[PATCH v4 2/8] drm/atomic: Add support for mouse hotspots

[Pekka Paalanen]

On Wed, 5 Jul 2023 09:08:07 -0700
Michael Banack <banackm at vmware.com> wrote:

> On 7/4/23 01:08, Pekka Paalanen wrote:
> > On Mon, 3 Jul 2023 14:06:56 -0700
> > Michael Banack <banackm at vmware.com> wrote:
> >  
> >> Hi, I can speak to the virtual mouse/console half of this from the
> >> VMware-side.
> >>
> >> I believe Zack's preparing a new set of comments here that can speak to
> >> most of your concerns, but I'll answer some of the other questions directly.
> >>
> >> On 6/29/23 01:03, Pekka Paalanen wrote:  
> >>> Is it really required that the hotspot coordinates fall inside the
> >>> cursor plane? Will the atomic commit be rejected otherwise?  
> >> Most console systems require the hotspot to get within the cursor image,
> >> but in theory it's semantically meaningful to have it extend outside the
> >> image.
> >>
> >> VMware's clients in particular will clamp the hotspot to the dimension
> >> of the cursor image if we receive one that's out of bounds.
> >>
> >> So I would assume the right thing to do here would be to allow it and
> >> let the clients figure out how to best handle it.  
> > Hi,
> >
> > if it is normal that clients clamp the hotspot to inside the cursor
> > image, then I would come to the opposite conclusion: KMS UAPI needs to
> > require the hotspot to be within the cursor image. Otherwise the
> > results would be unpredictable, if clients still continue to clamp it
> > anyway. I would assume that clients in use today are not prepared to
> > handle hotspot outside the cursor image.
> >
> > It is also not a big deal to require that. I think it would be very rare
> > to not have hotspot inside the cursor image, and even if it happened,
> > the only consequence would be that the guest display server falls back
> > to rendered cursor instead of a cursor plane. That may happen any time
> > anyway, if an application sets e.g. a huge cursor that exceeds cursor
> > plane size limits.  
> Hypervisors are normally more privileged than the kernel, so any 
> hypervisor/remoting client here really should be dealing with this case 
> rather than trusting the kernel to handle it for them.

Sorry, handle what? Trust the guest kernel to do what?

Personally I'm only interested in the KMS UAPI the guest kernel offers
to guest userspace, and requiring hotspot to be inside the cursor image
is fine. I don't think it needs even a strong justification, it's what
most would likely expect, and expectations are good to record in spec.

The UAPI contract is between (guest) kernel and (guest) userspace, and
I expect the kernel to fully enforce that towards the userspace.

I understand that hypervisors cannot trust guest kernels for security,
but I also think that's a different matter.

>  From that perspective, we would normally try to preserve the 
> application/guest semantics as much as possible, and then that gives us 
> the ability to deal with this on the hypervisor side if it turns out 
> that there's a critical case with the hotspot outside the image that we 
> need to handle.
> 
> But that said, while I've seen real Guests do this in the past, I don't 
> recall seeing this from any modern operating systems, so I don't think 
> it's a big deal for us either way.
> 
> >
> > What I'm after with the question is that the requirement must be spelled
> > out clearly if it is there, or not even hinted at if it's not there.  
> Agreed.
> 
> >>> The question of which input device corresponds to which cursor plane
> >>> might be good to answer too. I presume the VM runner is configured to
> >>> expose exactly one of each, so there can be only one association?  
> >> As far as I know, all of the VM consoles are written as though they
> >> taking the place of what would the the physical monitors and input
> >> devices on a native machine.  So they assume that there is one user,
> >> sitting in front of one console, and all monitors/input devices are
> >> being used by that user.  
> > Ok, but having a single user does not mean that there cannot be
> > multiple independent pointers, especially on Wayland. The same with
> > keyboards.  
> 
> True, and if the userspace is doing anything complicated here, the 
> hypervisor has to be responsible for ensuring that whatever it's doing 
> works with that, or else this system won't work.  I don't know that the 
> kernel is in a good position to police that.

What do you mean by policing here?

