contrib/vhost-user-gpu/main.c

   1 /*
   2  * Virtio vhost-user GPU Device
   3  *
   4  * Copyright Red Hat, Inc. 2013-2018
   5  *
   6  * Authors:
   7  *     Dave Airlie <airlied@redhat.com>
   8  *     Gerd Hoffmann <kraxel@redhat.com>
   9  *     Marc-André Lureau <marcandre.lureau@redhat.com>
  10  *
  11  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  12  * See the COPYING file in the top-level directory.
  13  */
  14 #include "qemu/osdep.h"
  15 #include "qemu/drm.h"
  16 #include "qapi/error.h"
  17 #include "qemu/sockets.h"
  18
  19 #include <pixman.h>
  20 #include <glib-unix.h>
  21
  22 #include "vugpu.h"
  23 #include "hw/virtio/virtio-gpu-bswap.h"
  24 #include "hw/virtio/virtio-gpu-pixman.h"
  25 #include "virgl.h"
  26 #include "vugbm.h"
  27
  28 struct virtio_gpu_simple_resource {
  29     uint32_t resource_id;
  30     uint32_t width;
  31     uint32_t height;
  32     uint32_t format;
  33     struct iovec *iov;
  34     unsigned int iov_cnt;
  35     uint32_t scanout_bitmask;
  36     pixman_image_t *image;
  37     struct vugbm_buffer buffer;
  38     QTAILQ_ENTRY(virtio_gpu_simple_resource) next;
  39 };
  40
  41 static gboolean opt_print_caps;
  42 static int opt_fdnum = -1;
  43 static char *opt_socket_path;
  44 static char *opt_render_node;
  45 static gboolean opt_virgl;
  46
  47 static void vg_handle_ctrl(VuDev *dev, int qidx);
  48
  49 static const char *
  50 vg_cmd_to_string(int cmd)
  51 {
  52 #define CMD(cmd) [cmd] = #cmd
  53     static const char *vg_cmd_str[] = {
  54         CMD(VIRTIO_GPU_UNDEFINED),
  55
  56         /* 2d commands */
  57         CMD(VIRTIO_GPU_CMD_GET_DISPLAY_INFO),
  58         CMD(VIRTIO_GPU_CMD_RESOURCE_CREATE_2D),
  59         CMD(VIRTIO_GPU_CMD_RESOURCE_UNREF),
  60         CMD(VIRTIO_GPU_CMD_SET_SCANOUT),
  61         CMD(VIRTIO_GPU_CMD_RESOURCE_FLUSH),
  62         CMD(VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D),
  63         CMD(VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING),
  64         CMD(VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING),
  65         CMD(VIRTIO_GPU_CMD_GET_CAPSET_INFO),
  66         CMD(VIRTIO_GPU_CMD_GET_CAPSET),
  67
  68         /* 3d commands */
  69         CMD(VIRTIO_GPU_CMD_CTX_CREATE),
  70         CMD(VIRTIO_GPU_CMD_CTX_DESTROY),
  71         CMD(VIRTIO_GPU_CMD_CTX_ATTACH_RESOURCE),
  72         CMD(VIRTIO_GPU_CMD_CTX_DETACH_RESOURCE),
  73         CMD(VIRTIO_GPU_CMD_RESOURCE_CREATE_3D),
  74         CMD(VIRTIO_GPU_CMD_TRANSFER_TO_HOST_3D),
  75         CMD(VIRTIO_GPU_CMD_TRANSFER_FROM_HOST_3D),
  76         CMD(VIRTIO_GPU_CMD_SUBMIT_3D),
  77
  78         /* cursor commands */
  79         CMD(VIRTIO_GPU_CMD_UPDATE_CURSOR),
  80         CMD(VIRTIO_GPU_CMD_MOVE_CURSOR),
  81     };
  82 #undef REQ
  83
  84     if (cmd >= 0 && cmd < G_N_ELEMENTS(vg_cmd_str)) {
  85         return vg_cmd_str[cmd];
  86     } else {
  87         return "unknown";
  88     }
  89 }
  90
  91 static int
  92 vg_sock_fd_read(int sock, void *buf, ssize_t buflen)
  93 {
  94     int ret;
  95
  96     do {
  97         ret = read(sock, buf, buflen);
  98     } while (ret < 0 && (errno == EINTR || errno == EAGAIN));
  99
 100     g_warn_if_fail(ret == buflen);
 101     return ret;
 102 }
 103
 104 static void
 105 vg_sock_fd_close(VuGpu *g)
 106 {
 107     if (g->sock_fd >= 0) {
 108         close(g->sock_fd);
 109         g->sock_fd = -1;
 110     }
 111 }
 112
 113 static gboolean
 114 source_wait_cb(gint fd, GIOCondition condition, gpointer user_data)
 115 {
 116     VuGpu *g = user_data;
 117
 118     if (!vg_recv_msg(g, VHOST_USER_GPU_DMABUF_UPDATE, 0, NULL)) {
 119         return G_SOURCE_CONTINUE;
 120     }
 121
 122     /* resume */
 123     g->wait_ok = 0;
 124     vg_handle_ctrl(&g->dev.parent, 0);
 125
 126     return G_SOURCE_REMOVE;
 127 }
 128
 129 void
 130 vg_wait_ok(VuGpu *g)
 131 {
 132     assert(g->wait_ok == 0);
 133     g->wait_ok = g_unix_fd_add(g->sock_fd, G_IO_IN | G_IO_HUP,
 134                                source_wait_cb, g);
 135 }
 136
 137 static int
 138 vg_sock_fd_write(int sock, const void *buf, ssize_t buflen, int fd)
 139 {
 140     ssize_t ret;
 141     struct msghdr msg;
 142     struct iovec iov;
 143     union {
 144         struct cmsghdr cmsghdr;
 145         char control[CMSG_SPACE(sizeof(int))];
 146     } cmsgu;
 147     struct cmsghdr *cmsg;
 148
 149     iov.iov_base = (void *)buf;
 150     iov.iov_len = buflen;
 151
 152     msg.msg_name = NULL;
 153     msg.msg_namelen = 0;
 154     msg.msg_iov = &iov;
 155     msg.msg_iovlen = 1;
 156
 157     if (fd != -1) {
 158         msg.msg_control = cmsgu.control;
 159         msg.msg_controllen = sizeof(cmsgu.control);
 160
 161         cmsg = CMSG_FIRSTHDR(&msg);
 162         cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 163         cmsg->cmsg_level = SOL_SOCKET;
 164         cmsg->cmsg_type = SCM_RIGHTS;
 165
 166         *((int *)CMSG_DATA(cmsg)) = fd;
 167     } else {
 168         msg.msg_control = NULL;
 169         msg.msg_controllen = 0;
 170     }
 171
