qemu/hw/display/vmware_vga.c
<<
>>
Prefs
   1/*
   2 * QEMU VMware-SVGA "chipset".
   3 *
   4 * Copyright (c) 2007 Andrzej Zaborowski  <balrog@zabor.org>
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24#include "qemu/osdep.h"
  25#include "qapi/error.h"
  26#include "hw/hw.h"
  27#include "hw/loader.h"
  28#include "trace.h"
  29#include "ui/console.h"
  30#include "ui/vnc.h"
  31#include "hw/pci/pci.h"
  32
  33#undef VERBOSE
  34#define HW_RECT_ACCEL
  35#define HW_FILL_ACCEL
  36#define HW_MOUSE_ACCEL
  37
  38#include "vga_int.h"
  39
  40/* See http://vmware-svga.sf.net/ for some documentation on VMWare SVGA */
  41
  42struct vmsvga_state_s {
  43    VGACommonState vga;
  44
  45    int invalidated;
  46    int enable;
  47    int config;
  48    struct {
  49        int id;
  50        int x;
  51        int y;
  52        int on;
  53    } cursor;
  54
  55    int index;
  56    int scratch_size;
  57    uint32_t *scratch;
  58    int new_width;
  59    int new_height;
  60    int new_depth;
  61    uint32_t guest;
  62    uint32_t svgaid;
  63    int syncing;
  64
  65    MemoryRegion fifo_ram;
  66    uint8_t *fifo_ptr;
  67    unsigned int fifo_size;
  68
  69    uint32_t *fifo;
  70    uint32_t fifo_min;
  71    uint32_t fifo_max;
  72    uint32_t fifo_next;
  73    uint32_t fifo_stop;
  74
  75#define REDRAW_FIFO_LEN  512
  76    struct vmsvga_rect_s {
  77        int x, y, w, h;
  78    } redraw_fifo[REDRAW_FIFO_LEN];
  79    int redraw_fifo_first, redraw_fifo_last;
  80};
  81
  82#define TYPE_VMWARE_SVGA "vmware-svga"
  83
  84#define VMWARE_SVGA(obj) \
  85    OBJECT_CHECK(struct pci_vmsvga_state_s, (obj), TYPE_VMWARE_SVGA)
  86
  87struct pci_vmsvga_state_s {
  88    /*< private >*/
  89    PCIDevice parent_obj;
  90    /*< public >*/
  91
  92    struct vmsvga_state_s chip;
  93    MemoryRegion io_bar;
  94};
  95
  96#define SVGA_MAGIC              0x900000UL
  97#define SVGA_MAKE_ID(ver)       (SVGA_MAGIC << 8 | (ver))
  98#define SVGA_ID_0               SVGA_MAKE_ID(0)
  99#define SVGA_ID_1               SVGA_MAKE_ID(1)
 100#define SVGA_ID_2               SVGA_MAKE_ID(2)
 101
 102#define SVGA_LEGACY_BASE_PORT   0x4560
 103#define SVGA_INDEX_PORT         0x0
 104#define SVGA_VALUE_PORT         0x1
 105#define SVGA_BIOS_PORT          0x2
 106
 107#define SVGA_VERSION_2
 108
 109#ifdef SVGA_VERSION_2
 110# define SVGA_ID                SVGA_ID_2
 111# define SVGA_IO_BASE           SVGA_LEGACY_BASE_PORT
 112# define SVGA_IO_MUL            1
 113# define SVGA_FIFO_SIZE         0x10000
 114# define SVGA_PCI_DEVICE_ID     PCI_DEVICE_ID_VMWARE_SVGA2
 115#else
 116# define SVGA_ID                SVGA_ID_1
 117# define SVGA_IO_BASE           SVGA_LEGACY_BASE_PORT
 118# define SVGA_IO_MUL            4
 119# define SVGA_FIFO_SIZE         0x10000
 120# define SVGA_PCI_DEVICE_ID     PCI_DEVICE_ID_VMWARE_SVGA
 121#endif
 122
 123enum {
 124    /* ID 0, 1 and 2 registers */
 125    SVGA_REG_ID = 0,
 126    SVGA_REG_ENABLE = 1,
 127    SVGA_REG_WIDTH = 2,
 128    SVGA_REG_HEIGHT = 3,
 129    SVGA_REG_MAX_WIDTH = 4,
 130    SVGA_REG_MAX_HEIGHT = 5,
 131    SVGA_REG_DEPTH = 6,
 132    SVGA_REG_BITS_PER_PIXEL = 7,        /* Current bpp in the guest */
 133    SVGA_REG_PSEUDOCOLOR = 8,
 134    SVGA_REG_RED_MASK = 9,
 135    SVGA_REG_GREEN_MASK = 10,
 136    SVGA_REG_BLUE_MASK = 11,
 137    SVGA_REG_BYTES_PER_LINE = 12,
 138    SVGA_REG_FB_START = 13,
 139    SVGA_REG_FB_OFFSET = 14,
 140    SVGA_REG_VRAM_SIZE = 15,
 141    SVGA_REG_FB_SIZE = 16,
 142
 143    /* ID 1 and 2 registers */
 144    SVGA_REG_CAPABILITIES = 17,
 145    SVGA_REG_MEM_START = 18,            /* Memory for command FIFO */
 146    SVGA_REG_MEM_SIZE = 19,
 147    SVGA_REG_CONFIG_DONE = 20,          /* Set when memory area configured */
 148    SVGA_REG_SYNC = 21,                 /* Write to force synchronization */
 149    SVGA_REG_BUSY = 22,                 /* Read to check if sync is done */
 150    SVGA_REG_GUEST_ID = 23,             /* Set guest OS identifier */
 151    SVGA_REG_CURSOR_ID = 24,            /* ID of cursor */
 152    SVGA_REG_CURSOR_X = 25,             /* Set cursor X position */
 153    SVGA_REG_CURSOR_Y = 26,             /* Set cursor Y position */
 154    SVGA_REG_CURSOR_ON = 27,            /* Turn cursor on/off */
 155    SVGA_REG_HOST_BITS_PER_PIXEL = 28,  /* Current bpp in the host */
 156    SVGA_REG_SCRATCH_SIZE = 29,         /* Number of scratch registers */
 157    SVGA_REG_MEM_REGS = 30,             /* Number of FIFO registers */
 158    SVGA_REG_NUM_DISPLAYS = 31,         /* Number of guest displays */
 159    SVGA_REG_PITCHLOCK = 32,            /* Fixed pitch for all modes */
 160
 161    SVGA_PALETTE_BASE = 1024,           /* Base of SVGA color map */
 162    SVGA_PALETTE_END  = SVGA_PALETTE_BASE + 767,
 163    SVGA_SCRATCH_BASE = SVGA_PALETTE_BASE + 768,
 164};
 165
 166#define SVGA_CAP_NONE                   0
 167#define SVGA_CAP_RECT_FILL              (1 << 0)
 168#define SVGA_CAP_RECT_COPY              (1 << 1)
 169#define SVGA_CAP_RECT_PAT_FILL          (1 << 2)
 170#define SVGA_CAP_LEGACY_OFFSCREEN       (1 << 3)
 171#define SVGA_CAP_RASTER_OP              (1 << 4)
 172#define SVGA_CAP_CURSOR                 (1 << 5)
 173#define SVGA_CAP_CURSOR_BYPASS          (1 << 6)
 174#define SVGA_CAP_CURSOR_BYPASS_2        (1 << 7)
 175#define SVGA_CAP_8BIT_EMULATION         (1 << 8)
 176#define SVGA_CAP_ALPHA_CURSOR           (1 << 9)
 177#define SVGA_CAP_GLYPH                  (1 << 10)
