qemu/hw/display/vmware_vga.c
<<
>>
Prefs
   1/*
   2 * QEMU VMware-SVGA "chipset".
   3 *
   4 * Copyright (c) 2007 Andrzej Zaborowski  <balrog@zabor.org>
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24
  25#include "qemu/osdep.h"
  26#include "qemu/module.h"
  27#include "qemu/units.h"
  28#include "qapi/error.h"
  29#include "hw/hw.h"
  30#include "hw/loader.h"
  31#include "trace.h"
  32#include "ui/vnc.h"
  33#include "hw/pci/pci.h"
  34
  35#undef VERBOSE
  36#define HW_RECT_ACCEL
  37#define HW_FILL_ACCEL
  38#define HW_MOUSE_ACCEL
  39
  40#include "vga_int.h"
  41
  42/* See http://vmware-svga.sf.net/ for some documentation on VMWare SVGA */
  43
  44struct vmsvga_state_s {
  45    VGACommonState vga;
  46
  47    int invalidated;
  48    int enable;
  49    int config;
  50    struct {
  51        int id;
  52        int x;
  53        int y;
  54        int on;
  55    } cursor;
  56
  57    int index;
  58    int scratch_size;
  59    uint32_t *scratch;
  60    int new_width;
  61    int new_height;
  62    int new_depth;
  63    uint32_t guest;
  64    uint32_t svgaid;
  65    int syncing;
  66
  67    MemoryRegion fifo_ram;
  68    uint8_t *fifo_ptr;
  69    unsigned int fifo_size;
  70
  71    uint32_t *fifo;
  72    uint32_t fifo_min;
  73    uint32_t fifo_max;
  74    uint32_t fifo_next;
  75    uint32_t fifo_stop;
  76
  77#define REDRAW_FIFO_LEN  512
  78    struct vmsvga_rect_s {
  79        int x, y, w, h;
  80    } redraw_fifo[REDRAW_FIFO_LEN];
  81    int redraw_fifo_first, redraw_fifo_last;
  82};
  83
  84#define TYPE_VMWARE_SVGA "vmware-svga"
  85
  86#define VMWARE_SVGA(obj) \
  87    OBJECT_CHECK(struct pci_vmsvga_state_s, (obj), TYPE_VMWARE_SVGA)
  88
  89struct pci_vmsvga_state_s {
  90    /*< private >*/
  91    PCIDevice parent_obj;
  92    /*< public >*/
  93
  94    struct vmsvga_state_s chip;
  95    MemoryRegion io_bar;
  96};
  97
  98#define SVGA_MAGIC              0x900000UL
  99#define SVGA_MAKE_ID(ver)       (SVGA_MAGIC << 8 | (ver))
 100#define SVGA_ID_0               SVGA_MAKE_ID(0)
 101#define SVGA_ID_1               SVGA_MAKE_ID(1)
 102#define SVGA_ID_2               SVGA_MAKE_ID(2)
 103
 104#define SVGA_LEGACY_BASE_PORT   0x4560
 105#define SVGA_INDEX_PORT         0x0
 106#define SVGA_VALUE_PORT         0x1
 107#define SVGA_BIOS_PORT          0x2
 108
 109#define SVGA_VERSION_2
 110
 111#ifdef SVGA_VERSION_2
 112# define SVGA_ID                SVGA_ID_2
 113# define SVGA_IO_BASE           SVGA_LEGACY_BASE_PORT
 114# define SVGA_IO_MUL            1
 115# define SVGA_FIFO_SIZE         0x10000
 116# define SVGA_PCI_DEVICE_ID     PCI_DEVICE_ID_VMWARE_SVGA2
 117#else
 118# define SVGA_ID                SVGA_ID_1
 119# define SVGA_IO_BASE           SVGA_LEGACY_BASE_PORT
 120# define SVGA_IO_MUL            4
 121# define SVGA_FIFO_SIZE         0x10000
 122# define SVGA_PCI_DEVICE_ID     PCI_DEVICE_ID_VMWARE_SVGA
 123#endif
 124
 125enum {
 126    /* ID 0, 1 and 2 registers */
 127    SVGA_REG_ID = 0,
 128    SVGA_REG_ENABLE = 1,
 129    SVGA_REG_WIDTH = 2,
 130    SVGA_REG_HEIGHT = 3,
 131    SVGA_REG_MAX_WIDTH = 4,
 132    SVGA_REG_MAX_HEIGHT = 5,
 133    SVGA_REG_DEPTH = 6,
 134    SVGA_REG_BITS_PER_PIXEL = 7,        /* Current bpp in the guest */
 135    SVGA_REG_PSEUDOCOLOR = 8,
 136    SVGA_REG_RED_MASK = 9,
 137    SVGA_REG_GREEN_MASK = 10,
 138    SVGA_REG_BLUE_MASK = 11,
 139    SVGA_REG_BYTES_PER_LINE = 12,
 140    SVGA_REG_FB_START = 13,
 141    SVGA_REG_FB_OFFSET = 14,
 142    SVGA_REG_VRAM_SIZE = 15,
 143    SVGA_REG_FB_SIZE = 16,
 144
 145    /* ID 1 and 2 registers */
 146    SVGA_REG_CAPABILITIES = 17,
 147    SVGA_REG_MEM_START = 18,            /* Memory for command FIFO */
 148    SVGA_REG_MEM_SIZE = 19,
 149    SVGA_REG_CONFIG_DONE = 20,          /* Set when memory area configured */
 150    SVGA_REG_SYNC = 21,                 /* Write to force synchronization */
 151    SVGA_REG_BUSY = 22,                 /* Read to check if sync is done */
 152    SVGA_REG_GUEST_ID = 23,             /* Set guest OS identifier */
 153    SVGA_REG_CURSOR_ID = 24,            /* ID of cursor */
 154    SVGA_REG_CURSOR_X = 25,             /* Set cursor X position */
 155    SVGA_REG_CURSOR_Y = 26,             /* Set cursor Y position */
 156    SVGA_REG_CURSOR_ON = 27,            /* Turn cursor on/off */
 157    SVGA_REG_HOST_BITS_PER_PIXEL = 28,  /* Current bpp in the host */
 158    SVGA_REG_SCRATCH_SIZE = 29,         /* Number of scratch registers */
 159    SVGA_REG_MEM_REGS = 30,             /* Number of FIFO registers */
 160    SVGA_REG_NUM_DISPLAYS = 31,         /* Number of guest displays */
 161    SVGA_REG_PITCHLOCK = 32,            /* Fixed pitch for all modes */
 162
 163    SVGA_PALETTE_BASE = 1024,           /* Base of SVGA color map */
 164    SVGA_PALETTE_END  = SVGA_PALETTE_BASE + 767,
 165    SVGA_SCRATCH_BASE = SVGA_PALETTE_BASE + 768,
 166};
 167
 168#define SVGA_CAP_NONE                   0
 169#define SVGA_CAP_RECT_FILL              (1 << 0)
 170#define SVGA_CAP_RECT_COPY              (1 << 1)
 171#define SVGA_CAP_RECT_PAT_FILL          (1 << 2)
 172#define SVGA_CAP_LEGACY_OFFSCREEN       (1 << 3)
 173#define SVGA_CAP_RASTER_OP              (1 << 4)
 174#define SVGA_CAP_CURSOR                 (1 << 5)
 175#define SVGA_CAP_CURSOR_BYPASS          (1 << 6)
 176#define SVGA_CAP_CURSOR_BYPASS_2        (1 << 7)
 177#define SVGA_CAP_8BIT_EMULATION         (1 << 8)
 178#define SVGA_CAP_ALPHA_CURSOR           (1 << 9)
