Re: [Qemu-devel] [PATCH 4/7] xen: add framebuffer backend driver

[Anthony Liguori <anthony@codemonkey.ws>]

Gerd Hoffmann wrote:
> This patch adds a frsamebuffer (and kbd+mouse) backend driver.  It
> it based on current xen-unstable code.  It has been changed to make
> use of the common backend driver code.  It also has been changed to
> compile with xen headers older than unstable (aka son-to-be 3.3).
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
>  Makefile.target      |    2 +-
>  hw/xen-backend.h     |    4 +
>  hw/xen-framebuffer.c |  925 ++++++++++++++++++++++++++++++++++++++++++++++++++
>  hw/xen-machine.c     |    5 +
>  4 files changed, 935 insertions(+), 1 deletions(-)
>  create mode 100644 hw/xen-framebuffer.c
>
> diff --git a/Makefile.target b/Makefile.target
> index 05619fa..66d41ee 100644
> --- a/Makefile.target
> +++ b/Makefile.target
> @@ -517,7 +517,7 @@ endif
>  
>  # xen backend driver support
>  XEN_OBJS := xen-machine.o xen-backend.o
> -XEN_OBJS += xen-console.o
> +XEN_OBJS += xen-console.o xen-framebuffer.o
>  ifeq ($(CONFIG_XEN), yes)
>    OBJS += $(XEN_OBJS)
>    LIBS += $(XEN_LIBS)
> diff --git a/hw/xen-backend.h b/hw/xen-backend.h
> index 55ffd31..3facf90 100644
> --- a/hw/xen-backend.h
> +++ b/hw/xen-backend.h
> @@ -116,4 +116,8 @@ void xen_be_printf(struct xendev *xendev, int msg_level, const char *fmt, ...)
>  
>  /* actual backend drivers */
>  struct devops xen_console_ops;      /* xen_console.c     */
> +struct devops xen_kbdmouse_ops;     /* xen_framebuffer.c */
> +struct devops xen_framebuffer_ops;  /* xen_framebuffer.c */
> +
> +void xen_set_display(int domid, DisplayState *ds);
>  
> diff --git a/hw/xen-framebuffer.c b/hw/xen-framebuffer.c
> new file mode 100644
> index 0000000..716eafd
> --- /dev/null
> +++ b/hw/xen-framebuffer.c
> @@ -0,0 +1,925 @@
> +/*
> + *  xen paravirt framebuffer backend
>
>   

No copyright?

> + *  This program is free software; you can redistribute it and/or modify
> + *  it under the terms of the GNU General Public License as published by
> + *  the Free Software Foundation; under version 2 of the License.
> + *
> + *  This program is distributed in the hope that it will be useful,
> + *  but WITHOUT ANY WARRANTY; without even the implied warranty of
> + *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + *  GNU General Public License for more details.
> + *
> + *  You should have received a copy of the GNU General Public License
> + *  along with this program; if not, write to the Free Software
> + *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
> + */
> +
> +#include <stdarg.h>
> +#include <stdlib.h>
> +#include <sys/types.h>
> +#include <fcntl.h>
> +#include <unistd.h>
> +#include <stdbool.h>
> +#include <sys/mman.h>
> +#include <errno.h>
> +#include <stdio.h>
> +#include <string.h>
> +#include <time.h>
> +
> +#include <xs.h>
> +#include <xenctrl.h>
> +#include <xen/event_channel.h>
> +#include <xen/io/xenbus.h>
> +#include <xen/io/fbif.h>
> +#include <xen/io/kbdif.h>
> +#include <xen/io/protocols.h>
> +
> +#include "hw.h"
> +#include "sysemu.h"
> +#include "console.h"
> +#include "qemu-char.h"
> +#include "xen-backend.h"
> +
> +#ifndef BTN_LEFT
> +#define BTN_LEFT 0x110 /* from <linux/input.h> */
> +#endif
> +
> +/* -------------------------------------------------------------------- */
> +
> +struct xen_common {
> +    struct xendev     xendev;  /* must be first */
> +    void              *page;
> +    DisplayState      *ds;
> +};
> +
> +struct xen_input {
> +    struct xen_common c;
> +    int abs_pointer_wanted; /* Whether guest supports absolute pointer */
> +    int button_state;       /* Last seen pointer button state */
> +    int extended;
> +    QEMUPutMouseEntry *qmouse;
> +};
> +
> +#define UP_QUEUE 8
> +
> +struct xen_fb {
> +    struct xen_common c;
> +    size_t            fb_len;
> +    int               row_stride;
> +    int               depth;
> +    int               width;
> +    int               height;
> +    int               offset;
> +    void              *pixels;
> +    int               feature_update;
> +    int               refresh_period;
> +    int               bug_trigger;
> +
> +    struct {
> +	int x,y,w,h;
> +    } up_rects[UP_QUEUE];
> +    int               up_count;
> +    int               up_fullscreen;
> +};
> +
> +/* -------------------------------------------------------------------- */
> +
> +static int common_bind(struct xen_common *c)
> +{
> +    int mfn;
> +
> +    if (-1 == xenstore_read_fe_int(&c->xendev, "page-ref", &mfn))
> +	return -1;
> +    if (-1 == xenstore_read_fe_int(&c->xendev, "event-channel", &c->xendev.remote_port))
> +	return -1;
> +
> +    xen_be_bind_evtchn(&c->xendev);
> +    xen_be_printf(&c->xendev, 1, "ring mfn %d, remote-port %d, local-port %d\n",
> +		  mfn, c->xendev.remote_port, c->xendev.local_port);
> +
> +    c->page = xc_map_foreign_range(xen_xc, c->xendev.dom,
> +				   XC_PAGE_SIZE,
> +				   PROT_READ | PROT_WRITE, mfn);
> +    if (NULL == c->page)
> +	return -1;
> +    return 0;
> +}
> +
> +static void common_unbind(struct xen_common *c)
> +{
> +    if (c->page) {
> +	munmap(c->page, XC_PAGE_SIZE);
> +	c->page = NULL;
> +    }
> +    xen_be_unbind_evtchn(&c->xendev);
> +}
> +
> +/* -------------------------------------------------------------------- */
> +
> +/*
> + * Tables to map from scancode to Linux input layer keycode.
