface_notify_update(QXLInstance *sin, uint32_t update_id)
812
{
813
    /*
814
     * Called by spice-server as a result of a QXL_CMD_UPDATE which is not in
815
     * use by xf86-video-qxl and is defined out in the qxl windows driver.
816
     * Probably was at some earlier version that is prior to git start (2009),
817
     * and is still guest trigerrable.
818
     */
819
    fprintf(stderr, "%s: deprecated\n", __func__);
820
}
821

    
822
/* called from spice server thread context only */
823
static int interface_flush_resources(QXLInstance *sin)
824
{
825
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
826
    int ret;
827

    
828
    ret = qxl->num_free_res;
829
    if (ret) {
830
        qxl_push_free_res(qxl, 1);
831
    }
832
    return ret;
833
}
834

    
835
static void qxl_create_guest_primary_complete(PCIQXLDevice *d);
836

    
837
/* called from spice server thread context only */
838
static void interface_async_complete_io(PCIQXLDevice *qxl, QXLCookie *cookie)
839
{
840
    uint32_t current_async;
841

    
842
    qemu_mutex_lock(&qxl->async_lock);
843
    current_async = qxl->current_async;
844
    qxl->current_async = QXL_UNDEFINED_IO;
845
    qemu_mutex_unlock(&qxl->async_lock);
846

    
847
    trace_qxl_interface_async_complete_io(qxl->id, current_async, cookie);
848
    if (!cookie) {
849
        fprintf(stderr, "qxl: %s: error, cookie is NULL\n", __func__);
850
        return;
851
    }
852
    if (cookie && current_async != cookie->io) {
853
        fprintf(stderr,
854
                "qxl: %s: error: current_async = %d != %"
855
                PRId64 " = cookie->io\n", __func__, current_async, cookie->io);
856
    }
857
    switch (current_async) {
858
    case QXL_IO_MEMSLOT_ADD_ASYNC:
859
    case QXL_IO_DESTROY_PRIMARY_ASYNC:
860
    case QXL_IO_UPDATE_AREA_ASYNC:
861
    case QXL_IO_FLUSH_SURFACES_ASYNC:
862
    case QXL_IO_MONITORS_CONFIG_ASYNC:
863
        break;
864
    case QXL_IO_CREATE_PRIMARY_ASYNC:
865
        qxl_create_guest_primary_complete(qxl);
866
        break;
867
    case QXL_IO_DESTROY_ALL_SURFACES_ASYNC:
868
        qxl_spice_destroy_surfaces_complete(qxl);
869
        break;
870
    case QXL_IO_DESTROY_SURFACE_ASYNC:
871
        qxl_spice_destroy_surface_wait_complete(qxl, cookie->u.surface_id);
872
        break;
873
    default:
874
        fprintf(stderr, "qxl: %s: unexpected current_async %d\n", __func__,
875
                current_async);
876
    }
877
    qxl_send_events(qxl, QXL_INTERRUPT_IO_CMD);
878
}
879

    
880
/* called from spice server thread context only */
881
static void interface_update_area_complete(QXLInstance *sin,
882
        uint32_t surface_id,
883
        QXLRect *dirty, uint32_t num_updated_rects)
884
{
885
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
886
    int i;
887
    int qxl_i;
888

    
889
    qemu_mutex_lock(&qxl->ssd.lock);
890
    if (surface_id != 0 || !qxl->render_update_cookie_num) {
891
        qemu_mutex_unlock(&qxl->ssd.lock);
892
        return;
893
    }
894
    trace_qxl_interface_update_area_complete(qxl->id, surface_id, dirty->left,
895
            dirty->right, dirty->top, dirty->bottom);
896
    trace_qxl_interface_update_area_complete_rest(qxl->id, num_updated_rects);
897
    if (qxl->num_dirty_rects + num_updated_rects > QXL_NUM_DIRTY_RECTS) {
898
        /*
899
         * overflow - treat this as a full update. Not expected to be common.
900
         */
901
        trace_qxl_interface_update_area_complete_overflow(qxl->id,
902
                                                          QXL_NUM_DIRTY_RECTS);
903
        qxl->guest_primary.resized = 1;
904
    }
905
    if (qxl->guest_primary.resized) {
906
        /*
907
         * Don't bother copying or scheduling the bh since we will flip
908
         * the whole area anyway on completion of the update_area async call
909
         */
910
        qemu_mutex_unlock(&qxl->ssd.lock);
911
        return;
912
    }
913
    qxl_i = qxl->num_dirty_rects;
914
    for (i = 0; i < num_updated_rects; i++) {
915
        qxl->dirty[qxl_i++] = dirty[i];
916
    }
917
    qxl->num_dirty_rects += num_updated_rects;
918
    trace_qxl_interface_update_area_complete_schedule_bh(qxl->id,
919
                                                         qxl->num_dirty_rects);
920
    qemu_bh_schedule(qxl->update_area_bh);
921
    qemu_mutex_unlock(&qxl->ssd.lock);
922
}
923

    
924
/* called from spice server thread context only */
925
static void interface_async_complete(QXLInstance *sin, uint64_t cookie_token)
926
{
927
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
928
    QXLCookie *cookie = (QXLCookie *)(uintptr_t)cookie_token;
929

    
930
    switch (cookie->type) {
931
    case QXL_COOKIE_TYPE_IO:
932
        interface_async_complete_io(qxl, cookie);
933
        g_free(cookie);
934
        break;
935
    case QXL_COOKIE_TYPE_RENDER_UPDATE_AREA:
936
        qxl_render_update_area_done(qxl, cookie);
937
        break;
938
    case QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG:
939
        break;
940
    default:
941
        fprintf(stderr, "qxl: %s: unexpected cookie type %d\n",
942
                __func__, cookie->type);
943
        g_free(cookie);
944
    }
945
}
946

    
947
#if SPICE_SERVER_VERSION >= 0x000b04
948

    
949
/* called from spice server thread context only */
950
static void interface_set_client_capabilities(QXLInstance *sin,
951
                                              uint8_t client_present,
952
                                              uint8_t caps[58])
953
{
954
    PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
955

    
956
    qxl->shadow_rom.client_present = client_present;
957
    memcpy(qxl->shadow_rom.client_capabilities, caps, sizeof(caps));
958
    qxl->rom->client_present = client_present;
959
    memcpy(qxl->rom->client_capabilities, caps, sizeof(caps));
960
    qxl_rom_set_dirty(qxl);
961

    
962
    qxl_send_events(qxl, QXL_INTERRUPT_CLIENT);
963
}
964

    
965
#endif
966

    
967
static const QXLInterface qxl_interface = {
968
    .base.type               = SPICE_INTERFACE_QXL,
969
    .base.description        = "qxl gpu",
970
    .base.major_version      = SPICE_INTERFACE_QXL_MAJOR,
971
    .base.minor_version      = SPICE_INTERFACE_QXL_MINOR,
972

    
973
    .attache_worker          = interface_attach_worker,
974
    .set_compression_level   = interface_set_compression_level,
975
    .set_mm_time             = interface_set_mm_time,
976
    .get_init_info           = interface_get_init_info,
977

    
978
    /* the callbacks below are called from spice server thread context */
979
    .get_command             = interface_get_command,
980
    .req_cmd_notification    = interface_req_cmd_notification,
981
    .release_resource        = interface_release_resource,
982
    .get_cursor_command      = interface_get_cursor_command,
983
    .req_cursor_notification = interface_req_cursor_notification,
984
    .notify_update           = interface_notify_update,
985
    .flush_resources         = interface_flush_resources,
986
    .async_complete          = interface_async_complete,
987
    .update_area_complete    = interface_update_area_complete,
988
#if SPICE_SERVER_VERSION >= 0x000b04
989
    .set_client_capabilities = interface_set_client_capabilities,
990
#endif
991
};
992

    
993
static void qxl_enter_vga_mode(PCIQXLDevice *d)
994
{
995
    if (d->mode == QXL_MODE_VGA) {
996
        return;
997
    }
998
    trace_qxl_enter_vga_mode(d->id);
999
    qemu_spice_create_host_primary(&d->ssd);
1000
    d->mode = QXL_MODE_VGA;
1001
    memset(&d->ssd.dirty, 0, sizeof(d->ssd.dirty));
1002
    vga_dirty_log_start(&d->vga);
1003
}
1004

