xref: /openbmc/qemu/hw/display/cirrus_vga.c (revision 72149414e25784de60b821fe67c56108a5b03ce1)
1 /*
2  * QEMU Cirrus CLGD 54xx VGA Emulator.
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  * Copyright (c) 2004 Makoto Suzuki (suzu)
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * Reference: Finn Thogersons' VGADOC4b
27  *   available at http://home.worldonline.dk/~finth/
28  */
29 #include "hw/hw.h"
30 #include "hw/pci/pci.h"
31 #include "ui/console.h"
32 #include "ui/pixel_ops.h"
33 #include "vga_int.h"
34 #include "hw/loader.h"
35 
36 /*
37  * TODO:
38  *    - destination write mask support not complete (bits 5..7)
39  *    - optimize linear mappings
40  *    - optimize bitblt functions
41  */
42 
43 //#define DEBUG_CIRRUS
44 //#define DEBUG_BITBLT
45 
46 /***************************************
47  *
48  *  definitions
49  *
50  ***************************************/
51 
52 // ID
53 #define CIRRUS_ID_CLGD5422  (0x23<<2)
54 #define CIRRUS_ID_CLGD5426  (0x24<<2)
55 #define CIRRUS_ID_CLGD5424  (0x25<<2)
56 #define CIRRUS_ID_CLGD5428  (0x26<<2)
57 #define CIRRUS_ID_CLGD5430  (0x28<<2)
58 #define CIRRUS_ID_CLGD5434  (0x2A<<2)
59 #define CIRRUS_ID_CLGD5436  (0x2B<<2)
60 #define CIRRUS_ID_CLGD5446  (0x2E<<2)
61 
62 // sequencer 0x07
63 #define CIRRUS_SR7_BPP_VGA            0x00
64 #define CIRRUS_SR7_BPP_SVGA           0x01
65 #define CIRRUS_SR7_BPP_MASK           0x0e
66 #define CIRRUS_SR7_BPP_8              0x00
67 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
68 #define CIRRUS_SR7_BPP_24             0x04
69 #define CIRRUS_SR7_BPP_16             0x06
70 #define CIRRUS_SR7_BPP_32             0x08
71 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
72 
73 // sequencer 0x0f
74 #define CIRRUS_MEMSIZE_512k        0x08
75 #define CIRRUS_MEMSIZE_1M          0x10
76 #define CIRRUS_MEMSIZE_2M          0x18
77 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80	// bank switching is enabled.
78 
79 // sequencer 0x12
80 #define CIRRUS_CURSOR_SHOW         0x01
81 #define CIRRUS_CURSOR_HIDDENPEL    0x02
82 #define CIRRUS_CURSOR_LARGE        0x04	// 64x64 if set, 32x32 if clear
83 
84 // sequencer 0x17
85 #define CIRRUS_BUSTYPE_VLBFAST   0x10
86 #define CIRRUS_BUSTYPE_PCI       0x20
87 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
88 #define CIRRUS_BUSTYPE_ISA       0x38
89 #define CIRRUS_MMIO_ENABLE       0x04
90 #define CIRRUS_MMIO_USE_PCIADDR  0x40	// 0xb8000 if cleared.
91 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
92 
93 // control 0x0b
94 #define CIRRUS_BANKING_DUAL             0x01
95 #define CIRRUS_BANKING_GRANULARITY_16K  0x20	// set:16k, clear:4k
96 
97 // control 0x30
98 #define CIRRUS_BLTMODE_BACKWARDS        0x01
99 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
100 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
101 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
102 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
103 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
104 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
105 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
106 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
107 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
108 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
109 
110 // control 0x31
111 #define CIRRUS_BLT_BUSY                 0x01
112 #define CIRRUS_BLT_START                0x02
113 #define CIRRUS_BLT_RESET                0x04
114 #define CIRRUS_BLT_FIFOUSED             0x10
115 #define CIRRUS_BLT_AUTOSTART            0x80
116 
117 // control 0x32
118 #define CIRRUS_ROP_0                    0x00
119 #define CIRRUS_ROP_SRC_AND_DST          0x05
120 #define CIRRUS_ROP_NOP                  0x06
121 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
122 #define CIRRUS_ROP_NOTDST               0x0b
123 #define CIRRUS_ROP_SRC                  0x0d
124 #define CIRRUS_ROP_1                    0x0e
125 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
126 #define CIRRUS_ROP_SRC_XOR_DST          0x59
127 #define CIRRUS_ROP_SRC_OR_DST           0x6d
128 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
129 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
130 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
131 #define CIRRUS_ROP_NOTSRC               0xd0
132 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
133 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
134 
135 #define CIRRUS_ROP_NOP_INDEX 2
136 #define CIRRUS_ROP_SRC_INDEX 5
137 
138 // control 0x33
139 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
140 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
141 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
142 
143 // memory-mapped IO
144 #define CIRRUS_MMIO_BLTBGCOLOR        0x00	// dword
145 #define CIRRUS_MMIO_BLTFGCOLOR        0x04	// dword
146 #define CIRRUS_MMIO_BLTWIDTH          0x08	// word
147 #define CIRRUS_MMIO_BLTHEIGHT         0x0a	// word
148 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c	// word
149 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e	// word
150 #define CIRRUS_MMIO_BLTDESTADDR       0x10	// dword
151 #define CIRRUS_MMIO_BLTSRCADDR        0x14	// dword
152 #define CIRRUS_MMIO_BLTWRITEMASK      0x17	// byte
153 #define CIRRUS_MMIO_BLTMODE           0x18	// byte
154 #define CIRRUS_MMIO_BLTROP            0x1a	// byte
155 #define CIRRUS_MMIO_BLTMODEEXT        0x1b	// byte
156 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c	// word?
157 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20	// word?
158 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24	// word
159 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26	// word
160 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28	// word
161 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a	// word
162 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c	// byte
163 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d	// byte
164 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e	// byte
165 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f	// byte
166 #define CIRRUS_MMIO_BRESENHAM_K1      0x30	// word
167 #define CIRRUS_MMIO_BRESENHAM_K3      0x32	// word
168 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34	// word
169 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36	// word
170 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38	// byte
171 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39	// byte
172 #define CIRRUS_MMIO_BLTSTATUS         0x40	// byte
173 
174 #define CIRRUS_PNPMMIO_SIZE         0x1000
175 
176 struct CirrusVGAState;
177 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
178                                      uint8_t * dst, const uint8_t * src,
179 				     int dstpitch, int srcpitch,
180 				     int bltwidth, int bltheight);
181 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
182                               uint8_t *dst, int dst_pitch, int width, int height);
183 
184 typedef struct CirrusVGAState {
185     VGACommonState vga;
186 
187     MemoryRegion cirrus_vga_io;
188     MemoryRegion cirrus_linear_io;
189     MemoryRegion cirrus_linear_bitblt_io;
190     MemoryRegion cirrus_mmio_io;
191     MemoryRegion pci_bar;
192     bool linear_vram;  /* vga.vram mapped over cirrus_linear_io */
193     MemoryRegion low_mem_container; /* container for 0xa0000-0xc0000 */
194     MemoryRegion low_mem;           /* always mapped, overridden by: */
195     MemoryRegion cirrus_bank[2];    /*   aliases at 0xa0000-0xb0000  */
196     uint32_t cirrus_addr_mask;
197     uint32_t linear_mmio_mask;
198     uint8_t cirrus_shadow_gr0;
199     uint8_t cirrus_shadow_gr1;
200     uint8_t cirrus_hidden_dac_lockindex;
201     uint8_t cirrus_hidden_dac_data;
202     uint32_t cirrus_bank_base[2];
203     uint32_t cirrus_bank_limit[2];
204     uint8_t cirrus_hidden_palette[48];
205     uint32_t hw_cursor_x;
206     uint32_t hw_cursor_y;
207     int cirrus_blt_pixelwidth;
208     int cirrus_blt_width;
209     int cirrus_blt_height;
210     int cirrus_blt_dstpitch;
211     int cirrus_blt_srcpitch;
212     uint32_t cirrus_blt_fgcol;
213     uint32_t cirrus_blt_bgcol;
214     uint32_t cirrus_blt_dstaddr;
215     uint32_t cirrus_blt_srcaddr;
216     uint8_t cirrus_blt_mode;
217     uint8_t cirrus_blt_modeext;
218     cirrus_bitblt_rop_t cirrus_rop;
219 #define CIRRUS_BLTBUFSIZE (2048 * 4) /* one line width */
220     uint8_t cirrus_bltbuf[CIRRUS_BLTBUFSIZE];
221     uint8_t *cirrus_srcptr;
222     uint8_t *cirrus_srcptr_end;
223     uint32_t cirrus_srccounter;
224     /* hwcursor display state */
225     int last_hw_cursor_size;
226     int last_hw_cursor_x;
227     int last_hw_cursor_y;
228     int last_hw_cursor_y_start;
229     int last_hw_cursor_y_end;
230     int real_vram_size; /* XXX: suppress that */
231     int device_id;
232     int bustype;
233 } CirrusVGAState;
234 
235 typedef struct PCICirrusVGAState {
236     PCIDevice dev;
237     CirrusVGAState cirrus_vga;
238 } PCICirrusVGAState;
239 
240 #define TYPE_ISA_CIRRUS_VGA "isa-cirrus-vga"
241 #define ISA_CIRRUS_VGA(obj) \
242     OBJECT_CHECK(ISACirrusVGAState, (obj), TYPE_ISA_CIRRUS_VGA)
243 
244 typedef struct ISACirrusVGAState {
245     ISADevice parent_obj;
246 
247     CirrusVGAState cirrus_vga;
248 } ISACirrusVGAState;
249 
250 static uint8_t rop_to_index[256];
251 
252 /***************************************
253  *
254  *  prototypes.