> + * Scancodes are hardware-specific.  These maps assumes a
> + * standard AT or PS/2 keyboard which is what QEMU feeds us.
> + */
> +const unsigned char atkbd_set2_keycode[512] = {
> +
> +     0, 67, 65, 63, 61, 59, 60, 88,  0, 68, 66, 64, 62, 15, 41,117,
> +     0, 56, 42, 93, 29, 16,  2,  0,  0,  0, 44, 31, 30, 17,  3,  0,
> +     0, 46, 45, 32, 18,  5,  4, 95,  0, 57, 47, 33, 20, 19,  6,183,
> +     0, 49, 48, 35, 34, 21,  7,184,  0,  0, 50, 36, 22,  8,  9,185,
> +     0, 51, 37, 23, 24, 11, 10,  0,  0, 52, 53, 38, 39, 25, 12,  0,
> +     0, 89, 40,  0, 26, 13,  0,  0, 58, 54, 28, 27,  0, 43,  0, 85,
> +     0, 86, 91, 90, 92,  0, 14, 94,  0, 79,124, 75, 71,121,  0,  0,
> +    82, 83, 80, 76, 77, 72,  1, 69, 87, 78, 81, 74, 55, 73, 70, 99,
> +
> +      0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
> +    217,100,255,  0, 97,165,  0,  0,156,  0,  0,  0,  0,  0,  0,125,
> +    173,114,  0,113,  0,  0,  0,126,128,  0,  0,140,  0,  0,  0,127,
> +    159,  0,115,  0,164,  0,  0,116,158,  0,150,166,  0,  0,  0,142,
> +    157,  0,  0,  0,  0,  0,  0,  0,155,  0, 98,  0,  0,163,  0,  0,
> +    226,  0,  0,  0,  0,  0,  0,  0,  0,255, 96,  0,  0,  0,143,  0,
> +      0,  0,  0,  0,  0,  0,  0,  0,  0,107,  0,105,102,  0,  0,112,
> +    110,111,108,112,106,103,  0,119,  0,118,109,  0, 99,104,119,  0,
> +
> +};
> +
> +const unsigned char atkbd_unxlate_table[128] = {
> +
> +      0,118, 22, 30, 38, 37, 46, 54, 61, 62, 70, 69, 78, 85,102, 13,
> +     21, 29, 36, 45, 44, 53, 60, 67, 68, 77, 84, 91, 90, 20, 28, 27,
> +     35, 43, 52, 51, 59, 66, 75, 76, 82, 14, 18, 93, 26, 34, 33, 42,
> +     50, 49, 58, 65, 73, 74, 89,124, 17, 41, 88,  5,  6,  4, 12,  3,
> +     11,  2, 10,  1,  9,119,126,108,117,125,123,107,115,116,121,105,
> +    114,122,112,113,127, 96, 97,120,  7, 15, 23, 31, 39, 47, 55, 63,
> +     71, 79, 86, 94,  8, 16, 24, 32, 40, 48, 56, 64, 72, 80, 87,111,
> +     19, 25, 57, 81, 83, 92, 95, 98, 99,100,101,103,104,106,109,110
> +
> +};
> +
> +static unsigned char scancode2linux[512];
> +
> +/* Send an event to the keyboard frontend driver */
> +static int xenfb_kbd_event(struct xen_input *xenfb,
> +			   union xenkbd_in_event *event)
> +{
> +    struct xenkbd_page *page = xenfb->c.page;
> +    uint32_t prod;
> +
> +    if (xenfb->c.xendev.be_state != XenbusStateConnected)
> +	return 0;
> +
> +    prod = page->in_prod;
> +    if (prod - page->in_cons == XENKBD_IN_RING_LEN) {
> +	errno = EAGAIN;
> +	return -1;
> +    }
> +
> +    xen_mb();		/* ensure ring space available */
> +    XENKBD_IN_RING_REF(page, prod) = *event;
> +    xen_wmb();		/* ensure ring contents visible */
> +    page->in_prod = prod + 1;
> +    return xen_be_send_notify(&xenfb->c.xendev);
> +}
> +
> +/* Send a keyboard (or mouse button) event */
> +static int xenfb_send_key(struct xen_input *xenfb, bool down, int keycode)
> +{
> +    union xenkbd_in_event event;
> +
> +    memset(&event, 0, XENKBD_IN_EVENT_SIZE);
> +    event.type = XENKBD_TYPE_KEY;
> +    event.key.pressed = down ? 1 : 0;
> +    event.key.keycode = keycode;
> +
> +    return xenfb_kbd_event(xenfb, &event);
> +}
> +
> +/* Send a relative mouse movement event */
> +static int xenfb_send_motion(struct xen_input *xenfb,
> +			     int rel_x, int rel_y, int rel_z)
> +{
> +    union xenkbd_in_event event;
> +
> +    memset(&event, 0, XENKBD_IN_EVENT_SIZE);
> +    event.type = XENKBD_TYPE_MOTION;
> +    event.motion.rel_x = rel_x;
> +    event.motion.rel_y = rel_y;
> +#if __XEN_LATEST_INTERFACE_VERSION__ >= 0x00030207
> +    event.motion.rel_z = rel_z;
> +#endif
> +
> +    return xenfb_kbd_event(xenfb, &event);
> +}
> +
> +/* Send an absolute mouse movement event */
> +static int xenfb_send_position(struct xen_input *xenfb,
> +			       int abs_x, int abs_y, int rel_z)
