1 /* 2 * Virtio GPU Device 3 * 4 * Copyright Red Hat, Inc. 2013-2014 5 * 6 * Authors: 7 * Dave Airlie <airlied@redhat.com> 8 * Gerd Hoffmann <kraxel@redhat.com> 9 * 10 * This work is licensed under the terms of the GNU GPL, version 2 or later. 11 * See the COPYING file in the top-level directory. 12 */ 13 14 #include "qemu/osdep.h" 15 #include "qemu/units.h" 16 #include "qemu/iov.h" 17 #include "sysemu/cpus.h" 18 #include "ui/console.h" 19 #include "ui/rect.h" 20 #include "trace.h" 21 #include "sysemu/dma.h" 22 #include "sysemu/sysemu.h" 23 #include "hw/virtio/virtio.h" 24 #include "migration/qemu-file-types.h" 25 #include "hw/virtio/virtio-gpu.h" 26 #include "hw/virtio/virtio-gpu-bswap.h" 27 #include "hw/virtio/virtio-gpu-pixman.h" 28 #include "hw/virtio/virtio-bus.h" 29 #include "hw/qdev-properties.h" 30 #include "qemu/log.h" 31 #include "qemu/module.h" 32 #include "qapi/error.h" 33 #include "qemu/error-report.h" 34 35 #define VIRTIO_GPU_VM_VERSION 1 36 37 static struct virtio_gpu_simple_resource * 38 virtio_gpu_find_check_resource(VirtIOGPU *g, uint32_t resource_id, 39 bool require_backing, 40 const char *caller, uint32_t *error); 41 42 static void virtio_gpu_reset_bh(void *opaque); 43 44 void virtio_gpu_update_cursor_data(VirtIOGPU *g, 45 struct virtio_gpu_scanout *s, 46 uint32_t resource_id) 47 { 48 struct virtio_gpu_simple_resource *res; 49 uint32_t pixels; 50 void *data; 51 52 res = virtio_gpu_find_check_resource(g, resource_id, false, 53 __func__, NULL); 54 if (!res) { 55 return; 56 } 57 58 if (res->blob_size) { 59 if (res->blob_size < (s->current_cursor->width * 60 s->current_cursor->height * 4)) { 61 return; 62 } 63 data = res->blob; 64 } else { 65 if (pixman_image_get_width(res->image) != s->current_cursor->width || 66 pixman_image_get_height(res->image) != s->current_cursor->height) { 67 return; 68 } 69 data = pixman_image_get_data(res->image); 70 } 71 72 pixels = s->current_cursor->width * s->current_cursor->height; 73 memcpy(s->current_cursor->data, data, 74 pixels * sizeof(uint32_t)); 75 } 76 77 static void update_cursor(VirtIOGPU *g, struct virtio_gpu_update_cursor *cursor) 78 { 79 struct virtio_gpu_scanout *s; 80 VirtIOGPUClass *vgc = VIRTIO_GPU_GET_CLASS(g); 81 bool move = cursor->hdr.type == VIRTIO_GPU_CMD_MOVE_CURSOR; 82 83 if (cursor->pos.scanout_id >= g->parent_obj.conf.max_outputs) { 84 return; 85 } 86 s = &g->parent_obj.scanout[cursor->pos.scanout_id]; 87 88 trace_virtio_gpu_update_cursor(cursor->pos.scanout_id, 89 cursor->pos.x, 90 cursor->pos.y, 91 move ? "move" : "update", 92 cursor->resource_id); 93 94 if (!move) { 95 if (!s->current_cursor) { 96 s->current_cursor = cursor_alloc(64, 64); 97 } 98 99 s->current_cursor->hot_x = cursor->hot_x; 100 s->current_cursor->hot_y = cursor->hot_y; 101 102 if (cursor->resource_id > 0) { 103 vgc->update_cursor_data(g, s, cursor->resource_id); 104 } 105 dpy_cursor_define(s->con, s->current_cursor); 106 107 s->cursor = *cursor; 108 } else { 109 s->cursor.pos.x = cursor->pos.x; 110 s->cursor.pos.y = cursor->pos.y; 111 } 112 dpy_mouse_set(s->con, cursor->pos.x, cursor->pos.y, 113 cursor->resource_id ? 1 : 0); 114 } 115 116 struct virtio_gpu_simple_resource * 117 virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id) 118 { 119 struct virtio_gpu_simple_resource *res; 120 121 QTAILQ_FOREACH(res, &g->reslist, next) { 122 if (res->resource_id == resource_id) { 123 return res; 124 } 125 } 126 return NULL; 127 } 128 129 static struct virtio_gpu_simple_resource * 130 virtio_gpu_find_check_resource(VirtIOGPU *g, uint32_t resource_id, 131 bool require_backing, 132 const char *caller, uint32_t *error) 133 { 134 struct virtio_gpu_simple_resource *res; 135 136 res = virtio_gpu_find_resource(g, resource_id); 137 if (!res) { 138 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid resource specified %d\n", 139 caller, resource_id); 140 if (error) { 141 *error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; 142 } 143 return NULL; 144 } 145 146 if (require_backing) { 147 if (!res->iov || (!res->image && !res->blob)) { 148 qemu_log_mask(LOG_GUEST_ERROR, "%s: no backing storage %d\n", 149 caller, resource_id); 150 if (error) { 151 *error = VIRTIO_GPU_RESP_ERR_UNSPEC; 152 } 153 return NULL; 154 } 155 } 156 157 return res; 158 } 159 160 void virtio_gpu_ctrl_response(VirtIOGPU *g, 161 struct virtio_gpu_ctrl_command *cmd, 162 struct virtio_gpu_ctrl_hdr *resp, 163 size_t resp_len) 164 { 165 size_t s; 166 167 if (cmd->cmd_hdr.flags & VIRTIO_GPU_FLAG_FENCE) { 168 resp->flags |= VIRTIO_GPU_FLAG_FENCE; 169 resp->fence_id = cmd->cmd_hdr.fence_id; 170 resp->ctx_id = cmd->cmd_hdr.ctx_id; 171 } 172 virtio_gpu_ctrl_hdr_bswap(resp); 173 s = iov_from_buf(cmd->elem.in_sg, cmd->elem.in_num, 0, resp, resp_len); 174 if (s != resp_len) { 175 qemu_log_mask(LOG_GUEST_ERROR, 176 "%s: response size incorrect %zu vs %zu\n", 177 __func__, s, resp_len); 178 } 179 virtqueue_push(cmd->vq, &cmd->elem, s); 180 virtio_notify(VIRTIO_DEVICE(g), cmd->vq); 181 cmd->finished = true; 182 } 183 184 void virtio_gpu_ctrl_response_nodata(VirtIOGPU *g, 185 struct virtio_gpu_ctrl_command *cmd, 186 enum virtio_gpu_ctrl_type type) 187 { 188 struct virtio_gpu_ctrl_hdr resp; 189 190 memset(&resp, 0, sizeof(resp)); 191 resp.type = type; 192 virtio_gpu_ctrl_response(g, cmd, &resp, sizeof(resp)); 193 } 194 195 void virtio_gpu_get_display_info(VirtIOGPU *g, 196 struct virtio_gpu_ctrl_command *cmd) 197 { 198 struct virtio_gpu_resp_display_info display_info; 199 200 trace_virtio_gpu_cmd_get_display_info(); 201 memset(&display_info, 0, sizeof(display_info)); 202 display_info.hdr.type = VIRTIO_GPU_RESP_OK_DISPLAY_INFO; 203 virtio_gpu_base_fill_display_info(VIRTIO_GPU_BASE(g), &display_info); 204 virtio_gpu_ctrl_response(g, cmd, &display_info.hdr, 205 sizeof(display_info)); 206 } 207 208 void virtio_gpu_get_edid(VirtIOGPU *g, 209 struct virtio_gpu_ctrl_command *cmd) 210 { 211 struct virtio_gpu_resp_edid edid; 212 struct virtio_gpu_cmd_get_edid get_edid; 213 VirtIOGPUBase *b = VIRTIO_GPU_BASE(g); 214 215 VIRTIO_GPU_FILL_CMD(get_edid); 216 virtio_gpu_bswap_32(&get_edid, sizeof(get_edid)); 217 218 if (get_edid.scanout >= b->conf.max_outputs) { 219 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 220 return; 221 } 222 223 trace_virtio_gpu_cmd_get_edid(get_edid.scanout); 224 memset(&edid, 0, sizeof(edid)); 225 edid.hdr.type = VIRTIO_GPU_RESP_OK_EDID; 226 virtio_gpu_base_generate_edid(VIRTIO_GPU_BASE(g), get_edid.scanout, &edid); 227 virtio_gpu_ctrl_response(g, cmd, &edid.hdr, sizeof(edid)); 228 } 229 230 static uint32_t calc_image_hostmem(pixman_format_code_t pformat, 231 uint32_t width, uint32_t height) 232 { 233 /* Copied from pixman/pixman-bits-image.c, skip integer overflow check. 