 178#define SVGA_CAP_GLYPH_CLIPPING         (1 << 11)
 179#define SVGA_CAP_OFFSCREEN_1            (1 << 12)
 180#define SVGA_CAP_ALPHA_BLEND            (1 << 13)
 181#define SVGA_CAP_3D                     (1 << 14)
 182#define SVGA_CAP_EXTENDED_FIFO          (1 << 15)
 183#define SVGA_CAP_MULTIMON               (1 << 16)
 184#define SVGA_CAP_PITCHLOCK              (1 << 17)
 185
 186/*
 187 * FIFO offsets (seen as an array of 32-bit words)
 188 */
 189enum {
 190    /*
 191     * The original defined FIFO offsets
 192     */
 193    SVGA_FIFO_MIN = 0,
 194    SVGA_FIFO_MAX,      /* The distance from MIN to MAX must be at least 10K */
 195    SVGA_FIFO_NEXT,
 196    SVGA_FIFO_STOP,
 197
 198    /*
 199     * Additional offsets added as of SVGA_CAP_EXTENDED_FIFO
 200     */
 201    SVGA_FIFO_CAPABILITIES = 4,
 202    SVGA_FIFO_FLAGS,
 203    SVGA_FIFO_FENCE,
 204    SVGA_FIFO_3D_HWVERSION,
 205    SVGA_FIFO_PITCHLOCK,
 206};
 207
 208#define SVGA_FIFO_CAP_NONE              0
 209#define SVGA_FIFO_CAP_FENCE             (1 << 0)
 210#define SVGA_FIFO_CAP_ACCELFRONT        (1 << 1)
 211#define SVGA_FIFO_CAP_PITCHLOCK         (1 << 2)
 212
 213#define SVGA_FIFO_FLAG_NONE             0
 214#define SVGA_FIFO_FLAG_ACCELFRONT       (1 << 0)
 215
 216/* These values can probably be changed arbitrarily.  */
 217#define SVGA_SCRATCH_SIZE               0x8000
 218#define SVGA_MAX_WIDTH                  ROUND_UP(2360, VNC_DIRTY_PIXELS_PER_BIT)
 219#define SVGA_MAX_HEIGHT                 1770
 220
 221#ifdef VERBOSE
 222# define GUEST_OS_BASE          0x5001
 223static const char *vmsvga_guest_id[] = {
 224    [0x00] = "Dos",
 225    [0x01] = "Windows 3.1",
 226    [0x02] = "Windows 95",
 227    [0x03] = "Windows 98",
 228    [0x04] = "Windows ME",
 229    [0x05] = "Windows NT",
 230    [0x06] = "Windows 2000",
 231    [0x07] = "Linux",
 232    [0x08] = "OS/2",
 233    [0x09] = "an unknown OS",
 234    [0x0a] = "BSD",
 235    [0x0b] = "Whistler",
 236    [0x0c] = "an unknown OS",
 237    [0x0d] = "an unknown OS",
 238    [0x0e] = "an unknown OS",
 239    [0x0f] = "an unknown OS",
 240    [0x10] = "an unknown OS",
 241    [0x11] = "an unknown OS",
 242    [0x12] = "an unknown OS",
 243    [0x13] = "an unknown OS",
 244    [0x14] = "an unknown OS",
 245    [0x15] = "Windows 2003",
 246};
 247#endif
 248
 249enum {
 250    SVGA_CMD_INVALID_CMD = 0,
 251    SVGA_CMD_UPDATE = 1,
 252    SVGA_CMD_RECT_FILL = 2,
 253    SVGA_CMD_RECT_COPY = 3,
 254    SVGA_CMD_DEFINE_BITMAP = 4,
 255    SVGA_CMD_DEFINE_BITMAP_SCANLINE = 5,
 256    SVGA_CMD_DEFINE_PIXMAP = 6,
 257    SVGA_CMD_DEFINE_PIXMAP_SCANLINE = 7,
 258    SVGA_CMD_RECT_BITMAP_FILL = 8,
 259    SVGA_CMD_RECT_PIXMAP_FILL = 9,
 260    SVGA_CMD_RECT_BITMAP_COPY = 10,
 261    SVGA_CMD_RECT_PIXMAP_COPY = 11,
 262    SVGA_CMD_FREE_OBJECT = 12,
 263    SVGA_CMD_RECT_ROP_FILL = 13,
 264    SVGA_CMD_RECT_ROP_COPY = 14,
 265    SVGA_CMD_RECT_ROP_BITMAP_FILL = 15,
 266    SVGA_CMD_RECT_ROP_PIXMAP_FILL = 16,
 267    SVGA_CMD_RECT_ROP_BITMAP_COPY = 17,
 268    SVGA_CMD_RECT_ROP_PIXMAP_COPY = 18,
 269    SVGA_CMD_DEFINE_CURSOR = 19,
 270    SVGA_CMD_DISPLAY_CURSOR = 20,
 271    SVGA_CMD_MOVE_CURSOR = 21,
 272    SVGA_CMD_DEFINE_ALPHA_CURSOR = 22,
 273    SVGA_CMD_DRAW_GLYPH = 23,
 274    SVGA_CMD_DRAW_GLYPH_CLIPPED = 24,
 275    SVGA_CMD_UPDATE_VERBOSE = 25,
 276    SVGA_CMD_SURFACE_FILL = 26,
 277    SVGA_CMD_SURFACE_COPY = 27,
 278    SVGA_CMD_SURFACE_ALPHA_BLEND = 28,
 279    SVGA_CMD_FRONT_ROP_FILL = 29,
 280    SVGA_CMD_FENCE = 30,
 281};
 282
 283/* Legal values for the SVGA_REG_CURSOR_ON register in cursor bypass mode */
 284enum {
 285    SVGA_CURSOR_ON_HIDE = 0,
 286    SVGA_CURSOR_ON_SHOW = 1,
 287    SVGA_CURSOR_ON_REMOVE_FROM_FB = 2,
 288    SVGA_CURSOR_ON_RESTORE_TO_FB = 3,
 289};
 290
 291static inline bool vmsvga_verify_rect(DisplaySurface *surface,
 292                                      const char *name,
 293                                      int x, int y, int w, int h)
 294{
 295    if (x < 0) {
 296        fprintf(stderr, "%s: x was < 0 (%d)\n", name, x);
 297        return false;
 298    }
 299    if (x > SVGA_MAX_WIDTH) {
 300        fprintf(stderr, "%s: x was > %d (%d)\n", name, SVGA_MAX_WIDTH, x);
 301        return false;
 302    }
 303    if (w < 0) {
 304        fprintf(stderr, "%s: w was < 0 (%d)\n", name, w);
 305        return false;
 306    }
 307    if (w > SVGA_MAX_WIDTH) {
 308        fprintf(stderr, "%s: w was > %d (%d)\n", name, SVGA_MAX_WIDTH, w);
 309        return false;
 310    }
 311    if (x + w > surface_width(surface)) {
 312        fprintf(stderr, "%s: width was > %d (x: %d, w: %d)\n",
 313                name, surface_width(surface), x, w);
 314        return false;
 315    }
 316
 317    if (y < 0) {
 318        fprintf(stderr, "%s: y was < 0 (%d)\n", name, y);
 319        return false;
 320    }
 321    if (y > SVGA_MAX_HEIGHT) {
 322        fprintf(stderr, "%s: y was > %d (%d)\n", name, SVGA_MAX_HEIGHT, y);
 323        return false;
 324    }
 325    if (h < 0) {
 326        fprintf(stderr, "%s: h was < 0 (%d)\n", name, h);
 327        return false;
 328    }
 329    if (h > SVGA_MAX_HEIGHT) {
 330        fprintf(stderr, "%s: h was > %d (%d)\n", name, SVGA_MAX_HEIGHT, h);
 331        return false;
 332    }
 333    if (y + h > surface_height(surface)) {
 334        fprintf(stderr, "%s: update height > %d (y: %d, h: %d)\n",
 335                name, surface_height(surface), y, h);
 336        return false;
 337    }
 338
 339    return true;
 340}
 341
