qxl.c · samitouri/QOSamiQemu · siGit Code & Deploy

Code Commits Issues Pulls Sessions CI/CD

master

c 2,622 lines 85.6 KB

Raw

1	/*
2	* Copyright (C) 2010 Red Hat, Inc.
3	*
4	* written by Yaniv Kamay, Izik Eidus, Gerd Hoffmann
5	* maintained by Gerd Hoffmann <kraxel@redhat.com>
6	*
7	* This program is free software; you can redistribute it and/or
8	* modify it under the terms of the GNU General Public License as
9	* published by the Free Software Foundation; either version 2 or
10	* (at your option) version 3 of the License.
11	*
12	* This program is distributed in the hope that it will be useful,
13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	* GNU General Public License for more details.
16	*
17	* You should have received a copy of the GNU General Public License
18	* along with this program; if not, see <http://www.gnu.org/licenses/>.
19	*/
20
21	#include "qemu/osdep.h"
22	#include "qemu/units.h"
23	#include <zlib.h>
24
25	#include "qapi/error.h"
26	#include "qemu/timer.h"
27	#include "qemu/queue.h"
28	#include "qemu/atomic.h"
29	#include "qemu/main-loop.h"
30	#include "qemu/module.h"
31	#include "hw/core/qdev-properties.h"
32	#include "system/runstate.h"
33	#include "migration/cpr.h"
34	#include "migration/vmstate.h"
35	#include "trace.h"
36
37	#include "qxl.h"
38
39	#undef SPICE_RING_CONS_ITEM
40	#define SPICE_RING_CONS_ITEM(qxl, r, ret) { \
41	uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r); \
42	if (cons >= ARRAY_SIZE((r)->items)) { \
43	qxl_set_guest_bug(qxl, "SPICE_RING_CONS_ITEM indices mismatch " \
44	"%u >= %zu", cons, ARRAY_SIZE((r)->items)); \
45	ret = NULL; \
46	} else { \
47	ret = &(r)->items[cons].el; \
48	} \
49	}
50
51	#undef ALIGN
52	#define ALIGN(a, b) (((a) + ((b) - 1)) & ~((b) - 1))
53
54	#define PIXEL_SIZE 0.2936875 /* 1280x1024 is 14.8" x 11.9" */
55
56	#define QXL_MODE(_x, _y, _b, _o) \
57	{ .x_res = _x, \
58	.y_res = _y, \
59	.bits = _b, \
60	.stride = (_x) * (_b) / 8, \
61	.x_mili = PIXEL_SIZE * (_x), \
62	.y_mili = PIXEL_SIZE * (_y), \
63	.orientation = _o, \
64	}
65
66	#define QXL_MODE_16_32(x_res, y_res, orientation) \
67	QXL_MODE(x_res, y_res, 16, orientation), \
68	QXL_MODE(x_res, y_res, 32, orientation)
69
70	#define QXL_MODE_EX(x_res, y_res) \
71	QXL_MODE_16_32(x_res, y_res, 0), \
72	QXL_MODE_16_32(x_res, y_res, 1)
73
74	static QXLMode qxl_modes[] = {
75	QXL_MODE_EX(640, 480),
76	QXL_MODE_EX(800, 480),
77	QXL_MODE_EX(800, 600),
78	QXL_MODE_EX(832, 624),
79	QXL_MODE_EX(960, 640),
80	QXL_MODE_EX(1024, 600),
81	QXL_MODE_EX(1024, 768),
82	QXL_MODE_EX(1152, 864),
83	QXL_MODE_EX(1152, 870),
84	QXL_MODE_EX(1280, 720),
85	QXL_MODE_EX(1280, 760),
86	QXL_MODE_EX(1280, 768),
87	QXL_MODE_EX(1280, 800),
88	QXL_MODE_EX(1280, 960),
89	QXL_MODE_EX(1280, 1024),
90	QXL_MODE_EX(1360, 768),
91	QXL_MODE_EX(1366, 768),
92	QXL_MODE_EX(1400, 1050),
93	QXL_MODE_EX(1440, 900),
94	QXL_MODE_EX(1600, 900),
95	QXL_MODE_EX(1600, 1200),
96	QXL_MODE_EX(1680, 1050),
97	QXL_MODE_EX(1920, 1080),
98	/* these modes need more than 8 MB video memory */
99	QXL_MODE_EX(1920, 1200),
100	QXL_MODE_EX(1920, 1440),
101	QXL_MODE_EX(2000, 2000),
102	QXL_MODE_EX(2048, 1536),
103	QXL_MODE_EX(2048, 2048),
104	QXL_MODE_EX(2560, 1440),
105	QXL_MODE_EX(2560, 1600),
106	/* these modes need more than 16 MB video memory */
107	QXL_MODE_EX(2560, 2048),
108	QXL_MODE_EX(2800, 2100),
109	QXL_MODE_EX(3200, 2400),
110	/* these modes need more than 32 MB video memory */
111	QXL_MODE_EX(3840, 2160), /* 4k mainstream */
112	QXL_MODE_EX(4096, 2160), /* 4k */
113	/* these modes need more than 64 MB video memory */
114	QXL_MODE_EX(7680, 4320), /* 8k mainstream */
115	/* these modes need more than 128 MB video memory */
116	QXL_MODE_EX(8192, 4320), /* 8k */
117	};
118
119	static void qxl_send_events(PCIQXLDevice *d, uint32_t events);
120	static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async);
121	static void qxl_reset_memslots(PCIQXLDevice *d);
122	static void qxl_reset_surfaces(PCIQXLDevice *d);
123	static void qxl_ring_set_dirty(PCIQXLDevice *qxl);
124
125	static bool qxl_hw_update(void *opaque);
126
127	void qxl_set_guest_bug(PCIQXLDevice qxl, const char msg, ...)
128	{
129	trace_qxl_set_guest_bug(qxl->id);
130	qxl_send_events(qxl, QXL_INTERRUPT_ERROR);
131	qxl->guest_bug = 1;
132	if (qxl->guestdebug) {
133	va_list ap;
134	va_start(ap, msg);
135	fprintf(stderr, "qxl-%d: guest bug: ", qxl->id);
136	vfprintf(stderr, msg, ap);
137	fprintf(stderr, "\n");
138	va_end(ap);
139	}
140	}
141
142	static void qxl_clear_guest_bug(PCIQXLDevice *qxl)
143	{
144	qxl->guest_bug = 0;
145	}
146
147	void qxl_spice_update_area(PCIQXLDevice *qxl, uint32_t surface_id,
148	struct QXLRect area, struct QXLRect dirty_rects,
149	uint32_t num_dirty_rects,
150	uint32_t clear_dirty_region,
151	qxl_async_io async, struct QXLCookie *cookie)
152	{
153	trace_qxl_spice_update_area(qxl->id, surface_id, area->left, area->right,
154	area->top, area->bottom);
155	trace_qxl_spice_update_area_rest(qxl->id, num_dirty_rects,
156	clear_dirty_region);
157	if (async == QXL_SYNC) {
158	spice_qxl_update_area(&qxl->ssd.qxl, surface_id, area,
159	dirty_rects, num_dirty_rects, clear_dirty_region);
160	} else {
161	assert(cookie != NULL);
162	spice_qxl_update_area_async(&qxl->ssd.qxl, surface_id, area,
163	clear_dirty_region, (uintptr_t)cookie);
164	}
165	}
166
167	static void qxl_spice_destroy_surface_wait_complete(PCIQXLDevice *qxl,
168	uint32_t id)
169	{
170	trace_qxl_spice_destroy_surface_wait_complete(qxl->id, id);
171	qemu_mutex_lock(&qxl->track_lock);
172	qxl->guest_surfaces.cmds[id] = 0;
173	qxl->guest_surfaces.count--;
174	qemu_mutex_unlock(&qxl->track_lock);
175	}
176
177	static void qxl_spice_destroy_surface_wait(PCIQXLDevice *qxl, uint32_t id,
178	qxl_async_io async)
179	{
180	QXLCookie *cookie;
181
182	trace_qxl_spice_destroy_surface_wait(qxl->id, id, async);
183	if (async) {
184	cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
185	QXL_IO_DESTROY_SURFACE_ASYNC);
186	cookie->u.surface_id = id;
187	spice_qxl_destroy_surface_async(&qxl->ssd.qxl, id, (uintptr_t)cookie);
188	} else {
189	spice_qxl_destroy_surface_wait(&qxl->ssd.qxl, id);
190	qxl_spice_destroy_surface_wait_complete(qxl, id);
191	}
192	}
193
194	static void qxl_spice_flush_surfaces_async(PCIQXLDevice *qxl)
195	{
196	trace_qxl_spice_flush_surfaces_async(qxl->id, qxl->guest_surfaces.count,
197	qxl->num_free_res);
198	spice_qxl_flush_surfaces_async(&qxl->ssd.qxl,
199	(uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
200	QXL_IO_FLUSH_SURFACES_ASYNC));
201	}
202
203	void qxl_spice_loadvm_commands(PCIQXLDevice qxl, struct QXLCommandExt ext,
204	uint32_t count)
205	{
206	trace_qxl_spice_loadvm_commands(qxl->id, ext, count);
207	spice_qxl_loadvm_commands(&qxl->ssd.qxl, ext, count);
208	}
209
210	void qxl_spice_oom(PCIQXLDevice *qxl)
211	{
212	trace_qxl_spice_oom(qxl->id);
213	spice_qxl_oom(&qxl->ssd.qxl);
214	}
215
216	void qxl_spice_reset_memslots(PCIQXLDevice *qxl)
217	{
218	trace_qxl_spice_reset_memslots(qxl->id);
219	spice_qxl_reset_memslots(&qxl->ssd.qxl);
220	}
221
222	static void qxl_spice_destroy_surfaces_complete(PCIQXLDevice *qxl)
223	{
224	trace_qxl_spice_destroy_surfaces_complete(qxl->id);
225	qemu_mutex_lock(&qxl->track_lock);
226	memset(qxl->guest_surfaces.cmds, 0,
227	sizeof(qxl->guest_surfaces.cmds[0]) * qxl->ssd.num_surfaces);
228	qxl->guest_surfaces.count = 0;
229	qemu_mutex_unlock(&qxl->track_lock);
230	}
231
232	static void qxl_spice_destroy_surfaces(PCIQXLDevice *qxl, qxl_async_io async)
233	{
234	trace_qxl_spice_destroy_surfaces(qxl->id, async);
235	if (async) {
236	spice_qxl_destroy_surfaces_async(&qxl->ssd.qxl,
237	(uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
238	QXL_IO_DESTROY_ALL_SURFACES_ASYNC));
239	} else {
240	spice_qxl_destroy_surfaces(&qxl->ssd.qxl);
241	qxl_spice_destroy_surfaces_complete(qxl);
242	}
243	}
244
245	static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay)
246	{
247	QXLMonitorsConfig *cfg;
248
249	trace_qxl_spice_monitors_config(qxl->id);
250	if (replay) {
251	/*
252	* don't use QXL_COOKIE_TYPE_IO:
253	* - we are not running yet (post_load), we will assert
254	* in send_events
255	* - this is not a guest io, but a reply, so async_io isn't set.
256	*/
257	spice_qxl_monitors_config_async(&qxl->ssd.qxl,
258	qxl->guest_monitors_config,
259	MEMSLOT_GROUP_GUEST,
260	(uintptr_t)qxl_cookie_new(
261	QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG,
262	0));
263	} else {
264	qxl->guest_monitors_config = qxl->ram->monitors_config;
265	spice_qxl_monitors_config_async(&qxl->ssd.qxl,
266	qxl->ram->monitors_config,
267	MEMSLOT_GROUP_GUEST,
268	(uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_IO,
269	QXL_IO_MONITORS_CONFIG_ASYNC));
270	}
271
272	cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST,
273	sizeof(QXLMonitorsConfig) + sizeof(QXLHead));
274	if (cfg != NULL && cfg->count == 1) {
275	qxl->guest_primary.resized = 1;
276	qxl->guest_head0_width = cfg->heads[0].width;
277	qxl->guest_head0_height = cfg->heads[0].height;
278	} else {
279	qxl->guest_head0_width = 0;
280	qxl->guest_head0_height = 0;
281	}
282	}
283
284	void qxl_spice_reset_image_cache(PCIQXLDevice *qxl)
285	{
286	trace_qxl_spice_reset_image_cache(qxl->id);
287	spice_qxl_reset_image_cache(&qxl->ssd.qxl);
288	}
289
290	void qxl_spice_reset_cursor(PCIQXLDevice *qxl)
291	{
292	trace_qxl_spice_reset_cursor(qxl->id);
293	spice_qxl_reset_cursor(&qxl->ssd.qxl);
294	qemu_mutex_lock(&qxl->track_lock);
295	qxl->guest_cursor = 0;
296	qemu_mutex_unlock(&qxl->track_lock);
297	if (qxl->ssd.cursor) {
298	cursor_unref(qxl->ssd.cursor);
299	}
300	qxl->ssd.cursor = cursor_builtin_hidden();
301	}
302
303	static uint32_t qxl_crc32(const uint8_t *p, unsigned len)
304	{
305	/*
306	* zlib xors the seed with 0xffffffff, and xors the result
307	* again with 0xffffffff; Both are not done with linux's crc32,
308	* which we want to be compatible with, so undo that.