> +{
> +    union xenkbd_in_event event;
> +
> +    memset(&event, 0, XENKBD_IN_EVENT_SIZE);
> +    event.type = XENKBD_TYPE_POS;
> +    event.pos.abs_x = abs_x;
> +    event.pos.abs_y = abs_y;
> +#if __XEN_LATEST_INTERFACE_VERSION__ >= 0x00030207
> +    event.pos.rel_z = rel_z;
> +#endif
> +
> +    return xenfb_kbd_event(xenfb, &event);
> +}
> +
> +/*
> + * Send a key event from the client to the guest OS
> + * QEMU gives us a raw scancode from an AT / PS/2 style keyboard.
> + * We have to turn this into a Linux Input layer keycode.
> + *
> + * Extra complexity from the fact that with extended scancodes
> + * (like those produced by arrow keys) this method gets called
> + * twice, but we only want to send a single event. So we have to
> + * track the '0xe0' scancode state & collapse the extended keys
> + * as needed.
> + *
> + * Wish we could just send scancodes straight to the guest which
> + * already has code for dealing with this...
> + */
> +static void xenfb_key_event(void *opaque, int scancode)
> +{
> +    struct xen_input *xenfb = opaque;
> +    int down = 1;
> +
> +    if (scancode == 0xe0) {
> +	xenfb->extended = 1;
> +	return;
> +    } else if (scancode & 0x80) {
> +	scancode &= 0x7f;
> +	down = 0;
> +    }
> +    if (xenfb->extended) {
> +	scancode |= 0x80;
> +	xenfb->extended = 0;
> +    }
> +    xenfb_send_key(xenfb, down, scancode2linux[scancode]);
> +}
> +
> +/*
> + * Send a mouse event from the client to the guest OS
> + *
> + * The QEMU mouse can be in either relative, or absolute mode.
> + * Movement is sent separately from button state, which has to
> + * be encoded as virtual key events. We also don't actually get
> + * given any button up/down events, so have to track changes in
> + * the button state.
> + */
> +static void xenfb_mouse_event(void *opaque,
> +			      int dx, int dy, int dz, int button_state)
> +{
> +    struct xen_input *xenfb = opaque;
> +    int i;
> +
> +    if (xenfb->abs_pointer_wanted)
> +	xenfb_send_position(xenfb,
> +			    dx * (xenfb->c.ds->width - 1) / 0x7fff,
> +			    dy * (xenfb->c.ds->height - 1) / 0x7fff,
> +			    dz);
> +    else
> +	xenfb_send_motion(xenfb, dx, dy, dz);
> +
> +    for (i = 0 ; i < 8 ; i++) {
> +	int lastDown = xenfb->button_state & (1 << i);
> +	int down = button_state & (1 << i);
> +	if (down == lastDown)
> +	    continue;
> +
> +	if (xenfb_send_key(xenfb, down, BTN_LEFT+i) < 0)
> +	    return;
> +    }
> +    xenfb->button_state = button_state;
> +}
> +
> +static int input_init(struct xendev *xendev)
> +{
> +    struct xen_input *in = container_of(xendev, struct xen_input, c.xendev);
> +    static int first = 1;
> +    int i;
> +
> +    if (first) {
> +	/* Prepare scancode mapping table */
> +	for (i = 0; i < 128; i++) {
> +	    scancode2linux[i] = atkbd_set2_keycode[atkbd_unxlate_table[i]];
> +	    scancode2linux[i | 0x80] =
> +		atkbd_set2_keycode[atkbd_unxlate_table[i] | 0x80];
> +	}
> +	first = 0;
> +    }
> +
> +    if (!in->c.ds) {
> +        /* xen_set_display() below will set that and trigger us again */
> +        xen_be_printf(xendev, 1, "ds not set (yet)\n");
> +	return -1;
> +    }
> +
> +    xenstore_write_be_int(xendev, "feature-abs-pointer", 1);
> +    return 0;
> +}
> +
> +static int input_connect(struct xendev *xendev)
> +{
> +    struct xen_input *in = container_of(xendev, struct xen_input, c.xendev);
> +    int rc;
> +
> +    if (-1 == xenstore_read_fe_int(xendev, "request-abs-pointer", &in->abs_pointer_wanted))
> +	in->abs_pointer_wanted = 0;
> +
> +    rc = common_bind(&in->c);
> +    if (0 != rc)
> +	return rc;
> +
> +    qemu_add_kbd_event_handler(xenfb_key_event, in);
> +    in->qmouse = qemu_add_mouse_event_handler(xenfb_mouse_event, in,
> +					      in->abs_pointer_wanted,
> +					      "Xen PVFB Mouse");
