xref: /openbmc/qemu/hw/display/cirrus_vga.c (revision 7562f907)
1 /*
2  * QEMU Cirrus CLGD 54xx VGA Emulator.
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  * Copyright (c) 2004 Makoto Suzuki (suzu)
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * Reference: Finn Thogersons' VGADOC4b
27  *   available at http://home.worldonline.dk/~finth/
28  */
29 #include "qemu/osdep.h"
30 #include "qapi/error.h"
31 #include "trace.h"
32 #include "hw/hw.h"
33 #include "hw/pci/pci.h"
34 #include "ui/console.h"
35 #include "ui/pixel_ops.h"
36 #include "vga_int.h"
37 #include "hw/loader.h"
38 
39 /*
40  * TODO:
41  *    - destination write mask support not complete (bits 5..7)
42  *    - optimize linear mappings
43  *    - optimize bitblt functions
44  */
45 
46 //#define DEBUG_CIRRUS
47 //#define DEBUG_BITBLT
48 
49 /***************************************
50  *
51  *  definitions
52  *
53  ***************************************/
54 
55 // ID
56 #define CIRRUS_ID_CLGD5422  (0x23<<2)
57 #define CIRRUS_ID_CLGD5426  (0x24<<2)
58 #define CIRRUS_ID_CLGD5424  (0x25<<2)
59 #define CIRRUS_ID_CLGD5428  (0x26<<2)
60 #define CIRRUS_ID_CLGD5430  (0x28<<2)
61 #define CIRRUS_ID_CLGD5434  (0x2A<<2)
62 #define CIRRUS_ID_CLGD5436  (0x2B<<2)
63 #define CIRRUS_ID_CLGD5446  (0x2E<<2)
64 
65 // sequencer 0x07
66 #define CIRRUS_SR7_BPP_VGA            0x00
67 #define CIRRUS_SR7_BPP_SVGA           0x01
68 #define CIRRUS_SR7_BPP_MASK           0x0e
69 #define CIRRUS_SR7_BPP_8              0x00
70 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
71 #define CIRRUS_SR7_BPP_24             0x04
72 #define CIRRUS_SR7_BPP_16             0x06
73 #define CIRRUS_SR7_BPP_32             0x08
74 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
75 
76 // sequencer 0x0f
77 #define CIRRUS_MEMSIZE_512k        0x08
78 #define CIRRUS_MEMSIZE_1M          0x10
79 #define CIRRUS_MEMSIZE_2M          0x18
80 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80	// bank switching is enabled.
81 
82 // sequencer 0x12
83 #define CIRRUS_CURSOR_SHOW         0x01
84 #define CIRRUS_CURSOR_HIDDENPEL    0x02
85 #define CIRRUS_CURSOR_LARGE        0x04	// 64x64 if set, 32x32 if clear
86 
87 // sequencer 0x17
88 #define CIRRUS_BUSTYPE_VLBFAST   0x10
89 #define CIRRUS_BUSTYPE_PCI       0x20
90 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
91 #define CIRRUS_BUSTYPE_ISA       0x38
92 #define CIRRUS_MMIO_ENABLE       0x04
93 #define CIRRUS_MMIO_USE_PCIADDR  0x40	// 0xb8000 if cleared.
94 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
95 
96 // control 0x0b
97 #define CIRRUS_BANKING_DUAL             0x01
98 #define CIRRUS_BANKING_GRANULARITY_16K  0x20	// set:16k, clear:4k
99 
100 // control 0x30
101 #define CIRRUS_BLTMODE_BACKWARDS        0x01
102 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
103 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
104 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
105 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
106 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
107 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
108 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
109 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
110 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
111 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
112 
113 // control 0x31
114 #define CIRRUS_BLT_BUSY                 0x01
115 #define CIRRUS_BLT_START                0x02
116 #define CIRRUS_BLT_RESET                0x04
117 #define CIRRUS_BLT_FIFOUSED             0x10
118 #define CIRRUS_BLT_AUTOSTART            0x80
119 
120 // control 0x32
121 #define CIRRUS_ROP_0                    0x00
122 #define CIRRUS_ROP_SRC_AND_DST          0x05
123 #define CIRRUS_ROP_NOP                  0x06
124 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
125 #define CIRRUS_ROP_NOTDST               0x0b
126 #define CIRRUS_ROP_SRC                  0x0d
127 #define CIRRUS_ROP_1                    0x0e
128 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
129 #define CIRRUS_ROP_SRC_XOR_DST          0x59
130 #define CIRRUS_ROP_SRC_OR_DST           0x6d
131 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
132 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
133 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
134 #define CIRRUS_ROP_NOTSRC               0xd0
135 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
136 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
137 
138 #define CIRRUS_ROP_NOP_INDEX 2
139 #define CIRRUS_ROP_SRC_INDEX 5
140 
141 // control 0x33
142 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
143 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
144 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
145 
146 // memory-mapped IO
147 #define CIRRUS_MMIO_BLTBGCOLOR        0x00	// dword
148 #define CIRRUS_MMIO_BLTFGCOLOR        0x04	// dword
149 #define CIRRUS_MMIO_BLTWIDTH          0x08	// word
150 #define CIRRUS_MMIO_BLTHEIGHT         0x0a	// word
151 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c	// word
152 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e	// word
153 #define CIRRUS_MMIO_BLTDESTADDR       0x10	// dword
154 #define CIRRUS_MMIO_BLTSRCADDR        0x14	// dword
155 #define CIRRUS_MMIO_BLTWRITEMASK      0x17	// byte
156 #define CIRRUS_MMIO_BLTMODE           0x18	// byte
157 #define CIRRUS_MMIO_BLTROP            0x1a	// byte
158 #define CIRRUS_MMIO_BLTMODEEXT        0x1b	// byte
159 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c	// word?
160 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20	// word?
161 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24	// word
162 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26	// word
163 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28	// word
164 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a	// word
165 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c	// byte
166 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d	// byte
167 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e	// byte
168 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f	// byte
169 #define CIRRUS_MMIO_BRESENHAM_K1      0x30	// word
170 #define CIRRUS_MMIO_BRESENHAM_K3      0x32	// word
171 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34	// word
172 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36	// word
173 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38	// byte
174 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39	// byte
175 #define CIRRUS_MMIO_BLTSTATUS         0x40	// byte
176 
177 #define CIRRUS_PNPMMIO_SIZE         0x1000
178 
179 struct CirrusVGAState;
180 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
181                                      uint8_t * dst, const uint8_t * src,
182 				     int dstpitch, int srcpitch,
183 				     int bltwidth, int bltheight);
184 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
185                               uint8_t *dst, int dst_pitch, int width, int height);
186 
187 typedef struct CirrusVGAState {
188     VGACommonState vga;
189 
190     MemoryRegion cirrus_vga_io;
191     MemoryRegion cirrus_linear_io;
192     MemoryRegion cirrus_linear_bitblt_io;
193     MemoryRegion cirrus_mmio_io;
194     MemoryRegion pci_bar;
195     bool linear_vram;  /* vga.vram mapped over cirrus_linear_io */
196     MemoryRegion low_mem_container; /* container for 0xa0000-0xc0000 */
197     MemoryRegion low_mem;           /* always mapped, overridden by: */
198     MemoryRegion cirrus_bank[2];    /*   aliases at 0xa0000-0xb0000  */
199     uint32_t cirrus_addr_mask;
200     uint32_t linear_mmio_mask;
201     uint8_t cirrus_shadow_gr0;
202     uint8_t cirrus_shadow_gr1;
203     uint8_t cirrus_hidden_dac_lockindex;
204     uint8_t cirrus_hidden_dac_data;
205     uint32_t cirrus_bank_base[2];
206     uint32_t cirrus_bank_limit[2];
207     uint8_t cirrus_hidden_palette[48];
208     int cirrus_blt_pixelwidth;
209     int cirrus_blt_width;
210     int cirrus_blt_height;
211     int cirrus_blt_dstpitch;
212     int cirrus_blt_srcpitch;
213     uint32_t cirrus_blt_fgcol;
214     uint32_t cirrus_blt_bgcol;
215     uint32_t cirrus_blt_dstaddr;
216     uint32_t cirrus_blt_srcaddr;
217     uint8_t cirrus_blt_mode;
218     uint8_t cirrus_blt_modeext;
219     cirrus_bitblt_rop_t cirrus_rop;
220 #define CIRRUS_BLTBUFSIZE (2048 * 4) /* one line width */
221     uint8_t cirrus_bltbuf[CIRRUS_BLTBUFSIZE];
222     uint8_t *cirrus_srcptr;
223     uint8_t *cirrus_srcptr_end;
224     uint32_t cirrus_srccounter;
225     /* hwcursor display state */
226     int last_hw_cursor_size;
227     int last_hw_cursor_x;
228     int last_hw_cursor_y;
229     int last_hw_cursor_y_start;
230     int last_hw_cursor_y_end;
231     int real_vram_size; /* XXX: suppress that */
232     int device_id;
233     int bustype;
234 } CirrusVGAState;
235 
236 typedef struct PCICirrusVGAState {
237     PCIDevice dev;
238     CirrusVGAState cirrus_vga;
239 } PCICirrusVGAState;
240 
241 #define TYPE_PCI_CIRRUS_VGA "cirrus-vga"
242 #define PCI_CIRRUS_VGA(obj) \
243     OBJECT_CHECK(PCICirrusVGAState, (obj), TYPE_PCI_CIRRUS_VGA)
244 
245 #define TYPE_ISA_CIRRUS_VGA "isa-cirrus-vga"
246 #define ISA_CIRRUS_VGA(obj) \
247     OBJECT_CHECK(ISACirrusVGAState, (obj), TYPE_ISA_CIRRUS_VGA)
248 
249 typedef struct ISACirrusVGAState {
250     ISADevice parent_obj;
251 
252     CirrusVGAState cirrus_vga;
253 } ISACirrusVGAState;
254 
255 static uint8_t rop_to_index[256];
256 
257 /***************************************
258  *
259  *  prototypes.