 342static inline void vmsvga_update_rect(struct vmsvga_state_s *s,
 343                                      int x, int y, int w, int h)
 344{
 345    DisplaySurface *surface = qemu_console_surface(s->vga.con);
 346    int line;
 347    int bypl;
 348    int width;
 349    int start;
 350    uint8_t *src;
 351    uint8_t *dst;
 352
 353    if (!vmsvga_verify_rect(surface, __func__, x, y, w, h)) {
 354        /* go for a fullscreen update as fallback */
 355        x = 0;
 356        y = 0;
 357        w = surface_width(surface);
 358        h = surface_height(surface);
 359    }
 360
 361    bypl = surface_stride(surface);
 362    width = surface_bytes_per_pixel(surface) * w;
 363    start = surface_bytes_per_pixel(surface) * x + bypl * y;
 364    src = s->vga.vram_ptr + start;
 365    dst = surface_data(surface) + start;
 366
 367    for (line = h; line > 0; line--, src += bypl, dst += bypl) {
 368        memcpy(dst, src, width);
 369    }
 370    dpy_gfx_update(s->vga.con, x, y, w, h);
 371}
 372
 373static inline void vmsvga_update_rect_delayed(struct vmsvga_state_s *s,
 374                int x, int y, int w, int h)
 375{
 376    struct vmsvga_rect_s *rect = &s->redraw_fifo[s->redraw_fifo_last++];
 377
 378    s->redraw_fifo_last &= REDRAW_FIFO_LEN - 1;
 379    rect->x = x;
 380    rect->y = y;
 381    rect->w = w;
 382    rect->h = h;
 383}
 384
 385static inline void vmsvga_update_rect_flush(struct vmsvga_state_s *s)
 386{
 387    struct vmsvga_rect_s *rect;
 388
 389    if (s->invalidated) {
 390        s->redraw_fifo_first = s->redraw_fifo_last;
 391        return;
 392    }
 393    /* Overlapping region updates can be optimised out here - if someone
 394     * knows a smart algorithm to do that, please share.  */
 395    while (s->redraw_fifo_first != s->redraw_fifo_last) {
 396        rect = &s->redraw_fifo[s->redraw_fifo_first++];
 397        s->redraw_fifo_first &= REDRAW_FIFO_LEN - 1;
 398        vmsvga_update_rect(s, rect->x, rect->y, rect->w, rect->h);
 399    }
 400}
 401
 402#ifdef HW_RECT_ACCEL
 403static inline int vmsvga_copy_rect(struct vmsvga_state_s *s,
 404                int x0, int y0, int x1, int y1, int w, int h)
 405{
 406    DisplaySurface *surface = qemu_console_surface(s->vga.con);
 407    uint8_t *vram = s->vga.vram_ptr;
 408    int bypl = surface_stride(surface);
 409    int bypp = surface_bytes_per_pixel(surface);
 410    int width = bypp * w;
 411    int line = h;
 412    uint8_t *ptr[2];
 413
 414    if (!vmsvga_verify_rect(surface, "vmsvga_copy_rect/src", x0, y0, w, h)) {
 415        return -1;
 416    }
 417    if (!vmsvga_verify_rect(surface, "vmsvga_copy_rect/dst", x1, y1, w, h)) {
 418        return -1;
 419    }
 420
 421    if (y1 > y0) {
 422        ptr[0] = vram + bypp * x0 + bypl * (y0 + h - 1);
 423        ptr[1] = vram + bypp * x1 + bypl * (y1 + h - 1);
 424        for (; line > 0; line --, ptr[0] -= bypl, ptr[1] -= bypl) {
 425            memmove(ptr[1], ptr[0], width);
 426        }
 427    } else {
 428        ptr[0] = vram + bypp * x0 + bypl * y0;
 429        ptr[1] = vram + bypp * x1 + bypl * y1;
 430        for (; line > 0; line --, ptr[0] += bypl, ptr[1] += bypl) {
 431            memmove(ptr[1], ptr[0], width);
 432        }
 433    }
 434
 435    vmsvga_update_rect_delayed(s, x1, y1, w, h);
 436    return 0;
 437}
 438#endif
 439
 440#ifdef HW_FILL_ACCEL
 441static inline int vmsvga_fill_rect(struct vmsvga_state_s *s,
 442                uint32_t c, int x, int y, int w, int h)
 443{
 444    DisplaySurface *surface = qemu_console_surface(s->vga.con);
 445    int bypl = surface_stride(surface);
 446    int width = surface_bytes_per_pixel(surface) * w;
 447    int line = h;
 448    int column;
 449    uint8_t *fst;
 450    uint8_t *dst;
 451    uint8_t *src;
 452    uint8_t col[4];
 453
 454    if (!vmsvga_verify_rect(surface, __func__, x, y, w, h)) {
 455        return -1;
 456    }
 457
 458    col[0] = c;
 459    col[1] = c >> 8;
 460    col[2] = c >> 16;
 461    col[3] = c >> 24;
 462
 463    fst = s->vga.vram_ptr + surface_bytes_per_pixel(surface) * x + bypl * y;
 464
 465    if (line--) {
 466        dst = fst;
 467        src = col;
 468        for (column = width; column > 0; column--) {
 469            *(dst++) = *(src++);
 470            if (src - col == surface_bytes_per_pixel(surface)) {
 471                src = col;
 472            }
 473        }
 474        dst = fst;
 475        for (; line > 0; line--) {
 476            dst += bypl;
 477            memcpy(dst, fst, width);
 478        }
 479    }
 480
 481    vmsvga_update_rect_delayed(s, x, y, w, h);
 482    return 0;
 483}
 484#endif
 485
 486struct vmsvga_cursor_definition_s {
 487    uint32_t width;
 488    uint32_t height;
 489    int id;
 490    uint32_t bpp;
 491    int hot_x;
 492    int hot_y;
 493    uint32_t mask[1024];
 494    uint32_t image[4096];
 495};
 496
 497#define SVGA_BITMAP_SIZE(w, h)          ((((w) + 31) >> 5) * (h))
 498#define SVGA_PIXMAP_SIZE(w, h, bpp)     (((((w) * (bpp)) + 31) >> 5) * (h))
 499
 500#ifdef HW_MOUSE_ACCEL
 501static inline void vmsvga_cursor_define(struct vmsvga_state_s *s,
 502                struct vmsvga_cursor_definition_s *c)
 503{
 504    QEMUCursor *qc;
 505    int i, pixels;
 506
 507    qc = cursor_alloc(c->width, c->height);
 508    qc->hot_x = c->hot_x;
 509    qc->hot_y = c->hot_y;
 510    switch (c->bpp) {
 511    case 1:
 512        cursor_set_mono(qc, 0xffffff, 0x000000, (void *)c->image,
 513                        1, (void *)c->mask);
