xref: /openbmc/qemu/hw/display/cirrus_vga.c (revision 47b43a1f)
1 /*
2  * QEMU Cirrus CLGD 54xx VGA Emulator.
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  * Copyright (c) 2004 Makoto Suzuki (suzu)
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * Reference: Finn Thogersons' VGADOC4b
27  *   available at http://home.worldonline.dk/~finth/
28  */
29 #include "hw/hw.h"
30 #include "hw/pci/pci.h"
31 #include "ui/console.h"
32 #include "vga_int.h"
33 #include "hw/loader.h"
34 
35 /*
36  * TODO:
37  *    - destination write mask support not complete (bits 5..7)
38  *    - optimize linear mappings
39  *    - optimize bitblt functions
40  */
41 
42 //#define DEBUG_CIRRUS
43 //#define DEBUG_BITBLT
44 
45 /***************************************
46  *
47  *  definitions
48  *
49  ***************************************/
50 
51 // ID
52 #define CIRRUS_ID_CLGD5422  (0x23<<2)
53 #define CIRRUS_ID_CLGD5426  (0x24<<2)
54 #define CIRRUS_ID_CLGD5424  (0x25<<2)
55 #define CIRRUS_ID_CLGD5428  (0x26<<2)
56 #define CIRRUS_ID_CLGD5430  (0x28<<2)
57 #define CIRRUS_ID_CLGD5434  (0x2A<<2)
58 #define CIRRUS_ID_CLGD5436  (0x2B<<2)
59 #define CIRRUS_ID_CLGD5446  (0x2E<<2)
60 
61 // sequencer 0x07
62 #define CIRRUS_SR7_BPP_VGA            0x00
63 #define CIRRUS_SR7_BPP_SVGA           0x01
64 #define CIRRUS_SR7_BPP_MASK           0x0e
65 #define CIRRUS_SR7_BPP_8              0x00
66 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
67 #define CIRRUS_SR7_BPP_24             0x04
68 #define CIRRUS_SR7_BPP_16             0x06
69 #define CIRRUS_SR7_BPP_32             0x08
70 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
71 
72 // sequencer 0x0f
73 #define CIRRUS_MEMSIZE_512k        0x08
74 #define CIRRUS_MEMSIZE_1M          0x10
75 #define CIRRUS_MEMSIZE_2M          0x18
76 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80	// bank switching is enabled.
77 
78 // sequencer 0x12
79 #define CIRRUS_CURSOR_SHOW         0x01
80 #define CIRRUS_CURSOR_HIDDENPEL    0x02
81 #define CIRRUS_CURSOR_LARGE        0x04	// 64x64 if set, 32x32 if clear
82 
83 // sequencer 0x17
84 #define CIRRUS_BUSTYPE_VLBFAST   0x10
85 #define CIRRUS_BUSTYPE_PCI       0x20
86 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
87 #define CIRRUS_BUSTYPE_ISA       0x38
88 #define CIRRUS_MMIO_ENABLE       0x04
89 #define CIRRUS_MMIO_USE_PCIADDR  0x40	// 0xb8000 if cleared.
90 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
91 
92 // control 0x0b
93 #define CIRRUS_BANKING_DUAL             0x01
94 #define CIRRUS_BANKING_GRANULARITY_16K  0x20	// set:16k, clear:4k
95 
96 // control 0x30
97 #define CIRRUS_BLTMODE_BACKWARDS        0x01
98 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
99 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
100 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
101 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
102 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
103 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
104 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
105 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
106 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
107 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
108 
109 // control 0x31
110 #define CIRRUS_BLT_BUSY                 0x01
111 #define CIRRUS_BLT_START                0x02
112 #define CIRRUS_BLT_RESET                0x04
113 #define CIRRUS_BLT_FIFOUSED             0x10
114 #define CIRRUS_BLT_AUTOSTART            0x80
115 
116 // control 0x32
117 #define CIRRUS_ROP_0                    0x00
118 #define CIRRUS_ROP_SRC_AND_DST          0x05
119 #define CIRRUS_ROP_NOP                  0x06
120 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
121 #define CIRRUS_ROP_NOTDST               0x0b
122 #define CIRRUS_ROP_SRC                  0x0d
123 #define CIRRUS_ROP_1                    0x0e
124 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
125 #define CIRRUS_ROP_SRC_XOR_DST          0x59
126 #define CIRRUS_ROP_SRC_OR_DST           0x6d
127 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
128 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
129 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
130 #define CIRRUS_ROP_NOTSRC               0xd0
131 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
132 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
133 
134 #define CIRRUS_ROP_NOP_INDEX 2
135 #define CIRRUS_ROP_SRC_INDEX 5
136 
137 // control 0x33
138 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
139 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
140 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
141 
142 // memory-mapped IO
143 #define CIRRUS_MMIO_BLTBGCOLOR        0x00	// dword
144 #define CIRRUS_MMIO_BLTFGCOLOR        0x04	// dword
145 #define CIRRUS_MMIO_BLTWIDTH          0x08	// word
146 #define CIRRUS_MMIO_BLTHEIGHT         0x0a	// word
147 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c	// word
148 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e	// word
149 #define CIRRUS_MMIO_BLTDESTADDR       0x10	// dword
150 #define CIRRUS_MMIO_BLTSRCADDR        0x14	// dword
151 #define CIRRUS_MMIO_BLTWRITEMASK      0x17	// byte
152 #define CIRRUS_MMIO_BLTMODE           0x18	// byte
153 #define CIRRUS_MMIO_BLTROP            0x1a	// byte
154 #define CIRRUS_MMIO_BLTMODEEXT        0x1b	// byte
155 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c	// word?
156 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20	// word?
157 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24	// word
158 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26	// word
159 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28	// word
160 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a	// word
161 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c	// byte
162 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d	// byte
163 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e	// byte
164 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f	// byte
165 #define CIRRUS_MMIO_BRESENHAM_K1      0x30	// word
166 #define CIRRUS_MMIO_BRESENHAM_K3      0x32	// word
167 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34	// word
168 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36	// word
169 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38	// byte
170 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39	// byte
171 #define CIRRUS_MMIO_BLTSTATUS         0x40	// byte
172 
173 #define CIRRUS_PNPMMIO_SIZE         0x1000
174 
175 #define BLTUNSAFE(s) \
176     ( \
177         ( /* check dst is within bounds */ \
178             (s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \
179                 + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
180                     (s)->vga.vram_size \
181         ) || \
182         ( /* check src is within bounds */ \
183             (s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \
184                 + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
185                     (s)->vga.vram_size \
186         ) \
187     )
188 
189 struct CirrusVGAState;
190 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
191                                      uint8_t * dst, const uint8_t * src,
192 				     int dstpitch, int srcpitch,
193 				     int bltwidth, int bltheight);
194 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
195                               uint8_t *dst, int dst_pitch, int width, int height);
196 
197 typedef struct CirrusVGAState {
198     VGACommonState vga;
199 
200     MemoryRegion cirrus_vga_io;
201     MemoryRegion cirrus_linear_io;
202     MemoryRegion cirrus_linear_bitblt_io;
203     MemoryRegion cirrus_mmio_io;
204     MemoryRegion pci_bar;
205     bool linear_vram;  /* vga.vram mapped over cirrus_linear_io */
206     MemoryRegion low_mem_container; /* container for 0xa0000-0xc0000 */
207     MemoryRegion low_mem;           /* always mapped, overridden by: */
208     MemoryRegion cirrus_bank[2];    /*   aliases at 0xa0000-0xb0000  */
209     uint32_t cirrus_addr_mask;
210     uint32_t linear_mmio_mask;
211     uint8_t cirrus_shadow_gr0;
212     uint8_t cirrus_shadow_gr1;
213     uint8_t cirrus_hidden_dac_lockindex;
214     uint8_t cirrus_hidden_dac_data;
215     uint32_t cirrus_bank_base[2];
216     uint32_t cirrus_bank_limit[2];
217     uint8_t cirrus_hidden_palette[48];
218     uint32_t hw_cursor_x;
219     uint32_t hw_cursor_y;
220     int cirrus_blt_pixelwidth;
221     int cirrus_blt_width;
222     int cirrus_blt_height;
223     int cirrus_blt_dstpitch;
224     int cirrus_blt_srcpitch;
225     uint32_t cirrus_blt_fgcol;
226     uint32_t cirrus_blt_bgcol;
227     uint32_t cirrus_blt_dstaddr;
228     uint32_t cirrus_blt_srcaddr;
229     uint8_t cirrus_blt_mode;
230     uint8_t cirrus_blt_modeext;
231     cirrus_bitblt_rop_t cirrus_rop;
232 #define CIRRUS_BLTBUFSIZE (2048 * 4) /* one line width */
233     uint8_t cirrus_bltbuf[CIRRUS_BLTBUFSIZE];
234     uint8_t *cirrus_srcptr;
235     uint8_t *cirrus_srcptr_end;
236     uint32_t cirrus_srccounter;
237     /* hwcursor display state */
238     int last_hw_cursor_size;
239     int last_hw_cursor_x;
240     int last_hw_cursor_y;
241     int last_hw_cursor_y_start;
242     int last_hw_cursor_y_end;
243     int real_vram_size; /* XXX: suppress that */
244     int device_id;
245     int bustype;
246 } CirrusVGAState;
247 
248 typedef struct PCICirrusVGAState {
249     PCIDevice dev;
250     CirrusVGAState cirrus_vga;
251 } PCICirrusVGAState;
252 
253 typedef struct ISACirrusVGAState {
254     ISADevice dev;
255     CirrusVGAState cirrus_vga;
256 } ISACirrusVGAState;
257 
258 static uint8_t rop_to_index[256];
259 
260 /***************************************
261  *
262  *  prototypes.