260  *
261  ***************************************/
262 
263 
264 static void cirrus_bitblt_reset(CirrusVGAState *s);
265 static void cirrus_update_memory_access(CirrusVGAState *s);
266 
267 /***************************************
268  *
269  *  raster operations
270  *
271  ***************************************/
272 
273 static bool blit_region_is_unsafe(struct CirrusVGAState *s,
274                                   int32_t pitch, int32_t addr)
275 {
276     if (!pitch) {
277         return true;
278     }
279     if (pitch < 0) {
280         int64_t min = addr
281             + ((int64_t)s->cirrus_blt_height - 1) * pitch
282             - s->cirrus_blt_width;
283         if (min < -1 || addr >= s->vga.vram_size) {
284             return true;
285         }
286     } else {
287         int64_t max = addr
288             + ((int64_t)s->cirrus_blt_height-1) * pitch
289             + s->cirrus_blt_width;
290         if (max > s->vga.vram_size) {
291             return true;
292         }
293     }
294     return false;
295 }
296 
297 static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only)
298 {
299     /* should be the case, see cirrus_bitblt_start */
300     assert(s->cirrus_blt_width > 0);
301     assert(s->cirrus_blt_height > 0);
302 
303     if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
304         return true;
305     }
306 
307     if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
308                               s->cirrus_blt_dstaddr)) {
309         return true;
310     }
311     if (dst_only) {
312         return false;
313     }
314     if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
315                               s->cirrus_blt_srcaddr)) {
316         return true;
317     }
318 
319     return false;
320 }
321 
322 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
323                                   uint8_t *dst,const uint8_t *src,
324                                   int dstpitch,int srcpitch,
325                                   int bltwidth,int bltheight)
326 {
327 }
328 
329 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
330                                    uint8_t *dst,
331                                    int dstpitch, int bltwidth,int bltheight)
332 {
333 }
334 
335 #define ROP_NAME 0
336 #define ROP_FN(d, s) 0
337 #include "cirrus_vga_rop.h"
338 
339 #define ROP_NAME src_and_dst
340 #define ROP_FN(d, s) (s) & (d)
341 #include "cirrus_vga_rop.h"
342 
343 #define ROP_NAME src_and_notdst
344 #define ROP_FN(d, s) (s) & (~(d))
345 #include "cirrus_vga_rop.h"
346 
347 #define ROP_NAME notdst
348 #define ROP_FN(d, s) ~(d)
349 #include "cirrus_vga_rop.h"
350 
351 #define ROP_NAME src
352 #define ROP_FN(d, s) s
353 #include "cirrus_vga_rop.h"
354 
355 #define ROP_NAME 1
356 #define ROP_FN(d, s) ~0
357 #include "cirrus_vga_rop.h"
358 
359 #define ROP_NAME notsrc_and_dst
360 #define ROP_FN(d, s) (~(s)) & (d)
361 #include "cirrus_vga_rop.h"
362 
363 #define ROP_NAME src_xor_dst
364 #define ROP_FN(d, s) (s) ^ (d)
365 #include "cirrus_vga_rop.h"
366 
367 #define ROP_NAME src_or_dst
368 #define ROP_FN(d, s) (s) | (d)
369 #include "cirrus_vga_rop.h"
370 
371 #define ROP_NAME notsrc_or_notdst
372 #define ROP_FN(d, s) (~(s)) | (~(d))
373 #include "cirrus_vga_rop.h"
374 
375 #define ROP_NAME src_notxor_dst
376 #define ROP_FN(d, s) ~((s) ^ (d))
377 #include "cirrus_vga_rop.h"
378 
379 #define ROP_NAME src_or_notdst
380 #define ROP_FN(d, s) (s) | (~(d))
381 #include "cirrus_vga_rop.h"
382 
383 #define ROP_NAME notsrc
384 #define ROP_FN(d, s) (~(s))
385 #include "cirrus_vga_rop.h"
386 
387 #define ROP_NAME notsrc_or_dst
388 #define ROP_FN(d, s) (~(s)) | (d)
389 #include "cirrus_vga_rop.h"
390 
391 #define ROP_NAME notsrc_and_notdst
392 #define ROP_FN(d, s) (~(s)) & (~(d))
393 #include "cirrus_vga_rop.h"
394 
395 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
396     cirrus_bitblt_rop_fwd_0,
397     cirrus_bitblt_rop_fwd_src_and_dst,
398     cirrus_bitblt_rop_nop,
399     cirrus_bitblt_rop_fwd_src_and_notdst,
400     cirrus_bitblt_rop_fwd_notdst,
401     cirrus_bitblt_rop_fwd_src,
402     cirrus_bitblt_rop_fwd_1,
403     cirrus_bitblt_rop_fwd_notsrc_and_dst,
404     cirrus_bitblt_rop_fwd_src_xor_dst,
405     cirrus_bitblt_rop_fwd_src_or_dst,
406     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
407     cirrus_bitblt_rop_fwd_src_notxor_dst,
408     cirrus_bitblt_rop_fwd_src_or_notdst,
409     cirrus_bitblt_rop_fwd_notsrc,
410     cirrus_bitblt_rop_fwd_notsrc_or_dst,
411     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
412 };
413 
414 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
415     cirrus_bitblt_rop_bkwd_0,
416     cirrus_bitblt_rop_bkwd_src_and_dst,
417     cirrus_bitblt_rop_nop,
418     cirrus_bitblt_rop_bkwd_src_and_notdst,
419     cirrus_bitblt_rop_bkwd_notdst,
420     cirrus_bitblt_rop_bkwd_src,
421     cirrus_bitblt_rop_bkwd_1,
422     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
423     cirrus_bitblt_rop_bkwd_src_xor_dst,
424     cirrus_bitblt_rop_bkwd_src_or_dst,
425     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
426     cirrus_bitblt_rop_bkwd_src_notxor_dst,
427     cirrus_bitblt_rop_bkwd_src_or_notdst,
428     cirrus_bitblt_rop_bkwd_notsrc,
429     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
430     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
431 };
432 
433 #define TRANSP_ROP(name) {\
434     name ## _8,\
435     name ## _16,\
436         }
437 #define TRANSP_NOP(func) {\
438     func,\
439     func,\
440         }
441 
442 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
443     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
444     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
445     TRANSP_NOP(cirrus_bitblt_rop_nop),
446     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
447     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
448     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
449     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
450     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
451     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
452     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
453     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
454     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
455     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
456     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
457     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
458     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
459 };
460 
461 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
462     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
463     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
464     TRANSP_NOP(cirrus_bitblt_rop_nop),
465     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
466     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
467     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
468     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
469     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
470     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
471     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
472     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
473     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
474     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
475     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
476     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
477     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
478 };
479 
480 #define ROP2(name) {\
481     name ## _8,\
482     name ## _16,\
483     name ## _24,\
484     name ## _32,\
485         }
486 
487 #define ROP_NOP2(func) {\
488     func,\
489     func,\
490     func,\
491     func,\
492         }
493 
494 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
495     ROP2(cirrus_patternfill_0),
496     ROP2(cirrus_patternfill_src_and_dst),
497     ROP_NOP2(cirrus_bitblt_rop_nop),
498     ROP2(cirrus_patternfill_src_and_notdst),
499     ROP2(cirrus_patternfill_notdst),
500     ROP2(cirrus_patternfill_src),
501     ROP2(cirrus_patternfill_1),
502     ROP2(cirrus_patternfill_notsrc_and_dst),
503     ROP2(cirrus_patternfill_src_xor_dst),
504     ROP2(cirrus_patternfill_src_or_dst),
505     ROP2(cirrus_patternfill_notsrc_or_notdst),
506     ROP2(cirrus_patternfill_src_notxor_dst),
507     ROP2(cirrus_patternfill_src_or_notdst),
508     ROP2(cirrus_patternfill_notsrc),
509     ROP2(cirrus_patternfill_notsrc_or_dst),
510     ROP2(cirrus_patternfill_notsrc_and_notdst),
511 };
512 
513 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
514     ROP2(cirrus_colorexpand_transp_0),
515     ROP2(cirrus_colorexpand_transp_src_and_dst),
516     ROP_NOP2(cirrus_bitblt_rop_nop),
517     ROP2(cirrus_colorexpand_transp_src_and_notdst),
518     ROP2(cirrus_colorexpand_transp_notdst),
519     ROP2(cirrus_colorexpand_transp_src),
520     ROP2(cirrus_colorexpand_transp_1),
521     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
522     ROP2(cirrus_colorexpand_transp_src_xor_dst),
523     ROP2(cirrus_colorexpand_transp_src_or_dst),
524     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
525     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
526     ROP2(cirrus_colorexpand_transp_src_or_notdst),
527     ROP2(cirrus_colorexpand_transp_notsrc),
528     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
529     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
530 };
531 
532 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
533     ROP2(cirrus_colorexpand_0),
534     ROP2(cirrus_colorexpand_src_and_dst),
535     ROP_NOP2(cirrus_bitblt_rop_nop),
536     ROP2(cirrus_colorexpand_src_and_notdst),
537     ROP2(cirrus_colorexpand_notdst),
538     ROP2(cirrus_colorexpand_src),
539     ROP2(cirrus_colorexpand_1),
540     ROP2(cirrus_colorexpand_notsrc_and_dst),
541     ROP2(cirrus_colorexpand_src_xor_dst),
542     ROP2(cirrus_colorexpand_src_or_dst),
543     ROP2(cirrus_colorexpand_notsrc_or_notdst),
544     ROP2(cirrus_colorexpand_src_notxor_dst),
545     ROP2(cirrus_colorexpand_src_or_notdst),
546     ROP2(cirrus_colorexpand_notsrc),
547     ROP2(cirrus_colorexpand_notsrc_or_dst),
548     ROP2(cirrus_colorexpand_notsrc_and_notdst),
549 };
550 
551 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
552     ROP2(cirrus_colorexpand_pattern_transp_0),
553     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
554     ROP_NOP2(cirrus_bitblt_rop_nop),
555     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
556     ROP2(cirrus_colorexpand_pattern_transp_notdst),
557     ROP2(cirrus_colorexpand_pattern_transp_src),
558     ROP2(cirrus_colorexpand_pattern_transp_1),
559     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
560     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
561     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
562     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
563     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
564     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
565     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
566     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
567     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
568 };
569 
570 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
571     ROP2(cirrus_colorexpand_pattern_0),
572     ROP2(cirrus_colorexpand_pattern_src_and_dst),
573     ROP_NOP2(cirrus_bitblt_rop_nop),
574     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
575     ROP2(cirrus_colorexpand_pattern_notdst),
576     ROP2(cirrus_colorexpand_pattern_src),
577     ROP2(cirrus_colorexpand_pattern_1),
578     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
579     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
580     ROP2(cirrus_colorexpand_pattern_src_or_dst),
581     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
582     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
583     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
584     ROP2(cirrus_colorexpand_pattern_notsrc),
585     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
586     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
587 };
588 
589 static const cirrus_fill_t cirrus_fill[16][4] = {
590     ROP2(cirrus_fill_0),
591     ROP2(cirrus_fill_src_and_dst),
592     ROP_NOP2(cirrus_bitblt_fill_nop),
593     ROP2(cirrus_fill_src_and_notdst),
594     ROP2(cirrus_fill_notdst),
595     ROP2(cirrus_fill_src),
596     ROP2(cirrus_fill_1),
597     ROP2(cirrus_fill_notsrc_and_dst),
598     ROP2(cirrus_fill_src_xor_dst),
599     ROP2(cirrus_fill_src_or_dst),
600     ROP2(cirrus_fill_notsrc_or_notdst),
601     ROP2(cirrus_fill_src_notxor_dst),
602     ROP2(cirrus_fill_src_or_notdst),
603     ROP2(cirrus_fill_notsrc),
604     ROP2(cirrus_fill_notsrc_or_dst),
605     ROP2(cirrus_fill_notsrc_and_notdst),
606 };
607 
608 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
609 {
610     unsigned int color;
611     switch (s->cirrus_blt_pixelwidth) {
612     case 1:
613         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
614         break;
615     case 2:
616         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
617         s->cirrus_blt_fgcol = le16_to_cpu(color);
618         break;
619     case 3:
620         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
621             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
622         break;
623     default:
624     case 4:
625         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
626             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
627         s->cirrus_blt_fgcol = le32_to_cpu(color);
628         break;
629     }
630 }
631 
632 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
633 {
634     unsigned int color;
635     switch (s->cirrus_blt_pixelwidth) {
636     case 1:
637         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
638         break;
639     case 2:
640         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
641         s->cirrus_blt_bgcol = le16_to_cpu(color);
642         break;
643     case 3:
644         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
645             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
646         break;
647     default:
648     case 4:
649         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
650             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
651         s->cirrus_blt_bgcol = le32_to_cpu(color);
652         break;
653     }
654 }
655 
656 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
657 				     int off_pitch, int bytesperline,
658 				     int lines)
659 {
660     int y;
661     int off_cur;
662     int off_cur_end;
663 
664     if (off_pitch < 0) {
665         off_begin -= bytesperline - 1;
666     }
667 
668     for (y = 0; y < lines; y++) {
669 	off_cur = off_begin;
670 	off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
671         assert(off_cur_end >= off_cur);
672         memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);
673 	off_begin += off_pitch;
674     }
675 }
676 
677 static int cirrus_bitblt_common_patterncopy(CirrusVGAState *s, bool videosrc)
678 {
679     uint32_t patternsize;
680     uint8_t *dst;
681     uint8_t *src;
682 
683     dst = s->vga.vram_ptr + s->cirrus_blt_dstaddr;
684 
685     if (videosrc) {
686         switch (s->vga.get_bpp(&s->vga)) {
687         case 8:
688             patternsize = 64;
689             break;
690         case 15:
691         case 16:
692             patternsize = 128;
693             break;
694         case 24:
695         case 32:
696         default:
697             patternsize = 256;
698             break;
699         }
700         s->cirrus_blt_srcaddr &= ~(patternsize - 1);
701         if (s->cirrus_blt_srcaddr + patternsize > s->vga.vram_size) {
702             return 0;
703         }
704         src = s->vga.vram_ptr + s->cirrus_blt_srcaddr;
705     } else {
706         src = s->cirrus_bltbuf;
707     }
708 
709     if (blit_is_unsafe(s, true)) {
710         return 0;
711     }
712 
713     (*s->cirrus_rop) (s, dst, src,
714                       s->cirrus_blt_dstpitch, 0,
715                       s->cirrus_blt_width, s->cirrus_blt_height);
716     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
717                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
718                              s->cirrus_blt_height);
719     return 1;
720 }
721 
722 /* fill */
723 
724 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
725 {
726     cirrus_fill_t rop_func;
727 
728     if (blit_is_unsafe(s, true)) {
729         return 0;
730     }
731     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
732     rop_func(s, s->vga.vram_ptr + s->cirrus_blt_dstaddr,
733              s->cirrus_blt_dstpitch,
734              s->cirrus_blt_width, s->cirrus_blt_height);
735     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
736 			     s->cirrus_blt_dstpitch, s->cirrus_blt_width,
737 			     s->cirrus_blt_height);
738     cirrus_bitblt_reset(s);
739     return 1;
740 }
741 
742 /***************************************
743  *
744  *  bitblt (video-to-video)
745  *
746  ***************************************/
747 
748 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
749 {
750     return cirrus_bitblt_common_patterncopy(s, true);
751 }
752 
753 static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
754 {
755     int sx = 0, sy = 0;
756     int dx = 0, dy = 0;
757     int depth = 0;
758     int notify = 0;
759 
760     /* make sure to only copy if it's a plain copy ROP */
761     if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
762         *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {
763 
764         int width, height;
765 
766         depth = s->vga.get_bpp(&s->vga) / 8;
767         if (!depth) {
768             return 0;
769         }
770         s->vga.get_resolution(&s->vga, &width, &height);
771 
772         /* extra x, y */
773         sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
774         sy = (src / ABS(s->cirrus_blt_srcpitch));
775         dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
776         dy = (dst / ABS(s->cirrus_blt_dstpitch));
777 
778         /* normalize width */