 514#ifdef DEBUG
 515        cursor_print_ascii_art(qc, "vmware/mono");
 516#endif
 517        break;
 518    case 32:
 519        /* fill alpha channel from mask, set color to zero */
 520        cursor_set_mono(qc, 0x000000, 0x000000, (void *)c->mask,
 521                        1, (void *)c->mask);
 522        /* add in rgb values */
 523        pixels = c->width * c->height;
 524        for (i = 0; i < pixels; i++) {
 525            qc->data[i] |= c->image[i] & 0xffffff;
 526        }
 527#ifdef DEBUG
 528        cursor_print_ascii_art(qc, "vmware/32bit");
 529#endif
 530        break;
 531    default:
 532        fprintf(stderr, "%s: unhandled bpp %d, using fallback cursor\n",
 533                __func__, c->bpp);
 534        cursor_put(qc);
 535        qc = cursor_builtin_left_ptr();
 536    }
 537
 538    dpy_cursor_define(s->vga.con, qc);
 539    cursor_put(qc);
 540}
 541#endif
 542
 543static inline int vmsvga_fifo_length(struct vmsvga_state_s *s)
 544{
 545    int num;
 546
 547    if (!s->config || !s->enable) {
 548        return 0;
 549    }
 550
 551    s->fifo_min  = le32_to_cpu(s->fifo[SVGA_FIFO_MIN]);
 552    s->fifo_max  = le32_to_cpu(s->fifo[SVGA_FIFO_MAX]);
 553    s->fifo_next = le32_to_cpu(s->fifo[SVGA_FIFO_NEXT]);
 554    s->fifo_stop = le32_to_cpu(s->fifo[SVGA_FIFO_STOP]);
 555
 556    /* Check range and alignment.  */
 557    if ((s->fifo_min | s->fifo_max | s->fifo_next | s->fifo_stop) & 3) {
 558        return 0;
 559    }
 560    if (s->fifo_min < sizeof(uint32_t) * 4) {
 561        return 0;
 562    }
 563    if (s->fifo_max > SVGA_FIFO_SIZE ||
 564        s->fifo_min >= SVGA_FIFO_SIZE ||
 565        s->fifo_stop >= SVGA_FIFO_SIZE ||
 566        s->fifo_next >= SVGA_FIFO_SIZE) {
 567        return 0;
 568    }
 569    if (s->fifo_max < s->fifo_min + 10 * 1024) {
 570        return 0;
 571    }
 572
 573    num = s->fifo_next - s->fifo_stop;
 574    if (num < 0) {
 575        num += s->fifo_max - s->fifo_min;
 576    }
 577    return num >> 2;
 578}
 579
 580static inline uint32_t vmsvga_fifo_read_raw(struct vmsvga_state_s *s)
 581{
 582    uint32_t cmd = s->fifo[s->fifo_stop >> 2];
 583
 584    s->fifo_stop += 4;
 585    if (s->fifo_stop >= s->fifo_max) {
 586        s->fifo_stop = s->fifo_min;
 587    }
 588    s->fifo[SVGA_FIFO_STOP] = cpu_to_le32(s->fifo_stop);
 589    return cmd;
 590}
 591
 592static inline uint32_t vmsvga_fifo_read(struct vmsvga_state_s *s)
 593{
 594    return le32_to_cpu(vmsvga_fifo_read_raw(s));
 595}
 596
 597static void vmsvga_fifo_run(struct vmsvga_state_s *s)
 598{
 599    uint32_t cmd, colour;
 600    int args, len, maxloop = 1024;
 601    int x, y, dx, dy, width, height;
 602    struct vmsvga_cursor_definition_s cursor;
 603    uint32_t cmd_start;
 604
 605    len = vmsvga_fifo_length(s);
 606    while (len > 0 && --maxloop > 0) {
 607        /* May need to go back to the start of the command if incomplete */
 608        cmd_start = s->fifo_stop;
 609
 610        switch (cmd = vmsvga_fifo_read(s)) {
 611        case SVGA_CMD_UPDATE:
 612        case SVGA_CMD_UPDATE_VERBOSE:
 613            len -= 5;
 614            if (len < 0) {
 615                goto rewind;
 616            }
 617
 618            x = vmsvga_fifo_read(s);
 619            y = vmsvga_fifo_read(s);
 620            width = vmsvga_fifo_read(s);
 621            height = vmsvga_fifo_read(s);
 622            vmsvga_update_rect_delayed(s, x, y, width, height);
 623            break;
 624
 625        case SVGA_CMD_RECT_FILL:
 626            len -= 6;
 627            if (len < 0) {
 628                goto rewind;
 629            }
 630
 631            colour = vmsvga_fifo_read(s);
 632            x = vmsvga_fifo_read(s);
 633            y = vmsvga_fifo_read(s);
 634            width = vmsvga_fifo_read(s);
 635            height = vmsvga_fifo_read(s);
 636#ifdef HW_FILL_ACCEL
 637            if (vmsvga_fill_rect(s, colour, x, y, width, height) == 0) {
 638                break;
 639            }
 640#endif
 641            args = 0;
 642            goto badcmd;
 643
 644        case SVGA_CMD_RECT_COPY:
 645            len -= 7;
 646            if (len < 0) {
 647                goto rewind;
 648            }
 649
 650            x = vmsvga_fifo_read(s);
 651            y = vmsvga_fifo_read(s);
 652            dx = vmsvga_fifo_read(s);
 653            dy = vmsvga_fifo_read(s);
 654            width = vmsvga_fifo_read(s);
 655            height = vmsvga_fifo_read(s);
 656#ifdef HW_RECT_ACCEL
 657            if (vmsvga_copy_rect(s, x, y, dx, dy, width, height) == 0) {
 658                break;
 659            }
 660#endif
 661            args = 0;
 662            goto badcmd;
 663
 664        case SVGA_CMD_DEFINE_CURSOR:
 665            len -= 8;
 666            if (len < 0) {
 667                goto rewind;
 668            }
 669
 670            cursor.id = vmsvga_fifo_read(s);
 671            cursor.hot_x = vmsvga_fifo_read(s);
 672            cursor.hot_y = vmsvga_fifo_read(s);
 673            cursor.width = x = vmsvga_fifo_read(s);
 674            cursor.height = y = vmsvga_fifo_read(s);
 675            vmsvga_fifo_read(s);
 676            cursor.bpp = vmsvga_fifo_read(s);
 677
 678            args = SVGA_BITMAP_SIZE(x, y) + SVGA_PIXMAP_SIZE(x, y, cursor.bpp);
 679            if (cursor.width > 256 ||
 680                cursor.height > 256 ||
 681                cursor.bpp > 32 ||
 682                SVGA_BITMAP_SIZE(x, y) > sizeof cursor.mask ||
 683                SVGA_PIXMAP_SIZE(x, y, cursor.bpp) > sizeof cursor.image) {
