contrib/vhost-user-gpu/vhost-user-gpu.c

   1 /*
   2  * Virtio vhost-user GPU Device
   3  *
   4  * Copyright Red Hat, Inc. 2013-2018
   5  *
   6  * Authors:
   7  *     Dave Airlie <airlied@redhat.com>
   8  *     Gerd Hoffmann <kraxel@redhat.com>
   9  *     Marc-André Lureau <marcandre.lureau@redhat.com>
  10  *
  11  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  12  * See the COPYING file in the top-level directory.
  13  */
  14 #include "qemu/osdep.h"
  15 #include "qemu/drm.h"
  16 #include "qapi/error.h"
  17 #include "qemu/sockets.h"
  18
  19 #include <pixman.h>
  20 #include <glib-unix.h>
  21
  22 #include "vugpu.h"
  23 #include "hw/virtio/virtio-gpu-bswap.h"
  24 #include "hw/virtio/virtio-gpu-pixman.h"
  25 #include "virgl.h"
  26 #include "vugbm.h"
  27
  28 enum {
  29     VHOST_USER_GPU_MAX_QUEUES = 2,
  30 };
  31
  32 struct virtio_gpu_simple_resource {
  33     uint32_t resource_id;
  34     uint32_t width;
  35     uint32_t height;
  36     uint32_t format;
  37     struct iovec *iov;
  38     unsigned int iov_cnt;
  39     uint32_t scanout_bitmask;
  40     pixman_image_t *image;
  41     struct vugbm_buffer buffer;
  42     QTAILQ_ENTRY(virtio_gpu_simple_resource) next;
  43 };
  44
  45 static gboolean opt_print_caps;
  46 static int opt_fdnum = -1;
  47 static char *opt_socket_path;
  48 static char *opt_render_node;
  49 static gboolean opt_virgl;
  50
  51 static void vg_handle_ctrl(VuDev *dev, int qidx);
  52
  53 static const char *
  54 vg_cmd_to_string(int cmd)
  55 {
  56 #define CMD(cmd) [cmd] = #cmd
  57     static const char *vg_cmd_str[] = {
  58         CMD(VIRTIO_GPU_UNDEFINED),
  59
  60         /* 2d commands */
  61         CMD(VIRTIO_GPU_CMD_GET_DISPLAY_INFO),
  62         CMD(VIRTIO_GPU_CMD_RESOURCE_CREATE_2D),
  63         CMD(VIRTIO_GPU_CMD_RESOURCE_UNREF),
  64         CMD(VIRTIO_GPU_CMD_SET_SCANOUT),
  65         CMD(VIRTIO_GPU_CMD_RESOURCE_FLUSH),
  66         CMD(VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D),
  67         CMD(VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING),
  68         CMD(VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING),
  69         CMD(VIRTIO_GPU_CMD_GET_CAPSET_INFO),
  70         CMD(VIRTIO_GPU_CMD_GET_CAPSET),
  71
  72         /* 3d commands */
  73         CMD(VIRTIO_GPU_CMD_CTX_CREATE),
  74         CMD(VIRTIO_GPU_CMD_CTX_DESTROY),
  75         CMD(VIRTIO_GPU_CMD_CTX_ATTACH_RESOURCE),
  76         CMD(VIRTIO_GPU_CMD_CTX_DETACH_RESOURCE),
  77         CMD(VIRTIO_GPU_CMD_RESOURCE_CREATE_3D),
  78         CMD(VIRTIO_GPU_CMD_TRANSFER_TO_HOST_3D),
  79         CMD(VIRTIO_GPU_CMD_TRANSFER_FROM_HOST_3D),
  80         CMD(VIRTIO_GPU_CMD_SUBMIT_3D),
  81
  82         /* cursor commands */
  83         CMD(VIRTIO_GPU_CMD_UPDATE_CURSOR),
  84         CMD(VIRTIO_GPU_CMD_MOVE_CURSOR),
  85     };
  86 #undef REQ
  87
  88     if (cmd >= 0 && cmd < G_N_ELEMENTS(vg_cmd_str)) {
  89         return vg_cmd_str[cmd];
  90     } else {
  91         return "unknown";
  92     }
  93 }
  94
  95 static int
  96 vg_sock_fd_read(int sock, void *buf, ssize_t buflen)
  97 {
  98     int ret;
  99
 100     do {
 101         ret = read(sock, buf, buflen);
 102     } while (ret < 0 && (errno == EINTR || errno == EAGAIN));
 103
 104     g_warn_if_fail(ret == buflen);
 105     return ret;
 106 }
 107
 108 static void
 109 vg_sock_fd_close(VuGpu *g)
 110 {
 111     if (g->sock_fd >= 0) {
 112         close(g->sock_fd);
 113         g->sock_fd = -1;
 114     }
 115 }
 116
 117 static gboolean
 118 source_wait_cb(gint fd, GIOCondition condition, gpointer user_data)
 119 {
 120     VuGpu *g = user_data;
 121
 122     if (!vg_recv_msg(g, VHOST_USER_GPU_DMABUF_UPDATE, 0, NULL)) {
 123         return G_SOURCE_CONTINUE;
 124     }
 125
 126     /* resume */
 127     g->wait_in = 0;
 128     vg_handle_ctrl(&g->dev.parent, 0);
 129
 130     return G_SOURCE_REMOVE;
 131 }
 132
 133 void
 134 vg_wait_ok(VuGpu *g)
 135 {
 136     assert(g->wait_in == 0);
 137     g->wait_in = g_unix_fd_add(g->sock_fd, G_IO_IN | G_IO_HUP,
 138                                source_wait_cb, g);
 139 }
 140
 141 static int
 142 vg_sock_fd_write(int sock, const void *buf, ssize_t buflen, int fd)
 143 {
 144     ssize_t ret;
 145     struct iovec iov = {
 146         .iov_base = (void *)buf,
 147         .iov_len = buflen,
 148     };
 149     struct msghdr msg = {
 150         .msg_iov = &iov,
 151         .msg_iovlen = 1,
 152     };
 153     union {
 154         struct cmsghdr cmsghdr;
 155         char control[CMSG_SPACE(sizeof(int))];
 156     } cmsgu;
 157     struct cmsghdr *cmsg;
 158
 159     if (fd != -1) {
 160         msg.msg_control = cmsgu.control;
 161         msg.msg_controllen = sizeof(cmsgu.control);
 162
 163         cmsg = CMSG_FIRSTHDR(&msg);
 164         cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 165         cmsg->cmsg_level = SOL_SOCKET;
 166         cmsg->cmsg_type = SCM_RIGHTS;
 167
 168         *((int *)CMSG_DATA(cmsg)) = fd;
 169     }
 170
 171     do {
 172         ret = sendmsg(sock, &msg, 0);
 173     } while (ret == -1 && (errno == EINTR || errno == EAGAIN));
 174
 175     g_warn_if_fail(ret == buflen);
 176     return ret;
 177 }
