hw/display/cirrus_vga.c

   1 /*
   2  * QEMU Cirrus CLGD 54xx VGA Emulator.
   3  *
   4  * Copyright (c) 2004 Fabrice Bellard
   5  * Copyright (c) 2004 Makoto Suzuki (suzu)
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  */
  25 /*
  26  * Reference: Finn Thogersons' VGADOC4b:
  27  *
  28  *  http://web.archive.org/web/20021019054927/http://home.worldonline.dk/finth/
  29  *
  30  * VGADOC4b.ZIP content available at:
  31  *
  32  *  https://pdos.csail.mit.edu/6.828/2005/readings/hardware/vgadoc
  33  */
  34
  35 #include "qemu/osdep.h"
  36 #include "qemu/module.h"
  37 #include "qemu/units.h"
  38 #include "qemu/log.h"
  39 #include "sysemu/reset.h"
  40 #include "qapi/error.h"
  41 #include "trace.h"
  42 #include "hw/pci/pci.h"
  43 #include "hw/qdev-properties.h"
  44 #include "migration/vmstate.h"
  45 #include "ui/pixel_ops.h"
  46 #include "cirrus_vga_internal.h"
  47
  48 /*
  49  * TODO:
  50  *    - destination write mask support not complete (bits 5..7)
  51  *    - optimize linear mappings
  52  *    - optimize bitblt functions
  53  */
  54
  55 //#define DEBUG_CIRRUS
  56
  57 /***************************************
  58  *
  59  *  definitions
  60  *
  61  ***************************************/
  62
  63 // sequencer 0x07
  64 #define CIRRUS_SR7_BPP_VGA            0x00
  65 #define CIRRUS_SR7_BPP_SVGA           0x01
  66 #define CIRRUS_SR7_BPP_MASK           0x0e
  67 #define CIRRUS_SR7_BPP_8              0x00
  68 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
  69 #define CIRRUS_SR7_BPP_24             0x04
  70 #define CIRRUS_SR7_BPP_16             0x06
  71 #define CIRRUS_SR7_BPP_32             0x08
  72 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
  73
  74 // sequencer 0x0f
  75 #define CIRRUS_MEMSIZE_512k        0x08
  76 #define CIRRUS_MEMSIZE_1M          0x10
  77 #define CIRRUS_MEMSIZE_2M          0x18
  78 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80 // bank switching is enabled.
  79
  80 // sequencer 0x12
  81 #define CIRRUS_CURSOR_SHOW         0x01
  82 #define CIRRUS_CURSOR_HIDDENPEL    0x02
  83 #define CIRRUS_CURSOR_LARGE        0x04 // 64x64 if set, 32x32 if clear
  84
  85 // sequencer 0x17
  86 #define CIRRUS_BUSTYPE_VLBFAST   0x10
  87 #define CIRRUS_BUSTYPE_PCI       0x20
  88 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
  89 #define CIRRUS_BUSTYPE_ISA       0x38
  90 #define CIRRUS_MMIO_ENABLE       0x04
  91 #define CIRRUS_MMIO_USE_PCIADDR  0x40   // 0xb8000 if cleared.
  92 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
  93
  94 // control 0x0b
  95 #define CIRRUS_BANKING_DUAL             0x01
  96 #define CIRRUS_BANKING_GRANULARITY_16K  0x20    // set:16k, clear:4k
  97
  98 // control 0x30
  99 #define CIRRUS_BLTMODE_BACKWARDS        0x01
 100 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
 101 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
 102 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
 103 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
 104 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
 105 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
 106 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
 107 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
 108 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
 109 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
 110
 111 // control 0x31
 112 #define CIRRUS_BLT_BUSY                 0x01
 113 #define CIRRUS_BLT_START                0x02
 114 #define CIRRUS_BLT_RESET                0x04
 115 #define CIRRUS_BLT_FIFOUSED             0x10
 116 #define CIRRUS_BLT_AUTOSTART            0x80
 117
 118 // control 0x32
 119 #define CIRRUS_ROP_0                    0x00
 120 #define CIRRUS_ROP_SRC_AND_DST          0x05
 121 #define CIRRUS_ROP_NOP                  0x06
 122 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
 123 #define CIRRUS_ROP_NOTDST               0x0b
 124 #define CIRRUS_ROP_SRC                  0x0d
 125 #define CIRRUS_ROP_1                    0x0e
 126 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
 127 #define CIRRUS_ROP_SRC_XOR_DST          0x59
 128 #define CIRRUS_ROP_SRC_OR_DST           0x6d
 129 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
 130 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
 131 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
 132 #define CIRRUS_ROP_NOTSRC               0xd0
 133 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
 134 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
 135
 136 #define CIRRUS_ROP_NOP_INDEX 2
 137 #define CIRRUS_ROP_SRC_INDEX 5
 138
 139 // control 0x33
 140 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
 141 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
 142 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
 143
 144 // memory-mapped IO
 145 #define CIRRUS_MMIO_BLTBGCOLOR        0x00      // dword
 146 #define CIRRUS_MMIO_BLTFGCOLOR        0x04      // dword
 147 #define CIRRUS_MMIO_BLTWIDTH          0x08      // word
 148 #define CIRRUS_MMIO_BLTHEIGHT         0x0a      // word
 149 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c      // word
 150 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e      // word
 151 #define CIRRUS_MMIO_BLTDESTADDR       0x10      // dword
 152 #define CIRRUS_MMIO_BLTSRCADDR        0x14      // dword
 153 #define CIRRUS_MMIO_BLTWRITEMASK      0x17      // byte
 154 #define CIRRUS_MMIO_BLTMODE           0x18      // byte
 155 #define CIRRUS_MMIO_BLTROP            0x1a      // byte
 156 #define CIRRUS_MMIO_BLTMODEEXT        0x1b      // byte
 157 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c    // word?
 158 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20        // word?
 159 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24     // word
 160 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26     // word
 161 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28      // word
 162 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a      // word
 163 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c       // byte
 164 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d  // byte
 165 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e      // byte
 166 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f     // byte
 167 #define CIRRUS_MMIO_BRESENHAM_K1      0x30      // word
 168 #define CIRRUS_MMIO_BRESENHAM_K3      0x32      // word
 169 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34      // word
 170 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36  // word
 171 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38    // byte
 172 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39      // byte
 173 #define CIRRUS_MMIO_BLTSTATUS         0x40      // byte
 174
 175 #define CIRRUS_PNPMMIO_SIZE         0x1000
 176
 177 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
 178                               uint32_t dstaddr, int dst_pitch,
 179                               int width, int height);
 180
 181 typedef struct PCICirrusVGAState {
 182     PCIDevice dev;
 183     CirrusVGAState cirrus_vga;
 184 } PCICirrusVGAState;
 185
 186 #define TYPE_PCI_CIRRUS_VGA "cirrus-vga"
 187 #define PCI_CIRRUS_VGA(obj) \
 188     OBJECT_CHECK(PCICirrusVGAState, (obj), TYPE_PCI_CIRRUS_VGA)
 189
 190 static uint8_t rop_to_index[256];
 191
 192 /***************************************
 193  *
 194  *  prototypes.
 195  *
 196  ***************************************/
 197
 198
 199 static void cirrus_bitblt_reset(CirrusVGAState *s);
 200 static void cirrus_update_memory_access(CirrusVGAState *s);
 201
 202 /***************************************
 203  *
 204  *  raster operations
 205  *
 206  ***************************************/
 207
 208 static bool blit_region_is_unsafe(struct CirrusVGAState *s,
 209                                   int32_t pitch, int32_t addr)
 210 {
 211     if (!pitch) {
 212         return true;
 213     }
 214     if (pitch < 0) {
 215         int64_t min = addr
 216             + ((int64_t)s->cirrus_blt_height - 1) * pitch
 217             - s->cirrus_blt_width;
 218         if (min < -1 || addr >= s->vga.vram_size) {
 219             return true;
 220         }
 221     } else {
 222         int64_t max = addr
 223             + ((int64_t)s->cirrus_blt_height-1) * pitch
 224             + s->cirrus_blt_width;
 225         if (max > s->vga.vram_size) {
 226             return true;
 227         }
 228     }
 229     return false;
 230 }
 231
 232 static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only)
 233 {
 234     /* should be the case, see cirrus_bitblt_start */
 235     assert(s->cirrus_blt_width > 0);
 236     assert(s->cirrus_blt_height > 0);
 237
 238     if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
 239         return true;
 240     }
 241
 242     if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
 243                               s->cirrus_blt_dstaddr)) {
 244         return true;
 245     }
 246     if (dst_only) {
 247         return false;
 248     }
 249     if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
 250                               s->cirrus_blt_srcaddr)) {
 251         return true;
 252     }
 253
 254     return false;
 255 }
 256
 257 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
 258                                   uint32_t dstaddr, uint32_t srcaddr,
 259                                   int dstpitch,int srcpitch,
 260                                   int bltwidth,int bltheight)
 261 {
 262 }
 263
 264 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
 265                                    uint32_t dstaddr,
 266                                    int dstpitch, int bltwidth,int bltheight)
 267 {
 268 }
 269
 270 static inline uint8_t cirrus_src(CirrusVGAState *s, uint32_t srcaddr)
 271 {
 272     if (s->cirrus_srccounter) {
 273         /* cputovideo */
 274         return s->cirrus_bltbuf[srcaddr & (CIRRUS_BLTBUFSIZE - 1)];
 275     } else {
 276         /* videotovideo */
 277         return s->vga.vram_ptr[srcaddr & s->cirrus_addr_mask];
 278     }
 279 }
 280
 281 static inline uint16_t cirrus_src16(CirrusVGAState *s, uint32_t srcaddr)
 282 {
 283     uint16_t *src;
 284
 285     if (s->cirrus_srccounter) {
 286         /* cputovideo */
 287         src = (void *)&s->cirrus_bltbuf[srcaddr & (CIRRUS_BLTBUFSIZE - 1) & ~1];
 288     } else {
 289         /* videotovideo */
 290         src = (void *)&s->vga.vram_ptr[srcaddr & s->cirrus_addr_mask & ~1];
 291     }
 292     return *src;
 293 }
 294
 295 static inline uint32_t cirrus_src32(CirrusVGAState *s, uint32_t srcaddr)
 296 {
 297     uint32_t *src;
 298
 299     if (s->cirrus_srccounter) {
 300         /* cputovideo */
 301         src = (void *)&s->cirrus_bltbuf[srcaddr & (CIRRUS_BLTBUFSIZE - 1) & ~3];
 302     } else {
 303         /* videotovideo */
 304         src = (void *)&s->vga.vram_ptr[srcaddr & s->cirrus_addr_mask & ~3];
 305     }
 306     return *src;
 307 }
 308
 309 #define ROP_NAME 0
 310 #define ROP_FN(d, s) 0
 311 #include "cirrus_vga_rop.h"
 312
 313 #define ROP_NAME src_and_dst
 314 #define ROP_FN(d, s) (s) & (d)
 315 #include "cirrus_vga_rop.h"
 316
 317 #define ROP_NAME src_and_notdst
 318 #define ROP_FN(d, s) (s) & (~(d))
 319 #include "cirrus_vga_rop.h"
 320
 321 #define ROP_NAME notdst
 322 #define ROP_FN(d, s) ~(d)
 323 #include "cirrus_vga_rop.h"
 324
 325 #define ROP_NAME src
 326 #define ROP_FN(d, s) s
 327 #include "cirrus_vga_rop.h"
 328
 329 #define ROP_NAME 1
 330 #define ROP_FN(d, s) ~0
 331 #include "cirrus_vga_rop.h"
 332
 333 #define ROP_NAME notsrc_and_dst
 334 #define ROP_FN(d, s) (~(s)) & (d)
 335 #include "cirrus_vga_rop.h"
 336
 337 #define ROP_NAME src_xor_dst
 338 #define ROP_FN(d, s) (s) ^ (d)
 339 #include "cirrus_vga_rop.h"
 340
 341 #define ROP_NAME src_or_dst
 342 #define ROP_FN(d, s) (s) | (d)
 343 #include "cirrus_vga_rop.h"
 344
 345 #define ROP_NAME notsrc_or_notdst
 346 #define ROP_FN(d, s) (~(s)) | (~(d))
 347 #include "cirrus_vga_rop.h"
 348
 349 #define ROP_NAME src_notxor_dst
 350 #define ROP_FN(d, s) ~((s) ^ (d))
 351 #include "cirrus_vga_rop.h"
 352
 353 #define ROP_NAME src_or_notdst
 354 #define ROP_FN(d, s) (s) | (~(d))
 355 #include "cirrus_vga_rop.h"
 356
 357 #define ROP_NAME notsrc
 358 #define ROP_FN(d, s) (~(s))
 359 #include "cirrus_vga_rop.h"
 360
 361 #define ROP_NAME notsrc_or_dst
 362 #define ROP_FN(d, s) (~(s)) | (d)
 363 #include "cirrus_vga_rop.h"
 364
 365 #define ROP_NAME notsrc_and_notdst
 366 #define ROP_FN(d, s) (~(s)) & (~(d))
 367 #include "cirrus_vga_rop.h"
 368
 369 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
 370     cirrus_bitblt_rop_fwd_0,
 371     cirrus_bitblt_rop_fwd_src_and_dst,
 372     cirrus_bitblt_rop_nop,
 373     cirrus_bitblt_rop_fwd_src_and_notdst,
 374     cirrus_bitblt_rop_fwd_notdst,
 375     cirrus_bitblt_rop_fwd_src,
 376     cirrus_bitblt_rop_fwd_1,
 377     cirrus_bitblt_rop_fwd_notsrc_and_dst,
 378     cirrus_bitblt_rop_fwd_src_xor_dst,
 379     cirrus_bitblt_rop_fwd_src_or_dst,
 380     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
 381     cirrus_bitblt_rop_fwd_src_notxor_dst,
 382     cirrus_bitblt_rop_fwd_src_or_notdst,
 383     cirrus_bitblt_rop_fwd_notsrc,
 384     cirrus_bitblt_rop_fwd_notsrc_or_dst,
 385     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
 386 };
 387
 388 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
 389     cirrus_bitblt_rop_bkwd_0,
 390     cirrus_bitblt_rop_bkwd_src_and_dst,
 391     cirrus_bitblt_rop_nop,
 392     cirrus_bitblt_rop_bkwd_src_and_notdst,
 393     cirrus_bitblt_rop_bkwd_notdst,
 394     cirrus_bitblt_rop_bkwd_src,
 395     cirrus_bitblt_rop_bkwd_1,
 396     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
 397     cirrus_bitblt_rop_bkwd_src_xor_dst,
 398     cirrus_bitblt_rop_bkwd_src_or_dst,
 399     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
 400     cirrus_bitblt_rop_bkwd_src_notxor_dst,
 401     cirrus_bitblt_rop_bkwd_src_or_notdst,
 402     cirrus_bitblt_rop_bkwd_notsrc,
 403     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
 404     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
 405 };
 406
 407 #define TRANSP_ROP(name) {\
 408     name ## _8,\
 409     name ## _16,\
 410         }
 411 #define TRANSP_NOP(func) {\
 412     func,\
 413     func,\
 414         }
 415
 416 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
 417     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
 418     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
 419     TRANSP_NOP(cirrus_bitblt_rop_nop),
 420     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
 421     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
 422     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
 423     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
 424     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
 425     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
 426     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
 427     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
 428     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
 429     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
 430     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
 431     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
 432     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
 433 };
 434
 435 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
 436     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
 437     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
 438     TRANSP_NOP(cirrus_bitblt_rop_nop),
 439     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
 440     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