 172     do {
 173         ret = sendmsg(sock, &msg, 0);
 174     } while (ret == -1 && (errno == EINTR || errno == EAGAIN));
 175
 176     g_warn_if_fail(ret == buflen);
 177     return ret;
 178 }
 179
 180 void
 181 vg_send_msg(VuGpu *vg, const VhostUserGpuMsg *msg, int fd)
 182 {
 183     if (vg_sock_fd_write(vg->sock_fd, msg,
 184                          VHOST_USER_GPU_HDR_SIZE + msg->size, fd) < 0) {
 185         vg_sock_fd_close(vg);
 186     }
 187 }
 188
 189 bool
 190 vg_recv_msg(VuGpu *g, uint32_t expect_req, uint32_t expect_size,
 191             gpointer payload)
 192 {
 193     uint32_t req, flags, size;
 194
 195     if (vg_sock_fd_read(g->sock_fd, &req, sizeof(req)) < 0 ||
 196         vg_sock_fd_read(g->sock_fd, &flags, sizeof(flags)) < 0 ||
 197         vg_sock_fd_read(g->sock_fd, &size, sizeof(size)) < 0) {
 198         goto err;
 199     }
 200
 201     g_return_val_if_fail(req == expect_req, false);
 202     g_return_val_if_fail(flags & VHOST_USER_GPU_MSG_FLAG_REPLY, false);
 203     g_return_val_if_fail(size == expect_size, false);
 204
 205     if (size && vg_sock_fd_read(g->sock_fd, payload, size) != size) {
 206         goto err;
 207     }
 208
 209     return true;
 210
 211 err:
 212     vg_sock_fd_close(g);
 213     return false;
 214 }
 215
 216 static struct virtio_gpu_simple_resource *
 217 virtio_gpu_find_resource(VuGpu *g, uint32_t resource_id)
 218 {
 219     struct virtio_gpu_simple_resource *res;
 220
 221     QTAILQ_FOREACH(res, &g->reslist, next) {
 222         if (res->resource_id == resource_id) {
 223             return res;
 224         }
 225     }
 226     return NULL;
 227 }
 228
 229 void
 230 vg_ctrl_response(VuGpu *g,
 231                  struct virtio_gpu_ctrl_command *cmd,
 232                  struct virtio_gpu_ctrl_hdr *resp,
 233                  size_t resp_len)
 234 {
 235     size_t s;
 236
 237     if (cmd->cmd_hdr.flags & VIRTIO_GPU_FLAG_FENCE) {
 238         resp->flags |= VIRTIO_GPU_FLAG_FENCE;
 239         resp->fence_id = cmd->cmd_hdr.fence_id;
 240         resp->ctx_id = cmd->cmd_hdr.ctx_id;
 241     }
 242     virtio_gpu_ctrl_hdr_bswap(resp);
 243     s = iov_from_buf(cmd->elem.in_sg, cmd->elem.in_num, 0, resp, resp_len);
 244     if (s != resp_len) {
 245         g_critical("%s: response size incorrect %zu vs %zu",
 246                    __func__, s, resp_len);
 247     }
 248     vu_queue_push(&g->dev.parent, cmd->vq, &cmd->elem, s);
 249     vu_queue_notify(&g->dev.parent, cmd->vq);
 250     cmd->finished = true;
 251 }
 252
 253 void
 254 vg_ctrl_response_nodata(VuGpu *g,
 255                         struct virtio_gpu_ctrl_command *cmd,
 256                         enum virtio_gpu_ctrl_type type)
 257 {
 258     struct virtio_gpu_ctrl_hdr resp = {
 259         .type = type,
 260     };
 261
 262     vg_ctrl_response(g, cmd, &resp, sizeof(resp));
 263 }
 264
 265 void
 266 vg_get_display_info(VuGpu *vg, struct virtio_gpu_ctrl_command *cmd)
 267 {
 268     struct virtio_gpu_resp_display_info dpy_info = { {} };
 269     VhostUserGpuMsg msg = {
 270         .request = VHOST_USER_GPU_GET_DISPLAY_INFO,
 271         .size = 0,
 272     };
 273
 274     assert(vg->wait_ok == 0);
 275
 276     vg_send_msg(vg, &msg, -1);
 277     if (!vg_recv_msg(vg, msg.request, sizeof(dpy_info), &dpy_info)) {
 278         return;
 279     }
 280
 281     vg_ctrl_response(vg, cmd, &dpy_info.hdr, sizeof(dpy_info));
 282 }
 283
 284 static void
 285 vg_resource_create_2d(VuGpu *g,
 286                       struct virtio_gpu_ctrl_command *cmd)
 287 {
 288     pixman_format_code_t pformat;
 289     struct virtio_gpu_simple_resource *res;
 290     struct virtio_gpu_resource_create_2d c2d;
 291
 292     VUGPU_FILL_CMD(c2d);
 293     virtio_gpu_bswap_32(&c2d, sizeof(c2d));
 294
 295     if (c2d.resource_id == 0) {
 296         g_critical("%s: resource id 0 is not allowed", __func__);
 297         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 298         return;
 299     }
 300
 301     res = virtio_gpu_find_resource(g, c2d.resource_id);
 302     if (res) {
 303         g_critical("%s: resource already exists %d", __func__, c2d.resource_id);
 304         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 305         return;
 306     }
 307
 308     res = g_new0(struct virtio_gpu_simple_resource, 1);
 309     res->width = c2d.width;
 310     res->height = c2d.height;
 311     res->format = c2d.format;
 312     res->resource_id = c2d.resource_id;
 313
 314     pformat = virtio_gpu_get_pixman_format(c2d.format);
 315     if (!pformat) {
 316         g_critical("%s: host couldn't handle guest format %d",
 317                    __func__, c2d.format);
 318         g_free(res);
 319         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 320         return;
 321     }
 322     vugbm_buffer_create(&res->buffer, &g->gdev, c2d.width, c2d.height);
 323     res->image = pixman_image_create_bits(pformat,
 324                                           c2d.width,
 325                                           c2d.height,