 179#define SVGA_CAP_GLYPH                  (1 << 10)
 180#define SVGA_CAP_GLYPH_CLIPPING         (1 << 11)
 181#define SVGA_CAP_OFFSCREEN_1            (1 << 12)
 182#define SVGA_CAP_ALPHA_BLEND            (1 << 13)
 183#define SVGA_CAP_3D                     (1 << 14)
 184#define SVGA_CAP_EXTENDED_FIFO          (1 << 15)
 185#define SVGA_CAP_MULTIMON               (1 << 16)
 186#define SVGA_CAP_PITCHLOCK              (1 << 17)
 187
 188/*
 189 * FIFO offsets (seen as an array of 32-bit words)
 190 */
 191enum {
 192    /*
 193     * The original defined FIFO offsets
 194     */
 195    SVGA_FIFO_MIN = 0,
 196    SVGA_FIFO_MAX,      /* The distance from MIN to MAX must be at least 10K */
 197    SVGA_FIFO_NEXT,
 198    SVGA_FIFO_STOP,
 199
 200    /*
 201     * Additional offsets added as of SVGA_CAP_EXTENDED_FIFO
 202     */
 203    SVGA_FIFO_CAPABILITIES = 4,
 204    SVGA_FIFO_FLAGS,
 205    SVGA_FIFO_FENCE,
 206    SVGA_FIFO_3D_HWVERSION,
 207    SVGA_FIFO_PITCHLOCK,
 208};
 209
 210#define SVGA_FIFO_CAP_NONE              0
 211#define SVGA_FIFO_CAP_FENCE             (1 << 0)
 212#define SVGA_FIFO_CAP_ACCELFRONT        (1 << 1)
 213#define SVGA_FIFO_CAP_PITCHLOCK         (1 << 2)
 214
 215#define SVGA_FIFO_FLAG_NONE             0
 216#define SVGA_FIFO_FLAG_ACCELFRONT       (1 << 0)
 217
 218/* These values can probably be changed arbitrarily.  */
 219#define SVGA_SCRATCH_SIZE               0x8000
 220#define SVGA_MAX_WIDTH                  ROUND_UP(2360, VNC_DIRTY_PIXELS_PER_BIT)
 221#define SVGA_MAX_HEIGHT                 1770
 222
 223#ifdef VERBOSE
 224# define GUEST_OS_BASE          0x5001
 225static const char *vmsvga_guest_id[] = {
 226    [0x00] = "Dos",
 227    [0x01] = "Windows 3.1",
 228    [0x02] = "Windows 95",
 229    [0x03] = "Windows 98",
 230    [0x04] = "Windows ME",
 231    [0x05] = "Windows NT",
 232    [0x06] = "Windows 2000",
 233    [0x07] = "Linux",
 234    [0x08] = "OS/2",
 235    [0x09] = "an unknown OS",
 236    [0x0a] = "BSD",
 237    [0x0b] = "Whistler",
 238    [0x0c] = "an unknown OS",
 239    [0x0d] = "an unknown OS",
 240    [0x0e] = "an unknown OS",
 241    [0x0f] = "an unknown OS",
 242    [0x10] = "an unknown OS",
 243    [0x11] = "an unknown OS",
 244    [0x12] = "an unknown OS",
 245    [0x13] = "an unknown OS",
 246    [0x14] = "an unknown OS",
 247    [0x15] = "Windows 2003",
 248};
 249#endif
 250
 251enum {
 252    SVGA_CMD_INVALID_CMD = 0,
 253    SVGA_CMD_UPDATE = 1,
 254    SVGA_CMD_RECT_FILL = 2,
 255    SVGA_CMD_RECT_COPY = 3,
 256    SVGA_CMD_DEFINE_BITMAP = 4,
 257    SVGA_CMD_DEFINE_BITMAP_SCANLINE = 5,
 258    SVGA_CMD_DEFINE_PIXMAP = 6,
 259    SVGA_CMD_DEFINE_PIXMAP_SCANLINE = 7,
 260    SVGA_CMD_RECT_BITMAP_FILL = 8,
 261    SVGA_CMD_RECT_PIXMAP_FILL = 9,
 262    SVGA_CMD_RECT_BITMAP_COPY = 10,
 263    SVGA_CMD_RECT_PIXMAP_COPY = 11,
 264    SVGA_CMD_FREE_OBJECT = 12,
 265    SVGA_CMD_RECT_ROP_FILL = 13,
 266    SVGA_CMD_RECT_ROP_COPY = 14,
 267    SVGA_CMD_RECT_ROP_BITMAP_FILL = 15,
 268    SVGA_CMD_RECT_ROP_PIXMAP_FILL = 16,
 269    SVGA_CMD_RECT_ROP_BITMAP_COPY = 17,
 270    SVGA_CMD_RECT_ROP_PIXMAP_COPY = 18,
 271    SVGA_CMD_DEFINE_CURSOR = 19,
 272    SVGA_CMD_DISPLAY_CURSOR = 20,
 273    SVGA_CMD_MOVE_CURSOR = 21,
 274    SVGA_CMD_DEFINE_ALPHA_CURSOR = 22,
 275    SVGA_CMD_DRAW_GLYPH = 23,
 276    SVGA_CMD_DRAW_GLYPH_CLIPPED = 24,
 277    SVGA_CMD_UPDATE_VERBOSE = 25,
 278    SVGA_CMD_SURFACE_FILL = 26,
 279    SVGA_CMD_SURFACE_COPY = 27,
 280    SVGA_CMD_SURFACE_ALPHA_BLEND = 28,
 281    SVGA_CMD_FRONT_ROP_FILL = 29,
 282    SVGA_CMD_FENCE = 30,
 283};
 284
 285/* Legal values for the SVGA_REG_CURSOR_ON register in cursor bypass mode */
 286enum {
 287    SVGA_CURSOR_ON_HIDE = 0,
 288    SVGA_CURSOR_ON_SHOW = 1,
 289    SVGA_CURSOR_ON_REMOVE_FROM_FB = 2,
 290    SVGA_CURSOR_ON_RESTORE_TO_FB = 3,
 291};
 292
 293static inline bool vmsvga_verify_rect(DisplaySurface *surface,
 294                                      const char *name,
 295                                      int x, int y, int w, int h)
 296{
 297    if (x < 0) {
 298        fprintf(stderr, "%s: x was < 0 (%d)\n", name, x);
 299        return false;
 300    }
 301    if (x > SVGA_MAX_WIDTH) {
 302        fprintf(stderr, "%s: x was > %d (%d)\n", name, SVGA_MAX_WIDTH, x);
 303        return false;
 304    }
 305    if (w < 0) {
 306        fprintf(stderr, "%s: w was < 0 (%d)\n", name, w);
 307        return false;
 308    }
 309    if (w > SVGA_MAX_WIDTH) {
 310        fprintf(stderr, "%s: w was > %d (%d)\n", name, SVGA_MAX_WIDTH, w);
 311        return false;
 312    }
 313    if (x + w > surface_width(surface)) {
 314        fprintf(stderr, "%s: width was > %d (x: %d, w: %d)\n",
 315                name, surface_width(surface), x, w);
 316        return false;
 317    }
 318
 319    if (y < 0) {
 320        fprintf(stderr, "%s: y was < 0 (%d)\n", name, y);
 321        return false;
 322    }
 323    if (y > SVGA_MAX_HEIGHT) {
 324        fprintf(stderr, "%s: y was > %d (%d)\n", name, SVGA_MAX_HEIGHT, y);
 325        return false;
 326    }
 327    if (h < 0) {
 328        fprintf(stderr, "%s: h was < 0 (%d)\n", name, h);
 329        return false;
 330    }
 331    if (h > SVGA_MAX_HEIGHT) {
 332        fprintf(stderr, "%s: h was > %d (%d)\n", name, SVGA_MAX_HEIGHT, h);
 333        return false;
 334    }
 335    if (y + h > surface_height(surface)) {
 336        fprintf(stderr, "%s: update height > %d (y: %d, h: %d)\n",