 441     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
 442     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
 443     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
 444     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
 445     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
 446     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
 447     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
 448     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
 449     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
 450     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
 451     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
 452 };
 453
 454 #define ROP2(name) {\
 455     name ## _8,\
 456     name ## _16,\
 457     name ## _24,\
 458     name ## _32,\
 459         }
 460
 461 #define ROP_NOP2(func) {\
 462     func,\
 463     func,\
 464     func,\
 465     func,\
 466         }
 467
 468 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
 469     ROP2(cirrus_patternfill_0),
 470     ROP2(cirrus_patternfill_src_and_dst),
 471     ROP_NOP2(cirrus_bitblt_rop_nop),
 472     ROP2(cirrus_patternfill_src_and_notdst),
 473     ROP2(cirrus_patternfill_notdst),
 474     ROP2(cirrus_patternfill_src),
 475     ROP2(cirrus_patternfill_1),
 476     ROP2(cirrus_patternfill_notsrc_and_dst),
 477     ROP2(cirrus_patternfill_src_xor_dst),
 478     ROP2(cirrus_patternfill_src_or_dst),
 479     ROP2(cirrus_patternfill_notsrc_or_notdst),
 480     ROP2(cirrus_patternfill_src_notxor_dst),
 481     ROP2(cirrus_patternfill_src_or_notdst),
 482     ROP2(cirrus_patternfill_notsrc),
 483     ROP2(cirrus_patternfill_notsrc_or_dst),
 484     ROP2(cirrus_patternfill_notsrc_and_notdst),
 485 };
 486
 487 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
 488     ROP2(cirrus_colorexpand_transp_0),
 489     ROP2(cirrus_colorexpand_transp_src_and_dst),
 490     ROP_NOP2(cirrus_bitblt_rop_nop),
 491     ROP2(cirrus_colorexpand_transp_src_and_notdst),
 492     ROP2(cirrus_colorexpand_transp_notdst),
 493     ROP2(cirrus_colorexpand_transp_src),
 494     ROP2(cirrus_colorexpand_transp_1),
 495     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
 496     ROP2(cirrus_colorexpand_transp_src_xor_dst),
 497     ROP2(cirrus_colorexpand_transp_src_or_dst),
 498     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
 499     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
 500     ROP2(cirrus_colorexpand_transp_src_or_notdst),
 501     ROP2(cirrus_colorexpand_transp_notsrc),
 502     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
 503     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
 504 };
 505
 506 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
 507     ROP2(cirrus_colorexpand_0),
 508     ROP2(cirrus_colorexpand_src_and_dst),
 509     ROP_NOP2(cirrus_bitblt_rop_nop),
 510     ROP2(cirrus_colorexpand_src_and_notdst),
 511     ROP2(cirrus_colorexpand_notdst),
 512     ROP2(cirrus_colorexpand_src),
 513     ROP2(cirrus_colorexpand_1),
 514     ROP2(cirrus_colorexpand_notsrc_and_dst),
 515     ROP2(cirrus_colorexpand_src_xor_dst),
 516     ROP2(cirrus_colorexpand_src_or_dst),
 517     ROP2(cirrus_colorexpand_notsrc_or_notdst),
 518     ROP2(cirrus_colorexpand_src_notxor_dst),
 519     ROP2(cirrus_colorexpand_src_or_notdst),
 520     ROP2(cirrus_colorexpand_notsrc),
 521     ROP2(cirrus_colorexpand_notsrc_or_dst),
 522     ROP2(cirrus_colorexpand_notsrc_and_notdst),
 523 };
 524
 525 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
 526     ROP2(cirrus_colorexpand_pattern_transp_0),
 527     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
 528     ROP_NOP2(cirrus_bitblt_rop_nop),
 529     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
 530     ROP2(cirrus_colorexpand_pattern_transp_notdst),
 531     ROP2(cirrus_colorexpand_pattern_transp_src),
 532     ROP2(cirrus_colorexpand_pattern_transp_1),
 533     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
 534     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
 535     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
 536     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
 537     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
 538     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
 539     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
 540     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
 541     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
 542 };
 543
 544 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
 545     ROP2(cirrus_colorexpand_pattern_0),
 546     ROP2(cirrus_colorexpand_pattern_src_and_dst),
 547     ROP_NOP2(cirrus_bitblt_rop_nop),
 548     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
 549     ROP2(cirrus_colorexpand_pattern_notdst),
 550     ROP2(cirrus_colorexpand_pattern_src),
 551     ROP2(cirrus_colorexpand_pattern_1),
 552     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
 553     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
 554     ROP2(cirrus_colorexpand_pattern_src_or_dst),
 555     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
 556     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
 557     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
 558     ROP2(cirrus_colorexpand_pattern_notsrc),
 559     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
 560     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
 561 };
 562
 563 static const cirrus_fill_t cirrus_fill[16][4] = {
 564     ROP2(cirrus_fill_0),
 565     ROP2(cirrus_fill_src_and_dst),
 566     ROP_NOP2(cirrus_bitblt_fill_nop),
 567     ROP2(cirrus_fill_src_and_notdst),
 568     ROP2(cirrus_fill_notdst),
 569     ROP2(cirrus_fill_src),
 570     ROP2(cirrus_fill_1),
 571     ROP2(cirrus_fill_notsrc_and_dst),
 572     ROP2(cirrus_fill_src_xor_dst),
 573     ROP2(cirrus_fill_src_or_dst),
 574     ROP2(cirrus_fill_notsrc_or_notdst),
 575     ROP2(cirrus_fill_src_notxor_dst),
 576     ROP2(cirrus_fill_src_or_notdst),
 577     ROP2(cirrus_fill_notsrc),
 578     ROP2(cirrus_fill_notsrc_or_dst),
 579     ROP2(cirrus_fill_notsrc_and_notdst),
 580 };
 581
 582 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
 583 {
 584     unsigned int color;
 585     switch (s->cirrus_blt_pixelwidth) {
 586     case 1:
 587         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
 588         break;
 589     case 2:
 590         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
 591         s->cirrus_blt_fgcol = le16_to_cpu(color);
 592         break;
 593     case 3:
 594         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
 595             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
 596         break;
 597     default:
 598     case 4:
 599         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
 600             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
 601         s->cirrus_blt_fgcol = le32_to_cpu(color);
 602         break;
 603     }
 604 }
 605
 606 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
 607 {
 608     unsigned int color;
 609     switch (s->cirrus_blt_pixelwidth) {
 610     case 1:
 611         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
 612         break;
 613     case 2:
 614         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
 615         s->cirrus_blt_bgcol = le16_to_cpu(color);
 616         break;
 617     case 3:
 618         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
 619             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
 620         break;
 621     default:
 622     case 4:
 623         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
 624             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
 625         s->cirrus_blt_bgcol = le32_to_cpu(color);
 626         break;
 627     }
 628 }
 629
 630 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
 631                                      int off_pitch, int bytesperline,
 632                                      int lines)
 633 {
 634     int y;
 635     int off_cur;
 636     int off_cur_end;
 637
 638     if (off_pitch < 0) {
 639         off_begin -= bytesperline - 1;
 640     }
 641
 642     for (y = 0; y < lines; y++) {
 643         off_cur = off_begin;
 644         off_cur_end = ((off_cur + bytesperline - 1) & s->cirrus_addr_mask) + 1;
 645         assert(off_cur_end >= off_cur);
 646         memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);
 647         off_begin += off_pitch;
 648     }
 649 }
 650
 651 static int cirrus_bitblt_common_patterncopy(CirrusVGAState *s)
 652 {
 653     uint32_t patternsize;
 654     bool videosrc = !s->cirrus_srccounter;
 655
 656     if (videosrc) {
 657         switch (s->vga.get_bpp(&s->vga)) {
 658         case 8:
 659             patternsize = 64;
 660             break;
 661         case 15:
 662         case 16:
 663             patternsize = 128;
 664             break;
 665         case 24:
 666         case 32:
 667         default:
 668             patternsize = 256;
 669             break;
 670         }
 671         s->cirrus_blt_srcaddr &= ~(patternsize - 1);
 672         if (s->cirrus_blt_srcaddr + patternsize > s->vga.vram_size) {
 673             return 0;
 674         }
 675     }
 676
 677     if (blit_is_unsafe(s, true)) {
 678         return 0;
 679     }
 680
 681     (*s->cirrus_rop) (s, s->cirrus_blt_dstaddr,
 682                       videosrc ? s->cirrus_blt_srcaddr : 0,
 683                       s->cirrus_blt_dstpitch, 0,
 684                       s->cirrus_blt_width, s->cirrus_blt_height);
 685     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
 686                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
 687                              s->cirrus_blt_height);
 688     return 1;
 689 }
 690
 691 /* fill */
 692
 693 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
 694 {
 695     cirrus_fill_t rop_func;
 696
 697     if (blit_is_unsafe(s, true)) {
 698         return 0;
 699     }
 700     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
 701     rop_func(s, s->cirrus_blt_dstaddr,
 702              s->cirrus_blt_dstpitch,
 703              s->cirrus_blt_width, s->cirrus_blt_height);
 704     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
 705                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
 706                              s->cirrus_blt_height);
 707     cirrus_bitblt_reset(s);
 708     return 1;
 709 }
 710
 711 /***************************************
 712  *
 713  *  bitblt (video-to-video)
 714  *
 715  ***************************************/
 716
 717 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
 718 {
 719     return cirrus_bitblt_common_patterncopy(s);
 720 }
 721
 722 static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
 723 {
 724     int sx = 0, sy = 0;
 725     int dx = 0, dy = 0;
 726     int depth = 0;
 727     int notify = 0;
 728
 729     /* make sure to only copy if it's a plain copy ROP */
 730     if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
 731         *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {
 732
 733         int width, height;
 734
 735         depth = s->vga.get_bpp(&s->vga) / 8;
 736         if (!depth) {
 737             return 0;
 738         }
 739         s->vga.get_resolution(&s->vga, &width, &height);
 740
 741         /* extra x, y */
 742         sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
 743         sy = (src / ABS(s->cirrus_blt_srcpitch));
 744         dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
 745         dy = (dst / ABS(s->cirrus_blt_dstpitch));
 746
 747         /* normalize width */
 748         w /= depth;
 749
 750         /* if we're doing a backward copy, we have to adjust
 751            our x/y to be the upper left corner (instead of the lower
 752            right corner) */
 753         if (s->cirrus_blt_dstpitch < 0) {
 754             sx -= (s->cirrus_blt_width / depth) - 1;
 755             dx -= (s->cirrus_blt_width / depth) - 1;
 756             sy -= s->cirrus_blt_height - 1;
 757             dy -= s->cirrus_blt_height - 1;
 758         }
 759
 760         /* are we in the visible portion of memory? */
 761         if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
 762             (sx + w) <= width && (sy + h) <= height &&
 763             (dx + w) <= width && (dy + h) <= height) {
 764             notify = 1;
 765         }
 766     }
 767
 768     (*s->cirrus_rop) (s, s->cirrus_blt_dstaddr,
 769                       s->cirrus_blt_srcaddr,
 770                       s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
 771                       s->cirrus_blt_width, s->cirrus_blt_height);
 772
 773     if (notify) {
 774         dpy_gfx_update(s->vga.con, dx, dy,
 775                        s->cirrus_blt_width / depth,
 776                        s->cirrus_blt_height);
 777     }
 778
 779     /* we don't have to notify the display that this portion has
 780        changed since qemu_console_copy implies this */
 781
 782     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
 783                                 s->cirrus_blt_dstpitch, s->cirrus_blt_width,
 784                                 s->cirrus_blt_height);
 785
 786     return 1;
 787 }
 788
 789 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
 790 {
 791     if (blit_is_unsafe(s, false))
 792         return 0;
 793
 794     return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
 795             s->cirrus_blt_srcaddr - s->vga.start_addr,
 796             s->cirrus_blt_width, s->cirrus_blt_height);
 797 }
 798
 799 /***************************************
 800  *
 801  *  bitblt (cpu-to-video)
 802  *
 803  ***************************************/
 804
 805 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
 806 {
 807     int copy_count;
 808     uint8_t *end_ptr;
 809
 810     if (s->cirrus_srccounter > 0) {
 811         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
 812             cirrus_bitblt_common_patterncopy(s);
 813         the_end:
 814             s->cirrus_srccounter = 0;
 815             cirrus_bitblt_reset(s);
 816         } else {
 817             /* at least one scan line */
 818             do {
 819                 (*s->cirrus_rop)(s, s->cirrus_blt_dstaddr,
 820                                  0, 0, 0, s->cirrus_blt_width, 1);
 821                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
 822                                          s->cirrus_blt_width, 1);
 823                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
 824                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
 825                 if (s->cirrus_srccounter <= 0)
 826                     goto the_end;
 827                 /* more bytes than needed can be transferred because of
 828                    word alignment, so we keep them for the next line */
 829                 /* XXX: keep alignment to speed up transfer */
 830                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
 831                 copy_count = s->cirrus_srcptr_end - end_ptr;
 832                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
 833                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
 834                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
 835             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
 836         }
 837     }
 838 }
 839
 840 /***************************************
 841  *
 842  *  bitblt wrapper
 843  *
 844  ***************************************/
 845
 846 static void cirrus_bitblt_reset(CirrusVGAState * s)
 847 {
 848     int need_update;
 849
 850     s->vga.gr[0x31] &=
 851         ~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
