Merge remote-tracking branch 'kraxel/usb.29' into staging

[qemu.git] / hw / cirrus_vga.c

diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
index b36984936abf62eb1a11fde6aecc408ffdba682e..c7e365b2a67ba2cb043065493f6712f4739d3d08 100644 (file)
--- a/hw/cirrus_vga.c
+++ b/hw/cirrus_vga.c
@@ -31,7 +31,7 @@
 #include "pci.h"
 #include "console.h"
 #include "vga_int.h"
 #include "pci.h"
 #include "console.h"
 #include "vga_int.h"

-#include "kvm.h"
+#include "loader.h"

 
 /*
  * TODO:
 
 /*
  * TODO:


@@ -171,50 +171,8 @@
 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39     // byte
 #define CIRRUS_MMIO_BLTSTATUS         0x40     // byte
 
 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39     // byte
 #define CIRRUS_MMIO_BLTSTATUS         0x40     // byte
 

-// PCI 0x04: command(word), 0x06(word): status
-#define PCI_COMMAND_IOACCESS                0x0001
-#define PCI_COMMAND_MEMACCESS               0x0002
-#define PCI_COMMAND_BUSMASTER               0x0004
-#define PCI_COMMAND_SPECIALCYCLE            0x0008
-#define PCI_COMMAND_MEMWRITEINVALID         0x0010
-#define PCI_COMMAND_PALETTESNOOPING         0x0020
-#define PCI_COMMAND_PARITYDETECTION         0x0040
-#define PCI_COMMAND_ADDRESSDATASTEPPING     0x0080
-#define PCI_COMMAND_SERR                    0x0100
-#define PCI_COMMAND_BACKTOBACKTRANS         0x0200
-// PCI 0x08, 0xff000000 (0x09-0x0b:class,0x08:rev)
-#define PCI_CLASS_BASE_DISPLAY        0x03
-// PCI 0x08, 0x00ff0000
-#define PCI_CLASS_SUB_VGA             0x00
-// PCI 0x0c, 0x00ff0000 (0x0c:cacheline,0x0d:latency,0x0e:headertype,0x0f:Built-in self test)
-// 0x10-0x3f (headertype 00h)
-// PCI 0x10,0x14,0x18,0x1c,0x20,0x24: base address mapping registers
-//   0x10: MEMBASE, 0x14: IOBASE(hard-coded in XFree86 3.x)
-#define PCI_MAP_MEM                 0x0
-#define PCI_MAP_IO                  0x1
-#define PCI_MAP_MEM_ADDR_MASK       (~0xf)
-#define PCI_MAP_IO_ADDR_MASK        (~0x3)
-#define PCI_MAP_MEMFLAGS_32BIT      0x0
-#define PCI_MAP_MEMFLAGS_32BIT_1M   0x1
-#define PCI_MAP_MEMFLAGS_64BIT      0x4
-#define PCI_MAP_MEMFLAGS_CACHEABLE  0x8
-// PCI 0x28: cardbus CIS pointer
-// PCI 0x2c: subsystem vendor id, 0x2e: subsystem id
-// PCI 0x30: expansion ROM base address
-#define PCI_ROMBIOS_ENABLED         0x1
-// PCI 0x34: 0xffffff00=reserved, 0x000000ff=capabilities pointer
-// PCI 0x38: reserved
-// PCI 0x3c: 0x3c=int-line, 0x3d=int-pin, 0x3e=min-gnt, 0x3f=maax-lat
-

 #define CIRRUS_PNPMMIO_SIZE         0x1000
 
 #define CIRRUS_PNPMMIO_SIZE         0x1000
 

-
-/* I/O and memory hook */
-#define CIRRUS_HOOK_NOT_HANDLED 0
-#define CIRRUS_HOOK_HANDLED 1
-
-#define ABS(a) ((signed)(a) > 0 ? a : -a)
-

 #define BLTUNSAFE(s) \
     ( \
         ( /* check dst is within bounds */ \
 #define BLTUNSAFE(s) \
     ( \
         ( /* check dst is within bounds */ \


@@ -240,9 +198,14 @@ typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
 typedef struct CirrusVGAState {
     VGACommonState vga;
 
 typedef struct CirrusVGAState {
     VGACommonState vga;
 

-    int cirrus_linear_io_addr;
-    int cirrus_linear_bitblt_io_addr;
-    int cirrus_mmio_io_addr;
+    MemoryRegion cirrus_linear_io;
+    MemoryRegion cirrus_linear_bitblt_io;
+    MemoryRegion cirrus_mmio_io;
+    MemoryRegion pci_bar;
+    bool linear_vram;  /* vga.vram mapped over cirrus_linear_io */
+    MemoryRegion low_mem_container; /* container for 0xa0000-0xc0000 */
+    MemoryRegion low_mem;           /* always mapped, overridden by: */
+    MemoryRegion *cirrus_bank[2];   /*   aliases at 0xa0000-0xb0000  */

     uint32_t cirrus_addr_mask;
     uint32_t linear_mmio_mask;
     uint8_t cirrus_shadow_gr0;
     uint32_t cirrus_addr_mask;
     uint32_t linear_mmio_mask;
     uint8_t cirrus_shadow_gr0;


@@ -319,63 +282,63 @@ static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
 }
 
 #define ROP_NAME 0
 }
 
 #define ROP_NAME 0

-#define ROP_OP(d, s) d = 0
+#define ROP_FN(d, s) 0

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_and_dst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_and_dst

-#define ROP_OP(d, s) d = (s) & (d)
+#define ROP_FN(d, s) (s) & (d)

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_and_notdst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_and_notdst

-#define ROP_OP(d, s) d = (s) & (~(d))
+#define ROP_FN(d, s) (s) & (~(d))

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notdst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notdst

-#define ROP_OP(d, s) d = ~(d)
+#define ROP_FN(d, s) ~(d)

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src

-#define ROP_OP(d, s) d = s
+#define ROP_FN(d, s) s

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME 1
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME 1

-#define ROP_OP(d, s) d = ~0
+#define ROP_FN(d, s) ~0

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc_and_dst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc_and_dst

-#define ROP_OP(d, s) d = (~(s)) & (d)
+#define ROP_FN(d, s) (~(s)) & (d)

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_xor_dst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_xor_dst

-#define ROP_OP(d, s) d = (s) ^ (d)
+#define ROP_FN(d, s) (s) ^ (d)

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_or_dst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_or_dst

-#define ROP_OP(d, s) d = (s) | (d)
+#define ROP_FN(d, s) (s) | (d)

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc_or_notdst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc_or_notdst

-#define ROP_OP(d, s) d = (~(s)) | (~(d))
+#define ROP_FN(d, s) (~(s)) | (~(d))

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_notxor_dst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_notxor_dst

-#define ROP_OP(d, s) d = ~((s) ^ (d))
+#define ROP_FN(d, s) ~((s) ^ (d))

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_or_notdst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME src_or_notdst

-#define ROP_OP(d, s) d = (s) | (~(d))
+#define ROP_FN(d, s) (s) | (~(d))

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc

-#define ROP_OP(d, s) d = (~(s))
+#define ROP_FN(d, s) (~(s))

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc_or_dst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc_or_dst

-#define ROP_OP(d, s) d = (~(s)) | (d)
+#define ROP_FN(d, s) (~(s)) | (d)

 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc_and_notdst
 #include "cirrus_vga_rop.h"
 
 #define ROP_NAME notsrc_and_notdst

-#define ROP_OP(d, s) d = (~(s)) & (~(d))
+#define ROP_FN(d, s) (~(s)) & (~(d))

 #include "cirrus_vga_rop.h"
 
 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
 #include "cirrus_vga_rop.h"
 
 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {


@@ -652,7 +615,7 @@ static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
        off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
        off_cur &= TARGET_PAGE_MASK;
        while (off_cur < off_cur_end) {
        off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
        off_cur &= TARGET_PAGE_MASK;
        while (off_cur < off_cur_end) {

-           cpu_physical_memory_set_dirty(s->vga.vram_offset + off_cur);
+           memory_region_set_dirty(&s->vga.vram, off_cur);

            off_cur += TARGET_PAGE_SIZE;
        }
        off_begin += off_pitch;
            off_cur += TARGET_PAGE_SIZE;
        }
        off_begin += off_pitch;


@@ -712,45 +675,46 @@ static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
 
 static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
 {
 
 static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
 {

-    int sx, sy;
-    int dx, dy;
-    int width, height;
-    int depth;
+    int sx = 0, sy = 0;
+    int dx = 0, dy = 0;
+    int depth = 0;

     int notify = 0;
 
     int notify = 0;
 

-    depth = s->vga.get_bpp(&s->vga) / 8;
-    s->vga.get_resolution(&s->vga, &width, &height);
-
-    /* extra x, y */
-    sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
-    sy = (src / ABS(s->cirrus_blt_srcpitch));
-    dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
-    dy = (dst / ABS(s->cirrus_blt_dstpitch));
-
-    /* normalize width */
-    w /= depth;
-
-    /* if we're doing a backward copy, we have to adjust
-       our x/y to be the upper left corner (instead of the lower
-       right corner) */
-    if (s->cirrus_blt_dstpitch < 0) {
-       sx -= (s->cirrus_blt_width / depth) - 1;
-       dx -= (s->cirrus_blt_width / depth) - 1;
-       sy -= s->cirrus_blt_height - 1;
-       dy -= s->cirrus_blt_height - 1;
-    }
+    /* make sure to only copy if it's a plain copy ROP */
+    if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
+        *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {

 
 

-    /* are we in the visible portion of memory? */
-    if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
-       (sx + w) <= width && (sy + h) <= height &&
-       (dx + w) <= width && (dy + h) <= height) {
-       notify = 1;
-    }
+        int width, height;

 
 

-    /* make to sure only copy if it's a plain copy ROP */
-    if (*s->cirrus_rop != cirrus_bitblt_rop_fwd_src &&
-       *s->cirrus_rop != cirrus_bitblt_rop_bkwd_src)
-       notify = 0;
+        depth = s->vga.get_bpp(&s->vga) / 8;
+        s->vga.get_resolution(&s->vga, &width, &height);
+
+        /* extra x, y */
+        sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
+        sy = (src / ABS(s->cirrus_blt_srcpitch));
+        dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
+        dy = (dst / ABS(s->cirrus_blt_dstpitch));
+
+        /* normalize width */
+        w /= depth;
+
+        /* if we're doing a backward copy, we have to adjust
+           our x/y to be the upper left corner (instead of the lower
+           right corner) */
+        if (s->cirrus_blt_dstpitch < 0) {
+            sx -= (s->cirrus_blt_width / depth) - 1;
+            dx -= (s->cirrus_blt_width / depth) - 1;
+            sy -= s->cirrus_blt_height - 1;
+            dy -= s->cirrus_blt_height - 1;
+        }
+
+        /* are we in the visible portion of memory? */
+        if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
+            (sx + w) <= width && (sy + h) <= height &&
+            (dx + w) <= width && (dy + h) <= height) {
+            notify = 1;
+        }
+    }