 337                name, surface_height(surface), y, h);
 338        return false;
 339    }
 340
 341    return true;
 342}
 343
 344static inline void vmsvga_update_rect(struct vmsvga_state_s *s,
 345                                      int x, int y, int w, int h)
 346{
 347    DisplaySurface *surface = qemu_console_surface(s->vga.con);
 348    int line;
 349    int bypl;
 350    int width;
 351    int start;
 352    uint8_t *src;
 353    uint8_t *dst;
 354
 355    if (!vmsvga_verify_rect(surface, __func__, x, y, w, h)) {
 356        /* go for a fullscreen update as fallback */
 357        x = 0;
 358        y = 0;
 359        w = surface_width(surface);
 360        h = surface_height(surface);
 361    }
 362
 363    bypl = surface_stride(surface);
 364    width = surface_bytes_per_pixel(surface) * w;
 365    start = surface_bytes_per_pixel(surface) * x + bypl * y;
 366    src = s->vga.vram_ptr + start;
 367    dst = surface_data(surface) + start;
 368
 369    for (line = h; line > 0; line--, src += bypl, dst += bypl) {
 370        memcpy(dst, src, width);
 371    }
 372    dpy_gfx_update(s->vga.con, x, y, w, h);
 373}
 374
 375static inline void vmsvga_update_rect_delayed(struct vmsvga_state_s *s,
 376                int x, int y, int w, int h)
 377{
 378    struct vmsvga_rect_s *rect = &s->redraw_fifo[s->redraw_fifo_last++];
 379
 380    s->redraw_fifo_last &= REDRAW_FIFO_LEN - 1;
 381    rect->x = x;
 382    rect->y = y;
 383    rect->w = w;
 384    rect->h = h;
 385}
 386
 387static inline void vmsvga_update_rect_flush(struct vmsvga_state_s *s)
 388{
 389    struct vmsvga_rect_s *rect;
 390
 391    if (s->invalidated) {
 392        s->redraw_fifo_first = s->redraw_fifo_last;
 393        return;
 394    }
 395    /* Overlapping region updates can be optimised out here - if someone
 396     * knows a smart algorithm to do that, please share.  */
 397    while (s->redraw_fifo_first != s->redraw_fifo_last) {
 398        rect = &s->redraw_fifo[s->redraw_fifo_first++];
 399        s->redraw_fifo_first &= REDRAW_FIFO_LEN - 1;
 400        vmsvga_update_rect(s, rect->x, rect->y, rect->w, rect->h);
 401    }
 402}
 403
 404#ifdef HW_RECT_ACCEL
 405static inline int vmsvga_copy_rect(struct vmsvga_state_s *s,
 406                int x0, int y0, int x1, int y1, int w, int h)
 407{
 408    DisplaySurface *surface = qemu_console_surface(s->vga.con);
 409    uint8_t *vram = s->vga.vram_ptr;
 410    int bypl = surface_stride(surface);
 411    int bypp = surface_bytes_per_pixel(surface);
 412    int width = bypp * w;
 413    int line = h;
 414    uint8_t *ptr[2];
 415
 416    if (!vmsvga_verify_rect(surface, "vmsvga_copy_rect/src", x0, y0, w, h)) {
 417        return -1;
 418    }
 419    if (!vmsvga_verify_rect(surface, "vmsvga_copy_rect/dst", x1, y1, w, h)) {
 420        return -1;
 421    }
 422
 423    if (y1 > y0) {
 424        ptr[0] = vram + bypp * x0 + bypl * (y0 + h - 1);
 425        ptr[1] = vram + bypp * x1 + bypl * (y1 + h - 1);
 426        for (; line > 0; line --, ptr[0] -= bypl, ptr[1] -= bypl) {
 427            memmove(ptr[1], ptr[0], width);
 428        }
 429    } else {
 430        ptr[0] = vram + bypp * x0 + bypl * y0;
 431        ptr[1] = vram + bypp * x1 + bypl * y1;
 432        for (; line > 0; line --, ptr[0] += bypl, ptr[1] += bypl) {
 433            memmove(ptr[1], ptr[0], width);
 434        }
 435    }
 436
 437    vmsvga_update_rect_delayed(s, x1, y1, w, h);
 438    return 0;
 439}
 440#endif
 441
 442#ifdef HW_FILL_ACCEL
 443static inline int vmsvga_fill_rect(struct vmsvga_state_s *s,
 444                uint32_t c, int x, int y, int w, int h)
 445{
 446    DisplaySurface *surface = qemu_console_surface(s->vga.con);
 447    int bypl = surface_stride(surface);
 448    int width = surface_bytes_per_pixel(surface) * w;
 449    int line = h;
 450    int column;
 451    uint8_t *fst;
 452    uint8_t *dst;
 453    uint8_t *src;
 454    uint8_t col[4];
 455
 456    if (!vmsvga_verify_rect(surface, __func__, x, y, w, h)) {
 457        return -1;
 458    }
 459
 460    col[0] = c;
 461    col[1] = c >> 8;
 462    col[2] = c >> 16;
 463    col[3] = c >> 24;
 464
 465    fst = s->vga.vram_ptr + surface_bytes_per_pixel(surface) * x + bypl * y;
 466
 467    if (line--) {
 468        dst = fst;
 469        src = col;
 470        for (column = width; column > 0; column--) {
 471            *(dst++) = *(src++);
 472            if (src - col == surface_bytes_per_pixel(surface)) {
 473                src = col;
 474            }
 475        }
 476        dst = fst;
 477        for (; line > 0; line--) {
 478            dst += bypl;
 479            memcpy(dst, fst, width);
 480        }
 481    }
 482
 483    vmsvga_update_rect_delayed(s, x, y, w, h);
 484    return 0;
 485}
 486#endif
 487
 488struct vmsvga_cursor_definition_s {
 489    uint32_t width;
 490    uint32_t height;
 491    int id;
 492    uint32_t bpp;
 493    int hot_x;
 494    int hot_y;
 495    uint32_t mask[1024];
 496    uint32_t image[4096];
 497};
 498
 499#define SVGA_BITMAP_SIZE(w, h)          ((((w) + 31) >> 5) * (h))
 500#define SVGA_PIXMAP_SIZE(w, h, bpp)     (((((w) * (bpp)) + 31) >> 5) * (h))
 501
 502#ifdef HW_MOUSE_ACCEL
 503static inline void vmsvga_cursor_define(struct vmsvga_state_s *s,
 504                struct vmsvga_cursor_definition_s *c)
 505{
 506    QEMUCursor *qc;
 507    int i, pixels;
 508
 509    qc = cursor_alloc(c->width, c->height);