Isn't it the hypervisor that determines what virtual input devices will
be available to the guest OS? Therefore, the hypervisor is in a
position to expose exactly one pointer device and exactly one
cursor plane to guest OS which means the guest OS cannot get the
association wrong. If that's the general and expected hypervisor
policy, then there is no need to design explicit device association in
the guest kernel UAPI. If so, I'd like it to be mentioned in the kernel
docs, too.

> >  
> >> Any more complicated multi-user/multi-cursor setup would have to be
> >> coordinated through a lot of layers (ie from the VM's userspace/kernel
> >> and then through hypervisor/client-consoles), and as far as I know
> >> nobody has tried to plumb that all the way through.  Even physical
> >> multi-user/multi-console configurations like that are rare.  
> > Right.
> >
> > So if there a VM viewer client running on a Wayland system, that viewer
> > client may be presented with an arbitrary number of independent
> > pointer/keyboard/touchscreen input devices. Then it is up to the client
> > to pick one at a time to pass through to the VM.
> >
> > That's fine.
> >
> > I just think it would be good to document, that VM/viewer systems
> > expect to expose just a single pointer to the guest, hence it is
> > obvious which input device in the guest is associated with all the
> > cursor planes in the guest.  
> 
> I don't have a problem adding something that suggests what we think the 
> hypervisors are doing, but I would be a little cautious trying to 
> prescribe what the hypervisors should be doing here.

If the UAPI has been designed to cater for specific hypervisor
configurations, then I think the assumptions should definitely be
documented in the UAPI. Hypervisor developers can look at the UAPI and
see what it caters for and what it doesn't. It's not a spec for what
hypervisors must or must not do, but an explanation of what works and
what doesn't given that guest userspace is forced to follow the UAPI.

If there is no record of how the input vs. output device association is
expected to be handled, I will be raising questions about it until it
is.

Having limitations is fine, but they need to be documented.

> I certainly can't speak for all of them, but we at least do a lot of odd 
> tricks to keep this coordinated that violate what would normally be 
> abstraction layers in a physical system such as having the mouse and the 
> display adapter collude.  Ultimately it's the hypervisor that is 
> responsible for doing the synchronization correctly, and the kernel 
> really isn't involved there besides ferrying the right information down.

Are you happy with that, having to chase and special-case guest OS quirks?

Or would you rather know how a guest Linux kernel expects and enforces
guest userspace to behave, and develop for that, making all Linux OSs
look fairly similar?

You have a golden opportunity here to define how a Linux guest OS needs
to behave. When it's enshrined in Linux UAPI, it will hold for decades,
too.

> >
> > Btw. what do you do if a guest display server simultaneously uses
> > multiple cursor planes, assuming there are multiple outputs each with a
> > cursor plane? Or does the VM/viewer system limit the number of outputs
> > to one for the guest?  
> 
> Zack would have to confirm what the vmwgfx driver does, but the VMware 
> virtual display hardware at least only has one cursor position.  So I 
> would assume that vmwgfx tries to only expose one plane and the rest get 
> emulated, or else it just picks one to set live, but I'm not an expert 
> on vmwgfx.

Right. I would not expect a guest driver to invent more virtual devices
than what the hypervisor exposes.

I believe that using universal planes KMS UAPI, a guest display driver
can also expose a single cursor plane that can migrate between CRTCs.

> Normally we try to run a userspace agent in the Guest that also helps 
> coordinate screen positions/resolutions to match what the user wanted on 
> their client.  So when a user connects and requests from our UI that 
> they want the screens to be a particular configuration, we then send a 
> message to the userspace agent which coordinates with the display 
> manager to request that setup.  You can certainly manually configure 
> modes with things like rotation/topologies that break the console mouse, 
> but we try not to put the user into that state as much as possible.  
> Multiple cursors in the Guest display manager probably fall into that 
> category.

That sounds like something that only works with Xorg as the guest
display server, as X11 allows you to do that, and Wayland does not.

You could do similar things through the guest kernel display driver by
manufacturing hotplug events and changing read-only KMS properties
accordingly, at least to some degree.

At some point, extending KMS for virtualized use cases stops being
reasonable and it would be better to connect to the guest using VNC,
RDP, or such. But I think adding hotspot properties is on the
reasonable side and far from that line.


Thanks,
pq
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20230706/18ec7cda/attachment-0001.sig>