 852     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
 853         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
 854     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
 855     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
 856     s->cirrus_srccounter = 0;
 857     if (!need_update)
 858         return;
 859     cirrus_update_memory_access(s);
 860 }
 861
 862 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
 863 {
 864     int w;
 865
 866     if (blit_is_unsafe(s, true)) {
 867         return 0;
 868     }
 869
 870     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
 871     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
 872     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
 873
 874     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
 875         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
 876             s->cirrus_blt_srcpitch = 8;
 877         } else {
 878             /* XXX: check for 24 bpp */
 879             s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
 880         }
 881         s->cirrus_srccounter = s->cirrus_blt_srcpitch;
 882     } else {
 883         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
 884             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
 885             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
 886                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
 887             else
 888                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
 889         } else {
 890             /* always align input size to 32 bits */
 891             s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
 892         }
 893         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
 894     }
 895
 896     /* the blit_is_unsafe call above should catch this */
 897     assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
 898
 899     s->cirrus_srcptr = s->cirrus_bltbuf;
 900     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
 901     cirrus_update_memory_access(s);
 902     return 1;
 903 }
 904
 905 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
 906 {
 907     /* XXX */
 908     qemu_log_mask(LOG_UNIMP,
 909                   "cirrus: bitblt (video to cpu) is not implemented\n");
 910     return 0;
 911 }
 912
 913 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
 914 {
 915     int ret;
 916
 917     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
 918         ret = cirrus_bitblt_videotovideo_patterncopy(s);
 919     } else {
 920         ret = cirrus_bitblt_videotovideo_copy(s);
 921     }
 922     if (ret)
 923         cirrus_bitblt_reset(s);
 924     return ret;
 925 }
 926
 927 static void cirrus_bitblt_start(CirrusVGAState * s)
 928 {
 929     uint8_t blt_rop;
 930
 931     if (!s->enable_blitter) {
 932         goto bitblt_ignore;
 933     }
 934
 935     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
 936
 937     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
 938     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
 939     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
 940     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
 941     s->cirrus_blt_dstaddr =
 942         (s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
 943     s->cirrus_blt_srcaddr =
 944         (s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
 945     s->cirrus_blt_mode = s->vga.gr[0x30];
 946     s->cirrus_blt_modeext = s->vga.gr[0x33];
 947     blt_rop = s->vga.gr[0x32];
 948
 949     s->cirrus_blt_dstaddr &= s->cirrus_addr_mask;
 950     s->cirrus_blt_srcaddr &= s->cirrus_addr_mask;
 951
 952     trace_vga_cirrus_bitblt_start(blt_rop,
 953                                   s->cirrus_blt_mode,
 954                                   s->cirrus_blt_modeext,
 955                                   s->cirrus_blt_width,
 956                                   s->cirrus_blt_height,
 957                                   s->cirrus_blt_dstpitch,
 958                                   s->cirrus_blt_srcpitch,
 959                                   s->cirrus_blt_dstaddr,
 960                                   s->cirrus_blt_srcaddr,
 961                                   s->vga.gr[0x2f]);
 962
 963     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
 964     case CIRRUS_BLTMODE_PIXELWIDTH8:
 965         s->cirrus_blt_pixelwidth = 1;
 966         break;
 967     case CIRRUS_BLTMODE_PIXELWIDTH16:
 968         s->cirrus_blt_pixelwidth = 2;
 969         break;
 970     case CIRRUS_BLTMODE_PIXELWIDTH24:
 971         s->cirrus_blt_pixelwidth = 3;
 972         break;
 973     case CIRRUS_BLTMODE_PIXELWIDTH32:
 974         s->cirrus_blt_pixelwidth = 4;
 975         break;
 976     default:
 977         qemu_log_mask(LOG_GUEST_ERROR,
 978                       "cirrus: bitblt - pixel width is unknown\n");
 979         goto bitblt_ignore;
 980     }
 981     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
 982
 983     if ((s->
 984          cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
 985                             CIRRUS_BLTMODE_MEMSYSDEST))
 986         == (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
 987         qemu_log_mask(LOG_UNIMP,
 988                       "cirrus: bitblt - memory-to-memory copy requested\n");
 989         goto bitblt_ignore;
 990     }
 991
 992     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
 993         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
 994                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
 995                                CIRRUS_BLTMODE_PATTERNCOPY |
 996                                CIRRUS_BLTMODE_COLOREXPAND)) ==
 997          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
 998         cirrus_bitblt_fgcol(s);
 999         cirrus_bitblt_solidfill(s, blt_rop);
1000     } else {
1001         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
1002                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
1003             CIRRUS_BLTMODE_COLOREXPAND) {
1004
1005             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1006                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1007                     cirrus_bitblt_bgcol(s);
1008                 else
1009                     cirrus_bitblt_fgcol(s);
1010                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1011             } else {
1012                 cirrus_bitblt_fgcol(s);
1013                 cirrus_bitblt_bgcol(s);
1014                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1015             }
1016         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
1017             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
1018                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1019                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1020                         cirrus_bitblt_bgcol(s);
1021                     else
1022                         cirrus_bitblt_fgcol(s);
1023                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1024                 } else {
1025                     cirrus_bitblt_fgcol(s);
1026                     cirrus_bitblt_bgcol(s);
1027                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1028                 }
1029             } else {
1030                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1031             }
1032         } else {
1033             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1034                 if (s->cirrus_blt_pixelwidth > 2) {
1035                     qemu_log_mask(LOG_GUEST_ERROR,
1036                                   "cirrus: src transparent without colorexpand "
1037                                   "must be 8bpp or 16bpp\n");
1038                     goto bitblt_ignore;
1039                 }
1040                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1041                     s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1042                     s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1043                     s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1044                 } else {
1045                     s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1046                 }
1047             } else {
1048                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1049                     s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1050                     s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1051                     s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1052                 } else {
1053                     s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1054                 }
1055             }
1056         }
1057         // setup bitblt engine.
1058         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1059             if (!cirrus_bitblt_cputovideo(s))
1060                 goto bitblt_ignore;
1061         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1062             if (!cirrus_bitblt_videotocpu(s))
1063                 goto bitblt_ignore;
1064         } else {
1065             if (!cirrus_bitblt_videotovideo(s))
1066                 goto bitblt_ignore;
1067         }
1068     }
1069     return;
1070   bitblt_ignore:;
1071     cirrus_bitblt_reset(s);
1072 }
1073
1074 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1075 {
1076     unsigned old_value;
1077
1078     old_value = s->vga.gr[0x31];
1079     s->vga.gr[0x31] = reg_value;
1080
1081     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1082         ((reg_value & CIRRUS_BLT_RESET) == 0)) {
1083         cirrus_bitblt_reset(s);
1084     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1085                ((reg_value & CIRRUS_BLT_START) != 0)) {
1086         cirrus_bitblt_start(s);
1087     }
1088 }
1089
1090
1091 /***************************************
1092  *
1093  *  basic parameters
1094  *
1095  ***************************************/
1096
1097 static void cirrus_get_offsets(VGACommonState *s1,
1098                                uint32_t *pline_offset,
1099                                uint32_t *pstart_addr,
1100                                uint32_t *pline_compare)
1101 {
1102     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1103     uint32_t start_addr, line_offset, line_compare;
1104
1105     line_offset = s->vga.cr[0x13]
1106         | ((s->vga.cr[0x1b] & 0x10) << 4);
1107     line_offset <<= 3;
1108     *pline_offset = line_offset;
1109
1110     start_addr = (s->vga.cr[0x0c] << 8)
1111         | s->vga.cr[0x0d]
1112         | ((s->vga.cr[0x1b] & 0x01) << 16)
1113         | ((s->vga.cr[0x1b] & 0x0c) << 15)
1114         | ((s->vga.cr[0x1d] & 0x80) << 12);
1115     *pstart_addr = start_addr;
1116
1117     line_compare = s->vga.cr[0x18] |
1118         ((s->vga.cr[0x07] & 0x10) << 4) |
1119         ((s->vga.cr[0x09] & 0x40) << 3);
1120     *pline_compare = line_compare;
1121 }
1122
1123 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1124 {
1125     uint32_t ret = 16;
1126
1127     switch (s->cirrus_hidden_dac_data & 0xf) {
1128     case 0:
1129         ret = 15;
1130         break;                  /* Sierra HiColor */
1131     case 1:
1132         ret = 16;
1133         break;                  /* XGA HiColor */
1134     default:
1135         qemu_log_mask(LOG_GUEST_ERROR,
1136                       "cirrus: invalid DAC value 0x%x in 16bpp\n",
1137                       (s->cirrus_hidden_dac_data & 0xf));
1138         ret = 15;               /* XXX */
1139         break;
1140     }
1141     return ret;
1142 }
1143
1144 static int cirrus_get_bpp(VGACommonState *s1)
1145 {
1146     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1147     uint32_t ret = 8;
1148
1149     if ((s->vga.sr[0x07] & 0x01) != 0) {
1150         /* Cirrus SVGA */
1151         switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1152         case CIRRUS_SR7_BPP_8:
1153             ret = 8;
1154             break;
1155         case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1156             ret = cirrus_get_bpp16_depth(s);
1157             break;
1158         case CIRRUS_SR7_BPP_24:
1159             ret = 24;
1160             break;
1161         case CIRRUS_SR7_BPP_16:
1162             ret = cirrus_get_bpp16_depth(s);
1163             break;
1164         case CIRRUS_SR7_BPP_32:
1165             ret = 32;
1166             break;
1167         default:
1168 #ifdef DEBUG_CIRRUS
1169             printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1170 #endif
1171             ret = 8;
1172             break;
1173         }
1174     } else {
1175         /* VGA */
1176         ret = 0;
1177     }
1178
1179     return ret;
1180 }
1181
1182 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1183 {
1184     int width, height;
1185
1186     width = (s->cr[0x01] + 1) * 8;
1187     height = s->cr[0x12] |
1188         ((s->cr[0x07] & 0x02) << 7) |
1189         ((s->cr[0x07] & 0x40) << 3);
1190     height = (height + 1);
1191     /* interlace support */
1192     if (s->cr[0x1a] & 0x01)
1193         height = height * 2;
1194     *pwidth = width;
1195     *pheight = height;
1196 }
1197
1198 /***************************************
1199  *
1200  * bank memory
1201  *
1202  ***************************************/
1203
1204 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1205 {
1206     unsigned offset;
1207     unsigned limit;
1208
1209     if ((s->vga.gr[0x0b] & 0x01) != 0)  /* dual bank */
1210         offset = s->vga.gr[0x09 + bank_index];
1211     else                        /* single bank */
1212         offset = s->vga.gr[0x09];
1213
1214     if ((s->vga.gr[0x0b] & 0x20) != 0)
1215         offset <<= 14;
1216     else
1217         offset <<= 12;
1218
1219     if (s->real_vram_size <= offset)
1220         limit = 0;
1221     else
1222         limit = s->real_vram_size - offset;
1223
1224     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1225         if (limit > 0x8000) {
1226             offset += 0x8000;
1227             limit -= 0x8000;
1228         } else {
1229             limit = 0;
1230         }
1231     }
1232
1233     if (limit > 0) {
1234         s->cirrus_bank_base[bank_index] = offset;
1235         s->cirrus_bank_limit[bank_index] = limit;
1236     } else {
1237         s->cirrus_bank_base[bank_index] = 0;
1238         s->cirrus_bank_limit[bank_index] = 0;
1239     }
1240 }
1241
1242 /***************************************
1243  *
1244  *  I/O access between 0x3c4-0x3c5
1245  *
1246  ***************************************/
1247
1248 static int cirrus_vga_read_sr(CirrusVGAState * s)
1249 {
1250     switch (s->vga.sr_index) {
1251     case 0x00:                  // Standard VGA
1252     case 0x01:                  // Standard VGA
1253     case 0x02:                  // Standard VGA
1254     case 0x03:                  // Standard VGA
1255     case 0x04:                  // Standard VGA
1256         return s->vga.sr[s->vga.sr_index];
1257     case 0x06:                  // Unlock Cirrus extensions
1258         return s->vga.sr[s->vga.sr_index];
1259     case 0x10:
1260     case 0x30:
1261     case 0x50:
1262     case 0x70:                  // Graphics Cursor X
1263     case 0x90:
1264     case 0xb0:
1265     case 0xd0:
1266     case 0xf0:                  // Graphics Cursor X
1267         return s->vga.sr[0x10];
1268     case 0x11:
1269     case 0x31:
1270     case 0x51:
1271     case 0x71:                  // Graphics Cursor Y
1272     case 0x91:
1273     case 0xb1:
1274     case 0xd1:
1275     case 0xf1:                  // Graphics Cursor Y
1276         return s->vga.sr[0x11];
1277     case 0x05:                  // ???