 
     /* we have to flush all pending changes so that the copy
        is generated at the appropriate moment in time */
 
     /* we have to flush all pending changes so that the copy
        is generated at the appropriate moment in time */


@@ -1216,12 +1180,6 @@ static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
     }
 
     if (limit > 0) {
     }
 
     if (limit > 0) {

-        /* Thinking about changing bank base? First, drop the dirty bitmap information
-         * on the current location, otherwise we lose this pointer forever */
-        if (s->vga.lfb_vram_mapped) {
-            target_phys_addr_t base_addr = isa_mem_base + 0xa0000 + bank_index * 0x8000;
-            cpu_physical_sync_dirty_bitmap(base_addr, base_addr + 0x8000);
-        }

        s->cirrus_bank_base[bank_index] = offset;
        s->cirrus_bank_limit[bank_index] = limit;
     } else {
        s->cirrus_bank_base[bank_index] = offset;
        s->cirrus_bank_limit[bank_index] = limit;
     } else {


@@ -1419,33 +1377,37 @@ static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
  *
  ***************************************/
 
  *
  ***************************************/
 

-static int cirrus_hook_read_palette(CirrusVGAState * s, int *reg_value)
+static int cirrus_vga_read_palette(CirrusVGAState * s)

 {
 {

-    if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL))
-       return CIRRUS_HOOK_NOT_HANDLED;
-    *reg_value =
-        s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
-                                 s->vga.dac_sub_index];
+    int val;
+
+    if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
+        val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
+                                       s->vga.dac_sub_index];
+    } else {
+        val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
+    }

     if (++s->vga.dac_sub_index == 3) {
        s->vga.dac_sub_index = 0;
        s->vga.dac_read_index++;
     }
     if (++s->vga.dac_sub_index == 3) {
        s->vga.dac_sub_index = 0;
        s->vga.dac_read_index++;
     }

-    return CIRRUS_HOOK_HANDLED;
+    return val;

 }
 
 }
 

-static int cirrus_hook_write_palette(CirrusVGAState * s, int reg_value)
+static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)

 {
 {

-    if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL))
-       return CIRRUS_HOOK_NOT_HANDLED;

     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
     if (++s->vga.dac_sub_index == 3) {
     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
     if (++s->vga.dac_sub_index == 3) {

-        memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
-               s->vga.dac_cache, 3);
+        if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
+            memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
+                   s->vga.dac_cache, 3);
+        } else {
+            memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
+        }

         /* XXX update cursor */
        s->vga.dac_sub_index = 0;
        s->vga.dac_write_index++;
     }
         /* XXX update cursor */
        s->vga.dac_sub_index = 0;
        s->vga.dac_write_index++;
     }

-    return CIRRUS_HOOK_HANDLED;

 }
 
 /***************************************
 }
 
 /***************************************


@@ -1454,60 +1416,58 @@ static int cirrus_hook_write_palette(CirrusVGAState * s, int reg_value)
  *
  ***************************************/
 
  *
  ***************************************/
 

-static int
-cirrus_hook_read_gr(CirrusVGAState * s, unsigned reg_index, int *reg_value)
+static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)

 {
     switch (reg_index) {
     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
 {
     switch (reg_index) {
     case 0x00: // Standard VGA, BGCOLOR 0x000000ff

-      *reg_value = s->cirrus_shadow_gr0;
-      return CIRRUS_HOOK_HANDLED;
+        return s->cirrus_shadow_gr0;

     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
     case 0x01: // Standard VGA, FGCOLOR 0x000000ff

-      *reg_value = s->cirrus_shadow_gr1;
-      return CIRRUS_HOOK_HANDLED;
+        return s->cirrus_shadow_gr1;

     case 0x02:                 // Standard VGA
     case 0x03:                 // Standard VGA
     case 0x04:                 // Standard VGA
     case 0x06:                 // Standard VGA
     case 0x07:                 // Standard VGA
     case 0x08:                 // Standard VGA
     case 0x02:                 // Standard VGA
     case 0x03:                 // Standard VGA
     case 0x04:                 // Standard VGA
     case 0x06:                 // Standard VGA
     case 0x07:                 // Standard VGA
     case 0x08:                 // Standard VGA

-       return CIRRUS_HOOK_NOT_HANDLED;
+        return s->vga.gr[s->vga.gr_index];

     case 0x05:                 // Standard VGA, Cirrus extended mode
     default:
        break;
     }
 
     if (reg_index < 0x3a) {
     case 0x05:                 // Standard VGA, Cirrus extended mode
     default:
        break;
     }
 
     if (reg_index < 0x3a) {

-       *reg_value = s->vga.gr[reg_index];
+       return s->vga.gr[reg_index];

     } else {
 #ifdef DEBUG_CIRRUS
        printf("cirrus: inport gr_index %02x\n", reg_index);
 #endif
     } else {
 #ifdef DEBUG_CIRRUS
        printf("cirrus: inport gr_index %02x\n", reg_index);
 #endif

-       *reg_value = 0xff;
+       return 0xff;

     }
     }

-
-    return CIRRUS_HOOK_HANDLED;

 }
 
 }
 

-static int
-cirrus_hook_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
+static void
+cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)

 {
 #if defined(DEBUG_BITBLT) && 0
     printf("gr%02x: %02x\n", reg_index, reg_value);
 #endif
     switch (reg_index) {
     case 0x00:                 // Standard VGA, BGCOLOR 0x000000ff
 {
 #if defined(DEBUG_BITBLT) && 0
     printf("gr%02x: %02x\n", reg_index, reg_value);
 #endif
     switch (reg_index) {
     case 0x00:                 // Standard VGA, BGCOLOR 0x000000ff

+       s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];

        s->cirrus_shadow_gr0 = reg_value;
        s->cirrus_shadow_gr0 = reg_value;

-       return CIRRUS_HOOK_NOT_HANDLED;
+       break;

     case 0x01:                 // Standard VGA, FGCOLOR 0x000000ff
     case 0x01:                 // Standard VGA, FGCOLOR 0x000000ff

+       s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];

        s->cirrus_shadow_gr1 = reg_value;
        s->cirrus_shadow_gr1 = reg_value;

-       return CIRRUS_HOOK_NOT_HANDLED;
+       break;

     case 0x02:                 // Standard VGA
     case 0x03:                 // Standard VGA
     case 0x04:                 // Standard VGA
     case 0x06:                 // Standard VGA
     case 0x07:                 // Standard VGA
     case 0x08:                 // Standard VGA
     case 0x02:                 // Standard VGA
     case 0x03:                 // Standard VGA
     case 0x04:                 // Standard VGA
     case 0x06:                 // Standard VGA
     case 0x07:                 // Standard VGA
     case 0x08:                 // Standard VGA

-       return CIRRUS_HOOK_NOT_HANDLED;
+       s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
+        break;

     case 0x05:                 // Standard VGA, Cirrus extended mode
        s->vga.gr[reg_index] = reg_value & 0x7f;
         cirrus_update_memory_access(s);
     case 0x05:                 // Standard VGA, Cirrus extended mode
        s->vga.gr[reg_index] = reg_value & 0x7f;
         cirrus_update_memory_access(s);


@@ -1575,8 +1535,6 @@ cirrus_hook_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
 #endif
        break;
     }
 #endif
        break;
     }

-
-    return CIRRUS_HOOK_HANDLED;

 }
 
 /***************************************
 }
 
 /***************************************


@@ -1585,8 +1543,7 @@ cirrus_hook_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
  *
  ***************************************/
 
  *
  ***************************************/
 

-static int
-cirrus_hook_read_cr(CirrusVGAState * s, unsigned reg_index, int *reg_value)
+static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)

 {
     switch (reg_index) {
     case 0x00:                 // Standard VGA
 {
     switch (reg_index) {
     case 0x00:                 // Standard VGA


@@ -1614,10 +1571,9 @@ cirrus_hook_read_cr(CirrusVGAState * s, unsigned reg_index, int *reg_value)
     case 0x16:                 // Standard VGA
     case 0x17:                 // Standard VGA
     case 0x18:                 // Standard VGA
     case 0x16:                 // Standard VGA
     case 0x17:                 // Standard VGA
     case 0x18:                 // Standard VGA

-       return CIRRUS_HOOK_NOT_HANDLED;
+       return s->vga.cr[s->vga.cr_index];

     case 0x24:                 // Attribute Controller Toggle Readback (R)
     case 0x24:                 // Attribute Controller Toggle Readback (R)

-        *reg_value = (s->vga.ar_flip_flop << 7);
-        break;
+        return (s->vga.ar_flip_flop << 7);

     case 0x19:                 // Interlace End
     case 0x1a:                 // Miscellaneous Control
     case 0x1b:                 // Extended Display Control
     case 0x19:                 // Interlace End
     case 0x1a:                 // Miscellaneous Control
     case 0x1b:                 // Extended Display Control


@@ -1626,26 +1582,21 @@ cirrus_hook_read_cr(CirrusVGAState * s, unsigned reg_index, int *reg_value)
     case 0x22:                 // Graphics Data Latches Readback (R)
     case 0x25:                 // Part Status
     case 0x27:                 // Part ID (R)
     case 0x22:                 // Graphics Data Latches Readback (R)
     case 0x25:                 // Part Status
     case 0x27:                 // Part ID (R)

-       *reg_value = s->vga.cr[reg_index];
-       break;
+       return s->vga.cr[s->vga.cr_index];

     case 0x26:                 // Attribute Controller Index Readback (R)
     case 0x26:                 // Attribute Controller Index Readback (R)

-       *reg_value = s->vga.ar_index & 0x3f;
+       return s->vga.ar_index & 0x3f;

        break;
     default:
 #ifdef DEBUG_CIRRUS
        printf("cirrus: inport cr_index %02x\n", reg_index);
        break;
     default:
 #ifdef DEBUG_CIRRUS
        printf("cirrus: inport cr_index %02x\n", reg_index);

-       *reg_value = 0xff;

 #endif
 #endif

-       break;
+       return 0xff;

     }
     }

-
-    return CIRRUS_HOOK_HANDLED;

 }
 
 }
 

-static int
-cirrus_hook_write_cr(CirrusVGAState * s, unsigned reg_index, int reg_value)
+static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)

 {
 {

-    switch (reg_index) {
+    switch (s->vga.cr_index) {

     case 0x00:                 // Standard VGA
     case 0x01:                 // Standard VGA
     case 0x02:                 // Standard VGA
     case 0x00:                 // Standard VGA
     case 0x01:                 // Standard VGA
     case 0x02:                 // Standard VGA


@@ -1671,16 +1622,35 @@ cirrus_hook_write_cr(CirrusVGAState * s, unsigned reg_index, int reg_value)
     case 0x16:                 // Standard VGA
     case 0x17:                 // Standard VGA
     case 0x18:                 // Standard VGA
     case 0x16:                 // Standard VGA
     case 0x17:                 // Standard VGA
     case 0x18:                 // Standard VGA