234 * pixman_image_create_bits will fail in case it overflow. 235 */ 236 237 int bpp = PIXMAN_FORMAT_BPP(pformat); 238 int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t); 239 return height * stride; 240 } 241 242 #ifdef WIN32 243 static void 244 win32_pixman_image_destroy(pixman_image_t *image, void *data) 245 { 246 HANDLE handle = data; 247 248 qemu_win32_map_free(pixman_image_get_data(image), handle, &error_warn); 249 } 250 #endif 251 252 static void virtio_gpu_resource_create_2d(VirtIOGPU *g, 253 struct virtio_gpu_ctrl_command *cmd) 254 { 255 pixman_format_code_t pformat; 256 struct virtio_gpu_simple_resource *res; 257 struct virtio_gpu_resource_create_2d c2d; 258 259 VIRTIO_GPU_FILL_CMD(c2d); 260 virtio_gpu_bswap_32(&c2d, sizeof(c2d)); 261 trace_virtio_gpu_cmd_res_create_2d(c2d.resource_id, c2d.format, 262 c2d.width, c2d.height); 263 264 if (c2d.resource_id == 0) { 265 qemu_log_mask(LOG_GUEST_ERROR, "%s: resource id 0 is not allowed\n", 266 __func__); 267 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; 268 return; 269 } 270 271 res = virtio_gpu_find_resource(g, c2d.resource_id); 272 if (res) { 273 qemu_log_mask(LOG_GUEST_ERROR, "%s: resource already exists %d\n", 274 __func__, c2d.resource_id); 275 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; 276 return; 277 } 278 279 res = g_new0(struct virtio_gpu_simple_resource, 1); 280 281 res->width = c2d.width; 282 res->height = c2d.height; 283 res->format = c2d.format; 284 res->resource_id = c2d.resource_id; 285 286 pformat = virtio_gpu_get_pixman_format(c2d.format); 287 if (!pformat) { 288 qemu_log_mask(LOG_GUEST_ERROR, 289 "%s: host couldn't handle guest format %d\n", 290 __func__, c2d.format); 291 g_free(res); 292 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 293 return; 294 } 295 296 res->hostmem = calc_image_hostmem(pformat, c2d.width, c2d.height); 297 if (res->hostmem + g->hostmem < g->conf_max_hostmem) { 298 void *bits = NULL; 299 #ifdef WIN32 300 bits = qemu_win32_map_alloc(res->hostmem, &res->handle, &error_warn); 301 if (!bits) { 302 goto end; 303 } 304 #endif 305 res->image = pixman_image_create_bits( 306 pformat, 307 c2d.width, 308 c2d.height, 309 bits, c2d.height ? res->hostmem / c2d.height : 0); 310 #ifdef WIN32 311 if (res->image) { 312 pixman_image_set_destroy_function(res->image, win32_pixman_image_destroy, res->handle); 313 } 314 #endif 315 } 316 317 #ifdef WIN32 318 end: 319 #endif 320 if (!res->image) { 321 qemu_log_mask(LOG_GUEST_ERROR, 322 "%s: resource creation failed %d %d %d\n", 323 __func__, c2d.resource_id, c2d.width, c2d.height); 324 g_free(res); 325 cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY; 326 return; 327 } 328 329 QTAILQ_INSERT_HEAD(&g->reslist, res, next); 330 g->hostmem += res->hostmem; 331 } 332 333 static void virtio_gpu_resource_create_blob(VirtIOGPU *g, 334 struct virtio_gpu_ctrl_command *cmd) 335 { 336 struct virtio_gpu_simple_resource *res; 337 struct virtio_gpu_resource_create_blob cblob; 338 int ret; 339 340 VIRTIO_GPU_FILL_CMD(cblob); 341 virtio_gpu_create_blob_bswap(&cblob); 342 trace_virtio_gpu_cmd_res_create_blob(cblob.resource_id, cblob.size); 343 344 if (cblob.resource_id == 0) { 345 qemu_log_mask(LOG_GUEST_ERROR, "%s: resource id 0 is not allowed\n", 346 __func__); 347 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; 348 return; 349 } 350 351 if (cblob.blob_mem != VIRTIO_GPU_BLOB_MEM_GUEST && 352 cblob.blob_flags != VIRTIO_GPU_BLOB_FLAG_USE_SHAREABLE) { 353 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid memory type\n", 354 __func__); 355 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 356 return; 357 } 358 359 if (virtio_gpu_find_resource(g, cblob.resource_id)) { 360 qemu_log_mask(LOG_GUEST_ERROR, "%s: resource already exists %d\n", 361 __func__, cblob.resource_id); 362 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; 363 return; 364 } 365 366 res = g_new0(struct virtio_gpu_simple_resource, 1); 367 res->resource_id = cblob.resource_id; 368 res->blob_size = cblob.size; 369 370 ret = virtio_gpu_create_mapping_iov(g, cblob.nr_entries, sizeof(cblob), 371 cmd, &res->addrs, &res->iov, 372 &res->iov_cnt); 373 if (ret != 0) { 374 cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC; 375 g_free(res); 376 return; 377 } 378 379 virtio_gpu_init_udmabuf(res); 380 QTAILQ_INSERT_HEAD(&g->reslist, res, next); 381 } 382 383 static void virtio_gpu_disable_scanout(VirtIOGPU *g, int scanout_id) 384 { 385 struct virtio_gpu_scanout *scanout = &g->parent_obj.scanout[scanout_id]; 386 struct virtio_gpu_simple_resource *res; 387 388 if (scanout->resource_id == 0) { 389 return; 390 } 391 392 res = virtio_gpu_find_resource(g, scanout->resource_id); 393 if (res) { 394 res->scanout_bitmask &= ~(1 << scanout_id); 395 } 396 397 dpy_gfx_replace_surface(scanout->con, NULL); 398 scanout->resource_id = 0; 399 scanout->ds = NULL; 400 scanout->width = 0; 401 scanout->height = 0; 402 } 403 404 static void virtio_gpu_resource_destroy(VirtIOGPU *g, 405 struct virtio_gpu_simple_resource *res) 406 { 407 int i; 408 409 if (res->scanout_bitmask) { 410 for (i = 0; i < g->parent_obj.conf.max_outputs; i++) { 411 if (res->scanout_bitmask & (1 << i)) { 412 virtio_gpu_disable_scanout(g, i); 413 } 414 } 415 } 416 417 qemu_pixman_image_unref(res->image); 418 virtio_gpu_cleanup_mapping(g, res); 419 QTAILQ_REMOVE(&g->reslist, res, next); 420 g->hostmem -= res->hostmem; 421 g_free(res); 422 } 423 424 static void virtio_gpu_resource_unref(VirtIOGPU *g, 425 struct virtio_gpu_ctrl_command *cmd) 426 { 427 struct virtio_gpu_simple_resource *res; 428 struct virtio_gpu_resource_unref unref; 429 430 VIRTIO_GPU_FILL_CMD(unref); 431 virtio_gpu_bswap_32(&unref, sizeof(unref)); 432 trace_virtio_gpu_cmd_res_unref(unref.resource_id); 433 434 res = virtio_gpu_find_resource(g, unref.resource_id); 435 if (!res) { 436 qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n", 437 __func__, unref.resource_id); 438 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; 439 return; 440 } 441 virtio_gpu_resource_destroy(g, res); 442 } 443 444 static void virtio_gpu_transfer_to_host_2d(VirtIOGPU *g, 445 struct virtio_gpu_ctrl_command *cmd) 446 { 447 struct virtio_gpu_simple_resource *res; 448 int h, bpp; 449 uint32_t src_offset, dst_offset, stride; 450 pixman_format_code_t format; 451 struct virtio_gpu_transfer_to_host_2d t2d; 452 void *img_data; 453 454 VIRTIO_GPU_FILL_CMD(t2d); 455 virtio_gpu_t2d_bswap(&t2d); 456 trace_virtio_gpu_cmd_res_xfer_toh_2d(t2d.resource_id); 457 458 res = virtio_gpu_find_check_resource(g, t2d.resource_id, true, 459 __func__, &cmd->error); 460 if (!res || res->blob) { 461 return; 462 } 463 464 if (t2d.r.x > res->width || 465 t2d.r.y > res->height || 466 t2d.r.width > res->width || 467 t2d.r.height > res->height || 468 t2d.r.x + t2d.r.width > res->width || 469 t2d.r.y + t2d.r.height > res->height) { 470 qemu_log_mask(LOG_GUEST_ERROR, "%s: transfer bounds outside resource" 471 " bounds for resource %d: %d %d %d %d vs %d %d\n", 472 __func__, t2d.resource_id, t2d.r.x, t2d.r.y, 473 t2d.r.width, t2d.r.height, res->width, res->height); 474 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 475 return; 476 } 477 478 format = pixman_image_get_format(res->image); 479 bpp = DIV_ROUND_UP(PIXMAN_FORMAT_BPP(format), 8); 480 stride = pixman_image_get_stride(res->image); 481 img_data = pixman_image_get_data(res->image); 482 483 if (t2d.r.x || t2d.r.width != pixman_image_get_width(res->image)) { 484 for (h = 0; h < t2d.r.height; h++) { 485 src_offset = t2d.offset + stride * h; 486 dst_offset = (t2d.r.y + h) * stride + (t2d.r.x * bpp); 487 488 iov_to_buf(res->iov, res->iov_cnt, src_offset, 489 (uint8_t *)img_data + dst_offset, 490 t2d.r.width * bpp); 491 } 492 } else { 493 src_offset = t2d.offset; 494 dst_offset = t2d.r.y * stride + t2d.r.x * bpp; 495 iov_to_buf(res->iov, res->iov_cnt, src_offset, 496 (uint8_t *)img_data + dst_offset, 497 stride * t2d.r.height); 498 } 499 } 500 501 static void virtio_gpu_resource_flush(VirtIOGPU *g, 502 struct virtio_gpu_ctrl_command *cmd) 503 { 504 struct virtio_gpu_simple_resource *res; 505 struct virtio_gpu_resource_flush rf; 506 struct virtio_gpu_scanout *scanout; 507 QemuRect flush_rect; 508 bool within_bounds = false; 509 bool update_submitted = false; 510 int i; 511 512 VIRTIO_GPU_FILL_CMD(rf); 513 virtio_gpu_bswap_32(&rf, sizeof(rf)); 514 trace_virtio_gpu_cmd_res_flush(rf.resource_id, 515 rf.r.width, rf.r.height, rf.r.x, rf.r.y); 516 517 res = virtio_gpu_find_check_resource(g, rf.resource_id, false, 518 __func__, &cmd->error); 519 if (!res) { 520 return; 521 } 522 523 if (res->blob) { 524 for (i = 0; i < g->parent_obj.conf.max_outputs; i++) { 525 scanout = &g->parent_obj.scanout[i]; 526 if (scanout->resource_id == res->resource_id && 527 rf.r.x < scanout->x + scanout->width && 528 rf.r.x + rf.r.width >= scanout->x && 529 rf.r.y < scanout->y + scanout->height && 530 rf.r.y + rf.r.height >= scanout->y) { 531 within_bounds = true; 532 533 if (console_has_gl(scanout->con)) { 534 dpy_gl_update(scanout->con, 0, 0, scanout->width, 535 scanout->height); 536 update_submitted = true; 537 } 538 } 539 } 540 541 if (update_submitted) { 542 return; 543 } 544 if (!within_bounds) { 545 qemu_log_mask(LOG_GUEST_ERROR, "%s: flush bounds outside scanouts" 546 " bounds for flush %d: %d %d %d %d\n", 547 __func__, rf.resource_id, rf.r.x, rf.r.y, 548 rf.r.width, rf.r.height); 549 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 550 return; 551 } 552 } 553 554 if (!res->blob && 555 (rf.r.x > res->width || 556 rf.r.y > res->height || 557 rf.r.width > res->width || 558 rf.r.height > res->height || 559 rf.r.x + rf.r.width > res->width || 560 rf.r.y + rf.r.height > res->height)) { 561 qemu_log_mask(LOG_GUEST_ERROR, "%s: flush bounds outside resource" 562 " bounds for resource %d: %d %d %d %d vs %d %d\n", 563 __func__, rf.resource_id, rf.r.x, rf.r.y, 564 rf.r.width, rf.r.height, res->width, res->height); 565 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 566 return; 567 } 568 569 qemu_rect_init(&flush_rect, rf.r.x, rf.r.y, rf.r.width, rf.r.height); 570 for (i = 0; i < g->parent_obj.conf.max_outputs; i++) { 571 QemuRect rect; 572 573 if (!(res->scanout_bitmask & (1 << i))) { 574 continue; 575 } 576 scanout = &g->parent_obj.scanout[i]; 577 578 qemu_rect_init(&rect, scanout->x, scanout->y, 579 scanout->width, scanout->height); 580 581 /* work out the area we need to update for each console */ 582 if (qemu_rect_intersect(&flush_rect, &rect, &rect)) { 583 qemu_rect_translate(&rect, -scanout->x, -scanout->y); 584 dpy_gfx_update(g->parent_obj.scanout[i].con, 585 rect.x, rect.y, rect.width, rect.height); 586 } 587 } 588 } 589 590 static void virtio_unref_resource(pixman_image_t *image, void *data) 591 { 592 pixman_image_unref(data); 593 } 594 595 static void virtio_gpu_update_scanout(VirtIOGPU *g, 596 uint32_t scanout_id, 597 struct virtio_gpu_simple_resource *res, 598 struct virtio_gpu_rect *r) 599 { 600 struct virtio_gpu_simple_resource *ores; 601 struct virtio_gpu_scanout *scanout; 602 603 scanout = &g->parent_obj.scanout[scanout_id]; 604 ores = virtio_gpu_find_resource(g, scanout->resource_id); 605 if (ores) { 606 ores->scanout_bitmask &= ~(1 << scanout_id); 607 } 608 609 res->scanout_bitmask |= (1 << scanout_id); 610 scanout->resource_id = res->resource_id; 611 scanout->x = r->x; 612 scanout->y = r->y; 613 scanout->width = r->width; 614 scanout->height = r->height; 615 } 616 617 static void virtio_gpu_do_set_scanout(VirtIOGPU *g, 618 uint32_t scanout_id, 619 struct virtio_gpu_framebuffer *fb, 620 struct virtio_gpu_simple_resource *res, 621 struct virtio_gpu_rect *r, 622 uint32_t *error) 623 { 624 struct virtio_gpu_scanout *scanout; 625 uint8_t *data; 626 627 scanout = &g->parent_obj.scanout[scanout_id]; 628 629 if (r->x > fb->width || 630 r->y > fb->height || 631 r->width < 16 || 632 r->height < 16 || 633 r->width > fb->width || 634 r->height > fb->height || 635 r->x + r->width > fb->width || 636 r->y + r->height > fb->height) { 637 qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout %d bounds for" 638 " resource %d, rect (%d,%d)+%d,%d, fb %d %d\n", 639 __func__, scanout_id, res->resource_id, 640 r->x, r->y, r->width, r->height, 641 fb->width, fb->height); 642 *error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 643 return; 644 } 645 646 g->parent_obj.enable = 1; 647 648 if (res->blob) { 649 if (console_has_gl(scanout->con)) { 650 if (!virtio_gpu_update_dmabuf(g, scanout_id, res, fb, r)) { 651 virtio_gpu_update_scanout(g, scanout_id, res, r); 652 } else { 653 *error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY; 654 } 655 return; 656 } 657 658 data = res->blob; 659 } else { 660 data = (uint8_t *)pixman_image_get_data(res->image); 661 } 662 663 /* create a surface for this scanout */ 664 if ((res->blob && !console_has_gl(scanout->con)) || 665 !scanout->ds || 666 surface_data(scanout->ds) != data + fb->offset || 667 scanout->width != r->width || 668 scanout->height != r->height) { 669 pixman_image_t *rect; 670 void *ptr = data + fb->offset; 671 rect = pixman_image_create_bits(fb->format, r->width, r->height, 672 ptr, fb->stride); 673 674 if (res->image) { 675 pixman_image_ref(res->image); 676 pixman_image_set_destroy_function(rect, virtio_unref_resource, 677 res->image); 678 } 679 680 /* realloc the surface ptr */ 681 scanout->ds = qemu_create_displaysurface_pixman(rect); 682 if (!scanout->ds) { 683 *error = VIRTIO_GPU_RESP_ERR_UNSPEC; 684 return; 685 } 686 #ifdef WIN32 687 qemu_displaysurface_win32_set_handle(scanout->ds, res->handle, fb->offset); 688 #endif 689 690 pixman_image_unref(rect); 691 dpy_gfx_replace_surface(g->parent_obj.scanout[scanout_id].con, 692 scanout->ds); 693 } 694 695 virtio_gpu_update_scanout(g, scanout_id, res, r); 696 } 697 698 static void virtio_gpu_set_scanout(VirtIOGPU *g, 699 struct virtio_gpu_ctrl_command *cmd) 700 { 701 struct virtio_gpu_simple_resource *res; 702 struct virtio_gpu_framebuffer fb = { 0 }; 703 struct virtio_gpu_set_scanout ss; 704 705 VIRTIO_GPU_FILL_CMD(ss); 706 virtio_gpu_bswap_32(&ss, sizeof(ss)); 707 trace_virtio_gpu_cmd_set_scanout(ss.scanout_id, ss.resource_id, 708 ss.r.width, ss.r.height, ss.r.x, ss.r.y); 709 710 if (ss.scanout_id >= g->parent_obj.conf.max_outputs) { 711 qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d", 712 __func__, ss.scanout_id); 713 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID; 714 return; 715 } 716 717 if (ss.resource_id == 0) { 718 virtio_gpu_disable_scanout(g, ss.scanout_id); 719 return; 720 } 721 722 res = virtio_gpu_find_check_resource(g, ss.resource_id, true, 723 __func__, &cmd->error); 724 if (!res) { 725 return; 726 } 727 728 fb.format = pixman_image_get_format(res->image); 729 fb.bytes_pp = DIV_ROUND_UP(PIXMAN_FORMAT_BPP(fb.format), 8); 730 fb.width = pixman_image_get_width(res->image); 731 fb.height = pixman_image_get_height(res->image); 732 fb.stride = pixman_image_get_stride(res->image); 733 fb.offset = ss.r.x * fb.bytes_pp + ss.r.y * fb.stride; 734 735 virtio_gpu_do_set_scanout(g, ss.scanout_id, 736 &fb, res, &ss.r, &cmd->error); 737 } 738 739 static void virtio_gpu_set_scanout_blob(VirtIOGPU *g, 740 struct virtio_gpu_ctrl_command *cmd) 741 { 742 struct virtio_gpu_simple_resource *res; 743 struct virtio_gpu_framebuffer fb = { 0 }; 744 struct virtio_gpu_set_scanout_blob ss; 745 uint64_t fbend; 746 747 VIRTIO_GPU_FILL_CMD(ss); 748 virtio_gpu_scanout_blob_bswap(&ss); 749 trace_virtio_gpu_cmd_set_scanout_blob(ss.scanout_id, ss.resource_id, 750 ss.r.width, ss.r.height, ss.r.x, 751 ss.r.y); 752 753 if (ss.scanout_id >= g->parent_obj.conf.max_outputs) { 754 qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d", 755 __func__, ss.scanout_id); 756 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID; 757 return; 758 } 759 760 if (ss.resource_id == 0) { 761 virtio_gpu_disable_scanout(g, ss.scanout_id); 762 return; 763 } 764 765 res = virtio_gpu_find_check_resource(g, ss.resource_id, true, 766 __func__, &cmd->error); 767 if (!res) { 768 return; 769 } 770 771 fb.format = virtio_gpu_get_pixman_format(ss.format); 772 if (!fb.format) { 773 qemu_log_mask(LOG_GUEST_ERROR, 774 "%s: host couldn't handle guest format %d\n", 775 __func__, ss.format); 776 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 777 return; 778 } 779 780 fb.bytes_pp = DIV_ROUND_UP(PIXMAN_FORMAT_BPP(fb.format), 8); 781 fb.width = ss.width; 782 fb.height = ss.height; 783 fb.stride = ss.strides[0]; 784 fb.offset = ss.offsets[0] + ss.r.x * fb.bytes_pp + ss.r.y * fb.stride; 785 786 fbend = fb.offset; 787 fbend += fb.stride * (ss.r.height - 1); 788 fbend += fb.bytes_pp * ss.r.width; 789 if (fbend > res->blob_size) { 790 qemu_log_mask(LOG_GUEST_ERROR, 791 "%s: fb end out of range\n", 792 __func__); 793 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 794 return; 795 } 796 797 virtio_gpu_do_set_scanout(g, ss.scanout_id, 798 &fb, res, &ss.r, &cmd->error); 799 } 800 801 int virtio_gpu_create_mapping_iov(VirtIOGPU *g, 802 uint32_t nr_entries, uint32_t offset, 803 struct virtio_gpu_ctrl_command *cmd, 804 uint64_t **addr, struct iovec **iov, 805 uint32_t *niov) 806 { 807 struct virtio_gpu_mem_entry *ents; 808 size_t esize, s; 809 int e, v; 810 811 if (nr_entries > 16384) { 812 qemu_log_mask(LOG_GUEST_ERROR, 813 "%s: nr_entries is too big (%d > 16384)\n", 814 __func__, nr_entries); 815 return -1; 816 } 817 818 esize = sizeof(*ents) * nr_entries; 819 ents = g_malloc(esize); 820 s = iov_to_buf(cmd->elem.out_sg, cmd->elem.out_num, 821 offset, ents, esize); 822 if (s != esize) { 823 qemu_log_mask(LOG_GUEST_ERROR, 824 "%s: command data size incorrect %zu vs %zu\n", 825 __func__, s, esize); 826 g_free(ents); 827 return -1; 828 } 829 830 *iov = NULL; 831 if (addr) { 832 *addr = NULL; 833 } 834 for (e = 0, v = 0; e < nr_entries; e++) { 835 uint64_t a = le64_to_cpu(ents[e].addr); 836 uint32_t l = le32_to_cpu(ents[e].length); 837 hwaddr len; 838 void *map; 839 840 do { 841 len = l; 842 map = dma_memory_map(VIRTIO_DEVICE(g)->dma_as, a, &len, 843 DMA_DIRECTION_TO_DEVICE, 844 MEMTXATTRS_UNSPECIFIED); 845 if (!map) { 846 qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to map MMIO memory for" 847 " element %d\n", __func__, e); 848 virtio_gpu_cleanup_mapping_iov(g, *iov, v); 849 g_free(ents); 850 *iov = NULL; 851 if (addr) { 852 g_free(*addr); 853 *addr = NULL; 854 } 855 return -1; 856 } 857 858 if (!