> +    return 0;
> +}
> +
> +static void input_disconnect(struct xendev *xendev)
> +{
> +    struct xen_input *in = container_of(xendev, struct xen_input, c.xendev);
> +
> +    if (in->qmouse) {
> +	qemu_remove_mouse_event_handler(in->qmouse);
> +	in->qmouse = NULL;
> +    }
> +    qemu_add_kbd_event_handler(NULL, NULL);
> +    common_unbind(&in->c);
> +}
> +
> +static void input_event(struct xendev *xendev)
> +{
> +    struct xen_input *xenfb = container_of(xendev, struct xen_input, c.xendev);
> +    struct xenkbd_page *page = xenfb->c.page;
> +
> +    /* We don't understand any keyboard events, so just ignore them. */
> +    if (page->out_prod == page->out_cons)
> +	return;
> +    page->out_cons = page->out_prod;
> +    xen_be_send_notify(&xenfb->c.xendev);
> +}
> +
> +/* -------------------------------------------------------------------- */
> +
> +static void xenfb_copy_mfns(int mode, int count, unsigned long *dst, void *src)
> +{
> +    uint32_t *src32 = src;
> +    uint64_t *src64 = src;
> +    int i;
> +
> +    for (i = 0; i < count; i++)
> +	dst[i] = (mode == 32) ? src32[i] : src64[i];
> +}
> +
> +static int xenfb_map_fb(struct xen_fb *xenfb)
> +{
> +    struct xenfb_page *page = xenfb->c.page;
> +    char *protocol = xenfb->c.xendev.protocol;
> +    int n_fbmfns;
> +    int n_fbdirs;
> +    unsigned long *pgmfns = NULL;
> +    unsigned long *fbmfns = NULL;
> +    void *map, *pd;
> +    int mode, ret = -1;
> +
> +    /* default to native */
> +    pd = page->pd;
> +    mode = sizeof(unsigned long) * 8;
> +
> +    if (!protocol) {
> +	/*
> +	 * Undefined protocol, some guesswork needed.
> +	 *
> +	 * Old frontends which don't set the protocol use
> +	 * one page directory only, thus pd[1] must be zero.
> +	 * pd[1] of the 32bit struct layout and the lower
> +	 * 32 bits of pd[0] of the 64bit struct layout have
> +	 * the same location, so we can check that ...
> +	 */
> +	uint32_t *ptr32 = NULL;
> +	uint32_t *ptr64 = NULL;
> +#if defined(__i386__)
> +	ptr32 = (void*)page->pd;
> +	ptr64 = ((void*)page->pd) + 4;
> +#elif defined(__x86_64__)
> +	ptr32 = ((void*)page->pd) - 4;
> +	ptr64 = (void*)page->pd;
> +#endif
> +	if (ptr32) {
> +	    if (0 == ptr32[1]) {
> +		mode = 32;
> +		pd   = ptr32;
> +	    } else {
> +		mode = 64;
> +		pd   = ptr64;
> +	    }
> +	}
> +#if defined(__x86_64__)
> +    } else if (0 == strcmp(protocol, XEN_IO_PROTO_ABI_X86_32)) {
> +	/* 64bit dom0, 32bit domU */
> +	mode = 32;
> +	pd   = ((void*)page->pd) - 4;
> +#elif defined(__i386__)
> +    } else if (0 == strcmp(protocol, XEN_IO_PROTO_ABI_X86_64)) {
> +	/* 32bit dom0, 64bit domU */
> +	mode = 64;
> +	pd   = ((void*)page->pd) + 4;
> +#endif
> +    }
> +
> +    n_fbmfns = (xenfb->fb_len + (XC_PAGE_SIZE - 1)) / XC_PAGE_SIZE;
> +    n_fbdirs = n_fbmfns * mode / 8;
> +    n_fbdirs = (n_fbdirs + (XC_PAGE_SIZE - 1)) / XC_PAGE_SIZE;
> +
> +    pgmfns = malloc(sizeof(unsigned long) * n_fbdirs);
> +    fbmfns = malloc(sizeof(unsigned long) * n_fbmfns);
> +    if (!pgmfns || !fbmfns)
> +	goto out;
> +
> +    xenfb_copy_mfns(mode, n_fbdirs, pgmfns, pd);
> +    map = xc_map_foreign_pages(xen_xc, xenfb->c.xendev.dom,
> +			       PROT_READ, pgmfns, n_fbdirs);
> +    if (map == NULL)
> +	goto out;
> +    xenfb_copy_mfns(mode, n_fbmfns, fbmfns, map);
> +    munmap(map, n_fbdirs * XC_PAGE_SIZE);
> +
> +    xenfb->pixels = xc_map_foreign_pages(xen_xc, xenfb->c.xendev.dom,
> +					 PROT_READ | PROT_WRITE, fbmfns, n_fbmfns);
> +    if (xenfb->pixels == NULL)
> +	goto out;
> +
> +    ret = 0; /* all is fine */
> +
> +out:
> +    if (pgmfns)
> +	free(pgmfns);
> +    if (fbmfns)
> +	free(fbmfns);
> +    return ret;
> +}
> +
> +static int xenfb_configure_fb(struct xen_fb *xenfb, size_t fb_len_lim,
> +			      int width, int height, int depth,