 510    qc->hot_x = c->hot_x;
 511    qc->hot_y = c->hot_y;
 512    switch (c->bpp) {
 513    case 1:
 514        cursor_set_mono(qc, 0xffffff, 0x000000, (void *)c->image,
 515                        1, (void *)c->mask);
 516#ifdef DEBUG
 517        cursor_print_ascii_art(qc, "vmware/mono");
 518#endif
 519        break;
 520    case 32:
 521        /* fill alpha channel from mask, set color to zero */
 522        cursor_set_mono(qc, 0x000000, 0x000000, (void *)c->mask,
 523                        1, (void *)c->mask);
 524        /* add in rgb values */
 525        pixels = c->width * c->height;
 526        for (i = 0; i < pixels; i++) {
 527            qc->data[i] |= c->image[i] & 0xffffff;
 528        }
 529#ifdef DEBUG
 530        cursor_print_ascii_art(qc, "vmware/32bit");
 531#endif
 532        break;
 533    default:
 534        fprintf(stderr, "%s: unhandled bpp %d, using fallback cursor\n",
 535                __func__, c->bpp);
 536        cursor_put(qc);
 537        qc = cursor_builtin_left_ptr();
 538    }
 539
 540    dpy_cursor_define(s->vga.con, qc);
 541    cursor_put(qc);
 542}
 543#endif
 544
 545static inline int vmsvga_fifo_length(struct vmsvga_state_s *s)
 546{
 547    int num;
 548
 549    if (!s->config || !s->enable) {
 550        return 0;
 551    }
 552
 553    s->fifo_min  = le32_to_cpu(s->fifo[SVGA_FIFO_MIN]);
 554    s->fifo_max  = le32_to_cpu(s->fifo[SVGA_FIFO_MAX]);
 555    s->fifo_next = le32_to_cpu(s->fifo[SVGA_FIFO_NEXT]);
 556    s->fifo_stop = le32_to_cpu(s->fifo[SVGA_FIFO_STOP]);
 557
 558    /* Check range and alignment.  */
 559    if ((s->fifo_min | s->fifo_max | s->fifo_next | s->fifo_stop) & 3) {
 560        return 0;
 561    }
 562    if (s->fifo_min < sizeof(uint32_t) * 4) {
 563        return 0;
 564    }
 565    if (s->fifo_max > SVGA_FIFO_SIZE ||
 566        s->fifo_min >= SVGA_FIFO_SIZE ||
 567        s->fifo_stop >= SVGA_FIFO_SIZE ||
 568        s->fifo_next >= SVGA_FIFO_SIZE) {
 569        return 0;
 570    }
 571    if (s->fifo_max < s->fifo_min + 10 * KiB) {
 572        return 0;
 573    }
 574
 575    num = s->fifo_next - s->fifo_stop;
 576    if (num < 0) {
 577        num += s->fifo_max - s->fifo_min;
 578    }
 579    return num >> 2;
 580}
 581
 582static inline uint32_t vmsvga_fifo_read_raw(struct vmsvga_state_s *s)
 583{
 584    uint32_t cmd = s->fifo[s->fifo_stop >> 2];
 585
 586    s->fifo_stop += 4;
 587    if (s->fifo_stop >= s->fifo_max) {
 588        s->fifo_stop = s->fifo_min;
 589    }
 590    s->fifo[SVGA_FIFO_STOP] = cpu_to_le32(s->fifo_stop);
 591    return cmd;
 592}
 593
 594static inline uint32_t vmsvga_fifo_read(struct vmsvga_state_s *s)
 595{
 596    return le32_to_cpu(vmsvga_fifo_read_raw(s));
 597}
 598
 599static void vmsvga_fifo_run(struct vmsvga_state_s *s)
 600{
 601    uint32_t cmd, colour;
 602    int args, len, maxloop = 1024;
 603    int x, y, dx, dy, width, height;
 604    struct vmsvga_cursor_definition_s cursor;
 605    uint32_t cmd_start;
 606
 607    len = vmsvga_fifo_length(s);
 608    while (len > 0 && --maxloop > 0) {
 609        /* May need to go back to the start of the command if incomplete */
 610        cmd_start = s->fifo_stop;
 611
 612        switch (cmd = vmsvga_fifo_read(s)) {
 613        case SVGA_CMD_UPDATE:
 614        case SVGA_CMD_UPDATE_VERBOSE:
 615            len -= 5;
 616            if (len < 0) {
 617                goto rewind;
 618            }
 619
 620            x = vmsvga_fifo_read(s);
 621            y = vmsvga_fifo_read(s);
 622            width = vmsvga_fifo_read(s);
 623            height = vmsvga_fifo_read(s);
 624            vmsvga_update_rect_delayed(s, x, y, width, height);
 625            break;
 626
 627        case SVGA_CMD_RECT_FILL:
 628            len -= 6;
 629            if (len < 0) {
 630                goto rewind;
 631            }
 632
 633            colour = vmsvga_fifo_read(s);
 634            x = vmsvga_fifo_read(s);
 635            y = vmsvga_fifo_read(s);
 636            width = vmsvga_fifo_read(s);
 637            height = vmsvga_fifo_read(s);
 638#ifdef HW_FILL_ACCEL
 639            if (vmsvga_fill_rect(s, colour, x, y, width, height) == 0) {
 640                break;
 641            }
 642#endif
 643            args = 0;
 644            goto badcmd;
 645
 646        case SVGA_CMD_RECT_COPY:
 647            len -= 7;
 648            if (len < 0) {
 649                goto rewind;
 650            }
 651
 652            x = vmsvga_fifo_read(s);
 653            y = vmsvga_fifo_read(s);
 654            dx = vmsvga_fifo_read(s);
 655            dy = vmsvga_fifo_read(s);
 656            width = vmsvga_fifo_read(s);
 657            height = vmsvga_fifo_read(s);
 658#ifdef HW_RECT_ACCEL
 659            if (vmsvga_copy_rect(s, x, y, dx, dy, width, height) == 0) {
 660                break;
 661            }
 662#endif
 663            args = 0;
 664            goto badcmd;
 665
 666        case SVGA_CMD_DEFINE_CURSOR:
 667            len -= 8;
 668            if (len < 0) {
 669                goto rewind;
 670            }
 671
 672            cursor.id = vmsvga_fifo_read(s);
 673            cursor.hot_x = vmsvga_fifo_read(s);
 674            cursor.hot_y = vmsvga_fifo_read(s);
 675            cursor.width = x = vmsvga_fifo_read(s);
 676            cursor.height = y = vmsvga_fifo_read(s);
 677            vmsvga_fifo_read(s);
 678            cursor.bpp = vmsvga_fifo_read(s);
 679
 680            args = SVGA_BITMAP_SIZE(x, y) + SVGA_PIXMAP_SIZE(x, y, cursor.bpp);