    
1005
static void qxl_exit_vga_mode(PCIQXLDevice *d)
1006
{
1007
    if (d->mode != QXL_MODE_VGA) {
1008
        return;
1009
    }
1010
    trace_qxl_exit_vga_mode(d->id);
1011
    vga_dirty_log_stop(&d->vga);
1012
    qxl_destroy_primary(d, QXL_SYNC);
1013
}
1014

    
1015
static void qxl_update_irq(PCIQXLDevice *d)
1016
{
1017
    uint32_t pending = le32_to_cpu(d->ram->int_pending);
1018
    uint32_t mask    = le32_to_cpu(d->ram->int_mask);
1019
    int level = !!(pending & mask);
1020
    qemu_set_irq(d->pci.irq[0], level);
1021
    qxl_ring_set_dirty(d);
1022
}
1023

    
1024
static void qxl_check_state(PCIQXLDevice *d)
1025
{
1026
    QXLRam *ram = d->ram;
1027
    int spice_display_running = qemu_spice_display_is_running(&d->ssd);
1028

    
1029
    assert(!spice_display_running || SPICE_RING_IS_EMPTY(&ram->cmd_ring));
1030
    assert(!spice_display_running || SPICE_RING_IS_EMPTY(&ram->cursor_ring));
1031
}
1032

    
1033
static void qxl_reset_state(PCIQXLDevice *d)
1034
{
1035
    QXLRom *rom = d->rom;
1036

    
1037
    qxl_check_state(d);
1038
    d->shadow_rom.update_id = cpu_to_le32(0);
1039
    *rom = d->shadow_rom;
1040
    qxl_rom_set_dirty(d);
1041
    init_qxl_ram(d);
1042
    d->num_free_res = 0;
1043
    d->last_release = NULL;
1044
    memset(&d->ssd.dirty, 0, sizeof(d->ssd.dirty));
1045
}
1046

    
1047
static void qxl_soft_reset(PCIQXLDevice *d)
1048
{
1049
    trace_qxl_soft_reset(d->id);
1050
    qxl_check_state(d);
1051
    qxl_clear_guest_bug(d);
1052
    d->current_async = QXL_UNDEFINED_IO;
1053

    
1054
    if (d->id == 0) {
1055
        qxl_enter_vga_mode(d);
1056
    } else {
1057
        d->mode = QXL_MODE_UNDEFINED;
1058
    }
1059
}
1060

    
1061
static void qxl_hard_reset(PCIQXLDevice *d, int loadvm)
1062
{
1063
    trace_qxl_hard_reset(d->id, loadvm);
1064

    
1065
    qxl_spice_reset_cursor(d);
1066
    qxl_spice_reset_image_cache(d);
1067
    qxl_reset_surfaces(d);
1068
    qxl_reset_memslots(d);
1069

    
1070
    /* pre loadvm reset must not touch QXLRam.  This lives in
1071
     * device memory, is migrated together with RAM and thus
1072
     * already loaded at this point */
1073
    if (!loadvm) {
1074
        qxl_reset_state(d);
1075
    }
1076
    qemu_spice_create_host_memslot(&d->ssd);
1077
    qxl_soft_reset(d);
1078
}
1079

    
1080
static void qxl_reset_handler(DeviceState *dev)
1081
{
1082
    PCIQXLDevice *d = DO_UPCAST(PCIQXLDevice, pci.qdev, dev);
1083

    
1084
    qxl_hard_reset(d, 0);
1085
}
1086

    
1087
static void qxl_vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
1088
{
1089
    VGACommonState *vga = opaque;
1090
    PCIQXLDevice *qxl = container_of(vga, PCIQXLDevice, vga);
1091

    
1092
    trace_qxl_io_write_vga(qxl->id, qxl_mode_to_string(qxl->mode), addr, val);
1093
    if (qxl->mode != QXL_MODE_VGA) {
1094
        qxl_destroy_primary(qxl, QXL_SYNC);
1095
        qxl_soft_reset(qxl);
1096
    }
1097
    vga_ioport_write(opaque, addr, val);
1098
}
1099

    
1100
static const MemoryRegionPortio qxl_vga_portio_list[] = {
1101
    { 0x04,  2, 1, .read  = vga_ioport_read,
1102
                   .write = qxl_vga_ioport_write }, /* 3b4 */
1103
    { 0x0a,  1, 1, .read  = vga_ioport_read,
1104
                   .write = qxl_vga_ioport_write }, /* 3ba */
1105
    { 0x10, 16, 1, .read  = vga_ioport_read,
1106
                   .write = qxl_vga_ioport_write }, /* 3c0 */
1107
    { 0x24,  2, 1, .read  = vga_ioport_read,
1108
                   .write = qxl_vga_ioport_write }, /* 3d4 */
1109
    { 0x2a,  1, 1, .read  = vga_ioport_read,
1110
                   .write = qxl_vga_ioport_write }, /* 3da */
1111
    PORTIO_END_OF_LIST(),
1112
};
1113

    
1114
static int qxl_add_memslot(PCIQXLDevice *d, uint32_t slot_id, uint64_t delta,
1115
                           qxl_async_io async)
1116
{
1117
    static const int regions[] = {
1118
        QXL_RAM_RANGE_INDEX,
1119
        QXL_VRAM_RANGE_INDEX,
1120
        QXL_VRAM64_RANGE_INDEX,
1121
    };
1122
    uint64_t guest_start;
1123
    uint64_t guest_end;
1124
    int pci_region;
1125
    pcibus_t pci_start;
1126
    pcibus_t pci_end;
1127
    intptr_t virt_start;
1128
    QXLDevMemSlot memslot;
1129
    int i;
1130

    
1131
    guest_start = le64_to_cpu(d->guest_slots[slot_id].slot.mem_start);
1132
    guest_end   = le64_to_cpu(d->guest_slots[slot_id].slot.mem_end);
1133

    
1134
    trace_qxl_memslot_add_guest(d->id, slot_id, guest_start, guest_end);
1135

    
1136
    if (slot_id >= NUM_MEMSLOTS) {
1137
        qxl_set_guest_bug(d, "%s: slot_id >= NUM_MEMSLOTS %d >= %d", __func__,
1138
                      slot_id, NUM_MEMSLOTS);
1139
        return 1;
1140
    }
1141
    if (guest_start > guest_end) {
1142
        qxl_set_guest_bug(d, "%s: guest_start > guest_end 0x%" PRIx64
1143
                         " > 0x%" PRIx64, __func__, guest_start, guest_end);
1144
        return 1;
1145
    }
1146

    
1147
    for (i = 0; i < ARRAY_SIZE(regions); i++) {
1148
        pci_region = regions[i];
1149
        pci_start = d->pci.io_regions[pci_region].addr;
1150
        pci_end = pci_start + d->pci.io_regions[pci_region].size;
1151
        /* mapped? */
1152
        if (pci_start == -1) {
1153
            continue;
1154
        }
1155
        /* start address in range ? */
1156
        if (guest_start < pci_start || guest_start > pci_end) {
1157
            continue;
1158
        }
1159
        /* end address in range ? */
1160
        if (guest_end > pci_end) {
1161
            continue;
1162
        }
1163
        /* passed */
1164
        break;
1165
    }
1166
    if (i == ARRAY_SIZE(regions)) {
1167
        qxl_set_guest_bug(d, "%s: finished loop without match", __func__);
1168
        return 1;
1169
    }
1170

    
1171
    switch (pci_region) {
1172
    case QXL_RAM_RANGE_INDEX:
1173
        virt_start = (intptr_t)memory_region_get_ram_ptr(&d->vga.vram);
1174
        break;
1175
    case QXL_VRAM_RANGE_INDEX:
1176
    case 4 /* vram 64bit */:
1177
        virt_start = (intptr_t)memory_region_get_ram_ptr(&d->vram_bar);
1178
        break;
1179
    default:
1180
        /* should not happen */
1181
        qxl_set_guest_bug(d, "%s: pci_region = %d", __func__, pci_region);
1182
        return 1;
1183
    }
1184