 326                                           (uint32_t *)res->buffer.mmap,
 327                                           res->buffer.stride);
 328     if (!res->image) {
 329         g_critical("%s: resource creation failed %d %d %d",
 330                    __func__, c2d.resource_id, c2d.width, c2d.height);
 331         g_free(res);
 332         cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
 333         return;
 334     }
 335
 336     QTAILQ_INSERT_HEAD(&g->reslist, res, next);
 337 }
 338
 339 static void
 340 vg_disable_scanout(VuGpu *g, int scanout_id)
 341 {
 342     struct virtio_gpu_scanout *scanout = &g->scanout[scanout_id];
 343     struct virtio_gpu_simple_resource *res;
 344
 345     if (scanout->resource_id == 0) {
 346         return;
 347     }
 348
 349     res = virtio_gpu_find_resource(g, scanout->resource_id);
 350     if (res) {
 351         res->scanout_bitmask &= ~(1 << scanout_id);
 352     }
 353
 354     scanout->width = 0;
 355     scanout->height = 0;
 356
 357     {
 358         VhostUserGpuMsg msg = {
 359             .request = VHOST_USER_GPU_SCANOUT,
 360             .size = sizeof(VhostUserGpuScanout),
 361             .payload.scanout.scanout_id = scanout_id,
 362         };
 363         vg_send_msg(g, &msg, -1);
 364     }
 365 }
 366
 367 static void
 368 vg_resource_destroy(VuGpu *g,
 369                     struct virtio_gpu_simple_resource *res)
 370 {
 371     int i;
 372
 373     if (res->scanout_bitmask) {
 374         for (i = 0; i < VIRTIO_GPU_MAX_SCANOUTS; i++) {
 375             if (res->scanout_bitmask & (1 << i)) {
 376                 vg_disable_scanout(g, i);
 377             }
 378         }
 379     }
 380
 381     vugbm_buffer_destroy(&res->buffer);
 382     pixman_image_unref(res->image);
 383     QTAILQ_REMOVE(&g->reslist, res, next);
 384     g_free(res);
 385 }
 386
 387 static void
 388 vg_resource_unref(VuGpu *g,
 389                   struct virtio_gpu_ctrl_command *cmd)
 390 {
 391     struct virtio_gpu_simple_resource *res;
 392     struct virtio_gpu_resource_unref unref;
 393
 394     VUGPU_FILL_CMD(unref);
 395     virtio_gpu_bswap_32(&unref, sizeof(unref));
 396
 397     res = virtio_gpu_find_resource(g, unref.resource_id);
 398     if (!res) {
 399         g_critical("%s: illegal resource specified %d",
 400                    __func__, unref.resource_id);
 401         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 402         return;
 403     }
 404     vg_resource_destroy(g, res);
 405 }
 406
 407 int
 408 vg_create_mapping_iov(VuGpu *g,
 409                       struct virtio_gpu_resource_attach_backing *ab,
 410                       struct virtio_gpu_ctrl_command *cmd,
 411                       struct iovec **iov)
 412 {
 413     struct virtio_gpu_mem_entry *ents;
 414     size_t esize, s;
 415     int i;
 416
 417     if (ab->nr_entries > 16384) {
 418         g_critical("%s: nr_entries is too big (%d > 16384)",
 419                    __func__, ab->nr_entries);
 420         return -1;
 421     }
 422
 423     esize = sizeof(*ents) * ab->nr_entries;
 424     ents = g_malloc(esize);
 425     s = iov_to_buf(cmd->elem.out_sg, cmd->elem.out_num,
 426                    sizeof(*ab), ents, esize);
 427     if (s != esize) {
 428         g_critical("%s: command data size incorrect %zu vs %zu",
 429                    __func__, s, esize);
 430         g_free(ents);
 431         return -1;
 432     }
 433
 434     *iov = g_malloc0(sizeof(struct iovec) * ab->nr_entries);
 435     for (i = 0; i < ab->nr_entries; i++) {
 436         uint64_t len = ents[i].length;
 437         (*iov)[i].iov_len = ents[i].length;
 438         (*iov)[i].iov_base = vu_gpa_to_va(&g->dev.parent, &len, ents[i].addr);
 439         if (!(*iov)[i].iov_base || len != ents[i].length) {
 440             g_critical("%s: resource %d element %d",
 441                        __func__, ab->resource_id, i);
 442             g_free(*iov);
 443             g_free(ents);
 444             *iov = NULL;
 445             return -1;
 446         }
 447     }
 448     g_free(ents);
 449     return 0;
 450 }
 451
 452 static void
 453 vg_resource_attach_backing(VuGpu *g,
 454                            struct virtio_gpu_ctrl_command *cmd)
 455 {
 456     struct virtio_gpu_simple_resource *res;
 457     struct virtio_gpu_resource_attach_backing ab;
 458     int ret;
 459
 460     VUGPU_FILL_CMD(ab);
 461     virtio_gpu_bswap_32(&ab, sizeof(ab));
 462
 463     res = virtio_gpu_find_resource(g, ab.resource_id);
 464     if (!res) {
 465         g_critical("%s: illegal resource specified %d",
 466                    __func__, ab.resource_id);
 467         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 468         return;
 469     }
 470
 471     ret = vg_create_mapping_iov(g, &ab, cmd, &res->iov);
 472     if (ret != 0) {
 473         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
 474         return;
 475     }
 476
 477     res->iov_cnt = ab.nr_entries;
 478 }
 479
 480 static void
 481 vg_resource_detach_backing(VuGpu *g,