> +			      size_t fb_len, int offset, int row_stride)
> +{
> +    size_t mfn_sz = sizeof(*((struct xenfb_page *)0)->pd);
> +    size_t pd_len = sizeof(((struct xenfb_page *)0)->pd) / mfn_sz;
> +    size_t fb_pages = pd_len * XC_PAGE_SIZE / mfn_sz;
> +    size_t fb_len_max = fb_pages * XC_PAGE_SIZE;
> +    int max_width, max_height;
> +
> +    if (fb_len_lim > fb_len_max) {
> +	xen_be_printf(&xenfb->c.xendev, 0, "fb size limit %zu exceeds %zu, corrected\n",
> +		      fb_len_lim, fb_len_max);
> +	fb_len_lim = fb_len_max;
> +    }
> +    if (fb_len_lim && fb_len > fb_len_lim) {
> +	xen_be_printf(&xenfb->c.xendev, 0, "frontend fb size %zu limited to %zu\n",
> +		      fb_len, fb_len_lim);
> +	fb_len = fb_len_lim;
> +    }
> +    if (depth != 8 && depth != 16 && depth != 24 && depth != 32) {
> +	xen_be_printf(&xenfb->c.xendev, 0, "can't handle frontend fb depth %d\n",
> +		      depth);
> +	return -1;
> +    }
> +    if (row_stride < 0 || row_stride > fb_len) {
> +	xen_be_printf(&xenfb->c.xendev, 0, "invalid frontend stride %d\n", row_stride);
> +	return -1;
> +    }
> +    max_width = row_stride / (depth / 8);
> +    if (width < 0 || width > max_width) {
> +	xen_be_printf(&xenfb->c.xendev, 0, "invalid frontend width %d limited to %d\n",
> +		      width, max_width);
> +	width = max_width;
> +    }
> +    if (offset < 0 || offset >= fb_len) {
> +	xen_be_printf(&xenfb->c.xendev, 0, "invalid frontend offset %d (max %zu)\n",
> +		      offset, fb_len - 1);
> +	return -1;
> +    }
> +    max_height = (fb_len - offset) / row_stride;
> +    if (height < 0 || height > max_height) {
> +	xen_be_printf(&xenfb->c.xendev, 0, "invalid frontend height %d limited to %d\n",
> +		      height, max_height);
> +	height = max_height;
> +    }
> +    xenfb->fb_len = fb_len;
> +    xenfb->row_stride = row_stride;
> +    xenfb->depth = depth;
> +    xenfb->width = width;
> +    xenfb->height = height;
> +    xenfb->offset = offset;
> +    xen_be_printf(&xenfb->c.xendev, 1, "framebuffer %dx%dx%d offset %d stride %d\n",
> +		  width, height, depth, offset, row_stride);
> +    return 0;
> +}
> +
> +/* A convenient function for munging pixels between different depths */
> +#define BLT(SRC_T,DST_T,RSB,GSB,BSB,RDB,GDB,BDB)                        \
> +    for (line = y ; line < (y+h) ; line++) {				\
> +	SRC_T *src = (SRC_T *)(xenfb->pixels				\
> +			       + xenfb->offset				\
> +			       + (line * xenfb->row_stride)		\
> +			       + (x * xenfb->depth / 8));		\
> +	DST_T *dst = (DST_T *)(xenfb->c.ds->data				\
> +			       + (line * xenfb->c.ds->linesize)		\
> +			       + (x * xenfb->c.ds->depth / 8));		\
> +	int col;							\
> +	const int RSS = 32 - (RSB + GSB + BSB);				\
> +	const int GSS = 32 - (GSB + BSB);				\
> +	const int BSS = 32 - (BSB);					\
> +	const uint32_t RSM = (~0U) << (32 - RSB);			\
> +	const uint32_t GSM = (~0U) << (32 - GSB);			\
> +	const uint32_t BSM = (~0U) << (32 - BSB);			\
> +	const int RDS = 32 - (RDB + GDB + BDB);				\
> +	const int GDS = 32 - (GDB + BDB);				\
> +	const int BDS = 32 - (BDB);					\
> +	const uint32_t RDM = (~0U) << (32 - RDB);			\
> +	const uint32_t GDM = (~0U) << (32 - GDB);			\
> +	const uint32_t BDM = (~0U) << (32 - BDB);			\
> +	for (col = x ; col < (x+w) ; col++) {				\
> +	    uint32_t spix = *src;					\
> +	    *dst = (((spix << RSS) & RSM & RDM) >> RDS) |		\
> +		(((spix << GSS) & GSM & GDM) >> GDS) |			\
> +		(((spix << BSS) & BSM & BDM) >> BDS);			\
> +	    src = (SRC_T *) ((unsigned long) src + xenfb->depth / 8);	\
> +	    dst = (DST_T *) ((unsigned long) dst + xenfb->c.ds->depth / 8); \
> +	}								\
> +    }
>   

There are similar conversion macros in the VGA code.  I don't know how 
practical it would be to reuse them but it's at least worth looking at.