    
1185
    memslot.slot_id = slot_id;
1186
    memslot.slot_group_id = MEMSLOT_GROUP_GUEST; /* guest group */
1187
    memslot.virt_start = virt_start + (guest_start - pci_start);
1188
    memslot.virt_end   = virt_start + (guest_end   - pci_start);
1189
    memslot.addr_delta = memslot.virt_start - delta;
1190
    memslot.generation = d->rom->slot_generation = 0;
1191
    qxl_rom_set_dirty(d);
1192

    
1193
    qemu_spice_add_memslot(&d->ssd, &memslot, async);
1194
    d->guest_slots[slot_id].ptr = (void*)memslot.virt_start;
1195
    d->guest_slots[slot_id].size = memslot.virt_end - memslot.virt_start;
1196
    d->guest_slots[slot_id].delta = delta;
1197
    d->guest_slots[slot_id].active = 1;
1198
    return 0;
1199
}
1200

    
1201
static void qxl_del_memslot(PCIQXLDevice *d, uint32_t slot_id)
1202
{
1203
    qemu_spice_del_memslot(&d->ssd, MEMSLOT_GROUP_HOST, slot_id);
1204
    d->guest_slots[slot_id].active = 0;
1205
}
1206

    
1207
static void qxl_reset_memslots(PCIQXLDevice *d)
1208
{
1209
    qxl_spice_reset_memslots(d);
1210
    memset(&d->guest_slots, 0, sizeof(d->guest_slots));
1211
}
1212

    
1213
static void qxl_reset_surfaces(PCIQXLDevice *d)
1214
{
1215
    trace_qxl_reset_surfaces(d->id);
1216
    d->mode = QXL_MODE_UNDEFINED;
1217
    qxl_spice_destroy_surfaces(d, QXL_SYNC);
1218
}
1219

    
1220
/* can be also called from spice server thread context */
1221
void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
1222
{
1223
    uint64_t phys   = le64_to_cpu(pqxl);
1224
    uint32_t slot   = (phys >> (64 -  8)) & 0xff;
1225
    uint64_t offset = phys & 0xffffffffffff;
1226

    
1227
    switch (group_id) {
1228
    case MEMSLOT_GROUP_HOST:
1229
        return (void *)(intptr_t)offset;
1230
    case MEMSLOT_GROUP_GUEST:
1231
        if (slot >= NUM_MEMSLOTS) {
1232
            qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot,
1233
                              NUM_MEMSLOTS);
1234
            return NULL;
1235
        }
1236
        if (!qxl->guest_slots[slot].active) {
1237
            qxl_set_guest_bug(qxl, "inactive slot %d\n", slot);
1238
            return NULL;
1239
        }
1240
        if (offset < qxl->guest_slots[slot].delta) {
1241
            qxl_set_guest_bug(qxl,
1242
                          "slot %d offset %"PRIu64" < delta %"PRIu64"\n",
1243
                          slot, offset, qxl->guest_slots[slot].delta);
1244
            return NULL;
1245
        }
1246
        offset -= qxl->guest_slots[slot].delta;
1247
        if (offset > qxl->guest_slots[slot].size) {
1248
            qxl_set_guest_bug(qxl,
1249
                          "slot %d offset %"PRIu64" > size %"PRIu64"\n",
1250
                          slot, offset, qxl->guest_slots[slot].size);
1251
            return NULL;
1252
        }
1253
        return qxl->guest_slots[slot].ptr + offset;
1254
    }
1255
    return NULL;
1256
}
1257

    
1258
static void qxl_create_guest_primary_complete(PCIQXLDevice *qxl)
1259
{
1260
    /* for local rendering */
1261
    qxl_render_resize(qxl);
1262
}
1263

    
1264
static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
1265
                                     qxl_async_io async)
1266
{
1267
    QXLDevSurfaceCreate surface;
1268
    QXLSurfaceCreate *sc = &qxl->guest_primary.surface;
1269
    int size;
1270
    int requested_height = le32_to_cpu(sc->height);
1271
    int requested_stride = le32_to_cpu(sc->stride);
1272

    
1273
    size = abs(requested_stride) * requested_height;
1274
    if (size > qxl->vgamem_size) {
1275
        qxl_set_guest_bug(qxl, "%s: requested primary larger then framebuffer"
1276
                               " size", __func__);
1277
        return;
1278
    }
1279

    
1280
    if (qxl->mode == QXL_MODE_NATIVE) {
1281
        qxl_set_guest_bug(qxl, "%s: nop since already in QXL_MODE_NATIVE",
1282
                      __func__);
1283
    }
1284
    qxl_exit_vga_mode(qxl);
1285

    
1286
    surface.format     = le32_to_cpu(sc->format);
1287
    surface.height     = le32_to_cpu(sc->height);
1288
    surface.mem        = le64_to_cpu(sc->mem);
1289
    surface.position   = le32_to_cpu(sc->position);
1290
    surface.stride     = le32_to_cpu(sc->stride);
1291
    surface.width      = le32_to_cpu(sc->width);
1292
    surface.type       = le32_to_cpu(sc->type);
1293
    surface.flags      = le32_to_cpu(sc->flags);
1294
    trace_qxl_create_guest_primary(qxl->id, sc->width, sc->height, sc->mem,
1295
                                   sc->format, sc->position);
1296
    trace_qxl_create_guest_primary_rest(qxl->id, sc->stride, sc->type,
1297
                                        sc->flags);
1298

    
1299
    surface.mouse_mode = true;
1300
    surface.group_id   = MEMSLOT_GROUP_GUEST;
1301
    if (loadvm) {
1302
        surface.flags |= QXL_SURF_FLAG_KEEP_DATA;
1303
    }
1304

    
1305
    qxl->mode = QXL_MODE_NATIVE;
1306
    qxl->cmdflags = 0;
1307
    qemu_spice_create_primary_surface(&qxl->ssd, 0, &surface, async);
1308

    
1309
    if (async == QXL_SYNC) {
1310
        qxl_create_guest_primary_complete(qxl);
1311
    }
1312
}
1313

    
1314
/* return 1 if surface destoy was initiated (in QXL_ASYNC case) or
1315
 * done (in QXL_SYNC case), 0 otherwise. */
1316
static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async)
1317
{
1318
    if (d->mode == QXL_MODE_UNDEFINED) {
1319
        return 0;
1320
    }
1321
    trace_qxl_destroy_primary(d->id);
1322
    d->mode = QXL_MODE_UNDEFINED;
1323
    qemu_spice_destroy_primary_surface(&d->ssd, 0, async);
1324
    qxl_spice_reset_cursor(d);
1325
    return 1;
1326
}
1327

    
1328
static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
1329
{
1330
    pcibus_t start = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr;
1331
    pcibus_t end   = d->pci.io_regions[QXL_RAM_RANGE_INDEX].size + start;
1332
    QXLMode *mode = d->modes->modes + modenr;
1333
    uint64_t devmem = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr;
1334
    QXLMemSlot slot = {
1335
        .mem_start = start,
1336
        .mem_end = end
1337
    };
1338
    QXLSurfaceCreate surface = {
1339
        .width      = mode->x_res,
1340
        .height     = mode->y_res,
1341
        .stride     = -mode->x_res * 4,
1342
        .format     = SPICE_SURFACE_FMT_32_xRGB,
1343
        .flags      = loadvm ? QXL_SURF_FLAG_KEEP_DATA : 0,
1344
        .mouse_mode = true,
1345
        .mem        = devmem + d->shadow_rom.draw_area_offset,
1346
    };
1347

    
1348
    trace_qxl_set_mode(d->id, modenr, mode->x_res, mode->y_res, mode->bits,
1349
                       devmem);
1350
    if (!loadvm) {
1351
        qxl_hard_reset(d, 0);
1352
    }
1353

    
1354
    d->guest_slots[0].slot = slot;
1355
    assert(qxl_add_memslot(d, 0, devmem, QXL_SYNC) == 0);
1356

    
1357
    d->guest_primary.surface = surface;
1358
    qxl_create_guest_primary(d, 0, QXL_SYNC);
1359

    
1360
    d->mode = QXL_MODE_COMPAT;
1361
    d->cmdflags = QXL_COMMAND_FLAG_COMPAT;
1362
    if (mode->bits == 16) {
1363
        d->cmdflags |= QXL_COMMAND_FLAG_COMPAT_16BPP;
1364
    }
1365
    d->shadow_rom.mode = cpu_to_le32(modenr);
1366
    d->rom->mode = cpu_to_le32(modenr);
1367
    qxl_rom_set_dirty(d);
1368
}
1369