309	*/
310	return crc32(0xffffffff, p, len) ^ 0xffffffff;
311	}
312
313	static ram_addr_t qxl_rom_size(void)
314	{
315	#define QXL_REQUIRED_SZ (sizeof(QXLRom) + sizeof(QXLModes) + sizeof(qxl_modes))
316	#define QXL_ROM_SZ 8192
317
318	QEMU_BUILD_BUG_ON(QXL_REQUIRED_SZ > QXL_ROM_SZ);
319	return QEMU_ALIGN_UP(QXL_REQUIRED_SZ, qemu_real_host_page_size());
320	}
321
322	static void init_qxl_rom(PCIQXLDevice *d)
323	{
324	QXLRom *rom = memory_region_get_ram_ptr(&d->rom_bar);
325	QXLModes modes = (QXLModes )(rom + 1);
326	uint32_t ram_header_size;
327	uint32_t surface0_area_size;
328	uint32_t num_pages;
329	uint32_t fb;
330	int i, n;
331
332	if (cpr_is_incoming()) {
333	goto skip_init;
334	}
335
336	memset(rom, 0, d->rom_size);
337
338	rom->magic = cpu_to_le32(QXL_ROM_MAGIC);
339	rom->id = cpu_to_le32(d->id);
340	rom->log_level = cpu_to_le32(d->guestdebug);
341	rom->modes_offset = cpu_to_le32(sizeof(QXLRom));
342
343	rom->slot_gen_bits = MEMSLOT_GENERATION_BITS;
344	rom->slot_id_bits = MEMSLOT_SLOT_BITS;
345	rom->slots_start = 1;
346	rom->slots_end = NUM_MEMSLOTS - 1;
347	rom->n_surfaces = cpu_to_le32(d->ssd.num_surfaces);
348
349	for (i = 0, n = 0; i < ARRAY_SIZE(qxl_modes); i++) {
350	fb = qxl_modes[i].y_res * qxl_modes[i].stride;
351	if (fb > d->vgamem_size) {
352	continue;
353	}
354	modes->modes[n].id = cpu_to_le32(i);
355	modes->modes[n].x_res = cpu_to_le32(qxl_modes[i].x_res);
356	modes->modes[n].y_res = cpu_to_le32(qxl_modes[i].y_res);
357	modes->modes[n].bits = cpu_to_le32(qxl_modes[i].bits);
358	modes->modes[n].stride = cpu_to_le32(qxl_modes[i].stride);
359	modes->modes[n].x_mili = cpu_to_le32(qxl_modes[i].x_mili);
360	modes->modes[n].y_mili = cpu_to_le32(qxl_modes[i].y_mili);
361	modes->modes[n].orientation = cpu_to_le32(qxl_modes[i].orientation);
362	n++;
363	}
364	modes->n_modes = cpu_to_le32(n);
365
366	ram_header_size = ALIGN(sizeof(QXLRam), 4096);
367	surface0_area_size = ALIGN(d->vgamem_size, 4096);
368	num_pages = d->vga.vram_size;
369	num_pages -= ram_header_size;
370	num_pages -= surface0_area_size;
371	num_pages = num_pages / QXL_PAGE_SIZE;
372
373	assert(ram_header_size + surface0_area_size <= d->vga.vram_size);
374
375	rom->draw_area_offset = cpu_to_le32(0);
376	rom->surface0_area_size = cpu_to_le32(surface0_area_size);
377	rom->pages_offset = cpu_to_le32(surface0_area_size);
378	rom->num_pages = cpu_to_le32(num_pages);
379	rom->ram_header_offset = cpu_to_le32(d->vga.vram_size - ram_header_size);
380
381	if (d->xres && d->yres) {
382	/* needs linux kernel 4.12+ to work */
383	rom->client_monitors_config.count = 1;
384	rom->client_monitors_config.heads[0].left = 0;
385	rom->client_monitors_config.heads[0].top = 0;
386	rom->client_monitors_config.heads[0].right = cpu_to_le32(d->xres);
387	rom->client_monitors_config.heads[0].bottom = cpu_to_le32(d->yres);
388	rom->client_monitors_config_crc = qxl_crc32(
389	(const uint8_t *)&rom->client_monitors_config,
390	sizeof(rom->client_monitors_config));
391	}
392
393	skip_init:
394	d->shadow_rom = *rom;
395	d->rom = rom;
396	d->modes = modes;
397	}
398
399	static void init_qxl_ram(PCIQXLDevice *d)
400	{
401	uint8_t *buf;
402	uint32_t prod;
403	QXLReleaseRing *ring;
404
405	buf = d->vga.vram_ptr;
406	d->ram = (QXLRam *)(buf + le32_to_cpu(d->shadow_rom.ram_header_offset));
407	if (cpr_is_incoming()) {
408	return;
409	}
410	d->ram->magic = cpu_to_le32(QXL_RAM_MAGIC);
411	d->ram->int_pending = cpu_to_le32(0);
412	d->ram->int_mask = cpu_to_le32(0);
413	d->ram->update_surface = 0;
414	d->ram->monitors_config = 0;
415	SPICE_RING_INIT(&d->ram->cmd_ring);
416	SPICE_RING_INIT(&d->ram->cursor_ring);
417	SPICE_RING_INIT(&d->ram->release_ring);
418
419	ring = &d->ram->release_ring;
420	prod = ring->prod & SPICE_RING_INDEX_MASK(ring);
421	assert(prod < ARRAY_SIZE(ring->items));
422	ring->items[prod].el = 0;
423
424	qxl_ring_set_dirty(d);
425	}
426
427	/* can be called from spice server thread context */
428	static void qxl_set_dirty(MemoryRegion *mr, ram_addr_t addr, ram_addr_t end)
429	{
430	memory_region_set_dirty(mr, addr, end - addr);
431	}
432
433	static void qxl_rom_set_dirty(PCIQXLDevice *qxl)
434	{
435	qxl_set_dirty(&qxl->rom_bar, 0, qxl->rom_size);
436	}
437
438	/* called from spice server thread context only */
439	static void qxl_ram_set_dirty(PCIQXLDevice qxl, void ptr)
440	{
441	void *base = qxl->vga.vram_ptr;
442	intptr_t offset;
443
444	offset = ptr - base;
445	assert(offset < qxl->vga.vram_size);
446	qxl_set_dirty(&qxl->vga.vram, offset, offset + 3);
447	}
448
449	/* can be called from spice server thread context */
450	static void qxl_ring_set_dirty(PCIQXLDevice *qxl)
451	{
452	ram_addr_t addr = qxl->shadow_rom.ram_header_offset;
453	ram_addr_t end = qxl->vga.vram_size;
454	qxl_set_dirty(&qxl->vga.vram, addr, end);
455	}
456
457	/*
458	* keep track of some command state, for savevm/loadvm.
459	* called from spice server thread context only
460	*/
461	static int qxl_track_command(PCIQXLDevice qxl, struct QXLCommandExt ext)
462	{
463	switch (le32_to_cpu(ext->cmd.type)) {
464	case QXL_CMD_SURFACE:
465	{
466	QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id,
467	sizeof(QXLSurfaceCmd));
468
469	if (!cmd) {
470	return 1;
471	}
472	uint32_t id = le32_to_cpu(cmd->surface_id);
473
474	if (id >= qxl->ssd.num_surfaces) {
475	qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE id %d >= %d", id,
476	qxl->ssd.num_surfaces);
477	return 1;
478	}
479	if (cmd->type == QXL_SURFACE_CMD_CREATE &&
480	(cmd->u.surface_create.stride & 0x03) != 0) {
481	qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE stride = %d %% 4 != 0\n",
482	cmd->u.surface_create.stride);
483	return 1;
484	}
485	WITH_QEMU_LOCK_GUARD(&qxl->track_lock) {
486	if (cmd->type == QXL_SURFACE_CMD_CREATE) {
487	qxl->guest_surfaces.cmds[id] = ext->cmd.data;
488	qxl->guest_surfaces.count++;
489	if (qxl->guest_surfaces.max < qxl->guest_surfaces.count) {
490	qxl->guest_surfaces.max = qxl->guest_surfaces.count;
491	}
492	}
493	if (cmd->type == QXL_SURFACE_CMD_DESTROY) {
494	qxl->guest_surfaces.cmds[id] = 0;
495	qxl->guest_surfaces.count--;
496	}
497	}
498	break;
499	}
500	case QXL_CMD_CURSOR:
501	{
502	QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id,
503	sizeof(QXLCursorCmd));
504
505	if (!cmd) {
506	return 1;
507	}
508	if (cmd->type == QXL_CURSOR_SET) {
509	qemu_mutex_lock(&qxl->track_lock);
510	qxl->guest_cursor = ext->cmd.data;
511	qemu_mutex_unlock(&qxl->track_lock);
512	}
513	if (cmd->type == QXL_CURSOR_HIDE) {
514	qemu_mutex_lock(&qxl->track_lock);
515	qxl->guest_cursor = 0;
516	qemu_mutex_unlock(&qxl->track_lock);
517	}
518	break;
519	}
520	}
521	return 0;
522	}
523
524	/* spice display interface callbacks */
525
526	static void interface_attached_worker(QXLInstance *sin)
527	{
528	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
529
530	trace_qxl_interface_attach_worker(qxl->id);
531	}
532
533	static void interface_set_compression_level(QXLInstance *sin, int level)
534	{
535	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
536
537	trace_qxl_interface_set_compression_level(qxl->id, level);
538	qxl->shadow_rom.compression_level = cpu_to_le32(level);
539	if (cpr_is_incoming()) {
540	assert(qxl->rom->compression_level == cpu_to_le32(level));
541	return;
542	}
543	qxl->rom->compression_level = cpu_to_le32(level);
544	qxl_rom_set_dirty(qxl);
545	}
546
547	static void interface_get_init_info(QXLInstance sin, QXLDevInitInfo info)
548	{
549	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
550
551	trace_qxl_interface_get_init_info(qxl->id);
552	info->memslot_gen_bits = MEMSLOT_GENERATION_BITS;
553	info->memslot_id_bits = MEMSLOT_SLOT_BITS;
554	info->num_memslots = NUM_MEMSLOTS;
555	info->num_memslots_groups = NUM_MEMSLOTS_GROUPS;
556	info->internal_groupslot_id = 0;
557	info->qxl_ram_size =
558	le32_to_cpu(qxl->shadow_rom.num_pages) << QXL_PAGE_BITS;
559	info->n_surfaces = qxl->ssd.num_surfaces;
560	}
561
562	static const char *qxl_mode_to_string(int mode)
563	{
564	switch (mode) {
565	case QXL_MODE_COMPAT:
566	return "compat";
567	case QXL_MODE_NATIVE:
568	return "native";
569	case QXL_MODE_UNDEFINED:
570	return "undefined";
571	case QXL_MODE_VGA:
572	return "vga";
573	}
574	return "INVALID";
575	}
576
577	static const char *io_port_to_string(uint32_t io_port)
578	{
579	if (io_port >= QXL_IO_RANGE_SIZE) {
580	return "out of range";
581	}
582	static const char *io_port_to_string[QXL_IO_RANGE_SIZE + 1] = {
583	[QXL_IO_NOTIFY_CMD] = "QXL_IO_NOTIFY_CMD",
584	[QXL_IO_NOTIFY_CURSOR] = "QXL_IO_NOTIFY_CURSOR",
585	[QXL_IO_UPDATE_AREA] = "QXL_IO_UPDATE_AREA",
586	[QXL_IO_UPDATE_IRQ] = "QXL_IO_UPDATE_IRQ",
587	[QXL_IO_NOTIFY_OOM] = "QXL_IO_NOTIFY_OOM",
588	[QXL_IO_RESET] = "QXL_IO_RESET",
589	[QXL_IO_SET_MODE] = "QXL_IO_SET_MODE",
590	[QXL_IO_LOG] = "QXL_IO_LOG",
591	[QXL_IO_MEMSLOT_ADD] = "QXL_IO_MEMSLOT_ADD",
592	[QXL_IO_MEMSLOT_DEL] = "QXL_IO_MEMSLOT_DEL",
593	[QXL_IO_DETACH_PRIMARY] = "QXL_IO_DETACH_PRIMARY",
594	[QXL_IO_ATTACH_PRIMARY] = "QXL_IO_ATTACH_PRIMARY",
595	[QXL_IO_CREATE_PRIMARY] = "QXL_IO_CREATE_PRIMARY",
596	[QXL_IO_DESTROY_PRIMARY] = "QXL_IO_DESTROY_PRIMARY",
597	[QXL_IO_DESTROY_SURFACE_WAIT] = "QXL_IO_DESTROY_SURFACE_WAIT",
598	[QXL_IO_DESTROY_ALL_SURFACES] = "QXL_IO_DESTROY_ALL_SURFACES",
599	[QXL_IO_UPDATE_AREA_ASYNC] = "QXL_IO_UPDATE_AREA_ASYNC",
600	[QXL_IO_MEMSLOT_ADD_ASYNC] = "QXL_IO_MEMSLOT_ADD_ASYNC",
601	[QXL_IO_CREATE_PRIMARY_ASYNC] = "QXL_IO_CREATE_PRIMARY_ASYNC",
602	[QXL_IO_DESTROY_PRIMARY_ASYNC] = "QXL_IO_DESTROY_PRIMARY_ASYNC",
603	[QXL_IO_DESTROY_SURFACE_ASYNC] = "QXL_IO_DESTROY_SURFACE_ASYNC",
604	[QXL_IO_DESTROY_ALL_SURFACES_ASYNC]
605	= "QXL_IO_DESTROY_ALL_SURFACES_ASYNC",
606	[QXL_IO_FLUSH_SURFACES_ASYNC] = "QXL_IO_FLUSH_SURFACES_ASYNC",
607	[QXL_IO_FLUSH_RELEASE] = "QXL_IO_FLUSH_RELEASE",
608	[QXL_IO_MONITORS_CONFIG_ASYNC] = "QXL_IO_MONITORS_CONFIG_ASYNC",
609	};
610	return io_port_to_string[io_port];
611	}
612