-       return CIRRUS_HOOK_NOT_HANDLED;
+       /* handle CR0-7 protection */
+       if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
+           /* can always write bit 4 of CR7 */
+           if (s->vga.cr_index == 7)
+               s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
+           return;
+       }
+       s->vga.cr[s->vga.cr_index] = reg_value;
+       switch(s->vga.cr_index) {
+       case 0x00:
+       case 0x04:
+       case 0x05:
+       case 0x06:
+       case 0x07:
+       case 0x11:
+       case 0x17:
+           s->vga.update_retrace_info(&s->vga);
+           break;
+       }
+        break;

     case 0x19:                 // Interlace End
     case 0x1a:                 // Miscellaneous Control
     case 0x1b:                 // Extended Display Control
     case 0x1c:                 // Sync Adjust and Genlock
     case 0x1d:                 // Overlay Extended Control
     case 0x19:                 // Interlace End
     case 0x1a:                 // Miscellaneous Control
     case 0x1b:                 // Extended Display Control
     case 0x1c:                 // Sync Adjust and Genlock
     case 0x1d:                 // Overlay Extended Control

-       s->vga.cr[reg_index] = reg_value;
+       s->vga.cr[s->vga.cr_index] = reg_value;

 #ifdef DEBUG_CIRRUS
        printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
 #ifdef DEBUG_CIRRUS
        printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",

-              reg_index, reg_value);
+              s->vga.cr_index, reg_value);

 #endif
        break;
     case 0x22:                 // Graphics Data Latches Readback (R)
 #endif
        break;
     case 0x22:                 // Graphics Data Latches Readback (R)


@@ -1691,13 +1661,11 @@ cirrus_hook_write_cr(CirrusVGAState * s, unsigned reg_index, int reg_value)
     case 0x25:                 // Part Status
     default:
 #ifdef DEBUG_CIRRUS
     case 0x25:                 // Part Status
     default:
 #ifdef DEBUG_CIRRUS

-       printf("cirrus: outport cr_index %02x, cr_value %02x\n", reg_index,
-              reg_value);
+       printf("cirrus: outport cr_index %02x, cr_value %02x\n",
+               s->vga.cr_index, reg_value);

 #endif
        break;
     }
 #endif
        break;
     }

-
-    return CIRRUS_HOOK_HANDLED;

 }
 
 /***************************************
 }
 
 /***************************************


@@ -1712,97 +1680,97 @@ static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
 
     switch (address) {
     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
 
     switch (address) {
     case (CIRRUS_MMIO_BLTBGCOLOR + 0):

-       cirrus_hook_read_gr(s, 0x00, &value);
+       value = cirrus_vga_read_gr(s, 0x00);

        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 1):

-       cirrus_hook_read_gr(s, 0x10, &value);
+       value = cirrus_vga_read_gr(s, 0x10);

        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 2):

-       cirrus_hook_read_gr(s, 0x12, &value);
+       value = cirrus_vga_read_gr(s, 0x12);

        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 3):

-       cirrus_hook_read_gr(s, 0x14, &value);
+       value = cirrus_vga_read_gr(s, 0x14);

        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 0):

-       cirrus_hook_read_gr(s, 0x01, &value);
+       value = cirrus_vga_read_gr(s, 0x01);

        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 1):

-       cirrus_hook_read_gr(s, 0x11, &value);
+       value = cirrus_vga_read_gr(s, 0x11);

        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 2):

-       cirrus_hook_read_gr(s, 0x13, &value);
+       value = cirrus_vga_read_gr(s, 0x13);

        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 3):

-       cirrus_hook_read_gr(s, 0x15, &value);
+       value = cirrus_vga_read_gr(s, 0x15);

        break;
     case (CIRRUS_MMIO_BLTWIDTH + 0):
        break;
     case (CIRRUS_MMIO_BLTWIDTH + 0):

-       cirrus_hook_read_gr(s, 0x20, &value);
+       value = cirrus_vga_read_gr(s, 0x20);

        break;
     case (CIRRUS_MMIO_BLTWIDTH + 1):
        break;
     case (CIRRUS_MMIO_BLTWIDTH + 1):

-       cirrus_hook_read_gr(s, 0x21, &value);
+       value = cirrus_vga_read_gr(s, 0x21);

        break;
     case (CIRRUS_MMIO_BLTHEIGHT + 0):
        break;
     case (CIRRUS_MMIO_BLTHEIGHT + 0):

-       cirrus_hook_read_gr(s, 0x22, &value);
+       value = cirrus_vga_read_gr(s, 0x22);

        break;
     case (CIRRUS_MMIO_BLTHEIGHT + 1):
        break;
     case (CIRRUS_MMIO_BLTHEIGHT + 1):

-       cirrus_hook_read_gr(s, 0x23, &value);
+       value = cirrus_vga_read_gr(s, 0x23);

        break;
     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
        break;
     case (CIRRUS_MMIO_BLTDESTPITCH + 0):

-       cirrus_hook_read_gr(s, 0x24, &value);
+       value = cirrus_vga_read_gr(s, 0x24);

        break;
     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
        break;
     case (CIRRUS_MMIO_BLTDESTPITCH + 1):

-       cirrus_hook_read_gr(s, 0x25, &value);
+       value = cirrus_vga_read_gr(s, 0x25);

        break;
     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
        break;
     case (CIRRUS_MMIO_BLTSRCPITCH + 0):

-       cirrus_hook_read_gr(s, 0x26, &value);
+       value = cirrus_vga_read_gr(s, 0x26);

        break;
     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
        break;
     case (CIRRUS_MMIO_BLTSRCPITCH + 1):

-       cirrus_hook_read_gr(s, 0x27, &value);
+       value = cirrus_vga_read_gr(s, 0x27);

        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 0):
        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 0):

-       cirrus_hook_read_gr(s, 0x28, &value);
+       value = cirrus_vga_read_gr(s, 0x28);

        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 1):
        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 1):

-       cirrus_hook_read_gr(s, 0x29, &value);
+       value = cirrus_vga_read_gr(s, 0x29);

        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 2):
        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 2):

-       cirrus_hook_read_gr(s, 0x2a, &value);
+       value = cirrus_vga_read_gr(s, 0x2a);

        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 0):
        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 0):

-       cirrus_hook_read_gr(s, 0x2c, &value);
+       value = cirrus_vga_read_gr(s, 0x2c);

        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 1):
        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 1):

-       cirrus_hook_read_gr(s, 0x2d, &value);
+       value = cirrus_vga_read_gr(s, 0x2d);

        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 2):
        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 2):

-       cirrus_hook_read_gr(s, 0x2e, &value);
+       value = cirrus_vga_read_gr(s, 0x2e);

        break;
     case CIRRUS_MMIO_BLTWRITEMASK:
        break;
     case CIRRUS_MMIO_BLTWRITEMASK:

-       cirrus_hook_read_gr(s, 0x2f, &value);
+       value = cirrus_vga_read_gr(s, 0x2f);

        break;
     case CIRRUS_MMIO_BLTMODE:
        break;
     case CIRRUS_MMIO_BLTMODE:

-       cirrus_hook_read_gr(s, 0x30, &value);
+       value = cirrus_vga_read_gr(s, 0x30);

        break;
     case CIRRUS_MMIO_BLTROP:
        break;
     case CIRRUS_MMIO_BLTROP:

-       cirrus_hook_read_gr(s, 0x32, &value);
+       value = cirrus_vga_read_gr(s, 0x32);

        break;
     case CIRRUS_MMIO_BLTMODEEXT:
        break;
     case CIRRUS_MMIO_BLTMODEEXT:

-       cirrus_hook_read_gr(s, 0x33, &value);
+       value = cirrus_vga_read_gr(s, 0x33);

        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):

-       cirrus_hook_read_gr(s, 0x34, &value);
+       value = cirrus_vga_read_gr(s, 0x34);

        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):

-       cirrus_hook_read_gr(s, 0x35, &value);
+       value = cirrus_vga_read_gr(s, 0x35);

        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):

-       cirrus_hook_read_gr(s, 0x38, &value);
+       value = cirrus_vga_read_gr(s, 0x38);

        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):

-       cirrus_hook_read_gr(s, 0x39, &value);
+       value = cirrus_vga_read_gr(s, 0x39);

        break;
     case CIRRUS_MMIO_BLTSTATUS:
        break;
     case CIRRUS_MMIO_BLTSTATUS:

-       cirrus_hook_read_gr(s, 0x31, &value);
+       value = cirrus_vga_read_gr(s, 0x31);

        break;
     default:
 #ifdef DEBUG_CIRRUS
        break;
     default:
 #ifdef DEBUG_CIRRUS


@@ -1819,100 +1787,100 @@ static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
 {
     switch (address) {
     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
 {
     switch (address) {
     case (CIRRUS_MMIO_BLTBGCOLOR + 0):

-       cirrus_hook_write_gr(s, 0x00, value);
+       cirrus_vga_write_gr(s, 0x00, value);

        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 1):

-       cirrus_hook_write_gr(s, 0x10, value);
+       cirrus_vga_write_gr(s, 0x10, value);

        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 2):

-       cirrus_hook_write_gr(s, 0x12, value);
+       cirrus_vga_write_gr(s, 0x12, value);

        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
        break;
     case (CIRRUS_MMIO_BLTBGCOLOR + 3):

-       cirrus_hook_write_gr(s, 0x14, value);
+       cirrus_vga_write_gr(s, 0x14, value);

        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 0):

-       cirrus_hook_write_gr(s, 0x01, value);
+       cirrus_vga_write_gr(s, 0x01, value);

        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 1):

-       cirrus_hook_write_gr(s, 0x11, value);
+       cirrus_vga_write_gr(s, 0x11, value);

        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 2):

-       cirrus_hook_write_gr(s, 0x13, value);
+       cirrus_vga_write_gr(s, 0x13, value);

        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
        break;
     case (CIRRUS_MMIO_BLTFGCOLOR + 3):

-       cirrus_hook_write_gr(s, 0x15, value);
+       cirrus_vga_write_gr(s, 0x15, value);

        break;
     case (CIRRUS_MMIO_BLTWIDTH + 0):
        break;
     case (CIRRUS_MMIO_BLTWIDTH + 0):

-       cirrus_hook_write_gr(s, 0x20, value);
+       cirrus_vga_write_gr(s, 0x20, value);

        break;
     case (CIRRUS_MMIO_BLTWIDTH + 1):
        break;
     case (CIRRUS_MMIO_BLTWIDTH + 1):

-       cirrus_hook_write_gr(s, 0x21, value);
+       cirrus_vga_write_gr(s, 0x21, value);

        break;
     case (CIRRUS_MMIO_BLTHEIGHT + 0):
        break;
     case (CIRRUS_MMIO_BLTHEIGHT + 0):