779         w /= depth;
780 
781         /* if we're doing a backward copy, we have to adjust
782            our x/y to be the upper left corner (instead of the lower
783            right corner) */
784         if (s->cirrus_blt_dstpitch < 0) {
785             sx -= (s->cirrus_blt_width / depth) - 1;
786             dx -= (s->cirrus_blt_width / depth) - 1;
787             sy -= s->cirrus_blt_height - 1;
788             dy -= s->cirrus_blt_height - 1;
789         }
790 
791         /* are we in the visible portion of memory? */
792         if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
793             (sx + w) <= width && (sy + h) <= height &&
794             (dx + w) <= width && (dy + h) <= height) {
795             notify = 1;
796         }
797     }
798 
799     /* we have to flush all pending changes so that the copy
800        is generated at the appropriate moment in time */
801     if (notify)
802         graphic_hw_update(s->vga.con);
803 
804     (*s->cirrus_rop) (s, s->vga.vram_ptr + s->cirrus_blt_dstaddr,
805                       s->vga.vram_ptr + s->cirrus_blt_srcaddr,
806 		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
807 		      s->cirrus_blt_width, s->cirrus_blt_height);
808 
809     if (notify) {
810         qemu_console_copy(s->vga.con,
811 			  sx, sy, dx, dy,
812 			  s->cirrus_blt_width / depth,
813 			  s->cirrus_blt_height);
814     }
815 
816     /* we don't have to notify the display that this portion has
817        changed since qemu_console_copy implies this */
818 
819     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
820 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
821 				s->cirrus_blt_height);
822 
823     return 1;
824 }
825 
826 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
827 {
828     if (blit_is_unsafe(s, false))
829         return 0;
830 
831     return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
832             s->cirrus_blt_srcaddr - s->vga.start_addr,
833             s->cirrus_blt_width, s->cirrus_blt_height);
834 }
835 
836 /***************************************
837  *
838  *  bitblt (cpu-to-video)
839  *
840  ***************************************/
841 
842 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
843 {
844     int copy_count;
845     uint8_t *end_ptr;
846 
847     if (s->cirrus_srccounter > 0) {
848         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
849             cirrus_bitblt_common_patterncopy(s, false);
850         the_end:
851             s->cirrus_srccounter = 0;
852             cirrus_bitblt_reset(s);
853         } else {
854             /* at least one scan line */
855             do {
856                 (*s->cirrus_rop)(s, s->vga.vram_ptr + s->cirrus_blt_dstaddr,
857                                   s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
858                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
859                                          s->cirrus_blt_width, 1);
860                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
861                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
862                 if (s->cirrus_srccounter <= 0)
863                     goto the_end;
864                 /* more bytes than needed can be transferred because of
865                    word alignment, so we keep them for the next line */
866                 /* XXX: keep alignment to speed up transfer */
867                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
868                 copy_count = s->cirrus_srcptr_end - end_ptr;
869                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
870                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
871                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
872             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
873         }
874     }
875 }
876 
877 /***************************************
878  *
879  *  bitblt wrapper
880  *
881  ***************************************/
882 
883 static void cirrus_bitblt_reset(CirrusVGAState * s)
884 {
885     int need_update;
886 
887     s->vga.gr[0x31] &=
888 	~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
889     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
890         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
891     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
892     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
893     s->cirrus_srccounter = 0;
894     if (!need_update)
895         return;
896     cirrus_update_memory_access(s);
897 }
898 
899 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
900 {
901     int w;
902 
903     if (blit_is_unsafe(s, true)) {
904         return 0;
905     }
906 
907     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
908     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
909     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
910 
911     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
912 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
913 	    s->cirrus_blt_srcpitch = 8;
914 	} else {
915             /* XXX: check for 24 bpp */
916 	    s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
917 	}
918 	s->cirrus_srccounter = s->cirrus_blt_srcpitch;
919     } else {
920 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
921             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
922             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
923                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
924             else
925                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
926 	} else {
927             /* always align input size to 32 bits */
928 	    s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
929 	}
930         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
931     }
932 
933     /* the blit_is_unsafe call above should catch this */
934     assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
935 
936     s->cirrus_srcptr = s->cirrus_bltbuf;
937     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
938     cirrus_update_memory_access(s);
939     return 1;
940 }
941 
942 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
943 {
944     /* XXX */
945 #ifdef DEBUG_BITBLT
946     printf("cirrus: bitblt (video to cpu) is not implemented yet\n");
947 #endif
948     return 0;
949 }
950 
951 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
952 {
953     int ret;
954 
955     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
956 	ret = cirrus_bitblt_videotovideo_patterncopy(s);
957     } else {
958 	ret = cirrus_bitblt_videotovideo_copy(s);
959     }
960     if (ret)
961 	cirrus_bitblt_reset(s);
962     return ret;
963 }
964 
965 static void cirrus_bitblt_start(CirrusVGAState * s)
966 {
967     uint8_t blt_rop;
968 
969     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
970 
971     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
972     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
973     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
974     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
975     s->cirrus_blt_dstaddr =
976 	(s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
977     s->cirrus_blt_srcaddr =
978 	(s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
979     s->cirrus_blt_mode = s->vga.gr[0x30];
980     s->cirrus_blt_modeext = s->vga.gr[0x33];
981     blt_rop = s->vga.gr[0x32];
982 
983     s->cirrus_blt_dstaddr &= s->cirrus_addr_mask;
984     s->cirrus_blt_srcaddr &= s->cirrus_addr_mask;
985 
986 #ifdef DEBUG_BITBLT
987     printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n",
988            blt_rop,
989            s->cirrus_blt_mode,
990            s->cirrus_blt_modeext,
991            s->cirrus_blt_width,
992            s->cirrus_blt_height,
993            s->cirrus_blt_dstpitch,
994            s->cirrus_blt_srcpitch,
995            s->cirrus_blt_dstaddr,
996            s->cirrus_blt_srcaddr,
997            s->vga.gr[0x2f]);
998 #endif
999 
1000     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
1001     case CIRRUS_BLTMODE_PIXELWIDTH8:
1002 	s->cirrus_blt_pixelwidth = 1;
1003 	break;
1004     case CIRRUS_BLTMODE_PIXELWIDTH16:
1005 	s->cirrus_blt_pixelwidth = 2;
1006 	break;
1007     case CIRRUS_BLTMODE_PIXELWIDTH24:
1008 	s->cirrus_blt_pixelwidth = 3;
1009 	break;
1010     case CIRRUS_BLTMODE_PIXELWIDTH32:
1011 	s->cirrus_blt_pixelwidth = 4;
1012 	break;
1013     default:
1014 #ifdef DEBUG_BITBLT
1015 	printf("cirrus: bitblt - pixel width is unknown\n");
1016 #endif
1017 	goto bitblt_ignore;
1018     }
1019     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
1020 
1021     if ((s->
1022 	 cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
1023 			    CIRRUS_BLTMODE_MEMSYSDEST))
1024 	== (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
1025 #ifdef DEBUG_BITBLT
1026 	printf("cirrus: bitblt - memory-to-memory copy is requested\n");
1027 #endif
1028 	goto bitblt_ignore;
1029     }
1030 
1031     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
1032         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
1033                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
1034                                CIRRUS_BLTMODE_PATTERNCOPY |
1035                                CIRRUS_BLTMODE_COLOREXPAND)) ==
1036          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
1037         cirrus_bitblt_fgcol(s);
1038         cirrus_bitblt_solidfill(s, blt_rop);
1039     } else {
1040         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
1041                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
1042             CIRRUS_BLTMODE_COLOREXPAND) {
1043 
1044             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1045                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1046                     cirrus_bitblt_bgcol(s);
1047                 else
1048                     cirrus_bitblt_fgcol(s);
1049                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1050             } else {
1051                 cirrus_bitblt_fgcol(s);
1052                 cirrus_bitblt_bgcol(s);
1053                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1054             }
1055         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
1056             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
1057                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1058                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1059                         cirrus_bitblt_bgcol(s);
1060                     else
1061                         cirrus_bitblt_fgcol(s);
1062                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1063                 } else {
1064                     cirrus_bitblt_fgcol(s);
1065                     cirrus_bitblt_bgcol(s);
1066                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1067                 }
1068             } else {
1069                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1070             }
1071         } else {
1072 	    if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1073 		if (s->cirrus_blt_pixelwidth > 2) {
1074 		    printf("src transparent without colorexpand must be 8bpp or 16bpp\n");
1075 		    goto bitblt_ignore;
1076 		}
1077 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1078 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1079 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1080 		    s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1081 		} else {
1082 		    s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1083 		}
1084 	    } else {
1085 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1086 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1087 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1088 		    s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1089 		} else {
1090 		    s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1091 		}
1092 	    }
1093 	}
1094         // setup bitblt engine.
1095         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1096             if (!cirrus_bitblt_cputovideo(s))
1097                 goto bitblt_ignore;
1098         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1099             if (!cirrus_bitblt_videotocpu(s))
1100                 goto bitblt_ignore;
1101         } else {
1102             if (!cirrus_bitblt_videotovideo(s))
1103                 goto bitblt_ignore;
1104         }
1105     }
1106     return;
1107   bitblt_ignore:;
1108     cirrus_bitblt_reset(s);
1109 }
1110 
1111 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1112 {
1113     unsigned old_value;
1114 
1115     old_value = s->vga.gr[0x31];
1116     s->vga.gr[0x31] = reg_value;
1117 
1118     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1119 	((reg_value & CIRRUS_BLT_RESET) == 0)) {
1120 	cirrus_bitblt_reset(s);
1121     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1122 	       ((reg_value & CIRRUS_BLT_START) != 0)) {
1123 	cirrus_bitblt_start(s);
1124     }
1125 }
1126 
1127 
1128 /***************************************
1129  *
1130  *  basic parameters
1131  *
1132  ***************************************/
1133 
1134 static void cirrus_get_offsets(VGACommonState *s1,
1135                                uint32_t *pline_offset,
1136                                uint32_t *pstart_addr,
1137                                uint32_t *pline_compare)
1138 {
1139     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1140     uint32_t start_addr, line_offset, line_compare;
1141 
1142     line_offset = s->vga.cr[0x13]
1143 	| ((s->vga.cr[0x1b] & 0x10) << 4);
1144     line_offset <<= 3;
1145     *pline_offset = line_offset;
1146 
1147     start_addr = (s->vga.cr[0x0c] << 8)
1148 	| s->vga.cr[0x0d]
1149 	| ((s->vga.cr[0x1b] & 0x01) << 16)
1150 	| ((s->vga.cr[0x1b] & 0x0c) << 15)
1151 	| ((s->vga.cr[0x1d] & 0x80) << 12);
1152     *pstart_addr = start_addr;
1153 
1154     line_compare = s->vga.cr[0x18] |
1155         ((s->vga.cr[0x07] & 0x10) << 4) |
1156         ((s->vga.cr[0x09] & 0x40) << 3);
1157     *pline_compare = line_compare;
1158 }
1159 
1160 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1161 {
1162     uint32_t ret = 16;
1163 
1164     switch (s->cirrus_hidden_dac_data & 0xf) {
1165     case 0:
1166 	ret = 15;
1167 	break;			/* Sierra HiColor */
1168     case 1:
1169 	ret = 16;
1170 	break;			/* XGA HiColor */
1171     default:
1172 #ifdef DEBUG_CIRRUS
1173 	printf("cirrus: invalid DAC value %x in 16bpp\n",
1174 	       (s->cirrus_hidden_dac_data & 0xf));
1175 #endif
1176 	ret = 15;		/* XXX */
1177 	break;
1178     }
1179     return ret;
1180 }
1181 
1182 static int cirrus_get_bpp(VGACommonState *s1)
1183 {
1184     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1185     uint32_t ret = 8;
1186 
1187     if ((s->vga.sr[0x07] & 0x01) != 0) {
1188 	/* Cirrus SVGA */
1189 	switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1190 	case CIRRUS_SR7_BPP_8:
1191 	    ret = 8;
1192 	    break;
1193 	case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1194 	    ret = cirrus_get_bpp16_depth(s);
1195 	    break;
1196 	case CIRRUS_SR7_BPP_24:
1197 	    ret = 24;
1198 	    break;
1199 	case CIRRUS_SR7_BPP_16:
1200 	    ret = cirrus_get_bpp16_depth(s);
1201 	    break;
1202 	case CIRRUS_SR7_BPP_32:
1203 	    ret = 32;
1204 	    break;
1205 	default:
1206 #ifdef DEBUG_CIRRUS
1207 	    printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1208 #endif
1209 	    ret = 8;
1210 	    break;
1211 	}
1212     } else {
1213 	/* VGA */
1214 	ret = 0;
1215     }
1216 
1217     return ret;
1218 }
1219 
1220 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1221 {
1222     int width, height;
1223 
1224     width = (s->cr[0x01] + 1) * 8;
1225     height = s->cr[0x12] |
1226         ((s->cr[0x07] & 0x02) << 7) |
1227         ((s->cr[0x07] & 0x40) << 3);
1228     height = (height + 1);
1229     /* interlace support */
1230     if (s->cr[0x1a] & 0x01)
1231         height = height * 2;
1232     *pwidth = width;
1233     *pheight = height;
1234 }
1235 
1236 /***************************************
1237  *
1238  * bank memory
1239  *
1240  ***************************************/
1241 
1242 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1243 {
1244     unsigned offset;
1245     unsigned limit;
1246 
1247     if ((s->vga.gr[0x0b] & 0x01) != 0)	/* dual bank */
1248 	offset = s->vga.gr[0x09 + bank_index];
1249     else			/* single bank */
1250 	offset = s->vga.gr[0x09];
1251 
1252     if ((s->vga.gr[0x0b] & 0x20) != 0)
1253 	offset <<= 14;
1254     else
1255 	offset <<= 12;
1256 
1257     if (s->real_vram_size <= offset)
1258 	limit = 0;
1259     else
1260 	limit = s->real_vram_size - offset;
1261 
1262     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1263 	if (limit > 0x8000) {
1264 	    offset += 0x8000;
1265 	    limit -= 0x8000;
1266 	} else {
1267 	    limit = 0;
1268 	}
1269     }
1270 
1271     if (limit > 0) {
1272 	s->cirrus_bank_base[bank_index] = offset;
1273 	s->cirrus_bank_limit[bank_index] = limit;
1274     } else {
1275 	s->cirrus_bank_base[bank_index] = 0;
1276 	s->cirrus_bank_limit[bank_index] = 0;
1277     }
1278 }
1279 
1280 /***************************************
1281  *
1282  *  I/O access between 0x3c4-0x3c5
1283  *
1284  ***************************************/
1285 
1286 static int cirrus_vga_read_sr(CirrusVGAState * s)
1287 {
1288     switch (s->vga.sr_index) {
1289     case 0x00:			// Standard VGA
1290     case 0x01:			// Standard VGA
1291     case 0x02:			// Standard VGA
1292     case 0x03:			// Standard VGA
1293     case 0x04:			// Standard VGA
1294 	return s->vga.sr[s->vga.sr_index];
1295     case 0x06:			// Unlock Cirrus extensions
1296 	return s->vga.sr[s->vga.sr_index];
1297     case 0x10:
1298     case 0x30:
1299     case 0x50:
1300     case 0x70:			// Graphics Cursor X
1301     case 0x90:
1302     case 0xb0:
1303     case 0xd0:
1304     case 0xf0:			// Graphics Cursor X
1305 	return s->vga.sr[0x10];
1306     case 0x11:
1307     case 0x31:
1308     case 0x51:
1309     case 0x71:			// Graphics Cursor Y
1310     case 0x91:
1311     case 0xb1:
1312     case 0xd1:
1313     case 0xf1:			// Graphics Cursor Y
1314 	return s->vga.sr[0x11];
1315     case 0x05:			// ???