 684                    goto badcmd;
 685            }
 686
 687            len -= args;
 688            if (len < 0) {
 689                goto rewind;
 690            }
 691
 692            for (args = 0; args < SVGA_BITMAP_SIZE(x, y); args++) {
 693                cursor.mask[args] = vmsvga_fifo_read_raw(s);
 694            }
 695            for (args = 0; args < SVGA_PIXMAP_SIZE(x, y, cursor.bpp); args++) {
 696                cursor.image[args] = vmsvga_fifo_read_raw(s);
 697            }
 698#ifdef HW_MOUSE_ACCEL
 699            vmsvga_cursor_define(s, &cursor);
 700            break;
 701#else
 702            args = 0;
 703            goto badcmd;
 704#endif
 705
 706        /*
 707         * Other commands that we at least know the number of arguments
 708         * for so we can avoid FIFO desync if driver uses them illegally.
 709         */
 710        case SVGA_CMD_DEFINE_ALPHA_CURSOR:
 711            len -= 6;
 712            if (len < 0) {
 713                goto rewind;
 714            }
 715            vmsvga_fifo_read(s);
 716            vmsvga_fifo_read(s);
 717            vmsvga_fifo_read(s);
 718            x = vmsvga_fifo_read(s);
 719            y = vmsvga_fifo_read(s);
 720            args = x * y;
 721            goto badcmd;
 722        case SVGA_CMD_RECT_ROP_FILL:
 723            args = 6;
 724            goto badcmd;
 725        case SVGA_CMD_RECT_ROP_COPY:
 726            args = 7;
 727            goto badcmd;
 728        case SVGA_CMD_DRAW_GLYPH_CLIPPED:
 729            len -= 4;
 730            if (len < 0) {
 731                goto rewind;
 732            }
 733            vmsvga_fifo_read(s);
 734            vmsvga_fifo_read(s);
 735            args = 7 + (vmsvga_fifo_read(s) >> 2);
 736            goto badcmd;
 737        case SVGA_CMD_SURFACE_ALPHA_BLEND:
 738            args = 12;
 739            goto badcmd;
 740
 741        /*
 742         * Other commands that are not listed as depending on any
 743         * CAPABILITIES bits, but are not described in the README either.
 744         */
 745        case SVGA_CMD_SURFACE_FILL:
 746        case SVGA_CMD_SURFACE_COPY:
 747        case SVGA_CMD_FRONT_ROP_FILL:
 748        case SVGA_CMD_FENCE:
 749        case SVGA_CMD_INVALID_CMD:
 750            break; /* Nop */
 751
 752        default:
 753            args = 0;
 754        badcmd:
 755            len -= args;
 756            if (len < 0) {
 757                goto rewind;
 758            }
 759            while (args--) {
 760                vmsvga_fifo_read(s);
 761            }
 762            printf("%s: Unknown command 0x%02x in SVGA command FIFO\n",
 763                   __func__, cmd);
 764            break;
 765
 766        rewind:
 767            s->fifo_stop = cmd_start;
 768            s->fifo[SVGA_FIFO_STOP] = cpu_to_le32(s->fifo_stop);
 769            break;
 770        }
 771    }
 772
 773    s->syncing = 0;
 774}
 775
 776static uint32_t vmsvga_index_read(void *opaque, uint32_t address)
 777{
 778    struct vmsvga_state_s *s = opaque;
 779
 780    return s->index;
 781}
 782
 783static void vmsvga_index_write(void *opaque, uint32_t address, uint32_t index)
 784{
 785    struct vmsvga_state_s *s = opaque;
 786
 787    s->index = index;
 788}
 789
 790static uint32_t vmsvga_value_read(void *opaque, uint32_t address)
 791{
 792    uint32_t caps;
 793    struct vmsvga_state_s *s = opaque;
 794    DisplaySurface *surface = qemu_console_surface(s->vga.con);
 795    PixelFormat pf;
 796    uint32_t ret;
 797
 798    switch (s->index) {
 799    case SVGA_REG_ID:
 800        ret = s->svgaid;
 801        break;
 802
 803    case SVGA_REG_ENABLE:
 804        ret = s->enable;
 805        break;
 806
 807    case SVGA_REG_WIDTH:
 808        ret = s->new_width ? s->new_width : surface_width(surface);
 809        break;
 810
 811    case SVGA_REG_HEIGHT:
 812        ret = s->new_height ? s->new_height : surface_height(surface);
 813        break;
 814
 815    case SVGA_REG_MAX_WIDTH:
 816        ret = SVGA_MAX_WIDTH;
 817        break;
 818
 819    case SVGA_REG_MAX_HEIGHT:
 820        ret = SVGA_MAX_HEIGHT;
 821        break;
 822
 823    case SVGA_REG_DEPTH:
 824        ret = (s->new_depth == 32) ? 24 : s->new_depth;
 825        break;
 826
 827    case SVGA_REG_BITS_PER_PIXEL:
 828    case SVGA_REG_HOST_BITS_PER_PIXEL:
 829        ret = s->new_depth;
 830        break;
 831
 832    case SVGA_REG_PSEUDOCOLOR:
 833        ret = 0x0;
 834        break;
 835
 836    case SVGA_REG_RED_MASK:
 837        pf = qemu_default_pixelformat(s->new_depth);
 838        ret = pf.rmask;
 839        break;
 840
 841    case SVGA_REG_GREEN_MASK:
 842        pf = qemu_default_pixelformat(s->new_depth);
 843        ret = pf.gmask;
 844        break;
 845
 846    case SVGA_REG_BLUE_MASK:
 847        pf = qemu_default_pixelformat(s->new_depth);
 848        ret = pf.bmask;
 849        break;
 850
 851    case SVGA_REG_BYTES_PER_LINE:
 852        if (s->new_width) {
 853            ret = (s->new_depth * s->new_width) / 8;
 854        } else {
 855            ret = surface_stride(surface);
 856        }
 857        break;
 858
 859    case SVGA_REG_FB_START: {
 860        struct pci_vmsvga_state_s *pci_vmsvga
 861            = container_of(s, struct pci_vmsvga_state_s, chip);
 862        ret = pci_get_bar_addr(PCI_DEVICE(pci_vmsvga), 1);
 863        break;
 864    }
 865
 866    case SVGA_REG_FB_OFFSET:
 867        ret = 0x0;
 868        break;
 869
 870    case SVGA_REG_VRAM_SIZE:
 871        ret = s->vga.vram_size; /* No physical VRAM besides the framebuffer */
 872        break;
 873
 874    case SVGA_REG_FB_SIZE:
 875        ret = s->vga.vram_size;
 876        break;
 877
 878    case SVGA_REG_CAPABILITIES:
 879        caps = SVGA_CAP_NONE;
 880#ifdef HW_RECT_ACCEL
 881        caps |= SVGA_CAP_RECT_COPY;
 882#endif
 883#ifdef HW_FILL_ACCEL
 884        caps |= SVGA_CAP_RECT_FILL;
 885#endif
 886#ifdef HW_MOUSE_ACCEL
 887        if (dpy_cursor_define_supported(s->vga.con)) {
 888            caps |= SVGA_CAP_CURSOR | SVGA_CAP_CURSOR_BYPASS_2 |
 889                    SVGA_CAP_CURSOR_BYPASS;
 890        }
 891#endif
 892        ret = caps;
 893        break;
 894
 895    case SVGA_REG_MEM_START: {
 896        struct pci_vmsvga_state_s *pci_vmsvga
 897            = container_of(s, struct pci_vmsvga_state_s, chip);
 898        ret = pci_get_bar_addr(PCI_DEVICE(pci_vmsvga), 2);
 899        break;
 900    }
 901
 902    case SVGA_REG_MEM_SIZE:
 903        ret = s->fifo_size;
 904        break;
 905
 906    case SVGA_REG_CONFIG_DONE:
 907        ret = s->config;
 908        break;
 909
 910    case SVGA_REG_SYNC:
 911    case SVGA_REG_BUSY:
 912        ret = s->syncing;
 913        break;
 914
 915    case SVGA_REG_GUEST_ID:
 916        ret = s->guest;
 917        break;
 918
 919    case SVGA_REG_CURSOR_ID:
 920        ret = s->cursor.id;
 921        break;
 922
 923    case SVGA_REG_CURSOR_X:
 924        ret = s->cursor.x;
 925        break;
 926
 927    case SVGA_REG_CURSOR_Y:
 928        ret = s->cursor.y;
 929        break;
 930
 931    case SVGA_REG_CURSOR_ON:
 932        ret = s->cursor.on;
 933        break;
 934
 935    case SVGA_REG_SCRATCH_SIZE:
 936        ret = s->scratch_size;
 937        break;
 938
 939    case SVGA_REG_MEM_REGS:
 940    case SVGA_REG_NUM_DISPLAYS:
 941    case SVGA_REG_PITCHLOCK:
 942    case SVGA_PALETTE_BASE ... SVGA_PALETTE_END:
 943        ret = 0;
 944        break;
 945
 946    default:
 947        if (s->index >= SVGA_SCRATCH_BASE &&
 948            s->index < SVGA_SCRATCH_BASE + s->scratch_size) {
 949            ret = s->scratch[s->index - SVGA_SCRATCH_BASE];
 950            break;
 951        }
 952        printf("%s: Bad register %02x\n", __func__, s->index);
 953        ret = 0;
 954        break;
 955    }
 956
 957    if (s->index >= SVGA_SCRATCH_BASE) {
 958        trace_vmware_scratch_read(s->index, ret);
 959    } else if (s->index >= SVGA_PALETTE_BASE) {
 960        trace_vmware_palette_read(s->index, ret);
 961    } else {
 962        trace_vmware_value_read(s->index, ret);
 963    }
 964    return ret;
 965}
 966
 967static void vmsvga_value_write(void *opaque, uint32_t address, uint32_t value)
 968{
 969    struct vmsvga_state_s *s = opaque;
 970
 971    if (s->index >= SVGA_SCRATCH_BASE) {
 972        trace_vmware_scratch_write(s->index, value);
 973    } else if (s->index >= SVGA_PALETTE_BASE) {
 974        trace_vmware_palette_write(s->index, value);
 975    } else {
 976        trace_vmware_value_write(s->index, value);
 977    }
 978    switch (s->index) {
 979    case SVGA_REG_ID:
 980        if (value == SVGA_ID_2 || value == SVGA_ID_1 || value == SVGA_ID_0) {
 981            s->svgaid = value;
 982        }
 983        break;
 984
 985    case SVGA_REG_ENABLE:
 986        s->enable = !!value;
 987        s->invalidated = 1;
 988        s->vga.hw_ops->invalidate(&s->vga);
 989        if (s->enable && s->config) {
 990            vga_dirty_log_stop(&s->vga);
 991        } else {
 992            vga_dirty_log_start(&s->vga);
 993        }
 994        break;
 995
 996    case SVGA_REG_WIDTH:
 997        if (value <= SVGA_MAX_WIDTH) {
 998            s->new_width = value;
 999            s->invalidated = 1;
1000        } else {
1001            printf("%s: Bad width: %i\n", __func__, value);
1002        }
1003        break;
1004
1005    case SVGA_REG_HEIGHT:
1006        if (value <= SVGA_MAX_HEIGHT) {
1007            s->new_height = value;
1008            s->invalidated = 1;
1009        } else {
1010            printf("%s: Bad height: %i\n", __func__, value);
1011        }
1012        break;
1013
1014    case SVGA_REG_BITS_PER_PIXEL:
1015        if (value != 32) {
1016            printf("%s: Bad bits per pixel: %i bits\n", __func__, value);
1017            s->config = 0;
1018            s->invalidated = 1;
1019        }
1020        break;
1021
1022    case SVGA_REG_CONFIG_DONE:
1023        if (value) {
1024            s->fifo = (uint32_t *) s->fifo_ptr;
1025            vga_dirty_log_stop(&s->vga);
1026        }
1027        s->config = !!value;
1028        break;
1029
1030    case SVGA_REG_SYNC:
1031        s->syncing = 1;
1032        vmsvga_fifo_run(s); /* Or should we just wait for update_display? */
1033        break;
1034
1035    case SVGA_REG_GUEST_ID:
1036        s->guest = value;
1037#ifdef VERBOSE
1038        if (value >= GUEST_OS_BASE && value < GUEST_OS_BASE +
1039            ARRAY_SIZE(vmsvga_guest_id)) {
1040            printf("%s: guest runs %s.\n", __func__,
1041                   vmsvga_guest_id[value - GUEST_OS_BASE]);
1042        }
1043#endif
1044        break;
1045
1046    case SVGA_REG_CURSOR_ID:
1047        s->cursor.id = value;
1048        break;
1049
1050    case SVGA_REG_CURSOR_X:
1051        s->cursor.x = value;
1052        break;
1053
1054    case SVGA_REG_CURSOR_Y:
1055        s->cursor.y = value;
1056        break;
1057
1058    case SVGA_REG_CURSOR_ON:
1059        s->cursor.on |= (value == SVGA_CURSOR_ON_SHOW);