255  *
256  ***************************************/
257 
258 
259 static void cirrus_bitblt_reset(CirrusVGAState *s);
260 static void cirrus_update_memory_access(CirrusVGAState *s);
261 
262 /***************************************
263  *
264  *  raster operations
265  *
266  ***************************************/
267 
268 static bool blit_region_is_unsafe(struct CirrusVGAState *s,
269                                   int32_t pitch, int32_t addr)
270 {
271     if (pitch < 0) {
272         int64_t min = addr
273             + ((int64_t)s->cirrus_blt_height-1) * pitch;
274         int32_t max = addr
275             + s->cirrus_blt_width;
276         if (min < 0 || max >= s->vga.vram_size) {
277             return true;
278         }
279     } else {
280         int64_t max = addr
281             + ((int64_t)s->cirrus_blt_height-1) * pitch
282             + s->cirrus_blt_width;
283         if (max >= s->vga.vram_size) {
284             return true;
285         }
286     }
287     return false;
288 }
289 
290 static bool blit_is_unsafe(struct CirrusVGAState *s)
291 {
292     /* should be the case, see cirrus_bitblt_start */
293     assert(s->cirrus_blt_width > 0);
294     assert(s->cirrus_blt_height > 0);
295 
296     if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
297         return true;
298     }
299 
300     if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
301                               s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) {
302         return true;
303     }
304     if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
305                               s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) {
306         return true;
307     }
308 
309     return false;
310 }
311 
312 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
313                                   uint8_t *dst,const uint8_t *src,
314                                   int dstpitch,int srcpitch,
315                                   int bltwidth,int bltheight)
316 {
317 }
318 
319 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
320                                    uint8_t *dst,
321                                    int dstpitch, int bltwidth,int bltheight)
322 {
323 }
324 
325 #define ROP_NAME 0
326 #define ROP_FN(d, s) 0
327 #include "cirrus_vga_rop.h"
328 
329 #define ROP_NAME src_and_dst
330 #define ROP_FN(d, s) (s) & (d)
331 #include "cirrus_vga_rop.h"
332 
333 #define ROP_NAME src_and_notdst
334 #define ROP_FN(d, s) (s) & (~(d))
335 #include "cirrus_vga_rop.h"
336 
337 #define ROP_NAME notdst
338 #define ROP_FN(d, s) ~(d)
339 #include "cirrus_vga_rop.h"
340 
341 #define ROP_NAME src
342 #define ROP_FN(d, s) s
343 #include "cirrus_vga_rop.h"
344 
345 #define ROP_NAME 1
346 #define ROP_FN(d, s) ~0
347 #include "cirrus_vga_rop.h"
348 
349 #define ROP_NAME notsrc_and_dst
350 #define ROP_FN(d, s) (~(s)) & (d)
351 #include "cirrus_vga_rop.h"
352 
353 #define ROP_NAME src_xor_dst
354 #define ROP_FN(d, s) (s) ^ (d)
355 #include "cirrus_vga_rop.h"
356 
357 #define ROP_NAME src_or_dst
358 #define ROP_FN(d, s) (s) | (d)
359 #include "cirrus_vga_rop.h"
360 
361 #define ROP_NAME notsrc_or_notdst
362 #define ROP_FN(d, s) (~(s)) | (~(d))
363 #include "cirrus_vga_rop.h"
364 
365 #define ROP_NAME src_notxor_dst
366 #define ROP_FN(d, s) ~((s) ^ (d))
367 #include "cirrus_vga_rop.h"
368 
369 #define ROP_NAME src_or_notdst
370 #define ROP_FN(d, s) (s) | (~(d))
371 #include "cirrus_vga_rop.h"
372 
373 #define ROP_NAME notsrc
374 #define ROP_FN(d, s) (~(s))
375 #include "cirrus_vga_rop.h"
376 
377 #define ROP_NAME notsrc_or_dst
378 #define ROP_FN(d, s) (~(s)) | (d)
379 #include "cirrus_vga_rop.h"
380 
381 #define ROP_NAME notsrc_and_notdst
382 #define ROP_FN(d, s) (~(s)) & (~(d))
383 #include "cirrus_vga_rop.h"
384 
385 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
386     cirrus_bitblt_rop_fwd_0,
387     cirrus_bitblt_rop_fwd_src_and_dst,
388     cirrus_bitblt_rop_nop,
389     cirrus_bitblt_rop_fwd_src_and_notdst,
390     cirrus_bitblt_rop_fwd_notdst,
391     cirrus_bitblt_rop_fwd_src,
392     cirrus_bitblt_rop_fwd_1,
393     cirrus_bitblt_rop_fwd_notsrc_and_dst,
394     cirrus_bitblt_rop_fwd_src_xor_dst,
395     cirrus_bitblt_rop_fwd_src_or_dst,
396     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
397     cirrus_bitblt_rop_fwd_src_notxor_dst,
398     cirrus_bitblt_rop_fwd_src_or_notdst,
399     cirrus_bitblt_rop_fwd_notsrc,
400     cirrus_bitblt_rop_fwd_notsrc_or_dst,
401     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
402 };
403 
404 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
405     cirrus_bitblt_rop_bkwd_0,
406     cirrus_bitblt_rop_bkwd_src_and_dst,
407     cirrus_bitblt_rop_nop,
408     cirrus_bitblt_rop_bkwd_src_and_notdst,
409     cirrus_bitblt_rop_bkwd_notdst,
410     cirrus_bitblt_rop_bkwd_src,
411     cirrus_bitblt_rop_bkwd_1,
412     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
413     cirrus_bitblt_rop_bkwd_src_xor_dst,
414     cirrus_bitblt_rop_bkwd_src_or_dst,
415     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
416     cirrus_bitblt_rop_bkwd_src_notxor_dst,
417     cirrus_bitblt_rop_bkwd_src_or_notdst,
418     cirrus_bitblt_rop_bkwd_notsrc,
419     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
420     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
421 };
422 
423 #define TRANSP_ROP(name) {\
424     name ## _8,\
425     name ## _16,\
426         }
427 #define TRANSP_NOP(func) {\
428     func,\
429     func,\
430         }
431 
432 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
433     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
434     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
435     TRANSP_NOP(cirrus_bitblt_rop_nop),
436     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
437     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
438     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
439     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
440     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
441     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
442     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
443     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
444     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
445     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
446     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
447     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
448     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
449 };
450 
451 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
452     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
453     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
454     TRANSP_NOP(cirrus_bitblt_rop_nop),
455     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
456     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
457     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
458     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
459     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
460     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
461     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
462     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
463     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
464     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
465     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
466     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
467     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
468 };
469 
470 #define ROP2(name) {\
471     name ## _8,\
472     name ## _16,\
473     name ## _24,\
474     name ## _32,\
475         }
476 
477 #define ROP_NOP2(func) {\
478     func,\
479     func,\
480     func,\
481     func,\
482         }
483 
484 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
485     ROP2(cirrus_patternfill_0),
486     ROP2(cirrus_patternfill_src_and_dst),
487     ROP_NOP2(cirrus_bitblt_rop_nop),
488     ROP2(cirrus_patternfill_src_and_notdst),
489     ROP2(cirrus_patternfill_notdst),
490     ROP2(cirrus_patternfill_src),
491     ROP2(cirrus_patternfill_1),
492     ROP2(cirrus_patternfill_notsrc_and_dst),
493     ROP2(cirrus_patternfill_src_xor_dst),
494     ROP2(cirrus_patternfill_src_or_dst),
495     ROP2(cirrus_patternfill_notsrc_or_notdst),
496     ROP2(cirrus_patternfill_src_notxor_dst),
497     ROP2(cirrus_patternfill_src_or_notdst),
498     ROP2(cirrus_patternfill_notsrc),
499     ROP2(cirrus_patternfill_notsrc_or_dst),
500     ROP2(cirrus_patternfill_notsrc_and_notdst),
501 };
502 
503 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
504     ROP2(cirrus_colorexpand_transp_0),
505     ROP2(cirrus_colorexpand_transp_src_and_dst),
506     ROP_NOP2(cirrus_bitblt_rop_nop),
507     ROP2(cirrus_colorexpand_transp_src_and_notdst),
508     ROP2(cirrus_colorexpand_transp_notdst),
509     ROP2(cirrus_colorexpand_transp_src),
510     ROP2(cirrus_colorexpand_transp_1),
511     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
512     ROP2(cirrus_colorexpand_transp_src_xor_dst),
513     ROP2(cirrus_colorexpand_transp_src_or_dst),
514     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
515     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
516     ROP2(cirrus_colorexpand_transp_src_or_notdst),
517     ROP2(cirrus_colorexpand_transp_notsrc),
518     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
519     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
520 };
521 
522 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
523     ROP2(cirrus_colorexpand_0),
524     ROP2(cirrus_colorexpand_src_and_dst),
525     ROP_NOP2(cirrus_bitblt_rop_nop),
526     ROP2(cirrus_colorexpand_src_and_notdst),
527     ROP2(cirrus_colorexpand_notdst),
528     ROP2(cirrus_colorexpand_src),
529     ROP2(cirrus_colorexpand_1),
530     ROP2(cirrus_colorexpand_notsrc_and_dst),
531     ROP2(cirrus_colorexpand_src_xor_dst),
532     ROP2(cirrus_colorexpand_src_or_dst),
533     ROP2(cirrus_colorexpand_notsrc_or_notdst),
534     ROP2(cirrus_colorexpand_src_notxor_dst),
535     ROP2(cirrus_colorexpand_src_or_notdst),
536     ROP2(cirrus_colorexpand_notsrc),
537     ROP2(cirrus_colorexpand_notsrc_or_dst),
538     ROP2(cirrus_colorexpand_notsrc_and_notdst),
539 };
540 
541 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
542     ROP2(cirrus_colorexpand_pattern_transp_0),
543     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
544     ROP_NOP2(cirrus_bitblt_rop_nop),
545     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
546     ROP2(cirrus_colorexpand_pattern_transp_notdst),
547     ROP2(cirrus_colorexpand_pattern_transp_src),
548     ROP2(cirrus_colorexpand_pattern_transp_1),
549     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
550     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
551     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
552     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
553     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
554     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
555     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
556     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
557     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
558 };
559 
560 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
561     ROP2(cirrus_colorexpand_pattern_0),
562     ROP2(cirrus_colorexpand_pattern_src_and_dst),
563     ROP_NOP2(cirrus_bitblt_rop_nop),
564     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
565     ROP2(cirrus_colorexpand_pattern_notdst),
566     ROP2(cirrus_colorexpand_pattern_src),
567     ROP2(cirrus_colorexpand_pattern_1),
568     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
569     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
570     ROP2(cirrus_colorexpand_pattern_src_or_dst),
571     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
572     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
573     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
574     ROP2(cirrus_colorexpand_pattern_notsrc),
575     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
576     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
577 };
578 
579 static const cirrus_fill_t cirrus_fill[16][4] = {
580     ROP2(cirrus_fill_0),
581     ROP2(cirrus_fill_src_and_dst),
582     ROP_NOP2(cirrus_bitblt_fill_nop),
583     ROP2(cirrus_fill_src_and_notdst),
584     ROP2(cirrus_fill_notdst),
585     ROP2(cirrus_fill_src),
586     ROP2(cirrus_fill_1),
587     ROP2(cirrus_fill_notsrc_and_dst),
588     ROP2(cirrus_fill_src_xor_dst),
589     ROP2(cirrus_fill_src_or_dst),
590     ROP2(cirrus_fill_notsrc_or_notdst),
591     ROP2(cirrus_fill_src_notxor_dst),
592     ROP2(cirrus_fill_src_or_notdst),
593     ROP2(cirrus_fill_notsrc),
594     ROP2(cirrus_fill_notsrc_or_dst),
595     ROP2(cirrus_fill_notsrc_and_notdst),
596 };
597 
598 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
599 {
600     unsigned int color;
601     switch (s->cirrus_blt_pixelwidth) {
602     case 1:
603         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
604         break;
605     case 2:
606         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
607         s->cirrus_blt_fgcol = le16_to_cpu(color);
608         break;
609     case 3:
610         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
611             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
612         break;
613     default:
614     case 4:
615         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
616             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
617         s->cirrus_blt_fgcol = le32_to_cpu(color);
618         break;
619     }
620 }
621 
622 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
623 {
624     unsigned int color;
625     switch (s->cirrus_blt_pixelwidth) {
626     case 1:
627         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
628         break;
629     case 2:
630         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
631         s->cirrus_blt_bgcol = le16_to_cpu(color);
632         break;
633     case 3:
634         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
635             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
636         break;
637     default:
638     case 4:
639         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
640             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
641         s->cirrus_blt_bgcol = le32_to_cpu(color);
642         break;
643     }
644 }
645 
646 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
647 				     int off_pitch, int bytesperline,
648 				     int lines)
649 {
650     int y;
651     int off_cur;
652     int off_cur_end;
653 
654     for (y = 0; y < lines; y++) {
655 	off_cur = off_begin;
656 	off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
657         memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);
658 	off_begin += off_pitch;
659     }
660 }
661 
662 static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,
663 					    const uint8_t * src)
664 {
665     uint8_t *dst;
666 
667     dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
668 
669     if (blit_is_unsafe(s))
670         return 0;
671 
672     (*s->cirrus_rop) (s, dst, src,
673                       s->cirrus_blt_dstpitch, 0,
674                       s->cirrus_blt_width, s->cirrus_blt_height);
675     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
676                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
677                              s->cirrus_blt_height);
678     return 1;
679 }
680 
681 /* fill */
682 
683 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
684 {
685     cirrus_fill_t rop_func;
686 
687     if (blit_is_unsafe(s)) {
688         return 0;
689     }
690     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
691     rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
692              s->cirrus_blt_dstpitch,
693              s->cirrus_blt_width, s->cirrus_blt_height);
694     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
695 			     s->cirrus_blt_dstpitch, s->cirrus_blt_width,
696 			     s->cirrus_blt_height);
697     cirrus_bitblt_reset(s);
698     return 1;
699 }
700 
701 /***************************************
702  *
703  *  bitblt (video-to-video)
704  *
705  ***************************************/
706 
707 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
708 {
709     return cirrus_bitblt_common_patterncopy(s,
710 					    s->vga.vram_ptr + ((s->cirrus_blt_srcaddr & ~7) &
711                                             s->cirrus_addr_mask));
712 }
713 
714 static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
715 {
716     int sx = 0, sy = 0;
717     int dx = 0, dy = 0;
718     int depth = 0;
719     int notify = 0;
720 
721     /* make sure to only copy if it's a plain copy ROP */
722     if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
723         *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {
724 
725         int width, height;
726 
727         depth = s->vga.get_bpp(&s->vga) / 8;
728         s->vga.get_resolution(&s->vga, &width, &height);
729 
730         /* extra x, y */
731         sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
732         sy = (src / ABS(s->cirrus_blt_srcpitch));
733         dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
734         dy = (dst / ABS(s->cirrus_blt_dstpitch));
735 
736         /* normalize width */
737         w /= depth;
738 
739         /* if we're doing a backward copy, we have to adjust
740            our x/y to be the upper left corner (instead of the lower
741            right corner) */
742         if (s->cirrus_blt_dstpitch < 0) {
743             sx -= (s->cirrus_blt_width / depth) - 1;