1316     case 0x07:			// Extended Sequencer Mode
1317     case 0x08:			// EEPROM Control
1318     case 0x09:			// Scratch Register 0
1319     case 0x0a:			// Scratch Register 1
1320     case 0x0b:			// VCLK 0
1321     case 0x0c:			// VCLK 1
1322     case 0x0d:			// VCLK 2
1323     case 0x0e:			// VCLK 3
1324     case 0x0f:			// DRAM Control
1325     case 0x12:			// Graphics Cursor Attribute
1326     case 0x13:			// Graphics Cursor Pattern Address
1327     case 0x14:			// Scratch Register 2
1328     case 0x15:			// Scratch Register 3
1329     case 0x16:			// Performance Tuning Register
1330     case 0x17:			// Configuration Readback and Extended Control
1331     case 0x18:			// Signature Generator Control
1332     case 0x19:			// Signal Generator Result
1333     case 0x1a:			// Signal Generator Result
1334     case 0x1b:			// VCLK 0 Denominator & Post
1335     case 0x1c:			// VCLK 1 Denominator & Post
1336     case 0x1d:			// VCLK 2 Denominator & Post
1337     case 0x1e:			// VCLK 3 Denominator & Post
1338     case 0x1f:			// BIOS Write Enable and MCLK select
1339 #ifdef DEBUG_CIRRUS
1340 	printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1341 #endif
1342 	return s->vga.sr[s->vga.sr_index];
1343     default:
1344 #ifdef DEBUG_CIRRUS
1345 	printf("cirrus: inport sr_index %02x\n", s->vga.sr_index);
1346 #endif
1347 	return 0xff;
1348 	break;
1349     }
1350 }
1351 
1352 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1353 {
1354     switch (s->vga.sr_index) {
1355     case 0x00:			// Standard VGA
1356     case 0x01:			// Standard VGA
1357     case 0x02:			// Standard VGA
1358     case 0x03:			// Standard VGA
1359     case 0x04:			// Standard VGA
1360 	s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1361 	if (s->vga.sr_index == 1)
1362             s->vga.update_retrace_info(&s->vga);
1363         break;
1364     case 0x06:			// Unlock Cirrus extensions
1365 	val &= 0x17;
1366 	if (val == 0x12) {
1367 	    s->vga.sr[s->vga.sr_index] = 0x12;
1368 	} else {
1369 	    s->vga.sr[s->vga.sr_index] = 0x0f;
1370 	}
1371 	break;
1372     case 0x10:
1373     case 0x30:
1374     case 0x50:
1375     case 0x70:			// Graphics Cursor X
1376     case 0x90:
1377     case 0xb0:
1378     case 0xd0:
1379     case 0xf0:			// Graphics Cursor X
1380 	s->vga.sr[0x10] = val;
1381         s->vga.hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1382 	break;
1383     case 0x11:
1384     case 0x31:
1385     case 0x51:
1386     case 0x71:			// Graphics Cursor Y
1387     case 0x91:
1388     case 0xb1:
1389     case 0xd1:
1390     case 0xf1:			// Graphics Cursor Y
1391 	s->vga.sr[0x11] = val;
1392         s->vga.hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1393 	break;
1394     case 0x07:			// Extended Sequencer Mode
1395     cirrus_update_memory_access(s);
1396     case 0x08:			// EEPROM Control
1397     case 0x09:			// Scratch Register 0
1398     case 0x0a:			// Scratch Register 1
1399     case 0x0b:			// VCLK 0
1400     case 0x0c:			// VCLK 1
1401     case 0x0d:			// VCLK 2
1402     case 0x0e:			// VCLK 3
1403     case 0x0f:			// DRAM Control
1404     case 0x13:			// Graphics Cursor Pattern Address
1405     case 0x14:			// Scratch Register 2
1406     case 0x15:			// Scratch Register 3
1407     case 0x16:			// Performance Tuning Register
1408     case 0x18:			// Signature Generator Control
1409     case 0x19:			// Signature Generator Result
1410     case 0x1a:			// Signature Generator Result
1411     case 0x1b:			// VCLK 0 Denominator & Post
1412     case 0x1c:			// VCLK 1 Denominator & Post
1413     case 0x1d:			// VCLK 2 Denominator & Post
1414     case 0x1e:			// VCLK 3 Denominator & Post
1415     case 0x1f:			// BIOS Write Enable and MCLK select
1416 	s->vga.sr[s->vga.sr_index] = val;
1417 #ifdef DEBUG_CIRRUS
1418 	printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1419 	       s->vga.sr_index, val);
1420 #endif
1421 	break;
1422     case 0x12:			// Graphics Cursor Attribute
1423 	s->vga.sr[0x12] = val;
1424         s->vga.force_shadow = !!(val & CIRRUS_CURSOR_SHOW);
1425 #ifdef DEBUG_CIRRUS
1426         printf("cirrus: cursor ctl SR12=%02x (force shadow: %d)\n",
1427                val, s->vga.force_shadow);
1428 #endif
1429         break;
1430     case 0x17:			// Configuration Readback and Extended Control
1431 	s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1432                                    | (val & 0xc7);
1433         cirrus_update_memory_access(s);
1434         break;
1435     default:
1436 #ifdef DEBUG_CIRRUS
1437 	printf("cirrus: outport sr_index %02x, sr_value %02x\n",
1438                s->vga.sr_index, val);
1439 #endif
1440 	break;
1441     }
1442 }
1443 
1444 /***************************************
1445  *
1446  *  I/O access at 0x3c6
1447  *
1448  ***************************************/
1449 
1450 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1451 {
1452     if (++s->cirrus_hidden_dac_lockindex == 5) {
1453         s->cirrus_hidden_dac_lockindex = 0;
1454         return s->cirrus_hidden_dac_data;
1455     }
1456     return 0xff;
1457 }
1458 
1459 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1460 {
1461     if (s->cirrus_hidden_dac_lockindex == 4) {
1462 	s->cirrus_hidden_dac_data = reg_value;
1463 #if defined(DEBUG_CIRRUS)
1464 	printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1465 #endif
1466     }
1467     s->cirrus_hidden_dac_lockindex = 0;
1468 }
1469 
1470 /***************************************
1471  *
1472  *  I/O access at 0x3c9
1473  *
1474  ***************************************/
1475 
1476 static int cirrus_vga_read_palette(CirrusVGAState * s)
1477 {
1478     int val;
1479 
1480     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1481         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1482                                        s->vga.dac_sub_index];
1483     } else {
1484         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1485     }
1486     if (++s->vga.dac_sub_index == 3) {
1487 	s->vga.dac_sub_index = 0;
1488 	s->vga.dac_read_index++;
1489     }
1490     return val;
1491 }
1492 
1493 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1494 {
1495     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1496     if (++s->vga.dac_sub_index == 3) {
1497         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1498             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1499                    s->vga.dac_cache, 3);
1500         } else {
1501             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1502         }
1503         /* XXX update cursor */
1504 	s->vga.dac_sub_index = 0;
1505 	s->vga.dac_write_index++;
1506     }
1507 }
1508 
1509 /***************************************
1510  *
1511  *  I/O access between 0x3ce-0x3cf
1512  *
1513  ***************************************/
1514 
1515 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1516 {
1517     switch (reg_index) {
1518     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1519         return s->cirrus_shadow_gr0;
1520     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1521         return s->cirrus_shadow_gr1;
1522     case 0x02:			// Standard VGA
1523     case 0x03:			// Standard VGA
1524     case 0x04:			// Standard VGA
1525     case 0x06:			// Standard VGA
1526     case 0x07:			// Standard VGA
1527     case 0x08:			// Standard VGA
1528         return s->vga.gr[s->vga.gr_index];
1529     case 0x05:			// Standard VGA, Cirrus extended mode
1530     default:
1531 	break;
1532     }
1533 
1534     if (reg_index < 0x3a) {
1535 	return s->vga.gr[reg_index];
1536     } else {
1537 #ifdef DEBUG_CIRRUS
1538 	printf("cirrus: inport gr_index %02x\n", reg_index);
1539 #endif
1540 	return 0xff;
1541     }
1542 }
1543 
1544 static void
1545 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1546 {
1547 #if defined(DEBUG_BITBLT) && 0
1548     printf("gr%02x: %02x\n", reg_index, reg_value);
1549 #endif
1550     switch (reg_index) {
1551     case 0x00:			// Standard VGA, BGCOLOR 0x000000ff
1552 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1553 	s->cirrus_shadow_gr0 = reg_value;
1554 	break;
1555     case 0x01:			// Standard VGA, FGCOLOR 0x000000ff
1556 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1557 	s->cirrus_shadow_gr1 = reg_value;
1558 	break;
1559     case 0x02:			// Standard VGA
1560     case 0x03:			// Standard VGA
1561     case 0x04:			// Standard VGA
1562     case 0x06:			// Standard VGA
1563     case 0x07:			// Standard VGA
1564     case 0x08:			// Standard VGA
1565 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1566         break;
1567     case 0x05:			// Standard VGA, Cirrus extended mode
1568 	s->vga.gr[reg_index] = reg_value & 0x7f;
1569         cirrus_update_memory_access(s);
1570 	break;
1571     case 0x09:			// bank offset #0
1572     case 0x0A:			// bank offset #1
1573 	s->vga.gr[reg_index] = reg_value;
1574 	cirrus_update_bank_ptr(s, 0);
1575 	cirrus_update_bank_ptr(s, 1);
1576         cirrus_update_memory_access(s);
1577         break;
1578     case 0x0B:
1579 	s->vga.gr[reg_index] = reg_value;
1580 	cirrus_update_bank_ptr(s, 0);
1581 	cirrus_update_bank_ptr(s, 1);
1582         cirrus_update_memory_access(s);
1583 	break;
1584     case 0x10:			// BGCOLOR 0x0000ff00
1585     case 0x11:			// FGCOLOR 0x0000ff00
1586     case 0x12:			// BGCOLOR 0x00ff0000
1587     case 0x13:			// FGCOLOR 0x00ff0000
1588     case 0x14:			// BGCOLOR 0xff000000
1589     case 0x15:			// FGCOLOR 0xff000000
1590     case 0x20:			// BLT WIDTH 0x0000ff
1591     case 0x22:			// BLT HEIGHT 0x0000ff
1592     case 0x24:			// BLT DEST PITCH 0x0000ff
1593     case 0x26:			// BLT SRC PITCH 0x0000ff
1594     case 0x28:			// BLT DEST ADDR 0x0000ff
1595     case 0x29:			// BLT DEST ADDR 0x00ff00
1596     case 0x2c:			// BLT SRC ADDR 0x0000ff
1597     case 0x2d:			// BLT SRC ADDR 0x00ff00
1598     case 0x2f:                  // BLT WRITEMASK
1599     case 0x30:			// BLT MODE
1600     case 0x32:			// RASTER OP
1601     case 0x33:			// BLT MODEEXT
1602     case 0x34:			// BLT TRANSPARENT COLOR 0x00ff
1603     case 0x35:			// BLT TRANSPARENT COLOR 0xff00
1604     case 0x38:			// BLT TRANSPARENT COLOR MASK 0x00ff
1605     case 0x39:			// BLT TRANSPARENT COLOR MASK 0xff00
1606 	s->vga.gr[reg_index] = reg_value;
1607 	break;
1608     case 0x21:			// BLT WIDTH 0x001f00
1609     case 0x23:			// BLT HEIGHT 0x001f00
1610     case 0x25:			// BLT DEST PITCH 0x001f00
1611     case 0x27:			// BLT SRC PITCH 0x001f00
1612 	s->vga.gr[reg_index] = reg_value & 0x1f;
1613 	break;
1614     case 0x2a:			// BLT DEST ADDR 0x3f0000
1615 	s->vga.gr[reg_index] = reg_value & 0x3f;
1616         /* if auto start mode, starts bit blt now */
1617         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1618             cirrus_bitblt_start(s);
1619         }
1620 	break;
1621     case 0x2e:			// BLT SRC ADDR 0x3f0000
1622 	s->vga.gr[reg_index] = reg_value & 0x3f;
1623 	break;
1624     case 0x31:			// BLT STATUS/START
1625 	cirrus_write_bitblt(s, reg_value);
1626 	break;
1627     default:
1628 #ifdef DEBUG_CIRRUS
1629 	printf("cirrus: outport gr_index %02x, gr_value %02x\n", reg_index,
1630 	       reg_value);
1631 #endif
1632 	break;
1633     }
1634 }
1635 
1636 /***************************************
1637  *
1638  *  I/O access between 0x3d4-0x3d5
1639  *
1640  ***************************************/
1641 
1642 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1643 {
1644     switch (reg_index) {
1645     case 0x00:			// Standard VGA
1646     case 0x01:			// Standard VGA
1647     case 0x02:			// Standard VGA
1648     case 0x03:			// Standard VGA
1649     case 0x04:			// Standard VGA
1650     case 0x05:			// Standard VGA
1651     case 0x06:			// Standard VGA
1652     case 0x07:			// Standard VGA
1653     case 0x08:			// Standard VGA
1654     case 0x09:			// Standard VGA
1655     case 0x0a:			// Standard VGA
1656     case 0x0b:			// Standard VGA
1657     case 0x0c:			// Standard VGA
1658     case 0x0d:			// Standard VGA
1659     case 0x0e:			// Standard VGA
1660     case 0x0f:			// Standard VGA
1661     case 0x10:			// Standard VGA
1662     case 0x11:			// Standard VGA
1663     case 0x12:			// Standard VGA
1664     case 0x13:			// Standard VGA
1665     case 0x14:			// Standard VGA
1666     case 0x15:			// Standard VGA
1667     case 0x16:			// Standard VGA
1668     case 0x17:			// Standard VGA
1669     case 0x18:			// Standard VGA
1670 	return s->vga.cr[s->vga.cr_index];
1671     case 0x24:			// Attribute Controller Toggle Readback (R)