 178
 179 void
 180 vg_send_msg(VuGpu *vg, const VhostUserGpuMsg *msg, int fd)
 181 {
 182     if (vg_sock_fd_write(vg->sock_fd, msg,
 183                          VHOST_USER_GPU_HDR_SIZE + msg->size, fd) < 0) {
 184         vg_sock_fd_close(vg);
 185     }
 186 }
 187
 188 bool
 189 vg_recv_msg(VuGpu *g, uint32_t expect_req, uint32_t expect_size,
 190             gpointer payload)
 191 {
 192     uint32_t req, flags, size;
 193
 194     if (vg_sock_fd_read(g->sock_fd, &req, sizeof(req)) < 0 ||
 195         vg_sock_fd_read(g->sock_fd, &flags, sizeof(flags)) < 0 ||
 196         vg_sock_fd_read(g->sock_fd, &size, sizeof(size)) < 0) {
 197         goto err;
 198     }
 199
 200     g_return_val_if_fail(req == expect_req, false);
 201     g_return_val_if_fail(flags & VHOST_USER_GPU_MSG_FLAG_REPLY, false);
 202     g_return_val_if_fail(size == expect_size, false);
 203
 204     if (size && vg_sock_fd_read(g->sock_fd, payload, size) != size) {
 205         goto err;
 206     }
 207
 208     return true;
 209
 210 err:
 211     vg_sock_fd_close(g);
 212     return false;
 213 }
 214
 215 static struct virtio_gpu_simple_resource *
 216 virtio_gpu_find_resource(VuGpu *g, uint32_t resource_id)
 217 {
 218     struct virtio_gpu_simple_resource *res;
 219
 220     QTAILQ_FOREACH(res, &g->reslist, next) {
 221         if (res->resource_id == resource_id) {
 222             return res;
 223         }
 224     }
 225     return NULL;
 226 }
 227
 228 void
 229 vg_ctrl_response(VuGpu *g,
 230                  struct virtio_gpu_ctrl_command *cmd,
 231                  struct virtio_gpu_ctrl_hdr *resp,
 232                  size_t resp_len)
 233 {
 234     size_t s;
 235
 236     if (cmd->cmd_hdr.flags & VIRTIO_GPU_FLAG_FENCE) {
 237         resp->flags |= VIRTIO_GPU_FLAG_FENCE;
 238         resp->fence_id = cmd->cmd_hdr.fence_id;
 239         resp->ctx_id = cmd->cmd_hdr.ctx_id;
 240     }
 241     virtio_gpu_ctrl_hdr_bswap(resp);
 242     s = iov_from_buf(cmd->elem.in_sg, cmd->elem.in_num, 0, resp, resp_len);
 243     if (s != resp_len) {
 244         g_critical("%s: response size incorrect %zu vs %zu",
 245                    __func__, s, resp_len);
 246     }
 247     vu_queue_push(&g->dev.parent, cmd->vq, &cmd->elem, s);
 248     vu_queue_notify(&g->dev.parent, cmd->vq);
 249     cmd->state = VG_CMD_STATE_FINISHED;
 250 }
 251
 252 void
 253 vg_ctrl_response_nodata(VuGpu *g,
 254                         struct virtio_gpu_ctrl_command *cmd,
 255                         enum virtio_gpu_ctrl_type type)
 256 {
 257     struct virtio_gpu_ctrl_hdr resp = {
 258         .type = type,
 259     };
 260
 261     vg_ctrl_response(g, cmd, &resp, sizeof(resp));
 262 }
 263
 264
 265 static gboolean
 266 get_display_info_cb(gint fd, GIOCondition condition, gpointer user_data)
 267 {
 268     struct virtio_gpu_resp_display_info dpy_info = { {} };
 269     VuGpu *vg = user_data;
 270     struct virtio_gpu_ctrl_command *cmd = QTAILQ_LAST(&vg->fenceq);
 271
 272     g_debug("disp info cb");
 273     assert(cmd->cmd_hdr.type == VIRTIO_GPU_CMD_GET_DISPLAY_INFO);
 274     if (!vg_recv_msg(vg, VHOST_USER_GPU_GET_DISPLAY_INFO,
 275                      sizeof(dpy_info), &dpy_info)) {
 276         return G_SOURCE_CONTINUE;
 277     }
 278
 279     QTAILQ_REMOVE(&vg->fenceq, cmd, next);
 280     vg_ctrl_response(vg, cmd, &dpy_info.hdr, sizeof(dpy_info));
 281
 282     vg->wait_in = 0;
 283     vg_handle_ctrl(&vg->dev.parent, 0);
 284
 285     return G_SOURCE_REMOVE;
 286 }
 287
 288 void
 289 vg_get_display_info(VuGpu *vg, struct virtio_gpu_ctrl_command *cmd)
 290 {
 291     VhostUserGpuMsg msg = {
 292         .request = VHOST_USER_GPU_GET_DISPLAY_INFO,
 293         .size = 0,
 294     };
 295
 296     assert(vg->wait_in == 0);
 297
 298     vg_send_msg(vg, &msg, -1);
 299     vg->wait_in = g_unix_fd_add(vg->sock_fd, G_IO_IN | G_IO_HUP,
 300                                get_display_info_cb, vg);
 301     cmd->state = VG_CMD_STATE_PENDING;
 302 }
 303
 304 static void
 305 vg_resource_create_2d(VuGpu *g,
 306                       struct virtio_gpu_ctrl_command *cmd)
 307 {
 308     pixman_format_code_t pformat;
 309     struct virtio_gpu_simple_resource *res;
 310     struct virtio_gpu_resource_create_2d c2d;
 311
 312     VUGPU_FILL_CMD(c2d);
 313     virtio_gpu_bswap_32(&c2d, sizeof(c2d));
 314
 315     if (c2d.resource_id == 0) {
 316         g_critical("%s: resource id 0 is not allowed", __func__);
 317         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 318         return;
 319     }
 320
 321     res = virtio_gpu_find_resource(g, c2d.resource_id);
 322     if (res) {
 323         g_critical("%s: resource already exists %d", __func__, c2d.resource_id);
 324         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 325         return;
 326     }
 327
 328     res = g_new0(struct virtio_gpu_simple_resource, 1);
 329     res->width = c2d.width;
 330     res->height = c2d.height;
 331     res->format = c2d.format;
 332     res->resource_id = c2d.resource_id;
 333
 334     pformat = virtio_gpu_get_pixman_format(c2d.format);
 335     if (!pformat) {
 336         g_critical("%s: host couldn't handle guest format %d",
 337                    __func__, c2d.format);