 482                            struct virtio_gpu_ctrl_command *cmd)
 483 {
 484     struct virtio_gpu_simple_resource *res;
 485     struct virtio_gpu_resource_detach_backing detach;
 486
 487     VUGPU_FILL_CMD(detach);
 488     virtio_gpu_bswap_32(&detach, sizeof(detach));
 489
 490     res = virtio_gpu_find_resource(g, detach.resource_id);
 491     if (!res || !res->iov) {
 492         g_critical("%s: illegal resource specified %d",
 493                    __func__, detach.resource_id);
 494         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 495         return;
 496     }
 497
 498     g_free(res->iov);
 499     res->iov = NULL;
 500     res->iov_cnt = 0;
 501 }
 502
 503 static void
 504 vg_transfer_to_host_2d(VuGpu *g,
 505                        struct virtio_gpu_ctrl_command *cmd)
 506 {
 507     struct virtio_gpu_simple_resource *res;
 508     int h;
 509     uint32_t src_offset, dst_offset, stride;
 510     int bpp;
 511     pixman_format_code_t format;
 512     struct virtio_gpu_transfer_to_host_2d t2d;
 513
 514     VUGPU_FILL_CMD(t2d);
 515     virtio_gpu_t2d_bswap(&t2d);
 516
 517     res = virtio_gpu_find_resource(g, t2d.resource_id);
 518     if (!res || !res->iov) {
 519         g_critical("%s: illegal resource specified %d",
 520                    __func__, t2d.resource_id);
 521         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 522         return;
 523     }
 524
 525     if (t2d.r.x > res->width ||
 526         t2d.r.y > res->height ||
 527         t2d.r.width > res->width ||
 528         t2d.r.height > res->height ||
 529         t2d.r.x + t2d.r.width > res->width ||
 530         t2d.r.y + t2d.r.height > res->height) {
 531         g_critical("%s: transfer bounds outside resource"
 532                    " bounds for resource %d: %d %d %d %d vs %d %d",
 533                    __func__, t2d.resource_id, t2d.r.x, t2d.r.y,
 534                    t2d.r.width, t2d.r.height, res->width, res->height);
 535         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 536         return;
 537     }
 538
 539     format = pixman_image_get_format(res->image);
 540     bpp = (PIXMAN_FORMAT_BPP(format) + 7) / 8;
 541     stride = pixman_image_get_stride(res->image);
 542
 543     if (t2d.offset || t2d.r.x || t2d.r.y ||
 544         t2d.r.width != pixman_image_get_width(res->image)) {
 545         void *img_data = pixman_image_get_data(res->image);
 546         for (h = 0; h < t2d.r.height; h++) {
 547             src_offset = t2d.offset + stride * h;
 548             dst_offset = (t2d.r.y + h) * stride + (t2d.r.x * bpp);
 549
 550             iov_to_buf(res->iov, res->iov_cnt, src_offset,
 551                        img_data
 552                        + dst_offset, t2d.r.width * bpp);
 553         }
 554     } else {
 555         iov_to_buf(res->iov, res->iov_cnt, 0,
 556                    pixman_image_get_data(res->image),
 557                    pixman_image_get_stride(res->image)
 558                    * pixman_image_get_height(res->image));
 559     }
 560 }
 561
 562 static void
 563 vg_set_scanout(VuGpu *g,
 564                struct virtio_gpu_ctrl_command *cmd)
 565 {
 566     struct virtio_gpu_simple_resource *res, *ores;
 567     struct virtio_gpu_scanout *scanout;
 568     struct virtio_gpu_set_scanout ss;
 569     int fd;
 570
 571     VUGPU_FILL_CMD(ss);
 572     virtio_gpu_bswap_32(&ss, sizeof(ss));
 573
 574     if (ss.scanout_id >= VIRTIO_GPU_MAX_SCANOUTS) {
 575         g_critical("%s: illegal scanout id specified %d",
 576                    __func__, ss.scanout_id);
 577         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID;
 578         return;
 579     }
 580
 581     if (ss.resource_id == 0) {
 582         vg_disable_scanout(g, ss.scanout_id);
 583         return;
 584     }
 585
 586     /* create a surface for this scanout */
 587     res = virtio_gpu_find_resource(g, ss.resource_id);
 588     if (!res) {
 589         g_critical("%s: illegal resource specified %d",
 590                       __func__, ss.resource_id);
 591         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 592         return;
 593     }
 594
 595     if (ss.r.x > res->width ||
 596         ss.r.y > res->height ||
 597         ss.r.width > res->width ||
 598         ss.r.height > res->height ||
 599         ss.r.x + ss.r.width > res->width ||
 600         ss.r.y + ss.r.height > res->height) {
 601         g_critical("%s: illegal scanout %d bounds for"
 602                    " resource %d, (%d,%d)+%d,%d vs %d %d",
 603                    __func__, ss.scanout_id, ss.resource_id, ss.r.x, ss.r.y,
 604                    ss.r.width, ss.r.height, res->width, res->height);
 605         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 606         return;
 607     }
 608
 609     scanout = &g->scanout[ss.scanout_id];
 610
 611     ores = virtio_gpu_find_resource(g, scanout->resource_id);
 612     if (ores) {
 613         ores->scanout_bitmask &= ~(1 << ss.scanout_id);
 614     }
 615
 616     res->scanout_bitmask |= (1 << ss.scanout_id);
 617     scanout->resource_id = ss.resource_id;