1060        s->cursor.on &= (value != SVGA_CURSOR_ON_HIDE);
1061#ifdef HW_MOUSE_ACCEL
1062        if (value <= SVGA_CURSOR_ON_SHOW) {
1063            dpy_mouse_set(s->vga.con, s->cursor.x, s->cursor.y, s->cursor.on);
1064        }
1065#endif
1066        break;
1067
1068    case SVGA_REG_DEPTH:
1069    case SVGA_REG_MEM_REGS:
1070    case SVGA_REG_NUM_DISPLAYS:
1071    case SVGA_REG_PITCHLOCK:
1072    case SVGA_PALETTE_BASE ... SVGA_PALETTE_END:
1073        break;
1074
1075    default:
1076        if (s->index >= SVGA_SCRATCH_BASE &&
1077                s->index < SVGA_SCRATCH_BASE + s->scratch_size) {
1078            s->scratch[s->index - SVGA_SCRATCH_BASE] = value;
1079            break;
1080        }
1081        printf("%s: Bad register %02x\n", __func__, s->index);
1082    }
1083}
1084
1085static uint32_t vmsvga_bios_read(void *opaque, uint32_t address)
1086{
1087    printf("%s: what are we supposed to return?\n", __func__);
1088    return 0xcafe;
1089}
1090
1091static void vmsvga_bios_write(void *opaque, uint32_t address, uint32_t data)
1092{
1093    printf("%s: what are we supposed to do with (%08x)?\n", __func__, data);
1094}
1095
1096static inline void vmsvga_check_size(struct vmsvga_state_s *s)
1097{
1098    DisplaySurface *surface = qemu_console_surface(s->vga.con);
1099
1100    if (s->new_width != surface_width(surface) ||
1101        s->new_height != surface_height(surface) ||
1102        s->new_depth != surface_bits_per_pixel(surface)) {
1103        int stride = (s->new_depth * s->new_width) / 8;
1104        pixman_format_code_t format =
1105            qemu_default_pixman_format(s->new_depth, true);
1106        trace_vmware_setmode(s->new_width, s->new_height, s->new_depth);
1107        surface = qemu_create_displaysurface_from(s->new_width, s->new_height,
1108                                                  format, stride,
1109                                                  s->vga.vram_ptr);
1110        dpy_gfx_replace_surface(s->vga.con, surface);
1111        s->invalidated = 1;
1112    }
1113}
1114
1115static void vmsvga_update_display(void *opaque)
1116{
1117    struct vmsvga_state_s *s = opaque;
1118    DisplaySurface *surface;
1119    bool dirty = false;
1120
1121    if (!s->enable) {
1122        s->vga.hw_ops->gfx_update(&s->vga);
1123        return;
1124    }
1125
1126    vmsvga_check_size(s);
1127    surface = qemu_console_surface(s->vga.con);
1128
1129    vmsvga_fifo_run(s);
1130    vmsvga_update_rect_flush(s);
1131
1132    /*
1133     * Is it more efficient to look at vram VGA-dirty bits or wait
1134     * for the driver to issue SVGA_CMD_UPDATE?
1135     */
1136    if (memory_region_is_logging(&s->vga.vram, DIRTY_MEMORY_VGA)) {
1137        vga_sync_dirty_bitmap(&s->vga);
1138        dirty = memory_region_get_dirty(&s->vga.vram, 0,
1139            surface_stride(surface) * surface_height(surface),
1140            DIRTY_MEMORY_VGA);
1141    }
1142    if (s->invalidated || dirty) {
1143        s->invalidated = 0;
1144        dpy_gfx_update(s->vga.con, 0, 0,
1145                   surface_width(surface), surface_height(surface));
1146    }
1147    if (dirty) {
1148        memory_region_reset_dirty(&s->vga.vram, 0,
1149            surface_stride(surface) * surface_height(surface),
1150            DIRTY_MEMORY_VGA);
1151    }
1152}
1153
1154static void vmsvga_reset(DeviceState *dev)
1155{
1156    struct pci_vmsvga_state_s *pci = VMWARE_SVGA(dev);
1157    struct vmsvga_state_s *s = &pci->chip;
1158
1159    s->index = 0;
1160    s->enable = 0;
1161    s->config = 0;
1162    s->svgaid = SVGA_ID;
1163    s->cursor.on = 0;
1164    s->redraw_fifo_first = 0;
1165    s->redraw_fifo_last = 0;
1166    s->syncing = 0;
1167
1168    vga_dirty_log_start(&s->vga);
1169}
1170
1171static void vmsvga_invalidate_display(void *opaque)
1172{
1173    struct vmsvga_state_s *s = opaque;
1174    if (!s->enable) {
1175        s->vga.hw_ops->invalidate(&s->vga);
1176        return;
1177    }
1178
1179    s->invalidated = 1;
1180}
1181
1182static void vmsvga_text_update(void *opaque, console_ch_t *chardata)
1183{
1184    struct vmsvga_state_s *s = opaque;
1185
1186    if (s->vga.hw_ops->text_update) {
1187        s->vga.hw_ops->text_update(&s->vga, chardata);
1188    }
1189}
1190
1191static int vmsvga_post_load(void *opaque, int version_id)
1192{
1193    struct vmsvga_state_s *s = opaque;
1194
1195    s->invalidated = 1;
1196    if (s->config) {
1197        s->fifo = (uint32_t *) s->fifo_ptr;
1198    }
1199    return 0;
1200}
1201
1202static const VMStateDescription vmstate_vmware_vga_internal = {
1203    .name = "vmware_vga_internal",
1204    .version_id = 0,
1205    .minimum_version_id = 0,
1206    .post_load = vmsvga_post_load,
1207    .fields = (VMStateField[]) {
1208        VMSTATE_INT32_EQUAL(new_depth, struct vmsvga_state_s),
1209        VMSTATE_INT32(enable, struct vmsvga_state_s),
1210        VMSTATE_INT32(config, struct vmsvga_state_s),
1211        VMSTATE_INT32(cursor.id, struct vmsvga_state_s),
1212        VMSTATE_INT32(cursor.x, struct vmsvga_state_s),
1213        VMSTATE_INT32(cursor.y, struct vmsvga_state_s),
1214        VMSTATE_INT32(cursor.on, struct vmsvga_state_s),
1215        VMSTATE_INT32(index, struct vmsvga_state_s),
1216        VMSTATE_VARRAY_INT32(scratch, struct vmsvga_state_s,
1217                             scratch_size, 0, vmstate_info_uint32, uint32_t),
1218        VMSTATE_INT32(new_width, struct vmsvga_state_s),
1219        VMSTATE_INT32(new_height, struct vmsvga_state_s),