 338         g_free(res);
 339         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 340         return;
 341     }
 342     vugbm_buffer_create(&res->buffer, &g->gdev, c2d.width, c2d.height);
 343     res->image = pixman_image_create_bits(pformat,
 344                                           c2d.width,
 345                                           c2d.height,
 346                                           (uint32_t *)res->buffer.mmap,
 347                                           res->buffer.stride);
 348     if (!res->image) {
 349         g_critical("%s: resource creation failed %d %d %d",
 350                    __func__, c2d.resource_id, c2d.width, c2d.height);
 351         g_free(res);
 352         vugbm_buffer_destroy(&res->buffer);
 353         cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
 354         return;
 355     }
 356
 357     QTAILQ_INSERT_HEAD(&g->reslist, res, next);
 358 }
 359
 360 static void
 361 vg_disable_scanout(VuGpu *g, int scanout_id)
 362 {
 363     struct virtio_gpu_scanout *scanout = &g->scanout[scanout_id];
 364     struct virtio_gpu_simple_resource *res;
 365
 366     if (scanout->resource_id == 0) {
 367         return;
 368     }
 369
 370     res = virtio_gpu_find_resource(g, scanout->resource_id);
 371     if (res) {
 372         res->scanout_bitmask &= ~(1 << scanout_id);
 373     }
 374
 375     scanout->width = 0;
 376     scanout->height = 0;
 377
 378     if (g->sock_fd >= 0) {
 379         VhostUserGpuMsg msg = {
 380             .request = VHOST_USER_GPU_SCANOUT,
 381             .size = sizeof(VhostUserGpuScanout),
 382             .payload.scanout.scanout_id = scanout_id,
 383         };
 384         vg_send_msg(g, &msg, -1);
 385     }
 386 }
 387
 388 static void
 389 vg_resource_destroy(VuGpu *g,
 390                     struct virtio_gpu_simple_resource *res)
 391 {
 392     int i;
 393
 394     if (res->scanout_bitmask) {
 395         for (i = 0; i < VIRTIO_GPU_MAX_SCANOUTS; i++) {
 396             if (res->scanout_bitmask & (1 << i)) {
 397                 vg_disable_scanout(g, i);
 398             }
 399         }
 400     }
 401
 402     vugbm_buffer_destroy(&res->buffer);
 403     pixman_image_unref(res->image);
 404     QTAILQ_REMOVE(&g->reslist, res, next);
 405     g_free(res);
 406 }
 407
 408 static void
 409 vg_resource_unref(VuGpu *g,
 410                   struct virtio_gpu_ctrl_command *cmd)
 411 {
 412     struct virtio_gpu_simple_resource *res;
 413     struct virtio_gpu_resource_unref unref;
 414
 415     VUGPU_FILL_CMD(unref);
 416     virtio_gpu_bswap_32(&unref, sizeof(unref));
 417
 418     res = virtio_gpu_find_resource(g, unref.resource_id);
 419     if (!res) {
 420         g_critical("%s: illegal resource specified %d",
 421                    __func__, unref.resource_id);
 422         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 423         return;
 424     }
 425     vg_resource_destroy(g, res);
 426 }
 427
 428 int
 429 vg_create_mapping_iov(VuGpu *g,
 430                       struct virtio_gpu_resource_attach_backing *ab,
 431                       struct virtio_gpu_ctrl_command *cmd,
 432                       struct iovec **iov)
 433 {
 434     struct virtio_gpu_mem_entry *ents;
 435     size_t esize, s;
 436     int i;
 437
 438     if (ab->nr_entries > 16384) {
 439         g_critical("%s: nr_entries is too big (%d > 16384)",
 440                    __func__, ab->nr_entries);
 441         return -1;
 442     }
 443
 444     esize = sizeof(*ents) * ab->nr_entries;
 445     ents = g_malloc(esize);
 446     s = iov_to_buf(cmd->elem.out_sg, cmd->elem.out_num,
 447                    sizeof(*ab), ents, esize);
 448     if (s != esize) {
 449         g_critical("%s: command data size incorrect %zu vs %zu",
 450                    __func__, s, esize);
 451         g_free(ents);
 452         return -1;
 453     }
 454
 455     *iov = g_malloc0(sizeof(struct iovec) * ab->nr_entries);
 456     for (i = 0; i < ab->nr_entries; i++) {
 457         uint64_t len = ents[i].length;
 458         (*iov)[i].iov_len = ents[i].length;
 459         (*iov)[i].iov_base = vu_gpa_to_va(&g->dev.parent, &len, ents[i].addr);
 460         if (!(*iov)[i].iov_base || len != ents[i].length) {
 461             g_critical("%s: resource %d element %d",
 462                        __func__, ab->resource_id, i);
 463             g_free(*iov);
 464             g_free(ents);
 465             *iov = NULL;
 466             return -1;
 467         }
 468     }
 469     g_free(ents);
 470     return 0;
 471 }
 472
 473 static void
 474 vg_resource_attach_backing(VuGpu *g,
 475                            struct virtio_gpu_ctrl_command *cmd)
 476 {
 477     struct virtio_gpu_simple_resource *res;
 478     struct virtio_gpu_resource_attach_backing ab;
 479     int ret;
 480
 481     VUGPU_FILL_CMD(ab);
 482     virtio_gpu_bswap_32(&ab, sizeof(ab));
 483
 484     res = virtio_gpu_find_resource(g, ab.resource_id);
 485     if (!res) {
 486         g_critical("%s: illegal resource specified %d",
 487                    __func__, ab.resource_id);
 488         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 489         return;
 490     }