 618     scanout->x = ss.r.x;
 619     scanout->y = ss.r.y;
 620     scanout->width = ss.r.width;
 621     scanout->height = ss.r.height;
 622
 623     struct vugbm_buffer *buffer = &res->buffer;
 624
 625     if (vugbm_buffer_can_get_dmabuf_fd(buffer)) {
 626         VhostUserGpuMsg msg = {
 627             .request = VHOST_USER_GPU_DMABUF_SCANOUT,
 628             .size = sizeof(VhostUserGpuDMABUFScanout),
 629             .payload.dmabuf_scanout = (VhostUserGpuDMABUFScanout) {
 630                 .scanout_id = ss.scanout_id,
 631                 .x = ss.r.x,
 632                 .y = ss.r.y,
 633                 .width = ss.r.width,
 634                 .height = ss.r.height,
 635                 .fd_width = buffer->width,
 636                 .fd_height = buffer->height,
 637                 .fd_stride = buffer->stride,
 638                 .fd_drm_fourcc = buffer->format
 639             }
 640         };
 641
 642         if (vugbm_buffer_get_dmabuf_fd(buffer, &fd)) {
 643             vg_send_msg(g, &msg, fd);
 644             close(fd);
 645         }
 646     } else {
 647         VhostUserGpuMsg msg = {
 648             .request = VHOST_USER_GPU_SCANOUT,
 649             .size = sizeof(VhostUserGpuScanout),
 650             .payload.scanout = (VhostUserGpuScanout) {
 651                 .scanout_id = ss.scanout_id,
 652                 .width = scanout->width,
 653                 .height = scanout->height
 654             }
 655         };
 656         vg_send_msg(g, &msg, -1);
 657     }
 658 }
 659
 660 static void
 661 vg_resource_flush(VuGpu *g,
 662                   struct virtio_gpu_ctrl_command *cmd)
 663 {
 664     struct virtio_gpu_simple_resource *res;
 665     struct virtio_gpu_resource_flush rf;
 666     pixman_region16_t flush_region;
 667     int i;
 668
 669     VUGPU_FILL_CMD(rf);
 670     virtio_gpu_bswap_32(&rf, sizeof(rf));
 671
 672     res = virtio_gpu_find_resource(g, rf.resource_id);
 673     if (!res) {
 674         g_critical("%s: illegal resource specified %d\n",
 675                    __func__, rf.resource_id);
 676         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 677         return;
 678     }
 679
 680     if (rf.r.x > res->width ||
 681         rf.r.y > res->height ||
 682         rf.r.width > res->width ||
 683         rf.r.height > res->height ||
 684         rf.r.x + rf.r.width > res->width ||
 685         rf.r.y + rf.r.height > res->height) {
 686         g_critical("%s: flush bounds outside resource"
 687                    " bounds for resource %d: %d %d %d %d vs %d %d\n",
 688                    __func__, rf.resource_id, rf.r.x, rf.r.y,
 689                    rf.r.width, rf.r.height, res->width, res->height);
 690         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 691         return;
 692     }
 693
 694     pixman_region_init_rect(&flush_region,
 695                             rf.r.x, rf.r.y, rf.r.width, rf.r.height);
 696     for (i = 0; i < VIRTIO_GPU_MAX_SCANOUTS; i++) {
 697         struct virtio_gpu_scanout *scanout;
 698         pixman_region16_t region, finalregion;
 699         pixman_box16_t *extents;
 700
 701         if (!(res->scanout_bitmask & (1 << i))) {
 702             continue;
 703         }
 704         scanout = &g->scanout[i];
 705
 706         pixman_region_init(&finalregion);
 707         pixman_region_init_rect(&region, scanout->x, scanout->y,
 708                                 scanout->width, scanout->height);
 709
 710         pixman_region_intersect(&finalregion, &flush_region, &region);
 711
 712         extents = pixman_region_extents(&finalregion);
 713         size_t width = extents->x2 - extents->x1;
 714         size_t height = extents->y2 - extents->y1;
 715
 716         if (vugbm_buffer_can_get_dmabuf_fd(&res->buffer)) {
 717             VhostUserGpuMsg vmsg = {
 718                 .request = VHOST_USER_GPU_DMABUF_UPDATE,
 719                 .size = sizeof(VhostUserGpuUpdate),
 720                 .payload.update = (VhostUserGpuUpdate) {
 721                     .scanout_id = i,
 722                     .x = extents->x1,
 723                     .y = extents->y1,
 724                     .width = width,
 725                     .height = height,
 726                 }
 727             };
 728             vg_send_msg(g, &vmsg, -1);
 729             vg_wait_ok(g);
 730         } else {
 731             size_t bpp =
 732                 PIXMAN_FORMAT_BPP(pixman_image_get_format(res->image)) / 8;
 733             size_t size = width * height * bpp;
 734
 735             void *p = g_malloc(VHOST_USER_GPU_HDR_SIZE +
 736                                sizeof(VhostUserGpuUpdate) + size);
 737             VhostUserGpuMsg *msg = p;
 738             msg->request = VHOST_USER_GPU_UPDATE;
 739             msg->size = sizeof(VhostUserGpuUpdate) + size;
 740             msg->payload.update = (VhostUserGpuUpdate) {
 741                 .scanout_id = i,
 742                 .x = extents->x1,
 743                 .y = extents->y1,
 744                 .width = width,