613	/* called from spice server thread context only */
614	static int interface_get_command(QXLInstance sin, struct QXLCommandExt ext)
615	{
616	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
617	SimpleSpiceUpdate *update;
618	QXLCommandRing *ring;
619	QXLCommand *cmd;
620	int notify, ret;
621
622	trace_qxl_ring_command_check(qxl->id, qxl_mode_to_string(qxl->mode));
623
624	switch (qxl->mode) {
625	case QXL_MODE_VGA:
626	ret = false;
627	qemu_mutex_lock(&qxl->ssd.lock);
628	update = QTAILQ_FIRST(&qxl->ssd.updates);
629	if (update != NULL) {
630	QTAILQ_REMOVE(&qxl->ssd.updates, update, next);
631	*ext = update->ext;
632	ret = true;
633	}
634	qemu_mutex_unlock(&qxl->ssd.lock);
635	if (ret) {
636	trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode));
637	qxl_log_command(qxl, "vga", ext);
638	}
639	return ret;
640	case QXL_MODE_COMPAT:
641	case QXL_MODE_NATIVE:
642	case QXL_MODE_UNDEFINED:
643	ring = &qxl->ram->cmd_ring;
644	if (qxl->guest_bug \|\| SPICE_RING_IS_EMPTY(ring)) {
645	return false;
646	}
647	SPICE_RING_CONS_ITEM(qxl, ring, cmd);
648	if (!cmd) {
649	return false;
650	}
651	ext->cmd = *cmd;
652	ext->group_id = MEMSLOT_GROUP_GUEST;
653	ext->flags = qxl->cmdflags;
654	SPICE_RING_POP(ring, notify);
655	qxl_ring_set_dirty(qxl);
656	if (notify) {
657	qxl_send_events(qxl, QXL_INTERRUPT_DISPLAY);
658	}
659	qxl->guest_primary.commands++;
660	qxl_track_command(qxl, ext);
661	qxl_log_command(qxl, "cmd", ext);
662	trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode));
663	return true;
664	default:
665	return false;
666	}
667	}
668
669	/* called from spice server thread context only */
670	static int interface_req_cmd_notification(QXLInstance *sin)
671	{
672	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
673	int wait = 1;
674
675	trace_qxl_ring_command_req_notification(qxl->id);
676	switch (qxl->mode) {
677	case QXL_MODE_COMPAT:
678	case QXL_MODE_NATIVE:
679	case QXL_MODE_UNDEFINED:
680	SPICE_RING_CONS_WAIT(&qxl->ram->cmd_ring, wait);
681	qxl_ring_set_dirty(qxl);
682	break;
683	default:
684	/* nothing */
685	break;
686	}
687	return wait;
688	}
689
690	/* called from spice server thread context only */
691	static inline void qxl_push_free_res(PCIQXLDevice *d, int flush)
692	{
693	QXLReleaseRing *ring = &d->ram->release_ring;
694	uint32_t prod;
695	int notify;
696
697	#define QXL_FREE_BUNCH_SIZE 32
698
699	if (ring->prod - ring->cons + 1 == ring->num_items) {
700	/* ring full -- can't push */
701	return;
702	}
703	if (!flush && d->oom_running) {
704	/* collect everything from oom handler before pushing */
705	return;
706	}
707	if (!flush && d->num_free_res < QXL_FREE_BUNCH_SIZE) {
708	/* collect a bit more before pushing */
709	return;
710	}
711
712	SPICE_RING_PUSH(ring, notify);
713	trace_qxl_ring_res_push(d->id, qxl_mode_to_string(d->mode),
714	d->guest_surfaces.count, d->num_free_res,
715	d->last_release, notify ? "yes" : "no");
716	trace_qxl_ring_res_push_rest(d->id, ring->prod - ring->cons,
717	ring->num_items, ring->prod, ring->cons);
718	if (notify) {
719	qxl_send_events(d, QXL_INTERRUPT_DISPLAY);
720	}
721
722	ring = &d->ram->release_ring;
723	prod = ring->prod & SPICE_RING_INDEX_MASK(ring);
724	if (prod >= ARRAY_SIZE(ring->items)) {
725	qxl_set_guest_bug(d, "SPICE_RING_PROD_ITEM indices mismatch "
726	"%u >= %zu", prod, ARRAY_SIZE(ring->items));
727	return;
728	}
729	ring->items[prod].el = 0;
730	d->num_free_res = 0;
731	d->last_release = NULL;
732	qxl_ring_set_dirty(d);
733	}
734
735	/* called from spice server thread context only */
736	static void interface_release_resource(QXLInstance *sin,
737	QXLReleaseInfoExt ext)
738	{
739	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
740	QXLReleaseRing *ring;
741	uint32_t prod;
742	uint64_t id;
743
744	if (!ext.info) {
745	return;
746	}
747	if (ext.group_id == MEMSLOT_GROUP_HOST) {
748	/* host group -> vga mode update request */
749	QXLCommandExt cmdext = (void )(intptr_t)(ext.info->id);
750	SimpleSpiceUpdate *update;
751	g_assert(cmdext->cmd.type == QXL_CMD_DRAW);
752	update = container_of(cmdext, SimpleSpiceUpdate, ext);
753	qemu_spice_destroy_update(&qxl->ssd, update);
754	return;
755	}
756
757	/*
758	* ext->info points into guest-visible memory
759	* pci bar 0, $command.release_info
760	*/
761	ring = &qxl->ram->release_ring;
762	prod = ring->prod & SPICE_RING_INDEX_MASK(ring);
763	if (prod >= ARRAY_SIZE(ring->items)) {
764	qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch "
765	"%u >= %zu", prod, ARRAY_SIZE(ring->items));
766	return;
767	}
768	if (ring->items[prod].el == 0) {
769	/* stick head into the ring */
770	id = ext.info->id;
771	ext.info->next = 0;
772	qxl_ram_set_dirty(qxl, &ext.info->next);
773	ring->items[prod].el = id;
774	qxl_ring_set_dirty(qxl);
775	} else {
776	/* append item to the list */
777	qxl->last_release->next = ext.info->id;
778	qxl_ram_set_dirty(qxl, &qxl->last_release->next);
779	ext.info->next = 0;
780	qxl_ram_set_dirty(qxl, &ext.info->next);
781	}
782	qxl->last_release = ext.info;
783	qxl->num_free_res++;
784	trace_qxl_ring_res_put(qxl->id, qxl->num_free_res);
785	qxl_push_free_res(qxl, 0);
786	}
787
788	/* called from spice server thread context only */
789	static int interface_get_cursor_command(QXLInstance sin, struct QXLCommandExt ext)
790	{
791	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
792	QXLCursorRing *ring;
793	QXLCommand *cmd;
794	int notify;
795
796	trace_qxl_ring_cursor_check(qxl->id, qxl_mode_to_string(qxl->mode));
797
798	switch (qxl->mode) {
799	case QXL_MODE_COMPAT:
800	case QXL_MODE_NATIVE:
801	case QXL_MODE_UNDEFINED:
802	ring = &qxl->ram->cursor_ring;
803	if (SPICE_RING_IS_EMPTY(ring)) {
804	return false;
805	}
806	SPICE_RING_CONS_ITEM(qxl, ring, cmd);
807	if (!cmd) {
808	return false;
809	}
810	ext->cmd = *cmd;
811	ext->group_id = MEMSLOT_GROUP_GUEST;
812	ext->flags = qxl->cmdflags;
813	SPICE_RING_POP(ring, notify);
814	qxl_ring_set_dirty(qxl);
815	if (notify) {
816	qxl_send_events(qxl, QXL_INTERRUPT_CURSOR);
817	}
818	qxl->guest_primary.commands++;
819	qxl_track_command(qxl, ext);
820	qxl_log_command(qxl, "csr", ext);
821	if (qxl->have_vga) {
822	qxl_render_cursor(qxl, ext);
823	}
824	trace_qxl_ring_cursor_get(qxl->id, qxl_mode_to_string(qxl->mode));
825	return true;
826	default:
827	return false;
828	}
829	}
830
831	/* called from spice server thread context only */
832	static int interface_req_cursor_notification(QXLInstance *sin)
833	{
834	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
835	int wait = 1;
836
837	trace_qxl_ring_cursor_req_notification(qxl->id);
838	switch (qxl->mode) {
839	case QXL_MODE_COMPAT:
840	case QXL_MODE_NATIVE:
841	case QXL_MODE_UNDEFINED:
842	SPICE_RING_CONS_WAIT(&qxl->ram->cursor_ring, wait);
843	qxl_ring_set_dirty(qxl);
844	break;
845	default:
846	/* nothing */
847	break;
848	}
849	return wait;
850	}
851
852	/* called from spice server thread context */
853	static void interface_notify_update(QXLInstance *sin, uint32_t update_id)
854	{
855	/*
856	* Called by spice-server as a result of a QXL_CMD_UPDATE which is not in
857	* use by xf86-video-qxl and is defined out in the qxl windows driver.
858	* Probably was at some earlier version that is prior to git start (2009),
859	* and is still guest trigerrable.
860	*/
861	fprintf(stderr, "%s: deprecated\n", __func__);
862	}
863
864	/* called from spice server thread context only */
865	static int interface_flush_resources(QXLInstance *sin)
866	{
867	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
868	int ret;
869
870	ret = qxl->num_free_res;
871	if (ret) {
872	qxl_push_free_res(qxl, 1);
873	}
874	return ret;
875	}
876
877	static void qxl_create_guest_primary_complete(PCIQXLDevice *d);
878
879	/* called from spice server thread context only */
880	static void interface_async_complete_io(PCIQXLDevice qxl, QXLCookie cookie)
881	{
882	uint32_t current_async;
883
884	qemu_mutex_lock(&qxl->async_lock);
885	current_async = qxl->current_async;
886	qxl->current_async = QXL_UNDEFINED_IO;
887	qemu_mutex_unlock(&qxl->async_lock);
888
889	trace_qxl_interface_async_complete_io(qxl->id, current_async, cookie);
890	if (!cookie) {
891	fprintf(stderr, "qxl: %s: error, cookie is NULL\n", __func__);
892	return;
893	}
894	if (cookie && current_async != cookie->io) {
895	fprintf(stderr,
896	"qxl: %s: error: current_async = %d != %"
897	PRId64 " = cookie->io\n", __func__, current_async, cookie->io);
898	}
899	switch (current_async) {
900	case QXL_IO_MEMSLOT_ADD_ASYNC:
901	case QXL_IO_DESTROY_PRIMARY_ASYNC:
902	case QXL_IO_UPDATE_AREA_ASYNC:
903	case QXL_IO_FLUSH_SURFACES_ASYNC:
904	case QXL_IO_MONITORS_CONFIG_ASYNC:
905	break;
906	case QXL_IO_CREATE_PRIMARY_ASYNC:
907	qxl_create_guest_primary_complete(qxl);
908	break;
909	case QXL_IO_DESTROY_ALL_SURFACES_ASYNC:
910	qxl_spice_destroy_surfaces_complete(qxl);
911	break;
912	case QXL_IO_DESTROY_SURFACE_ASYNC:
913	qxl_spice_destroy_surface_wait_complete(qxl, cookie->u.surface_id);
914	break;
915	default:
916	fprintf(stderr, "qxl: %s: unexpected current_async %u\n", __func__,
917	current_async);
918	}
919	qxl_send_events(qxl, QXL_INTERRUPT_IO_CMD);
920	}
921
922	/* called from spice server thread context only */
923	static void interface_update_area_complete(QXLInstance *sin,
924	uint32_t surface_id,
925	QXLRect *dirty, uint32_t num_updated_rects)
926	{
927	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
928	int i;
929	int qxl_i;
930
931	QEMU_LOCK_GUARD(&qxl->ssd.lock);
932	if (surface_id != 0 \|\| !num_updated_rects \|\|
933	!qxl->render_update_cookie_num) {
934	return;
935	}
936	trace_qxl_interface_update_area_complete(qxl->id, surface_id, dirty->left,
937	dirty->right, dirty->top, dirty->bottom);
938	trace_qxl_interface_update_area_complete_rest(qxl->id, num_updated_rects);
939	if (qxl->num_dirty_rects + num_updated_rects > QXL_NUM_DIRTY_RECTS) {
940	/*
941	* overflow - treat this as a full update. Not expected to be common.