    
1370
static void ioport_write(void *opaque, target_phys_addr_t addr,
1371
                         uint64_t val, unsigned size)
1372
{
1373
    PCIQXLDevice *d = opaque;
1374
    uint32_t io_port = addr;
1375
    qxl_async_io async = QXL_SYNC;
1376
    uint32_t orig_io_port = io_port;
1377

    
1378
    if (d->guest_bug && !io_port == QXL_IO_RESET) {
1379
        return;
1380
    }
1381

    
1382
    if (d->revision <= QXL_REVISION_STABLE_V10 &&
1383
        io_port >= QXL_IO_FLUSH_SURFACES_ASYNC) {
1384
        qxl_set_guest_bug(d, "unsupported io %d for revision %d\n",
1385
            io_port, d->revision);
1386
        return;
1387
    }
1388

    
1389
    switch (io_port) {
1390
    case QXL_IO_RESET:
1391
    case QXL_IO_SET_MODE:
1392
    case QXL_IO_MEMSLOT_ADD:
1393
    case QXL_IO_MEMSLOT_DEL:
1394
    case QXL_IO_CREATE_PRIMARY:
1395
    case QXL_IO_UPDATE_IRQ:
1396
    case QXL_IO_LOG:
1397
    case QXL_IO_MEMSLOT_ADD_ASYNC:
1398
    case QXL_IO_CREATE_PRIMARY_ASYNC:
1399
        break;
1400
    default:
1401
        if (d->mode != QXL_MODE_VGA) {
1402
            break;
1403
        }
1404
        trace_qxl_io_unexpected_vga_mode(d->id,
1405
            io_port, io_port_to_string(io_port));
1406
        /* be nice to buggy guest drivers */
1407
        if (io_port >= QXL_IO_UPDATE_AREA_ASYNC &&
1408
            io_port < QXL_IO_RANGE_SIZE) {
1409
            qxl_send_events(d, QXL_INTERRUPT_IO_CMD);
1410
        }
1411
        return;
1412
    }
1413

    
1414
    /* we change the io_port to avoid ifdeffery in the main switch */
1415
    orig_io_port = io_port;
1416
    switch (io_port) {
1417
    case QXL_IO_UPDATE_AREA_ASYNC:
1418
        io_port = QXL_IO_UPDATE_AREA;
1419
        goto async_common;
1420
    case QXL_IO_MEMSLOT_ADD_ASYNC:
1421
        io_port = QXL_IO_MEMSLOT_ADD;
1422
        goto async_common;
1423
    case QXL_IO_CREATE_PRIMARY_ASYNC:
1424
        io_port = QXL_IO_CREATE_PRIMARY;
1425
        goto async_common;
1426
    case QXL_IO_DESTROY_PRIMARY_ASYNC:
1427
        io_port = QXL_IO_DESTROY_PRIMARY;
1428
        goto async_common;
1429
    case QXL_IO_DESTROY_SURFACE_ASYNC:
1430
        io_port = QXL_IO_DESTROY_SURFACE_WAIT;
1431
        goto async_common;
1432
    case QXL_IO_DESTROY_ALL_SURFACES_ASYNC:
1433
        io_port = QXL_IO_DESTROY_ALL_SURFACES;
1434
        goto async_common;
1435
    case QXL_IO_FLUSH_SURFACES_ASYNC:
1436
    case QXL_IO_MONITORS_CONFIG_ASYNC:
1437
async_common:
1438
        async = QXL_ASYNC;
1439
        qemu_mutex_lock(&d->async_lock);
1440
        if (d->current_async != QXL_UNDEFINED_IO) {
1441
            qxl_set_guest_bug(d, "%d async started before last (%d) complete",
1442
                io_port, d->current_async);
1443
            qemu_mutex_unlock(&d->async_lock);
1444
            return;
1445
        }
1446
        d->current_async = orig_io_port;
1447
        qemu_mutex_unlock(&d->async_lock);
1448
        break;
1449
    default:
1450
        break;
1451
    }
1452
    trace_qxl_io_write(d->id, qxl_mode_to_string(d->mode), addr, val, size,
1453
                       async);
1454

    
1455
    switch (io_port) {
1456
    case QXL_IO_UPDATE_AREA:
1457
    {
1458
        QXLCookie *cookie = NULL;
1459
        QXLRect update = d->ram->update_area;
1460

    
1461
        if (d->ram->update_surface > d->ssd.num_surfaces) {
1462
            qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
1463
                              d->ram->update_surface);
1464
            return;
1465
        }
1466
        if (update.left >= update.right || update.top >= update.bottom) {
1467
            qxl_set_guest_bug(d,
1468
                    "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
1469
                    update.left, update.top, update.right, update.bottom);
1470
            return;
1471
        }
1472

    
1473
        if (async == QXL_ASYNC) {
1474
            cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
1475
                                    QXL_IO_UPDATE_AREA_ASYNC);
1476
            cookie->u.area = update;
1477
        }
1478
        qxl_spice_update_area(d, d->ram->update_surface,
1479
                              cookie ? &cookie->u.area : &update,
1480
                              NULL, 0, 0, async, cookie);
1481
        break;
1482
    }
1483
    case QXL_IO_NOTIFY_CMD:
1484
        qemu_spice_wakeup(&d->ssd);
1485
        break;
1486
    case QXL_IO_NOTIFY_CURSOR:
1487
        qemu_spice_wakeup(&d->ssd);
1488
        break;
1489
    case QXL_IO_UPDATE_IRQ:
1490
        qxl_update_irq(d);
1491
        break;
1492
    case QXL_IO_NOTIFY_OOM:
1493
        if (!SPICE_RING_IS_EMPTY(&d->ram->release_ring)) {
1494
            break;
1495
        }
1496
        d->oom_running = 1;
1497
        qxl_spice_oom(d);
1498
        d->oom_running = 0;
1499
        break;
1500
    case QXL_IO_SET_MODE:
1501
        qxl_set_mode(d, val, 0);
1502
        break;
1503
    case QXL_IO_LOG:
1504
        if (d->guestdebug) {
1505
            fprintf(stderr, "qxl/guest-%d: %" PRId64 ": %s", d->id,
1506
                    qemu_get_clock_ns(vm_clock), d->ram->log_buf);
1507
        }
1508
        break;
1509
    case QXL_IO_RESET:
1510
        qxl_hard_reset(d, 0);
1511
        break;
1512
    case QXL_IO_MEMSLOT_ADD:
1513
        if (val >= NUM_MEMSLOTS) {
1514
            qxl_set_guest_bug(d, "QXL_IO_MEMSLOT_ADD: val out of range");
1515
            break;
1516
        }
1517
        if (d->guest_slots[val].active) {
1518
            qxl_set_guest_bug(d,
1519
                        "QXL_IO_MEMSLOT_ADD: memory slot already active");
1520
            break;
1521
        }
1522
        d->guest_slots[val].slot = d->ram->mem_slot;
1523
        qxl_add_memslot(d, val, 0, async);
1524
        break;
1525
    case QXL_IO_MEMSLOT_DEL:
1526
        if (val >= NUM_MEMSLOTS) {
1527
            qxl_set_guest_bug(d, "QXL_IO_MEMSLOT_DEL: val out of range");
1528
            break;
1529
        }
1530
        qxl_del_memslot(d, val);
1531
        break;
1532
    case QXL_IO_CREATE_PRIMARY:
1533
        if (val != 0) {
1534
            qxl_set_guest_bug(d, "QXL_IO_CREATE_PRIMARY (async=%d): val != 0",
1535
                          async);
1536
            goto cancel_async;
1537
        }
1538
        d->guest_primary.surface = d->ram->create_surface;
1539
        qxl_create_guest_primary(d, 0, async);
1540
        break;
1541
    case QXL_IO_DESTROY_PRIMARY:
1542
        if (val != 0) {
1543
            qxl_set_guest_bug(d, "QXL_IO_DESTROY_PRIMARY (async=%d): val != 0",
1544
                          async);
1545
            goto cancel_async;
1546
        }
1547
        if (!qxl_destroy_primary(d, async)) {
1548
            trace_qxl_io_destroy_primary_ignored(d->id,
1549
                                                 qxl_mode_to_string(d->mode));
1550
            goto cancel_async;
1551
        }
1552
        break;
1553
    case QXL_IO_DESTROY_SURFACE_WAIT:
1554
        if (val >= d->ssd.num_surfaces) {
1555
            qxl_set_guest_bug(d, "QXL_IO_DESTROY_SURFACE (async=%d):"
1556
                             "%" PRIu64 " >= NUM_SURFACES", async, val);
1557
            goto cancel_async;
1558
        }
1559
        qxl_spice_destroy_surface_wait(d, val, async);
1560
        break;
1561
    case QXL_IO_FLUSH_RELEASE: {
1562
        QXLReleaseRing *ring = &d->ram->release_ring;
1563
        if (ring->prod - ring->cons + 1 == ring->num_items) {
1564
            fprintf(stderr,
1565
                "ERROR: no flush, full release ring [p%d,%dc]\n",
1566
                ring->prod, ring->cons);
1567
        }
1568
        qxl_push_free_res(d, 1 /* flush */);
1569
        break;
1570
    }
1571
    case QXL_IO_FLUSH_SURFACES_ASYNC:
1572
        qxl_spice_flush_surfaces_async(d);
1573
        break;
1574
    case QXL_IO_DESTROY_ALL_SURFACES:
1575
        d->mode = QXL_MODE_UNDEFINED;
1576
        qxl_spice_destroy_surfaces(d, async);
1577
        break;
1578
    case QXL_IO_MONITORS_CONFIG_ASYNC:
1579
        qxl_spice_monitors_config_async(d, 0);
1580
        break;
1581
    default:
1582
        qxl_set_guest_bug(d, "%s: unexpected ioport=0x%x\n", __func__, io_port);
1583
    }
1584
    return;
1585
cancel_async:
1586
    if (async) {
1587
        qxl_send_events(d, QXL_INTERRUPT_IO_CMD);
1588
        qemu_mutex_lock(&d->async_lock);
1589
        d->current_async = QXL_UNDEFINED_IO;
1590
        qemu_mutex_unlock(&d->async_lock);
1591
    }
1592
}
1593