 681            if (cursor.width > 256
 682                || cursor.height > 256
 683                || cursor.bpp > 32
 684                || SVGA_BITMAP_SIZE(x, y) > ARRAY_SIZE(cursor.mask)
 685                || SVGA_PIXMAP_SIZE(x, y, cursor.bpp)
 686                    > ARRAY_SIZE(cursor.image)) {
 687                    goto badcmd;
 688            }
 689
 690            len -= args;
 691            if (len < 0) {
 692                goto rewind;
 693            }
 694
 695            for (args = 0; args < SVGA_BITMAP_SIZE(x, y); args++) {
 696                cursor.mask[args] = vmsvga_fifo_read_raw(s);
 697            }
 698            for (args = 0; args < SVGA_PIXMAP_SIZE(x, y, cursor.bpp); args++) {
 699                cursor.image[args] = vmsvga_fifo_read_raw(s);
 700            }
 701#ifdef HW_MOUSE_ACCEL
 702            vmsvga_cursor_define(s, &cursor);
 703            break;
 704#else
 705            args = 0;
 706            goto badcmd;
 707#endif
 708
 709        /*
 710         * Other commands that we at least know the number of arguments
 711         * for so we can avoid FIFO desync if driver uses them illegally.
 712         */
 713        case SVGA_CMD_DEFINE_ALPHA_CURSOR:
 714            len -= 6;
 715            if (len < 0) {
 716                goto rewind;
 717            }
 718            vmsvga_fifo_read(s);
 719            vmsvga_fifo_read(s);
 720            vmsvga_fifo_read(s);
 721            x = vmsvga_fifo_read(s);
 722            y = vmsvga_fifo_read(s);
 723            args = x * y;
 724            goto badcmd;
 725        case SVGA_CMD_RECT_ROP_FILL:
 726            args = 6;
 727            goto badcmd;
 728        case SVGA_CMD_RECT_ROP_COPY:
 729            args = 7;
 730            goto badcmd;
 731        case SVGA_CMD_DRAW_GLYPH_CLIPPED:
 732            len -= 4;
 733            if (len < 0) {
 734                goto rewind;
 735            }
 736            vmsvga_fifo_read(s);
 737            vmsvga_fifo_read(s);
 738            args = 7 + (vmsvga_fifo_read(s) >> 2);
 739            goto badcmd;
 740        case SVGA_CMD_SURFACE_ALPHA_BLEND:
 741            args = 12;
 742            goto badcmd;
 743
 744        /*
 745         * Other commands that are not listed as depending on any
 746         * CAPABILITIES bits, but are not described in the README either.
 747         */
 748        case SVGA_CMD_SURFACE_FILL:
 749        case SVGA_CMD_SURFACE_COPY:
 750        case SVGA_CMD_FRONT_ROP_FILL:
 751        case SVGA_CMD_FENCE:
 752        case SVGA_CMD_INVALID_CMD:
 753            break; /* Nop */
 754
 755        default:
 756            args = 0;
 757        badcmd:
 758            len -= args;
 759            if (len < 0) {
 760                goto rewind;
 761            }
 762            while (args--) {
 763                vmsvga_fifo_read(s);
 764            }
 765            printf("%s: Unknown command 0x%02x in SVGA command FIFO\n",
 766                   __func__, cmd);
 767            break;
 768
 769        rewind:
 770            s->fifo_stop = cmd_start;
 771            s->fifo[SVGA_FIFO_STOP] = cpu_to_le32(s->fifo_stop);
 772            break;
 773        }
 774    }
 775
 776    s->syncing = 0;
 777}
 778
 779static uint32_t vmsvga_index_read(void *opaque, uint32_t address)
 780{
 781    struct vmsvga_state_s *s = opaque;
 782
 783    return s->index;
 784}
 785
 786static void vmsvga_index_write(void *opaque, uint32_t address, uint32_t index)
 787{
 788    struct vmsvga_state_s *s = opaque;
 789
 790    s->index = index;
 791}
 792
 793static uint32_t vmsvga_value_read(void *opaque, uint32_t address)
 794{
 795    uint32_t caps;
 796    struct vmsvga_state_s *s = opaque;
 797    DisplaySurface *surface = qemu_console_surface(s->vga.con);
 798    PixelFormat pf;
 799    uint32_t ret;
 800
 801    switch (s->index) {
 802    case SVGA_REG_ID:
 803        ret = s->svgaid;
 804        break;
 805
 806    case SVGA_REG_ENABLE:
 807        ret = s->enable;
 808        break;
 809
 810    case SVGA_REG_WIDTH:
 811        ret = s->new_width ? s->new_width : surface_width(surface);
 812        break;
 813
 814    case SVGA_REG_HEIGHT:
 815        ret = s->new_height ? s->new_height : surface_height(surface);
 816        break;
 817
 818    case SVGA_REG_MAX_WIDTH:
 819        ret = SVGA_MAX_WIDTH;
 820        break;
 821
 822    case SVGA_REG_MAX_HEIGHT:
 823        ret = SVGA_MAX_HEIGHT;
 824        break;
 825
 826    case SVGA_REG_DEPTH:
 827        ret = (s->new_depth == 32) ? 24 : s->new_depth;
 828        break;
 829
 830    case SVGA_REG_BITS_PER_PIXEL:
 831    case SVGA_REG_HOST_BITS_PER_PIXEL:
 832        ret = s->new_depth;
 833        break;
 834
 835    case SVGA_REG_PSEUDOCOLOR:
 836        ret = 0x0;
 837        break;
 838
 839    case SVGA_REG_RED_MASK:
 840        pf = qemu_default_pixelformat(s->new_depth);
 841        ret = pf.rmask;
 842        break;
 843
 844    case SVGA_REG_GREEN_MASK:
 845        pf = qemu_default_pixelformat(s->new_depth);
 846        ret = pf.gmask;
 847        break;
 848
 849    case SVGA_REG_BLUE_MASK:
 850        pf = qemu_default_pixelformat(s->new_depth);
 851        ret = pf.bmask;
 852        break;
 853
 854    case SVGA_REG_BYTES_PER_LINE:
 855        if (s->new_width) {
 856            ret = (s->new_depth * s->new_width) / 8;
 857        } else {
 858            ret = surface_stride(surface);
 859        }