942	*/
943	trace_qxl_interface_update_area_complete_overflow(qxl->id,
944	QXL_NUM_DIRTY_RECTS);
945	qxl->guest_primary.resized = 1;
946	}
947	if (qxl->guest_primary.resized) {
948	/*
949	* Don't bother copying or scheduling the bh since we will flip
950	* the whole area anyway on completion of the update_area async call
951	*/
952	return;
953	}
954	qxl_i = qxl->num_dirty_rects;
955	for (i = 0; i < num_updated_rects; i++) {
956	qxl->dirty[qxl_i++] = dirty[i];
957	}
958	qxl->num_dirty_rects += num_updated_rects;
959	trace_qxl_interface_update_area_complete_schedule_bh(qxl->id,
960	qxl->num_dirty_rects);
961	qemu_bh_schedule(qxl->update_area_bh);
962	}
963
964	/* called from spice server thread context only */
965	static void interface_async_complete(QXLInstance *sin, uint64_t cookie_token)
966	{
967	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
968	QXLCookie cookie = (QXLCookie )(uintptr_t)cookie_token;
969
970	switch (cookie->type) {
971	case QXL_COOKIE_TYPE_IO:
972	interface_async_complete_io(qxl, cookie);
973	g_free(cookie);
974	break;
975	case QXL_COOKIE_TYPE_RENDER_UPDATE_AREA:
976	qxl_render_update_area_done(qxl, cookie);
977	break;
978	case QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG:
979	break;
980	default:
981	fprintf(stderr, "qxl: %s: unexpected cookie type %d\n",
982	__func__, cookie->type);
983	g_free(cookie);
984	}
985	}
986
987	/* called from spice server thread context only */
988	static void interface_set_client_capabilities(QXLInstance *sin,
989	uint8_t client_present,
990	uint8_t caps[58])
991	{
992	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
993
994	if (qxl->revision < 4) {
995	trace_qxl_set_client_capabilities_unsupported_by_revision(qxl->id,
996	qxl->revision);
997	return;
998	}
999
1000	if (runstate_check(RUN_STATE_INMIGRATE) \|\|
1001	runstate_check(RUN_STATE_POSTMIGRATE) \|\|
1002	cpr_is_incoming()) {
1003	return;
1004	}
1005
1006	qxl->shadow_rom.client_present = client_present;
1007	memcpy(qxl->shadow_rom.client_capabilities, caps,
1008	sizeof(qxl->shadow_rom.client_capabilities));
1009	qxl->rom->client_present = client_present;
1010	memcpy(qxl->rom->client_capabilities, caps,
1011	sizeof(qxl->rom->client_capabilities));
1012	qxl_rom_set_dirty(qxl);
1013
1014	qxl_send_events(qxl, QXL_INTERRUPT_CLIENT);
1015	}
1016
1017	static bool qxl_rom_monitors_config_changed(QXLRom *rom,
1018	VDAgentMonitorsConfig *monitors_config,
1019	unsigned int max_outputs)
1020	{
1021	int i;
1022	unsigned int monitors_count;
1023
1024	monitors_count = MIN(monitors_config->num_of_monitors, max_outputs);
1025
1026	if (rom->client_monitors_config.count != monitors_count) {
1027	return true;
1028	}
1029
1030	for (i = 0 ; i < rom->client_monitors_config.count ; ++i) {
1031	VDAgentMonConfig *monitor = &monitors_config->monitors[i];
1032	QXLURect *rect = &rom->client_monitors_config.heads[i];
1033	/* monitor->depth ignored */
1034	if ((rect->left != monitor->x) \|\|
1035	(rect->top != monitor->y) \|\|
1036	(rect->right != monitor->x + monitor->width) \|\|
1037	(rect->bottom != monitor->y + monitor->height)) {
1038	return true;
1039	}
1040	}
1041
1042	return false;
1043	}
1044
1045	/* called from main context only */
1046	static int interface_client_monitors_config(QXLInstance *sin,
1047	VDAgentMonitorsConfig *monitors_config)
1048	{
1049	PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
1050	QXLRom *rom = memory_region_get_ram_ptr(&qxl->rom_bar);
1051	int i;
1052	unsigned max_outputs = ARRAY_SIZE(rom->client_monitors_config.heads);
1053	bool config_changed = false;
1054
1055	if (qxl->revision < 4) {
1056	trace_qxl_client_monitors_config_unsupported_by_device(qxl->id,
1057	qxl->revision);
1058	return 0;
1059	}
1060	/*
1061	* Older windows drivers set int_mask to 0 when their ISR is called,
1062	* then later set it to ~0. So it doesn't relate to the actual interrupts
1063	* handled. However, they are old, so clearly they don't support this
1064	* interrupt
1065	*/
1066	if (qxl->ram->int_mask == 0 \|\| qxl->ram->int_mask == ~0 \|\|
1067	!(qxl->ram->int_mask & QXL_INTERRUPT_CLIENT_MONITORS_CONFIG)) {
1068	trace_qxl_client_monitors_config_unsupported_by_guest(qxl->id,
1069	qxl->ram->int_mask,
1070	monitors_config);
1071	return 0;
1072	}
1073	if (!monitors_config) {
1074	return 1;
1075	}
1076
1077	/* limit number of outputs based on setting limit */
1078	if (qxl->max_outputs && qxl->max_outputs <= max_outputs) {
1079	max_outputs = qxl->max_outputs;
1080	}
1081
1082	config_changed = qxl_rom_monitors_config_changed(rom,
1083	monitors_config,
1084	max_outputs);
1085
1086	memset(&rom->client_monitors_config, 0,
1087	sizeof(rom->client_monitors_config));
1088	rom->client_monitors_config.count = monitors_config->num_of_monitors;
1089	/* monitors_config->flags ignored */
1090	if (rom->client_monitors_config.count >= max_outputs) {
1091	trace_qxl_client_monitors_config_capped(qxl->id,
1092	monitors_config->num_of_monitors,
1093	max_outputs);
1094	rom->client_monitors_config.count = max_outputs;
1095	}
1096	for (i = 0 ; i < rom->client_monitors_config.count ; ++i) {
1097	VDAgentMonConfig *monitor = &monitors_config->monitors[i];
1098	QXLURect *rect = &rom->client_monitors_config.heads[i];
1099	/* monitor->depth ignored */
1100	rect->left = monitor->x;
1101	rect->top = monitor->y;
1102	rect->right = monitor->x + monitor->width;
1103	rect->bottom = monitor->y + monitor->height;
1104	}
1105	rom->client_monitors_config_crc = qxl_crc32(
1106	(const uint8_t *)&rom->client_monitors_config,
1107	sizeof(rom->client_monitors_config));
1108	trace_qxl_client_monitors_config_crc(qxl->id,
1109	sizeof(rom->client_monitors_config),
1110	rom->client_monitors_config_crc);
1111
1112	trace_qxl_interrupt_client_monitors_config(qxl->id,
1113	rom->client_monitors_config.count,
1114	rom->client_monitors_config.heads);
1115	if (config_changed) {
1116	qxl_send_events(qxl, QXL_INTERRUPT_CLIENT_MONITORS_CONFIG);
1117	}
1118	return 1;
1119	}
1120
1121	static const QXLInterface qxl_interface = {
1122	.base.type = SPICE_INTERFACE_QXL,
1123	.base.description = "qxl gpu",
1124	.base.major_version = SPICE_INTERFACE_QXL_MAJOR,
1125	.base.minor_version = SPICE_INTERFACE_QXL_MINOR,
1126
1127	.attached_worker = interface_attached_worker,
1128	.set_compression_level = interface_set_compression_level,
1129	.get_init_info = interface_get_init_info,
1130
1131	/* the callbacks below are called from spice server thread context */
1132	.get_command = interface_get_command,
1133	.req_cmd_notification = interface_req_cmd_notification,
1134	.release_resource = interface_release_resource,
1135	.get_cursor_command = interface_get_cursor_command,
1136	.req_cursor_notification = interface_req_cursor_notification,
1137	.notify_update = interface_notify_update,
1138	.flush_resources = interface_flush_resources,
1139	.async_complete = interface_async_complete,
1140	.update_area_complete = interface_update_area_complete,
1141	.set_client_capabilities = interface_set_client_capabilities,
1142	.client_monitors_config = interface_client_monitors_config,
1143	};
1144
1145	static const GraphicHwOps qxl_ops = {
1146	.gfx_update = qxl_hw_update,
1147	};
1148
1149	static void qxl_enter_vga_mode(PCIQXLDevice *d)
1150	{
1151	if (d->mode == QXL_MODE_VGA) {
1152	return;
1153	}
1154	trace_qxl_enter_vga_mode(d->id);
1155	spice_qxl_driver_unload(&d->ssd.qxl);
1156	qemu_graphic_console_set_hwops(d->ssd.dcl.con, d->vga.hw_ops, &d->vga);
1157	qemu_console_listener_set_refresh(&d->ssd.dcl, GUI_REFRESH_INTERVAL_DEFAULT);
1158	qemu_spice_create_host_primary(&d->ssd);
1159	d->mode = QXL_MODE_VGA;
1160	qemu_spice_display_switch(&d->ssd, d->ssd.ds);
1161	vga_dirty_log_start(&d->vga);
1162	qemu_console_hw_update(d->vga.con);
1163	}
1164
1165	static void qxl_exit_vga_mode(PCIQXLDevice *d)
1166	{
1167	if (d->mode != QXL_MODE_VGA) {
1168	return;
1169	}
1170	trace_qxl_exit_vga_mode(d->id);
1171	qemu_graphic_console_set_hwops(d->ssd.dcl.con, &qxl_ops, d);
1172	qemu_console_listener_set_refresh(&d->ssd.dcl, GUI_REFRESH_INTERVAL_IDLE);
1173	vga_dirty_log_stop(&d->vga);
1174	qxl_destroy_primary(d, QXL_SYNC);
1175	}
1176
1177	static void qxl_update_irq(PCIQXLDevice *d)
1178	{
1179	uint32_t pending = le32_to_cpu(d->ram->int_pending);
1180	uint32_t mask = le32_to_cpu(d->ram->int_mask);
1181	int level = !!(pending & mask);
1182	pci_set_irq(&d->pci, level);
1183	qxl_ring_set_dirty(d);
1184	}
1185
1186	static void qxl_check_state(PCIQXLDevice *d)
1187	{
1188	QXLRam *ram = d->ram;
1189	int spice_display_running = qemu_spice_display_is_running(&d->ssd);
1190
1191	assert(!spice_display_running \|\| SPICE_RING_IS_EMPTY(&ram->cmd_ring));
1192	assert(!spice_display_running \|\| SPICE_RING_IS_EMPTY(&ram->cursor_ring));
1193	}
1194
1195	static void qxl_reset_state(PCIQXLDevice *d)
1196	{
1197	QXLRom *rom = d->rom;
1198
1199	if (cpr_is_incoming()) {
1200	return;
1201	}
1202
1203	qxl_check_state(d);
1204	d->shadow_rom.update_id = cpu_to_le32(0);
1205	*rom = d->shadow_rom;
1206	qxl_rom_set_dirty(d);
1207	init_qxl_ram(d);
1208	d->num_free_res = 0;
1209	d->last_release = NULL;
1210	memset(&d->ssd.dirty, 0, sizeof(d->ssd.dirty));
1211	qxl_update_irq(d);
1212	}
1213
1214	static void qxl_soft_reset(PCIQXLDevice *d)
1215	{
1216	trace_qxl_soft_reset(d->id);
1217	qxl_check_state(d);
1218	qxl_clear_guest_bug(d);
1219	qemu_mutex_lock(&d->async_lock);
1220	d->current_async = QXL_UNDEFINED_IO;
1221	qemu_mutex_unlock(&d->async_lock);
1222
1223	if (d->have_vga) {
1224	qxl_enter_vga_mode(d);
1225	} else {
1226	d->mode = QXL_MODE_UNDEFINED;
1227	}
1228	}
1229
1230	static void qxl_hard_reset(PCIQXLDevice *d, int loadvm)
1231	{
1232	bool startstop = qemu_spice_display_is_running(&d->ssd);
1233
1234	trace_qxl_hard_reset(d->id, loadvm);
1235
1236	if (startstop) {
1237	qemu_spice_display_stop();
1238	}
1239
1240	qxl_spice_reset_cursor(d);
1241	qxl_spice_reset_image_cache(d);
1242	qxl_reset_surfaces(d);
1243	qxl_reset_memslots(d);
1244
1245	/* pre loadvm reset must not touch QXLRam. This lives in
1246	* device memory, is migrated together with RAM and thus
1247	* already loaded at this point */
1248	if (!loadvm) {
1249	qxl_reset_state(d);
1250	}
1251	qemu_spice_create_host_memslot(&d->ssd);
1252	qxl_soft_reset(d);
1253
1254	if (startstop) {
1255	qemu_spice_display_start();
1256	}
1257	}
1258
1259	static void qxl_reset_handler(DeviceState *dev)
1260	{
1261	PCIQXLDevice *d = PCI_QXL(PCI_DEVICE(dev));
1262
1263	qxl_hard_reset(d, 0);
1264	}
1265
1266	static void qxl_vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
1267	{
1268	VGACommonState *vga = opaque;
1269	PCIQXLDevice *qxl = container_of(vga, PCIQXLDevice, vga);
1270
1271	trace_qxl_io_write_vga(qxl->id, qxl_mode_to_string(qxl->mode), addr, val);
1272	if (qxl->mode != QXL_MODE_VGA &&