1672         return (s->vga.ar_flip_flop << 7);
1673     case 0x19:			// Interlace End
1674     case 0x1a:			// Miscellaneous Control
1675     case 0x1b:			// Extended Display Control
1676     case 0x1c:			// Sync Adjust and Genlock
1677     case 0x1d:			// Overlay Extended Control
1678     case 0x22:			// Graphics Data Latches Readback (R)
1679     case 0x25:			// Part Status
1680     case 0x27:			// Part ID (R)
1681 	return s->vga.cr[s->vga.cr_index];
1682     case 0x26:			// Attribute Controller Index Readback (R)
1683 	return s->vga.ar_index & 0x3f;
1684 	break;
1685     default:
1686 #ifdef DEBUG_CIRRUS
1687 	printf("cirrus: inport cr_index %02x\n", reg_index);
1688 #endif
1689 	return 0xff;
1690     }
1691 }
1692 
1693 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1694 {
1695     switch (s->vga.cr_index) {
1696     case 0x00:			// Standard VGA
1697     case 0x01:			// Standard VGA
1698     case 0x02:			// Standard VGA
1699     case 0x03:			// Standard VGA
1700     case 0x04:			// Standard VGA
1701     case 0x05:			// Standard VGA
1702     case 0x06:			// Standard VGA
1703     case 0x07:			// Standard VGA
1704     case 0x08:			// Standard VGA
1705     case 0x09:			// Standard VGA
1706     case 0x0a:			// Standard VGA
1707     case 0x0b:			// Standard VGA
1708     case 0x0c:			// Standard VGA
1709     case 0x0d:			// Standard VGA
1710     case 0x0e:			// Standard VGA
1711     case 0x0f:			// Standard VGA
1712     case 0x10:			// Standard VGA
1713     case 0x11:			// Standard VGA
1714     case 0x12:			// Standard VGA
1715     case 0x13:			// Standard VGA
1716     case 0x14:			// Standard VGA
1717     case 0x15:			// Standard VGA
1718     case 0x16:			// Standard VGA
1719     case 0x17:			// Standard VGA
1720     case 0x18:			// Standard VGA
1721 	/* handle CR0-7 protection */
1722 	if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1723 	    /* can always write bit 4 of CR7 */
1724 	    if (s->vga.cr_index == 7)
1725 		s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1726 	    return;
1727 	}
1728 	s->vga.cr[s->vga.cr_index] = reg_value;
1729 	switch(s->vga.cr_index) {
1730 	case 0x00:
1731 	case 0x04:
1732 	case 0x05:
1733 	case 0x06:
1734 	case 0x07:
1735 	case 0x11:
1736 	case 0x17:
1737 	    s->vga.update_retrace_info(&s->vga);
1738 	    break;
1739 	}
1740         break;
1741     case 0x19:			// Interlace End
1742     case 0x1a:			// Miscellaneous Control
1743     case 0x1b:			// Extended Display Control
1744     case 0x1c:			// Sync Adjust and Genlock
1745     case 0x1d:			// Overlay Extended Control
1746 	s->vga.cr[s->vga.cr_index] = reg_value;
1747 #ifdef DEBUG_CIRRUS
1748 	printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1749 	       s->vga.cr_index, reg_value);
1750 #endif
1751 	break;
1752     case 0x22:			// Graphics Data Latches Readback (R)
1753     case 0x24:			// Attribute Controller Toggle Readback (R)
1754     case 0x26:			// Attribute Controller Index Readback (R)
1755     case 0x27:			// Part ID (R)
1756 	break;
1757     case 0x25:			// Part Status
1758     default:
1759 #ifdef DEBUG_CIRRUS
1760 	printf("cirrus: outport cr_index %02x, cr_value %02x\n",
1761                s->vga.cr_index, reg_value);
1762 #endif
1763 	break;
1764     }
1765 }
1766 
1767 /***************************************
1768  *
1769  *  memory-mapped I/O (bitblt)
1770  *
1771  ***************************************/
1772 
1773 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1774 {
1775     int value = 0xff;
1776 
1777     switch (address) {
1778     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1779 	value = cirrus_vga_read_gr(s, 0x00);
1780 	break;
1781     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1782 	value = cirrus_vga_read_gr(s, 0x10);
1783 	break;
1784     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1785 	value = cirrus_vga_read_gr(s, 0x12);
1786 	break;
1787     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1788 	value = cirrus_vga_read_gr(s, 0x14);
1789 	break;
1790     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1791 	value = cirrus_vga_read_gr(s, 0x01);
1792 	break;
1793     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1794 	value = cirrus_vga_read_gr(s, 0x11);
1795 	break;
1796     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1797 	value = cirrus_vga_read_gr(s, 0x13);
1798 	break;
1799     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1800 	value = cirrus_vga_read_gr(s, 0x15);
1801 	break;
1802     case (CIRRUS_MMIO_BLTWIDTH + 0):
1803 	value = cirrus_vga_read_gr(s, 0x20);
1804 	break;
1805     case (CIRRUS_MMIO_BLTWIDTH + 1):
1806 	value = cirrus_vga_read_gr(s, 0x21);
1807 	break;
1808     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1809 	value = cirrus_vga_read_gr(s, 0x22);
1810 	break;
1811     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1812 	value = cirrus_vga_read_gr(s, 0x23);
1813 	break;
1814     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1815 	value = cirrus_vga_read_gr(s, 0x24);
1816 	break;
1817     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1818 	value = cirrus_vga_read_gr(s, 0x25);
1819 	break;
1820     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1821 	value = cirrus_vga_read_gr(s, 0x26);
1822 	break;
1823     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1824 	value = cirrus_vga_read_gr(s, 0x27);
1825 	break;
1826     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1827 	value = cirrus_vga_read_gr(s, 0x28);
1828 	break;
1829     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1830 	value = cirrus_vga_read_gr(s, 0x29);
1831 	break;
1832     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1833 	value = cirrus_vga_read_gr(s, 0x2a);
1834 	break;
1835     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1836 	value = cirrus_vga_read_gr(s, 0x2c);
1837 	break;
1838     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1839 	value = cirrus_vga_read_gr(s, 0x2d);
1840 	break;
1841     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1842 	value = cirrus_vga_read_gr(s, 0x2e);
1843 	break;
1844     case CIRRUS_MMIO_BLTWRITEMASK:
1845 	value = cirrus_vga_read_gr(s, 0x2f);
1846 	break;
1847     case CIRRUS_MMIO_BLTMODE:
1848 	value = cirrus_vga_read_gr(s, 0x30);
1849 	break;
1850     case CIRRUS_MMIO_BLTROP:
1851 	value = cirrus_vga_read_gr(s, 0x32);
1852 	break;
1853     case CIRRUS_MMIO_BLTMODEEXT:
1854 	value = cirrus_vga_read_gr(s, 0x33);
1855 	break;
1856     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1857 	value = cirrus_vga_read_gr(s, 0x34);
1858 	break;
1859     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1860 	value = cirrus_vga_read_gr(s, 0x35);
1861 	break;
1862     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1863 	value = cirrus_vga_read_gr(s, 0x38);
1864 	break;
1865     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1866 	value = cirrus_vga_read_gr(s, 0x39);
1867 	break;
1868     case CIRRUS_MMIO_BLTSTATUS:
1869 	value = cirrus_vga_read_gr(s, 0x31);
1870 	break;
1871     default:
1872 #ifdef DEBUG_CIRRUS
1873 	printf("cirrus: mmio read - address 0x%04x\n", address);
1874 #endif
1875 	break;
1876     }
1877 
1878     trace_vga_cirrus_write_blt(address, value);
1879     return (uint8_t) value;
1880 }
1881 
1882 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1883 				  uint8_t value)
1884 {
1885     trace_vga_cirrus_write_blt(address, value);
1886     switch (address) {
1887     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1888 	cirrus_vga_write_gr(s, 0x00, value);
1889 	break;
1890     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1891 	cirrus_vga_write_gr(s, 0x10, value);
1892 	break;
1893     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1894 	cirrus_vga_write_gr(s, 0x12, value);
1895 	break;
1896     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1897 	cirrus_vga_write_gr(s, 0x14, value);
1898 	break;
1899     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1900 	cirrus_vga_write_gr(s, 0x01, value);
1901 	break;
1902     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1903 	cirrus_vga_write_gr(s, 0x11, value);
1904 	break;
1905     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1906 	cirrus_vga_write_gr(s, 0x13, value);
1907 	break;
1908     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1909 	cirrus_vga_write_gr(s, 0x15, value);
1910 	break;
1911     case (CIRRUS_MMIO_BLTWIDTH + 0):
1912 	cirrus_vga_write_gr(s, 0x20, value);
1913 	break;
1914     case (CIRRUS_MMIO_BLTWIDTH + 1):
1915 	cirrus_vga_write_gr(s, 0x21, value);
1916 	break;
1917     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1918 	cirrus_vga_write_gr(s, 0x22, value);
1919 	break;
1920     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1921 	cirrus_vga_write_gr(s, 0x23, value);
1922 	break;
1923     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1924 	cirrus_vga_write_gr(s, 0x24, value);
1925 	break;
1926     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1927 	cirrus_vga_write_gr(s, 0x25, value);
1928 	break;
1929     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1930 	cirrus_vga_write_gr(s, 0x26, value);
1931 	break;
1932     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1933 	cirrus_vga_write_gr(s, 0x27, value);
1934 	break;
1935     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1936 	cirrus_vga_write_gr(s, 0x28, value);
1937 	break;
1938     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1939 	cirrus_vga_write_gr(s, 0x29, value);
1940 	break;
1941     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1942 	cirrus_vga_write_gr(s, 0x2a, value);
1943 	break;
1944     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1945 	/* ignored */
1946 	break;
1947     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1948 	cirrus_vga_write_gr(s, 0x2c, value);
1949 	break;
1950     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1951 	cirrus_vga_write_gr(s, 0x2d, value);
1952 	break;
1953     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1954 	cirrus_vga_write_gr(s, 0x2e, value);
1955 	break;
1956     case CIRRUS_MMIO_BLTWRITEMASK:
1957 	cirrus_vga_write_gr(s, 0x2f, value);
1958 	break;
1959     case CIRRUS_MMIO_BLTMODE:
1960 	cirrus_vga_write_gr(s, 0x30, value);
1961 	break;
1962     case CIRRUS_MMIO_BLTROP:
1963 	cirrus_vga_write_gr(s, 0x32, value);
1964 	break;
1965     case CIRRUS_MMIO_BLTMODEEXT:
1966 	cirrus_vga_write_gr(s, 0x33, value);
1967 	break;
1968     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1969 	cirrus_vga_write_gr(s, 0x34, value);
1970 	break;
1971     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1972 	cirrus_vga_write_gr(s, 0x35, value);
1973 	break;
1974     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1975 	cirrus_vga_write_gr(s, 0x38, value);
1976 	break;
1977     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1978 	cirrus_vga_write_gr(s, 0x39, value);
1979 	break;
1980     case CIRRUS_MMIO_BLTSTATUS:
1981 	cirrus_vga_write_gr(s, 0x31, value);
1982 	break;
1983     default:
1984 #ifdef DEBUG_CIRRUS
1985 	printf("cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1986 	       address, value);
1987 #endif
1988 	break;
1989     }
1990 }
1991 
1992 /***************************************
1993  *
1994  *  write mode 4/5
1995  *
1996  ***************************************/
1997 
1998 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1999 					     unsigned mode,
2000 					     unsigned offset,
2001 					     uint32_t mem_value)
2002 {
2003     int x;
2004     unsigned val = mem_value;
2005     uint8_t *dst;
2006 
2007     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
2008     for (x = 0; x < 8; x++) {
2009 	if (val & 0x80) {
2010 	    *dst = s->cirrus_shadow_gr1;
2011 	} else if (mode == 5) {
2012 	    *dst = s->cirrus_shadow_gr0;
2013 	}
2014 	val <<= 1;
2015 	dst++;
2016     }
2017     memory_region_set_dirty(&s->vga.vram, offset, 8);
2018 }
2019 
2020 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
2021 					      unsigned mode,
2022 					      unsigned offset,
2023 					      uint32_t mem_value)
2024 {
2025     int x;
2026     unsigned val = mem_value;
2027     uint8_t *dst;
2028 
2029     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
2030     for (x = 0; x < 8; x++) {
2031 	if (val & 0x80) {
2032 	    *dst = s->cirrus_shadow_gr1;
2033 	    *(dst + 1) = s->vga.gr[0x11];
2034 	} else if (mode == 5) {
2035 	    *dst = s->cirrus_shadow_gr0;
2036 	    *(dst + 1) = s->vga.gr[0x10];
2037 	}