(v % 16)) { 859 *iov = g_renew(struct iovec, *iov, v + 16); 860 if (addr) { 861 *addr = g_renew(uint64_t, *addr, v + 16); 862 } 863 } 864 (*iov)[v].iov_base = map; 865 (*iov)[v].iov_len = len; 866 if (addr) { 867 (*addr)[v] = a; 868 } 869 870 a += len; 871 l -= len; 872 v += 1; 873 } while (l > 0); 874 } 875 *niov = v; 876 877 g_free(ents); 878 return 0; 879 } 880 881 void virtio_gpu_cleanup_mapping_iov(VirtIOGPU *g, 882 struct iovec *iov, uint32_t count) 883 { 884 int i; 885 886 for (i = 0; i < count; i++) { 887 dma_memory_unmap(VIRTIO_DEVICE(g)->dma_as, 888 iov[i].iov_base, iov[i].iov_len, 889 DMA_DIRECTION_TO_DEVICE, 890 iov[i].iov_len); 891 } 892 g_free(iov); 893 } 894 895 void virtio_gpu_cleanup_mapping(VirtIOGPU *g, 896 struct virtio_gpu_simple_resource *res) 897 { 898 virtio_gpu_cleanup_mapping_iov(g, res->iov, res->iov_cnt); 899 res->iov = NULL; 900 res->iov_cnt = 0; 901 g_free(res->addrs); 902 res->addrs = NULL; 903 904 if (res->blob) { 905 virtio_gpu_fini_udmabuf(res); 906 } 907 } 908 909 static void 910 virtio_gpu_resource_attach_backing(VirtIOGPU *g, 911 struct virtio_gpu_ctrl_command *cmd) 912 { 913 struct virtio_gpu_simple_resource *res; 914 struct virtio_gpu_resource_attach_backing ab; 915 int ret; 916 917 VIRTIO_GPU_FILL_CMD(ab); 918 virtio_gpu_bswap_32(&ab, sizeof(ab)); 919 trace_virtio_gpu_cmd_res_back_attach(ab.resource_id); 920 921 res = virtio_gpu_find_resource(g, ab.resource_id); 922 if (!res) { 923 qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n", 924 __func__, ab.resource_id); 925 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; 926 return; 927 } 928 929 if (res->iov) { 930 cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC; 931 return; 932 } 933 934 ret = virtio_gpu_create_mapping_iov(g, ab.nr_entries, sizeof(ab), cmd, 935 &res->addrs, &res->iov, &res->iov_cnt); 936 if (ret != 0) { 937 cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC; 938 return; 939 } 940 } 941 942 static void 943 virtio_gpu_resource_detach_backing(VirtIOGPU *g, 944 struct virtio_gpu_ctrl_command *cmd) 945 { 946 struct virtio_gpu_simple_resource *res; 947 struct virtio_gpu_resource_detach_backing detach; 948 949 VIRTIO_GPU_FILL_CMD(detach); 950 virtio_gpu_bswap_32(&detach, sizeof(detach)); 951 trace_virtio_gpu_cmd_res_back_detach(detach.resource_id); 952 953 res = virtio_gpu_find_check_resource(g, detach.resource_id, true, 954 __func__, &cmd->error); 955 if (!res) { 956 return; 957 } 958 virtio_gpu_cleanup_mapping(g, res); 959 } 960 961 void virtio_gpu_simple_process_cmd(VirtIOGPU *g, 962 struct virtio_gpu_ctrl_command *cmd) 963 { 964 VIRTIO_GPU_FILL_CMD(cmd->cmd_hdr); 965 virtio_gpu_ctrl_hdr_bswap(&cmd->cmd_hdr); 966 967 switch (cmd->cmd_hdr.type) { 968 case VIRTIO_GPU_CMD_GET_DISPLAY_INFO: 969 virtio_gpu_get_display_info(g, cmd); 970 break; 971 case VIRTIO_GPU_CMD_GET_EDID: 972 virtio_gpu_get_edid(g, cmd); 973 break; 974 case VIRTIO_GPU_CMD_RESOURCE_CREATE_2D: 975 virtio_gpu_resource_create_2d(g, cmd); 976 break; 977 case VIRTIO_GPU_CMD_RESOURCE_CREATE_BLOB: 978 if (!virtio_gpu_blob_enabled(g->parent_obj.conf)) { 979 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 980 break; 981 } 982 virtio_gpu_resource_create_blob(g, cmd); 983 break; 984 case VIRTIO_GPU_CMD_RESOURCE_UNREF: 985 virtio_gpu_resource_unref(g, cmd); 986 break; 987 case VIRTIO_GPU_CMD_RESOURCE_FLUSH: 988 virtio_gpu_resource_flush(g, cmd); 989 break; 990 case VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D: 991 virtio_gpu_transfer_to_host_2d(g, cmd); 992 break; 993 case VIRTIO_GPU_CMD_SET_SCANOUT: 994 virtio_gpu_set_scanout(g, cmd); 995 break; 996 case VIRTIO_GPU_CMD_SET_SCANOUT_BLOB: 997 if (!virtio_gpu_blob_enabled(g->parent_obj.conf)) { 998 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; 999 break; 1000 } 1001 virtio_gpu_set_scanout_blob(g, cmd); 1002 break; 1003 case VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING: 1004 virtio_gpu_resource_attach_backing(g, cmd); 1005 break; 1006 case VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING: 1007 virtio_gpu_resource_detach_backing(g, cmd); 1008 break; 1009 default: 1010 cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC; 1011 break; 1012 } 1013 if (!cmd->finished) { 1014 if (!g->parent_obj.renderer_blocked) { 1015 virtio_gpu_ctrl_response_nodata(g, cmd, cmd->error ? cmd->error : 1016 VIRTIO_GPU_RESP_OK_NODATA); 1017 } 1018 } 1019 } 1020 1021 static void virtio_gpu_handle_ctrl_cb(VirtIODevice *vdev, VirtQueue *vq) 1022 { 1023 VirtIOGPU *g = VIRTIO_GPU(vdev); 1024 qemu_bh_schedule(g->ctrl_bh); 1025 } 1026 1027 static void virtio_gpu_handle_cursor_cb(VirtIODevice *vdev, VirtQueue *vq) 1028 { 1029 VirtIOGPU *g = VIRTIO_GPU(vdev); 1030 qemu_bh_schedule(g->cursor_bh); 1031 } 1032 1033 void virtio_gpu_process_cmdq(VirtIOGPU *g) 1034 { 1035 struct virtio_gpu_ctrl_command *cmd; 1036 VirtIOGPUClass *vgc = VIRTIO_GPU_GET_CLASS(g); 1037 1038 if (g->processing_cmdq) { 1039 return; 1040 } 1041 g->processing_cmdq = true; 1042 while (!QTAILQ_EMPTY(&g->cmdq)) { 1043 cmd = QTAILQ_FIRST(&g->cmdq); 1044 1045 if (g->parent_obj.renderer_blocked) { 1046 break; 1047 } 1048 1049 /* process command */ 1050 vgc->process_cmd(g, cmd); 1051 1052 QTAILQ_REMOVE(&g->cmdq, cmd, next); 1053 if (virtio_gpu_stats_enabled(g->parent_obj.conf)) { 1054 g->stats.requests++; 1055 } 1056 1057 if (!cmd->finished) { 1058 QTAILQ_INSERT_TAIL(&g->fenceq, cmd, next); 1059 g->inflight++; 1060 if (virtio_gpu_stats_enabled(g->parent_obj.conf)) { 1061 if (g->stats.max_inflight < g->inflight) { 1062 g->stats.max_inflight = g->inflight; 1063 } 1064 fprintf(stderr, "inflight: %3d (+)\r", g->inflight); 1065 } 1066 } else { 1067 g_free(cmd); 1068 } 1069 } 1070 g->processing_cmdq = false; 1071 } 1072 1073 static void virtio_gpu_process_fenceq(VirtIOGPU *g) 1074 { 1075 struct virtio_gpu_ctrl_command *cmd, *tmp; 1076 1077 QTAILQ_FOREACH_SAFE(cmd, &g->fenceq, next, tmp) { 1078 trace_virtio_gpu_fence_resp(cmd->cmd_hdr.fence_id); 1079 virtio_gpu_ctrl_response_nodata(g, cmd, VIRTIO_GPU_RESP_OK_NODATA); 1080 QTAILQ_REMOVE(&g->fenceq, cmd, next); 1081 g_free(cmd); 1082 g->inflight--; 1083 if (virtio_gpu_stats_enabled(g->parent_obj.conf)) { 1084 fprintf(stderr, "inflight: %3d (-)\r", g->inflight); 1085 } 1086 } 1087 } 1088 1089 static void virtio_gpu_handle_gl_flushed(VirtIOGPUBase *b) 1090 { 1091 VirtIOGPU *g = container_of(b, VirtIOGPU, parent_obj); 1092 1093 virtio_gpu_process_fenceq(g); 1094 virtio_gpu_process_cmdq(g); 1095 } 1096 1097 static void virtio_gpu_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq) 1098 { 1099 VirtIOGPU *g = VIRTIO_GPU(vdev); 1100 struct virtio_gpu_ctrl_command *cmd; 1101 1102 if (!virtio_queue_ready(vq)) { 1103 return; 1104 } 1105 1106 cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command)); 1107 while (cmd) { 1108 cmd->vq = vq; 1109 cmd->error = 0; 1110 cmd->finished = false; 1111 QTAILQ_INSERT_TAIL(&g->cmdq, cmd, next); 1112 cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command)); 1113 } 1114 1115 virtio_gpu_process_cmdq(g); 1116 } 1117 1118 static void virtio_gpu_ctrl_bh(void *opaque) 1119 { 1120 VirtIOGPU *g = opaque; 1121 VirtIOGPUClass *vgc = VIRTIO_GPU_GET_CLASS(g); 1122 1123 vgc->handle_ctrl(VIRTIO_DEVICE(g), g->ctrl_vq); 1124 } 1125 1126 static void virtio_gpu_handle_cursor(VirtIODevice *vdev, VirtQueue *vq) 1127 { 1128 VirtIOGPU *g = VIRTIO_GPU(vdev); 1129 VirtQueueElement *elem; 1130 size_t s; 1131 struct virtio_gpu_update_cursor cursor_info; 1132 1133 if (!virtio_queue_ready(vq)) { 1134 return; 1135 } 1136 for (;;) { 1137 elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); 1138 if (!elem) { 1139 break; 1140 } 1141 1142 s = iov_to_buf(elem->out_sg, elem->out_num, 0, 1143 &cursor_info, sizeof(cursor_info)); 1144 if (s != sizeof(cursor_info)) { 1145 qemu_log_mask(LOG_GUEST_ERROR, 1146 "%s: cursor size incorrect %zu vs %zu\n", 1147 __func__, s, sizeof(cursor_info)); 1148 } else { 1149 virtio_gpu_bswap_32(&cursor_info, sizeof(cursor_info)); 1150 update_cursor(g, &cursor_info); 1151 } 1152 virtqueue_push(vq, elem, 0); 1153 virtio_notify(vdev, vq); 1154 g_free(elem); 1155 } 1156 } 1157 1158 static void virtio_gpu_cursor_bh(void *opaque) 1159 { 1160 VirtIOGPU *g = opaque; 1161 virtio_gpu_handle_cursor(&g->parent_obj.parent_obj, g->cursor_vq); 1162 } 1163 1164 static const VMStateDescription vmstate_virtio_gpu_scanout = { 1165 .name = "virtio-gpu-one-scanout", 1166 .version_id = 1, 1167 .fields = (const VMStateField[]) { 1168 VMSTATE_UINT32(resource_id, struct virtio_gpu_scanout), 1169 VMSTATE_UINT32(width, struct virtio_gpu_scanout), 1170 VMSTATE_UINT32(height, struct virtio_gpu_scanout), 1171 VMSTATE_INT32(x, struct virtio_gpu_scanout), 1172 VMSTATE_INT32(y, struct virtio_gpu_scanout), 1173 VMSTATE_UINT32(cursor.resource_id, struct virtio_gpu_scanout), 1174 VMSTATE_UINT32(cursor.hot_x, struct virtio_gpu_scanout), 1175 VMSTATE_UINT32(cursor.hot_y, struct virtio_gpu_scanout), 1176 VMSTATE_UINT32(cursor.pos.x, struct virtio_gpu_scanout), 1177 VMSTATE_UINT32(cursor.pos.y, struct virtio_gpu_scanout), 1178 VMSTATE_END_OF_LIST() 1179 }, 1180 }; 1181 1182 static const VMStateDescription vmstate_virtio_gpu_scanouts = { 1183 .name = "virtio-gpu-scanouts", 1184 .version_id = 1, 1185 .fields = (const VMStateField[]) { 1186 VMSTATE_INT32(parent_obj.enable, struct VirtIOGPU), 1187 VMSTATE_UINT32_EQUAL(parent_obj.conf.max_outputs, 1188 struct VirtIOGPU, NULL), 1189 VMSTATE_STRUCT_VARRAY_UINT32(parent_obj.scanout, struct VirtIOGPU, 1190 parent_obj.conf.max_outputs, 1, 1191 vmstate_virtio_gpu_scanout, 1192 struct virtio_gpu_scanout), 1193 VMSTATE_END_OF_LIST() 1194 }, 1195 }; 1196 1197 static int virtio_gpu_save(QEMUFile *f, void *opaque, size_t size, 1198 const VMStateField *field, JSONWriter *vmdesc) 1199 { 1200 VirtIOGPU *g = opaque; 1201 struct virtio_gpu_simple_resource *res; 1202 int i; 1203 1204 /* in 2d mode we should never find unprocessed commands here */ 1205 assert(QTAILQ_EMPTY(&g->cmdq)); 1206 1207 QTAILQ_FOREACH(res, &g->reslist, next) { 1208 if (res->blob_size) { 1209 continue; 1210 } 1211 qemu_put_be32(f, res->resource_id); 1212 qemu_put_be32(f, res->width); 1213 qemu_put_be32(f, res->height); 1214 qemu_put_be32(f, res->format); 1215 qemu_put_be32(f, res->iov_cnt); 1216 for (i = 0; i < res->iov_cnt; i++) { 1217 qemu_put_be64(f, res->addrs[i]); 1218 qemu_put_be32(f, res->iov[i].iov_len); 1219 } 1220 qemu_put_buffer(f, (void *)pixman_image_get_data(res->image), 1221 pixman_image_get_stride(res->image) * res->height); 1222 } 1223 qemu_put_be32(f, 0); /* end of list */ 1224 1225 return vmstate_save_state(f, &vmstate_virtio_gpu_scanouts, g, NULL); 1226 } 1227 1228 static bool virtio_gpu_load_restore_mapping(VirtIOGPU *g, 1229 struct virtio_gpu_simple_resource *res) 1230 { 1231 int i; 1232 1233 for (i = 0; i < res->iov_cnt; i++) { 1234 hwaddr len = res->iov[i].iov_len; 1235 res->iov[i].iov_base = 1236 dma_memory_map(VIRTIO_DEVICE(g)->dma_as, res->addrs[i], &len, 1237 DMA_DIRECTION_TO_DEVICE, MEMTXATTRS_UNSPECIFIED); 1238 1239 if (!res->iov[i].iov_base || len != res->iov[i].iov_len) { 1240 /* Clean up the half-a-mapping we just created... */ 1241 if (res->iov[i].iov_base) { 1242 dma_memory_unmap(VIRTIO_DEVICE(g)->dma_as, res->iov[i].iov_base, 1243 len, DMA_DIRECTION_TO_DEVICE, 0); 1244 } 1245 /* ...and the mappings