744             dx -= (s->cirrus_blt_width / depth) - 1;
745             sy -= s->cirrus_blt_height - 1;
746             dy -= s->cirrus_blt_height - 1;
747         }
748 
749         /* are we in the visible portion of memory? */
750         if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
751             (sx + w) <= width && (sy + h) <= height &&
752             (dx + w) <= width && (dy + h) <= height) {
753             notify = 1;
754         }
755     }
756 
757     /* we have to flush all pending changes so that the copy
758        is generated at the appropriate moment in time */
759     if (notify)
760         graphic_hw_update(s->vga.con);
761 
762     (*s->cirrus_rop) (s, s->vga.vram_ptr +
763 		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
764 		      s->vga.vram_ptr +
765 		      (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
766 		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
767 		      s->cirrus_blt_width, s->cirrus_blt_height);
768 
769     if (notify) {
770         qemu_console_copy(s->vga.con,
771 			  sx, sy, dx, dy,
772 			  s->cirrus_blt_width / depth,
773 			  s->cirrus_blt_height);
774     }
775 
776     /* we don't have to notify the display that this portion has
777        changed since qemu_console_copy implies this */
778 
779     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
780 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
781 				s->cirrus_blt_height);
782 }
783 
784 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
785 {
786     if (blit_is_unsafe(s))
787         return 0;
788 
789     cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
790             s->cirrus_blt_srcaddr - s->vga.start_addr,
791             s->cirrus_blt_width, s->cirrus_blt_height);
792 
793     return 1;
794 }
795 
796 /***************************************
797  *
798  *  bitblt (cpu-to-video)
799  *
800  ***************************************/
801 
802 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
803 {
804     int copy_count;
805     uint8_t *end_ptr;
806 
807     if (s->cirrus_srccounter > 0) {
808         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
809             cirrus_bitblt_common_patterncopy(s, s->cirrus_bltbuf);
810         the_end:
811             s->cirrus_srccounter = 0;
812             cirrus_bitblt_reset(s);
813         } else {
814             /* at least one scan line */
815             do {
816                 (*s->cirrus_rop)(s, s->vga.vram_ptr +
817                                  (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
818                                   s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
819                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
820                                          s->cirrus_blt_width, 1);
821                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
822                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
823                 if (s->cirrus_srccounter <= 0)
824                     goto the_end;
825                 /* more bytes than needed can be transferred because of
826                    word alignment, so we keep them for the next line */
827                 /* XXX: keep alignment to speed up transfer */
828                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
829                 copy_count = s->cirrus_srcptr_end - end_ptr;
830                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
831                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
832                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
833             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
834         }
835     }
836 }
837 
838 /***************************************
839  *
840  *  bitblt wrapper
841  *
842  ***************************************/
843 
844 static void cirrus_bitblt_reset(CirrusVGAState * s)
845 {
846     int need_update;
847 
848     s->vga.gr[0x31] &=
849 	~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
850     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
851         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
852     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
853     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
854     s->cirrus_srccounter = 0;
855     if (!need_update)
856         return;
857     cirrus_update_memory_access(s);
858 }
859 
860 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
861 {
862     int w;
863 
864     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
865     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
866     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
867 
868     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
869 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
870 	    s->cirrus_blt_srcpitch = 8;
871 	} else {
872             /* XXX: check for 24 bpp */
873 	    s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
874 	}
875 	s->cirrus_srccounter = s->cirrus_blt_srcpitch;
876     } else {
877 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
878             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
879             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
880                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
881             else
882                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
883 	} else {
884             /* always align input size to 32 bits */
885 	    s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
886 	}
887         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
888     }
889     s->cirrus_srcptr = s->cirrus_bltbuf;
890     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
891     cirrus_update_memory_access(s);
892     return 1;
893 }
894 
895 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
896 {
897     /* XXX */
898 #ifdef DEBUG_BITBLT
899     printf("cirrus: bitblt (video to cpu) is not implemented yet\n");
900 #endif
901     return 0;
902 }
903 
904 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
905 {
906     int ret;
907 
908     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
909 	ret = cirrus_bitblt_videotovideo_patterncopy(s);
910     } else {
911 	ret = cirrus_bitblt_videotovideo_copy(s);
912     }
913     if (ret)
914 	cirrus_bitblt_reset(s);
915     return ret;
916 }
917 
918 static void cirrus_bitblt_start(CirrusVGAState * s)
919 {
920     uint8_t blt_rop;
921 
922     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
923 
924     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
925     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
926     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
927     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
928     s->cirrus_blt_dstaddr =
929 	(s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
930     s->cirrus_blt_srcaddr =
931 	(s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
932     s->cirrus_blt_mode = s->vga.gr[0x30];
933     s->cirrus_blt_modeext = s->vga.gr[0x33];
934     blt_rop = s->vga.gr[0x32];
935 
936 #ifdef DEBUG_BITBLT
937     printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n",
938            blt_rop,
939            s->cirrus_blt_mode,
940            s->cirrus_blt_modeext,
941            s->cirrus_blt_width,
942            s->cirrus_blt_height,
943            s->cirrus_blt_dstpitch,
944            s->cirrus_blt_srcpitch,
945            s->cirrus_blt_dstaddr,
946            s->cirrus_blt_srcaddr,
947            s->vga.gr[0x2f]);
948 #endif
949 
950     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
951     case CIRRUS_BLTMODE_PIXELWIDTH8:
952 	s->cirrus_blt_pixelwidth = 1;
953 	break;
954     case CIRRUS_BLTMODE_PIXELWIDTH16:
955 	s->cirrus_blt_pixelwidth = 2;
956 	break;
957     case CIRRUS_BLTMODE_PIXELWIDTH24:
958 	s->cirrus_blt_pixelwidth = 3;
959 	break;
960     case CIRRUS_BLTMODE_PIXELWIDTH32:
961 	s->cirrus_blt_pixelwidth = 4;
962 	break;
963     default:
964 #ifdef DEBUG_BITBLT
965 	printf("cirrus: bitblt - pixel width is unknown\n");
966 #endif
967 	goto bitblt_ignore;
968     }
969     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
970 
971     if ((s->
972 	 cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
973 			    CIRRUS_BLTMODE_MEMSYSDEST))
974 	== (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
975 #ifdef DEBUG_BITBLT
976 	printf("cirrus: bitblt - memory-to-memory copy is requested\n");
977 #endif
978 	goto bitblt_ignore;
979     }
980 
981     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
982         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
983                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
984                                CIRRUS_BLTMODE_PATTERNCOPY |
985                                CIRRUS_BLTMODE_COLOREXPAND)) ==
986          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
987         cirrus_bitblt_fgcol(s);
988         cirrus_bitblt_solidfill(s, blt_rop);
989     } else {
990         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
991                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
992             CIRRUS_BLTMODE_COLOREXPAND) {
993 
994             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
995                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
996                     cirrus_bitblt_bgcol(s);
997                 else
998                     cirrus_bitblt_fgcol(s);
999                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1000             } else {
1001                 cirrus_bitblt_fgcol(s);
1002                 cirrus_bitblt_bgcol(s);
1003                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1004             }
1005         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
1006             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
1007                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1008                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1009                         cirrus_bitblt_bgcol(s);
1010                     else
1011                         cirrus_bitblt_fgcol(s);
1012                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1013                 } else {
1014                     cirrus_bitblt_fgcol(s);
1015                     cirrus_bitblt_bgcol(s);
1016                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1017                 }
1018             } else {
1019                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1020             }
1021         } else {
1022 	    if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1023 		if (s->cirrus_blt_pixelwidth > 2) {
1024 		    printf("src transparent without colorexpand must be 8bpp or 16bpp\n");
1025 		    goto bitblt_ignore;
1026 		}
1027 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1028 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1029 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1030 		    s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1031 		} else {
1032 		    s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1033 		}
1034 	    } else {
1035 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1036 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1037 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1038 		    s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1039 		} else {
1040 		    s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1041 		}
1042 	    }
1043 	}
1044         // setup bitblt engine.
1045         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1046             if (!cirrus_bitblt_cputovideo(s))
1047                 goto bitblt_ignore;
1048         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1049             if (!cirrus_bitblt_videotocpu(s))
1050                 goto bitblt_ignore;
1051         } else {
1052             if (!cirrus_bitblt_videotovideo(s))
1053                 goto bitblt_ignore;
1054         }
1055     }
1056     return;
1057   bitblt_ignore:;
1058     cirrus_bitblt_reset(s);
1059 }
1060 
1061 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1062 {
1063     unsigned old_value;
1064 
1065     old_value = s->vga.gr[0x31];
1066     s->vga.gr[0x31] = reg_value;
1067 
1068     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1069 	((reg_value & CIRRUS_BLT_RESET) == 0)) {
1070 	cirrus_bitblt_reset(s);
1071     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1072 	       ((reg_value & CIRRUS_BLT_START) != 0)) {
1073 	cirrus_bitblt_start(s);
1074     }
1075 }
1076 
1077 
1078 /***************************************
1079  *
1080  *  basic parameters
1081  *
1082  ***************************************/
1083 
1084 static void cirrus_get_offsets(VGACommonState *s1,
1085                                uint32_t *pline_offset,
1086                                uint32_t *pstart_addr,
1087                                uint32_t *pline_compare)
1088 {
1089     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1090     uint32_t start_addr, line_offset, line_compare;
1091 
1092     line_offset = s->vga.cr[0x13]
1093 	| ((s->vga.cr[0x1b] & 0x10) << 4);
1094     line_offset <<= 3;
1095     *pline_offset = line_offset;
1096 
1097     start_addr = (s->vga.cr[0x0c] << 8)
1098 	| s->vga.cr[0x0d]
1099 	| ((s->vga.cr[0x1b] & 0x01) << 16)
1100 	| ((s->vga.cr[0x1b] & 0x0c) << 15)
1101 	| ((s->vga.cr[0x1d] & 0x80) << 12);
1102     *pstart_addr = start_addr;
1103 
1104     line_compare = s->vga.cr[0x18] |
1105         ((s->vga.cr[0x07] & 0x10) << 4) |
1106         ((s->vga.cr[0x09] & 0x40) << 3);
1107     *pline_compare = line_compare;
1108 }
1109 
1110 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1111 {
1112     uint32_t ret = 16;
1113 
1114     switch (s->cirrus_hidden_dac_data & 0xf) {
1115     case 0:
1116 	ret = 15;
1117 	break;			/* Sierra HiColor */
1118     case 1:
1119 	ret = 16;
1120 	break;			/* XGA HiColor */
1121     default:
1122 #ifdef DEBUG_CIRRUS
1123 	printf("cirrus: invalid DAC value %x in 16bpp\n",
1124 	       (s->cirrus_hidden_dac_data & 0xf));
1125 #endif
1126 	ret = 15;		/* XXX */
1127 	break;
1128     }
1129     return ret;
1130 }
1131 
1132 static int cirrus_get_bpp(VGACommonState *s1)
1133 {
1134     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1135     uint32_t ret = 8;
1136 
1137     if ((s->vga.sr[0x07] & 0x01) != 0) {
1138 	/* Cirrus SVGA */
1139 	switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1140 	case CIRRUS_SR7_BPP_8:
1141 	    ret = 8;
1142 	    break;
1143 	case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1144 	    ret = cirrus_get_bpp16_depth(s);
1145 	    break;
1146 	case CIRRUS_SR7_BPP_24:
1147 	    ret = 24;
1148 	    break;
1149 	case CIRRUS_SR7_BPP_16:
1150 	    ret = cirrus_get_bpp16_depth(s);
1151 	    break;
1152 	case CIRRUS_SR7_BPP_32:
1153 	    ret = 32;
1154 	    break;
1155 	default:
1156 #ifdef DEBUG_CIRRUS
1157 	    printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1158 #endif
1159 	    ret = 8;
1160 	    break;
1161 	}
1162     } else {
1163 	/* VGA */
1164 	ret = 0;
1165     }
1166 
1167     return ret;
1168 }
1169 
1170 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1171 {
1172     int width, height;
1173 
1174     width = (s->cr[0x01] + 1) * 8;
1175     height = s->cr[0x12] |
1176         ((s->cr[0x07] & 0x02) << 7) |
1177         ((s->cr[0x07] & 0x40) << 3);
1178     height = (height + 1);
1179     /* interlace support */
1180     if (s->cr[0x1a] & 0x01)
1181         height = height * 2;
1182     *pwidth = width;
1183     *pheight = height;
1184 }
1185 
1186 /***************************************
1187  *
1188  * bank memory
1189  *
1190  ***************************************/
1191 
1192 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1193 {
1194     unsigned offset;
1195     unsigned limit;
1196 
1197     if ((s->vga.gr[0x0b] & 0x01) != 0)	/* dual bank */
1198 	offset = s->vga.gr[0x09 + bank_index];
1199     else			/* single bank */
1200 	offset = s->vga.gr[0x09];
1201 
1202     if ((s->vga.gr[0x0b] & 0x20) != 0)
1203 	offset <<= 14;
1204     else
1205 	offset <<= 12;
1206 
1207     if (s->real_vram_size <= offset)
1208 	limit = 0;
1209     else
1210 	limit = s->real_vram_size - offset;
1211 
1212     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1213 	if (limit > 0x8000) {
1214 	    offset += 0x8000;
1215 	    limit -= 0x8000;
1216 	} else {
1217 	    limit = 0;
1218 	}
1219     }
1220 
1221     if (limit > 0) {
1222 	s->cirrus_bank_base[bank_index] = offset;
1223 	s->cirrus_bank_limit[bank_index] = limit;
1224     } else {
1225 	s->cirrus_bank_base[bank_index] = 0;
1226 	s->cirrus_bank_limit[bank_index] = 0;
1227     }
1228 }
1229 
1230 /***************************************
1231  *
1232  *  I/O access between 0x3c4-0x3c5
1233  *
1234  ***************************************/
1235 
1236 static int cirrus_vga_read_sr(CirrusVGAState * s)
1237 {
1238     switch (s->vga.sr_index) {
1239     case 0x00:			// Standard VGA
1240     case 0x01:			// Standard VGA
1241     case 0x02:			// Standard VGA
1242     case 0x03:			// Standard VGA
1243     case 0x04:			// Standard VGA
1244 	return s->vga.sr[s->vga.sr_index];
1245     case 0x06:			// Unlock Cirrus extensions
1246 	return s->vga.sr[s->vga.sr_index];
1247     case 0x10:
1248     case 0x30:
1249     case 0x50:
1250     case 0x70:			// Graphics Cursor X
1251     case 0x90:
1252     case 0xb0:
1253     case 0xd0:
1254     case 0xf0:			// Graphics Cursor X
1255 	return s->vga.sr[0x10];
1256     case 0x11:
1257     case 0x31:
1258     case 0x51:
1259     case 0x71:			// Graphics Cursor Y
1260     case 0x91:
1261     case 0xb1:
1262     case 0xd1:
1263     case 0xf1:			// Graphics Cursor Y
1264 	return s->vga.sr[0x11];
1265     case 0x05:			// ???