    
1594
static uint64_t ioport_read(void *opaque, target_phys_addr_t addr,
1595
                            unsigned size)
1596
{
1597
    PCIQXLDevice *d = opaque;
1598

    
1599
    trace_qxl_io_read_unexpected(d->id);
1600
    return 0xff;
1601
}
1602

    
1603
static const MemoryRegionOps qxl_io_ops = {
1604
    .read = ioport_read,
1605
    .write = ioport_write,
1606
    .valid = {
1607
        .min_access_size = 1,
1608
        .max_access_size = 1,
1609
    },
1610
};
1611

    
1612
static void pipe_read(void *opaque)
1613
{
1614
    PCIQXLDevice *d = opaque;
1615
    char dummy;
1616
    int len;
1617

    
1618
    do {
1619
        len = read(d->pipe[0], &dummy, sizeof(dummy));
1620
    } while (len == sizeof(dummy));
1621
    qxl_update_irq(d);
1622
}
1623

    
1624
static void qxl_send_events(PCIQXLDevice *d, uint32_t events)
1625
{
1626
    uint32_t old_pending;
1627
    uint32_t le_events = cpu_to_le32(events);
1628

    
1629
    assert(qemu_spice_display_is_running(&d->ssd));
1630
    old_pending = __sync_fetch_and_or(&d->ram->int_pending, le_events);
1631
    if ((old_pending & le_events) == le_events) {
1632
        return;
1633
    }
1634
    if (qemu_thread_is_self(&d->main)) {
1635
        qxl_update_irq(d);
1636
    } else {
1637
        if (write(d->pipe[1], d, 1) != 1) {
1638
            dprint(d, 1, "%s: write to pipe failed\n", __func__);
1639
        }
1640
    }
1641
}
1642

    
1643
static void init_pipe_signaling(PCIQXLDevice *d)
1644
{
1645
    if (pipe(d->pipe) < 0) {
1646
        fprintf(stderr, "%s:%s: qxl pipe creation failed\n",
1647
                __FILE__, __func__);
1648
        exit(1);
1649
    }
1650
    fcntl(d->pipe[0], F_SETFL, O_NONBLOCK);
1651
    fcntl(d->pipe[1], F_SETFL, O_NONBLOCK);
1652
    fcntl(d->pipe[0], F_SETOWN, getpid());
1653

    
1654
    qemu_thread_get_self(&d->main);
1655
    qemu_set_fd_handler(d->pipe[0], pipe_read, NULL, d);
1656
}
1657

    
1658
/* graphics console */
1659

    
1660
static void qxl_hw_update(void *opaque)
1661
{
1662
    PCIQXLDevice *qxl = opaque;
1663
    VGACommonState *vga = &qxl->vga;
1664

    
1665
    switch (qxl->mode) {
1666
    case QXL_MODE_VGA:
1667
        vga->update(vga);
1668
        break;
1669
    case QXL_MODE_COMPAT:
1670
    case QXL_MODE_NATIVE:
1671
        qxl_render_update(qxl);
1672
        break;
1673
    default:
1674
        break;
1675
    }
1676
}
1677

    
1678
static void qxl_hw_invalidate(void *opaque)
1679
{
1680
    PCIQXLDevice *qxl = opaque;
1681
    VGACommonState *vga = &qxl->vga;
1682

    
1683
    vga->invalidate(vga);
1684
}
1685

    
1686
static void qxl_hw_screen_dump(void *opaque, const char *filename, bool cswitch)
1687
{
1688
    PCIQXLDevice *qxl = opaque;
1689
    VGACommonState *vga = &qxl->vga;
1690

    
1691
    switch (qxl->mode) {
1692
    case QXL_MODE_COMPAT:
1693
    case QXL_MODE_NATIVE:
1694
        qxl_render_update(qxl);
1695
        ppm_save(filename, qxl->ssd.ds->surface);
1696
        break;
1697
    case QXL_MODE_VGA:
1698
        vga->screen_dump(vga, filename, cswitch);
1699
        break;
1700
    default:
1701
        break;
1702
    }
1703
}
1704

    
1705
static void qxl_hw_text_update(void *opaque, console_ch_t *chardata)
1706
{
1707
    PCIQXLDevice *qxl = opaque;
1708
    VGACommonState *vga = &qxl->vga;
1709

    
1710
    if (qxl->mode == QXL_MODE_VGA) {
1711
        vga->text_update(vga, chardata);
1712
        return;
1713
    }
1714
}
1715

    
1716
static void qxl_dirty_surfaces(PCIQXLDevice *qxl)
1717
{
1718
    intptr_t vram_start;
1719
    int i;
1720

    
1721
    if (qxl->mode != QXL_MODE_NATIVE && qxl->mode != QXL_MODE_COMPAT) {
1722
        return;
1723
    }
1724

    
1725
    /* dirty the primary surface */
1726
    qxl_set_dirty(&qxl->vga.vram, qxl->shadow_rom.draw_area_offset,
1727
                  qxl->shadow_rom.surface0_area_size);
1728

    
1729
    vram_start =  (intptr_t)memory_region_get_ram_ptr(&qxl->vram_bar);
1730

    
1731
    /* dirty the off-screen surfaces */
1732
    for (i = 0; i < qxl->ssd.num_surfaces; i++) {
1733
        QXLSurfaceCmd *cmd;
1734
        intptr_t surface_offset;
1735
        int surface_size;
1736

    
1737
        if (qxl->guest_surfaces.cmds[i] == 0) {
1738
            continue;
1739
        }
1740

    
1741
        cmd = qxl_phys2virt(qxl, qxl->guest_surfaces.cmds[i],
1742
                            MEMSLOT_GROUP_GUEST);
1743
        assert(cmd);
1744
        assert(cmd->type == QXL_SURFACE_CMD_CREATE);
1745
        surface_offset = (intptr_t)qxl_phys2virt(qxl,
1746
                                                 cmd->u.surface_create.data,
1747
                                                 MEMSLOT_GROUP_GUEST);
1748
        assert(surface_offset);
1749
        surface_offset -= vram_start;
1750
        surface_size = cmd->u.surface_create.height *
1751
                       abs(cmd->u.surface_create.stride);
1752
        trace_qxl_surfaces_dirty(qxl->id, i, (int)surface_offset, surface_size);
1753
        qxl_set_dirty(&qxl->vram_bar, surface_offset, surface_size);
1754
    }
1755
}
1756

