hw/display/virtio-gpu.c

   1 /*
   2  * Virtio GPU Device
   3  *
   4  * Copyright Red Hat, Inc. 2013-2014
   5  *
   6  * Authors:
   7  *     Dave Airlie <airlied@redhat.com>
   8  *     Gerd Hoffmann <kraxel@redhat.com>
   9  *
  10  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  11  * See the COPYING file in the top-level directory.
  12  */
  13
  14 #include "qemu/osdep.h"
  15 #include "qemu-common.h"
  16 #include "qemu/iov.h"
  17 #include "ui/console.h"
  18 #include "trace.h"
  19 #include "hw/virtio/virtio.h"
  20 #include "hw/virtio/virtio-gpu.h"
  21 #include "hw/virtio/virtio-bus.h"
  22 #include "migration/migration.h"
  23 #include "qemu/log.h"
  24 #include "qapi/error.h"
  25
  26 #define VIRTIO_GPU_VM_VERSION 1
  27
  28 static struct virtio_gpu_simple_resource*
  29 virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id);
  30
  31 static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res);
  32
  33 #ifdef CONFIG_VIRGL
  34 #include <virglrenderer.h>
  35 #define VIRGL(_g, _virgl, _simple, ...)                     \
  36     do {                                                    \
  37         if (_g->use_virgl_renderer) {                       \
  38             _virgl(__VA_ARGS__);                            \
  39         } else {                                            \
  40             _simple(__VA_ARGS__);                           \
  41         }                                                   \
  42     } while (0)
  43 #else
  44 #define VIRGL(_g, _virgl, _simple, ...)                 \
  45     do {                                                \
  46         _simple(__VA_ARGS__);                           \
  47     } while (0)
  48 #endif
  49
  50 static void update_cursor_data_simple(VirtIOGPU *g,
  51                                       struct virtio_gpu_scanout *s,
  52                                       uint32_t resource_id)
  53 {
  54     struct virtio_gpu_simple_resource *res;
  55     uint32_t pixels;
  56
  57     res = virtio_gpu_find_resource(g, resource_id);
  58     if (!res) {
  59         return;
  60     }
  61
  62     if (pixman_image_get_width(res->image)  != s->current_cursor->width ||
  63         pixman_image_get_height(res->image) != s->current_cursor->height) {
  64         return;
  65     }
  66
  67     pixels = s->current_cursor->width * s->current_cursor->height;
  68     memcpy(s->current_cursor->data,
  69            pixman_image_get_data(res->image),
  70            pixels * sizeof(uint32_t));
  71 }
  72
  73 #ifdef CONFIG_VIRGL
  74
  75 static void update_cursor_data_virgl(VirtIOGPU *g,
  76                                      struct virtio_gpu_scanout *s,
  77                                      uint32_t resource_id)
  78 {
  79     uint32_t width, height;
  80     uint32_t pixels, *data;
  81
  82     data = virgl_renderer_get_cursor_data(resource_id, &width, &height);
  83     if (!data) {
  84         return;
  85     }
  86
  87     if (width != s->current_cursor->width ||
  88         height != s->current_cursor->height) {
  89         free(data);
  90         return;
  91     }
  92
  93     pixels = s->current_cursor->width * s->current_cursor->height;
  94     memcpy(s->current_cursor->data, data, pixels * sizeof(uint32_t));
  95     free(data);
  96 }
  97
  98 #endif
  99
 100 static void update_cursor(VirtIOGPU *g, struct virtio_gpu_update_cursor *cursor)
 101 {
 102     struct virtio_gpu_scanout *s;
 103     bool move = cursor->hdr.type == VIRTIO_GPU_CMD_MOVE_CURSOR;
 104
 105     if (cursor->pos.scanout_id >= g->conf.max_outputs) {
 106         return;
 107     }
 108     s = &g->scanout[cursor->pos.scanout_id];
 109
 110     trace_virtio_gpu_update_cursor(cursor->pos.scanout_id,
 111                                    cursor->pos.x,
 112                                    cursor->pos.y,
 113                                    move ? "move" : "update",
 114                                    cursor->resource_id);
 115
 116     if (!move) {
 117         if (!s->current_cursor) {
 118             s->current_cursor = cursor_alloc(64, 64);
 119         }
 120
 121         s->current_cursor->hot_x = cursor->hot_x;
 122         s->current_cursor->hot_y = cursor->hot_y;
 123
 124         if (cursor->resource_id > 0) {
 125             VIRGL(g, update_cursor_data_virgl, update_cursor_data_simple,
 126                   g, s, cursor->resource_id);
 127         }
 128         dpy_cursor_define(s->con, s->current_cursor);
 129
 130         s->cursor = *cursor;
 131     } else {
 132         s->cursor.pos.x = cursor->pos.x;
 133         s->cursor.pos.y = cursor->pos.y;
 134     }
 135     dpy_mouse_set(s->con, cursor->pos.x, cursor->pos.y,
 136                   cursor->resource_id ? 1 : 0);
 137 }
 138
 139 static void virtio_gpu_get_config(VirtIODevice *vdev, uint8_t *config)
 140 {
 141     VirtIOGPU *g = VIRTIO_GPU(vdev);
 142     memcpy(config, &g->virtio_config, sizeof(g->virtio_config));
 143 }
 144
 145 static void virtio_gpu_set_config(VirtIODevice *vdev, const uint8_t *config)
 146 {
 147     VirtIOGPU *g = VIRTIO_GPU(vdev);
 148     struct virtio_gpu_config vgconfig;
 149
 150     memcpy(&vgconfig, config, sizeof(g->virtio_config));
 151
 152     if (vgconfig.events_clear) {
 153         g->virtio_config.events_read &= ~vgconfig.events_clear;
 154     }
 155 }
 156
 157 static uint64_t virtio_gpu_get_features(VirtIODevice *vdev, uint64_t features,
 158                                         Error **errp)
 159 {
 160     VirtIOGPU *g = VIRTIO_GPU(vdev);
 161
 162     if (virtio_gpu_virgl_enabled(g->conf)) {
 163         features |= (1 << VIRTIO_GPU_F_VIRGL);
 164     }
 165     return features;
 166 }
 167
 168 static void virtio_gpu_set_features(VirtIODevice *vdev, uint64_t features)
 169 {
 170     static const uint32_t virgl = (1 << VIRTIO_GPU_F_VIRGL);
 171     VirtIOGPU *g = VIRTIO_GPU(vdev);
 172
 173     g->use_virgl_renderer = ((features & virgl) == virgl);
 174     trace_virtio_gpu_features(g->use_virgl_renderer);
 175 }
 176
 177 static void virtio_gpu_notify_event(VirtIOGPU *g, uint32_t event_type)
 178 {
 179     g->virtio_config.events_read |= event_type;
 180     virtio_notify_config(&g->parent_obj);
 181 }
 182
 183 static struct virtio_gpu_simple_resource *
 184 virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id)