1278     case 0x07:                  // Extended Sequencer Mode
1279     case 0x08:                  // EEPROM Control
1280     case 0x09:                  // Scratch Register 0
1281     case 0x0a:                  // Scratch Register 1
1282     case 0x0b:                  // VCLK 0
1283     case 0x0c:                  // VCLK 1
1284     case 0x0d:                  // VCLK 2
1285     case 0x0e:                  // VCLK 3
1286     case 0x0f:                  // DRAM Control
1287     case 0x12:                  // Graphics Cursor Attribute
1288     case 0x13:                  // Graphics Cursor Pattern Address
1289     case 0x14:                  // Scratch Register 2
1290     case 0x15:                  // Scratch Register 3
1291     case 0x16:                  // Performance Tuning Register
1292     case 0x17:                  // Configuration Readback and Extended Control
1293     case 0x18:                  // Signature Generator Control
1294     case 0x19:                  // Signal Generator Result
1295     case 0x1a:                  // Signal Generator Result
1296     case 0x1b:                  // VCLK 0 Denominator & Post
1297     case 0x1c:                  // VCLK 1 Denominator & Post
1298     case 0x1d:                  // VCLK 2 Denominator & Post
1299     case 0x1e:                  // VCLK 3 Denominator & Post
1300     case 0x1f:                  // BIOS Write Enable and MCLK select
1301 #ifdef DEBUG_CIRRUS
1302         printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1303 #endif
1304         return s->vga.sr[s->vga.sr_index];
1305     default:
1306         qemu_log_mask(LOG_GUEST_ERROR,
1307                       "cirrus: inport sr_index 0x%02x\n", s->vga.sr_index);
1308         return 0xff;
1309     }
1310 }
1311
1312 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1313 {
1314     switch (s->vga.sr_index) {
1315     case 0x00:                  // Standard VGA
1316     case 0x01:                  // Standard VGA
1317     case 0x02:                  // Standard VGA
1318     case 0x03:                  // Standard VGA
1319     case 0x04:                  // Standard VGA
1320         s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1321         if (s->vga.sr_index == 1)
1322             s->vga.update_retrace_info(&s->vga);
1323         break;
1324     case 0x06:                  // Unlock Cirrus extensions
1325         val &= 0x17;
1326         if (val == 0x12) {
1327             s->vga.sr[s->vga.sr_index] = 0x12;
1328         } else {
1329             s->vga.sr[s->vga.sr_index] = 0x0f;
1330         }
1331         break;
1332     case 0x10:
1333     case 0x30:
1334     case 0x50:
1335     case 0x70:                  // Graphics Cursor X
1336     case 0x90:
1337     case 0xb0:
1338     case 0xd0:
1339     case 0xf0:                  // Graphics Cursor X
1340         s->vga.sr[0x10] = val;
1341         s->vga.hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1342         break;
1343     case 0x11:
1344     case 0x31:
1345     case 0x51:
1346     case 0x71:                  // Graphics Cursor Y
1347     case 0x91:
1348     case 0xb1:
1349     case 0xd1:
1350     case 0xf1:                  // Graphics Cursor Y
1351         s->vga.sr[0x11] = val;
1352         s->vga.hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1353         break;
1354     case 0x07:                  // Extended Sequencer Mode
1355         cirrus_update_memory_access(s);
1356         /* fall through */
1357     case 0x08:                  // EEPROM Control
1358     case 0x09:                  // Scratch Register 0
1359     case 0x0a:                  // Scratch Register 1
1360     case 0x0b:                  // VCLK 0
1361     case 0x0c:                  // VCLK 1
1362     case 0x0d:                  // VCLK 2
1363     case 0x0e:                  // VCLK 3
1364     case 0x0f:                  // DRAM Control
1365     case 0x13:                  // Graphics Cursor Pattern Address
1366     case 0x14:                  // Scratch Register 2
1367     case 0x15:                  // Scratch Register 3
1368     case 0x16:                  // Performance Tuning Register
1369     case 0x18:                  // Signature Generator Control
1370     case 0x19:                  // Signature Generator Result
1371     case 0x1a:                  // Signature Generator Result
1372     case 0x1b:                  // VCLK 0 Denominator & Post
1373     case 0x1c:                  // VCLK 1 Denominator & Post
1374     case 0x1d:                  // VCLK 2 Denominator & Post
1375     case 0x1e:                  // VCLK 3 Denominator & Post
1376     case 0x1f:                  // BIOS Write Enable and MCLK select
1377         s->vga.sr[s->vga.sr_index] = val;
1378 #ifdef DEBUG_CIRRUS
1379         printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1380                s->vga.sr_index, val);
1381 #endif
1382         break;
1383     case 0x12:                  // Graphics Cursor Attribute
1384         s->vga.sr[0x12] = val;
1385         s->vga.force_shadow = !!(val & CIRRUS_CURSOR_SHOW);
1386 #ifdef DEBUG_CIRRUS
1387         printf("cirrus: cursor ctl SR12=%02x (force shadow: %d)\n",
1388                val, s->vga.force_shadow);
1389 #endif
1390         break;
1391     case 0x17:                  // Configuration Readback and Extended Control
1392         s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1393                                    | (val & 0xc7);
1394         cirrus_update_memory_access(s);
1395         break;
1396     default:
1397         qemu_log_mask(LOG_GUEST_ERROR,
1398                       "cirrus: outport sr_index 0x%02x, sr_value 0x%02x\n",
1399                       s->vga.sr_index, val);
1400         break;
1401     }
1402 }
1403
1404 /***************************************
1405  *
1406  *  I/O access at 0x3c6
1407  *
1408  ***************************************/
1409
1410 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1411 {
1412     if (++s->cirrus_hidden_dac_lockindex == 5) {
1413         s->cirrus_hidden_dac_lockindex = 0;
1414         return s->cirrus_hidden_dac_data;
1415     }
1416     return 0xff;
1417 }
1418
1419 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1420 {
1421     if (s->cirrus_hidden_dac_lockindex == 4) {
1422         s->cirrus_hidden_dac_data = reg_value;
1423 #if defined(DEBUG_CIRRUS)
1424         printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1425 #endif
1426     }
1427     s->cirrus_hidden_dac_lockindex = 0;
1428 }
1429
1430 /***************************************
1431  *
1432  *  I/O access at 0x3c9
1433  *
1434  ***************************************/
1435
1436 static int cirrus_vga_read_palette(CirrusVGAState * s)
1437 {
1438     int val;
1439
1440     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1441         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1442                                        s->vga.dac_sub_index];
1443     } else {
1444         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1445     }
1446     if (++s->vga.dac_sub_index == 3) {
1447         s->vga.dac_sub_index = 0;
1448         s->vga.dac_read_index++;
1449     }
1450     return val;
1451 }
1452
1453 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1454 {
1455     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1456     if (++s->vga.dac_sub_index == 3) {
1457         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1458             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1459                    s->vga.dac_cache, 3);
1460         } else {
1461             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1462         }
1463         /* XXX update cursor */
1464         s->vga.dac_sub_index = 0;
1465         s->vga.dac_write_index++;
1466     }
1467 }
1468
1469 /***************************************
1470  *
1471  *  I/O access between 0x3ce-0x3cf
1472  *
1473  ***************************************/
1474
1475 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1476 {
1477     switch (reg_index) {
1478     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1479         return s->cirrus_shadow_gr0;
1480     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1481         return s->cirrus_shadow_gr1;
1482     case 0x02:                  // Standard VGA
1483     case 0x03:                  // Standard VGA
1484     case 0x04:                  // Standard VGA
1485     case 0x06:                  // Standard VGA
1486     case 0x07:                  // Standard VGA
1487     case 0x08:                  // Standard VGA
1488         return s->vga.gr[s->vga.gr_index];
1489     case 0x05:                  // Standard VGA, Cirrus extended mode
1490     default:
1491         break;
1492     }
1493
1494     if (reg_index < 0x3a) {
1495         return s->vga.gr[reg_index];
1496     } else {
1497         qemu_log_mask(LOG_GUEST_ERROR,
1498                       "cirrus: inport gr_index 0x%02x\n", reg_index);
1499         return 0xff;
1500     }
1501 }
1502
1503 static void
1504 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1505 {
1506     trace_vga_cirrus_write_gr(reg_index, reg_value);
1507     switch (reg_index) {
1508     case 0x00:                  // Standard VGA, BGCOLOR 0x000000ff
1509         s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1510         s->cirrus_shadow_gr0 = reg_value;
1511         break;
1512     case 0x01:                  // Standard VGA, FGCOLOR 0x000000ff
1513         s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1514         s->cirrus_shadow_gr1 = reg_value;
1515         break;
1516     case 0x02:                  // Standard VGA
1517     case 0x03:                  // Standard VGA
1518     case 0x04:                  // Standard VGA
1519     case 0x06:                  // Standard VGA
1520     case 0x07:                  // Standard VGA
1521     case 0x08:                  // Standard VGA
1522         s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1523         break;
1524     case 0x05:                  // Standard VGA, Cirrus extended mode
1525         s->vga.gr[reg_index] = reg_value & 0x7f;
1526         cirrus_update_memory_access(s);
1527         break;
1528     case 0x09:                  // bank offset #0
1529     case 0x0A:                  // bank offset #1
1530         s->vga.gr[reg_index] = reg_value;
1531         cirrus_update_bank_ptr(s, 0);
1532         cirrus_update_bank_ptr(s, 1);
1533         cirrus_update_memory_access(s);
1534         break;
1535     case 0x0B:
1536         s->vga.gr[reg_index] = reg_value;
1537         cirrus_update_bank_ptr(s, 0);
1538         cirrus_update_bank_ptr(s, 1);
1539         cirrus_update_memory_access(s);
1540         break;
1541     case 0x10:                  // BGCOLOR 0x0000ff00
1542     case 0x11:                  // FGCOLOR 0x0000ff00
1543     case 0x12:                  // BGCOLOR 0x00ff0000
1544     case 0x13:                  // FGCOLOR 0x00ff0000
1545     case 0x14:                  // BGCOLOR 0xff000000
1546     case 0x15:                  // FGCOLOR 0xff000000
1547     case 0x20:                  // BLT WIDTH 0x0000ff
1548     case 0x22:                  // BLT HEIGHT 0x0000ff
1549     case 0x24:                  // BLT DEST PITCH 0x0000ff
1550     case 0x26:                  // BLT SRC PITCH 0x0000ff
1551     case 0x28:                  // BLT DEST ADDR 0x0000ff
1552     case 0x29:                  // BLT DEST ADDR 0x00ff00
1553     case 0x2c:                  // BLT SRC ADDR 0x0000ff
1554     case 0x2d:                  // BLT SRC ADDR 0x00ff00
1555     case 0x2f:                  // BLT WRITEMASK
1556     case 0x30:                  // BLT MODE
1557     case 0x32:                  // RASTER OP
1558     case 0x33:                  // BLT MODEEXT
1559     case 0x34:                  // BLT TRANSPARENT COLOR 0x00ff
1560     case 0x35:                  // BLT TRANSPARENT COLOR 0xff00
1561     case 0x38:                  // BLT TRANSPARENT COLOR MASK 0x00ff
1562     case 0x39:                  // BLT TRANSPARENT COLOR MASK 0xff00
1563         s->vga.gr[reg_index] = reg_value;
1564         break;
1565     case 0x21:                  // BLT WIDTH 0x001f00
1566     case 0x23:                  // BLT HEIGHT 0x001f00
1567     case 0x25:                  // BLT DEST PITCH 0x001f00
1568     case 0x27:                  // BLT SRC PITCH 0x001f00
1569         s->vga.gr[reg_index] = reg_value & 0x1f;
1570         break;
1571     case 0x2a:                  // BLT DEST ADDR 0x3f0000
1572         s->vga.gr[reg_index] = reg_value & 0x3f;
1573         /* if auto start mode, starts bit blt now */
1574         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1575             cirrus_bitblt_start(s);
1576         }
1577         break;
1578     case 0x2e:                  // BLT SRC ADDR 0x3f0000
1579         s->vga.gr[reg_index] = reg_value & 0x3f;
1580         break;
1581     case 0x31:                  // BLT STATUS/START
1582         cirrus_write_bitblt(s, reg_value);
1583         break;
1584     default:
1585         qemu_log_mask(LOG_GUEST_ERROR,
1586                       "cirrus: outport gr_index 0x%02x, gr_value 0x%02x\n",
1587                       reg_index, reg_value);
1588         break;
1589     }
1590 }
1591
1592 /***************************************
1593  *
1594  *  I/O access between 0x3d4-0x3d5
1595  *
1596  ***************************************/
1597
1598 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1599 {
1600     switch (reg_index) {