Regards,

Anthony Liguori

> +
> +/* This copies data from the guest framebuffer region, into QEMU's copy
> + * NB. QEMU's copy is stored in the pixel format of a) the local X
> + * server (SDL case) or b) the current VNC client pixel format.
> + * When shifting between colour depths we preserve the MSB.
> + */
> +static void xenfb_guest_copy(struct xen_fb *xenfb, int x, int y, int w, int h)
> +{
> +    int line;
> +
> +    if (1 /* !xenfb->c.ds->shared_buf */) {
> +	if (xenfb->depth == xenfb->c.ds->depth) { /* Perfect match can use fast path */
> +	    for (line = y ; line < (y+h) ; line++) {
> +		memcpy(xenfb->c.ds->data + (line * xenfb->c.ds->linesize) + (x * xenfb->c.ds->depth / 8),
> +		       xenfb->pixels + xenfb->offset + (line * xenfb->row_stride) + (x * xenfb->depth / 8),
> +		       w * xenfb->depth / 8);
> +	    }
> +	} else { /* Mismatch requires slow pixel munging */
> +	    /* 8 bit == r:3 g:3 b:2 */
> +	    /* 16 bit == r:5 g:6 b:5 */
> +	    /* 24 bit == r:8 g:8 b:8 */
> +	    /* 32 bit == r:8 g:8 b:8 (padding:8) */
> +	    if (xenfb->depth == 8) {
> +		if (xenfb->c.ds->depth == 16) {
> +		    BLT(uint8_t, uint16_t,   3, 3, 2,   5, 6, 5);
> +		} else if (xenfb->c.ds->depth == 32) {
> +		    BLT(uint8_t, uint32_t,   3, 3, 2,   8, 8, 8);
> +		}
> +	    } else if (xenfb->depth == 16) {
> +		if (xenfb->c.ds->depth == 8) {
> +		    BLT(uint16_t, uint8_t,   5, 6, 5,   3, 3, 2);
> +		} else if (xenfb->c.ds->depth == 32) {
> +		    BLT(uint16_t, uint32_t,  5, 6, 5,   8, 8, 8);
> +		}
> +	    } else if (xenfb->depth == 24 || xenfb->depth == 32) {
> +		if (xenfb->c.ds->depth == 8) {
> +		    BLT(uint32_t, uint8_t,   8, 8, 8,   3, 3, 2);
> +		} else if (xenfb->c.ds->depth == 16) {
> +		    BLT(uint32_t, uint16_t,  8, 8, 8,   5, 6, 5);
> +		} else if (xenfb->c.ds->depth == 32) {
> +		    BLT(uint32_t, uint32_t,  8, 8, 8,   8, 8, 8);
> +		}
> +	    }
> +	}
> +    }
> +    dpy_update(xenfb->c.ds, x, y, w, h);
> +}
> +
> +#ifdef XENFB_TYPE_REFRESH_PERIOD
> +static int xenfb_queue_full(struct xen_fb *xenfb)
> +{
> +    struct xenfb_page *page = xenfb->c.page;
> +    uint32_t cons, prod;
> +
> +    prod = page->in_prod;
> +    cons = page->in_cons;
> +    return prod - cons == XENFB_IN_RING_LEN;
> +}
> +
> +static void xenfb_send_event(struct xen_fb *xenfb, union xenfb_in_event *event)
> +{
> +    uint32_t prod;
> +    struct xenfb_page *page = xenfb->c.page;
> +
> +    prod = page->in_prod;
> +    /* caller ensures !xenfb_queue_full() */
> +    xen_mb();                   /* ensure ring space available */
> +    XENFB_IN_RING_REF(page, prod) = *event;
> +    xen_wmb();                  /* ensure ring contents visible */
> +    page->in_prod = prod + 1;
> +
> +    xen_be_send_notify(&xenfb->c.xendev);
> +}
> +
> +static void xenfb_send_refresh_period(struct xen_fb *xenfb, int period)
> +{
> +    union xenfb_in_event event;
> +
> +    memset(&event, 0, sizeof(event));
> +    event.type = XENFB_TYPE_REFRESH_PERIOD;
> +    event.refresh_period.period = period;
> +    xenfb_send_event(xenfb, &event);
> +}
> +#endif
> +
> +/*
> + * Periodic update of display.
> + * Also transmit the refresh interval to the frontend.
> + * 
> + * Never ever do any qemu display operations
> + * (resize, screen update) outside this function.
> + * Our screen might be inactive.  When asked for
> + * an update we know it is active.
> + */
> +static void xenfb_update(void *opaque)
> +{
> +    struct xen_fb *xenfb = opaque;
> +    int i;
> +
> +    if (xenfb->feature_update) {
> +#ifdef XENFB_TYPE_REFRESH_PERIOD
> +	int period;
> +
> +	if (xenfb_queue_full(xenfb))
> +	    return;
> +
> +        /*
> +         * TODO: xen's qemu-dm seems to have some patches to
> +         *       make the qemu display code avoid unneeded
> +         *       work.
> +         *        - Port them over.
> +         *        - Put ds->idle back into use then.
> +         *        - Same goes for ds->shared_buf btw.