 491
 492     if (res->iov) {
 493         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
 494         return;
 495     }
 496
 497     ret = vg_create_mapping_iov(g, &ab, cmd, &res->iov);
 498     if (ret != 0) {
 499         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
 500         return;
 501     }
 502
 503     res->iov_cnt = ab.nr_entries;
 504 }
 505
 506 static void
 507 vg_resource_detach_backing(VuGpu *g,
 508                            struct virtio_gpu_ctrl_command *cmd)
 509 {
 510     struct virtio_gpu_simple_resource *res;
 511     struct virtio_gpu_resource_detach_backing detach;
 512
 513     VUGPU_FILL_CMD(detach);
 514     virtio_gpu_bswap_32(&detach, sizeof(detach));
 515
 516     res = virtio_gpu_find_resource(g, detach.resource_id);
 517     if (!res || !res->iov) {
 518         g_critical("%s: illegal resource specified %d",
 519                    __func__, detach.resource_id);
 520         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 521         return;
 522     }
 523
 524     g_free(res->iov);
 525     res->iov = NULL;
 526     res->iov_cnt = 0;
 527 }
 528
 529 static void
 530 vg_transfer_to_host_2d(VuGpu *g,
 531                        struct virtio_gpu_ctrl_command *cmd)
 532 {
 533     struct virtio_gpu_simple_resource *res;
 534     int h;
 535     uint32_t src_offset, dst_offset, stride;
 536     int bpp;
 537     pixman_format_code_t format;
 538     struct virtio_gpu_transfer_to_host_2d t2d;
 539
 540     VUGPU_FILL_CMD(t2d);
 541     virtio_gpu_t2d_bswap(&t2d);
 542
 543     res = virtio_gpu_find_resource(g, t2d.resource_id);
 544     if (!res || !res->iov) {
 545         g_critical("%s: illegal resource specified %d",
 546                    __func__, t2d.resource_id);
 547         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 548         return;
 549     }
 550
 551     if (t2d.r.x > res->width ||
 552         t2d.r.y > res->height ||
 553         t2d.r.width > res->width ||
 554         t2d.r.height > res->height ||
 555         t2d.r.x + t2d.r.width > res->width ||
 556         t2d.r.y + t2d.r.height > res->height) {
 557         g_critical("%s: transfer bounds outside resource"
 558                    " bounds for resource %d: %d %d %d %d vs %d %d",
 559                    __func__, t2d.resource_id, t2d.r.x, t2d.r.y,
 560                    t2d.r.width, t2d.r.height, res->width, res->height);
 561         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 562         return;
 563     }
 564
 565     format = pixman_image_get_format(res->image);
 566     bpp = (PIXMAN_FORMAT_BPP(format) + 7) / 8;
 567     stride = pixman_image_get_stride(res->image);
 568
 569     if (t2d.offset || t2d.r.x || t2d.r.y ||
 570         t2d.r.width != pixman_image_get_width(res->image)) {
 571         void *img_data = pixman_image_get_data(res->image);
 572         for (h = 0; h < t2d.r.height; h++) {
 573             src_offset = t2d.offset + stride * h;
 574             dst_offset = (t2d.r.y + h) * stride + (t2d.r.x * bpp);
 575
 576             iov_to_buf(res->iov, res->iov_cnt, src_offset,
 577                        img_data
 578                        + dst_offset, t2d.r.width * bpp);
 579         }
 580     } else {
 581         iov_to_buf(res->iov, res->iov_cnt, 0,
 582                    pixman_image_get_data(res->image),
 583                    pixman_image_get_stride(res->image)
 584                    * pixman_image_get_height(res->image));
 585     }
 586 }
 587
 588 static void
 589 vg_set_scanout(VuGpu *g,
 590                struct virtio_gpu_ctrl_command *cmd)
 591 {
 592     struct virtio_gpu_simple_resource *res, *ores;
 593     struct virtio_gpu_scanout *scanout;
 594     struct virtio_gpu_set_scanout ss;
 595     int fd;
 596
 597     VUGPU_FILL_CMD(ss);
 598     virtio_gpu_bswap_32(&ss, sizeof(ss));
 599
 600     if (ss.scanout_id >= VIRTIO_GPU_MAX_SCANOUTS) {
 601         g_critical("%s: illegal scanout id specified %d",
 602                    __func__, ss.scanout_id);
 603         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID;
 604         return;
 605     }
 606
 607     if (ss.resource_id == 0) {
 608         vg_disable_scanout(g, ss.scanout_id);
 609         return;
 610     }
 611
 612     /* create a surface for this scanout */
 613     res = virtio_gpu_find_resource(g, ss.resource_id);
 614     if (!res) {
 615         g_critical("%s: illegal resource specified %d",
 616                       __func__, ss.resource_id);
 617         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 618         return;
 619     }
 620
 621     if (ss.r.x > res->width ||
 622         ss.r.y > res->height ||
 623         ss.r.width > res->width ||
 624         ss.r.height > res->height ||
 625         ss.r.x + ss.r.width > res->width ||
 626         ss.r.y + ss.r.height > res->height) {
 627         g_critical("%s: illegal scanout %d bounds for"
 628                    " resource %d, (%d,%d)+%d,%d vs %d %d",
 629                    __func__, ss.scanout_id, ss.resource_id, ss.r.x, ss.r.y,
 630                    ss.r.width, ss.r.height, res->width, res->height);
 631         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 632         return;