1273	qxl->revision <= QXL_REVISION_STABLE_V12) {
1274	qxl_destroy_primary(qxl, QXL_SYNC);
1275	qxl_soft_reset(qxl);
1276	}
1277	vga_ioport_write(opaque, addr, val);
1278	}
1279
1280	static const MemoryRegionPortio qxl_vga_portio_list[] = {
1281	{ 0x04, 2, 1, .read = vga_ioport_read,
1282	.write = qxl_vga_ioport_write }, /* 3b4 */
1283	{ 0x0a, 1, 1, .read = vga_ioport_read,
1284	.write = qxl_vga_ioport_write }, /* 3ba */
1285	{ 0x10, 16, 1, .read = vga_ioport_read,
1286	.write = qxl_vga_ioport_write }, /* 3c0 */
1287	{ 0x24, 2, 1, .read = vga_ioport_read,
1288	.write = qxl_vga_ioport_write }, /* 3d4 */
1289	{ 0x2a, 1, 1, .read = vga_ioport_read,
1290	.write = qxl_vga_ioport_write }, /* 3da */
1291	PORTIO_END_OF_LIST(),
1292	};
1293
1294	static int qxl_add_memslot(PCIQXLDevice *d, uint32_t slot_id, uint64_t delta,
1295	qxl_async_io async)
1296	{
1297	static const int regions[] = {
1298	QXL_RAM_RANGE_INDEX,
1299	QXL_VRAM_RANGE_INDEX,
1300	QXL_VRAM64_RANGE_INDEX,
1301	};
1302	uint64_t guest_start;
1303	uint64_t guest_end;
1304	int pci_region = -1;
1305	pcibus_t pci_start = PCI_BAR_UNMAPPED;
1306	pcibus_t pci_end;
1307	MemoryRegion *mr;
1308	intptr_t virt_start;
1309	QXLDevMemSlot memslot;
1310	int i;
1311
1312	guest_start = le64_to_cpu(d->guest_slots[slot_id].slot.mem_start);
1313	guest_end = le64_to_cpu(d->guest_slots[slot_id].slot.mem_end);
1314
1315	trace_qxl_memslot_add_guest(d->id, slot_id, guest_start, guest_end);
1316
1317	if (slot_id >= NUM_MEMSLOTS) {
1318	qxl_set_guest_bug(d, "%s: slot_id >= NUM_MEMSLOTS %d >= %d", __func__,
1319	slot_id, NUM_MEMSLOTS);
1320	return 1;
1321	}
1322	if (guest_start > guest_end) {
1323	qxl_set_guest_bug(d, "%s: guest_start > guest_end 0x%" PRIx64
1324	" > 0x%" PRIx64, __func__, guest_start, guest_end);
1325	return 1;
1326	}
1327
1328	for (i = 0; i < ARRAY_SIZE(regions); i++) {
1329	pci_region = regions[i];
1330	pci_start = d->pci.io_regions[pci_region].addr;
1331	pci_end = pci_start + d->pci.io_regions[pci_region].size;
1332	/* mapped? */
1333	if (pci_start == -1) {
1334	continue;
1335	}
1336	/* start address in range ? */
1337	if (guest_start < pci_start \|\| guest_start > pci_end) {
1338	continue;
1339	}
1340	/* end address in range ? */
1341	if (guest_end > pci_end) {
1342	continue;
1343	}
1344	/* passed */
1345	break;
1346	}
1347	if (i == ARRAY_SIZE(regions)) {
1348	qxl_set_guest_bug(d, "%s: finished loop without match", __func__);
1349	return 1;
1350	}
1351
1352	switch (pci_region) {
1353	case QXL_RAM_RANGE_INDEX:
1354	mr = &d->vga.vram;
1355	break;
1356	case QXL_VRAM_RANGE_INDEX:
1357	case 4 /* vram 64bit */:
1358	mr = &d->vram_bar;
1359	break;
1360	default:
1361	/* should not happen */
1362	qxl_set_guest_bug(d, "%s: pci_region = %d", __func__, pci_region);
1363	return 1;
1364	}
1365	assert(guest_end - pci_start <= memory_region_size(mr));
1366
1367	virt_start = (intptr_t)memory_region_get_ram_ptr(mr);
1368	memslot.slot_id = slot_id;
1369	memslot.slot_group_id = MEMSLOT_GROUP_GUEST; /* guest group */
1370	memslot.virt_start = virt_start + (guest_start - pci_start);
1371	memslot.virt_end = virt_start + (guest_end - pci_start);
1372	memslot.addr_delta = memslot.virt_start - delta;
1373	if (!cpr_is_incoming()) {
1374	d->rom->slot_generation = 0;
1375	qxl_rom_set_dirty(d);
1376	}
1377	memslot.generation = d->rom->slot_generation;
1378
1379	qemu_spice_add_memslot(&d->ssd, &memslot, async);
1380	d->guest_slots[slot_id].mr = mr;
1381	d->guest_slots[slot_id].offset = memslot.virt_start - virt_start;
1382	d->guest_slots[slot_id].size = memslot.virt_end - memslot.virt_start;
1383	d->guest_slots[slot_id].delta = delta;
1384	d->guest_slots[slot_id].active = 1;
1385	return 0;
1386	}
1387
1388	static void qxl_del_memslot(PCIQXLDevice *d, uint32_t slot_id)
1389	{
1390	qemu_spice_del_memslot(&d->ssd, MEMSLOT_GROUP_HOST, slot_id);
1391	d->guest_slots[slot_id].active = 0;
1392	}
1393
1394	static void qxl_reset_memslots(PCIQXLDevice *d)
1395	{
1396	qxl_spice_reset_memslots(d);
1397	memset(&d->guest_slots, 0, sizeof(d->guest_slots));
1398	}
1399
1400	static void qxl_reset_surfaces(PCIQXLDevice *d)
1401	{
1402	trace_qxl_reset_surfaces(d->id);
1403	d->mode = QXL_MODE_UNDEFINED;
1404	qxl_spice_destroy_surfaces(d, QXL_SYNC);
1405	}
1406
1407	/* can be also called from spice server thread context */
1408	static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
1409	uint32_t s, uint64_t o,
1410	size_t size_requested)
1411	{
1412	uint64_t phys = le64_to_cpu(pqxl);
1413	uint32_t slot = (phys >> (64 - 8)) & 0xff;
1414	uint64_t offset = phys & 0xffffffffffff;
1415	uint64_t size_available;
1416
1417	if (slot >= NUM_MEMSLOTS) {
1418	qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot,
1419	NUM_MEMSLOTS);
1420	return false;
1421	}
1422	if (!qxl->guest_slots[slot].active) {
1423	qxl_set_guest_bug(qxl, "inactive slot %d\n", slot);
1424	return false;
1425	}
1426	if (offset < qxl->guest_slots[slot].delta) {
1427	qxl_set_guest_bug(qxl,
1428	"slot %d offset %"PRIu64" < delta %"PRIu64"\n",
1429	slot, offset, qxl->guest_slots[slot].delta);
1430	return false;
1431	}
1432	offset -= qxl->guest_slots[slot].delta;
1433	if (offset > qxl->guest_slots[slot].size) {
1434	qxl_set_guest_bug(qxl,
1435	"slot %d offset %"PRIu64" > size %"PRIu64"\n",
1436	slot, offset, qxl->guest_slots[slot].size);
1437	return false;
1438	}
1439	size_available = memory_region_size(qxl->guest_slots[slot].mr);
1440	if (qxl->guest_slots[slot].offset + offset >= size_available) {
1441	qxl_set_guest_bug(qxl,
1442	"slot %d offset %"PRIu64" > region size %"PRIu64"\n",
1443	slot, qxl->guest_slots[slot].offset + offset,
1444	size_available);
1445	return false;
1446	}
1447	size_available -= qxl->guest_slots[slot].offset + offset;
1448	if (size_requested > size_available) {
1449	qxl_set_guest_bug(qxl,
1450	"slot %d offset %"PRIu64" size %zu: "
1451	"overrun by %"PRIu64" bytes\n",
1452	slot, offset, size_requested,
1453	size_requested - size_available);
1454	return false;
1455	}
1456
1457	*s = slot;
1458	*o = offset;
1459	return true;
1460	}
1461
1462	/* can be also called from spice server thread context */
1463	void qxl_phys2virt(PCIQXLDevice qxl, QXLPHYSICAL pqxl, int group_id,
1464	size_t size)
1465	{
1466	uint64_t offset;
1467	uint32_t slot;
1468	void *ptr;
1469
1470	switch (group_id) {
1471	case MEMSLOT_GROUP_HOST:
1472	offset = le64_to_cpu(pqxl) & 0xffffffffffff;
1473	return (void *)(intptr_t)offset;
1474	case MEMSLOT_GROUP_GUEST:
1475	if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) {
1476	return NULL;
1477	}
1478	ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
1479	ptr += qxl->guest_slots[slot].offset;
1480	ptr += offset;
1481	return ptr;
1482	}
1483	return NULL;
1484	}
1485
1486	static void qxl_create_guest_primary_complete(PCIQXLDevice *qxl)
1487	{
1488	/* for local rendering */
1489	qxl_render_resize(qxl);
1490	}
1491
1492	/*
1493	* Convert a SpiceSurfaceFormat to bytes per pixel and bits per pixel.
1494	*
1495	* Only valid for surface suitable for rendering.
1496	*/
1497	bool qxl_format_bpp(PCIQXLDevice *qxl, SpiceSurfaceFmt format,
1498	uint32_t bytes_pp, uint32_t bits_pp)
1499	{
1500	uint32_t bypp = 4;
1501	uint32_t bipp = 32;
1502	bool ret = true;
1503
1504	switch (format) {
1505	case SPICE_SURFACE_FMT_16_555:
1506	bypp = 2;
1507	bipp = 15;
1508	break;
1509	case SPICE_SURFACE_FMT_16_565:
1510	bypp = 2;
1511	bipp = 16;
1512	break;
1513	case SPICE_SURFACE_FMT_32_xRGB:
1514	case SPICE_SURFACE_FMT_32_ARGB:
1515	bypp = 4;
1516	bipp = 32;
1517	break;
1518	default:
1519	ret = false;
1520	qxl_set_guest_bug(qxl, "%s: unhandled format: %x", __func__, format);
1521	}
1522
1523	if (bytes_pp != NULL) {
1524	*bytes_pp = bypp;
1525	}
1526	if (bits_pp != NULL) {
1527	*bits_pp = bipp;
1528	}
1529
1530	return ret;
1531	}
1532
1533	static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
1534	qxl_async_io async)
1535	{
1536	QXLDevSurfaceCreate surface;
1537	QXLSurfaceCreate *sc = &qxl->guest_primary.surface;
1538	uint32_t requested_height = le32_to_cpu(sc->height);
1539	int requested_stride = le32_to_cpu(sc->stride);
1540	uint32_t bytes_pp;
1541
1542	if (requested_stride == INT32_MIN \|\|
1543	abs(requested_stride) * (uint64_t)requested_height
1544	> qxl->vgamem_size) {
1545	qxl_set_guest_bug(qxl, "%s: requested primary larger than framebuffer"
1546	" stride %d x height %" PRIu32 " > %" PRIu32,
1547	__func__, requested_stride, requested_height,
1548	qxl->vgamem_size);
1549	return;
1550	}
1551
1552	if (qxl->mode == QXL_MODE_NATIVE) {
1553	qxl_set_guest_bug(qxl, "%s: nop since already in QXL_MODE_NATIVE",
1554	__func__);
1555	}
1556	qxl_exit_vga_mode(qxl);
1557
1558	surface.format = le32_to_cpu(sc->format);
1559	surface.height = le32_to_cpu(sc->height);
1560	surface.mem = le64_to_cpu(sc->mem);
1561	surface.position = le32_to_cpu(sc->position);
1562	surface.stride = le32_to_cpu(sc->stride);
1563	surface.width = le32_to_cpu(sc->width);
1564	surface.type = le32_to_cpu(sc->type);
1565	surface.flags = le32_to_cpu(sc->flags);
1566	trace_qxl_create_guest_primary(qxl->id, sc->width, sc->height, sc->mem,
1567	sc->format, sc->position);
1568	trace_qxl_create_guest_primary_rest(qxl->id, sc->stride, sc->type,
1569	sc->flags);
1570
1571	if ((surface.stride & 0x3) != 0) {
1572	qxl_set_guest_bug(qxl, "primary surface stride = %d %% 4 != 0",
1573	surface.stride);
1574	return;
1575	}
1576
1577	if (!qxl_format_bpp(qxl, surface.format, &bytes_pp, NULL)) {
1578	return;
1579	}
1580
1581	if (surface.width == 0 \|\| surface.height == 0) {
1582	qxl_set_guest_bug(qxl, "%s: zero dimension %ux%u",
1583	__func__, surface.width, surface.height);
1584	return;
1585	}
1586
1587	if ((uint64_t)surface.width * bytes_pp > abs(surface.stride)) {
1588	qxl_set_guest_bug(qxl, "%s: stride too small for width:"
1589	" stride %d width %u bpp %u",
1590	__func__, surface.stride, surface.width, bytes_pp);
1591	return;
1592	}
1593
1594	surface.mouse_mode = true;
1595	surface.group_id = MEMSLOT_GROUP_GUEST;
1596	if (loadvm) {
1597	surface.flags \|= QXL_SURF_FLAG_KEEP_DATA;
1598	}
1599
1600	qxl->mode = QXL_MODE_NATIVE;
1601	qxl->cmdflags = 0;
1602	qemu_spice_create_primary_surface(&qxl->ssd, 0, &surface, async);
1603
1604	if (async == QXL_SYNC) {
1605	qxl_create_guest_primary_complete(qxl);
1606	}
1607	}
1608
1609	/* return 1 if surface destroy was initiated (in QXL_ASYNC case) or
1610	* done (in QXL_SYNC case), 0 otherwise. */
1611	static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async)
1612	{
1613	if (d->mode == QXL_MODE_UNDEFINED) {
1614	return 0;
1615	}
1616	trace_qxl_destroy_primary(d->id);
1617	d->mode = QXL_MODE_UNDEFINED;
1618	qemu_spice_destroy_primary_surface(&d->ssd, 0, async);
1619	qxl_spice_reset_cursor(d);
1620	return 1;
1621	}
1622