 860        break;
 861
 862    case SVGA_REG_FB_START: {
 863        struct pci_vmsvga_state_s *pci_vmsvga
 864            = container_of(s, struct pci_vmsvga_state_s, chip);
 865        ret = pci_get_bar_addr(PCI_DEVICE(pci_vmsvga), 1);
 866        break;
 867    }
 868
 869    case SVGA_REG_FB_OFFSET:
 870        ret = 0x0;
 871        break;
 872
 873    case SVGA_REG_VRAM_SIZE:
 874        ret = s->vga.vram_size; /* No physical VRAM besides the framebuffer */
 875        break;
 876
 877    case SVGA_REG_FB_SIZE:
 878        ret = s->vga.vram_size;
 879        break;
 880
 881    case SVGA_REG_CAPABILITIES:
 882        caps = SVGA_CAP_NONE;
 883#ifdef HW_RECT_ACCEL
 884        caps |= SVGA_CAP_RECT_COPY;
 885#endif
 886#ifdef HW_FILL_ACCEL
 887        caps |= SVGA_CAP_RECT_FILL;
 888#endif
 889#ifdef HW_MOUSE_ACCEL
 890        if (dpy_cursor_define_supported(s->vga.con)) {
 891            caps |= SVGA_CAP_CURSOR | SVGA_CAP_CURSOR_BYPASS_2 |
 892                    SVGA_CAP_CURSOR_BYPASS;
 893        }
 894#endif
 895        ret = caps;
 896        break;
 897
 898    case SVGA_REG_MEM_START: {
 899        struct pci_vmsvga_state_s *pci_vmsvga
 900            = container_of(s, struct pci_vmsvga_state_s, chip);
 901        ret = pci_get_bar_addr(PCI_DEVICE(pci_vmsvga), 2);
 902        break;
 903    }
 904
 905    case SVGA_REG_MEM_SIZE:
 906        ret = s->fifo_size;
 907        break;
 908
 909    case SVGA_REG_CONFIG_DONE:
 910        ret = s->config;
 911        break;
 912
 913    case SVGA_REG_SYNC:
 914    case SVGA_REG_BUSY:
 915        ret = s->syncing;
 916        break;
 917
 918    case SVGA_REG_GUEST_ID:
 919        ret = s->guest;
 920        break;
 921
 922    case SVGA_REG_CURSOR_ID:
 923        ret = s->cursor.id;
 924        break;
 925
 926    case SVGA_REG_CURSOR_X:
 927        ret = s->cursor.x;
 928        break;
 929
 930    case SVGA_REG_CURSOR_Y:
 931        ret = s->cursor.y;
 932        break;
 933
 934    case SVGA_REG_CURSOR_ON:
 935        ret = s->cursor.on;
 936        break;
 937
 938    case SVGA_REG_SCRATCH_SIZE:
 939        ret = s->scratch_size;
 940        break;
 941
 942    case SVGA_REG_MEM_REGS:
 943    case SVGA_REG_NUM_DISPLAYS:
 944    case SVGA_REG_PITCHLOCK:
 945    case SVGA_PALETTE_BASE ... SVGA_PALETTE_END:
 946        ret = 0;
 947        break;
 948
 949    default:
 950        if (s->index >= SVGA_SCRATCH_BASE &&
 951            s->index < SVGA_SCRATCH_BASE + s->scratch_size) {
 952            ret = s->scratch[s->index - SVGA_SCRATCH_BASE];
 953            break;
 954        }
 955        printf("%s: Bad register %02x\n", __func__, s->index);
 956        ret = 0;
 957        break;
 958    }
 959
 960    if (s->index >= SVGA_SCRATCH_BASE) {
 961        trace_vmware_scratch_read(s->index, ret);
 962    } else if (s->index >= SVGA_PALETTE_BASE) {
 963        trace_vmware_palette_read(s->index, ret);
 964    } else {
 965        trace_vmware_value_read(s->index, ret);
 966    }
 967    return ret;
 968}
 969
 970static void vmsvga_value_write(void *opaque, uint32_t address, uint32_t value)
 971{
 972    struct vmsvga_state_s *s = opaque;
 973
 974    if (s->index >= SVGA_SCRATCH_BASE) {
 975        trace_vmware_scratch_write(s->index, value);
 976    } else if (s->index >= SVGA_PALETTE_BASE) {
 977        trace_vmware_palette_write(s->index, value);
 978    } else {
 979        trace_vmware_value_write(s->index, value);
 980    }
 981    switch (s->index) {
 982    case SVGA_REG_ID:
 983        if (value == SVGA_ID_2 || value == SVGA_ID_1 || value == SVGA_ID_0) {
 984            s->svgaid = value;
 985        }
 986        break;
 987
 988    case SVGA_REG_ENABLE:
 989        s->enable = !!value;
 990        s->invalidated = 1;
 991        s->vga.hw_ops->invalidate(&s->vga);
 992        if (s->enable && s->config) {
 993            vga_dirty_log_stop(&s->vga);
 994        } else {
 995            vga_dirty_log_start(&s->vga);
 996        }
 997        break;
 998
 999    case SVGA_REG_WIDTH:
1000        if (value <= SVGA_MAX_WIDTH) {
1001            s->new_width = value;
1002            s->invalidated = 1;
1003        } else {
1004            printf("%s: Bad width: %i\n", __func__, value);
1005        }
1006        break;
1007
1008    case SVGA_REG_HEIGHT:
1009        if (value <= SVGA_MAX_HEIGHT) {
1010            s->new_height = value;
1011            s->invalidated = 1;
1012        } else {
1013            printf("%s: Bad height: %i\n", __func__, value);
1014        }
1015        break;
1016
1017    case SVGA_REG_BITS_PER_PIXEL:
1018        if (value != 32) {
1019            printf("%s: Bad bits per pixel: %i bits\n", __func__, value);
1020            s->config = 0;
1021            s->invalidated = 1;
1022        }
1023        break;
1024
1025    case SVGA_REG_CONFIG_DONE:
1026        if (value) {
1027            s->fifo = (uint32_t *) s->fifo_ptr;
1028            vga_dirty_log_stop(&s->vga);
1029        }
1030        s->config = !!value;
1031        break;
1032
1033    case SVGA_REG_SYNC:
1034        s->syncing = 1;
1035        vmsvga_fifo_run(s); /* Or should we just wait for update_display? */
1036        break;
1037
1038    case SVGA_REG_GUEST_ID:
1039        s->guest = value;
1040#ifdef VERBOSE
1041        if (value >= GUEST_OS_BASE && value < GUEST_OS_BASE +
1042            ARRAY_SIZE(vmsvga_guest_id)) {
1043            printf("%s: guest runs %s.\n", __func__,
1044                   vmsvga_guest_id[value - GUEST_OS_BASE]);