 185 {
 186     struct virtio_gpu_simple_resource *res;
 187
 188     QTAILQ_FOREACH(res, &g->reslist, next) {
 189         if (res->resource_id == resource_id) {
 190             return res;
 191         }
 192     }
 193     return NULL;
 194 }
 195
 196 void virtio_gpu_ctrl_response(VirtIOGPU *g,
 197                               struct virtio_gpu_ctrl_command *cmd,
 198                               struct virtio_gpu_ctrl_hdr *resp,
 199                               size_t resp_len)
 200 {
 201     size_t s;
 202
 203     if (cmd->cmd_hdr.flags & VIRTIO_GPU_FLAG_FENCE) {
 204         resp->flags |= VIRTIO_GPU_FLAG_FENCE;
 205         resp->fence_id = cmd->cmd_hdr.fence_id;
 206         resp->ctx_id = cmd->cmd_hdr.ctx_id;
 207     }
 208     s = iov_from_buf(cmd->elem.in_sg, cmd->elem.in_num, 0, resp, resp_len);
 209     if (s != resp_len) {
 210         qemu_log_mask(LOG_GUEST_ERROR,
 211                       "%s: response size incorrect %zu vs %zu\n",
 212                       __func__, s, resp_len);
 213     }
 214     virtqueue_push(cmd->vq, &cmd->elem, s);
 215     virtio_notify(VIRTIO_DEVICE(g), cmd->vq);
 216     cmd->finished = true;
 217 }
 218
 219 void virtio_gpu_ctrl_response_nodata(VirtIOGPU *g,
 220                                      struct virtio_gpu_ctrl_command *cmd,
 221                                      enum virtio_gpu_ctrl_type type)
 222 {
 223     struct virtio_gpu_ctrl_hdr resp;
 224
 225     memset(&resp, 0, sizeof(resp));
 226     resp.type = type;
 227     virtio_gpu_ctrl_response(g, cmd, &resp, sizeof(resp));
 228 }
 229
 230 static void
 231 virtio_gpu_fill_display_info(VirtIOGPU *g,
 232                              struct virtio_gpu_resp_display_info *dpy_info)
 233 {
 234     int i;
 235
 236     for (i = 0; i < g->conf.max_outputs; i++) {
 237         if (g->enabled_output_bitmask & (1 << i)) {
 238             dpy_info->pmodes[i].enabled = 1;
 239             dpy_info->pmodes[i].r.width = g->req_state[i].width;
 240             dpy_info->pmodes[i].r.height = g->req_state[i].height;
 241         }
 242     }
 243 }
 244
 245 void virtio_gpu_get_display_info(VirtIOGPU *g,
 246                                  struct virtio_gpu_ctrl_command *cmd)
 247 {
 248     struct virtio_gpu_resp_display_info display_info;
 249
 250     trace_virtio_gpu_cmd_get_display_info();
 251     memset(&display_info, 0, sizeof(display_info));
 252     display_info.hdr.type = VIRTIO_GPU_RESP_OK_DISPLAY_INFO;
 253     virtio_gpu_fill_display_info(g, &display_info);
 254     virtio_gpu_ctrl_response(g, cmd, &display_info.hdr,
 255                              sizeof(display_info));
 256 }
 257
 258 static pixman_format_code_t get_pixman_format(uint32_t virtio_gpu_format)
 259 {
 260     switch (virtio_gpu_format) {
 261 #ifdef HOST_WORDS_BIGENDIAN
 262     case VIRTIO_GPU_FORMAT_B8G8R8X8_UNORM:
 263         return PIXMAN_b8g8r8x8;
 264     case VIRTIO_GPU_FORMAT_B8G8R8A8_UNORM:
 265         return PIXMAN_b8g8r8a8;
 266     case VIRTIO_GPU_FORMAT_X8R8G8B8_UNORM:
 267         return PIXMAN_x8r8g8b8;
 268     case VIRTIO_GPU_FORMAT_A8R8G8B8_UNORM:
 269         return PIXMAN_a8r8g8b8;
 270     case VIRTIO_GPU_FORMAT_R8G8B8X8_UNORM:
 271         return PIXMAN_r8g8b8x8;
 272     case VIRTIO_GPU_FORMAT_R8G8B8A8_UNORM:
 273         return PIXMAN_r8g8b8a8;
 274     case VIRTIO_GPU_FORMAT_X8B8G8R8_UNORM:
 275         return PIXMAN_x8b8g8r8;
 276     case VIRTIO_GPU_FORMAT_A8B8G8R8_UNORM:
 277         return PIXMAN_a8b8g8r8;
 278 #else
 279     case VIRTIO_GPU_FORMAT_B8G8R8X8_UNORM:
 280         return PIXMAN_x8r8g8b8;
 281     case VIRTIO_GPU_FORMAT_B8G8R8A8_UNORM:
 282         return PIXMAN_a8r8g8b8;
 283     case VIRTIO_GPU_FORMAT_X8R8G8B8_UNORM:
 284         return PIXMAN_b8g8r8x8;
 285     case VIRTIO_GPU_FORMAT_A8R8G8B8_UNORM:
 286         return PIXMAN_b8g8r8a8;
 287     case VIRTIO_GPU_FORMAT_R8G8B8X8_UNORM:
 288         return PIXMAN_x8b8g8r8;
 289     case VIRTIO_GPU_FORMAT_R8G8B8A8_UNORM:
 290         return PIXMAN_a8b8g8r8;
 291     case VIRTIO_GPU_FORMAT_X8B8G8R8_UNORM:
 292         return PIXMAN_r8g8b8x8;
 293     case VIRTIO_GPU_FORMAT_A8B8G8R8_UNORM:
 294         return PIXMAN_r8g8b8a8;
 295 #endif
 296     default:
 297         return 0;
 298     }
 299 }
 300
 301 static void virtio_gpu_resource_create_2d(VirtIOGPU *g,
 302                                           struct virtio_gpu_ctrl_command *cmd)
 303 {
 304     pixman_format_code_t pformat;
 305     struct virtio_gpu_simple_resource *res;
 306     struct virtio_gpu_resource_create_2d c2d;
 307
 308     VIRTIO_GPU_FILL_CMD(c2d);
 309     trace_virtio_gpu_cmd_res_create_2d(c2d.resource_id, c2d.format,
 310                                        c2d.width, c2d.height);
 311
 312     if (c2d.resource_id == 0) {
 313         qemu_log_mask(LOG_GUEST_ERROR, "%s: resource id 0 is not allowed\n",
 314                       __func__);
 315         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 316         return;
 317     }
 318
 319     res = virtio_gpu_find_resource(g, c2d.resource_id);
 320     if (res) {
 321         qemu_log_mask(LOG_GUEST_ERROR, "%s: resource already exists %d\n",
 322                       __func__, c2d.resource_id);
 323         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 324         return;
 325     }
 326
 327     res = g_new0(struct virtio_gpu_simple_resource, 1);
 328
 329     res->width = c2d.width;
 330     res->height = c2d.height;
 331     res->format = c2d.format;
 332     res->resource_id = c2d.resource_id;
 333
 334     pformat = get_pixman_format(c2d.format);
 335     if (!pformat) {
 336         qemu_log_mask(LOG_GUEST_ERROR,
 337                       "%s: host couldn't handle guest format %d\n",
 338                       __func__, c2d.format);
 339         g_free(res);
 340         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 341         return;
 342     }
 343
 344     res->hostmem = PIXMAN_FORMAT_BPP(pformat) * c2d.width * c2d.height;
 345     if (res->hostmem + g->hostmem < g->conf.max_hostmem) {
 346         res->image = pixman_image_create_bits(pformat,
 347                                               c2d.width,
 348                                               c2d.height,
 349                                               NULL, 0);
 350     }
 351