1623	static void qxl_set_mode(PCIQXLDevice *d, unsigned int modenr, int loadvm)
1624	{
1625	pcibus_t start = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr;
1626	pcibus_t end = d->pci.io_regions[QXL_RAM_RANGE_INDEX].size + start;
1627	QXLMode *mode = d->modes->modes + modenr;
1628	uint64_t devmem = d->pci.io_regions[QXL_RAM_RANGE_INDEX].addr;
1629	QXLMemSlot slot = {
1630	.mem_start = start,
1631	.mem_end = end
1632	};
1633
1634	if (modenr >= d->modes->n_modes) {
1635	qxl_set_guest_bug(d, "mode number out of range");
1636	return;
1637	}
1638
1639	QXLSurfaceCreate surface = {
1640	.width = mode->x_res,
1641	.height = mode->y_res,
1642	.stride = -mode->x_res * 4,
1643	.format = SPICE_SURFACE_FMT_32_xRGB,
1644	.flags = loadvm ? QXL_SURF_FLAG_KEEP_DATA : 0,
1645	.mouse_mode = true,
1646	.mem = devmem + d->shadow_rom.draw_area_offset,
1647	};
1648
1649	trace_qxl_set_mode(d->id, modenr, mode->x_res, mode->y_res, mode->bits,
1650	devmem);
1651	if (!loadvm) {
1652	qxl_hard_reset(d, 0);
1653	}
1654
1655	d->guest_slots[0].slot = slot;
1656	if (qxl_add_memslot(d, 0, devmem, QXL_SYNC) != 0) {
1657	qxl_set_guest_bug(d, "device isn't initialized yet");
1658	return;
1659	}
1660
1661	d->guest_primary.surface = surface;
1662	qxl_create_guest_primary(d, 0, QXL_SYNC);
1663
1664	d->mode = QXL_MODE_COMPAT;
1665	d->cmdflags = QXL_COMMAND_FLAG_COMPAT;
1666	if (mode->bits == 16) {
1667	d->cmdflags \|= QXL_COMMAND_FLAG_COMPAT_16BPP;
1668	}
1669	d->shadow_rom.mode = cpu_to_le32(modenr);
1670	d->rom->mode = cpu_to_le32(modenr);
1671	qxl_rom_set_dirty(d);
1672	}
1673
1674	static void ioport_write(void *opaque, hwaddr addr,
1675	uint64_t val, unsigned size)
1676	{
1677	PCIQXLDevice *d = opaque;
1678	uint32_t io_port = addr;
1679	qxl_async_io async = QXL_SYNC;
1680	uint32_t orig_io_port;
1681
1682	if (d->guest_bug && io_port != QXL_IO_RESET) {
1683	return;
1684	}
1685
1686	if (d->revision <= QXL_REVISION_STABLE_V10 &&
1687	io_port > QXL_IO_FLUSH_RELEASE) {
1688	qxl_set_guest_bug(d, "unsupported io %d for revision %d\n",
1689	io_port, d->revision);
1690	return;
1691	}
1692
1693	switch (io_port) {
1694	case QXL_IO_RESET:
1695	case QXL_IO_SET_MODE:
1696	case QXL_IO_MEMSLOT_ADD:
1697	case QXL_IO_MEMSLOT_DEL:
1698	case QXL_IO_CREATE_PRIMARY:
1699	case QXL_IO_UPDATE_IRQ:
1700	case QXL_IO_LOG:
1701	case QXL_IO_MEMSLOT_ADD_ASYNC:
1702	case QXL_IO_CREATE_PRIMARY_ASYNC:
1703	break;
1704	default:
1705	if (d->mode != QXL_MODE_VGA) {
1706	break;
1707	}
1708	trace_qxl_io_unexpected_vga_mode(d->id,
1709	addr, val, io_port_to_string(io_port));
1710	/* be nice to buggy guest drivers */
1711	if (io_port >= QXL_IO_UPDATE_AREA_ASYNC &&
1712	io_port < QXL_IO_RANGE_SIZE) {
1713	qxl_send_events(d, QXL_INTERRUPT_IO_CMD);
1714	}
1715	return;
1716	}
1717
1718	/* we change the io_port to avoid ifdeffery in the main switch */
1719	orig_io_port = io_port;
1720	switch (io_port) {
1721	case QXL_IO_UPDATE_AREA_ASYNC:
1722	io_port = QXL_IO_UPDATE_AREA;
1723	goto async_common;
1724	case QXL_IO_MEMSLOT_ADD_ASYNC:
1725	io_port = QXL_IO_MEMSLOT_ADD;
1726	goto async_common;
1727	case QXL_IO_CREATE_PRIMARY_ASYNC:
1728	io_port = QXL_IO_CREATE_PRIMARY;
1729	goto async_common;
1730	case QXL_IO_DESTROY_PRIMARY_ASYNC:
1731	io_port = QXL_IO_DESTROY_PRIMARY;
1732	goto async_common;
1733	case QXL_IO_DESTROY_SURFACE_ASYNC:
1734	io_port = QXL_IO_DESTROY_SURFACE_WAIT;
1735	goto async_common;
1736	case QXL_IO_DESTROY_ALL_SURFACES_ASYNC:
1737	io_port = QXL_IO_DESTROY_ALL_SURFACES;
1738	goto async_common;
1739	case QXL_IO_FLUSH_SURFACES_ASYNC:
1740	case QXL_IO_MONITORS_CONFIG_ASYNC:
1741	async_common:
1742	async = QXL_ASYNC;
1743	WITH_QEMU_LOCK_GUARD(&d->async_lock) {
1744	if (d->current_async != QXL_UNDEFINED_IO) {
1745	qxl_set_guest_bug(d, "%d async started before last (%d) complete",
1746	io_port, d->current_async);
1747	return;
1748	}
1749	d->current_async = orig_io_port;
1750	}
1751	break;
1752	default:
1753	break;
1754	}
1755	trace_qxl_io_write(d->id, qxl_mode_to_string(d->mode),
1756	addr, io_port_to_string(addr),
1757	val, size, async);
1758
1759	switch (io_port) {
1760	case QXL_IO_UPDATE_AREA:
1761	{
1762	QXLCookie *cookie = NULL;
1763	QXLRect update = d->ram->update_area;
1764
1765	if (d->ram->update_surface > d->ssd.num_surfaces) {
1766	qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n",
1767	d->ram->update_surface);
1768	break;
1769	}
1770	if (update.left >= update.right \|\| update.top >= update.bottom \|\|
1771	update.left < 0 \|\| update.top < 0) {
1772	qxl_set_guest_bug(d,
1773	"QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
1774	update.left, update.top, update.right, update.bottom);
1775	if (update.left == update.right \|\| update.top == update.bottom) {
1776	/* old drivers may provide empty area, keep going */
1777	qxl_clear_guest_bug(d);
1778	goto cancel_async;
1779	}
1780	break;
1781	}
1782	if (async == QXL_ASYNC) {
1783	cookie = qxl_cookie_new(QXL_COOKIE_TYPE_IO,
1784	QXL_IO_UPDATE_AREA_ASYNC);
1785	cookie->u.area = update;
1786	}
1787	qxl_spice_update_area(d, d->ram->update_surface,
1788	cookie ? &cookie->u.area : &update,
1789	NULL, 0, 0, async, cookie);
1790	break;
1791	}
1792	case QXL_IO_NOTIFY_CMD:
1793	qemu_spice_wakeup(&d->ssd);
1794	break;
1795	case QXL_IO_NOTIFY_CURSOR:
1796	qemu_spice_wakeup(&d->ssd);
1797	break;
1798	case QXL_IO_UPDATE_IRQ:
1799	qxl_update_irq(d);
1800	break;
1801	case QXL_IO_NOTIFY_OOM:
1802	if (!SPICE_RING_IS_EMPTY(&d->ram->release_ring)) {
1803	break;
1804	}
1805	d->oom_running = 1;
1806	qxl_spice_oom(d);
1807	d->oom_running = 0;
1808	break;
1809	case QXL_IO_SET_MODE:
1810	qxl_set_mode(d, val, 0);
1811	break;
1812	case QXL_IO_LOG:
1813	#ifdef CONFIG_MODULES
1814	/*
1815	* FIXME
1816	* trace_event_get_state_backends() does not work for modules,
1817	* it leads to "undefined symbol: qemu_qxl_io_log_semaphore"
1818	*/
1819	if (true) {
1820	#else
1821	if (trace_event_get_state_backends(TRACE_QXL_IO_LOG) \|\| d->guestdebug) {
1822	#endif
1823	/* We cannot trust the guest to NUL terminate d->ram->log_buf */
1824	char log_buf = g_strndup((const char )d->ram->log_buf,
1825	sizeof(d->ram->log_buf));
1826	trace_qxl_io_log(d->id, log_buf);
1827	if (d->guestdebug) {
1828	fprintf(stderr, "qxl/guest-%d: %" PRId64 ": %s", d->id,
1829	qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), log_buf);
1830	}
1831	g_free(log_buf);
1832	}
1833	break;
1834	case QXL_IO_RESET:
1835	qxl_hard_reset(d, 0);
1836	break;
1837	case QXL_IO_MEMSLOT_ADD:
1838	if (val >= NUM_MEMSLOTS) {
1839	qxl_set_guest_bug(d, "QXL_IO_MEMSLOT_ADD: val out of range");
1840	break;
1841	}
1842	if (d->guest_slots[val].active) {
1843	qxl_set_guest_bug(d,
1844	"QXL_IO_MEMSLOT_ADD: memory slot already active");
1845	break;
1846	}
1847	d->guest_slots[val].slot = d->ram->mem_slot;
1848	qxl_add_memslot(d, val, 0, async);
1849	break;
1850	case QXL_IO_MEMSLOT_DEL:
1851	if (val >= NUM_MEMSLOTS) {
1852	qxl_set_guest_bug(d, "QXL_IO_MEMSLOT_DEL: val out of range");
1853	break;
1854	}
1855	qxl_del_memslot(d, val);
1856	break;
1857	case QXL_IO_CREATE_PRIMARY:
1858	if (val != 0) {
1859	qxl_set_guest_bug(d, "QXL_IO_CREATE_PRIMARY (async=%d): val != 0",
1860	async);
1861	goto cancel_async;
1862	}
1863	d->guest_primary.surface = d->ram->create_surface;
1864	qxl_create_guest_primary(d, 0, async);
1865	break;
1866	case QXL_IO_DESTROY_PRIMARY:
1867	if (val != 0) {
1868	qxl_set_guest_bug(d, "QXL_IO_DESTROY_PRIMARY (async=%d): val != 0",
1869	async);
1870	goto cancel_async;
1871	}
1872	if (!qxl_destroy_primary(d, async)) {
1873	trace_qxl_io_destroy_primary_ignored(d->id,
1874	qxl_mode_to_string(d->mode));
1875	goto cancel_async;
1876	}
1877	break;
1878	case QXL_IO_DESTROY_SURFACE_WAIT:
1879	if (val >= d->ssd.num_surfaces) {
1880	qxl_set_guest_bug(d, "QXL_IO_DESTROY_SURFACE (async=%d):"
1881	"%" PRIu64 " >= NUM_SURFACES", async, val);
1882	goto cancel_async;
1883	}
1884	qxl_spice_destroy_surface_wait(d, val, async);
1885	break;
1886	case QXL_IO_FLUSH_RELEASE: {
1887	QXLReleaseRing *ring = &d->ram->release_ring;
1888	if (ring->prod - ring->cons + 1 == ring->num_items) {
1889	fprintf(stderr,
1890	"ERROR: no flush, full release ring [p%d,%dc]\n",
1891	ring->prod, ring->cons);
1892	}
1893	qxl_push_free_res(d, 1 /* flush */);
1894	break;
1895	}
1896	case QXL_IO_FLUSH_SURFACES_ASYNC:
1897	qxl_spice_flush_surfaces_async(d);
1898	break;
1899	case QXL_IO_DESTROY_ALL_SURFACES:
1900	d->mode = QXL_MODE_UNDEFINED;
1901	qxl_spice_destroy_surfaces(d, async);
1902	break;
1903	case QXL_IO_MONITORS_CONFIG_ASYNC:
1904	qxl_spice_monitors_config_async(d, 0);
1905	break;
1906	default:
1907	qxl_set_guest_bug(d, "%s: unexpected ioport=0x%x\n", __func__, io_port);
1908	}
1909	return;
1910	cancel_async:
1911	if (async) {
1912	qxl_send_events(d, QXL_INTERRUPT_IO_CMD);
1913	qemu_mutex_lock(&d->async_lock);
1914	d->current_async = QXL_UNDEFINED_IO;
1915	qemu_mutex_unlock(&d->async_lock);
1916	}
1917	}
1918
1919	static uint64_t ioport_read(void *opaque, hwaddr addr,
1920	unsigned size)
1921	{
1922	PCIQXLDevice *qxl = opaque;
1923
1924	trace_qxl_io_read_unexpected(qxl->id);
1925	return 0xff;
1926	}
1927
1928	static const MemoryRegionOps qxl_io_ops = {
1929	.read = ioport_read,
1930	.write = ioport_write,
1931	.valid = {
1932	.min_access_size = 1,
1933	.max_access_size = 1,
1934	},
1935	};
1936
1937	static void qxl_update_irq_bh(void *opaque)
1938	{
1939	PCIQXLDevice *d = opaque;
1940	qxl_update_irq(d);
1941	}
1942
1943	static void qxl_send_events(PCIQXLDevice *d, uint32_t events)
1944	{
1945	uint32_t old_pending;
1946	uint32_t le_events = cpu_to_le32(events);
1947
1948	trace_qxl_send_events(d->id, events);
1949	if (!qemu_spice_display_is_running(&d->ssd)) {
1950	/* spice-server tracks guest running state and should not do this */
1951	fprintf(stderr, "%s: spice-server bug: guest stopped, ignoring\n",
1952	__func__);
1953	trace_qxl_send_events_vm_stopped(d->id, events);
1954	return;
1955	}
1956	/*
1957	* Older versions of Spice forgot to define the QXLRam struct
1958	* with the '__aligned__(4)' attribute. clang 7 and newer will
1959	* thus warn that qatomic_fetch_or(&d->ram->int_pending, ...)
1960	* might be a misaligned atomic access, and will generate an
1961	* out-of-line call for it, which results in a link error since
1962	* we don't currently link against libatomic.
1963	*
1964	* In fact we set up d->ram in init_qxl_ram() so it always starts
1965	* at a 4K boundary, so we know that &d->ram->int_pending is
1966	* naturally aligned for a uint32_t. Newer Spice versions
1967	* (with Spice commit beda5ec7a6848be20c0cac2a9a8ef2a41e8069c1)
1968	* will fix the bug directly. To deal with older versions,
1969	* we tell the compiler to assume the address really is aligned.
1970	* Any compiler which cares about the misalignment will have
1971	* __builtin_assume_aligned.