1601     case 0x00:                  // Standard VGA
1602     case 0x01:                  // Standard VGA
1603     case 0x02:                  // Standard VGA
1604     case 0x03:                  // Standard VGA
1605     case 0x04:                  // Standard VGA
1606     case 0x05:                  // Standard VGA
1607     case 0x06:                  // Standard VGA
1608     case 0x07:                  // Standard VGA
1609     case 0x08:                  // Standard VGA
1610     case 0x09:                  // Standard VGA
1611     case 0x0a:                  // Standard VGA
1612     case 0x0b:                  // Standard VGA
1613     case 0x0c:                  // Standard VGA
1614     case 0x0d:                  // Standard VGA
1615     case 0x0e:                  // Standard VGA
1616     case 0x0f:                  // Standard VGA
1617     case 0x10:                  // Standard VGA
1618     case 0x11:                  // Standard VGA
1619     case 0x12:                  // Standard VGA
1620     case 0x13:                  // Standard VGA
1621     case 0x14:                  // Standard VGA
1622     case 0x15:                  // Standard VGA
1623     case 0x16:                  // Standard VGA
1624     case 0x17:                  // Standard VGA
1625     case 0x18:                  // Standard VGA
1626         return s->vga.cr[s->vga.cr_index];
1627     case 0x24:                  // Attribute Controller Toggle Readback (R)
1628         return (s->vga.ar_flip_flop << 7);
1629     case 0x19:                  // Interlace End
1630     case 0x1a:                  // Miscellaneous Control
1631     case 0x1b:                  // Extended Display Control
1632     case 0x1c:                  // Sync Adjust and Genlock
1633     case 0x1d:                  // Overlay Extended Control
1634     case 0x22:                  // Graphics Data Latches Readback (R)
1635     case 0x25:                  // Part Status
1636     case 0x27:                  // Part ID (R)
1637         return s->vga.cr[s->vga.cr_index];
1638     case 0x26:                  // Attribute Controller Index Readback (R)
1639         return s->vga.ar_index & 0x3f;
1640     default:
1641         qemu_log_mask(LOG_GUEST_ERROR,
1642                       "cirrus: inport cr_index 0x%02x\n", reg_index);
1643         return 0xff;
1644     }
1645 }
1646
1647 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1648 {
1649     switch (s->vga.cr_index) {
1650     case 0x00:                  // Standard VGA
1651     case 0x01:                  // Standard VGA
1652     case 0x02:                  // Standard VGA
1653     case 0x03:                  // Standard VGA
1654     case 0x04:                  // Standard VGA
1655     case 0x05:                  // Standard VGA
1656     case 0x06:                  // Standard VGA
1657     case 0x07:                  // Standard VGA
1658     case 0x08:                  // Standard VGA
1659     case 0x09:                  // Standard VGA
1660     case 0x0a:                  // Standard VGA
1661     case 0x0b:                  // Standard VGA
1662     case 0x0c:                  // Standard VGA
1663     case 0x0d:                  // Standard VGA
1664     case 0x0e:                  // Standard VGA
1665     case 0x0f:                  // Standard VGA
1666     case 0x10:                  // Standard VGA
1667     case 0x11:                  // Standard VGA
1668     case 0x12:                  // Standard VGA
1669     case 0x13:                  // Standard VGA
1670     case 0x14:                  // Standard VGA
1671     case 0x15:                  // Standard VGA
1672     case 0x16:                  // Standard VGA
1673     case 0x17:                  // Standard VGA
1674     case 0x18:                  // Standard VGA
1675         /* handle CR0-7 protection */
1676         if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1677             /* can always write bit 4 of CR7 */
1678             if (s->vga.cr_index == 7)
1679                 s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1680             return;
1681         }
1682         s->vga.cr[s->vga.cr_index] = reg_value;
1683         switch(s->vga.cr_index) {
1684         case 0x00:
1685         case 0x04:
1686         case 0x05:
1687         case 0x06:
1688         case 0x07:
1689         case 0x11:
1690         case 0x17:
1691             s->vga.update_retrace_info(&s->vga);
1692             break;
1693         }
1694         break;
1695     case 0x19:                  // Interlace End
1696     case 0x1a:                  // Miscellaneous Control
1697     case 0x1b:                  // Extended Display Control
1698     case 0x1c:                  // Sync Adjust and Genlock
1699     case 0x1d:                  // Overlay Extended Control
1700         s->vga.cr[s->vga.cr_index] = reg_value;
1701 #ifdef DEBUG_CIRRUS
1702         printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1703                s->vga.cr_index, reg_value);
1704 #endif
1705         break;
1706     case 0x22:                  // Graphics Data Latches Readback (R)
1707     case 0x24:                  // Attribute Controller Toggle Readback (R)
1708     case 0x26:                  // Attribute Controller Index Readback (R)
1709     case 0x27:                  // Part ID (R)
1710         break;
1711     case 0x25:                  // Part Status
1712     default:
1713         qemu_log_mask(LOG_GUEST_ERROR,
1714                       "cirrus: outport cr_index 0x%02x, cr_value 0x%02x\n",
1715                       s->vga.cr_index, reg_value);
1716         break;
1717     }
1718 }
1719
1720 /***************************************
1721  *
1722  *  memory-mapped I/O (bitblt)
1723  *
1724  ***************************************/
1725
1726 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1727 {
1728     int value = 0xff;
1729
1730     switch (address) {
1731     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1732         value = cirrus_vga_read_gr(s, 0x00);
1733         break;
1734     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1735         value = cirrus_vga_read_gr(s, 0x10);
1736         break;
1737     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1738         value = cirrus_vga_read_gr(s, 0x12);
1739         break;
1740     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1741         value = cirrus_vga_read_gr(s, 0x14);
1742         break;
1743     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1744         value = cirrus_vga_read_gr(s, 0x01);
1745         break;
1746     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1747         value = cirrus_vga_read_gr(s, 0x11);
1748         break;
1749     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1750         value = cirrus_vga_read_gr(s, 0x13);
1751         break;
1752     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1753         value = cirrus_vga_read_gr(s, 0x15);
1754         break;
1755     case (CIRRUS_MMIO_BLTWIDTH + 0):
1756         value = cirrus_vga_read_gr(s, 0x20);
1757         break;
1758     case (CIRRUS_MMIO_BLTWIDTH + 1):
1759         value = cirrus_vga_read_gr(s, 0x21);
1760         break;
1761     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1762         value = cirrus_vga_read_gr(s, 0x22);
1763         break;
1764     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1765         value = cirrus_vga_read_gr(s, 0x23);
1766         break;
1767     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1768         value = cirrus_vga_read_gr(s, 0x24);
1769         break;
1770     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1771         value = cirrus_vga_read_gr(s, 0x25);
1772         break;
1773     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1774         value = cirrus_vga_read_gr(s, 0x26);
1775         break;
1776     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1777         value = cirrus_vga_read_gr(s, 0x27);
1778         break;
1779     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1780         value = cirrus_vga_read_gr(s, 0x28);
1781         break;
1782     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1783         value = cirrus_vga_read_gr(s, 0x29);
1784         break;
1785     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1786         value = cirrus_vga_read_gr(s, 0x2a);
1787         break;
1788     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1789         value = cirrus_vga_read_gr(s, 0x2c);
1790         break;
1791     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1792         value = cirrus_vga_read_gr(s, 0x2d);
1793         break;
1794     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1795         value = cirrus_vga_read_gr(s, 0x2e);
1796         break;
1797     case CIRRUS_MMIO_BLTWRITEMASK:
1798         value = cirrus_vga_read_gr(s, 0x2f);
1799         break;
1800     case CIRRUS_MMIO_BLTMODE:
1801         value = cirrus_vga_read_gr(s, 0x30);
1802         break;
1803     case CIRRUS_MMIO_BLTROP:
1804         value = cirrus_vga_read_gr(s, 0x32);
1805         break;
1806     case CIRRUS_MMIO_BLTMODEEXT:
1807         value = cirrus_vga_read_gr(s, 0x33);
1808         break;
1809     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1810         value = cirrus_vga_read_gr(s, 0x34);
1811         break;
1812     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1813         value = cirrus_vga_read_gr(s, 0x35);
1814         break;
1815     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1816         value = cirrus_vga_read_gr(s, 0x38);
1817         break;
1818     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1819         value = cirrus_vga_read_gr(s, 0x39);
1820         break;
1821     case CIRRUS_MMIO_BLTSTATUS:
1822         value = cirrus_vga_read_gr(s, 0x31);
1823         break;
1824     default:
1825         qemu_log_mask(LOG_GUEST_ERROR,
1826                       "cirrus: mmio read - address 0x%04x\n", address);
1827         break;
1828     }
1829
1830     trace_vga_cirrus_write_blt(address, value);
1831     return (uint8_t) value;
1832 }
1833
1834 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1835                                   uint8_t value)
1836 {
1837     trace_vga_cirrus_write_blt(address, value);
1838     switch (address) {
1839     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1840         cirrus_vga_write_gr(s, 0x00, value);
1841         break;
1842     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1843         cirrus_vga_write_gr(s, 0x10, value);
1844         break;
1845     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1846         cirrus_vga_write_gr(s, 0x12, value);
1847         break;
1848     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1849         cirrus_vga_write_gr(s, 0x14, value);
1850         break;
1851     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1852         cirrus_vga_write_gr(s, 0x01, value);
1853         break;
1854     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1855         cirrus_vga_write_gr(s, 0x11, value);
1856         break;
1857     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1858         cirrus_vga_write_gr(s, 0x13, value);
1859         break;
1860     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1861         cirrus_vga_write_gr(s, 0x15, value);
1862         break;
1863     case (CIRRUS_MMIO_BLTWIDTH + 0):
1864         cirrus_vga_write_gr(s, 0x20, value);
1865         break;
1866     case (CIRRUS_MMIO_BLTWIDTH + 1):
1867         cirrus_vga_write_gr(s, 0x21, value);
1868         break;
1869     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1870         cirrus_vga_write_gr(s, 0x22, value);
1871         break;
1872     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1873         cirrus_vga_write_gr(s, 0x23, value);
1874         break;
1875     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1876         cirrus_vga_write_gr(s, 0x24, value);
1877         break;
1878     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1879         cirrus_vga_write_gr(s, 0x25, value);
1880         break;
1881     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1882         cirrus_vga_write_gr(s, 0x26, value);
1883         break;
1884     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1885         cirrus_vga_write_gr(s, 0x27, value);
1886         break;
1887     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1888         cirrus_vga_write_gr(s, 0x28, value);
1889         break;
1890     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1891         cirrus_vga_write_gr(s, 0x29, value);
1892         break;
1893     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1894         cirrus_vga_write_gr(s, 0x2a, value);
1895         break;
1896     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1897         /* ignored */
1898         break;
1899     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1900         cirrus_vga_write_gr(s, 0x2c, value);
1901         break;
1902     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1903         cirrus_vga_write_gr(s, 0x2d, value);
1904         break;
1905     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1906         cirrus_vga_write_gr(s, 0x2e, value);
1907         break;
1908     case CIRRUS_MMIO_BLTWRITEMASK:
1909         cirrus_vga_write_gr(s, 0x2f, value);
1910         break;
1911     case CIRRUS_MMIO_BLTMODE:
1912         cirrus_vga_write_gr(s, 0x30, value);
1913         break;
1914     case CIRRUS_MMIO_BLTROP:
1915         cirrus_vga_write_gr(s, 0x32, value);