 352     if (!res->image) {
 353         qemu_log_mask(LOG_GUEST_ERROR,
 354                       "%s: resource creation failed %d %d %d\n",
 355                       __func__, c2d.resource_id, c2d.width, c2d.height);
 356         g_free(res);
 357         cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
 358         return;
 359     }
 360
 361     QTAILQ_INSERT_HEAD(&g->reslist, res, next);
 362     g->hostmem += res->hostmem;
 363 }
 364
 365 static void virtio_gpu_resource_destroy(VirtIOGPU *g,
 366                                         struct virtio_gpu_simple_resource *res)
 367 {
 368     pixman_image_unref(res->image);
 369     virtio_gpu_cleanup_mapping(res);
 370     QTAILQ_REMOVE(&g->reslist, res, next);
 371     g->hostmem -= res->hostmem;
 372     g_free(res);
 373 }
 374
 375 static void virtio_gpu_resource_unref(VirtIOGPU *g,
 376                                       struct virtio_gpu_ctrl_command *cmd)
 377 {
 378     struct virtio_gpu_simple_resource *res;
 379     struct virtio_gpu_resource_unref unref;
 380
 381     VIRTIO_GPU_FILL_CMD(unref);
 382     trace_virtio_gpu_cmd_res_unref(unref.resource_id);
 383
 384     res = virtio_gpu_find_resource(g, unref.resource_id);
 385     if (!res) {
 386         qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n",
 387                       __func__, unref.resource_id);
 388         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 389         return;
 390     }
 391     virtio_gpu_resource_destroy(g, res);
 392 }
 393
 394 static void virtio_gpu_transfer_to_host_2d(VirtIOGPU *g,
 395                                            struct virtio_gpu_ctrl_command *cmd)
 396 {
 397     struct virtio_gpu_simple_resource *res;
 398     int h;
 399     uint32_t src_offset, dst_offset, stride;
 400     int bpp;
 401     pixman_format_code_t format;
 402     struct virtio_gpu_transfer_to_host_2d t2d;
 403
 404     VIRTIO_GPU_FILL_CMD(t2d);
 405     trace_virtio_gpu_cmd_res_xfer_toh_2d(t2d.resource_id);
 406
 407     res = virtio_gpu_find_resource(g, t2d.resource_id);
 408     if (!res || !res->iov) {
 409         qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n",
 410                       __func__, t2d.resource_id);
 411         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 412         return;
 413     }
 414
 415     if (t2d.r.x > res->width ||
 416         t2d.r.y > res->height ||
 417         t2d.r.width > res->width ||
 418         t2d.r.height > res->height ||
 419         t2d.r.x + t2d.r.width > res->width ||
 420         t2d.r.y + t2d.r.height > res->height) {
 421         qemu_log_mask(LOG_GUEST_ERROR, "%s: transfer bounds outside resource"
 422                       " bounds for resource %d: %d %d %d %d vs %d %d\n",
 423                       __func__, t2d.resource_id, t2d.r.x, t2d.r.y,
 424                       t2d.r.width, t2d.r.height, res->width, res->height);
 425         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 426         return;
 427     }
 428
 429     format = pixman_image_get_format(res->image);
 430     bpp = (PIXMAN_FORMAT_BPP(format) + 7) / 8;
 431     stride = pixman_image_get_stride(res->image);
 432
 433     if (t2d.offset || t2d.r.x || t2d.r.y ||
 434         t2d.r.width != pixman_image_get_width(res->image)) {
 435         void *img_data = pixman_image_get_data(res->image);
 436         for (h = 0; h < t2d.r.height; h++) {
 437             src_offset = t2d.offset + stride * h;
 438             dst_offset = (t2d.r.y + h) * stride + (t2d.r.x * bpp);
 439
 440             iov_to_buf(res->iov, res->iov_cnt, src_offset,
 441                        (uint8_t *)img_data
 442                        + dst_offset, t2d.r.width * bpp);
 443         }
 444     } else {
 445         iov_to_buf(res->iov, res->iov_cnt, 0,
 446                    pixman_image_get_data(res->image),
 447                    pixman_image_get_stride(res->image)
 448                    * pixman_image_get_height(res->image));
 449     }
 450 }
 451
 452 static void virtio_gpu_resource_flush(VirtIOGPU *g,
 453                                       struct virtio_gpu_ctrl_command *cmd)
 454 {
 455     struct virtio_gpu_simple_resource *res;
 456     struct virtio_gpu_resource_flush rf;
 457     pixman_region16_t flush_region;
 458     int i;
 459
 460     VIRTIO_GPU_FILL_CMD(rf);
 461     trace_virtio_gpu_cmd_res_flush(rf.resource_id,
 462                                    rf.r.width, rf.r.height, rf.r.x, rf.r.y);
 463
 464     res = virtio_gpu_find_resource(g, rf.resource_id);
 465     if (!res) {
 466         qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n",
 467                       __func__, rf.resource_id);
 468         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 469         return;
 470     }
 471
 472     if (rf.r.x > res->width ||
 473         rf.r.y > res->height ||
 474         rf.r.width > res->width ||
 475         rf.r.height > res->height ||
 476         rf.r.x + rf.r.width > res->width ||
 477         rf.r.y + rf.r.height > res->height) {
 478         qemu_log_mask(LOG_GUEST_ERROR, "%s: flush bounds outside resource"
 479                       " bounds for resource %d: %d %d %d %d vs %d %d\n",
 480                       __func__, rf.resource_id, rf.r.x, rf.r.y,
 481                       rf.r.width, rf.r.height, res->width, res->height);
 482         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 483         return;
 484     }
 485
 486     pixman_region_init_rect(&flush_region,
 487                             rf.r.x, rf.r.y, rf.r.width, rf.r.height);
 488     for (i = 0; i < g->conf.max_outputs; i++) {
 489         struct virtio_gpu_scanout *scanout;
 490         pixman_region16_t region, finalregion;
 491         pixman_box16_t *extents;
 492
 493         if (!(res->scanout_bitmask & (1 << i))) {
 494             continue;
 495         }
 496         scanout = &g->scanout[i];
 497
 498         pixman_region_init(&finalregion);
 499         pixman_region_init_rect(&region, scanout->x, scanout->y,
 500                                 scanout->width, scanout->height);
 501
 502         pixman_region_intersect(&finalregion, &flush_region, &region);
 503         pixman_region_translate(&finalregion, -scanout->x, -scanout->y);
 504         extents = pixman_region_extents(&finalregion);