1266     case 0x07:			// Extended Sequencer Mode
1267     case 0x08:			// EEPROM Control
1268     case 0x09:			// Scratch Register 0
1269     case 0x0a:			// Scratch Register 1
1270     case 0x0b:			// VCLK 0
1271     case 0x0c:			// VCLK 1
1272     case 0x0d:			// VCLK 2
1273     case 0x0e:			// VCLK 3
1274     case 0x0f:			// DRAM Control
1275     case 0x12:			// Graphics Cursor Attribute
1276     case 0x13:			// Graphics Cursor Pattern Address
1277     case 0x14:			// Scratch Register 2
1278     case 0x15:			// Scratch Register 3
1279     case 0x16:			// Performance Tuning Register
1280     case 0x17:			// Configuration Readback and Extended Control
1281     case 0x18:			// Signature Generator Control
1282     case 0x19:			// Signal Generator Result
1283     case 0x1a:			// Signal Generator Result
1284     case 0x1b:			// VCLK 0 Denominator & Post
1285     case 0x1c:			// VCLK 1 Denominator & Post
1286     case 0x1d:			// VCLK 2 Denominator & Post
1287     case 0x1e:			// VCLK 3 Denominator & Post
1288     case 0x1f:			// BIOS Write Enable and MCLK select
1289 #ifdef DEBUG_CIRRUS
1290 	printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1291 #endif
1292 	return s->vga.sr[s->vga.sr_index];
1293     default:
1294 #ifdef DEBUG_CIRRUS
1295 	printf("cirrus: inport sr_index %02x\n", s->vga.sr_index);
1296 #endif
1297 	return 0xff;
1298 	break;
1299     }
1300 }
1301 
1302 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1303 {
1304     switch (s->vga.sr_index) {
1305     case 0x00:			// Standard VGA
1306     case 0x01:			// Standard VGA
1307     case 0x02:			// Standard VGA
1308     case 0x03:			// Standard VGA
1309     case 0x04:			// Standard VGA
1310 	s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1311 	if (s->vga.sr_index == 1)
1312             s->vga.update_retrace_info(&s->vga);
1313         break;
1314     case 0x06:			// Unlock Cirrus extensions
1315 	val &= 0x17;
1316 	if (val == 0x12) {
1317 	    s->vga.sr[s->vga.sr_index] = 0x12;
1318 	} else {
1319 	    s->vga.sr[s->vga.sr_index] = 0x0f;
1320 	}
1321 	break;
1322     case 0x10:
1323     case 0x30:
1324     case 0x50:
1325     case 0x70:			// Graphics Cursor X
1326     case 0x90:
1327     case 0xb0:
1328     case 0xd0:
1329     case 0xf0:			// Graphics Cursor X
1330 	s->vga.sr[0x10] = val;
1331 	s->hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1332 	break;
1333     case 0x11:
1334     case 0x31:
1335     case 0x51:
1336     case 0x71:			// Graphics Cursor Y
1337     case 0x91:
1338     case 0xb1:
1339     case 0xd1:
1340     case 0xf1:			// Graphics Cursor Y
1341 	s->vga.sr[0x11] = val;
1342 	s->hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1343 	break;
1344     case 0x07:			// Extended Sequencer Mode
1345     cirrus_update_memory_access(s);
1346     case 0x08:			// EEPROM Control
1347     case 0x09:			// Scratch Register 0
1348     case 0x0a:			// Scratch Register 1
1349     case 0x0b:			// VCLK 0
1350     case 0x0c:			// VCLK 1
1351     case 0x0d:			// VCLK 2
1352     case 0x0e:			// VCLK 3
1353     case 0x0f:			// DRAM Control
1354     case 0x12:			// Graphics Cursor Attribute
1355     case 0x13:			// Graphics Cursor Pattern Address
1356     case 0x14:			// Scratch Register 2
1357     case 0x15:			// Scratch Register 3
1358     case 0x16:			// Performance Tuning Register
1359     case 0x18:			// Signature Generator Control
1360     case 0x19:			// Signature Generator Result
1361     case 0x1a:			// Signature Generator Result
1362     case 0x1b:			// VCLK 0 Denominator & Post
1363     case 0x1c:			// VCLK 1 Denominator & Post
1364     case 0x1d:			// VCLK 2 Denominator & Post
1365     case 0x1e:			// VCLK 3 Denominator & Post
1366     case 0x1f:			// BIOS Write Enable and MCLK select
1367 	s->vga.sr[s->vga.sr_index] = val;
1368 #ifdef DEBUG_CIRRUS
1369 	printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1370 	       s->vga.sr_index, val);
1371 #endif
1372 	break;
1373     case 0x17:			// Configuration Readback and Extended Control
1374 	s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1375                                    | (val & 0xc7);
1376         cirrus_update_memory_access(s);
1377         break;
1378     default:
1379 #ifdef DEBUG_CIRRUS
1380 	printf("cirrus: outport sr_index %02x, sr_value %02x\n",
1381                s->vga.sr_index, val);
1382 #endif
1383 	break;
1384     }
1385 }
1386 
1387 /***************************************
1388  *
1389  *  I/O access at 0x3c6
1390  *
1391  ***************************************/
1392 
1393 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1394 {
1395     if (++s->cirrus_hidden_dac_lockindex == 5) {
1396         s->cirrus_hidden_dac_lockindex = 0;
1397         return s->cirrus_hidden_dac_data;
1398     }
1399     return 0xff;
1400 }
1401 
1402 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1403 {
1404     if (s->cirrus_hidden_dac_lockindex == 4) {
1405 	s->cirrus_hidden_dac_data = reg_value;
1406 #if defined(DEBUG_CIRRUS)
1407 	printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1408 #endif
1409     }
1410     s->cirrus_hidden_dac_lockindex = 0;
1411 }
1412 
1413 /***************************************
1414  *
1415  *  I/O access at 0x3c9
1416  *
1417  ***************************************/
1418 
1419 static int cirrus_vga_read_palette(CirrusVGAState * s)
1420 {
1421     int val;
1422 
1423     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1424         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1425                                        s->vga.dac_sub_index];
1426     } else {
1427         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1428     }
1429     if (++s->vga.dac_sub_index == 3) {
1430 	s->vga.dac_sub_index = 0;
1431 	s->vga.dac_read_index++;
1432     }
1433     return val;
1434 }
1435 
1436 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1437 {
1438     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1439     if (++s->vga.dac_sub_index == 3) {
1440         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1441             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1442                    s->vga.dac_cache, 3);
1443         } else {
1444             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1445         }
1446         /* XXX update cursor */
1447 	s->vga.dac_sub_index = 0;
1448 	s->vga.dac_write_index++;
1449     }
1450 }
1451 
1452 /***************************************
1453  *
1454  *  I/O access between 0x3ce-0x3cf
1455  *
1456  ***************************************/
1457 
1458 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1459 {
1460     switch (reg_index) {
1461     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1462         return s->cirrus_shadow_gr0;
1463     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1464         return s->cirrus_shadow_gr1;
1465     case 0x02:			// Standard VGA
1466     case 0x03:			// Standard VGA
1467     case 0x04:			// Standard VGA
1468     case 0x06:			// Standard VGA
1469     case 0x07:			// Standard VGA
1470     case 0x08:			// Standard VGA
1471         return s->vga.gr[s->vga.gr_index];
1472     case 0x05:			// Standard VGA, Cirrus extended mode
1473     default:
1474 	break;
1475     }
1476 
1477     if (reg_index < 0x3a) {
1478 	return s->vga.gr[reg_index];
1479     } else {
1480 #ifdef DEBUG_CIRRUS
1481 	printf("cirrus: inport gr_index %02x\n", reg_index);
1482 #endif
1483 	return 0xff;
1484     }
1485 }
1486 
1487 static void
1488 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1489 {
1490 #if defined(DEBUG_BITBLT) && 0
1491     printf("gr%02x: %02x\n", reg_index, reg_value);
1492 #endif
1493     switch (reg_index) {
1494     case 0x00:			// Standard VGA, BGCOLOR 0x000000ff
1495 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1496 	s->cirrus_shadow_gr0 = reg_value;
1497 	break;
1498     case 0x01:			// Standard VGA, FGCOLOR 0x000000ff
1499 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1500 	s->cirrus_shadow_gr1 = reg_value;
1501 	break;
1502     case 0x02:			// Standard VGA
1503     case 0x03:			// Standard VGA
1504     case 0x04:			// Standard VGA
1505     case 0x06:			// Standard VGA
1506     case 0x07:			// Standard VGA
1507     case 0x08:			// Standard VGA
1508 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1509         break;
1510     case 0x05:			// Standard VGA, Cirrus extended mode
1511 	s->vga.gr[reg_index] = reg_value & 0x7f;
1512         cirrus_update_memory_access(s);
1513 	break;
1514     case 0x09:			// bank offset #0
1515     case 0x0A:			// bank offset #1
1516 	s->vga.gr[reg_index] = reg_value;
1517 	cirrus_update_bank_ptr(s, 0);
1518 	cirrus_update_bank_ptr(s, 1);
1519         cirrus_update_memory_access(s);
1520         break;
1521     case 0x0B:
1522 	s->vga.gr[reg_index] = reg_value;
1523 	cirrus_update_bank_ptr(s, 0);
1524 	cirrus_update_bank_ptr(s, 1);
1525         cirrus_update_memory_access(s);
1526 	break;
1527     case 0x10:			// BGCOLOR 0x0000ff00
1528     case 0x11:			// FGCOLOR 0x0000ff00
1529     case 0x12:			// BGCOLOR 0x00ff0000
1530     case 0x13:			// FGCOLOR 0x00ff0000
1531     case 0x14:			// BGCOLOR 0xff000000
1532     case 0x15:			// FGCOLOR 0xff000000
1533     case 0x20:			// BLT WIDTH 0x0000ff
1534     case 0x22:			// BLT HEIGHT 0x0000ff
1535     case 0x24:			// BLT DEST PITCH 0x0000ff
1536     case 0x26:			// BLT SRC PITCH 0x0000ff
1537     case 0x28:			// BLT DEST ADDR 0x0000ff
1538     case 0x29:			// BLT DEST ADDR 0x00ff00
1539     case 0x2c:			// BLT SRC ADDR 0x0000ff
1540     case 0x2d:			// BLT SRC ADDR 0x00ff00
1541     case 0x2f:                  // BLT WRITEMASK
1542     case 0x30:			// BLT MODE
1543     case 0x32:			// RASTER OP
1544     case 0x33:			// BLT MODEEXT
1545     case 0x34:			// BLT TRANSPARENT COLOR 0x00ff
1546     case 0x35:			// BLT TRANSPARENT COLOR 0xff00
1547     case 0x38:			// BLT TRANSPARENT COLOR MASK 0x00ff
1548     case 0x39:			// BLT TRANSPARENT COLOR MASK 0xff00
1549 	s->vga.gr[reg_index] = reg_value;
1550 	break;
1551     case 0x21:			// BLT WIDTH 0x001f00
1552     case 0x23:			// BLT HEIGHT 0x001f00
1553     case 0x25:			// BLT DEST PITCH 0x001f00
1554     case 0x27:			// BLT SRC PITCH 0x001f00
1555 	s->vga.gr[reg_index] = reg_value & 0x1f;
1556 	break;
1557     case 0x2a:			// BLT DEST ADDR 0x3f0000
1558 	s->vga.gr[reg_index] = reg_value & 0x3f;
1559         /* if auto start mode, starts bit blt now */
1560         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1561             cirrus_bitblt_start(s);
1562         }
1563 	break;
1564     case 0x2e:			// BLT SRC ADDR 0x3f0000
1565 	s->vga.gr[reg_index] = reg_value & 0x3f;
1566 	break;
1567     case 0x31:			// BLT STATUS/START
1568 	cirrus_write_bitblt(s, reg_value);
1569 	break;
1570     default:
1571 #ifdef DEBUG_CIRRUS
1572 	printf("cirrus: outport gr_index %02x, gr_value %02x\n", reg_index,
1573 	       reg_value);
1574 #endif
1575 	break;
1576     }
1577 }
1578 
1579 /***************************************
1580  *
1581  *  I/O access between 0x3d4-0x3d5
1582  *
1583  ***************************************/
1584 
1585 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1586 {
1587     switch (reg_index) {
1588     case 0x00:			// Standard VGA
1589     case 0x01:			// Standard VGA
1590     case 0x02:			// Standard VGA
1591     case 0x03:			// Standard VGA
1592     case 0x04:			// Standard VGA
1593     case 0x05:			// Standard VGA
1594     case 0x06:			// Standard VGA
1595     case 0x07:			// Standard VGA
1596     case 0x08:			// Standard VGA
1597     case 0x09:			// Standard VGA
1598     case 0x0a:			// Standard VGA
1599     case 0x0b:			// Standard VGA
1600     case 0x0c:			// Standard VGA
1601     case 0x0d:			// Standard VGA
1602     case 0x0e:			// Standard VGA
1603     case 0x0f:			// Standard VGA
1604     case 0x10:			// Standard VGA
1605     case 0x11:			// Standard VGA
1606     case 0x12:			// Standard VGA
1607     case 0x13:			// Standard VGA
1608     case 0x14:			// Standard VGA
1609     case 0x15:			// Standard VGA
1610     case 0x16:			// Standard VGA
1611     case 0x17:			// Standard VGA
1612     case 0x18:			// Standard VGA
1613 	return s->vga.cr[s->vga.cr_index];
1614     case 0x24:			// Attribute Controller Toggle Readback (R)
1615         return (s->vga.ar_flip_flop << 7);
1616     case 0x19:			// Interlace End
1617     case 0x1a:			// Miscellaneous Control
1618     case 0x1b:			// Extended Display Control
1619     case 0x1c:			// Sync Adjust and Genlock