    
1757
static void qxl_vm_change_state_handler(void *opaque, int running,
1758
                                        RunState state)
1759
{
1760
    PCIQXLDevice *qxl = opaque;
1761
    qemu_spice_vm_change_state_handler(&qxl->ssd, running, state);
1762

    
1763
    if (running) {
1764
        /*
1765
         * if qxl_send_events was called from spice server context before
1766
         * migration ended, qxl_update_irq for these events might not have been
1767
         * called
1768
         */
1769
         qxl_update_irq(qxl);
1770
    } else {
1771
        /* make sure surfaces are saved before migration */
1772
        qxl_dirty_surfaces(qxl);
1773
    }
1774
}
1775

    
1776
/* display change listener */
1777

    
1778
static void display_update(struct DisplayState *ds, int x, int y, int w, int h)
1779
{
1780
    if (qxl0->mode == QXL_MODE_VGA) {
1781
        qemu_spice_display_update(&qxl0->ssd, x, y, w, h);
1782
    }
1783
}
1784

    
1785
static void display_resize(struct DisplayState *ds)
1786
{
1787
    if (qxl0->mode == QXL_MODE_VGA) {
1788
        qemu_spice_display_resize(&qxl0->ssd);
1789
    }
1790
}
1791

    
1792
static void display_refresh(struct DisplayState *ds)
1793
{
1794
    if (qxl0->mode == QXL_MODE_VGA) {
1795
        qemu_spice_display_refresh(&qxl0->ssd);
1796
    } else {
1797
        qemu_mutex_lock(&qxl0->ssd.lock);
1798
        qemu_spice_cursor_refresh_unlocked(&qxl0->ssd);
1799
        qemu_mutex_unlock(&qxl0->ssd.lock);
1800
    }
1801
}
1802

    
1803
static DisplayChangeListener display_listener = {
1804
    .dpy_update  = display_update,
1805
    .dpy_resize  = display_resize,
1806
    .dpy_refresh = display_refresh,
1807
};
1808

    
1809
static void qxl_init_ramsize(PCIQXLDevice *qxl)
1810
{
1811
    /* vga mode framebuffer / primary surface (bar 0, first part) */
1812
    if (qxl->vgamem_size_mb < 8) {
1813
        qxl->vgamem_size_mb = 8;
1814
    }
1815
    qxl->vgamem_size = qxl->vgamem_size_mb * 1024 * 1024;
1816

    
1817
    /* vga ram (bar 0, total) */
1818
    if (qxl->ram_size_mb != -1) {
1819
        qxl->vga.vram_size = qxl->ram_size_mb * 1024 * 1024;
1820
    }
1821
    if (qxl->vga.vram_size < qxl->vgamem_size * 2) {
1822
        qxl->vga.vram_size = qxl->vgamem_size * 2;
1823
    }
1824

    
1825
    /* vram32 (surfaces, 32bit, bar 1) */
1826
    if (qxl->vram32_size_mb != -1) {
1827
        qxl->vram32_size = qxl->vram32_size_mb * 1024 * 1024;
1828
    }
1829
    if (qxl->vram32_size < 4096) {
1830
        qxl->vram32_size = 4096;
1831
    }
1832

    
1833
    /* vram (surfaces, 64bit, bar 4+5) */
1834
    if (qxl->vram_size_mb != -1) {
1835
        qxl->vram_size = qxl->vram_size_mb * 1024 * 1024;
1836
    }
1837
    if (qxl->vram_size < qxl->vram32_size) {
1838
        qxl->vram_size = qxl->vram32_size;
1839
    }
1840

    
1841
    if (qxl->revision == 1) {
1842
        qxl->vram32_size = 4096;
1843
        qxl->vram_size = 4096;
1844
    }
1845
    qxl->vgamem_size = msb_mask(qxl->vgamem_size * 2 - 1);
1846
    qxl->vga.vram_size = msb_mask(qxl->vga.vram_size * 2 - 1);
1847
    qxl->vram32_size = msb_mask(qxl->vram32_size * 2 - 1);
1848
    qxl->vram_size = msb_mask(qxl->vram_size * 2 - 1);
1849
}
1850

    
1851
static int qxl_init_common(PCIQXLDevice *qxl)
1852
{
1853
    uint8_t* config = qxl->pci.config;
1854
    uint32_t pci_device_rev;
1855
    uint32_t io_size;
1856

    
1857
    qxl->mode = QXL_MODE_UNDEFINED;
1858
    qxl->generation = 1;
1859
    qxl->num_memslots = NUM_MEMSLOTS;
1860
    qemu_mutex_init(&qxl->track_lock);
1861
    qemu_mutex_init(&qxl->async_lock);
1862
    qxl->current_async = QXL_UNDEFINED_IO;
1863
    qxl->guest_bug = 0;
1864

    
1865
    switch (qxl->revision) {
1866
    case 1: /* spice 0.4 -- qxl-1 */
1867
        pci_device_rev = QXL_REVISION_STABLE_V04;
1868
        io_size = 8;
1869
        break;
1870
    case 2: /* spice 0.6 -- qxl-2 */
1871
        pci_device_rev = QXL_REVISION_STABLE_V06;
1872
        io_size = 16;
1873
        break;
1874
    case 3: /* qxl-3 */
1875
        pci_device_rev = QXL_REVISION_STABLE_V10;
1876
        io_size = 32; /* PCI region size must be pow2 */
1877
        break;
1878
/* 0x000b01 == 0.11.1 */
1879
#if SPICE_SERVER_VERSION >= 0x000b01 && \
1880
        defined(CONFIG_QXL_IO_MONITORS_CONFIG_ASYNC)
1881
    case 4: /* qxl-4 */
1882
        pci_device_rev = QXL_REVISION_STABLE_V12;
1883
        io_size = msb_mask(QXL_IO_RANGE_SIZE * 2 - 1);
1884
        break;
1885
#endif
1886
    default:
1887
        error_report("Invalid revision %d for qxl device (max %d)",
1888
                     qxl->revision, QXL_DEFAULT_REVISION);
1889
        return -1;
1890
    }
1891

    
1892
    pci_set_byte(&config[PCI_REVISION_ID], pci_device_rev);
1893
    pci_set_byte(&config[PCI_INTERRUPT_PIN], 1);
1894

    
1895
    qxl->rom_size = qxl_rom_size();
1896
    memory_region_init_ram(&qxl->rom_bar, "qxl.vrom", qxl->rom_size);
1897
    vmstate_register_ram(&qxl->rom_bar, &qxl->pci.qdev);
1898
    init_qxl_rom(qxl);
1899
    init_qxl_ram(qxl);
1900

    
1901
    qxl->guest_surfaces.cmds = g_new0(QXLPHYSICAL, qxl->ssd.num_surfaces);
1902
    memory_region_init_ram(&qxl->vram_bar, "qxl.vram", qxl->vram_size);
1903
    vmstate_register_ram(&qxl->vram_bar, &qxl->pci.qdev);
1904
    memory_region_init_alias(&qxl->vram32_bar, "qxl.vram32", &qxl->vram_bar,
1905
                             0, qxl->vram32_size);
1906

    
1907
    memory_region_init_io(&qxl->io_bar, &qxl_io_ops, qxl,
1908
                          "qxl-ioports", io_size);
1909
    if (qxl->id == 0) {
1910
        vga_dirty_log_start(&qxl->vga);
1911
    }
1912

    
1913

    
1914
    pci_register_bar(&qxl->pci, QXL_IO_RANGE_INDEX,
1915
                     PCI_BASE_ADDRESS_SPACE_IO, &qxl->io_bar);
1916

    
1917
    pci_register_bar(&qxl->pci, QXL_ROM_RANGE_INDEX,
1918
                     PCI_BASE_ADDRESS_SPACE_MEMORY, &qxl->rom_bar);
1919

    
1920
    pci_register_bar(&qxl->pci, QXL_RAM_RANGE_INDEX,
1921
                     PCI_BASE_ADDRESS_SPACE_MEMORY, &qxl->vga.vram);
1922

    
1923
    pci_register_bar(&qxl->pci, QXL_VRAM_RANGE_INDEX,
1924
                     PCI_BASE_ADDRESS_SPACE_MEMORY, &qxl->vram32_bar);
1925