263  *
264  ***************************************/
265 
266 
267 static void cirrus_bitblt_reset(CirrusVGAState *s);
268 static void cirrus_update_memory_access(CirrusVGAState *s);
269 
270 /***************************************
271  *
272  *  raster operations
273  *
274  ***************************************/
275 
276 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
277                                   uint8_t *dst,const uint8_t *src,
278                                   int dstpitch,int srcpitch,
279                                   int bltwidth,int bltheight)
280 {
281 }
282 
283 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
284                                    uint8_t *dst,
285                                    int dstpitch, int bltwidth,int bltheight)
286 {
287 }
288 
289 #define ROP_NAME 0
290 #define ROP_FN(d, s) 0
291 #include "cirrus_vga_rop.h"
292 
293 #define ROP_NAME src_and_dst
294 #define ROP_FN(d, s) (s) & (d)
295 #include "cirrus_vga_rop.h"
296 
297 #define ROP_NAME src_and_notdst
298 #define ROP_FN(d, s) (s) & (~(d))
299 #include "cirrus_vga_rop.h"
300 
301 #define ROP_NAME notdst
302 #define ROP_FN(d, s) ~(d)
303 #include "cirrus_vga_rop.h"
304 
305 #define ROP_NAME src
306 #define ROP_FN(d, s) s
307 #include "cirrus_vga_rop.h"
308 
309 #define ROP_NAME 1
310 #define ROP_FN(d, s) ~0
311 #include "cirrus_vga_rop.h"
312 
313 #define ROP_NAME notsrc_and_dst
314 #define ROP_FN(d, s) (~(s)) & (d)
315 #include "cirrus_vga_rop.h"
316 
317 #define ROP_NAME src_xor_dst
318 #define ROP_FN(d, s) (s) ^ (d)
319 #include "cirrus_vga_rop.h"
320 
321 #define ROP_NAME src_or_dst
322 #define ROP_FN(d, s) (s) | (d)
323 #include "cirrus_vga_rop.h"
324 
325 #define ROP_NAME notsrc_or_notdst
326 #define ROP_FN(d, s) (~(s)) | (~(d))
327 #include "cirrus_vga_rop.h"
328 
329 #define ROP_NAME src_notxor_dst
330 #define ROP_FN(d, s) ~((s) ^ (d))
331 #include "cirrus_vga_rop.h"
332 
333 #define ROP_NAME src_or_notdst
334 #define ROP_FN(d, s) (s) | (~(d))
335 #include "cirrus_vga_rop.h"
336 
337 #define ROP_NAME notsrc
338 #define ROP_FN(d, s) (~(s))
339 #include "cirrus_vga_rop.h"
340 
341 #define ROP_NAME notsrc_or_dst
342 #define ROP_FN(d, s) (~(s)) | (d)
343 #include "cirrus_vga_rop.h"
344 
345 #define ROP_NAME notsrc_and_notdst
346 #define ROP_FN(d, s) (~(s)) & (~(d))
347 #include "cirrus_vga_rop.h"
348 
349 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
350     cirrus_bitblt_rop_fwd_0,
351     cirrus_bitblt_rop_fwd_src_and_dst,
352     cirrus_bitblt_rop_nop,
353     cirrus_bitblt_rop_fwd_src_and_notdst,
354     cirrus_bitblt_rop_fwd_notdst,
355     cirrus_bitblt_rop_fwd_src,
356     cirrus_bitblt_rop_fwd_1,
357     cirrus_bitblt_rop_fwd_notsrc_and_dst,
358     cirrus_bitblt_rop_fwd_src_xor_dst,
359     cirrus_bitblt_rop_fwd_src_or_dst,
360     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
361     cirrus_bitblt_rop_fwd_src_notxor_dst,
362     cirrus_bitblt_rop_fwd_src_or_notdst,
363     cirrus_bitblt_rop_fwd_notsrc,
364     cirrus_bitblt_rop_fwd_notsrc_or_dst,
365     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
366 };
367 
368 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
369     cirrus_bitblt_rop_bkwd_0,
370     cirrus_bitblt_rop_bkwd_src_and_dst,
371     cirrus_bitblt_rop_nop,
372     cirrus_bitblt_rop_bkwd_src_and_notdst,
373     cirrus_bitblt_rop_bkwd_notdst,
374     cirrus_bitblt_rop_bkwd_src,
375     cirrus_bitblt_rop_bkwd_1,
376     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
377     cirrus_bitblt_rop_bkwd_src_xor_dst,
378     cirrus_bitblt_rop_bkwd_src_or_dst,
379     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
380     cirrus_bitblt_rop_bkwd_src_notxor_dst,
381     cirrus_bitblt_rop_bkwd_src_or_notdst,
382     cirrus_bitblt_rop_bkwd_notsrc,
383     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
384     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
385 };
386 
387 #define TRANSP_ROP(name) {\
388     name ## _8,\
389     name ## _16,\
390         }
391 #define TRANSP_NOP(func) {\
392     func,\
393     func,\
394         }
395 
396 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
397     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
398     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
399     TRANSP_NOP(cirrus_bitblt_rop_nop),
400     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
401     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
402     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
403     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
404     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
405     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
406     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
407     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
408     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
409     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
410     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
411     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
412     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
413 };
414 
415 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
416     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
417     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
418     TRANSP_NOP(cirrus_bitblt_rop_nop),
419     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
420     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
421     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
422     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
423     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
424     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
425     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
426     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
427     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
428     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
429     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
430     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
431     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
432 };
433 
434 #define ROP2(name) {\
435     name ## _8,\
436     name ## _16,\
437     name ## _24,\
438     name ## _32,\
439         }
440 
441 #define ROP_NOP2(func) {\
442     func,\
443     func,\
444     func,\
445     func,\
446         }
447 
448 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
449     ROP2(cirrus_patternfill_0),
450     ROP2(cirrus_patternfill_src_and_dst),
451     ROP_NOP2(cirrus_bitblt_rop_nop),
452     ROP2(cirrus_patternfill_src_and_notdst),
453     ROP2(cirrus_patternfill_notdst),
454     ROP2(cirrus_patternfill_src),
455     ROP2(cirrus_patternfill_1),
456     ROP2(cirrus_patternfill_notsrc_and_dst),
457     ROP2(cirrus_patternfill_src_xor_dst),
458     ROP2(cirrus_patternfill_src_or_dst),
459     ROP2(cirrus_patternfill_notsrc_or_notdst),
460     ROP2(cirrus_patternfill_src_notxor_dst),
461     ROP2(cirrus_patternfill_src_or_notdst),
462     ROP2(cirrus_patternfill_notsrc),
463     ROP2(cirrus_patternfill_notsrc_or_dst),
464     ROP2(cirrus_patternfill_notsrc_and_notdst),
465 };
466 
467 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
468     ROP2(cirrus_colorexpand_transp_0),
469     ROP2(cirrus_colorexpand_transp_src_and_dst),
470     ROP_NOP2(cirrus_bitblt_rop_nop),
471     ROP2(cirrus_colorexpand_transp_src_and_notdst),
472     ROP2(cirrus_colorexpand_transp_notdst),
473     ROP2(cirrus_colorexpand_transp_src),
474     ROP2(cirrus_colorexpand_transp_1),
475     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
476     ROP2(cirrus_colorexpand_transp_src_xor_dst),
477     ROP2(cirrus_colorexpand_transp_src_or_dst),
478     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
479     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
480     ROP2(cirrus_colorexpand_transp_src_or_notdst),
481     ROP2(cirrus_colorexpand_transp_notsrc),
482     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
483     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
484 };
485 
486 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
487     ROP2(cirrus_colorexpand_0),
488     ROP2(cirrus_colorexpand_src_and_dst),
489     ROP_NOP2(cirrus_bitblt_rop_nop),
490     ROP2(cirrus_colorexpand_src_and_notdst),
491     ROP2(cirrus_colorexpand_notdst),
492     ROP2(cirrus_colorexpand_src),
493     ROP2(cirrus_colorexpand_1),
494     ROP2(cirrus_colorexpand_notsrc_and_dst),
495     ROP2(cirrus_colorexpand_src_xor_dst),
496     ROP2(cirrus_colorexpand_src_or_dst),
497     ROP2(cirrus_colorexpand_notsrc_or_notdst),
498     ROP2(cirrus_colorexpand_src_notxor_dst),
499     ROP2(cirrus_colorexpand_src_or_notdst),
500     ROP2(cirrus_colorexpand_notsrc),
501     ROP2(cirrus_colorexpand_notsrc_or_dst),
502     ROP2(cirrus_colorexpand_notsrc_and_notdst),
503 };
504 
505 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
506     ROP2(cirrus_colorexpand_pattern_transp_0),
507     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
508     ROP_NOP2(cirrus_bitblt_rop_nop),
509     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
510     ROP2(cirrus_colorexpand_pattern_transp_notdst),
511     ROP2(cirrus_colorexpand_pattern_transp_src),
512     ROP2(cirrus_colorexpand_pattern_transp_1),
513     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
514     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
515     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
516     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
517     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
518     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
519     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
520     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
521     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
522 };
523 
524 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
525     ROP2(cirrus_colorexpand_pattern_0),
526     ROP2(cirrus_colorexpand_pattern_src_and_dst),
527     ROP_NOP2(cirrus_bitblt_rop_nop),
528     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
529     ROP2(cirrus_colorexpand_pattern_notdst),
530     ROP2(cirrus_colorexpand_pattern_src),
531     ROP2(cirrus_colorexpand_pattern_1),
532     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
533     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
534     ROP2(cirrus_colorexpand_pattern_src_or_dst),
535     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
536     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
537     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
538     ROP2(cirrus_colorexpand_pattern_notsrc),
539     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
540     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
541 };
542 
543 static const cirrus_fill_t cirrus_fill[16][4] = {
544     ROP2(cirrus_fill_0),
545     ROP2(cirrus_fill_src_and_dst),
546     ROP_NOP2(cirrus_bitblt_fill_nop),
547     ROP2(cirrus_fill_src_and_notdst),
548     ROP2(cirrus_fill_notdst),
549     ROP2(cirrus_fill_src),
550     ROP2(cirrus_fill_1),
551     ROP2(cirrus_fill_notsrc_and_dst),
552     ROP2(cirrus_fill_src_xor_dst),
553     ROP2(cirrus_fill_src_or_dst),
554     ROP2(cirrus_fill_notsrc_or_notdst),
555     ROP2(cirrus_fill_src_notxor_dst),
556     ROP2(cirrus_fill_src_or_notdst),
557     ROP2(cirrus_fill_notsrc),
558     ROP2(cirrus_fill_notsrc_or_dst),
559     ROP2(cirrus_fill_notsrc_and_notdst),
560 };
561 
562 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
563 {
564     unsigned int color;
565     switch (s->cirrus_blt_pixelwidth) {
566     case 1:
567         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
568         break;
569     case 2:
570         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
571         s->cirrus_blt_fgcol = le16_to_cpu(color);
572         break;
573     case 3:
574         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
575             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
576         break;
577     default:
578     case 4:
579         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
580             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
581         s->cirrus_blt_fgcol = le32_to_cpu(color);
582         break;
583     }
584 }
585 
586 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
587 {
588     unsigned int color;
589     switch (s->cirrus_blt_pixelwidth) {
590     case 1:
591         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
592         break;
593     case 2:
594         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
595         s->cirrus_blt_bgcol = le16_to_cpu(color);
596         break;
597     case 3:
598         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
599             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
600         break;
601     default:
602     case 4:
603         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
604             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
605         s->cirrus_blt_bgcol = le32_to_cpu(color);
606         break;
607     }
608 }
609 
610 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
611 				     int off_pitch, int bytesperline,
612 				     int lines)
613 {
614     int y;
615     int off_cur;
616     int off_cur_end;
617 
618     for (y = 0; y < lines; y++) {
619 	off_cur = off_begin;
620 	off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
621         memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);
622 	off_begin += off_pitch;
623     }
624 }
625 
626 static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,
627 					    const uint8_t * src)
628 {
629     uint8_t *dst;
630 
631     dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
632 
633     if (BLTUNSAFE(s))
634         return 0;
635 
636     (*s->cirrus_rop) (s, dst, src,
637                       s->cirrus_blt_dstpitch, 0,
638                       s->cirrus_blt_width, s->cirrus_blt_height);
639     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
640                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
641                              s->cirrus_blt_height);
642     return 1;
643 }
644 
645 /* fill */
646 
647 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
648 {
649     cirrus_fill_t rop_func;
650 
651     if (BLTUNSAFE(s))
652         return 0;
653     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
654     rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
655              s->cirrus_blt_dstpitch,
656              s->cirrus_blt_width, s->cirrus_blt_height);
657     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
658 			     s->cirrus_blt_dstpitch, s->cirrus_blt_width,
659 			     s->cirrus_blt_height);
660     cirrus_bitblt_reset(s);
661     return 1;
662 }
663 
664 /***************************************
665  *
666  *  bitblt (video-to-video)
667  *
668  ***************************************/
669 
670 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
671 {
672     return cirrus_bitblt_common_patterncopy(s,
673 					    s->vga.vram_ptr + ((s->cirrus_blt_srcaddr & ~7) &
674                                             s->cirrus_addr_mask));
675 }
676 
677 static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
678 {
679     int sx = 0, sy = 0;
680     int dx = 0, dy = 0;
681     int depth = 0;
682     int notify = 0;
683 
684     /* make sure to only copy if it's a plain copy ROP */
685     if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
686         *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {
687 
688         int width, height;
689 
690         depth = s->vga.get_bpp(&s->vga) / 8;
691         s->vga.get_resolution(&s->vga, &width, &height);
692 
693         /* extra x, y */
694         sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
695         sy = (src / ABS(s->cirrus_blt_srcpitch));
696         dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
697         dy = (dst / ABS(s->cirrus_blt_dstpitch));
698 
699         /* normalize width */
700         w /= depth;
701 
702         /* if we're doing a backward copy, we have to adjust
703            our x/y to be the upper left corner (instead of the lower
704            right corner) */
705         if (s->cirrus_blt_dstpitch < 0) {
706             sx -= (s->cirrus_blt_width / depth) - 1;
707             dx -= (s->cirrus_blt_width / depth) - 1;
708             sy -= s->cirrus_blt_height - 1;
709             dy -= s->cirrus_blt_height - 1;
710         }
711 
712         /* are we in the visible portion of memory? */
713         if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
714             (sx + w) <= width && (sy + h) <= height &&
715             (dx + w) <= width && (dy + h) <= height) {
716             notify = 1;
717         }
718     }
719 
720     /* we have to flush all pending changes so that the copy
721        is generated at the appropriate moment in time */
722     if (notify)
723 	vga_hw_update();
724 
725     (*s->cirrus_rop) (s, s->vga.vram_ptr +