 505         /* work out the area we need to update for each console */
 506         dpy_gfx_update(g->scanout[i].con,
 507                        extents->x1, extents->y1,
 508                        extents->x2 - extents->x1,
 509                        extents->y2 - extents->y1);
 510
 511         pixman_region_fini(&region);
 512         pixman_region_fini(&finalregion);
 513     }
 514     pixman_region_fini(&flush_region);
 515 }
 516
 517 static void virtio_unref_resource(pixman_image_t *image, void *data)
 518 {
 519     pixman_image_unref(data);
 520 }
 521
 522 static void virtio_gpu_set_scanout(VirtIOGPU *g,
 523                                    struct virtio_gpu_ctrl_command *cmd)
 524 {
 525     struct virtio_gpu_simple_resource *res;
 526     struct virtio_gpu_scanout *scanout;
 527     pixman_format_code_t format;
 528     uint32_t offset;
 529     int bpp;
 530     struct virtio_gpu_set_scanout ss;
 531
 532     VIRTIO_GPU_FILL_CMD(ss);
 533     trace_virtio_gpu_cmd_set_scanout(ss.scanout_id, ss.resource_id,
 534                                      ss.r.width, ss.r.height, ss.r.x, ss.r.y);
 535
 536     if (ss.scanout_id >= g->conf.max_outputs) {
 537         qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d",
 538                       __func__, ss.scanout_id);
 539         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID;
 540         return;
 541     }
 542
 543     g->enable = 1;
 544     if (ss.resource_id == 0) {
 545         scanout = &g->scanout[ss.scanout_id];
 546         if (scanout->resource_id) {
 547             res = virtio_gpu_find_resource(g, scanout->resource_id);
 548             if (res) {
 549                 res->scanout_bitmask &= ~(1 << ss.scanout_id);
 550             }
 551         }
 552         if (ss.scanout_id == 0) {
 553             qemu_log_mask(LOG_GUEST_ERROR,
 554                           "%s: illegal scanout id specified %d",
 555                           __func__, ss.scanout_id);
 556             cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID;
 557             return;
 558         }
 559         dpy_gfx_replace_surface(g->scanout[ss.scanout_id].con, NULL);
 560         scanout->ds = NULL;
 561         scanout->width = 0;
 562         scanout->height = 0;
 563         return;
 564     }
 565
 566     /* create a surface for this scanout */
 567     res = virtio_gpu_find_resource(g, ss.resource_id);
 568     if (!res) {
 569         qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n",
 570                       __func__, ss.resource_id);
 571         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 572         return;
 573     }
 574
 575     if (ss.r.x > res->width ||
 576         ss.r.y > res->height ||
 577         ss.r.width > res->width ||
 578         ss.r.height > res->height ||
 579         ss.r.x + ss.r.width > res->width ||
 580         ss.r.y + ss.r.height > res->height) {
 581         qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout %d bounds for"
 582                       " resource %d, (%d,%d)+%d,%d vs %d %d\n",
 583                       __func__, ss.scanout_id, ss.resource_id, ss.r.x, ss.r.y,
 584                       ss.r.width, ss.r.height, res->width, res->height);
 585         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
 586         return;
 587     }
 588
 589     scanout = &g->scanout[ss.scanout_id];
 590
 591     format = pixman_image_get_format(res->image);
 592     bpp = (PIXMAN_FORMAT_BPP(format) + 7) / 8;
 593     offset = (ss.r.x * bpp) + ss.r.y * pixman_image_get_stride(res->image);
 594     if (!scanout->ds || surface_data(scanout->ds)
 595         != ((uint8_t *)pixman_image_get_data(res->image) + offset) ||
 596         scanout->width != ss.r.width ||
 597         scanout->height != ss.r.height) {
 598         pixman_image_t *rect;
 599         void *ptr = (uint8_t *)pixman_image_get_data(res->image) + offset;
 600         rect = pixman_image_create_bits(format, ss.r.width, ss.r.height, ptr,
 601                                         pixman_image_get_stride(res->image));
 602         pixman_image_ref(res->image);
 603         pixman_image_set_destroy_function(rect, virtio_unref_resource,
 604                                           res->image);
 605         /* realloc the surface ptr */
 606         scanout->ds = qemu_create_displaysurface_pixman(rect);
 607         if (!scanout->ds) {
 608             cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
 609             return;
 610         }
 611         pixman_image_unref(rect);
 612         dpy_gfx_replace_surface(g->scanout[ss.scanout_id].con, scanout->ds);
 613     }
 614
 615     res->scanout_bitmask |= (1 << ss.scanout_id);
 616     scanout->resource_id = ss.resource_id;
 617     scanout->x = ss.r.x;
 618     scanout->y = ss.r.y;
 619     scanout->width = ss.r.width;
 620     scanout->height = ss.r.height;
 621 }
 622
 623 int virtio_gpu_create_mapping_iov(struct virtio_gpu_resource_attach_backing *ab,
 624                                   struct virtio_gpu_ctrl_command *cmd,
 625                                   uint64_t **addr, struct iovec **iov)
 626 {
 627     struct virtio_gpu_mem_entry *ents;
 628     size_t esize, s;
 629     int i;
 630
 631     if (ab->nr_entries > 16384) {
 632         qemu_log_mask(LOG_GUEST_ERROR,
 633                       "%s: nr_entries is too big (%d > 16384)\n",
 634                       __func__, ab->nr_entries);
 635         return -1;
 636     }
 637
 638     esize = sizeof(*ents) * ab->nr_entries;
 639     ents = g_malloc(esize);
 640     s = iov_to_buf(cmd->elem.out_sg, cmd->elem.out_num,
 641                    sizeof(*ab), ents, esize);
 642     if (s != esize) {
 643         qemu_log_mask(LOG_GUEST_ERROR,
 644                       "%s: command data size incorrect %zu vs %zu\n",
 645                       __func__, s, esize);
 646         g_free(ents);
 647         return -1;
 648     }
 649
 650     *iov = g_malloc0(sizeof(struct iovec) * ab->nr_entries);
 651     if (addr) {
 652         *addr = g_malloc0(sizeof(uint64_t) * ab->nr_entries);
 653     }
 654     for (i = 0; i < ab->nr_entries; i++) {
 655         hwaddr len = ents[i].length;
 656         (*iov)[i].iov_len = ents[i].length;
 657         (*iov)[i].iov_base = cpu_physical_memory_map(ents[i].addr, &len, 1);
 658         if (addr) {