1916         break;
1917     case CIRRUS_MMIO_BLTMODEEXT:
1918         cirrus_vga_write_gr(s, 0x33, value);
1919         break;
1920     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1921         cirrus_vga_write_gr(s, 0x34, value);
1922         break;
1923     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1924         cirrus_vga_write_gr(s, 0x35, value);
1925         break;
1926     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1927         cirrus_vga_write_gr(s, 0x38, value);
1928         break;
1929     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1930         cirrus_vga_write_gr(s, 0x39, value);
1931         break;
1932     case CIRRUS_MMIO_BLTSTATUS:
1933         cirrus_vga_write_gr(s, 0x31, value);
1934         break;
1935     default:
1936         qemu_log_mask(LOG_GUEST_ERROR,
1937                       "cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1938                       address, value);
1939         break;
1940     }
1941 }
1942
1943 /***************************************
1944  *
1945  *  write mode 4/5
1946  *
1947  ***************************************/
1948
1949 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1950                                              unsigned mode,
1951                                              unsigned offset,
1952                                              uint32_t mem_value)
1953 {
1954     int x;
1955     unsigned val = mem_value;
1956     uint8_t *dst;
1957
1958     for (x = 0; x < 8; x++) {
1959         dst = s->vga.vram_ptr + ((offset + x) & s->cirrus_addr_mask);
1960         if (val & 0x80) {
1961             *dst = s->cirrus_shadow_gr1;
1962         } else if (mode == 5) {
1963             *dst = s->cirrus_shadow_gr0;
1964         }
1965         val <<= 1;
1966     }
1967     memory_region_set_dirty(&s->vga.vram, offset, 8);
1968 }
1969
1970 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
1971                                               unsigned mode,
1972                                               unsigned offset,
1973                                               uint32_t mem_value)
1974 {
1975     int x;
1976     unsigned val = mem_value;
1977     uint8_t *dst;
1978
1979     for (x = 0; x < 8; x++) {
1980         dst = s->vga.vram_ptr + ((offset + 2 * x) & s->cirrus_addr_mask & ~1);
1981         if (val & 0x80) {
1982             *dst = s->cirrus_shadow_gr1;
1983             *(dst + 1) = s->vga.gr[0x11];
1984         } else if (mode == 5) {
1985             *dst = s->cirrus_shadow_gr0;
1986             *(dst + 1) = s->vga.gr[0x10];
1987         }
1988         val <<= 1;
1989     }
1990     memory_region_set_dirty(&s->vga.vram, offset, 16);
1991 }
1992
1993 /***************************************
1994  *
1995  *  memory access between 0xa0000-0xbffff
1996  *
1997  ***************************************/
1998
1999 static uint64_t cirrus_vga_mem_read(void *opaque,
2000                                     hwaddr addr,
2001                                     uint32_t size)
2002 {
2003     CirrusVGAState *s = opaque;
2004     unsigned bank_index;
2005     unsigned bank_offset;
2006     uint32_t val;
2007
2008     if ((s->vga.sr[0x07] & 0x01) == 0) {
2009         return vga_mem_readb(&s->vga, addr);
2010     }
2011
2012     if (addr < 0x10000) {
2013         /* XXX handle bitblt */
2014         /* video memory */
2015         bank_index = addr >> 15;
2016         bank_offset = addr & 0x7fff;
2017         if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2018             bank_offset += s->cirrus_bank_base[bank_index];
2019             if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2020                 bank_offset <<= 4;
2021             } else if (s->vga.gr[0x0B] & 0x02) {
2022                 bank_offset <<= 3;
2023             }
2024             bank_offset &= s->cirrus_addr_mask;
2025             val = *(s->vga.vram_ptr + bank_offset);
2026         } else
2027             val = 0xff;
2028     } else if (addr >= 0x18000 && addr < 0x18100) {
2029         /* memory-mapped I/O */
2030         val = 0xff;
2031         if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2032             val = cirrus_mmio_blt_read(s, addr & 0xff);
2033         }
2034     } else {
2035         val = 0xff;
2036         qemu_log_mask(LOG_GUEST_ERROR,
2037                       "cirrus: mem_readb 0x" TARGET_FMT_plx "\n", addr);
2038     }
2039     return val;
2040 }
2041
2042 static void cirrus_vga_mem_write(void *opaque,
2043                                  hwaddr addr,
2044                                  uint64_t mem_value,
2045                                  uint32_t size)
2046 {
2047     CirrusVGAState *s = opaque;
2048     unsigned bank_index;
2049     unsigned bank_offset;
2050     unsigned mode;
2051
2052     if ((s->vga.sr[0x07] & 0x01) == 0) {
2053         vga_mem_writeb(&s->vga, addr, mem_value);
2054         return;
2055     }
2056
2057     if (addr < 0x10000) {
2058         if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2059             /* bitblt */
2060             *s->cirrus_srcptr++ = (uint8_t) mem_value;
2061             if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2062                 cirrus_bitblt_cputovideo_next(s);
2063             }
2064         } else {
2065             /* video memory */
2066             bank_index = addr >> 15;
2067             bank_offset = addr & 0x7fff;
2068             if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2069                 bank_offset += s->cirrus_bank_base[bank_index];
2070                 if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2071                     bank_offset <<= 4;
2072                 } else if (s->vga.gr[0x0B] & 0x02) {
2073                     bank_offset <<= 3;
2074                 }
2075                 bank_offset &= s->cirrus_addr_mask;
2076                 mode = s->vga.gr[0x05] & 0x7;
2077                 if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2078                     *(s->vga.vram_ptr + bank_offset) = mem_value;
2079                     memory_region_set_dirty(&s->vga.vram, bank_offset,
2080                                             sizeof(mem_value));
2081                 } else {
2082                     if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2083                         cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2084                                                          bank_offset,
2085                                                          mem_value);
2086                     } else {
2087                         cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2088                                                           bank_offset,
2089                                                           mem_value);
2090                     }
2091                 }
2092             }
2093         }
2094     } else if (addr >= 0x18000 && addr < 0x18100) {
2095         /* memory-mapped I/O */
2096         if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2097             cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2098         }
2099     } else {
2100         qemu_log_mask(LOG_GUEST_ERROR,
2101                       "cirrus: mem_writeb 0x" TARGET_FMT_plx " "
2102                       "value 0x%02" PRIu64 "\n", addr, mem_value);
2103     }
2104 }
2105
2106 static const MemoryRegionOps cirrus_vga_mem_ops = {
2107     .read = cirrus_vga_mem_read,
2108     .write = cirrus_vga_mem_write,
2109     .endianness = DEVICE_LITTLE_ENDIAN,
2110     .impl = {
2111         .min_access_size = 1,
2112         .max_access_size = 1,
2113     },
2114 };
2115
2116 /***************************************
2117  *
2118  *  hardware cursor
2119  *
2120  ***************************************/
2121
2122 static inline void invalidate_cursor1(CirrusVGAState *s)
2123 {
2124     if (s->last_hw_cursor_size) {
2125         vga_invalidate_scanlines(&s->vga,
2126                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2127                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2128     }
2129 }
2130
2131 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2132 {
2133     const uint8_t *src;
2134     uint32_t content;
2135     int y, y_min, y_max;
2136
2137     src = s->vga.vram_ptr + s->real_vram_size - 16 * KiB;
2138     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2139         src += (s->vga.sr[0x13] & 0x3c) * 256;
2140         y_min = 64;
2141         y_max = -1;
2142         for(y = 0; y < 64; y++) {
2143             content = ((uint32_t *)src)[0] |
2144                 ((uint32_t *)src)[1] |
2145                 ((uint32_t *)src)[2] |
2146                 ((uint32_t *)src)[3];
2147             if (content) {
2148                 if (y < y_min)
2149                     y_min = y;
2150                 if (y > y_max)
2151                     y_max = y;
2152             }
2153             src += 16;
2154         }
2155     } else {
2156         src += (s->vga.sr[0x13] & 0x3f) * 256;
2157         y_min = 32;
2158         y_max = -1;
2159         for(y = 0; y < 32; y++) {
2160             content = ((uint32_t *)src)[0] |
2161                 ((uint32_t *)(src + 128))[0];
2162             if (content) {
2163                 if (y < y_min)
2164                     y_min = y;
2165                 if (y > y_max)
2166                     y_max = y;
2167             }
2168             src += 4;
2169         }
2170     }
2171     if (y_min > y_max) {
2172         s->last_hw_cursor_y_start = 0;
2173         s->last_hw_cursor_y_end = 0;
2174     } else {
2175         s->last_hw_cursor_y_start = y_min;
2176         s->last_hw_cursor_y_end = y_max + 1;
2177     }
2178 }
2179
2180 /* NOTE: we do not currently handle the cursor bitmap change, so we
2181    update the cursor only if it moves. */
2182 static void cirrus_cursor_invalidate(VGACommonState *s1)
2183 {
2184     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2185     int size;
2186
2187     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2188         size = 0;
2189     } else {
2190         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2191             size = 64;
2192         else
2193             size = 32;
2194     }
2195     /* invalidate last cursor and new cursor if any change */
2196     if (s->last_hw_cursor_size != size ||
2197         s->last_hw_cursor_x != s->vga.hw_cursor_x ||
2198         s->last_hw_cursor_y != s->vga.hw_cursor_y) {
2199
2200         invalidate_cursor1(s);
2201
2202         s->last_hw_cursor_size = size;
2203         s->last_hw_cursor_x = s->vga.hw_cursor_x;
2204         s->last_hw_cursor_y = s->vga.hw_cursor_y;
2205         /* compute the real cursor min and max y */
2206         cirrus_cursor_compute_yrange(s);
2207         invalidate_cursor1(s);
2208     }
2209 }
2210
2211 static void vga_draw_cursor_line(uint8_t *d1,
2212                                  const uint8_t *src1,
2213                                  int poffset, int w,
2214                                  unsigned int color0,
2215                                  unsigned int color1,
2216                                  unsigned int color_xor)
2217 {
2218     const uint8_t *plane0, *plane1;
2219     int x, b0, b1;
2220     uint8_t *d;
2221
2222     d = d1;
2223     plane0 = src1;
2224     plane1 = src1 + poffset;
2225     for (x = 0; x < w; x++) {
2226         b0 = (plane0[x >> 3] >> (7 - (x & 7))) & 1;
2227         b1 = (plane1[x >> 3] >> (7 - (x & 7))) & 1;
2228         switch (b0 | (b1 << 1)) {
2229         case 0:
2230             break;
2231         case 1:
2232             ((uint32_t *)d)[0] ^= color_xor;
2233             break;
2234         case 2:
2235             ((uint32_t *)d)[0] = color0;
2236             break;
2237         case 3:
2238             ((uint32_t *)d)[0] = color1;
2239             break;
2240         }
2241         d += 4;
2242     }
2243 }
2244
2245 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2246 {
2247     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2248     int w, h, x1, x2, poffset;
2249     unsigned int color0, color1;
2250     const uint8_t *palette, *src;
2251     uint32_t content;
2252
2253     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2254         return;
2255     /* fast test to see if the cursor intersects with the scan line */
2256     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2257         h = 64;
2258     } else {
2259         h = 32;
2260     }
2261     if (scr_y < s->vga.hw_cursor_y ||
2262         scr_y >= (s->vga.hw_cursor_y + h)) {
2263         return;
2264     }
2265
2266     src = s->vga.vram_ptr + s->real_vram_size - 16 * KiB;
2267     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2268         src += (s->vga.sr[0x13] & 0x3c) * 256;
2269         src += (scr_y - s->vga.hw_cursor_y) * 16;
2270         poffset = 8;
2271         content = ((uint32_t *)src)[0] |
2272             ((uint32_t *)src)[1] |
2273             ((uint32_t *)src)[2] |
2274             ((uint32_t *)src)[3];
2275     } else {
2276         src += (s->vga.sr[0x13] & 0x3f) * 256;
2277         src += (scr_y - s->vga.hw_cursor_y) * 4;
2278
2279
2280         poffset = 128;
2281         content = ((uint32_t *)src)[0] |
2282             ((uint32_t *)(src + 128))[0];
2283     }
2284     /* if nothing to draw, no need to continue */
2285     if (!content)
2286         return;
2287     w = h;
2288
2289     x1 = s->vga.hw_cursor_x;