 633     }
 634
 635     scanout = &g->scanout[ss.scanout_id];
 636
 637     ores = virtio_gpu_find_resource(g, scanout->resource_id);
 638     if (ores) {
 639         ores->scanout_bitmask &= ~(1 << ss.scanout_id);
 640     }
 641
 642     res->scanout_bitmask |= (1 << ss.scanout_id);
 643     scanout->resource_id = ss.resource_id;
 644     scanout->x = ss.r.x;
 645     scanout->y = ss.r.y;
 646     scanout->width = ss.r.width;
 647     scanout->height = ss.r.height;
 648
 649     struct vugbm_buffer *buffer = &res->buffer;
 650
 651     if (vugbm_buffer_can_get_dmabuf_fd(buffer)) {
 652         VhostUserGpuMsg msg = {
 653             .request = VHOST_USER_GPU_DMABUF_SCANOUT,
 654             .size = sizeof(VhostUserGpuDMABUFScanout),
 655             .payload.dmabuf_scanout = (VhostUserGpuDMABUFScanout) {
 656                 .scanout_id = ss.scanout_id,
 657                 .x = ss.r.x,
 658                 .y = ss.r.y,
 659                 .width = ss.r.width,
 660                 .height = ss.r.height,
 661                 .fd_width = buffer->width,
 662                 .fd_height = buffer->height,
 663                 .fd_stride = buffer->stride,
 664                 .fd_drm_fourcc = buffer->format
 665             }
 666         };
 667
 668         if (vugbm_buffer_get_dmabuf_fd(buffer, &fd)) {
 669             vg_send_msg(g, &msg, fd);
 670             close(fd);
 671         }
 672     } else {
 673         VhostUserGpuMsg msg = {
 674             .request = VHOST_USER_GPU_SCANOUT,
 675             .size = sizeof(VhostUserGpuScanout),
 676             .payload.scanout = (VhostUserGpuScanout) {
 677                 .scanout_id = ss.scanout_id,
 678                 .width = scanout->width,
 679                 .height = scanout->height
 680             }
 681         };
 682         vg_send_msg(g, &msg, -1);
 683     }
 684 }
 685
 686 static void
 687 vg_resource_flush(VuGpu *g,
 688                   struct virtio_gpu_ctrl_command *cmd)
 689 {
 690     struct virtio_gpu_simple_resource *res;
 691     struct virtio_gpu_resource_flush rf;
 692     pixman_region16_t flush_region;
 693     int i;
 694
 695     VUGPU_FILL_CMD(rf);
 696     virtio_gpu_bswap_32(&rf, sizeof(rf));
 697
 698     res = virtio_gpu_find_resource(g, rf.resource_id);
 699     if (!res) {
 700         g_critical("%s: illegal resource specified %d\n",
 701                    __func__, rf.resource_id);
 702         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 703         return;
 704     }
 705
 706     if (rf.r.x > res->width ||
 707         rf.r.y > res->height ||
 708         rf.r.width > res->width ||
 709         rf.r.height > res->height ||
 710         rf.r.x + rf.r.width > res->width ||
 711         rf.r.y + rf.r.height > res->height) {
 712         g_critical("%s: flush bounds outside resource"
 713                    " bounds for resource %d: %d %d %d %d vs %d %d\n",
 714                    __func__, rf.resource_id, rf.r.x, rf.r.y,
 715                    rf.r.width, rf.r.height, res->width, res->height);
 716         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 717         return;
 718     }
 719
 720     pixman_region_init_rect(&flush_region,
 721                             rf.r.x, rf.r.y, rf.r.width, rf.r.height);
 722     for (i = 0; i < VIRTIO_GPU_MAX_SCANOUTS; i++) {
 723         struct virtio_gpu_scanout *scanout;
 724         pixman_region16_t region, finalregion;
 725         pixman_box16_t *extents;
 726
 727         if (!(res->scanout_bitmask & (1 << i))) {
 728             continue;
 729         }
 730         scanout = &g->scanout[i];
 731
 732         pixman_region_init(&finalregion);
 733         pixman_region_init_rect(&region, scanout->x, scanout->y,
 734                                 scanout->width, scanout->height);
 735
 736         pixman_region_intersect(&finalregion, &flush_region, &region);
 737
 738         extents = pixman_region_extents(&finalregion);
 739         size_t width = extents->x2 - extents->x1;
 740         size_t height = extents->y2 - extents->y1;
 741
 742         if (vugbm_buffer_can_get_dmabuf_fd(&res->buffer)) {
 743             VhostUserGpuMsg vmsg = {
 744                 .request = VHOST_USER_GPU_DMABUF_UPDATE,
 745                 .size = sizeof(VhostUserGpuUpdate),
 746                 .payload.update = (VhostUserGpuUpdate) {
 747                     .scanout_id = i,
 748                     .x = extents->x1,
 749                     .y = extents->y1,
 750                     .width = width,
 751                     .height = height,
 752                 }
 753             };
 754             vg_send_msg(g, &vmsg, -1);
 755             vg_wait_ok(g);
 756         } else {
 757             size_t bpp =
 758                 PIXMAN_FORMAT_BPP(pixman_image_get_format(res->image)) / 8;
 759             size_t size = width * height * bpp;
 760
 761             void *p = g_malloc(VHOST_USER_GPU_HDR_SIZE +
 762                                sizeof(VhostUserGpuUpdate) + size);
 763             VhostUserGpuMsg *msg = p;
 764             msg->request = VHOST_USER_GPU_UPDATE;
 765             msg->size = sizeof(VhostUserGpuUpdate) + size;
 766             msg->payload.update = (VhostUserGpuUpdate) {