 659             (*addr)[i] = ents[i].addr;
 660         }
 661         if (!(*iov)[i].iov_base || len != ents[i].length) {
 662             qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to map MMIO memory for"
 663                           " resource %d element %d\n",
 664                           __func__, ab->resource_id, i);
 665             virtio_gpu_cleanup_mapping_iov(*iov, i);
 666             g_free(ents);
 667             *iov = NULL;
 668             if (addr) {
 669                 g_free(*addr);
 670                 *addr = NULL;
 671             }
 672             return -1;
 673         }
 674     }
 675     g_free(ents);
 676     return 0;
 677 }
 678
 679 void virtio_gpu_cleanup_mapping_iov(struct iovec *iov, uint32_t count)
 680 {
 681     int i;
 682
 683     for (i = 0; i < count; i++) {
 684         cpu_physical_memory_unmap(iov[i].iov_base, iov[i].iov_len, 1,
 685                                   iov[i].iov_len);
 686     }
 687     g_free(iov);
 688 }
 689
 690 static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res)
 691 {
 692     virtio_gpu_cleanup_mapping_iov(res->iov, res->iov_cnt);
 693     res->iov = NULL;
 694     res->iov_cnt = 0;
 695     g_free(res->addrs);
 696     res->addrs = NULL;
 697 }
 698
 699 static void
 700 virtio_gpu_resource_attach_backing(VirtIOGPU *g,
 701                                    struct virtio_gpu_ctrl_command *cmd)
 702 {
 703     struct virtio_gpu_simple_resource *res;
 704     struct virtio_gpu_resource_attach_backing ab;
 705     int ret;
 706
 707     VIRTIO_GPU_FILL_CMD(ab);
 708     trace_virtio_gpu_cmd_res_back_attach(ab.resource_id);
 709
 710     res = virtio_gpu_find_resource(g, ab.resource_id);
 711     if (!res) {
 712         qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n",
 713                       __func__, ab.resource_id);
 714         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 715         return;
 716     }
 717
 718     if (res->iov) {
 719         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
 720         return;
 721     }
 722
 723     ret = virtio_gpu_create_mapping_iov(&ab, cmd, &res->addrs, &res->iov);
 724     if (ret != 0) {
 725         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
 726         return;
 727     }
 728
 729     res->iov_cnt = ab.nr_entries;
 730 }
 731
 732 static void
 733 virtio_gpu_resource_detach_backing(VirtIOGPU *g,
 734                                    struct virtio_gpu_ctrl_command *cmd)
 735 {
 736     struct virtio_gpu_simple_resource *res;
 737     struct virtio_gpu_resource_detach_backing detach;
 738
 739     VIRTIO_GPU_FILL_CMD(detach);
 740     trace_virtio_gpu_cmd_res_back_detach(detach.resource_id);
 741
 742     res = virtio_gpu_find_resource(g, detach.resource_id);
 743     if (!res || !res->iov) {
 744         qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal resource specified %d\n",
 745                       __func__, detach.resource_id);
 746         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
 747         return;
 748     }
 749     virtio_gpu_cleanup_mapping(res);
 750 }
 751
 752 static void virtio_gpu_simple_process_cmd(VirtIOGPU *g,
 753                                           struct virtio_gpu_ctrl_command *cmd)
 754 {
 755     VIRTIO_GPU_FILL_CMD(cmd->cmd_hdr);
 756
 757     switch (cmd->cmd_hdr.type) {
 758     case VIRTIO_GPU_CMD_GET_DISPLAY_INFO:
 759         virtio_gpu_get_display_info(g, cmd);
 760         break;
 761     case VIRTIO_GPU_CMD_RESOURCE_CREATE_2D:
 762         virtio_gpu_resource_create_2d(g, cmd);
 763         break;
 764     case VIRTIO_GPU_CMD_RESOURCE_UNREF:
 765         virtio_gpu_resource_unref(g, cmd);
 766         break;
 767     case VIRTIO_GPU_CMD_RESOURCE_FLUSH:
 768         virtio_gpu_resource_flush(g, cmd);
 769         break;
 770     case VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D:
 771         virtio_gpu_transfer_to_host_2d(g, cmd);
 772         break;
 773     case VIRTIO_GPU_CMD_SET_SCANOUT:
 774         virtio_gpu_set_scanout(g, cmd);
 775         break;
 776     case VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING:
 777         virtio_gpu_resource_attach_backing(g, cmd);
 778         break;
 779     case VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING:
 780         virtio_gpu_resource_detach_backing(g, cmd);
 781         break;
 782     default:
 783         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
 784         break;
 785     }
 786     if (!cmd->finished) {
 787         virtio_gpu_ctrl_response_nodata(g, cmd, cmd->error ? cmd->error :
 788                                         VIRTIO_GPU_RESP_OK_NODATA);
 789     }
 790 }
 791
 792 static void virtio_gpu_handle_ctrl_cb(VirtIODevice *vdev, VirtQueue *vq)
 793 {
 794     VirtIOGPU *g = VIRTIO_GPU(vdev);
 795     qemu_bh_schedule(g->ctrl_bh);
 796 }
 797
 798 static void virtio_gpu_handle_cursor_cb(VirtIODevice *vdev, VirtQueue *vq)
 799 {
 800     VirtIOGPU *g = VIRTIO_GPU(vdev);
 801     qemu_bh_schedule(g->cursor_bh);
 802 }
 803
 804 void virtio_gpu_process_cmdq(VirtIOGPU *g)
 805 {
 806     struct virtio_gpu_ctrl_command *cmd;
 807
 808     while (!QTAILQ_EMPTY(&g->cmdq)) {
 809         cmd = QTAILQ_FIRST(&g->cmdq);
 810
 811         /* process command */
 812         VIRGL(g, virtio_gpu_virgl_process_cmd, virtio_gpu_simple_process_cmd,
 813               g, cmd);
 814         if (cmd->waiting) {
 815             break;
 816         }
 817         QTAILQ_REMOVE(&g->cmdq, cmd, next);
 818         if (virtio_gpu_stats_enabled(g->conf)) {
 819             g->stats.requests++;
 820         }
 821
 822         if (!cmd->finished) {
 823             QTAILQ_INSERT_TAIL(&g->fenceq, cmd, next);
 824             g->inflight++;
 825             if (virtio_gpu_stats_enabled(g->conf)) {
 826                 if (g->stats.max_inflight < g->inflight) {
 827                     g->stats.max_inflight = g->inflight;
 828                 }
 829                 fprintf(stderr, "inflight: %3d (+)\r", g->inflight);
 830             }
 831         } else {
 832             g_free(cmd);
 833         }
 834     }
 835 }
 836
 837 static void virtio_gpu_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
 838 {
 839     VirtIOGPU *g = VIRTIO_GPU(vdev);
 840     struct virtio_gpu_ctrl_command *cmd;
 841