2290     if (x1 >= s->vga.last_scr_width)
2291         return;
2292     x2 = s->vga.hw_cursor_x + w;
2293     if (x2 > s->vga.last_scr_width)
2294         x2 = s->vga.last_scr_width;
2295     w = x2 - x1;
2296     palette = s->cirrus_hidden_palette;
2297     color0 = rgb_to_pixel32(c6_to_8(palette[0x0 * 3]),
2298                             c6_to_8(palette[0x0 * 3 + 1]),
2299                             c6_to_8(palette[0x0 * 3 + 2]));
2300     color1 = rgb_to_pixel32(c6_to_8(palette[0xf * 3]),
2301                             c6_to_8(palette[0xf * 3 + 1]),
2302                             c6_to_8(palette[0xf * 3 + 2]));
2303     d1 += x1 * 4;
2304     vga_draw_cursor_line(d1, src, poffset, w, color0, color1, 0xffffff);
2305 }
2306
2307 /***************************************
2308  *
2309  *  LFB memory access
2310  *
2311  ***************************************/
2312
2313 static uint64_t cirrus_linear_read(void *opaque, hwaddr addr,
2314                                    unsigned size)
2315 {
2316     CirrusVGAState *s = opaque;
2317     uint32_t ret;
2318
2319     addr &= s->cirrus_addr_mask;
2320
2321     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2322         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2323         /* memory-mapped I/O */
2324         ret = cirrus_mmio_blt_read(s, addr & 0xff);
2325     } else if (0) {
2326         /* XXX handle bitblt */
2327         ret = 0xff;
2328     } else {
2329         /* video memory */
2330         if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2331             addr <<= 4;
2332         } else if (s->vga.gr[0x0B] & 0x02) {
2333             addr <<= 3;
2334         }
2335         addr &= s->cirrus_addr_mask;
2336         ret = *(s->vga.vram_ptr + addr);
2337     }
2338
2339     return ret;
2340 }
2341
2342 static void cirrus_linear_write(void *opaque, hwaddr addr,
2343                                 uint64_t val, unsigned size)
2344 {
2345     CirrusVGAState *s = opaque;
2346     unsigned mode;
2347
2348     addr &= s->cirrus_addr_mask;
2349
2350     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2351         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2352         /* memory-mapped I/O */
2353         cirrus_mmio_blt_write(s, addr & 0xff, val);
2354     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2355         /* bitblt */
2356         *s->cirrus_srcptr++ = (uint8_t) val;
2357         if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2358             cirrus_bitblt_cputovideo_next(s);
2359         }
2360     } else {
2361         /* video memory */
2362         if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2363             addr <<= 4;
2364         } else if (s->vga.gr[0x0B] & 0x02) {
2365             addr <<= 3;
2366         }
2367         addr &= s->cirrus_addr_mask;
2368
2369         mode = s->vga.gr[0x05] & 0x7;
2370         if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2371             *(s->vga.vram_ptr + addr) = (uint8_t) val;
2372             memory_region_set_dirty(&s->vga.vram, addr, 1);
2373         } else {
2374             if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2375                 cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2376             } else {
2377                 cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2378             }
2379         }
2380     }
2381 }
2382
2383 /***************************************
2384  *
2385  *  system to screen memory access
2386  *
2387  ***************************************/
2388
2389
2390 static uint64_t cirrus_linear_bitblt_read(void *opaque,
2391                                           hwaddr addr,
2392                                           unsigned size)
2393 {
2394     CirrusVGAState *s = opaque;
2395
2396     /* XXX handle bitblt */
2397     (void)s;
2398     qemu_log_mask(LOG_UNIMP,
2399                   "cirrus: linear bitblt is not implemented\n");
2400
2401     return 0xff;
2402 }
2403
2404 static void cirrus_linear_bitblt_write(void *opaque,
2405                                        hwaddr addr,
2406                                        uint64_t val,
2407                                        unsigned size)
2408 {
2409     CirrusVGAState *s = opaque;
2410
2411     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2412         /* bitblt */
2413         *s->cirrus_srcptr++ = (uint8_t) val;
2414         if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2415             cirrus_bitblt_cputovideo_next(s);
2416         }
2417     }
2418 }
2419
2420 static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
2421     .read = cirrus_linear_bitblt_read,
2422     .write = cirrus_linear_bitblt_write,
2423     .endianness = DEVICE_LITTLE_ENDIAN,
2424     .impl = {
2425         .min_access_size = 1,
2426         .max_access_size = 1,
2427     },
2428 };
2429
2430 static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
2431 {
2432     MemoryRegion *mr = &s->cirrus_bank[bank];
2433     bool enabled = !(s->cirrus_srcptr != s->cirrus_srcptr_end)
2434         && !((s->vga.sr[0x07] & 0x01) == 0)
2435         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2436         && !(s->vga.gr[0x0B] & 0x02);
2437
2438     memory_region_set_enabled(mr, enabled);
2439     memory_region_set_alias_offset(mr, s->cirrus_bank_base[bank]);
2440 }
2441
2442 static void map_linear_vram(CirrusVGAState *s)
2443 {
2444     if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
2445         s->linear_vram = true;
2446         memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
2447     }
2448     map_linear_vram_bank(s, 0);
2449     map_linear_vram_bank(s, 1);
2450 }
2451
2452 static void unmap_linear_vram(CirrusVGAState *s)
2453 {
2454     if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
2455         s->linear_vram = false;
2456         memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
2457     }
2458     memory_region_set_enabled(&s->cirrus_bank[0], false);
2459     memory_region_set_enabled(&s->cirrus_bank[1], false);
2460 }
2461
2462 /* Compute the memory access functions */
2463 static void cirrus_update_memory_access(CirrusVGAState *s)
2464 {
2465     unsigned mode;
2466
2467     memory_region_transaction_begin();
2468     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2469         goto generic_io;
2470     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2471         goto generic_io;
2472     } else {
2473         if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2474             goto generic_io;
2475         } else if (s->vga.gr[0x0B] & 0x02) {
2476             goto generic_io;
2477         }
2478
2479         mode = s->vga.gr[0x05] & 0x7;
2480         if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2481             map_linear_vram(s);
2482         } else {
2483         generic_io:
2484             unmap_linear_vram(s);
2485         }
2486     }
2487     memory_region_transaction_commit();
2488 }
2489
2490
2491 /* I/O ports */
2492
2493 static uint64_t cirrus_vga_ioport_read(void *opaque, hwaddr addr,
2494                                        unsigned size)
2495 {
2496     CirrusVGAState *c = opaque;
2497     VGACommonState *s = &c->vga;
2498     int val, index;
2499
2500     addr += 0x3b0;
2501
2502     if (vga_ioport_invalid(s, addr)) {
2503         val = 0xff;
2504     } else {
2505         switch (addr) {
2506         case 0x3c0:
2507             if (s->ar_flip_flop == 0) {
2508                 val = s->ar_index;
2509             } else {
2510                 val = 0;
2511             }
2512             break;
2513         case 0x3c1:
2514             index = s->ar_index & 0x1f;
2515             if (index < 21)
2516                 val = s->ar[index];
2517             else
2518                 val = 0;
2519             break;
2520         case 0x3c2:
2521             val = s->st00;
2522             break;
2523         case 0x3c4:
2524             val = s->sr_index;
2525             break;
2526         case 0x3c5:
2527             val = cirrus_vga_read_sr(c);
2528             break;
2529 #ifdef DEBUG_VGA_REG
2530             printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
2531 #endif
2532             break;
2533         case 0x3c6:
2534             val = cirrus_read_hidden_dac(c);
2535             break;
2536         case 0x3c7:
2537             val = s->dac_state;
2538             break;
2539         case 0x3c8:
2540             val = s->dac_write_index;
2541             c->cirrus_hidden_dac_lockindex = 0;
2542             break;
2543         case 0x3c9:
2544             val = cirrus_vga_read_palette(c);
2545             break;
2546         case 0x3ca:
2547             val = s->fcr;
2548             break;
2549         case 0x3cc:
2550             val = s->msr;
2551             break;
2552         case 0x3ce:
2553             val = s->gr_index;
2554             break;
2555         case 0x3cf:
2556             val = cirrus_vga_read_gr(c, s->gr_index);
2557 #ifdef DEBUG_VGA_REG
2558             printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
2559 #endif
2560             break;
2561         case 0x3b4:
2562         case 0x3d4:
2563             val = s->cr_index;
2564             break;
2565         case 0x3b5:
2566         case 0x3d5:
2567             val = cirrus_vga_read_cr(c, s->cr_index);
2568 #ifdef DEBUG_VGA_REG
2569             printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
2570 #endif
2571             break;
2572         case 0x3ba:
2573         case 0x3da:
2574             /* just toggle to fool polling */
2575             val = s->st01 = s->retrace(s);
2576             s->ar_flip_flop = 0;
2577             break;
2578         default:
2579             val = 0x00;
2580             break;
2581         }
2582     }
2583     trace_vga_cirrus_read_io(addr, val);
2584     return val;
2585 }
2586
2587 static void cirrus_vga_ioport_write(void *opaque, hwaddr addr, uint64_t val,
2588                                     unsigned size)
2589 {
2590     CirrusVGAState *c = opaque;
2591     VGACommonState *s = &c->vga;
2592     int index;
2593
2594     addr += 0x3b0;
2595
2596     /* check port range access depending on color/monochrome mode */
2597     if (vga_ioport_invalid(s, addr)) {
2598         return;
2599     }
2600     trace_vga_cirrus_write_io(addr, val);
2601
2602     switch (addr) {
2603     case 0x3c0:
2604         if (s->ar_flip_flop == 0) {
2605             val &= 0x3f;
2606             s->ar_index = val;
2607         } else {
2608             index = s->ar_index & 0x1f;
2609             switch (index) {
2610             case 0x00 ... 0x0f:
2611                 s->ar[index] = val & 0x3f;
2612                 break;
2613             case 0x10:
2614                 s->ar[index] = val & ~0x10;
2615                 break;
2616             case 0x11:
2617                 s->ar[index] = val;
2618                 break;
2619             case 0x12:
2620                 s->ar[index] = val & ~0xc0;
2621                 break;
2622             case 0x13:
2623                 s->ar[index] = val & ~0xf0;
2624                 break;
2625             case 0x14:
2626                 s->ar[index] = val & ~0xf0;
2627                 break;
2628             default:
2629                 break;
2630             }
2631         }
2632         s->ar_flip_flop ^= 1;
2633         break;
2634     case 0x3c2:
2635         s->msr = val & ~0x10;
2636         s->update_retrace_info(s);
2637         break;
2638     case 0x3c4:
2639         s->sr_index = val;
2640         break;
2641     case 0x3c5:
2642 #ifdef DEBUG_VGA_REG
2643         printf("vga: write SR%x = 0x%02" PRIu64 "\n", s->sr_index, val);
2644 #endif
2645         cirrus_vga_write_sr(c, val);
2646         break;
2647     case 0x3c6:
2648         cirrus_write_hidden_dac(c, val);
2649         break;
2650     case 0x3c7:
2651         s->dac_read_index = val;
2652         s->dac_sub_index = 0;
2653         s->dac_state = 3;
2654         break;
2655     case 0x3c8:
2656         s->dac_write_index = val;
2657         s->dac_sub_index = 0;
2658         s->dac_state = 0;
2659         break;
2660     case 0x3c9:
2661         cirrus_vga_write_palette(c, val);
2662         break;
2663     case 0x3ce:
2664         s->gr_index = val;
2665         break;
2666     case 0x3cf:
2667 #ifdef DEBUG_VGA_REG
2668         printf("vga: write GR%x = 0x%02" PRIu64 "\n", s->gr_index, val);
2669 #endif
2670         cirrus_vga_write_gr(c, s->gr_index, val);
2671         break;
2672     case 0x3b4:
2673     case 0x3d4:
2674         s->cr_index = val;
2675         break;
2676     case 0x3b5:
2677     case 0x3d5:
2678 #ifdef DEBUG_VGA_REG
2679         printf("vga: write CR%x = 0x%02"PRIu64"\n", s->cr_index, val);
2680 #endif
2681         cirrus_vga_write_cr(c, val);
2682         break;
2683     case 0x3ba:
2684     case 0x3da:
2685         s->fcr = val & 0x10;
2686         break;
2687     }
2688 }
2689
2690 /***************************************
2691  *
2692  *  memory-mapped I/O access
2693  *
2694  ***************************************/
2695
2696 static uint64_t cirrus_mmio_read(void *opaque, hwaddr addr,
2697                                  unsigned size)
2698 {
2699     CirrusVGAState *s = opaque;
2700
2701     if (addr >= 0x100) {
2702         return cirrus_mmio_blt_read(s, addr - 0x100);
2703     } else {
2704         return cirrus_vga_ioport_read(s, addr + 0x10, size);
2705     }
2706 }
2707
2708 static void cirrus_mmio_write(void *opaque, hwaddr addr,