 745                 .height = height,
 746             };
 747             pixman_image_t *i =
 748                 pixman_image_create_bits(pixman_image_get_format(res->image),
 749                                          msg->payload.update.width,
 750                                          msg->payload.update.height,
 751                                          p + offsetof(VhostUserGpuMsg,
 752                                                       payload.update.data),
 753                                          width * bpp);
 754             pixman_image_composite(PIXMAN_OP_SRC,
 755                                    res->image, NULL, i,
 756                                    extents->x1, extents->y1,
 757                                    0, 0, 0, 0,
 758                                    width, height);
 759             pixman_image_unref(i);
 760             vg_send_msg(g, msg, -1);
 761             g_free(msg);
 762         }
 763         pixman_region_fini(&region);
 764         pixman_region_fini(&finalregion);
 765     }
 766     pixman_region_fini(&flush_region);
 767 }
 768
 769 static void
 770 vg_process_cmd(VuGpu *vg, struct virtio_gpu_ctrl_command *cmd)
 771 {
 772     switch (cmd->cmd_hdr.type) {
 773     case VIRTIO_GPU_CMD_GET_DISPLAY_INFO:
 774         vg_get_display_info(vg, cmd);
 775         break;
 776     case VIRTIO_GPU_CMD_RESOURCE_CREATE_2D:
 777         vg_resource_create_2d(vg, cmd);
 778         break;
 779     case VIRTIO_GPU_CMD_RESOURCE_UNREF:
 780         vg_resource_unref(vg, cmd);
 781         break;
 782     case VIRTIO_GPU_CMD_RESOURCE_FLUSH:
 783         vg_resource_flush(vg, cmd);
 784         break;
 785     case VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D:
 786         vg_transfer_to_host_2d(vg, cmd);
 787         break;
 788     case VIRTIO_GPU_CMD_SET_SCANOUT:
 789         vg_set_scanout(vg, cmd);
 790         break;
 791     case VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING:
 792         vg_resource_attach_backing(vg, cmd);
 793         break;
 794     case VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING:
 795         vg_resource_detach_backing(vg, cmd);
 796         break;
 797     /* case VIRTIO_GPU_CMD_GET_EDID: */
 798     /*     break */
 799     default:
 800         g_warning("TODO handle ctrl %x\n", cmd->cmd_hdr.type);
 801         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
 802         break;
 803     }
 804     if (!cmd->finished) {
 805         vg_ctrl_response_nodata(vg, cmd, cmd->error ? cmd->error :
 806                                 VIRTIO_GPU_RESP_OK_NODATA);
 807     }
 808 }
 809
 810 static void
 811 vg_handle_ctrl(VuDev *dev, int qidx)
 812 {
 813     VuGpu *vg = container_of(dev, VuGpu, dev.parent);
 814     VuVirtq *vq = vu_get_queue(dev, qidx);
 815     struct virtio_gpu_ctrl_command *cmd = NULL;
 816     size_t len;
 817
 818     for (;;) {
 819         if (vg->wait_ok != 0) {
 820             return;
 821         }
 822
 823         cmd = vu_queue_pop(dev, vq, sizeof(struct virtio_gpu_ctrl_command));
 824         if (!cmd) {
 825             break;
 826         }
 827         cmd->vq = vq;
 828         cmd->error = 0;
 829         cmd->finished = false;
 830
 831         len = iov_to_buf(cmd->elem.out_sg, cmd->elem.out_num,
 832                          0, &cmd->cmd_hdr, sizeof(cmd->cmd_hdr));
 833         if (len != sizeof(cmd->cmd_hdr)) {
 834             g_warning("%s: command size incorrect %zu vs %zu\n",
 835                       __func__, len, sizeof(cmd->cmd_hdr));
 836         }
 837
 838         virtio_gpu_ctrl_hdr_bswap(&cmd->cmd_hdr);
 839         g_debug("%d %s\n", cmd->cmd_hdr.type,
 840                 vg_cmd_to_string(cmd->cmd_hdr.type));
 841
 842         if (vg->virgl) {
 843             vg_virgl_process_cmd(vg, cmd);
 844         } else {
 845             vg_process_cmd(vg, cmd);
 846         }
 847
 848         if (!cmd->finished) {
 849             QTAILQ_INSERT_TAIL(&vg->fenceq, cmd, next);
 850             vg->inflight++;
 851         } else {
 852             g_free(cmd);
 853         }
 854     }
 855 }
 856
 857 static void
 858 update_cursor_data_simple(VuGpu *g, uint32_t resource_id, gpointer data)
 859 {
 860     struct virtio_gpu_simple_resource *res;
 861
 862     res = virtio_gpu_find_resource(g, resource_id);
 863     g_return_if_fail(res != NULL);
 864     g_return_if_fail(pixman_image_get_width(res->image) == 64);
 865     g_return_if_fail(pixman_image_get_height(res->image) == 64);
 866     g_return_if_fail(
 867         PIXMAN_FORMAT_BPP(pixman_image_get_format(res->image)) == 32);
 868
 869     memcpy(data, pixman_image_get_data(res->image), 64 * 64 * sizeof(uint32_t));
 870 }
 871
 872 static void
 873 vg_process_cursor_cmd(VuGpu *g, struct virtio_gpu_update_cursor *cursor)
 874 {
 875     bool move = cursor->hdr.type != VIRTIO_GPU_CMD_MOVE_CURSOR;
 876
 877     g_debug("%s move:%d\n", G_STRFUNC, move);
 878
 879     if (move) {
 880         VhostUserGpuMsg msg = {
 881             .request = cursor->resource_id ?