 842     if (!virtio_queue_ready(vq)) {
 843         return;
 844     }
 845
 846 #ifdef CONFIG_VIRGL
 847     if (!g->renderer_inited && g->use_virgl_renderer) {
 848         virtio_gpu_virgl_init(g);
 849         g->renderer_inited = true;
 850     }
 851 #endif
 852
 853     cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command));
 854     while (cmd) {
 855         cmd->vq = vq;
 856         cmd->error = 0;
 857         cmd->finished = false;
 858         cmd->waiting = false;
 859         QTAILQ_INSERT_TAIL(&g->cmdq, cmd, next);
 860         cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command));
 861     }
 862
 863     virtio_gpu_process_cmdq(g);
 864
 865 #ifdef CONFIG_VIRGL
 866     if (g->use_virgl_renderer) {
 867         virtio_gpu_virgl_fence_poll(g);
 868     }
 869 #endif
 870 }
 871
 872 static void virtio_gpu_ctrl_bh(void *opaque)
 873 {
 874     VirtIOGPU *g = opaque;
 875     virtio_gpu_handle_ctrl(&g->parent_obj, g->ctrl_vq);
 876 }
 877
 878 static void virtio_gpu_handle_cursor(VirtIODevice *vdev, VirtQueue *vq)
 879 {
 880     VirtIOGPU *g = VIRTIO_GPU(vdev);
 881     VirtQueueElement *elem;
 882     size_t s;
 883     struct virtio_gpu_update_cursor cursor_info;
 884
 885     if (!virtio_queue_ready(vq)) {
 886         return;
 887     }
 888     for (;;) {
 889         elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
 890         if (!elem) {
 891             break;
 892         }
 893
 894         s = iov_to_buf(elem->out_sg, elem->out_num, 0,
 895                        &cursor_info, sizeof(cursor_info));
 896         if (s != sizeof(cursor_info)) {
 897             qemu_log_mask(LOG_GUEST_ERROR,
 898                           "%s: cursor size incorrect %zu vs %zu\n",
 899                           __func__, s, sizeof(cursor_info));
 900         } else {
 901             update_cursor(g, &cursor_info);
 902         }
 903         virtqueue_push(vq, elem, 0);
 904         virtio_notify(vdev, vq);
 905         g_free(elem);
 906     }
 907 }
 908
 909 static void virtio_gpu_cursor_bh(void *opaque)
 910 {
 911     VirtIOGPU *g = opaque;
 912     virtio_gpu_handle_cursor(&g->parent_obj, g->cursor_vq);
 913 }
 914
 915 static void virtio_gpu_invalidate_display(void *opaque)
 916 {
 917 }
 918
 919 static void virtio_gpu_update_display(void *opaque)
 920 {
 921 }
 922
 923 static void virtio_gpu_text_update(void *opaque, console_ch_t *chardata)
 924 {
 925 }
 926
 927 static int virtio_gpu_ui_info(void *opaque, uint32_t idx, QemuUIInfo *info)
 928 {
 929     VirtIOGPU *g = opaque;
 930
 931     if (idx >= g->conf.max_outputs) {
 932         return -1;
 933     }
 934
 935     g->req_state[idx].x = info->xoff;
 936     g->req_state[idx].y = info->yoff;
 937     g->req_state[idx].width = info->width;
 938     g->req_state[idx].height = info->height;
 939
 940     if (info->width && info->height) {
 941         g->enabled_output_bitmask |= (1 << idx);
 942     } else {
 943         g->enabled_output_bitmask &= ~(1 << idx);
 944     }
 945
 946     /* send event to guest */
 947     virtio_gpu_notify_event(g, VIRTIO_GPU_EVENT_DISPLAY);
 948     return 0;
 949 }
 950
 951 static void virtio_gpu_gl_block(void *opaque, bool block)
 952 {
 953     VirtIOGPU *g = opaque;
 954
 955     if (block) {
 956         g->renderer_blocked++;
 957     } else {
 958         g->renderer_blocked--;
 959     }
 960     assert(g->renderer_blocked >= 0);
 961
 962     if (g->renderer_blocked == 0) {
 963         virtio_gpu_process_cmdq(g);
 964     }
 965 }
 966
 967 const GraphicHwOps virtio_gpu_ops = {
 968     .invalidate = virtio_gpu_invalidate_display,
 969     .gfx_update = virtio_gpu_update_display,
 970     .text_update = virtio_gpu_text_update,
 971     .ui_info = virtio_gpu_ui_info,
 972     .gl_block = virtio_gpu_gl_block,
 973 };
 974
 975 static const VMStateDescription vmstate_virtio_gpu_scanout = {
 976     .name = "virtio-gpu-one-scanout",
 977     .version_id = 1,
 978     .fields = (VMStateField[]) {
 979         VMSTATE_UINT32(resource_id, struct virtio_gpu_scanout),
 980         VMSTATE_UINT32(width, struct virtio_gpu_scanout),
 981         VMSTATE_UINT32(height, struct virtio_gpu_scanout),
 982         VMSTATE_INT32(x, struct virtio_gpu_scanout),
 983         VMSTATE_INT32(y, struct virtio_gpu_scanout),
 984         VMSTATE_UINT32(cursor.resource_id, struct virtio_gpu_scanout),
 985         VMSTATE_UINT32(cursor.hot_x, struct virtio_gpu_scanout),
 986         VMSTATE_UINT32(cursor.hot_y, struct virtio_gpu_scanout),
 987         VMSTATE_UINT32(cursor.pos.x, struct virtio_gpu_scanout),
 988         VMSTATE_UINT32(cursor.pos.y, struct virtio_gpu_scanout),
 989         VMSTATE_END_OF_LIST()
 990     },
 991 };
 992
 993 static const VMStateDescription vmstate_virtio_gpu_scanouts = {
 994     .name = "virtio-gpu-scanouts",
 995     .version_id = 1,
 996     .fields = (VMStateField[]) {
 997         VMSTATE_INT32(enable, struct VirtIOGPU),
 998         VMSTATE_UINT32_EQUAL(conf.max_outputs, struct VirtIOGPU),
 999         VMSTATE_STRUCT_VARRAY_UINT32(scanout, struct VirtIOGPU,
1000                                      conf.max_outputs, 1,
1001                                      vmstate_virtio_gpu_scanout,
1002                                      struct virtio_gpu_scanout),
1003         VMSTATE_END_OF_LIST()
1004     },
1005 };
1006
1007 static int virtio_gpu_save(QEMUFile *f, void *opaque, size_t size,
1008                            VMStateField *field, QJSON *vmdesc)
1009 {
1010     VirtIOGPU *g = opaque;
1011     struct virtio_gpu_simple_resource *res;
1012     int i;
1013
1014     /* in 2d mode we should never find unprocessed commands here */
1015     assert(QTAILQ_EMPTY(&g->cmdq));
1016
1017     QTAILQ_FOREACH(res, &g->reslist, next) {
1018         qemu_put_be32(f, res->resource_id);
1019         qemu_put_be32(f, res->width);
1020         qemu_put_be32(f, res->height);
1021         qemu_put_be32(f, res->format);
1022         qemu_put_be32(f, res->iov_cnt);
1023         for (i = 0; i < res->iov_cnt; i++) {
1024             qemu_put_be64(f, res->addrs[i]);
1025             qemu_put_be32(f, res->iov[i].iov_len);
1026         }
1027         qemu_put_buffer(f, (void *)pixman_image_get_data(res->image),
1028                         pixman_image_get_stride(res->image) * res->height);