1045        }
1046#endif
1047        break;
1048
1049    case SVGA_REG_CURSOR_ID:
1050        s->cursor.id = value;
1051        break;
1052
1053    case SVGA_REG_CURSOR_X:
1054        s->cursor.x = value;
1055        break;
1056
1057    case SVGA_REG_CURSOR_Y:
1058        s->cursor.y = value;
1059        break;
1060
1061    case SVGA_REG_CURSOR_ON:
1062        s->cursor.on |= (value == SVGA_CURSOR_ON_SHOW);
1063        s->cursor.on &= (value != SVGA_CURSOR_ON_HIDE);
1064#ifdef HW_MOUSE_ACCEL
1065        if (value <= SVGA_CURSOR_ON_SHOW) {
1066            dpy_mouse_set(s->vga.con, s->cursor.x, s->cursor.y, s->cursor.on);
1067        }
1068#endif
1069        break;
1070
1071    case SVGA_REG_DEPTH:
1072    case SVGA_REG_MEM_REGS:
1073    case SVGA_REG_NUM_DISPLAYS:
1074    case SVGA_REG_PITCHLOCK:
1075    case SVGA_PALETTE_BASE ... SVGA_PALETTE_END:
1076        break;
1077
1078    default:
1079        if (s->index >= SVGA_SCRATCH_BASE &&
1080                s->index < SVGA_SCRATCH_BASE + s->scratch_size) {
1081            s->scratch[s->index - SVGA_SCRATCH_BASE] = value;
1082            break;
1083        }
1084        printf("%s: Bad register %02x\n", __func__, s->index);
1085    }
1086}
1087
1088static uint32_t vmsvga_bios_read(void *opaque, uint32_t address)
1089{
1090    printf("%s: what are we supposed to return?\n", __func__);
1091    return 0xcafe;
1092}
1093
1094static void vmsvga_bios_write(void *opaque, uint32_t address, uint32_t data)
1095{
1096    printf("%s: what are we supposed to do with (%08x)?\n", __func__, data);
1097}
1098
1099static inline void vmsvga_check_size(struct vmsvga_state_s *s)
1100{
1101    DisplaySurface *surface = qemu_console_surface(s->vga.con);
1102
1103    if (s->new_width != surface_width(surface) ||
1104        s->new_height != surface_height(surface) ||
1105        s->new_depth != surface_bits_per_pixel(surface)) {
1106        int stride = (s->new_depth * s->new_width) / 8;
1107        pixman_format_code_t format =
1108            qemu_default_pixman_format(s->new_depth, true);
1109        trace_vmware_setmode(s->new_width, s->new_height, s->new_depth);
1110        surface = qemu_create_displaysurface_from(s->new_width, s->new_height,
1111                                                  format, stride,
1112                                                  s->vga.vram_ptr);
1113        dpy_gfx_replace_surface(s->vga.con, surface);
1114        s->invalidated = 1;
1115    }
1116}
1117
1118static void vmsvga_update_display(void *opaque)
1119{
1120    struct vmsvga_state_s *s = opaque;
1121
1122    if (!s->enable || !s->config) {
1123        /* in standard vga mode */
1124        s->vga.hw_ops->gfx_update(&s->vga);
1125        return;
1126    }
1127
1128    vmsvga_check_size(s);
1129
1130    vmsvga_fifo_run(s);
1131    vmsvga_update_rect_flush(s);
1132
1133    if (s->invalidated) {
1134        s->invalidated = 0;
1135        dpy_gfx_update_full(s->vga.con);
1136    }
1137}
1138
1139static void vmsvga_reset(DeviceState *dev)
1140{
1141    struct pci_vmsvga_state_s *pci = VMWARE_SVGA(dev);
1142    struct vmsvga_state_s *s = &pci->chip;
1143
1144    s->index = 0;
1145    s->enable = 0;
1146    s->config = 0;
1147    s->svgaid = SVGA_ID;
1148    s->cursor.on = 0;
1149    s->redraw_fifo_first = 0;
1150    s->redraw_fifo_last = 0;
1151    s->syncing = 0;
1152
1153    vga_dirty_log_start(&s->vga);
1154}
1155
1156static void vmsvga_invalidate_display(void *opaque)
1157{
1158    struct vmsvga_state_s *s = opaque;
1159    if (!s->enable) {
1160        s->vga.hw_ops->invalidate(&s->vga);
1161        return;
1162    }
1163
1164    s->invalidated = 1;
1165}
1166
1167static void vmsvga_text_update(void *opaque, console_ch_t *chardata)
1168{
1169    struct vmsvga_state_s *s = opaque;
1170
1171    if (s->vga.hw_ops->text_update) {
1172        s->vga.hw_ops->text_update(&s->vga, chardata);
1173    }
1174}
1175
1176static int vmsvga_post_load(void *opaque, int version_id)
1177{
1178    struct vmsvga_state_s *s = opaque;
1179
1180    s->invalidated = 1;
1181    if (s->config) {
1182        s->fifo = (uint32_t *) s->fifo_ptr;
1183    }
1184    return 0;
1185}
1186
1187static const VMStateDescription vmstate_vmware_vga_internal = {
1188    .name = "vmware_vga_internal",
1189    .version_id = 0,
1190    .minimum_version_id = 0,
1191    .post_load = vmsvga_post_load,
1192    .fields = (VMStateField[]) {
1193        VMSTATE_INT32_EQUAL(new_depth, struct vmsvga_state_s, NULL),
1194        VMSTATE_INT32(enable, struct vmsvga_state_s),
1195        VMSTATE_INT32(config, struct vmsvga_state_s),
1196        VMSTATE_INT32(cursor.id, struct vmsvga_state_s),
1197        VMSTATE_INT32(cursor.x, struct vmsvga_state_s),
1198        VMSTATE_INT32(cursor.y, struct vmsvga_state_s),
1199        VMSTATE_INT32(cursor.on, struct vmsvga_state_s),
1200        VMSTATE_INT32(index, struct vmsvga_state_s),
1201        VMSTATE_VARRAY_INT32(scratch, struct vmsvga_state_s,
1202                             scratch_size, 0, vmstate_info_uint32, uint32_t),
1203        VMSTATE_INT32(new_width, struct vmsvga_state_s),
1204        VMSTATE_INT32(new_height, struct vmsvga_state_s),
1205        VMSTATE_UINT32(guest, struct vmsvga_state_s),
1206        VMSTATE_UINT32(svgaid, struct vmsvga_state_s),
1207        VMSTATE_INT32(syncing, struct vmsvga_state_s),
1208        VMSTATE_UNUSED(4), /* was fb_size */
1209        VMSTATE_END_OF_LIST()
1210    }
1211};