726 		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
727 		      s->vga.vram_ptr +
728 		      (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
729 		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
730 		      s->cirrus_blt_width, s->cirrus_blt_height);
731 
732     if (notify) {
733         qemu_console_copy(s->vga.con,
734 			  sx, sy, dx, dy,
735 			  s->cirrus_blt_width / depth,
736 			  s->cirrus_blt_height);
737     }
738 
739     /* we don't have to notify the display that this portion has
740        changed since qemu_console_copy implies this */
741 
742     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
743 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
744 				s->cirrus_blt_height);
745 }
746 
747 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
748 {
749     if (BLTUNSAFE(s))
750         return 0;
751 
752     cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
753             s->cirrus_blt_srcaddr - s->vga.start_addr,
754             s->cirrus_blt_width, s->cirrus_blt_height);
755 
756     return 1;
757 }
758 
759 /***************************************
760  *
761  *  bitblt (cpu-to-video)
762  *
763  ***************************************/
764 
765 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
766 {
767     int copy_count;
768     uint8_t *end_ptr;
769 
770     if (s->cirrus_srccounter > 0) {
771         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
772             cirrus_bitblt_common_patterncopy(s, s->cirrus_bltbuf);
773         the_end:
774             s->cirrus_srccounter = 0;
775             cirrus_bitblt_reset(s);
776         } else {
777             /* at least one scan line */
778             do {
779                 (*s->cirrus_rop)(s, s->vga.vram_ptr +
780                                  (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
781                                   s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
782                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
783                                          s->cirrus_blt_width, 1);
784                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
785                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
786                 if (s->cirrus_srccounter <= 0)
787                     goto the_end;
788                 /* more bytes than needed can be transferred because of
789                    word alignment, so we keep them for the next line */
790                 /* XXX: keep alignment to speed up transfer */
791                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
792                 copy_count = s->cirrus_srcptr_end - end_ptr;
793                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
794                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
795                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
796             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
797         }
798     }
799 }
800 
801 /***************************************
802  *
803  *  bitblt wrapper
804  *
805  ***************************************/
806 
807 static void cirrus_bitblt_reset(CirrusVGAState * s)
808 {
809     int need_update;
810 
811     s->vga.gr[0x31] &=
812 	~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
813     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
814         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
815     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
816     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
817     s->cirrus_srccounter = 0;
818     if (!need_update)
819         return;
820     cirrus_update_memory_access(s);
821 }
822 
823 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
824 {
825     int w;
826 
827     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
828     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
829     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
830 
831     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
832 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
833 	    s->cirrus_blt_srcpitch = 8;
834 	} else {
835             /* XXX: check for 24 bpp */
836 	    s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
837 	}
838 	s->cirrus_srccounter = s->cirrus_blt_srcpitch;
839     } else {
840 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
841             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
842             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
843                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
844             else
845                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
846 	} else {
847             /* always align input size to 32 bits */
848 	    s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
849 	}
850         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
851     }
852     s->cirrus_srcptr = s->cirrus_bltbuf;
853     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
854     cirrus_update_memory_access(s);
855     return 1;
856 }
857 
858 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
859 {
860     /* XXX */
861 #ifdef DEBUG_BITBLT
862     printf("cirrus: bitblt (video to cpu) is not implemented yet\n");
863 #endif
864     return 0;
865 }
866 
867 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
868 {
869     int ret;
870 
871     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
872 	ret = cirrus_bitblt_videotovideo_patterncopy(s);
873     } else {
874 	ret = cirrus_bitblt_videotovideo_copy(s);
875     }
876     if (ret)
877 	cirrus_bitblt_reset(s);
878     return ret;
879 }
880 
881 static void cirrus_bitblt_start(CirrusVGAState * s)
882 {
883     uint8_t blt_rop;
884 
885     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
886 
887     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
888     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
889     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
890     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
891     s->cirrus_blt_dstaddr =
892 	(s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
893     s->cirrus_blt_srcaddr =
894 	(s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
895     s->cirrus_blt_mode = s->vga.gr[0x30];
896     s->cirrus_blt_modeext = s->vga.gr[0x33];
897     blt_rop = s->vga.gr[0x32];
898 
899 #ifdef DEBUG_BITBLT
900     printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n",
901            blt_rop,
902            s->cirrus_blt_mode,
903            s->cirrus_blt_modeext,
904            s->cirrus_blt_width,
905            s->cirrus_blt_height,
906            s->cirrus_blt_dstpitch,
907            s->cirrus_blt_srcpitch,
908            s->cirrus_blt_dstaddr,
909            s->cirrus_blt_srcaddr,
910            s->vga.gr[0x2f]);
911 #endif
912 
913     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
914     case CIRRUS_BLTMODE_PIXELWIDTH8:
915 	s->cirrus_blt_pixelwidth = 1;
916 	break;
917     case CIRRUS_BLTMODE_PIXELWIDTH16:
918 	s->cirrus_blt_pixelwidth = 2;
919 	break;
920     case CIRRUS_BLTMODE_PIXELWIDTH24:
921 	s->cirrus_blt_pixelwidth = 3;
922 	break;
923     case CIRRUS_BLTMODE_PIXELWIDTH32:
924 	s->cirrus_blt_pixelwidth = 4;
925 	break;
926     default:
927 #ifdef DEBUG_BITBLT
928 	printf("cirrus: bitblt - pixel width is unknown\n");
929 #endif
930 	goto bitblt_ignore;
931     }
932     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
933 
934     if ((s->
935 	 cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
936 			    CIRRUS_BLTMODE_MEMSYSDEST))
937 	== (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
938 #ifdef DEBUG_BITBLT
939 	printf("cirrus: bitblt - memory-to-memory copy is requested\n");
940 #endif
941 	goto bitblt_ignore;
942     }
943 
944     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
945         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
946                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
947                                CIRRUS_BLTMODE_PATTERNCOPY |
948                                CIRRUS_BLTMODE_COLOREXPAND)) ==
949          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
950         cirrus_bitblt_fgcol(s);
951         cirrus_bitblt_solidfill(s, blt_rop);
952     } else {
953         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
954                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
955             CIRRUS_BLTMODE_COLOREXPAND) {
956 
957             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
958                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
959                     cirrus_bitblt_bgcol(s);
960                 else
961                     cirrus_bitblt_fgcol(s);
962                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
963             } else {
964                 cirrus_bitblt_fgcol(s);
965                 cirrus_bitblt_bgcol(s);
966                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
967             }
968         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
969             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
970                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
971                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
972                         cirrus_bitblt_bgcol(s);
973                     else
974                         cirrus_bitblt_fgcol(s);
975                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
976                 } else {
977                     cirrus_bitblt_fgcol(s);
978                     cirrus_bitblt_bgcol(s);
979                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
980                 }
981             } else {
982                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
983             }
984         } else {
985 	    if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
986 		if (s->cirrus_blt_pixelwidth > 2) {
987 		    printf("src transparent without colorexpand must be 8bpp or 16bpp\n");
988 		    goto bitblt_ignore;
989 		}
990 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
991 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
992 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
993 		    s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
994 		} else {
995 		    s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
996 		}
997 	    } else {
998 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
999 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1000 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1001 		    s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1002 		} else {
1003 		    s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1004 		}
1005 	    }
1006 	}
1007         // setup bitblt engine.
1008         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1009             if (!cirrus_bitblt_cputovideo(s))
1010                 goto bitblt_ignore;
1011         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1012             if (!cirrus_bitblt_videotocpu(s))
1013                 goto bitblt_ignore;
1014         } else {
1015             if (!cirrus_bitblt_videotovideo(s))
1016                 goto bitblt_ignore;
1017         }
1018     }
1019     return;
1020   bitblt_ignore:;
1021     cirrus_bitblt_reset(s);
1022 }
1023 
1024 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1025 {
1026     unsigned old_value;
1027 
1028     old_value = s->vga.gr[0x31];
1029     s->vga.gr[0x31] = reg_value;
1030 
1031     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1032 	((reg_value & CIRRUS_BLT_RESET) == 0)) {
1033 	cirrus_bitblt_reset(s);
1034     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1035 	       ((reg_value & CIRRUS_BLT_START) != 0)) {
1036 	cirrus_bitblt_start(s);
1037     }
1038 }
1039 
1040 
1041 /***************************************
1042  *
1043  *  basic parameters
1044  *
1045  ***************************************/
1046 
1047 static void cirrus_get_offsets(VGACommonState *s1,
1048                                uint32_t *pline_offset,
1049                                uint32_t *pstart_addr,
1050                                uint32_t *pline_compare)
1051 {
1052     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1053     uint32_t start_addr, line_offset, line_compare;
1054 
1055     line_offset = s->vga.cr[0x13]
1056 	| ((s->vga.cr[0x1b] & 0x10) << 4);
1057     line_offset <<= 3;
1058     *pline_offset = line_offset;
1059 
1060     start_addr = (s->vga.cr[0x0c] << 8)
1061 	| s->vga.cr[0x0d]
1062 	| ((s->vga.cr[0x1b] & 0x01) << 16)
1063 	| ((s->vga.cr[0x1b] & 0x0c) << 15)
1064 	| ((s->vga.cr[0x1d] & 0x80) << 12);
1065     *pstart_addr = start_addr;
1066 
1067     line_compare = s->vga.cr[0x18] |
1068         ((s->vga.cr[0x07] & 0x10) << 4) |
1069         ((s->vga.cr[0x09] & 0x40) << 3);
1070     *pline_compare = line_compare;
1071 }
1072 
1073 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1074 {
1075     uint32_t ret = 16;
1076 
1077     switch (s->cirrus_hidden_dac_data & 0xf) {
1078     case 0:
1079 	ret = 15;
1080 	break;			/* Sierra HiColor */
1081     case 1:
1082 	ret = 16;
1083 	break;			/* XGA HiColor */
1084     default:
1085 #ifdef DEBUG_CIRRUS
1086 	printf("cirrus: invalid DAC value %x in 16bpp\n",
1087 	       (s->cirrus_hidden_dac_data & 0xf));
1088 #endif
1089 	ret = 15;		/* XXX */
1090 	break;
1091     }
1092     return ret;
1093 }
1094 
1095 static int cirrus_get_bpp(VGACommonState *s1)
1096 {
1097     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1098     uint32_t ret = 8;
1099 
1100     if ((s->vga.sr[0x07] & 0x01) != 0) {
1101 	/* Cirrus SVGA */
1102 	switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1103 	case CIRRUS_SR7_BPP_8:
1104 	    ret = 8;
1105 	    break;
1106 	case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1107 	    ret = cirrus_get_bpp16_depth(s);
1108 	    break;
1109 	case CIRRUS_SR7_BPP_24:
1110 	    ret = 24;
1111 	    break;
1112 	case CIRRUS_SR7_BPP_16:
1113 	    ret = cirrus_get_bpp16_depth(s);
1114 	    break;
1115 	case CIRRUS_SR7_BPP_32:
1116 	    ret = 32;
1117 	    break;
1118 	default:
1119 #ifdef DEBUG_CIRRUS
1120 	    printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1121 #endif
1122 	    ret = 8;
1123 	    break;
1124 	}
1125     } else {
1126 	/* VGA */
1127 	ret = 0;
1128     }
1129 
1130     return ret;
1131 }
1132 
1133 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1134 {
1135     int width, height;
1136 
1137     width = (s->cr[0x01] + 1) * 8;
1138     height = s->cr[0x12] |
1139         ((s->cr[0x07] & 0x02) << 7) |
1140         ((s->cr[0x07] & 0x40) << 3);
1141     height = (height + 1);
1142     /* interlace support */
1143     if (s->cr[0x1a] & 0x01)
1144         height = height * 2;
1145     *pwidth = width;
1146     *pheight = height;
1147 }
1148 
1149 /***************************************
1150  *
1151  * bank memory
1152  *
1153  ***************************************/
1154 
1155 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1156 {
1157     unsigned offset;
1158     unsigned limit;
1159 
1160     if ((s->vga.gr[0x0b] & 0x01) != 0)	/* dual bank */
1161 	offset = s->vga.gr[0x09 + bank_index];
1162     else			/* single bank */
1163 	offset = s->vga.gr[0x09];
1164 
1165     if ((s->vga.gr[0x0b] & 0x20) != 0)
1166 	offset <<= 14;
1167     else
1168 	offset <<= 12;
1169 
1170     if (s->real_vram_size <= offset)
1171 	limit = 0;
1172     else
1173 	limit = s->real_vram_size - offset;
1174 
1175     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1176 	if (limit > 0x8000) {
1177 	    offset += 0x8000;
1178 	    limit -= 0x8000;
1179 	} else {
1180 	    limit = 0;
1181 	}
1182     }
1183 
1184     if (limit > 0) {
1185 	s->cirrus_bank_base[bank_index] = offset;
1186 	s->cirrus_bank_limit[bank_index] = limit;
1187     } else {
1188 	s->cirrus_bank_base[bank_index] = 0;
1189 	s->cirrus_bank_limit[bank_index] = 0;
1190     }
1191 }
1192 
1193 /***************************************
1194  *
1195  *  I/O access between 0x3c4-0x3c5
1196  *
1197  ***************************************/
1198 
1199 static int cirrus_vga_read_sr(CirrusVGAState * s)
1200 {
1201     switch (s->vga.sr_index) {
1202     case 0x00:			// Standard VGA
1203     case 0x01:			// Standard VGA
1204     case 0x02:			// Standard VGA
1205     case 0x03:			// Standard VGA
1206     case 0x04:			// Standard VGA
1207 	return s->vga.sr[s->vga.sr_index];
1208     case 0x06:			// Unlock Cirrus extensions
1209 	return s->vga.sr[s->vga.sr_index];
1210     case 0x10:
1211     case 0x30:
1212     case 0x50:
1213     case 0x70:			// Graphics Cursor X
1214     case 0x90:
1215     case 0xb0:
1216     case 0xd0:
1217     case 0xf0:			// Graphics Cursor X
1218 	return s->vga.sr[0x10];
1219     case 0x11:
1220     case 0x31:
1221     case 0x51:
1222     case 0x71:			// Graphics Cursor Y
1223     case 0x91:
1224     case 0xb1:
1225     case 0xd1:
1226     case 0xf1:			// Graphics Cursor Y
1227 	return s->vga.sr[0x11];
1228     case 0x05:			// ???