1972	*/
1973	#ifdef HAS_ASSUME_ALIGNED
1974	#define ALIGNED_UINT32_PTR(P) ((uint32_t *)__builtin_assume_aligned(P, 4))
1975	#else
1976	#define ALIGNED_UINT32_PTR(P) ((uint32_t *)P)
1977	#endif
1978
1979	old_pending = qatomic_fetch_or(ALIGNED_UINT32_PTR(&d->ram->int_pending),
1980	le_events);
1981	if ((old_pending & le_events) == le_events) {
1982	return;
1983	}
1984	qemu_bh_schedule(d->update_irq);
1985	}
1986
1987	/* graphics console */
1988
1989	static bool qxl_hw_update(void *opaque)
1990	{
1991	PCIQXLDevice *qxl = opaque;
1992
1993	return qxl_render_update(qxl);
1994	}
1995
1996	static void qxl_dirty_one_surface(PCIQXLDevice *qxl, QXLPHYSICAL pqxl,
1997	uint32_t height, int32_t stride)
1998	{
1999	uint64_t offset, size;
2000	uint32_t slot;
2001	bool rc;
2002
2003	size = (uint64_t)height * abs(stride);
2004	rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size);
2005	assert(rc == true);
2006	trace_qxl_surfaces_dirty(qxl->id, offset, size);
2007	qxl_set_dirty(qxl->guest_slots[slot].mr,
2008	qxl->guest_slots[slot].offset + offset,
2009	qxl->guest_slots[slot].offset + offset + size);
2010	}
2011
2012	static void qxl_dirty_surfaces(PCIQXLDevice *qxl)
2013	{
2014	int i;
2015
2016	if (qxl->mode != QXL_MODE_NATIVE && qxl->mode != QXL_MODE_COMPAT) {
2017	return;
2018	}
2019
2020	/* dirty the primary surface */
2021	qxl_dirty_one_surface(qxl, qxl->guest_primary.surface.mem,
2022	qxl->guest_primary.surface.height,
2023	qxl->guest_primary.surface.stride);
2024
2025	/* dirty the off-screen surfaces */
2026	for (i = 0; i < qxl->ssd.num_surfaces; i++) {
2027	QXLSurfaceCmd *cmd;
2028
2029	if (qxl->guest_surfaces.cmds[i] == 0) {
2030	continue;
2031	}
2032
2033	cmd = qxl_phys2virt(qxl, qxl->guest_surfaces.cmds[i],
2034	MEMSLOT_GROUP_GUEST, sizeof(QXLSurfaceCmd));
2035	assert(cmd);
2036	assert(cmd->type == QXL_SURFACE_CMD_CREATE);
2037	qxl_dirty_one_surface(qxl, cmd->u.surface_create.data,
2038	cmd->u.surface_create.height,
2039	cmd->u.surface_create.stride);
2040	}
2041	}
2042
2043	static void qxl_vm_change_state_handler(void *opaque, bool running,
2044	RunState state)
2045	{
2046	PCIQXLDevice *qxl = opaque;
2047
2048	if (running) {
2049	/*
2050	* if qxl_send_events was called from spice server context before
2051	* migration ended, qxl_update_irq for these events might not have been
2052	* called
2053	*/
2054	qxl_update_irq(qxl);
2055	} else {
2056	/* make sure surfaces are saved before migration */
2057	qxl_dirty_surfaces(qxl);
2058	}
2059	}
2060
2061	/* display change listener */
2062
2063	static void display_update(DisplayChangeListener *dcl,
2064	int x, int y, int w, int h)
2065	{
2066	PCIQXLDevice *qxl = container_of(dcl, PCIQXLDevice, ssd.dcl);
2067
2068	if (qxl->mode == QXL_MODE_VGA) {
2069	qemu_spice_display_update(&qxl->ssd, x, y, w, h);
2070	}
2071	}
2072
2073	static void display_switch(DisplayChangeListener *dcl,
2074	struct DisplaySurface *surface)
2075	{
2076	PCIQXLDevice *qxl = container_of(dcl, PCIQXLDevice, ssd.dcl);
2077
2078	qxl->ssd.ds = surface;
2079	if (qxl->mode == QXL_MODE_VGA) {
2080	qemu_spice_display_switch(&qxl->ssd, surface);
2081	}
2082	}
2083
2084	static void display_refresh(DisplayChangeListener *dcl)
2085	{
2086	PCIQXLDevice *qxl = container_of(dcl, PCIQXLDevice, ssd.dcl);
2087
2088	if (qxl->mode == QXL_MODE_VGA) {
2089	qemu_spice_display_refresh(&qxl->ssd);
2090	}
2091	}
2092
2093	static DisplayChangeListenerOps display_listener_ops = {
2094	.dpy_name = "spice/qxl",
2095	.dpy_gfx_update = display_update,
2096	.dpy_gfx_switch = display_switch,
2097	.dpy_refresh = display_refresh,
2098	};
2099
2100	static void qxl_init_ramsize(PCIQXLDevice *qxl)
2101	{
2102	/* vga mode framebuffer / primary surface (bar 0, first part) */
2103	if (qxl->vgamem_size_mb < 8) {
2104	qxl->vgamem_size_mb = 8;
2105	}
2106	/* XXX: we round vgamem_size_mb up to a nearest power of two and it must be
2107	* less than vga_common_init()'s maximum on qxl->vga.vram_size (512 now).
2108	*/
2109	if (qxl->vgamem_size_mb > 256) {
2110	qxl->vgamem_size_mb = 256;
2111	}
2112	qxl->vgamem_size = qxl->vgamem_size_mb * MiB;
2113
2114	/* vga ram (bar 0, total) */
2115	if (qxl->ram_size_mb != -1) {
2116	qxl->vga.vram_size = qxl->ram_size_mb * MiB;
2117	}
2118	if (qxl->vga.vram_size < qxl->vgamem_size * 2) {
2119	qxl->vga.vram_size = qxl->vgamem_size * 2;
2120	}
2121
2122	/* vram32 (surfaces, 32bit, bar 1) */
2123	if (qxl->vram32_size_mb != -1) {
2124	qxl->vram32_size = qxl->vram32_size_mb * MiB;
2125	}
2126	if (qxl->vram32_size < 4096) {
2127	qxl->vram32_size = 4096;
2128	}
2129
2130	/* vram (surfaces, 64bit, bar 4+5) */
2131	if (qxl->vram_size_mb != -1) {
2132	qxl->vram_size = (uint64_t)qxl->vram_size_mb * MiB;
2133	}
2134	if (qxl->vram_size < qxl->vram32_size) {
2135	qxl->vram_size = qxl->vram32_size;
2136	}
2137
2138	if (qxl->revision == 1) {
2139	qxl->vram32_size = 4096;
2140	qxl->vram_size = 4096;
2141	}
2142	qxl->vgamem_size = pow2ceil(qxl->vgamem_size);
2143	qxl->vga.vram_size = pow2ceil(qxl->vga.vram_size);
2144	qxl->vram32_size = pow2ceil(qxl->vram32_size);
2145	qxl->vram_size = pow2ceil(qxl->vram_size);
2146	}
2147
2148	static void qxl_realize_common(PCIQXLDevice qxl, Error *errp)
2149	{
2150	uint8_t* config = qxl->pci.config;
2151	uint32_t pci_device_rev;
2152	uint32_t io_size;
2153	Error *err = NULL;
2154	char device_address[256] = "";
2155
2156	qemu_spice_display_init_common(&qxl->ssd);
2157	qxl->mode = QXL_MODE_UNDEFINED;
2158	qxl->num_memslots = NUM_MEMSLOTS;
2159	qemu_mutex_init(&qxl->track_lock);
2160	qemu_mutex_init(&qxl->async_lock);
2161	qxl->current_async = QXL_UNDEFINED_IO;
2162	qxl->guest_bug = 0;
2163
2164	switch (qxl->revision) {
2165	case 1: /* spice 0.4 -- qxl-1 */
2166	pci_device_rev = QXL_REVISION_STABLE_V04;
2167	io_size = 8;
2168	break;
2169	case 2: /* spice 0.6 -- qxl-2 */
2170	pci_device_rev = QXL_REVISION_STABLE_V06;
2171	io_size = 16;
2172	break;
2173	case 3: /* qxl-3 */
2174	pci_device_rev = QXL_REVISION_STABLE_V10;
2175	io_size = 32; /* PCI region size must be pow2 */
2176	break;
2177	case 4: /* qxl-4 */
2178	pci_device_rev = QXL_REVISION_STABLE_V12;
2179	io_size = pow2ceil(QXL_IO_RANGE_SIZE);
2180	break;
2181	case 5: /* qxl-5 */
2182	pci_device_rev = QXL_REVISION_STABLE_V12 + 1;
2183	io_size = pow2ceil(QXL_IO_RANGE_SIZE);
2184	break;
2185	default:
2186	error_setg(errp, "Invalid revision %d for qxl device (max %d)",
2187	qxl->revision, QXL_DEFAULT_REVISION);
2188	return;
2189	}
2190
2191	pci_set_byte(&config[PCI_REVISION_ID], pci_device_rev);
2192	pci_set_byte(&config[PCI_INTERRUPT_PIN], 1);
2193
2194	qxl->rom_size = qxl_rom_size();
2195	memory_region_init_rom(&qxl->rom_bar, OBJECT(qxl), "qxl.vrom",
2196	qxl->rom_size, &error_fatal);
2197	init_qxl_rom(qxl);
2198	init_qxl_ram(qxl);
2199
2200	qxl->guest_surfaces.cmds = g_new0(QXLPHYSICAL, qxl->ssd.num_surfaces);
2201	memory_region_init_ram(&qxl->vram_bar, OBJECT(qxl), "qxl.vram",
2202	qxl->vram_size, &error_fatal);
2203	memory_region_init_alias(&qxl->vram32_bar, OBJECT(qxl), "qxl.vram32",
2204	&qxl->vram_bar, 0, qxl->vram32_size);
2205
2206	memory_region_init_io(&qxl->io_bar, OBJECT(qxl), &qxl_io_ops, qxl,
2207	"qxl-ioports", io_size);
2208	if (qxl->have_vga) {
2209	vga_dirty_log_start(&qxl->vga);
2210	}
2211	memory_region_set_flush_coalesced(&qxl->io_bar);
2212
2213
2214	pci_register_bar(&qxl->pci, QXL_IO_RANGE_INDEX,
2215	PCI_BASE_ADDRESS_SPACE_IO, &qxl->io_bar);
2216
2217	pci_register_bar(&qxl->pci, QXL_ROM_RANGE_INDEX,
2218	PCI_BASE_ADDRESS_SPACE_MEMORY, &qxl->rom_bar);
2219
2220	pci_register_bar(&qxl->pci, QXL_RAM_RANGE_INDEX,
2221	PCI_BASE_ADDRESS_SPACE_MEMORY, &qxl->vga.vram);
2222
2223	pci_register_bar(&qxl->pci, QXL_VRAM_RANGE_INDEX,
2224	PCI_BASE_ADDRESS_SPACE_MEMORY, &qxl->vram32_bar);
2225
2226	if (qxl->vram32_size < qxl->vram_size) {
2227	/*
2228	* Make the 64bit vram bar show up only in case it is
2229	* configured to be larger than the 32bit vram bar.
2230	*/
2231	pci_register_bar(&qxl->pci, QXL_VRAM64_RANGE_INDEX,
2232	PCI_BASE_ADDRESS_SPACE_MEMORY \|
2233	PCI_BASE_ADDRESS_MEM_TYPE_64 \|
2234	PCI_BASE_ADDRESS_MEM_PREFETCH,
2235	&qxl->vram_bar);
2236	}
2237
2238	/* print pci bar details */
2239	dprint(qxl, 1, "ram/%s: %" PRId64 " MB [region 0]\n",
2240	qxl->have_vga ? "pri" : "sec", qxl->vga.vram_size / MiB);
2241	dprint(qxl, 1, "vram/32: %" PRIx64 " MB [region 1]\n",
2242	qxl->vram32_size / MiB);
2243	dprint(qxl, 1, "vram/64: %" PRIx64 " MB %s\n",
2244	qxl->vram_size / MiB,
2245	qxl->vram32_size < qxl->vram_size ? "[region 4]" : "[unmapped]");
2246
2247	qxl->ssd.qxl.base.sif = &qxl_interface.base;
2248	if (qemu_spice_add_display_interface(&qxl->ssd.qxl, qxl->vga.con) != 0) {
2249	error_setg(errp, "qxl interface %d.%d not supported by spice-server",
2250	SPICE_INTERFACE_QXL_MAJOR, SPICE_INTERFACE_QXL_MINOR);
2251	return;
2252	}
2253
2254	if (qemu_console_fill_device_address(qxl->vga.con,
2255	device_address, sizeof(device_address),
2256	&err)) {
2257	spice_qxl_set_device_info(&qxl->ssd.qxl,
2258	device_address,
2259	0,
2260	qxl->max_outputs);
2261	} else {
2262	error_report_err(err);
2263	}
2264
2265	qxl->vmstate_handler =
2266	qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl);
2267
2268	qxl->update_irq = qemu_bh_new_guarded(qxl_update_irq_bh, qxl,
2269	&DEVICE(qxl)->mem_reentrancy_guard);
2270	qxl_reset_state(qxl);
2271
2272	qxl->update_area_bh = qemu_bh_new_guarded(qxl_render_update_area_bh, qxl,
2273	&DEVICE(qxl)->mem_reentrancy_guard);
2274	qxl->ssd.cursor_bh = qemu_bh_new_guarded(qemu_spice_cursor_refresh_bh, &qxl->ssd,
2275	&DEVICE(qxl)->mem_reentrancy_guard);
2276	}
2277
2278	static void qxl_realize_primary(PCIDevice dev, Error *errp)
2279	{
2280	PCIQXLDevice *qxl = PCI_QXL(dev);
2281	VGACommonState *vga = &qxl->vga;
2282	Error *local_err = NULL;
2283
2284	qxl_init_ramsize(qxl);
2285	vga->vbe_size = qxl->vgamem_size;
2286	vga->vram_size_mb = qxl->vga.vram_size / MiB;
2287	vga_common_init(vga, OBJECT(dev), &local_err);
2288	if (local_err) {
2289	error_propagate(errp, local_err);
2290	return;
2291	}
2292	vga_init(vga, OBJECT(dev),
2293	pci_address_space(dev), pci_address_space_io(dev), false);
2294	portio_list_init(&qxl->vga_port_list, OBJECT(dev), qxl_vga_portio_list,
2295	vga, "vga");
2296	portio_list_set_flush_coalesced(&qxl->vga_port_list);
2297	portio_list_add(&qxl->vga_port_list, pci_address_space_io(dev), 0x3b0);
2298	qxl->have_vga = true;
2299
2300	vga->con = qemu_graphic_console_create(DEVICE(dev), 0, &qxl_ops, qxl);
2301	qxl->id = qemu_console_get_index(vga->con); /* == channel_id */