1212
1213static const VMStateDescription vmstate_vmware_vga = {
1214    .name = "vmware_vga",
1215    .version_id = 0,
1216    .minimum_version_id = 0,
1217    .fields = (VMStateField[]) {
1218        VMSTATE_PCI_DEVICE(parent_obj, struct pci_vmsvga_state_s),
1219        VMSTATE_STRUCT(chip, struct pci_vmsvga_state_s, 0,
1220                       vmstate_vmware_vga_internal, struct vmsvga_state_s),
1221        VMSTATE_END_OF_LIST()
1222    }
1223};
1224
1225static const GraphicHwOps vmsvga_ops = {
1226    .invalidate  = vmsvga_invalidate_display,
1227    .gfx_update  = vmsvga_update_display,
1228    .text_update = vmsvga_text_update,
1229};
1230
1231static void vmsvga_init(DeviceState *dev, struct vmsvga_state_s *s,
1232                        MemoryRegion *address_space, MemoryRegion *io)
1233{
1234    s->scratch_size = SVGA_SCRATCH_SIZE;
1235    s->scratch = g_malloc(s->scratch_size * 4);
1236
1237    s->vga.con = graphic_console_init(dev, 0, &vmsvga_ops, s);
1238
1239    s->fifo_size = SVGA_FIFO_SIZE;
1240    memory_region_init_ram(&s->fifo_ram, NULL, "vmsvga.fifo", s->fifo_size,
1241                           &error_fatal);
1242    s->fifo_ptr = memory_region_get_ram_ptr(&s->fifo_ram);
1243
1244    vga_common_init(&s->vga, OBJECT(dev));
1245    vga_init(&s->vga, OBJECT(dev), address_space, io, true);
1246    vmstate_register(NULL, 0, &vmstate_vga_common, &s->vga);
1247    s->new_depth = 32;
1248}
1249
1250static uint64_t vmsvga_io_read(void *opaque, hwaddr addr, unsigned size)
1251{
1252    struct vmsvga_state_s *s = opaque;
1253
1254    switch (addr) {
1255    case SVGA_IO_MUL * SVGA_INDEX_PORT: return vmsvga_index_read(s, addr);
1256    case SVGA_IO_MUL * SVGA_VALUE_PORT: return vmsvga_value_read(s, addr);
1257    case SVGA_IO_MUL * SVGA_BIOS_PORT: return vmsvga_bios_read(s, addr);
1258    default: return -1u;
1259    }
1260}
1261
1262static void vmsvga_io_write(void *opaque, hwaddr addr,
1263                            uint64_t data, unsigned size)
1264{
1265    struct vmsvga_state_s *s = opaque;
1266
1267    switch (addr) {
1268    case SVGA_IO_MUL * SVGA_INDEX_PORT:
1269        vmsvga_index_write(s, addr, data);
1270        break;
1271    case SVGA_IO_MUL * SVGA_VALUE_PORT:
1272        vmsvga_value_write(s, addr, data);
1273        break;
1274    case SVGA_IO_MUL * SVGA_BIOS_PORT:
1275        vmsvga_bios_write(s, addr, data);
1276        break;
1277    }
1278}
1279
1280static const MemoryRegionOps vmsvga_io_ops = {
1281    .read = vmsvga_io_read,
1282    .write = vmsvga_io_write,
1283    .endianness = DEVICE_LITTLE_ENDIAN,
1284    .valid = {
1285        .min_access_size = 4,
1286        .max_access_size = 4,
1287        .unaligned = true,
1288    },
1289    .impl = {
1290        .unaligned = true,
1291    },
1292};
1293
1294static void pci_vmsvga_realize(PCIDevice *dev, Error **errp)
1295{
1296    struct pci_vmsvga_state_s *s = VMWARE_SVGA(dev);
1297
1298    dev->config[PCI_CACHE_LINE_SIZE] = 0x08;
1299    dev->config[PCI_LATENCY_TIMER] = 0x40;
1300    dev->config[PCI_INTERRUPT_LINE] = 0xff;          /* End */
1301
1302    memory_region_init_io(&s->io_bar, NULL, &vmsvga_io_ops, &s->chip,
1303                          "vmsvga-io", 0x10);
1304    memory_region_set_flush_coalesced(&s->io_bar);
1305    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1306
1307    vmsvga_init(DEVICE(dev), &s->chip,
1308                pci_address_space(dev), pci_address_space_io(dev));
1309
1310    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_MEM_PREFETCH,
1311                     &s->chip.vga.vram);
1312    pci_register_bar(dev, 2, PCI_BASE_ADDRESS_MEM_PREFETCH,
1313                     &s->chip.fifo_ram);
1314
1315    if (!dev->rom_bar) {
1316        /* compatibility with pc-0.13 and older */
1317        vga_init_vbe(&s->chip.vga, OBJECT(dev), pci_address_space(dev));
1318    }
1319}
1320
1321static Property vga_vmware_properties[] = {
1322    DEFINE_PROP_UINT32("vgamem_mb", struct pci_vmsvga_state_s,
1323                       chip.vga.vram_size_mb, 16),
1324    DEFINE_PROP_BOOL("global-vmstate", struct pci_vmsvga_state_s,
1325                     chip.vga.global_vmstate, false),
1326    DEFINE_PROP_END_OF_LIST(),
1327};
1328
1329static void vmsvga_class_init(ObjectClass *klass, void *data)
1330{
1331    DeviceClass *dc = DEVICE_CLASS(klass);
1332    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1333
1334    k->realize = pci_vmsvga_realize;
1335    k->romfile = "vgabios-vmware.bin";
1336    k->vendor_id = PCI_VENDOR_ID_VMWARE;
1337    k->device_id = SVGA_PCI_DEVICE_ID;
1338    k->class_id = PCI_CLASS_DISPLAY_VGA;
1339    k->subsystem_vendor_id = PCI_VENDOR_ID_VMWARE;
1340    k->subsystem_id = SVGA_PCI_DEVICE_ID;
1341    dc->reset = vmsvga_reset;
1342    dc->vmsd = &vmstate_vmware_vga;
1343    dc->props = vga_vmware_properties;
1344    dc->hotpluggable = false;
1345    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
1346}
1347
1348static const TypeInfo vmsvga_info = {
1349    .name          = TYPE_VMWARE_SVGA,
1350    .parent        = TYPE_PCI_DEVICE,
1351    .instance_size = sizeof(struct pci_vmsvga_state_s),
1352    .class_init    = vmsvga_class_init,
1353    .interfaces = (InterfaceInfo[]) {
1354        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
1355        { },
1356    },
1357};
1358
1359static void vmsvga_register_types(void)
1360{
1361    type_register_static(&vmsvga_info);
1362}
1363
1364type_init(vmsvga_register_types)
1365