 767                 .scanout_id = i,
 768                 .x = extents->x1,
 769                 .y = extents->y1,
 770                 .width = width,
 771                 .height = height,
 772             };
 773             pixman_image_t *i =
 774                 pixman_image_create_bits(pixman_image_get_format(res->image),
 775                                          msg->payload.update.width,
 776                                          msg->payload.update.height,
 777                                          p + offsetof(VhostUserGpuMsg,
 778                                                       payload.update.data),
 779                                          width * bpp);
 780             pixman_image_composite(PIXMAN_OP_SRC,
 781                                    res->image, NULL, i,
 782                                    extents->x1, extents->y1,
 783                                    0, 0, 0, 0,
 784                                    width, height);
 785             pixman_image_unref(i);
 786             vg_send_msg(g, msg, -1);
 787             g_free(msg);
 788         }
 789         pixman_region_fini(&region);
 790         pixman_region_fini(&finalregion);
 791     }
 792     pixman_region_fini(&flush_region);
 793 }
 794
 795 static void
 796 vg_process_cmd(VuGpu *vg, struct virtio_gpu_ctrl_command *cmd)
 797 {
 798     switch (cmd->cmd_hdr.type) {
 799     case VIRTIO_GPU_CMD_GET_DISPLAY_INFO:
 800         vg_get_display_info(vg, cmd);
 801         break;
 802     case VIRTIO_GPU_CMD_RESOURCE_CREATE_2D:
 803         vg_resource_create_2d(vg, cmd);
 804         break;
 805     case VIRTIO_GPU_CMD_RESOURCE_UNREF:
 806         vg_resource_unref(vg, cmd);
 807         break;
 808     case VIRTIO_GPU_CMD_RESOURCE_FLUSH:
 809         vg_resource_flush(vg, cmd);
 810         break;
 811     case VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D:
 812         vg_transfer_to_host_2d(vg, cmd);
 813         break;
 814     case VIRTIO_GPU_CMD_SET_SCANOUT:
 815         vg_set_scanout(vg, cmd);
 816         break;
 817     case VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING:
 818         vg_resource_attach_backing(vg, cmd);
 819         break;
 820     case VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING:
 821         vg_resource_detach_backing(vg, cmd);
 822         break;
 823     /* case VIRTIO_GPU_CMD_GET_EDID: */
 824     /*     break */
 825     default:
 826         g_warning("TODO handle ctrl %x\n", cmd->cmd_hdr.type);
 827         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
 828         break;
 829     }
 830     if (cmd->state == VG_CMD_STATE_NEW) {
 831         vg_ctrl_response_nodata(vg, cmd, cmd->error ? cmd->error :
 832                                 VIRTIO_GPU_RESP_OK_NODATA);
 833     }
 834 }
 835
 836 static void
 837 vg_handle_ctrl(VuDev *dev, int qidx)
 838 {
 839     VuGpu *vg = container_of(dev, VuGpu, dev.parent);
 840     VuVirtq *vq = vu_get_queue(dev, qidx);
 841     struct virtio_gpu_ctrl_command *cmd = NULL;
 842     size_t len;
 843
 844     for (;;) {
 845         if (vg->wait_in != 0) {
 846             return;
 847         }
 848
 849         cmd = vu_queue_pop(dev, vq, sizeof(struct virtio_gpu_ctrl_command));
 850         if (!cmd) {
 851             break;
 852         }
 853         cmd->vq = vq;
 854         cmd->error = 0;
 855         cmd->state = VG_CMD_STATE_NEW;
 856
 857         len = iov_to_buf(cmd->elem.out_sg, cmd->elem.out_num,
 858                          0, &cmd->cmd_hdr, sizeof(cmd->cmd_hdr));
 859         if (len != sizeof(cmd->cmd_hdr)) {
 860             g_warning("%s: command size incorrect %zu vs %zu\n",
 861                       __func__, len, sizeof(cmd->cmd_hdr));
 862         }
 863
 864         virtio_gpu_ctrl_hdr_bswap(&cmd->cmd_hdr);
 865         g_debug("%d %s\n", cmd->cmd_hdr.type,
 866                 vg_cmd_to_string(cmd->cmd_hdr.type));
 867
 868         if (vg->virgl) {
 869             vg_virgl_process_cmd(vg, cmd);
 870         } else {
 871             vg_process_cmd(vg, cmd);
 872         }
 873
 874         if (cmd->state != VG_CMD_STATE_FINISHED) {
 875             QTAILQ_INSERT_TAIL(&vg->fenceq, cmd, next);
 876             vg->inflight++;
 877         } else {
 878             free(cmd);
 879         }
 880     }
 881 }
 882
 883 static void
 884 update_cursor_data_simple(VuGpu *g, uint32_t resource_id, gpointer data)
 885 {
 886     struct virtio_gpu_simple_resource *res;
 887
 888     res = virtio_gpu_find_resource(g, resource_id);
 889     g_return_if_fail(res != NULL);
 890     g_return_if_fail(pixman_image_get_width(res->image) == 64);
 891     g_return_if_fail(pixman_image_get_height(res->image) == 64);
 892     g_return_if_fail(
 893         PIXMAN_FORMAT_BPP(pixman_image_get_format(res->image)) == 32);
 894
 895     memcpy(data, pixman_image_get_data(res->image), 64 * 64 * sizeof(uint32_t));
 896 }
 897
 898 static void
 899 vg_process_cursor_cmd(VuGpu *g, struct virtio_gpu_update_cursor *cursor)
 900 {
 901     switch (cursor->hdr.type) {
 902     case VIRTIO_GPU_CMD_MOVE_CURSOR: {
 903         VhostUserGpuMsg msg = {
 904             .request = cursor->resource_id ?