1620     case 0x1d:			// Overlay Extended Control
1621     case 0x22:			// Graphics Data Latches Readback (R)
1622     case 0x25:			// Part Status
1623     case 0x27:			// Part ID (R)
1624 	return s->vga.cr[s->vga.cr_index];
1625     case 0x26:			// Attribute Controller Index Readback (R)
1626 	return s->vga.ar_index & 0x3f;
1627 	break;
1628     default:
1629 #ifdef DEBUG_CIRRUS
1630 	printf("cirrus: inport cr_index %02x\n", reg_index);
1631 #endif
1632 	return 0xff;
1633     }
1634 }
1635 
1636 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1637 {
1638     switch (s->vga.cr_index) {
1639     case 0x00:			// Standard VGA
1640     case 0x01:			// Standard VGA
1641     case 0x02:			// Standard VGA
1642     case 0x03:			// Standard VGA
1643     case 0x04:			// Standard VGA
1644     case 0x05:			// Standard VGA
1645     case 0x06:			// Standard VGA
1646     case 0x07:			// Standard VGA
1647     case 0x08:			// Standard VGA
1648     case 0x09:			// Standard VGA
1649     case 0x0a:			// Standard VGA
1650     case 0x0b:			// Standard VGA
1651     case 0x0c:			// Standard VGA
1652     case 0x0d:			// Standard VGA
1653     case 0x0e:			// Standard VGA
1654     case 0x0f:			// Standard VGA
1655     case 0x10:			// Standard VGA
1656     case 0x11:			// Standard VGA
1657     case 0x12:			// Standard VGA
1658     case 0x13:			// Standard VGA
1659     case 0x14:			// Standard VGA
1660     case 0x15:			// Standard VGA
1661     case 0x16:			// Standard VGA
1662     case 0x17:			// Standard VGA
1663     case 0x18:			// Standard VGA
1664 	/* handle CR0-7 protection */
1665 	if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1666 	    /* can always write bit 4 of CR7 */
1667 	    if (s->vga.cr_index == 7)
1668 		s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1669 	    return;
1670 	}
1671 	s->vga.cr[s->vga.cr_index] = reg_value;
1672 	switch(s->vga.cr_index) {
1673 	case 0x00:
1674 	case 0x04:
1675 	case 0x05:
1676 	case 0x06:
1677 	case 0x07:
1678 	case 0x11:
1679 	case 0x17:
1680 	    s->vga.update_retrace_info(&s->vga);
1681 	    break;
1682 	}
1683         break;
1684     case 0x19:			// Interlace End
1685     case 0x1a:			// Miscellaneous Control
1686     case 0x1b:			// Extended Display Control
1687     case 0x1c:			// Sync Adjust and Genlock
1688     case 0x1d:			// Overlay Extended Control
1689 	s->vga.cr[s->vga.cr_index] = reg_value;
1690 #ifdef DEBUG_CIRRUS
1691 	printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1692 	       s->vga.cr_index, reg_value);
1693 #endif
1694 	break;
1695     case 0x22:			// Graphics Data Latches Readback (R)
1696     case 0x24:			// Attribute Controller Toggle Readback (R)
1697     case 0x26:			// Attribute Controller Index Readback (R)
1698     case 0x27:			// Part ID (R)
1699 	break;
1700     case 0x25:			// Part Status
1701     default:
1702 #ifdef DEBUG_CIRRUS
1703 	printf("cirrus: outport cr_index %02x, cr_value %02x\n",
1704                s->vga.cr_index, reg_value);
1705 #endif
1706 	break;
1707     }
1708 }
1709 
1710 /***************************************
1711  *
1712  *  memory-mapped I/O (bitblt)
1713  *
1714  ***************************************/
1715 
1716 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1717 {
1718     int value = 0xff;
1719 
1720     switch (address) {
1721     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1722 	value = cirrus_vga_read_gr(s, 0x00);
1723 	break;
1724     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1725 	value = cirrus_vga_read_gr(s, 0x10);
1726 	break;
1727     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1728 	value = cirrus_vga_read_gr(s, 0x12);
1729 	break;
1730     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1731 	value = cirrus_vga_read_gr(s, 0x14);
1732 	break;
1733     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1734 	value = cirrus_vga_read_gr(s, 0x01);
1735 	break;
1736     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1737 	value = cirrus_vga_read_gr(s, 0x11);
1738 	break;
1739     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1740 	value = cirrus_vga_read_gr(s, 0x13);
1741 	break;
1742     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1743 	value = cirrus_vga_read_gr(s, 0x15);
1744 	break;
1745     case (CIRRUS_MMIO_BLTWIDTH + 0):
1746 	value = cirrus_vga_read_gr(s, 0x20);
1747 	break;
1748     case (CIRRUS_MMIO_BLTWIDTH + 1):
1749 	value = cirrus_vga_read_gr(s, 0x21);
1750 	break;
1751     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1752 	value = cirrus_vga_read_gr(s, 0x22);
1753 	break;
1754     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1755 	value = cirrus_vga_read_gr(s, 0x23);
1756 	break;
1757     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1758 	value = cirrus_vga_read_gr(s, 0x24);
1759 	break;
1760     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1761 	value = cirrus_vga_read_gr(s, 0x25);
1762 	break;
1763     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1764 	value = cirrus_vga_read_gr(s, 0x26);
1765 	break;
1766     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1767 	value = cirrus_vga_read_gr(s, 0x27);
1768 	break;
1769     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1770 	value = cirrus_vga_read_gr(s, 0x28);
1771 	break;
1772     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1773 	value = cirrus_vga_read_gr(s, 0x29);
1774 	break;
1775     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1776 	value = cirrus_vga_read_gr(s, 0x2a);
1777 	break;
1778     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1779 	value = cirrus_vga_read_gr(s, 0x2c);
1780 	break;
1781     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1782 	value = cirrus_vga_read_gr(s, 0x2d);
1783 	break;
1784     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1785 	value = cirrus_vga_read_gr(s, 0x2e);
1786 	break;
1787     case CIRRUS_MMIO_BLTWRITEMASK:
1788 	value = cirrus_vga_read_gr(s, 0x2f);
1789 	break;
1790     case CIRRUS_MMIO_BLTMODE:
1791 	value = cirrus_vga_read_gr(s, 0x30);
1792 	break;
1793     case CIRRUS_MMIO_BLTROP:
1794 	value = cirrus_vga_read_gr(s, 0x32);
1795 	break;
1796     case CIRRUS_MMIO_BLTMODEEXT:
1797 	value = cirrus_vga_read_gr(s, 0x33);
1798 	break;
1799     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1800 	value = cirrus_vga_read_gr(s, 0x34);
1801 	break;
1802     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1803 	value = cirrus_vga_read_gr(s, 0x35);
1804 	break;
1805     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1806 	value = cirrus_vga_read_gr(s, 0x38);
1807 	break;
1808     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1809 	value = cirrus_vga_read_gr(s, 0x39);
1810 	break;
1811     case CIRRUS_MMIO_BLTSTATUS:
1812 	value = cirrus_vga_read_gr(s, 0x31);
1813 	break;
1814     default:
1815 #ifdef DEBUG_CIRRUS
1816 	printf("cirrus: mmio read - address 0x%04x\n", address);
1817 #endif
1818 	break;
1819     }
1820 
1821     return (uint8_t) value;
1822 }
1823 
1824 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1825 				  uint8_t value)
1826 {
1827     switch (address) {
1828     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1829 	cirrus_vga_write_gr(s, 0x00, value);
1830 	break;
1831     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1832 	cirrus_vga_write_gr(s, 0x10, value);
1833 	break;
1834     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1835 	cirrus_vga_write_gr(s, 0x12, value);
1836 	break;
1837     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1838 	cirrus_vga_write_gr(s, 0x14, value);
1839 	break;
1840     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1841 	cirrus_vga_write_gr(s, 0x01, value);
1842 	break;
1843     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1844 	cirrus_vga_write_gr(s, 0x11, value);
1845 	break;
1846     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1847 	cirrus_vga_write_gr(s, 0x13, value);
1848 	break;
1849     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1850 	cirrus_vga_write_gr(s, 0x15, value);
1851 	break;
1852     case (CIRRUS_MMIO_BLTWIDTH + 0):
1853 	cirrus_vga_write_gr(s, 0x20, value);
1854 	break;
1855     case (CIRRUS_MMIO_BLTWIDTH + 1):
1856 	cirrus_vga_write_gr(s, 0x21, value);
1857 	break;
1858     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1859 	cirrus_vga_write_gr(s, 0x22, value);
1860 	break;
1861     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1862 	cirrus_vga_write_gr(s, 0x23, value);
1863 	break;
1864     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1865 	cirrus_vga_write_gr(s, 0x24, value);
1866 	break;
1867     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1868 	cirrus_vga_write_gr(s, 0x25, value);
1869 	break;
1870     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1871 	cirrus_vga_write_gr(s, 0x26, value);
1872 	break;
1873     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1874 	cirrus_vga_write_gr(s, 0x27, value);
1875 	break;
1876     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1877 	cirrus_vga_write_gr(s, 0x28, value);
1878 	break;
1879     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1880 	cirrus_vga_write_gr(s, 0x29, value);
1881 	break;
1882     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1883 	cirrus_vga_write_gr(s, 0x2a, value);
1884 	break;
1885     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1886 	/* ignored */
1887 	break;
1888     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1889 	cirrus_vga_write_gr(s, 0x2c, value);
1890 	break;
1891     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1892 	cirrus_vga_write_gr(s, 0x2d, value);
1893 	break;
1894     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1895 	cirrus_vga_write_gr(s, 0x2e, value);
1896 	break;
1897     case CIRRUS_MMIO_BLTWRITEMASK:
1898 	cirrus_vga_write_gr(s, 0x2f, value);
1899 	break;
1900     case CIRRUS_MMIO_BLTMODE:
1901 	cirrus_vga_write_gr(s, 0x30, value);
1902 	break;
1903     case CIRRUS_MMIO_BLTROP:
1904 	cirrus_vga_write_gr(s, 0x32, value);
1905 	break;
1906     case CIRRUS_MMIO_BLTMODEEXT:
1907 	cirrus_vga_write_gr(s, 0x33, value);
1908 	break;
1909     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1910 	cirrus_vga_write_gr(s, 0x34, value);
1911 	break;
1912     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1913 	cirrus_vga_write_gr(s, 0x35, value);
1914 	break;
1915     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1916 	cirrus_vga_write_gr(s, 0x38, value);
1917 	break;
1918     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1919 	cirrus_vga_write_gr(s, 0x39, value);
1920 	break;
1921     case CIRRUS_MMIO_BLTSTATUS:
1922 	cirrus_vga_write_gr(s, 0x31, value);
1923 	break;
1924     default:
1925 #ifdef DEBUG_CIRRUS
1926 	printf("cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1927 	       address, value);
1928 #endif
1929 	break;
1930     }
1931 }
1932 
1933 /***************************************
1934  *
1935  *  write mode 4/5
1936  *
1937  ***************************************/
1938 
1939 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1940 					     unsigned mode,
1941 					     unsigned offset,
1942 					     uint32_t mem_value)
1943 {
1944     int x;
1945     unsigned val = mem_value;
1946     uint8_t *dst;
1947 
1948     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1949     for (x = 0; x < 8; x++) {
1950 	if (val & 0x80) {
1951 	    *dst = s->cirrus_shadow_gr1;
1952 	} else if (mode == 5) {
1953 	    *dst = s->cirrus_shadow_gr0;
1954 	}
1955 	val <<= 1;
1956 	dst++;
1957     }
1958     memory_region_set_dirty(&s->vga.vram, offset, 8);
1959 }
1960 
1961 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
1962 					      unsigned mode,
1963 					      unsigned offset,
1964 					      uint32_t mem_value)
1965 {
1966     int x;
1967     unsigned val = mem_value;
1968     uint8_t *dst;
1969 
1970     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1971     for (x = 0; x < 8; x++) {
1972 	if (val & 0x80) {
1973 	    *dst = s->cirrus_shadow_gr1;
1974 	    *(dst + 1) = s->vga.gr[0x11];
1975 	} else if (mode == 5) {
1976 	    *dst = s->cirrus_shadow_gr0;
1977 	    *(dst + 1) = s->vga.gr[0x10];
1978 	}
1979 	val <<= 1;
1980 	dst += 2;
1981     }
1982     memory_region_set_dirty(&s->vga.vram, offset, 16);
1983 }
1984 
1985 /***************************************
1986  *
1987  *  memory access between 0xa0000-0xbffff
1988  *
1989  ***************************************/
1990 