-       cirrus_hook_write_gr(s, 0x22, value);
+       cirrus_vga_write_gr(s, 0x22, value);

        break;
     case (CIRRUS_MMIO_BLTHEIGHT + 1):
        break;
     case (CIRRUS_MMIO_BLTHEIGHT + 1):

-       cirrus_hook_write_gr(s, 0x23, value);
+       cirrus_vga_write_gr(s, 0x23, value);

        break;
     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
        break;
     case (CIRRUS_MMIO_BLTDESTPITCH + 0):

-       cirrus_hook_write_gr(s, 0x24, value);
+       cirrus_vga_write_gr(s, 0x24, value);

        break;
     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
        break;
     case (CIRRUS_MMIO_BLTDESTPITCH + 1):

-       cirrus_hook_write_gr(s, 0x25, value);
+       cirrus_vga_write_gr(s, 0x25, value);

        break;
     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
        break;
     case (CIRRUS_MMIO_BLTSRCPITCH + 0):

-       cirrus_hook_write_gr(s, 0x26, value);
+       cirrus_vga_write_gr(s, 0x26, value);

        break;
     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
        break;
     case (CIRRUS_MMIO_BLTSRCPITCH + 1):

-       cirrus_hook_write_gr(s, 0x27, value);
+       cirrus_vga_write_gr(s, 0x27, value);

        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 0):
        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 0):

-       cirrus_hook_write_gr(s, 0x28, value);
+       cirrus_vga_write_gr(s, 0x28, value);

        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 1):
        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 1):

-       cirrus_hook_write_gr(s, 0x29, value);
+       cirrus_vga_write_gr(s, 0x29, value);

        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 2):
        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 2):

-       cirrus_hook_write_gr(s, 0x2a, value);
+       cirrus_vga_write_gr(s, 0x2a, value);

        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 3):
        /* ignored */
        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 0):
        break;
     case (CIRRUS_MMIO_BLTDESTADDR + 3):
        /* ignored */
        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 0):

-       cirrus_hook_write_gr(s, 0x2c, value);
+       cirrus_vga_write_gr(s, 0x2c, value);

        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 1):
        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 1):

-       cirrus_hook_write_gr(s, 0x2d, value);
+       cirrus_vga_write_gr(s, 0x2d, value);

        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 2):
        break;
     case (CIRRUS_MMIO_BLTSRCADDR + 2):

-       cirrus_hook_write_gr(s, 0x2e, value);
+       cirrus_vga_write_gr(s, 0x2e, value);

        break;
     case CIRRUS_MMIO_BLTWRITEMASK:
        break;
     case CIRRUS_MMIO_BLTWRITEMASK:

-       cirrus_hook_write_gr(s, 0x2f, value);
+       cirrus_vga_write_gr(s, 0x2f, value);

        break;
     case CIRRUS_MMIO_BLTMODE:
        break;
     case CIRRUS_MMIO_BLTMODE:

-       cirrus_hook_write_gr(s, 0x30, value);
+       cirrus_vga_write_gr(s, 0x30, value);

        break;
     case CIRRUS_MMIO_BLTROP:
        break;
     case CIRRUS_MMIO_BLTROP:

-       cirrus_hook_write_gr(s, 0x32, value);
+       cirrus_vga_write_gr(s, 0x32, value);

        break;
     case CIRRUS_MMIO_BLTMODEEXT:
        break;
     case CIRRUS_MMIO_BLTMODEEXT:

-       cirrus_hook_write_gr(s, 0x33, value);
+       cirrus_vga_write_gr(s, 0x33, value);

        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):

-       cirrus_hook_write_gr(s, 0x34, value);
+       cirrus_vga_write_gr(s, 0x34, value);

        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):

-       cirrus_hook_write_gr(s, 0x35, value);
+       cirrus_vga_write_gr(s, 0x35, value);

        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):

-       cirrus_hook_write_gr(s, 0x38, value);
+       cirrus_vga_write_gr(s, 0x38, value);

        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
        break;
     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):

-       cirrus_hook_write_gr(s, 0x39, value);
+       cirrus_vga_write_gr(s, 0x39, value);

        break;
     case CIRRUS_MMIO_BLTSTATUS:
        break;
     case CIRRUS_MMIO_BLTSTATUS:

-       cirrus_hook_write_gr(s, 0x31, value);
+       cirrus_vga_write_gr(s, 0x31, value);

        break;
     default:
 #ifdef DEBUG_CIRRUS
        break;
     default:
 #ifdef DEBUG_CIRRUS


@@ -1950,8 +1918,8 @@ static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
        val <<= 1;
        dst++;
     }
        val <<= 1;
        dst++;
     }

-    cpu_physical_memory_set_dirty(s->vga.vram_offset + offset);
-    cpu_physical_memory_set_dirty(s->vga.vram_offset + offset + 7);
+    memory_region_set_dirty(&s->vga.vram, offset);
+    memory_region_set_dirty(&s->vga.vram, offset + 7);

 }
 
 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
 }
 
 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,


@@ -1975,8 +1943,8 @@ static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
        val <<= 1;
        dst += 2;
     }
        val <<= 1;
        dst += 2;
     }

-    cpu_physical_memory_set_dirty(s->vga.vram_offset + offset);
-    cpu_physical_memory_set_dirty(s->vga.vram_offset + offset + 15);
+    memory_region_set_dirty(&s->vga.vram, offset);
+    memory_region_set_dirty(&s->vga.vram, offset + 15);

 }
 
 /***************************************
 }
 
 /***************************************


@@ -1985,7 +1953,9 @@ static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
  *
  ***************************************/
 
  *
  ***************************************/
 

-static uint32_t cirrus_vga_mem_readb(void *opaque, target_phys_addr_t addr)
+static uint64_t cirrus_vga_mem_read(void *opaque,
+                                    target_phys_addr_t addr,
+                                    uint32_t size)

 {
     CirrusVGAState *s = opaque;
     unsigned bank_index;
 {
     CirrusVGAState *s = opaque;
     unsigned bank_index;


@@ -1993,11 +1963,9 @@ static uint32_t cirrus_vga_mem_readb(void *opaque, target_phys_addr_t addr)
     uint32_t val;
 
     if ((s->vga.sr[0x07] & 0x01) == 0) {
     uint32_t val;
 
     if ((s->vga.sr[0x07] & 0x01) == 0) {

-       return vga_mem_readb(s, addr);
+        return vga_mem_readb(&s->vga, addr);

     }
 
     }
 

-    addr &= 0x1ffff;
-

     if (addr < 0x10000) {
        /* XXX handle bitblt */
        /* video memory */
     if (addr < 0x10000) {
        /* XXX handle bitblt */
        /* video memory */


@@ -2029,38 +1997,10 @@ static uint32_t cirrus_vga_mem_readb(void *opaque, target_phys_addr_t addr)
     return val;
 }
 
     return val;
 }
 

-static uint32_t cirrus_vga_mem_readw(void *opaque, target_phys_addr_t addr)
-{
-    uint32_t v;
-#ifdef TARGET_WORDS_BIGENDIAN
-    v = cirrus_vga_mem_readb(opaque, addr) << 8;
-    v |= cirrus_vga_mem_readb(opaque, addr + 1);
-#else
-    v = cirrus_vga_mem_readb(opaque, addr);
-    v |= cirrus_vga_mem_readb(opaque, addr + 1) << 8;
-#endif
-    return v;
-}
-
-static uint32_t cirrus_vga_mem_readl(void *opaque, target_phys_addr_t addr)
-{
-    uint32_t v;
-#ifdef TARGET_WORDS_BIGENDIAN
-    v = cirrus_vga_mem_readb(opaque, addr) << 24;
-    v |= cirrus_vga_mem_readb(opaque, addr + 1) << 16;
-    v |= cirrus_vga_mem_readb(opaque, addr + 2) << 8;
-    v |= cirrus_vga_mem_readb(opaque, addr + 3);
-#else
-    v = cirrus_vga_mem_readb(opaque, addr);
-    v |= cirrus_vga_mem_readb(opaque, addr + 1) << 8;
-    v |= cirrus_vga_mem_readb(opaque, addr + 2) << 16;
-    v |= cirrus_vga_mem_readb(opaque, addr + 3) << 24;
-#endif
-    return v;
-}
-
-static void cirrus_vga_mem_writeb(void *opaque, target_phys_addr_t addr,
-                                  uint32_t mem_value)
+static void cirrus_vga_mem_write(void *opaque,
+                                 target_phys_addr_t addr,
+                                 uint64_t mem_value,
+                                 uint32_t size)

 {
     CirrusVGAState *s = opaque;
     unsigned bank_index;
 {
     CirrusVGAState *s = opaque;
     unsigned bank_index;


@@ -2068,12 +2008,10 @@ static void cirrus_vga_mem_writeb(void *opaque, target_phys_addr_t addr,
     unsigned mode;
 
     if ((s->vga.sr[0x07] & 0x01) == 0) {
     unsigned mode;
 
     if ((s->vga.sr[0x07] & 0x01) == 0) {

-       vga_mem_writeb(s, addr, mem_value);
+        vga_mem_writeb(&s->vga, addr, mem_value);

         return;
     }
 
         return;
     }
 

-    addr &= 0x1ffff;
-

     if (addr < 0x10000) {
        if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
            /* bitblt */
     if (addr < 0x10000) {
        if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
            /* bitblt */


@@ -2096,8 +2034,7 @@ static void cirrus_vga_mem_writeb(void *opaque, target_phys_addr_t addr,
                mode = s->vga.gr[0x05] & 0x7;
                if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
                    *(s->vga.vram_ptr + bank_offset) = mem_value;
                mode = s->vga.gr[0x05] & 0x7;
                if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
                    *(s->vga.vram_ptr + bank_offset) = mem_value;

-                   cpu_physical_memory_set_dirty(s->vga.vram_offset +
-                                                 bank_offset);
+                   memory_region_set_dirty(&s->vga.vram, bank_offset);

                } else {
                    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
                        cirrus_mem_writeb_mode4and5_8bpp(s, mode,
                } else {
                    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
                        cirrus_mem_writeb_mode4and5_8bpp(s, mode,


@@ -2124,42 +2061,14 @@ static void cirrus_vga_mem_writeb(void *opaque, target_phys_addr_t addr,
     }
 }
 