> +         */
> +	if (0 /* xenfb->c.ds->idle */)
> +	    period =  XENFB_NO_REFRESH;
> +	else {
> +	    period = xenfb->c.ds->gui_timer_interval;
> +	    if (!period)
> +		period = 30; // GUI_REFRESH_INTERVAL (see vl.c)
> +	}
> +
> +	if (xenfb->refresh_period != period) {
> +	    dprintf("%s: %d\n", __FUNCTION__, period);
> +	    xenfb_send_refresh_period(xenfb, period);
> +	    xenfb->refresh_period = period;
> +	}
> +#else
> +	; /* nothing */
> +#endif
> +    } else {
> +	/* we don't get update notifications, thus use the
> +	 * sledge hammer approach ... */
> +	xenfb->up_fullscreen = 1;
> +    }
> +
> +    /* resize if needed */
> +    if (xenfb->width != xenfb->c.ds->width || xenfb->height != xenfb->c.ds->height) {
> +	xen_be_printf(&xenfb->c.xendev, 1, "update: resizing\n");
> +	dpy_resize(xenfb->c.ds, xenfb->width, xenfb->height);
> +	xenfb->up_fullscreen = 1;
> +    }
> +
> +    /* run queued updates */
> +    if (xenfb->up_fullscreen) {
> +	xen_be_printf(&xenfb->c.xendev, 3, "update: fullscreen\n");
> +	xenfb_guest_copy(xenfb, 0, 0, xenfb->width, xenfb->height);
> +    } else if (xenfb->up_count) {
> +	xen_be_printf(&xenfb->c.xendev, 3, "update: %d rects\n", xenfb->up_count);
> +	for (i = 0; i < xenfb->up_count; i++)
> +	    xenfb_guest_copy(xenfb,
> +			     xenfb->up_rects[i].x,
> +			     xenfb->up_rects[i].y,
> +			     xenfb->up_rects[i].w,
> +			     xenfb->up_rects[i].h);
> +    } else {
> +	xen_be_printf(&xenfb->c.xendev, 3, "update: nothing\n");
> +    }
> +    xenfb->up_count = 0;
> +    xenfb->up_fullscreen = 0;
> +}
> +
> +static void xenfb_handle_events(struct xen_fb *xenfb)
> +{
> +    uint32_t prod, cons;
> +    struct xenfb_page *page = xenfb->c.page;
> +
> +    prod = page->out_prod;
> +    if (prod == page->out_cons)
> +	return;
> +    xen_rmb();		/* ensure we see ring contents up to prod */
> +    for (cons = page->out_cons; cons != prod; cons++) {
> +	union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);
> +	int x, y, w, h;
> +
> +	switch (event->type) {
> +	case XENFB_TYPE_UPDATE:
> +	    if (xenfb->up_count == UP_QUEUE)
> +		xenfb->up_fullscreen = 1;
> +	    if (xenfb->up_fullscreen)
> +		break;
> +	    x = MAX(event->update.x, 0);
> +	    y = MAX(event->update.y, 0);
> +	    w = MIN(event->update.width, xenfb->width - x);
> +	    h = MIN(event->update.height, xenfb->height - y);
> +	    if (w < 0 || h < 0) {
> +		fprintf(stderr, "xen be: %s: bogus update ignored\n",
> +			xenfb->c.xendev.name);
> +		break;
> +	    }
> +	    if (x != event->update.x || y != event->update.y
> +		|| w != event->update.width
> +		|| h != event->update.height) {
> +		fprintf(stderr, "xen be: %s: bogus update clipped\n",
> +			xenfb->c.xendev.name);
> +	    }
> +	    if (w == xenfb->width && h > xenfb->height / 2) {
> +		/* scroll detector: updated more than 50% of the lines,
> +		 * don't bother keeping track of the rectangles then */
> +		xenfb->up_fullscreen = 1;
> +	    } else {
> +		xenfb->up_rects[xenfb->up_count].x = x;
> +		xenfb->up_rects[xenfb->up_count].y = y;
> +		xenfb->up_rects[xenfb->up_count].w = w;
> +		xenfb->up_rects[xenfb->up_count].h = h;
> +		xenfb->up_count++;
> +	    }
> +	    break;
> +#ifdef XENFB_TYPE_RESIZE
> +	case XENFB_TYPE_RESIZE:
> +	    if (xenfb_configure_fb(xenfb, xenfb->fb_len,
> +				   event->resize.width,
> +				   event->resize.height,
> +				   event->resize.depth,
> +				   xenfb->fb_len,
> +				   event->resize.offset,
> +				   event->resize.stride) < 0)
> +		break;
> +	    xenfb_invalidate(xenfb);
> +	    break;
> +#endif
> +	}
> +    }
> +    xen_mb();		/* ensure we're done with ring contents */
> +    page->out_cons = cons;
> +}
> +
> +/* QEMU display state changed, so refresh the framebuffer copy */
> +static void xenfb_invalidate(void *opaque)
> +{
> +    struct xen_fb *xenfb = opaque;
> +    xenfb->up_fullscreen = 1;
> +}
> +
> +static int fb_init(struct xendev *xendev)
> +{
> +    struct xen_fb *fb = container_of(xendev, struct xen_fb, c.xendev);
> +
> +    if (!fb->c.ds) {
> +        /* xen_set_display() below will set that and trigger us again */
> +	xen_be_printf(xendev, 1, "ds not set (yet)\n");