2709                               uint64_t val, unsigned size)
2710 {
2711     CirrusVGAState *s = opaque;
2712
2713     if (addr >= 0x100) {
2714         cirrus_mmio_blt_write(s, addr - 0x100, val);
2715     } else {
2716         cirrus_vga_ioport_write(s, addr + 0x10, val, size);
2717     }
2718 }
2719
2720 static const MemoryRegionOps cirrus_mmio_io_ops = {
2721     .read = cirrus_mmio_read,
2722     .write = cirrus_mmio_write,
2723     .endianness = DEVICE_LITTLE_ENDIAN,
2724     .impl = {
2725         .min_access_size = 1,
2726         .max_access_size = 1,
2727     },
2728 };
2729
2730 /* load/save state */
2731
2732 static int cirrus_post_load(void *opaque, int version_id)
2733 {
2734     CirrusVGAState *s = opaque;
2735
2736     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2737     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2738
2739     cirrus_update_bank_ptr(s, 0);
2740     cirrus_update_bank_ptr(s, 1);
2741     cirrus_update_memory_access(s);
2742     /* force refresh */
2743     s->vga.graphic_mode = -1;
2744
2745     return 0;
2746 }
2747
2748 const VMStateDescription vmstate_cirrus_vga = {
2749     .name = "cirrus_vga",
2750     .version_id = 2,
2751     .minimum_version_id = 1,
2752     .post_load = cirrus_post_load,
2753     .fields = (VMStateField[]) {
2754         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2755         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2756         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2757         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2758         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2759         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2760         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2761         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2762         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2763         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2764         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2765         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
2766         VMSTATE_UINT8(vga.msr, CirrusVGAState),
2767         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
2768         VMSTATE_UINT8(vga.st00, CirrusVGAState),
2769         VMSTATE_UINT8(vga.st01, CirrusVGAState),
2770         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
2771         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
2772         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
2773         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
2774         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
2775         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
2776         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
2777         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
2778         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
2779         VMSTATE_UINT32(vga.hw_cursor_x, CirrusVGAState),
2780         VMSTATE_UINT32(vga.hw_cursor_y, CirrusVGAState),
2781         /* XXX: we do not save the bitblt state - we assume we do not save
2782            the state when the blitter is active */
2783         VMSTATE_END_OF_LIST()
2784     }
2785 };
2786
2787 static const VMStateDescription vmstate_pci_cirrus_vga = {
2788     .name = "cirrus_vga",
2789     .version_id = 2,
2790     .minimum_version_id = 2,
2791     .fields = (VMStateField[]) {
2792         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
2793         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
2794                        vmstate_cirrus_vga, CirrusVGAState),
2795         VMSTATE_END_OF_LIST()
2796     }
2797 };
2798
2799 /***************************************
2800  *
2801  *  initialize
2802  *
2803  ***************************************/
2804
2805 static void cirrus_reset(void *opaque)
2806 {
2807     CirrusVGAState *s = opaque;
2808
2809     vga_common_reset(&s->vga);
2810     unmap_linear_vram(s);
2811     s->vga.sr[0x06] = 0x0f;
2812     if (s->device_id == CIRRUS_ID_CLGD5446) {
2813         /* 4MB 64 bit memory config, always PCI */
2814         s->vga.sr[0x1F] = 0x2d;         // MemClock
2815         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
2816         s->vga.sr[0x0f] = 0x98;
2817         s->vga.sr[0x17] = 0x20;
2818         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
2819     } else {
2820         s->vga.sr[0x1F] = 0x22;         // MemClock
2821         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
2822         s->vga.sr[0x17] = s->bustype;
2823         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
2824     }
2825     s->vga.cr[0x27] = s->device_id;
2826
2827     s->cirrus_hidden_dac_lockindex = 5;
2828     s->cirrus_hidden_dac_data = 0;
2829 }
2830
2831 static const MemoryRegionOps cirrus_linear_io_ops = {
2832     .read = cirrus_linear_read,
2833     .write = cirrus_linear_write,
2834     .endianness = DEVICE_LITTLE_ENDIAN,
2835     .impl = {
2836         .min_access_size = 1,
2837         .max_access_size = 1,
2838     },
2839 };
2840
2841 static const MemoryRegionOps cirrus_vga_io_ops = {
2842     .read = cirrus_vga_ioport_read,
2843     .write = cirrus_vga_ioport_write,
2844     .endianness = DEVICE_LITTLE_ENDIAN,
2845     .impl = {
2846         .min_access_size = 1,
2847         .max_access_size = 1,
2848     },
2849 };
2850
2851 void cirrus_init_common(CirrusVGAState *s, Object *owner,
2852                         int device_id, int is_pci,
2853                         MemoryRegion *system_memory, MemoryRegion *system_io)
2854 {
2855     int i;
2856     static int inited;
2857
2858     if (!inited) {
2859         inited = 1;
2860         for(i = 0;i < 256; i++)
2861             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
2862         rop_to_index[CIRRUS_ROP_0] = 0;
2863         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
2864         rop_to_index[CIRRUS_ROP_NOP] = 2;
2865         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
2866         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
2867         rop_to_index[CIRRUS_ROP_SRC] = 5;
2868         rop_to_index[CIRRUS_ROP_1] = 6;
2869         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
2870         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
2871         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
2872         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
2873         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
2874         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
2875         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
2876         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
2877         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
2878         s->device_id = device_id;
2879         if (is_pci)
2880             s->bustype = CIRRUS_BUSTYPE_PCI;
2881         else
2882             s->bustype = CIRRUS_BUSTYPE_ISA;
2883     }
2884
2885     /* Register ioport 0x3b0 - 0x3df */
2886     memory_region_init_io(&s->cirrus_vga_io, owner, &cirrus_vga_io_ops, s,
2887                           "cirrus-io", 0x30);
2888     memory_region_set_flush_coalesced(&s->cirrus_vga_io);
2889     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
2890
2891     memory_region_init(&s->low_mem_container, owner,
2892                        "cirrus-lowmem-container",
2893                        0x20000);
2894
2895     memory_region_init_io(&s->low_mem, owner, &cirrus_vga_mem_ops, s,
2896                           "cirrus-low-memory", 0x20000);
2897     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
2898     for (i = 0; i < 2; ++i) {
2899         static const char *names[] = { "vga.bank0", "vga.bank1" };
2900         MemoryRegion *bank = &s->cirrus_bank[i];
2901         memory_region_init_alias(bank, owner, names[i], &s->vga.vram,
2902                                  0, 0x8000);
2903         memory_region_set_enabled(bank, false);
2904         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
2905                                             bank, 1);
2906     }
2907     memory_region_add_subregion_overlap(system_memory,
2908                                         0x000a0000,
2909                                         &s->low_mem_container,
2910                                         1);
2911     memory_region_set_coalescing(&s->low_mem);
2912
2913     /* I/O handler for LFB */
2914     memory_region_init_io(&s->cirrus_linear_io, owner, &cirrus_linear_io_ops, s,
2915                           "cirrus-linear-io", s->vga.vram_size_mb * MiB);
2916     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
2917
2918     /* I/O handler for LFB */
2919     memory_region_init_io(&s->cirrus_linear_bitblt_io, owner,
2920                           &cirrus_linear_bitblt_io_ops,
2921                           s,
2922                           "cirrus-bitblt-mmio",
2923                           0x400000);
2924     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
2925
2926     /* I/O handler for memory-mapped I/O */
2927     memory_region_init_io(&s->cirrus_mmio_io, owner, &cirrus_mmio_io_ops, s,
2928                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
2929     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
2930
2931     s->real_vram_size =
2932         (s->device_id == CIRRUS_ID_CLGD5446) ? 4 * MiB : 2 * MiB;
2933
2934     /* XXX: s->vga.vram_size must be a power of two */
2935     s->cirrus_addr_mask = s->real_vram_size - 1;
2936     s->linear_mmio_mask = s->real_vram_size - 256;
2937
2938     s->vga.get_bpp = cirrus_get_bpp;
2939     s->vga.get_offsets = cirrus_get_offsets;
2940     s->vga.get_resolution = cirrus_get_resolution;
2941     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
2942     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
2943
2944     qemu_register_reset(cirrus_reset, s);
2945 }
2946
2947 /***************************************
2948  *
2949  *  PCI bus support
2950  *
2951  ***************************************/
2952
2953 static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
2954 {
2955      PCICirrusVGAState *d = PCI_CIRRUS_VGA(dev);
2956      CirrusVGAState *s = &d->cirrus_vga;
2957      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
2958      int16_t device_id = pc->device_id;
2959
2960      /* follow real hardware, cirrus card emulated has 4 MB video memory.
2961        Also accept 8 MB/16 MB for backward compatibility. */
2962      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
2963          s->vga.vram_size_mb != 16) {
2964          error_setg(errp, "Invalid cirrus_vga ram size '%u'",
2965                     s->vga.vram_size_mb);
2966          return;
2967      }
2968      /* setup VGA */
2969      vga_common_init(&s->vga, OBJECT(dev));
2970      cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
2971                         pci_address_space_io(dev));
2972      s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);
2973
2974      /* setup PCI */
2975
2976     memory_region_init(&s->pci_bar, OBJECT(dev), "cirrus-pci-bar0", 0x2000000);
2977
2978     /* XXX: add byte swapping apertures */
2979     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
2980     memory_region_add_subregion(&s->pci_bar, 0x1000000,
2981                                 &s->cirrus_linear_bitblt_io);
2982
2983      /* setup memory space */
2984      /* memory #0 LFB */
2985      /* memory #1 memory-mapped I/O */
2986      /* XXX: s->vga.vram_size must be a power of two */
2987      pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);
2988      if (device_id == CIRRUS_ID_CLGD5446) {
2989          pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
2990      }
2991 }
2992
2993 static Property pci_vga_cirrus_properties[] = {
2994     DEFINE_PROP_UINT32("vgamem_mb", struct PCICirrusVGAState,
2995                        cirrus_vga.vga.vram_size_mb, 4),
2996     DEFINE_PROP_BOOL("blitter", struct PCICirrusVGAState,
2997                      cirrus_vga.enable_blitter, true),
2998     DEFINE_PROP_BOOL("global-vmstate", struct PCICirrusVGAState,
2999                      cirrus_vga.vga.global_vmstate, false),
3000     DEFINE_PROP_END_OF_LIST(),
3001 };
3002
3003 static void cirrus_vga_class_init(ObjectClass *klass, void *data)
3004 {
3005     DeviceClass *dc = DEVICE_CLASS(klass);
3006     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
3007
3008     k->realize = pci_cirrus_vga_realize;
3009     k->romfile = VGABIOS_CIRRUS_FILENAME;
3010     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
3011     k->device_id = CIRRUS_ID_CLGD5446;
3012     k->class_id = PCI_CLASS_DISPLAY_VGA;
3013     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3014     dc->desc = "Cirrus CLGD 54xx VGA";
3015     dc->vmsd = &vmstate_pci_cirrus_vga;
3016     device_class_set_props(dc, pci_vga_cirrus_properties);
3017     dc->hotpluggable = false;
3018 }
3019
3020 static const TypeInfo cirrus_vga_info = {
3021     .name          = TYPE_PCI_CIRRUS_VGA,
3022     .parent        = TYPE_PCI_DEVICE,
3023     .instance_size = sizeof(PCICirrusVGAState),
3024     .class_init    = cirrus_vga_class_init,
3025     .interfaces = (InterfaceInfo[]) {
3026         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
3027         { },
3028     },
3029 };
3030
3031 static void cirrus_vga_register_types(void)
3032 {
3033     type_register_static(&cirrus_vga_info);
3034 }
3035
3036 type_init(cirrus_vga_register_types)