     }
 }
 

-static void cirrus_vga_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-#ifdef TARGET_WORDS_BIGENDIAN
-    cirrus_vga_mem_writeb(opaque, addr, (val >> 8) & 0xff);
-    cirrus_vga_mem_writeb(opaque, addr + 1, val & 0xff);
-#else
-    cirrus_vga_mem_writeb(opaque, addr, val & 0xff);
-    cirrus_vga_mem_writeb(opaque, addr + 1, (val >> 8) & 0xff);
-#endif
-}
-
-static void cirrus_vga_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-#ifdef TARGET_WORDS_BIGENDIAN
-    cirrus_vga_mem_writeb(opaque, addr, (val >> 24) & 0xff);
-    cirrus_vga_mem_writeb(opaque, addr + 1, (val >> 16) & 0xff);
-    cirrus_vga_mem_writeb(opaque, addr + 2, (val >> 8) & 0xff);
-    cirrus_vga_mem_writeb(opaque, addr + 3, val & 0xff);
-#else
-    cirrus_vga_mem_writeb(opaque, addr, val & 0xff);
-    cirrus_vga_mem_writeb(opaque, addr + 1, (val >> 8) & 0xff);
-    cirrus_vga_mem_writeb(opaque, addr + 2, (val >> 16) & 0xff);
-    cirrus_vga_mem_writeb(opaque, addr + 3, (val >> 24) & 0xff);
-#endif
-}
-
-static CPUReadMemoryFunc * const cirrus_vga_mem_read[3] = {
-    cirrus_vga_mem_readb,
-    cirrus_vga_mem_readw,
-    cirrus_vga_mem_readl,
-};
-
-static CPUWriteMemoryFunc * const cirrus_vga_mem_write[3] = {
-    cirrus_vga_mem_writeb,
-    cirrus_vga_mem_writew,
-    cirrus_vga_mem_writel,
+static const MemoryRegionOps cirrus_vga_mem_ops = {
+    .read = cirrus_vga_mem_read,
+    .write = cirrus_vga_mem_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },

 };
 
 /***************************************
 };
 
 /***************************************


@@ -2338,7 +2247,8 @@ static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
  *
  ***************************************/
 
  *
  ***************************************/
 

-static uint32_t cirrus_linear_readb(void *opaque, target_phys_addr_t addr)
+static uint64_t cirrus_linear_read(void *opaque, target_phys_addr_t addr,
+                                   unsigned size)

 {
     CirrusVGAState *s = opaque;
     uint32_t ret;
 {
     CirrusVGAState *s = opaque;
     uint32_t ret;


@@ -2366,38 +2276,8 @@ static uint32_t cirrus_linear_readb(void *opaque, target_phys_addr_t addr)
     return ret;
 }
 
     return ret;
 }
 

-static uint32_t cirrus_linear_readw(void *opaque, target_phys_addr_t addr)
-{
-    uint32_t v;
-#ifdef TARGET_WORDS_BIGENDIAN
-    v = cirrus_linear_readb(opaque, addr) << 8;
-    v |= cirrus_linear_readb(opaque, addr + 1);
-#else
-    v = cirrus_linear_readb(opaque, addr);
-    v |= cirrus_linear_readb(opaque, addr + 1) << 8;
-#endif
-    return v;
-}
-
-static uint32_t cirrus_linear_readl(void *opaque, target_phys_addr_t addr)
-{
-    uint32_t v;
-#ifdef TARGET_WORDS_BIGENDIAN
-    v = cirrus_linear_readb(opaque, addr) << 24;
-    v |= cirrus_linear_readb(opaque, addr + 1) << 16;
-    v |= cirrus_linear_readb(opaque, addr + 2) << 8;
-    v |= cirrus_linear_readb(opaque, addr + 3);
-#else
-    v = cirrus_linear_readb(opaque, addr);
-    v |= cirrus_linear_readb(opaque, addr + 1) << 8;
-    v |= cirrus_linear_readb(opaque, addr + 2) << 16;
-    v |= cirrus_linear_readb(opaque, addr + 3) << 24;
-#endif
-    return v;
-}
-
-static void cirrus_linear_writeb(void *opaque, target_phys_addr_t addr,
-                                uint32_t val)
+static void cirrus_linear_write(void *opaque, target_phys_addr_t addr,
+                                uint64_t val, unsigned size)

 {
     CirrusVGAState *s = opaque;
     unsigned mode;
 {
     CirrusVGAState *s = opaque;
     unsigned mode;


@@ -2426,7 +2306,7 @@ static void cirrus_linear_writeb(void *opaque, target_phys_addr_t addr,
        mode = s->vga.gr[0x05] & 0x7;
        if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
            *(s->vga.vram_ptr + addr) = (uint8_t) val;
        mode = s->vga.gr[0x05] & 0x7;
        if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
            *(s->vga.vram_ptr + addr) = (uint8_t) val;

-           cpu_physical_memory_set_dirty(s->vga.vram_offset + addr);
+           memory_region_set_dirty(&s->vga.vram, addr);

        } else {
            if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
                cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
        } else {
            if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
                cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);


@@ -2437,47 +2317,6 @@ static void cirrus_linear_writeb(void *opaque, target_phys_addr_t addr,
     }
 }
 
     }
 }
 

-static void cirrus_linear_writew(void *opaque, target_phys_addr_t addr,
-                                uint32_t val)
-{
-#ifdef TARGET_WORDS_BIGENDIAN
-    cirrus_linear_writeb(opaque, addr, (val >> 8) & 0xff);
-    cirrus_linear_writeb(opaque, addr + 1, val & 0xff);
-#else
-    cirrus_linear_writeb(opaque, addr, val & 0xff);
-    cirrus_linear_writeb(opaque, addr + 1, (val >> 8) & 0xff);
-#endif
-}
-
-static void cirrus_linear_writel(void *opaque, target_phys_addr_t addr,
-                                uint32_t val)
-{
-#ifdef TARGET_WORDS_BIGENDIAN
-    cirrus_linear_writeb(opaque, addr, (val >> 24) & 0xff);
-    cirrus_linear_writeb(opaque, addr + 1, (val >> 16) & 0xff);
-    cirrus_linear_writeb(opaque, addr + 2, (val >> 8) & 0xff);
-    cirrus_linear_writeb(opaque, addr + 3, val & 0xff);
-#else
-    cirrus_linear_writeb(opaque, addr, val & 0xff);
-    cirrus_linear_writeb(opaque, addr + 1, (val >> 8) & 0xff);
-    cirrus_linear_writeb(opaque, addr + 2, (val >> 16) & 0xff);
-    cirrus_linear_writeb(opaque, addr + 3, (val >> 24) & 0xff);
-#endif
-}
-
-
-static CPUReadMemoryFunc * const cirrus_linear_read[3] = {
-    cirrus_linear_readb,
-    cirrus_linear_readw,
-    cirrus_linear_readl,
-};
-
-static CPUWriteMemoryFunc * const cirrus_linear_write[3] = {
-    cirrus_linear_writeb,
-    cirrus_linear_writew,
-    cirrus_linear_writel,
-};
-

 /***************************************
  *
  *  system to screen memory access
 /***************************************
  *
  *  system to screen memory access


@@ -2485,47 +2324,23 @@ static CPUWriteMemoryFunc * const cirrus_linear_write[3] = {
  ***************************************/
 
 
  ***************************************/
 
 

-static uint32_t cirrus_linear_bitblt_readb(void *opaque, target_phys_addr_t addr)
+static uint64_t cirrus_linear_bitblt_read(void *opaque,
+                                          target_phys_addr_t addr,
+                                          unsigned size)

 {
 {

+    CirrusVGAState *s = opaque;

     uint32_t ret;
 
     /* XXX handle bitblt */
     uint32_t ret;
 
     /* XXX handle bitblt */

+    (void)s;

     ret = 0xff;
     return ret;
 }
 
     ret = 0xff;
     return ret;
 }
 

-static uint32_t cirrus_linear_bitblt_readw(void *opaque, target_phys_addr_t addr)
-{
-    uint32_t v;
-#ifdef TARGET_WORDS_BIGENDIAN
-    v = cirrus_linear_bitblt_readb(opaque, addr) << 8;
-    v |= cirrus_linear_bitblt_readb(opaque, addr + 1);
-#else
-    v = cirrus_linear_bitblt_readb(opaque, addr);
-    v |= cirrus_linear_bitblt_readb(opaque, addr + 1) << 8;
-#endif
-    return v;
-}
-
-static uint32_t cirrus_linear_bitblt_readl(void *opaque, target_phys_addr_t addr)
-{
-    uint32_t v;
-#ifdef TARGET_WORDS_BIGENDIAN
-    v = cirrus_linear_bitblt_readb(opaque, addr) << 24;
-    v |= cirrus_linear_bitblt_readb(opaque, addr + 1) << 16;
-    v |= cirrus_linear_bitblt_readb(opaque, addr + 2) << 8;
-    v |= cirrus_linear_bitblt_readb(opaque, addr + 3);
-#else
-    v = cirrus_linear_bitblt_readb(opaque, addr);
-    v |= cirrus_linear_bitblt_readb(opaque, addr + 1) << 8;
-    v |= cirrus_linear_bitblt_readb(opaque, addr + 2) << 16;
-    v |= cirrus_linear_bitblt_readb(opaque, addr + 3) << 24;
-#endif
-    return v;
-}
-
-static void cirrus_linear_bitblt_writeb(void *opaque, target_phys_addr_t addr,
-                                uint32_t val)
+static void cirrus_linear_bitblt_write(void *opaque,
+                                       target_phys_addr_t addr,
+                                       uint64_t val,
+                                       unsigned size)

 {
     CirrusVGAState *s = opaque;
 
 {
     CirrusVGAState *s = opaque;
 


@@ -2538,87 +2353,70 @@ static void cirrus_linear_bitblt_writeb(void *opaque, target_phys_addr_t addr,
     }
 }
 
     }
 }
 

-static void cirrus_linear_bitblt_writew(void *opaque, target_phys_addr_t addr,
-                                uint32_t val)
-{
-#ifdef TARGET_WORDS_BIGENDIAN
-    cirrus_linear_bitblt_writeb(opaque, addr, (val >> 8) & 0xff);
-    cirrus_linear_bitblt_writeb(opaque, addr + 1, val & 0xff);
-#else
-    cirrus_linear_bitblt_writeb(opaque, addr, val & 0xff);
-    cirrus_linear_bitblt_writeb(opaque, addr + 1, (val >> 8) & 0xff);
-#endif
-}
-
-static void cirrus_linear_bitblt_writel(void *opaque, target_phys_addr_t addr,
-                                uint32_t val)
-{
-#ifdef TARGET_WORDS_BIGENDIAN
-    cirrus_linear_bitblt_writeb(opaque, addr, (val >> 24) & 0xff);
-    cirrus_linear_bitblt_writeb(opaque, addr + 1, (val >> 16) & 0xff);
-    cirrus_linear_bitblt_writeb(opaque, addr + 2, (val >> 8) & 0xff);
-    cirrus_linear_bitblt_writeb(opaque, addr + 3, val & 0xff);
-#else
-    cirrus_linear_bitblt_writeb(opaque, addr, val & 0xff);
-    cirrus_linear_bitblt_writeb(opaque, addr + 1, (val >> 8) & 0xff);
-    cirrus_linear_bitblt_writeb(opaque, addr + 2, (val >> 16) & 0xff);
-    cirrus_linear_bitblt_writeb(opaque, addr + 3, (val >> 24) & 0xff);
-#endif
-}
-
-
-static CPUReadMemoryFunc * const cirrus_linear_bitblt_read[3] = {
-    cirrus_linear_bitblt_readb,
-    cirrus_linear_bitblt_readw,
-    cirrus_linear_bitblt_readl,
+static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
+    .read = cirrus_linear_bitblt_read,
+    .write = cirrus_linear_bitblt_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },

 };
 
 };
 

-static CPUWriteMemoryFunc * const cirrus_linear_bitblt_write[3] = {
-    cirrus_linear_bitblt_writeb,
-    cirrus_linear_bitblt_writew,
-    cirrus_linear_bitblt_writel,
-};
-
-static void map_linear_vram(CirrusVGAState *s)
+static void unmap_bank(CirrusVGAState *s, unsigned bank)

 {
 {

-    if (!s->vga.map_addr && s->vga.lfb_addr && s->vga.lfb_end) {
-        s->vga.map_addr = s->vga.lfb_addr;
-        s->vga.map_end = s->vga.lfb_end;
-        cpu_register_physical_memory(s->vga.map_addr, s->vga.map_end - s->vga.map_addr, s->vga.vram_offset);
+    if (s->cirrus_bank[bank]) {
+        memory_region_del_subregion(&s->low_mem_container,
+                                    s->cirrus_bank[bank]);
+        memory_region_destroy(s->cirrus_bank[bank]);
+        g_free(s->cirrus_bank[bank]);
+        s->cirrus_bank[bank] = NULL;

     }
     }

+}

 
 

-    if (!s->vga.map_addr)
-        return;
-
-    s->vga.lfb_vram_mapped = 0;
+static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
+{
+    MemoryRegion *mr;
+    static const char *names[] = { "vga.bank0", "vga.bank1" };

 
     if (!(s->cirrus_srcptr != s->cirrus_srcptr_end)
         && !((s->vga.sr[0x07] & 0x01) == 0)
         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
         && !(s->vga.gr[0x0B] & 0x02)) {
 
 
     if (!(s->cirrus_srcptr != s->cirrus_srcptr_end)
         && !((s->vga.sr[0x07] & 0x01) == 0)
         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
         && !(s->vga.gr[0x0B] & 0x02)) {
 

-        cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x8000,
-                                    (s->vga.vram_offset + s->cirrus_bank_base[0]) | IO_MEM_RAM);
-        cpu_register_physical_memory(isa_mem_base + 0xa8000, 0x8000,
-                                    (s->vga.vram_offset + s->cirrus_bank_base[1]) | IO_MEM_RAM);
-
-        s->vga.lfb_vram_mapped = 1;
-    }
-    else {
-        cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x20000,
-                                     s->vga.vga_io_memory);
+        mr = g_malloc(sizeof(*mr));
+        memory_region_init_alias(mr, names[bank], &s->vga.vram,
+                                 s->cirrus_bank_base[bank], 0x8000);
+        memory_region_add_subregion_overlap(
+            &s->low_mem_container,
+            0x8000 * bank,
+            mr,
+            1);
+        unmap_bank(s, bank);
+        s->cirrus_bank[bank] = mr;
+    } else {
+        unmap_bank(s, bank);

     }
     }

+}

 
 

-    vga_dirty_log_start(&s->vga);
+static void map_linear_vram(CirrusVGAState *s)
+{
+    if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
+        s->linear_vram = true;
+        memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
+    }
+    map_linear_vram_bank(s, 0);
+    map_linear_vram_bank(s, 1);

 }
 
 static void unmap_linear_vram(CirrusVGAState *s)
 {
 }
 
 static void unmap_linear_vram(CirrusVGAState *s)
 {

-    if (s->vga.map_addr && s->vga.lfb_addr && s->vga.lfb_end)
-        s->vga.map_addr = s->vga.map_end = 0;
-
-    cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x20000,
-                                 s->vga.vga_io_memory);
+    if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
+        s->linear_vram = false;
+        memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
+    }
+    unmap_bank(s, 0);
+    unmap_bank(s, 1);

 }
 
 /* Compute the memory access functions */
 }
 
 /* Compute the memory access functions */


@@ -2626,6 +2424,7 @@ static void cirrus_update_memory_access(CirrusVGAState *s)
 {
     unsigned mode;
 
 {
     unsigned mode;
 

+    memory_region_transaction_begin();

     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
         goto generic_io;
     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
         goto generic_io;
     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {


@@ -2645,6 +2444,7 @@ static void cirrus_update_memory_access(CirrusVGAState *s)
             unmap_linear_vram(s);
         }
     }
             unmap_linear_vram(s);
         }
     }

+    memory_region_transaction_commit();

 }
 
 
 }
 
 


@@ -2698,14 +2498,8 @@ static uint32_t cirrus_vga_ioport_read(void *opaque, uint32_t addr)
            c->cirrus_hidden_dac_lockindex = 0;
            break;
         case 0x3c9:
            c->cirrus_hidden_dac_lockindex = 0;
            break;
         case 0x3c9:

-           if (cirrus_hook_read_palette(c, &val))
-               break;
-           val = s->palette[s->dac_read_index * 3 + s->dac_sub_index];
-           if (++s->dac_sub_index == 3) {
-               s->dac_sub_index = 0;
-               s->dac_read_index++;
-           }
-           break;
+            val = cirrus_vga_read_palette(c);
+            break;

        case 0x3ca:
            val = s->fcr;
            break;
        case 0x3ca:
            val = s->fcr;
            break;


@@ -2716,9 +2510,7 @@ static uint32_t cirrus_vga_ioport_read(void *opaque, uint32_t addr)
            val = s->gr_index;
            break;
        case 0x3cf:
            val = s->gr_index;
            break;
        case 0x3cf:

-           if (cirrus_hook_read_gr(c, s->gr_index, &val))
-               break;
-           val = s->gr[s->gr_index];
+           val = cirrus_vga_read_gr(c, s->gr_index);

 #ifdef DEBUG_VGA_REG
            printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
 #endif
 #ifdef DEBUG_VGA_REG
            printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
 #endif


@@ -2729,9 +2521,7 @@ static uint32_t cirrus_vga_ioport_read(void *opaque, uint32_t addr)
            break;
        case 0x3b5:
        case 0x3d5:
            break;
        case 0x3b5:
        case 0x3d5:

-           if (cirrus_hook_read_cr(c, s->cr_index, &val))
-               break;
-           val = s->cr[s->cr_index];
+            val = cirrus_vga_read_cr(c, s->cr_index);

 #ifdef DEBUG_VGA_REG
            printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
 #endif
 #ifdef DEBUG_VGA_REG
            printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
 #endif


@@ -2827,25 +2617,16 @@ static void cirrus_vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
        s->dac_state = 0;
        break;
     case 0x3c9:
        s->dac_state = 0;
        break;
     case 0x3c9:

-       if (cirrus_hook_write_palette(c, val))
-           break;
-       s->dac_cache[s->dac_sub_index] = val;
-       if (++s->dac_sub_index == 3) {
-           memcpy(&s->palette[s->dac_write_index * 3], s->dac_cache, 3);
-           s->dac_sub_index = 0;
-           s->dac_write_index++;
-       }
-       break;
+        cirrus_vga_write_palette(c, val);
+        break;

     case 0x3ce:
        s->gr_index = val;
        break;
     case 0x3cf:
     case 0x3ce:
        s->gr_index = val;
        break;
     case 0x3cf:

-       if (cirrus_hook_write_gr(c, s->gr_index, val))
-           break;

 #ifdef DEBUG_VGA_REG
        printf("vga: write GR%x = 0x%02x\n", s->gr_index, val);
 #endif
 #ifdef DEBUG_VGA_REG
        printf("vga: write GR%x = 0x%02x\n", s->gr_index, val);
 #endif

-       s->gr[s->gr_index] = val & gr_mask[s->gr_index];
+       cirrus_vga_write_gr(c, s->gr_index, val);

        break;
     case 0x3b4:
     case 0x3d4:
        break;
     case 0x3b4:
     case 0x3d4:


@@ -2853,31 +2634,10 @@ static void cirrus_vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
        break;
     case 0x3b5:
     case 0x3d5:
        break;
     case 0x3b5:
     case 0x3d5:

-       if (cirrus_hook_write_cr(c, s->cr_index, val))
-           break;

 #ifdef DEBUG_VGA_REG
        printf("vga: write CR%x = 0x%02x\n", s->cr_index, val);
 #endif
 #ifdef DEBUG_VGA_REG
        printf("vga: write CR%x = 0x%02x\n", s->cr_index, val);
 #endif

-       /* handle CR0-7 protection */
-       if ((s->cr[0x11] & 0x80) && s->cr_index <= 7) {
-           /* can always write bit 4 of CR7 */
-           if (s->cr_index == 7)
-               s->cr[7] = (s->cr[7] & ~0x10) | (val & 0x10);
-           return;
-       }
-       s->cr[s->cr_index] = val;
-
-       switch(s->cr_index) {
-       case 0x00:
-       case 0x04:
-       case 0x05:
-       case 0x06:
-       case 0x07:
-       case 0x11:
-       case 0x17:
-           s->update_retrace_info(s);
-           break;
-       }
+       cirrus_vga_write_cr(c, val);

        break;
     case 0x3ba:
     case 0x3da:
        break;
     case 0x3ba:
     case 0x3da:


@@ -2892,12 +2652,11 @@ static void cirrus_vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
  *
  ***************************************/
 
  *
  ***************************************/
 

-static uint32_t cirrus_mmio_readb(void *opaque, target_phys_addr_t addr)
+static uint64_t cirrus_mmio_read(void *opaque, target_phys_addr_t addr,
+                                 unsigned size)

 {
     CirrusVGAState *s = opaque;
 
 {
     CirrusVGAState *s = opaque;
 

-    addr &= CIRRUS_PNPMMIO_SIZE - 1;
-

     if (addr >= 0x100) {
         return cirrus_mmio_blt_read(s, addr - 0x100);
     } else {
     if (addr >= 0x100) {
         return cirrus_mmio_blt_read(s, addr - 0x100);
     } else {


@@ -2905,43 +2664,11 @@ static uint32_t cirrus_mmio_readb(void *opaque, target_phys_addr_t addr)
     }
 }
 
     }
 }
 

-static uint32_t cirrus_mmio_readw(void *opaque, target_phys_addr_t addr)
-{
-    uint32_t v;
-#ifdef TARGET_WORDS_BIGENDIAN
-    v = cirrus_mmio_readb(opaque, addr) << 8;
-    v |= cirrus_mmio_readb(opaque, addr + 1);
-#else
-    v = cirrus_mmio_readb(opaque, addr);
-    v |= cirrus_mmio_readb(opaque, addr + 1) << 8;
-#endif
-    return v;
-}
-
-static uint32_t cirrus_mmio_readl(void *opaque, target_phys_addr_t addr)
-{
-    uint32_t v;
-#ifdef TARGET_WORDS_BIGENDIAN
-    v = cirrus_mmio_readb(opaque, addr) << 24;
-    v |= cirrus_mmio_readb(opaque, addr + 1) << 16;
-    v |= cirrus_mmio_readb(opaque, addr + 2) << 8;
-    v |= cirrus_mmio_readb(opaque, addr + 3);
-#else
-    v = cirrus_mmio_readb(opaque, addr);
-    v |= cirrus_mmio_readb(opaque, addr + 1) << 8;
-    v |= cirrus_mmio_readb(opaque, addr + 2) << 16;
-    v |= cirrus_mmio_readb(opaque, addr + 3) << 24;
-#endif
-    return v;
-}
-
-static void cirrus_mmio_writeb(void *opaque, target_phys_addr_t addr,
-                              uint32_t val)
+static void cirrus_mmio_write(void *opaque, target_phys_addr_t addr,
+                              uint64_t val, unsigned size)