1029     }
1030     qemu_put_be32(f, 0); /* end of list */
1031
1032     vmstate_save_state(f, &vmstate_virtio_gpu_scanouts, g, NULL);
1033
1034     return 0;
1035 }
1036
1037 static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
1038                            VMStateField *field)
1039 {
1040     VirtIOGPU *g = opaque;
1041     struct virtio_gpu_simple_resource *res;
1042     struct virtio_gpu_scanout *scanout;
1043     uint32_t resource_id, pformat;
1044     int i;
1045
1046     g->hostmem = 0;
1047
1048     resource_id = qemu_get_be32(f);
1049     while (resource_id != 0) {
1050         res = g_new0(struct virtio_gpu_simple_resource, 1);
1051         res->resource_id = resource_id;
1052         res->width = qemu_get_be32(f);
1053         res->height = qemu_get_be32(f);
1054         res->format = qemu_get_be32(f);
1055         res->iov_cnt = qemu_get_be32(f);
1056
1057         /* allocate */
1058         pformat = get_pixman_format(res->format);
1059         if (!pformat) {
1060             g_free(res);
1061             return -EINVAL;
1062         }
1063         res->image = pixman_image_create_bits(pformat,
1064                                               res->width, res->height,
1065                                               NULL, 0);
1066         if (!res->image) {
1067             g_free(res);
1068             return -EINVAL;
1069         }
1070
1071         res->hostmem = PIXMAN_FORMAT_BPP(pformat) * res->width * res->height;
1072
1073         res->addrs = g_new(uint64_t, res->iov_cnt);
1074         res->iov = g_new(struct iovec, res->iov_cnt);
1075
1076         /* read data */
1077         for (i = 0; i < res->iov_cnt; i++) {
1078             res->addrs[i] = qemu_get_be64(f);
1079             res->iov[i].iov_len = qemu_get_be32(f);
1080         }
1081         qemu_get_buffer(f, (void *)pixman_image_get_data(res->image),
1082                         pixman_image_get_stride(res->image) * res->height);
1083
1084         /* restore mapping */
1085         for (i = 0; i < res->iov_cnt; i++) {
1086             hwaddr len = res->iov[i].iov_len;
1087             res->iov[i].iov_base =
1088                 cpu_physical_memory_map(res->addrs[i], &len, 1);
1089             if (!res->iov[i].iov_base || len != res->iov[i].iov_len) {
1090                 /* Clean up the half-a-mapping we just created... */
1091                 if (res->iov[i].iov_base) {
1092                     cpu_physical_memory_unmap(res->iov[i].iov_base,
1093                                               len, 0, 0);
1094                 }
1095                 /* ...and the mappings for previous loop iterations */
1096                 res->iov_cnt = i;
1097                 virtio_gpu_cleanup_mapping(res);
1098                 pixman_image_unref(res->image);
1099                 g_free(res);
1100                 return -EINVAL;
1101             }
1102         }
1103
1104         QTAILQ_INSERT_HEAD(&g->reslist, res, next);
1105         g->hostmem += res->hostmem;
1106
1107         resource_id = qemu_get_be32(f);
1108     }
1109
1110     /* load & apply scanout state */
1111     vmstate_load_state(f, &vmstate_virtio_gpu_scanouts, g, 1);
1112     for (i = 0; i < g->conf.max_outputs; i++) {
1113         scanout = &g->scanout[i];
1114         if (!scanout->resource_id) {
1115             continue;
1116         }
1117         res = virtio_gpu_find_resource(g, scanout->resource_id);
1118         if (!res) {
1119             return -EINVAL;
1120         }
1121         scanout->ds = qemu_create_displaysurface_pixman(res->image);
1122         if (!scanout->ds) {
1123             return -EINVAL;
1124         }
1125
1126         dpy_gfx_replace_surface(scanout->con, scanout->ds);
1127         dpy_gfx_update(scanout->con, 0, 0, scanout->width, scanout->height);
1128         update_cursor(g, &scanout->cursor);
1129         res->scanout_bitmask |= (1 << i);
1130     }
1131
1132     return 0;
1133 }
1134
1135 static void virtio_gpu_device_realize(DeviceState *qdev, Error **errp)
1136 {
1137     VirtIODevice *vdev = VIRTIO_DEVICE(qdev);
1138     VirtIOGPU *g = VIRTIO_GPU(qdev);
1139     bool have_virgl;
1140     Error *local_err = NULL;
1141     int i;
1142
1143     if (g->conf.max_outputs > VIRTIO_GPU_MAX_SCANOUTS) {
1144         error_setg(errp, "invalid max_outputs > %d", VIRTIO_GPU_MAX_SCANOUTS);
1145         return;
1146     }
1147
1148     g->use_virgl_renderer = false;
1149 #if !defined(CONFIG_VIRGL) || defined(HOST_WORDS_BIGENDIAN)
1150     have_virgl = false;
1151 #else
1152     have_virgl = display_opengl;
1153 #endif
1154     if (!have_virgl) {
1155         g->conf.flags &= ~(1 << VIRTIO_GPU_FLAG_VIRGL_ENABLED);
1156     }
1157
1158     if (virtio_gpu_virgl_enabled(g->conf)) {
1159         error_setg(&g->migration_blocker, "virgl is not yet migratable");
1160         migrate_add_blocker(g->migration_blocker, &local_err);
1161         if (local_err) {
1162             error_propagate(errp, local_err);
1163             error_free(g->migration_blocker);
1164             return;
1165         }
1166     }
1167
1168     g->config_size = sizeof(struct virtio_gpu_config);
1169     g->virtio_config.num_scanouts = g->conf.max_outputs;
1170     virtio_init(VIRTIO_DEVICE(g), "virtio-gpu", VIRTIO_ID_GPU,
1171                 g->config_size);
1172
1173     g->req_state[0].width = 1024;
1174     g->req_state[0].height = 768;
1175
1176     if (virtio_gpu_virgl_enabled(g->conf)) {
1177         /* use larger control queue in 3d mode */
1178         g->ctrl_vq   = virtio_add_queue(vdev, 256, virtio_gpu_handle_ctrl_cb);
1179         g->cursor_vq = virtio_add_queue(vdev, 16, virtio_gpu_handle_cursor_cb);
1180         g->virtio_config.num_capsets = 1;
1181     } else {
1182         g->ctrl_vq   = virtio_add_queue(vdev, 64, virtio_gpu_handle_ctrl_cb);
1183         g->cursor_vq = virtio_add_queue(vdev, 16, virtio_gpu_handle_cursor_cb);
1184     }
1185
1186     g->ctrl_bh = qemu_bh_new(virtio_gpu_ctrl_bh, g);
1187     g->cursor_bh = qemu_bh_new(virtio_gpu_cursor_bh, g);
1188     QTAILQ_INIT(&g->reslist);
1189     QTAILQ_INIT(&g->cmdq);
1190     QTAILQ_INIT(&g->fenceq);
1191
1192     g->enabled_output_bitmask = 1;
1193     g->qdev = qdev;
1194
1195     for (i = 0; i < g->conf.max_outputs; i++) {
1196         g->scanout[i].con =
1197             graphic_console_init(DEVICE(g), i, &virtio_gpu_ops, g);