for previous loop iterations */ 1246 res->iov_cnt = i; 1247 virtio_gpu_cleanup_mapping(g, res); 1248 return false; 1249 } 1250 } 1251 1252 QTAILQ_INSERT_HEAD(&g->reslist, res, next); 1253 g->hostmem += res->hostmem; 1254 return true; 1255 } 1256 1257 static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size, 1258 const VMStateField *field) 1259 { 1260 VirtIOGPU *g = opaque; 1261 struct virtio_gpu_simple_resource *res; 1262 uint32_t resource_id, pformat; 1263 void *bits = NULL; 1264 int i; 1265 1266 g->hostmem = 0; 1267 1268 resource_id = qemu_get_be32(f); 1269 while (resource_id != 0) { 1270 res = virtio_gpu_find_resource(g, resource_id); 1271 if (res) { 1272 return -EINVAL; 1273 } 1274 1275 res = g_new0(struct virtio_gpu_simple_resource, 1); 1276 res->resource_id = resource_id; 1277 res->width = qemu_get_be32(f); 1278 res->height = qemu_get_be32(f); 1279 res->format = qemu_get_be32(f); 1280 res->iov_cnt = qemu_get_be32(f); 1281 1282 /* allocate */ 1283 pformat = virtio_gpu_get_pixman_format(res->format); 1284 if (!pformat) { 1285 g_free(res); 1286 return -EINVAL; 1287 } 1288 1289 res->hostmem = calc_image_hostmem(pformat, res->width, res->height); 1290 #ifdef WIN32 1291 bits = qemu_win32_map_alloc(res->hostmem, &res->handle, &error_warn); 1292 if (!bits) { 1293 g_free(res); 1294 return -EINVAL; 1295 } 1296 #endif 1297 res->image = pixman_image_create_bits( 1298 pformat, 1299 res->width, res->height, 1300 bits, res->height ? res->hostmem / res->height : 0); 1301 if (!res->image) { 1302 g_free(res); 1303 return -EINVAL; 1304 } 1305 #ifdef WIN32 1306 pixman_image_set_destroy_function(res->image, win32_pixman_image_destroy, res->handle); 1307 #endif 1308 1309 res->addrs = g_new(uint64_t, res->iov_cnt); 1310 res->iov = g_new(struct iovec, res->iov_cnt); 1311 1312 /* read data */ 1313 for (i = 0; i < res->iov_cnt; i++) { 1314 res->addrs[i] = qemu_get_be64(f); 1315 res->iov[i].iov_len = qemu_get_be32(f); 1316 } 1317 qemu_get_buffer(f, (void *)pixman_image_get_data(res->image), 1318 pixman_image_get_stride(res->image) * res->height); 1319 1320 if (!virtio_gpu_load_restore_mapping(g, res)) { 1321 pixman_image_unref(res->image); 1322 g_free(res); 1323 return -EINVAL; 1324 } 1325 1326 resource_id = qemu_get_be32(f); 1327 } 1328 1329 /* load & apply scanout state */ 1330 vmstate_load_state(f, &vmstate_virtio_gpu_scanouts, g, 1); 1331 1332 return 0; 1333 } 1334 1335 static int virtio_gpu_blob_save(QEMUFile *f, void *opaque, size_t size, 1336 const VMStateField *field, JSONWriter *vmdesc) 1337 { 1338 VirtIOGPU *g = opaque; 1339 struct virtio_gpu_simple_resource *res; 1340 int i; 1341 1342 /* in 2d mode we should never find unprocessed commands here */ 1343 assert(QTAILQ_EMPTY(&g->cmdq)); 1344 1345 QTAILQ_FOREACH(res, &g->reslist, next) { 1346 if (!res->blob_size) { 1347 continue; 1348 } 1349 qemu_put_be32(f, res->resource_id); 1350 qemu_put_be32(f, res->blob_size); 1351 qemu_put_be32(f, res->iov_cnt); 1352 for (i = 0; i < res->iov_cnt; i++) { 1353 qemu_put_be64(f, res->addrs[i]); 1354 qemu_put_be32(f, res->iov[i].iov_len); 1355 } 1356 } 1357 qemu_put_be32(f, 0); /* end of list */ 1358 1359 return 0; 1360 } 1361 1362 static int virtio_gpu_blob_load(QEMUFile *f, void *opaque, size_t size, 1363 const VMStateField *field) 1364 { 1365 VirtIOGPU *g = opaque; 1366 struct virtio_gpu_simple_resource *res; 1367 uint32_t resource_id; 1368 int i; 1369 1370 resource_id = qemu_get_be32(f); 1371 while (resource_id != 0) { 1372 res = virtio_gpu_find_resource(g, resource_id); 1373 if (res) { 1374 return -EINVAL; 1375 } 1376 1377 res = g_new0(struct virtio_gpu_simple_resource, 1); 1378 res->resource_id = resource_id; 1379 res->blob_size = qemu_get_be32(f); 1380 res->iov_cnt = qemu_get_be32(f); 1381 res->addrs = g_new(uint64_t, res->iov_cnt); 1382 res->iov = g_new(struct iovec, res->iov_cnt); 1383 1384 /* read data */ 1385 for (i = 0; i < res->iov_cnt; i++) { 1386 res->addrs[i] = qemu_get_be64(f); 1387 res->iov[i].iov_len = qemu_get_be32(f); 1388 } 1389 1390 if (!virtio_gpu_load_restore_mapping(g, res)) { 1391 g_free(res); 1392 return -EINVAL; 1393 } 1394 1395 virtio_gpu_init_udmabuf(res); 1396 1397 resource_id = qemu_get_be32(f); 1398 } 1399 1400 return 0; 1401 } 1402 1403 static int virtio_gpu_post_load(void *opaque, int version_id) 1404 { 1405 VirtIOGPU *g = opaque; 1406 struct virtio_gpu_scanout *scanout; 1407 struct virtio_gpu_simple_resource *res; 1408 int i; 1409 1410 for (i = 0; i < g->parent_obj.conf.max_outputs; i++) { 1411 /* FIXME: should take scanout.r.{x,y} into account */ 1412 scanout = &g->parent_obj.scanout[i]; 1413 if (!scanout->resource_id) { 1414 continue; 1415 } 1416 res = virtio_gpu_find_resource(g, scanout->resource_id); 1417 if (!res) { 1418 return -EINVAL; 1419 } 1420 scanout->ds = qemu_create_displaysurface_pixman(res->image); 1421 if (!scanout->ds) { 1422 return -EINVAL; 1423 } 1424 #ifdef WIN32 1425 qemu_displaysurface_win32_set_handle(scanout->ds, res->handle, 0); 1426 #endif 1427 1428 dpy_gfx_replace_surface(scanout->con, scanout->ds); 1429 dpy_gfx_update_full(scanout->con); 1430 if (scanout->cursor.resource_id) { 1431 update_cursor(g, &scanout->cursor); 1432 } 1433 res->scanout_bitmask |= (1 << i); 1434 } 1435 1436 return 0; 1437 } 1438 1439 void virtio_gpu_device_realize(DeviceState *qdev, Error **errp) 1440 { 1441 VirtIODevice *vdev = VIRTIO_DEVICE(qdev); 1442 VirtIOGPU *g = VIRTIO_GPU(qdev); 1443 1444 if (virtio_gpu_blob_enabled(g->parent_obj.conf)) { 1445 if (!virtio_gpu_rutabaga_enabled(g->parent_obj.conf) && 1446 !virtio_gpu_have_udmabuf()) { 1447 error_setg(errp, "need rutabaga or udmabuf for blob resources"); 1448 return; 1449 } 1450 1451 if (virtio_gpu_virgl_enabled(g->parent_obj.conf)) { 1452 error_setg(errp, "blobs and virgl are not compatible (yet)"); 1453 return; 1454 } 1455 } 1456 1457 if (!virtio_gpu_base_device_realize(qdev, 1458 virtio_gpu_handle_ctrl_cb, 1459 virtio_gpu_handle_cursor_cb, 1460 errp)) { 1461 return; 1462 } 1463 1464 g->ctrl_vq = virtio_get_queue(vdev, 0); 1465 g->cursor_vq = virtio_get_queue(vdev, 1); 1466 