    
1926
    if (qxl->vram32_size < qxl->vram_size) {
1927
        /*
1928
         * Make the 64bit vram bar show up only in case it is
1929
         * configured to be larger than the 32bit vram bar.
1930
         */
1931
        pci_register_bar(&qxl->pci, QXL_VRAM64_RANGE_INDEX,
1932
                         PCI_BASE_ADDRESS_SPACE_MEMORY |
1933
                         PCI_BASE_ADDRESS_MEM_TYPE_64 |
1934
                         PCI_BASE_ADDRESS_MEM_PREFETCH,
1935
                         &qxl->vram_bar);
1936
    }
1937

    
1938
    /* print pci bar details */
1939
    dprint(qxl, 1, "ram/%s: %d MB [region 0]\n",
1940
           qxl->id == 0 ? "pri" : "sec",
1941
           qxl->vga.vram_size / (1024*1024));
1942
    dprint(qxl, 1, "vram/32: %d MB [region 1]\n",
1943
           qxl->vram32_size / (1024*1024));
1944
    dprint(qxl, 1, "vram/64: %d MB %s\n",
1945
           qxl->vram_size / (1024*1024),
1946
           qxl->vram32_size < qxl->vram_size ? "[region 4]" : "[unmapped]");
1947

    
1948
    qxl->ssd.qxl.base.sif = &qxl_interface.base;
1949
    qxl->ssd.qxl.id = qxl->id;
1950
    qemu_spice_add_interface(&qxl->ssd.qxl.base);
1951
    qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl);
1952

    
1953
    init_pipe_signaling(qxl);
1954
    qxl_reset_state(qxl);
1955

    
1956
    qxl->update_area_bh = qemu_bh_new(qxl_render_update_area_bh, qxl);
1957

    
1958
    return 0;
1959
}
1960

    
1961
static int qxl_init_primary(PCIDevice *dev)
1962
{
1963
    PCIQXLDevice *qxl = DO_UPCAST(PCIQXLDevice, pci, dev);
1964
    VGACommonState *vga = &qxl->vga;
1965
    PortioList *qxl_vga_port_list = g_new(PortioList, 1);
1966

    
1967
    qxl->id = 0;
1968
    qxl_init_ramsize(qxl);
1969
    vga->vram_size_mb = qxl->vga.vram_size >> 20;
1970
    vga_common_init(vga);
1971
    vga_init(vga, pci_address_space(dev), pci_address_space_io(dev), false);
1972
    portio_list_init(qxl_vga_port_list, qxl_vga_portio_list, vga, "vga");
1973
    portio_list_add(qxl_vga_port_list, pci_address_space_io(dev), 0x3b0);
1974

    
1975
    vga->ds = graphic_console_init(qxl_hw_update, qxl_hw_invalidate,
1976
                                   qxl_hw_screen_dump, qxl_hw_text_update, qxl);
1977
    qemu_spice_display_init_common(&qxl->ssd, vga->ds);
1978

    
1979
    qxl0 = qxl;
1980
    register_displaychangelistener(vga->ds, &display_listener);
1981

    
1982
    return qxl_init_common(qxl);
1983
}
1984

    
1985
static int qxl_init_secondary(PCIDevice *dev)
1986
{
1987
    static int device_id = 1;
1988
    PCIQXLDevice *qxl = DO_UPCAST(PCIQXLDevice, pci, dev);
1989

    
1990
    qxl->id = device_id++;
1991
    qxl_init_ramsize(qxl);
1992
    memory_region_init_ram(&qxl->vga.vram, "qxl.vgavram", qxl->vga.vram_size);
1993
    vmstate_register_ram(&qxl->vga.vram, &qxl->pci.qdev);
1994
    qxl->vga.vram_ptr = memory_region_get_ram_ptr(&qxl->vga.vram);
1995

    
1996
    return qxl_init_common(qxl);
1997
}
1998

    
1999
static void qxl_pre_save(void *opaque)
2000
{
2001
    PCIQXLDevice* d = opaque;
2002
    uint8_t *ram_start = d->vga.vram_ptr;
2003

    
2004
    trace_qxl_pre_save(d->id);
2005
    if (d->last_release == NULL) {
2006
        d->last_release_offset = 0;
2007
    } else {
2008
        d->last_release_offset = (uint8_t *)d->last_release - ram_start;
2009
    }
2010
    assert(d->last_release_offset < d->vga.vram_size);
2011
}
2012

    
2013
static int qxl_pre_load(void *opaque)
2014
{
2015
    PCIQXLDevice* d = opaque;
2016

    
2017
    trace_qxl_pre_load(d->id);
2018
    qxl_hard_reset(d, 1);
2019
    qxl_exit_vga_mode(d);
2020
    return 0;
2021
}
2022

    
2023
static void qxl_create_memslots(PCIQXLDevice *d)
2024
{
2025
    int i;
2026

    
2027
    for (i = 0; i < NUM_MEMSLOTS; i++) {
2028
        if (!d->guest_slots[i].active) {
2029
            continue;
2030
        }
2031
        qxl_add_memslot(d, i, 0, QXL_SYNC);
2032
    }
2033
}
2034

    
2035
static int qxl_post_load(void *opaque, int version)
2036
{
2037
    PCIQXLDevice* d = opaque;
2038
    uint8_t *ram_start = d->vga.vram_ptr;
2039
    QXLCommandExt *cmds;
2040
    int in, out, newmode;
2041

    
2042
    assert(d->last_release_offset < d->vga.vram_size);
2043
    if (d->last_release_offset == 0) {
2044
        d->last_release = NULL;
2045
    } else {
2046
        d->last_release = (QXLReleaseInfo *)(ram_start + d->last_release_offset);
2047
    }
2048

    
2049
    d->modes = (QXLModes*)((uint8_t*)d->rom + d->rom->modes_offset);
2050

    
2051
    trace_qxl_post_load(d->id, qxl_mode_to_string(d->mode));
2052
    newmode = d->mode;
2053
    d->mode = QXL_MODE_UNDEFINED;
2054

    
2055
    switch (newmode) {
2056
    case QXL_MODE_UNDEFINED:
2057
        break;
2058
    case QXL_MODE_VGA:
2059
        qxl_create_memslots(d);
2060
        qxl_enter_vga_mode(d);
2061
        break;
2062
    case QXL_MODE_NATIVE:
2063
        qxl_create_memslots(d);
2064
        qxl_create_guest_primary(d, 1, QXL_SYNC);
2065

    
2066
        /* replay surface-create and cursor-set commands */
2067
        cmds = g_malloc0(sizeof(QXLCommandExt) * (d->ssd.num_surfaces + 1));
2068
        for (in = 0, out = 0; in < d->ssd.num_surfaces; in++) {
2069
            if (d->guest_surfaces.cmds[in] == 0) {
2070
                continue;
2071
            }
2072
            cmds[out].cmd.data = d->guest_surfaces.cmds[in];
2073
            cmds[out].cmd.type = QXL_CMD_SURFACE;
2074
            cmds[out].group_id = MEMSLOT_GROUP_GUEST;
2075
            out++;
2076
        }
2077
        if (d->guest_cursor) {
2078
            cmds[out].cmd.data = d->guest_cursor;
2079
            cmds[out].cmd.type = QXL_CMD_CURSOR;
2080
            cmds[out].group_id = MEMSLOT_GROUP_GUEST;
2081
            out++;
2082
        }
2083
        qxl_spice_loadvm_commands(d, cmds, out);
2084
        g_free(cmds);
2085
        if (d->guest_monitors_config) {
2086
            qxl_spice_monitors_config_async(d, 1);
2087
        }
2088
        break;
2089
    case QXL_MODE_COMPAT:
2090
        /* note: no need to call qxl_create_memslots, qxl_set_mode
2091
         * creates the mem slot. */
2092
        qxl_set_mode(d, d->shadow_rom.mode, 1);
2093
        break;
2094
    }
2095
    return 0;
2096
}
2097

    
2098
#define QXL_SAVE_VERSION 21
2099

    
2100
static bool qxl_monitors_config_needed(void *opaque)
2101
{
2102
    PCIQXLDevice *qxl = opaque;
2103