 905                 VHOST_USER_GPU_CURSOR_POS : VHOST_USER_GPU_CURSOR_POS_HIDE,
 906             .size = sizeof(VhostUserGpuCursorPos),
 907             .payload.cursor_pos = {
 908                 .scanout_id = cursor->pos.scanout_id,
 909                 .x = cursor->pos.x,
 910                 .y = cursor->pos.y,
 911             }
 912         };
 913         g_debug("%s: move", G_STRFUNC);
 914         vg_send_msg(g, &msg, -1);
 915         break;
 916     }
 917     case VIRTIO_GPU_CMD_UPDATE_CURSOR: {
 918         VhostUserGpuMsg msg = {
 919             .request = VHOST_USER_GPU_CURSOR_UPDATE,
 920             .size = sizeof(VhostUserGpuCursorUpdate),
 921             .payload.cursor_update = {
 922                 .pos = {
 923                     .scanout_id = cursor->pos.scanout_id,
 924                     .x = cursor->pos.x,
 925                     .y = cursor->pos.y,
 926                 },
 927                 .hot_x = cursor->hot_x,
 928                 .hot_y = cursor->hot_y,
 929             }
 930         };
 931         g_debug("%s: update", G_STRFUNC);
 932         if (g->virgl) {
 933             vg_virgl_update_cursor_data(g, cursor->resource_id,
 934                                         msg.payload.cursor_update.data);
 935         } else {
 936             update_cursor_data_simple(g, cursor->resource_id,
 937                                       msg.payload.cursor_update.data);
 938         }
 939         vg_send_msg(g, &msg, -1);
 940         break;
 941     }
 942     default:
 943         g_debug("%s: unknown cmd %d", G_STRFUNC, cursor->hdr.type);
 944         break;
 945     }
 946 }
 947
 948 static void
 949 vg_handle_cursor(VuDev *dev, int qidx)
 950 {
 951     VuGpu *g = container_of(dev, VuGpu, dev.parent);
 952     VuVirtq *vq = vu_get_queue(dev, qidx);
 953     VuVirtqElement *elem;
 954     size_t len;
 955     struct virtio_gpu_update_cursor cursor;
 956
 957     for (;;) {
 958         elem = vu_queue_pop(dev, vq, sizeof(VuVirtqElement));
 959         if (!elem) {
 960             break;
 961         }
 962         g_debug("cursor out:%d in:%d\n", elem->out_num, elem->in_num);
 963
 964         len = iov_to_buf(elem->out_sg, elem->out_num,
 965                          0, &cursor, sizeof(cursor));
 966         if (len != sizeof(cursor)) {
 967             g_warning("%s: cursor size incorrect %zu vs %zu\n",
 968                       __func__, len, sizeof(cursor));
 969         } else {
 970             virtio_gpu_bswap_32(&cursor, sizeof(cursor));
 971             vg_process_cursor_cmd(g, &cursor);
 972         }
 973         vu_queue_push(dev, vq, elem, 0);
 974         vu_queue_notify(dev, vq);
 975         free(elem);
 976     }
 977 }
 978
 979 static void
 980 vg_panic(VuDev *dev, const char *msg)
 981 {
 982     g_critical("%s\n", msg);
 983     exit(1);
 984 }
 985
 986 static void
 987 vg_queue_set_started(VuDev *dev, int qidx, bool started)
 988 {
 989     VuVirtq *vq = vu_get_queue(dev, qidx);
 990
 991     g_debug("queue started %d:%d\n", qidx, started);
 992
 993     switch (qidx) {
 994     case 0:
 995         vu_set_queue_handler(dev, vq, started ? vg_handle_ctrl : NULL);
 996         break;
 997     case 1:
 998         vu_set_queue_handler(dev, vq, started ? vg_handle_cursor : NULL);
 999         break;
1000     default:
1001         break;
1002     }
1003 }
1004
1005 static gboolean
1006 protocol_features_cb(gint fd, GIOCondition condition, gpointer user_data)
1007 {
1008     VuGpu *g = user_data;
1009     uint64_t u64;
1010     VhostUserGpuMsg msg = {
1011         .request = VHOST_USER_GPU_GET_PROTOCOL_FEATURES
1012     };
1013
1014     if (!vg_recv_msg(g, msg.request, sizeof(u64), &u64)) {
1015         return G_SOURCE_CONTINUE;
1016     }
1017
1018     msg = (VhostUserGpuMsg) {
1019         .request = VHOST_USER_GPU_SET_PROTOCOL_FEATURES,
1020         .size = sizeof(uint64_t),
1021         .payload.u64 = 0
1022     };
1023     vg_send_msg(g, &msg, -1);
1024
1025     g->wait_in = 0;
1026     vg_handle_ctrl(&g->dev.parent, 0);
1027
1028     return G_SOURCE_REMOVE;
1029 }
1030
1031 static void
1032 set_gpu_protocol_features(VuGpu *g)
1033 {
1034     VhostUserGpuMsg msg = {
1035         .request = VHOST_USER_GPU_GET_PROTOCOL_FEATURES
1036     };
1037
1038     vg_send_msg(g, &msg, -1);
1039     assert(g->wait_in == 0);
1040     g->wait_in = g_unix_fd_add(g->sock_fd, G_IO_IN | G_IO_HUP,
1041                                protocol_features_cb, g);
1042 }
1043
1044 static int
1045 vg_process_msg(VuDev *dev, VhostUserMsg *msg, int *do_reply)
1046 {
1047     VuGpu *g = container_of(dev, VuGpu, dev.parent);
1048
1049     switch (msg->request) {
1050     case VHOST_USER_GPU_SET_SOCKET: {
1051         g_return_val_if_fail(msg->fd_num == 1, 1);
1052         g_return_val_if_fail(g->sock_fd == -1, 1);
1053         g->sock_fd = msg->fds[0];
1054         set_gpu_protocol_features(g);
1055         return 1;
1056     }
1057     default:
1058         return 0;
1059     }
1060
1061     return 0;
1062 }
1063
1064 static uint64_t
1065 vg_get_features(VuDev *dev)
1066 {
1067     uint64_t features = 0;
1068
1069     if (opt_virgl) {