1229     case 0x07:			// Extended Sequencer Mode
1230     case 0x08:			// EEPROM Control
1231     case 0x09:			// Scratch Register 0
1232     case 0x0a:			// Scratch Register 1
1233     case 0x0b:			// VCLK 0
1234     case 0x0c:			// VCLK 1
1235     case 0x0d:			// VCLK 2
1236     case 0x0e:			// VCLK 3
1237     case 0x0f:			// DRAM Control
1238     case 0x12:			// Graphics Cursor Attribute
1239     case 0x13:			// Graphics Cursor Pattern Address
1240     case 0x14:			// Scratch Register 2
1241     case 0x15:			// Scratch Register 3
1242     case 0x16:			// Performance Tuning Register
1243     case 0x17:			// Configuration Readback and Extended Control
1244     case 0x18:			// Signature Generator Control
1245     case 0x19:			// Signal Generator Result
1246     case 0x1a:			// Signal Generator Result
1247     case 0x1b:			// VCLK 0 Denominator & Post
1248     case 0x1c:			// VCLK 1 Denominator & Post
1249     case 0x1d:			// VCLK 2 Denominator & Post
1250     case 0x1e:			// VCLK 3 Denominator & Post
1251     case 0x1f:			// BIOS Write Enable and MCLK select
1252 #ifdef DEBUG_CIRRUS
1253 	printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1254 #endif
1255 	return s->vga.sr[s->vga.sr_index];
1256     default:
1257 #ifdef DEBUG_CIRRUS
1258 	printf("cirrus: inport sr_index %02x\n", s->vga.sr_index);
1259 #endif
1260 	return 0xff;
1261 	break;
1262     }
1263 }
1264 
1265 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1266 {
1267     switch (s->vga.sr_index) {
1268     case 0x00:			// Standard VGA
1269     case 0x01:			// Standard VGA
1270     case 0x02:			// Standard VGA
1271     case 0x03:			// Standard VGA
1272     case 0x04:			// Standard VGA
1273 	s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1274 	if (s->vga.sr_index == 1)
1275             s->vga.update_retrace_info(&s->vga);
1276         break;
1277     case 0x06:			// Unlock Cirrus extensions
1278 	val &= 0x17;
1279 	if (val == 0x12) {
1280 	    s->vga.sr[s->vga.sr_index] = 0x12;
1281 	} else {
1282 	    s->vga.sr[s->vga.sr_index] = 0x0f;
1283 	}
1284 	break;
1285     case 0x10:
1286     case 0x30:
1287     case 0x50:
1288     case 0x70:			// Graphics Cursor X
1289     case 0x90:
1290     case 0xb0:
1291     case 0xd0:
1292     case 0xf0:			// Graphics Cursor X
1293 	s->vga.sr[0x10] = val;
1294 	s->hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1295 	break;
1296     case 0x11:
1297     case 0x31:
1298     case 0x51:
1299     case 0x71:			// Graphics Cursor Y
1300     case 0x91:
1301     case 0xb1:
1302     case 0xd1:
1303     case 0xf1:			// Graphics Cursor Y
1304 	s->vga.sr[0x11] = val;
1305 	s->hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1306 	break;
1307     case 0x07:			// Extended Sequencer Mode
1308     cirrus_update_memory_access(s);
1309     case 0x08:			// EEPROM Control
1310     case 0x09:			// Scratch Register 0
1311     case 0x0a:			// Scratch Register 1
1312     case 0x0b:			// VCLK 0
1313     case 0x0c:			// VCLK 1
1314     case 0x0d:			// VCLK 2
1315     case 0x0e:			// VCLK 3
1316     case 0x0f:			// DRAM Control
1317     case 0x12:			// Graphics Cursor Attribute
1318     case 0x13:			// Graphics Cursor Pattern Address
1319     case 0x14:			// Scratch Register 2
1320     case 0x15:			// Scratch Register 3
1321     case 0x16:			// Performance Tuning Register
1322     case 0x18:			// Signature Generator Control
1323     case 0x19:			// Signature Generator Result
1324     case 0x1a:			// Signature Generator Result
1325     case 0x1b:			// VCLK 0 Denominator & Post
1326     case 0x1c:			// VCLK 1 Denominator & Post
1327     case 0x1d:			// VCLK 2 Denominator & Post
1328     case 0x1e:			// VCLK 3 Denominator & Post
1329     case 0x1f:			// BIOS Write Enable and MCLK select
1330 	s->vga.sr[s->vga.sr_index] = val;
1331 #ifdef DEBUG_CIRRUS
1332 	printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1333 	       s->vga.sr_index, val);
1334 #endif
1335 	break;
1336     case 0x17:			// Configuration Readback and Extended Control
1337 	s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1338                                    | (val & 0xc7);
1339         cirrus_update_memory_access(s);
1340         break;
1341     default:
1342 #ifdef DEBUG_CIRRUS
1343 	printf("cirrus: outport sr_index %02x, sr_value %02x\n",
1344                s->vga.sr_index, val);
1345 #endif
1346 	break;
1347     }
1348 }
1349 
1350 /***************************************
1351  *
1352  *  I/O access at 0x3c6
1353  *
1354  ***************************************/
1355 
1356 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1357 {
1358     if (++s->cirrus_hidden_dac_lockindex == 5) {
1359         s->cirrus_hidden_dac_lockindex = 0;
1360         return s->cirrus_hidden_dac_data;
1361     }
1362     return 0xff;
1363 }
1364 
1365 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1366 {
1367     if (s->cirrus_hidden_dac_lockindex == 4) {
1368 	s->cirrus_hidden_dac_data = reg_value;
1369 #if defined(DEBUG_CIRRUS)
1370 	printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1371 #endif
1372     }
1373     s->cirrus_hidden_dac_lockindex = 0;
1374 }
1375 
1376 /***************************************
1377  *
1378  *  I/O access at 0x3c9
1379  *
1380  ***************************************/
1381 
1382 static int cirrus_vga_read_palette(CirrusVGAState * s)
1383 {
1384     int val;
1385 
1386     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1387         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1388                                        s->vga.dac_sub_index];
1389     } else {
1390         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1391     }
1392     if (++s->vga.dac_sub_index == 3) {
1393 	s->vga.dac_sub_index = 0;
1394 	s->vga.dac_read_index++;
1395     }
1396     return val;
1397 }
1398 
1399 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1400 {
1401     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1402     if (++s->vga.dac_sub_index == 3) {
1403         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1404             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1405                    s->vga.dac_cache, 3);
1406         } else {
1407             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1408         }
1409         /* XXX update cursor */
1410 	s->vga.dac_sub_index = 0;
1411 	s->vga.dac_write_index++;
1412     }
1413 }
1414 
1415 /***************************************
1416  *
1417  *  I/O access between 0x3ce-0x3cf
1418  *
1419  ***************************************/
1420 
1421 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1422 {
1423     switch (reg_index) {
1424     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1425         return s->cirrus_shadow_gr0;
1426     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1427         return s->cirrus_shadow_gr1;
1428     case 0x02:			// Standard VGA
1429     case 0x03:			// Standard VGA
1430     case 0x04:			// Standard VGA
1431     case 0x06:			// Standard VGA
1432     case 0x07:			// Standard VGA
1433     case 0x08:			// Standard VGA
1434         return s->vga.gr[s->vga.gr_index];
1435     case 0x05:			// Standard VGA, Cirrus extended mode
1436     default:
1437 	break;
1438     }
1439 
1440     if (reg_index < 0x3a) {
1441 	return s->vga.gr[reg_index];
1442     } else {
1443 #ifdef DEBUG_CIRRUS
1444 	printf("cirrus: inport gr_index %02x\n", reg_index);
1445 #endif
1446 	return 0xff;
1447     }
1448 }
1449 
1450 static void
1451 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1452 {
1453 #if defined(DEBUG_BITBLT) && 0
1454     printf("gr%02x: %02x\n", reg_index, reg_value);
1455 #endif
1456     switch (reg_index) {
1457     case 0x00:			// Standard VGA, BGCOLOR 0x000000ff
1458 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1459 	s->cirrus_shadow_gr0 = reg_value;
1460 	break;
1461     case 0x01:			// Standard VGA, FGCOLOR 0x000000ff
1462 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1463 	s->cirrus_shadow_gr1 = reg_value;
1464 	break;
1465     case 0x02:			// Standard VGA
1466     case 0x03:			// Standard VGA
1467     case 0x04:			// Standard VGA
1468     case 0x06:			// Standard VGA
1469     case 0x07:			// Standard VGA
1470     case 0x08:			// Standard VGA
1471 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1472         break;
1473     case 0x05:			// Standard VGA, Cirrus extended mode
1474 	s->vga.gr[reg_index] = reg_value & 0x7f;
1475         cirrus_update_memory_access(s);
1476 	break;
1477     case 0x09:			// bank offset #0
1478     case 0x0A:			// bank offset #1
1479 	s->vga.gr[reg_index] = reg_value;
1480 	cirrus_update_bank_ptr(s, 0);
1481 	cirrus_update_bank_ptr(s, 1);
1482         cirrus_update_memory_access(s);
1483         break;
1484     case 0x0B:
1485 	s->vga.gr[reg_index] = reg_value;
1486 	cirrus_update_bank_ptr(s, 0);
1487 	cirrus_update_bank_ptr(s, 1);
1488         cirrus_update_memory_access(s);
1489 	break;
1490     case 0x10:			// BGCOLOR 0x0000ff00
1491     case 0x11:			// FGCOLOR 0x0000ff00
1492     case 0x12:			// BGCOLOR 0x00ff0000
1493     case 0x13:			// FGCOLOR 0x00ff0000
1494     case 0x14:			// BGCOLOR 0xff000000
1495     case 0x15:			// FGCOLOR 0xff000000
1496     case 0x20:			// BLT WIDTH 0x0000ff
1497     case 0x22:			// BLT HEIGHT 0x0000ff
1498     case 0x24:			// BLT DEST PITCH 0x0000ff
1499     case 0x26:			// BLT SRC PITCH 0x0000ff
1500     case 0x28:			// BLT DEST ADDR 0x0000ff
1501     case 0x29:			// BLT DEST ADDR 0x00ff00
1502     case 0x2c:			// BLT SRC ADDR 0x0000ff
1503     case 0x2d:			// BLT SRC ADDR 0x00ff00
1504     case 0x2f:                  // BLT WRITEMASK
1505     case 0x30:			// BLT MODE
1506     case 0x32:			// RASTER OP
1507     case 0x33:			// BLT MODEEXT
1508     case 0x34:			// BLT TRANSPARENT COLOR 0x00ff
1509     case 0x35:			// BLT TRANSPARENT COLOR 0xff00
1510     case 0x38:			// BLT TRANSPARENT COLOR MASK 0x00ff
1511     case 0x39:			// BLT TRANSPARENT COLOR MASK 0xff00
1512 	s->vga.gr[reg_index] = reg_value;
1513 	break;
1514     case 0x21:			// BLT WIDTH 0x001f00
1515     case 0x23:			// BLT HEIGHT 0x001f00
1516     case 0x25:			// BLT DEST PITCH 0x001f00
1517     case 0x27:			// BLT SRC PITCH 0x001f00
1518 	s->vga.gr[reg_index] = reg_value & 0x1f;
1519 	break;
1520     case 0x2a:			// BLT DEST ADDR 0x3f0000
1521 	s->vga.gr[reg_index] = reg_value & 0x3f;
1522         /* if auto start mode, starts bit blt now */
1523         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1524             cirrus_bitblt_start(s);
1525         }
1526 	break;
1527     case 0x2e:			// BLT SRC ADDR 0x3f0000
1528 	s->vga.gr[reg_index] = reg_value & 0x3f;
1529 	break;
1530     case 0x31:			// BLT STATUS/START
1531 	cirrus_write_bitblt(s, reg_value);
1532 	break;
1533     default:
1534 #ifdef DEBUG_CIRRUS
1535 	printf("cirrus: outport gr_index %02x, gr_value %02x\n", reg_index,
1536 	       reg_value);
1537 #endif
1538 	break;
1539     }
1540 }
1541 
1542 /***************************************
1543  *
1544  *  I/O access between 0x3d4-0x3d5
1545  *
1546  ***************************************/
1547 
1548 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1549 {
1550     switch (reg_index) {
1551     case 0x00:			// Standard VGA
1552     case 0x01:			// Standard VGA
1553     case 0x02:			// Standard VGA
1554     case 0x03:			// Standard VGA
1555     case 0x04:			// Standard VGA
1556     case 0x05:			// Standard VGA
1557     case 0x06:			// Standard VGA
1558     case 0x07:			// Standard VGA
1559     case 0x08:			// Standard VGA
1560     case 0x09:			// Standard VGA
1561     case 0x0a:			// Standard VGA
1562     case 0x0b:			// Standard VGA
1563     case 0x0c:			// Standard VGA
1564     case 0x0d:			// Standard VGA
1565     case 0x0e:			// Standard VGA
1566     case 0x0f:			// Standard VGA
1567     case 0x10:			// Standard VGA
1568     case 0x11:			// Standard VGA
1569     case 0x12:			// Standard VGA
1570     case 0x13:			// Standard VGA
1571     case 0x14:			// Standard VGA
1572     case 0x15:			// Standard VGA
1573     case 0x16:			// Standard VGA
1574     case 0x17:			// Standard VGA
1575     case 0x18:			// Standard VGA
1576 	return s->vga.cr[s->vga.cr_index];
1577     case 0x24:			// Attribute Controller Toggle Readback (R)