2302	if (qxl->id != 0) {
2303	error_setg(errp, "primary qxl-vga device must be console 0 "
2304	"(first display device on the command line)");
2305	return;
2306	}
2307
2308	qxl_realize_common(qxl, &local_err);
2309	if (local_err) {
2310	error_propagate(errp, local_err);
2311	return;
2312	}
2313
2314	qemu_console_register_listener(vga->con, &qxl->ssd.dcl, &display_listener_ops);
2315	}
2316
2317	static void qxl_realize_secondary(PCIDevice dev, Error *errp)
2318	{
2319	PCIQXLDevice *qxl = PCI_QXL(dev);
2320
2321	qxl_init_ramsize(qxl);
2322	memory_region_init_ram(&qxl->vga.vram, OBJECT(dev), "qxl.vgavram",
2323	qxl->vga.vram_size, &error_fatal);
2324	qxl->vga.vram_ptr = memory_region_get_ram_ptr(&qxl->vga.vram);
2325	qxl->vga.con = qemu_graphic_console_create(DEVICE(dev), 0, &qxl_ops, qxl);
2326	qxl->ssd.dcl.con = qxl->vga.con;
2327	qxl->id = qemu_console_get_index(qxl->vga.con); /* == channel_id */
2328
2329	qxl_realize_common(qxl, errp);
2330	}
2331
2332	static int qxl_pre_save(void *opaque)
2333	{
2334	PCIQXLDevice* d = opaque;
2335	uint8_t *ram_start = d->vga.vram_ptr;
2336
2337	trace_qxl_pre_save(d->id);
2338	if (d->last_release == NULL) {
2339	d->last_release_offset = 0;
2340	} else {
2341	d->last_release_offset = (uint8_t *)d->last_release - ram_start;
2342	}
2343	if (d->last_release_offset >= d->vga.vram_size) {
2344	return 1;
2345	}
2346
2347	return 0;
2348	}
2349
2350	static int qxl_pre_load(void *opaque)
2351	{
2352	PCIQXLDevice* d = opaque;
2353
2354	trace_qxl_pre_load(d->id);
2355	qxl_hard_reset(d, 1);
2356	qxl_exit_vga_mode(d);
2357	return 0;
2358	}
2359
2360	static void qxl_create_memslots(PCIQXLDevice *d)
2361	{
2362	int i;
2363
2364	for (i = 0; i < NUM_MEMSLOTS; i++) {
2365	if (!d->guest_slots[i].active) {
2366	continue;
2367	}
2368	qxl_add_memslot(d, i, 0, QXL_SYNC);
2369	}
2370	}
2371
2372	static int qxl_post_load(void *opaque, int version)
2373	{
2374	PCIQXLDevice* d = opaque;
2375	uint8_t *ram_start = d->vga.vram_ptr;
2376	QXLCommandExt *cmds;
2377	int in, out, newmode;
2378
2379	assert(d->last_release_offset < d->vga.vram_size);
2380	if (d->last_release_offset == 0) {
2381	d->last_release = NULL;
2382	} else {
2383	d->last_release = (QXLReleaseInfo *)(ram_start + d->last_release_offset);
2384	}
2385
2386	d->modes = (QXLModes)((uint8_t)d->rom + d->rom->modes_offset);
2387
2388	trace_qxl_post_load(d->id, qxl_mode_to_string(d->mode));
2389	newmode = d->mode;
2390	d->mode = QXL_MODE_UNDEFINED;
2391
2392	switch (newmode) {
2393	case QXL_MODE_UNDEFINED:
2394	qxl_create_memslots(d);
2395	break;
2396	case QXL_MODE_VGA:
2397	qxl_create_memslots(d);
2398	qxl_enter_vga_mode(d);
2399	break;
2400	case QXL_MODE_NATIVE:
2401	qxl_create_memslots(d);
2402	qxl_create_guest_primary(d, 1, QXL_SYNC);
2403
2404	/* replay surface-create and cursor-set commands */
2405	cmds = g_new0(QXLCommandExt, d->ssd.num_surfaces + 1);
2406	for (in = 0, out = 0; in < d->ssd.num_surfaces; in++) {
2407	if (d->guest_surfaces.cmds[in] == 0) {
2408	continue;
2409	}
2410	cmds[out].cmd.data = d->guest_surfaces.cmds[in];
2411	cmds[out].cmd.type = QXL_CMD_SURFACE;
2412	cmds[out].group_id = MEMSLOT_GROUP_GUEST;
2413	out++;
2414	}
2415	if (d->guest_cursor) {
2416	cmds[out].cmd.data = d->guest_cursor;
2417	cmds[out].cmd.type = QXL_CMD_CURSOR;
2418	cmds[out].group_id = MEMSLOT_GROUP_GUEST;
2419	out++;
2420	}
2421	qxl_spice_loadvm_commands(d, cmds, out);
2422	g_free(cmds);
2423	if (d->guest_monitors_config) {
2424	qxl_spice_monitors_config_async(d, 1);
2425	}
2426	break;
2427	case QXL_MODE_COMPAT:
2428	/* note: no need to call qxl_create_memslots, qxl_set_mode
2429	* creates the mem slot. */
2430	qxl_set_mode(d, d->shadow_rom.mode, 1);
2431	break;
2432	}
2433	return 0;
2434	}
2435
2436	#define QXL_SAVE_VERSION 21
2437
2438	static bool qxl_monitors_config_needed(void *opaque)
2439	{
2440	PCIQXLDevice *qxl = opaque;
2441
2442	return qxl->guest_monitors_config != 0;
2443	}
2444
2445
2446	static const VMStateDescription qxl_memslot = {
2447	.name = "qxl-memslot",
2448	.version_id = QXL_SAVE_VERSION,
2449	.minimum_version_id = QXL_SAVE_VERSION,
2450	.fields = (const VMStateField[]) {
2451	VMSTATE_UINT64(slot.mem_start, struct guest_slots),
2452	VMSTATE_UINT64(slot.mem_end, struct guest_slots),
2453	VMSTATE_UINT32(active, struct guest_slots),
2454	VMSTATE_END_OF_LIST()
2455	}
2456	};
2457
2458	static const VMStateDescription qxl_surface = {
2459	.name = "qxl-surface",
2460	.version_id = QXL_SAVE_VERSION,
2461	.minimum_version_id = QXL_SAVE_VERSION,
2462	.fields = (const VMStateField[]) {
2463	VMSTATE_UINT32(width, QXLSurfaceCreate),
2464	VMSTATE_UINT32(height, QXLSurfaceCreate),
2465	VMSTATE_INT32(stride, QXLSurfaceCreate),
2466	VMSTATE_UINT32(format, QXLSurfaceCreate),
2467	VMSTATE_UINT32(position, QXLSurfaceCreate),
2468	VMSTATE_UINT32(mouse_mode, QXLSurfaceCreate),
2469	VMSTATE_UINT32(flags, QXLSurfaceCreate),
2470	VMSTATE_UINT32(type, QXLSurfaceCreate),
2471	VMSTATE_UINT64(mem, QXLSurfaceCreate),
2472	VMSTATE_END_OF_LIST()
2473	}
2474	};
2475
2476	static const VMStateDescription qxl_vmstate_monitors_config = {
2477	.name = "qxl/monitors-config",
2478	.version_id = 1,
2479	.minimum_version_id = 1,
2480	.needed = qxl_monitors_config_needed,
2481	.fields = (const VMStateField[]) {
2482	VMSTATE_UINT64(guest_monitors_config, PCIQXLDevice),
2483	VMSTATE_END_OF_LIST()
2484	},
2485	};
2486
2487	static const VMStateDescription qxl_vmstate = {
2488	.name = "qxl",
2489	.version_id = QXL_SAVE_VERSION,
2490	.minimum_version_id = QXL_SAVE_VERSION,
2491	.pre_save = qxl_pre_save,
2492	.pre_load = qxl_pre_load,
2493	.post_load = qxl_post_load,
2494	.fields = (const VMStateField[]) {
2495	VMSTATE_PCI_DEVICE(pci, PCIQXLDevice),
2496	VMSTATE_STRUCT(vga, PCIQXLDevice, 0, vmstate_vga_common, VGACommonState),
2497	VMSTATE_UINT32(shadow_rom.mode, PCIQXLDevice),
2498	VMSTATE_UINT32(num_free_res, PCIQXLDevice),
2499	VMSTATE_UINT32(last_release_offset, PCIQXLDevice),
2500	VMSTATE_UINT32(mode, PCIQXLDevice),
2501	VMSTATE_UINT32(ssd.unique, PCIQXLDevice),
2502	VMSTATE_INT32_EQUAL(num_memslots, PCIQXLDevice),
2503	VMSTATE_STRUCT_ARRAY(guest_slots, PCIQXLDevice, NUM_MEMSLOTS, 0,
2504	qxl_memslot, struct guest_slots),
2505	VMSTATE_STRUCT(guest_primary.surface, PCIQXLDevice, 0,
2506	qxl_surface, QXLSurfaceCreate),
2507	VMSTATE_INT32_EQUAL(ssd.num_surfaces, PCIQXLDevice),
2508	VMSTATE_VARRAY_INT32(guest_surfaces.cmds, PCIQXLDevice,
2509	ssd.num_surfaces, 0,
2510	vmstate_info_uint64, uint64_t),
2511	VMSTATE_UINT64(guest_cursor, PCIQXLDevice),
2512	VMSTATE_END_OF_LIST()
2513	},
2514	.subsections = (const VMStateDescription * const []) {
2515	&qxl_vmstate_monitors_config,
2516	NULL
2517	}
2518	};
2519
2520	static const Property qxl_properties[] = {
2521	DEFINE_PROP_UINT32("ram_size", PCIQXLDevice, vga.vram_size, 64 * MiB),
2522	DEFINE_PROP_UINT64("vram_size", PCIQXLDevice, vram32_size, 64 * MiB),
2523	DEFINE_PROP_UINT32("revision", PCIQXLDevice, revision,
2524	QXL_DEFAULT_REVISION),
2525	DEFINE_PROP_UINT32("debug", PCIQXLDevice, debug, 0),
2526	DEFINE_PROP_UINT32("guestdebug", PCIQXLDevice, guestdebug, 0),
2527	DEFINE_PROP_UINT32("cmdlog", PCIQXLDevice, cmdlog, 0),
2528	DEFINE_PROP_UINT32("ram_size_mb", PCIQXLDevice, ram_size_mb, -1),
2529	DEFINE_PROP_UINT32("vram_size_mb", PCIQXLDevice, vram32_size_mb, -1),
2530	DEFINE_PROP_UINT32("vram64_size_mb", PCIQXLDevice, vram_size_mb, -1),
2531	DEFINE_PROP_UINT32("vgamem_mb", PCIQXLDevice, vgamem_size_mb, 16),
2532	DEFINE_PROP_INT32("surfaces", PCIQXLDevice, ssd.num_surfaces, 1024),
2533	DEFINE_PROP_UINT16("max_outputs", PCIQXLDevice, max_outputs, 0),
2534	DEFINE_PROP_UINT32("xres", PCIQXLDevice, xres, 0),
2535	DEFINE_PROP_UINT32("yres", PCIQXLDevice, yres, 0),
2536	};
2537
2538	static void qxl_exit(PCIDevice *dev)
2539	{
2540	PCIQXLDevice *qxl = PCI_QXL(dev);
2541
2542	/* TODO: complete cleanup, error paths etc */
2543	g_clear_pointer(&qxl->vmstate_handler, qemu_del_vm_change_state_handler);
2544	g_clear_pointer(&qxl->update_irq, qemu_bh_delete);
2545	g_clear_pointer(&qxl->update_area_bh, qemu_bh_delete);
2546	g_clear_pointer(&qxl->ssd.cursor_bh, qemu_bh_delete);
2547	g_clear_pointer(&qxl->guest_surfaces.cmds, g_free);
2548	}
2549
2550	static void qxl_pci_class_init(ObjectClass klass, const void data)
2551	{
2552	DeviceClass *dc = DEVICE_CLASS(klass);
2553	PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2554
2555	k->vendor_id = REDHAT_PCI_VENDOR_ID;
2556	k->device_id = QXL_DEVICE_ID_STABLE;
2557	k->exit = qxl_exit;
2558	set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2559	device_class_set_legacy_reset(dc, qxl_reset_handler);
2560	dc->vmsd = &qxl_vmstate;
2561	device_class_set_props(dc, qxl_properties);
2562	}
2563
2564	static const TypeInfo qxl_pci_type_info = {
2565	.name = TYPE_PCI_QXL,
2566	.parent = TYPE_PCI_DEVICE,
2567	.instance_size = sizeof(PCIQXLDevice),
2568	.abstract = true,
2569	.class_init = qxl_pci_class_init,
2570	.interfaces = (const InterfaceInfo[]) {
2571	{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
2572	{ },
2573	},
2574	};
2575
2576	static void qxl_primary_class_init(ObjectClass klass, const void data)
2577	{
2578	DeviceClass *dc = DEVICE_CLASS(klass);
2579	PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2580
2581	k->realize = qxl_realize_primary;
2582	k->romfile = "vgabios-qxl.bin";
2583	k->class_id = PCI_CLASS_DISPLAY_VGA;
2584	dc->desc = "Spice QXL GPU (primary, vga compatible)";
2585	dc->hotpluggable = false;
2586	}
2587
2588	static const TypeInfo qxl_primary_info = {
2589	.name = "qxl-vga",
2590	.parent = TYPE_PCI_QXL,
2591	.class_init = qxl_primary_class_init,
2592	};
2593	module_obj("qxl-vga");
2594	module_kconfig(QXL);
2595
2596	static void qxl_secondary_class_init(ObjectClass klass, const void data)
2597	{
2598	DeviceClass *dc = DEVICE_CLASS(klass);
2599	PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2600
2601	k->realize = qxl_realize_secondary;
2602	k->class_id = PCI_CLASS_DISPLAY_OTHER;
2603	dc->desc = "Spice QXL GPU (secondary)";
2604	}
2605
2606	static const TypeInfo qxl_secondary_info = {
2607	.name = "qxl",
2608	.parent = TYPE_PCI_QXL,
2609	.class_init = qxl_secondary_class_init,
2610	};
2611	module_obj("qxl");
2612
2613	static void qxl_register_types(void)
2614	{
2615	type_register_static(&qxl_pci_type_info);
2616	type_register_static(&qxl_primary_info);
2617	type_register_static(&qxl_secondary_info);
2618	}
2619
2620	type_init(qxl_register_types)
2621
2622	module_dep("ui-spice-core");