1220        VMSTATE_UINT32(guest, struct vmsvga_state_s),
1221        VMSTATE_UINT32(svgaid, struct vmsvga_state_s),
1222        VMSTATE_INT32(syncing, struct vmsvga_state_s),
1223        VMSTATE_UNUSED(4), /* was fb_size */
1224        VMSTATE_END_OF_LIST()
1225    }
1226};
1227
1228static const VMStateDescription vmstate_vmware_vga = {
1229    .name = "vmware_vga",
1230    .version_id = 0,
1231    .minimum_version_id = 0,
1232    .fields = (VMStateField[]) {
1233        VMSTATE_PCI_DEVICE(parent_obj, struct pci_vmsvga_state_s),
1234        VMSTATE_STRUCT(chip, struct pci_vmsvga_state_s, 0,
1235                       vmstate_vmware_vga_internal, struct vmsvga_state_s),
1236        VMSTATE_END_OF_LIST()
1237    }
1238};
1239
1240static const GraphicHwOps vmsvga_ops = {
1241    .invalidate  = vmsvga_invalidate_display,
1242    .gfx_update  = vmsvga_update_display,
1243    .text_update = vmsvga_text_update,
1244};
1245
1246static void vmsvga_init(DeviceState *dev, struct vmsvga_state_s *s,
1247                        MemoryRegion *address_space, MemoryRegion *io)
1248{
1249    s->scratch_size = SVGA_SCRATCH_SIZE;
1250    s->scratch = g_malloc(s->scratch_size * 4);
1251
1252    s->vga.con = graphic_console_init(dev, 0, &vmsvga_ops, s);
1253
1254    s->fifo_size = SVGA_FIFO_SIZE;
1255    memory_region_init_ram(&s->fifo_ram, NULL, "vmsvga.fifo", s->fifo_size,
1256                           &error_fatal);
1257    vmstate_register_ram_global(&s->fifo_ram);
1258    s->fifo_ptr = memory_region_get_ram_ptr(&s->fifo_ram);
1259
1260    vga_common_init(&s->vga, OBJECT(dev), true);
1261    vga_init(&s->vga, OBJECT(dev), address_space, io, true);
1262    vmstate_register(NULL, 0, &vmstate_vga_common, &s->vga);
1263    s->new_depth = 32;
1264}
1265
1266static uint64_t vmsvga_io_read(void *opaque, hwaddr addr, unsigned size)
1267{
1268    struct vmsvga_state_s *s = opaque;
1269
1270    switch (addr) {
1271    case SVGA_IO_MUL * SVGA_INDEX_PORT: return vmsvga_index_read(s, addr);
1272    case SVGA_IO_MUL * SVGA_VALUE_PORT: return vmsvga_value_read(s, addr);
1273    case SVGA_IO_MUL * SVGA_BIOS_PORT: return vmsvga_bios_read(s, addr);
1274    default: return -1u;
1275    }
1276}
1277
1278static void vmsvga_io_write(void *opaque, hwaddr addr,
1279                            uint64_t data, unsigned size)
1280{
1281    struct vmsvga_state_s *s = opaque;
1282
1283    switch (addr) {
1284    case SVGA_IO_MUL * SVGA_INDEX_PORT:
1285        vmsvga_index_write(s, addr, data);
1286        break;
1287    case SVGA_IO_MUL * SVGA_VALUE_PORT:
1288        vmsvga_value_write(s, addr, data);
1289        break;
1290    case SVGA_IO_MUL * SVGA_BIOS_PORT:
1291        vmsvga_bios_write(s, addr, data);
1292        break;
1293    }
1294}
1295
1296static const MemoryRegionOps vmsvga_io_ops = {
1297    .read = vmsvga_io_read,
1298    .write = vmsvga_io_write,
1299    .endianness = DEVICE_LITTLE_ENDIAN,
1300    .valid = {
1301        .min_access_size = 4,
1302        .max_access_size = 4,
1303        .unaligned = true,
1304    },
1305    .impl = {
1306        .unaligned = true,
1307    },
1308};
1309
1310static void pci_vmsvga_realize(PCIDevice *dev, Error **errp)
1311{
1312    struct pci_vmsvga_state_s *s = VMWARE_SVGA(dev);
1313
1314    dev->config[PCI_CACHE_LINE_SIZE] = 0x08;
1315    dev->config[PCI_LATENCY_TIMER] = 0x40;
1316    dev->config[PCI_INTERRUPT_LINE] = 0xff;          /* End */
1317
1318    memory_region_init_io(&s->io_bar, NULL, &vmsvga_io_ops, &s->chip,
1319                          "vmsvga-io", 0x10);
1320    memory_region_set_flush_coalesced(&s->io_bar);
1321    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1322
1323    vmsvga_init(DEVICE(dev), &s->chip,
1324                pci_address_space(dev), pci_address_space_io(dev));
1325
1326    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_MEM_PREFETCH,
1327                     &s->chip.vga.vram);
1328    pci_register_bar(dev, 2, PCI_BASE_ADDRESS_MEM_PREFETCH,
1329                     &s->chip.fifo_ram);
1330
1331    if (!dev->rom_bar) {
1332        /* compatibility with pc-0.13 and older */
1333        vga_init_vbe(&s->chip.vga, OBJECT(dev), pci_address_space(dev));
1334    }
1335}
1336
1337static Property vga_vmware_properties[] = {
1338    DEFINE_PROP_UINT32("vgamem_mb", struct pci_vmsvga_state_s,
1339                       chip.vga.vram_size_mb, 16),
1340    DEFINE_PROP_END_OF_LIST(),
1341};
1342
1343static void vmsvga_class_init(ObjectClass *klass, void *data)
1344{
1345    DeviceClass *dc = DEVICE_CLASS(klass);
1346    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1347
1348    k->realize = pci_vmsvga_realize;
1349    k->romfile = "vgabios-vmware.bin";
1350    k->vendor_id = PCI_VENDOR_ID_VMWARE;
1351    k->device_id = SVGA_PCI_DEVICE_ID;
1352    k->class_id = PCI_CLASS_DISPLAY_VGA;
1353    k->subsystem_vendor_id = PCI_VENDOR_ID_VMWARE;
1354    k->subsystem_id = SVGA_PCI_DEVICE_ID;
1355    dc->reset = vmsvga_reset;
1356    dc->vmsd = &vmstate_vmware_vga;
1357    dc->props = vga_vmware_properties;
1358    dc->hotpluggable = false;
1359    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
1360}
1361
1362static const TypeInfo vmsvga_info = {
1363    .name          = TYPE_VMWARE_SVGA,
1364    .parent        = TYPE_PCI_DEVICE,
1365    .instance_size = sizeof(struct pci_vmsvga_state_s),
1366    .class_init    = vmsvga_class_init,
1367};
1368
1369static void vmsvga_register_types(void)
1370{
1371    type_register_static(&vmsvga_info);
1372}
1373
1374type_init(vmsvga_register_types)
1375