1578         return (s->vga.ar_flip_flop << 7);
1579     case 0x19:			// Interlace End
1580     case 0x1a:			// Miscellaneous Control
1581     case 0x1b:			// Extended Display Control
1582     case 0x1c:			// Sync Adjust and Genlock
1583     case 0x1d:			// Overlay Extended Control
1584     case 0x22:			// Graphics Data Latches Readback (R)
1585     case 0x25:			// Part Status
1586     case 0x27:			// Part ID (R)
1587 	return s->vga.cr[s->vga.cr_index];
1588     case 0x26:			// Attribute Controller Index Readback (R)
1589 	return s->vga.ar_index & 0x3f;
1590 	break;
1591     default:
1592 #ifdef DEBUG_CIRRUS
1593 	printf("cirrus: inport cr_index %02x\n", reg_index);
1594 #endif
1595 	return 0xff;
1596     }
1597 }
1598 
1599 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1600 {
1601     switch (s->vga.cr_index) {
1602     case 0x00:			// Standard VGA
1603     case 0x01:			// Standard VGA
1604     case 0x02:			// Standard VGA
1605     case 0x03:			// Standard VGA
1606     case 0x04:			// Standard VGA
1607     case 0x05:			// Standard VGA
1608     case 0x06:			// Standard VGA
1609     case 0x07:			// Standard VGA
1610     case 0x08:			// Standard VGA
1611     case 0x09:			// Standard VGA
1612     case 0x0a:			// Standard VGA
1613     case 0x0b:			// Standard VGA
1614     case 0x0c:			// Standard VGA
1615     case 0x0d:			// Standard VGA
1616     case 0x0e:			// Standard VGA
1617     case 0x0f:			// Standard VGA
1618     case 0x10:			// Standard VGA
1619     case 0x11:			// Standard VGA
1620     case 0x12:			// Standard VGA
1621     case 0x13:			// Standard VGA
1622     case 0x14:			// Standard VGA
1623     case 0x15:			// Standard VGA
1624     case 0x16:			// Standard VGA
1625     case 0x17:			// Standard VGA
1626     case 0x18:			// Standard VGA
1627 	/* handle CR0-7 protection */
1628 	if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1629 	    /* can always write bit 4 of CR7 */
1630 	    if (s->vga.cr_index == 7)
1631 		s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1632 	    return;
1633 	}
1634 	s->vga.cr[s->vga.cr_index] = reg_value;
1635 	switch(s->vga.cr_index) {
1636 	case 0x00:
1637 	case 0x04:
1638 	case 0x05:
1639 	case 0x06:
1640 	case 0x07:
1641 	case 0x11:
1642 	case 0x17:
1643 	    s->vga.update_retrace_info(&s->vga);
1644 	    break;
1645 	}
1646         break;
1647     case 0x19:			// Interlace End
1648     case 0x1a:			// Miscellaneous Control
1649     case 0x1b:			// Extended Display Control
1650     case 0x1c:			// Sync Adjust and Genlock
1651     case 0x1d:			// Overlay Extended Control
1652 	s->vga.cr[s->vga.cr_index] = reg_value;
1653 #ifdef DEBUG_CIRRUS
1654 	printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1655 	       s->vga.cr_index, reg_value);
1656 #endif
1657 	break;
1658     case 0x22:			// Graphics Data Latches Readback (R)
1659     case 0x24:			// Attribute Controller Toggle Readback (R)
1660     case 0x26:			// Attribute Controller Index Readback (R)
1661     case 0x27:			// Part ID (R)
1662 	break;
1663     case 0x25:			// Part Status
1664     default:
1665 #ifdef DEBUG_CIRRUS
1666 	printf("cirrus: outport cr_index %02x, cr_value %02x\n",
1667                s->vga.cr_index, reg_value);
1668 #endif
1669 	break;
1670     }
1671 }
1672 
1673 /***************************************
1674  *
1675  *  memory-mapped I/O (bitblt)
1676  *
1677  ***************************************/
1678 
1679 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1680 {
1681     int value = 0xff;
1682 
1683     switch (address) {
1684     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1685 	value = cirrus_vga_read_gr(s, 0x00);
1686 	break;
1687     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1688 	value = cirrus_vga_read_gr(s, 0x10);
1689 	break;
1690     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1691 	value = cirrus_vga_read_gr(s, 0x12);
1692 	break;
1693     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1694 	value = cirrus_vga_read_gr(s, 0x14);
1695 	break;
1696     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1697 	value = cirrus_vga_read_gr(s, 0x01);
1698 	break;
1699     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1700 	value = cirrus_vga_read_gr(s, 0x11);
1701 	break;
1702     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1703 	value = cirrus_vga_read_gr(s, 0x13);
1704 	break;
1705     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1706 	value = cirrus_vga_read_gr(s, 0x15);
1707 	break;
1708     case (CIRRUS_MMIO_BLTWIDTH + 0):
1709 	value = cirrus_vga_read_gr(s, 0x20);
1710 	break;
1711     case (CIRRUS_MMIO_BLTWIDTH + 1):
1712 	value = cirrus_vga_read_gr(s, 0x21);
1713 	break;
1714     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1715 	value = cirrus_vga_read_gr(s, 0x22);
1716 	break;
1717     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1718 	value = cirrus_vga_read_gr(s, 0x23);
1719 	break;
1720     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1721 	value = cirrus_vga_read_gr(s, 0x24);
1722 	break;
1723     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1724 	value = cirrus_vga_read_gr(s, 0x25);
1725 	break;
1726     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1727 	value = cirrus_vga_read_gr(s, 0x26);
1728 	break;
1729     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1730 	value = cirrus_vga_read_gr(s, 0x27);
1731 	break;
1732     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1733 	value = cirrus_vga_read_gr(s, 0x28);
1734 	break;
1735     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1736 	value = cirrus_vga_read_gr(s, 0x29);
1737 	break;
1738     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1739 	value = cirrus_vga_read_gr(s, 0x2a);
1740 	break;
1741     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1742 	value = cirrus_vga_read_gr(s, 0x2c);
1743 	break;
1744     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1745 	value = cirrus_vga_read_gr(s, 0x2d);
1746 	break;
1747     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1748 	value = cirrus_vga_read_gr(s, 0x2e);
1749 	break;
1750     case CIRRUS_MMIO_BLTWRITEMASK:
1751 	value = cirrus_vga_read_gr(s, 0x2f);
1752 	break;
1753     case CIRRUS_MMIO_BLTMODE:
1754 	value = cirrus_vga_read_gr(s, 0x30);
1755 	break;
1756     case CIRRUS_MMIO_BLTROP:
1757 	value = cirrus_vga_read_gr(s, 0x32);
1758 	break;
1759     case CIRRUS_MMIO_BLTMODEEXT:
1760 	value = cirrus_vga_read_gr(s, 0x33);
1761 	break;
1762     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1763 	value = cirrus_vga_read_gr(s, 0x34);
1764 	break;
1765     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1766 	value = cirrus_vga_read_gr(s, 0x35);
1767 	break;
1768     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1769 	value = cirrus_vga_read_gr(s, 0x38);
1770 	break;
1771     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1772 	value = cirrus_vga_read_gr(s, 0x39);
1773 	break;
1774     case CIRRUS_MMIO_BLTSTATUS:
1775 	value = cirrus_vga_read_gr(s, 0x31);
1776 	break;
1777     default:
1778 #ifdef DEBUG_CIRRUS
1779 	printf("cirrus: mmio read - address 0x%04x\n", address);
1780 #endif
1781 	break;
1782     }
1783 
1784     return (uint8_t) value;
1785 }
1786 
1787 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1788 				  uint8_t value)
1789 {
1790     switch (address) {
1791     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1792 	cirrus_vga_write_gr(s, 0x00, value);
1793 	break;
1794     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1795 	cirrus_vga_write_gr(s, 0x10, value);
1796 	break;
1797     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1798 	cirrus_vga_write_gr(s, 0x12, value);
1799 	break;
1800     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1801 	cirrus_vga_write_gr(s, 0x14, value);
1802 	break;
1803     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1804 	cirrus_vga_write_gr(s, 0x01, value);
1805 	break;
1806     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1807 	cirrus_vga_write_gr(s, 0x11, value);
1808 	break;
1809     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1810 	cirrus_vga_write_gr(s, 0x13, value);
1811 	break;
1812     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1813 	cirrus_vga_write_gr(s, 0x15, value);
1814 	break;
1815     case (CIRRUS_MMIO_BLTWIDTH + 0):
1816 	cirrus_vga_write_gr(s, 0x20, value);
1817 	break;
1818     case (CIRRUS_MMIO_BLTWIDTH + 1):
1819 	cirrus_vga_write_gr(s, 0x21, value);
1820 	break;
1821     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1822 	cirrus_vga_write_gr(s, 0x22, value);
1823 	break;
1824     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1825 	cirrus_vga_write_gr(s, 0x23, value);
1826 	break;
1827     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1828 	cirrus_vga_write_gr(s, 0x24, value);
1829 	break;
1830     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1831 	cirrus_vga_write_gr(s, 0x25, value);
1832 	break;
1833     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1834 	cirrus_vga_write_gr(s, 0x26, value);
1835 	break;
1836     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1837 	cirrus_vga_write_gr(s, 0x27, value);
1838 	break;
1839     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1840 	cirrus_vga_write_gr(s, 0x28, value);
1841 	break;
1842     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1843 	cirrus_vga_write_gr(s, 0x29, value);
1844 	break;
1845     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1846 	cirrus_vga_write_gr(s, 0x2a, value);
1847 	break;
1848     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1849 	/* ignored */
1850 	break;
1851     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1852 	cirrus_vga_write_gr(s, 0x2c, value);
1853 	break;
1854     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1855 	cirrus_vga_write_gr(s, 0x2d, value);
1856 	break;
1857     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1858 	cirrus_vga_write_gr(s, 0x2e, value);
1859 	break;
1860     case CIRRUS_MMIO_BLTWRITEMASK:
1861 	cirrus_vga_write_gr(s, 0x2f, value);
1862 	break;
1863     case CIRRUS_MMIO_BLTMODE:
1864 	cirrus_vga_write_gr(s, 0x30, value);
1865 	break;
1866     case CIRRUS_MMIO_BLTROP:
1867 	cirrus_vga_write_gr(s, 0x32, value);
1868 	break;
1869     case CIRRUS_MMIO_BLTMODEEXT:
1870 	cirrus_vga_write_gr(s, 0x33, value);
1871 	break;
1872     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1873 	cirrus_vga_write_gr(s, 0x34, value);
1874 	break;
1875     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1876 	cirrus_vga_write_gr(s, 0x35, value);
1877 	break;
1878     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1879 	cirrus_vga_write_gr(s, 0x38, value);
1880 	break;
1881     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1882 	cirrus_vga_write_gr(s, 0x39, value);
1883 	break;
1884     case CIRRUS_MMIO_BLTSTATUS:
1885 	cirrus_vga_write_gr(s, 0x31, value);
1886 	break;
1887     default:
1888 #ifdef DEBUG_CIRRUS
1889 	printf("cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1890 	       address, value);
1891 #endif
1892 	break;
1893     }
1894 }
1895 
1896 /***************************************
1897  *
1898  *  write mode 4/5
1899  *
1900  ***************************************/
1901 
1902 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1903 					     unsigned mode,
1904 					     unsigned offset,
1905 					     uint32_t mem_value)
1906 {
1907     int x;
1908     unsigned val = mem_value;
1909     uint8_t *dst;
1910 
1911     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1912     for (x = 0; x < 8; x++) {
1913 	if (val & 0x80) {
1914 	    *dst = s->cirrus_shadow_gr1;
1915 	} else if (mode == 5) {
1916 	    *dst = s->cirrus_shadow_gr0;
1917 	}
1918 	val <<= 1;
1919 	dst++;
1920     }
1921     memory_region_set_dirty(&s->vga.vram, offset, 8);
1922 }
1923 
1924 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
1925 					      unsigned mode,
1926 					      unsigned offset,
1927 					      uint32_t mem_value)
1928 {
1929     int x;
1930     unsigned val = mem_value;
1931     uint8_t *dst;
1932 
1933     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1934     for (x = 0; x < 8; x++) {
1935 	if (val & 0x80) {
1936 	    *dst = s->cirrus_shadow_gr1;