1991 static uint64_t cirrus_vga_mem_read(void *opaque,
1992                                     hwaddr addr,
1993                                     uint32_t size)
1994 {
1995     CirrusVGAState *s = opaque;
1996     unsigned bank_index;
1997     unsigned bank_offset;
1998     uint32_t val;
1999 
2000     if ((s->vga.sr[0x07] & 0x01) == 0) {
2001         return vga_mem_readb(&s->vga, addr);
2002     }
2003 
2004     if (addr < 0x10000) {
2005 	/* XXX handle bitblt */
2006 	/* video memory */
2007 	bank_index = addr >> 15;
2008 	bank_offset = addr & 0x7fff;
2009 	if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2010 	    bank_offset += s->cirrus_bank_base[bank_index];
2011 	    if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2012 		bank_offset <<= 4;
2013 	    } else if (s->vga.gr[0x0B] & 0x02) {
2014 		bank_offset <<= 3;
2015 	    }
2016 	    bank_offset &= s->cirrus_addr_mask;
2017 	    val = *(s->vga.vram_ptr + bank_offset);
2018 	} else
2019 	    val = 0xff;
2020     } else if (addr >= 0x18000 && addr < 0x18100) {
2021 	/* memory-mapped I/O */
2022 	val = 0xff;
2023 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2024 	    val = cirrus_mmio_blt_read(s, addr & 0xff);
2025 	}
2026     } else {
2027 	val = 0xff;
2028 #ifdef DEBUG_CIRRUS
2029 	printf("cirrus: mem_readb " TARGET_FMT_plx "\n", addr);
2030 #endif
2031     }
2032     return val;
2033 }
2034 
2035 static void cirrus_vga_mem_write(void *opaque,
2036                                  hwaddr addr,
2037                                  uint64_t mem_value,
2038                                  uint32_t size)
2039 {
2040     CirrusVGAState *s = opaque;
2041     unsigned bank_index;
2042     unsigned bank_offset;
2043     unsigned mode;
2044 
2045     if ((s->vga.sr[0x07] & 0x01) == 0) {
2046         vga_mem_writeb(&s->vga, addr, mem_value);
2047         return;
2048     }
2049 
2050     if (addr < 0x10000) {
2051 	if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2052 	    /* bitblt */
2053 	    *s->cirrus_srcptr++ = (uint8_t) mem_value;
2054 	    if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2055 		cirrus_bitblt_cputovideo_next(s);
2056 	    }
2057 	} else {
2058 	    /* video memory */
2059 	    bank_index = addr >> 15;
2060 	    bank_offset = addr & 0x7fff;
2061 	    if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2062 		bank_offset += s->cirrus_bank_base[bank_index];
2063 		if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2064 		    bank_offset <<= 4;
2065 		} else if (s->vga.gr[0x0B] & 0x02) {
2066 		    bank_offset <<= 3;
2067 		}
2068 		bank_offset &= s->cirrus_addr_mask;
2069 		mode = s->vga.gr[0x05] & 0x7;
2070 		if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2071 		    *(s->vga.vram_ptr + bank_offset) = mem_value;
2072                     memory_region_set_dirty(&s->vga.vram, bank_offset,
2073                                             sizeof(mem_value));
2074 		} else {
2075 		    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2076 			cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2077 							 bank_offset,
2078 							 mem_value);
2079 		    } else {
2080 			cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2081 							  bank_offset,
2082 							  mem_value);
2083 		    }
2084 		}
2085 	    }
2086 	}
2087     } else if (addr >= 0x18000 && addr < 0x18100) {
2088 	/* memory-mapped I/O */
2089 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2090 	    cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2091 	}
2092     } else {
2093 #ifdef DEBUG_CIRRUS
2094         printf("cirrus: mem_writeb " TARGET_FMT_plx " value 0x%02" PRIu64 "\n", addr,
2095                mem_value);
2096 #endif
2097     }
2098 }
2099 
2100 static const MemoryRegionOps cirrus_vga_mem_ops = {
2101     .read = cirrus_vga_mem_read,
2102     .write = cirrus_vga_mem_write,
2103     .endianness = DEVICE_LITTLE_ENDIAN,
2104     .impl = {
2105         .min_access_size = 1,
2106         .max_access_size = 1,
2107     },
2108 };
2109 
2110 /***************************************
2111  *
2112  *  hardware cursor
2113  *
2114  ***************************************/
2115 
2116 static inline void invalidate_cursor1(CirrusVGAState *s)
2117 {
2118     if (s->last_hw_cursor_size) {
2119         vga_invalidate_scanlines(&s->vga,
2120                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2121                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2122     }
2123 }
2124 
2125 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2126 {
2127     const uint8_t *src;
2128     uint32_t content;
2129     int y, y_min, y_max;
2130 
2131     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2132     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2133         src += (s->vga.sr[0x13] & 0x3c) * 256;
2134         y_min = 64;
2135         y_max = -1;
2136         for(y = 0; y < 64; y++) {
2137             content = ((uint32_t *)src)[0] |
2138                 ((uint32_t *)src)[1] |
2139                 ((uint32_t *)src)[2] |
2140                 ((uint32_t *)src)[3];
2141             if (content) {
2142                 if (y < y_min)
2143                     y_min = y;
2144                 if (y > y_max)
2145                     y_max = y;
2146             }
2147             src += 16;
2148         }
2149     } else {
2150         src += (s->vga.sr[0x13] & 0x3f) * 256;
2151         y_min = 32;
2152         y_max = -1;
2153         for(y = 0; y < 32; y++) {
2154             content = ((uint32_t *)src)[0] |
2155                 ((uint32_t *)(src + 128))[0];
2156             if (content) {
2157                 if (y < y_min)
2158                     y_min = y;
2159                 if (y > y_max)
2160                     y_max = y;
2161             }
2162             src += 4;
2163         }
2164     }
2165     if (y_min > y_max) {
2166         s->last_hw_cursor_y_start = 0;
2167         s->last_hw_cursor_y_end = 0;
2168     } else {
2169         s->last_hw_cursor_y_start = y_min;
2170         s->last_hw_cursor_y_end = y_max + 1;
2171     }
2172 }
2173 
2174 /* NOTE: we do not currently handle the cursor bitmap change, so we
2175    update the cursor only if it moves. */
2176 static void cirrus_cursor_invalidate(VGACommonState *s1)
2177 {
2178     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2179     int size;
2180 
2181     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2182         size = 0;
2183     } else {
2184         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2185             size = 64;
2186         else
2187             size = 32;
2188     }
2189     /* invalidate last cursor and new cursor if any change */
2190     if (s->last_hw_cursor_size != size ||
2191         s->last_hw_cursor_x != s->hw_cursor_x ||
2192         s->last_hw_cursor_y != s->hw_cursor_y) {
2193 
2194         invalidate_cursor1(s);
2195 
2196         s->last_hw_cursor_size = size;
2197         s->last_hw_cursor_x = s->hw_cursor_x;
2198         s->last_hw_cursor_y = s->hw_cursor_y;
2199         /* compute the real cursor min and max y */
2200         cirrus_cursor_compute_yrange(s);
2201         invalidate_cursor1(s);
2202     }
2203 }
2204 
2205 static void vga_draw_cursor_line(uint8_t *d1,
2206                                  const uint8_t *src1,
2207                                  int poffset, int w,
2208                                  unsigned int color0,
2209                                  unsigned int color1,
2210                                  unsigned int color_xor)
2211 {
2212     const uint8_t *plane0, *plane1;
2213     int x, b0, b1;
2214     uint8_t *d;
2215 
2216     d = d1;
2217     plane0 = src1;
2218     plane1 = src1 + poffset;
2219     for (x = 0; x < w; x++) {
2220         b0 = (plane0[x >> 3] >> (7 - (x & 7))) & 1;
2221         b1 = (plane1[x >> 3] >> (7 - (x & 7))) & 1;
2222         switch (b0 | (b1 << 1)) {
2223         case 0:
2224             break;
2225         case 1:
2226             ((uint32_t *)d)[0] ^= color_xor;
2227             break;
2228         case 2:
2229             ((uint32_t *)d)[0] = color0;
2230             break;
2231         case 3:
2232             ((uint32_t *)d)[0] = color1;
2233             break;
2234         }
2235         d += 4;
2236     }
2237 }
2238 
2239 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2240 {
2241     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2242     int w, h, x1, x2, poffset;
2243     unsigned int color0, color1;
2244     const uint8_t *palette, *src;
2245     uint32_t content;
2246 
2247     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2248         return;
2249     /* fast test to see if the cursor intersects with the scan line */
2250     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2251         h = 64;
2252     } else {
2253         h = 32;
2254     }
2255     if (scr_y < s->hw_cursor_y ||
2256         scr_y >= (s->hw_cursor_y + h))
2257         return;
2258 
2259     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2260     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2261         src += (s->vga.sr[0x13] & 0x3c) * 256;
2262         src += (scr_y - s->hw_cursor_y) * 16;
2263         poffset = 8;
2264         content = ((uint32_t *)src)[0] |
2265             ((uint32_t *)src)[1] |
2266             ((uint32_t *)src)[2] |
2267             ((uint32_t *)src)[3];
2268     } else {
2269         src += (s->vga.sr[0x13] & 0x3f) * 256;
2270         src += (scr_y - s->hw_cursor_y) * 4;
2271 
2272 
2273         poffset = 128;
2274         content = ((uint32_t *)src)[0] |
2275             ((uint32_t *)(src + 128))[0];
2276     }
2277     /* if nothing to draw, no need to continue */
2278     if (!content)
2279         return;
2280     w = h;
2281 
2282     x1 = s->hw_cursor_x;
2283     if (x1 >= s->vga.last_scr_width)
2284         return;
2285     x2 = s->hw_cursor_x + w;
2286     if (x2 > s->vga.last_scr_width)
2287         x2 = s->vga.last_scr_width;
2288     w = x2 - x1;
2289     palette = s->cirrus_hidden_palette;
2290     color0 = rgb_to_pixel32(c6_to_8(palette[0x0 * 3]),
2291                             c6_to_8(palette[0x0 * 3 + 1]),
2292                             c6_to_8(palette[0x0 * 3 + 2]));
2293     color1 = rgb_to_pixel32(c6_to_8(palette[0xf * 3]),
2294                             c6_to_8(palette[0xf * 3 + 1]),
2295                             c6_to_8(palette[0xf * 3 + 2]));
2296     d1 += x1 * 4;
2297     vga_draw_cursor_line(d1, src, poffset, w, color0, color1, 0xffffff);
2298 }
2299 
2300 /***************************************
2301  *
2302  *  LFB memory access
2303  *
2304  ***************************************/
2305 
2306 static uint64_t cirrus_linear_read(void *opaque, hwaddr addr,
2307                                    unsigned size)
2308 {
2309     CirrusVGAState *s = opaque;
2310     uint32_t ret;
2311 
2312     addr &= s->cirrus_addr_mask;
2313 
2314     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2315         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2316 	/* memory-mapped I/O */
2317 	ret = cirrus_mmio_blt_read(s, addr & 0xff);
2318     } else if (0) {
2319 	/* XXX handle bitblt */
2320 	ret = 0xff;
2321     } else {
2322 	/* video memory */
2323 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2324 	    addr <<= 4;
2325 	} else if (s->vga.gr[0x0B] & 0x02) {
2326 	    addr <<= 3;
2327 	}
2328 	addr &= s->cirrus_addr_mask;
2329 	ret = *(s->vga.vram_ptr + addr);
2330     }
2331 
2332     return ret;
2333 }
2334 
2335 static void cirrus_linear_write(void *opaque, hwaddr addr,
2336                                 uint64_t val, unsigned size)
2337 {
2338     CirrusVGAState *s = opaque;
2339     unsigned mode;
2340 
2341     addr &= s->cirrus_addr_mask;
2342 
2343     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2344         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2345 	/* memory-mapped I/O */
2346 	cirrus_mmio_blt_write(s, addr & 0xff, val);
2347     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2348 	/* bitblt */
2349 	*s->cirrus_srcptr++ = (uint8_t) val;
2350 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2351 	    cirrus_bitblt_cputovideo_next(s);
2352 	}
2353     } else {
2354 	/* video memory */
2355 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2356 	    addr <<= 4;
2357 	} else if (s->vga.gr[0x0B] & 0x02) {
2358 	    addr <<= 3;
2359 	}
2360 	addr &= s->cirrus_addr_mask;
2361 
2362 	mode = s->vga.gr[0x05] & 0x7;