2038 	val <<= 1;
2039 	dst += 2;
2040     }
2041     memory_region_set_dirty(&s->vga.vram, offset, 16);
2042 }
2043 
2044 /***************************************
2045  *
2046  *  memory access between 0xa0000-0xbffff
2047  *
2048  ***************************************/
2049 
2050 static uint64_t cirrus_vga_mem_read(void *opaque,
2051                                     hwaddr addr,
2052                                     uint32_t size)
2053 {
2054     CirrusVGAState *s = opaque;
2055     unsigned bank_index;
2056     unsigned bank_offset;
2057     uint32_t val;
2058 
2059     if ((s->vga.sr[0x07] & 0x01) == 0) {
2060         return vga_mem_readb(&s->vga, addr);
2061     }
2062 
2063     if (addr < 0x10000) {
2064 	/* XXX handle bitblt */
2065 	/* video memory */
2066 	bank_index = addr >> 15;
2067 	bank_offset = addr & 0x7fff;
2068 	if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2069 	    bank_offset += s->cirrus_bank_base[bank_index];
2070 	    if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2071 		bank_offset <<= 4;
2072 	    } else if (s->vga.gr[0x0B] & 0x02) {
2073 		bank_offset <<= 3;
2074 	    }
2075 	    bank_offset &= s->cirrus_addr_mask;
2076 	    val = *(s->vga.vram_ptr + bank_offset);
2077 	} else
2078 	    val = 0xff;
2079     } else if (addr >= 0x18000 && addr < 0x18100) {
2080 	/* memory-mapped I/O */
2081 	val = 0xff;
2082 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2083 	    val = cirrus_mmio_blt_read(s, addr & 0xff);
2084 	}
2085     } else {
2086 	val = 0xff;
2087 #ifdef DEBUG_CIRRUS
2088 	printf("cirrus: mem_readb " TARGET_FMT_plx "\n", addr);
2089 #endif
2090     }
2091     return val;
2092 }
2093 
2094 static void cirrus_vga_mem_write(void *opaque,
2095                                  hwaddr addr,
2096                                  uint64_t mem_value,
2097                                  uint32_t size)
2098 {
2099     CirrusVGAState *s = opaque;
2100     unsigned bank_index;
2101     unsigned bank_offset;
2102     unsigned mode;
2103 
2104     if ((s->vga.sr[0x07] & 0x01) == 0) {
2105         vga_mem_writeb(&s->vga, addr, mem_value);
2106         return;
2107     }
2108 
2109     if (addr < 0x10000) {
2110 	if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2111 	    /* bitblt */
2112 	    *s->cirrus_srcptr++ = (uint8_t) mem_value;
2113 	    if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2114 		cirrus_bitblt_cputovideo_next(s);
2115 	    }
2116 	} else {
2117 	    /* video memory */
2118 	    bank_index = addr >> 15;
2119 	    bank_offset = addr & 0x7fff;
2120 	    if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2121 		bank_offset += s->cirrus_bank_base[bank_index];
2122 		if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2123 		    bank_offset <<= 4;
2124 		} else if (s->vga.gr[0x0B] & 0x02) {
2125 		    bank_offset <<= 3;
2126 		}
2127 		bank_offset &= s->cirrus_addr_mask;
2128 		mode = s->vga.gr[0x05] & 0x7;
2129 		if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2130 		    *(s->vga.vram_ptr + bank_offset) = mem_value;
2131                     memory_region_set_dirty(&s->vga.vram, bank_offset,
2132                                             sizeof(mem_value));
2133 		} else {
2134 		    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2135 			cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2136 							 bank_offset,
2137 							 mem_value);
2138 		    } else {
2139 			cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2140 							  bank_offset,
2141 							  mem_value);
2142 		    }
2143 		}
2144 	    }
2145 	}
2146     } else if (addr >= 0x18000 && addr < 0x18100) {
2147 	/* memory-mapped I/O */
2148 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2149 	    cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2150 	}
2151     } else {
2152 #ifdef DEBUG_CIRRUS
2153         printf("cirrus: mem_writeb " TARGET_FMT_plx " value 0x%02" PRIu64 "\n", addr,
2154                mem_value);
2155 #endif
2156     }
2157 }
2158 
2159 static const MemoryRegionOps cirrus_vga_mem_ops = {
2160     .read = cirrus_vga_mem_read,
2161     .write = cirrus_vga_mem_write,
2162     .endianness = DEVICE_LITTLE_ENDIAN,
2163     .impl = {
2164         .min_access_size = 1,
2165         .max_access_size = 1,
2166     },
2167 };
2168 
2169 /***************************************
2170  *
2171  *  hardware cursor
2172  *
2173  ***************************************/
2174 
2175 static inline void invalidate_cursor1(CirrusVGAState *s)
2176 {
2177     if (s->last_hw_cursor_size) {
2178         vga_invalidate_scanlines(&s->vga,
2179                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2180                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2181     }
2182 }
2183 
2184 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2185 {
2186     const uint8_t *src;
2187     uint32_t content;
2188     int y, y_min, y_max;
2189 
2190     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2191     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2192         src += (s->vga.sr[0x13] & 0x3c) * 256;
2193         y_min = 64;
2194         y_max = -1;
2195         for(y = 0; y < 64; y++) {
2196             content = ((uint32_t *)src)[0] |
2197                 ((uint32_t *)src)[1] |
2198                 ((uint32_t *)src)[2] |
2199                 ((uint32_t *)src)[3];
2200             if (content) {
2201                 if (y < y_min)
2202                     y_min = y;
2203                 if (y > y_max)
2204                     y_max = y;
2205             }
2206             src += 16;
2207         }
2208     } else {
2209         src += (s->vga.sr[0x13] & 0x3f) * 256;
2210         y_min = 32;
2211         y_max = -1;
2212         for(y = 0; y < 32; y++) {
2213             content = ((uint32_t *)src)[0] |
2214                 ((uint32_t *)(src + 128))[0];
2215             if (content) {
2216                 if (y < y_min)
2217                     y_min = y;
2218                 if (y > y_max)
2219                     y_max = y;
2220             }
2221             src += 4;
2222         }
2223     }
2224     if (y_min > y_max) {
2225         s->last_hw_cursor_y_start = 0;
2226         s->last_hw_cursor_y_end = 0;
2227     } else {
2228         s->last_hw_cursor_y_start = y_min;
2229         s->last_hw_cursor_y_end = y_max + 1;
2230     }
2231 }
2232 
2233 /* NOTE: we do not currently handle the cursor bitmap change, so we
2234    update the cursor only if it moves. */
2235 static void cirrus_cursor_invalidate(VGACommonState *s1)
2236 {
2237     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2238     int size;
2239 
2240     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2241         size = 0;
2242     } else {
2243         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2244             size = 64;
2245         else
2246             size = 32;
2247     }
2248     /* invalidate last cursor and new cursor if any change */
2249     if (s->last_hw_cursor_size != size ||
2250         s->last_hw_cursor_x != s->vga.hw_cursor_x ||
2251         s->last_hw_cursor_y != s->vga.hw_cursor_y) {
2252 
2253         invalidate_cursor1(s);
2254 
2255         s->last_hw_cursor_size = size;
2256         s->last_hw_cursor_x = s->vga.hw_cursor_x;
2257         s->last_hw_cursor_y = s->vga.hw_cursor_y;
2258         /* compute the real cursor min and max y */
2259         cirrus_cursor_compute_yrange(s);
2260         invalidate_cursor1(s);
2261     }
2262 }
2263 
2264 static void vga_draw_cursor_line(uint8_t *d1,
2265                                  const uint8_t *src1,
2266                                  int poffset, int w,
2267                                  unsigned int color0,
2268                                  unsigned int color1,
2269                                  unsigned int color_xor)
2270 {
2271     const uint8_t *plane0, *plane1;
2272     int x, b0, b1;
2273     uint8_t *d;
2274 
2275     d = d1;
2276     plane0 = src1;
2277     plane1 = src1 + poffset;
2278     for (x = 0; x < w; x++) {
2279         b0 = (plane0[x >> 3] >> (7 - (x & 7))) & 1;
2280         b1 = (plane1[x >> 3] >> (7 - (x & 7))) & 1;
2281         switch (b0 | (b1 << 1)) {
2282         case 0:
2283             break;
2284         case 1:
2285             ((uint32_t *)d)[0] ^= color_xor;
2286             break;
2287         case 2:
2288             ((uint32_t *)d)[0] = color0;
2289             break;
2290         case 3:
2291             ((uint32_t *)d)[0] = color1;
2292             break;
2293         }
2294         d += 4;
2295     }
2296 }
2297 
2298 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2299 {
2300     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2301     int w, h, x1, x2, poffset;
2302     unsigned int color0, color1;
2303     const uint8_t *palette, *src;
2304     uint32_t content;
2305 
2306     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2307         return;
2308     /* fast test to see if the cursor intersects with the scan line */
2309     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2310         h = 64;
2311     } else {
2312         h = 32;
2313     }
2314     if (scr_y < s->vga.hw_cursor_y ||
2315         scr_y >= (s->vga.hw_cursor_y + h)) {
2316         return;
2317     }
2318 
2319     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2320     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2321         src += (s->vga.sr[0x13] & 0x3c) * 256;
2322         src += (scr_y - s->vga.hw_cursor_y) * 16;
2323         poffset = 8;
2324         content = ((uint32_t *)src)[0] |
2325             ((uint32_t *)src)[1] |
2326             ((uint32_t *)src)[2] |
2327             ((uint32_t *)src)[3];
2328     } else {
2329         src += (s->vga.sr[0x13] & 0x3f) * 256;
2330         src += (scr_y - s->vga.hw_cursor_y) * 4;
2331 
2332 
2333         poffset = 128;
2334         content = ((uint32_t *)src)[0] |
2335             ((uint32_t *)(src + 128))[0];
2336     }
2337     /* if nothing to draw, no need to continue */
2338     if (!content)
2339         return;
2340     w = h;
2341 
2342     x1 = s->vga.hw_cursor_x;
2343     if (x1 >= s->vga.last_scr_width)
2344         return;
2345     x2 = s->vga.hw_cursor_x + w;
2346     if (x2 > s->vga.last_scr_width)
2347         x2 = s->vga.last_scr_width;
2348     w = x2 - x1;
2349     palette = s->cirrus_hidden_palette;
2350     color0 = rgb_to_pixel32(c6_to_8(palette[0x0 * 3]),
2351                             c6_to_8(palette[0x0 * 3 + 1]),
2352                             c6_to_8(palette[0x0 * 3 + 2]));
2353     color1 = rgb_to_pixel32(c6_to_8(palette[0xf * 3]),
2354                             c6_to_8(palette[0xf * 3 + 1]),
2355                             c6_to_8(palette[0xf * 3 + 2]));
2356     d1 += x1 * 4;
2357     vga_draw_cursor_line(d1, src, poffset, w, color0, color1, 0xffffff);
2358 }
2359 
2360 /***************************************
2361  *
2362  *  LFB memory access
2363  *
2364  ***************************************/
2365 
2366 static uint64_t cirrus_linear_read(void *opaque, hwaddr addr,
2367                                    unsigned size)
2368 {
2369     CirrusVGAState *s = opaque;
2370     uint32_t ret;
2371 
2372     addr &= s->cirrus_addr_mask;
2373 
2374     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2375         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2376 	/* memory-mapped I/O */
2377 	ret = cirrus_mmio_blt_read(s, addr & 0xff);
2378     } else if (0) {
2379 	/* XXX handle bitblt */
2380 	ret = 0xff;
2381     } else {
2382 	/* video memory */
2383 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2384 	    addr <<= 4;
2385 	} else if (s->vga.gr[0x0B] & 0x02) {
2386 	    addr <<= 3;
2387 	}
2388 	addr &= s->cirrus_addr_mask;
2389 	ret = *(s->vga.vram_ptr + addr);
2390     }
2391 
2392     return ret;
2393 }
2394 
2395 static void cirrus_linear_write(void *opaque, hwaddr addr,
2396                                 uint64_t val, unsigned size)
2397 {
2398     CirrusVGAState *s = opaque;
2399     unsigned mode;
2400 
2401     addr &= s->cirrus_addr_mask;
2402 
2403     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2404         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2405 	/* memory-mapped I/O */
2406 	cirrus_mmio_blt_write(s, addr & 0xff, val);
2407     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2408 	/* bitblt */
2409 	*s->cirrus_srcptr++ = (uint8_t) val;
2410 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2411 	    cirrus_bitblt_cputovideo_next(s);
2412 	}