1937 	    *(dst + 1) = s->vga.gr[0x11];
1938 	} else if (mode == 5) {
1939 	    *dst = s->cirrus_shadow_gr0;
1940 	    *(dst + 1) = s->vga.gr[0x10];
1941 	}
1942 	val <<= 1;
1943 	dst += 2;
1944     }
1945     memory_region_set_dirty(&s->vga.vram, offset, 16);
1946 }
1947 
1948 /***************************************
1949  *
1950  *  memory access between 0xa0000-0xbffff
1951  *
1952  ***************************************/
1953 
1954 static uint64_t cirrus_vga_mem_read(void *opaque,
1955                                     hwaddr addr,
1956                                     uint32_t size)
1957 {
1958     CirrusVGAState *s = opaque;
1959     unsigned bank_index;
1960     unsigned bank_offset;
1961     uint32_t val;
1962 
1963     if ((s->vga.sr[0x07] & 0x01) == 0) {
1964         return vga_mem_readb(&s->vga, addr);
1965     }
1966 
1967     if (addr < 0x10000) {
1968 	/* XXX handle bitblt */
1969 	/* video memory */
1970 	bank_index = addr >> 15;
1971 	bank_offset = addr & 0x7fff;
1972 	if (bank_offset < s->cirrus_bank_limit[bank_index]) {
1973 	    bank_offset += s->cirrus_bank_base[bank_index];
1974 	    if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
1975 		bank_offset <<= 4;
1976 	    } else if (s->vga.gr[0x0B] & 0x02) {
1977 		bank_offset <<= 3;
1978 	    }
1979 	    bank_offset &= s->cirrus_addr_mask;
1980 	    val = *(s->vga.vram_ptr + bank_offset);
1981 	} else
1982 	    val = 0xff;
1983     } else if (addr >= 0x18000 && addr < 0x18100) {
1984 	/* memory-mapped I/O */
1985 	val = 0xff;
1986 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
1987 	    val = cirrus_mmio_blt_read(s, addr & 0xff);
1988 	}
1989     } else {
1990 	val = 0xff;
1991 #ifdef DEBUG_CIRRUS
1992 	printf("cirrus: mem_readb " TARGET_FMT_plx "\n", addr);
1993 #endif
1994     }
1995     return val;
1996 }
1997 
1998 static void cirrus_vga_mem_write(void *opaque,
1999                                  hwaddr addr,
2000                                  uint64_t mem_value,
2001                                  uint32_t size)
2002 {
2003     CirrusVGAState *s = opaque;
2004     unsigned bank_index;
2005     unsigned bank_offset;
2006     unsigned mode;
2007 
2008     if ((s->vga.sr[0x07] & 0x01) == 0) {
2009         vga_mem_writeb(&s->vga, addr, mem_value);
2010         return;
2011     }
2012 
2013     if (addr < 0x10000) {
2014 	if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2015 	    /* bitblt */
2016 	    *s->cirrus_srcptr++ = (uint8_t) mem_value;
2017 	    if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2018 		cirrus_bitblt_cputovideo_next(s);
2019 	    }
2020 	} else {
2021 	    /* video memory */
2022 	    bank_index = addr >> 15;
2023 	    bank_offset = addr & 0x7fff;
2024 	    if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2025 		bank_offset += s->cirrus_bank_base[bank_index];
2026 		if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2027 		    bank_offset <<= 4;
2028 		} else if (s->vga.gr[0x0B] & 0x02) {
2029 		    bank_offset <<= 3;
2030 		}
2031 		bank_offset &= s->cirrus_addr_mask;
2032 		mode = s->vga.gr[0x05] & 0x7;
2033 		if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2034 		    *(s->vga.vram_ptr + bank_offset) = mem_value;
2035                     memory_region_set_dirty(&s->vga.vram, bank_offset,
2036                                             sizeof(mem_value));
2037 		} else {
2038 		    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2039 			cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2040 							 bank_offset,
2041 							 mem_value);
2042 		    } else {
2043 			cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2044 							  bank_offset,
2045 							  mem_value);
2046 		    }
2047 		}
2048 	    }
2049 	}
2050     } else if (addr >= 0x18000 && addr < 0x18100) {
2051 	/* memory-mapped I/O */
2052 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2053 	    cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2054 	}
2055     } else {
2056 #ifdef DEBUG_CIRRUS
2057         printf("cirrus: mem_writeb " TARGET_FMT_plx " value %02x\n", addr,
2058                mem_value);
2059 #endif
2060     }
2061 }
2062 
2063 static const MemoryRegionOps cirrus_vga_mem_ops = {
2064     .read = cirrus_vga_mem_read,
2065     .write = cirrus_vga_mem_write,
2066     .endianness = DEVICE_LITTLE_ENDIAN,
2067     .impl = {
2068         .min_access_size = 1,
2069         .max_access_size = 1,
2070     },
2071 };
2072 
2073 /***************************************
2074  *
2075  *  hardware cursor
2076  *
2077  ***************************************/
2078 
2079 static inline void invalidate_cursor1(CirrusVGAState *s)
2080 {
2081     if (s->last_hw_cursor_size) {
2082         vga_invalidate_scanlines(&s->vga,
2083                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2084                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2085     }
2086 }
2087 
2088 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2089 {
2090     const uint8_t *src;
2091     uint32_t content;
2092     int y, y_min, y_max;
2093 
2094     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2095     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2096         src += (s->vga.sr[0x13] & 0x3c) * 256;
2097         y_min = 64;
2098         y_max = -1;
2099         for(y = 0; y < 64; y++) {
2100             content = ((uint32_t *)src)[0] |
2101                 ((uint32_t *)src)[1] |
2102                 ((uint32_t *)src)[2] |
2103                 ((uint32_t *)src)[3];
2104             if (content) {
2105                 if (y < y_min)
2106                     y_min = y;
2107                 if (y > y_max)
2108                     y_max = y;
2109             }
2110             src += 16;
2111         }
2112     } else {
2113         src += (s->vga.sr[0x13] & 0x3f) * 256;
2114         y_min = 32;
2115         y_max = -1;
2116         for(y = 0; y < 32; y++) {
2117             content = ((uint32_t *)src)[0] |
2118                 ((uint32_t *)(src + 128))[0];
2119             if (content) {
2120                 if (y < y_min)
2121                     y_min = y;
2122                 if (y > y_max)
2123                     y_max = y;
2124             }
2125             src += 4;
2126         }
2127     }
2128     if (y_min > y_max) {
2129         s->last_hw_cursor_y_start = 0;
2130         s->last_hw_cursor_y_end = 0;
2131     } else {
2132         s->last_hw_cursor_y_start = y_min;
2133         s->last_hw_cursor_y_end = y_max + 1;
2134     }
2135 }
2136 
2137 /* NOTE: we do not currently handle the cursor bitmap change, so we
2138    update the cursor only if it moves. */
2139 static void cirrus_cursor_invalidate(VGACommonState *s1)
2140 {
2141     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2142     int size;
2143 
2144     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2145         size = 0;
2146     } else {
2147         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2148             size = 64;
2149         else
2150             size = 32;
2151     }
2152     /* invalidate last cursor and new cursor if any change */
2153     if (s->last_hw_cursor_size != size ||
2154         s->last_hw_cursor_x != s->hw_cursor_x ||
2155         s->last_hw_cursor_y != s->hw_cursor_y) {
2156 
2157         invalidate_cursor1(s);
2158 
2159         s->last_hw_cursor_size = size;
2160         s->last_hw_cursor_x = s->hw_cursor_x;
2161         s->last_hw_cursor_y = s->hw_cursor_y;
2162         /* compute the real cursor min and max y */
2163         cirrus_cursor_compute_yrange(s);
2164         invalidate_cursor1(s);
2165     }
2166 }
2167 
2168 #define DEPTH 8
2169 #include "cirrus_vga_template.h"
2170 
2171 #define DEPTH 16
2172 #include "cirrus_vga_template.h"
2173 
2174 #define DEPTH 32
2175 #include "cirrus_vga_template.h"
2176 
2177 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2178 {
2179     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2180     DisplaySurface *surface = qemu_console_surface(s->vga.con);
2181     int w, h, bpp, x1, x2, poffset;
2182     unsigned int color0, color1;
2183     const uint8_t *palette, *src;
2184     uint32_t content;
2185 
2186     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2187         return;
2188     /* fast test to see if the cursor intersects with the scan line */
2189     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2190         h = 64;
2191     } else {
2192         h = 32;
2193     }
2194     if (scr_y < s->hw_cursor_y ||
2195         scr_y >= (s->hw_cursor_y + h))
2196         return;
2197 
2198     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2199     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2200         src += (s->vga.sr[0x13] & 0x3c) * 256;
2201         src += (scr_y - s->hw_cursor_y) * 16;
2202         poffset = 8;
2203         content = ((uint32_t *)src)[0] |
2204             ((uint32_t *)src)[1] |
2205             ((uint32_t *)src)[2] |
2206             ((uint32_t *)src)[3];
2207     } else {
2208         src += (s->vga.sr[0x13] & 0x3f) * 256;
2209         src += (scr_y - s->hw_cursor_y) * 4;
2210         poffset = 128;
2211         content = ((uint32_t *)src)[0] |
2212             ((uint32_t *)(src + 128))[0];
2213     }
2214     /* if nothing to draw, no need to continue */
2215     if (!content)
2216         return;
2217     w = h;
2218 
2219     x1 = s->hw_cursor_x;
2220     if (x1 >= s->vga.last_scr_width)
2221         return;
2222     x2 = s->hw_cursor_x + w;
2223     if (x2 > s->vga.last_scr_width)
2224         x2 = s->vga.last_scr_width;
2225     w = x2 - x1;
2226     palette = s->cirrus_hidden_palette;
2227     color0 = s->vga.rgb_to_pixel(c6_to_8(palette[0x0 * 3]),
2228                                  c6_to_8(palette[0x0 * 3 + 1]),
2229                                  c6_to_8(palette[0x0 * 3 + 2]));
2230     color1 = s->vga.rgb_to_pixel(c6_to_8(palette[0xf * 3]),
2231                                  c6_to_8(palette[0xf * 3 + 1]),
2232                                  c6_to_8(palette[0xf * 3 + 2]));
2233     bpp = surface_bytes_per_pixel(surface);
2234     d1 += x1 * bpp;
2235     switch (surface_bits_per_pixel(surface)) {
2236     default:
2237         break;
2238     case 8:
2239         vga_draw_cursor_line_8(d1, src, poffset, w, color0, color1, 0xff);
2240         break;
2241     case 15:
2242         vga_draw_cursor_line_16(d1, src, poffset, w, color0, color1, 0x7fff);
2243         break;
2244     case 16:
2245         vga_draw_cursor_line_16(d1, src, poffset, w, color0, color1, 0xffff);
2246         break;
2247     case 32:
2248         vga_draw_cursor_line_32(d1, src, poffset, w, color0, color1, 0xffffff);
2249         break;
2250     }
2251 }
2252 
2253 /***************************************
2254  *
2255  *  LFB memory access
2256  *
2257  ***************************************/
2258 
2259 static uint64_t cirrus_linear_read(void *opaque, hwaddr addr,
2260                                    unsigned size)
2261 {
2262     CirrusVGAState *s = opaque;
2263     uint32_t ret;
2264 
2265     addr &= s->cirrus_addr_mask;
2266 
2267     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2268         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2269 	/* memory-mapped I/O */
2270 	ret = cirrus_mmio_blt_read(s, addr & 0xff);
2271     } else if (0) {
2272 	/* XXX handle bitblt */
2273 	ret = 0xff;
2274     } else {
2275 	/* video memory */
2276 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2277 	    addr <<= 4;
2278 	} else if (s->vga.gr[0x0B] & 0x02) {
2279 	    addr <<= 3;
2280 	}
2281 	addr &= s->cirrus_addr_mask;
2282 	ret = *(s->vga.vram_ptr + addr);
2283     }
2284 
2285     return ret;
2286 }
2287 
2288 static void cirrus_linear_write(void *opaque, hwaddr addr,
2289                                 uint64_t val, unsigned size)
2290 {
2291     CirrusVGAState *s = opaque;
2292     unsigned mode;
2293 
2294     addr &= s->cirrus_addr_mask;
2295 
2296     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2297         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2298 	/* memory-mapped I/O */
2299 	cirrus_mmio_blt_write(s, addr & 0xff, val);
2300     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2301 	/* bitblt */
2302 	*s->cirrus_srcptr++ = (uint8_t) val;