 {
     CirrusVGAState *s = opaque;
 
 {
     CirrusVGAState *s = opaque;
 

-    addr &= CIRRUS_PNPMMIO_SIZE - 1;
-

     if (addr >= 0x100) {
        cirrus_mmio_blt_write(s, addr - 0x100, val);
     } else {
     if (addr >= 0x100) {
        cirrus_mmio_blt_write(s, addr - 0x100, val);
     } else {


@@ -2949,128 +2676,24 @@ static void cirrus_mmio_writeb(void *opaque, target_phys_addr_t addr,
     }
 }
 
     }
 }
 

-static void cirrus_mmio_writew(void *opaque, target_phys_addr_t addr,
-                              uint32_t val)
-{
-#ifdef TARGET_WORDS_BIGENDIAN
-    cirrus_mmio_writeb(opaque, addr, (val >> 8) & 0xff);
-    cirrus_mmio_writeb(opaque, addr + 1, val & 0xff);
-#else
-    cirrus_mmio_writeb(opaque, addr, val & 0xff);
-    cirrus_mmio_writeb(opaque, addr + 1, (val >> 8) & 0xff);
-#endif
-}
-
-static void cirrus_mmio_writel(void *opaque, target_phys_addr_t addr,
-                              uint32_t val)
-{
-#ifdef TARGET_WORDS_BIGENDIAN
-    cirrus_mmio_writeb(opaque, addr, (val >> 24) & 0xff);
-    cirrus_mmio_writeb(opaque, addr + 1, (val >> 16) & 0xff);
-    cirrus_mmio_writeb(opaque, addr + 2, (val >> 8) & 0xff);
-    cirrus_mmio_writeb(opaque, addr + 3, val & 0xff);
-#else
-    cirrus_mmio_writeb(opaque, addr, val & 0xff);
-    cirrus_mmio_writeb(opaque, addr + 1, (val >> 8) & 0xff);
-    cirrus_mmio_writeb(opaque, addr + 2, (val >> 16) & 0xff);
-    cirrus_mmio_writeb(opaque, addr + 3, (val >> 24) & 0xff);
-#endif
-}
-
-
-static CPUReadMemoryFunc * const cirrus_mmio_read[3] = {
-    cirrus_mmio_readb,
-    cirrus_mmio_readw,
-    cirrus_mmio_readl,
-};
-
-static CPUWriteMemoryFunc * const cirrus_mmio_write[3] = {
-    cirrus_mmio_writeb,
-    cirrus_mmio_writew,
-    cirrus_mmio_writel,
+static const MemoryRegionOps cirrus_mmio_io_ops = {
+    .read = cirrus_mmio_read,
+    .write = cirrus_mmio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },

 };
 
 /* load/save state */
 
 };
 
 /* load/save state */
 

-static void cirrus_vga_save(QEMUFile *f, void *opaque)
+static int cirrus_post_load(void *opaque, int version_id)

 {
     CirrusVGAState *s = opaque;
 
 {
     CirrusVGAState *s = opaque;
 

-    qemu_put_be32s(f, &s->vga.latch);
-    qemu_put_8s(f, &s->vga.sr_index);
-    qemu_put_buffer(f, s->vga.sr, 256);
-    qemu_put_8s(f, &s->vga.gr_index);
-    qemu_put_8s(f, &s->cirrus_shadow_gr0);
-    qemu_put_8s(f, &s->cirrus_shadow_gr1);
-    qemu_put_buffer(f, s->vga.gr + 2, 254);
-    qemu_put_8s(f, &s->vga.ar_index);
-    qemu_put_buffer(f, s->vga.ar, 21);
-    qemu_put_be32(f, s->vga.ar_flip_flop);
-    qemu_put_8s(f, &s->vga.cr_index);
-    qemu_put_buffer(f, s->vga.cr, 256);
-    qemu_put_8s(f, &s->vga.msr);
-    qemu_put_8s(f, &s->vga.fcr);
-    qemu_put_8s(f, &s->vga.st00);
-    qemu_put_8s(f, &s->vga.st01);
-
-    qemu_put_8s(f, &s->vga.dac_state);
-    qemu_put_8s(f, &s->vga.dac_sub_index);
-    qemu_put_8s(f, &s->vga.dac_read_index);
-    qemu_put_8s(f, &s->vga.dac_write_index);
-    qemu_put_buffer(f, s->vga.dac_cache, 3);
-    qemu_put_buffer(f, s->vga.palette, 768);
-
-    qemu_put_be32(f, s->vga.bank_offset);
-
-    qemu_put_8s(f, &s->cirrus_hidden_dac_lockindex);
-    qemu_put_8s(f, &s->cirrus_hidden_dac_data);
-
-    qemu_put_be32s(f, &s->hw_cursor_x);
-    qemu_put_be32s(f, &s->hw_cursor_y);
-    /* XXX: we do not save the bitblt state - we assume we do not save
-       the state when the blitter is active */
-}
-
-static int cirrus_vga_load(QEMUFile *f, void *opaque, int version_id)
-{
-    CirrusVGAState *s = opaque;
-
-    if (version_id > 2)
-        return -EINVAL;
-
-    qemu_get_be32s(f, &s->vga.latch);
-    qemu_get_8s(f, &s->vga.sr_index);
-    qemu_get_buffer(f, s->vga.sr, 256);
-    qemu_get_8s(f, &s->vga.gr_index);
-    qemu_get_8s(f, &s->cirrus_shadow_gr0);
-    qemu_get_8s(f, &s->cirrus_shadow_gr1);

     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;

-    qemu_get_buffer(f, s->vga.gr + 2, 254);
-    qemu_get_8s(f, &s->vga.ar_index);
-    qemu_get_buffer(f, s->vga.ar, 21);
-    s->vga.ar_flip_flop=qemu_get_be32(f);
-    qemu_get_8s(f, &s->vga.cr_index);
-    qemu_get_buffer(f, s->vga.cr, 256);
-    qemu_get_8s(f, &s->vga.msr);
-    qemu_get_8s(f, &s->vga.fcr);
-    qemu_get_8s(f, &s->vga.st00);
-    qemu_get_8s(f, &s->vga.st01);
-
-    qemu_get_8s(f, &s->vga.dac_state);
-    qemu_get_8s(f, &s->vga.dac_sub_index);
-    qemu_get_8s(f, &s->vga.dac_read_index);
-    qemu_get_8s(f, &s->vga.dac_write_index);
-    qemu_get_buffer(f, s->vga.dac_cache, 3);
-    qemu_get_buffer(f, s->vga.palette, 768);
-
-    s->vga.bank_offset = qemu_get_be32(f);
-
-    qemu_get_8s(f, &s->cirrus_hidden_dac_lockindex);
-    qemu_get_8s(f, &s->cirrus_hidden_dac_data);
-
-    qemu_get_be32s(f, &s->hw_cursor_x);
-    qemu_get_be32s(f, &s->hw_cursor_y);

 
     cirrus_update_memory_access(s);
     /* force refresh */
 
     cirrus_update_memory_access(s);
     /* force refresh */


@@ -3080,30 +2703,58 @@ static int cirrus_vga_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
     return 0;
 }
 

-static void pci_cirrus_vga_save(QEMUFile *f, void *opaque)
-{
-    PCICirrusVGAState *s = opaque;
-
-    pci_device_save(&s->dev, f);
-    cirrus_vga_save(f, &s->cirrus_vga);
-}
-
-static int pci_cirrus_vga_load(QEMUFile *f, void *opaque, int version_id)
-{
-    PCICirrusVGAState *s = opaque;
-    int ret;
-
-    if (version_id > 2)
-        return -EINVAL;
-
-    if (version_id >= 2) {
-        ret = pci_device_load(&s->dev, f);
-        if (ret < 0)
-            return ret;
+static const VMStateDescription vmstate_cirrus_vga = {
+    .name = "cirrus_vga",
+    .version_id = 2,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .post_load = cirrus_post_load,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(vga.latch, CirrusVGAState),
+        VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
+        VMSTATE_BUFFER(vga.sr, CirrusVGAState),
+        VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
+        VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
+        VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
+        VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
+        VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
+        VMSTATE_BUFFER(vga.ar, CirrusVGAState),
+        VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
+        VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
+        VMSTATE_BUFFER(vga.cr, CirrusVGAState),
+        VMSTATE_UINT8(vga.msr, CirrusVGAState),
+        VMSTATE_UINT8(vga.fcr, CirrusVGAState),
+        VMSTATE_UINT8(vga.st00, CirrusVGAState),
+        VMSTATE_UINT8(vga.st01, CirrusVGAState),
+        VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
+        VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
+        VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
+        VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
+        VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
+        VMSTATE_BUFFER(vga.palette, CirrusVGAState),
+        VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
+        VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
+        VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
+        VMSTATE_UINT32(hw_cursor_x, CirrusVGAState),
+        VMSTATE_UINT32(hw_cursor_y, CirrusVGAState),
+        /* XXX: we do not save the bitblt state - we assume we do not save
+           the state when the blitter is active */
+        VMSTATE_END_OF_LIST()

     }
     }

+};

 
 

-    return cirrus_vga_load(f, &s->cirrus_vga, version_id);
-}
+static const VMStateDescription vmstate_pci_cirrus_vga = {
+    .name = "cirrus_vga",
+    .version_id = 2,
+    .minimum_version_id = 2,
+    .minimum_version_id_old = 2,
+    .fields      = (VMStateField []) {
+        VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
+        VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
+                       vmstate_cirrus_vga, CirrusVGAState),
+        VMSTATE_END_OF_LIST()
+    }
+};

 
 /***************************************
  *
 
 /***************************************
  *


@@ -3141,7 +2792,18 @@ static void cirrus_reset(void *opaque)
     s->cirrus_hidden_dac_data = 0;
 }
 
     s->cirrus_hidden_dac_data = 0;
 }
 

-static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
+static const MemoryRegionOps cirrus_linear_io_ops = {
+    .read = cirrus_linear_read,
+    .write = cirrus_linear_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },
+};
+
+static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
+                               MemoryRegion *system_memory)

 {
     int i;
     static int inited;
 {
     int i;
     static int inited;