    
2104
    return qxl->guest_monitors_config != 0;
2105
}
2106

    
2107

    
2108
static VMStateDescription qxl_memslot = {
2109
    .name               = "qxl-memslot",
2110
    .version_id         = QXL_SAVE_VERSION,
2111
    .minimum_version_id = QXL_SAVE_VERSION,
2112
    .fields = (VMStateField[]) {
2113
        VMSTATE_UINT64(slot.mem_start, struct guest_slots),
2114
        VMSTATE_UINT64(slot.mem_end,   struct guest_slots),
2115
        VMSTATE_UINT32(active,         struct guest_slots),
2116
        VMSTATE_END_OF_LIST()
2117
    }
2118
};
2119

    
2120
static VMStateDescription qxl_surface = {
2121
    .name               = "qxl-surface",
2122
    .version_id         = QXL_SAVE_VERSION,
2123
    .minimum_version_id = QXL_SAVE_VERSION,
2124
    .fields = (VMStateField[]) {
2125
        VMSTATE_UINT32(width,      QXLSurfaceCreate),
2126
        VMSTATE_UINT32(height,     QXLSurfaceCreate),
2127
        VMSTATE_INT32(stride,      QXLSurfaceCreate),
2128
        VMSTATE_UINT32(format,     QXLSurfaceCreate),
2129
        VMSTATE_UINT32(position,   QXLSurfaceCreate),
2130
        VMSTATE_UINT32(mouse_mode, QXLSurfaceCreate),
2131
        VMSTATE_UINT32(flags,      QXLSurfaceCreate),
2132
        VMSTATE_UINT32(type,       QXLSurfaceCreate),
2133
        VMSTATE_UINT64(mem,        QXLSurfaceCreate),
2134
        VMSTATE_END_OF_LIST()
2135
    }
2136
};
2137

    
2138
static VMStateDescription qxl_vmstate_monitors_config = {
2139
    .name               = "qxl/monitors-config",
2140
    .version_id         = 1,
2141
    .minimum_version_id = 1,
2142
    .fields = (VMStateField[]) {
2143
        VMSTATE_UINT64(guest_monitors_config, PCIQXLDevice),
2144
        VMSTATE_END_OF_LIST()
2145
    },
2146
};
2147

    
2148
static VMStateDescription qxl_vmstate = {
2149
    .name               = "qxl",
2150
    .version_id         = QXL_SAVE_VERSION,
2151
    .minimum_version_id = QXL_SAVE_VERSION,
2152
    .pre_save           = qxl_pre_save,
2153
    .pre_load           = qxl_pre_load,
2154
    .post_load          = qxl_post_load,
2155
    .fields = (VMStateField[]) {
2156
        VMSTATE_PCI_DEVICE(pci, PCIQXLDevice),
2157
        VMSTATE_STRUCT(vga, PCIQXLDevice, 0, vmstate_vga_common, VGACommonState),
2158
        VMSTATE_UINT32(shadow_rom.mode, PCIQXLDevice),
2159
        VMSTATE_UINT32(num_free_res, PCIQXLDevice),
2160
        VMSTATE_UINT32(last_release_offset, PCIQXLDevice),
2161
        VMSTATE_UINT32(mode, PCIQXLDevice),
2162
        VMSTATE_UINT32(ssd.unique, PCIQXLDevice),
2163
        VMSTATE_INT32_EQUAL(num_memslots, PCIQXLDevice),
2164
        VMSTATE_STRUCT_ARRAY(guest_slots, PCIQXLDevice, NUM_MEMSLOTS, 0,
2165
                             qxl_memslot, struct guest_slots),
2166
        VMSTATE_STRUCT(guest_primary.surface, PCIQXLDevice, 0,
2167
                       qxl_surface, QXLSurfaceCreate),
2168
        VMSTATE_INT32_EQUAL(ssd.num_surfaces, PCIQXLDevice),
2169
        VMSTATE_VARRAY_INT32(guest_surfaces.cmds, PCIQXLDevice,
2170
                             ssd.num_surfaces, 0,
2171
                             vmstate_info_uint64, uint64_t),
2172
        VMSTATE_UINT64(guest_cursor, PCIQXLDevice),
2173
        VMSTATE_END_OF_LIST()
2174
    },
2175
    .subsections = (VMStateSubsection[]) {
2176
        {
2177
            .vmsd = &qxl_vmstate_monitors_config,
2178
            .needed = qxl_monitors_config_needed,
2179
        }, {
2180
            /* empty */
2181
        }
2182
    }
2183
};
2184

    
2185
static Property qxl_properties[] = {
2186
        DEFINE_PROP_UINT32("ram_size", PCIQXLDevice, vga.vram_size,
2187
                           64 * 1024 * 1024),
2188
        DEFINE_PROP_UINT32("vram_size", PCIQXLDevice, vram32_size,
2189
                           64 * 1024 * 1024),
2190
        DEFINE_PROP_UINT32("revision", PCIQXLDevice, revision,
2191
                           QXL_DEFAULT_REVISION),
2192
        DEFINE_PROP_UINT32("debug", PCIQXLDevice, debug, 0),
2193
        DEFINE_PROP_UINT32("guestdebug", PCIQXLDevice, guestdebug, 0),
2194
        DEFINE_PROP_UINT32("cmdlog", PCIQXLDevice, cmdlog, 0),
2195
        DEFINE_PROP_UINT32("ram_size_mb",  PCIQXLDevice, ram_size_mb, -1),
2196
        DEFINE_PROP_UINT32("vram_size_mb", PCIQXLDevice, vram32_size_mb, -1),
2197
        DEFINE_PROP_UINT32("vram64_size_mb", PCIQXLDevice, vram_size_mb, -1),
2198
        DEFINE_PROP_UINT32("vgamem_mb", PCIQXLDevice, vgamem_size_mb, 16),
2199
        DEFINE_PROP_INT32("surfaces", PCIQXLDevice, ssd.num_surfaces, 1024),
2200
        DEFINE_PROP_END_OF_LIST(),
2201
};
2202

    
2203
static void qxl_primary_class_init(ObjectClass *klass, void *data)
2204
{
2205
    DeviceClass *dc = DEVICE_CLASS(klass);
2206
    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2207

    
2208
    k->no_hotplug = 1;
2209
    k->init = qxl_init_primary;
2210
    k->romfile = "vgabios-qxl.bin";
2211
    k->vendor_id = REDHAT_PCI_VENDOR_ID;
2212
    k->device_id = QXL_DEVICE_ID_STABLE;
2213
    k->class_id = PCI_CLASS_DISPLAY_VGA;
2214
    dc->desc = "Spice QXL GPU (primary, vga compatible)";
2215
    dc->reset = qxl_reset_handler;
2216
    dc->vmsd = &qxl_vmstate;
2217
    dc->props = qxl_properties;
2218
}
2219

    
2220
static TypeInfo qxl_primary_info = {
2221
    .name          = "qxl-vga",
2222
    .parent        = TYPE_PCI_DEVICE,
2223
    .instance_size = sizeof(PCIQXLDevice),
2224
    .class_init    = qxl_primary_class_init,
2225
};
2226

    
2227
static void qxl_secondary_class_init(ObjectClass *klass, void *data)
2228
{
2229
    DeviceClass *dc = DEVICE_CLASS(klass);
2230
    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2231

    
2232
    k->init = qxl_init_secondary;
2233
    k->vendor_id = REDHAT_PCI_VENDOR_ID;
2234
    k->device_id = QXL_DEVICE_ID_STABLE;
2235
    k->class_id = PCI_CLASS_DISPLAY_OTHER;
2236
    dc->desc = "Spice QXL GPU (secondary)";
2237
    dc->reset = qxl_reset_handler;
2238
    dc->vmsd = &qxl_vmstate;
2239
    dc->props = qxl_properties;
2240
}
2241

    
2242
static TypeInfo qxl_secondary_info = {
2243
    .name          = "qxl",
2244
    .parent        = TYPE_PCI_DEVICE,
2245
    .instance_size = sizeof(PCIQXLDevice),
2246
    .class_init    = qxl_secondary_class_init,
2247
};
2248

    
2249
static void qxl_register_types(void)
2250
{
2251
    type_register_static(&qxl_primary_info);
2252
    type_register_static(&qxl_secondary_info);
2253
}
2254

    
2255
type_init(qxl_register_types)