2303 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2304 	    cirrus_bitblt_cputovideo_next(s);
2305 	}
2306     } else {
2307 	/* video memory */
2308 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2309 	    addr <<= 4;
2310 	} else if (s->vga.gr[0x0B] & 0x02) {
2311 	    addr <<= 3;
2312 	}
2313 	addr &= s->cirrus_addr_mask;
2314 
2315 	mode = s->vga.gr[0x05] & 0x7;
2316 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2317 	    *(s->vga.vram_ptr + addr) = (uint8_t) val;
2318             memory_region_set_dirty(&s->vga.vram, addr, 1);
2319 	} else {
2320 	    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2321 		cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2322 	    } else {
2323 		cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2324 	    }
2325 	}
2326     }
2327 }
2328 
2329 /***************************************
2330  *
2331  *  system to screen memory access
2332  *
2333  ***************************************/
2334 
2335 
2336 static uint64_t cirrus_linear_bitblt_read(void *opaque,
2337                                           hwaddr addr,
2338                                           unsigned size)
2339 {
2340     CirrusVGAState *s = opaque;
2341     uint32_t ret;
2342 
2343     /* XXX handle bitblt */
2344     (void)s;
2345     ret = 0xff;
2346     return ret;
2347 }
2348 
2349 static void cirrus_linear_bitblt_write(void *opaque,
2350                                        hwaddr addr,
2351                                        uint64_t val,
2352                                        unsigned size)
2353 {
2354     CirrusVGAState *s = opaque;
2355 
2356     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2357 	/* bitblt */
2358 	*s->cirrus_srcptr++ = (uint8_t) val;
2359 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2360 	    cirrus_bitblt_cputovideo_next(s);
2361 	}
2362     }
2363 }
2364 
2365 static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
2366     .read = cirrus_linear_bitblt_read,
2367     .write = cirrus_linear_bitblt_write,
2368     .endianness = DEVICE_LITTLE_ENDIAN,
2369     .impl = {
2370         .min_access_size = 1,
2371         .max_access_size = 1,
2372     },
2373 };
2374 
2375 static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
2376 {
2377     MemoryRegion *mr = &s->cirrus_bank[bank];
2378     bool enabled = !(s->cirrus_srcptr != s->cirrus_srcptr_end)
2379         && !((s->vga.sr[0x07] & 0x01) == 0)
2380         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2381         && !(s->vga.gr[0x0B] & 0x02);
2382 
2383     memory_region_set_enabled(mr, enabled);
2384     memory_region_set_alias_offset(mr, s->cirrus_bank_base[bank]);
2385 }
2386 
2387 static void map_linear_vram(CirrusVGAState *s)
2388 {
2389     if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
2390         s->linear_vram = true;
2391         memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
2392     }
2393     map_linear_vram_bank(s, 0);
2394     map_linear_vram_bank(s, 1);
2395 }
2396 
2397 static void unmap_linear_vram(CirrusVGAState *s)
2398 {
2399     if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
2400         s->linear_vram = false;
2401         memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
2402     }
2403     memory_region_set_enabled(&s->cirrus_bank[0], false);
2404     memory_region_set_enabled(&s->cirrus_bank[1], false);
2405 }
2406 
2407 /* Compute the memory access functions */
2408 static void cirrus_update_memory_access(CirrusVGAState *s)
2409 {
2410     unsigned mode;
2411 
2412     memory_region_transaction_begin();
2413     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2414         goto generic_io;
2415     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2416         goto generic_io;
2417     } else {
2418 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2419             goto generic_io;
2420 	} else if (s->vga.gr[0x0B] & 0x02) {
2421             goto generic_io;
2422         }
2423 
2424 	mode = s->vga.gr[0x05] & 0x7;
2425 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2426             map_linear_vram(s);
2427         } else {
2428         generic_io:
2429             unmap_linear_vram(s);
2430         }
2431     }
2432     memory_region_transaction_commit();
2433 }
2434 
2435 
2436 /* I/O ports */
2437 
2438 static uint64_t cirrus_vga_ioport_read(void *opaque, hwaddr addr,
2439                                        unsigned size)
2440 {
2441     CirrusVGAState *c = opaque;
2442     VGACommonState *s = &c->vga;
2443     int val, index;
2444 
2445     qemu_flush_coalesced_mmio_buffer();
2446     addr += 0x3b0;
2447 
2448     if (vga_ioport_invalid(s, addr)) {
2449 	val = 0xff;
2450     } else {
2451 	switch (addr) {
2452 	case 0x3c0:
2453 	    if (s->ar_flip_flop == 0) {
2454 		val = s->ar_index;
2455 	    } else {
2456 		val = 0;
2457 	    }
2458 	    break;
2459 	case 0x3c1:
2460 	    index = s->ar_index & 0x1f;
2461 	    if (index < 21)
2462 		val = s->ar[index];
2463 	    else
2464 		val = 0;
2465 	    break;
2466 	case 0x3c2:
2467 	    val = s->st00;
2468 	    break;
2469 	case 0x3c4:
2470 	    val = s->sr_index;
2471 	    break;
2472 	case 0x3c5:
2473 	    val = cirrus_vga_read_sr(c);
2474             break;
2475 #ifdef DEBUG_VGA_REG
2476 	    printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
2477 #endif
2478 	    break;
2479 	case 0x3c6:
2480 	    val = cirrus_read_hidden_dac(c);
2481 	    break;
2482 	case 0x3c7:
2483 	    val = s->dac_state;
2484 	    break;
2485 	case 0x3c8:
2486 	    val = s->dac_write_index;
2487 	    c->cirrus_hidden_dac_lockindex = 0;
2488 	    break;
2489         case 0x3c9:
2490             val = cirrus_vga_read_palette(c);
2491             break;
2492 	case 0x3ca:
2493 	    val = s->fcr;
2494 	    break;
2495 	case 0x3cc:
2496 	    val = s->msr;
2497 	    break;
2498 	case 0x3ce:
2499 	    val = s->gr_index;
2500 	    break;
2501 	case 0x3cf:
2502 	    val = cirrus_vga_read_gr(c, s->gr_index);
2503 #ifdef DEBUG_VGA_REG
2504 	    printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
2505 #endif
2506 	    break;
2507 	case 0x3b4:
2508 	case 0x3d4:
2509 	    val = s->cr_index;
2510 	    break;
2511 	case 0x3b5:
2512 	case 0x3d5:
2513             val = cirrus_vga_read_cr(c, s->cr_index);
2514 #ifdef DEBUG_VGA_REG
2515 	    printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
2516 #endif
2517 	    break;
2518 	case 0x3ba:
2519 	case 0x3da:
2520 	    /* just toggle to fool polling */
2521 	    val = s->st01 = s->retrace(s);
2522 	    s->ar_flip_flop = 0;
2523 	    break;
2524 	default:
2525 	    val = 0x00;
2526 	    break;
2527 	}
2528     }
2529 #if defined(DEBUG_VGA)
2530     printf("VGA: read addr=0x%04x data=0x%02x\n", addr, val);
2531 #endif
2532     return val;
2533 }
2534 
2535 static void cirrus_vga_ioport_write(void *opaque, hwaddr addr, uint64_t val,
2536                                     unsigned size)
2537 {
2538     CirrusVGAState *c = opaque;
2539     VGACommonState *s = &c->vga;
2540     int index;
2541 
2542     qemu_flush_coalesced_mmio_buffer();
2543     addr += 0x3b0;
2544 
2545     /* check port range access depending on color/monochrome mode */
2546     if (vga_ioport_invalid(s, addr)) {
2547 	return;
2548     }
2549 #ifdef DEBUG_VGA
2550     printf("VGA: write addr=0x%04x data=0x%02x\n", addr, val);
2551 #endif
2552 
2553     switch (addr) {
2554     case 0x3c0:
2555 	if (s->ar_flip_flop == 0) {
2556 	    val &= 0x3f;
2557 	    s->ar_index = val;
2558 	} else {
2559 	    index = s->ar_index & 0x1f;
2560 	    switch (index) {
2561 	    case 0x00 ... 0x0f:
2562 		s->ar[index] = val & 0x3f;
2563 		break;
2564 	    case 0x10:
2565 		s->ar[index] = val & ~0x10;
2566 		break;
2567 	    case 0x11:
2568 		s->ar[index] = val;
2569 		break;
2570 	    case 0x12:
2571 		s->ar[index] = val & ~0xc0;
2572 		break;
2573 	    case 0x13:
2574 		s->ar[index] = val & ~0xf0;
2575 		break;
2576 	    case 0x14:
2577 		s->ar[index] = val & ~0xf0;
2578 		break;
2579 	    default:
2580 		break;
2581 	    }
2582 	}
2583 	s->ar_flip_flop ^= 1;
2584 	break;
2585     case 0x3c2:
2586 	s->msr = val & ~0x10;
2587 	s->update_retrace_info(s);
2588 	break;
2589     case 0x3c4:
2590 	s->sr_index = val;
2591 	break;
2592     case 0x3c5:
2593 #ifdef DEBUG_VGA_REG
2594 	printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
2595 #endif
2596 	cirrus_vga_write_sr(c, val);
2597         break;
2598 	break;
2599     case 0x3c6:
2600 	cirrus_write_hidden_dac(c, val);
2601 	break;
2602     case 0x3c7:
2603 	s->dac_read_index = val;
2604 	s->dac_sub_index = 0;
2605 	s->dac_state = 3;
2606 	break;
2607     case 0x3c8:
2608 	s->dac_write_index = val;
2609 	s->dac_sub_index = 0;
2610 	s->dac_state = 0;
2611 	break;
2612     case 0x3c9:
2613         cirrus_vga_write_palette(c, val);
2614         break;
2615     case 0x3ce:
2616 	s->gr_index = val;
2617 	break;
2618     case 0x3cf:
2619 #ifdef DEBUG_VGA_REG
2620 	printf("vga: write GR%x = 0x%02x\n", s->gr_index, val);
2621 #endif
2622 	cirrus_vga_write_gr(c, s->gr_index, val);
2623 	break;
2624     case 0x3b4:
2625     case 0x3d4:
2626 	s->cr_index = val;
2627 	break;
2628     case 0x3b5:
2629     case 0x3d5:
2630 #ifdef DEBUG_VGA_REG
2631 	printf("vga: write CR%x = 0x%02x\n", s->cr_index, val);
2632 #endif
2633 	cirrus_vga_write_cr(c, val);
2634 	break;
2635     case 0x3ba:
2636     case 0x3da:
2637 	s->fcr = val & 0x10;
2638 	break;
2639     }
2640 }
2641 
2642 /***************************************
2643  *
2644  *  memory-mapped I/O access
2645  *
2646  ***************************************/
2647 
2648 static uint64_t cirrus_mmio_read(void *opaque, hwaddr addr,
2649                                  unsigned size)
2650 {
2651     CirrusVGAState *s = opaque;
2652 
2653     if (addr >= 0x100) {
2654         return cirrus_mmio_blt_read(s, addr - 0x100);
2655     } else {
2656         return cirrus_vga_ioport_read(s, addr + 0x10, size);
2657     }
2658 }
2659 
2660 static void cirrus_mmio_write(void *opaque, hwaddr addr,
2661                               uint64_t val, unsigned size)
2662 {
2663     CirrusVGAState *s = opaque;
2664 
2665     if (addr >= 0x100) {
2666 	cirrus_mmio_blt_write(s, addr - 0x100, val);
2667     } else {
2668         cirrus_vga_ioport_write(s, addr + 0x10, val, size);
2669     }
2670 }
2671 
2672 static const MemoryRegionOps cirrus_mmio_io_ops = {
2673     .read = cirrus_mmio_read,
2674     .write = cirrus_mmio_write,
2675     .endianness = DEVICE_LITTLE_ENDIAN,
2676     .impl = {
2677         .min_access_size = 1,
2678         .max_access_size = 1,
2679     },
2680 };
2681 
2682 /* load/save state */
2683 
2684 static int cirrus_post_load(void *opaque, int version_id)
2685 {
2686     CirrusVGAState *s = opaque;
2687 
2688     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2689     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2690 
2691     cirrus_update_memory_access(s);
2692     /* force refresh */
2693     s->vga.graphic_mode = -1;
2694     cirrus_update_bank_ptr(s, 0);
2695     cirrus_update_bank_ptr(s, 1);
2696     return 0;
2697 }
2698 
2699 static const VMStateDescription vmstate_cirrus_vga = {
2700     .name = "cirrus_vga",
2701     .version_id = 2,
2702     .minimum_version_id = 1,
2703     .minimum_version_id_old = 1,
2704     .post_load = cirrus_post_load,
2705     .fields      = (VMStateField []) {
2706         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2707         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2708         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2709         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2710         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2711         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2712         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2713         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2714         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2715         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2716         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2717         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
2718         VMSTATE_UINT8(vga.msr, CirrusVGAState),
2719         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