 882                 VHOST_USER_GPU_CURSOR_POS : VHOST_USER_GPU_CURSOR_POS_HIDE,
 883             .size = sizeof(VhostUserGpuCursorPos),
 884             .payload.cursor_pos = {
 885                 .scanout_id = cursor->pos.scanout_id,
 886                 .x = cursor->pos.x,
 887                 .y = cursor->pos.y,
 888             }
 889         };
 890         vg_send_msg(g, &msg, -1);
 891     } else {
 892         VhostUserGpuMsg msg = {
 893             .request = VHOST_USER_GPU_CURSOR_UPDATE,
 894             .size = sizeof(VhostUserGpuCursorUpdate),
 895             .payload.cursor_update = {
 896                 .pos = {
 897                     .scanout_id = cursor->pos.scanout_id,
 898                     .x = cursor->pos.x,
 899                     .y = cursor->pos.y,
 900                 },
 901                 .hot_x = cursor->hot_x,
 902                 .hot_y = cursor->hot_y,
 903             }
 904         };
 905         if (g->virgl) {
 906             vg_virgl_update_cursor_data(g, cursor->resource_id,
 907                                         msg.payload.cursor_update.data);
 908         } else {
 909             update_cursor_data_simple(g, cursor->resource_id,
 910                                       msg.payload.cursor_update.data);
 911         }
 912         vg_send_msg(g, &msg, -1);
 913     }
 914 }
 915
 916 static void
 917 vg_handle_cursor(VuDev *dev, int qidx)
 918 {
 919     VuGpu *g = container_of(dev, VuGpu, dev.parent);
 920     VuVirtq *vq = vu_get_queue(dev, qidx);
 921     VuVirtqElement *elem;
 922     size_t len;
 923     struct virtio_gpu_update_cursor cursor;
 924
 925     for (;;) {
 926         elem = vu_queue_pop(dev, vq, sizeof(VuVirtqElement));
 927         if (!elem) {
 928             break;
 929         }
 930         g_debug("cursor out:%d in:%d\n", elem->out_num, elem->in_num);
 931
 932         len = iov_to_buf(elem->out_sg, elem->out_num,
 933                          0, &cursor, sizeof(cursor));
 934         if (len != sizeof(cursor)) {
 935             g_warning("%s: cursor size incorrect %zu vs %zu\n",
 936                       __func__, len, sizeof(cursor));
 937         } else {
 938             virtio_gpu_bswap_32(&cursor, sizeof(cursor));
 939             vg_process_cursor_cmd(g, &cursor);
 940         }
 941         vu_queue_push(dev, vq, elem, 0);
 942         vu_queue_notify(dev, vq);
 943         g_free(elem);
 944     }
 945 }
 946
 947 static void
 948 vg_panic(VuDev *dev, const char *msg)
 949 {
 950     g_critical("%s\n", msg);
 951     exit(1);
 952 }
 953
 954 static void
 955 vg_queue_set_started(VuDev *dev, int qidx, bool started)
 956 {
 957     VuVirtq *vq = vu_get_queue(dev, qidx);
 958
 959     g_debug("queue started %d:%d\n", qidx, started);
 960
 961     switch (qidx) {
 962     case 0:
 963         vu_set_queue_handler(dev, vq, started ? vg_handle_ctrl : NULL);
 964         break;
 965     case 1:
 966         vu_set_queue_handler(dev, vq, started ? vg_handle_cursor : NULL);
 967         break;
 968     default:
 969         break;
 970     }
 971 }
 972
 973 static void
 974 set_gpu_protocol_features(VuGpu *g)
 975 {
 976     uint64_t u64;
 977     VhostUserGpuMsg msg = {
 978         .request = VHOST_USER_GPU_GET_PROTOCOL_FEATURES
 979     };
 980
 981     assert(g->wait_ok == 0);
 982     vg_send_msg(g, &msg, -1);
 983     if (!vg_recv_msg(g, msg.request, sizeof(u64), &u64)) {
 984         return;
 985     }
 986
 987     msg = (VhostUserGpuMsg) {
 988         .request = VHOST_USER_GPU_SET_PROTOCOL_FEATURES,
 989         .size = sizeof(uint64_t),
 990         .payload.u64 = 0
 991     };
 992     vg_send_msg(g, &msg, -1);
 993 }
 994
 995 static int
 996 vg_process_msg(VuDev *dev, VhostUserMsg *msg, int *do_reply)
 997 {
 998     VuGpu *g = container_of(dev, VuGpu, dev.parent);
 999
1000     switch (msg->request) {
1001     case VHOST_USER_GPU_SET_SOCKET: {
1002         g_return_val_if_fail(msg->fd_num == 1, 1);
1003         g_return_val_if_fail(g->sock_fd == -1, 1);
1004         g->sock_fd = msg->fds[0];
1005         set_gpu_protocol_features(g);
1006         return 1;
1007     }
1008     default:
1009         return 0;
1010     }
1011
1012     return 0;
1013 }
1014
1015 static uint64_t
1016 vg_get_features(VuDev *dev)
1017 {
1018     uint64_t features = 0;
1019
1020     if (opt_virgl) {
1021         features |= 1 << VIRTIO_GPU_F_VIRGL;
1022     }
1023
1024     return features;
1025 }
1026
1027 static void
1028 vg_set_features(VuDev *dev, uint64_t features)
1029 {
1030     VuGpu *g = container_of(dev, VuGpu, dev.parent);
1031     bool virgl = features & (1 << VIRTIO_GPU_F_VIRGL);
1032
1033     if (virgl && !g->virgl_inited) {