2413     } else {
2414 	/* video memory */
2415 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2416 	    addr <<= 4;
2417 	} else if (s->vga.gr[0x0B] & 0x02) {
2418 	    addr <<= 3;
2419 	}
2420 	addr &= s->cirrus_addr_mask;
2421 
2422 	mode = s->vga.gr[0x05] & 0x7;
2423 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2424 	    *(s->vga.vram_ptr + addr) = (uint8_t) val;
2425             memory_region_set_dirty(&s->vga.vram, addr, 1);
2426 	} else {
2427 	    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2428 		cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2429 	    } else {
2430 		cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2431 	    }
2432 	}
2433     }
2434 }
2435 
2436 /***************************************
2437  *
2438  *  system to screen memory access
2439  *
2440  ***************************************/
2441 
2442 
2443 static uint64_t cirrus_linear_bitblt_read(void *opaque,
2444                                           hwaddr addr,
2445                                           unsigned size)
2446 {
2447     CirrusVGAState *s = opaque;
2448     uint32_t ret;
2449 
2450     /* XXX handle bitblt */
2451     (void)s;
2452     ret = 0xff;
2453     return ret;
2454 }
2455 
2456 static void cirrus_linear_bitblt_write(void *opaque,
2457                                        hwaddr addr,
2458                                        uint64_t val,
2459                                        unsigned size)
2460 {
2461     CirrusVGAState *s = opaque;
2462 
2463     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2464 	/* bitblt */
2465 	*s->cirrus_srcptr++ = (uint8_t) val;
2466 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2467 	    cirrus_bitblt_cputovideo_next(s);
2468 	}
2469     }
2470 }
2471 
2472 static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
2473     .read = cirrus_linear_bitblt_read,
2474     .write = cirrus_linear_bitblt_write,
2475     .endianness = DEVICE_LITTLE_ENDIAN,
2476     .impl = {
2477         .min_access_size = 1,
2478         .max_access_size = 1,
2479     },
2480 };
2481 
2482 static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
2483 {
2484     MemoryRegion *mr = &s->cirrus_bank[bank];
2485     bool enabled = !(s->cirrus_srcptr != s->cirrus_srcptr_end)
2486         && !((s->vga.sr[0x07] & 0x01) == 0)
2487         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2488         && !(s->vga.gr[0x0B] & 0x02);
2489 
2490     memory_region_set_enabled(mr, enabled);
2491     memory_region_set_alias_offset(mr, s->cirrus_bank_base[bank]);
2492 }
2493 
2494 static void map_linear_vram(CirrusVGAState *s)
2495 {
2496     if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
2497         s->linear_vram = true;
2498         memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
2499     }
2500     map_linear_vram_bank(s, 0);
2501     map_linear_vram_bank(s, 1);
2502 }
2503 
2504 static void unmap_linear_vram(CirrusVGAState *s)
2505 {
2506     if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
2507         s->linear_vram = false;
2508         memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
2509     }
2510     memory_region_set_enabled(&s->cirrus_bank[0], false);
2511     memory_region_set_enabled(&s->cirrus_bank[1], false);
2512 }
2513 
2514 /* Compute the memory access functions */
2515 static void cirrus_update_memory_access(CirrusVGAState *s)
2516 {
2517     unsigned mode;
2518 
2519     memory_region_transaction_begin();
2520     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2521         goto generic_io;
2522     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2523         goto generic_io;
2524     } else {
2525 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2526             goto generic_io;
2527 	} else if (s->vga.gr[0x0B] & 0x02) {
2528             goto generic_io;
2529         }
2530 
2531 	mode = s->vga.gr[0x05] & 0x7;
2532 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2533             map_linear_vram(s);
2534         } else {
2535         generic_io:
2536             unmap_linear_vram(s);
2537         }
2538     }
2539     memory_region_transaction_commit();
2540 }
2541 
2542 
2543 /* I/O ports */
2544 
2545 static uint64_t cirrus_vga_ioport_read(void *opaque, hwaddr addr,
2546                                        unsigned size)
2547 {
2548     CirrusVGAState *c = opaque;
2549     VGACommonState *s = &c->vga;
2550     int val, index;
2551 
2552     addr += 0x3b0;
2553 
2554     if (vga_ioport_invalid(s, addr)) {
2555 	val = 0xff;
2556     } else {
2557 	switch (addr) {
2558 	case 0x3c0:
2559 	    if (s->ar_flip_flop == 0) {
2560 		val = s->ar_index;
2561 	    } else {
2562 		val = 0;
2563 	    }
2564 	    break;
2565 	case 0x3c1:
2566 	    index = s->ar_index & 0x1f;
2567 	    if (index < 21)
2568 		val = s->ar[index];
2569 	    else
2570 		val = 0;
2571 	    break;
2572 	case 0x3c2:
2573 	    val = s->st00;
2574 	    break;
2575 	case 0x3c4:
2576 	    val = s->sr_index;
2577 	    break;
2578 	case 0x3c5:
2579 	    val = cirrus_vga_read_sr(c);
2580             break;
2581 #ifdef DEBUG_VGA_REG
2582 	    printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
2583 #endif
2584 	    break;
2585 	case 0x3c6:
2586 	    val = cirrus_read_hidden_dac(c);
2587 	    break;
2588 	case 0x3c7:
2589 	    val = s->dac_state;
2590 	    break;
2591 	case 0x3c8:
2592 	    val = s->dac_write_index;
2593 	    c->cirrus_hidden_dac_lockindex = 0;
2594 	    break;
2595         case 0x3c9:
2596             val = cirrus_vga_read_palette(c);
2597             break;
2598 	case 0x3ca:
2599 	    val = s->fcr;
2600 	    break;
2601 	case 0x3cc:
2602 	    val = s->msr;
2603 	    break;
2604 	case 0x3ce:
2605 	    val = s->gr_index;
2606 	    break;
2607 	case 0x3cf:
2608 	    val = cirrus_vga_read_gr(c, s->gr_index);
2609 #ifdef DEBUG_VGA_REG
2610 	    printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
2611 #endif
2612 	    break;
2613 	case 0x3b4:
2614 	case 0x3d4:
2615 	    val = s->cr_index;
2616 	    break;
2617 	case 0x3b5:
2618 	case 0x3d5:
2619             val = cirrus_vga_read_cr(c, s->cr_index);
2620 #ifdef DEBUG_VGA_REG
2621 	    printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
2622 #endif
2623 	    break;
2624 	case 0x3ba:
2625 	case 0x3da:
2626 	    /* just toggle to fool polling */
2627 	    val = s->st01 = s->retrace(s);
2628 	    s->ar_flip_flop = 0;
2629 	    break;
2630 	default:
2631 	    val = 0x00;
2632 	    break;
2633 	}
2634     }
2635     trace_vga_cirrus_read_io(addr, val);
2636     return val;
2637 }
2638 
2639 static void cirrus_vga_ioport_write(void *opaque, hwaddr addr, uint64_t val,
2640                                     unsigned size)
2641 {
2642     CirrusVGAState *c = opaque;
2643     VGACommonState *s = &c->vga;
2644     int index;
2645 
2646     addr += 0x3b0;
2647 
2648     /* check port range access depending on color/monochrome mode */
2649     if (vga_ioport_invalid(s, addr)) {
2650 	return;
2651     }
2652     trace_vga_cirrus_write_io(addr, val);
2653 
2654     switch (addr) {
2655     case 0x3c0:
2656 	if (s->ar_flip_flop == 0) {
2657 	    val &= 0x3f;
2658 	    s->ar_index = val;
2659 	} else {
2660 	    index = s->ar_index & 0x1f;
2661 	    switch (index) {
2662 	    case 0x00 ... 0x0f:
2663 		s->ar[index] = val & 0x3f;
2664 		break;
2665 	    case 0x10:
2666 		s->ar[index] = val & ~0x10;
2667 		break;
2668 	    case 0x11:
2669 		s->ar[index] = val;
2670 		break;
2671 	    case 0x12:
2672 		s->ar[index] = val & ~0xc0;
2673 		break;
2674 	    case 0x13:
2675 		s->ar[index] = val & ~0xf0;
2676 		break;
2677 	    case 0x14:
2678 		s->ar[index] = val & ~0xf0;
2679 		break;
2680 	    default:
2681 		break;
2682 	    }
2683 	}
2684 	s->ar_flip_flop ^= 1;
2685 	break;
2686     case 0x3c2:
2687 	s->msr = val & ~0x10;
2688 	s->update_retrace_info(s);
2689 	break;
2690     case 0x3c4:
2691 	s->sr_index = val;
2692 	break;
2693     case 0x3c5:
2694 #ifdef DEBUG_VGA_REG
2695 	printf("vga: write SR%x = 0x%02" PRIu64 "\n", s->sr_index, val);
2696 #endif
2697 	cirrus_vga_write_sr(c, val);
2698         break;
2699     case 0x3c6:
2700 	cirrus_write_hidden_dac(c, val);
2701 	break;
2702     case 0x3c7:
2703 	s->dac_read_index = val;
2704 	s->dac_sub_index = 0;
2705 	s->dac_state = 3;
2706 	break;
2707     case 0x3c8:
2708 	s->dac_write_index = val;
2709 	s->dac_sub_index = 0;
2710 	s->dac_state = 0;
2711 	break;
2712     case 0x3c9:
2713         cirrus_vga_write_palette(c, val);
2714         break;
2715     case 0x3ce:
2716 	s->gr_index = val;
2717 	break;
2718     case 0x3cf:
2719 #ifdef DEBUG_VGA_REG
2720 	printf("vga: write GR%x = 0x%02" PRIu64 "\n", s->gr_index, val);
2721 #endif
2722 	cirrus_vga_write_gr(c, s->gr_index, val);
2723 	break;
2724     case 0x3b4:
2725     case 0x3d4:
2726 	s->cr_index = val;
2727 	break;
2728     case 0x3b5:
2729     case 0x3d5:
2730 #ifdef DEBUG_VGA_REG
2731 	printf("vga: write CR%x = 0x%02"PRIu64"\n", s->cr_index, val);
2732 #endif
2733 	cirrus_vga_write_cr(c, val);
2734 	break;
2735     case 0x3ba:
2736     case 0x3da:
2737 	s->fcr = val & 0x10;
2738 	break;
2739     }
2740 }
2741 
2742 /***************************************
2743  *
2744  *  memory-mapped I/O access
2745  *
2746  ***************************************/
2747 
2748 static uint64_t cirrus_mmio_read(void *opaque, hwaddr addr,
2749                                  unsigned size)
2750 {
2751     CirrusVGAState *s = opaque;
2752 
2753     if (addr >= 0x100) {
2754         return cirrus_mmio_blt_read(s, addr - 0x100);
2755     } else {
2756         return cirrus_vga_ioport_read(s, addr + 0x10, size);
2757     }
2758 }
2759 
2760 static void cirrus_mmio_write(void *opaque, hwaddr addr,
2761                               uint64_t val, unsigned size)
2762 {
2763     CirrusVGAState *s = opaque;
2764 
2765     if (addr >= 0x100) {
2766 	cirrus_mmio_blt_write(s, addr - 0x100, val);
2767     } else {
2768         cirrus_vga_ioport_write(s, addr + 0x10, val, size);
2769     }
2770 }
2771 
2772 static const MemoryRegionOps cirrus_mmio_io_ops = {
2773     .read = cirrus_mmio_read,
2774     .write = cirrus_mmio_write,
2775     .endianness = DEVICE_LITTLE_ENDIAN,
2776     .impl = {
2777         .min_access_size = 1,
2778         .max_access_size = 1,
2779     },
2780 };
2781 
2782 /* load/save state */
2783 
2784 static int cirrus_post_load(void *opaque, int version_id)
2785 {
2786     CirrusVGAState *s = opaque;
2787 
2788     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2789     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2790 
2791     cirrus_update_memory_access(s);
2792     /* force refresh */
2793     s->vga.graphic_mode = -1;
2794     cirrus_update_bank_ptr(s, 0);
2795     cirrus_update_bank_ptr(s, 1);
2796     return 0;
2797 }
2798 
2799 static const VMStateDescription vmstate_cirrus_vga = {
2800     .name = "cirrus_vga",
2801     .version_id = 2,
2802     .minimum_version_id = 1,
2803     .post_load = cirrus_post_load,
2804     .fields = (VMStateField[]) {
2805         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2806         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2807         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2808         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2809         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2810         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2811         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2812         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2813         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2814         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2815         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2816         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
2817         VMSTATE_UINT8(vga.msr, CirrusVGAState),
2818         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
2819         VMSTATE_UINT8(vga.st00, CirrusVGAState),
2820         VMSTATE_UINT8(vga.st01, CirrusVGAState),
2821         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
2822         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
2823         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
2824         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
2825         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
2826         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
2827         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