2720         VMSTATE_UINT8(vga.st00, CirrusVGAState),
2721         VMSTATE_UINT8(vga.st01, CirrusVGAState),
2722         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
2723         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
2724         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
2725         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
2726         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
2727         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
2728         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
2729         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
2730         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
2731         VMSTATE_UINT32(hw_cursor_x, CirrusVGAState),
2732         VMSTATE_UINT32(hw_cursor_y, CirrusVGAState),
2733         /* XXX: we do not save the bitblt state - we assume we do not save
2734            the state when the blitter is active */
2735         VMSTATE_END_OF_LIST()
2736     }
2737 };
2738 
2739 static const VMStateDescription vmstate_pci_cirrus_vga = {
2740     .name = "cirrus_vga",
2741     .version_id = 2,
2742     .minimum_version_id = 2,
2743     .minimum_version_id_old = 2,
2744     .fields      = (VMStateField []) {
2745         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
2746         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
2747                        vmstate_cirrus_vga, CirrusVGAState),
2748         VMSTATE_END_OF_LIST()
2749     }
2750 };
2751 
2752 /***************************************
2753  *
2754  *  initialize
2755  *
2756  ***************************************/
2757 
2758 static void cirrus_reset(void *opaque)
2759 {
2760     CirrusVGAState *s = opaque;
2761 
2762     vga_common_reset(&s->vga);
2763     unmap_linear_vram(s);
2764     s->vga.sr[0x06] = 0x0f;
2765     if (s->device_id == CIRRUS_ID_CLGD5446) {
2766         /* 4MB 64 bit memory config, always PCI */
2767         s->vga.sr[0x1F] = 0x2d;		// MemClock
2768         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
2769         s->vga.sr[0x0f] = 0x98;
2770         s->vga.sr[0x17] = 0x20;
2771         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
2772     } else {
2773         s->vga.sr[0x1F] = 0x22;		// MemClock
2774         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
2775         s->vga.sr[0x17] = s->bustype;
2776         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
2777     }
2778     s->vga.cr[0x27] = s->device_id;
2779 
2780     s->cirrus_hidden_dac_lockindex = 5;
2781     s->cirrus_hidden_dac_data = 0;
2782 }
2783 
2784 static const MemoryRegionOps cirrus_linear_io_ops = {
2785     .read = cirrus_linear_read,
2786     .write = cirrus_linear_write,
2787     .endianness = DEVICE_LITTLE_ENDIAN,
2788     .impl = {
2789         .min_access_size = 1,
2790         .max_access_size = 1,
2791     },
2792 };
2793 
2794 static const MemoryRegionOps cirrus_vga_io_ops = {
2795     .read = cirrus_vga_ioport_read,
2796     .write = cirrus_vga_ioport_write,
2797     .endianness = DEVICE_LITTLE_ENDIAN,
2798     .impl = {
2799         .min_access_size = 1,
2800         .max_access_size = 1,
2801     },
2802 };
2803 
2804 static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
2805                                MemoryRegion *system_memory,
2806                                MemoryRegion *system_io)
2807 {
2808     int i;
2809     static int inited;
2810 
2811     if (!inited) {
2812         inited = 1;
2813         for(i = 0;i < 256; i++)
2814             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
2815         rop_to_index[CIRRUS_ROP_0] = 0;
2816         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
2817         rop_to_index[CIRRUS_ROP_NOP] = 2;
2818         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
2819         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
2820         rop_to_index[CIRRUS_ROP_SRC] = 5;
2821         rop_to_index[CIRRUS_ROP_1] = 6;
2822         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
2823         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
2824         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
2825         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
2826         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
2827         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
2828         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
2829         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
2830         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
2831         s->device_id = device_id;
2832         if (is_pci)
2833             s->bustype = CIRRUS_BUSTYPE_PCI;
2834         else
2835             s->bustype = CIRRUS_BUSTYPE_ISA;
2836     }
2837 
2838     /* Register ioport 0x3b0 - 0x3df */
2839     memory_region_init_io(&s->cirrus_vga_io, &cirrus_vga_io_ops, s,
2840                           "cirrus-io", 0x30);
2841     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
2842 
2843     memory_region_init(&s->low_mem_container,
2844                        "cirrus-lowmem-container",
2845                        0x20000);
2846 
2847     memory_region_init_io(&s->low_mem, &cirrus_vga_mem_ops, s,
2848                           "cirrus-low-memory", 0x20000);
2849     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
2850     for (i = 0; i < 2; ++i) {
2851         static const char *names[] = { "vga.bank0", "vga.bank1" };
2852         MemoryRegion *bank = &s->cirrus_bank[i];
2853         memory_region_init_alias(bank, names[i], &s->vga.vram, 0, 0x8000);
2854         memory_region_set_enabled(bank, false);
2855         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
2856                                             bank, 1);
2857     }
2858     memory_region_add_subregion_overlap(system_memory,
2859                                         isa_mem_base + 0x000a0000,
2860                                         &s->low_mem_container,
2861                                         1);
2862     memory_region_set_coalescing(&s->low_mem);
2863 
2864     /* I/O handler for LFB */
2865     memory_region_init_io(&s->cirrus_linear_io, &cirrus_linear_io_ops, s,
2866                           "cirrus-linear-io", s->vga.vram_size_mb
2867                                               * 1024 * 1024);
2868     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
2869 
2870     /* I/O handler for LFB */
2871     memory_region_init_io(&s->cirrus_linear_bitblt_io,
2872                           &cirrus_linear_bitblt_io_ops,
2873                           s,
2874                           "cirrus-bitblt-mmio",
2875                           0x400000);
2876     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
2877 
2878     /* I/O handler for memory-mapped I/O */
2879     memory_region_init_io(&s->cirrus_mmio_io, &cirrus_mmio_io_ops, s,
2880                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
2881     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
2882 
2883     s->real_vram_size =
2884         (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;
2885 
2886     /* XXX: s->vga.vram_size must be a power of two */
2887     s->cirrus_addr_mask = s->real_vram_size - 1;
2888     s->linear_mmio_mask = s->real_vram_size - 256;
2889 
2890     s->vga.get_bpp = cirrus_get_bpp;
2891     s->vga.get_offsets = cirrus_get_offsets;
2892     s->vga.get_resolution = cirrus_get_resolution;
2893     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
2894     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
2895 
2896     qemu_register_reset(cirrus_reset, s);
2897 }
2898 
2899 /***************************************
2900  *
2901  *  ISA bus support
2902  *
2903  ***************************************/
2904 
2905 static int vga_initfn(ISADevice *dev)
2906 {
2907     ISACirrusVGAState *d = DO_UPCAST(ISACirrusVGAState, dev, dev);
2908     VGACommonState *s = &d->cirrus_vga.vga;
2909 
2910     vga_common_init(s);
2911     cirrus_init_common(&d->cirrus_vga, CIRRUS_ID_CLGD5430, 0,
2912                        isa_address_space(dev), isa_address_space_io(dev));
2913     s->con = graphic_console_init(s->update, s->invalidate,
2914                                   s->screen_dump, s->text_update,
2915                                   s);
2916     rom_add_vga(VGABIOS_CIRRUS_FILENAME);
2917     /* XXX ISA-LFB support */
2918     /* FIXME not qdev yet */
2919     return 0;
2920 }
2921 
2922 static Property isa_vga_cirrus_properties[] = {
2923     DEFINE_PROP_UINT32("vgamem_mb", struct ISACirrusVGAState,
2924                        cirrus_vga.vga.vram_size_mb, 8),
2925     DEFINE_PROP_END_OF_LIST(),
2926 };
2927 
2928 static void isa_cirrus_vga_class_init(ObjectClass *klass, void *data)
2929 {
2930     ISADeviceClass *k = ISA_DEVICE_CLASS(klass);
2931     DeviceClass *dc = DEVICE_CLASS(klass);
2932 
2933     dc->vmsd  = &vmstate_cirrus_vga;
2934     k->init   = vga_initfn;
2935     dc->props = isa_vga_cirrus_properties;
2936 }
2937 
2938 static const TypeInfo isa_cirrus_vga_info = {
2939     .name          = "isa-cirrus-vga",
2940     .parent        = TYPE_ISA_DEVICE,
2941     .instance_size = sizeof(ISACirrusVGAState),
2942     .class_init = isa_cirrus_vga_class_init,
2943 };
2944 
2945 /***************************************
2946  *
2947  *  PCI bus support
2948  *
2949  ***************************************/
2950 
2951 static int pci_cirrus_vga_initfn(PCIDevice *dev)
2952 {
2953      PCICirrusVGAState *d = DO_UPCAST(PCICirrusVGAState, dev, dev);
2954      CirrusVGAState *s = &d->cirrus_vga;
2955      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
2956      int16_t device_id = pc->device_id;
2957 
2958      /* setup VGA */
2959      vga_common_init(&s->vga);
2960      cirrus_init_common(s, device_id, 1, pci_address_space(dev),
2961                         pci_address_space_io(dev));
2962      s->vga.con = graphic_console_init(s->vga.update, s->vga.invalidate,
2963                                        s->vga.screen_dump, s->vga.text_update,
2964                                        &s->vga);
2965 
2966      /* setup PCI */
2967 
2968     memory_region_init(&s->pci_bar, "cirrus-pci-bar0", 0x2000000);
2969 
2970     /* XXX: add byte swapping apertures */
2971     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
2972     memory_region_add_subregion(&s->pci_bar, 0x1000000,
2973                                 &s->cirrus_linear_bitblt_io);
2974 
2975      /* setup memory space */
2976      /* memory #0 LFB */
2977      /* memory #1 memory-mapped I/O */
2978      /* XXX: s->vga.vram_size must be a power of two */
2979      pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);
2980      if (device_id == CIRRUS_ID_CLGD5446) {
2981          pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
2982      }
2983      return 0;
2984 }
2985 
2986 static Property pci_vga_cirrus_properties[] = {
2987     DEFINE_PROP_UINT32("vgamem_mb", struct PCICirrusVGAState,
2988                        cirrus_vga.vga.vram_size_mb, 8),
2989     DEFINE_PROP_END_OF_LIST(),
2990 };
2991 
2992 static void cirrus_vga_class_init(ObjectClass *klass, void *data)
2993 {
2994     DeviceClass *dc = DEVICE_CLASS(klass);
2995     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2996 
2997     k->no_hotplug = 1;
2998     k->init = pci_cirrus_vga_initfn;
2999     k->romfile = VGABIOS_CIRRUS_FILENAME;
3000     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
3001     k->device_id = CIRRUS_ID_CLGD5446;
3002     k->class_id = PCI_CLASS_DISPLAY_VGA;
3003     dc->desc = "Cirrus CLGD 54xx VGA";
3004     dc->vmsd = &vmstate_pci_cirrus_vga;
3005     dc->props = pci_vga_cirrus_properties;
3006 }
3007 
3008 static const TypeInfo cirrus_vga_info = {
3009     .name          = "cirrus-vga",
3010     .parent        = TYPE_PCI_DEVICE,
3011     .instance_size = sizeof(PCICirrusVGAState),
3012     .class_init    = cirrus_vga_class_init,
3013 };
3014 
3015 static void cirrus_vga_register_types(void)
3016 {
3017     type_register_static(&isa_cirrus_vga_info);
3018     type_register_static(&cirrus_vga_info);
3019 }
3020 
3021 type_init(cirrus_vga_register_types)
3022