2363 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2364 	    *(s->vga.vram_ptr + addr) = (uint8_t) val;
2365             memory_region_set_dirty(&s->vga.vram, addr, 1);
2366 	} else {
2367 	    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2368 		cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2369 	    } else {
2370 		cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2371 	    }
2372 	}
2373     }
2374 }
2375 
2376 /***************************************
2377  *
2378  *  system to screen memory access
2379  *
2380  ***************************************/
2381 
2382 
2383 static uint64_t cirrus_linear_bitblt_read(void *opaque,
2384                                           hwaddr addr,
2385                                           unsigned size)
2386 {
2387     CirrusVGAState *s = opaque;
2388     uint32_t ret;
2389 
2390     /* XXX handle bitblt */
2391     (void)s;
2392     ret = 0xff;
2393     return ret;
2394 }
2395 
2396 static void cirrus_linear_bitblt_write(void *opaque,
2397                                        hwaddr addr,
2398                                        uint64_t val,
2399                                        unsigned size)
2400 {
2401     CirrusVGAState *s = opaque;
2402 
2403     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2404 	/* bitblt */
2405 	*s->cirrus_srcptr++ = (uint8_t) val;
2406 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2407 	    cirrus_bitblt_cputovideo_next(s);
2408 	}
2409     }
2410 }
2411 
2412 static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
2413     .read = cirrus_linear_bitblt_read,
2414     .write = cirrus_linear_bitblt_write,
2415     .endianness = DEVICE_LITTLE_ENDIAN,
2416     .impl = {
2417         .min_access_size = 1,
2418         .max_access_size = 1,
2419     },
2420 };
2421 
2422 static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
2423 {
2424     MemoryRegion *mr = &s->cirrus_bank[bank];
2425     bool enabled = !(s->cirrus_srcptr != s->cirrus_srcptr_end)
2426         && !((s->vga.sr[0x07] & 0x01) == 0)
2427         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2428         && !(s->vga.gr[0x0B] & 0x02);
2429 
2430     memory_region_set_enabled(mr, enabled);
2431     memory_region_set_alias_offset(mr, s->cirrus_bank_base[bank]);
2432 }
2433 
2434 static void map_linear_vram(CirrusVGAState *s)
2435 {
2436     if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
2437         s->linear_vram = true;
2438         memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
2439     }
2440     map_linear_vram_bank(s, 0);
2441     map_linear_vram_bank(s, 1);
2442 }
2443 
2444 static void unmap_linear_vram(CirrusVGAState *s)
2445 {
2446     if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
2447         s->linear_vram = false;
2448         memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
2449     }
2450     memory_region_set_enabled(&s->cirrus_bank[0], false);
2451     memory_region_set_enabled(&s->cirrus_bank[1], false);
2452 }
2453 
2454 /* Compute the memory access functions */
2455 static void cirrus_update_memory_access(CirrusVGAState *s)
2456 {
2457     unsigned mode;
2458 
2459     memory_region_transaction_begin();
2460     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2461         goto generic_io;
2462     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2463         goto generic_io;
2464     } else {
2465 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2466             goto generic_io;
2467 	} else if (s->vga.gr[0x0B] & 0x02) {
2468             goto generic_io;
2469         }
2470 
2471 	mode = s->vga.gr[0x05] & 0x7;
2472 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2473             map_linear_vram(s);
2474         } else {
2475         generic_io:
2476             unmap_linear_vram(s);
2477         }
2478     }
2479     memory_region_transaction_commit();
2480 }
2481 
2482 
2483 /* I/O ports */
2484 
2485 static uint64_t cirrus_vga_ioport_read(void *opaque, hwaddr addr,
2486                                        unsigned size)
2487 {
2488     CirrusVGAState *c = opaque;
2489     VGACommonState *s = &c->vga;
2490     int val, index;
2491 
2492     addr += 0x3b0;
2493 
2494     if (vga_ioport_invalid(s, addr)) {
2495 	val = 0xff;
2496     } else {
2497 	switch (addr) {
2498 	case 0x3c0:
2499 	    if (s->ar_flip_flop == 0) {
2500 		val = s->ar_index;
2501 	    } else {
2502 		val = 0;
2503 	    }
2504 	    break;
2505 	case 0x3c1:
2506 	    index = s->ar_index & 0x1f;
2507 	    if (index < 21)
2508 		val = s->ar[index];
2509 	    else
2510 		val = 0;
2511 	    break;
2512 	case 0x3c2:
2513 	    val = s->st00;
2514 	    break;
2515 	case 0x3c4:
2516 	    val = s->sr_index;
2517 	    break;
2518 	case 0x3c5:
2519 	    val = cirrus_vga_read_sr(c);
2520             break;
2521 #ifdef DEBUG_VGA_REG
2522 	    printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
2523 #endif
2524 	    break;
2525 	case 0x3c6:
2526 	    val = cirrus_read_hidden_dac(c);
2527 	    break;
2528 	case 0x3c7:
2529 	    val = s->dac_state;
2530 	    break;
2531 	case 0x3c8:
2532 	    val = s->dac_write_index;
2533 	    c->cirrus_hidden_dac_lockindex = 0;
2534 	    break;
2535         case 0x3c9:
2536             val = cirrus_vga_read_palette(c);
2537             break;
2538 	case 0x3ca:
2539 	    val = s->fcr;
2540 	    break;
2541 	case 0x3cc:
2542 	    val = s->msr;
2543 	    break;
2544 	case 0x3ce:
2545 	    val = s->gr_index;
2546 	    break;
2547 	case 0x3cf:
2548 	    val = cirrus_vga_read_gr(c, s->gr_index);
2549 #ifdef DEBUG_VGA_REG
2550 	    printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
2551 #endif
2552 	    break;
2553 	case 0x3b4:
2554 	case 0x3d4:
2555 	    val = s->cr_index;
2556 	    break;
2557 	case 0x3b5:
2558 	case 0x3d5:
2559             val = cirrus_vga_read_cr(c, s->cr_index);
2560 #ifdef DEBUG_VGA_REG
2561 	    printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
2562 #endif
2563 	    break;
2564 	case 0x3ba:
2565 	case 0x3da:
2566 	    /* just toggle to fool polling */
2567 	    val = s->st01 = s->retrace(s);
2568 	    s->ar_flip_flop = 0;
2569 	    break;
2570 	default:
2571 	    val = 0x00;
2572 	    break;
2573 	}
2574     }
2575 #if defined(DEBUG_VGA)
2576     printf("VGA: read addr=0x%04x data=0x%02x\n", addr, val);
2577 #endif
2578     return val;
2579 }
2580 
2581 static void cirrus_vga_ioport_write(void *opaque, hwaddr addr, uint64_t val,
2582                                     unsigned size)
2583 {
2584     CirrusVGAState *c = opaque;
2585     VGACommonState *s = &c->vga;
2586     int index;
2587 
2588     addr += 0x3b0;
2589 
2590     /* check port range access depending on color/monochrome mode */
2591     if (vga_ioport_invalid(s, addr)) {
2592 	return;
2593     }
2594 #ifdef DEBUG_VGA
2595     printf("VGA: write addr=0x%04x data=0x%02x\n", addr, val);
2596 #endif
2597 
2598     switch (addr) {
2599     case 0x3c0:
2600 	if (s->ar_flip_flop == 0) {
2601 	    val &= 0x3f;
2602 	    s->ar_index = val;
2603 	} else {
2604 	    index = s->ar_index & 0x1f;
2605 	    switch (index) {
2606 	    case 0x00 ... 0x0f:
2607 		s->ar[index] = val & 0x3f;
2608 		break;
2609 	    case 0x10:
2610 		s->ar[index] = val & ~0x10;
2611 		break;
2612 	    case 0x11:
2613 		s->ar[index] = val;
2614 		break;
2615 	    case 0x12:
2616 		s->ar[index] = val & ~0xc0;
2617 		break;
2618 	    case 0x13:
2619 		s->ar[index] = val & ~0xf0;
2620 		break;
2621 	    case 0x14:
2622 		s->ar[index] = val & ~0xf0;
2623 		break;
2624 	    default:
2625 		break;
2626 	    }
2627 	}
2628 	s->ar_flip_flop ^= 1;
2629 	break;
2630     case 0x3c2:
2631 	s->msr = val & ~0x10;
2632 	s->update_retrace_info(s);
2633 	break;
2634     case 0x3c4:
2635 	s->sr_index = val;
2636 	break;
2637     case 0x3c5:
2638 #ifdef DEBUG_VGA_REG
2639 	printf("vga: write SR%x = 0x%02" PRIu64 "\n", s->sr_index, val);
2640 #endif
2641 	cirrus_vga_write_sr(c, val);
2642         break;
2643     case 0x3c6:
2644 	cirrus_write_hidden_dac(c, val);
2645 	break;
2646     case 0x3c7:
2647 	s->dac_read_index = val;
2648 	s->dac_sub_index = 0;
2649 	s->dac_state = 3;
2650 	break;
2651     case 0x3c8:
2652 	s->dac_write_index = val;
2653 	s->dac_sub_index = 0;
2654 	s->dac_state = 0;
2655 	break;
2656     case 0x3c9:
2657         cirrus_vga_write_palette(c, val);
2658         break;
2659     case 0x3ce:
2660 	s->gr_index = val;
2661 	break;
2662     case 0x3cf:
2663 #ifdef DEBUG_VGA_REG
2664 	printf("vga: write GR%x = 0x%02" PRIu64 "\n", s->gr_index, val);
2665 #endif
2666 	cirrus_vga_write_gr(c, s->gr_index, val);
2667 	break;
2668     case 0x3b4:
2669     case 0x3d4:
2670 	s->cr_index = val;
2671 	break;
2672     case 0x3b5:
2673     case 0x3d5:
2674 #ifdef DEBUG_VGA_REG
2675 	printf("vga: write CR%x = 0x%02"PRIu64"\n", s->cr_index, val);
2676 #endif
2677 	cirrus_vga_write_cr(c, val);
2678 	break;
2679     case 0x3ba:
2680     case 0x3da:
2681 	s->fcr = val & 0x10;
2682 	break;
2683     }
2684 }
2685 
2686 /***************************************
2687  *
2688  *  memory-mapped I/O access
2689  *
2690  ***************************************/
2691 
2692 static uint64_t cirrus_mmio_read(void *opaque, hwaddr addr,
2693                                  unsigned size)
2694 {
2695     CirrusVGAState *s = opaque;
2696 
2697     if (addr >= 0x100) {
2698         return cirrus_mmio_blt_read(s, addr - 0x100);
2699     } else {
2700         return cirrus_vga_ioport_read(s, addr + 0x10, size);
2701     }
2702 }
2703 
2704 static void cirrus_mmio_write(void *opaque, hwaddr addr,
2705                               uint64_t val, unsigned size)
2706 {
2707     CirrusVGAState *s = opaque;
2708 
2709     if (addr >= 0x100) {
2710 	cirrus_mmio_blt_write(s, addr - 0x100, val);
2711     } else {
2712         cirrus_vga_ioport_write(s, addr + 0x10, val, size);
2713     }
2714 }
2715 
2716 static const MemoryRegionOps cirrus_mmio_io_ops = {
2717     .read = cirrus_mmio_read,
2718     .write = cirrus_mmio_write,
2719     .endianness = DEVICE_LITTLE_ENDIAN,
2720     .impl = {
2721         .min_access_size = 1,
2722         .max_access_size = 1,
2723     },
2724 };
2725 
2726 /* load/save state */
2727 
2728 static int cirrus_post_load(void *opaque, int version_id)
2729 {
2730     CirrusVGAState *s = opaque;
2731 
2732     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2733     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2734 
2735     cirrus_update_memory_access(s);
2736     /* force refresh */
2737     s->vga.graphic_mode = -1;
2738     cirrus_update_bank_ptr(s, 0);
2739     cirrus_update_bank_ptr(s, 1);
2740     return 0;
2741 }
2742 
2743 static const VMStateDescription vmstate_cirrus_vga = {
2744     .name = "cirrus_vga",
2745     .version_id = 2,
2746     .minimum_version_id = 1,
2747     .post_load = cirrus_post_load,
2748     .fields = (VMStateField[]) {
2749         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2750         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2751         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2752         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2753         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2754         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2755         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2756         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2757         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2758         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2759         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2760         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
2761         VMSTATE_UINT8(vga.msr, CirrusVGAState),
2762         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
2763         VMSTATE_UINT8(vga.st00, CirrusVGAState),
2764         VMSTATE_UINT8(vga.st01, CirrusVGAState),
2765         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
2766         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
2767         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
2768         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
2769         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
2770         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
2771         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
2772         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
2773         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