g->ctrl_bh = qemu_bh_new_guarded(virtio_gpu_ctrl_bh, g, 1467 &qdev->mem_reentrancy_guard); 1468 g->cursor_bh = qemu_bh_new_guarded(virtio_gpu_cursor_bh, g, 1469 &qdev->mem_reentrancy_guard); 1470 g->reset_bh = qemu_bh_new(virtio_gpu_reset_bh, g); 1471 qemu_cond_init(&g->reset_cond); 1472 QTAILQ_INIT(&g->reslist); 1473 QTAILQ_INIT(&g->cmdq); 1474 QTAILQ_INIT(&g->fenceq); 1475 } 1476 1477 static void virtio_gpu_device_unrealize(DeviceState *qdev) 1478 { 1479 VirtIOGPU *g = VIRTIO_GPU(qdev); 1480 1481 g_clear_pointer(&g->ctrl_bh, qemu_bh_delete); 1482 g_clear_pointer(&g->cursor_bh, qemu_bh_delete); 1483 g_clear_pointer(&g->reset_bh, qemu_bh_delete); 1484 qemu_cond_destroy(&g->reset_cond); 1485 virtio_gpu_base_device_unrealize(qdev); 1486 } 1487 1488 static void virtio_gpu_reset_bh(void *opaque) 1489 { 1490 VirtIOGPU *g = VIRTIO_GPU(opaque); 1491 struct virtio_gpu_simple_resource *res, *tmp; 1492 int i = 0; 1493 1494 QTAILQ_FOREACH_SAFE(res, &g->reslist, next, tmp) { 1495 virtio_gpu_resource_destroy(g, res); 1496 } 1497 1498 for (i = 0; i < g->parent_obj.conf.max_outputs; i++) { 1499 dpy_gfx_replace_surface(g->parent_obj.scanout[i].con, NULL); 1500 } 1501 1502 g->reset_finished = true; 1503 qemu_cond_signal(&g->reset_cond); 1504 } 1505 1506 void virtio_gpu_reset(VirtIODevice *vdev) 1507 { 1508 VirtIOGPU *g = VIRTIO_GPU(vdev); 1509 struct virtio_gpu_ctrl_command *cmd; 1510 1511 if (qemu_in_vcpu_thread()) { 1512 g->reset_finished = false; 1513 qemu_bh_schedule(g->reset_bh); 1514 while (!g->reset_finished) { 1515 qemu_cond_wait_bql(&g->reset_cond); 1516 } 1517 } else { 1518 virtio_gpu_reset_bh(g); 1519 } 1520 1521 while (!QTAILQ_EMPTY(&g->cmdq)) { 1522 cmd = QTAILQ_FIRST(&g->cmdq); 1523 QTAILQ_REMOVE(&g->cmdq, cmd, next); 1524 g_free(cmd); 1525 } 1526 1527 while (!QTAILQ_EMPTY(&g->fenceq)) { 1528 cmd = QTAILQ_FIRST(&g->fenceq); 1529 QTAILQ_REMOVE(&g->fenceq, cmd, next); 1530 g->inflight--; 1531 g_free(cmd); 1532 } 1533 1534 virtio_gpu_base_reset(VIRTIO_GPU_BASE(vdev)); 1535 } 1536 1537 static void 1538 virtio_gpu_get_config(VirtIODevice *vdev, uint8_t *config) 1539 { 1540 VirtIOGPUBase *g = VIRTIO_GPU_BASE(vdev); 1541 1542 memcpy(config, &g->virtio_config, sizeof(g->virtio_config)); 1543 } 1544 1545 static void 1546 virtio_gpu_set_config(VirtIODevice *vdev, const uint8_t *config) 1547 { 1548 VirtIOGPUBase *g = VIRTIO_GPU_BASE(vdev); 1549 const struct virtio_gpu_config *vgconfig = 1550 (const struct virtio_gpu_config *)config; 1551 1552 if (vgconfig->events_clear) { 1553 g->virtio_config.events_read &= ~vgconfig->events_clear; 1554 } 1555 } 1556 1557 static bool virtio_gpu_blob_state_needed(void *opaque) 1558 { 1559 VirtIOGPU *g = VIRTIO_GPU(opaque); 1560 1561 return virtio_gpu_blob_enabled(g->parent_obj.conf); 1562 } 1563 1564 const VMStateDescription vmstate_virtio_gpu_blob_state = { 1565 .name = "virtio-gpu/blob", 1566 .minimum_version_id = VIRTIO_GPU_VM_VERSION, 1567 .version_id = VIRTIO_GPU_VM_VERSION, 1568 .needed = virtio_gpu_blob_state_needed, 1569 .fields = (const VMStateField[]){ 1570 { 1571 .name = "virtio-gpu/blob", 1572 .info = &(const VMStateInfo) { 1573 .name = "blob", 1574 .get = virtio_gpu_blob_load, 1575 .put = virtio_gpu_blob_save, 1576 }, 1577 .flags = VMS_SINGLE, 1578 } /* device */, 1579 VMSTATE_END_OF_LIST() 1580 }, 1581 }; 1582 1583 /* 1584 * For historical reasons virtio_gpu does not adhere to virtio migration 1585 * scheme as described in doc/virtio-migration.txt, in a sense that no 1586 * save/load callback are provided to the core. Instead the device data 1587 * is saved/loaded after the core data. 1588 * 1589 * Because of this we need a special vmsd. 1590 */ 1591 static const VMStateDescription vmstate_virtio_gpu = { 1592 .name = "virtio-gpu", 1593 .minimum_version_id = VIRTIO_GPU_VM_VERSION, 1594 .version_id = VIRTIO_GPU_VM_VERSION, 1595 .fields = (const VMStateField[]) { 1596 VMSTATE_VIRTIO_DEVICE /* core */, 1597 { 1598 .name = "virtio-gpu", 1599 .info = &(const VMStateInfo) { 1600 .name = "virtio-gpu", 1601 .get = virtio_gpu_load, 1602 .put = virtio_gpu_save, 1603 }, 1604 .flags = VMS_SINGLE, 1605 } /* device */, 1606 VMSTATE_END_OF_LIST() 1607 }, 1608 .subsections = (const VMStateDescription * const []) { 1609 &vmstate_virtio_gpu_blob_state, 1610 NULL 1611 }, 1612 .post_load = virtio_gpu_post_load, 1613 }; 1614 1615 static Property virtio_gpu_properties[] = { 1616 VIRTIO_GPU_BASE_PROPERTIES(VirtIOGPU, parent_obj.conf), 1617 DEFINE_PROP_SIZE("max_hostmem", VirtIOGPU, conf_max_hostmem, 1618 256 * MiB), 1619 DEFINE_PROP_BIT("blob", VirtIOGPU, parent_obj.conf.flags, 1620 VIRTIO_GPU_FLAG_BLOB_ENABLED, false), 1621 DEFINE_PROP_SIZE("hostmem", VirtIOGPU, parent_obj.conf.hostmem, 0), 1622 DEFINE_PROP_END_OF_LIST(), 1623 }; 1624 1625 static void virtio_gpu_class_init(ObjectClass *klass, void *data) 1626 { 1627 DeviceClass *dc = DEVICE_CLASS(klass); 1628 VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass); 1629 VirtIOGPUClass *vgc = VIRTIO_GPU_CLASS(klass); 1630 VirtIOGPUBaseClass *vgbc = &vgc->parent; 1631 1632 vgc->handle_ctrl = virtio_gpu_handle_ctrl; 1633 vgc->process_cmd = virtio_gpu_simple_process_cmd; 1634 vgc->update_cursor_data = virtio_gpu_update_cursor_data; 1635 vgbc->gl_flushed = virtio_gpu_handle_gl_flushed; 1636 1637 vdc->realize = virtio_gpu_device_realize; 1638 vdc->unrealize = virtio_gpu_device_unrealize; 1639 vdc->reset = virtio_gpu_reset; 1640 vdc->get_config = virtio_gpu_get_config; 1641 vdc->set_config = virtio_gpu_set_config; 1642 1643 dc->vmsd = &vmstate_virtio_gpu; 1644 device_class_set_props(dc, virtio_gpu_properties); 1645 } 1646 1647 static const TypeInfo virtio_gpu_info = { 1648 .name = TYPE_VIRTIO_GPU, 1649 .parent = TYPE_VIRTIO_GPU_BASE, 1650 .instance_size = sizeof(VirtIOGPU), 1651 .class_size = sizeof(VirtIOGPUClass), 1652 .class_init = virtio_gpu_class_init, 1653 }; 1654 module_obj(TYPE_VIRTIO_GPU); 1655 module_kconfig(VIRTIO_GPU); 1656 1657 static void virtio_register_types(void) 1658 { 1659 type_register_static(&virtio_gpu_info); 1660 } 1661 1662 type_init(virtio_register_types) 1663