1070         features |= 1 << VIRTIO_GPU_F_VIRGL;
1071     }
1072
1073     return features;
1074 }
1075
1076 static void
1077 vg_set_features(VuDev *dev, uint64_t features)
1078 {
1079     VuGpu *g = container_of(dev, VuGpu, dev.parent);
1080     bool virgl = features & (1 << VIRTIO_GPU_F_VIRGL);
1081
1082     if (virgl && !g->virgl_inited) {
1083         if (!vg_virgl_init(g)) {
1084             vg_panic(dev, "Failed to initialize virgl");
1085         }
1086         g->virgl_inited = true;
1087     }
1088
1089     g->virgl = virgl;
1090 }
1091
1092 static int
1093 vg_get_config(VuDev *dev, uint8_t *config, uint32_t len)
1094 {
1095     VuGpu *g = container_of(dev, VuGpu, dev.parent);
1096
1097     if (len > sizeof(struct virtio_gpu_config)) {
1098         return -1;
1099     }
1100
1101     if (opt_virgl) {
1102         g->virtio_config.num_capsets = vg_virgl_get_num_capsets();
1103     }
1104
1105     memcpy(config, &g->virtio_config, len);
1106
1107     return 0;
1108 }
1109
1110 static int
1111 vg_set_config(VuDev *dev, const uint8_t *data,
1112               uint32_t offset, uint32_t size,
1113               uint32_t flags)
1114 {
1115     VuGpu *g = container_of(dev, VuGpu, dev.parent);
1116     struct virtio_gpu_config *config = (struct virtio_gpu_config *)data;
1117
1118     if (config->events_clear) {
1119         g->virtio_config.events_read &= ~config->events_clear;
1120     }
1121
1122     return 0;
1123 }
1124
1125 static const VuDevIface vuiface = {
1126     .set_features = vg_set_features,
1127     .get_features = vg_get_features,
1128     .queue_set_started = vg_queue_set_started,
1129     .process_msg = vg_process_msg,
1130     .get_config = vg_get_config,
1131     .set_config = vg_set_config,
1132 };
1133
1134 static void
1135 vg_destroy(VuGpu *g)
1136 {
1137     struct virtio_gpu_simple_resource *res, *tmp;
1138
1139     vug_deinit(&g->dev);
1140
1141     vg_sock_fd_close(g);
1142
1143     QTAILQ_FOREACH_SAFE(res, &g->reslist, next, tmp) {
1144         vg_resource_destroy(g, res);
1145     }
1146
1147     vugbm_device_destroy(&g->gdev);
1148 }
1149
1150 static GOptionEntry entries[] = {
1151     { "print-capabilities", 'c', 0, G_OPTION_ARG_NONE, &opt_print_caps,
1152       "Print capabilities", NULL },
1153     { "fd", 'f', 0, G_OPTION_ARG_INT, &opt_fdnum,
1154       "Use inherited fd socket", "FDNUM" },
1155     { "socket-path", 's', 0, G_OPTION_ARG_FILENAME, &opt_socket_path,
1156       "Use UNIX socket path", "PATH" },
1157     { "render-node", 'r', 0, G_OPTION_ARG_FILENAME, &opt_render_node,
1158       "Specify DRM render node", "PATH" },
1159     { "virgl", 'v', 0, G_OPTION_ARG_NONE, &opt_virgl,
1160       "Turn virgl rendering on", NULL },
1161     { NULL, }
1162 };
1163
1164 int
1165 main(int argc, char *argv[])
1166 {
1167     GOptionContext *context;
1168     GError *error = NULL;
1169     GMainLoop *loop = NULL;
1170     int fd;
1171     VuGpu g = { .sock_fd = -1, .drm_rnode_fd = -1 };
1172
1173     QTAILQ_INIT(&g.reslist);
1174     QTAILQ_INIT(&g.fenceq);
1175
1176     context = g_option_context_new("QEMU vhost-user-gpu");
1177     g_option_context_add_main_entries(context, entries, NULL);
1178     if (!g_option_context_parse(context, &argc, &argv, &error)) {
1179         g_printerr("Option parsing failed: %s\n", error->message);
1180         exit(EXIT_FAILURE);
1181     }
1182     g_option_context_free(context);
1183
1184     if (opt_print_caps) {
1185         g_print("{\n");
1186         g_print("  \"type\": \"gpu\",\n");
1187         g_print("  \"features\": [\n");
1188         g_print("    \"render-node\",\n");
1189         g_print("    \"virgl\"\n");
1190         g_print("  ]\n");
1191         g_print("}\n");
1192         exit(EXIT_SUCCESS);
1193     }
1194
1195     g.drm_rnode_fd = qemu_drm_rendernode_open(opt_render_node);
1196     if (opt_render_node && g.drm_rnode_fd == -1) {
1197         g_printerr("Failed to open DRM rendernode.\n");
1198         exit(EXIT_FAILURE);
1199     }
1200
1201     vugbm_device_init(&g.gdev, g.drm_rnode_fd);
1202
1203     if ((!!opt_socket_path + (opt_fdnum != -1)) != 1) {
1204         g_printerr("Please specify either --fd or --socket-path\n");
1205         exit(EXIT_FAILURE);
1206     }
1207
1208     if (opt_socket_path) {
1209         int lsock = unix_listen(opt_socket_path, &error_fatal);
1210         if (lsock < 0) {
1211             g_printerr("Failed to listen on %s.\n", opt_socket_path);
1212             exit(EXIT_FAILURE);
1213         }
1214         fd = accept(lsock, NULL, NULL);
1215         close(lsock);
1216     } else {
1217         fd = opt_fdnum;
1218     }
1219     if (fd == -1) {
1220         g_printerr("Invalid vhost-user socket.\n");
1221         exit(EXIT_FAILURE);
1222     }
1223
1224     if (!vug_init(&g.dev, VHOST_USER_GPU_MAX_QUEUES, fd, vg_panic, &vuiface)) {
1225         g_printerr("Failed to initialize libvhost-user-glib.\n");
1226         exit(EXIT_FAILURE);
1227     }
1228
1229     loop = g_main_loop_new(NULL, FALSE);
1230     g_main_loop_run(loop);
1231     g_main_loop_unref(loop);
1232
1233     vg_destroy(&g);
1234     if (g.drm_rnode_fd >= 0) {
1235         close(g.drm_rnode_fd);
1236     }
1237
1238     return 0;
1239 }