> +	return -1;
> +    }
> +
> +    fb->refresh_period = -1;
> +
> +#ifdef XENFB_TYPE_RESIZE
> +    xenstore_write_be_int(xendev, "feature-resize", 1);
> +#endif
> +    return 0;
> +}
> +
> +static int fb_connect(struct xendev *xendev)
> +{
> +    struct xen_fb *fb = container_of(xendev, struct xen_fb, c.xendev);
> +    struct xenfb_page *fb_page;
> +    int videoram;
> +    int rc;
> +
> +    if (-1 == xenstore_read_fe_int(xendev, "feature-update", &fb->feature_update))
> +	fb->feature_update = 0;
> +    if (fb->feature_update)
> +	xenstore_write_be_int(xendev, "request-update", 1);
> +
> +    if (-1 == xenstore_read_fe_int(xendev, "videoram", &videoram))
> +	videoram = 0;
> +
> +    rc = common_bind(&fb->c);
> +    if (0 != rc)
> +	return rc;
> +
> +    fb_page = fb->c.page;
> +    rc = xenfb_configure_fb(fb, videoram * 1024 * 1024U,
> +			    fb_page->width, fb_page->height, fb_page->depth,
> +			    fb_page->mem_length, 0, fb_page->line_length);
> +    if (0 != rc)
> +	return rc;
> +
> +    rc = xenfb_map_fb(fb);
> +    if (0 != rc)
> +	return rc;
> +
> +    graphic_console_init(fb->c.ds,
> +			 xenfb_update,
> +			 xenfb_invalidate,
> +			 NULL,
> +			 NULL,
> +			 fb);
> +
> +    xen_be_printf(xendev, 1, "feature-update=%d, videoram=%d\n",
> +		  fb->feature_update, videoram);
> +
> +    return 0;
> +}
> +
> +static void fb_disconnect(struct xendev *xendev)
> +{
> +    struct xen_fb *fb = container_of(xendev, struct xen_fb, c.xendev);
> +
> +    /* FIXME: Hmm, un-init gfx display? can qemu handle that? */
> +    common_unbind(&fb->c);
> +}
> +
> +static void fb_frontend_changed(struct xendev *xendev, const char *node)
> +{
> +    struct xen_fb *fb = container_of(xendev, struct xen_fb, c.xendev);
> +
> +    /*
> +     * Set state to Connected *again* once the frontend switched
> +     * to connected.  We must trigger the watch a second time to
> +     * workaround a frontend bug.
> +     */
> +    if (0 == fb->bug_trigger && 0 == strcmp(node, "state") &&
> +	xendev->fe_state == XenbusStateConnected &&
> +	xendev->be_state == XenbusStateConnected) {
> +	xen_be_set_state(xendev, XenbusStateConnected);
> +	fb->bug_trigger = 1; /* only once */
> +    }
> +}
> +
> +static void fb_event(struct xendev *xendev)
> +{
> +    struct xen_fb *xenfb = container_of(xendev, struct xen_fb, c.xendev);
> +
> +    xenfb_handle_events(xenfb);
> +    xen_be_send_notify(&xenfb->c.xendev);
> +}
> +
> +/* -------------------------------------------------------------------- */
> +
> +struct devops xen_kbdmouse_ops = {
> +    .size       = sizeof(struct xen_input),
> +    .init       = input_init,
> +    .connect    = input_connect,
> +    .disconnect = input_disconnect,
> +    .event      = input_event,
> +};
> +
> +struct devops xen_framebuffer_ops = {
> +    .size       = sizeof(struct xen_fb),
> +    .init       = fb_init,
> +    .connect    = fb_connect,
> +    .disconnect = fb_disconnect,
> +    .event      = fb_event,
> +    .frontend_changed = fb_frontend_changed,
> +};
> +
> +static void xen_set_display_type(int domid, char *type, DisplayState *ds)
> +{
> +    struct xendev *xendev;
> +    struct xen_common *c;
> +
> +    xendev = xen_be_find_xendev(type, domid, 0);
> +    if (!xendev)
> +	return;
> +    c = container_of(xendev, struct xen_common, xendev);
> +    c->ds = ds;
> +    xen_be_printf(xendev, 1, "ds is %p\n", ds);
> +    /* retry ->init() */
> +    xen_be_check_state(xendev);
> +}
> +
> +void xen_set_display(int domid, DisplayState *ds)
> +{
> +    xen_set_display_type(domid, "vkbd", ds);
> +    xen_set_display_type(domid, "vfb", ds);
> +}
> diff --git a/hw/xen-machine.c b/hw/xen-machine.c
> index da10982..c03cb53 100644
> --- a/hw/xen-machine.c
> +++ b/hw/xen-machine.c
> @@ -59,6 +59,11 @@ static void xenpv_init(ram_addr_t ram_size, int vga_ram_size,
>      xen_be_init();
>  
>      xen_be_register("console", &xen_console_ops);
> +    xen_be_register("vkbd", &xen_kbdmouse_ops);
> +    xen_be_register("vfb", &xen_framebuffer_ops);
> +
> +    /* setup framebuffer */
> +    xen_set_display(xen_domid, ds);
>  }
>  
>  QEMUMachine xenpv_machine = {
>