2828         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
2829         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
2830         VMSTATE_UINT32(vga.hw_cursor_x, CirrusVGAState),
2831         VMSTATE_UINT32(vga.hw_cursor_y, CirrusVGAState),
2832         /* XXX: we do not save the bitblt state - we assume we do not save
2833            the state when the blitter is active */
2834         VMSTATE_END_OF_LIST()
2835     }
2836 };
2837 
2838 static const VMStateDescription vmstate_pci_cirrus_vga = {
2839     .name = "cirrus_vga",
2840     .version_id = 2,
2841     .minimum_version_id = 2,
2842     .fields = (VMStateField[]) {
2843         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
2844         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
2845                        vmstate_cirrus_vga, CirrusVGAState),
2846         VMSTATE_END_OF_LIST()
2847     }
2848 };
2849 
2850 /***************************************
2851  *
2852  *  initialize
2853  *
2854  ***************************************/
2855 
2856 static void cirrus_reset(void *opaque)
2857 {
2858     CirrusVGAState *s = opaque;
2859 
2860     vga_common_reset(&s->vga);
2861     unmap_linear_vram(s);
2862     s->vga.sr[0x06] = 0x0f;
2863     if (s->device_id == CIRRUS_ID_CLGD5446) {
2864         /* 4MB 64 bit memory config, always PCI */
2865         s->vga.sr[0x1F] = 0x2d;		// MemClock
2866         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
2867         s->vga.sr[0x0f] = 0x98;
2868         s->vga.sr[0x17] = 0x20;
2869         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
2870     } else {
2871         s->vga.sr[0x1F] = 0x22;		// MemClock
2872         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
2873         s->vga.sr[0x17] = s->bustype;
2874         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
2875     }
2876     s->vga.cr[0x27] = s->device_id;
2877 
2878     s->cirrus_hidden_dac_lockindex = 5;
2879     s->cirrus_hidden_dac_data = 0;
2880 }
2881 
2882 static const MemoryRegionOps cirrus_linear_io_ops = {
2883     .read = cirrus_linear_read,
2884     .write = cirrus_linear_write,
2885     .endianness = DEVICE_LITTLE_ENDIAN,
2886     .impl = {
2887         .min_access_size = 1,
2888         .max_access_size = 1,
2889     },
2890 };
2891 
2892 static const MemoryRegionOps cirrus_vga_io_ops = {
2893     .read = cirrus_vga_ioport_read,
2894     .write = cirrus_vga_ioport_write,
2895     .endianness = DEVICE_LITTLE_ENDIAN,
2896     .impl = {
2897         .min_access_size = 1,
2898         .max_access_size = 1,
2899     },
2900 };
2901 
2902 static void cirrus_init_common(CirrusVGAState *s, Object *owner,
2903                                int device_id, int is_pci,
2904                                MemoryRegion *system_memory,
2905                                MemoryRegion *system_io)
2906 {
2907     int i;
2908     static int inited;
2909 
2910     if (!inited) {
2911         inited = 1;
2912         for(i = 0;i < 256; i++)
2913             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
2914         rop_to_index[CIRRUS_ROP_0] = 0;
2915         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
2916         rop_to_index[CIRRUS_ROP_NOP] = 2;
2917         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
2918         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
2919         rop_to_index[CIRRUS_ROP_SRC] = 5;
2920         rop_to_index[CIRRUS_ROP_1] = 6;
2921         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
2922         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
2923         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
2924         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
2925         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
2926         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
2927         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
2928         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
2929         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
2930         s->device_id = device_id;
2931         if (is_pci)
2932             s->bustype = CIRRUS_BUSTYPE_PCI;
2933         else
2934             s->bustype = CIRRUS_BUSTYPE_ISA;
2935     }
2936 
2937     /* Register ioport 0x3b0 - 0x3df */
2938     memory_region_init_io(&s->cirrus_vga_io, owner, &cirrus_vga_io_ops, s,
2939                           "cirrus-io", 0x30);
2940     memory_region_set_flush_coalesced(&s->cirrus_vga_io);
2941     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
2942 
2943     memory_region_init(&s->low_mem_container, owner,
2944                        "cirrus-lowmem-container",
2945                        0x20000);
2946 
2947     memory_region_init_io(&s->low_mem, owner, &cirrus_vga_mem_ops, s,
2948                           "cirrus-low-memory", 0x20000);
2949     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
2950     for (i = 0; i < 2; ++i) {
2951         static const char *names[] = { "vga.bank0", "vga.bank1" };
2952         MemoryRegion *bank = &s->cirrus_bank[i];
2953         memory_region_init_alias(bank, owner, names[i], &s->vga.vram,
2954                                  0, 0x8000);
2955         memory_region_set_enabled(bank, false);
2956         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
2957                                             bank, 1);
2958     }
2959     memory_region_add_subregion_overlap(system_memory,
2960                                         0x000a0000,
2961                                         &s->low_mem_container,
2962                                         1);
2963     memory_region_set_coalescing(&s->low_mem);
2964 
2965     /* I/O handler for LFB */
2966     memory_region_init_io(&s->cirrus_linear_io, owner, &cirrus_linear_io_ops, s,
2967                           "cirrus-linear-io", s->vga.vram_size_mb
2968                                               * 1024 * 1024);
2969     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
2970 
2971     /* I/O handler for LFB */
2972     memory_region_init_io(&s->cirrus_linear_bitblt_io, owner,
2973                           &cirrus_linear_bitblt_io_ops,
2974                           s,
2975                           "cirrus-bitblt-mmio",
2976                           0x400000);
2977     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
2978 
2979     /* I/O handler for memory-mapped I/O */
2980     memory_region_init_io(&s->cirrus_mmio_io, owner, &cirrus_mmio_io_ops, s,
2981                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
2982     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
2983 
2984     s->real_vram_size =
2985         (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;
2986 
2987     /* XXX: s->vga.vram_size must be a power of two */
2988     s->cirrus_addr_mask = s->real_vram_size - 1;
2989     s->linear_mmio_mask = s->real_vram_size - 256;
2990 
2991     s->vga.get_bpp = cirrus_get_bpp;
2992     s->vga.get_offsets = cirrus_get_offsets;
2993     s->vga.get_resolution = cirrus_get_resolution;
2994     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
2995     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
2996 
2997     qemu_register_reset(cirrus_reset, s);
2998 }
2999 
3000 /***************************************
3001  *
3002  *  ISA bus support
3003  *
3004  ***************************************/
3005 
3006 static void isa_cirrus_vga_realizefn(DeviceState *dev, Error **errp)
3007 {
3008     ISADevice *isadev = ISA_DEVICE(dev);
3009     ISACirrusVGAState *d = ISA_CIRRUS_VGA(dev);
3010     VGACommonState *s = &d->cirrus_vga.vga;
3011 
3012     /* follow real hardware, cirrus card emulated has 4 MB video memory.
3013        Also accept 8 MB/16 MB for backward compatibility. */
3014     if (s->vram_size_mb != 4 && s->vram_size_mb != 8 &&
3015         s->vram_size_mb != 16) {
3016         error_setg(errp, "Invalid cirrus_vga ram size '%u'",
3017                    s->vram_size_mb);
3018         return;
3019     }
3020     vga_common_init(s, OBJECT(dev), true);
3021     cirrus_init_common(&d->cirrus_vga, OBJECT(dev), CIRRUS_ID_CLGD5430, 0,
3022                        isa_address_space(isadev),
3023                        isa_address_space_io(isadev));
3024     s->con = graphic_console_init(dev, 0, s->hw_ops, s);
3025     rom_add_vga(VGABIOS_CIRRUS_FILENAME);
3026     /* XXX ISA-LFB support */
3027     /* FIXME not qdev yet */
3028 }
3029 
3030 static Property isa_cirrus_vga_properties[] = {
3031     DEFINE_PROP_UINT32("vgamem_mb", struct ISACirrusVGAState,
3032                        cirrus_vga.vga.vram_size_mb, 8),
3033     DEFINE_PROP_END_OF_LIST(),
3034 };
3035 
3036 static void isa_cirrus_vga_class_init(ObjectClass *klass, void *data)
3037 {
3038     DeviceClass *dc = DEVICE_CLASS(klass);
3039 
3040     dc->vmsd  = &vmstate_cirrus_vga;
3041     dc->realize = isa_cirrus_vga_realizefn;
3042     dc->props = isa_cirrus_vga_properties;
3043     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3044 }
3045 
3046 static const TypeInfo isa_cirrus_vga_info = {
3047     .name          = TYPE_ISA_CIRRUS_VGA,
3048     .parent        = TYPE_ISA_DEVICE,
3049     .instance_size = sizeof(ISACirrusVGAState),
3050     .class_init = isa_cirrus_vga_class_init,
3051 };
3052 
3053 /***************************************
3054  *
3055  *  PCI bus support
3056  *
3057  ***************************************/
3058 
3059 static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
3060 {
3061      PCICirrusVGAState *d = PCI_CIRRUS_VGA(dev);
3062      CirrusVGAState *s = &d->cirrus_vga;
3063      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
3064      int16_t device_id = pc->device_id;
3065 
3066      /* follow real hardware, cirrus card emulated has 4 MB video memory.
3067        Also accept 8 MB/16 MB for backward compatibility. */
3068      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
3069          s->vga.vram_size_mb != 16) {
3070          error_setg(errp, "Invalid cirrus_vga ram size '%u'",
3071                     s->vga.vram_size_mb);
3072          return;
3073      }
3074      /* setup VGA */
3075      vga_common_init(&s->vga, OBJECT(dev), true);
3076      cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
3077                         pci_address_space_io(dev));
3078      s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);
3079 
3080      /* setup PCI */
3081 
3082     memory_region_init(&s->pci_bar, OBJECT(dev), "cirrus-pci-bar0", 0x2000000);
3083 
3084     /* XXX: add byte swapping apertures */
3085     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
3086     memory_region_add_subregion(&s->pci_bar, 0x1000000,
3087                                 &s->cirrus_linear_bitblt_io);
3088 
3089      /* setup memory space */
3090      /* memory #0 LFB */
3091      /* memory #1 memory-mapped I/O */
3092      /* XXX: s->vga.vram_size must be a power of two */
3093      pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);
3094      if (device_id == CIRRUS_ID_CLGD5446) {
3095          pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
3096      }
3097 }
3098 
3099 static Property pci_vga_cirrus_properties[] = {
3100     DEFINE_PROP_UINT32("vgamem_mb", struct PCICirrusVGAState,
3101                        cirrus_vga.vga.vram_size_mb, 8),
3102     DEFINE_PROP_END_OF_LIST(),
3103 };
3104 
3105 static void cirrus_vga_class_init(ObjectClass *klass, void *data)
3106 {
3107     DeviceClass *dc = DEVICE_CLASS(klass);
3108     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
3109 
3110     k->realize = pci_cirrus_vga_realize;
3111     k->romfile = VGABIOS_CIRRUS_FILENAME;
3112     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
3113     k->device_id = CIRRUS_ID_CLGD5446;
3114     k->class_id = PCI_CLASS_DISPLAY_VGA;
3115     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3116     dc->desc = "Cirrus CLGD 54xx VGA";
3117     dc->vmsd = &vmstate_pci_cirrus_vga;
3118     dc->props = pci_vga_cirrus_properties;
3119     dc->hotpluggable = false;
3120 }
3121 
3122 static const TypeInfo cirrus_vga_info = {
3123     .name          = TYPE_PCI_CIRRUS_VGA,
3124     .parent        = TYPE_PCI_DEVICE,
3125     .instance_size = sizeof(PCICirrusVGAState),
3126     .class_init    = cirrus_vga_class_init,
3127 };
3128 
3129 static void cirrus_vga_register_types(void)
3130 {
3131     type_register_static(&isa_cirrus_vga_info);
3132     type_register_static(&cirrus_vga_info);
3133 }
3134 
3135 type_init(cirrus_vga_register_types)
3136