@@ -3187,24 +2849,33 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
     register_ioport_read(0x3ba, 1, 1, cirrus_vga_ioport_read, s);
     register_ioport_read(0x3da, 1, 1, cirrus_vga_ioport_read, s);
 
     register_ioport_read(0x3ba, 1, 1, cirrus_vga_ioport_read, s);
     register_ioport_read(0x3da, 1, 1, cirrus_vga_ioport_read, s);
 

-    s->vga.vga_io_memory = cpu_register_io_memory(cirrus_vga_mem_read,
-                                                  cirrus_vga_mem_write, s);
-    cpu_register_physical_memory(isa_mem_base + 0x000a0000, 0x20000,
-                                 s->vga.vga_io_memory);
-    qemu_register_coalesced_mmio(isa_mem_base + 0x000a0000, 0x20000);
+    memory_region_init(&s->low_mem_container,
+                       "cirrus-lowmem-container",
+                       0x20000);
+
+    memory_region_init_io(&s->low_mem, &cirrus_vga_mem_ops, s,
+                          "cirrus-low-memory", 0x20000);
+    memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
+    memory_region_add_subregion_overlap(system_memory,
+                                        isa_mem_base + 0x000a0000,
+                                        &s->low_mem_container,
+                                        1);
+    memory_region_set_coalescing(&s->low_mem);

 
     /* I/O handler for LFB */
 
     /* I/O handler for LFB */

-    s->cirrus_linear_io_addr =
-        cpu_register_io_memory(cirrus_linear_read, cirrus_linear_write, s);
+    memory_region_init_io(&s->cirrus_linear_io, &cirrus_linear_io_ops, s,
+                          "cirrus-linear-io", VGA_RAM_SIZE);

 
     /* I/O handler for LFB */
 
     /* I/O handler for LFB */

-    s->cirrus_linear_bitblt_io_addr =
-        cpu_register_io_memory(cirrus_linear_bitblt_read,
-                               cirrus_linear_bitblt_write, s);
+    memory_region_init_io(&s->cirrus_linear_bitblt_io,
+                          &cirrus_linear_bitblt_io_ops,
+                          s,
+                          "cirrus-bitblt-mmio",
+                          0x400000);

 
     /* I/O handler for memory-mapped I/O */
 
     /* I/O handler for memory-mapped I/O */

-    s->cirrus_mmio_io_addr =
-        cpu_register_io_memory(cirrus_mmio_read, cirrus_mmio_write, s);
+    memory_region_init_io(&s->cirrus_mmio_io, &cirrus_mmio_io_ops, s,
+                          "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);

 
     s->real_vram_size =
         (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;
 
     s->real_vram_size =
         (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;


@@ -3220,7 +2891,6 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
 
     qemu_register_reset(cirrus_reset, s);
     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
 
     qemu_register_reset(cirrus_reset, s);

-    cirrus_reset(s);

 }
 
 /***************************************
 }
 
 /***************************************


@@ -3229,18 +2899,19 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
  *
  ***************************************/
 
  *
  ***************************************/
 

-void isa_cirrus_vga_init(void)
+void isa_cirrus_vga_init(MemoryRegion *system_memory)

 {
     CirrusVGAState *s;
 
 {
     CirrusVGAState *s;
 

-    s = qemu_mallocz(sizeof(CirrusVGAState));
+    s = g_malloc0(sizeof(CirrusVGAState));

 
     vga_common_init(&s->vga, VGA_RAM_SIZE);
 
     vga_common_init(&s->vga, VGA_RAM_SIZE);

-    cirrus_init_common(s, CIRRUS_ID_CLGD5430, 0);
+    cirrus_init_common(s, CIRRUS_ID_CLGD5430, 0, system_memory);

     s->vga.ds = graphic_console_init(s->vga.update, s->vga.invalidate,
                                      s->vga.screen_dump, s->vga.text_update,
                                      &s->vga);
     s->vga.ds = graphic_console_init(s->vga.update, s->vga.invalidate,
                                      s->vga.screen_dump, s->vga.text_update,
                                      &s->vga);

-    register_savevm("cirrus_vga", 0, 2, cirrus_vga_save, cirrus_vga_load, s);
+    vmstate_register(NULL, 0, &vmstate_cirrus_vga, s);
+    rom_add_vga(VGABIOS_CIRRUS_FILENAME);

     /* XXX ISA-LFB support */
 }
 
     /* XXX ISA-LFB support */
 }
 


@@ -3250,94 +2921,56 @@ void isa_cirrus_vga_init(void)
  *
  ***************************************/
 
  *
  ***************************************/
 

-static void cirrus_pci_lfb_map(PCIDevice *d, int region_num,
-                              uint32_t addr, uint32_t size, int type)
-{
-    CirrusVGAState *s = &DO_UPCAST(PCICirrusVGAState, dev, d)->cirrus_vga;
-
-    /* XXX: add byte swapping apertures */
-    cpu_register_physical_memory(addr, s->vga.vram_size,
-                                s->cirrus_linear_io_addr);
-    cpu_register_physical_memory(addr + 0x1000000, 0x400000,
-                                s->cirrus_linear_bitblt_io_addr);
-
-    s->vga.map_addr = s->vga.map_end = 0;
-    s->vga.lfb_addr = addr & TARGET_PAGE_MASK;
-    s->vga.lfb_end = ((addr + VGA_RAM_SIZE) + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
-    /* account for overflow */
-    if (s->vga.lfb_end < addr + VGA_RAM_SIZE)
-        s->vga.lfb_end = addr + VGA_RAM_SIZE;
-
-    vga_dirty_log_start(&s->vga);
-}
-
-static void cirrus_pci_mmio_map(PCIDevice *d, int region_num,
-                               uint32_t addr, uint32_t size, int type)
-{
-    CirrusVGAState *s = &DO_UPCAST(PCICirrusVGAState, dev, d)->cirrus_vga;
-
-    cpu_register_physical_memory(addr, CIRRUS_PNPMMIO_SIZE,
-                                s->cirrus_mmio_io_addr);
-}
-
-static void pci_cirrus_write_config(PCIDevice *d,
-                                    uint32_t address, uint32_t val, int len)
-{
-    PCICirrusVGAState *pvs = DO_UPCAST(PCICirrusVGAState, dev, d);
-    CirrusVGAState *s = &pvs->cirrus_vga;
-
-    pci_default_write_config(d, address, val, len);
-    if (s->vga.map_addr && d->io_regions[0].addr == -1)
-        s->vga.map_addr = 0;
-    cirrus_update_memory_access(s);
-}
-

 static int pci_cirrus_vga_initfn(PCIDevice *dev)
 {
      PCICirrusVGAState *d = DO_UPCAST(PCICirrusVGAState, dev, dev);
      CirrusVGAState *s = &d->cirrus_vga;
 static int pci_cirrus_vga_initfn(PCIDevice *dev)
 {
      PCICirrusVGAState *d = DO_UPCAST(PCICirrusVGAState, dev, dev);
      CirrusVGAState *s = &d->cirrus_vga;

-     uint8_t *pci_conf = d->dev.config;
-     int device_id = CIRRUS_ID_CLGD5446;
+     PCIDeviceInfo *info = DO_UPCAST(PCIDeviceInfo, qdev, dev->qdev.info);
+     int16_t device_id = info->device_id;

 
      /* setup VGA */
      vga_common_init(&s->vga, VGA_RAM_SIZE);
 
      /* setup VGA */
      vga_common_init(&s->vga, VGA_RAM_SIZE);

-     cirrus_init_common(s, device_id, 1);
+     cirrus_init_common(s, device_id, 1, pci_address_space(dev));

      s->vga.ds = graphic_console_init(s->vga.update, s->vga.invalidate,
                                       s->vga.screen_dump, s->vga.text_update,
                                       &s->vga);
 
      /* setup PCI */
      s->vga.ds = graphic_console_init(s->vga.update, s->vga.invalidate,
                                       s->vga.screen_dump, s->vga.text_update,
                                       &s->vga);
 
      /* setup PCI */

-     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_CIRRUS);
-     pci_config_set_device_id(pci_conf, device_id);
-     pci_conf[0x04] = PCI_COMMAND_IOACCESS | PCI_COMMAND_MEMACCESS;
-     pci_config_set_class(pci_conf, PCI_CLASS_DISPLAY_VGA);
-     pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL;
+
+    memory_region_init(&s->pci_bar, "cirrus-pci-bar0", 0x2000000);
+
+    /* XXX: add byte swapping apertures */
+    memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
+    memory_region_add_subregion(&s->pci_bar, 0x1000000,
+                                &s->cirrus_linear_bitblt_io);

 
      /* setup memory space */
      /* memory #0 LFB */
      /* memory #1 memory-mapped I/O */
      /* XXX: s->vga.vram_size must be a power of two */
 
      /* setup memory space */
      /* memory #0 LFB */
      /* memory #1 memory-mapped I/O */
      /* XXX: s->vga.vram_size must be a power of two */

-     pci_register_bar((PCIDevice *)d, 0, 0x2000000,
-                      PCI_ADDRESS_SPACE_MEM_PREFETCH, cirrus_pci_lfb_map);
+     pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);

      if (device_id == CIRRUS_ID_CLGD5446) {
      if (device_id == CIRRUS_ID_CLGD5446) {

-         pci_register_bar((PCIDevice *)d, 1, CIRRUS_PNPMMIO_SIZE,
-                          PCI_ADDRESS_SPACE_MEM, cirrus_pci_mmio_map);
+         pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);

      }
      }

-     register_savevm("cirrus_vga", 0, 2, pci_cirrus_vga_save, pci_cirrus_vga_load, d);
-     /* XXX: ROM BIOS */

      return 0;
 }
 
 void pci_cirrus_vga_init(PCIBus *bus)
 {
      return 0;
 }
 
 void pci_cirrus_vga_init(PCIBus *bus)
 {

-    pci_create_simple(bus, -1, "Cirrus VGA");
+    pci_create_simple(bus, -1, "cirrus-vga");

 }
 
 static PCIDeviceInfo cirrus_vga_info = {
 }
 
 static PCIDeviceInfo cirrus_vga_info = {

-    .qdev.name    = "Cirrus VGA",
+    .qdev.name    = "cirrus-vga",
+    .qdev.desc    = "Cirrus CLGD 54xx VGA",

     .qdev.size    = sizeof(PCICirrusVGAState),
     .qdev.size    = sizeof(PCICirrusVGAState),

+    .qdev.vmsd    = &vmstate_pci_cirrus_vga,
+    .no_hotplug   = 1,

     .init         = pci_cirrus_vga_initfn,
     .init         = pci_cirrus_vga_initfn,

-    .config_write = pci_cirrus_write_config,
+    .romfile      = VGABIOS_CIRRUS_FILENAME,
+    .vendor_id    = PCI_VENDOR_ID_CIRRUS,
+    .device_id    = CIRRUS_ID_CLGD5446,
+    .class_id     = PCI_CLASS_DISPLAY_VGA,

 };
 
 static void cirrus_vga_register(void)
 };
 
 static void cirrus_vga_register(void)