2774         VMSTATE_UINT32(hw_cursor_x, CirrusVGAState),
2775         VMSTATE_UINT32(hw_cursor_y, CirrusVGAState),
2776         /* XXX: we do not save the bitblt state - we assume we do not save
2777            the state when the blitter is active */
2778         VMSTATE_END_OF_LIST()
2779     }
2780 };
2781 
2782 static const VMStateDescription vmstate_pci_cirrus_vga = {
2783     .name = "cirrus_vga",
2784     .version_id = 2,
2785     .minimum_version_id = 2,
2786     .fields = (VMStateField[]) {
2787         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
2788         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
2789                        vmstate_cirrus_vga, CirrusVGAState),
2790         VMSTATE_END_OF_LIST()
2791     }
2792 };
2793 
2794 /***************************************
2795  *
2796  *  initialize
2797  *
2798  ***************************************/
2799 
2800 static void cirrus_reset(void *opaque)
2801 {
2802     CirrusVGAState *s = opaque;
2803 
2804     vga_common_reset(&s->vga);
2805     unmap_linear_vram(s);
2806     s->vga.sr[0x06] = 0x0f;
2807     if (s->device_id == CIRRUS_ID_CLGD5446) {
2808         /* 4MB 64 bit memory config, always PCI */
2809         s->vga.sr[0x1F] = 0x2d;		// MemClock
2810         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
2811         s->vga.sr[0x0f] = 0x98;
2812         s->vga.sr[0x17] = 0x20;
2813         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
2814     } else {
2815         s->vga.sr[0x1F] = 0x22;		// MemClock
2816         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
2817         s->vga.sr[0x17] = s->bustype;
2818         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
2819     }
2820     s->vga.cr[0x27] = s->device_id;
2821 
2822     s->cirrus_hidden_dac_lockindex = 5;
2823     s->cirrus_hidden_dac_data = 0;
2824 }
2825 
2826 static const MemoryRegionOps cirrus_linear_io_ops = {
2827     .read = cirrus_linear_read,
2828     .write = cirrus_linear_write,
2829     .endianness = DEVICE_LITTLE_ENDIAN,
2830     .impl = {
2831         .min_access_size = 1,
2832         .max_access_size = 1,
2833     },
2834 };
2835 
2836 static const MemoryRegionOps cirrus_vga_io_ops = {
2837     .read = cirrus_vga_ioport_read,
2838     .write = cirrus_vga_ioport_write,
2839     .endianness = DEVICE_LITTLE_ENDIAN,
2840     .impl = {
2841         .min_access_size = 1,
2842         .max_access_size = 1,
2843     },
2844 };
2845 
2846 static void cirrus_init_common(CirrusVGAState *s, Object *owner,
2847                                int device_id, int is_pci,
2848                                MemoryRegion *system_memory,
2849                                MemoryRegion *system_io)
2850 {
2851     int i;
2852     static int inited;
2853 
2854     if (!inited) {
2855         inited = 1;
2856         for(i = 0;i < 256; i++)
2857             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
2858         rop_to_index[CIRRUS_ROP_0] = 0;
2859         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
2860         rop_to_index[CIRRUS_ROP_NOP] = 2;
2861         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
2862         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
2863         rop_to_index[CIRRUS_ROP_SRC] = 5;
2864         rop_to_index[CIRRUS_ROP_1] = 6;
2865         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
2866         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
2867         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
2868         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
2869         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
2870         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
2871         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
2872         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
2873         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
2874         s->device_id = device_id;
2875         if (is_pci)
2876             s->bustype = CIRRUS_BUSTYPE_PCI;
2877         else
2878             s->bustype = CIRRUS_BUSTYPE_ISA;
2879     }
2880 
2881     /* Register ioport 0x3b0 - 0x3df */
2882     memory_region_init_io(&s->cirrus_vga_io, owner, &cirrus_vga_io_ops, s,
2883                           "cirrus-io", 0x30);
2884     memory_region_set_flush_coalesced(&s->cirrus_vga_io);
2885     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
2886 
2887     memory_region_init(&s->low_mem_container, owner,
2888                        "cirrus-lowmem-container",
2889                        0x20000);
2890 
2891     memory_region_init_io(&s->low_mem, owner, &cirrus_vga_mem_ops, s,
2892                           "cirrus-low-memory", 0x20000);
2893     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
2894     for (i = 0; i < 2; ++i) {
2895         static const char *names[] = { "vga.bank0", "vga.bank1" };
2896         MemoryRegion *bank = &s->cirrus_bank[i];
2897         memory_region_init_alias(bank, owner, names[i], &s->vga.vram,
2898                                  0, 0x8000);
2899         memory_region_set_enabled(bank, false);
2900         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
2901                                             bank, 1);
2902     }
2903     memory_region_add_subregion_overlap(system_memory,
2904                                         isa_mem_base + 0x000a0000,
2905                                         &s->low_mem_container,
2906                                         1);
2907     memory_region_set_coalescing(&s->low_mem);
2908 
2909     /* I/O handler for LFB */
2910     memory_region_init_io(&s->cirrus_linear_io, owner, &cirrus_linear_io_ops, s,
2911                           "cirrus-linear-io", s->vga.vram_size_mb
2912                                               * 1024 * 1024);
2913     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
2914 
2915     /* I/O handler for LFB */
2916     memory_region_init_io(&s->cirrus_linear_bitblt_io, owner,
2917                           &cirrus_linear_bitblt_io_ops,
2918                           s,
2919                           "cirrus-bitblt-mmio",
2920                           0x400000);
2921     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
2922 
2923     /* I/O handler for memory-mapped I/O */
2924     memory_region_init_io(&s->cirrus_mmio_io, owner, &cirrus_mmio_io_ops, s,
2925                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
2926     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
2927 
2928     s->real_vram_size =
2929         (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;
2930 
2931     /* XXX: s->vga.vram_size must be a power of two */
2932     s->cirrus_addr_mask = s->real_vram_size - 1;
2933     s->linear_mmio_mask = s->real_vram_size - 256;
2934 
2935     s->vga.get_bpp = cirrus_get_bpp;
2936     s->vga.get_offsets = cirrus_get_offsets;
2937     s->vga.get_resolution = cirrus_get_resolution;
2938     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
2939     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
2940 
2941     qemu_register_reset(cirrus_reset, s);
2942 }
2943 
2944 /***************************************
2945  *
2946  *  ISA bus support
2947  *
2948  ***************************************/
2949 
2950 static void isa_cirrus_vga_realizefn(DeviceState *dev, Error **errp)
2951 {
2952     ISADevice *isadev = ISA_DEVICE(dev);
2953     ISACirrusVGAState *d = ISA_CIRRUS_VGA(dev);
2954     VGACommonState *s = &d->cirrus_vga.vga;
2955 
2956     /* follow real hardware, cirrus card emulated has 4 MB video memory.
2957        Also accept 8 MB/16 MB for backward compatibility. */
2958     if (s->vram_size_mb != 4 && s->vram_size_mb != 8 &&
2959         s->vram_size_mb != 16) {
2960         error_setg(errp, "Invalid cirrus_vga ram size '%u'",
2961                    s->vram_size_mb);
2962         return;
2963     }
2964     vga_common_init(s, OBJECT(dev), true);
2965     cirrus_init_common(&d->cirrus_vga, OBJECT(dev), CIRRUS_ID_CLGD5430, 0,
2966                        isa_address_space(isadev),
2967                        isa_address_space_io(isadev));
2968     s->con = graphic_console_init(dev, 0, s->hw_ops, s);
2969     rom_add_vga(VGABIOS_CIRRUS_FILENAME);
2970     /* XXX ISA-LFB support */
2971     /* FIXME not qdev yet */
2972 }
2973 
2974 static Property isa_cirrus_vga_properties[] = {
2975     DEFINE_PROP_UINT32("vgamem_mb", struct ISACirrusVGAState,
2976                        cirrus_vga.vga.vram_size_mb, 8),
2977     DEFINE_PROP_END_OF_LIST(),
2978 };
2979 
2980 static void isa_cirrus_vga_class_init(ObjectClass *klass, void *data)
2981 {
2982     DeviceClass *dc = DEVICE_CLASS(klass);
2983 
2984     dc->vmsd  = &vmstate_cirrus_vga;
2985     dc->realize = isa_cirrus_vga_realizefn;
2986     dc->props = isa_cirrus_vga_properties;
2987     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2988 }
2989 
2990 static const TypeInfo isa_cirrus_vga_info = {
2991     .name          = TYPE_ISA_CIRRUS_VGA,
2992     .parent        = TYPE_ISA_DEVICE,
2993     .instance_size = sizeof(ISACirrusVGAState),
2994     .class_init = isa_cirrus_vga_class_init,
2995 };
2996 
2997 /***************************************
2998  *
2999  *  PCI bus support
3000  *
3001  ***************************************/
3002 
3003 static int pci_cirrus_vga_initfn(PCIDevice *dev)
3004 {
3005      PCICirrusVGAState *d = DO_UPCAST(PCICirrusVGAState, dev, dev);
3006      CirrusVGAState *s = &d->cirrus_vga;
3007      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
3008      int16_t device_id = pc->device_id;
3009 
3010      /* follow real hardware, cirrus card emulated has 4 MB video memory.
3011        Also accept 8 MB/16 MB for backward compatibility. */
3012      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
3013          s->vga.vram_size_mb != 16) {
3014          error_report("Invalid cirrus_vga ram size '%u'",
3015                       s->vga.vram_size_mb);
3016          return -1;
3017      }
3018      /* setup VGA */
3019      vga_common_init(&s->vga, OBJECT(dev), true);
3020      cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
3021                         pci_address_space_io(dev));
3022      s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);
3023 
3024      /* setup PCI */
3025 
3026     memory_region_init(&s->pci_bar, OBJECT(dev), "cirrus-pci-bar0", 0x2000000);
3027 
3028     /* XXX: add byte swapping apertures */
3029     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
3030     memory_region_add_subregion(&s->pci_bar, 0x1000000,
3031                                 &s->cirrus_linear_bitblt_io);
3032 
3033      /* setup memory space */
3034      /* memory #0 LFB */
3035      /* memory #1 memory-mapped I/O */
3036      /* XXX: s->vga.vram_size must be a power of two */
3037      pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);
3038      if (device_id == CIRRUS_ID_CLGD5446) {
3039          pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
3040      }
3041      return 0;
3042 }
3043 
3044 static Property pci_vga_cirrus_properties[] = {
3045     DEFINE_PROP_UINT32("vgamem_mb", struct PCICirrusVGAState,
3046                        cirrus_vga.vga.vram_size_mb, 8),
3047     DEFINE_PROP_END_OF_LIST(),
3048 };
3049 
3050 static void cirrus_vga_class_init(ObjectClass *klass, void *data)
3051 {
3052     DeviceClass *dc = DEVICE_CLASS(klass);
3053     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
3054 
3055     k->init = pci_cirrus_vga_initfn;
3056     k->romfile = VGABIOS_CIRRUS_FILENAME;
3057     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
3058     k->device_id = CIRRUS_ID_CLGD5446;
3059     k->class_id = PCI_CLASS_DISPLAY_VGA;
3060     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3061     dc->desc = "Cirrus CLGD 54xx VGA";
3062     dc->vmsd = &vmstate_pci_cirrus_vga;
3063     dc->props = pci_vga_cirrus_properties;
3064     dc->hotpluggable = false;
3065 }
3066 
3067 static const TypeInfo cirrus_vga_info = {
3068     .name          = "cirrus-vga",
3069     .parent        = TYPE_PCI_DEVICE,
3070     .instance_size = sizeof(PCICirrusVGAState),
3071     .class_init    = cirrus_vga_class_init,
3072 };
3073 
3074 static void cirrus_vga_register_types(void)
3075 {
3076     type_register_static(&isa_cirrus_vga_info);
3077     type_register_static(&cirrus_vga_info);
3078 }
3079 
3080 type_init(cirrus_vga_register_types)
3081