1034         if (!vg_virgl_init(g)) {
1035             vg_panic(dev, "Failed to initialize virgl");
1036         }
1037         g->virgl_inited = true;
1038     }
1039
1040     g->virgl = virgl;
1041 }
1042
1043 static int
1044 vg_get_config(VuDev *dev, uint8_t *config, uint32_t len)
1045 {
1046     VuGpu *g = container_of(dev, VuGpu, dev.parent);
1047
1048     g_return_val_if_fail(len <= sizeof(struct virtio_gpu_config), -1);
1049
1050     if (opt_virgl) {
1051         g->virtio_config.num_capsets = vg_virgl_get_num_capsets();
1052     }
1053
1054     memcpy(config, &g->virtio_config, len);
1055
1056     return 0;
1057 }
1058
1059 static int
1060 vg_set_config(VuDev *dev, const uint8_t *data,
1061               uint32_t offset, uint32_t size,
1062               uint32_t flags)
1063 {
1064     VuGpu *g = container_of(dev, VuGpu, dev.parent);
1065     struct virtio_gpu_config *config = (struct virtio_gpu_config *)data;
1066
1067     if (config->events_clear) {
1068         g->virtio_config.events_read &= ~config->events_clear;
1069     }
1070
1071     return 0;
1072 }
1073
1074 static const VuDevIface vuiface = {
1075     .set_features = vg_set_features,
1076     .get_features = vg_get_features,
1077     .queue_set_started = vg_queue_set_started,
1078     .process_msg = vg_process_msg,
1079     .get_config = vg_get_config,
1080     .set_config = vg_set_config,
1081 };
1082
1083 static void
1084 vg_destroy(VuGpu *g)
1085 {
1086     struct virtio_gpu_simple_resource *res, *tmp;
1087
1088     vug_deinit(&g->dev);
1089
1090     vg_sock_fd_close(g);
1091
1092     QTAILQ_FOREACH_SAFE(res, &g->reslist, next, tmp) {
1093         vg_resource_destroy(g, res);
1094     }
1095
1096     vugbm_device_destroy(&g->gdev);
1097 }
1098
1099 static GOptionEntry entries[] = {
1100     { "print-capabilities", 'c', 0, G_OPTION_ARG_NONE, &opt_print_caps,
1101       "Print capabilities", NULL },
1102     { "fd", 'f', 0, G_OPTION_ARG_INT, &opt_fdnum,
1103       "Use inherited fd socket", "FDNUM" },
1104     { "socket-path", 's', 0, G_OPTION_ARG_FILENAME, &opt_socket_path,
1105       "Use UNIX socket path", "PATH" },
1106     { "render-node", 'r', 0, G_OPTION_ARG_FILENAME, &opt_render_node,
1107       "Specify DRM render node", "PATH" },
1108     { "virgl", 'v', 0, G_OPTION_ARG_NONE, &opt_virgl,
1109       "Turn virgl rendering on", NULL },
1110     { NULL, }
1111 };
1112
1113 int
1114 main(int argc, char *argv[])
1115 {
1116     GOptionContext *context;
1117     GError *error = NULL;
1118     GMainLoop *loop = NULL;
1119     int fd;
1120     VuGpu g = { .sock_fd = -1, .drm_rnode_fd = -1 };
1121
1122     QTAILQ_INIT(&g.reslist);
1123     QTAILQ_INIT(&g.fenceq);
1124
1125     context = g_option_context_new("QEMU vhost-user-gpu");
1126     g_option_context_add_main_entries(context, entries, NULL);
1127     if (!g_option_context_parse(context, &argc, &argv, &error)) {
1128         g_printerr("Option parsing failed: %s\n", error->message);
1129         exit(EXIT_FAILURE);
1130     }
1131     g_option_context_free(context);
1132
1133     if (opt_print_caps) {
1134         g_print("{\n");
1135         g_print("  \"type\": \"gpu\",\n");
1136         g_print("  \"features\": [\n");
1137         g_print("    \"render-node\",\n");
1138         g_print("    \"virgl\"\n");
1139         g_print("  ]\n");
1140         g_print("}\n");
1141         exit(EXIT_SUCCESS);
1142     }
1143
1144     g.drm_rnode_fd = qemu_drm_rendernode_open(opt_render_node);
1145     if (opt_render_node && g.drm_rnode_fd == -1) {
1146         g_printerr("Failed to open DRM rendernode.\n");
1147         exit(EXIT_FAILURE);
1148     }
1149
1150     if (g.drm_rnode_fd >= 0) {
1151         if (!vugbm_device_init(&g.gdev, g.drm_rnode_fd)) {
1152             g_warning("Failed to init DRM device, using fallback path");
1153         }
1154     }
1155
1156     if ((!!opt_socket_path + (opt_fdnum != -1)) != 1) {
1157         g_printerr("Please specify either --fd or --socket-path\n");
1158         exit(EXIT_FAILURE);
1159     }
1160
1161     if (opt_socket_path) {
1162         int lsock = unix_listen(opt_socket_path, &error_fatal);
1163         fd = accept(lsock, NULL, NULL);
1164         close(lsock);
1165     } else {
1166         fd = opt_fdnum;
1167     }
1168     if (fd == -1) {
1169         g_printerr("Invalid socket");
1170         exit(EXIT_FAILURE);
1171     }
1172
1173     vug_init(&g.dev, fd, vg_panic, &vuiface);
1174
1175     loop = g_main_loop_new(NULL, FALSE);
1176     g_main_loop_run(loop);
1177     g_main_loop_unref(loop);
1178
1179     vg_destroy(&g);
1180     if (g.drm_rnode_fd >= 0) {
1181         close(g.drm_rnode_fd);
1182     }
1183
1184     return 0;
1185 }