1198         if (i > 0) {
1199             dpy_gfx_replace_surface(g->scanout[i].con, NULL);
1200         }
1201     }
1202 }
1203
1204 static void virtio_gpu_device_unrealize(DeviceState *qdev, Error **errp)
1205 {
1206     VirtIOGPU *g = VIRTIO_GPU(qdev);
1207     if (g->migration_blocker) {
1208         migrate_del_blocker(g->migration_blocker);
1209         error_free(g->migration_blocker);
1210     }
1211 }
1212
1213 static void virtio_gpu_instance_init(Object *obj)
1214 {
1215 }
1216
1217 static void virtio_gpu_reset(VirtIODevice *vdev)
1218 {
1219     VirtIOGPU *g = VIRTIO_GPU(vdev);
1220     struct virtio_gpu_simple_resource *res, *tmp;
1221     int i;
1222
1223     g->enable = 0;
1224
1225     QTAILQ_FOREACH_SAFE(res, &g->reslist, next, tmp) {
1226         virtio_gpu_resource_destroy(g, res);
1227     }
1228     for (i = 0; i < g->conf.max_outputs; i++) {
1229 #if 0
1230         g->req_state[i].x = 0;
1231         g->req_state[i].y = 0;
1232         if (i == 0) {
1233             g->req_state[0].width = 1024;
1234             g->req_state[0].height = 768;
1235         } else {
1236             g->req_state[i].width = 0;
1237             g->req_state[i].height = 0;
1238         }
1239 #endif
1240         g->scanout[i].resource_id = 0;
1241         g->scanout[i].width = 0;
1242         g->scanout[i].height = 0;
1243         g->scanout[i].x = 0;
1244         g->scanout[i].y = 0;
1245         g->scanout[i].ds = NULL;
1246     }
1247     g->enabled_output_bitmask = 1;
1248
1249 #ifdef CONFIG_VIRGL
1250     if (g->use_virgl_renderer) {
1251         virtio_gpu_virgl_reset(g);
1252         g->use_virgl_renderer = 0;
1253     }
1254 #endif
1255 }
1256
1257 /*
1258  * For historical reasons virtio_gpu does not adhere to virtio migration
1259  * scheme as described in doc/virtio-migration.txt, in a sense that no
1260  * save/load callback are provided to the core. Instead the device data
1261  * is saved/loaded after the core data.
1262  *
1263  * Because of this we need a special vmsd.
1264  */
1265 static const VMStateDescription vmstate_virtio_gpu = {
1266     .name = "virtio-gpu",
1267     .minimum_version_id = VIRTIO_GPU_VM_VERSION,
1268     .version_id = VIRTIO_GPU_VM_VERSION,
1269     .fields = (VMStateField[]) {
1270         VMSTATE_VIRTIO_DEVICE /* core */,
1271         {
1272             .name = "virtio-gpu",
1273             .info = &(const VMStateInfo) {
1274                         .name = "virtio-gpu",
1275                         .get = virtio_gpu_load,
1276                         .put = virtio_gpu_save,
1277             },
1278             .flags = VMS_SINGLE,
1279         } /* device */,
1280         VMSTATE_END_OF_LIST()
1281     },
1282 };
1283
1284 static Property virtio_gpu_properties[] = {
1285     DEFINE_PROP_UINT32("max_outputs", VirtIOGPU, conf.max_outputs, 1),
1286     DEFINE_PROP_SIZE("max_hostmem", VirtIOGPU, conf.max_hostmem,
1287                      256 * 1024 * 1024),
1288 #ifdef CONFIG_VIRGL
1289     DEFINE_PROP_BIT("virgl", VirtIOGPU, conf.flags,
1290                     VIRTIO_GPU_FLAG_VIRGL_ENABLED, true),
1291     DEFINE_PROP_BIT("stats", VirtIOGPU, conf.flags,
1292                     VIRTIO_GPU_FLAG_STATS_ENABLED, false),
1293 #endif
1294     DEFINE_PROP_END_OF_LIST(),
1295 };
1296
1297 static void virtio_gpu_class_init(ObjectClass *klass, void *data)
1298 {
1299     DeviceClass *dc = DEVICE_CLASS(klass);
1300     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
1301
1302     vdc->realize = virtio_gpu_device_realize;
1303     vdc->unrealize = virtio_gpu_device_unrealize;
1304     vdc->get_config = virtio_gpu_get_config;
1305     vdc->set_config = virtio_gpu_set_config;
1306     vdc->get_features = virtio_gpu_get_features;
1307     vdc->set_features = virtio_gpu_set_features;
1308
1309     vdc->reset = virtio_gpu_reset;
1310
1311     dc->props = virtio_gpu_properties;
1312     dc->vmsd = &vmstate_virtio_gpu;
1313     dc->hotpluggable = false;
1314 }
1315
1316 static const TypeInfo virtio_gpu_info = {
1317     .name = TYPE_VIRTIO_GPU,
1318     .parent = TYPE_VIRTIO_DEVICE,
1319     .instance_size = sizeof(VirtIOGPU),
1320     .instance_init = virtio_gpu_instance_init,
1321     .class_init = virtio_gpu_class_init,
1322 };
1323
1324 static void virtio_register_types(void)
1325 {
1326     type_register_static(&virtio_gpu_info);
1327 }
1328
1329 type_init(virtio_register_types)
1330
1331 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_ctrl_hdr)                != 24);
1332 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_update_cursor)           != 56);
1333 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_resource_unref)          != 32);
1334 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_resource_create_2d)      != 40);
1335 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_set_scanout)             != 48);
1336 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_resource_flush)          != 48);
1337 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_transfer_to_host_2d)     != 56);
1338 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_mem_entry)               != 16);
1339 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_resource_attach_backing) != 32);
1340 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_resource_detach_backing) != 32);
1341 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_resp_display_info)       != 408);
1342
1343 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_transfer_host_3d)        != 72);
1344 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_resource_create_3d)      != 72);
1345 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_ctx_create)              != 96);
1346 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_ctx_destroy)             != 24);
1347 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_ctx_resource)            != 32);
1348 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_cmd_submit)              != 32);
1349 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_get_capset_info)         != 32);
1350 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_resp_capset_info)        != 40);
1351 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_get_capset)              != 32);
1352 QEMU_BUILD_BUG_ON(sizeof(struct virtio_gpu_resp_capset)             != 24);